122 files changed, 2802 insertions, 988 deletions
diff --git a/include/linux/bcma/bcma.h b/include/linux/bcma/bcma.h
index 8deaf6d050c3..1954a4e305a3 100644
--- a/include/linux/bcma/bcma.h
+++ b/include/linux/bcma/bcma.h
@@ -7,6 +7,7 @@
 #include <linux/bcma/bcma_driver_chipcommon.h>
 #include <linux/bcma/bcma_driver_pci.h>
 #include <linux/bcma/bcma_driver_mips.h>
+#include <linux/bcma/bcma_driver_gmac_cmn.h>
 #include <linux/ssb/ssb.h> /* SPROM sharing */
 #include "bcma_regs.h"
@@ -70,6 +71,13 @@ struct bcma_host_ops {
 /* Core-ID values. */
 #define BCMA_CORE_OOB_ROUTER            0x367   /* Out of band */
+#define BCMA_CORE_4706_CHIPCOMMON       0x500
+#define BCMA_CORE_4706_SOC_RAM          0x50E
+#define BCMA_CORE_4706_MAC_GBIT         0x52D
+#define BCMA_CORE_AMEMC                 0x52E   /* DDR1/2 memory controller core */
+#define BCMA_CORE_ALTA                  0x534   /* I2S core */
+#define BCMA_CORE_4706_MAC_GBIT_COMMON  0x5DC
+#define BCMA_CORE_DDR23_PHY             0x5DD
 #define BCMA_CORE_INVALID               0x700
 #define BCMA_CORE_CHIPCOMMON            0x800
 #define BCMA_CORE_ILINE20               0x801
@@ -130,6 +138,36 @@ struct bcma_host_ops {
 #define BCMA_MAX_NR_CORES               16
+/* Chip IDs of PCIe devices */
+#define BCMA_CHIP_ID_BCM4313    0x4313
+#define BCMA_CHIP_ID_BCM43224   43224
+#define  BCMA_PKG_ID_BCM43224_FAB_CSM   0x8
+#define  BCMA_PKG_ID_BCM43224_FAB_SMIC  0xa
+#define BCMA_CHIP_ID_BCM43225   43225
+#define BCMA_CHIP_ID_BCM43227   43227
+#define BCMA_CHIP_ID_BCM43228   43228
+#define BCMA_CHIP_ID_BCM43421   43421
+#define BCMA_CHIP_ID_BCM43428   43428
+#define BCMA_CHIP_ID_BCM43431   43431
+#define BCMA_CHIP_ID_BCM43460   43460
+#define BCMA_CHIP_ID_BCM4331    0x4331
+#define BCMA_CHIP_ID_BCM6362    0x6362
+#define BCMA_CHIP_ID_BCM4360    0x4360
+#define BCMA_CHIP_ID_BCM4352    0x4352
+/* Chip IDs of SoCs */
+#define BCMA_CHIP_ID_BCM4706    0x5300
+#define BCMA_CHIP_ID_BCM4716    0x4716
+#define  BCMA_PKG_ID_BCM4716    8
+#define  BCMA_PKG_ID_BCM4717    9
+#define  BCMA_PKG_ID_BCM4718    10
+#define BCMA_CHIP_ID_BCM47162   47162
+#define BCMA_CHIP_ID_BCM4748    0x4748
+#define BCMA_CHIP_ID_BCM4749    0x4749
+#define BCMA_CHIP_ID_BCM5356    0x5356
+#define BCMA_CHIP_ID_BCM5357    0x5357
+#define BCMA_CHIP_ID_BCM53572   53572
 struct bcma_device {
        struct bcma_bus *bus;
        struct bcma_device_id id;
@@ -215,6 +253,7 @@ struct bcma_bus {
        struct bcma_drv_cc drv_cc;
        struct bcma_drv_pci drv_pci;
        struct bcma_drv_mips drv_mips;
+        struct bcma_drv_gmac_cmn drv_gmac_cmn;
        /* We decided to share SPROM struct with SSB as long as we do not need
         * any hacks for BCMA. This simplifies drivers code. */
diff --git a/include/linux/bcma/bcma_driver_chipcommon.h b/include/linux/bcma/bcma_driver_chipcommon.h
index 8bbfe31fbac8..3c80885fa829 100644
--- a/include/linux/bcma/bcma_driver_chipcommon.h
+++ b/include/linux/bcma/bcma_driver_chipcommon.h
@@ -24,7 +24,7 @@
 #define   BCMA_CC_FLASHT_NONE           0x00000000      /* No flash */
 #define   BCMA_CC_FLASHT_STSER          0x00000100      /* ST serial flash */
 #define   BCMA_CC_FLASHT_ATSER          0x00000200      /* Atmel serial flash */
-#define   BCMA_CC_FLASHT_NFLASH         0x00000200
+#define   BCMA_CC_FLASHT_NFLASH         0x00000200      /* NAND flash */
 #define   BCMA_CC_FLASHT_PARA           0x00000700      /* Parallel flash */
 #define  BCMA_CC_CAP_PLLT               0x00038000      /* PLL Type */
 #define   BCMA_PLLTYPE_NONE             0x00000000
@@ -45,6 +45,7 @@
 #define  BCMA_CC_CAP_PMU                0x10000000      /* PMU available (rev >= 20) */
 #define  BCMA_CC_CAP_ECI                0x20000000      /* ECI available (rev >= 20) */
 #define  BCMA_CC_CAP_SPROM              0x40000000      /* SPROM present */
+#define  BCMA_CC_CAP_NFLASH             0x80000000      /* NAND flash present (rev >= 35 or BCM4706?) */
 #define BCMA_CC_CORECTL                 0x0008
 #define  BCMA_CC_CORECTL_UARTCLK0       0x00000001      /* Drive UART with internal clock */
 #define  BCMA_CC_CORECTL_SE             0x00000002      /* sync clk out enable (corerev >= 3) */
@@ -88,6 +89,11 @@
 #define  BCMA_CC_CHIPST_4313_OTP_PRESENT        2
 #define  BCMA_CC_CHIPST_4331_SPROM_PRESENT      2
 #define  BCMA_CC_CHIPST_4331_OTP_PRESENT        4
+#define  BCMA_CC_CHIPST_4706_PKG_OPTION         BIT(0) /* 0: full-featured package 1: low-cost package */
+#define  BCMA_CC_CHIPST_4706_SFLASH_PRESENT     BIT(1) /* 0: parallel, 1: serial flash is present */
+#define  BCMA_CC_CHIPST_4706_SFLASH_TYPE        BIT(2) /* 0: 8b-p/ST-s flash, 1: 16b-p/Atmal-s flash */
+#define  BCMA_CC_CHIPST_4706_MIPS_BENDIAN       BIT(3) /* 0: little, 1: big endian */
+#define  BCMA_CC_CHIPST_4706_PCIE1_DISABLE      BIT(5) /* PCIE1 enable strap pin */
 #define BCMA_CC_JCMD                    0x0030          /* Rev >= 10 only */
 #define  BCMA_CC_JCMD_START             0x80000000
 #define  BCMA_CC_JCMD_BUSY              0x80000000
@@ -117,10 +123,58 @@
 #define  BCMA_CC_JCTL_EXT_EN            2               /* Enable external targets */
 #define  BCMA_CC_JCTL_EN                1               /* Enable Jtag master */
 #define BCMA_CC_FLASHCTL                0x0040
+/* Start/busy bit in flashcontrol */
+#define  BCMA_CC_FLASHCTL_OPCODE        0x000000ff
+#define  BCMA_CC_FLASHCTL_ACTION        0x00000700
+#define  BCMA_CC_FLASHCTL_CS_ACTIVE     0x00001000      /* Chip Select Active, rev >= 20 */
 #define  BCMA_CC_FLASHCTL_START         0x80000000
 #define  BCMA_CC_FLASHCTL_BUSY          BCMA_CC_FLASHCTL_START
+/* Flashcontrol action + opcodes for ST flashes */
+#define  BCMA_CC_FLASHCTL_ST_WREN       0x0006          /* Write Enable */
+#define  BCMA_CC_FLASHCTL_ST_WRDIS      0x0004          /* Write Disable */
+#define  BCMA_CC_FLASHCTL_ST_RDSR       0x0105          /* Read Status Register */
+#define  BCMA_CC_FLASHCTL_ST_WRSR       0x0101          /* Write Status Register */
+#define  BCMA_CC_FLASHCTL_ST_READ       0x0303          /* Read Data Bytes */
+#define  BCMA_CC_FLASHCTL_ST_PP         0x0302          /* Page Program */
+#define  BCMA_CC_FLASHCTL_ST_SE         0x02d8          /* Sector Erase */
+#define  BCMA_CC_FLASHCTL_ST_BE         0x00c7          /* Bulk Erase */
+#define  BCMA_CC_FLASHCTL_ST_DP         0x00b9          /* Deep Power-down */
+#define  BCMA_CC_FLASHCTL_ST_RES        0x03ab          /* Read Electronic Signature */
+#define  BCMA_CC_FLASHCTL_ST_CSA        0x1000          /* Keep chip select asserted */
+#define  BCMA_CC_FLASHCTL_ST_SSE        0x0220          /* Sub-sector Erase */
+/* Flashcontrol action + opcodes for Atmel flashes */
+#define  BCMA_CC_FLASHCTL_AT_READ                       0x07e8
+#define  BCMA_CC_FLASHCTL_AT_PAGE_READ                  0x07d2
+#define  BCMA_CC_FLASHCTL_AT_STATUS                     0x01d7
+#define  BCMA_CC_FLASHCTL_AT_BUF1_WRITE                 0x0384
+#define  BCMA_CC_FLASHCTL_AT_BUF2_WRITE                 0x0387
+#define  BCMA_CC_FLASHCTL_AT_BUF1_ERASE_PROGRAM         0x0283
+#define  BCMA_CC_FLASHCTL_AT_BUF2_ERASE_PROGRAM         0x0286
+#define  BCMA_CC_FLASHCTL_AT_BUF1_PROGRAM               0x0288
+#define  BCMA_CC_FLASHCTL_AT_BUF2_PROGRAM               0x0289
+#define  BCMA_CC_FLASHCTL_AT_PAGE_ERASE                 0x0281
+#define  BCMA_CC_FLASHCTL_AT_BLOCK_ERASE                0x0250
+#define  BCMA_CC_FLASHCTL_AT_BUF1_WRITE_ERASE_PROGRAM   0x0382
+#define  BCMA_CC_FLASHCTL_AT_BUF2_WRITE_ERASE_PROGRAM   0x0385
+#define  BCMA_CC_FLASHCTL_AT_BUF1_LOAD                  0x0253
+#define  BCMA_CC_FLASHCTL_AT_BUF2_LOAD                  0x0255
+#define  BCMA_CC_FLASHCTL_AT_BUF1_COMPARE               0x0260
+#define  BCMA_CC_FLASHCTL_AT_BUF2_COMPARE               0x0261
+#define  BCMA_CC_FLASHCTL_AT_BUF1_REPROGRAM             0x0258
+#define  BCMA_CC_FLASHCTL_AT_BUF2_REPROGRAM             0x0259
 #define BCMA_CC_FLASHADDR               0x0044
 #define BCMA_CC_FLASHDATA               0x0048
+/* Status register bits for ST flashes */
+#define  BCMA_CC_FLASHDATA_ST_WIP       0x01            /* Write In Progress */
+#define  BCMA_CC_FLASHDATA_ST_WEL       0x02            /* Write Enable Latch */
+#define  BCMA_CC_FLASHDATA_ST_BP_MASK   0x1c            /* Block Protect */
+#define  BCMA_CC_FLASHDATA_ST_BP_SHIFT  2
+#define  BCMA_CC_FLASHDATA_ST_SRWD      0x80            /* Status Register Write Disable */
+/* Status register bits for Atmel flashes */
+#define  BCMA_CC_FLASHDATA_AT_READY     0x80
+#define  BCMA_CC_FLASHDATA_AT_MISMATCH  0x40
+#define  BCMA_CC_FLASHDATA_AT_ID_MASK   0x38
+#define  BCMA_CC_FLASHDATA_AT_ID_SHIFT  3
 #define BCMA_CC_BCAST_ADDR              0x0050
 #define BCMA_CC_BCAST_DATA              0x0054
 #define BCMA_CC_GPIOPULLUP              0x0058          /* Rev >= 20 only */
@@ -280,6 +334,15 @@
 /* 4706 PMU */
 #define BCMA_CC_PMU4706_MAINPLL_PLL0    0
+#define BCMA_CC_PMU6_4706_PROCPLL_OFF   4       /* The CPU PLL */
+#define  BCMA_CC_PMU6_4706_PROC_P2DIV_MASK      0x000f0000
+#define  BCMA_CC_PMU6_4706_PROC_P2DIV_SHIFT     16
+#define  BCMA_CC_PMU6_4706_PROC_P1DIV_MASK      0x0000f000
+#define  BCMA_CC_PMU6_4706_PROC_P1DIV_SHIFT     12
+#define  BCMA_CC_PMU6_4706_PROC_NDIV_INT_MASK   0x00000ff8
+#define  BCMA_CC_PMU6_4706_PROC_NDIV_INT_SHIFT  3
+#define  BCMA_CC_PMU6_4706_PROC_NDIV_MODE_MASK  0x00000007
+#define  BCMA_CC_PMU6_4706_PROC_NDIV_MODE_SHIFT 0
 /* ALP clock on pre-PMU chips */
 #define BCMA_CC_PMU_ALP_CLOCK           20000000
@@ -308,6 +371,19 @@
 #define BCMA_CC_PPL_PCHI_OFF            5
 #define BCMA_CC_PPL_PCHI_MASK           0x0000003f
+#define BCMA_CC_PMU_PLL_CTL0            0
+#define BCMA_CC_PMU_PLL_CTL1            1
+#define BCMA_CC_PMU_PLL_CTL2            2
+#define BCMA_CC_PMU_PLL_CTL3            3
+#define BCMA_CC_PMU_PLL_CTL4            4
+#define BCMA_CC_PMU_PLL_CTL5            5
+#define BCMA_CC_PMU1_PLL0_PC0_P1DIV_MASK        0x00f00000
+#define BCMA_CC_PMU1_PLL0_PC0_P1DIV_SHIFT       20
+#define BCMA_CC_PMU1_PLL0_PC2_NDIV_INT_MASK     0x1ff00000
+#define BCMA_CC_PMU1_PLL0_PC2_NDIV_INT_SHIFT    20
 /* BCM4331 ChipControl numbers. */
 #define BCMA_CHIPCTL_4331_BT_COEXIST            BIT(0)  /* 0 disable */
 #define BCMA_CHIPCTL_4331_SECI                  BIT(1)  /* 0 SECI is disabled (JATG functional) */
@@ -321,9 +397,18 @@
 #define BCMA_CHIPCTL_4331_OVR_PIPEAUXPWRDOWN    BIT(9)  /* override core control on pipe_AuxPowerDown */
 #define BCMA_CHIPCTL_4331_PCIE_AUXCLKEN         BIT(10) /* pcie_auxclkenable */
 #define BCMA_CHIPCTL_4331_PCIE_PIPE_PLLDOWN     BIT(11) /* pcie_pipe_pllpowerdown */
+#define BCMA_CHIPCTL_4331_EXTPA_EN2             BIT(12) /* 0 ext pa disable, 1 ext pa enabled */
 #define BCMA_CHIPCTL_4331_BT_SHD0_ON_GPIO4      BIT(16) /* enable bt_shd0 at gpio4 */
 #define BCMA_CHIPCTL_4331_BT_SHD1_ON_GPIO5      BIT(17) /* enable bt_shd1 at gpio5 */
+/* 43224 chip-specific ChipControl register bits */
+#define BCMA_CCTRL_43224_GPIO_TOGGLE            0x8000          /* gpio[3:0] pins as btcoex or s/w gpio */
+#define BCMA_CCTRL_43224A0_12MA_LED_DRIVE       0x00F000F0      /* 12 mA drive strength */
+#define BCMA_CCTRL_43224B0_12MA_LED_DRIVE       0xF0            /* 12 mA drive strength for later 43224s */
+/* 4313 Chip specific ChipControl register bits */
+#define BCMA_CCTRL_4313_12MA_LED_DRIVE          0x00000007      /* 12 mA drive strengh for later 4313 */
 /* Data for the PMU, if available.
 * Check availability with ((struct bcma_chipcommon)->capabilities & BCMA_CC_CAP_PMU)
 */
@@ -411,5 +496,6 @@ extern void bcma_chipco_chipctl_maskset(struct bcma_drv_cc *cc,
                                        u32 offset, u32 mask, u32 set);
 extern void bcma_chipco_regctl_maskset(struct bcma_drv_cc *cc,
                                       u32 offset, u32 mask, u32 set);
+extern void bcma_pmu_spuravoid_pllupdate(struct bcma_drv_cc *cc, int spuravoid);
 #endif /* LINUX_BCMA_DRIVER_CC_H_ */
diff --git a/include/linux/bcma/bcma_driver_gmac_cmn.h b/include/linux/bcma/bcma_driver_gmac_cmn.h
new file mode 100644
index 000000000000..def894b83b0d
--- /dev/null
+++ b/include/linux/bcma/bcma_driver_gmac_cmn.h
@@ -0,0 +1,100 @@
+#ifndef LINUX_BCMA_DRIVER_GMAC_CMN_H_
+#define LINUX_BCMA_DRIVER_GMAC_CMN_H_
+#include <linux/types.h>
+#define BCMA_GMAC_CMN_STAG0             0x000
+#define BCMA_GMAC_CMN_STAG1             0x004
+#define BCMA_GMAC_CMN_STAG2             0x008
+#define BCMA_GMAC_CMN_STAG3             0x00C
+#define BCMA_GMAC_CMN_PARSER_CTL        0x020
+#define BCMA_GMAC_CMN_MIB_MAX_LEN       0x024
+#define BCMA_GMAC_CMN_PHY_ACCESS        0x100
+#define  BCMA_GMAC_CMN_PA_DATA_MASK     0x0000ffff
+#define  BCMA_GMAC_CMN_PA_ADDR_MASK     0x001f0000
+#define  BCMA_GMAC_CMN_PA_ADDR_SHIFT    16
+#define  BCMA_GMAC_CMN_PA_REG_MASK      0x1f000000
+#define  BCMA_GMAC_CMN_PA_REG_SHIFT     24
+#define  BCMA_GMAC_CMN_PA_WRITE         0x20000000
+#define  BCMA_GMAC_CMN_PA_START         0x40000000
+#define BCMA_GMAC_CMN_PHY_CTL           0x104
+#define  BCMA_GMAC_CMN_PC_EPA_MASK      0x0000001f
+#define  BCMA_GMAC_CMN_PC_MCT_MASK      0x007f0000
+#define  BCMA_GMAC_CMN_PC_MCT_SHIFT     16
+#define  BCMA_GMAC_CMN_PC_MTE           0x00800000
+#define BCMA_GMAC_CMN_GMAC0_RGMII_CTL   0x110
+#define BCMA_GMAC_CMN_CFP_ACCESS        0x200
+#define BCMA_GMAC_CMN_CFP_TCAM_DATA0    0x210
+#define BCMA_GMAC_CMN_CFP_TCAM_DATA1    0x214
+#define BCMA_GMAC_CMN_CFP_TCAM_DATA2    0x218
+#define BCMA_GMAC_CMN_CFP_TCAM_DATA3    0x21C
+#define BCMA_GMAC_CMN_CFP_TCAM_DATA4    0x220
+#define BCMA_GMAC_CMN_CFP_TCAM_DATA5    0x224
+#define BCMA_GMAC_CMN_CFP_TCAM_DATA6    0x228
+#define BCMA_GMAC_CMN_CFP_TCAM_DATA7    0x22C
+#define BCMA_GMAC_CMN_CFP_TCAM_MASK0    0x230
+#define BCMA_GMAC_CMN_CFP_TCAM_MASK1    0x234
+#define BCMA_GMAC_CMN_CFP_TCAM_MASK2    0x238
+#define BCMA_GMAC_CMN_CFP_TCAM_MASK3    0x23C
+#define BCMA_GMAC_CMN_CFP_TCAM_MASK4    0x240
+#define BCMA_GMAC_CMN_CFP_TCAM_MASK5    0x244
+#define BCMA_GMAC_CMN_CFP_TCAM_MASK6    0x248
+#define BCMA_GMAC_CMN_CFP_TCAM_MASK7    0x24C
+#define BCMA_GMAC_CMN_CFP_ACTION_DATA   0x250
+#define BCMA_GMAC_CMN_TCAM_BIST_CTL     0x2A0
+#define BCMA_GMAC_CMN_TCAM_BIST_STATUS  0x2A4
+#define BCMA_GMAC_CMN_TCAM_CMP_STATUS   0x2A8
+#define BCMA_GMAC_CMN_TCAM_DISABLE      0x2AC
+#define BCMA_GMAC_CMN_TCAM_TEST_CTL     0x2F0
+#define BCMA_GMAC_CMN_UDF_0_A3_A0       0x300
+#define BCMA_GMAC_CMN_UDF_0_A7_A4       0x304
+#define BCMA_GMAC_CMN_UDF_0_A8          0x308
+#define BCMA_GMAC_CMN_UDF_1_A3_A0       0x310
+#define BCMA_GMAC_CMN_UDF_1_A7_A4       0x314
+#define BCMA_GMAC_CMN_UDF_1_A8          0x318
+#define BCMA_GMAC_CMN_UDF_2_A3_A0       0x320
+#define BCMA_GMAC_CMN_UDF_2_A7_A4       0x324
+#define BCMA_GMAC_CMN_UDF_2_A8          0x328
+#define BCMA_GMAC_CMN_UDF_0_B3_B0       0x330
+#define BCMA_GMAC_CMN_UDF_0_B7_B4       0x334
+#define BCMA_GMAC_CMN_UDF_0_B8          0x338
+#define BCMA_GMAC_CMN_UDF_1_B3_B0       0x340
+#define BCMA_GMAC_CMN_UDF_1_B7_B4       0x344
+#define BCMA_GMAC_CMN_UDF_1_B8          0x348
+#define BCMA_GMAC_CMN_UDF_2_B3_B0       0x350
+#define BCMA_GMAC_CMN_UDF_2_B7_B4       0x354
+#define BCMA_GMAC_CMN_UDF_2_B8          0x358
+#define BCMA_GMAC_CMN_UDF_0_C3_C0       0x360
+#define BCMA_GMAC_CMN_UDF_0_C7_C4       0x364
+#define BCMA_GMAC_CMN_UDF_0_C8          0x368
+#define BCMA_GMAC_CMN_UDF_1_C3_C0       0x370
+#define BCMA_GMAC_CMN_UDF_1_C7_C4       0x374
+#define BCMA_GMAC_CMN_UDF_1_C8          0x378
+#define BCMA_GMAC_CMN_UDF_2_C3_C0       0x380
+#define BCMA_GMAC_CMN_UDF_2_C7_C4       0x384
+#define BCMA_GMAC_CMN_UDF_2_C8          0x388
+#define BCMA_GMAC_CMN_UDF_0_D3_D0       0x390
+#define BCMA_GMAC_CMN_UDF_0_D7_D4       0x394
+#define BCMA_GMAC_CMN_UDF_0_D11_D8      0x394
+struct bcma_drv_gmac_cmn {
+        struct bcma_device *core;
+        /* Drivers accessing BCMA_GMAC_CMN_PHY_ACCESS and
+         * BCMA_GMAC_CMN_PHY_CTL need to take that mutex first. */
+        struct mutex phy_mutex;
+};
+/* Register access */
+#define gmac_cmn_read16(gc, offset)             bcma_read16((gc)->core, offset)
+#define gmac_cmn_read32(gc, offset)             bcma_read32((gc)->core, offset)
+#define gmac_cmn_write16(gc, offset, val)       bcma_write16((gc)->core, offset, val)
+#define gmac_cmn_write32(gc, offset, val)       bcma_write32((gc)->core, offset, val)
+#ifdef CONFIG_BCMA_DRIVER_GMAC_CMN
+extern void __devinit bcma_core_gmac_cmn_init(struct bcma_drv_gmac_cmn *gc);
+#else
+static inline void bcma_core_gmac_cmn_init(struct bcma_drv_gmac_cmn *gc) { }
+#endif
+#endif /* LINUX_BCMA_DRIVER_GMAC_CMN_H_ */
diff --git a/include/linux/can.h b/include/linux/can.h
index 9a19bcb3eeaf..018055efc034 100644
--- a/include/linux/can.h
+++ b/include/linux/can.h
@@ -21,7 +21,7 @@
 /* special address description flags for the CAN_ID */
 #define CAN_EFF_FLAG 0x80000000U /* EFF/SFF is set in the MSB */
 #define CAN_RTR_FLAG 0x40000000U /* remote transmission request */
-#define CAN_ERR_FLAG 0x20000000U /* error frame */
+#define CAN_ERR_FLAG 0x20000000U /* error message frame */
 /* valid bits in CAN ID for frame formats */
 #define CAN_SFF_MASK 0x000007FFU /* standard frame format (SFF) */
@@ -32,32 +32,84 @@
 * Controller Area Network Identifier structure
 *
 * bit 0-28     : CAN identifier (11/29 bit)
- * bit 29       : error frame flag (0 = data frame, 1 = error frame)
+ * bit 29       : error message frame flag (0 = data frame, 1 = error message)
 * bit 30       : remote transmission request flag (1 = rtr frame)
 * bit 31       : frame format flag (0 = standard 11 bit, 1 = extended 29 bit)
 */
 typedef __u32 canid_t;
+#define CAN_SFF_ID_BITS         11
+#define CAN_EFF_ID_BITS         29
 /*
- * Controller Area Network Error Frame Mask structure
+ * Controller Area Network Error Message Frame Mask structure
 *
 * bit 0-28     : error class mask (see include/linux/can/error.h)
 * bit 29-31    : set to zero
 */
 typedef __u32 can_err_mask_t;
+/* CAN payload length and DLC definitions according to ISO 11898-1 */
+#define CAN_MAX_DLC 8
+#define CAN_MAX_DLEN 8
+/* CAN FD payload length and DLC definitions according to ISO 11898-7 */
+#define CANFD_MAX_DLC 15
+#define CANFD_MAX_DLEN 64
 /**
 * struct can_frame - basic CAN frame structure
- * @can_id:  the CAN ID of the frame and CAN_*_FLAG flags, see above.
+ * @can_id:  CAN ID of the frame and CAN_*_FLAG flags, see canid_t definition
- * @can_dlc: the data length field of the CAN frame
+ * @can_dlc: frame payload length in byte (0 .. 8) aka data length code
- * @data:    the CAN frame payload.
+ *           N.B. the DLC field from ISO 11898-1 Chapter 8.4.2.3 has a 1:1
+ *           mapping of the 'data length code' to the real payload length
+ * @data:    CAN frame payload (up to 8 byte)
 */
 struct can_frame {
        canid_t can_id;  /* 32 bit CAN_ID + EFF/RTR/ERR flags */
-        __u8    can_dlc; /* data length code: 0 .. 8 */
+        __u8    can_dlc; /* frame payload length in byte (0 .. CAN_MAX_DLEN) */
-        __u8    data[8] __attribute__((aligned(8)));
+        __u8    data[CAN_MAX_DLEN] __attribute__((aligned(8)));
+};
+/*
+ * defined bits for canfd_frame.flags
+ *
+ * As the default for CAN FD should be to support the high data rate in the
+ * payload section of the frame (HDR) and to support up to 64 byte in the
+ * data section (EDL) the bits are only set in the non-default case.
+ * Btw. as long as there's no real implementation for CAN FD network driver
+ * these bits are only preliminary.
+ *
+ * RX: NOHDR/NOEDL - info about received CAN FD frame
+ *     ESI         - bit from originating CAN controller
+ * TX: NOHDR/NOEDL - control per-frame settings if supported by CAN controller
+ *     ESI         - bit is set by local CAN controller
+ */
+#define CANFD_NOHDR 0x01 /* frame without high data rate */
+#define CANFD_NOEDL 0x02 /* frame without extended data length */
+#define CANFD_ESI   0x04 /* error state indicator */
+/**
+ * struct canfd_frame - CAN flexible data rate frame structure
+ * @can_id: CAN ID of the frame and CAN_*_FLAG flags, see canid_t definition
+ * @len:    frame payload length in byte (0 .. CANFD_MAX_DLEN)
+ * @flags:  additional flags for CAN FD
+ * @__res0: reserved / padding
+ * @__res1: reserved / padding
+ * @data:   CAN FD frame payload (up to CANFD_MAX_DLEN byte)
+ */
+struct canfd_frame {
+        canid_t can_id;  /* 32 bit CAN_ID + EFF/RTR/ERR flags */
+        __u8    len;     /* frame payload length in byte */
+        __u8    flags;   /* additional flags for CAN FD */
+        __u8    __res0;  /* reserved / padding */
+        __u8    __res1;  /* reserved / padding */
+        __u8    data[CANFD_MAX_DLEN] __attribute__((aligned(8)));
 };
+#define CAN_MTU         (sizeof(struct can_frame))
+#define CANFD_MTU       (sizeof(struct canfd_frame))
 /* particular protocols of the protocol family PF_CAN */
 #define CAN_RAW         1 /* RAW sockets */
 #define CAN_BCM         2 /* Broadcast Manager */
@@ -97,7 +149,7 @@ struct sockaddr_can {
 *          <received_can_id> & mask == can_id & mask
 *
 * The filter can be inverted (CAN_INV_FILTER bit set in can_id) or it can
- * filter for error frames (CAN_ERR_FLAG bit set in mask).
+ * filter for error message frames (CAN_ERR_FLAG bit set in mask).
 */
 struct can_filter {
        canid_t can_id;
diff --git a/include/linux/can/core.h b/include/linux/can/core.h
index 0ccc1cd28b95..78c6c52073ad 100644
--- a/include/linux/can/core.h
+++ b/include/linux/can/core.h
@@ -17,10 +17,10 @@
 #include <linux/skbuff.h>
 #include <linux/netdevice.h>
-#define CAN_VERSION "20090105"
+#define CAN_VERSION "20120528"
 /* increment this number each time you change some user-space interface */
-#define CAN_ABI_VERSION "8"
+#define CAN_ABI_VERSION "9"
 #define CAN_VERSION_STRING "rev " CAN_VERSION " abi " CAN_ABI_VERSION
diff --git a/include/linux/can/dev.h b/include/linux/can/dev.h
index 5d2efe7e3f1b..2b2fc345afca 100644
--- a/include/linux/can/dev.h
+++ b/include/linux/can/dev.h
@@ -33,7 +33,7 @@ struct can_priv {
        struct can_device_stats can_stats;
        struct can_bittiming bittiming;
-        struct can_bittiming_const *bittiming_const;
+        const struct can_bittiming_const *bittiming_const;
        struct can_clock clock;
        enum can_state state;
@@ -61,23 +61,40 @@ struct can_priv {
 * To be used in the CAN netdriver receive path to ensure conformance with
 * ISO 11898-1 Chapter 8.4.2.3 (DLC field)
 */
-#define get_can_dlc(i)  (min_t(__u8, (i), 8))
+#define get_can_dlc(i)          (min_t(__u8, (i), CAN_MAX_DLC))
+#define get_canfd_dlc(i)        (min_t(__u8, (i), CANFD_MAX_DLC))
 /* Drop a given socketbuffer if it does not contain a valid CAN frame. */
 static inline int can_dropped_invalid_skb(struct net_device *dev,
                                          struct sk_buff *skb)
 {
-        const struct can_frame *cf = (struct can_frame *)skb->data;
+        const struct canfd_frame *cfd = (struct canfd_frame *)skb->data;
-        if (unlikely(skb->len != sizeof(*cf) || cf->can_dlc > 8)) {
+        if (skb->protocol == htons(ETH_P_CAN)) {
-                kfree_skb(skb);
+                if (unlikely(skb->len != CAN_MTU ||
-                dev->stats.tx_dropped++;
+                             cfd->len > CAN_MAX_DLEN))
-                return 1;
+                        goto inval_skb;
-        }
+        } else if (skb->protocol == htons(ETH_P_CANFD)) {
+                if (unlikely(skb->len != CANFD_MTU ||
+                             cfd->len > CANFD_MAX_DLEN))
+                        goto inval_skb;
+        } else
+                goto inval_skb;
        return 0;
+inval_skb:
+        kfree_skb(skb);
+        dev->stats.tx_dropped++;
+        return 1;
 }
+/* get data length from can_dlc with sanitized can_dlc */
+u8 can_dlc2len(u8 can_dlc);
+/* map the sanitized data length to an appropriate data length code */
+u8 can_len2dlc(u8 len);
 struct net_device *alloc_candev(int sizeof_priv, unsigned int echo_skb_max);
 void free_candev(struct net_device *dev);
diff --git a/include/linux/can/error.h b/include/linux/can/error.h
index 63e855ea6b84..7b7148bded71 100644
--- a/include/linux/can/error.h
+++ b/include/linux/can/error.h
@@ -1,7 +1,7 @@
 /*
 * linux/can/error.h
 *
- * Definitions of the CAN error frame to be filtered and passed to the user.
+ * Definitions of the CAN error messages to be filtered and passed to the user.
 *
 * Author: Oliver Hartkopp <oliver.hartkopp@volkswagen.de>
 * Copyright (c) 2002-2007 Volkswagen Group Electronic Research
@@ -12,7 +12,7 @@
 #ifndef CAN_ERROR_H
 #define CAN_ERROR_H
-#define CAN_ERR_DLC 8 /* dlc for error frames */
+#define CAN_ERR_DLC 8 /* dlc for error message frames */
 /* error class (mask) in can_id */
 #define CAN_ERR_TX_TIMEOUT   0x00000001U /* TX timeout (by netdevice driver) */
diff --git a/include/linux/can/raw.h b/include/linux/can/raw.h
index 781f3a3701be..a814062b0719 100644
--- a/include/linux/can/raw.h
+++ b/include/linux/can/raw.h
@@ -23,7 +23,8 @@ enum {
        CAN_RAW_FILTER = 1,     /* set 0 .. n can_filter(s)          */
        CAN_RAW_ERR_FILTER,     /* set filter for error frames       */
        CAN_RAW_LOOPBACK,       /* local loopback (default:on)       */
-        CAN_RAW_RECV_OWN_MSGS   /* receive my own msgs (default:off) */
+        CAN_RAW_RECV_OWN_MSGS,  /* receive my own msgs (default:off) */
+        CAN_RAW_FD_FRAMES,      /* allow CAN FD frames (default:off) */
 };
 #endif
diff --git a/include/linux/cpu_rmap.h b/include/linux/cpu_rmap.h
index 473771a528c0..ac3bbb5b9502 100644
--- a/include/linux/cpu_rmap.h
+++ b/include/linux/cpu_rmap.h
@@ -1,3 +1,6 @@
+#ifndef __LINUX_CPU_RMAP_H
+#define __LINUX_CPU_RMAP_H
 /*
 * cpu_rmap.c: CPU affinity reverse-map support
 * Copyright 2011 Solarflare Communications Inc.
@@ -71,3 +74,4 @@ extern void free_irq_cpu_rmap(struct cpu_rmap *rmap);
 extern int irq_cpu_rmap_add(struct cpu_rmap *rmap, int irq);
 #endif
+#endif /* __LINUX_CPU_RMAP_H */
diff --git a/include/linux/etherdevice.h b/include/linux/etherdevice.h
index 3d406e0ede6d..d426336d92d9 100644
--- a/include/linux/etherdevice.h
+++ b/include/linux/etherdevice.h
@@ -124,17 +124,30 @@ static inline bool is_valid_ether_addr(const u8 *addr)
 }
 /**
- * random_ether_addr - Generate software assigned random Ethernet address
+ * eth_random_addr - Generate software assigned random Ethernet address
 * @addr: Pointer to a six-byte array containing the Ethernet address
 *
 * Generate a random Ethernet address (MAC) that is not multicast
 * and has the local assigned bit set.
 */
-static inline void random_ether_addr(u8 *addr)
+static inline void eth_random_addr(u8 *addr)
 {
-        get_random_bytes (addr, ETH_ALEN);
+        get_random_bytes(addr, ETH_ALEN);
-        addr [0] &= 0xfe;       /* clear multicast bit */
+        addr[0] &= 0xfe;        /* clear multicast bit */
-        addr [0] |= 0x02;       /* set local assignment bit (IEEE802) */
+        addr[0] |= 0x02;        /* set local assignment bit (IEEE802) */
+}
+#define random_ether_addr(addr) eth_random_addr(addr)
+/**
+ * eth_broadcast_addr - Assign broadcast address
+ * @addr: Pointer to a six-byte array containing the Ethernet address
+ *
+ * Assign the broadcast address to the given address array.
+ */
+static inline void eth_broadcast_addr(u8 *addr)
+{
+        memset(addr, 0xff, ETH_ALEN);
 }
 /**
@@ -149,7 +162,7 @@ static inline void random_ether_addr(u8 *addr)
 static inline void eth_hw_addr_random(struct net_device *dev)
 {
        dev->addr_assign_type |= NET_ADDR_RANDOM;
-        random_ether_addr(dev->dev_addr);
+        eth_random_addr(dev->dev_addr);
 }
 /**
diff --git a/include/linux/ethtool.h b/include/linux/ethtool.h
index e17fa7140588..21eff418091b 100644
--- a/include/linux/ethtool.h
+++ b/include/linux/ethtool.h
@@ -137,6 +137,35 @@ struct ethtool_eeprom {
 };
 /**
+ * struct ethtool_eee - Energy Efficient Ethernet information
+ * @cmd: ETHTOOL_{G,S}EEE
+ * @supported: Mask of %SUPPORTED_* flags for the speed/duplex combinations
+ *      for which there is EEE support.
+ * @advertised: Mask of %ADVERTISED_* flags for the speed/duplex combinations
+ *      advertised as eee capable.
+ * @lp_advertised: Mask of %ADVERTISED_* flags for the speed/duplex
+ *      combinations advertised by the link partner as eee capable.
+ * @eee_active: Result of the eee auto negotiation.
+ * @eee_enabled: EEE configured mode (enabled/disabled).
+ * @tx_lpi_enabled: Whether the interface should assert its tx lpi, given
+ *      that eee was negotiated.
+ * @tx_lpi_timer: Time in microseconds the interface delays prior to asserting
+ *      its tx lpi (after reaching 'idle' state). Effective only when eee
+ *      was negotiated and tx_lpi_enabled was set.
+ */
+struct ethtool_eee {
+        __u32   cmd;
+        __u32   supported;
+        __u32   advertised;
+        __u32   lp_advertised;
+        __u32   eee_active;
+        __u32   eee_enabled;
+        __u32   tx_lpi_enabled;
+        __u32   tx_lpi_timer;
+        __u32   reserved[2];
+};
+/**
 * struct ethtool_modinfo - plugin module eeprom information
 * @cmd: %ETHTOOL_GMODULEINFO
 * @type: Standard the module information conforms to %ETH_MODULE_SFF_xxxx
@@ -945,6 +974,8 @@ static inline u32 ethtool_rxfh_indir_default(u32 index, u32 n_rx_rings)
 * @get_module_info: Get the size and type of the eeprom contained within
 *      a plug-in module.
 * @get_module_eeprom: Get the eeprom information from the plug-in module
+ * @get_eee: Get Energy-Efficient (EEE) supported and status.
+ * @set_eee: Set EEE status (enable/disable) as well as LPI timers.
 *
 * All operations are optional (i.e. the function pointer may be set
 * to %NULL) and callers must take this into account.  Callers must
@@ -1011,6 +1042,8 @@ struct ethtool_ops {
                                   struct ethtool_modinfo *);
        int     (*get_module_eeprom)(struct net_device *,
                                     struct ethtool_eeprom *, u8 *);
+        int     (*get_eee)(struct net_device *, struct ethtool_eee *);
+        int     (*set_eee)(struct net_device *, struct ethtool_eee *);
 };
@@ -1089,6 +1122,8 @@ struct ethtool_ops {
 #define ETHTOOL_GET_TS_INFO     0x00000041 /* Get time stamping and PHC info */
 #define ETHTOOL_GMODULEINFO     0x00000042 /* Get plug-in module information */
 #define ETHTOOL_GMODULEEEPROM   0x00000043 /* Get plug-in module eeprom */
+#define ETHTOOL_GEEE            0x00000044 /* Get EEE settings */
+#define ETHTOOL_SEEE            0x00000045 /* Set EEE settings */
 /* compatibility with older code */
 #define SPARC_ETH_GSET          ETHTOOL_GSET
@@ -1118,6 +1153,10 @@ struct ethtool_ops {
 #define SUPPORTED_10000baseR_FEC        (1 << 20)
 #define SUPPORTED_20000baseMLD2_Full    (1 << 21)
 #define SUPPORTED_20000baseKR2_Full     (1 << 22)
+#define SUPPORTED_40000baseKR4_Full     (1 << 23)
+#define SUPPORTED_40000baseCR4_Full     (1 << 24)
+#define SUPPORTED_40000baseSR4_Full     (1 << 25)
+#define SUPPORTED_40000baseLR4_Full     (1 << 26)
 /* Indicates what features are advertised by the interface. */
 #define ADVERTISED_10baseT_Half         (1 << 0)
@@ -1143,6 +1182,10 @@ struct ethtool_ops {
 #define ADVERTISED_10000baseR_FEC       (1 << 20)
 #define ADVERTISED_20000baseMLD2_Full   (1 << 21)
 #define ADVERTISED_20000baseKR2_Full    (1 << 22)
+#define ADVERTISED_40000baseKR4_Full    (1 << 23)
+#define ADVERTISED_40000baseCR4_Full    (1 << 24)
+#define ADVERTISED_40000baseSR4_Full    (1 << 25)
+#define ADVERTISED_40000baseLR4_Full    (1 << 26)
 /* The following are all involved in forcing a particular link
 * mode for the device for setting things.  When getting the
diff --git a/include/linux/genetlink.h b/include/linux/genetlink.h
index 7a114016ac7d..5ab61c1eb6bf 100644
--- a/include/linux/genetlink.h
+++ b/include/linux/genetlink.h
@@ -85,7 +85,7 @@ enum {
 /* All generic netlink requests are serialized by a global lock.  */
 extern void genl_lock(void);
 extern void genl_unlock(void);
-#ifdef CONFIG_PROVE_LOCKING
+#ifdef CONFIG_LOCKDEP
 extern int lockdep_genl_is_held(void);
 #endif
diff --git a/include/linux/ieee80211.h b/include/linux/ieee80211.h
index ce9af8918514..e02fc682bb68 100644
--- a/include/linux/ieee80211.h
+++ b/include/linux/ieee80211.h
@@ -47,6 +47,7 @@
 #define IEEE80211_FCTL_MOREDATA         0x2000
 #define IEEE80211_FCTL_PROTECTED        0x4000
 #define IEEE80211_FCTL_ORDER            0x8000
+#define IEEE80211_FCTL_CTL_EXT          0x0f00
 #define IEEE80211_SCTL_FRAG             0x000F
 #define IEEE80211_SCTL_SEQ              0xFFF0
@@ -54,6 +55,7 @@
 #define IEEE80211_FTYPE_MGMT            0x0000
 #define IEEE80211_FTYPE_CTL             0x0004
 #define IEEE80211_FTYPE_DATA            0x0008
+#define IEEE80211_FTYPE_EXT             0x000c
 /* management */
 #define IEEE80211_STYPE_ASSOC_REQ       0x0000
@@ -70,6 +72,7 @@
 #define IEEE80211_STYPE_ACTION          0x00D0
 /* control */
+#define IEEE80211_STYPE_CTL_EXT         0x0060
 #define IEEE80211_STYPE_BACK_REQ        0x0080
 #define IEEE80211_STYPE_BACK            0x0090
 #define IEEE80211_STYPE_PSPOLL          0x00A0
@@ -97,6 +100,18 @@
 #define IEEE80211_STYPE_QOS_CFPOLL              0x00E0
 #define IEEE80211_STYPE_QOS_CFACKPOLL           0x00F0
+/* extension, added by 802.11ad */
+#define IEEE80211_STYPE_DMG_BEACON              0x0000
+/* control extension - for IEEE80211_FTYPE_CTL | IEEE80211_STYPE_CTL_EXT */
+#define IEEE80211_CTL_EXT_POLL          0x2000
+#define IEEE80211_CTL_EXT_SPR           0x3000
+#define IEEE80211_CTL_EXT_GRANT 0x4000
+#define IEEE80211_CTL_EXT_DMG_CTS       0x5000
+#define IEEE80211_CTL_EXT_DMG_DTS       0x6000
+#define IEEE80211_CTL_EXT_SSW           0x8000
+#define IEEE80211_CTL_EXT_SSW_FBACK     0x9000
+#define IEEE80211_CTL_EXT_SSW_ACK       0xa000
 /* miscellaneous IEEE 802.11 constants */
 #define IEEE80211_MAX_FRAG_THRESHOLD    2352
@@ -568,6 +583,26 @@ struct ieee80211s_hdr {
 #define MESH_FLAGS_PS_DEEP      0x4
 /**
+ * enum ieee80211_preq_flags - mesh PREQ element flags
+ *
+ * @IEEE80211_PREQ_PROACTIVE_PREP_FLAG: proactive PREP subfield
+ */
+enum ieee80211_preq_flags {
+        IEEE80211_PREQ_PROACTIVE_PREP_FLAG      = 1<<2,
+};
+/**
+ * enum ieee80211_preq_target_flags - mesh PREQ element per target flags
+ *
+ * @IEEE80211_PREQ_TO_FLAG: target only subfield
+ * @IEEE80211_PREQ_USN_FLAG: unknown target HWMP sequence number subfield
+ */
+enum ieee80211_preq_target_flags {
+        IEEE80211_PREQ_TO_FLAG  = 1<<0,
+        IEEE80211_PREQ_USN_FLAG = 1<<2,
+};
+/**
 * struct ieee80211_quiet_ie
 *
 * This structure refers to "Quiet information element"
@@ -1072,6 +1107,73 @@ struct ieee80211_ht_operation {
 #define WLAN_HT_SMPS_CONTROL_STATIC     1
 #define WLAN_HT_SMPS_CONTROL_DYNAMIC    3
+#define VHT_MCS_SUPPORTED_SET_SIZE      8
+struct ieee80211_vht_capabilities {
+        __le32 vht_capabilities_info;
+        u8 vht_supported_mcs_set[VHT_MCS_SUPPORTED_SET_SIZE];
+} __packed;
+struct ieee80211_vht_operation {
+        u8 vht_op_info_chwidth;
+        u8 vht_op_info_chan_center_freq_seg1_idx;
+        u8 vht_op_info_chan_center_freq_seg2_idx;
+        __le16 vht_basic_mcs_set;
+} __packed;
+/**
+ * struct ieee80211_vht_mcs_info - VHT MCS information
+ * @rx_mcs_map: RX MCS map 2 bits for each stream, total 8 streams
+ * @rx_highest: Indicates highest long GI VHT PPDU data rate
+ *      STA can receive. Rate expressed in units of 1 Mbps.
+ *      If this field is 0 this value should not be used to
+ *      consider the highest RX data rate supported.
+ * @tx_mcs_map: TX MCS map 2 bits for each stream, total 8 streams
+ * @tx_highest: Indicates highest long GI VHT PPDU data rate
+ *      STA can transmit. Rate expressed in units of 1 Mbps.
+ *      If this field is 0 this value should not be used to
+ *      consider the highest TX data rate supported.
+ */
+struct ieee80211_vht_mcs_info {
+        __le16 rx_mcs_map;
+        __le16 rx_highest;
+        __le16 tx_mcs_map;
+        __le16 tx_highest;
+} __packed;
+#define IEEE80211_VHT_MCS_ZERO_TO_SEVEN_SUPPORT 0
+#define IEEE80211_VHT_MCS_ZERO_TO_EIGHT_SUPPORT 1
+#define IEEE80211_VHT_MCS_ZERO_TO_NINE_SUPPORT  2
+#define IEEE80211_VHT_MCS_NOT_SUPPORTED 3
+/* 802.11ac VHT Capabilities */
+#define IEEE80211_VHT_CAP_MAX_MPDU_LENGTH_3895                0x00000000
+#define IEEE80211_VHT_CAP_MAX_MPDU_LENGTH_7991                0x00000001
+#define IEEE80211_VHT_CAP_MAX_MPDU_LENGTH_11454               0x00000002
+#define IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160MHZ              0x00000004
+#define IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160_80PLUS80MHZ     0x00000008
+#define IEEE80211_VHT_CAP_RXLDPC                              0x00000010
+#define IEEE80211_VHT_CAP_SHORT_GI_80                         0x00000020
+#define IEEE80211_VHT_CAP_SHORT_GI_160                        0x00000040
+#define IEEE80211_VHT_CAP_TXSTBC                              0x00000080
+#define IEEE80211_VHT_CAP_RXSTBC_1                            0x00000100
+#define IEEE80211_VHT_CAP_RXSTBC_2                            0x00000200
+#define IEEE80211_VHT_CAP_RXSTBC_3                            0x00000300
+#define IEEE80211_VHT_CAP_RXSTBC_4                            0x00000400
+#define IEEE80211_VHT_CAP_SU_BEAMFORMER_CAPABLE               0x00000800
+#define IEEE80211_VHT_CAP_SU_BEAMFORMEE_CAPABLE               0x00001000
+#define IEEE80211_VHT_CAP_BEAMFORMER_ANTENNAS_MAX             0x00006000
+#define IEEE80211_VHT_CAP_SOUNDING_DIMENTION_MAX              0x00030000
+#define IEEE80211_VHT_CAP_MU_BEAMFORMER_CAPABLE               0x00080000
+#define IEEE80211_VHT_CAP_MU_BEAMFORMEE_CAPABLE               0x00100000
+#define IEEE80211_VHT_CAP_VHT_TXOP_PS                         0x00200000
+#define IEEE80211_VHT_CAP_HTC_VHT                             0x00400000
+#define IEEE80211_VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT          0x00800000
+#define IEEE80211_VHT_CAP_VHT_LINK_ADAPTATION_VHT_UNSOL_MFB   0x08000000
+#define IEEE80211_VHT_CAP_VHT_LINK_ADAPTATION_VHT_MRQ_MFB     0x0c000000
+#define IEEE80211_VHT_CAP_RX_ANTENNA_PATTERN                  0x10000000
+#define IEEE80211_VHT_CAP_TX_ANTENNA_PATTERN                  0x20000000
 /* Authentication algorithms */
 #define WLAN_AUTH_OPEN 0
 #define WLAN_AUTH_SHARED_KEY 1
@@ -1104,6 +1206,21 @@ struct ieee80211_ht_operation {
 #define WLAN_CAPABILITY_QOS             (1<<9)
 #define WLAN_CAPABILITY_SHORT_SLOT_TIME (1<<10)
 #define WLAN_CAPABILITY_DSSS_OFDM       (1<<13)
+/* DMG (60gHz) 802.11ad */
+/* type - bits 0..1 */
+#define WLAN_CAPABILITY_DMG_TYPE_IBSS           (1<<0) /* Tx by: STA */
+#define WLAN_CAPABILITY_DMG_TYPE_PBSS           (2<<0) /* Tx by: PCP */
+#define WLAN_CAPABILITY_DMG_TYPE_AP             (3<<0) /* Tx by: AP */
+#define WLAN_CAPABILITY_DMG_CBAP_ONLY           (1<<2)
+#define WLAN_CAPABILITY_DMG_CBAP_SOURCE (1<<3)
+#define WLAN_CAPABILITY_DMG_PRIVACY             (1<<4)
+#define WLAN_CAPABILITY_DMG_ECPAC               (1<<5)
+#define WLAN_CAPABILITY_DMG_SPECTRUM_MGMT       (1<<8)
+#define WLAN_CAPABILITY_DMG_RADIO_MEASURE       (1<<12)
 /* measurement */
 #define IEEE80211_SPCT_MSR_RPRT_MODE_LATE       (1<<0)
 #define IEEE80211_SPCT_MSR_RPRT_MODE_INCAPABLE  (1<<1)
@@ -1113,7 +1230,6 @@ struct ieee80211_ht_operation {
 #define IEEE80211_SPCT_MSR_RPRT_TYPE_CCA        1
 #define IEEE80211_SPCT_MSR_RPRT_TYPE_RPI        2
 /* 802.11g ERP information element */
 #define WLAN_ERP_NON_ERP_PRESENT (1<<0)
 #define WLAN_ERP_USE_PROTECTION (1<<1)
@@ -1125,6 +1241,16 @@ enum {
        WLAN_ERP_PREAMBLE_LONG = 1,
 };
+/* Band ID, 802.11ad #8.4.1.45 */
+enum {
+        IEEE80211_BANDID_TV_WS = 0, /* TV white spaces */
+        IEEE80211_BANDID_SUB1  = 1, /* Sub-1 GHz (excluding TV white spaces) */
+        IEEE80211_BANDID_2G    = 2, /* 2.4 GHz */
+        IEEE80211_BANDID_3G    = 3, /* 3.6 GHz */
+        IEEE80211_BANDID_5G    = 4, /* 4.9 and 5 GHz */
+        IEEE80211_BANDID_60G   = 5, /* 60 GHz */
+};
 /* Status codes */
 enum ieee80211_statuscode {
        WLAN_STATUS_SUCCESS = 0,
@@ -1176,6 +1302,17 @@ enum ieee80211_statuscode {
        WLAN_STATUS_ANTI_CLOG_REQUIRED = 76,
        WLAN_STATUS_FCG_NOT_SUPP = 78,
        WLAN_STATUS_STA_NO_TBTT = 78,
+        /* 802.11ad */
+        WLAN_STATUS_REJECTED_WITH_SUGGESTED_CHANGES = 39,
+        WLAN_STATUS_REJECTED_FOR_DELAY_PERIOD = 47,
+        WLAN_STATUS_REJECT_WITH_SCHEDULE = 83,
+        WLAN_STATUS_PENDING_ADMITTING_FST_SESSION = 86,
+        WLAN_STATUS_PERFORMING_FST_NOW = 87,
+        WLAN_STATUS_PENDING_GAP_IN_BA_WINDOW = 88,
+        WLAN_STATUS_REJECT_U_PID_SETTING = 89,
+        WLAN_STATUS_REJECT_DSE_BAND = 96,
+        WLAN_STATUS_DENIED_WITH_SUGGESTED_BAND_AND_CHANNEL = 99,
+        WLAN_STATUS_DENIED_DUE_TO_SPECTRUM_MANAGEMENT = 103,
 };
@@ -1332,6 +1469,43 @@ enum ieee80211_eid {
        WLAN_EID_DSE_REGISTERED_LOCATION = 58,
        WLAN_EID_SUPPORTED_REGULATORY_CLASSES = 59,
        WLAN_EID_EXT_CHANSWITCH_ANN = 60,
+        WLAN_EID_VHT_CAPABILITY = 191,
+        WLAN_EID_VHT_OPERATION = 192,
+        /* 802.11ad */
+        WLAN_EID_NON_TX_BSSID_CAP =  83,
+        WLAN_EID_WAKEUP_SCHEDULE = 143,
+        WLAN_EID_EXT_SCHEDULE = 144,
+        WLAN_EID_STA_AVAILABILITY = 145,
+        WLAN_EID_DMG_TSPEC = 146,
+        WLAN_EID_DMG_AT = 147,
+        WLAN_EID_DMG_CAP = 148,
+        WLAN_EID_DMG_OPERATION = 151,
+        WLAN_EID_DMG_BSS_PARAM_CHANGE = 152,
+        WLAN_EID_DMG_BEAM_REFINEMENT = 153,
+        WLAN_EID_CHANNEL_MEASURE_FEEDBACK = 154,
+        WLAN_EID_AWAKE_WINDOW = 157,
+        WLAN_EID_MULTI_BAND = 158,
+        WLAN_EID_ADDBA_EXT = 159,
+        WLAN_EID_NEXT_PCP_LIST = 160,
+        WLAN_EID_PCP_HANDOVER = 161,
+        WLAN_EID_DMG_LINK_MARGIN = 162,
+        WLAN_EID_SWITCHING_STREAM = 163,
+        WLAN_EID_SESSION_TRANSITION = 164,
+        WLAN_EID_DYN_TONE_PAIRING_REPORT = 165,
+        WLAN_EID_CLUSTER_REPORT = 166,
+        WLAN_EID_RELAY_CAP = 167,
+        WLAN_EID_RELAY_XFER_PARAM_SET = 168,
+        WLAN_EID_BEAM_LINK_MAINT = 169,
+        WLAN_EID_MULTIPLE_MAC_ADDR = 170,
+        WLAN_EID_U_PID = 171,
+        WLAN_EID_DMG_LINK_ADAPT_ACK = 172,
+        WLAN_EID_QUIET_PERIOD_REQ = 175,
+        WLAN_EID_QUIET_PERIOD_RESP = 177,
+        WLAN_EID_EPAC_POLICY = 182,
+        WLAN_EID_CLISTER_TIME_OFF = 183,
+        WLAN_EID_ANTENNA_SECTOR_ID_PATTERN = 190,
 };
 /* Action category code */
@@ -1348,7 +1522,10 @@ enum ieee80211_category {
        WLAN_CATEGORY_MESH_ACTION = 13,
        WLAN_CATEGORY_MULTIHOP_ACTION = 14,
        WLAN_CATEGORY_SELF_PROTECTED = 15,
+        WLAN_CATEGORY_DMG = 16,
        WLAN_CATEGORY_WMM = 17,
+        WLAN_CATEGORY_FST = 18,
+        WLAN_CATEGORY_UNPROT_DMG = 20,
        WLAN_CATEGORY_VENDOR_SPECIFIC_PROTECTED = 126,
        WLAN_CATEGORY_VENDOR_SPECIFIC = 127,
 };
@@ -1443,7 +1620,7 @@ enum ieee80211_tdls_actioncode {
 *
 * @IEEE80211_SYNC_METHOD_NEIGHBOR_OFFSET: the default synchronization method
 * @IEEE80211_SYNC_METHOD_VENDOR: a vendor specific synchronization method
- * that will be specified in a vendor specific information element
+ *      that will be specified in a vendor specific information element
 */
 enum {
        IEEE80211_SYNC_METHOD_NEIGHBOR_OFFSET = 1,
@@ -1455,7 +1632,7 @@ enum {
 *
 * @IEEE80211_PATH_PROTOCOL_HWMP: the default path selection protocol
 * @IEEE80211_PATH_PROTOCOL_VENDOR: a vendor specific protocol that will
- * be specified in a vendor specific information element
+ *      be specified in a vendor specific information element
 */
 enum {
        IEEE80211_PATH_PROTOCOL_HWMP = 1,
@@ -1467,13 +1644,35 @@ enum {
 *
 * @IEEE80211_PATH_METRIC_AIRTIME: the default path selection metric
 * @IEEE80211_PATH_METRIC_VENDOR: a vendor specific metric that will be
- * specified in a vendor specific information element
+ *      specified in a vendor specific information element
 */
 enum {
        IEEE80211_PATH_METRIC_AIRTIME = 1,
        IEEE80211_PATH_METRIC_VENDOR = 255,
 };
+/**
+ * enum ieee80211_root_mode_identifier - root mesh STA mode identifier
+ *
+ * These attribute are used by dot11MeshHWMPRootMode to set root mesh STA mode
+ *
+ * @IEEE80211_ROOTMODE_NO_ROOT: the mesh STA is not a root mesh STA (default)
+ * @IEEE80211_ROOTMODE_ROOT: the mesh STA is a root mesh STA if greater than
+ *      this value
+ * @IEEE80211_PROACTIVE_PREQ_NO_PREP: the mesh STA is a root mesh STA supports
+ *      the proactive PREQ with proactive PREP subfield set to 0
+ * @IEEE80211_PROACTIVE_PREQ_WITH_PREP: the mesh STA is a root mesh STA
+ *      supports the proactive PREQ with proactive PREP subfield set to 1
+ * @IEEE80211_PROACTIVE_RANN: the mesh STA is a root mesh STA supports
+ *      the proactive RANN
+ */
+enum ieee80211_root_mode_identifier {
+        IEEE80211_ROOTMODE_NO_ROOT = 0,
+        IEEE80211_ROOTMODE_ROOT = 1,
+        IEEE80211_PROACTIVE_PREQ_NO_PREP = 2,
+        IEEE80211_PROACTIVE_PREQ_WITH_PREP = 3,
+        IEEE80211_PROACTIVE_RANN = 4,
+};
 /*
 * IEEE 802.11-2007 7.3.2.9 Country information element
@@ -1574,6 +1773,7 @@ enum ieee80211_sa_query_action {
 #define WLAN_CIPHER_SUITE_CCMP          0x000FAC04
 #define WLAN_CIPHER_SUITE_WEP104        0x000FAC05
 #define WLAN_CIPHER_SUITE_AES_CMAC      0x000FAC06
+#define WLAN_CIPHER_SUITE_GCMP          0x000FAC08
 #define WLAN_CIPHER_SUITE_SMS4          0x00147201
@@ -1589,6 +1789,10 @@ enum ieee80211_sa_query_action {
 #define WLAN_OUI_WFA                    0x506f9a
 #define WLAN_OUI_TYPE_WFA_P2P           9
+#define WLAN_OUI_MICROSOFT              0x0050f2
+#define WLAN_OUI_TYPE_MICROSOFT_WPA     1
+#define WLAN_OUI_TYPE_MICROSOFT_WMM     2
+#define WLAN_OUI_TYPE_MICROSOFT_WPS     4
 /*
 * WMM/802.11e Tspec Element
diff --git a/include/linux/if.h b/include/linux/if.h
index f995c663c493..1ec407b01e46 100644
--- a/include/linux/if.h
+++ b/include/linux/if.h
@@ -81,6 +81,8 @@
 #define IFF_UNICAST_FLT 0x20000         /* Supports unicast filtering   */
 #define IFF_TEAM_PORT   0x40000         /* device used as team port */
 #define IFF_SUPP_NOFCS  0x80000         /* device supports sending custom FCS */
+#define IFF_LIVE_ADDR_CHANGE 0x100000   /* device supports hardware address
+                                         * change when it's running */
 #define IF_GET_IFACE    0x0001          /* for querying only */
diff --git a/include/linux/if_ether.h b/include/linux/if_ether.h
index 56d907a2c804..167ce5b363d2 100644
--- a/include/linux/if_ether.h
+++ b/include/linux/if_ether.h
@@ -105,7 +105,8 @@
 #define ETH_P_WAN_PPP   0x0007          /* Dummy type for WAN PPP frames*/
 #define ETH_P_PPP_MP    0x0008          /* Dummy type for PPP MP frames */
 #define ETH_P_LOCALTALK 0x0009          /* Localtalk pseudo type        */
-#define ETH_P_CAN       0x000C          /* Controller Area Network      */
+#define ETH_P_CAN       0x000C          /* CAN: Controller Area Network */
+#define ETH_P_CANFD     0x000D          /* CANFD: CAN flexible data rate*/
 #define ETH_P_PPPTALK   0x0010          /* Dummy type for Atalk over PPP*/
 #define ETH_P_TR_802_2  0x0011          /* 802.2 frames                 */
 #define ETH_P_MOBITEX   0x0015          /* Mobitex (kaz@cafe.net)       */
diff --git a/include/linux/if_link.h b/include/linux/if_link.h
index f715750d0b87..ac173bd2ab65 100644
--- a/include/linux/if_link.h
+++ b/include/linux/if_link.h
@@ -140,6 +140,8 @@ enum {
        IFLA_EXT_MASK,          /* Extended info mask, VFs, etc */
        IFLA_PROMISCUITY,       /* Promiscuity count: > 0 means acts PROMISC */
 #define IFLA_PROMISCUITY IFLA_PROMISCUITY
+        IFLA_NUM_TX_QUEUES,
+        IFLA_NUM_RX_QUEUES,
        __IFLA_MAX
 };
diff --git a/include/linux/if_team.h b/include/linux/if_team.h
index 8185f57a9c7f..6960fc1841a7 100644
--- a/include/linux/if_team.h
+++ b/include/linux/if_team.h
@@ -13,6 +13,9 @@
 #ifdef __KERNEL__
+#include <linux/netpoll.h>
+#include <net/sch_generic.h>
 struct team_pcpu_stats {
        u64                     rx_packets;
        u64                     rx_bytes;
@@ -60,9 +63,54 @@ struct team_port {
                unsigned int mtu;
        } orig;
-        struct rcu_head rcu;
+#ifdef CONFIG_NET_POLL_CONTROLLER
+        struct netpoll *np;
+#endif
+        long mode_priv[0];
 };
+static inline bool team_port_enabled(struct team_port *port)
+{
+        return port->index != -1;
+}
+static inline bool team_port_txable(struct team_port *port)
+{
+        return port->linkup && team_port_enabled(port);
+}
+#ifdef CONFIG_NET_POLL_CONTROLLER
+static inline void team_netpoll_send_skb(struct team_port *port,
+                                         struct sk_buff *skb)
+{
+        struct netpoll *np = port->np;
+        if (np)
+                netpoll_send_skb(np, skb);
+}
+#else
+static inline void team_netpoll_send_skb(struct team_port *port,
+                                         struct sk_buff *skb)
+{
+}
+#endif
+static inline int team_dev_queue_xmit(struct team *team, struct team_port *port,
+                                      struct sk_buff *skb)
+{
+        BUILD_BUG_ON(sizeof(skb->queue_mapping) !=
+                     sizeof(qdisc_skb_cb(skb)->slave_dev_queue_mapping));
+        skb_set_queue_mapping(skb, qdisc_skb_cb(skb)->slave_dev_queue_mapping);
+        skb->dev = port->dev;
+        if (unlikely(netpoll_tx_running(port->dev))) {
+                team_netpoll_send_skb(port, skb);
+                return 0;
+        }
+        return dev_queue_xmit(skb);
+}
 struct team_mode_ops {
        int (*init)(struct team *team);
        void (*exit)(struct team *team);
@@ -73,6 +121,8 @@ struct team_mode_ops {
        int (*port_enter)(struct team *team, struct team_port *port);
        void (*port_leave)(struct team *team, struct team_port *port);
        void (*port_change_mac)(struct team *team, struct team_port *port);
+        void (*port_enabled)(struct team *team, struct team_port *port);
+        void (*port_disabled)(struct team *team, struct team_port *port);
 };
 enum team_option_type {
@@ -82,6 +132,11 @@ enum team_option_type {
        TEAM_OPTION_TYPE_BOOL,
 };
+struct team_option_inst_info {
+        u32 array_index;
+        struct team_port *port; /* != NULL if per-port */
+};
 struct team_gsetter_ctx {
        union {
                u32 u32_val;
@@ -92,23 +147,28 @@ struct team_gsetter_ctx {
                } bin_val;
                bool bool_val;
        } data;
-        struct team_port *port;
+        struct team_option_inst_info *info;
 };
 struct team_option {
        struct list_head list;
        const char *name;
        bool per_port;
+        unsigned int array_size; /* != 0 means the option is array */
        enum team_option_type type;
+        int (*init)(struct team *team, struct team_option_inst_info *info);
        int (*getter)(struct team *team, struct team_gsetter_ctx *ctx);
        int (*setter)(struct team *team, struct team_gsetter_ctx *ctx);
 };
+extern void team_option_inst_set_change(struct team_option_inst_info *opt_inst_info);
+extern void team_options_change_check(struct team *team);
 struct team_mode {
-        struct list_head list;
        const char *kind;
        struct module *owner;
        size_t priv_size;
+        size_t port_priv_size;
        const struct team_mode_ops *ops;
 };
@@ -178,8 +238,11 @@ extern int team_options_register(struct team *team,
 extern void team_options_unregister(struct team *team,
                                    const struct team_option *option,
                                    size_t option_count);
-extern int team_mode_register(struct team_mode *mode);
+extern int team_mode_register(const struct team_mode *mode);
-extern int team_mode_unregister(struct team_mode *mode);
+extern void team_mode_unregister(const struct team_mode *mode);
+#define TEAM_DEFAULT_NUM_TX_QUEUES 16
+#define TEAM_DEFAULT_NUM_RX_QUEUES 16
 #endif /* __KERNEL__ */
@@ -241,6 +304,7 @@ enum {
        TEAM_ATTR_OPTION_DATA,          /* dynamic */
        TEAM_ATTR_OPTION_REMOVED,       /* flag */
        TEAM_ATTR_OPTION_PORT_IFINDEX,  /* u32 */ /* for per-port options */
+        TEAM_ATTR_OPTION_ARRAY_INDEX,   /* u32 */ /* for array options */
        __TEAM_ATTR_OPTION_MAX,
        TEAM_ATTR_OPTION_MAX = __TEAM_ATTR_OPTION_MAX - 1,
diff --git a/include/linux/if_tunnel.h b/include/linux/if_tunnel.h
index 16b92d008bed..5efff60b6f56 100644
--- a/include/linux/if_tunnel.h
+++ b/include/linux/if_tunnel.h
@@ -80,4 +80,18 @@ enum {
 #define IFLA_GRE_MAX    (__IFLA_GRE_MAX - 1)
+/* VTI-mode i_flags */
+#define VTI_ISVTI 0x0001
+enum {
+        IFLA_VTI_UNSPEC,
+        IFLA_VTI_LINK,
+        IFLA_VTI_IKEY,
+        IFLA_VTI_OKEY,
+        IFLA_VTI_LOCAL,
+        IFLA_VTI_REMOTE,
+        __IFLA_VTI_MAX,
+};
+#define IFLA_VTI_MAX    (__IFLA_VTI_MAX - 1)
 #endif /* _IF_TUNNEL_H_ */
diff --git a/include/linux/inetdevice.h b/include/linux/inetdevice.h
index 597f4a9f3240..67f9ddacb70c 100644
--- a/include/linux/inetdevice.h
+++ b/include/linux/inetdevice.h
@@ -38,6 +38,7 @@ enum
        IPV4_DEVCONF_ACCEPT_LOCAL,
        IPV4_DEVCONF_SRC_VMARK,
        IPV4_DEVCONF_PROXY_ARP_PVLAN,
+        IPV4_DEVCONF_ROUTE_LOCALNET,
        __IPV4_DEVCONF_MAX
 };
@@ -131,6 +132,7 @@ static inline void ipv4_devconf_setall(struct in_device *in_dev)
 #define IN_DEV_PROMOTE_SECONDARIES(in_dev) \
                                        IN_DEV_ORCONF((in_dev), \
                                                      PROMOTE_SECONDARIES)
+#define IN_DEV_ROUTE_LOCALNET(in_dev)   IN_DEV_ORCONF(in_dev, ROUTE_LOCALNET)
 #define IN_DEV_RX_REDIRECTS(in_dev) \
        ((IN_DEV_FORWARD(in_dev) && \
diff --git a/include/linux/ipv6.h b/include/linux/ipv6.h
index 8260ef779762..379e433e15e0 100644
--- a/include/linux/ipv6.h
+++ b/include/linux/ipv6.h
@@ -299,9 +299,9 @@ struct ipv6_pinfo {
        struct in6_addr         rcv_saddr;
        struct in6_addr         daddr;
        struct in6_pktinfo      sticky_pktinfo;
-        struct in6_addr         *daddr_cache;
+        const struct in6_addr           *daddr_cache;
 #ifdef CONFIG_IPV6_SUBTREES
-        struct in6_addr         *saddr_cache;
+        const struct in6_addr           *saddr_cache;
 #endif
        __be32                  flow_label;
@@ -410,6 +410,22 @@ struct tcp6_sock {
 extern int inet6_sk_rebuild_header(struct sock *sk);
+struct inet6_timewait_sock {
+        struct in6_addr tw_v6_daddr;
+        struct in6_addr tw_v6_rcv_saddr;
+};
+struct tcp6_timewait_sock {
+        struct tcp_timewait_sock   tcp6tw_tcp;
+        struct inet6_timewait_sock tcp6tw_inet6;
+};
+static inline struct inet6_timewait_sock *inet6_twsk(const struct sock *sk)
+{
+        return (struct inet6_timewait_sock *)(((u8 *)sk) +
+                                              inet_twsk(sk)->tw_ipv6_offset);
+}
 #if IS_ENABLED(CONFIG_IPV6)
 static inline struct ipv6_pinfo * inet6_sk(const struct sock *__sk)
 {
@@ -459,28 +475,12 @@ static inline void inet_sk_copy_descendant(struct sock *sk_to,
 #define __ipv6_only_sock(sk)    (inet6_sk(sk)->ipv6only)
 #define ipv6_only_sock(sk)      ((sk)->sk_family == PF_INET6 && __ipv6_only_sock(sk))
-struct inet6_timewait_sock {
-        struct in6_addr tw_v6_daddr;
-        struct in6_addr tw_v6_rcv_saddr;
-};
-struct tcp6_timewait_sock {
-        struct tcp_timewait_sock   tcp6tw_tcp;
-        struct inet6_timewait_sock tcp6tw_inet6;
-};
 static inline u16 inet6_tw_offset(const struct proto *prot)
 {
        return prot->twsk_prot->twsk_obj_size -
                        sizeof(struct inet6_timewait_sock);
 }
-static inline struct inet6_timewait_sock *inet6_twsk(const struct sock *sk)
-{
-        return (struct inet6_timewait_sock *)(((u8 *)sk) +
-                                              inet_twsk(sk)->tw_ipv6_offset);
-}
 static inline struct in6_addr *__inet6_rcv_saddr(const struct sock *sk)
 {
        return likely(sk->sk_state != TCP_TIME_WAIT) ?
diff --git a/include/linux/ks8851_mll.h b/include/linux/ks8851_mll.h
new file mode 100644
index 000000000000..e9ccfb59ed30
--- /dev/null
+++ b/include/linux/ks8851_mll.h
@@ -0,0 +1,33 @@
+/*
+ * ks8861_mll platform data struct definition
+ * Copyright (c) 2012 BTicino S.p.A.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+ */
+#ifndef _LINUX_KS8851_MLL_H
+#define _LINUX_KS8851_MLL_H
+#include <linux/if_ether.h>
+/**
+ * struct ks8851_mll_platform_data - Platform data of the KS8851_MLL network driver
+ * @macaddr:    The MAC address of the device, set to all 0:s to use the on in
+ *              the chip.
+ */
+struct ks8851_mll_platform_data {
+        u8 mac_addr[ETH_ALEN];
+};
+#endif
diff --git a/include/linux/mdio.h b/include/linux/mdio.h
index dfb947959ec9..7cccafe50e7b 100644
--- a/include/linux/mdio.h
+++ b/include/linux/mdio.h
@@ -43,7 +43,11 @@
 #define MDIO_PKGID2             15
 #define MDIO_AN_ADVERTISE       16      /* AN advertising (base page) */
 #define MDIO_AN_LPA             19      /* AN LP abilities (base page) */
+#define MDIO_PCS_EEE_ABLE       20      /* EEE Capability register */
+#define MDIO_PCS_EEE_WK_ERR     22      /* EEE wake error counter */
 #define MDIO_PHYXS_LNSTAT       24      /* PHY XGXS lane state */
+#define MDIO_AN_EEE_ADV         60      /* EEE advertisement */
+#define MDIO_AN_EEE_LPABLE      61      /* EEE link partner ability */
 /* Media-dependent registers. */
 #define MDIO_PMA_10GBT_SWAPPOL  130     /* 10GBASE-T pair swap & polarity */
@@ -56,7 +60,6 @@
 #define MDIO_PCS_10GBRT_STAT2   33      /* 10GBASE-R/-T PCS status 2 */
 #define MDIO_AN_10GBT_CTRL      32      /* 10GBASE-T auto-negotiation control */
 #define MDIO_AN_10GBT_STAT      33      /* 10GBASE-T auto-negotiation status */
-#define MDIO_AN_EEE_ADV         60      /* EEE advertisement */
 /* LASI (Link Alarm Status Interrupt) registers, defined by XENPAK MSA. */
 #define MDIO_PMA_LASI_RXCTRL    0x9000  /* RX_ALARM control */
@@ -82,6 +85,7 @@
 #define MDIO_AN_CTRL1_RESTART           BMCR_ANRESTART
 #define MDIO_AN_CTRL1_ENABLE            BMCR_ANENABLE
 #define MDIO_AN_CTRL1_XNP               0x2000  /* Enable extended next page */
+#define MDIO_PCS_CTRL1_CLKSTOP_EN       0x400   /* Stop the clock during LPI */
 /* 10 Gb/s */
 #define MDIO_CTRL1_SPEED10G             (MDIO_CTRL1_SPEEDSELEXT | 0x00)
@@ -237,9 +241,25 @@
 #define MDIO_AN_10GBT_STAT_MS           0x4000  /* Master/slave config */
 #define MDIO_AN_10GBT_STAT_MSFLT        0x8000  /* Master/slave config fault */
-/* AN EEE Advertisement register. */
+/* EEE Supported/Advertisement/LP Advertisement registers.
-#define MDIO_AN_EEE_ADV_100TX           0x0002  /* Advertise 100TX EEE cap */
+ *
-#define MDIO_AN_EEE_ADV_1000T           0x0004  /* Advertise 1000T EEE cap */
+ * EEE capability Register (3.20), Advertisement (7.60) and
+ * Link partner ability (7.61) registers have and can use the same identical
+ * bit masks.
+ */
+#define MDIO_AN_EEE_ADV_100TX   0x0002  /* Advertise 100TX EEE cap */
+#define MDIO_AN_EEE_ADV_1000T   0x0004  /* Advertise 1000T EEE cap */
+/* Note: the two defines above can be potentially used by the user-land
+ * and cannot remove them now.
+ * So, we define the new generic MDIO_EEE_100TX and MDIO_EEE_1000T macros
+ * using the previous ones (that can be considered obsolete).
+ */
+#define MDIO_EEE_100TX          MDIO_AN_EEE_ADV_100TX   /* 100TX EEE cap */
+#define MDIO_EEE_1000T          MDIO_AN_EEE_ADV_1000T   /* 1000T EEE cap */
+#define MDIO_EEE_10GT           0x0008  /* 10GT EEE cap */
+#define MDIO_EEE_1000KX         0x0010  /* 1000KX EEE cap */
+#define MDIO_EEE_10GKX4         0x0020  /* 10G KX4 EEE cap */
+#define MDIO_EEE_10GKR          0x0040  /* 10G KR EEE cap */
 /* LASI RX_ALARM control/status registers. */
 #define MDIO_PMA_LASI_RX_PHYXSLFLT      0x0001  /* PHY XS RX local fault */
diff --git a/include/linux/mii.h b/include/linux/mii.h
index 2783eca629a0..8ef3a7a11592 100644
--- a/include/linux/mii.h
+++ b/include/linux/mii.h
@@ -21,6 +21,8 @@
 #define MII_EXPANSION           0x06    /* Expansion register          */
 #define MII_CTRL1000            0x09    /* 1000BASE-T control          */
 #define MII_STAT1000            0x0a    /* 1000BASE-T status           */
+#define MII_MMD_CTRL            0x0d    /* MMD Access Control Register */
+#define MII_MMD_DATA            0x0e    /* MMD Access Data Register */
 #define MII_ESTATUS             0x0f    /* Extended Status             */
 #define MII_DCOUNTER            0x12    /* Disconnect counter          */
 #define MII_FCSCOUNTER          0x13    /* False carrier counter       */
@@ -141,6 +143,13 @@
 #define FLOW_CTRL_TX            0x01
 #define FLOW_CTRL_RX            0x02
+/* MMD Access Control register fields */
+#define MII_MMD_CTRL_DEVAD_MASK 0x1f    /* Mask MMD DEVAD*/
+#define MII_MMD_CTRL_ADDR       0x0000  /* Address */
+#define MII_MMD_CTRL_NOINCR     0x4000  /* no post increment */
+#define MII_MMD_CTRL_INCR_RDWT  0x8000  /* post increment on reads & writes */
+#define MII_MMD_CTRL_INCR_ON_WT 0xC000  /* post increment on writes only */
 /* This structure is used in all SIOCxMIIxxx ioctl calls */
 struct mii_ioctl_data {
        __u16           phy_id;
diff --git a/include/linux/mlx4/cmd.h b/include/linux/mlx4/cmd.h
index 1f3860a8a109..260695186256 100644
--- a/include/linux/mlx4/cmd.h
+++ b/include/linux/mlx4/cmd.h
@@ -154,6 +154,10 @@ enum {
        /* set port opcode modifiers */
        MLX4_SET_PORT_PRIO2TC = 0x8,
        MLX4_SET_PORT_SCHEDULER  = 0x9,
+        /* register/delete flow steering network rules */
+        MLX4_QP_FLOW_STEERING_ATTACH = 0x65,
+        MLX4_QP_FLOW_STEERING_DETACH = 0x66,
 };
 enum {
diff --git a/include/linux/mlx4/device.h b/include/linux/mlx4/device.h
index 6a8f002b8ed3..4d7761f8c3f6 100644
--- a/include/linux/mlx4/device.h
+++ b/include/linux/mlx4/device.h
@@ -36,6 +36,7 @@
 #include <linux/pci.h>
 #include <linux/completion.h>
 #include <linux/radix-tree.h>
+#include <linux/cpu_rmap.h>
 #include <linux/atomic.h>
@@ -70,6 +71,36 @@ enum {
        MLX4_MFUNC_EQE_MASK     = (MLX4_MFUNC_MAX_EQES - 1)
 };
+/* Driver supports 3 diffrent device methods to manage traffic steering:
+ *      -device managed - High level API for ib and eth flow steering. FW is
+ *                        managing flow steering tables.
+ *      - B0 steering mode - Common low level API for ib and (if supported) eth.
+ *      - A0 steering mode - Limited low level API for eth. In case of IB,
+ *                           B0 mode is in use.
+ */
+enum {
+        MLX4_STEERING_MODE_A0,
+        MLX4_STEERING_MODE_B0,
+        MLX4_STEERING_MODE_DEVICE_MANAGED
+};
+static inline const char *mlx4_steering_mode_str(int steering_mode)
+{
+        switch (steering_mode) {
+        case MLX4_STEERING_MODE_A0:
+                return "A0 steering";
+        case MLX4_STEERING_MODE_B0:
+                return "B0 steering";
+        case MLX4_STEERING_MODE_DEVICE_MANAGED:
+                return "Device managed flow steering";
+        default:
+                return "Unrecognize steering mode";
+        }
+}
 enum {
        MLX4_DEV_CAP_FLAG_RC            = 1LL <<  0,
        MLX4_DEV_CAP_FLAG_UC            = 1LL <<  1,
@@ -102,7 +133,8 @@ enum {
 enum {
        MLX4_DEV_CAP_FLAG2_RSS                  = 1LL <<  0,
        MLX4_DEV_CAP_FLAG2_RSS_TOP              = 1LL <<  1,
-        MLX4_DEV_CAP_FLAG2_RSS_XOR              = 1LL <<  2
+        MLX4_DEV_CAP_FLAG2_RSS_XOR              = 1LL <<  2,
+        MLX4_DEV_CAP_FLAG2_FS_EN                = 1LL <<  3
 };
 #define MLX4_ATTR_EXTENDED_PORT_INFO    cpu_to_be16(0xff90)
@@ -295,6 +327,8 @@ struct mlx4_caps {
        int                     num_amgms;
        int                     reserved_mcgs;
        int                     num_qp_per_mgm;
+        int                     steering_mode;
+        int                     fs_log_max_ucast_qp_range_size;
        int                     num_pds;
        int                     reserved_pds;
        int                     max_xrcds;
@@ -509,6 +543,8 @@ struct mlx4_dev {
        u8                      rev_id;
        char                    board_id[MLX4_BOARD_ID_LEN];
        int                     num_vfs;
+        u64                     regid_promisc_array[MLX4_MAX_PORTS + 1];
+        u64                     regid_allmulti_array[MLX4_MAX_PORTS + 1];
 };
 struct mlx4_init_port_param {
@@ -623,9 +659,99 @@ int mlx4_unicast_attach(struct mlx4_dev *dev, struct mlx4_qp *qp, u8 gid[16],
 int mlx4_unicast_detach(struct mlx4_dev *dev, struct mlx4_qp *qp, u8 gid[16],
                        enum mlx4_protocol prot);
 int mlx4_multicast_attach(struct mlx4_dev *dev, struct mlx4_qp *qp, u8 gid[16],
-                          int block_mcast_loopback, enum mlx4_protocol protocol);
+                          u8 port, int block_mcast_loopback,
+                          enum mlx4_protocol protocol, u64 *reg_id);
 int mlx4_multicast_detach(struct mlx4_dev *dev, struct mlx4_qp *qp, u8 gid[16],
-                          enum mlx4_protocol protocol);
+                          enum mlx4_protocol protocol, u64 reg_id);
+enum {
+        MLX4_DOMAIN_UVERBS      = 0x1000,
+        MLX4_DOMAIN_ETHTOOL     = 0x2000,
+        MLX4_DOMAIN_RFS         = 0x3000,
+        MLX4_DOMAIN_NIC    = 0x5000,
+};
+enum mlx4_net_trans_rule_id {
+        MLX4_NET_TRANS_RULE_ID_ETH = 0,
+        MLX4_NET_TRANS_RULE_ID_IB,
+        MLX4_NET_TRANS_RULE_ID_IPV6,
+        MLX4_NET_TRANS_RULE_ID_IPV4,
+        MLX4_NET_TRANS_RULE_ID_TCP,
+        MLX4_NET_TRANS_RULE_ID_UDP,
+        MLX4_NET_TRANS_RULE_NUM, /* should be last */
+};
+enum mlx4_net_trans_promisc_mode {
+        MLX4_FS_PROMISC_NONE = 0,
+        MLX4_FS_PROMISC_UPLINK,
+        /* For future use. Not implemented yet */
+        MLX4_FS_PROMISC_FUNCTION_PORT,
+        MLX4_FS_PROMISC_ALL_MULTI,
+};
+struct mlx4_spec_eth {
+        u8      dst_mac[6];
+        u8      dst_mac_msk[6];
+        u8      src_mac[6];
+        u8      src_mac_msk[6];
+        u8      ether_type_enable;
+        __be16  ether_type;
+        __be16  vlan_id_msk;
+        __be16  vlan_id;
+};
+struct mlx4_spec_tcp_udp {
+        __be16 dst_port;
+        __be16 dst_port_msk;
+        __be16 src_port;
+        __be16 src_port_msk;
+};
+struct mlx4_spec_ipv4 {
+        __be32 dst_ip;
+        __be32 dst_ip_msk;
+        __be32 src_ip;
+        __be32 src_ip_msk;
+};
+struct mlx4_spec_ib {
+        __be32  r_qpn;
+        __be32  qpn_msk;
+        u8      dst_gid[16];
+        u8      dst_gid_msk[16];
+};
+struct mlx4_spec_list {
+        struct  list_head list;
+        enum    mlx4_net_trans_rule_id id;
+        union {
+                struct mlx4_spec_eth eth;
+                struct mlx4_spec_ib ib;
+                struct mlx4_spec_ipv4 ipv4;
+                struct mlx4_spec_tcp_udp tcp_udp;
+        };
+};
+enum mlx4_net_trans_hw_rule_queue {
+        MLX4_NET_TRANS_Q_FIFO,
+        MLX4_NET_TRANS_Q_LIFO,
+};
+struct mlx4_net_trans_rule {
+        struct  list_head list;
+        enum    mlx4_net_trans_hw_rule_queue queue_mode;
+        bool    exclusive;
+        bool    allow_loopback;
+        enum    mlx4_net_trans_promisc_mode promisc_mode;
+        u8      port;
+        u16     priority;
+        u32     qpn;
+};
+int mlx4_flow_steer_promisc_add(struct mlx4_dev *dev, u8 port, u32 qpn,
+                                enum mlx4_net_trans_promisc_mode mode);
+int mlx4_flow_steer_promisc_remove(struct mlx4_dev *dev, u8 port,
+                                   enum mlx4_net_trans_promisc_mode mode);
 int mlx4_multicast_promisc_add(struct mlx4_dev *dev, u32 qpn, u8 port);
 int mlx4_multicast_promisc_remove(struct mlx4_dev *dev, u32 qpn, u8 port);
 int mlx4_unicast_promisc_add(struct mlx4_dev *dev, u32 qpn, u8 port);
@@ -659,7 +785,8 @@ void mlx4_fmr_unmap(struct mlx4_dev *dev, struct mlx4_fmr *fmr,
 int mlx4_fmr_free(struct mlx4_dev *dev, struct mlx4_fmr *fmr);
 int mlx4_SYNC_TPT(struct mlx4_dev *dev);
 int mlx4_test_interrupts(struct mlx4_dev *dev);
-int mlx4_assign_eq(struct mlx4_dev *dev, char* name , int* vector);
+int mlx4_assign_eq(struct mlx4_dev *dev, char *name, struct cpu_rmap *rmap,
+                   int *vector);
 void mlx4_release_eq(struct mlx4_dev *dev, int vec);
 int mlx4_wol_read(struct mlx4_dev *dev, u64 *config, int port);
@@ -668,4 +795,8 @@ int mlx4_wol_write(struct mlx4_dev *dev, u64 config, int port);
 int mlx4_counter_alloc(struct mlx4_dev *dev, u32 *idx);
 void mlx4_counter_free(struct mlx4_dev *dev, u32 idx);
+int mlx4_flow_attach(struct mlx4_dev *dev,
+                     struct mlx4_net_trans_rule *rule, u64 *reg_id);
+int mlx4_flow_detach(struct mlx4_dev *dev, u64 reg_id);
 #endif /* MLX4_DEVICE_H */
diff --git a/include/linux/mlx4/driver.h b/include/linux/mlx4/driver.h
index 5f1298b1b5ef..8dc485febc6b 100644
--- a/include/linux/mlx4/driver.h
+++ b/include/linux/mlx4/driver.h
@@ -37,6 +37,8 @@
 struct mlx4_dev;
+#define MLX4_MAC_MASK      0xffffffffffffULL
 enum mlx4_dev_event {
        MLX4_DEV_EVENT_CATASTROPHIC_ERROR,
        MLX4_DEV_EVENT_PORT_UP,
diff --git a/include/linux/net.h b/include/linux/net.h
index e9ac2df079ba..99276c3dc89a 100644
--- a/include/linux/net.h
+++ b/include/linux/net.h
@@ -72,6 +72,7 @@ struct net;
 #define SOCK_NOSPACE            2
 #define SOCK_PASSCRED           3
 #define SOCK_PASSSEC            4
+#define SOCK_EXTERNALLY_ALLOCATED 5
 #ifndef ARCH_HAS_SOCKET_TYPES
 /**
@@ -247,6 +248,7 @@ extern int	     sock_recvmsg(struct socket *sock, struct msghdr *msg,
                                  size_t size, int flags);
 extern int           sock_map_fd(struct socket *sock, int flags);
 extern struct socket *sockfd_lookup(int fd, int *err);
+extern struct socket *sock_from_file(struct file *file, int *err);
 #define              sockfd_put(sock) fput(sock->file)
 extern int           net_ratelimit(void);
diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h
index d94cb1431519..eb06e58bed0b 100644
--- a/include/linux/netdevice.h
+++ b/include/linux/netdevice.h
@@ -1046,10 +1046,9 @@ struct net_device {
         */
        char                    name[IFNAMSIZ];
-        struct pm_qos_request   pm_qos_req;
+        /* device name hash chain, please keep it close to name[] */
-        /* device name hash chain */
        struct hlist_node       name_hlist;
        /* snmp alias */
        char                    *ifalias;
@@ -1322,6 +1321,8 @@ struct net_device {
        /* group the device belongs to */
        int group;
+        struct pm_qos_request   pm_qos_req;
 };
 #define to_net_dev(d) container_of(d, struct net_device, dev)
@@ -1626,6 +1627,7 @@ extern int		dev_alloc_name(struct net_device *dev, const char *name);
 extern int              dev_open(struct net_device *dev);
 extern int              dev_close(struct net_device *dev);
 extern void             dev_disable_lro(struct net_device *dev);
+extern int              dev_loopback_xmit(struct sk_buff *newskb);
 extern int              dev_queue_xmit(struct sk_buff *skb);
 extern int              register_netdevice(struct net_device *dev);
 extern void             unregister_netdevice_queue(struct net_device *dev,
@@ -2108,7 +2110,12 @@ static inline int netif_set_real_num_rx_queues(struct net_device *dev,
 static inline int netif_copy_real_num_queues(struct net_device *to_dev,
                                             const struct net_device *from_dev)
 {
-        netif_set_real_num_tx_queues(to_dev, from_dev->real_num_tx_queues);
+        int err;
+        err = netif_set_real_num_tx_queues(to_dev,
+                                           from_dev->real_num_tx_queues);
+        if (err)
+                return err;
 #ifdef CONFIG_RPS
        return netif_set_real_num_rx_queues(to_dev,
                                            from_dev->real_num_rx_queues);
@@ -2117,6 +2124,9 @@ static inline int netif_copy_real_num_queues(struct net_device *to_dev,
 #endif
 }
+#define DEFAULT_MAX_NUM_RSS_QUEUES      (8)
+extern int netif_get_num_default_rss_queues(void);
 /* Use this variant when it is known for sure that it
 * is executing from hardware interrupt context or with hardware interrupts
 * disabled.
diff --git a/include/linux/netfilter.h b/include/linux/netfilter.h
index ff9c84c29b28..c613cf0d7884 100644
--- a/include/linux/netfilter.h
+++ b/include/linux/netfilter.h
@@ -94,6 +94,16 @@ static inline int nf_inet_addr_cmp(const union nf_inet_addr *a1,
               a1->all[3] == a2->all[3];
 }
+static inline void nf_inet_addr_mask(const union nf_inet_addr *a1,
+                                     union nf_inet_addr *result,
+                                     const union nf_inet_addr *mask)
+{
+        result->all[0] = a1->all[0] & mask->all[0];
+        result->all[1] = a1->all[1] & mask->all[1];
+        result->all[2] = a1->all[2] & mask->all[2];
+        result->all[3] = a1->all[3] & mask->all[3];
+}
 extern void netfilter_init(void);
 /* Largest hook number + 1 */
@@ -383,6 +393,22 @@ nf_nat_decode_session(struct sk_buff *skb, struct flowi *fl, u_int8_t family)
 extern void (*ip_ct_attach)(struct sk_buff *, struct sk_buff *) __rcu;
 extern void nf_ct_attach(struct sk_buff *, struct sk_buff *);
 extern void (*nf_ct_destroy)(struct nf_conntrack *) __rcu;
+struct nf_conn;
+struct nlattr;
+struct nfq_ct_hook {
+        size_t (*build_size)(const struct nf_conn *ct);
+        int (*build)(struct sk_buff *skb, struct nf_conn *ct);
+        int (*parse)(const struct nlattr *attr, struct nf_conn *ct);
+};
+extern struct nfq_ct_hook __rcu *nfq_ct_hook;
+struct nfq_ct_nat_hook {
+        void (*seq_adjust)(struct sk_buff *skb, struct nf_conn *ct,
+                           u32 ctinfo, int off);
+};
+extern struct nfq_ct_nat_hook __rcu *nfq_ct_nat_hook;
 #else
 static inline void nf_ct_attach(struct sk_buff *new, struct sk_buff *skb) {}
 #endif
diff --git a/include/linux/netfilter/Kbuild b/include/linux/netfilter/Kbuild
index 1697036336b6..874ae8f2706b 100644
--- a/include/linux/netfilter/Kbuild
+++ b/include/linux/netfilter/Kbuild
@@ -10,6 +10,7 @@ header-y += nfnetlink.h
 header-y += nfnetlink_acct.h
 header-y += nfnetlink_compat.h
 header-y += nfnetlink_conntrack.h
+header-y += nfnetlink_cthelper.h
 header-y += nfnetlink_cttimeout.h
 header-y += nfnetlink_log.h
 header-y += nfnetlink_queue.h
diff --git a/include/linux/netfilter/nf_conntrack_sip.h b/include/linux/netfilter/nf_conntrack_sip.h
index 0ce91d56a5f2..0dfc8b7210a3 100644
--- a/include/linux/netfilter/nf_conntrack_sip.h
+++ b/include/linux/netfilter/nf_conntrack_sip.h
@@ -2,6 +2,8 @@
 #define __NF_CONNTRACK_SIP_H__
 #ifdef __KERNEL__
+#include <net/netfilter/nf_conntrack_expect.h>
 #define SIP_PORT        5060
 #define SIP_TIMEOUT     3600
diff --git a/include/linux/netfilter/nfnetlink.h b/include/linux/netfilter/nfnetlink.h
index a1048c1587d1..18341cdb2443 100644
--- a/include/linux/netfilter/nfnetlink.h
+++ b/include/linux/netfilter/nfnetlink.h
@@ -50,7 +50,8 @@ struct nfgenmsg {
 #define NFNL_SUBSYS_IPSET               6
 #define NFNL_SUBSYS_ACCT                7
 #define NFNL_SUBSYS_CTNETLINK_TIMEOUT   8
-#define NFNL_SUBSYS_COUNT               9
+#define NFNL_SUBSYS_CTHELPER            9
+#define NFNL_SUBSYS_COUNT               10
 #ifdef __KERNEL__
diff --git a/include/linux/netfilter/nfnetlink_conntrack.h b/include/linux/netfilter/nfnetlink_conntrack.h
index e58e4b93c108..f649f7423ca2 100644
--- a/include/linux/netfilter/nfnetlink_conntrack.h
+++ b/include/linux/netfilter/nfnetlink_conntrack.h
@@ -7,6 +7,8 @@ enum cntl_msg_types {
        IPCTNL_MSG_CT_GET,
        IPCTNL_MSG_CT_DELETE,
        IPCTNL_MSG_CT_GET_CTRZERO,
+        IPCTNL_MSG_CT_GET_STATS_CPU,
+        IPCTNL_MSG_CT_GET_STATS,
        IPCTNL_MSG_MAX
 };
@@ -15,6 +17,7 @@ enum ctnl_exp_msg_types {
        IPCTNL_MSG_EXP_NEW,
        IPCTNL_MSG_EXP_GET,
        IPCTNL_MSG_EXP_DELETE,
+        IPCTNL_MSG_EXP_GET_STATS_CPU,
        IPCTNL_MSG_EXP_MAX
 };
@@ -191,6 +194,7 @@ enum ctattr_expect_nat {
 enum ctattr_help {
        CTA_HELP_UNSPEC,
        CTA_HELP_NAME,
+        CTA_HELP_INFO,
        __CTA_HELP_MAX
 };
 #define CTA_HELP_MAX (__CTA_HELP_MAX - 1)
@@ -202,4 +206,39 @@ enum ctattr_secctx {
 };
 #define CTA_SECCTX_MAX (__CTA_SECCTX_MAX - 1)
+enum ctattr_stats_cpu {
+        CTA_STATS_UNSPEC,
+        CTA_STATS_SEARCHED,
+        CTA_STATS_FOUND,
+        CTA_STATS_NEW,
+        CTA_STATS_INVALID,
+        CTA_STATS_IGNORE,
+        CTA_STATS_DELETE,
+        CTA_STATS_DELETE_LIST,
+        CTA_STATS_INSERT,
+        CTA_STATS_INSERT_FAILED,
+        CTA_STATS_DROP,
+        CTA_STATS_EARLY_DROP,
+        CTA_STATS_ERROR,
+        CTA_STATS_SEARCH_RESTART,
+        __CTA_STATS_MAX,
+};
+#define CTA_STATS_MAX (__CTA_STATS_MAX - 1)
+enum ctattr_stats_global {
+        CTA_STATS_GLOBAL_UNSPEC,
+        CTA_STATS_GLOBAL_ENTRIES,
+        __CTA_STATS_GLOBAL_MAX,
+};
+#define CTA_STATS_GLOBAL_MAX (__CTA_STATS_GLOBAL_MAX - 1)
+enum ctattr_expect_stats {
+        CTA_STATS_EXP_UNSPEC,
+        CTA_STATS_EXP_NEW,
+        CTA_STATS_EXP_CREATE,
+        CTA_STATS_EXP_DELETE,
+        __CTA_STATS_EXP_MAX,
+};
+#define CTA_STATS_EXP_MAX (__CTA_STATS_EXP_MAX - 1)
 #endif /* _IPCONNTRACK_NETLINK_H */
diff --git a/include/linux/netfilter/nfnetlink_cthelper.h b/include/linux/netfilter/nfnetlink_cthelper.h
new file mode 100644
index 000000000000..33659f6fad3e
--- /dev/null
+++ b/include/linux/netfilter/nfnetlink_cthelper.h
@@ -0,0 +1,55 @@
+#ifndef _NFNL_CTHELPER_H_
+#define _NFNL_CTHELPER_H_
+#define NFCT_HELPER_STATUS_DISABLED     0
+#define NFCT_HELPER_STATUS_ENABLED      1
+enum nfnl_acct_msg_types {
+        NFNL_MSG_CTHELPER_NEW,
+        NFNL_MSG_CTHELPER_GET,
+        NFNL_MSG_CTHELPER_DEL,
+        NFNL_MSG_CTHELPER_MAX
+};
+enum nfnl_cthelper_type {
+        NFCTH_UNSPEC,
+        NFCTH_NAME,
+        NFCTH_TUPLE,
+        NFCTH_QUEUE_NUM,
+        NFCTH_POLICY,
+        NFCTH_PRIV_DATA_LEN,
+        NFCTH_STATUS,
+        __NFCTH_MAX
+};
+#define NFCTH_MAX (__NFCTH_MAX - 1)
+enum nfnl_cthelper_policy_type {
+        NFCTH_POLICY_SET_UNSPEC,
+        NFCTH_POLICY_SET_NUM,
+        NFCTH_POLICY_SET,
+        NFCTH_POLICY_SET1       = NFCTH_POLICY_SET,
+        NFCTH_POLICY_SET2,
+        NFCTH_POLICY_SET3,
+        NFCTH_POLICY_SET4,
+        __NFCTH_POLICY_SET_MAX
+};
+#define NFCTH_POLICY_SET_MAX (__NFCTH_POLICY_SET_MAX - 1)
+enum nfnl_cthelper_pol_type {
+        NFCTH_POLICY_UNSPEC,
+        NFCTH_POLICY_NAME,
+        NFCTH_POLICY_EXPECT_MAX,
+        NFCTH_POLICY_EXPECT_TIMEOUT,
+        __NFCTH_POLICY_MAX
+};
+#define NFCTH_POLICY_MAX (__NFCTH_POLICY_MAX - 1)
+enum nfnl_cthelper_tuple_type {
+        NFCTH_TUPLE_UNSPEC,
+        NFCTH_TUPLE_L3PROTONUM,
+        NFCTH_TUPLE_L4PROTONUM,
+        __NFCTH_TUPLE_MAX,
+};
+#define NFCTH_TUPLE_MAX (__NFCTH_TUPLE_MAX - 1)
+#endif /* _NFNL_CTHELPER_H */
diff --git a/include/linux/netfilter/nfnetlink_queue.h b/include/linux/netfilter/nfnetlink_queue.h
index 24b32e6c009e..3b1c1360aedf 100644
--- a/include/linux/netfilter/nfnetlink_queue.h
+++ b/include/linux/netfilter/nfnetlink_queue.h
@@ -42,6 +42,8 @@ enum nfqnl_attr_type {
        NFQA_IFINDEX_PHYSOUTDEV,        /* __u32 ifindex */
        NFQA_HWADDR,                    /* nfqnl_msg_packet_hw */
        NFQA_PAYLOAD,                   /* opaque data payload */
+        NFQA_CT,                        /* nf_conntrack_netlink.h */
+        NFQA_CT_INFO,                   /* enum ip_conntrack_info */
        __NFQA_MAX
 };
@@ -84,8 +86,15 @@ enum nfqnl_attr_config {
        NFQA_CFG_CMD,                   /* nfqnl_msg_config_cmd */
        NFQA_CFG_PARAMS,                /* nfqnl_msg_config_params */
        NFQA_CFG_QUEUE_MAXLEN,          /* __u32 */
+        NFQA_CFG_MASK,                  /* identify which flags to change */
+        NFQA_CFG_FLAGS,                 /* value of these flags (__u32) */
        __NFQA_CFG_MAX
 };
 #define NFQA_CFG_MAX (__NFQA_CFG_MAX-1)
+/* Flags for NFQA_CFG_FLAGS */
+#define NFQA_CFG_F_FAIL_OPEN                    (1 << 0)
+#define NFQA_CFG_F_CONNTRACK                    (1 << 1)
+#define NFQA_CFG_F_MAX                          (1 << 2)
 #endif /* _NFNETLINK_QUEUE_H */
diff --git a/include/linux/netfilter/xt_connlimit.h b/include/linux/netfilter/xt_connlimit.h
index d1366f05d1b2..f1656096121e 100644
--- a/include/linux/netfilter/xt_connlimit.h
+++ b/include/linux/netfilter/xt_connlimit.h
@@ -22,13 +22,8 @@ struct xt_connlimit_info {
 #endif
        };
        unsigned int limit;
-        union {
+        /* revision 1 */
-                /* revision 0 */
+        __u32 flags;
-                unsigned int inverse;
-                /* revision 1 */
-                __u32 flags;
-        };
        /* Used internally by the kernel */
        struct xt_connlimit_data *data __attribute__((aligned(8)));
diff --git a/include/linux/netfilter/xt_recent.h b/include/linux/netfilter/xt_recent.h
index 83318e01425e..6ef36c113e89 100644
--- a/include/linux/netfilter/xt_recent.h
+++ b/include/linux/netfilter/xt_recent.h
@@ -32,4 +32,14 @@ struct xt_recent_mtinfo {
        __u8 side;
 };
+struct xt_recent_mtinfo_v1 {
+        __u32 seconds;
+        __u32 hit_count;
+        __u8 check_set;
+        __u8 invert;
+        char name[XT_RECENT_NAME_LEN];
+        __u8 side;
+        union nf_inet_addr mask;
+};
 #endif /* _LINUX_NETFILTER_XT_RECENT_H */
diff --git a/include/linux/netfilter_ipv4.h b/include/linux/netfilter_ipv4.h
index fa0946c549d3..e2b12801378d 100644
--- a/include/linux/netfilter_ipv4.h
+++ b/include/linux/netfilter_ipv4.h
@@ -66,6 +66,7 @@ enum nf_ip_hook_priorities {
        NF_IP_PRI_SECURITY = 50,
        NF_IP_PRI_NAT_SRC = 100,
        NF_IP_PRI_SELINUX_LAST = 225,
+        NF_IP_PRI_CONNTRACK_HELPER = 300,
        NF_IP_PRI_CONNTRACK_CONFIRM = INT_MAX,
        NF_IP_PRI_LAST = INT_MAX,
 };
diff --git a/include/linux/netfilter_ipv4/Kbuild b/include/linux/netfilter_ipv4/Kbuild
index c61b8fb1a9ef..8ba0c5b72ea9 100644
--- a/include/linux/netfilter_ipv4/Kbuild
+++ b/include/linux/netfilter_ipv4/Kbuild
@@ -5,7 +5,6 @@ header-y += ipt_LOG.h
 header-y += ipt_REJECT.h
 header-y += ipt_TTL.h
 header-y += ipt_ULOG.h
-header-y += ipt_addrtype.h
 header-y += ipt_ah.h
 header-y += ipt_ecn.h
 header-y += ipt_ttl.h
diff --git a/include/linux/netfilter_ipv4/ipt_addrtype.h b/include/linux/netfilter_ipv4/ipt_addrtype.h
deleted file mode 100644
index 0da42237c8da..000000000000
--- a/include/linux/netfilter_ipv4/ipt_addrtype.h
+++ /dev/null
@@ -1,27 +0,0 @@
-#ifndef _IPT_ADDRTYPE_H
-#define _IPT_ADDRTYPE_H
-#include <linux/types.h>
-enum {
-        IPT_ADDRTYPE_INVERT_SOURCE      = 0x0001,
-        IPT_ADDRTYPE_INVERT_DEST        = 0x0002,
-        IPT_ADDRTYPE_LIMIT_IFACE_IN     = 0x0004,
-        IPT_ADDRTYPE_LIMIT_IFACE_OUT    = 0x0008,
-};
-struct ipt_addrtype_info_v1 {
-        __u16   source;         /* source-type mask */
-        __u16   dest;           /* dest-type mask */
-        __u32   flags;
-};
-/* revision 0 */
-struct ipt_addrtype_info {
-        __u16   source;         /* source-type mask */
-        __u16   dest;           /* dest-type mask */
-        __u32   invert_source;
-        __u32   invert_dest;
-};
-#endif
diff --git a/include/linux/netfilter_ipv6.h b/include/linux/netfilter_ipv6.h
index 57c025127f1d..7c8a513ce7a3 100644
--- a/include/linux/netfilter_ipv6.h
+++ b/include/linux/netfilter_ipv6.h
@@ -71,6 +71,7 @@ enum nf_ip6_hook_priorities {
        NF_IP6_PRI_SECURITY = 50,
        NF_IP6_PRI_NAT_SRC = 100,
        NF_IP6_PRI_SELINUX_LAST = 225,
+        NF_IP6_PRI_CONNTRACK_HELPER = 300,
        NF_IP6_PRI_LAST = INT_MAX,
 };
diff --git a/include/linux/netlink.h b/include/linux/netlink.h
index 0f628ffa420c..f74dd133788f 100644
--- a/include/linux/netlink.h
+++ b/include/linux/netlink.h
@@ -174,11 +174,17 @@ struct netlink_skb_parms {
 extern void netlink_table_grab(void);
 extern void netlink_table_ungrab(void);
-extern struct sock *netlink_kernel_create(struct net *net,
+/* optional Netlink kernel configuration parameters */
-                                          int unit,unsigned int groups,
+struct netlink_kernel_cfg {
-                                          void (*input)(struct sk_buff *skb),
+        unsigned int    groups;
-                                          struct mutex *cb_mutex,
+        void            (*input)(struct sk_buff *skb);
-                                          struct module *module);
+        struct mutex    *cb_mutex;
+        void            (*bind)(int group);
+};
+extern struct sock *netlink_kernel_create(struct net *net, int unit,
+                                          struct module *module,
+                                          struct netlink_kernel_cfg *cfg);
 extern void netlink_kernel_release(struct sock *sk);
 extern int __netlink_change_ngroups(struct sock *sk, unsigned int groups);
 extern int netlink_change_ngroups(struct sock *sk, unsigned int groups);
@@ -241,14 +247,6 @@ struct netlink_notify {
 struct nlmsghdr *
 __nlmsg_put(struct sk_buff *skb, u32 pid, u32 seq, int type, int len, int flags);
-#define NLMSG_NEW(skb, pid, seq, type, len, flags) \
-({      if (unlikely(skb_tailroom(skb) < (int)NLMSG_SPACE(len))) \
-                goto nlmsg_failure; \
-        __nlmsg_put(skb, pid, seq, type, len, flags); })
-#define NLMSG_PUT(skb, pid, seq, type, len) \
-        NLMSG_NEW(skb, pid, seq, type, len, 0)
 struct netlink_dump_control {
        int (*dump)(struct sk_buff *skb, struct netlink_callback *);
        int (*done)(struct netlink_callback*);
diff --git a/include/linux/netpoll.h b/include/linux/netpoll.h
index 5dfa091c3347..28f5389c924b 100644
--- a/include/linux/netpoll.h
+++ b/include/linux/netpoll.h
@@ -43,7 +43,7 @@ struct netpoll_info {
 void netpoll_send_udp(struct netpoll *np, const char *msg, int len);
 void netpoll_print_options(struct netpoll *np);
 int netpoll_parse_options(struct netpoll *np, char *opt);
-int __netpoll_setup(struct netpoll *np);
+int __netpoll_setup(struct netpoll *np, struct net_device *ndev);
 int netpoll_setup(struct netpoll *np);
 int netpoll_trap(void);
 void netpoll_set_trap(int trap);
diff --git a/include/linux/nfc.h b/include/linux/nfc.h
index 0ae9b5857c83..6189f27e305b 100644
--- a/include/linux/nfc.h
+++ b/include/linux/nfc.h
@@ -56,6 +56,10 @@
 *      %NFC_ATTR_PROTOCOLS)
 * @NFC_EVENT_DEVICE_REMOVED: event emitted when a device is removed
 *      (it sends %NFC_ATTR_DEVICE_INDEX)
+ * @NFC_EVENT_TM_ACTIVATED: event emitted when the adapter is activated in
+ *      target mode.
+ * @NFC_EVENT_DEVICE_DEACTIVATED: event emitted when the adapter is deactivated
+ *      from target mode.
 */
 enum nfc_commands {
        NFC_CMD_UNSPEC,
@@ -71,6 +75,8 @@ enum nfc_commands {
        NFC_EVENT_DEVICE_ADDED,
        NFC_EVENT_DEVICE_REMOVED,
        NFC_EVENT_TARGET_LOST,
+        NFC_EVENT_TM_ACTIVATED,
+        NFC_EVENT_TM_DEACTIVATED,
 /* private: internal use only */
        __NFC_CMD_AFTER_LAST
 };
@@ -94,6 +100,8 @@ enum nfc_commands {
 * @NFC_ATTR_TARGET_SENSF_RES: NFC-F targets extra information, max 18 bytes
 * @NFC_ATTR_COMM_MODE: Passive or active mode
 * @NFC_ATTR_RF_MODE: Initiator or target
+ * @NFC_ATTR_IM_PROTOCOLS: Initiator mode protocols to poll for
+ * @NFC_ATTR_TM_PROTOCOLS: Target mode protocols to listen for
 */
 enum nfc_attrs {
        NFC_ATTR_UNSPEC,
@@ -109,6 +117,8 @@ enum nfc_attrs {
        NFC_ATTR_COMM_MODE,
        NFC_ATTR_RF_MODE,
        NFC_ATTR_DEVICE_POWERED,
+        NFC_ATTR_IM_PROTOCOLS,
+        NFC_ATTR_TM_PROTOCOLS,
 /* private: internal use only */
        __NFC_ATTR_AFTER_LAST
 };
@@ -118,6 +128,7 @@ enum nfc_attrs {
 #define NFC_NFCID1_MAXSIZE 10
 #define NFC_SENSB_RES_MAXSIZE 12
 #define NFC_SENSF_RES_MAXSIZE 18
+#define NFC_GB_MAXSIZE        48
 /* NFC protocols */
 #define NFC_PROTO_JEWEL         1
@@ -125,8 +136,9 @@ enum nfc_attrs {
 #define NFC_PROTO_FELICA        3
 #define NFC_PROTO_ISO14443      4
 #define NFC_PROTO_NFC_DEP       5
+#define NFC_PROTO_ISO14443_B    6
-#define NFC_PROTO_MAX           6
+#define NFC_PROTO_MAX           7
 /* NFC communication modes */
 #define NFC_COMM_ACTIVE  0
@@ -135,13 +147,15 @@ enum nfc_attrs {
 /* NFC RF modes */
 #define NFC_RF_INITIATOR 0
 #define NFC_RF_TARGET    1
+#define NFC_RF_NONE      2
 /* NFC protocols masks used in bitsets */
-#define NFC_PROTO_JEWEL_MASK    (1 << NFC_PROTO_JEWEL)
+#define NFC_PROTO_JEWEL_MASK      (1 << NFC_PROTO_JEWEL)
-#define NFC_PROTO_MIFARE_MASK   (1 << NFC_PROTO_MIFARE)
+#define NFC_PROTO_MIFARE_MASK     (1 << NFC_PROTO_MIFARE)
-#define NFC_PROTO_FELICA_MASK   (1 << NFC_PROTO_FELICA)
+#define NFC_PROTO_FELICA_MASK     (1 << NFC_PROTO_FELICA)
-#define NFC_PROTO_ISO14443_MASK (1 << NFC_PROTO_ISO14443)
+#define NFC_PROTO_ISO14443_MASK   (1 << NFC_PROTO_ISO14443)
-#define NFC_PROTO_NFC_DEP_MASK  (1 << NFC_PROTO_NFC_DEP)
+#define NFC_PROTO_NFC_DEP_MASK    (1 << NFC_PROTO_NFC_DEP)
+#define NFC_PROTO_ISO14443_B_MASK (1 << NFC_PROTO_ISO14443_B)
 struct sockaddr_nfc {
        sa_family_t sa_family;
diff --git a/include/linux/nl80211.h b/include/linux/nl80211.h
index a6959f72745e..2f3878806403 100644
--- a/include/linux/nl80211.h
+++ b/include/linux/nl80211.h
@@ -170,6 +170,8 @@
 *      %NL80211_ATTR_CIPHER_GROUP, %NL80211_ATTR_WPA_VERSIONS,
 *      %NL80211_ATTR_AKM_SUITES, %NL80211_ATTR_PRIVACY,
 *      %NL80211_ATTR_AUTH_TYPE and %NL80211_ATTR_INACTIVITY_TIMEOUT.
+ *      The channel to use can be set on the interface or be given using the
+ *      %NL80211_ATTR_WIPHY_FREQ and %NL80211_ATTR_WIPHY_CHANNEL_TYPE attrs.
 * @NL80211_CMD_NEW_BEACON: old alias for %NL80211_CMD_START_AP
 * @NL80211_CMD_STOP_AP: Stop AP operation on the given interface
 * @NL80211_CMD_DEL_BEACON: old alias for %NL80211_CMD_STOP_AP
@@ -275,6 +277,12 @@
 * @NL80211_CMD_NEW_SURVEY_RESULTS: survey data notification (as a reply to
 *      NL80211_CMD_GET_SURVEY and on the "scan" multicast group)
 *
+ * @NL80211_CMD_SET_PMKSA: Add a PMKSA cache entry, using %NL80211_ATTR_MAC
+ *      (for the BSSID) and %NL80211_ATTR_PMKID.
+ * @NL80211_CMD_DEL_PMKSA: Delete a PMKSA cache entry, using %NL80211_ATTR_MAC
+ *      (for the BSSID) and %NL80211_ATTR_PMKID.
+ * @NL80211_CMD_FLUSH_PMKSA: Flush all PMKSA cache entries.
+ *
 * @NL80211_CMD_REG_CHANGE: indicates to userspace the regulatory domain
 *      has been changed and provides details of the request information
 *      that caused the change such as who initiated the regulatory request
@@ -454,6 +462,10 @@
 *      the frame.
 * @NL80211_CMD_ACTION_TX_STATUS: Alias for @NL80211_CMD_FRAME_TX_STATUS for
 *      backward compatibility.
+ *
+ * @NL80211_CMD_SET_POWER_SAVE: Set powersave, using %NL80211_ATTR_PS_STATE
+ * @NL80211_CMD_GET_POWER_SAVE: Get powersave status in %NL80211_ATTR_PS_STATE
+ *
 * @NL80211_CMD_SET_CQM: Connection quality monitor configuration. This command
 *      is used to configure connection quality monitoring notification trigger
 *      levels.
@@ -759,6 +771,9 @@ enum nl80211_commands {
 * @NL80211_ATTR_IFNAME: network interface name
 * @NL80211_ATTR_IFTYPE: type of virtual interface, see &enum nl80211_iftype
 *
+ * @NL80211_ATTR_WDEV: wireless device identifier, used for pseudo-devices
+ *      that don't have a netdev (u64)
+ *
 * @NL80211_ATTR_MAC: MAC address (various uses)
 *
 * @NL80211_ATTR_KEY_DATA: (temporal) key data; for TKIP this consists of
@@ -769,6 +784,13 @@ enum nl80211_commands {
 *      section 7.3.2.25.1, e.g. 0x000FAC04)
 * @NL80211_ATTR_KEY_SEQ: transmit key sequence number (IV/PN) for TKIP and
 *      CCMP keys, each six bytes in little endian
+ * @NL80211_ATTR_KEY_DEFAULT: Flag attribute indicating the key is default key
+ * @NL80211_ATTR_KEY_DEFAULT_MGMT: Flag attribute indicating the key is the
+ *      default management key
+ * @NL80211_ATTR_CIPHER_SUITES_PAIRWISE: For crypto settings for connect or
+ *      other commands, indicates which pairwise cipher suites are used
+ * @NL80211_ATTR_CIPHER_SUITE_GROUP: For crypto settings for connect or
+ *      other commands, indicates which group cipher suite is used
 *
 * @NL80211_ATTR_BEACON_INTERVAL: beacon interval in TU
 * @NL80211_ATTR_DTIM_PERIOD: DTIM period for beaconing
@@ -1004,6 +1026,8 @@ enum nl80211_commands {
 * @NL80211_ATTR_ACK: Flag attribute indicating that the frame was
 *      acknowledged by the recipient.
 *
+ * @NL80211_ATTR_PS_STATE: powersave state, using &enum nl80211_ps_state values.
+ *
 * @NL80211_ATTR_CQM: connection quality monitor configuration in a
 *      nested attribute with %NL80211_ATTR_CQM_* sub-attributes.
 *
@@ -1061,7 +1085,7 @@ enum nl80211_commands {
 *      flag isn't set, the frame will be rejected. This is also used as an
 *      nl80211 capability flag.
 *
- * @NL80211_ATTR_BSS_HTOPMODE: HT operation mode (u16)
+ * @NL80211_ATTR_BSS_HT_OPMODE: HT operation mode (u16)
 *
 * @NL80211_ATTR_KEY_DEFAULT_TYPES: A nested attribute containing flags
 *      attributes, specifying what a key should be set as default as.
@@ -1085,10 +1109,10 @@ enum nl80211_commands {
 *      indicate which WoW triggers should be enabled. This is also
 *      used by %NL80211_CMD_GET_WOWLAN to get the currently enabled WoWLAN
 *      triggers.
+ *
 * @NL80211_ATTR_SCHED_SCAN_INTERVAL: Interval between scheduled scan
 *      cycles, in msecs.
+ *
 * @NL80211_ATTR_SCHED_SCAN_MATCH: Nested attribute with one or more
 *      sets of attributes to match during scheduled scans.  Only BSSs
 *      that match any of the sets will be reported.  These are
@@ -1115,7 +1139,7 @@ enum nl80211_commands {
 *      are managed in software: interfaces of these types aren't subject to
 *      any restrictions in their number or combinations.
 *
- * @%NL80211_ATTR_REKEY_DATA: nested attribute containing the information
+ * @NL80211_ATTR_REKEY_DATA: nested attribute containing the information
 *      necessary for GTK rekeying in the device, see &enum nl80211_rekey_data.
 *
 * @NL80211_ATTR_SCAN_SUPP_RATES: rates per to be advertised as supported in scan,
@@ -1182,7 +1206,6 @@ enum nl80211_commands {
 * @NL80211_ATTR_FEATURE_FLAGS: This u32 attribute contains flags from
 *      &enum nl80211_feature_flags and is advertised in wiphy information.
 * @NL80211_ATTR_PROBE_RESP_OFFLOAD: Indicates that the HW responds to probe
- *
 *      requests while operating in AP-mode.
 *      This attribute holds a bitmap of the supported protocols for
 *      offloading (see &enum nl80211_probe_resp_offload_support_attr).
@@ -1222,6 +1245,12 @@ enum nl80211_commands {
 * @NL80211_ATTR_BG_SCAN_PERIOD: Background scan period in seconds
 *      or 0 to disable background scan.
 *
+ * @NL80211_ATTR_USER_REG_HINT_TYPE: type of regulatory hint passed from
+ *      userspace. If unset it is assumed the hint comes directly from
+ *      a user. If set code could specify exactly what type of source
+ *      was used to provide the hint. For the different types of
+ *      allowed user regulatory hints see nl80211_user_reg_hint_type.
+ *
 * @NL80211_ATTR_MAX: highest attribute number currently defined
 * @__NL80211_ATTR_AFTER_LAST: internal use
 */
@@ -1473,6 +1502,10 @@ enum nl80211_attrs {
        NL80211_ATTR_BG_SCAN_PERIOD,
+        NL80211_ATTR_WDEV,
+        NL80211_ATTR_USER_REG_HINT_TYPE,
        /* add attributes here, update the policy in nl80211.c */
        __NL80211_ATTR_AFTER_LAST,
@@ -1520,6 +1553,13 @@ enum nl80211_attrs {
 #define NL80211_MAX_NR_CIPHER_SUITES            5
 #define NL80211_MAX_NR_AKM_SUITES               2
+#define NL80211_MIN_REMAIN_ON_CHANNEL_TIME      10
+/* default RSSI threshold for scan results if none specified. */
+#define NL80211_SCAN_RSSI_THOLD_OFF             -300
+#define NL80211_CQM_TXE_MAX_INTVL               1800
 /**
 * enum nl80211_iftype - (virtual) interface types
 *
@@ -1613,12 +1653,20 @@ struct nl80211_sta_flag_update {
 *
 * These attribute types are used with %NL80211_STA_INFO_TXRATE
 * when getting information about the bitrate of a station.
+ * There are 2 attributes for bitrate, a legacy one that represents
+ * a 16-bit value, and new one that represents a 32-bit value.
+ * If the rate value fits into 16 bit, both attributes are reported
+ * with the same value. If the rate is too high to fit into 16 bits
+ * (>6.5535Gbps) only 32-bit attribute is included.
+ * User space tools encouraged to use the 32-bit attribute and fall
+ * back to the 16-bit one for compatibility with older kernels.
 *
 * @__NL80211_RATE_INFO_INVALID: attribute number 0 is reserved
 * @NL80211_RATE_INFO_BITRATE: total bitrate (u16, 100kbit/s)
 * @NL80211_RATE_INFO_MCS: mcs index for 802.11n (u8)
 * @NL80211_RATE_INFO_40_MHZ_WIDTH: 40 Mhz dualchannel bitrate
 * @NL80211_RATE_INFO_SHORT_GI: 400ns guard interval
+ * @NL80211_RATE_INFO_BITRATE32: total bitrate (u32, 100kbit/s)
 * @NL80211_RATE_INFO_MAX: highest rate_info number currently defined
 * @__NL80211_RATE_INFO_AFTER_LAST: internal use
 */
@@ -1628,6 +1676,7 @@ enum nl80211_rate_info {
        NL80211_RATE_INFO_MCS,
        NL80211_RATE_INFO_40_MHZ_WIDTH,
        NL80211_RATE_INFO_SHORT_GI,
+        NL80211_RATE_INFO_BITRATE32,
        /* keep last */
        __NL80211_RATE_INFO_AFTER_LAST,
@@ -1788,6 +1837,9 @@ enum nl80211_mpath_info {
 * @NL80211_BAND_ATTR_HT_CAPA: HT capabilities, as in the HT information IE
 * @NL80211_BAND_ATTR_HT_AMPDU_FACTOR: A-MPDU factor, as in 11n
 * @NL80211_BAND_ATTR_HT_AMPDU_DENSITY: A-MPDU density, as in 11n
+ * @NL80211_BAND_ATTR_VHT_MCS_SET: 32-byte attribute containing the MCS set as
+ *      defined in 802.11ac
+ * @NL80211_BAND_ATTR_VHT_CAPA: VHT capabilities, as in the HT information IE
 * @NL80211_BAND_ATTR_MAX: highest band attribute currently defined
 * @__NL80211_BAND_ATTR_AFTER_LAST: internal use
 */
@@ -1801,6 +1853,9 @@ enum nl80211_band_attr {
        NL80211_BAND_ATTR_HT_AMPDU_FACTOR,
        NL80211_BAND_ATTR_HT_AMPDU_DENSITY,
+        NL80211_BAND_ATTR_VHT_MCS_SET,
+        NL80211_BAND_ATTR_VHT_CAPA,
        /* keep last */
        __NL80211_BAND_ATTR_AFTER_LAST,
        NL80211_BAND_ATTR_MAX = __NL80211_BAND_ATTR_AFTER_LAST - 1
@@ -1952,6 +2007,8 @@ enum nl80211_reg_rule_attr {
 * @__NL80211_SCHED_SCAN_MATCH_ATTR_INVALID: attribute number 0 is reserved
 * @NL80211_SCHED_SCAN_MATCH_ATTR_SSID: SSID to be used for matching,
 * only report BSS with matching SSID.
+ * @NL80211_SCHED_SCAN_MATCH_ATTR_RSSI: RSSI threshold (in dBm) for reporting a
+ *      BSS in scan results. Filtering is turned off if not specified.
 * @NL80211_SCHED_SCAN_MATCH_ATTR_MAX: highest scheduled scan filter
 *      attribute number currently defined
 * @__NL80211_SCHED_SCAN_MATCH_ATTR_AFTER_LAST: internal use
@@ -1959,7 +2016,8 @@ enum nl80211_reg_rule_attr {
 enum nl80211_sched_scan_match_attr {
        __NL80211_SCHED_SCAN_MATCH_ATTR_INVALID,
-        NL80211_ATTR_SCHED_SCAN_MATCH_SSID,
+        NL80211_SCHED_SCAN_MATCH_ATTR_SSID,
+        NL80211_SCHED_SCAN_MATCH_ATTR_RSSI,
        /* keep last */
        __NL80211_SCHED_SCAN_MATCH_ATTR_AFTER_LAST,
@@ -1967,6 +2025,9 @@ enum nl80211_sched_scan_match_attr {
                __NL80211_SCHED_SCAN_MATCH_ATTR_AFTER_LAST - 1
 };
+/* only for backward compatibility */
+#define NL80211_ATTR_SCHED_SCAN_MATCH_SSID NL80211_SCHED_SCAN_MATCH_ATTR_SSID
 /**
 * enum nl80211_reg_rule_flags - regulatory rule flags
 *
@@ -2008,6 +2069,26 @@ enum nl80211_dfs_regions {
 };
 /**
+ * enum nl80211_user_reg_hint_type - type of user regulatory hint
+ *
+ * @NL80211_USER_REG_HINT_USER: a user sent the hint. This is always
+ *      assumed if the attribute is not set.
+ * @NL80211_USER_REG_HINT_CELL_BASE: the hint comes from a cellular
+ *      base station. Device drivers that have been tested to work
+ *      properly to support this type of hint can enable these hints
+ *      by setting the NL80211_FEATURE_CELL_BASE_REG_HINTS feature
+ *      capability on the struct wiphy. The wireless core will
+ *      ignore all cell base station hints until at least one device
+ *      present has been registered with the wireless core that
+ *      has listed NL80211_FEATURE_CELL_BASE_REG_HINTS as a
+ *      supported feature.
+ */
+enum nl80211_user_reg_hint_type {
+        NL80211_USER_REG_HINT_USER      = 0,
+        NL80211_USER_REG_HINT_CELL_BASE = 1,
+};
+/**
 * enum nl80211_survey_info - survey information
 *
 * These attribute types are used with %NL80211_ATTR_SURVEY_INFO
@@ -2086,78 +2167,91 @@ enum nl80211_mntr_flags {
 * @__NL80211_MESHCONF_INVALID: internal use
 *
 * @NL80211_MESHCONF_RETRY_TIMEOUT: specifies the initial retry timeout in
- * millisecond units, used by the Peer Link Open message
+ *      millisecond units, used by the Peer Link Open message
 *
 * @NL80211_MESHCONF_CONFIRM_TIMEOUT: specifies the initial confirm timeout, in
- * millisecond units, used by the peer link management to close a peer link
+ *      millisecond units, used by the peer link management to close a peer link
 *
 * @NL80211_MESHCONF_HOLDING_TIMEOUT: specifies the holding timeout, in
- * millisecond units
+ *      millisecond units
 *
 * @NL80211_MESHCONF_MAX_PEER_LINKS: maximum number of peer links allowed
- * on this mesh interface
+ *      on this mesh interface
 *
 * @NL80211_MESHCONF_MAX_RETRIES: specifies the maximum number of peer link
- * open retries that can be sent to establish a new peer link instance in a
+ *      open retries that can be sent to establish a new peer link instance in a
- * mesh
+ *      mesh
 *
 * @NL80211_MESHCONF_TTL: specifies the value of TTL field set at a source mesh
- * point.
+ *      point.
 *
 * @NL80211_MESHCONF_AUTO_OPEN_PLINKS: whether we should automatically
- * open peer links when we detect compatible mesh peers.
+ *      open peer links when we detect compatible mesh peers.
 *
 * @NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES: the number of action frames
- * containing a PREQ that an MP can send to a particular destination (path
+ *      containing a PREQ that an MP can send to a particular destination (path
- * target)
+ *      target)
 *
 * @NL80211_MESHCONF_PATH_REFRESH_TIME: how frequently to refresh mesh paths
- * (in milliseconds)
+ *      (in milliseconds)
 *
 * @NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT: minimum length of time to wait
- * until giving up on a path discovery (in milliseconds)
+ *      until giving up on a path discovery (in milliseconds)
 *
 * @NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT: The time (in TUs) for which mesh
- * points receiving a PREQ shall consider the forwarding information from the
+ *      points receiving a PREQ shall consider the forwarding information from
- * root to be valid. (TU = time unit)
+ *      the root to be valid. (TU = time unit)
 *
 * @NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL: The minimum interval of time (in
- * TUs) during which an MP can send only one action frame containing a PREQ
+ *      TUs) during which an MP can send only one action frame containing a PREQ
- * reference element
+ *      reference element
 *
 * @NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME: The interval of time (in TUs)
- * that it takes for an HWMP information element to propagate across the mesh
+ *      that it takes for an HWMP information element to propagate across the
+ *      mesh
 *
 * @NL80211_MESHCONF_HWMP_ROOTMODE: whether root mode is enabled or not
 *
 * @NL80211_MESHCONF_ELEMENT_TTL: specifies the value of TTL field set at a
- * source mesh point for path selection elements.
+ *      source mesh point for path selection elements.
 *
 * @NL80211_MESHCONF_HWMP_RANN_INTERVAL:  The interval of time (in TUs) between
- * root announcements are transmitted.
+ *      root announcements are transmitted.
 *
 * @NL80211_MESHCONF_GATE_ANNOUNCEMENTS: Advertise that this mesh station has
- * access to a broader network beyond the MBSS.  This is done via Root
+ *      access to a broader network beyond the MBSS.  This is done via Root
- * Announcement frames.
+ *      Announcement frames.
 *
 * @NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL: The minimum interval of time (in
- * TUs) during which a mesh STA can send only one Action frame containing a
+ *      TUs) during which a mesh STA can send only one Action frame containing a
- * PERR element.
+ *      PERR element.
 *
 * @NL80211_MESHCONF_FORWARDING: set Mesh STA as forwarding or non-forwarding
- * or forwarding entity (default is TRUE - forwarding entity)
+ *      or forwarding entity (default is TRUE - forwarding entity)
 *
 * @NL80211_MESHCONF_RSSI_THRESHOLD: RSSI threshold in dBm. This specifies the
- * threshold for average signal strength of candidate station to establish
+ *      threshold for average signal strength of candidate station to establish
- * a peer link.
+ *      a peer link.
- *
- * @NL80211_MESHCONF_ATTR_MAX: highest possible mesh configuration attribute
 *
 * @NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR: maximum number of neighbors
- * to synchronize to for 11s default synchronization method (see 11C.12.2.2)
+ *      to synchronize to for 11s default synchronization method
+ *      (see 11C.12.2.2)
 *
 * @NL80211_MESHCONF_HT_OPMODE: set mesh HT protection mode.
 *
+ * @NL80211_MESHCONF_ATTR_MAX: highest possible mesh configuration attribute
+ *
+ * @NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT: The time (in TUs) for
+ *      which mesh STAs receiving a proactive PREQ shall consider the forwarding
+ *      information to the root mesh STA to be valid.
+ *
+ * @NL80211_MESHCONF_HWMP_ROOT_INTERVAL: The interval of time (in TUs) between
+ *      proactive PREQs are transmitted.
+ *
+ * @NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL: The minimum interval of time
+ *      (in TUs) during which a mesh STA can send only one Action frame
+ *      containing a PREQ element for root path confirmation.
+ *
 * @__NL80211_MESHCONF_ATTR_AFTER_LAST: internal use
 */
 enum nl80211_meshconf_params {
@@ -2184,6 +2278,9 @@ enum nl80211_meshconf_params {
        NL80211_MESHCONF_RSSI_THRESHOLD,
        NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR,
        NL80211_MESHCONF_HT_OPMODE,
+        NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT,
+        NL80211_MESHCONF_HWMP_ROOT_INTERVAL,
+        NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL,
        /* keep last */
        __NL80211_MESHCONF_ATTR_AFTER_LAST,
@@ -2199,34 +2296,36 @@ enum nl80211_meshconf_params {
 * @__NL80211_MESH_SETUP_INVALID: Internal use
 *
 * @NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL: Enable this option to use a
- * vendor specific path selection algorithm or disable it to use the default
+ *      vendor specific path selection algorithm or disable it to use the
- * HWMP.
+ *      default HWMP.
 *
 * @NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC: Enable this option to use a
- * vendor specific path metric or disable it to use the default Airtime
+ *      vendor specific path metric or disable it to use the default Airtime
- * metric.
+ *      metric.
 *
 * @NL80211_MESH_SETUP_IE: Information elements for this mesh, for instance, a
- * robust security network ie, or a vendor specific information element that
+ *      robust security network ie, or a vendor specific information element
- * vendors will use to identify the path selection methods and metrics in use.
+ *      that vendors will use to identify the path selection methods and
+ *      metrics in use.
 *
 * @NL80211_MESH_SETUP_USERSPACE_AUTH: Enable this option if an authentication
- * daemon will be authenticating mesh candidates.
+ *      daemon will be authenticating mesh candidates.
 *
 * @NL80211_MESH_SETUP_USERSPACE_AMPE: Enable this option if an authentication
- * daemon will be securing peer link frames.  AMPE is a secured version of Mesh
+ *      daemon will be securing peer link frames.  AMPE is a secured version of
- * Peering Management (MPM) and is implemented with the assistance of a
+ *      Mesh Peering Management (MPM) and is implemented with the assistance of
- * userspace daemon.  When this flag is set, the kernel will send peer
+ *      a userspace daemon.  When this flag is set, the kernel will send peer
- * management frames to a userspace daemon that will implement AMPE
+ *      management frames to a userspace daemon that will implement AMPE
- * functionality (security capabilities selection, key confirmation, and key
+ *      functionality (security capabilities selection, key confirmation, and
- * management).  When the flag is unset (default), the kernel can autonomously
+ *      key management).  When the flag is unset (default), the kernel can
- * complete (unsecured) mesh peering without the need of a userspace daemon.
+ *      autonomously complete (unsecured) mesh peering without the need of a
- *
+ *      userspace daemon.
- * @NL80211_MESH_SETUP_ATTR_MAX: highest possible mesh setup attribute number
 *
 * @NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC: Enable this option to use a
- * vendor specific synchronization method or disable it to use the default
+ *      vendor specific synchronization method or disable it to use the default
- * neighbor offset synchronization
+ *      neighbor offset synchronization
+ *
+ * @NL80211_MESH_SETUP_ATTR_MAX: highest possible mesh setup attribute number
 *
 * @__NL80211_MESH_SETUP_ATTR_AFTER_LAST: Internal use
 */
@@ -2490,12 +2589,19 @@ enum nl80211_tx_rate_attributes {
 * enum nl80211_band - Frequency band
 * @NL80211_BAND_2GHZ: 2.4 GHz ISM band
 * @NL80211_BAND_5GHZ: around 5 GHz band (4.9 - 5.7 GHz)
+ * @NL80211_BAND_60GHZ: around 60 GHz band (58.32 - 64.80 GHz)
 */
 enum nl80211_band {
        NL80211_BAND_2GHZ,
        NL80211_BAND_5GHZ,
+        NL80211_BAND_60GHZ,
 };
+/**
+ * enum nl80211_ps_state - powersave state
+ * @NL80211_PS_DISABLED: powersave is disabled
+ * @NL80211_PS_ENABLED: powersave is enabled
+ */
 enum nl80211_ps_state {
        NL80211_PS_DISABLED,
        NL80211_PS_ENABLED,
@@ -2513,6 +2619,17 @@ enum nl80211_ps_state {
 * @NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT: RSSI threshold event
 * @NL80211_ATTR_CQM_PKT_LOSS_EVENT: a u32 value indicating that this many
 *      consecutive packets were not acknowledged by the peer
+ * @NL80211_ATTR_CQM_TXE_RATE: TX error rate in %. Minimum % of TX failures
+ *      during the given %NL80211_ATTR_CQM_TXE_INTVL before an
+ *      %NL80211_CMD_NOTIFY_CQM with reported %NL80211_ATTR_CQM_TXE_RATE and
+ *      %NL80211_ATTR_CQM_TXE_PKTS is generated.
+ * @NL80211_ATTR_CQM_TXE_PKTS: number of attempted packets in a given
+ *      %NL80211_ATTR_CQM_TXE_INTVL before %NL80211_ATTR_CQM_TXE_RATE is
+ *      checked.
+ * @NL80211_ATTR_CQM_TXE_INTVL: interval in seconds. Specifies the periodic
+ *      interval in which %NL80211_ATTR_CQM_TXE_PKTS and
+ *      %NL80211_ATTR_CQM_TXE_RATE must be satisfied before generating an
+ *      %NL80211_CMD_NOTIFY_CQM. Set to 0 to turn off TX error reporting.
 * @__NL80211_ATTR_CQM_AFTER_LAST: internal
 * @NL80211_ATTR_CQM_MAX: highest key attribute
 */
@@ -2522,6 +2639,9 @@ enum nl80211_attr_cqm {
        NL80211_ATTR_CQM_RSSI_HYST,
        NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT,
        NL80211_ATTR_CQM_PKT_LOSS_EVENT,
+        NL80211_ATTR_CQM_TXE_RATE,
+        NL80211_ATTR_CQM_TXE_PKTS,
+        NL80211_ATTR_CQM_TXE_INTVL,
        /* keep last */
        __NL80211_ATTR_CQM_AFTER_LAST,
@@ -2534,10 +2654,14 @@ enum nl80211_attr_cqm {
 *      configured threshold
 * @NL80211_CQM_RSSI_THRESHOLD_EVENT_HIGH: The RSSI is higher than the
 *      configured threshold
+ * @NL80211_CQM_RSSI_BEACON_LOSS_EVENT: The device experienced beacon loss.
+ *      (Note that deauth/disassoc will still follow if the AP is not
+ *      available. This event might get used as roaming event, etc.)
 */
 enum nl80211_cqm_rssi_threshold_event {
        NL80211_CQM_RSSI_THRESHOLD_EVENT_LOW,
        NL80211_CQM_RSSI_THRESHOLD_EVENT_HIGH,
+        NL80211_CQM_RSSI_BEACON_LOSS_EVENT,
 };
@@ -2867,11 +2991,15 @@ enum nl80211_ap_sme_features {
 * @NL80211_FEATURE_HT_IBSS: This driver supports IBSS with HT datarates.
 * @NL80211_FEATURE_INACTIVITY_TIMER: This driver takes care of freeing up
 *      the connected inactive stations in AP mode.
+ * @NL80211_FEATURE_CELL_BASE_REG_HINTS: This driver has been tested
+ *      to work properly to suppport receiving regulatory hints from
+ *      cellular base stations.
 */
 enum nl80211_feature_flags {
        NL80211_FEATURE_SK_TX_STATUS    = 1 << 0,
        NL80211_FEATURE_HT_IBSS         = 1 << 1,
        NL80211_FEATURE_INACTIVITY_TIMER = 1 << 2,
+        NL80211_FEATURE_CELL_BASE_REG_HINTS = 1 << 3,
 };
 /**
diff --git a/include/linux/nl802154.h b/include/linux/nl802154.h
index 5a3db3aa5f17..fd4f2d1cdf6c 100644
--- a/include/linux/nl802154.h
+++ b/include/linux/nl802154.h
@@ -130,18 +130,8 @@ enum {
 enum {
        __IEEE802154_DEV_INVALID = -1,
-         /* TODO:
+        IEEE802154_DEV_WPAN,
-         * Nowadays three device types supported by this stack at linux-zigbee
+        IEEE802154_DEV_MONITOR,
-         * project: WPAN = 0, MONITOR = 1 and SMAC = 2.
-         *
-         * Since this stack implementation exists many years, it's definitely
-         * bad idea to change the assigned values due to they are already used
-         * by third-party userspace software like: iz-tools, wireshark...
-         *
-         * Currently only monitor device is added and initialized by '1' for
-         * compatibility.
-         */
-        IEEE802154_DEV_MONITOR = 1,
        __IEEE802154_DEV_MAX,
 };
diff --git a/include/linux/phy.h b/include/linux/phy.h
index c291cae8ce32..93b3cf77f564 100644
--- a/include/linux/phy.h
+++ b/include/linux/phy.h
@@ -243,6 +243,15 @@ enum phy_state {
        PHY_RESUMING
 };
+/**
+ * struct phy_c45_device_ids - 802.3-c45 Device Identifiers
+ * @devices_in_package: Bit vector of devices present.
+ * @device_ids: The device identifer for each present device.
+ */
+struct phy_c45_device_ids {
+        u32 devices_in_package;
+        u32 device_ids[8];
+};
 /* phy_device: An instance of a PHY
 *
@@ -250,6 +259,8 @@ enum phy_state {
 * bus: Pointer to the bus this PHY is on
 * dev: driver model device structure for this PHY
 * phy_id: UID for this device found during discovery
+ * c45_ids: 802.3-c45 Device Identifers if is_c45.
+ * is_c45:  Set to true if this phy uses clause 45 addressing.
 * state: state of the PHY for management purposes
 * dev_flags: Device-specific flags used by the PHY driver.
 * addr: Bus address of PHY
@@ -285,6 +296,9 @@ struct phy_device {
        u32 phy_id;
+        struct phy_c45_device_ids c45_ids;
+        bool is_c45;
        enum phy_state state;
        u32 dev_flags;
@@ -412,6 +426,12 @@ struct phy_driver {
        /* Clears up any memory if needed */
        void (*remove)(struct phy_device *phydev);
+        /* Returns true if this is a suitable driver for the given
+         * phydev.  If NULL, matching is based on phy_id and
+         * phy_id_mask.
+         */
+        int (*match_phy_device)(struct phy_device *phydev);
        /* Handles ethtool queries for hardware time stamping. */
        int (*ts_info)(struct phy_device *phydev, struct ethtool_ts_info *ti);
@@ -480,7 +500,9 @@ static inline int phy_write(struct phy_device *phydev, u32 regnum, u16 val)
        return mdiobus_write(phydev->bus, phydev->addr, regnum, val);
 }
-struct phy_device* get_phy_device(struct mii_bus *bus, int addr);
+struct phy_device *phy_device_create(struct mii_bus *bus, int addr, int phy_id,
+                bool is_c45, struct phy_c45_device_ids *c45_ids);
+struct phy_device *get_phy_device(struct mii_bus *bus, int addr, bool is_c45);
 int phy_device_register(struct phy_device *phy);
 int phy_init_hw(struct phy_device *phydev);
 struct phy_device * phy_attach(struct net_device *dev,
@@ -511,7 +533,9 @@ int genphy_read_status(struct phy_device *phydev);
 int genphy_suspend(struct phy_device *phydev);
 int genphy_resume(struct phy_device *phydev);
 void phy_driver_unregister(struct phy_driver *drv);
+void phy_drivers_unregister(struct phy_driver *drv, int n);
 int phy_driver_register(struct phy_driver *new_driver);
+int phy_drivers_register(struct phy_driver *new_driver, int n);
 void phy_state_machine(struct work_struct *work);
 void phy_start_machine(struct phy_device *phydev,
                void (*handler)(struct net_device *));
@@ -532,6 +556,11 @@ int phy_register_fixup_for_uid(u32 phy_uid, u32 phy_uid_mask,
                int (*run)(struct phy_device *));
 int phy_scan_fixups(struct phy_device *phydev);
+int phy_init_eee(struct phy_device *phydev, bool clk_stop_enable);
+int phy_get_eee_err(struct phy_device *phydev);
+int phy_ethtool_set_eee(struct phy_device *phydev, struct ethtool_eee *data);
+int phy_ethtool_get_eee(struct phy_device *phydev, struct ethtool_eee *data);
 int __init mdio_bus_init(void);
 void mdio_bus_exit(void);
diff --git a/include/linux/pkt_cls.h b/include/linux/pkt_cls.h
index defbde203d07..082eafaf026b 100644
--- a/include/linux/pkt_cls.h
+++ b/include/linux/pkt_cls.h
@@ -451,8 +451,10 @@ enum {
 #define TCF_EM_U32              3
 #define TCF_EM_META             4
 #define TCF_EM_TEXT             5
-#define        TCF_EM_VLAN              6
+#define TCF_EM_VLAN             6
-#define TCF_EM_MAX              6
+#define TCF_EM_CANID            7
+#define TCF_EM_IPSET            8
+#define TCF_EM_MAX              8
 enum {
        TCF_EM_PROG_TC
diff --git a/include/linux/rtnetlink.h b/include/linux/rtnetlink.h
index 2c1de8982c85..db71c4ad8624 100644
--- a/include/linux/rtnetlink.h
+++ b/include/linux/rtnetlink.h
@@ -612,12 +612,6 @@ struct tcamsg {
 #include <linux/mutex.h>
 #include <linux/netdevice.h>
-static __inline__ int rtattr_strcmp(const struct rtattr *rta, const char *str)
-{
-        int len = strlen(str) + 1;
-        return len > rta->rta_len || memcmp(RTA_DATA(rta), str, len);
-}
 extern int rtnetlink_send(struct sk_buff *skb, struct net *net, u32 pid, u32 group, int echo);
 extern int rtnl_unicast(struct sk_buff *skb, struct net *net, u32 pid);
 extern void rtnl_notify(struct sk_buff *skb, struct net *net, u32 pid,
@@ -625,124 +619,7 @@ extern void rtnl_notify(struct sk_buff *skb, struct net *net, u32 pid,
 extern void rtnl_set_sk_err(struct net *net, u32 group, int error);
 extern int rtnetlink_put_metrics(struct sk_buff *skb, u32 *metrics);
 extern int rtnl_put_cacheinfo(struct sk_buff *skb, struct dst_entry *dst,
-                              u32 id, u32 ts, u32 tsage, long expires,
+                              u32 id, long expires, u32 error);
-                              u32 error);
-extern void __rta_fill(struct sk_buff *skb, int attrtype, int attrlen, const void *data);
-#define RTA_PUT(skb, attrtype, attrlen, data) \
-({      if (unlikely(skb_tailroom(skb) < (int)RTA_SPACE(attrlen))) \
-                 goto rtattr_failure; \
-        __rta_fill(skb, attrtype, attrlen, data); }) 
-#define RTA_APPEND(skb, attrlen, data) \
-({      if (unlikely(skb_tailroom(skb) < (int)(attrlen))) \
-                goto rtattr_failure; \
-        memcpy(skb_put(skb, attrlen), data, attrlen); })
-#define RTA_PUT_NOHDR(skb, attrlen, data) \
-({      RTA_APPEND(skb, RTA_ALIGN(attrlen), data); \
-        memset(skb_tail_pointer(skb) - (RTA_ALIGN(attrlen) - attrlen), 0, \
-               RTA_ALIGN(attrlen) - attrlen); })
-#define RTA_PUT_U8(skb, attrtype, value) \
-({      u8 _tmp = (value); \
-        RTA_PUT(skb, attrtype, sizeof(u8), &_tmp); })
-#define RTA_PUT_U16(skb, attrtype, value) \
-({      u16 _tmp = (value); \
-        RTA_PUT(skb, attrtype, sizeof(u16), &_tmp); })
-#define RTA_PUT_U32(skb, attrtype, value) \
-({      u32 _tmp = (value); \
-        RTA_PUT(skb, attrtype, sizeof(u32), &_tmp); })
-#define RTA_PUT_U64(skb, attrtype, value) \
-({      u64 _tmp = (value); \
-        RTA_PUT(skb, attrtype, sizeof(u64), &_tmp); })
-#define RTA_PUT_SECS(skb, attrtype, value) \
-        RTA_PUT_U64(skb, attrtype, (value) / HZ)
-#define RTA_PUT_MSECS(skb, attrtype, value) \
-        RTA_PUT_U64(skb, attrtype, jiffies_to_msecs(value))
-#define RTA_PUT_STRING(skb, attrtype, value) \
-        RTA_PUT(skb, attrtype, strlen(value) + 1, value)
-#define RTA_PUT_FLAG(skb, attrtype) \
-        RTA_PUT(skb, attrtype, 0, NULL);
-#define RTA_NEST(skb, type) \
-({      struct rtattr *__start = (struct rtattr *)skb_tail_pointer(skb); \
-        RTA_PUT(skb, type, 0, NULL); \
-        __start;  })
-#define RTA_NEST_END(skb, start) \
-({      (start)->rta_len = skb_tail_pointer(skb) - (unsigned char *)(start); \
-        (skb)->len; })
-#define RTA_NEST_COMPAT(skb, type, attrlen, data) \
-({      struct rtattr *__start = (struct rtattr *)skb_tail_pointer(skb); \
-        RTA_PUT(skb, type, attrlen, data); \
-        RTA_NEST(skb, type); \
-        __start; })
-#define RTA_NEST_COMPAT_END(skb, start) \
-({      struct rtattr *__nest = (void *)(start) + NLMSG_ALIGN((start)->rta_len); \
-        (start)->rta_len = skb_tail_pointer(skb) - (unsigned char *)(start); \
-        RTA_NEST_END(skb, __nest); \
-        (skb)->len; })
-#define RTA_NEST_CANCEL(skb, start) \
-({      if (start) \
-                skb_trim(skb, (unsigned char *) (start) - (skb)->data); \
-        -1; })
-#define RTA_GET_U8(rta) \
-({      if (!rta || RTA_PAYLOAD(rta) < sizeof(u8)) \
-                goto rtattr_failure; \
-        *(u8 *) RTA_DATA(rta); })
-#define RTA_GET_U16(rta) \
-({      if (!rta || RTA_PAYLOAD(rta) < sizeof(u16)) \
-                goto rtattr_failure; \
-        *(u16 *) RTA_DATA(rta); })
-#define RTA_GET_U32(rta) \
-({      if (!rta || RTA_PAYLOAD(rta) < sizeof(u32)) \
-                goto rtattr_failure; \
-        *(u32 *) RTA_DATA(rta); })
-#define RTA_GET_U64(rta) \
-({      u64 _tmp; \
-        if (!rta || RTA_PAYLOAD(rta) < sizeof(u64)) \
-                goto rtattr_failure; \
-        memcpy(&_tmp, RTA_DATA(rta), sizeof(_tmp)); \
-        _tmp; })
-#define RTA_GET_FLAG(rta) (!!(rta))
-#define RTA_GET_SECS(rta) ((unsigned long) RTA_GET_U64(rta) * HZ)
-#define RTA_GET_MSECS(rta) (msecs_to_jiffies((unsigned long) RTA_GET_U64(rta)))
-                
-static inline struct rtattr *
-__rta_reserve(struct sk_buff *skb, int attrtype, int attrlen)
-{
-        struct rtattr *rta;
-        int size = RTA_LENGTH(attrlen);
-        rta = (struct rtattr*)skb_put(skb, RTA_ALIGN(size));
-        rta->rta_type = attrtype;
-        rta->rta_len = size;
-        memset(RTA_DATA(rta) + attrlen, 0, RTA_ALIGN(size) - size);
-        return rta;
-}
-#define __RTA_PUT(skb, attrtype, attrlen) \
-({      if (unlikely(skb_tailroom(skb) < (int)RTA_SPACE(attrlen))) \
-                goto rtattr_failure; \
-        __rta_reserve(skb, attrtype, attrlen); })
 extern void rtmsg_ifinfo(int type, struct net_device *dev, unsigned change);
@@ -794,13 +671,6 @@ extern void __rtnl_unlock(void);
        } \
 } while(0)
-static inline u32 rtm_get_table(struct rtattr **rta, u8 table)
-{
-        return RTA_GET_U32(rta[RTA_TABLE-1]);
-rtattr_failure:
-        return table;
-}
 extern int ndo_dflt_fdb_dump(struct sk_buff *skb,
                             struct netlink_callback *cb,
                             struct net_device *dev,
diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h
index 642cb7355df3..d205c4be7f5b 100644
--- a/include/linux/skbuff.h
+++ b/include/linux/skbuff.h
@@ -1667,6 +1667,22 @@ static inline void skb_orphan(struct sk_buff *skb)
 }
 /**
+ *      skb_orphan_frags - orphan the frags contained in a buffer
+ *      @skb: buffer to orphan frags from
+ *      @gfp_mask: allocation mask for replacement pages
+ *
+ *      For each frag in the SKB which needs a destructor (i.e. has an
+ *      owner) create a copy of that frag and release the original
+ *      page by calling the destructor.
+ */
+static inline int skb_orphan_frags(struct sk_buff *skb, gfp_t gfp_mask)
+{
+        if (likely(!(skb_shinfo(skb)->tx_flags & SKBTX_DEV_ZEROCOPY)))
+                return 0;
+        return skb_copy_ubufs(skb, gfp_mask);
+}
+/**
 *      __skb_queue_purge - empty a list
 *      @list: list to empty
 *
diff --git a/include/linux/snmp.h b/include/linux/snmp.h
index 2e68f5ba0389..00bc189cb395 100644
--- a/include/linux/snmp.h
+++ b/include/linux/snmp.h
@@ -208,7 +208,6 @@ enum
        LINUX_MIB_TCPDSACKOFOSENT,              /* TCPDSACKOfoSent */
        LINUX_MIB_TCPDSACKRECV,                 /* TCPDSACKRecv */
        LINUX_MIB_TCPDSACKOFORECV,              /* TCPDSACKOfoRecv */
-        LINUX_MIB_TCPABORTONSYN,                /* TCPAbortOnSyn */
        LINUX_MIB_TCPABORTONDATA,               /* TCPAbortOnData */
        LINUX_MIB_TCPABORTONCLOSE,              /* TCPAbortOnClose */
        LINUX_MIB_TCPABORTONMEMORY,             /* TCPAbortOnMemory */
@@ -233,7 +232,13 @@ enum
        LINUX_MIB_TCPREQQFULLDOCOOKIES,         /* TCPReqQFullDoCookies */
        LINUX_MIB_TCPREQQFULLDROP,              /* TCPReqQFullDrop */
        LINUX_MIB_TCPRETRANSFAIL,               /* TCPRetransFail */
-        LINUX_MIB_TCPRCVCOALESCE,                       /* TCPRcvCoalesce */
+        LINUX_MIB_TCPRCVCOALESCE,               /* TCPRcvCoalesce */
+        LINUX_MIB_TCPOFOQUEUE,                  /* TCPOFOQueue */
+        LINUX_MIB_TCPOFODROP,                   /* TCPOFODrop */
+        LINUX_MIB_TCPOFOMERGE,                  /* TCPOFOMerge */
+        LINUX_MIB_TCPCHALLENGEACK,              /* TCPChallengeACK */
+        LINUX_MIB_TCPSYNCHALLENGE,              /* TCPSYNChallenge */
+        LINUX_MIB_TCPFASTOPENACTIVE,            /* TCPFastOpenActive */
        __LINUX_MIB_MAX
 };
diff --git a/include/linux/sock_diag.h b/include/linux/sock_diag.h
index db4bae78bda9..e3e395acc2fd 100644
--- a/include/linux/sock_diag.h
+++ b/include/linux/sock_diag.h
@@ -18,6 +18,7 @@ enum {
        SK_MEMINFO_FWD_ALLOC,
        SK_MEMINFO_WMEM_QUEUED,
        SK_MEMINFO_OPTMEM,
+        SK_MEMINFO_BACKLOG,
        SK_MEMINFO_VARS,
 };
@@ -43,6 +44,5 @@ void sock_diag_save_cookie(void *sk, __u32 *cookie);
 int sock_diag_put_meminfo(struct sock *sk, struct sk_buff *skb, int attr);
-extern struct sock *sock_diag_nlsk;
 #endif /* KERNEL */
 #endif
diff --git a/include/linux/socket.h b/include/linux/socket.h
index 25d6322fb635..ba7b2e817cfa 100644
--- a/include/linux/socket.h
+++ b/include/linux/socket.h
@@ -268,6 +268,7 @@ struct ucred {
 #define MSG_SENDPAGE_NOTLAST 0x20000 /* sendpage() internal : not the last page */
 #define MSG_EOF         MSG_FIN
+#define MSG_FASTOPEN    0x20000000      /* Send data in TCP SYN */
 #define MSG_CMSG_CLOEXEC 0x40000000     /* Set close_on_exit for file
                                           descriptor received through
                                           SCM_RIGHTS */
diff --git a/include/linux/spi/at86rf230.h b/include/linux/spi/at86rf230.h
new file mode 100644
index 000000000000..b2b1afbb3202
--- /dev/null
+++ b/include/linux/spi/at86rf230.h
@@ -0,0 +1,31 @@
+/*
+ * AT86RF230/RF231 driver
+ *
+ * Copyright (C) 2009-2012 Siemens AG
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2
+ * as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Written by:
+ * Dmitry Eremin-Solenikov <dmitry.baryshkov@siemens.com>
+ */
+#ifndef AT86RF230_H
+#define AT86RF230_H
+struct at86rf230_platform_data {
+        int rstn;
+        int slp_tr;
+        int dig2;
+};
+#endif
diff --git a/include/linux/ssb/ssb.h b/include/linux/ssb/ssb.h
index bc14bd738ade..bb674c02f306 100644
--- a/include/linux/ssb/ssb.h
+++ b/include/linux/ssb/ssb.h
@@ -243,6 +243,7 @@ struct ssb_bus_ops {
 #define SSB_DEV_MINI_MACPHY     0x823
 #define SSB_DEV_ARM_1176        0x824
 #define SSB_DEV_ARM_7TDMI       0x825
+#define SSB_DEV_ARM_CM3         0x82A
 /* Vendor-ID values */
 #define SSB_VENDOR_BROADCOM     0x4243
diff --git a/include/linux/tcp.h b/include/linux/tcp.h
index 5f359dbfcdce..eb125a4c30b3 100644
--- a/include/linux/tcp.h
+++ b/include/linux/tcp.h
@@ -243,6 +243,16 @@ static inline unsigned int tcp_optlen(const struct sk_buff *skb)
        return (tcp_hdr(skb)->doff - 5) * 4;
 }
+/* TCP Fast Open */
+#define TCP_FASTOPEN_COOKIE_MIN 4       /* Min Fast Open Cookie size in bytes */
+#define TCP_FASTOPEN_COOKIE_MAX 16      /* Max Fast Open Cookie size in bytes */
+/* TCP Fast Open Cookie as stored in memory */
+struct tcp_fastopen_cookie {
+        s8      len;
+        u8      val[TCP_FASTOPEN_COOKIE_MAX];
+};
 /* This defines a selective acknowledgement block. */
 struct tcp_sack_block_wire {
        __be32  start_seq;
@@ -339,6 +349,9 @@ struct tcp_sock {
        u32     rcv_tstamp;     /* timestamp of last received ACK (for keepalives) */
        u32     lsndtime;       /* timestamp of last sent data packet (for restart window) */
+        struct list_head tsq_node; /* anchor in tsq_tasklet.head list */
+        unsigned long   tsq_flags;
        /* Data for direct copy to user */
        struct {
                struct sk_buff_head     prequeue;
@@ -373,7 +386,9 @@ struct tcp_sock {
                unused      : 1;
        u8      repair_queue;
        u8      do_early_retrans:1,/* Enable RFC5827 early-retransmit  */
-                early_retrans_delayed:1; /* Delayed ER timer installed */
+                early_retrans_delayed:1, /* Delayed ER timer installed */
+                syn_data:1,     /* SYN includes data */
+                syn_fastopen:1; /* SYN includes Fast Open option */
 /* RTT measurement */
        u32     srtt;           /* smoothed round trip time << 3        */
@@ -478,6 +493,9 @@ struct tcp_sock {
                u32               probe_seq_start;
                u32               probe_seq_end;
        } mtu_probe;
+        u32     mtu_info; /* We received an ICMP_FRAG_NEEDED / ICMPV6_PKT_TOOBIG
+                           * while socket was owned by user.
+                           */
 #ifdef CONFIG_TCP_MD5SIG
 /* TCP AF-Specific parts; only used by MD5 Signature support so far */
@@ -487,6 +505,9 @@ struct tcp_sock {
        struct tcp_md5sig_info  __rcu *md5sig_info;
 #endif
+/* TCP fastopen related information */
+        struct tcp_fastopen_request *fastopen_req;
        /* When the cookie options are generated and exchanged, then this
         * object holds a reference to them (cookie_values->kref).  Also
         * contains related tcp_cookie_transactions fields.
@@ -494,6 +515,17 @@ struct tcp_sock {
        struct tcp_cookie_values  *cookie_values;
 };
+enum tsq_flags {
+        TSQ_THROTTLED,
+        TSQ_QUEUED,
+        TCP_TSQ_DEFERRED,          /* tcp_tasklet_func() found socket was owned */
+        TCP_WRITE_TIMER_DEFERRED,  /* tcp_write_timer() found socket was owned */
+        TCP_DELACK_TIMER_DEFERRED, /* tcp_delack_timer() found socket was owned */
+        TCP_MTU_REDUCED_DEFERRED,  /* tcp_v{4|6}_err() could not call
+                                    * tcp_v{4|6}_mtu_reduced()
+                                    */
+};
 static inline struct tcp_sock *tcp_sk(const struct sock *sk)
 {
        return (struct tcp_sock *)sk;
@@ -507,7 +539,7 @@ struct tcp_timewait_sock {
        u32                       tw_ts_recent;
        long                      tw_ts_recent_stamp;
 #ifdef CONFIG_TCP_MD5SIG
-        struct tcp_md5sig_key   *tw_md5_key;
+        struct tcp_md5sig_key     *tw_md5_key;
 #endif
        /* Few sockets in timewait have cookies; in that case, then this
         * object holds a reference to them (tw_cookie_values->kref).
diff --git a/include/linux/tipc_config.h b/include/linux/tipc_config.h
index 9730b0e51e46..c98928420100 100644
--- a/include/linux/tipc_config.h
+++ b/include/linux/tipc_config.h
@@ -102,8 +102,8 @@
 #define  TIPC_CMD_SET_LINK_TOL      0x4107    /* tx link_config, rx none */
 #define  TIPC_CMD_SET_LINK_PRI      0x4108    /* tx link_config, rx none */
 #define  TIPC_CMD_SET_LINK_WINDOW   0x4109    /* tx link_config, rx none */
-#define  TIPC_CMD_SET_LOG_SIZE      0x410A    /* tx unsigned, rx none */
+#define  TIPC_CMD_SET_LOG_SIZE      0x410A    /* obsoleted */
-#define  TIPC_CMD_DUMP_LOG          0x410B    /* tx none, rx ultra_string */
+#define  TIPC_CMD_DUMP_LOG          0x410B    /* obsoleted */
 #define  TIPC_CMD_RESET_LINK_STATS  0x410C    /* tx link_name, rx none */
 /*
diff --git a/include/linux/usb/usbnet.h b/include/linux/usb/usbnet.h
index 76f439647c4b..f87cf622317f 100644
--- a/include/linux/usb/usbnet.h
+++ b/include/linux/usb/usbnet.h
@@ -66,9 +66,8 @@ struct usbnet {
 #               define EVENT_STS_SPLIT  3
 #               define EVENT_LINK_RESET 4
 #               define EVENT_RX_PAUSED  5
-#               define EVENT_DEV_WAKING 6
+#               define EVENT_DEV_ASLEEP 6
-#               define EVENT_DEV_ASLEEP 7
+#               define EVENT_DEV_OPEN   7
-#               define EVENT_DEV_OPEN   8
 };
 static inline struct usb_driver *driver_of(struct usb_interface *intf)
diff --git a/include/net/addrconf.h b/include/net/addrconf.h
index f2b801c4b555..089a09d001d1 100644
--- a/include/net/addrconf.h
+++ b/include/net/addrconf.h
@@ -46,7 +46,8 @@ struct prefix_info {
 #include <net/if_inet6.h>
 #include <net/ipv6.h>
-#define IN6_ADDR_HSIZE          16
+#define IN6_ADDR_HSIZE_SHIFT    4
+#define IN6_ADDR_HSIZE          (1 << IN6_ADDR_HSIZE_SHIFT)
 extern int                      addrconf_init(void);
 extern void                     addrconf_cleanup(void);
diff --git a/include/net/af_unix.h b/include/net/af_unix.h
index 2ee33da36a7a..b5f8988e4283 100644
--- a/include/net/af_unix.h
+++ b/include/net/af_unix.h
@@ -14,10 +14,11 @@ extern struct sock *unix_get_socket(struct file *filp);
 extern struct sock *unix_peer_get(struct sock *);
 #define UNIX_HASH_SIZE  256
+#define UNIX_HASH_BITS  8
 extern unsigned int unix_tot_inflight;
 extern spinlock_t unix_table_lock;
-extern struct hlist_head unix_socket_table[UNIX_HASH_SIZE + 1];
+extern struct hlist_head unix_socket_table[2 * UNIX_HASH_SIZE];
 struct unix_address {
        atomic_t        refcnt;
diff --git a/include/net/arp.h b/include/net/arp.h
index 4a1f3fb562eb..7f7df93f37cd 100644
--- a/include/net/arp.h
+++ b/include/net/arp.h
@@ -15,24 +15,31 @@ static inline u32 arp_hashfn(u32 key, const struct net_device *dev, u32 hash_rnd
        return val * hash_rnd;
 }
-static inline struct neighbour *__ipv4_neigh_lookup(struct net_device *dev, u32 key)
+static inline struct neighbour *__ipv4_neigh_lookup_noref(struct net_device *dev, u32 key)
 {
-        struct neigh_hash_table *nht;
+        struct neigh_hash_table *nht = rcu_dereference_bh(arp_tbl.nht);
        struct neighbour *n;
        u32 hash_val;
-        rcu_read_lock_bh();
-        nht = rcu_dereference_bh(arp_tbl.nht);
        hash_val = arp_hashfn(key, dev, nht->hash_rnd[0]) >> (32 - nht->hash_shift);
        for (n = rcu_dereference_bh(nht->hash_buckets[hash_val]);
             n != NULL;
             n = rcu_dereference_bh(n->next)) {
-                if (n->dev == dev && *(u32 *)n->primary_key == key) {
+                if (n->dev == dev && *(u32 *)n->primary_key == key)
-                        if (!atomic_inc_not_zero(&n->refcnt))
+                        return n;
-                                n = NULL;
-                        break;
-                }
        }
+        return NULL;
+}
+static inline struct neighbour *__ipv4_neigh_lookup(struct net_device *dev, u32 key)
+{
+        struct neighbour *n;
+        rcu_read_lock_bh();
+        n = __ipv4_neigh_lookup_noref(dev, key);
+        if (n && !atomic_inc_not_zero(&n->refcnt))
+                n = NULL;
        rcu_read_unlock_bh();
        return n;
diff --git a/include/net/bluetooth/a2mp.h b/include/net/bluetooth/a2mp.h
new file mode 100644
index 000000000000..6a76e0a0705e
--- /dev/null
+++ b/include/net/bluetooth/a2mp.h
@@ -0,0 +1,126 @@
+/*
+   Copyright (c) 2010,2011 Code Aurora Forum.  All rights reserved.
+   Copyright (c) 2011,2012 Intel Corp.
+   This program is free software; you can redistribute it and/or modify
+   it under the terms of the GNU General Public License version 2 and
+   only version 2 as published by the Free Software Foundation.
+   This program is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+   GNU General Public License for more details.
+*/
+#ifndef __A2MP_H
+#define __A2MP_H
+#include <net/bluetooth/l2cap.h>
+#define A2MP_FEAT_EXT   0x8000
+struct amp_mgr {
+        struct l2cap_conn       *l2cap_conn;
+        struct l2cap_chan       *a2mp_chan;
+        struct kref             kref;
+        __u8                    ident;
+        __u8                    handle;
+        unsigned long           flags;
+};
+struct a2mp_cmd {
+        __u8    code;
+        __u8    ident;
+        __le16  len;
+        __u8    data[0];
+} __packed;
+/* A2MP command codes */
+#define A2MP_COMMAND_REJ         0x01
+struct a2mp_cmd_rej {
+        __le16  reason;
+        __u8    data[0];
+} __packed;
+#define A2MP_DISCOVER_REQ        0x02
+struct a2mp_discov_req {
+        __le16  mtu;
+        __le16  ext_feat;
+} __packed;
+struct a2mp_cl {
+        __u8    id;
+        __u8    type;
+        __u8    status;
+} __packed;
+#define A2MP_DISCOVER_RSP        0x03
+struct a2mp_discov_rsp {
+        __le16     mtu;
+        __le16     ext_feat;
+        struct a2mp_cl cl[0];
+} __packed;
+#define A2MP_CHANGE_NOTIFY       0x04
+#define A2MP_CHANGE_RSP          0x05
+#define A2MP_GETINFO_REQ         0x06
+struct a2mp_info_req {
+        __u8       id;
+} __packed;
+#define A2MP_GETINFO_RSP         0x07
+struct a2mp_info_rsp {
+        __u8    id;
+        __u8    status;
+        __le32  total_bw;
+        __le32  max_bw;
+        __le32  min_latency;
+        __le16  pal_cap;
+        __le16  assoc_size;
+} __packed;
+#define A2MP_GETAMPASSOC_REQ     0x08
+struct a2mp_amp_assoc_req {
+        __u8    id;
+} __packed;
+#define A2MP_GETAMPASSOC_RSP     0x09
+struct a2mp_amp_assoc_rsp {
+        __u8    id;
+        __u8    status;
+        __u8    amp_assoc[0];
+} __packed;
+#define A2MP_CREATEPHYSLINK_REQ  0x0A
+#define A2MP_DISCONNPHYSLINK_REQ 0x0C
+struct a2mp_physlink_req {
+        __u8    local_id;
+        __u8    remote_id;
+        __u8    amp_assoc[0];
+} __packed;
+#define A2MP_CREATEPHYSLINK_RSP  0x0B
+#define A2MP_DISCONNPHYSLINK_RSP 0x0D
+struct a2mp_physlink_rsp {
+        __u8    local_id;
+        __u8    remote_id;
+        __u8    status;
+} __packed;
+/* A2MP response status */
+#define A2MP_STATUS_SUCCESS                     0x00
+#define A2MP_STATUS_INVALID_CTRL_ID             0x01
+#define A2MP_STATUS_UNABLE_START_LINK_CREATION  0x02
+#define A2MP_STATUS_NO_PHYSICAL_LINK_EXISTS     0x02
+#define A2MP_STATUS_COLLISION_OCCURED           0x03
+#define A2MP_STATUS_DISCONN_REQ_RECVD           0x04
+#define A2MP_STATUS_PHYS_LINK_EXISTS            0x05
+#define A2MP_STATUS_SECURITY_VIOLATION          0x06
+void amp_mgr_get(struct amp_mgr *mgr);
+int amp_mgr_put(struct amp_mgr *mgr);
+struct l2cap_chan *a2mp_channel_create(struct l2cap_conn *conn,
+                                       struct sk_buff *skb);
+#endif /* __A2MP_H */
diff --git a/include/net/bluetooth/bluetooth.h b/include/net/bluetooth/bluetooth.h
index 961669b648fd..565d4bee1e49 100644
--- a/include/net/bluetooth/bluetooth.h
+++ b/include/net/bluetooth/bluetooth.h
@@ -1,4 +1,4 @@
-/* 
+/*
   BlueZ - Bluetooth protocol stack for Linux
   Copyright (C) 2000-2001 Qualcomm Incorporated
@@ -12,22 +12,19 @@
   OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
   FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
   IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
-   CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES 
+   CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
-   WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN 
+   WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
-   ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF 
+   ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
   OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
-   ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS, 
+   ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
-   COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS 
+   COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
   SOFTWARE IS DISCLAIMED.
 */
 #ifndef __BLUETOOTH_H
 #define __BLUETOOTH_H
-#include <asm/types.h>
-#include <asm/byteorder.h>
-#include <linux/list.h>
 #include <linux/poll.h>
 #include <net/sock.h>
@@ -168,8 +165,8 @@ typedef struct {
 #define BDADDR_LE_PUBLIC        0x01
 #define BDADDR_LE_RANDOM        0x02
-#define BDADDR_ANY   (&(bdaddr_t) {{0, 0, 0, 0, 0, 0}})
+#define BDADDR_ANY   (&(bdaddr_t) {{0, 0, 0, 0, 0, 0} })
-#define BDADDR_LOCAL (&(bdaddr_t) {{0, 0, 0, 0xff, 0xff, 0xff}})
+#define BDADDR_LOCAL (&(bdaddr_t) {{0, 0, 0, 0xff, 0xff, 0xff} })
 /* Copy, swap, convert BD Address */
 static inline int bacmp(bdaddr_t *ba1, bdaddr_t *ba2)
@@ -215,7 +212,7 @@ int  bt_sock_recvmsg(struct kiocb *iocb, struct socket *sock,
                                struct msghdr *msg, size_t len, int flags);
 int  bt_sock_stream_recvmsg(struct kiocb *iocb, struct socket *sock,
                        struct msghdr *msg, size_t len, int flags);
-uint bt_sock_poll(struct file * file, struct socket *sock, poll_table *wait);
+uint bt_sock_poll(struct file *file, struct socket *sock, poll_table *wait);
 int  bt_sock_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg);
 int  bt_sock_wait_state(struct sock *sk, int state, unsigned long timeo);
@@ -225,12 +222,12 @@ struct sock *bt_accept_dequeue(struct sock *parent, struct socket *newsock);
 /* Skb helpers */
 struct l2cap_ctrl {
-        unsigned int    sframe  : 1,
+        unsigned int    sframe:1,
-                        poll    : 1,
+                        poll:1,
-                        final   : 1,
+                        final:1,
-                        fcs     : 1,
+                        fcs:1,
-                        sar     : 2,
+                        sar:2,
-                        super   : 2;
+                        super:2;
        __u16           reqseq;
        __u16           txseq;
        __u8            retries;
@@ -249,7 +246,8 @@ static inline struct sk_buff *bt_skb_alloc(unsigned int len, gfp_t how)
 {
        struct sk_buff *skb;
-        if ((skb = alloc_skb(len + BT_SKB_RESERVE, how))) {
+        skb = alloc_skb(len + BT_SKB_RESERVE, how);
+        if (skb) {
                skb_reserve(skb, BT_SKB_RESERVE);
                bt_cb(skb)->incoming  = 0;
        }
@@ -261,7 +259,8 @@ static inline struct sk_buff *bt_skb_send_alloc(struct sock *sk,
 {
        struct sk_buff *skb;
-        if ((skb = sock_alloc_send_skb(sk, len + BT_SKB_RESERVE, nb, err))) {
+        skb = sock_alloc_send_skb(sk, len + BT_SKB_RESERVE, nb, err);
+        if (skb) {
                skb_reserve(skb, BT_SKB_RESERVE);
                bt_cb(skb)->incoming  = 0;
        }
diff --git a/include/net/bluetooth/hci.h b/include/net/bluetooth/hci.h
index 3def64ba77fa..ccd723e0f783 100644
--- a/include/net/bluetooth/hci.h
+++ b/include/net/bluetooth/hci.h
@@ -30,6 +30,9 @@
 #define HCI_MAX_EVENT_SIZE      260
 #define HCI_MAX_FRAME_SIZE      (HCI_MAX_ACL_SIZE + 4)
+#define HCI_LINK_KEY_SIZE       16
+#define HCI_AMP_LINK_KEY_SIZE   (2 * HCI_LINK_KEY_SIZE)
 /* HCI dev events */
 #define HCI_DEV_REG                     1
 #define HCI_DEV_UNREG                   2
@@ -56,9 +59,12 @@
 #define HCI_BREDR       0x00
 #define HCI_AMP         0x01
+/* First BR/EDR Controller shall have ID = 0 */
+#define HCI_BREDR_ID    0
 /* HCI device quirks */
 enum {
-        HCI_QUIRK_NO_RESET,
+        HCI_QUIRK_RESET_ON_CLOSE,
        HCI_QUIRK_RAW_DEVICE,
        HCI_QUIRK_FIXUP_BUFFER_SIZE
 };
@@ -133,13 +139,12 @@ enum {
 #define HCIINQUIRY      _IOR('H', 240, int)
 /* HCI timeouts */
-#define HCI_CONNECT_TIMEOUT     (40000) /* 40 seconds */
+#define HCI_DISCONN_TIMEOUT     msecs_to_jiffies(2000)  /* 2 seconds */
-#define HCI_DISCONN_TIMEOUT     (2000)  /* 2 seconds */
+#define HCI_PAIRING_TIMEOUT     msecs_to_jiffies(60000) /* 60 seconds */
-#define HCI_PAIRING_TIMEOUT     (60000) /* 60 seconds */
+#define HCI_INIT_TIMEOUT        msecs_to_jiffies(10000) /* 10 seconds */
-#define HCI_IDLE_TIMEOUT        (6000)  /* 6 seconds */
+#define HCI_CMD_TIMEOUT         msecs_to_jiffies(1000)  /* 1 second */
-#define HCI_INIT_TIMEOUT        (10000) /* 10 seconds */
+#define HCI_ACL_TX_TIMEOUT      msecs_to_jiffies(45000) /* 45 seconds */
-#define HCI_CMD_TIMEOUT         (1000)  /* 1 seconds */
+#define HCI_AUTO_OFF_TIMEOUT    msecs_to_jiffies(2000)  /* 2 seconds */
-#define HCI_ACL_TX_TIMEOUT      (45000) /* 45 seconds */
 /* HCI data types */
 #define HCI_COMMAND_PKT         0x01
@@ -371,7 +376,7 @@ struct hci_cp_reject_conn_req {
 #define HCI_OP_LINK_KEY_REPLY           0x040b
 struct hci_cp_link_key_reply {
        bdaddr_t bdaddr;
-        __u8     link_key[16];
+        __u8     link_key[HCI_LINK_KEY_SIZE];
 } __packed;
 #define HCI_OP_LINK_KEY_NEG_REPLY       0x040c
@@ -523,6 +528,28 @@ struct hci_cp_io_capability_neg_reply {
        __u8     reason;
 } __packed;
+#define HCI_OP_CREATE_PHY_LINK          0x0435
+struct hci_cp_create_phy_link {
+        __u8     phy_handle;
+        __u8     key_len;
+        __u8     key_type;
+        __u8     key[HCI_AMP_LINK_KEY_SIZE];
+} __packed;
+#define HCI_OP_ACCEPT_PHY_LINK          0x0436
+struct hci_cp_accept_phy_link {
+        __u8     phy_handle;
+        __u8     key_len;
+        __u8     key_type;
+        __u8     key[HCI_AMP_LINK_KEY_SIZE];
+} __packed;
+#define HCI_OP_DISCONN_PHY_LINK 0x0437
+struct hci_cp_disconn_phy_link {
+        __u8     phy_handle;
+        __u8     reason;
+} __packed;
 #define HCI_OP_SNIFF_MODE               0x0803
 struct hci_cp_sniff_mode {
        __le16   handle;
@@ -818,6 +845,31 @@ struct hci_rp_read_local_amp_info {
        __le32   be_flush_to;
 } __packed;
+#define HCI_OP_READ_LOCAL_AMP_ASSOC     0x140a
+struct hci_cp_read_local_amp_assoc {
+        __u8     phy_handle;
+        __le16   len_so_far;
+        __le16   max_len;
+} __packed;
+struct hci_rp_read_local_amp_assoc {
+        __u8     status;
+        __u8     phy_handle;
+        __le16   rem_len;
+        __u8     frag[0];
+} __packed;
+#define HCI_OP_WRITE_REMOTE_AMP_ASSOC   0x140b
+struct hci_cp_write_remote_amp_assoc {
+        __u8     phy_handle;
+        __le16   len_so_far;
+        __le16   rem_len;
+        __u8     frag[0];
+} __packed;
+struct hci_rp_write_remote_amp_assoc {
+        __u8     status;
+        __u8     phy_handle;
+} __packed;
 #define HCI_OP_LE_SET_EVENT_MASK        0x2001
 struct hci_cp_le_set_event_mask {
        __u8     mask[8];
@@ -1048,7 +1100,7 @@ struct hci_ev_link_key_req {
 #define HCI_EV_LINK_KEY_NOTIFY          0x18
 struct hci_ev_link_key_notify {
        bdaddr_t bdaddr;
-        __u8     link_key[16];
+        __u8     link_key[HCI_LINK_KEY_SIZE];
        __u8     key_type;
 } __packed;
@@ -1196,6 +1248,39 @@ struct hci_ev_le_meta {
        __u8     subevent;
 } __packed;
+#define HCI_EV_PHY_LINK_COMPLETE        0x40
+struct hci_ev_phy_link_complete {
+        __u8     status;
+        __u8     phy_handle;
+} __packed;
+#define HCI_EV_CHANNEL_SELECTED         0x41
+struct hci_ev_channel_selected {
+        __u8     phy_handle;
+} __packed;
+#define HCI_EV_DISCONN_PHY_LINK_COMPLETE        0x42
+struct hci_ev_disconn_phy_link_complete {
+        __u8     status;
+        __u8     phy_handle;
+        __u8     reason;
+} __packed;
+#define HCI_EV_LOGICAL_LINK_COMPLETE            0x45
+struct hci_ev_logical_link_complete {
+        __u8     status;
+        __le16   handle;
+        __u8     phy_handle;
+        __u8     flow_spec_id;
+} __packed;
+#define HCI_EV_DISCONN_LOGICAL_LINK_COMPLETE    0x46
+struct hci_ev_disconn_logical_link_complete {
+        __u8     status;
+        __le16   handle;
+        __u8     reason;
+} __packed;
 #define HCI_EV_NUM_COMP_BLOCKS          0x48
 struct hci_comp_blocks_info {
        __le16   handle;
@@ -1296,7 +1381,6 @@ struct hci_sco_hdr {
        __u8    dlen;
 } __packed;
-#include <linux/skbuff.h>
 static inline struct hci_event_hdr *hci_event_hdr(const struct sk_buff *skb)
 {
        return (struct hci_event_hdr *) skb->data;
@@ -1313,12 +1397,12 @@ static inline struct hci_sco_hdr *hci_sco_hdr(const struct sk_buff *skb)
 }
 /* Command opcode pack/unpack */
-#define hci_opcode_pack(ogf, ocf)       (__u16) ((ocf & 0x03ff)|(ogf << 10))
+#define hci_opcode_pack(ogf, ocf)       ((__u16) ((ocf & 0x03ff)|(ogf << 10)))
 #define hci_opcode_ogf(op)              (op >> 10)
 #define hci_opcode_ocf(op)              (op & 0x03ff)
 /* ACL handle and flags pack/unpack */
-#define hci_handle_pack(h, f)   (__u16) ((h & 0x0fff)|(f << 12))
+#define hci_handle_pack(h, f)   ((__u16) ((h & 0x0fff)|(f << 12)))
 #define hci_handle(h)           (h & 0x0fff)
 #define hci_flags(h)            (h >> 12)
diff --git a/include/net/bluetooth/hci_core.h b/include/net/bluetooth/hci_core.h
index 9fc7728f94e4..475b8c04ba52 100644
--- a/include/net/bluetooth/hci_core.h
+++ b/include/net/bluetooth/hci_core.h
@@ -25,7 +25,6 @@
 #ifndef __HCI_CORE_H
 #define __HCI_CORE_H
-#include <linux/interrupt.h>
 #include <net/bluetooth/hci.h>
 /* HCI priority */
@@ -65,7 +64,7 @@ struct discovery_state {
                DISCOVERY_RESOLVING,
                DISCOVERY_STOPPING,
        } state;
-        struct list_head        all;            /* All devices found during inquiry */
+        struct list_head        all;    /* All devices found during inquiry */
        struct list_head        unknown;        /* Name state not known */
        struct list_head        resolve;        /* Name needs to be resolved */
        __u32                   timestamp;
@@ -105,7 +104,7 @@ struct link_key {
        struct list_head list;
        bdaddr_t bdaddr;
        u8 type;
-        u8 val[16];
+        u8 val[HCI_LINK_KEY_SIZE];
        u8 pin_len;
 };
@@ -333,6 +332,7 @@ struct hci_conn {
        void            *l2cap_data;
        void            *sco_data;
        void            *smp_conn;
+        struct amp_mgr  *amp_mgr;
        struct hci_conn *link;
@@ -360,7 +360,8 @@ extern int l2cap_connect_cfm(struct hci_conn *hcon, u8 status);
 extern int l2cap_disconn_ind(struct hci_conn *hcon);
 extern int l2cap_disconn_cfm(struct hci_conn *hcon, u8 reason);
 extern int l2cap_security_cfm(struct hci_conn *hcon, u8 status, u8 encrypt);
-extern int l2cap_recv_acldata(struct hci_conn *hcon, struct sk_buff *skb, u16 flags);
+extern int l2cap_recv_acldata(struct hci_conn *hcon, struct sk_buff *skb,
+                              u16 flags);
 extern int sco_connect_ind(struct hci_dev *hdev, bdaddr_t *bdaddr);
 extern int sco_connect_cfm(struct hci_conn *hcon, __u8 status);
@@ -429,8 +430,8 @@ enum {
 static inline bool hci_conn_ssp_enabled(struct hci_conn *conn)
 {
        struct hci_dev *hdev = conn->hdev;
-        return (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags) &&
+        return test_bit(HCI_SSP_ENABLED, &hdev->dev_flags) &&
-                                test_bit(HCI_CONN_SSP_ENABLED, &conn->flags));
+               test_bit(HCI_CONN_SSP_ENABLED, &conn->flags);
 }
 static inline void hci_conn_hash_init(struct hci_dev *hdev)
@@ -586,18 +587,24 @@ void hci_conn_put_device(struct hci_conn *conn);
 static inline void hci_conn_hold(struct hci_conn *conn)
 {
+        BT_DBG("hcon %p refcnt %d -> %d", conn, atomic_read(&conn->refcnt),
+               atomic_read(&conn->refcnt) + 1);
        atomic_inc(&conn->refcnt);
        cancel_delayed_work(&conn->disc_work);
 }
 static inline void hci_conn_put(struct hci_conn *conn)
 {
+        BT_DBG("hcon %p refcnt %d -> %d", conn, atomic_read(&conn->refcnt),
+               atomic_read(&conn->refcnt) - 1);
        if (atomic_dec_and_test(&conn->refcnt)) {
                unsigned long timeo;
                if (conn->type == ACL_LINK || conn->type == LE_LINK) {
                        del_timer(&conn->idle_timer);
                        if (conn->state == BT_CONNECTED) {
-                                timeo = msecs_to_jiffies(conn->disc_timeout);
+                                timeo = conn->disc_timeout;
                                if (!conn->out)
                                        timeo *= 2;
                        } else {
@@ -640,6 +647,19 @@ static inline void hci_set_drvdata(struct hci_dev *hdev, void *data)
        dev_set_drvdata(&hdev->dev, data);
 }
+/* hci_dev_list shall be locked */
+static inline uint8_t __hci_num_ctrl(void)
+{
+        uint8_t count = 0;
+        struct list_head *p;
+        list_for_each(p, &hci_dev_list) {
+                count++;
+        }
+        return count;
+}
 struct hci_dev *hci_dev_get(int index);
 struct hci_dev *hci_get_route(bdaddr_t *src, bdaddr_t *dst);
@@ -661,7 +681,8 @@ int hci_get_conn_info(struct hci_dev *hdev, void __user *arg);
 int hci_get_auth_info(struct hci_dev *hdev, void __user *arg);
 int hci_inquiry(void __user *arg);
-struct bdaddr_list *hci_blacklist_lookup(struct hci_dev *hdev, bdaddr_t *bdaddr);
+struct bdaddr_list *hci_blacklist_lookup(struct hci_dev *hdev,
+                                         bdaddr_t *bdaddr);
 int hci_blacklist_clear(struct hci_dev *hdev);
 int hci_blacklist_add(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type);
 int hci_blacklist_del(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type);
diff --git a/include/net/bluetooth/l2cap.h b/include/net/bluetooth/l2cap.h
index 1c7d1cd5e679..a7679f8913d2 100644
--- a/include/net/bluetooth/l2cap.h
+++ b/include/net/bluetooth/l2cap.h
@@ -40,11 +40,11 @@
 #define L2CAP_DEFAULT_MONITOR_TO        12000   /* 12 seconds */
 #define L2CAP_DEFAULT_MAX_PDU_SIZE      1009    /* Sized for 3-DH5 packet */
 #define L2CAP_DEFAULT_ACK_TO            200
-#define L2CAP_LE_DEFAULT_MTU            23
 #define L2CAP_DEFAULT_MAX_SDU_SIZE      0xFFFF
 #define L2CAP_DEFAULT_SDU_ITIME         0xFFFFFFFF
 #define L2CAP_DEFAULT_ACC_LAT           0xFFFFFFFF
 #define L2CAP_BREDR_MAX_PAYLOAD         1019    /* 3-DH5 packet */
+#define L2CAP_LE_MIN_MTU                23
 #define L2CAP_DISC_TIMEOUT              msecs_to_jiffies(100)
 #define L2CAP_DISC_REJ_TIMEOUT          msecs_to_jiffies(5000)
@@ -52,6 +52,8 @@
 #define L2CAP_CONN_TIMEOUT              msecs_to_jiffies(40000)
 #define L2CAP_INFO_TIMEOUT              msecs_to_jiffies(4000)
+#define L2CAP_A2MP_DEFAULT_MTU          670
 /* L2CAP socket address */
 struct sockaddr_l2 {
        sa_family_t     l2_family;
@@ -229,9 +231,14 @@ struct l2cap_conn_rsp {
        __le16     status;
 } __packed;
+/* protocol/service multiplexer (PSM) */
+#define L2CAP_PSM_SDP           0x0001
+#define L2CAP_PSM_RFCOMM        0x0003
 /* channel indentifier */
 #define L2CAP_CID_SIGNALING     0x0001
 #define L2CAP_CID_CONN_LESS     0x0002
+#define L2CAP_CID_A2MP          0x0003
 #define L2CAP_CID_LE_DATA       0x0004
 #define L2CAP_CID_LE_SIGNALING  0x0005
 #define L2CAP_CID_SMP           0x0006
@@ -271,6 +278,9 @@ struct l2cap_conf_rsp {
 #define L2CAP_CONF_PENDING      0x0004
 #define L2CAP_CONF_EFS_REJECT   0x0005
+/* configuration req/rsp continuation flag */
+#define L2CAP_CONF_FLAG_CONTINUATION    0x0001
 struct l2cap_conf_opt {
        __u8       type;
        __u8       len;
@@ -419,11 +429,6 @@ struct l2cap_seq_list {
 #define L2CAP_SEQ_LIST_CLEAR    0xFFFF
 #define L2CAP_SEQ_LIST_TAIL     0x8000
-struct srej_list {
-        __u16   tx_seq;
-        struct list_head list;
-};
 struct l2cap_chan {
        struct sock *sk;
@@ -459,6 +464,7 @@ struct l2cap_chan {
        __u16           tx_win;
        __u16           tx_win_max;
+        __u16           ack_win;
        __u8            max_tx;
        __u16           retrans_timeout;
        __u16           monitor_timeout;
@@ -475,14 +481,12 @@ struct l2cap_chan {
        __u16           expected_ack_seq;
        __u16           expected_tx_seq;
        __u16           buffer_seq;
-        __u16           buffer_seq_srej;
        __u16           srej_save_reqseq;
        __u16           last_acked_seq;
        __u16           frames_sent;
        __u16           unacked_frames;
        __u8            retry_count;
        __u16           srej_queue_next;
-        __u8            num_acked;
        __u16           sdu_len;
        struct sk_buff  *sdu;
        struct sk_buff  *sdu_last_frag;
@@ -515,7 +519,6 @@ struct l2cap_chan {
        struct sk_buff_head     srej_q;
        struct l2cap_seq_list   srej_list;
        struct l2cap_seq_list   retrans_list;
-        struct list_head        srej_l;
        struct list_head        list;
        struct list_head        global_l;
@@ -528,10 +531,14 @@ struct l2cap_chan {
 struct l2cap_ops {
        char                    *name;
-        struct l2cap_chan       *(*new_connection) (void *data);
+        struct l2cap_chan       *(*new_connection) (struct l2cap_chan *chan);
-        int                     (*recv) (void *data, struct sk_buff *skb);
+        int                     (*recv) (struct l2cap_chan * chan,
-        void                    (*close) (void *data);
+                                         struct sk_buff *skb);
-        void                    (*state_change) (void *data, int state);
+        void                    (*teardown) (struct l2cap_chan *chan, int err);
+        void                    (*close) (struct l2cap_chan *chan);
+        void                    (*state_change) (struct l2cap_chan *chan,
+                                                 int state);
+        void                    (*ready) (struct l2cap_chan *chan);
        struct sk_buff          *(*alloc_skb) (struct l2cap_chan *chan,
                                               unsigned long len, int nb);
 };
@@ -575,6 +582,7 @@ struct l2cap_conn {
 #define L2CAP_CHAN_RAW                  1
 #define L2CAP_CHAN_CONN_LESS            2
 #define L2CAP_CHAN_CONN_ORIENTED        3
+#define L2CAP_CHAN_CONN_FIX_A2MP        4
 /* ----- L2CAP socket info ----- */
 #define l2cap_pi(sk) ((struct l2cap_pinfo *) sk)
@@ -597,6 +605,7 @@ enum {
        CONF_EWS_RECV,
        CONF_LOC_CONF_PEND,
        CONF_REM_CONF_PEND,
+        CONF_NOT_COMPLETE,
 };
 #define L2CAP_CONF_MAX_CONF_REQ 2
@@ -664,11 +673,15 @@ enum {
 static inline void l2cap_chan_hold(struct l2cap_chan *c)
 {
+        BT_DBG("chan %p orig refcnt %d", c, atomic_read(&c->refcnt));
        atomic_inc(&c->refcnt);
 }
 static inline void l2cap_chan_put(struct l2cap_chan *c)
 {
+        BT_DBG("chan %p orig refcnt %d", c, atomic_read(&c->refcnt));
        if (atomic_dec_and_test(&c->refcnt))
                kfree(c);
 }
@@ -713,11 +726,7 @@ static inline bool l2cap_clear_timer(struct l2cap_chan *chan,
 #define __set_chan_timer(c, t) l2cap_set_timer(c, &c->chan_timer, (t))
 #define __clear_chan_timer(c) l2cap_clear_timer(c, &c->chan_timer)
-#define __set_retrans_timer(c) l2cap_set_timer(c, &c->retrans_timer, \
-                msecs_to_jiffies(L2CAP_DEFAULT_RETRANS_TO));
 #define __clear_retrans_timer(c) l2cap_clear_timer(c, &c->retrans_timer)
-#define __set_monitor_timer(c) l2cap_set_timer(c, &c->monitor_timer, \
-                msecs_to_jiffies(L2CAP_DEFAULT_MONITOR_TO));
 #define __clear_monitor_timer(c) l2cap_clear_timer(c, &c->monitor_timer)
 #define __set_ack_timer(c) l2cap_set_timer(c, &chan->ack_timer, \
                msecs_to_jiffies(L2CAP_DEFAULT_ACK_TO));
@@ -736,173 +745,17 @@ static inline __u16 __next_seq(struct l2cap_chan *chan, __u16 seq)
        return (seq + 1) % (chan->tx_win_max + 1);
 }
-static inline int l2cap_tx_window_full(struct l2cap_chan *ch)
+static inline struct l2cap_chan *l2cap_chan_no_new_connection(struct l2cap_chan *chan)
-{
-        int sub;
-        sub = (ch->next_tx_seq - ch->expected_ack_seq) % 64;
-        if (sub < 0)
-                sub += 64;
-        return sub == ch->remote_tx_win;
-}
-static inline __u16 __get_reqseq(struct l2cap_chan *chan, __u32 ctrl)
-{
-        if (test_bit(FLAG_EXT_CTRL, &chan->flags))
-                return (ctrl & L2CAP_EXT_CTRL_REQSEQ) >>
-                                                L2CAP_EXT_CTRL_REQSEQ_SHIFT;
-        else
-                return (ctrl & L2CAP_CTRL_REQSEQ) >> L2CAP_CTRL_REQSEQ_SHIFT;
-}
-static inline __u32 __set_reqseq(struct l2cap_chan *chan, __u32 reqseq)
-{
-        if (test_bit(FLAG_EXT_CTRL, &chan->flags))
-                return (reqseq << L2CAP_EXT_CTRL_REQSEQ_SHIFT) &
-                                                        L2CAP_EXT_CTRL_REQSEQ;
-        else
-                return (reqseq << L2CAP_CTRL_REQSEQ_SHIFT) & L2CAP_CTRL_REQSEQ;
-}
-static inline __u16 __get_txseq(struct l2cap_chan *chan, __u32 ctrl)
-{
-        if (test_bit(FLAG_EXT_CTRL, &chan->flags))
-                return (ctrl & L2CAP_EXT_CTRL_TXSEQ) >>
-                                                L2CAP_EXT_CTRL_TXSEQ_SHIFT;
-        else
-                return (ctrl & L2CAP_CTRL_TXSEQ) >> L2CAP_CTRL_TXSEQ_SHIFT;
-}
-static inline __u32 __set_txseq(struct l2cap_chan *chan, __u32 txseq)
-{
-        if (test_bit(FLAG_EXT_CTRL, &chan->flags))
-                return (txseq << L2CAP_EXT_CTRL_TXSEQ_SHIFT) &
-                                                        L2CAP_EXT_CTRL_TXSEQ;
-        else
-                return (txseq << L2CAP_CTRL_TXSEQ_SHIFT) & L2CAP_CTRL_TXSEQ;
-}
-static inline bool __is_sframe(struct l2cap_chan *chan, __u32 ctrl)
-{
-        if (test_bit(FLAG_EXT_CTRL, &chan->flags))
-                return ctrl & L2CAP_EXT_CTRL_FRAME_TYPE;
-        else
-                return ctrl & L2CAP_CTRL_FRAME_TYPE;
-}
-static inline __u32 __set_sframe(struct l2cap_chan *chan)
-{
-        if (test_bit(FLAG_EXT_CTRL, &chan->flags))
-                return L2CAP_EXT_CTRL_FRAME_TYPE;
-        else
-                return L2CAP_CTRL_FRAME_TYPE;
-}
-static inline __u8 __get_ctrl_sar(struct l2cap_chan *chan, __u32 ctrl)
 {
-        if (test_bit(FLAG_EXT_CTRL, &chan->flags))
+        return NULL;
-                return (ctrl & L2CAP_EXT_CTRL_SAR) >> L2CAP_EXT_CTRL_SAR_SHIFT;
-        else
-                return (ctrl & L2CAP_CTRL_SAR) >> L2CAP_CTRL_SAR_SHIFT;
 }
-static inline __u32 __set_ctrl_sar(struct l2cap_chan *chan, __u32 sar)
+static inline void l2cap_chan_no_teardown(struct l2cap_chan *chan, int err)
 {
-        if (test_bit(FLAG_EXT_CTRL, &chan->flags))
-                return (sar << L2CAP_EXT_CTRL_SAR_SHIFT) & L2CAP_EXT_CTRL_SAR;
-        else
-                return (sar << L2CAP_CTRL_SAR_SHIFT) & L2CAP_CTRL_SAR;
 }
-static inline bool __is_sar_start(struct l2cap_chan *chan, __u32 ctrl)
+static inline void l2cap_chan_no_ready(struct l2cap_chan *chan)
 {
-        return __get_ctrl_sar(chan, ctrl) == L2CAP_SAR_START;
-}
-static inline __u32 __get_sar_mask(struct l2cap_chan *chan)
-{
-        if (test_bit(FLAG_EXT_CTRL, &chan->flags))
-                return L2CAP_EXT_CTRL_SAR;
-        else
-                return L2CAP_CTRL_SAR;
-}
-static inline __u8 __get_ctrl_super(struct l2cap_chan *chan, __u32 ctrl)
-{
-        if (test_bit(FLAG_EXT_CTRL, &chan->flags))
-                return (ctrl & L2CAP_EXT_CTRL_SUPERVISE) >>
-                                                L2CAP_EXT_CTRL_SUPER_SHIFT;
-        else
-                return (ctrl & L2CAP_CTRL_SUPERVISE) >> L2CAP_CTRL_SUPER_SHIFT;
-}
-static inline __u32 __set_ctrl_super(struct l2cap_chan *chan, __u32 super)
-{
-        if (test_bit(FLAG_EXT_CTRL, &chan->flags))
-                return (super << L2CAP_EXT_CTRL_SUPER_SHIFT) &
-                                                L2CAP_EXT_CTRL_SUPERVISE;
-        else
-                return (super << L2CAP_CTRL_SUPER_SHIFT) &
-                                                        L2CAP_CTRL_SUPERVISE;
-}
-static inline __u32 __set_ctrl_final(struct l2cap_chan *chan)
-{
-        if (test_bit(FLAG_EXT_CTRL, &chan->flags))
-                return L2CAP_EXT_CTRL_FINAL;
-        else
-                return L2CAP_CTRL_FINAL;
-}
-static inline bool __is_ctrl_final(struct l2cap_chan *chan, __u32 ctrl)
-{
-        if (test_bit(FLAG_EXT_CTRL, &chan->flags))
-                return ctrl & L2CAP_EXT_CTRL_FINAL;
-        else
-                return ctrl & L2CAP_CTRL_FINAL;
-}
-static inline __u32 __set_ctrl_poll(struct l2cap_chan *chan)
-{
-        if (test_bit(FLAG_EXT_CTRL, &chan->flags))
-                return L2CAP_EXT_CTRL_POLL;
-        else
-                return L2CAP_CTRL_POLL;
-}
-static inline bool __is_ctrl_poll(struct l2cap_chan *chan, __u32 ctrl)
-{
-        if (test_bit(FLAG_EXT_CTRL, &chan->flags))
-                return ctrl & L2CAP_EXT_CTRL_POLL;
-        else
-                return ctrl & L2CAP_CTRL_POLL;
-}
-static inline __u32 __get_control(struct l2cap_chan *chan, void *p)
-{
-        if (test_bit(FLAG_EXT_CTRL, &chan->flags))
-                return get_unaligned_le32(p);
-        else
-                return get_unaligned_le16(p);
-}
-static inline void __put_control(struct l2cap_chan *chan, __u32 control,
-                                                                void *p)
-{
-        if (test_bit(FLAG_EXT_CTRL, &chan->flags))
-                return put_unaligned_le32(control, p);
-        else
-                return put_unaligned_le16(control, p);
-}
-static inline __u8 __ctrl_size(struct l2cap_chan *chan)
-{
-        if (test_bit(FLAG_EXT_CTRL, &chan->flags))
-                return L2CAP_EXT_HDR_SIZE - L2CAP_HDR_SIZE;
-        else
-                return L2CAP_ENH_HDR_SIZE - L2CAP_HDR_SIZE;
 }
 extern bool disable_ertm;
@@ -926,5 +779,8 @@ int l2cap_chan_send(struct l2cap_chan *chan, struct msghdr *msg, size_t len,
 void l2cap_chan_busy(struct l2cap_chan *chan, int busy);
 int l2cap_chan_check_security(struct l2cap_chan *chan);
 void l2cap_chan_set_defaults(struct l2cap_chan *chan);
+int l2cap_ertm_init(struct l2cap_chan *chan);
+void l2cap_chan_add(struct l2cap_conn *conn, struct l2cap_chan *chan);
+void l2cap_chan_del(struct l2cap_chan *chan, int err);
 #endif /* __L2CAP_H */
diff --git a/include/net/bluetooth/mgmt.h b/include/net/bluetooth/mgmt.h
index 23fd0546fccb..4348ee8bda69 100644
--- a/include/net/bluetooth/mgmt.h
+++ b/include/net/bluetooth/mgmt.h
@@ -444,7 +444,7 @@ struct mgmt_ev_auth_failed {
 struct mgmt_ev_device_found {
        struct mgmt_addr_info addr;
        __s8    rssi;
-        __u8    flags[4];
+        __le32  flags;
        __le16  eir_len;
        __u8    eir[0];
 } __packed;
diff --git a/include/net/caif/caif_hsi.h b/include/net/caif/caif_hsi.h
index 439dadc8102f..bcb9cc3ce98b 100644
--- a/include/net/caif/caif_hsi.h
+++ b/include/net/caif/caif_hsi.h
@@ -93,25 +93,25 @@ struct cfhsi_desc {
 #endif
 /* Structure implemented by the CAIF HSI driver. */
-struct cfhsi_drv {
+struct cfhsi_cb_ops {
-        void (*tx_done_cb) (struct cfhsi_drv *drv);
+        void (*tx_done_cb) (struct cfhsi_cb_ops *drv);
-        void (*rx_done_cb) (struct cfhsi_drv *drv);
+        void (*rx_done_cb) (struct cfhsi_cb_ops *drv);
-        void (*wake_up_cb) (struct cfhsi_drv *drv);
+        void (*wake_up_cb) (struct cfhsi_cb_ops *drv);
-        void (*wake_down_cb) (struct cfhsi_drv *drv);
+        void (*wake_down_cb) (struct cfhsi_cb_ops *drv);
 };
 /* Structure implemented by HSI device. */
-struct cfhsi_dev {
+struct cfhsi_ops {
-        int (*cfhsi_up) (struct cfhsi_dev *dev);
+        int (*cfhsi_up) (struct cfhsi_ops *dev);
-        int (*cfhsi_down) (struct cfhsi_dev *dev);
+        int (*cfhsi_down) (struct cfhsi_ops *dev);
-        int (*cfhsi_tx) (u8 *ptr, int len, struct cfhsi_dev *dev);
+        int (*cfhsi_tx) (u8 *ptr, int len, struct cfhsi_ops *dev);
-        int (*cfhsi_rx) (u8 *ptr, int len, struct cfhsi_dev *dev);
+        int (*cfhsi_rx) (u8 *ptr, int len, struct cfhsi_ops *dev);
-        int (*cfhsi_wake_up) (struct cfhsi_dev *dev);
+        int (*cfhsi_wake_up) (struct cfhsi_ops *dev);
-        int (*cfhsi_wake_down) (struct cfhsi_dev *dev);
+        int (*cfhsi_wake_down) (struct cfhsi_ops *dev);
-        int (*cfhsi_get_peer_wake) (struct cfhsi_dev *dev, bool *status);
+        int (*cfhsi_get_peer_wake) (struct cfhsi_ops *dev, bool *status);
-        int (*cfhsi_fifo_occupancy)(struct cfhsi_dev *dev, size_t *occupancy);
+        int (*cfhsi_fifo_occupancy) (struct cfhsi_ops *dev, size_t *occupancy);
-        int (*cfhsi_rx_cancel)(struct cfhsi_dev *dev);
+        int (*cfhsi_rx_cancel)(struct cfhsi_ops *dev);
-        struct cfhsi_drv *drv;
+        struct cfhsi_cb_ops *cb_ops;
 };
 /* Structure holds status of received CAIF frames processing */
@@ -132,17 +132,26 @@ enum {
        CFHSI_PRIO_LAST,
 };
+struct cfhsi_config {
+        u32 inactivity_timeout;
+        u32 aggregation_timeout;
+        u32 head_align;
+        u32 tail_align;
+        u32 q_high_mark;
+        u32 q_low_mark;
+};
 /* Structure implemented by CAIF HSI drivers. */
 struct cfhsi {
        struct caif_dev_common cfdev;
        struct net_device *ndev;
        struct platform_device *pdev;
        struct sk_buff_head qhead[CFHSI_PRIO_LAST];
-        struct cfhsi_drv drv;
+        struct cfhsi_cb_ops cb_ops;
-        struct cfhsi_dev *dev;
+        struct cfhsi_ops *ops;
        int tx_state;
        struct cfhsi_rx_state rx_state;
-        unsigned long inactivity_timeout;
+        struct cfhsi_config cfg;
        int rx_len;
        u8 *rx_ptr;
        u8 *tx_buf;
@@ -150,8 +159,6 @@ struct cfhsi {
        u8 *rx_flip_buf;
        spinlock_t lock;
        int flow_off_sent;
-        u32 q_low_mark;
-        u32 q_high_mark;
        struct list_head list;
        struct work_struct wake_up_work;
        struct work_struct wake_down_work;
@@ -164,13 +171,31 @@ struct cfhsi {
        struct timer_list rx_slowpath_timer;
        /* TX aggregation */
-        unsigned long aggregation_timeout;
        int aggregation_len;
        struct timer_list aggregation_timer;
        unsigned long bits;
 };
 extern struct platform_driver cfhsi_driver;
+/**
+ * enum ifla_caif_hsi - CAIF HSI NetlinkRT parameters.
+ * @IFLA_CAIF_HSI_INACTIVITY_TOUT: Inactivity timeout before
+ *                      taking the HSI wakeline down, in milliseconds.
+ * When using RT Netlink to create, destroy or configure a CAIF HSI interface,
+ * enum ifla_caif_hsi is used to specify the configuration attributes.
+ */
+enum ifla_caif_hsi {
+        __IFLA_CAIF_HSI_UNSPEC,
+        __IFLA_CAIF_HSI_INACTIVITY_TOUT,
+        __IFLA_CAIF_HSI_AGGREGATION_TOUT,
+        __IFLA_CAIF_HSI_HEAD_ALIGN,
+        __IFLA_CAIF_HSI_TAIL_ALIGN,
+        __IFLA_CAIF_HSI_QHIGH_WATERMARK,
+        __IFLA_CAIF_HSI_QLOW_WATERMARK,
+        __IFLA_CAIF_HSI_MAX
+};
+extern struct cfhsi_ops *cfhsi_get_ops(void);
 #endif          /* CAIF_HSI_H_ */
diff --git a/include/net/cfg80211.h b/include/net/cfg80211.h
index 0289d4ce7070..493fa0c79005 100644
--- a/include/net/cfg80211.h
+++ b/include/net/cfg80211.h
@@ -70,11 +70,13 @@
 *
 * @IEEE80211_BAND_2GHZ: 2.4GHz ISM band
 * @IEEE80211_BAND_5GHZ: around 5GHz band (4.9-5.7)
+ * @IEEE80211_BAND_60GHZ: around 60 GHz band (58.32 - 64.80 GHz)
 * @IEEE80211_NUM_BANDS: number of defined bands
 */
 enum ieee80211_band {
        IEEE80211_BAND_2GHZ = NL80211_BAND_2GHZ,
        IEEE80211_BAND_5GHZ = NL80211_BAND_5GHZ,
+        IEEE80211_BAND_60GHZ = NL80211_BAND_60GHZ,
        /* keep last */
        IEEE80211_NUM_BANDS
@@ -211,6 +213,22 @@ struct ieee80211_sta_ht_cap {
 };
 /**
+ * struct ieee80211_sta_vht_cap - STA's VHT capabilities
+ *
+ * This structure describes most essential parameters needed
+ * to describe 802.11ac VHT capabilities for an STA.
+ *
+ * @vht_supported: is VHT supported by the STA
+ * @cap: VHT capabilities map as described in 802.11ac spec
+ * @vht_mcs: Supported VHT MCS rates
+ */
+struct ieee80211_sta_vht_cap {
+        bool vht_supported;
+        u32 cap; /* use IEEE80211_VHT_CAP_ */
+        struct ieee80211_vht_mcs_info vht_mcs;
+};
+/**
 * struct ieee80211_supported_band - frequency band definition
 *
 * This structure describes a frequency band a wiphy
@@ -233,6 +251,7 @@ struct ieee80211_supported_band {
        int n_channels;
        int n_bitrates;
        struct ieee80211_sta_ht_cap ht_cap;
+        struct ieee80211_sta_vht_cap vht_cap;
 };
 /*
@@ -404,6 +423,8 @@ struct cfg80211_beacon_data {
 *
 * Used to configure an AP interface.
 *
+ * @channel: the channel to start the AP on
+ * @channel_type: the channel type to use
 * @beacon: beacon data
 * @beacon_interval: beacon interval
 * @dtim_period: DTIM period
@@ -417,6 +438,9 @@ struct cfg80211_beacon_data {
 * @inactivity_timeout: time in seconds to determine station's inactivity.
 */
 struct cfg80211_ap_settings {
+        struct ieee80211_channel *channel;
+        enum nl80211_channel_type channel_type;
        struct cfg80211_beacon_data beacon;
        int beacon_interval, dtim_period;
@@ -556,11 +580,13 @@ enum station_info_flags {
 * @RATE_INFO_FLAGS_MCS: @tx_bitrate_mcs filled
 * @RATE_INFO_FLAGS_40_MHZ_WIDTH: 40 Mhz width transmission
 * @RATE_INFO_FLAGS_SHORT_GI: 400ns guard interval
+ * @RATE_INFO_FLAGS_60G: 60gHz MCS
 */
 enum rate_info_flags {
        RATE_INFO_FLAGS_MCS             = 1<<0,
        RATE_INFO_FLAGS_40_MHZ_WIDTH    = 1<<1,
        RATE_INFO_FLAGS_SHORT_GI        = 1<<2,
+        RATE_INFO_FLAGS_60G             = 1<<3,
 };
 /**
@@ -622,10 +648,10 @@ struct sta_bss_parameters {
 * @llid: mesh local link id
 * @plid: mesh peer link id
 * @plink_state: mesh peer link state
- * @signal: the signal strength, type depends on the wiphy's signal_type
+ * @signal: The signal strength, type depends on the wiphy's signal_type.
-        NOTE: For CFG80211_SIGNAL_TYPE_MBM, value is expressed in _dBm_.
+ *      For CFG80211_SIGNAL_TYPE_MBM, value is expressed in _dBm_.
- * @signal_avg: avg signal strength, type depends on the wiphy's signal_type
+ * @signal_avg: Average signal strength, type depends on the wiphy's signal_type.
-        NOTE: For CFG80211_SIGNAL_TYPE_MBM, value is expressed in _dBm_.
+ *      For CFG80211_SIGNAL_TYPE_MBM, value is expressed in _dBm_.
 * @txrate: current unicast bitrate from this station
 * @rxrate: current unicast bitrate to this station
 * @rx_packets: packets received from this station
@@ -785,47 +811,101 @@ struct bss_parameters {
        int ht_opmode;
 };
-/*
+/**
 * struct mesh_config - 802.11s mesh configuration
 *
 * These parameters can be changed while the mesh is active.
+ *
+ * @dot11MeshRetryTimeout: the initial retry timeout in millisecond units used
+ *      by the Mesh Peering Open message
+ * @dot11MeshConfirmTimeout: the initial retry timeout in millisecond units
+ *      used by the Mesh Peering Open message
+ * @dot11MeshHoldingTimeout: the confirm timeout in millisecond units used by
+ *      the mesh peering management to close a mesh peering
+ * @dot11MeshMaxPeerLinks: the maximum number of peer links allowed on this
+ *      mesh interface
+ * @dot11MeshMaxRetries: the maximum number of peer link open retries that can
+ *      be sent to establish a new peer link instance in a mesh
+ * @dot11MeshTTL: the value of TTL field set at a source mesh STA
+ * @element_ttl: the value of TTL field set at a mesh STA for path selection
+ *      elements
+ * @auto_open_plinks: whether we should automatically open peer links when we
+ *      detect compatible mesh peers
+ * @dot11MeshNbrOffsetMaxNeighbor: the maximum number of neighbors to
+ *      synchronize to for 11s default synchronization method
+ * @dot11MeshHWMPmaxPREQretries: the number of action frames containing a PREQ
+ *      that an originator mesh STA can send to a particular path target
+ * @path_refresh_time: how frequently to refresh mesh paths in milliseconds
+ * @min_discovery_timeout: the minimum length of time to wait until giving up on
+ *      a path discovery in milliseconds
+ * @dot11MeshHWMPactivePathTimeout: the time (in TUs) for which mesh STAs
+ *      receiving a PREQ shall consider the forwarding information from the
+ *      root to be valid. (TU = time unit)
+ * @dot11MeshHWMPpreqMinInterval: the minimum interval of time (in TUs) during
+ *      which a mesh STA can send only one action frame containing a PREQ
+ *      element
+ * @dot11MeshHWMPperrMinInterval: the minimum interval of time (in TUs) during
+ *      which a mesh STA can send only one Action frame containing a PERR
+ *      element
+ * @dot11MeshHWMPnetDiameterTraversalTime: the interval of time (in TUs) that
+ *      it takes for an HWMP information element to propagate across the mesh
+ * @dot11MeshHWMPRootMode: the configuration of a mesh STA as root mesh STA
+ * @dot11MeshHWMPRannInterval: the interval of time (in TUs) between root
+ *      announcements are transmitted
+ * @dot11MeshGateAnnouncementProtocol: whether to advertise that this mesh
+ *      station has access to a broader network beyond the MBSS. (This is
+ *      missnamed in draft 12.0: dot11MeshGateAnnouncementProtocol set to true
+ *      only means that the station will announce others it's a mesh gate, but
+ *      not necessarily using the gate announcement protocol. Still keeping the
+ *      same nomenclature to be in sync with the spec)
+ * @dot11MeshForwarding: whether the Mesh STA is forwarding or non-forwarding
+ *      entity (default is TRUE - forwarding entity)
+ * @rssi_threshold: the threshold for average signal strength of candidate
+ *      station to establish a peer link
+ * @ht_opmode: mesh HT protection mode
+ *
+ * @dot11MeshHWMPactivePathToRootTimeout: The time (in TUs) for which mesh STAs
+ *      receiving a proactive PREQ shall consider the forwarding information to
+ *      the root mesh STA to be valid.
+ *
+ * @dot11MeshHWMProotInterval: The interval of time (in TUs) between proactive
+ *      PREQs are transmitted.
+ * @dot11MeshHWMPconfirmationInterval: The minimum interval of time (in TUs)
+ *      during which a mesh STA can send only one Action frame containing
+ *      a PREQ element for root path confirmation.
 */
 struct mesh_config {
-        /* Timeouts in ms */
-        /* Mesh plink management parameters */
        u16 dot11MeshRetryTimeout;
        u16 dot11MeshConfirmTimeout;
        u16 dot11MeshHoldingTimeout;
        u16 dot11MeshMaxPeerLinks;
-        u8  dot11MeshMaxRetries;
+        u8 dot11MeshMaxRetries;
-        u8  dot11MeshTTL;
+        u8 dot11MeshTTL;
-        /* ttl used in path selection information elements */
+        u8 element_ttl;
-        u8  element_ttl;
        bool auto_open_plinks;
-        /* neighbor offset synchronization */
        u32 dot11MeshNbrOffsetMaxNeighbor;
-        /* HWMP parameters */
+        u8 dot11MeshHWMPmaxPREQretries;
-        u8  dot11MeshHWMPmaxPREQretries;
        u32 path_refresh_time;
        u16 min_discovery_timeout;
        u32 dot11MeshHWMPactivePathTimeout;
        u16 dot11MeshHWMPpreqMinInterval;
        u16 dot11MeshHWMPperrMinInterval;
        u16 dot11MeshHWMPnetDiameterTraversalTime;
-        u8  dot11MeshHWMPRootMode;
+        u8 dot11MeshHWMPRootMode;
        u16 dot11MeshHWMPRannInterval;
-        /* This is missnamed in draft 12.0: dot11MeshGateAnnouncementProtocol
+        bool dot11MeshGateAnnouncementProtocol;
-         * set to true only means that the station will announce others it's a
-         * mesh gate, but not necessarily using the gate announcement protocol.
-         * Still keeping the same nomenclature to be in sync with the spec. */
-        bool  dot11MeshGateAnnouncementProtocol;
        bool dot11MeshForwarding;
        s32 rssi_threshold;
        u16 ht_opmode;
+        u32 dot11MeshHWMPactivePathToRootTimeout;
+        u16 dot11MeshHWMProotInterval;
+        u16 dot11MeshHWMPconfirmationInterval;
 };
 /**
 * struct mesh_setup - 802.11s mesh setup configuration
+ * @channel: the channel to start the mesh network on
+ * @channel_type: the channel type to use
 * @mesh_id: the mesh ID
 * @mesh_id_len: length of the mesh ID, at least 1 and at most 32 bytes
 * @sync_method: which synchronization method to use
@@ -840,6 +920,8 @@ struct mesh_config {
 * These parameters are fixed when the mesh is created.
 */
 struct mesh_setup {
+        struct ieee80211_channel *channel;
+        enum nl80211_channel_type channel_type;
        const u8 *mesh_id;
        u8 mesh_id_len;
        u8 sync_method;
@@ -917,7 +999,7 @@ struct cfg80211_ssid {
 * @ie_len: length of ie in octets
 * @rates: bitmap of rates to advertise for each band
 * @wiphy: the wiphy this was for
- * @dev: the interface
+ * @wdev: the wireless device to scan for
 * @aborted: (internal) scan request was notified as aborted
 * @no_cck: used to send probe requests at non CCK rate in 2GHz band
 */
@@ -930,9 +1012,10 @@ struct cfg80211_scan_request {
        u32 rates[IEEE80211_NUM_BANDS];
+        struct wireless_dev *wdev;
        /* internal */
        struct wiphy *wiphy;
-        struct net_device *dev;
        bool aborted;
        bool no_cck;
@@ -966,6 +1049,7 @@ struct cfg80211_match_set {
 * @wiphy: the wiphy this was for
 * @dev: the interface
 * @channels: channels to scan
+ * @rssi_thold: don't report scan results below this threshold (in s32 dBm)
 */
 struct cfg80211_sched_scan_request {
        struct cfg80211_ssid *ssids;
@@ -976,6 +1060,7 @@ struct cfg80211_sched_scan_request {
        size_t ie_len;
        struct cfg80211_match_set *match_sets;
        int n_match_sets;
+        s32 rssi_thold;
        /* internal */
        struct wiphy *wiphy;
@@ -1351,10 +1436,10 @@ struct cfg80211_gtk_rekey_data {
 *
 * @add_virtual_intf: create a new virtual interface with the given name,
 *      must set the struct wireless_dev's iftype. Beware: You must create
- *      the new netdev in the wiphy's network namespace! Returns the netdev,
+ *      the new netdev in the wiphy's network namespace! Returns the struct
- *      or an ERR_PTR.
+ *      wireless_dev, or an ERR_PTR.
 *
- * @del_virtual_intf: remove the virtual interface determined by ifindex.
+ * @del_virtual_intf: remove the virtual interface
 *
 * @change_virtual_intf: change type/configuration of virtual interface,
 *      keep the struct wireless_dev's iftype updated.
@@ -1411,14 +1496,14 @@ struct cfg80211_gtk_rekey_data {
 *
 * @set_txq_params: Set TX queue parameters
 *
- * @set_channel: Set channel for a given wireless interface. Some devices
+ * @libertas_set_mesh_channel: Only for backward compatibility for libertas,
- *      may support multi-channel operation (by channel hopping) so cfg80211
+ *      as it doesn't implement join_mesh and needs to set the channel to
- *      doesn't verify much. Note, however, that the passed netdev may be
+ *      join the mesh instead.
- *      %NULL as well if the user requested changing the channel for the
+ *
- *      device itself, or for a monitor interface.
+ * @set_monitor_channel: Set the monitor mode channel for the device. If other
- * @get_channel: Get the current operating channel, should return %NULL if
+ *      interfaces are active this callback should reject the configuration.
- *      there's no single defined operating channel if for example the
+ *      If no interfaces are active or the device is down, the channel should
- *      device implements channel hopping for multi-channel virtual interfaces.
+ *      be stored for when a monitor interface becomes active.
 *
 * @scan: Request to do a scan. If returning zero, the scan request is given
 *      the driver, and will be valid until passed to cfg80211_scan_done().
@@ -1488,6 +1573,8 @@ struct cfg80211_gtk_rekey_data {
 * @set_power_mgmt: Configure WLAN power management. A timeout value of -1
 *      allows the driver to adjust the dynamic ps timeout value.
 * @set_cqm_rssi_config: Configure connection quality monitor RSSI threshold.
+ * @set_cqm_txe_config: Configure connection quality monitor TX error
+ *      thresholds.
 * @sched_scan_start: Tell the driver to start a scheduled scan.
 * @sched_scan_stop: Tell the driver to stop an ongoing scheduled
 *      scan.  The driver_initiated flag specifies whether the driver
@@ -1525,18 +1612,23 @@ struct cfg80211_gtk_rekey_data {
 * @get_et_strings:  Ethtool API to get a set of strings to describe stats
 *      and perhaps other supported types of ethtool data-sets.
 *      See @ethtool_ops.get_strings
+ *
+ * @get_channel: Get the current operating channel for the virtual interface.
+ *      For monitor interfaces, it should return %NULL unless there's a single
+ *      current monitoring channel.
 */
 struct cfg80211_ops {
        int     (*suspend)(struct wiphy *wiphy, struct cfg80211_wowlan *wow);
        int     (*resume)(struct wiphy *wiphy);
        void    (*set_wakeup)(struct wiphy *wiphy, bool enabled);
-        struct net_device * (*add_virtual_intf)(struct wiphy *wiphy,
+        struct wireless_dev * (*add_virtual_intf)(struct wiphy *wiphy,
-                                                char *name,
+                                                  char *name,
-                                                enum nl80211_iftype type,
+                                                  enum nl80211_iftype type,
-                                                u32 *flags,
+                                                  u32 *flags,
-                                                struct vif_params *params);
+                                                  struct vif_params *params);
-        int     (*del_virtual_intf)(struct wiphy *wiphy, struct net_device *dev);
+        int     (*del_virtual_intf)(struct wiphy *wiphy,
+                                    struct wireless_dev *wdev);
        int     (*change_virtual_intf)(struct wiphy *wiphy,
                                       struct net_device *dev,
                                       enum nl80211_iftype type, u32 *flags,
@@ -1605,11 +1697,15 @@ struct cfg80211_ops {
        int     (*set_txq_params)(struct wiphy *wiphy, struct net_device *dev,
                                  struct ieee80211_txq_params *params);
-        int     (*set_channel)(struct wiphy *wiphy, struct net_device *dev,
+        int     (*libertas_set_mesh_channel)(struct wiphy *wiphy,
-                               struct ieee80211_channel *chan,
+                                             struct net_device *dev,
-                               enum nl80211_channel_type channel_type);
+                                             struct ieee80211_channel *chan);
+        int     (*set_monitor_channel)(struct wiphy *wiphy,
+                                       struct ieee80211_channel *chan,
+                                       enum nl80211_channel_type channel_type);
-        int     (*scan)(struct wiphy *wiphy, struct net_device *dev,
+        int     (*scan)(struct wiphy *wiphy,
                        struct cfg80211_scan_request *request);
        int     (*auth)(struct wiphy *wiphy, struct net_device *dev,
@@ -1663,23 +1759,23 @@ struct cfg80211_ops {
        int     (*flush_pmksa)(struct wiphy *wiphy, struct net_device *netdev);
        int     (*remain_on_channel)(struct wiphy *wiphy,
-                                     struct net_device *dev,
+                                     struct wireless_dev *wdev,
                                     struct ieee80211_channel *chan,
                                     enum nl80211_channel_type channel_type,
                                     unsigned int duration,
                                     u64 *cookie);
        int     (*cancel_remain_on_channel)(struct wiphy *wiphy,
-                                            struct net_device *dev,
+                                            struct wireless_dev *wdev,
                                            u64 cookie);
-        int     (*mgmt_tx)(struct wiphy *wiphy, struct net_device *dev,
+        int     (*mgmt_tx)(struct wiphy *wiphy, struct wireless_dev *wdev,
                          struct ieee80211_channel *chan, bool offchan,
                          enum nl80211_channel_type channel_type,
                          bool channel_type_valid, unsigned int wait,
                          const u8 *buf, size_t len, bool no_cck,
                          bool dont_wait_for_ack, u64 *cookie);
        int     (*mgmt_tx_cancel_wait)(struct wiphy *wiphy,
-                                       struct net_device *dev,
+                                       struct wireless_dev *wdev,
                                       u64 cookie);
        int     (*set_power_mgmt)(struct wiphy *wiphy, struct net_device *dev,
@@ -1689,8 +1785,12 @@ struct cfg80211_ops {
                                       struct net_device *dev,
                                       s32 rssi_thold, u32 rssi_hyst);
+        int     (*set_cqm_txe_config)(struct wiphy *wiphy,
+                                      struct net_device *dev,
+                                      u32 rate, u32 pkts, u32 intvl);
        void    (*mgmt_frame_register)(struct wiphy *wiphy,
-                                       struct net_device *dev,
+                                       struct wireless_dev *wdev,
                                       u16 frame_type, bool reg);
        int     (*set_antenna)(struct wiphy *wiphy, u32 tx_ant, u32 rx_ant);
@@ -1721,15 +1821,17 @@ struct cfg80211_ops {
                                  struct net_device *dev,
                                  u16 noack_map);
-        struct ieee80211_channel *(*get_channel)(struct wiphy *wiphy,
-                                               enum nl80211_channel_type *type);
        int     (*get_et_sset_count)(struct wiphy *wiphy,
                                     struct net_device *dev, int sset);
        void    (*get_et_stats)(struct wiphy *wiphy, struct net_device *dev,
                                struct ethtool_stats *stats, u64 *data);
        void    (*get_et_strings)(struct wiphy *wiphy, struct net_device *dev,
                                  u32 sset, u8 *data);
+        struct ieee80211_channel *
+                (*get_channel)(struct wiphy *wiphy,
+                               struct wireless_dev *wdev,
+                               enum nl80211_channel_type *type);
 };
 /*
@@ -2083,7 +2185,9 @@ struct wiphy {
        char fw_version[ETHTOOL_BUSINFO_LEN];
        u32 hw_version;
+#ifdef CONFIG_PM
        struct wiphy_wowlan_support wowlan;
+#endif
        u16 max_remain_on_channel_duration;
@@ -2250,20 +2354,31 @@ struct cfg80211_internal_bss;
 struct cfg80211_cached_keys;
 /**
- * struct wireless_dev - wireless per-netdev state
+ * struct wireless_dev - wireless device state
+ *
+ * For netdevs, this structure must be allocated by the driver
+ * that uses the ieee80211_ptr field in struct net_device (this
+ * is intentional so it can be allocated along with the netdev.)
+ * It need not be registered then as netdev registration will
+ * be intercepted by cfg80211 to see the new wireless device.
 *
- * This structure must be allocated by the driver/stack
+ * For non-netdev uses, it must also be allocated by the driver
- * that uses the ieee80211_ptr field in struct net_device
+ * in response to the cfg80211 callbacks that require it, as
- * (this is intentional so it can be allocated along with
+ * there's no netdev registration in that case it may not be
- * the netdev.)
+ * allocated outside of callback operations that return it.
 *
 * @wiphy: pointer to hardware description
 * @iftype: interface type
 * @list: (private) Used to collect the interfaces
- * @netdev: (private) Used to reference back to the netdev
+ * @netdev: (private) Used to reference back to the netdev, may be %NULL
+ * @identifier: (private) Identifier used in nl80211 to identify this
+ *      wireless device if it has no netdev
 * @current_bss: (private) Used by the internal configuration code
 * @channel: (private) Used by the internal configuration code to track
- *      user-set AP, monitor and WDS channels for wireless extensions
+ *      the user-set AP, monitor and WDS channel
+ * @preset_chan: (private) Used by the internal configuration code to
+ *      track the channel to be used for AP later
+ * @preset_chantype: (private) the corresponding channel type
 * @bssid: (private) Used by the internal configuration code
 * @ssid: (private) Used by the internal configuration code
 * @ssid_len: (private) Used by the internal configuration code
@@ -2289,6 +2404,8 @@ struct wireless_dev {
        struct list_head list;
        struct net_device *netdev;
+        u32 identifier;
        struct list_head mgmt_registrations;
        spinlock_t mgmt_registrations_lock;
@@ -2313,8 +2430,14 @@ struct wireless_dev {
        spinlock_t event_lock;
        struct cfg80211_internal_bss *current_bss; /* associated / joined */
+        struct ieee80211_channel *preset_chan;
+        enum nl80211_channel_type preset_chantype;
+        /* for AP and mesh channel tracking */
        struct ieee80211_channel *channel;
+        bool ibss_fixed;
        bool ps;
        int ps_timeout;
@@ -3169,7 +3292,7 @@ void cfg80211_disconnected(struct net_device *dev, u16 reason,
 /**
 * cfg80211_ready_on_channel - notification of remain_on_channel start
- * @dev: network device
+ * @wdev: wireless device
 * @cookie: the request cookie
 * @chan: The current channel (from remain_on_channel request)
 * @channel_type: Channel type
@@ -3177,21 +3300,20 @@ void cfg80211_disconnected(struct net_device *dev, u16 reason,
 *      channel
 * @gfp: allocation flags
 */
-void cfg80211_ready_on_channel(struct net_device *dev, u64 cookie,
+void cfg80211_ready_on_channel(struct wireless_dev *wdev, u64 cookie,
                               struct ieee80211_channel *chan,
                               enum nl80211_channel_type channel_type,
                               unsigned int duration, gfp_t gfp);
 /**
 * cfg80211_remain_on_channel_expired - remain_on_channel duration expired
- * @dev: network device
+ * @wdev: wireless device
 * @cookie: the request cookie
 * @chan: The current channel (from remain_on_channel request)
 * @channel_type: Channel type
 * @gfp: allocation flags
 */
-void cfg80211_remain_on_channel_expired(struct net_device *dev,
+void cfg80211_remain_on_channel_expired(struct wireless_dev *wdev, u64 cookie,
-                                        u64 cookie,
                                        struct ieee80211_channel *chan,
                                        enum nl80211_channel_type channel_type,
                                        gfp_t gfp);
@@ -3219,7 +3341,7 @@ void cfg80211_del_sta(struct net_device *dev, const u8 *mac_addr, gfp_t gfp);
 /**
 * cfg80211_rx_mgmt - notification of received, unprocessed management frame
- * @dev: network device
+ * @wdev: wireless device receiving the frame
 * @freq: Frequency on which the frame was received in MHz
 * @sig_dbm: signal strength in mBm, or 0 if unknown
 * @buf: Management frame (header + body)
@@ -3234,12 +3356,12 @@ void cfg80211_del_sta(struct net_device *dev, const u8 *mac_addr, gfp_t gfp);
 * This function is called whenever an Action frame is received for a station
 * mode interface, but is not processed in kernel.
 */
-bool cfg80211_rx_mgmt(struct net_device *dev, int freq, int sig_dbm,
+bool cfg80211_rx_mgmt(struct wireless_dev *wdev, int freq, int sig_dbm,
                      const u8 *buf, size_t len, gfp_t gfp);
 /**
 * cfg80211_mgmt_tx_status - notification of TX status for management frame
- * @dev: network device
+ * @wdev: wireless device receiving the frame
 * @cookie: Cookie returned by cfg80211_ops::mgmt_tx()
 * @buf: Management frame (header + body)
 * @len: length of the frame data
@@ -3250,7 +3372,7 @@ bool cfg80211_rx_mgmt(struct net_device *dev, int freq, int sig_dbm,
 * transmitted with cfg80211_ops::mgmt_tx() to report the TX status of the
 * transmission attempt.
 */
-void cfg80211_mgmt_tx_status(struct net_device *dev, u64 cookie,
+void cfg80211_mgmt_tx_status(struct wireless_dev *wdev, u64 cookie,
                             const u8 *buf, size_t len, bool ack, gfp_t gfp);
@@ -3280,6 +3402,21 @@ void cfg80211_cqm_pktloss_notify(struct net_device *dev,
                                 const u8 *peer, u32 num_packets, gfp_t gfp);
 /**
+ * cfg80211_cqm_txe_notify - TX error rate event
+ * @dev: network device
+ * @peer: peer's MAC address
+ * @num_packets: how many packets were lost
+ * @rate: % of packets which failed transmission
+ * @intvl: interval (in s) over which the TX failure threshold was breached.
+ * @gfp: context flags
+ *
+ * Notify userspace when configured % TX failures over number of packets in a
+ * given interval is exceeded.
+ */
+void cfg80211_cqm_txe_notify(struct net_device *dev, const u8 *peer,
+                             u32 num_packets, u32 rate, u32 intvl, gfp_t gfp);
+/**
 * cfg80211_gtk_rekey_notify - notify userspace about driver rekeying
 * @dev: network device
 * @bssid: BSSID of AP (to avoid races)
@@ -3359,11 +3496,14 @@ void cfg80211_report_obss_beacon(struct wiphy *wiphy,
                                 const u8 *frame, size_t len,
                                 int freq, int sig_dbm, gfp_t gfp);
-/*
+/**
 * cfg80211_can_beacon_sec_chan - test if ht40 on extension channel can be used
 * @wiphy: the wiphy
 * @chan: main channel
 * @channel_type: HT mode
+ *
+ * This function returns true if there is no secondary channel or the secondary
+ * channel can be used for beaconing (i.e. is not a radar channel etc.)
 */
 bool cfg80211_can_beacon_sec_chan(struct wiphy *wiphy,
                                  struct ieee80211_channel *chan,
@@ -3386,7 +3526,7 @@ void cfg80211_ch_switch_notify(struct net_device *dev, int freq,
 *
 * return 0 if MCS index >= 32
 */
-u16 cfg80211_calculate_bitrate(struct rate_info *rate);
+u32 cfg80211_calculate_bitrate(struct rate_info *rate);
 /* Logging, debugging and troubleshooting/diagnostic helpers. */
diff --git a/include/net/dn_route.h b/include/net/dn_route.h
index c507e05d172f..4f7d6a182381 100644
--- a/include/net/dn_route.h
+++ b/include/net/dn_route.h
@@ -67,6 +67,8 @@ extern void dn_rt_cache_flush(int delay);
 struct dn_route {
        struct dst_entry dst;
+        struct neighbour *n;
        struct flowidn fld;
        __le16 rt_saddr;
diff --git a/include/net/dst.h b/include/net/dst.h
index 8197eadca819..baf597890064 100644
--- a/include/net/dst.h
+++ b/include/net/dst.h
@@ -42,16 +42,16 @@ struct dst_entry {
                struct dst_entry        *from;
        };
        struct dst_entry        *path;
-        struct neighbour __rcu  *_neighbour;
+        void                    *__pad0;
 #ifdef CONFIG_XFRM
        struct xfrm_state       *xfrm;
 #else
        void                    *__pad1;
 #endif
-        int                     (*input)(struct sk_buff*);
+        int                     (*input)(struct sk_buff *);
-        int                     (*output)(struct sk_buff*);
+        int                     (*output)(struct sk_buff *);
-        int                     flags;
+        unsigned short          flags;
 #define DST_HOST                0x0001
 #define DST_NOXFRM              0x0002
 #define DST_NOPOLICY            0x0004
@@ -62,8 +62,23 @@ struct dst_entry {
 #define DST_FAKE_RTABLE         0x0080
 #define DST_XFRM_TUNNEL         0x0100
+        unsigned short          pending_confirm;
        short                   error;
+        /* A non-zero value of dst->obsolete forces by-hand validation
+         * of the route entry.  Positive values are set by the generic
+         * dst layer to indicate that the entry has been forcefully
+         * destroyed.
+         *
+         * Negative values are used by the implementation layer code to
+         * force invocation of the dst_ops->check() method.
+         */
        short                   obsolete;
+#define DST_OBSOLETE_NONE       0
+#define DST_OBSOLETE_DEAD       2
+#define DST_OBSOLETE_FORCE_CHK  -1
+#define DST_OBSOLETE_KILL       -2
        unsigned short          header_len;     /* more space at head required */
        unsigned short          trailer_len;    /* space to reserve at tail */
 #ifdef CONFIG_IP_ROUTE_CLASSID
@@ -94,21 +109,6 @@ struct dst_entry {
        };
 };
-static inline struct neighbour *dst_get_neighbour_noref(struct dst_entry *dst)
-{
-        return rcu_dereference(dst->_neighbour);
-}
-static inline struct neighbour *dst_get_neighbour_noref_raw(struct dst_entry *dst)
-{
-        return rcu_dereference_raw(dst->_neighbour);
-}
-static inline void dst_set_neighbour(struct dst_entry *dst, struct neighbour *neigh)
-{
-        rcu_assign_pointer(dst->_neighbour, neigh);
-}
 extern u32 *dst_cow_metrics_generic(struct dst_entry *dst, unsigned long old);
 extern const u32 dst_default_metrics[RTAX_MAX];
@@ -222,12 +222,6 @@ static inline unsigned long dst_metric_rtt(const struct dst_entry *dst, int metr
        return msecs_to_jiffies(dst_metric(dst, metric));
 }
-static inline void set_dst_metric_rtt(struct dst_entry *dst, int metric,
-                                      unsigned long rtt)
-{
-        dst_metric_set(dst, metric, jiffies_to_msecs(rtt));
-}
 static inline u32
 dst_allfrag(const struct dst_entry *dst)
 {
@@ -241,7 +235,7 @@ dst_metric_locked(const struct dst_entry *dst, int metric)
        return dst_metric(dst, RTAX_LOCK) & (1<<metric);
 }
-static inline void dst_hold(struct dst_entry * dst)
+static inline void dst_hold(struct dst_entry *dst)
 {
        /*
         * If your kernel compilation stops here, please check
@@ -264,8 +258,7 @@ static inline void dst_use_noref(struct dst_entry *dst, unsigned long time)
        dst->lastuse = time;
 }
-static inline
+static inline struct dst_entry *dst_clone(struct dst_entry *dst)
-struct dst_entry * dst_clone(struct dst_entry * dst)
 {
        if (dst)
                atomic_inc(&dst->__refcnt);
@@ -371,14 +364,15 @@ static inline struct dst_entry *skb_dst_pop(struct sk_buff *skb)
 }
 extern int dst_discard(struct sk_buff *skb);
-extern void *dst_alloc(struct dst_ops * ops, struct net_device *dev,
+extern void *dst_alloc(struct dst_ops *ops, struct net_device *dev,
-                       int initial_ref, int initial_obsolete, int flags);
+                       int initial_ref, int initial_obsolete,
-extern void __dst_free(struct dst_entry * dst);
+                       unsigned short flags);
-extern struct dst_entry *dst_destroy(struct dst_entry * dst);
+extern void __dst_free(struct dst_entry *dst);
+extern struct dst_entry *dst_destroy(struct dst_entry *dst);
-static inline void dst_free(struct dst_entry * dst)
+static inline void dst_free(struct dst_entry *dst)
 {
-        if (dst->obsolete > 1)
+        if (dst->obsolete > 0)
                return;
        if (!atomic_read(&dst->__refcnt)) {
                dst = dst_destroy(dst);
@@ -396,19 +390,35 @@ static inline void dst_rcu_free(struct rcu_head *head)
 static inline void dst_confirm(struct dst_entry *dst)
 {
-        if (dst) {
+        dst->pending_confirm = 1;
-                struct neighbour *n;
+}
-                rcu_read_lock();
+static inline int dst_neigh_output(struct dst_entry *dst, struct neighbour *n,
-                n = dst_get_neighbour_noref(dst);
+                                   struct sk_buff *skb)
-                neigh_confirm(n);
+{
-                rcu_read_unlock();
+        struct hh_cache *hh;
+        if (unlikely(dst->pending_confirm)) {
+                n->confirmed = jiffies;
+                dst->pending_confirm = 0;
        }
+        hh = &n->hh;
+        if ((n->nud_state & NUD_CONNECTED) && hh->hh_len)
+                return neigh_hh_output(hh, skb);
+        else
+                return n->output(n, skb);
 }
 static inline struct neighbour *dst_neigh_lookup(const struct dst_entry *dst, const void *daddr)
 {
-        return dst->ops->neigh_lookup(dst, daddr);
+        return dst->ops->neigh_lookup(dst, NULL, daddr);
+}
+static inline struct neighbour *dst_neigh_lookup_skb(const struct dst_entry *dst,
+                                                     struct sk_buff *skb)
+{
+        return dst->ops->neigh_lookup(dst, skb, NULL);
 }
 static inline void dst_link_failure(struct sk_buff *skb)
diff --git a/include/net/dst_ops.h b/include/net/dst_ops.h
index 3682a0a076c1..2f26dfb8450e 100644
--- a/include/net/dst_ops.h
+++ b/include/net/dst_ops.h
@@ -8,6 +8,7 @@ struct dst_entry;
 struct kmem_cachep;
 struct net_device;
 struct sk_buff;
+struct sock;
 struct dst_ops {
        unsigned short          family;
@@ -24,9 +25,14 @@ struct dst_ops {
                                          struct net_device *dev, int how);
        struct dst_entry *      (*negative_advice)(struct dst_entry *);
        void                    (*link_failure)(struct sk_buff *);
-        void                    (*update_pmtu)(struct dst_entry *dst, u32 mtu);
+        void                    (*update_pmtu)(struct dst_entry *dst, struct sock *sk,
+                                               struct sk_buff *skb, u32 mtu);
+        void                    (*redirect)(struct dst_entry *dst, struct sock *sk,
+                                            struct sk_buff *skb);
        int                     (*local_out)(struct sk_buff *skb);
-        struct neighbour *      (*neigh_lookup)(const struct dst_entry *dst, const void *daddr);
+        struct neighbour *      (*neigh_lookup)(const struct dst_entry *dst,
+                                                struct sk_buff *skb,
+                                                const void *daddr);
        struct kmem_cache       *kmem_cachep;
diff --git a/include/net/fib_rules.h b/include/net/fib_rules.h
index 075f1e3a0fed..e361f4882426 100644
--- a/include/net/fib_rules.h
+++ b/include/net/fib_rules.h
@@ -52,6 +52,7 @@ struct fib_rules_ops {
                                             struct sk_buff *,
                                             struct fib_rule_hdr *,
                                             struct nlattr **);
+        void                    (*delete)(struct fib_rule *);
        int                     (*compare)(struct fib_rule *,
                                           struct fib_rule_hdr *,
                                           struct nlattr **);
diff --git a/include/net/flow.h b/include/net/flow.h
index 6c469dbdb917..e1dd5082ec7e 100644
--- a/include/net/flow.h
+++ b/include/net/flow.h
@@ -20,8 +20,7 @@ struct flowi_common {
        __u8    flowic_proto;
        __u8    flowic_flags;
 #define FLOWI_FLAG_ANYSRC               0x01
-#define FLOWI_FLAG_PRECOW_METRICS       0x02
+#define FLOWI_FLAG_CAN_SLEEP            0x02
-#define FLOWI_FLAG_CAN_SLEEP            0x04
        __u32   flowic_secid;
 };
diff --git a/include/net/genetlink.h b/include/net/genetlink.h
index ccb68880abf5..48905cd3884c 100644
--- a/include/net/genetlink.h
+++ b/include/net/genetlink.h
@@ -5,6 +5,8 @@
 #include <net/netlink.h>
 #include <net/net_namespace.h>
+#define GENLMSG_DEFAULT_SIZE (NLMSG_DEFAULT_SIZE - GENL_HDRLEN)
 /**
 * struct genl_multicast_group - generic netlink multicast group
 * @name: name of the multicast group, names are per-family
diff --git a/include/net/inet6_connection_sock.h b/include/net/inet6_connection_sock.h
index 1866a676c810..04642c920431 100644
--- a/include/net/inet6_connection_sock.h
+++ b/include/net/inet6_connection_sock.h
@@ -26,6 +26,7 @@ extern int inet6_csk_bind_conflict(const struct sock *sk,
                                   const struct inet_bind_bucket *tb, bool relax);
 extern struct dst_entry* inet6_csk_route_req(struct sock *sk,
+                                             struct flowi6 *fl6,
                                             const struct request_sock *req);
 extern struct request_sock *inet6_csk_search_req(const struct sock *sk,
@@ -42,4 +43,6 @@ extern void inet6_csk_reqsk_queue_hash_add(struct sock *sk,
 extern void inet6_csk_addr2sockaddr(struct sock *sk, struct sockaddr *uaddr);
 extern int inet6_csk_xmit(struct sk_buff *skb, struct flowi *fl);
+extern struct dst_entry *inet6_csk_update_pmtu(struct sock *sk, u32 mtu);
 #endif /* _INET6_CONNECTION_SOCK_H */
diff --git a/include/net/inet_common.h b/include/net/inet_common.h
index 22fac9892b16..234008782c8c 100644
--- a/include/net/inet_common.h
+++ b/include/net/inet_common.h
@@ -14,9 +14,11 @@ struct sockaddr;
 struct socket;
 extern int inet_release(struct socket *sock);
-extern int inet_stream_connect(struct socket *sock, struct sockaddr * uaddr,
+extern int inet_stream_connect(struct socket *sock, struct sockaddr *uaddr,
                               int addr_len, int flags);
-extern int inet_dgram_connect(struct socket *sock, struct sockaddr * uaddr,
+extern int __inet_stream_connect(struct socket *sock, struct sockaddr *uaddr,
+                                 int addr_len, int flags);
+extern int inet_dgram_connect(struct socket *sock, struct sockaddr *uaddr,
                              int addr_len, int flags);
 extern int inet_accept(struct socket *sock, struct socket *newsock, int flags);
 extern int inet_sendmsg(struct kiocb *iocb, struct socket *sock,
diff --git a/include/net/inet_connection_sock.h b/include/net/inet_connection_sock.h
index 7d83f90f203f..5ee66f517b4f 100644
--- a/include/net/inet_connection_sock.h
+++ b/include/net/inet_connection_sock.h
@@ -43,7 +43,6 @@ struct inet_connection_sock_af_ops {
        struct sock *(*syn_recv_sock)(struct sock *sk, struct sk_buff *skb,
                                      struct request_sock *req,
                                      struct dst_entry *dst);
-        struct inet_peer *(*get_peer)(struct sock *sk, bool *release_it);
        u16         net_header_len;
        u16         net_frag_header_len;
        u16         sockaddr_len;
@@ -337,4 +336,6 @@ extern int inet_csk_compat_getsockopt(struct sock *sk, int level, int optname,
                                      char __user *optval, int __user *optlen);
 extern int inet_csk_compat_setsockopt(struct sock *sk, int level, int optname,
                                      char __user *optval, unsigned int optlen);
+extern struct dst_entry *inet_csk_update_pmtu(struct sock *sk, u32 mtu);
 #endif /* _INET_CONNECTION_SOCK_H */
diff --git a/include/net/inet_hashtables.h b/include/net/inet_hashtables.h
index 808fc5f76b03..54be0287eb98 100644
--- a/include/net/inet_hashtables.h
+++ b/include/net/inet_hashtables.h
@@ -379,10 +379,10 @@ static inline struct sock *__inet_lookup_skb(struct inet_hashinfo *hashinfo,
                                             const __be16 sport,
                                             const __be16 dport)
 {
-        struct sock *sk;
+        struct sock *sk = skb_steal_sock(skb);
        const struct iphdr *iph = ip_hdr(skb);
-        if (unlikely(sk = skb_steal_sock(skb)))
+        if (sk)
                return sk;
        else
                return __inet_lookup(dev_net(skb_dst(skb)->dev), hashinfo,
diff --git a/include/net/inet_sock.h b/include/net/inet_sock.h
index ae17e1352d7e..613cfa401672 100644
--- a/include/net/inet_sock.h
+++ b/include/net/inet_sock.h
@@ -172,6 +172,7 @@ struct inet_sock {
        int                     uc_index;
        int                     mc_index;
        __be32                  mc_addr;
+        int                     rx_dst_ifindex;
        struct ip_mc_socklist __rcu     *mc_list;
        struct inet_cork_full   cork;
 };
@@ -245,8 +246,6 @@ static inline __u8 inet_sk_flowi_flags(const struct sock *sk)
        if (inet_sk(sk)->transparent || inet_sk(sk)->hdrincl)
                flags |= FLOWI_FLAG_ANYSRC;
-        if (sk->sk_protocol == IPPROTO_TCP)
-                flags |= FLOWI_FLAG_PRECOW_METRICS;
        return flags;
 }
diff --git a/include/net/inetpeer.h b/include/net/inetpeer.h
index 2040bff945d4..53f464d7cddc 100644
--- a/include/net/inetpeer.h
+++ b/include/net/inetpeer.h
@@ -36,25 +36,19 @@ struct inet_peer {
        u32                     metrics[RTAX_MAX];
        u32                     rate_tokens;    /* rate limiting for ICMP */
        unsigned long           rate_last;
-        unsigned long           pmtu_expires;
-        u32                     pmtu_orig;
-        u32                     pmtu_learned;
-        struct inetpeer_addr_base redirect_learned;
        union {
                struct list_head        gc_list;
                struct rcu_head     gc_rcu;
        };
        /*
         * Once inet_peer is queued for deletion (refcnt == -1), following fields
-         * are not available: rid, ip_id_count, tcp_ts, tcp_ts_stamp
+         * are not available: rid, ip_id_count
         * We can share memory with rcu_head to help keep inet_peer small.
         */
        union {
                struct {
                        atomic_t                        rid;            /* Frag reception counter */
                        atomic_t                        ip_id_count;    /* IP ID for the next packet */
-                        __u32                           tcp_ts;
-                        __u32                           tcp_ts_stamp;
                };
                struct rcu_head         rcu;
                struct inet_peer        *gc_next;
@@ -65,6 +59,69 @@ struct inet_peer {
        atomic_t                refcnt;
 };
+struct inet_peer_base {
+        struct inet_peer __rcu  *root;
+        seqlock_t               lock;
+        u32                     flush_seq;
+        int                     total;
+};
+#define INETPEER_BASE_BIT       0x1UL
+static inline struct inet_peer *inetpeer_ptr(unsigned long val)
+{
+        BUG_ON(val & INETPEER_BASE_BIT);
+        return (struct inet_peer *) val;
+}
+static inline struct inet_peer_base *inetpeer_base_ptr(unsigned long val)
+{
+        if (!(val & INETPEER_BASE_BIT))
+                return NULL;
+        val &= ~INETPEER_BASE_BIT;
+        return (struct inet_peer_base *) val;
+}
+static inline bool inetpeer_ptr_is_peer(unsigned long val)
+{
+        return !(val & INETPEER_BASE_BIT);
+}
+static inline void __inetpeer_ptr_set_peer(unsigned long *val, struct inet_peer *peer)
+{
+        /* This implicitly clears INETPEER_BASE_BIT */
+        *val = (unsigned long) peer;
+}
+static inline bool inetpeer_ptr_set_peer(unsigned long *ptr, struct inet_peer *peer)
+{
+        unsigned long val = (unsigned long) peer;
+        unsigned long orig = *ptr;
+        if (!(orig & INETPEER_BASE_BIT) ||
+            cmpxchg(ptr, orig, val) != orig)
+                return false;
+        return true;
+}
+static inline void inetpeer_init_ptr(unsigned long *ptr, struct inet_peer_base *base)
+{
+        *ptr = (unsigned long) base | INETPEER_BASE_BIT;
+}
+static inline void inetpeer_transfer_peer(unsigned long *to, unsigned long *from)
+{
+        unsigned long val = *from;
+        *to = val;
+        if (inetpeer_ptr_is_peer(val)) {
+                struct inet_peer *peer = inetpeer_ptr(val);
+                atomic_inc(&peer->refcnt);
+        }
+}
+extern void inet_peer_base_init(struct inet_peer_base *);
 void                    inet_initpeers(void) __init;
 #define INETPEER_METRICS_NEW    (~(u32) 0)
@@ -75,31 +132,38 @@ static inline bool inet_metrics_new(const struct inet_peer *p)
 }
 /* can be called with or without local BH being disabled */
-struct inet_peer        *inet_getpeer(const struct inetpeer_addr *daddr, int create);
+struct inet_peer *inet_getpeer(struct inet_peer_base *base,
+                               const struct inetpeer_addr *daddr,
+                               int create);
-static inline struct inet_peer *inet_getpeer_v4(__be32 v4daddr, int create)
+static inline struct inet_peer *inet_getpeer_v4(struct inet_peer_base *base,
+                                                __be32 v4daddr,
+                                                int create)
 {
        struct inetpeer_addr daddr;
        daddr.addr.a4 = v4daddr;
        daddr.family = AF_INET;
-        return inet_getpeer(&daddr, create);
+        return inet_getpeer(base, &daddr, create);
 }
-static inline struct inet_peer *inet_getpeer_v6(const struct in6_addr *v6daddr, int create)
+static inline struct inet_peer *inet_getpeer_v6(struct inet_peer_base *base,
+                                                const struct in6_addr *v6daddr,
+                                                int create)
 {
        struct inetpeer_addr daddr;
        *(struct in6_addr *)daddr.addr.a6 = *v6daddr;
        daddr.family = AF_INET6;
-        return inet_getpeer(&daddr, create);
+        return inet_getpeer(base, &daddr, create);
 }
 /* can be called from BH context or outside */
 extern void inet_putpeer(struct inet_peer *p);
 extern bool inet_peer_xrlim_allow(struct inet_peer *peer, int timeout);
-extern void inetpeer_invalidate_tree(int family);
+extern void inetpeer_invalidate_tree(struct inet_peer_base *);
+extern void inetpeer_invalidate_family(int family);
 /*
 * temporary check to make sure we dont access rid, ip_id_count, tcp_ts,
diff --git a/include/net/ip.h b/include/net/ip.h
index 83e0619f59d0..bd5e444a19ce 100644
--- a/include/net/ip.h
+++ b/include/net/ip.h
@@ -158,8 +158,9 @@ static inline __u8 ip_reply_arg_flowi_flags(const struct ip_reply_arg *arg)
        return (arg->flags & IP_REPLY_ARG_NOSRCCHECK) ? FLOWI_FLAG_ANYSRC : 0;
 }
-void ip_send_reply(struct sock *sk, struct sk_buff *skb, __be32 daddr,
+void ip_send_unicast_reply(struct net *net, struct sk_buff *skb, __be32 daddr,
-                   const struct ip_reply_arg *arg, unsigned int len);
+                           __be32 saddr, const struct ip_reply_arg *arg,
+                           unsigned int len);
 struct ipv4_config {
        int     log_martians;
@@ -210,6 +211,9 @@ extern int inet_peer_threshold;
 extern int inet_peer_minttl;
 extern int inet_peer_maxttl;
+/* From ip_input.c */
+extern int sysctl_ip_early_demux;
 /* From ip_output.c */
 extern int sysctl_ip_dynaddr;
diff --git a/include/net/ip6_fib.h b/include/net/ip6_fib.h
index 0ae759a6c76e..0fedbd8d747a 100644
--- a/include/net/ip6_fib.h
+++ b/include/net/ip6_fib.h
@@ -86,6 +86,8 @@ struct fib6_table;
 struct rt6_info {
        struct dst_entry                dst;
+        struct neighbour                *n;
        /*
         * Tail elements of dst_entry (__refcnt etc.)
         * and these elements (rarely used in hot path) are in
@@ -107,7 +109,7 @@ struct rt6_info {
        u32                             rt6i_peer_genid;
        struct inet6_dev                *rt6i_idev;
-        struct inet_peer                *rt6i_peer;
+        unsigned long                   _rt6i_peer;
 #ifdef CONFIG_XFRM
        u32                             rt6i_flow_cache_genid;
@@ -118,6 +120,36 @@ struct rt6_info {
        u8                              rt6i_protocol;
 };
+static inline struct inet_peer *rt6_peer_ptr(struct rt6_info *rt)
+{
+        return inetpeer_ptr(rt->_rt6i_peer);
+}
+static inline bool rt6_has_peer(struct rt6_info *rt)
+{
+        return inetpeer_ptr_is_peer(rt->_rt6i_peer);
+}
+static inline void __rt6_set_peer(struct rt6_info *rt, struct inet_peer *peer)
+{
+        __inetpeer_ptr_set_peer(&rt->_rt6i_peer, peer);
+}
+static inline bool rt6_set_peer(struct rt6_info *rt, struct inet_peer *peer)
+{
+        return inetpeer_ptr_set_peer(&rt->_rt6i_peer, peer);
+}
+static inline void rt6_init_peer(struct rt6_info *rt, struct inet_peer_base *base)
+{
+        inetpeer_init_ptr(&rt->_rt6i_peer, base);
+}
+static inline void rt6_transfer_peer(struct rt6_info *rt, struct rt6_info *ort)
+{
+        inetpeer_transfer_peer(&rt->_rt6i_peer, &ort->_rt6i_peer);
+}
 static inline struct inet6_dev *ip6_dst_idev(struct dst_entry *dst)
 {
        return ((struct rt6_info *)dst)->rt6i_idev;
@@ -207,6 +239,7 @@ struct fib6_table {
        u32                     tb6_id;
        rwlock_t                tb6_lock;
        struct fib6_node        tb6_root;
+        struct inet_peer_base   tb6_peers;
 };
 #define RT6_TABLE_UNSPEC        RT_TABLE_UNSPEC
diff --git a/include/net/ip6_route.h b/include/net/ip6_route.h
index 37c1a1ed82c1..5fa2af00634a 100644
--- a/include/net/ip6_route.h
+++ b/include/net/ip6_route.h
@@ -53,16 +53,25 @@ static inline unsigned int rt6_flags2srcprefs(int flags)
        return (flags >> 3) & 7;
 }
-extern void                     rt6_bind_peer(struct rt6_info *rt,
+extern void rt6_bind_peer(struct rt6_info *rt, int create);
-                                              int create);
+static inline struct inet_peer *__rt6_get_peer(struct rt6_info *rt, int create)
+{
+        if (rt6_has_peer(rt))
+                return rt6_peer_ptr(rt);
+        rt6_bind_peer(rt, create);
+        return (rt6_has_peer(rt) ? rt6_peer_ptr(rt) : NULL);
+}
 static inline struct inet_peer *rt6_get_peer(struct rt6_info *rt)
 {
-        if (rt->rt6i_peer)
+        return __rt6_get_peer(rt, 0);
-                return rt->rt6i_peer;
+}
-        rt6_bind_peer(rt, 0);
+static inline struct inet_peer *rt6_get_peer_create(struct rt6_info *rt)
-        return rt->rt6i_peer;
+{
+        return __rt6_get_peer(rt, 1);
 }
 extern void                     ip6_route_input(struct sk_buff *skb);
@@ -124,17 +133,12 @@ extern int			rt6_route_rcv(struct net_device *dev,
                                              u8 *opt, int len,
                                              const struct in6_addr *gwaddr);
-extern void                     rt6_redirect(const struct in6_addr *dest,
+extern void ip6_update_pmtu(struct sk_buff *skb, struct net *net, __be32 mtu,
-                                             const struct in6_addr *src,
+                            int oif, u32 mark);
-                                             const struct in6_addr *saddr,
+extern void ip6_sk_update_pmtu(struct sk_buff *skb, struct sock *sk,
-                                             struct neighbour *neigh,
+                               __be32 mtu);
-                                             u8 *lladdr,
+extern void ip6_redirect(struct sk_buff *skb, struct net *net, int oif, u32 mark);
-                                             int on_link);
+extern void ip6_sk_redirect(struct sk_buff *skb, struct sock *sk);
-extern void                     rt6_pmtu_discovery(const struct in6_addr *daddr,
-                                                   const struct in6_addr *saddr,
-                                                   struct net_device *dev,
-                                                   u32 pmtu);
 struct netlink_callback;
@@ -154,7 +158,8 @@ extern void rt6_remove_prefsrc(struct inet6_ifaddr *ifp);
 *      Store a destination cache entry in a socket
 */
 static inline void __ip6_dst_store(struct sock *sk, struct dst_entry *dst,
-                                   struct in6_addr *daddr, struct in6_addr *saddr)
+                                   const struct in6_addr *daddr,
+                                   const struct in6_addr *saddr)
 {
        struct ipv6_pinfo *np = inet6_sk(sk);
        struct rt6_info *rt = (struct rt6_info *) dst;
diff --git a/include/net/ip6_tunnel.h b/include/net/ip6_tunnel.h
index fc73e667b50e..358fb86f57eb 100644
--- a/include/net/ip6_tunnel.h
+++ b/include/net/ip6_tunnel.h
@@ -9,6 +9,8 @@
 #define IP6_TNL_F_CAP_XMIT 0x10000
 /* capable of receiving packets */
 #define IP6_TNL_F_CAP_RCV 0x20000
+/* determine capability on a per-packet basis */
+#define IP6_TNL_F_CAP_PER_PACKET 0x40000
 /* IPv6 tunnel */
diff --git a/include/net/ip_fib.h b/include/net/ip_fib.h
index 78df0866cc38..e69c3a47153d 100644
--- a/include/net/ip_fib.h
+++ b/include/net/ip_fib.h
@@ -18,7 +18,9 @@
 #include <net/flow.h>
 #include <linux/seq_file.h>
+#include <linux/rcupdate.h>
 #include <net/fib_rules.h>
+#include <net/inetpeer.h>
 struct fib_config {
        u8                      fc_dst_len;
@@ -44,6 +46,23 @@ struct fib_config {
 };
 struct fib_info;
+struct rtable;
+struct fib_nh_exception {
+        struct fib_nh_exception __rcu   *fnhe_next;
+        __be32                          fnhe_daddr;
+        u32                             fnhe_pmtu;
+        __be32                          fnhe_gw;
+        unsigned long                   fnhe_expires;
+        unsigned long                   fnhe_stamp;
+};
+struct fnhe_hash_bucket {
+        struct fib_nh_exception __rcu   *chain;
+};
+#define FNHE_HASH_SIZE          2048
+#define FNHE_RECLAIM_DEPTH      5
 struct fib_nh {
        struct net_device       *nh_dev;
@@ -62,6 +81,9 @@ struct fib_nh {
        __be32                  nh_gw;
        __be32                  nh_saddr;
        int                     nh_saddr_genid;
+        struct rtable           *nh_rth_output;
+        struct rtable           *nh_rth_input;
+        struct fnhe_hash_bucket *nh_exceptions;
 };
 /*
@@ -105,12 +127,10 @@ struct fib_result {
        unsigned char   nh_sel;
        unsigned char   type;
        unsigned char   scope;
+        u32             tclassid;
        struct fib_info *fi;
        struct fib_table *table;
        struct list_head *fa_head;
-#ifdef CONFIG_IP_MULTIPLE_TABLES
-        struct fib_rule *r;
-#endif
 };
 struct fib_result_nl {
@@ -157,11 +177,11 @@ extern __be32 fib_info_update_nh_saddr(struct net *net, struct fib_nh *nh);
                                         FIB_RES_SADDR(net, res))
 struct fib_table {
-        struct hlist_node tb_hlist;
+        struct hlist_node       tb_hlist;
-        u32             tb_id;
+        u32                     tb_id;
-        int             tb_default;
+        int                     tb_default;
-        int             tb_num_default;
+        int                     tb_num_default;
-        unsigned long   tb_data[0];
+        unsigned long           tb_data[0];
 };
 extern int fib_table_lookup(struct fib_table *tb, const struct flowi4 *flp,
@@ -214,24 +234,55 @@ static inline int fib_lookup(struct net *net, const struct flowi4 *flp,
 extern int __net_init fib4_rules_init(struct net *net);
 extern void __net_exit fib4_rules_exit(struct net *net);
-#ifdef CONFIG_IP_ROUTE_CLASSID
-extern u32 fib_rules_tclass(const struct fib_result *res);
-#endif
-extern int fib_lookup(struct net *n, struct flowi4 *flp, struct fib_result *res);
 extern struct fib_table *fib_new_table(struct net *net, u32 id);
 extern struct fib_table *fib_get_table(struct net *net, u32 id);
+extern int __fib_lookup(struct net *net, struct flowi4 *flp,
+                        struct fib_result *res);
+static inline int fib_lookup(struct net *net, struct flowi4 *flp,
+                             struct fib_result *res)
+{
+        if (!net->ipv4.fib_has_custom_rules) {
+                res->tclassid = 0;
+                if (net->ipv4.fib_local &&
+                    !fib_table_lookup(net->ipv4.fib_local, flp, res,
+                                      FIB_LOOKUP_NOREF))
+                        return 0;
+                if (net->ipv4.fib_main &&
+                    !fib_table_lookup(net->ipv4.fib_main, flp, res,
+                                      FIB_LOOKUP_NOREF))
+                        return 0;
+                if (net->ipv4.fib_default &&
+                    !fib_table_lookup(net->ipv4.fib_default, flp, res,
+                                      FIB_LOOKUP_NOREF))
+                        return 0;
+                return -ENETUNREACH;
+        }
+        return __fib_lookup(net, flp, res);
+}
 #endif /* CONFIG_IP_MULTIPLE_TABLES */
 /* Exported by fib_frontend.c */
 extern const struct nla_policy rtm_ipv4_policy[];
 extern void             ip_fib_init(void);
+extern __be32 fib_compute_spec_dst(struct sk_buff *skb);
 extern int fib_validate_source(struct sk_buff *skb, __be32 src, __be32 dst,
                               u8 tos, int oif, struct net_device *dev,
-                               __be32 *spec_dst, u32 *itag);
+                               struct in_device *idev, u32 *itag);
 extern void fib_select_default(struct fib_result *res);
+#ifdef CONFIG_IP_ROUTE_CLASSID
+static inline int fib_num_tclassid_users(struct net *net)
+{
+        return net->ipv4.fib_num_tclassid_users;
+}
+#else
+static inline int fib_num_tclassid_users(struct net *net)
+{
+        return 0;
+}
+#endif
 /* Exported by fib_semantics.c */
 extern int ip_fib_check_default(__be32 gw, struct net_device *dev);
@@ -253,7 +304,7 @@ static inline void fib_combine_itag(u32 *itag, const struct fib_result *res)
 #endif
        *itag = FIB_RES_NH(*res).nh_tclassid<<16;
 #ifdef CONFIG_IP_MULTIPLE_TABLES
-        rtag = fib_rules_tclass(res);
+        rtag = res->tclassid;
        if (*itag == 0)
                *itag = (rtag<<16);
        *itag |= (rtag>>16);
diff --git a/include/net/ipv6.h b/include/net/ipv6.h
index aecf88436abf..01c34b363a34 100644
--- a/include/net/ipv6.h
+++ b/include/net/ipv6.h
@@ -251,6 +251,8 @@ static inline void fl6_sock_release(struct ip6_flowlabel *fl)
                atomic_dec(&fl->users);
 }
+extern void icmpv6_notify(struct sk_buff *skb, u8 type, u8 code, __be32 info);
 extern int                      ip6_ra_control(struct sock *sk, int sel);
 extern int                      ipv6_parse_hopopts(struct sk_buff *skb);
@@ -298,14 +300,23 @@ static inline int ipv6_addr_cmp(const struct in6_addr *a1, const struct in6_addr
        return memcmp(a1, a2, sizeof(struct in6_addr));
 }
-static inline int
+static inline bool
 ipv6_masked_addr_cmp(const struct in6_addr *a1, const struct in6_addr *m,
                     const struct in6_addr *a2)
 {
+#if defined(CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS) && BITS_PER_LONG == 64
+        const unsigned long *ul1 = (const unsigned long *)a1;
+        const unsigned long *ulm = (const unsigned long *)m;
+        const unsigned long *ul2 = (const unsigned long *)a2;
+        return !!(((ul1[0] ^ ul2[0]) & ulm[0]) |
+                  ((ul1[1] ^ ul2[1]) & ulm[1]));
+#else
        return !!(((a1->s6_addr32[0] ^ a2->s6_addr32[0]) & m->s6_addr32[0]) |
                  ((a1->s6_addr32[1] ^ a2->s6_addr32[1]) & m->s6_addr32[1]) |
                  ((a1->s6_addr32[2] ^ a2->s6_addr32[2]) & m->s6_addr32[2]) |
                  ((a1->s6_addr32[3] ^ a2->s6_addr32[3]) & m->s6_addr32[3]));
+#endif
 }
 static inline void ipv6_addr_prefix(struct in6_addr *pfx, 
@@ -335,10 +346,17 @@ static inline void ipv6_addr_set(struct in6_addr *addr,
 static inline bool ipv6_addr_equal(const struct in6_addr *a1,
                                   const struct in6_addr *a2)
 {
+#if defined(CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS) && BITS_PER_LONG == 64
+        const unsigned long *ul1 = (const unsigned long *)a1;
+        const unsigned long *ul2 = (const unsigned long *)a2;
+        return ((ul1[0] ^ ul2[0]) | (ul1[1] ^ ul2[1])) == 0UL;
+#else
        return ((a1->s6_addr32[0] ^ a2->s6_addr32[0]) |
                (a1->s6_addr32[1] ^ a2->s6_addr32[1]) |
                (a1->s6_addr32[2] ^ a2->s6_addr32[2]) |
                (a1->s6_addr32[3] ^ a2->s6_addr32[3])) == 0;
+#endif
 }
 static inline bool __ipv6_prefix_equal(const __be32 *a1, const __be32 *a2,
@@ -391,8 +409,27 @@ bool ip6_frag_match(struct inet_frag_queue *q, void *a);
 static inline bool ipv6_addr_any(const struct in6_addr *a)
 {
+#if defined(CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS) && BITS_PER_LONG == 64
+        const unsigned long *ul = (const unsigned long *)a;
+        return (ul[0] | ul[1]) == 0UL;
+#else
        return (a->s6_addr32[0] | a->s6_addr32[1] |
                a->s6_addr32[2] | a->s6_addr32[3]) == 0;
+#endif
+}
+static inline u32 ipv6_addr_hash(const struct in6_addr *a)
+{
+#if defined(CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS) && BITS_PER_LONG == 64
+        const unsigned long *ul = (const unsigned long *)a;
+        unsigned long x = ul[0] ^ ul[1];
+        return (u32)(x ^ (x >> 32));
+#else
+        return (__force u32)(a->s6_addr32[0] ^ a->s6_addr32[1] ^
+                             a->s6_addr32[2] ^ a->s6_addr32[3]);
+#endif
 }
 static inline bool ipv6_addr_loopback(const struct in6_addr *a)
diff --git a/include/net/mac80211.h b/include/net/mac80211.h
index 95e39b6a02ec..bb86aa6f98dd 100644
--- a/include/net/mac80211.h
+++ b/include/net/mac80211.h
@@ -233,8 +233,10 @@ enum ieee80211_rssi_event {
 *      valid in station mode only while @assoc is true and if also
 *      requested by %IEEE80211_HW_NEED_DTIM_PERIOD (cf. also hw conf
 *      @ps_dtim_period)
- * @last_tsf: last beacon's/probe response's TSF timestamp (could be old
+ * @sync_tsf: last beacon's/probe response's TSF timestamp (could be old
 *      as it may have been received during scanning long ago)
+ * @sync_device_ts: the device timestamp corresponding to the sync_tsf,
+ *      the driver/device can use this to calculate synchronisation
 * @beacon_int: beacon interval
 * @assoc_capability: capabilities taken from assoc resp
 * @basic_rates: bitmap of basic rates, each bit stands for an
@@ -281,7 +283,8 @@ struct ieee80211_bss_conf {
        u8 dtim_period;
        u16 beacon_int;
        u16 assoc_capability;
-        u64 last_tsf;
+        u64 sync_tsf;
+        u32 sync_device_ts;
        u32 basic_rates;
        int mcast_rate[IEEE80211_NUM_BANDS];
        u16 ht_operation_mode;
@@ -475,7 +478,7 @@ enum mac80211_rate_control_flags {
 #define IEEE80211_TX_INFO_RATE_DRIVER_DATA_SIZE 24
 /* maximum number of rate stages */
-#define IEEE80211_TX_MAX_RATES  5
+#define IEEE80211_TX_MAX_RATES  4
 /**
 * struct ieee80211_tx_rate - rate selection/status
@@ -563,11 +566,11 @@ struct ieee80211_tx_info {
                } control;
                struct {
                        struct ieee80211_tx_rate rates[IEEE80211_TX_MAX_RATES];
-                        u8 ampdu_ack_len;
                        int ack_signal;
+                        u8 ampdu_ack_len;
                        u8 ampdu_len;
                        u8 antenna;
-                        /* 14 bytes free */
+                        /* 21 bytes free */
                } status;
                struct {
                        struct ieee80211_tx_rate driver_rates[
@@ -634,7 +637,7 @@ ieee80211_tx_info_clear_status(struct ieee80211_tx_info *info)
                info->status.rates[i].count = 0;
        BUILD_BUG_ON(
-            offsetof(struct ieee80211_tx_info, status.ampdu_ack_len) != 23);
+            offsetof(struct ieee80211_tx_info, status.ack_signal) != 20);
        memset(&info->status.ampdu_ack_len, 0,
               sizeof(struct ieee80211_tx_info) -
               offsetof(struct ieee80211_tx_info, status.ampdu_ack_len));
@@ -696,6 +699,8 @@ enum mac80211_rx_flags {
 *
 * @mactime: value in microseconds of the 64-bit Time Synchronization Function
 *      (TSF) timer when the first data symbol (MPDU) arrived at the hardware.
+ * @device_timestamp: arbitrary timestamp for the device, mac80211 doesn't use
+ *      it but can store it and pass it back to the driver for synchronisation
 * @band: the active band when this frame was received
 * @freq: frequency the radio was tuned to when receiving this frame, in MHz
 * @signal: signal strength when receiving this frame, either in dBm, in dB or
@@ -709,13 +714,14 @@ enum mac80211_rx_flags {
 */
 struct ieee80211_rx_status {
        u64 mactime;
-        enum ieee80211_band band;
+        u32 device_timestamp;
-        int freq;
+        u16 flag;
-        int signal;
+        u16 freq;
-        int antenna;
+        u8 rate_idx;
-        int rate_idx;
+        u8 rx_flags;
-        int flag;
+        u8 band;
-        unsigned int rx_flags;
+        u8 antenna;
+        s8 signal;
 };
 /**
@@ -1297,6 +1303,10 @@ enum ieee80211_hw_flags {
 *      reports, by default it is set to _MCS, _GI and _BW but doesn't
 *      include _FMT. Use %IEEE80211_RADIOTAP_MCS_HAVE_* values, only
 *      adding _BW is supported today.
+ *
+ * @netdev_features: netdev features to be set in each netdev created
+ *      from this HW. Note only HW checksum features are currently
+ *      compatible with mac80211. Other feature bits will be rejected.
 */
 struct ieee80211_hw {
        struct ieee80211_conf conf;
@@ -1319,6 +1329,7 @@ struct ieee80211_hw {
        u8 max_tx_aggregation_subframes;
        u8 offchannel_tx_hw_queue;
        u8 radiotap_mcs_details;
+        netdev_features_t netdev_features;
 };
 /**
@@ -1891,19 +1902,6 @@ enum ieee80211_rate_control_changed {
 *      The low-level driver should send the frame out based on
 *      configuration in the TX control data. This handler should,
 *      preferably, never fail and stop queues appropriately.
- *      This must be implemented if @tx_frags is not.
- *      Must be atomic.
- *
- * @tx_frags: Called to transmit multiple fragments of a single MSDU.
- *      This handler must consume all fragments, sending out some of
- *      them only is useless and it can't ask for some of them to be
- *      queued again. If the frame is not fragmented the queue has a
- *      single SKB only. To avoid issues with the networking stack
- *      when TX status is reported the frames should be removed from
- *      the skb queue.
- *      If this is used, the tx_info @vif and @sta pointers will be
- *      invalid -- you must not use them in that case.
- *      This must be implemented if @tx isn't.
 *      Must be atomic.
 *
 * @start: Called before the first netdevice attached to the hardware
@@ -2183,7 +2181,10 @@ enum ieee80211_rate_control_changed {
 *      offload. Frames to transmit on the off-channel channel are transmitted
 *      normally except for the %IEEE80211_TX_CTL_TX_OFFCHAN flag. When the
 *      duration (which will always be non-zero) expires, the driver must call
- *      ieee80211_remain_on_channel_expired(). This callback may sleep.
+ *      ieee80211_remain_on_channel_expired().
+ *      Note that this callback may be called while the device is in IDLE and
+ *      must be accepted in this case.
+ *      This callback may sleep.
 * @cancel_remain_on_channel: Requests that an ongoing off-channel period is
 *      aborted before it expires. This callback may sleep.
 *
@@ -2246,11 +2247,24 @@ enum ieee80211_rate_control_changed {
 * @get_et_strings:  Ethtool API to get a set of strings to describe stats
 *      and perhaps other supported types of ethtool data-sets.
 *
+ * @get_rssi: Get current signal strength in dBm, the function is optional
+ *      and can sleep.
+ *
+ * @mgd_prepare_tx: Prepare for transmitting a management frame for association
+ *      before associated. In multi-channel scenarios, a virtual interface is
+ *      bound to a channel before it is associated, but as it isn't associated
+ *      yet it need not necessarily be given airtime, in particular since any
+ *      transmission to a P2P GO needs to be synchronized against the GO's
+ *      powersave state. mac80211 will call this function before transmitting a
+ *      management frame prior to having successfully associated to allow the
+ *      driver to give it channel time for the transmission, to get a response
+ *      and to be able to synchronize with the GO.
+ *      The callback will be called before each transmission and upon return
+ *      mac80211 will transmit the frame right away.
+ *      The callback is optional and can (should!) sleep.
 */
 struct ieee80211_ops {
        void (*tx)(struct ieee80211_hw *hw, struct sk_buff *skb);
-        void (*tx_frags)(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
-                         struct ieee80211_sta *sta, struct sk_buff_head *skbs);
        int (*start)(struct ieee80211_hw *hw);
        void (*stop)(struct ieee80211_hw *hw);
 #ifdef CONFIG_PM
@@ -2385,6 +2399,11 @@ struct ieee80211_ops {
        void    (*get_et_strings)(struct ieee80211_hw *hw,
                                  struct ieee80211_vif *vif,
                                  u32 sset, u8 *data);
+        int     (*get_rssi)(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+                            struct ieee80211_sta *sta, s8 *rssi_dbm);
+        void    (*mgd_prepare_tx)(struct ieee80211_hw *hw,
+                                  struct ieee80211_vif *vif);
 };
 /**
@@ -3557,16 +3576,6 @@ void ieee80211_cqm_rssi_notify(struct ieee80211_vif *vif,
                               gfp_t gfp);
 /**
- * ieee80211_get_operstate - get the operstate of the vif
- *
- * @vif: &struct ieee80211_vif pointer from the add_interface callback.
- *
- * The driver might need to know the operstate of the net_device
- * (specifically, whether the link is IF_OPER_UP after resume)
- */
-unsigned char ieee80211_get_operstate(struct ieee80211_vif *vif);
-/**
 * ieee80211_chswitch_done - Complete channel switch process
 * @vif: &struct ieee80211_vif pointer from the add_interface callback.
 * @success: make the channel switch successful or not
@@ -3589,22 +3598,6 @@ void ieee80211_request_smps(struct ieee80211_vif *vif,
                            enum ieee80211_smps_mode smps_mode);
 /**
- * ieee80211_key_removed - disable hw acceleration for key
- * @key_conf: The key hw acceleration should be disabled for
- *
- * This allows drivers to indicate that the given key has been
- * removed from hardware acceleration, due to a new key that
- * was added. Don't use this if the key can continue to be used
- * for TX, if the key restriction is on RX only it is permitted
- * to keep the key for TX only and not call this function.
- *
- * Due to locking constraints, it may only be called during
- * @set_key. This function must be allowed to sleep, and the
- * key it tries to disable may still be used until it returns.
- */
-void ieee80211_key_removed(struct ieee80211_key_conf *key_conf);
-/**
 * ieee80211_ready_on_channel - notification of remain-on-channel start
 * @hw: pointer as obtained from ieee80211_alloc_hw()
 */
@@ -3829,12 +3822,6 @@ void ieee80211_enable_rssi_reports(struct ieee80211_vif *vif,
 void ieee80211_disable_rssi_reports(struct ieee80211_vif *vif);
-int ieee80211_add_srates_ie(struct ieee80211_vif *vif,
-                            struct sk_buff *skb, bool need_basic);
-int ieee80211_add_ext_srates_ie(struct ieee80211_vif *vif,
-                                struct sk_buff *skb, bool need_basic);
 /**
 * ieee80211_ave_rssi - report the average rssi for the specified interface
 *
diff --git a/include/net/mac802154.h b/include/net/mac802154.h
index c9f8ab5cc687..d0d11df9cba1 100644
--- a/include/net/mac802154.h
+++ b/include/net/mac802154.h
@@ -21,6 +21,14 @@
 #include <net/af_ieee802154.h>
+/* General MAC frame format:
+ *  2 bytes: Frame Control
+ *  1 byte:  Sequence Number
+ * 20 bytes: Addressing fields
+ * 14 bytes: Auxiliary Security Header
+ */
+#define MAC802154_FRAME_HARD_HEADER_LEN         (2 + 1 + 20 + 14)
 /* The following flags are used to indicate changed address settings from
 * the stack to the hardware.
 */
diff --git a/include/net/ndisc.h b/include/net/ndisc.h
index c02b6ad3f6c5..96a3b5c03e37 100644
--- a/include/net/ndisc.h
+++ b/include/net/ndisc.h
@@ -47,6 +47,8 @@ enum {
 #include <linux/icmpv6.h>
 #include <linux/in6.h>
 #include <linux/types.h>
+#include <linux/if_arp.h>
+#include <linux/netdevice.h>
 #include <net/neighbour.h>
@@ -80,6 +82,54 @@ struct nd_opt_hdr {
        __u8            nd_opt_len;
 } __packed;
+/* ND options */
+struct ndisc_options {
+        struct nd_opt_hdr *nd_opt_array[__ND_OPT_ARRAY_MAX];
+#ifdef CONFIG_IPV6_ROUTE_INFO
+        struct nd_opt_hdr *nd_opts_ri;
+        struct nd_opt_hdr *nd_opts_ri_end;
+#endif
+        struct nd_opt_hdr *nd_useropts;
+        struct nd_opt_hdr *nd_useropts_end;
+};
+#define nd_opts_src_lladdr      nd_opt_array[ND_OPT_SOURCE_LL_ADDR]
+#define nd_opts_tgt_lladdr      nd_opt_array[ND_OPT_TARGET_LL_ADDR]
+#define nd_opts_pi              nd_opt_array[ND_OPT_PREFIX_INFO]
+#define nd_opts_pi_end          nd_opt_array[__ND_OPT_PREFIX_INFO_END]
+#define nd_opts_rh              nd_opt_array[ND_OPT_REDIRECT_HDR]
+#define nd_opts_mtu             nd_opt_array[ND_OPT_MTU]
+#define NDISC_OPT_SPACE(len) (((len)+2+7)&~7)
+extern struct ndisc_options *ndisc_parse_options(u8 *opt, int opt_len,
+                                                 struct ndisc_options *ndopts);
+/*
+ * Return the padding between the option length and the start of the
+ * link addr.  Currently only IP-over-InfiniBand needs this, although
+ * if RFC 3831 IPv6-over-Fibre Channel is ever implemented it may
+ * also need a pad of 2.
+ */
+static int ndisc_addr_option_pad(unsigned short type)
+{
+        switch (type) {
+        case ARPHRD_INFINIBAND: return 2;
+        default:                return 0;
+        }
+}
+static inline u8 *ndisc_opt_addr_data(struct nd_opt_hdr *p,
+                                      struct net_device *dev)
+{
+        u8 *lladdr = (u8 *)(p + 1);
+        int lladdrlen = p->nd_opt_len << 3;
+        int prepad = ndisc_addr_option_pad(dev->type);
+        if (lladdrlen != NDISC_OPT_SPACE(dev->addr_len + prepad))
+                return NULL;
+        return lladdr + prepad;
+}
 static inline u32 ndisc_hashfn(const void *pkey, const struct net_device *dev, __u32 *hash_rnd)
 {
        const u32 *p32 = pkey;
diff --git a/include/net/neighbour.h b/include/net/neighbour.h
index 6cdfeedb650b..344d8988842a 100644
--- a/include/net/neighbour.h
+++ b/include/net/neighbour.h
@@ -202,9 +202,16 @@ extern struct neighbour *	neigh_lookup(struct neigh_table *tbl,
 extern struct neighbour *       neigh_lookup_nodev(struct neigh_table *tbl,
                                                   struct net *net,
                                                   const void *pkey);
-extern struct neighbour *       neigh_create(struct neigh_table *tbl,
+extern struct neighbour *       __neigh_create(struct neigh_table *tbl,
+                                               const void *pkey,
+                                               struct net_device *dev,
+                                               bool want_ref);
+static inline struct neighbour *neigh_create(struct neigh_table *tbl,
                                             const void *pkey,
-                                             struct net_device *dev);
+                                             struct net_device *dev)
+{
+        return __neigh_create(tbl, pkey, dev, true);
+}
 extern void                     neigh_destroy(struct neighbour *neigh);
 extern int                      __neigh_event_send(struct neighbour *neigh, struct sk_buff *skb);
 extern int                      neigh_update(struct neighbour *neigh, const u8 *lladdr, u8 new, 
@@ -302,12 +309,6 @@ static inline struct neighbour * neigh_clone(struct neighbour *neigh)
 #define neigh_hold(n)   atomic_inc(&(n)->refcnt)
-static inline void neigh_confirm(struct neighbour *neigh)
-{
-        if (neigh)
-                neigh->confirmed = jiffies;
-}
 static inline int neigh_event_send(struct neighbour *neigh, struct sk_buff *skb)
 {
        unsigned long now = jiffies;
@@ -351,15 +352,6 @@ static inline int neigh_hh_output(struct hh_cache *hh, struct sk_buff *skb)
        return dev_queue_xmit(skb);
 }
-static inline int neigh_output(struct neighbour *n, struct sk_buff *skb)
-{
-        struct hh_cache *hh = &n->hh;
-        if ((n->nud_state & NUD_CONNECTED) && hh->hh_len)
-                return neigh_hh_output(hh, skb);
-        else
-                return n->output(n, skb);
-}
 static inline struct neighbour *
 __neigh_lookup(struct neigh_table *tbl, const void *pkey, struct net_device *dev, int creat)
 {
diff --git a/include/net/net_namespace.h b/include/net/net_namespace.h
index ac9195e6a062..ae1cd6c9ba52 100644
--- a/include/net/net_namespace.h
+++ b/include/net/net_namespace.h
@@ -101,6 +101,7 @@ struct net {
        struct netns_xfrm       xfrm;
 #endif
        struct netns_ipvs       *ipvs;
+        struct sock             *diag_nlsk;
 };
diff --git a/include/net/netevent.h b/include/net/netevent.h
index 086f8a5b59dc..3ce4988c9c08 100644
--- a/include/net/netevent.h
+++ b/include/net/netevent.h
@@ -12,10 +12,14 @@
 */
 struct dst_entry;
+struct neighbour;
 struct netevent_redirect {
        struct dst_entry *old;
+        struct neighbour *old_neigh;
        struct dst_entry *new;
+        struct neighbour *new_neigh;
+        const void *daddr;
 };
 enum netevent_notif_type {
diff --git a/include/net/netfilter/nf_conntrack.h b/include/net/netfilter/nf_conntrack.h
index cce7f6a798bf..f1494feba79f 100644
--- a/include/net/netfilter/nf_conntrack.h
+++ b/include/net/netfilter/nf_conntrack.h
@@ -39,36 +39,6 @@ union nf_conntrack_expect_proto {
        /* insert expect proto private data here */
 };
-/* Add protocol helper include file here */
-#include <linux/netfilter/nf_conntrack_ftp.h>
-#include <linux/netfilter/nf_conntrack_pptp.h>
-#include <linux/netfilter/nf_conntrack_h323.h>
-#include <linux/netfilter/nf_conntrack_sane.h>
-#include <linux/netfilter/nf_conntrack_sip.h>
-/* per conntrack: application helper private data */
-union nf_conntrack_help {
-        /* insert conntrack helper private data (master) here */
-#if defined(CONFIG_NF_CONNTRACK_FTP) || defined(CONFIG_NF_CONNTRACK_FTP_MODULE)
-        struct nf_ct_ftp_master ct_ftp_info;
-#endif
-#if defined(CONFIG_NF_CONNTRACK_PPTP) || \
-    defined(CONFIG_NF_CONNTRACK_PPTP_MODULE)
-        struct nf_ct_pptp_master ct_pptp_info;
-#endif
-#if defined(CONFIG_NF_CONNTRACK_H323) || \
-    defined(CONFIG_NF_CONNTRACK_H323_MODULE)
-        struct nf_ct_h323_master ct_h323_info;
-#endif
-#if defined(CONFIG_NF_CONNTRACK_SANE) || \
-    defined(CONFIG_NF_CONNTRACK_SANE_MODULE)
-        struct nf_ct_sane_master ct_sane_info;
-#endif
-#if defined(CONFIG_NF_CONNTRACK_SIP) || defined(CONFIG_NF_CONNTRACK_SIP_MODULE)
-        struct nf_ct_sip_master ct_sip_info;
-#endif
-};
 #include <linux/types.h>
 #include <linux/skbuff.h>
 #include <linux/timer.h>
@@ -89,12 +59,13 @@ struct nf_conn_help {
        /* Helper. if any */
        struct nf_conntrack_helper __rcu *helper;
-        union nf_conntrack_help help;
        struct hlist_head expectations;
        /* Current number of expected connections */
        u8 expecting[NF_CT_MAX_EXPECT_CLASSES];
+        /* private helper information. */
+        char data[];
 };
 #include <net/netfilter/ipv4/nf_conntrack_ipv4.h>
diff --git a/include/net/netfilter/nf_conntrack_core.h b/include/net/netfilter/nf_conntrack_core.h
index aced085132e7..d8f5b9f52169 100644
--- a/include/net/netfilter/nf_conntrack_core.h
+++ b/include/net/netfilter/nf_conntrack_core.h
@@ -28,8 +28,8 @@ extern unsigned int nf_conntrack_in(struct net *net,
 extern int nf_conntrack_init(struct net *net);
 extern void nf_conntrack_cleanup(struct net *net);
-extern int nf_conntrack_proto_init(void);
+extern int nf_conntrack_proto_init(struct net *net);
-extern void nf_conntrack_proto_fini(void);
+extern void nf_conntrack_proto_fini(struct net *net);
 extern bool
 nf_ct_get_tuple(const struct sk_buff *skb,
diff --git a/include/net/netfilter/nf_conntrack_expect.h b/include/net/netfilter/nf_conntrack_expect.h
index 4619caadd9d1..983f00263243 100644
--- a/include/net/netfilter/nf_conntrack_expect.h
+++ b/include/net/netfilter/nf_conntrack_expect.h
@@ -59,10 +59,12 @@ static inline struct net *nf_ct_exp_net(struct nf_conntrack_expect *exp)
        return nf_ct_net(exp->master);
 }
+#define NF_CT_EXP_POLICY_NAME_LEN       16
 struct nf_conntrack_expect_policy {
        unsigned int    max_expected;
        unsigned int    timeout;
-        const char      *name;
+        char            name[NF_CT_EXP_POLICY_NAME_LEN];
 };
 #define NF_CT_EXPECT_CLASS_DEFAULT      0
diff --git a/include/net/netfilter/nf_conntrack_extend.h b/include/net/netfilter/nf_conntrack_extend.h
index 96755c3798a5..8b4d1fc29096 100644
--- a/include/net/netfilter/nf_conntrack_extend.h
+++ b/include/net/netfilter/nf_conntrack_extend.h
@@ -80,10 +80,13 @@ static inline void nf_ct_ext_free(struct nf_conn *ct)
 }
 /* Add this type, returns pointer to data or NULL. */
-void *
+void *__nf_ct_ext_add_length(struct nf_conn *ct, enum nf_ct_ext_id id,
-__nf_ct_ext_add(struct nf_conn *ct, enum nf_ct_ext_id id, gfp_t gfp);
+                             size_t var_alloc_len, gfp_t gfp);
 #define nf_ct_ext_add(ct, id, gfp) \
-        ((id##_TYPE *)__nf_ct_ext_add((ct), (id), (gfp)))
+        ((id##_TYPE *)__nf_ct_ext_add_length((ct), (id), 0, (gfp)))
+#define nf_ct_ext_add_length(ct, id, len, gfp) \
+        ((id##_TYPE *)__nf_ct_ext_add_length((ct), (id), (len), (gfp)))
 #define NF_CT_EXT_F_PREALLOC    0x0001
diff --git a/include/net/netfilter/nf_conntrack_helper.h b/include/net/netfilter/nf_conntrack_helper.h
index 1d1889409b9e..9aad956d1008 100644
--- a/include/net/netfilter/nf_conntrack_helper.h
+++ b/include/net/netfilter/nf_conntrack_helper.h
@@ -11,18 +11,27 @@
 #define _NF_CONNTRACK_HELPER_H
 #include <net/netfilter/nf_conntrack.h>
 #include <net/netfilter/nf_conntrack_extend.h>
+#include <net/netfilter/nf_conntrack_expect.h>
 struct module;
+enum nf_ct_helper_flags {
+        NF_CT_HELPER_F_USERSPACE        = (1 << 0),
+        NF_CT_HELPER_F_CONFIGURED       = (1 << 1),
+};
 #define NF_CT_HELPER_NAME_LEN   16
 struct nf_conntrack_helper {
        struct hlist_node hnode;        /* Internal use. */
-        const char *name;               /* name of the module */
+        char name[NF_CT_HELPER_NAME_LEN]; /* name of the module */
        struct module *me;              /* pointer to self */
        const struct nf_conntrack_expect_policy *expect_policy;
+        /* length of internal data, ie. sizeof(struct nf_ct_*_master) */
+        size_t data_len;
        /* Tuple of things we will help (compared against server response) */
        struct nf_conntrack_tuple tuple;
@@ -35,8 +44,12 @@ struct nf_conntrack_helper {
        void (*destroy)(struct nf_conn *ct);
+        int (*from_nlattr)(struct nlattr *attr, struct nf_conn *ct);
        int (*to_nlattr)(struct sk_buff *skb, const struct nf_conn *ct);
        unsigned int expect_class_max;
+        unsigned int flags;
+        unsigned int queue_num;         /* For user-space helpers. */
 };
 extern struct nf_conntrack_helper *
@@ -48,7 +61,7 @@ nf_conntrack_helper_try_module_get(const char *name, u16 l3num, u8 protonum);
 extern int nf_conntrack_helper_register(struct nf_conntrack_helper *);
 extern void nf_conntrack_helper_unregister(struct nf_conntrack_helper *);
-extern struct nf_conn_help *nf_ct_helper_ext_add(struct nf_conn *ct, gfp_t gfp);
+extern struct nf_conn_help *nf_ct_helper_ext_add(struct nf_conn *ct, struct nf_conntrack_helper *helper, gfp_t gfp);
 extern int __nf_ct_try_assign_helper(struct nf_conn *ct, struct nf_conn *tmpl,
                                     gfp_t flags);
@@ -60,6 +73,15 @@ static inline struct nf_conn_help *nfct_help(const struct nf_conn *ct)
        return nf_ct_ext_find(ct, NF_CT_EXT_HELPER);
 }
+static inline void *nfct_help_data(const struct nf_conn *ct)
+{
+        struct nf_conn_help *help;
+        help = nf_ct_ext_find(ct, NF_CT_EXT_HELPER);
+        return (void *)help->data;
+}
 extern int nf_conntrack_helper_init(struct net *net);
 extern void nf_conntrack_helper_fini(struct net *net);
@@ -82,4 +104,7 @@ nf_ct_helper_expectfn_find_by_name(const char *name);
 struct nf_ct_helper_expectfn *
 nf_ct_helper_expectfn_find_by_symbol(const void *symbol);
+extern struct hlist_head *nf_ct_helper_hash;
+extern unsigned int nf_ct_helper_hsize;
 #endif /*_NF_CONNTRACK_HELPER_H*/
diff --git a/include/net/netfilter/nf_conntrack_l3proto.h b/include/net/netfilter/nf_conntrack_l3proto.h
index 9699c028b74b..6f7c13f4ac03 100644
--- a/include/net/netfilter/nf_conntrack_l3proto.h
+++ b/include/net/netfilter/nf_conntrack_l3proto.h
@@ -64,11 +64,12 @@ struct nf_conntrack_l3proto {
        size_t nla_size;
 #ifdef CONFIG_SYSCTL
-        struct ctl_table_header *ctl_table_header;
        const char              *ctl_table_path;
-        struct ctl_table        *ctl_table;
 #endif /* CONFIG_SYSCTL */
+        /* Init l3proto pernet data */
+        int (*init_net)(struct net *net);
        /* Module (if any) which this is connected to. */
        struct module *me;
 };
@@ -76,8 +77,10 @@ struct nf_conntrack_l3proto {
 extern struct nf_conntrack_l3proto __rcu *nf_ct_l3protos[AF_MAX];
 /* Protocol registration. */
-extern int nf_conntrack_l3proto_register(struct nf_conntrack_l3proto *proto);
+extern int nf_conntrack_l3proto_register(struct net *net,
-extern void nf_conntrack_l3proto_unregister(struct nf_conntrack_l3proto *proto);
+                                         struct nf_conntrack_l3proto *proto);
+extern void nf_conntrack_l3proto_unregister(struct net *net,
+                                            struct nf_conntrack_l3proto *proto);
 extern struct nf_conntrack_l3proto *nf_ct_l3proto_find_get(u_int16_t l3proto);
 extern void nf_ct_l3proto_put(struct nf_conntrack_l3proto *p);
diff --git a/include/net/netfilter/nf_conntrack_l4proto.h b/include/net/netfilter/nf_conntrack_l4proto.h
index 3b572bb20aa2..c3be4aef6bf7 100644
--- a/include/net/netfilter/nf_conntrack_l4proto.h
+++ b/include/net/netfilter/nf_conntrack_l4proto.h
@@ -12,6 +12,7 @@
 #include <linux/netlink.h>
 #include <net/netlink.h>
 #include <net/netfilter/nf_conntrack.h>
+#include <net/netns/generic.h>
 struct seq_file;
@@ -86,23 +87,21 @@ struct nf_conntrack_l4proto {
 #if IS_ENABLED(CONFIG_NF_CT_NETLINK_TIMEOUT)
        struct {
                size_t obj_size;
-                int (*nlattr_to_obj)(struct nlattr *tb[], void *data);
+                int (*nlattr_to_obj)(struct nlattr *tb[],
+                                     struct net *net, void *data);
                int (*obj_to_nlattr)(struct sk_buff *skb, const void *data);
                unsigned int nlattr_max;
                const struct nla_policy *nla_policy;
        } ctnl_timeout;
 #endif
+        int     *net_id;
+        /* Init l4proto pernet data */
+        int (*init_net)(struct net *net, u_int16_t proto);
+        /* Return the per-net protocol part. */
+        struct nf_proto_net *(*get_net_proto)(struct net *net);
-#ifdef CONFIG_SYSCTL
-        struct ctl_table_header **ctl_table_header;
-        struct ctl_table        *ctl_table;
-        unsigned int            *ctl_table_users;
-#ifdef CONFIG_NF_CONNTRACK_PROC_COMPAT
-        struct ctl_table_header *ctl_compat_table_header;
-        struct ctl_table        *ctl_compat_table;
-#endif
-#endif
        /* Protocol name */
        const char *name;
@@ -123,8 +122,18 @@ nf_ct_l4proto_find_get(u_int16_t l3proto, u_int8_t l4proto);
 extern void nf_ct_l4proto_put(struct nf_conntrack_l4proto *p);
 /* Protocol registration. */
-extern int nf_conntrack_l4proto_register(struct nf_conntrack_l4proto *proto);
+extern int nf_conntrack_l4proto_register(struct net *net,
-extern void nf_conntrack_l4proto_unregister(struct nf_conntrack_l4proto *proto);
+                                         struct nf_conntrack_l4proto *proto);
+extern void nf_conntrack_l4proto_unregister(struct net *net,
+                                            struct nf_conntrack_l4proto *proto);
+static inline void nf_ct_kfree_compat_sysctl_table(struct nf_proto_net *pn)
+{
+#if defined(CONFIG_SYSCTL) && defined(CONFIG_NF_CONNTRACK_PROC_COMPAT)
+        kfree(pn->ctl_compat_table);
+        pn->ctl_compat_table = NULL;
+#endif
+}
 /* Generic netlink helpers */
 extern int nf_ct_port_tuple_to_nlattr(struct sk_buff *skb,
diff --git a/include/net/netfilter/nf_nat_helper.h b/include/net/netfilter/nf_nat_helper.h
index 02bb6c29dc3d..7d8fb7b46c44 100644
--- a/include/net/netfilter/nf_nat_helper.h
+++ b/include/net/netfilter/nf_nat_helper.h
@@ -54,4 +54,8 @@ extern void nf_nat_follow_master(struct nf_conn *ct,
 extern s16 nf_nat_get_offset(const struct nf_conn *ct,
                             enum ip_conntrack_dir dir,
                             u32 seq);
+extern void nf_nat_tcp_seq_adjust(struct sk_buff *skb, struct nf_conn *ct,
+                                  u32 dir, int off);
 #endif
diff --git a/include/net/netfilter/nfnetlink_queue.h b/include/net/netfilter/nfnetlink_queue.h
new file mode 100644
index 000000000000..86267a529514
--- /dev/null
+++ b/include/net/netfilter/nfnetlink_queue.h
@@ -0,0 +1,43 @@
+#ifndef _NET_NFNL_QUEUE_H_
+#define _NET_NFNL_QUEUE_H_
+#include <linux/netfilter/nf_conntrack_common.h>
+struct nf_conn;
+#ifdef CONFIG_NETFILTER_NETLINK_QUEUE_CT
+struct nf_conn *nfqnl_ct_get(struct sk_buff *entskb, size_t *size,
+                             enum ip_conntrack_info *ctinfo);
+struct nf_conn *nfqnl_ct_parse(const struct sk_buff *skb,
+                               const struct nlattr *attr,
+                               enum ip_conntrack_info *ctinfo);
+int nfqnl_ct_put(struct sk_buff *skb, struct nf_conn *ct,
+                 enum ip_conntrack_info ctinfo);
+void nfqnl_ct_seq_adjust(struct sk_buff *skb, struct nf_conn *ct,
+                         enum ip_conntrack_info ctinfo, int diff);
+#else
+inline struct nf_conn *
+nfqnl_ct_get(struct sk_buff *entskb, size_t *size, enum ip_conntrack_info *ctinfo)
+{
+        return NULL;
+}
+inline struct nf_conn *nfqnl_ct_parse(const struct sk_buff *skb,
+                                      const struct nlattr *attr,
+                                      enum ip_conntrack_info *ctinfo)
+{
+        return NULL;
+}
+inline int
+nfqnl_ct_put(struct sk_buff *skb, struct nf_conn *ct, enum ip_conntrack_info ctinfo)
+{
+        return 0;
+}
+inline void nfqnl_ct_seq_adjust(struct sk_buff *skb, struct nf_conn *ct,
+                                enum ip_conntrack_info ctinfo, int diff)
+{
+}
+#endif /* NF_CONNTRACK */
+#endif
diff --git a/include/net/netns/conntrack.h b/include/net/netns/conntrack.h
index a053a19870cf..3aecdc7a84fb 100644
--- a/include/net/netns/conntrack.h
+++ b/include/net/netns/conntrack.h
@@ -4,10 +4,64 @@
 #include <linux/list.h>
 #include <linux/list_nulls.h>
 #include <linux/atomic.h>
+#include <linux/netfilter/nf_conntrack_tcp.h>
 struct ctl_table_header;
 struct nf_conntrack_ecache;
+struct nf_proto_net {
+#ifdef CONFIG_SYSCTL
+        struct ctl_table_header *ctl_table_header;
+        struct ctl_table        *ctl_table;
+#ifdef CONFIG_NF_CONNTRACK_PROC_COMPAT
+        struct ctl_table_header *ctl_compat_header;
+        struct ctl_table        *ctl_compat_table;
+#endif
+#endif
+        unsigned int            users;
+};
+struct nf_generic_net {
+        struct nf_proto_net pn;
+        unsigned int timeout;
+};
+struct nf_tcp_net {
+        struct nf_proto_net pn;
+        unsigned int timeouts[TCP_CONNTRACK_TIMEOUT_MAX];
+        unsigned int tcp_loose;
+        unsigned int tcp_be_liberal;
+        unsigned int tcp_max_retrans;
+};
+enum udp_conntrack {
+        UDP_CT_UNREPLIED,
+        UDP_CT_REPLIED,
+        UDP_CT_MAX
+};
+struct nf_udp_net {
+        struct nf_proto_net pn;
+        unsigned int timeouts[UDP_CT_MAX];
+};
+struct nf_icmp_net {
+        struct nf_proto_net pn;
+        unsigned int timeout;
+};
+struct nf_ip_net {
+        struct nf_generic_net   generic;
+        struct nf_tcp_net       tcp;
+        struct nf_udp_net       udp;
+        struct nf_icmp_net      icmp;
+        struct nf_icmp_net      icmpv6;
+#if defined(CONFIG_SYSCTL) && defined(CONFIG_NF_CONNTRACK_PROC_COMPAT)
+        struct ctl_table_header *ctl_table_header;
+        struct ctl_table        *ctl_table;
+#endif
+};
 struct netns_ct {
        atomic_t                count;
        unsigned int            expect_count;
@@ -28,6 +82,7 @@ struct netns_ct {
        unsigned int            sysctl_log_invalid; /* Log invalid packets */
        int                     sysctl_auto_assign_helper;
        bool                    auto_assign_helper_warned;
+        struct nf_ip_net        nf_ct_proto;
 #ifdef CONFIG_SYSCTL
        struct ctl_table_header *sysctl_header;
        struct ctl_table_header *acct_sysctl_header;
diff --git a/include/net/netns/ipv4.h b/include/net/netns/ipv4.h
index bbd023a1c9b9..0ffb8e31f3cd 100644
--- a/include/net/netns/ipv4.h
+++ b/include/net/netns/ipv4.h
@@ -7,10 +7,12 @@
 #include <net/inet_frag.h>
+struct tcpm_hash_bucket;
 struct ctl_table_header;
 struct ipv4_devconf;
 struct fib_rules_ops;
 struct hlist_head;
+struct fib_table;
 struct sock;
 struct netns_ipv4 {
@@ -24,13 +26,21 @@ struct netns_ipv4 {
        struct ipv4_devconf     *devconf_dflt;
 #ifdef CONFIG_IP_MULTIPLE_TABLES
        struct fib_rules_ops    *rules_ops;
+        bool                    fib_has_custom_rules;
+        struct fib_table        *fib_local;
+        struct fib_table        *fib_main;
+        struct fib_table        *fib_default;
+#endif
+#ifdef CONFIG_IP_ROUTE_CLASSID
+        int                     fib_num_tclassid_users;
 #endif
        struct hlist_head       *fib_table_hash;
        struct sock             *fibnl;
        struct sock             **icmp_sk;
-        struct sock             *tcp_sock;
+        struct inet_peer_base   *peers;
+        struct tcpm_hash_bucket *tcp_metrics_hash;
+        unsigned int            tcp_metrics_hash_log;
        struct netns_frags      frags;
 #ifdef CONFIG_NETFILTER
        struct xt_table         *iptable_filter;
diff --git a/include/net/netns/ipv6.h b/include/net/netns/ipv6.h
index b42be53587ba..df0a5456a3fd 100644
--- a/include/net/netns/ipv6.h
+++ b/include/net/netns/ipv6.h
@@ -33,6 +33,7 @@ struct netns_ipv6 {
        struct netns_sysctl_ipv6 sysctl;
        struct ipv6_devconf     *devconf_all;
        struct ipv6_devconf     *devconf_dflt;
+        struct inet_peer_base   *peers;
        struct netns_frags      frags;
 #ifdef CONFIG_NETFILTER
        struct xt_table         *ip6table_filter;
diff --git a/include/net/netprio_cgroup.h b/include/net/netprio_cgroup.h
index d58fdec47597..2719dec6b5a8 100644
--- a/include/net/netprio_cgroup.h
+++ b/include/net/netprio_cgroup.h
@@ -35,7 +35,7 @@ struct cgroup_netprio_state {
 extern int net_prio_subsys_id;
 #endif
-extern void sock_update_netprioidx(struct sock *sk);
+extern void sock_update_netprioidx(struct sock *sk, struct task_struct *task);
 #if IS_BUILTIN(CONFIG_NETPRIO_CGROUP)
@@ -82,7 +82,7 @@ static inline u32 task_netprioidx(struct task_struct *p)
 #endif /* CONFIG_NETPRIO_CGROUP */
 #else
-#define sock_update_netprioidx(sk)
+#define sock_update_netprioidx(sk, task)
 #endif
 #endif  /* _NET_CLS_CGROUP_H */
diff --git a/include/net/nfc/hci.h b/include/net/nfc/hci.h
index 4467c9460857..f5169b04f082 100644
--- a/include/net/nfc/hci.h
+++ b/include/net/nfc/hci.h
@@ -31,7 +31,8 @@ struct nfc_hci_ops {
        void (*close) (struct nfc_hci_dev *hdev);
        int (*hci_ready) (struct nfc_hci_dev *hdev);
        int (*xmit) (struct nfc_hci_dev *hdev, struct sk_buff *skb);
-        int (*start_poll) (struct nfc_hci_dev *hdev, u32 protocols);
+        int (*start_poll) (struct nfc_hci_dev *hdev,
+                           u32 im_protocols, u32 tm_protocols);
        int (*target_from_gate) (struct nfc_hci_dev *hdev, u8 gate,
                                 struct nfc_target *target);
        int (*complete_target_discovered) (struct nfc_hci_dev *hdev, u8 gate,
@@ -43,10 +44,20 @@ struct nfc_hci_ops {
                              struct nfc_target *target);
 };
-#define NFC_HCI_MAX_CUSTOM_GATES        15
+/* Pipes */
+#define NFC_HCI_INVALID_PIPE    0x80
+#define NFC_HCI_LINK_MGMT_PIPE  0x00
+#define NFC_HCI_ADMIN_PIPE      0x01
+struct nfc_hci_gate {
+        u8 gate;
+        u8 pipe;
+};
+#define NFC_HCI_MAX_CUSTOM_GATES        50
 struct nfc_hci_init_data {
        u8 gate_count;
-        u8 gates[NFC_HCI_MAX_CUSTOM_GATES];
+        struct nfc_hci_gate gates[NFC_HCI_MAX_CUSTOM_GATES];
        char session_id[9];
 };
@@ -111,6 +122,8 @@ void nfc_hci_unregister_device(struct nfc_hci_dev *hdev);
 void nfc_hci_set_clientdata(struct nfc_hci_dev *hdev, void *clientdata);
 void *nfc_hci_get_clientdata(struct nfc_hci_dev *hdev);
+void nfc_hci_driver_failure(struct nfc_hci_dev *hdev, int err);
 /* Host IDs */
 #define NFC_HCI_HOST_CONTROLLER_ID      0x00
 #define NFC_HCI_TERMINAL_HOST_ID        0x01
@@ -179,7 +192,8 @@ void nfc_hci_event_received(struct nfc_hci_dev *hdev, u8 pipe, u8 event,
 void nfc_hci_recv_frame(struct nfc_hci_dev *hdev, struct sk_buff *skb);
 /* connecting to gates and sending hci instructions */
-int nfc_hci_connect_gate(struct nfc_hci_dev *hdev, u8 dest_host, u8 dest_gate);
+int nfc_hci_connect_gate(struct nfc_hci_dev *hdev, u8 dest_host, u8 dest_gate,
+                         u8 pipe);
 int nfc_hci_disconnect_gate(struct nfc_hci_dev *hdev, u8 gate);
 int nfc_hci_disconnect_all_gates(struct nfc_hci_dev *hdev);
 int nfc_hci_get_param(struct nfc_hci_dev *hdev, u8 gate, u8 idx,
diff --git a/include/net/nfc/nfc.h b/include/net/nfc/nfc.h
index b7ca4a2a1d72..6431f5e39022 100644
--- a/include/net/nfc/nfc.h
+++ b/include/net/nfc/nfc.h
@@ -53,7 +53,8 @@ struct nfc_target;
 struct nfc_ops {
        int (*dev_up)(struct nfc_dev *dev);
        int (*dev_down)(struct nfc_dev *dev);
-        int (*start_poll)(struct nfc_dev *dev, u32 protocols);
+        int (*start_poll)(struct nfc_dev *dev,
+                          u32 im_protocols, u32 tm_protocols);
        void (*stop_poll)(struct nfc_dev *dev);
        int (*dep_link_up)(struct nfc_dev *dev, struct nfc_target *target,
                           u8 comm_mode, u8 *gb, size_t gb_len);
@@ -62,9 +63,10 @@ struct nfc_ops {
                               u32 protocol);
        void (*deactivate_target)(struct nfc_dev *dev,
                                  struct nfc_target *target);
-        int (*data_exchange)(struct nfc_dev *dev, struct nfc_target *target,
+        int (*im_transceive)(struct nfc_dev *dev, struct nfc_target *target,
                             struct sk_buff *skb, data_exchange_cb_t cb,
                             void *cb_context);
+        int (*tm_send)(struct nfc_dev *dev, struct sk_buff *skb);
        int (*check_presence)(struct nfc_dev *dev, struct nfc_target *target);
 };
@@ -99,10 +101,10 @@ struct nfc_dev {
        int targets_generation;
        struct device dev;
        bool dev_up;
+        u8 rf_mode;
        bool polling;
        struct nfc_target *active_target;
        bool dep_link_up;
-        u32 dep_rf_mode;
        struct nfc_genl_data genl_data;
        u32 supported_protocols;
@@ -188,6 +190,7 @@ struct sk_buff *nfc_alloc_recv_skb(unsigned int size, gfp_t gfp);
 int nfc_set_remote_general_bytes(struct nfc_dev *dev,
                                 u8 *gt, u8 gt_len);
+u8 *nfc_get_local_general_bytes(struct nfc_dev *dev, size_t *gb_len);
 int nfc_targets_found(struct nfc_dev *dev,
                      struct nfc_target *targets, int ntargets);
@@ -196,4 +199,11 @@ int nfc_target_lost(struct nfc_dev *dev, u32 target_idx);
 int nfc_dep_link_is_up(struct nfc_dev *dev, u32 target_idx,
                       u8 comm_mode, u8 rf_mode);
+int nfc_tm_activated(struct nfc_dev *dev, u32 protocol, u8 comm_mode,
+                     u8 *gb, size_t gb_len);
+int nfc_tm_deactivated(struct nfc_dev *dev);
+int nfc_tm_data_received(struct nfc_dev *dev, struct sk_buff *skb);
+void nfc_driver_failure(struct nfc_dev *dev, int err);
 #endif /* __NET_NFC_H */
diff --git a/include/net/nfc/shdlc.h b/include/net/nfc/shdlc.h
index ab06afd462da..35e930d2f638 100644
--- a/include/net/nfc/shdlc.h
+++ b/include/net/nfc/shdlc.h
@@ -27,7 +27,8 @@ struct nfc_shdlc_ops {
        void (*close) (struct nfc_shdlc *shdlc);
        int (*hci_ready) (struct nfc_shdlc *shdlc);
        int (*xmit) (struct nfc_shdlc *shdlc, struct sk_buff *skb);
-        int (*start_poll) (struct nfc_shdlc *shdlc, u32 protocols);
+        int (*start_poll) (struct nfc_shdlc *shdlc,
+                           u32 im_protocols, u32 tm_protocols);
        int (*target_from_gate) (struct nfc_shdlc *shdlc, u8 gate,
                                 struct nfc_target *target);
        int (*complete_target_discovered) (struct nfc_shdlc *shdlc, u8 gate,
diff --git a/include/net/protocol.h b/include/net/protocol.h
index 875f4895b033..057f2d315567 100644
--- a/include/net/protocol.h
+++ b/include/net/protocol.h
@@ -29,11 +29,15 @@
 #include <linux/ipv6.h>
 #endif
-#define MAX_INET_PROTOS 256             /* Must be a power of 2         */
+/* This is one larger than the largest protocol value that can be
+ * found in an ipv4 or ipv6 header.  Since in both cases the protocol
+ * value is presented in a __u8, this is defined to be 256.
+ */
+#define MAX_INET_PROTOS         256
 /* This is used to register protocols. */
 struct net_protocol {
+        void                    (*early_demux)(struct sk_buff *skb);
        int                     (*handler)(struct sk_buff *skb);
        void                    (*err_handler)(struct sk_buff *skb, u32 info);
        int                     (*gso_send_check)(struct sk_buff *skb);
diff --git a/include/net/regulatory.h b/include/net/regulatory.h
index a5f79933e211..7dcaa2794fde 100644
--- a/include/net/regulatory.h
+++ b/include/net/regulatory.h
@@ -52,6 +52,10 @@ enum environment_cap {
 *      DFS master operation on a known DFS region (NL80211_DFS_*),
 *      dfs_region represents that region. Drivers can use this and the
 *      @alpha2 to adjust their device's DFS parameters as required.
+ * @user_reg_hint_type: if the @initiator was of type
+ *      %NL80211_REGDOM_SET_BY_USER, this classifies the type
+ *      of hint passed. This could be any of the %NL80211_USER_REG_HINT_*
+ *      types.
 * @intersect: indicates whether the wireless core should intersect
 *      the requested regulatory domain with the presently set regulatory
 *      domain.
@@ -70,6 +74,7 @@ enum environment_cap {
 struct regulatory_request {
        int wiphy_idx;
        enum nl80211_reg_initiator initiator;
+        enum nl80211_user_reg_hint_type user_reg_hint_type;
        char alpha2[2];
        u8 dfs_region;
        bool intersect;
diff --git a/include/net/route.h b/include/net/route.h
index 98705468ac03..c29ef2733f2d 100644
--- a/include/net/route.h
+++ b/include/net/route.h
@@ -40,45 +40,39 @@
 #define RT_CONN_FLAGS(sk)   (RT_TOS(inet_sk(sk)->tos) | sock_flag(sk, SOCK_LOCALROUTE))
 struct fib_nh;
-struct inet_peer;
 struct fib_info;
 struct rtable {
        struct dst_entry        dst;
-        /* Lookup key. */
-        __be32                  rt_key_dst;
-        __be32                  rt_key_src;
        int                     rt_genid;
        unsigned int            rt_flags;
        __u16                   rt_type;
-        __u8                    rt_key_tos;
+        __u16                   rt_is_input;
-        __be32                  rt_dst; /* Path destination     */
-        __be32                  rt_src; /* Path source          */
-        int                     rt_route_iif;
        int                     rt_iif;
-        int                     rt_oif;
-        __u32                   rt_mark;
        /* Info on neighbour */
        __be32                  rt_gateway;
        /* Miscellaneous cached information */
-        __be32                  rt_spec_dst; /* RFC1122 specific destination */
+        u32                     rt_pmtu;
-        u32                     rt_peer_genid;
-        struct inet_peer        *peer; /* long-living peer info */
-        struct fib_info         *fi; /* for client ref to shared metrics */
 };
 static inline bool rt_is_input_route(const struct rtable *rt)
 {
-        return rt->rt_route_iif != 0;
+        return rt->rt_is_input != 0;
 }
 static inline bool rt_is_output_route(const struct rtable *rt)
 {
-        return rt->rt_route_iif == 0;
+        return rt->rt_is_input == 0;
+}
+static inline __be32 rt_nexthop(const struct rtable *rt, __be32 daddr)
+{
+        if (rt->rt_gateway)
+                return rt->rt_gateway;
+        return daddr;
 }
 struct ip_rt_acct {
@@ -111,10 +105,7 @@ extern struct ip_rt_acct __percpu *ip_rt_acct;
 struct in_device;
 extern int              ip_rt_init(void);
-extern void             ip_rt_redirect(__be32 old_gw, __be32 dst, __be32 new_gw,
-                                       __be32 src, struct net_device *dev);
 extern void             rt_cache_flush(struct net *net, int how);
-extern void             rt_cache_flush_batch(struct net *net);
 extern struct rtable *__ip_route_output_key(struct net *, struct flowi4 *flp);
 extern struct rtable *ip_route_output_flow(struct net *, struct flowi4 *flp,
                                           struct sock *sk);
@@ -166,24 +157,16 @@ static inline struct rtable *ip_route_output_gre(struct net *net, struct flowi4
        return ip_route_output_key(net, fl4);
 }
-extern int ip_route_input_common(struct sk_buff *skb, __be32 dst, __be32 src,
+extern int ip_route_input(struct sk_buff *skb, __be32 dst, __be32 src,
-                                 u8 tos, struct net_device *devin, bool noref);
+                          u8 tos, struct net_device *devin);
-static inline int ip_route_input(struct sk_buff *skb, __be32 dst, __be32 src,
-                                 u8 tos, struct net_device *devin)
-{
-        return ip_route_input_common(skb, dst, src, tos, devin, false);
-}
-static inline int ip_route_input_noref(struct sk_buff *skb, __be32 dst, __be32 src,
-                                       u8 tos, struct net_device *devin)
-{
-        return ip_route_input_common(skb, dst, src, tos, devin, true);
-}
-extern unsigned short   ip_rt_frag_needed(struct net *net, const struct iphdr *iph,
+extern void ipv4_update_pmtu(struct sk_buff *skb, struct net *net, u32 mtu,
-                                          unsigned short new_mtu, struct net_device *dev);
+                             int oif, u32 mark, u8 protocol, int flow_flags);
-extern void             ip_rt_send_redirect(struct sk_buff *skb);
+extern void ipv4_sk_update_pmtu(struct sk_buff *skb, struct sock *sk, u32 mtu);
+extern void ipv4_redirect(struct sk_buff *skb, struct net *net,
+                          int oif, u32 mark, u8 protocol, int flow_flags);
+extern void ipv4_sk_redirect(struct sk_buff *skb, struct sock *sk);
+extern void ip_rt_send_redirect(struct sk_buff *skb);
 extern unsigned int             inet_addr_type(struct net *net, __be32 addr);
 extern unsigned int             inet_dev_addr_type(struct net *net, const struct net_device *dev, __be32 addr);
@@ -244,8 +227,6 @@ static inline void ip_route_connect_init(struct flowi4 *fl4, __be32 dst, __be32
        if (inet_sk(sk)->transparent)
                flow_flags |= FLOWI_FLAG_ANYSRC;
-        if (protocol == IPPROTO_TCP)
-                flow_flags |= FLOWI_FLAG_PRECOW_METRICS;
        if (can_sleep)
                flow_flags |= FLOWI_FLAG_CAN_SLEEP;
@@ -294,20 +275,13 @@ static inline struct rtable *ip_route_newports(struct flowi4 *fl4, struct rtable
        return rt;
 }
-extern void rt_bind_peer(struct rtable *rt, __be32 daddr, int create);
-static inline struct inet_peer *rt_get_peer(struct rtable *rt, __be32 daddr)
-{
-        if (rt->peer)
-                return rt->peer;
-        rt_bind_peer(rt, daddr, 0);
-        return rt->peer;
-}
 static inline int inet_iif(const struct sk_buff *skb)
 {
-        return skb_rtable(skb)->rt_iif;
+        int iif = skb_rtable(skb)->rt_iif;
+        if (iif)
+                return iif;
+        return skb->skb_iif;
 }
 extern int sysctl_ip_default_ttl;
diff --git a/include/net/rtnetlink.h b/include/net/rtnetlink.h
index bbcfd0993432..6b00c4fc4291 100644
--- a/include/net/rtnetlink.h
+++ b/include/net/rtnetlink.h
@@ -44,8 +44,10 @@ static inline int rtnl_msg_family(const struct nlmsghdr *nlh)
 *      @get_xstats_size: Function to calculate required room for dumping device
 *                        specific statistics
 *      @fill_xstats: Function to dump device specific statistics
- *      @get_tx_queues: Function to determine number of transmit queues to create when
+ *      @get_num_tx_queues: Function to determine number of transmit queues
- *                      creating a new device.
+ *                          to create when creating a new device.
+ *      @get_num_rx_queues: Function to determine number of receive queues
+ *                          to create when creating a new device.
 */
 struct rtnl_link_ops {
        struct list_head        list;
@@ -77,8 +79,8 @@ struct rtnl_link_ops {
        size_t                  (*get_xstats_size)(const struct net_device *dev);
        int                     (*fill_xstats)(struct sk_buff *skb,
                                               const struct net_device *dev);
-        int                     (*get_tx_queues)(struct net *net,
+        unsigned int            (*get_num_tx_queues)(void);
-                                                 struct nlattr *tb[]);
+        unsigned int            (*get_num_rx_queues)(void);
 };
 extern int      __rtnl_link_register(struct rtnl_link_ops *ops);
diff --git a/include/net/sch_generic.h b/include/net/sch_generic.h
index 9d7d54a00e63..d9611e032418 100644
--- a/include/net/sch_generic.h
+++ b/include/net/sch_generic.h
@@ -220,7 +220,7 @@ struct tcf_proto {
 struct qdisc_skb_cb {
        unsigned int            pkt_len;
-        u16                     bond_queue_mapping;
+        u16                     slave_dev_queue_mapping;
        u16                     _pad;
        unsigned char           data[20];
 };
diff --git a/include/net/sctp/constants.h b/include/net/sctp/constants.h
index 942b864f6135..d053d2e99876 100644
--- a/include/net/sctp/constants.h
+++ b/include/net/sctp/constants.h
@@ -334,6 +334,7 @@ typedef enum {
 typedef enum {
        SCTP_TRANSPORT_UP,
        SCTP_TRANSPORT_DOWN,
+        SCTP_TRANSPORT_PF,
 } sctp_transport_cmd_t;
 /* These are the address scopes defined mainly for IPv4 addresses
diff --git a/include/net/sctp/sctp.h b/include/net/sctp/sctp.h
index a2ef81466b00..ff499640528b 100644
--- a/include/net/sctp/sctp.h
+++ b/include/net/sctp/sctp.h
@@ -162,6 +162,8 @@ struct sock *sctp_err_lookup(int family, struct sk_buff *,
 void sctp_err_finish(struct sock *, struct sctp_association *);
 void sctp_icmp_frag_needed(struct sock *, struct sctp_association *,
                           struct sctp_transport *t, __u32 pmtu);
+void sctp_icmp_redirect(struct sock *, struct sctp_transport *,
+                        struct sk_buff *);
 void sctp_icmp_proto_unreachable(struct sock *sk,
                                 struct sctp_association *asoc,
                                 struct sctp_transport *t);
@@ -517,10 +519,10 @@ static inline int sctp_frag_point(const struct sctp_association *asoc, int pmtu)
        return frag;
 }
-static inline void sctp_assoc_pending_pmtu(struct sctp_association *asoc)
+static inline void sctp_assoc_pending_pmtu(struct sock *sk, struct sctp_association *asoc)
 {
-        sctp_assoc_sync_pmtu(asoc);
+        sctp_assoc_sync_pmtu(sk, asoc);
        asoc->pmtu_pending = 0;
 }
diff --git a/include/net/sctp/structs.h b/include/net/sctp/structs.h
index fecdf31816f2..fc5e60016e37 100644
--- a/include/net/sctp/structs.h
+++ b/include/net/sctp/structs.h
@@ -161,6 +161,12 @@ extern struct sctp_globals {
        int max_retrans_path;
        int max_retrans_init;
+        /* Potentially-Failed.Max.Retrans sysctl value
+         * taken from:
+         * http://tools.ietf.org/html/draft-nishida-tsvwg-sctp-failover-05
+         */
+        int pf_retrans;
        /*
         * Policy for preforming sctp/socket accounting
         * 0   - do socket level accounting, all assocs share sk_sndbuf
@@ -258,6 +264,7 @@ extern struct sctp_globals {
 #define sctp_sndbuf_policy              (sctp_globals.sndbuf_policy)
 #define sctp_rcvbuf_policy              (sctp_globals.rcvbuf_policy)
 #define sctp_max_retrans_path           (sctp_globals.max_retrans_path)
+#define sctp_pf_retrans                 (sctp_globals.pf_retrans)
 #define sctp_max_retrans_init           (sctp_globals.max_retrans_init)
 #define sctp_sack_timeout               (sctp_globals.sack_timeout)
 #define sctp_hb_interval                (sctp_globals.hb_interval)
@@ -990,10 +997,15 @@ struct sctp_transport {
        /* This is the max_retrans value for the transport and will
         * be initialized from the assocs value.  This can be changed
-         * using SCTP_SET_PEER_ADDR_PARAMS socket option.
+         * using the SCTP_SET_PEER_ADDR_PARAMS socket option.
         */
        __u16 pathmaxrxt;
+        /* This is the partially failed retrans value for the transport
+         * and will be initialized from the assocs value.  This can be changed
+         * using the SCTP_PEER_ADDR_THLDS socket option
+         */
+        int pf_retrans;
        /* PMTU       : The current known path MTU.  */
        __u32 pathmtu;
@@ -1091,7 +1103,7 @@ void sctp_transport_burst_limited(struct sctp_transport *);
 void sctp_transport_burst_reset(struct sctp_transport *);
 unsigned long sctp_transport_timeout(struct sctp_transport *);
 void sctp_transport_reset(struct sctp_transport *);
-void sctp_transport_update_pmtu(struct sctp_transport *, u32);
+void sctp_transport_update_pmtu(struct sock *, struct sctp_transport *, u32);
 void sctp_transport_immediate_rtx(struct sctp_transport *);
@@ -1664,6 +1676,12 @@ struct sctp_association {
         */
        int max_retrans;
+        /* This is the partially failed retrans value for the transport
+         * and will be initialized from the assocs value.  This can be
+         * changed using the SCTP_PEER_ADDR_THLDS socket option
+         */
+        int pf_retrans;
        /* Maximum number of times the endpoint will retransmit INIT  */
        __u16 max_init_attempts;
@@ -2003,7 +2021,7 @@ void sctp_assoc_update(struct sctp_association *old,
 __u32 sctp_association_get_next_tsn(struct sctp_association *);
-void sctp_assoc_sync_pmtu(struct sctp_association *);
+void sctp_assoc_sync_pmtu(struct sock *, struct sctp_association *);
 void sctp_assoc_rwnd_increase(struct sctp_association *, unsigned int);
 void sctp_assoc_rwnd_decrease(struct sctp_association *, unsigned int);
 void sctp_assoc_set_primary(struct sctp_association *,
diff --git a/include/net/sctp/user.h b/include/net/sctp/user.h
index 0842ef00b2fe..1b02d7ad453b 100644
--- a/include/net/sctp/user.h
+++ b/include/net/sctp/user.h
@@ -93,6 +93,7 @@ typedef __s32 sctp_assoc_t;
 #define SCTP_GET_ASSOC_NUMBER   28      /* Read only */
 #define SCTP_GET_ASSOC_ID_LIST  29      /* Read only */
 #define SCTP_AUTO_ASCONF       30
+#define SCTP_PEER_ADDR_THLDS    31
 /* Internal Socket Options. Some of the sctp library functions are
 * implemented using these socket options.
@@ -649,6 +650,7 @@ struct sctp_paddrinfo {
 */
 enum sctp_spinfo_state {
        SCTP_INACTIVE,
+        SCTP_PF,
        SCTP_ACTIVE,
        SCTP_UNCONFIRMED,
        SCTP_UNKNOWN = 0xffff  /* Value used for transport state unknown */
@@ -741,4 +743,13 @@ typedef struct {
        int sd;
 } sctp_peeloff_arg_t;
+/*
+ *  Peer Address Thresholds socket option
+ */
+struct sctp_paddrthlds {
+        sctp_assoc_t spt_assoc_id;
+        struct sockaddr_storage spt_address;
+        __u16 spt_pathmaxrxt;
+        __u16 spt_pathpfthld;
+};
 #endif /* __net_sctp_user_h__ */
diff --git a/include/net/sock.h b/include/net/sock.h
index 4a4521699563..e067f8c18f88 100644
--- a/include/net/sock.h
+++ b/include/net/sock.h
@@ -198,6 +198,7 @@ struct cg_proto;
  *     @sk_lock:       synchronizer
  *     @sk_rcvbuf: size of receive buffer in bytes
  *     @sk_wq: sock wait queue and async head
+  *     @sk_rx_dst: receive input route used by early tcp demux
  *     @sk_dst_cache: destination cache
  *     @sk_dst_lock: destination cache lock
  *     @sk_policy: flow policy
@@ -317,6 +318,7 @@ struct sock {
        struct xfrm_policy      *sk_policy[2];
 #endif
        unsigned long           sk_flags;
+        struct dst_entry        *sk_rx_dst;
        struct dst_entry        *sk_dst_cache;
        spinlock_t              sk_dst_lock;
        atomic_t                sk_wmem_alloc;
@@ -856,6 +858,9 @@ struct proto {
        int                     (*backlog_rcv) (struct sock *sk,
                                                struct sk_buff *skb);
+        void            (*release_cb)(struct sock *sk);
+        void            (*mtu_reduced)(struct sock *sk);
        /* Keeping track of sk's, looking them up, and port selection methods. */
        void                    (*hash)(struct sock *sk);
        void                    (*unhash)(struct sock *sk);
@@ -1426,6 +1431,7 @@ extern struct sk_buff		*sock_rmalloc(struct sock *sk,
                                              gfp_t priority);
 extern void                     sock_wfree(struct sk_buff *skb);
 extern void                     sock_rfree(struct sk_buff *skb);
+extern void                     sock_edemux(struct sk_buff *skb);
 extern int                      sock_setsockopt(struct socket *sock, int level,
                                                int op, char __user *optval,
@@ -2152,7 +2158,7 @@ static inline void sk_change_net(struct sock *sk, struct net *net)
 static inline struct sock *skb_steal_sock(struct sk_buff *skb)
 {
-        if (unlikely(skb->sk)) {
+        if (skb->sk) {
                struct sock *sk = skb->sk;
                skb->destructor = NULL;
diff --git a/include/net/tcp.h b/include/net/tcp.h
index e79aa48d9fc1..e19124b84cd2 100644
--- a/include/net/tcp.h
+++ b/include/net/tcp.h
@@ -170,6 +170,11 @@ extern void tcp_time_wait(struct sock *sk, int state, int timeo);
 #define TCPOPT_TIMESTAMP        8       /* Better RTT estimations/PAWS */
 #define TCPOPT_MD5SIG           19      /* MD5 Signature (RFC2385) */
 #define TCPOPT_COOKIE           253     /* Cookie extension (experimental) */
+#define TCPOPT_EXP              254     /* Experimental */
+/* Magic number to be after the option value for sharing TCP
+ * experimental options. See draft-ietf-tcpm-experimental-options-00.txt
+ */
+#define TCPOPT_FASTOPEN_MAGIC   0xF989
 /*
 *     TCP option lengths
@@ -180,6 +185,7 @@ extern void tcp_time_wait(struct sock *sk, int state, int timeo);
 #define TCPOLEN_SACK_PERM      2
 #define TCPOLEN_TIMESTAMP      10
 #define TCPOLEN_MD5SIG         18
+#define TCPOLEN_EXP_FASTOPEN_BASE  4
 #define TCPOLEN_COOKIE_BASE    2        /* Cookie-less header extension */
 #define TCPOLEN_COOKIE_PAIR    3        /* Cookie pair header extension */
 #define TCPOLEN_COOKIE_MIN     (TCPOLEN_COOKIE_BASE+TCP_COOKIE_MIN)
@@ -206,6 +212,10 @@ extern void tcp_time_wait(struct sock *sk, int state, int timeo);
 /* TCP initial congestion window as per draft-hkchu-tcpm-initcwnd-01 */
 #define TCP_INIT_CWND           10
+/* Bit Flags for sysctl_tcp_fastopen */
+#define TFO_CLIENT_ENABLE       1
+#define TFO_CLIENT_NO_COOKIE    4       /* Data in SYN w/o cookie option */
 extern struct inet_timewait_death_row tcp_death_row;
 /* sysctl variables for tcp */
@@ -222,6 +232,7 @@ extern int sysctl_tcp_retries1;
 extern int sysctl_tcp_retries2;
 extern int sysctl_tcp_orphan_retries;
 extern int sysctl_tcp_syncookies;
+extern int sysctl_tcp_fastopen;
 extern int sysctl_tcp_retrans_collapse;
 extern int sysctl_tcp_stdurg;
 extern int sysctl_tcp_rfc1337;
@@ -253,6 +264,8 @@ extern int sysctl_tcp_cookie_size;
 extern int sysctl_tcp_thin_linear_timeouts;
 extern int sysctl_tcp_thin_dupack;
 extern int sysctl_tcp_early_retrans;
+extern int sysctl_tcp_limit_output_bytes;
+extern int sysctl_tcp_challenge_ack_limit;
 extern atomic_long_t tcp_memory_allocated;
 extern struct percpu_counter tcp_sockets_allocated;
@@ -321,19 +334,24 @@ extern struct proto tcp_prot;
 extern void tcp_init_mem(struct net *net);
+extern void tcp_tasklet_init(void);
 extern void tcp_v4_err(struct sk_buff *skb, u32);
 extern void tcp_shutdown (struct sock *sk, int how);
+extern void tcp_v4_early_demux(struct sk_buff *skb);
 extern int tcp_v4_rcv(struct sk_buff *skb);
-extern struct inet_peer *tcp_v4_get_peer(struct sock *sk, bool *release_it);
+extern struct inet_peer *tcp_v4_get_peer(struct sock *sk);
-extern void *tcp_v4_tw_get_peer(struct sock *sk);
 extern int tcp_v4_tw_remember_stamp(struct inet_timewait_sock *tw);
 extern int tcp_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
                       size_t size);
 extern int tcp_sendpage(struct sock *sk, struct page *page, int offset,
                        size_t size, int flags);
+extern void tcp_release_cb(struct sock *sk);
+extern void tcp_write_timer_handler(struct sock *sk);
+extern void tcp_delack_timer_handler(struct sock *sk);
 extern int tcp_ioctl(struct sock *sk, int cmd, unsigned long arg);
 extern int tcp_rcv_state_process(struct sock *sk, struct sk_buff *skb,
                                 const struct tcphdr *th, unsigned int len);
@@ -388,6 +406,19 @@ extern void tcp_enter_frto(struct sock *sk);
 extern void tcp_enter_loss(struct sock *sk, int how);
 extern void tcp_clear_retrans(struct tcp_sock *tp);
 extern void tcp_update_metrics(struct sock *sk);
+extern void tcp_init_metrics(struct sock *sk);
+extern void tcp_metrics_init(void);
+extern bool tcp_peer_is_proven(struct request_sock *req, struct dst_entry *dst, bool paws_check);
+extern bool tcp_remember_stamp(struct sock *sk);
+extern bool tcp_tw_remember_stamp(struct inet_timewait_sock *tw);
+extern void tcp_fastopen_cache_get(struct sock *sk, u16 *mss,
+                                   struct tcp_fastopen_cookie *cookie,
+                                   int *syn_loss, unsigned long *last_syn_loss);
+extern void tcp_fastopen_cache_set(struct sock *sk, u16 mss,
+                                   struct tcp_fastopen_cookie *cookie,
+                                   bool syn_lost);
+extern void tcp_fetch_timewait_stamp(struct sock *sk, struct dst_entry *dst);
+extern void tcp_disable_fack(struct tcp_sock *tp);
 extern void tcp_close(struct sock *sk, long timeout);
 extern void tcp_init_sock(struct sock *sk);
 extern unsigned int tcp_poll(struct file * file, struct socket *sock,
@@ -406,7 +437,7 @@ extern int tcp_recvmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
                       size_t len, int nonblock, int flags, int *addr_len);
 extern void tcp_parse_options(const struct sk_buff *skb,
                              struct tcp_options_received *opt_rx, const u8 **hvpp,
-                              int estab);
+                              int estab, struct tcp_fastopen_cookie *foc);
 extern const u8 *tcp_parse_md5sig_option(const struct tcphdr *th);
 /*
@@ -556,6 +587,8 @@ static inline u32 __tcp_set_rto(const struct tcp_sock *tp)
        return (tp->srtt >> 3) + tp->rttvar;
 }
+extern void tcp_set_rto(struct sock *sk);
 static inline void __tcp_fast_path_on(struct tcp_sock *tp, u32 snd_wnd)
 {
        tp->pred_flags = htonl((tp->tcp_header_len << 26) |
@@ -1264,6 +1297,15 @@ extern int tcp_md5_hash_skb_data(struct tcp_md5sig_pool *, const struct sk_buff
 extern int tcp_md5_hash_key(struct tcp_md5sig_pool *hp,
                            const struct tcp_md5sig_key *key);
+struct tcp_fastopen_request {
+        /* Fast Open cookie. Size 0 means a cookie request */
+        struct tcp_fastopen_cookie      cookie;
+        struct msghdr                   *data;  /* data in MSG_FASTOPEN */
+        u16                             copied; /* queued in tcp_connect() */
+};
+void tcp_free_fastopen_req(struct tcp_sock *tp);
 /* write queue abstraction */
 static inline void tcp_write_queue_purge(struct sock *sk)
 {
diff --git a/include/net/timewait_sock.h b/include/net/timewait_sock.h
index 8d6689cb2c66..68f0ecad6c6e 100644
--- a/include/net/timewait_sock.h
+++ b/include/net/timewait_sock.h
@@ -22,7 +22,6 @@ struct timewait_sock_ops {
        int             (*twsk_unique)(struct sock *sk,
                                       struct sock *sktw, void *twp);
        void            (*twsk_destructor)(struct sock *sk);
-        void            *(*twsk_getpeer)(struct sock *sk);
 };
 static inline int twsk_unique(struct sock *sk, struct sock *sktw, void *twp)
@@ -41,11 +40,4 @@ static inline void twsk_destructor(struct sock *sk)
                sk->sk_prot->twsk_prot->twsk_destructor(sk);
 }
-static inline void *twsk_getpeer(struct sock *sk)
-{
-        if (sk->sk_prot->twsk_prot->twsk_getpeer)
-                return sk->sk_prot->twsk_prot->twsk_getpeer(sk);
-        return NULL;
-}
 #endif /* _TIMEWAIT_SOCK_H */
diff --git a/include/net/xfrm.h b/include/net/xfrm.h
index e0a55df5bde8..d9509eb29b80 100644
--- a/include/net/xfrm.h
+++ b/include/net/xfrm.h
@@ -1475,6 +1475,8 @@ extern int xfrm4_output(struct sk_buff *skb);
 extern int xfrm4_output_finish(struct sk_buff *skb);
 extern int xfrm4_tunnel_register(struct xfrm_tunnel *handler, unsigned short family);
 extern int xfrm4_tunnel_deregister(struct xfrm_tunnel *handler, unsigned short family);
+extern int xfrm4_mode_tunnel_input_register(struct xfrm_tunnel *handler);
+extern int xfrm4_mode_tunnel_input_deregister(struct xfrm_tunnel *handler);
 extern int xfrm6_extract_header(struct sk_buff *skb);
 extern int xfrm6_extract_input(struct xfrm_state *x, struct sk_buff *skb);
 extern int xfrm6_rcv_spi(struct sk_buff *skb, int nexthdr, __be32 spi);
@@ -1682,13 +1684,11 @@ static inline int xfrm_mark_get(struct nlattr **attrs, struct xfrm_mark *m)
 static inline int xfrm_mark_put(struct sk_buff *skb, const struct xfrm_mark *m)
 {
-        if ((m->m | m->v) &&
+        int ret = 0;
-            nla_put(skb, XFRMA_MARK, sizeof(struct xfrm_mark), m))
-                goto nla_put_failure;
-        return 0;
-nla_put_failure:
+        if (m->m | m->v)
-        return -1;
+                ret = nla_put(skb, XFRMA_MARK, sizeof(struct xfrm_mark), m);
+        return ret;
 }
 #endif  /* _NET_XFRM_H */