110 files changed, 2476 insertions, 690 deletions

diff --git a/include/linux/ath9k_platform.h b/include/linux/ath9k_platform.h
index 6e3f54f37844..fcdd81bd5314 100644
--- a/include/linux/ath9k_platform.h
+++ b/include/linux/ath9k_platform.h
@@ -22,6 +22,8 @@
 #define ATH9K_PLAT_EEP_MAX_WORDS        2048
 
 struct ath9k_platform_data {
+        const char *eeprom_name;
+
         u16 eeprom_data[ATH9K_PLAT_EEP_MAX_WORDS];
         u8 *macaddr;
 
diff --git a/include/linux/atmdev.h b/include/linux/atmdev.h
index 22ef21c33d0c..c1da539f5e28 100644
--- a/include/linux/atmdev.h
+++ b/include/linux/atmdev.h
@@ -99,6 +99,7 @@ struct atm_vcc {
         struct atm_dev  *dev;           /* device back pointer */
         struct atm_qos  qos;            /* QOS */
         struct atm_sap  sap;            /* SAP */
+        void (*release_cb)(struct atm_vcc *vcc); /* release_sock callback */
         void (*push)(struct atm_vcc *vcc,struct sk_buff *skb);
         void (*pop)(struct atm_vcc *vcc,struct sk_buff *skb); /* optional */
         int (*push_oam)(struct atm_vcc *vcc,void *cell);
@@ -106,6 +107,7 @@ struct atm_vcc {
         void            *dev_data;      /* per-device data */
         void            *proto_data;    /* per-protocol data */
         struct k_atm_aal_stats *stats;  /* pointer to AAL stats group */
+        struct module *owner;           /* owner of ->push function */
         /* SVC part --- may move later ------------------------------------- */
         short           itf;            /* interface number */
         struct sockaddr_atmsvc local;
diff --git a/include/linux/bcm47xx_wdt.h b/include/linux/bcm47xx_wdt.h
new file mode 100644
index 000000000000..e5dfc256485b
--- /dev/null
+++ b/include/linux/bcm47xx_wdt.h
@@ -0,0 +1,19 @@
+#ifndef LINUX_BCM47XX_WDT_H_
+#define LINUX_BCM47XX_WDT_H_
+
+#include <linux/types.h>
+
+
+struct bcm47xx_wdt {
+        u32 (*timer_set)(struct bcm47xx_wdt *, u32);
+        u32 (*timer_set_ms)(struct bcm47xx_wdt *, u32);
+        u32 max_timer_ms;
+
+        void *driver_data;
+};
+
+static inline void *bcm47xx_wdt_get_drvdata(struct bcm47xx_wdt *wdt)
+{
+        return wdt->driver_data;
+}
+#endif /* LINUX_BCM47XX_WDT_H_ */
diff --git a/include/linux/bcma/bcma.h b/include/linux/bcma/bcma.h
index 4180eb78d575..93b1e091b1e9 100644
--- a/include/linux/bcma/bcma.h
+++ b/include/linux/bcma/bcma.h
@@ -157,6 +157,7 @@ struct bcma_host_ops {
 
 /* Chip IDs of SoCs */
 #define BCMA_CHIP_ID_BCM4706    0x5300
+#define  BCMA_PKG_ID_BCM4706L   1
 #define BCMA_CHIP_ID_BCM4716    0x4716
 #define  BCMA_PKG_ID_BCM4716    8
 #define  BCMA_PKG_ID_BCM4717    9
@@ -166,7 +167,11 @@ struct bcma_host_ops {
 #define BCMA_CHIP_ID_BCM4749    0x4749
 #define BCMA_CHIP_ID_BCM5356    0x5356
 #define BCMA_CHIP_ID_BCM5357    0x5357
+#define  BCMA_PKG_ID_BCM5358    9
+#define  BCMA_PKG_ID_BCM47186   10
+#define  BCMA_PKG_ID_BCM5357    11
 #define BCMA_CHIP_ID_BCM53572   53572
+#define  BCMA_PKG_ID_BCM47188   9
 
 struct bcma_device {
         struct bcma_bus *bus;
@@ -251,7 +256,7 @@ struct bcma_bus {
         u8 num;
 
         struct bcma_drv_cc drv_cc;
-        struct bcma_drv_pci drv_pci;
+        struct bcma_drv_pci drv_pci[2];
         struct bcma_drv_mips drv_mips;
         struct bcma_drv_gmac_cmn drv_gmac_cmn;
 
diff --git a/include/linux/bcma/bcma_driver_chipcommon.h b/include/linux/bcma/bcma_driver_chipcommon.h
index 1cf1749440ac..e51359180b6f 100644
--- a/include/linux/bcma/bcma_driver_chipcommon.h
+++ b/include/linux/bcma/bcma_driver_chipcommon.h
@@ -1,6 +1,8 @@
 #ifndef LINUX_BCMA_DRIVER_CC_H_
 #define LINUX_BCMA_DRIVER_CC_H_
 
+#include <linux/platform_device.h>
+
 /** ChipCommon core registers. **/
 #define BCMA_CC_ID                      0x0000
 #define  BCMA_CC_ID_ID                  0x0000FFFF
@@ -510,6 +512,7 @@ struct bcma_chipcommon_pmu {
 
 #ifdef CONFIG_BCMA_DRIVER_MIPS
 struct bcma_pflash {
+        bool present;
         u8 buswidth;
         u32 window;
         u32 window_size;
@@ -532,6 +535,7 @@ struct mtd_info;
 
 struct bcma_nflash {
         bool present;
+        bool boot;              /* This is the flash the SoC boots from */
 
         struct mtd_info *mtd;
 };
@@ -552,6 +556,7 @@ struct bcma_drv_cc {
         u32 capabilities;
         u32 capabilities_ext;
         u8 setup_done:1;
+        u8 early_setup_done:1;
         /* Fast Powerup Delay constant */
         u16 fast_pwrup_delay;
         struct bcma_chipcommon_pmu pmu;
@@ -567,6 +572,8 @@ struct bcma_drv_cc {
         int nr_serial_ports;
         struct bcma_serial_port serial_ports[4];
 #endif /* CONFIG_BCMA_DRIVER_MIPS */
+        u32 ticks_per_ms;
+        struct platform_device *watchdog;
 };
 
 /* Register access */
@@ -583,14 +590,14 @@ struct bcma_drv_cc {
         bcma_cc_write32(cc, offset, (bcma_cc_read32(cc, offset) & (mask)) | (set))
 
 extern void bcma_core_chipcommon_init(struct bcma_drv_cc *cc);
+extern void bcma_core_chipcommon_early_init(struct bcma_drv_cc *cc);
 
 extern void bcma_chipco_suspend(struct bcma_drv_cc *cc);
 extern void bcma_chipco_resume(struct bcma_drv_cc *cc);
 
 void bcma_chipco_bcm4331_ext_pa_lines_ctl(struct bcma_drv_cc *cc, bool enable);
 
-extern void bcma_chipco_watchdog_timer_set(struct bcma_drv_cc *cc,
-                                          u32 ticks);
+extern u32 bcma_chipco_watchdog_timer_set(struct bcma_drv_cc *cc, u32 ticks);
 
 void bcma_chipco_irq_mask(struct bcma_drv_cc *cc, u32 mask, u32 value);
 
@@ -606,6 +613,7 @@ u32 bcma_chipco_gpio_polarity(struct bcma_drv_cc *cc, u32 mask, u32 value);
 
 /* PMU support */
 extern void bcma_pmu_init(struct bcma_drv_cc *cc);
+extern void bcma_pmu_early_init(struct bcma_drv_cc *cc);
 
 extern void bcma_chipco_pll_write(struct bcma_drv_cc *cc, u32 offset,
                                   u32 value);
diff --git a/include/linux/bcma/bcma_driver_mips.h b/include/linux/bcma/bcma_driver_mips.h
index c0043645cdcb..0baf8a56b794 100644
--- a/include/linux/bcma/bcma_driver_mips.h
+++ b/include/linux/bcma/bcma_driver_mips.h
@@ -35,13 +35,16 @@ struct bcma_device;
 struct bcma_drv_mips {
         struct bcma_device *core;
         u8 setup_done:1;
+        u8 early_setup_done:1;
         unsigned int assigned_irqs;
 };
 
 #ifdef CONFIG_BCMA_DRIVER_MIPS
 extern void bcma_core_mips_init(struct bcma_drv_mips *mcore);
+extern void bcma_core_mips_early_init(struct bcma_drv_mips *mcore);
 #else
 static inline void bcma_core_mips_init(struct bcma_drv_mips *mcore) { }
+static inline void bcma_core_mips_early_init(struct bcma_drv_mips *mcore) { }
 #endif
 
 extern u32 bcma_cpu_clock(struct bcma_drv_mips *mcore);
diff --git a/include/linux/bcma/bcma_regs.h b/include/linux/bcma/bcma_regs.h
index 6c9cb93ae3de..7e8104bb7a7e 100644
--- a/include/linux/bcma/bcma_regs.h
+++ b/include/linux/bcma/bcma_regs.h
@@ -85,6 +85,9 @@
                                                          * (2 ZettaBytes), high 32 bits
                                                          */
 
-#define BCMA_SFLASH                     0x1c000000
+#define BCMA_SOC_FLASH1                 0x1fc00000      /* MIPS Flash Region 1 */
+#define BCMA_SOC_FLASH1_SZ              0x00400000      /* MIPS Size of Flash Region 1 */
+#define BCMA_SOC_FLASH2                 0x1c000000      /* Flash Region 2 (region 1 shadowed here) */
+#define BCMA_SOC_FLASH2_SZ              0x02000000      /* Size of Flash Region 2 */
 
 #endif /* LINUX_BCMA_REGS_H_ */
diff --git a/include/linux/etherdevice.h b/include/linux/etherdevice.h
index b006ba0a9f42..243eea1e33d8 100644
--- a/include/linux/etherdevice.h
+++ b/include/linux/etherdevice.h
@@ -51,6 +51,26 @@ extern struct net_device *alloc_etherdev_mqs(int sizeof_priv, unsigned int txqs,
 #define alloc_etherdev(sizeof_priv) alloc_etherdev_mq(sizeof_priv, 1)
 #define alloc_etherdev_mq(sizeof_priv, count) alloc_etherdev_mqs(sizeof_priv, count, count)
 
+/* Reserved Ethernet Addresses per IEEE 802.1Q */
+static const u8 eth_reserved_addr_base[ETH_ALEN] __aligned(2) =
+{ 0x01, 0x80, 0xc2, 0x00, 0x00, 0x00 };
+
+/**
+ * is_link_local_ether_addr - Determine if given Ethernet address is link-local
+ * @addr: Pointer to a six-byte array containing the Ethernet address
+ *
+ * Return true if address is link local reserved addr (01:80:c2:00:00:0X) per
+ * IEEE 802.1Q 8.6.3 Frame filtering.
+ */
+static inline bool is_link_local_ether_addr(const u8 *addr)
+{
+        __be16 *a = (__be16 *)addr;
+        static const __be16 *b = (const __be16 *)eth_reserved_addr_base;
+        static const __be16 m = cpu_to_be16(0xfff0);
+
+        return ((a[0] ^ b[0]) | (a[1] ^ b[1]) | ((a[2] ^ b[2]) & m)) == 0;
+}
+
 /**
  * is_zero_ether_addr - Determine if give Ethernet address is all zeros.
  * @addr: Pointer to a six-byte array containing the Ethernet address
diff --git a/include/linux/filter.h b/include/linux/filter.h
index 24d251f3bab0..c45eabc135e1 100644
--- a/include/linux/filter.h
+++ b/include/linux/filter.h
@@ -45,6 +45,7 @@ extern void sk_unattached_filter_destroy(struct sk_filter *fp);
 extern int sk_attach_filter(struct sock_fprog *fprog, struct sock *sk);
 extern int sk_detach_filter(struct sock *sk);
 extern int sk_chk_filter(struct sock_filter *filter, unsigned int flen);
+extern int sk_get_filter(struct sock *sk, struct sock_filter __user *filter, unsigned len);
 
 #ifdef CONFIG_BPF_JIT
 extern void bpf_jit_compile(struct sk_filter *fp);
@@ -123,6 +124,8 @@ enum {
         BPF_S_ANC_CPU,
         BPF_S_ANC_ALU_XOR_X,
         BPF_S_ANC_SECCOMP_LD_W,
+        BPF_S_ANC_VLAN_TAG,
+        BPF_S_ANC_VLAN_TAG_PRESENT,
 };
 
 #endif /* __LINUX_FILTER_H__ */
diff --git a/include/linux/hdlc/Kbuild b/include/linux/hdlc/Kbuild
index 1fb26448faa9..e69de29bb2d1 100644
--- a/include/linux/hdlc/Kbuild
+++ b/include/linux/hdlc/Kbuild
@@ -1 +0,0 @@
-header-y += ioctl.h
diff --git a/include/linux/ieee80211.h b/include/linux/ieee80211.h
index 2385119f8bb0..f0859cc73861 100644
--- a/include/linux/ieee80211.h
+++ b/include/linux/ieee80211.h
@@ -131,6 +131,8 @@
 
 #define IEEE80211_MAX_MESH_ID_LEN       32
 
+#define IEEE80211_NUM_TIDS              16
+
 #define IEEE80211_QOS_CTL_LEN           2
 /* 1d tag mask */
 #define IEEE80211_QOS_CTL_TAG1D_MASK            0x0007
@@ -666,6 +668,21 @@ struct ieee80211_meshconf_ie {
 } __attribute__ ((packed));
 
 /**
+ * enum mesh_config_capab_flags - Mesh Configuration IE capability field flags
+ *
+ * @IEEE80211_MESHCONF_CAPAB_ACCEPT_PLINKS: STA is willing to establish
+ *      additional mesh peerings with other mesh STAs
+ * @IEEE80211_MESHCONF_CAPAB_FORWARDING: the STA forwards MSDUs
+ * @IEEE80211_MESHCONF_CAPAB_TBTT_ADJUSTING: TBTT adjustment procedure
+ *      is ongoing
+ */
+enum mesh_config_capab_flags {
+        IEEE80211_MESHCONF_CAPAB_ACCEPT_PLINKS          = 0x01,
+        IEEE80211_MESHCONF_CAPAB_FORWARDING             = 0x08,
+        IEEE80211_MESHCONF_CAPAB_TBTT_ADJUSTING         = 0x20,
+};
+
+/**
  * struct ieee80211_rann_ie
  *
  * This structure refers to "Root Announcement information element"
@@ -905,6 +922,38 @@ struct ieee80211_tdls_data {
         } u;
 } __packed;
 
+/*
+ * Peer-to-Peer IE attribute related definitions.
+ */
+/**
+ * enum ieee80211_p2p_attr_id - identifies type of peer-to-peer attribute.
+ */
+enum ieee80211_p2p_attr_id {
+        IEEE80211_P2P_ATTR_STATUS = 0,
+        IEEE80211_P2P_ATTR_MINOR_REASON,
+        IEEE80211_P2P_ATTR_CAPABILITY,
+        IEEE80211_P2P_ATTR_DEVICE_ID,
+        IEEE80211_P2P_ATTR_GO_INTENT,
+        IEEE80211_P2P_ATTR_GO_CONFIG_TIMEOUT,
+        IEEE80211_P2P_ATTR_LISTEN_CHANNEL,
+        IEEE80211_P2P_ATTR_GROUP_BSSID,
+        IEEE80211_P2P_ATTR_EXT_LISTEN_TIMING,
+        IEEE80211_P2P_ATTR_INTENDED_IFACE_ADDR,
+        IEEE80211_P2P_ATTR_MANAGABILITY,
+        IEEE80211_P2P_ATTR_CHANNEL_LIST,
+        IEEE80211_P2P_ATTR_ABSENCE_NOTICE,
+        IEEE80211_P2P_ATTR_DEVICE_INFO,
+        IEEE80211_P2P_ATTR_GROUP_INFO,
+        IEEE80211_P2P_ATTR_GROUP_ID,
+        IEEE80211_P2P_ATTR_INTERFACE,
+        IEEE80211_P2P_ATTR_OPER_CHANNEL,
+        IEEE80211_P2P_ATTR_INVITE_FLAGS,
+        /* 19 - 220: Reserved */
+        IEEE80211_P2P_ATTR_VENDOR_SPECIFIC = 221,
+
+        IEEE80211_P2P_ATTR_MAX
+};
+
 /**
  * struct ieee80211_bar - HT Block Ack Request
  *
@@ -1107,20 +1156,6 @@ struct ieee80211_ht_operation {
 #define WLAN_HT_SMPS_CONTROL_STATIC     1
 #define WLAN_HT_SMPS_CONTROL_DYNAMIC    3
 
-#define VHT_MCS_SUPPORTED_SET_SIZE      8
-
-struct ieee80211_vht_capabilities {
-        __le32 vht_capabilities_info;
-        u8 vht_supported_mcs_set[VHT_MCS_SUPPORTED_SET_SIZE];
-} __packed;
-
-struct ieee80211_vht_operation {
-        u8 vht_op_info_chwidth;
-        u8 vht_op_info_chan_center_freq_seg1_idx;
-        u8 vht_op_info_chan_center_freq_seg2_idx;
-        __le16 vht_basic_mcs_set;
-} __packed;
-
 /**
  * struct ieee80211_vht_mcs_info - VHT MCS information
  * @rx_mcs_map: RX MCS map 2 bits for each stream, total 8 streams
@@ -1128,11 +1163,13 @@ struct ieee80211_vht_operation {
  *      STA can receive. Rate expressed in units of 1 Mbps.
  *      If this field is 0 this value should not be used to
  *      consider the highest RX data rate supported.
+ *      The top 3 bits of this field are reserved.
  * @tx_mcs_map: TX MCS map 2 bits for each stream, total 8 streams
  * @tx_highest: Indicates highest long GI VHT PPDU data rate
  *      STA can transmit. Rate expressed in units of 1 Mbps.
  *      If this field is 0 this value should not be used to
  *      consider the highest TX data rate supported.
+ *      The top 3 bits of this field are reserved.
  */
 struct ieee80211_vht_mcs_info {
         __le16 rx_mcs_map;
@@ -1141,38 +1178,107 @@ struct ieee80211_vht_mcs_info {
         __le16 tx_highest;
 } __packed;
 
+/**
+ * enum ieee80211_vht_mcs_support - VHT MCS support definitions
+ * @IEEE80211_VHT_MCS_SUPPORT_0_7: MCSes 0-7 are supported for the
+ *      number of streams
+ * @IEEE80211_VHT_MCS_SUPPORT_0_8: MCSes 0-8 are supported
+ * @IEEE80211_VHT_MCS_SUPPORT_0_9: MCSes 0-9 are supported
+ * @IEEE80211_VHT_MCS_NOT_SUPPORTED: This number of streams isn't supported
+ *
+ * These definitions are used in each 2-bit subfield of the @rx_mcs_map
+ * and @tx_mcs_map fields of &struct ieee80211_vht_mcs_info, which are
+ * both split into 8 subfields by number of streams. These values indicate
+ * which MCSes are supported for the number of streams the value appears
+ * for.
+ */
+enum ieee80211_vht_mcs_support {
+        IEEE80211_VHT_MCS_SUPPORT_0_7   = 0,
+        IEEE80211_VHT_MCS_SUPPORT_0_8   = 1,
+        IEEE80211_VHT_MCS_SUPPORT_0_9   = 2,
+        IEEE80211_VHT_MCS_NOT_SUPPORTED = 3,
+};
+
+/**
+ * struct ieee80211_vht_cap - VHT capabilities
+ *
+ * This structure is the "VHT capabilities element" as
+ * described in 802.11ac D3.0 8.4.2.160
+ * @vht_cap_info: VHT capability info
+ * @supp_mcs: VHT MCS supported rates
+ */
+struct ieee80211_vht_cap {
+        __le32 vht_cap_info;
+        struct ieee80211_vht_mcs_info supp_mcs;
+} __packed;
+
+/**
+ * enum ieee80211_vht_chanwidth - VHT channel width
+ * @IEEE80211_VHT_CHANWIDTH_USE_HT: use the HT operation IE to
+ *      determine the channel width (20 or 40 MHz)
+ * @IEEE80211_VHT_CHANWIDTH_80MHZ: 80 MHz bandwidth
+ * @IEEE80211_VHT_CHANWIDTH_160MHZ: 160 MHz bandwidth
+ * @IEEE80211_VHT_CHANWIDTH_80P80MHZ: 80+80 MHz bandwidth
+ */
+enum ieee80211_vht_chanwidth {
+        IEEE80211_VHT_CHANWIDTH_USE_HT          = 0,
+        IEEE80211_VHT_CHANWIDTH_80MHZ           = 1,
+        IEEE80211_VHT_CHANWIDTH_160MHZ          = 2,
+        IEEE80211_VHT_CHANWIDTH_80P80MHZ        = 3,
+};
+
+/**
+ * struct ieee80211_vht_operation - VHT operation IE
+ *
+ * This structure is the "VHT operation element" as
+ * described in 802.11ac D3.0 8.4.2.161
+ * @chan_width: Operating channel width
+ * @center_freq_seg1_idx: center freq segment 1 index
+ * @center_freq_seg2_idx: center freq segment 2 index
+ * @basic_mcs_set: VHT Basic MCS rate set
+ */
+struct ieee80211_vht_operation {
+        u8 chan_width;
+        u8 center_freq_seg1_idx;
+        u8 center_freq_seg2_idx;
+        __le16 basic_mcs_set;
+} __packed;
+
+
 #define IEEE80211_VHT_MCS_ZERO_TO_SEVEN_SUPPORT 0
 #define IEEE80211_VHT_MCS_ZERO_TO_EIGHT_SUPPORT 1
 #define IEEE80211_VHT_MCS_ZERO_TO_NINE_SUPPORT  2
 #define IEEE80211_VHT_MCS_NOT_SUPPORTED 3
 
 /* 802.11ac VHT Capabilities */
-#define IEEE80211_VHT_CAP_MAX_MPDU_LENGTH_3895                0x00000000
-#define IEEE80211_VHT_CAP_MAX_MPDU_LENGTH_7991                0x00000001
-#define IEEE80211_VHT_CAP_MAX_MPDU_LENGTH_11454               0x00000002
-#define IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160MHZ              0x00000004
-#define IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160_80PLUS80MHZ     0x00000008
-#define IEEE80211_VHT_CAP_RXLDPC                              0x00000010
-#define IEEE80211_VHT_CAP_SHORT_GI_80                         0x00000020
-#define IEEE80211_VHT_CAP_SHORT_GI_160                        0x00000040
-#define IEEE80211_VHT_CAP_TXSTBC                              0x00000080
-#define IEEE80211_VHT_CAP_RXSTBC_1                            0x00000100
-#define IEEE80211_VHT_CAP_RXSTBC_2                            0x00000200
-#define IEEE80211_VHT_CAP_RXSTBC_3                            0x00000300
-#define IEEE80211_VHT_CAP_RXSTBC_4                            0x00000400
-#define IEEE80211_VHT_CAP_SU_BEAMFORMER_CAPABLE               0x00000800
-#define IEEE80211_VHT_CAP_SU_BEAMFORMEE_CAPABLE               0x00001000
-#define IEEE80211_VHT_CAP_BEAMFORMER_ANTENNAS_MAX             0x00006000
-#define IEEE80211_VHT_CAP_SOUNDING_DIMENTION_MAX              0x00030000
-#define IEEE80211_VHT_CAP_MU_BEAMFORMER_CAPABLE               0x00080000
-#define IEEE80211_VHT_CAP_MU_BEAMFORMEE_CAPABLE               0x00100000
-#define IEEE80211_VHT_CAP_VHT_TXOP_PS                         0x00200000
-#define IEEE80211_VHT_CAP_HTC_VHT                             0x00400000
-#define IEEE80211_VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT          0x00800000
-#define IEEE80211_VHT_CAP_VHT_LINK_ADAPTATION_VHT_UNSOL_MFB   0x08000000
-#define IEEE80211_VHT_CAP_VHT_LINK_ADAPTATION_VHT_MRQ_MFB     0x0c000000
-#define IEEE80211_VHT_CAP_RX_ANTENNA_PATTERN                  0x10000000
-#define IEEE80211_VHT_CAP_TX_ANTENNA_PATTERN                  0x20000000
+#define IEEE80211_VHT_CAP_MAX_MPDU_LENGTH_3895                  0x00000000
+#define IEEE80211_VHT_CAP_MAX_MPDU_LENGTH_7991                  0x00000001
+#define IEEE80211_VHT_CAP_MAX_MPDU_LENGTH_11454                 0x00000002
+#define IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160MHZ                0x00000004
+#define IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160_80PLUS80MHZ       0x00000008
+#define IEEE80211_VHT_CAP_RXLDPC                                0x00000010
+#define IEEE80211_VHT_CAP_SHORT_GI_80                           0x00000020
+#define IEEE80211_VHT_CAP_SHORT_GI_160                          0x00000040
+#define IEEE80211_VHT_CAP_TXSTBC                                0x00000080
+#define IEEE80211_VHT_CAP_RXSTBC_1                              0x00000100
+#define IEEE80211_VHT_CAP_RXSTBC_2                              0x00000200
+#define IEEE80211_VHT_CAP_RXSTBC_3                              0x00000300
+#define IEEE80211_VHT_CAP_RXSTBC_4                              0x00000400
+#define IEEE80211_VHT_CAP_SU_BEAMFORMER_CAPABLE                 0x00000800
+#define IEEE80211_VHT_CAP_SU_BEAMFORMEE_CAPABLE                 0x00001000
+#define IEEE80211_VHT_CAP_BEAMFORMER_ANTENNAS_MAX               0x00006000
+#define IEEE80211_VHT_CAP_SOUNDING_DIMENTION_MAX                0x00030000
+#define IEEE80211_VHT_CAP_MU_BEAMFORMER_CAPABLE                 0x00080000
+#define IEEE80211_VHT_CAP_MU_BEAMFORMEE_CAPABLE                 0x00100000
+#define IEEE80211_VHT_CAP_VHT_TXOP_PS                           0x00200000
+#define IEEE80211_VHT_CAP_HTC_VHT                               0x00400000
+#define IEEE80211_VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT_SHIFT      23
+#define IEEE80211_VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT_MASK       \
+                (7 << IEEE80211_VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT_SHIFT)
+#define IEEE80211_VHT_CAP_VHT_LINK_ADAPTATION_VHT_UNSOL_MFB     0x08000000
+#define IEEE80211_VHT_CAP_VHT_LINK_ADAPTATION_VHT_MRQ_MFB       0x0c000000
+#define IEEE80211_VHT_CAP_RX_ANTENNA_PATTERN                    0x10000000
+#define IEEE80211_VHT_CAP_TX_ANTENNA_PATTERN                    0x20000000
 
 /* Authentication algorithms */
 #define WLAN_AUTH_OPEN 0
@@ -1440,8 +1546,6 @@ enum ieee80211_eid {
 
         WLAN_EID_RSN = 48,
         WLAN_EID_MMIE = 76,
-        WLAN_EID_WPA = 221,
-        WLAN_EID_GENERIC = 221,
         WLAN_EID_VENDOR_SPECIFIC = 221,
         WLAN_EID_QOS_PARAMETER = 222,
 
diff --git a/include/linux/if_tunnel.h b/include/linux/if_tunnel.h
index 1cc595a67cc9..f4e56ecd0b1a 100644
--- a/include/linux/if_tunnel.h
+++ b/include/linux/if_tunnel.h
@@ -4,5 +4,22 @@
 #include <linux/ip.h>
 #include <linux/in6.h>
 #include <uapi/linux/if_tunnel.h>
+#include <linux/u64_stats_sync.h>
+
+/*
+ * Locking : hash tables are protected by RCU and RTNL
+ */
+
+#define for_each_ip_tunnel_rcu(pos, start) \
+        for (pos = rcu_dereference(start); pos; pos = rcu_dereference(pos->next))
+
+/* often modified stats are per cpu, other are shared (netdev->stats) */
+struct pcpu_tstats {
+        u64     rx_packets;
+        u64     rx_bytes;
+        u64     tx_packets;
+        u64     tx_bytes;
+        struct u64_stats_sync   syncp;
+};
 
 #endif /* _IF_TUNNEL_H_ */
diff --git a/include/linux/inetdevice.h b/include/linux/inetdevice.h
index d032780d0ce5..a9d828976a77 100644
--- a/include/linux/inetdevice.h
+++ b/include/linux/inetdevice.h
@@ -171,6 +171,9 @@ struct in_ifaddr {
 extern int register_inetaddr_notifier(struct notifier_block *nb);
 extern int unregister_inetaddr_notifier(struct notifier_block *nb);
 
+extern void inet_netconf_notify_devconf(struct net *net, int type, int ifindex,
+                                        struct ipv4_devconf *devconf);
+
 extern struct net_device *__ip_dev_find(struct net *net, __be32 addr, bool devref);
 static inline struct net_device *ip_dev_find(struct net *net, __be32 addr)
 {
diff --git a/include/linux/ip.h b/include/linux/ip.h
index 58b82a22a52b..492bc6513533 100644
--- a/include/linux/ip.h
+++ b/include/linux/ip.h
@@ -25,6 +25,11 @@ static inline struct iphdr *ip_hdr(const struct sk_buff *skb)
         return (struct iphdr *)skb_network_header(skb);
 }
 
+static inline struct iphdr *inner_ip_hdr(const struct sk_buff *skb)
+{
+        return (struct iphdr *)skb_inner_network_header(skb);
+}
+
 static inline struct iphdr *ipip_hdr(const struct sk_buff *skb)
 {
         return (struct iphdr *)skb_transport_header(skb);
diff --git a/include/linux/ipv6.h b/include/linux/ipv6.h
index bcba48a97868..faed1e357dd6 100644
--- a/include/linux/ipv6.h
+++ b/include/linux/ipv6.h
@@ -47,6 +47,7 @@ struct ipv6_devconf {
         __s32           disable_ipv6;
         __s32           accept_dad;
         __s32           force_tllao;
+        __s32           ndisc_notify;
         void            *sysctl;
 };
 
@@ -66,6 +67,11 @@ static inline struct ipv6hdr *ipv6_hdr(const struct sk_buff *skb)
         return (struct ipv6hdr *)skb_network_header(skb);
 }
 
+static inline struct ipv6hdr *inner_ipv6_hdr(const struct sk_buff *skb)
+{
+        return (struct ipv6hdr *)skb_inner_network_header(skb);
+}
+
 static inline struct ipv6hdr *ipipv6_hdr(const struct sk_buff *skb)
 {
         return (struct ipv6hdr *)skb_transport_header(skb);
@@ -363,20 +369,22 @@ static inline struct raw6_sock *raw6_sk(const struct sock *sk)
 #define inet_v6_ipv6only(__sk)          0
 #endif /* IS_ENABLED(CONFIG_IPV6) */
 
-#define INET6_MATCH(__sk, __net, __hash, __saddr, __daddr, __ports, __dif)\
-        (((__sk)->sk_hash == (__hash)) && sock_net((__sk)) == (__net)   && \
-         ((*((__portpair *)&(inet_sk(__sk)->inet_dport))) == (__ports)) && \
-         ((__sk)->sk_family             == AF_INET6)            && \
-         ipv6_addr_equal(&inet6_sk(__sk)->daddr, (__saddr))     && \
-         ipv6_addr_equal(&inet6_sk(__sk)->rcv_saddr, (__daddr)) && \
-         (!((__sk)->sk_bound_dev_if) || ((__sk)->sk_bound_dev_if == (__dif))))
-
-#define INET6_TW_MATCH(__sk, __net, __hash, __saddr, __daddr, __ports, __dif) \
-        (((__sk)->sk_hash == (__hash)) && sock_net((__sk)) == (__net)   && \
-         (*((__portpair *)&(inet_twsk(__sk)->tw_dport)) == (__ports))   && \
-         ((__sk)->sk_family            == PF_INET6)                     && \
-         (ipv6_addr_equal(&inet6_twsk(__sk)->tw_v6_daddr, (__saddr)))   && \
-         (ipv6_addr_equal(&inet6_twsk(__sk)->tw_v6_rcv_saddr, (__daddr))) && \
-         (!((__sk)->sk_bound_dev_if) || ((__sk)->sk_bound_dev_if == (__dif))))
+#define INET6_MATCH(__sk, __net, __saddr, __daddr, __ports, __dif)      \
+        ((inet_sk(__sk)->inet_portpair == (__ports))            &&      \
+         ((__sk)->sk_family == AF_INET6)                        &&      \
+         ipv6_addr_equal(&inet6_sk(__sk)->daddr, (__saddr))     &&      \
+         ipv6_addr_equal(&inet6_sk(__sk)->rcv_saddr, (__daddr)) &&      \
+         (!(__sk)->sk_bound_dev_if      ||                              \
+           ((__sk)->sk_bound_dev_if == (__dif)))                &&      \
+         net_eq(sock_net(__sk), (__net)))
+
+#define INET6_TW_MATCH(__sk, __net, __saddr, __daddr, __ports, __dif)      \
+        ((inet_twsk(__sk)->tw_portpair == (__ports))                    && \
+         ((__sk)->sk_family == AF_INET6)                                && \
+         ipv6_addr_equal(&inet6_twsk(__sk)->tw_v6_daddr, (__saddr))     && \
+         ipv6_addr_equal(&inet6_twsk(__sk)->tw_v6_rcv_saddr, (__daddr)) && \
+         (!(__sk)->sk_bound_dev_if      ||                                 \
+          ((__sk)->sk_bound_dev_if == (__dif)))                         && \
+         net_eq(sock_net(__sk), (__net)))
 
 #endif /* _IPV6_H */
diff --git a/include/linux/ktime.h b/include/linux/ktime.h
index 06177ba10a16..e83512f63df5 100644
--- a/include/linux/ktime.h
+++ b/include/linux/ktime.h
@@ -282,6 +282,25 @@ static inline int ktime_equal(const ktime_t cmp1, const ktime_t cmp2)
         return cmp1.tv64 == cmp2.tv64;
 }
 
+/**
+ * ktime_compare - Compares two ktime_t variables for less, greater or equal
+ * @cmp1:       comparable1
+ * @cmp2:       comparable2
+ *
+ * Returns ...
+ *   cmp1  < cmp2: return <0
+ *   cmp1 == cmp2: return 0
+ *   cmp1  > cmp2: return >0
+ */
+static inline int ktime_compare(const ktime_t cmp1, const ktime_t cmp2)
+{
+        if (cmp1.tv64 < cmp2.tv64)
+                return -1;
+        if (cmp1.tv64 > cmp2.tv64)
+                return 1;
+        return 0;
+}
+
 static inline s64 ktime_to_us(const ktime_t kt)
 {
         struct timeval tv = ktime_to_timeval(kt);
diff --git a/include/linux/micrel_phy.h b/include/linux/micrel_phy.h
index de201203bc7c..adfe8c058f29 100644
--- a/include/linux/micrel_phy.h
+++ b/include/linux/micrel_phy.h
@@ -15,6 +15,7 @@
 
 #define MICREL_PHY_ID_MASK      0x00fffff0
 
+#define PHY_ID_KSZ8873MLL       0x000e7237
 #define PHY_ID_KSZ9021          0x00221610
 #define PHY_ID_KS8737           0x00221720
 #define PHY_ID_KSZ8021          0x00221555
diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h
index a848ffc327f4..ef9336c9d464 100644
--- a/include/linux/netdevice.h
+++ b/include/linux/netdevice.h
@@ -887,6 +887,10 @@ struct netdev_fcoe_hbainfo {
  *                     struct net_device *dev, int idx)
  *      Used to add FDB entries to dump requests. Implementers should add
  *      entries to skb and update idx with the number of entries.
+ *
+ * int (*ndo_bridge_setlink)(struct net_device *dev, struct nlmsghdr *nlh)
+ * int (*ndo_bridge_getlink)(struct sk_buff *skb, u32 pid, u32 seq,
+ *                           struct net_device *dev)
  */
 struct net_device_ops {
         int                     (*ndo_init)(struct net_device *dev);
@@ -998,6 +1002,12 @@ struct net_device_ops {
                                                 struct netlink_callback *cb,
                                                 struct net_device *dev,
                                                 int idx);
+
+        int                     (*ndo_bridge_setlink)(struct net_device *dev,
+                                                      struct nlmsghdr *nlh);
+        int                     (*ndo_bridge_getlink)(struct sk_buff *skb,
+                                                      u32 pid, u32 seq,
+                                                      struct net_device *dev);
 };
 
 /*
@@ -1053,6 +1063,12 @@ struct net_device {
         netdev_features_t       wanted_features;
         /* mask of features inheritable by VLAN devices */
         netdev_features_t       vlan_features;
+        /* mask of features inherited by encapsulating devices
+         * This field indicates what encapsulation offloads
+         * the hardware is capable of doing, and drivers will
+         * need to set them appropriately.
+         */
+        netdev_features_t       hw_enc_features;
 
         /* Interface index. Unique device identifier    */
         int                     ifindex;
@@ -1502,16 +1518,25 @@ struct packet_type {
                                          struct net_device *,
                                          struct packet_type *,
                                          struct net_device *);
+        bool                    (*id_match)(struct packet_type *ptype,
+                                            struct sock *sk);
+        void                    *af_packet_priv;
+        struct list_head        list;
+};
+
+struct offload_callbacks {
         struct sk_buff          *(*gso_segment)(struct sk_buff *skb,
                                                 netdev_features_t features);
         int                     (*gso_send_check)(struct sk_buff *skb);
         struct sk_buff          **(*gro_receive)(struct sk_buff **head,
                                                struct sk_buff *skb);
         int                     (*gro_complete)(struct sk_buff *skb);
-        bool                    (*id_match)(struct packet_type *ptype,
-                                            struct sock *sk);
-        void                    *af_packet_priv;
-        struct list_head        list;
+};
+
+struct packet_offload {
+        __be16                   type;  /* This is really htons(ether_type). */
+        struct offload_callbacks callbacks;
+        struct list_head         list;
 };
 
 #include <linux/notifier.h>
@@ -1551,6 +1576,8 @@ extern int call_netdevice_notifiers(unsigned long val, struct net_device *dev);
 
 extern rwlock_t                         dev_base_lock;          /* Device list lock */
 
+extern seqlock_t        devnet_rename_seq;      /* Device rename lock */
+
 
 #define for_each_netdev(net, d)         \
                 list_for_each_entry(d, &(net)->dev_base_head, dev_list)
@@ -1608,6 +1635,9 @@ extern struct net_device *__dev_getfirstbyhwtype(struct net *net, unsigned short
 extern void             dev_add_pack(struct packet_type *pt);
 extern void             dev_remove_pack(struct packet_type *pt);
 extern void             __dev_remove_pack(struct packet_type *pt);
+extern void             dev_add_offload(struct packet_offload *po);
+extern void             dev_remove_offload(struct packet_offload *po);
+extern void             __dev_remove_offload(struct packet_offload *po);
 
 extern struct net_device        *dev_get_by_flags_rcu(struct net *net, unsigned short flags,
                                                       unsigned short mask);
@@ -2132,16 +2162,10 @@ extern void dev_kfree_skb_any(struct sk_buff *skb);
 extern int              netif_rx(struct sk_buff *skb);
 extern int              netif_rx_ni(struct sk_buff *skb);
 extern int              netif_receive_skb(struct sk_buff *skb);
-extern gro_result_t     dev_gro_receive(struct napi_struct *napi,
-                                        struct sk_buff *skb);
-extern gro_result_t     napi_skb_finish(gro_result_t ret, struct sk_buff *skb);
 extern gro_result_t     napi_gro_receive(struct napi_struct *napi,
                                          struct sk_buff *skb);
 extern void             napi_gro_flush(struct napi_struct *napi, bool flush_old);
 extern struct sk_buff * napi_get_frags(struct napi_struct *napi);
-extern gro_result_t     napi_frags_finish(struct napi_struct *napi,
-                                          struct sk_buff *skb,
-                                          gro_result_t ret);
 extern gro_result_t     napi_gro_frags(struct napi_struct *napi);
 
 static inline void napi_free_frags(struct napi_struct *napi)
diff --git a/include/linux/netfilter_ipv6/ip6_tables.h b/include/linux/netfilter_ipv6/ip6_tables.h
index 5f84c6229dc6..610208b18c05 100644
--- a/include/linux/netfilter_ipv6/ip6_tables.h
+++ b/include/linux/netfilter_ipv6/ip6_tables.h
@@ -47,15 +47,6 @@ ip6t_ext_hdr(u8 nexthdr)
                (nexthdr == IPPROTO_DSTOPTS);
 }
 
-enum {
-        IP6T_FH_F_FRAG  = (1 << 0),
-        IP6T_FH_F_AUTH  = (1 << 1),
-};
-
-/* find specified header and get offset to it */
-extern int ipv6_find_hdr(const struct sk_buff *skb, unsigned int *offset,
-                         int target, unsigned short *fragoff, int *fragflg);
-
 #ifdef CONFIG_COMPAT
 #include <net/compat.h>
 
diff --git a/include/linux/nfc/pn544.h b/include/linux/nfc/pn544.h
deleted file mode 100644
index 9890bbaf4328..000000000000
--- a/include/linux/nfc/pn544.h
+++ /dev/null
@@ -1,104 +0,0 @@
-/*
- * Driver include for the PN544 NFC chip.
- *
- * Copyright (C) Nokia Corporation
- *
- * Author: Jari Vanhala <ext-jari.vanhala@nokia.com>
- * Contact: Matti Aaltoenn <matti.j.aaltonen@nokia.com>
- *
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of the GNU General Public License
- * version 2 as published by the Free Software Foundation.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
- */
-
-#ifndef _PN544_H_
-#define _PN544_H_
-
-#include <linux/i2c.h>
-
-#define PN544_DRIVER_NAME       "pn544"
-#define PN544_MAXWINDOW_SIZE    7
-#define PN544_WINDOW_SIZE       4
-#define PN544_RETRIES           10
-#define PN544_MAX_I2C_TRANSFER  0x0400
-#define PN544_MSG_MAX_SIZE      0x21 /* at normal HCI mode */
-
-/* ioctl */
-#define PN544_CHAR_BASE         'P'
-#define PN544_IOR(num, dtype)   _IOR(PN544_CHAR_BASE, num, dtype)
-#define PN544_IOW(num, dtype)   _IOW(PN544_CHAR_BASE, num, dtype)
-#define PN544_GET_FW_MODE       PN544_IOW(1, unsigned int)
-#define PN544_SET_FW_MODE       PN544_IOW(2, unsigned int)
-#define PN544_GET_DEBUG         PN544_IOW(3, unsigned int)
-#define PN544_SET_DEBUG         PN544_IOW(4, unsigned int)
-
-/* Timing restrictions (ms) */
-#define PN544_RESETVEN_TIME     30 /* 7 */
-#define PN544_PVDDVEN_TIME      0
-#define PN544_VBATVEN_TIME      0
-#define PN544_GPIO4VEN_TIME     0
-#define PN544_WAKEUP_ACK        5
-#define PN544_WAKEUP_GUARD      (PN544_WAKEUP_ACK + 1)
-#define PN544_INACTIVITY_TIME   1000
-#define PN544_INTERFRAME_DELAY  200 /* us */
-#define PN544_BAUDRATE_CHANGE   150 /* us */
-
-/* Debug bits */
-#define PN544_DEBUG_BUF         0x01
-#define PN544_DEBUG_READ        0x02
-#define PN544_DEBUG_WRITE       0x04
-#define PN544_DEBUG_IRQ         0x08
-#define PN544_DEBUG_CALLS       0x10
-#define PN544_DEBUG_MODE        0x20
-
-/* Normal (HCI) mode */
-#define PN544_LLC_HCI_OVERHEAD  3 /* header + crc (to length) */
-#define PN544_LLC_MIN_SIZE      (1 + PN544_LLC_HCI_OVERHEAD) /* length + */
-#define PN544_LLC_MAX_DATA      (PN544_MSG_MAX_SIZE - 2)
-#define PN544_LLC_MAX_HCI_SIZE  (PN544_LLC_MAX_DATA - 2)
-
-struct pn544_llc_packet {
-        unsigned char length; /* of rest of packet */
-        unsigned char header;
-        unsigned char data[PN544_LLC_MAX_DATA]; /* includes crc-ccitt */
-};
-
-/* Firmware upgrade mode */
-#define PN544_FW_HEADER_SIZE    3
-/* max fw transfer is 1024bytes, but I2C limits it to 0xC0 */
-#define PN544_MAX_FW_DATA       (PN544_MAX_I2C_TRANSFER - PN544_FW_HEADER_SIZE)
-
-struct pn544_fw_packet {
-        unsigned char command; /* status in answer */
-        unsigned char length[2]; /* big-endian order (msf) */
-        unsigned char data[PN544_MAX_FW_DATA];
-};
-
-#ifdef __KERNEL__
-enum {
-        NFC_GPIO_ENABLE,
-        NFC_GPIO_FW_RESET,
-        NFC_GPIO_IRQ
-};
-
-/* board config */
-struct pn544_nfc_platform_data {
-        int (*request_resources) (struct i2c_client *client);
-        void (*free_resources) (void);
-        void (*enable) (int fw);
-        int (*test) (void);
-        void (*disable) (void);
-        int (*get_gpio)(int type);
-};
-#endif /* __KERNEL__ */
-
-#endif /* _PN544_H_ */
diff --git a/include/linux/openvswitch.h b/include/linux/openvswitch.h
index eb1efa54fe84..d42e174bd0c8 100644
--- a/include/linux/openvswitch.h
+++ b/include/linux/openvswitch.h
@@ -243,6 +243,7 @@ enum ovs_key_attr {
         OVS_KEY_ATTR_ICMPV6,    /* struct ovs_key_icmpv6 */
         OVS_KEY_ATTR_ARP,       /* struct ovs_key_arp */
         OVS_KEY_ATTR_ND,        /* struct ovs_key_nd */
+        OVS_KEY_ATTR_SKB_MARK,  /* u32 skb mark */
         __OVS_KEY_ATTR_MAX
 };
 
diff --git a/include/linux/pci.h b/include/linux/pci.h
index d03d2463efac..af8229244ee2 100644
--- a/include/linux/pci.h
+++ b/include/linux/pci.h
@@ -604,6 +604,20 @@ struct pci_driver {
         .subvendor = PCI_ANY_ID, .subdevice = PCI_ANY_ID
 
 /**
+ * PCI_DEVICE_SUB - macro used to describe a specific pci device with subsystem
+ * @vend: the 16 bit PCI Vendor ID
+ * @dev: the 16 bit PCI Device ID
+ * @subvend: the 16 bit PCI Subvendor ID
+ * @subdev: the 16 bit PCI Subdevice ID
+ *
+ * This macro is used to create a struct pci_device_id that matches a
+ * specific device with subsystem information.
+ */
+#define PCI_DEVICE_SUB(vend, dev, subvend, subdev) \
+        .vendor = (vend), .device = (dev), \
+        .subvendor = (subvend), .subdevice = (subdev)
+
+/**
  * PCI_DEVICE_CLASS - macro used to describe a specific pci device class
  * @dev_class: the class, subclass, prog-if triple for this device
  * @dev_class_mask: the class mask for this device
diff --git a/include/linux/platform_data/cpsw.h b/include/linux/platform_data/cpsw.h
index c4e23d029498..24368a2e8b87 100644
--- a/include/linux/platform_data/cpsw.h
+++ b/include/linux/platform_data/cpsw.h
@@ -18,9 +18,7 @@
 #include <linux/if_ether.h>
 
 struct cpsw_slave_data {
-        u32             slave_reg_ofs;
-        u32             sliver_reg_ofs;
-        const char      *phy_id;
+        char            phy_id[MII_BUS_ID_SIZE];
         int             phy_if;
         u8              mac_addr[ETH_ALEN];
 };
@@ -28,27 +26,14 @@ struct cpsw_slave_data {
 struct cpsw_platform_data {
         u32     ss_reg_ofs;     /* Subsystem control register offset */
         u32     channels;       /* number of cpdma channels (symmetric) */
-        u32     cpdma_reg_ofs;  /* cpdma register offset */
-        u32     cpdma_sram_ofs; /* cpdma sram offset */
-
         u32     slaves;         /* number of slave cpgmac ports */
         struct cpsw_slave_data  *slave_data;
-
-        u32     ale_reg_ofs;    /* address lookup engine reg offset */
+        u32     cpts_active_slave; /* time stamping slave */
+        u32     cpts_clock_mult;  /* convert input clock ticks to nanoseconds */
+        u32     cpts_clock_shift; /* convert input clock ticks to nanoseconds */
         u32     ale_entries;    /* ale table size */
-
-        u32     host_port_reg_ofs; /* cpsw cpdma host port registers */
-        u32     host_port_num; /* The port number for the host port */
-
-        u32     hw_stats_reg_ofs;  /* cpsw hardware statistics counters */
-
-        u32     bd_ram_ofs;   /* embedded buffer descriptor RAM offset*/
         u32     bd_ram_size;  /*buffer descriptor ram size */
-        u32     hw_ram_addr; /*if the HW address for BD RAM is different */
-        bool    no_bd_ram; /* no embedded BD ram*/
-
         u32     rx_descs;       /* Number of Rx Descriptios */
-
         u32     mac_control;    /* Mac control register */
 };
 
diff --git a/include/linux/platform_data/macb.h b/include/linux/platform_data/macb.h
index b081c7245ec8..044a124bfbbc 100644
--- a/include/linux/platform_data/macb.h
+++ b/include/linux/platform_data/macb.h
@@ -12,6 +12,7 @@ struct macb_platform_data {
         u32             phy_mask;
         int             phy_irq_pin;    /* PHY IRQ */
         u8              is_rmii;        /* using RMII interface? */
+        u8              rev_eth_addr;   /* reverse Ethernet address byte order */
 };
 
 #endif /* __MACB_PDATA_H__ */
diff --git a/include/linux/platform_data/pn544.h b/include/linux/platform_data/pn544.h
new file mode 100644
index 000000000000..713bfd703342
--- /dev/null
+++ b/include/linux/platform_data/pn544.h
@@ -0,0 +1,44 @@
+/*
+ * Driver include for the PN544 NFC chip.
+ *
+ * Copyright (C) Nokia Corporation
+ *
+ * Author: Jari Vanhala <ext-jari.vanhala@nokia.com>
+ * Contact: Matti Aaltoenn <matti.j.aaltonen@nokia.com>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
+ */
+
+#ifndef _PN544_H_
+#define _PN544_H_
+
+#include <linux/i2c.h>
+
+enum {
+        NFC_GPIO_ENABLE,
+        NFC_GPIO_FW_RESET,
+        NFC_GPIO_IRQ
+};
+
+/* board config */
+struct pn544_nfc_platform_data {
+        int (*request_resources) (struct i2c_client *client);
+        void (*free_resources) (void);
+        void (*enable) (int fw);
+        int (*test) (void);
+        void (*disable) (void);
+        int (*get_gpio)(int type);
+};
+
+#endif /* _PN544_H_ */
diff --git a/include/linux/rtnetlink.h b/include/linux/rtnetlink.h
index 7002bbfd5d4a..489dd7bb28ec 100644
--- a/include/linux/rtnetlink.h
+++ b/include/linux/rtnetlink.h
@@ -69,4 +69,7 @@ extern int ndo_dflt_fdb_dump(struct sk_buff *skb,
                              struct netlink_callback *cb,
                              struct net_device *dev,
                              int idx);
+
+extern int ndo_dflt_bridge_getlink(struct sk_buff *skb, u32 pid, u32 seq,
+                                   struct net_device *dev, u16 mode);
 #endif  /* __LINUX_RTNETLINK_H */
diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h
index 6a2c34e6d962..320e976d5ab8 100644
--- a/include/linux/skbuff.h
+++ b/include/linux/skbuff.h
@@ -235,11 +235,13 @@ enum {
 /*
  * The callback notifies userspace to release buffers when skb DMA is done in
  * lower device, the skb last reference should be 0 when calling this.
+ * The zerocopy_success argument is true if zero copy transmit occurred,
+ * false on data copy or out of memory error caused by data copy attempt.
  * The ctx field is used to track device context.
  * The desc field is used to track userspace buffer index.
  */
 struct ubuf_info {
-        void (*callback)(struct ubuf_info *);
+        void (*callback)(struct ubuf_info *, bool zerocopy_success);
         void *ctx;
         unsigned long desc;
 };
@@ -374,6 +376,8 @@ typedef unsigned char *sk_buff_data_t;
  *      @mark: Generic packet mark
  *      @dropcount: total number of sk_receive_queue overflows
  *      @vlan_tci: vlan tag control information
+ *      @inner_transport_header: Inner transport layer header (encapsulation)
+ *      @inner_network_header: Network layer header (encapsulation)
  *      @transport_header: Transport layer header
  *      @network_header: Network layer header
  *      @mac_header: Link layer header
@@ -469,7 +473,13 @@ struct sk_buff {
         __u8                    wifi_acked:1;
         __u8                    no_fcs:1;
         __u8                    head_frag:1;
-        /* 8/10 bit hole (depending on ndisc_nodetype presence) */
+        /* Encapsulation protocol and NIC drivers should use
+         * this flag to indicate to each other if the skb contains
+         * encapsulated packet or not and maybe use the inner packet
+         * headers if needed
+         */
+        __u8                    encapsulation:1;
+        /* 7/9 bit hole (depending on ndisc_nodetype presence) */
         kmemcheck_bitfield_end(flags2);
 
 #ifdef CONFIG_NET_DMA
@@ -484,6 +494,8 @@ struct sk_buff {
                 __u32           avail_size;
         };
 
+        sk_buff_data_t          inner_transport_header;
+        sk_buff_data_t          inner_network_header;
         sk_buff_data_t          transport_header;
         sk_buff_data_t          network_header;
         sk_buff_data_t          mac_header;
@@ -566,6 +578,7 @@ static inline struct rtable *skb_rtable(const struct sk_buff *skb)
 }
 
 extern void kfree_skb(struct sk_buff *skb);
+extern void skb_tx_error(struct sk_buff *skb);
 extern void consume_skb(struct sk_buff *skb);
 extern void            __kfree_skb(struct sk_buff *skb);
 extern struct kmem_cache *skbuff_head_cache;
@@ -643,7 +656,7 @@ extern unsigned int   skb_find_text(struct sk_buff *skb, unsigned int from,
 extern void __skb_get_rxhash(struct sk_buff *skb);
 static inline __u32 skb_get_rxhash(struct sk_buff *skb)
 {
-        if (!skb->rxhash)
+        if (!skb->l4_rxhash)
                 __skb_get_rxhash(skb);
 
         return skb->rxhash;
@@ -1432,12 +1445,53 @@ static inline void skb_reserve(struct sk_buff *skb, int len)
         skb->tail += len;
 }
 
+static inline void skb_reset_inner_headers(struct sk_buff *skb)
+{
+        skb->inner_network_header = skb->network_header;
+        skb->inner_transport_header = skb->transport_header;
+}
+
 static inline void skb_reset_mac_len(struct sk_buff *skb)
 {
         skb->mac_len = skb->network_header - skb->mac_header;
 }
 
 #ifdef NET_SKBUFF_DATA_USES_OFFSET
+static inline unsigned char *skb_inner_transport_header(const struct sk_buff
+                                                        *skb)
+{
+        return skb->head + skb->inner_transport_header;
+}
+
+static inline void skb_reset_inner_transport_header(struct sk_buff *skb)
+{
+        skb->inner_transport_header = skb->data - skb->head;
+}
+
+static inline void skb_set_inner_transport_header(struct sk_buff *skb,
+                                                   const int offset)
+{
+        skb_reset_inner_transport_header(skb);
+        skb->inner_transport_header += offset;
+}
+
+static inline unsigned char *skb_inner_network_header(const struct sk_buff *skb)
+{
+        return skb->head + skb->inner_network_header;
+}
+
+static inline void skb_reset_inner_network_header(struct sk_buff *skb)
+{
+        skb->inner_network_header = skb->data - skb->head;
+}
+
+static inline void skb_set_inner_network_header(struct sk_buff *skb,
+                                                const int offset)
+{
+        skb_reset_inner_network_header(skb);
+        skb->inner_network_header += offset;
+}
+
 static inline unsigned char *skb_transport_header(const struct sk_buff *skb)
 {
         return skb->head + skb->transport_header;
@@ -1493,6 +1547,38 @@ static inline void skb_set_mac_header(struct sk_buff *skb, const int offset)
 }
 
 #else /* NET_SKBUFF_DATA_USES_OFFSET */
+static inline unsigned char *skb_inner_transport_header(const struct sk_buff
+                                                        *skb)
+{
+        return skb->inner_transport_header;
+}
+
+static inline void skb_reset_inner_transport_header(struct sk_buff *skb)
+{
+        skb->inner_transport_header = skb->data;
+}
+
+static inline void skb_set_inner_transport_header(struct sk_buff *skb,
+                                                   const int offset)
+{
+        skb->inner_transport_header = skb->data + offset;
+}
+
+static inline unsigned char *skb_inner_network_header(const struct sk_buff *skb)
+{
+        return skb->inner_network_header;
+}
+
+static inline void skb_reset_inner_network_header(struct sk_buff *skb)
+{
+        skb->inner_network_header = skb->data;
+}
+
+static inline void skb_set_inner_network_header(struct sk_buff *skb,
+                                                const int offset)
+{
+        skb->inner_network_header = skb->data + offset;
+}
 
 static inline unsigned char *skb_transport_header(const struct sk_buff *skb)
 {
@@ -1571,11 +1657,21 @@ static inline u32 skb_network_header_len(const struct sk_buff *skb)
         return skb->transport_header - skb->network_header;
 }
 
+static inline u32 skb_inner_network_header_len(const struct sk_buff *skb)
+{
+        return skb->inner_transport_header - skb->inner_network_header;
+}
+
 static inline int skb_network_offset(const struct sk_buff *skb)
 {
         return skb_network_header(skb) - skb->data;
 }
 
+static inline int skb_inner_network_offset(const struct sk_buff *skb)
+{
+        return skb_inner_network_header(skb) - skb->data;
+}
+
 static inline int pskb_network_may_pull(struct sk_buff *skb, unsigned int len)
 {
         return pskb_may_pull(skb, skb_network_offset(skb) + len);
diff --git a/include/linux/smscphy.h b/include/linux/smscphy.h
index ce718cbce435..f4bf16e16e16 100644
--- a/include/linux/smscphy.h
+++ b/include/linux/smscphy.h
@@ -4,6 +4,7 @@
 #define MII_LAN83C185_ISF 29 /* Interrupt Source Flags */
 #define MII_LAN83C185_IM  30 /* Interrupt Mask */
 #define MII_LAN83C185_CTRL_STATUS 17 /* Mode/Status Register */
+#define MII_LAN83C185_SPECIAL_MODES 18 /* Special Modes Register */
 
 #define MII_LAN83C185_ISF_INT1 (1<<1) /* Auto-Negotiation Page Received */
 #define MII_LAN83C185_ISF_INT2 (1<<2) /* Parallel Detection Fault */
@@ -22,4 +23,8 @@
 #define MII_LAN83C185_EDPWRDOWN (1 << 13) /* EDPWRDOWN */
 #define MII_LAN83C185_ENERGYON  (1 << 1)  /* ENERGYON */
 
+#define MII_LAN83C185_MODE_MASK      0xE0
+#define MII_LAN83C185_MODE_POWERDOWN 0xC0 /* Power Down mode */
+#define MII_LAN83C185_MODE_ALL       0xE0 /* All capable mode */
+
 #endif /* __LINUX_SMSCPHY_H__ */
diff --git a/include/linux/ssb/ssb.h b/include/linux/ssb/ssb.h
index bb674c02f306..1f64e3f1f22b 100644
--- a/include/linux/ssb/ssb.h
+++ b/include/linux/ssb/ssb.h
@@ -8,6 +8,7 @@
 #include <linux/pci.h>
 #include <linux/mod_devicetable.h>
 #include <linux/dma-mapping.h>
+#include <linux/platform_device.h>
 
 #include <linux/ssb/ssb_regs.h>
 
@@ -432,6 +433,7 @@ struct ssb_bus {
 #ifdef CONFIG_SSB_EMBEDDED
         /* Lock for GPIO register access. */
         spinlock_t gpio_lock;
+        struct platform_device *watchdog;
 #endif /* EMBEDDED */
 
         /* Internal-only stuff follows. Do not touch. */
diff --git a/include/linux/ssb/ssb_driver_chipcommon.h b/include/linux/ssb/ssb_driver_chipcommon.h
index c2b02a5c86ae..38339fd68a5f 100644
--- a/include/linux/ssb/ssb_driver_chipcommon.h
+++ b/include/linux/ssb/ssb_driver_chipcommon.h
@@ -591,6 +591,8 @@ struct ssb_chipcommon {
         /* Fast Powerup Delay constant */
         u16 fast_pwrup_delay;
         struct ssb_chipcommon_pmu pmu;
+        u32 ticks_per_ms;
+        u32 max_timer_ms;
 };
 
 static inline bool ssb_chipco_available(struct ssb_chipcommon *cc)
@@ -630,8 +632,7 @@ enum ssb_clkmode {
 extern void ssb_chipco_set_clockmode(struct ssb_chipcommon *cc,
                                      enum ssb_clkmode mode);
 
-extern void ssb_chipco_watchdog_timer_set(struct ssb_chipcommon *cc,
-                                          u32 ticks);
+extern u32 ssb_chipco_watchdog_timer_set(struct ssb_chipcommon *cc, u32 ticks);
 
 void ssb_chipco_irq_mask(struct ssb_chipcommon *cc, u32 mask, u32 value);
 
diff --git a/include/linux/ssb/ssb_driver_extif.h b/include/linux/ssb/ssb_driver_extif.h
index 91161f0aa22b..99511d0e931d 100644
--- a/include/linux/ssb/ssb_driver_extif.h
+++ b/include/linux/ssb/ssb_driver_extif.h
@@ -152,6 +152,9 @@
 /* watchdog */
 #define SSB_EXTIF_WATCHDOG_CLK          48000000        /* Hz */
 
+#define SSB_EXTIF_WATCHDOG_MAX_TIMER    ((1 << 28) - 1)
+#define SSB_EXTIF_WATCHDOG_MAX_TIMER_MS (SSB_EXTIF_WATCHDOG_MAX_TIMER \
+                                         / (SSB_EXTIF_WATCHDOG_CLK / 1000))
 
 
 #ifdef CONFIG_SSB_DRIVER_EXTIF
@@ -171,8 +174,7 @@ extern void ssb_extif_get_clockcontrol(struct ssb_extif *extif,
 extern void ssb_extif_timing_init(struct ssb_extif *extif,
                                   unsigned long ns);
 
-extern void ssb_extif_watchdog_timer_set(struct ssb_extif *extif,
-                                         u32 ticks);
+extern u32 ssb_extif_watchdog_timer_set(struct ssb_extif *extif, u32 ticks);
 
 /* Extif GPIO pin access */
 u32 ssb_extif_gpio_in(struct ssb_extif *extif, u32 mask);
@@ -205,10 +207,52 @@ void ssb_extif_get_clockcontrol(struct ssb_extif *extif,
 }
 
 static inline
-void ssb_extif_watchdog_timer_set(struct ssb_extif *extif,
-                                  u32 ticks)
+void ssb_extif_timing_init(struct ssb_extif *extif, unsigned long ns)
 {
 }
 
+static inline
+u32 ssb_extif_watchdog_timer_set(struct ssb_extif *extif, u32 ticks)
+{
+        return 0;
+}
+
+static inline u32 ssb_extif_gpio_in(struct ssb_extif *extif, u32 mask)
+{
+        return 0;
+}
+
+static inline u32 ssb_extif_gpio_out(struct ssb_extif *extif, u32 mask,
+                                     u32 value)
+{
+        return 0;
+}
+
+static inline u32 ssb_extif_gpio_outen(struct ssb_extif *extif, u32 mask,
+                                       u32 value)
+{
+        return 0;
+}
+
+static inline u32 ssb_extif_gpio_polarity(struct ssb_extif *extif, u32 mask,
+                                          u32 value)
+{
+        return 0;
+}
+
+static inline u32 ssb_extif_gpio_intmask(struct ssb_extif *extif, u32 mask,
+                                         u32 value)
+{
+        return 0;
+}
+
+#ifdef CONFIG_SSB_SERIAL
+static inline int ssb_extif_serial_init(struct ssb_extif *extif,
+                                        struct ssb_serial_port *ports)
+{
+        return 0;
+}
+#endif /* CONFIG_SSB_SERIAL */
+
 #endif /* CONFIG_SSB_DRIVER_EXTIF */
 #endif /* LINUX_SSB_EXTIFCORE_H_ */
diff --git a/include/linux/ssb/ssb_driver_mips.h b/include/linux/ssb/ssb_driver_mips.h
index 5f44e9740cd2..07a9c7a2e088 100644
--- a/include/linux/ssb/ssb_driver_mips.h
+++ b/include/linux/ssb/ssb_driver_mips.h
@@ -13,6 +13,12 @@ struct ssb_serial_port {
         unsigned int reg_shift;
 };
 
+struct ssb_pflash {
+        bool present;
+        u8 buswidth;
+        u32 window;
+        u32 window_size;
+};
 
 struct ssb_mipscore {
         struct ssb_device *dev;
@@ -20,9 +26,7 @@ struct ssb_mipscore {
         int nr_serial_ports;
         struct ssb_serial_port serial_ports[4];
 
-        u8 flash_buswidth;
-        u32 flash_window;
-        u32 flash_window_size;
+        struct ssb_pflash pflash;
 };
 
 extern void ssb_mipscore_init(struct ssb_mipscore *mcore);
diff --git a/include/linux/ssb/ssb_regs.h b/include/linux/ssb/ssb_regs.h
index a0525019e1d1..6ecfa02ddbac 100644
--- a/include/linux/ssb/ssb_regs.h
+++ b/include/linux/ssb/ssb_regs.h
@@ -485,7 +485,7 @@
 #define  SSB_SPROM8_HWIQ_IQSWP_IQCAL_SWP_SHIFT  4
 #define  SSB_SPROM8_HWIQ_IQSWP_HW_IQCAL 0x0020
 #define  SSB_SPROM8_HWIQ_IQSWP_HW_IQCAL_SHIFT   5
-#define SSB_SPROM8_TEMPDELTA            0x00BA
+#define SSB_SPROM8_TEMPDELTA            0x00BC
 #define  SSB_SPROM8_TEMPDELTA_PHYCAL    0x00ff
 #define  SSB_SPROM8_TEMPDELTA_PHYCAL_SHIFT      0
 #define  SSB_SPROM8_TEMPDELTA_PERIOD    0x0f00
diff --git a/include/linux/stmmac.h b/include/linux/stmmac.h
index a1547ea3920d..de5b2f8176ce 100644
--- a/include/linux/stmmac.h
+++ b/include/linux/stmmac.h
@@ -104,6 +104,7 @@ struct plat_stmmacenet_data {
         int bugged_jumbo;
         int pmt;
         int force_sf_dma_mode;
+        int riwt_off;
         void (*fix_mac_speed)(void *priv, unsigned int speed);
         void (*bus_setup)(void __iomem *ioaddr);
         int (*init)(struct platform_device *pdev);
diff --git a/include/linux/sysctl.h b/include/linux/sysctl.h
index cd844a6a8d5f..14a8ff2de11e 100644
--- a/include/linux/sysctl.h
+++ b/include/linux/sysctl.h
@@ -158,8 +158,7 @@ struct ctl_table_root {
         struct ctl_table_set default_set;
         struct ctl_table_set *(*lookup)(struct ctl_table_root *root,
                                            struct nsproxy *namespaces);
-        int (*permissions)(struct ctl_table_root *root,
-                        struct nsproxy *namespaces, struct ctl_table *table);
+        int (*permissions)(struct ctl_table_header *head, struct ctl_table *table);
 };
 
 /* struct ctl_path describes where in the hierarchy a table is added */
diff --git a/include/linux/tcp.h b/include/linux/tcp.h
index 60b7aac15e0e..4e1d2283e3cc 100644
--- a/include/linux/tcp.h
+++ b/include/linux/tcp.h
@@ -35,6 +35,16 @@ static inline unsigned int tcp_hdrlen(const struct sk_buff *skb)
         return tcp_hdr(skb)->doff * 4;
 }
 
+static inline struct tcphdr *inner_tcp_hdr(const struct sk_buff *skb)
+{
+        return (struct tcphdr *)skb_inner_transport_header(skb);
+}
+
+static inline unsigned int inner_tcp_hdrlen(const struct sk_buff *skb)
+{
+        return inner_tcp_hdr(skb)->doff * 4;
+}
+
 static inline unsigned int tcp_optlen(const struct sk_buff *skb)
 {
         return (tcp_hdr(skb)->doff - 5) * 4;
diff --git a/include/linux/timecompare.h b/include/linux/timecompare.h
deleted file mode 100644
index 546e2234e4b3..000000000000
--- a/include/linux/timecompare.h
+++ /dev/null
@@ -1,125 +0,0 @@
-/*
- * Utility code which helps transforming between two different time
- * bases, called "source" and "target" time in this code.
- *
- * Source time has to be provided via the timecounter API while target
- * time is accessed via a function callback whose prototype
- * intentionally matches ktime_get() and ktime_get_real(). These
- * interfaces where chosen like this so that the code serves its
- * initial purpose without additional glue code.
- *
- * This purpose is synchronizing a hardware clock in a NIC with system
- * time, in order to implement the Precision Time Protocol (PTP,
- * IEEE1588) with more accurate hardware assisted time stamping.  In
- * that context only synchronization against system time (=
- * ktime_get_real()) is currently needed. But this utility code might
- * become useful in other situations, which is why it was written as
- * general purpose utility code.
- *
- * The source timecounter is assumed to return monotonically
- * increasing time (but this code does its best to compensate if that
- * is not the case) whereas target time may jump.
- *
- * The target time corresponding to a source time is determined by
- * reading target time, reading source time, reading target time
- * again, then assuming that average target time corresponds to source
- * time. In other words, the assumption is that reading the source
- * time is slow and involves equal time for sending the request and
- * receiving the reply, whereas reading target time is assumed to be
- * fast.
- *
- * Copyright (C) 2009 Intel Corporation.
- * Author: Patrick Ohly <patrick.ohly@intel.com>
- *
- * This program is free software; you can redistribute it and/or modify it
- * under the terms and conditions of the GNU General Public License,
- * version 2, as published by the Free Software Foundation.
- *
- * This program is distributed in the hope it will be useful, but WITHOUT
- * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
- * FITNESS FOR A PARTICULAR PURPOSE. * See the GNU General Public License for
- * more details.
- *
- * You should have received a copy of the GNU General Public License along with
- * this program; if not, write to the Free Software Foundation, Inc.,
- * 51 Franklin St - Fifth Floor, Boston, MA 02110-1301 USA.
- */
-#ifndef _LINUX_TIMECOMPARE_H
-#define _LINUX_TIMECOMPARE_H
-
-#include <linux/clocksource.h>
-#include <linux/ktime.h>
-
-/**
- * struct timecompare - stores state and configuration for the two clocks
- *
- * Initialize to zero, then set source/target/num_samples.
- *
- * Transformation between source time and target time is done with:
- * target_time = source_time + offset +
- *               (source_time - last_update) * skew /
- *               TIMECOMPARE_SKEW_RESOLUTION
- *
- * @source:          used to get source time stamps via timecounter_read()
- * @target:          function returning target time (for example, ktime_get
- *                   for monotonic time, or ktime_get_real for wall clock)
- * @num_samples:     number of times that source time and target time are to
- *                   be compared when determining their offset
- * @offset:          (target time - source time) at the time of the last update
- * @skew:            average (target time - source time) / delta source time *
- *                   TIMECOMPARE_SKEW_RESOLUTION
- * @last_update:     last source time stamp when time offset was measured
- */
-struct timecompare {
-        struct timecounter *source;
-        ktime_t (*target)(void);
-        int num_samples;
-
-        s64 offset;
-        s64 skew;
-        u64 last_update;
-};
-
-/**
- * timecompare_transform - transform source time stamp into target time base
- * @sync:            context for time sync
- * @source_tstamp:   the result of timecounter_read() or
- *                   timecounter_cyc2time()
- */
-extern ktime_t timecompare_transform(struct timecompare *sync,
-                                     u64 source_tstamp);
-
-/**
- * timecompare_offset - measure current (target time - source time) offset
- * @sync:            context for time sync
- * @offset:          average offset during sample period returned here
- * @source_tstamp:   average source time during sample period returned here
- *
- * Returns number of samples used. Might be zero (= no result) in the
- * unlikely case that target time was monotonically decreasing for all
- * samples (= broken).
- */
-extern int timecompare_offset(struct timecompare *sync,
-                              s64 *offset,
-                              u64 *source_tstamp);
-
-extern void __timecompare_update(struct timecompare *sync,
-                                 u64 source_tstamp);
-
-/**
- * timecompare_update - update offset and skew by measuring current offset
- * @sync:            context for time sync
- * @source_tstamp:   the result of timecounter_read() or
- *                   timecounter_cyc2time(), pass zero to force update
- *
- * Updates are only done at most once per second.
- */
-static inline void timecompare_update(struct timecompare *sync,
-                                      u64 source_tstamp)
-{
-        if (!source_tstamp ||
-            (s64)(source_tstamp - sync->last_update) >= NSEC_PER_SEC)
-                __timecompare_update(sync, source_tstamp);
-}
-
-#endif /* _LINUX_TIMECOMPARE_H */
diff --git a/include/linux/udp.h b/include/linux/udp.h
index 0b67d7793520..9d81de123c90 100644
--- a/include/linux/udp.h
+++ b/include/linux/udp.h
@@ -27,6 +27,11 @@ static inline struct udphdr *udp_hdr(const struct sk_buff *skb)
         return (struct udphdr *)skb_transport_header(skb);
 }
 
+static inline struct udphdr *inner_udp_hdr(const struct sk_buff *skb)
+{
+        return (struct udphdr *)skb_inner_transport_header(skb);
+}
+
 #define UDP_HTABLE_SIZE_MIN             (CONFIG_BASE_SMALL ? 128 : 256)
 
 static inline int udp_hashfn(struct net *net, unsigned num, unsigned mask)
diff --git a/include/linux/usb/cdc_ncm.h b/include/linux/usb/cdc_ncm.h
new file mode 100644
index 000000000000..3b8f9d4fc3fe
--- /dev/null
+++ b/include/linux/usb/cdc_ncm.h
@@ -0,0 +1,134 @@
+/*
+ * Copyright (C) ST-Ericsson 2010-2012
+ * Contact: Alexey Orishko <alexey.orishko@stericsson.com>
+ * Original author: Hans Petter Selasky <hans.petter.selasky@stericsson.com>
+ *
+ * USB Host Driver for Network Control Model (NCM)
+ * http://www.usb.org/developers/devclass_docs/NCM10.zip
+ *
+ * The NCM encoding, decoding and initialization logic
+ * derives from FreeBSD 8.x. if_cdce.c and if_cdcereg.h
+ *
+ * This software is available to you under a choice of one of two
+ * licenses. You may choose this file to be licensed under the terms
+ * of the GNU General Public License (GPL) Version 2 or the 2-clause
+ * BSD license listed below:
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+#define CDC_NCM_COMM_ALTSETTING_NCM             0
+#define CDC_NCM_COMM_ALTSETTING_MBIM            1
+
+#define CDC_NCM_DATA_ALTSETTING_NCM             1
+#define CDC_NCM_DATA_ALTSETTING_MBIM            2
+
+/* CDC NCM subclass 3.2.1 */
+#define USB_CDC_NCM_NDP16_LENGTH_MIN            0x10
+
+/* Maximum NTB length */
+#define CDC_NCM_NTB_MAX_SIZE_TX                 32768   /* bytes */
+#define CDC_NCM_NTB_MAX_SIZE_RX                 32768   /* bytes */
+
+/* Minimum value for MaxDatagramSize, ch. 6.2.9 */
+#define CDC_NCM_MIN_DATAGRAM_SIZE               1514    /* bytes */
+
+/* Minimum value for MaxDatagramSize, ch. 8.1.3 */
+#define CDC_MBIM_MIN_DATAGRAM_SIZE              2048    /* bytes */
+
+#define CDC_NCM_MIN_TX_PKT                      512     /* bytes */
+
+/* Default value for MaxDatagramSize */
+#define CDC_NCM_MAX_DATAGRAM_SIZE               8192    /* bytes */
+
+/*
+ * Maximum amount of datagrams in NCM Datagram Pointer Table, not counting
+ * the last NULL entry.
+ */
+#define CDC_NCM_DPT_DATAGRAMS_MAX               40
+
+/* Restart the timer, if amount of datagrams is less than given value */
+#define CDC_NCM_RESTART_TIMER_DATAGRAM_CNT      3
+#define CDC_NCM_TIMER_PENDING_CNT               2
+#define CDC_NCM_TIMER_INTERVAL                  (400UL * NSEC_PER_USEC)
+
+/* The following macro defines the minimum header space */
+#define CDC_NCM_MIN_HDR_SIZE \
+        (sizeof(struct usb_cdc_ncm_nth16) + sizeof(struct usb_cdc_ncm_ndp16) + \
+        (CDC_NCM_DPT_DATAGRAMS_MAX + 1) * sizeof(struct usb_cdc_ncm_dpe16))
+
+#define CDC_NCM_NDP_SIZE \
+        (sizeof(struct usb_cdc_ncm_ndp16) +                             \
+              (CDC_NCM_DPT_DATAGRAMS_MAX + 1) * sizeof(struct usb_cdc_ncm_dpe16))
+
+#define cdc_ncm_comm_intf_is_mbim(x)  ((x)->desc.bInterfaceSubClass == USB_CDC_SUBCLASS_MBIM && \
+                                       (x)->desc.bInterfaceProtocol == USB_CDC_PROTO_NONE)
+#define cdc_ncm_data_intf_is_mbim(x)  ((x)->desc.bInterfaceProtocol == USB_CDC_MBIM_PROTO_NTB)
+
+struct cdc_ncm_ctx {
+        struct usb_cdc_ncm_ntb_parameters ncm_parm;
+        struct hrtimer tx_timer;
+        struct tasklet_struct bh;
+
+        const struct usb_cdc_ncm_desc *func_desc;
+        const struct usb_cdc_mbim_desc   *mbim_desc;
+        const struct usb_cdc_header_desc *header_desc;
+        const struct usb_cdc_union_desc *union_desc;
+        const struct usb_cdc_ether_desc *ether_desc;
+
+        struct net_device *netdev;
+        struct usb_device *udev;
+        struct usb_host_endpoint *in_ep;
+        struct usb_host_endpoint *out_ep;
+        struct usb_host_endpoint *status_ep;
+        struct usb_interface *intf;
+        struct usb_interface *control;
+        struct usb_interface *data;
+
+        struct sk_buff *tx_curr_skb;
+        struct sk_buff *tx_rem_skb;
+        __le32 tx_rem_sign;
+
+        spinlock_t mtx;
+        atomic_t stop;
+
+        u32 tx_timer_pending;
+        u32 tx_curr_frame_num;
+        u32 rx_speed;
+        u32 tx_speed;
+        u32 rx_max;
+        u32 tx_max;
+        u32 max_datagram_size;
+        u16 tx_max_datagrams;
+        u16 tx_remainder;
+        u16 tx_modulus;
+        u16 tx_ndp_modulus;
+        u16 tx_seq;
+        u16 rx_seq;
+        u16 connected;
+};
+
+extern int cdc_ncm_bind_common(struct usbnet *dev, struct usb_interface *intf, u8 data_altsetting);
+extern void cdc_ncm_unbind(struct usbnet *dev, struct usb_interface *intf);
+extern struct sk_buff *cdc_ncm_fill_tx_frame(struct cdc_ncm_ctx *ctx, struct sk_buff *skb, __le32 sign);
+extern int cdc_ncm_rx_verify_nth16(struct cdc_ncm_ctx *ctx, struct sk_buff *skb_in);
+extern int cdc_ncm_rx_verify_ndp16(struct sk_buff *skb_in, int ndpoffset);
diff --git a/include/linux/usb/usbnet.h b/include/linux/usb/usbnet.h
index ddbbb7de894b..9bbeabf66c54 100644
--- a/include/linux/usb/usbnet.h
+++ b/include/linux/usb/usbnet.h
@@ -163,6 +163,16 @@ extern int usbnet_resume(struct usb_interface *);
 extern void usbnet_disconnect(struct usb_interface *);
 extern void usbnet_device_suggests_idle(struct usbnet *dev);
 
+extern int usbnet_read_cmd(struct usbnet *dev, u8 cmd, u8 reqtype,
+                    u16 value, u16 index, void *data, u16 size);
+extern int usbnet_write_cmd(struct usbnet *dev, u8 cmd, u8 reqtype,
+                    u16 value, u16 index, const void *data, u16 size);
+extern int usbnet_read_cmd_nopm(struct usbnet *dev, u8 cmd, u8 reqtype,
+                    u16 value, u16 index, void *data, u16 size);
+extern int usbnet_write_cmd_nopm(struct usbnet *dev, u8 cmd, u8 reqtype,
+                    u16 value, u16 index, const void *data, u16 size);
+extern int usbnet_write_cmd_async(struct usbnet *dev, u8 cmd, u8 reqtype,
+                    u16 value, u16 index, const void *data, u16 size);
 
 /* Drivers that reuse some of the standard USB CDC infrastructure
  * (notably, using multiple interfaces according to the CDC
diff --git a/include/net/addrconf.h b/include/net/addrconf.h
index 9e63e76b20e7..df4ef9453384 100644
--- a/include/net/addrconf.h
+++ b/include/net/addrconf.h
@@ -172,6 +172,9 @@ extern bool ipv6_chk_acast_addr(struct net *net, struct net_device *dev,
 extern int register_inet6addr_notifier(struct notifier_block *nb);
 extern int unregister_inet6addr_notifier(struct notifier_block *nb);
 
+extern void inet6_netconf_notify_devconf(struct net *net, int type, int ifindex,
+                                         struct ipv6_devconf *devconf);
+
 /**
  * __in6_dev_get - get inet6_dev pointer from netdevice
  * @dev: network device
diff --git a/include/net/af_unix.h b/include/net/af_unix.h
index b5f8988e4283..0a996a3517ed 100644
--- a/include/net/af_unix.h
+++ b/include/net/af_unix.h
@@ -53,7 +53,6 @@ struct unix_sock {
         struct path             path;
         struct mutex            readlock;
         struct sock             *peer;
-        struct sock             *other;
         struct list_head        link;
         atomic_long_t           inflight;
         spinlock_t              lock;
diff --git a/include/net/bluetooth/a2mp.h b/include/net/bluetooth/a2mp.h
index 6a76e0a0705e..42f21766c538 100644
--- a/include/net/bluetooth/a2mp.h
+++ b/include/net/bluetooth/a2mp.h
@@ -19,13 +19,25 @@
 
 #define A2MP_FEAT_EXT   0x8000
 
+enum amp_mgr_state {
+        READ_LOC_AMP_INFO,
+        READ_LOC_AMP_ASSOC,
+        READ_LOC_AMP_ASSOC_FINAL,
+};
+
 struct amp_mgr {
+        struct list_head        list;
         struct l2cap_conn       *l2cap_conn;
         struct l2cap_chan       *a2mp_chan;
+        struct l2cap_chan       *bredr_chan;
         struct kref             kref;
         __u8                    ident;
         __u8                    handle;
+        enum amp_mgr_state      state;
         unsigned long           flags;
+
+        struct list_head        amp_ctrls;
+        struct mutex            amp_ctrls_lock;
 };
 
 struct a2mp_cmd {
@@ -118,9 +130,19 @@ struct a2mp_physlink_rsp {
 #define A2MP_STATUS_PHYS_LINK_EXISTS            0x05
 #define A2MP_STATUS_SECURITY_VIOLATION          0x06
 
-void amp_mgr_get(struct amp_mgr *mgr);
+extern struct list_head amp_mgr_list;
+extern struct mutex amp_mgr_list_lock;
+
+struct amp_mgr *amp_mgr_get(struct amp_mgr *mgr);
 int amp_mgr_put(struct amp_mgr *mgr);
+u8 __next_ident(struct amp_mgr *mgr);
 struct l2cap_chan *a2mp_channel_create(struct l2cap_conn *conn,
                                        struct sk_buff *skb);
+struct amp_mgr *amp_mgr_lookup_by_state(u8 state);
+void a2mp_send(struct amp_mgr *mgr, u8 code, u8 ident, u16 len, void *data);
+void a2mp_discover_amp(struct l2cap_chan *chan);
+void a2mp_send_getinfo_rsp(struct hci_dev *hdev);
+void a2mp_send_getampassoc_rsp(struct hci_dev *hdev, u8 status);
+void a2mp_send_create_phy_link_req(struct hci_dev *hdev, u8 status);
 
 #endif /* __A2MP_H */
diff --git a/include/net/bluetooth/amp.h b/include/net/bluetooth/amp.h
new file mode 100644
index 000000000000..7ea3db77ba89
--- /dev/null
+++ b/include/net/bluetooth/amp.h
@@ -0,0 +1,54 @@
+/*
+   Copyright (c) 2011,2012 Intel Corp.
+
+   This program is free software; you can redistribute it and/or modify
+   it under the terms of the GNU General Public License version 2 and
+   only version 2 as published by the Free Software Foundation.
+
+   This program is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+   GNU General Public License for more details.
+*/
+
+#ifndef __AMP_H
+#define __AMP_H
+
+struct amp_ctrl {
+        struct list_head        list;
+        struct kref             kref;
+        __u8                    id;
+        __u16                   assoc_len_so_far;
+        __u16                   assoc_rem_len;
+        __u16                   assoc_len;
+        __u8                    *assoc;
+};
+
+int amp_ctrl_put(struct amp_ctrl *ctrl);
+void amp_ctrl_get(struct amp_ctrl *ctrl);
+struct amp_ctrl *amp_ctrl_add(struct amp_mgr *mgr, u8 id);
+struct amp_ctrl *amp_ctrl_lookup(struct amp_mgr *mgr, u8 id);
+void amp_ctrl_list_flush(struct amp_mgr *mgr);
+
+struct hci_conn *phylink_add(struct hci_dev *hdev, struct amp_mgr *mgr,
+                             u8 remote_id, bool out);
+
+int phylink_gen_key(struct hci_conn *hcon, u8 *data, u8 *len, u8 *type);
+
+void amp_read_loc_info(struct hci_dev *hdev, struct amp_mgr *mgr);
+void amp_read_loc_assoc_frag(struct hci_dev *hdev, u8 phy_handle);
+void amp_read_loc_assoc(struct hci_dev *hdev, struct amp_mgr *mgr);
+void amp_read_loc_assoc_final_data(struct hci_dev *hdev,
+                                   struct hci_conn *hcon);
+void amp_create_phylink(struct hci_dev *hdev, struct amp_mgr *mgr,
+                        struct hci_conn *hcon);
+void amp_accept_phylink(struct hci_dev *hdev, struct amp_mgr *mgr,
+                        struct hci_conn *hcon);
+void amp_write_remote_assoc(struct hci_dev *hdev, u8 handle);
+void amp_write_rem_assoc_continue(struct hci_dev *hdev, u8 handle);
+void amp_physical_cfm(struct hci_conn *bredr_hcon, struct hci_conn *hs_hcon);
+void amp_create_logical_link(struct l2cap_chan *chan);
+void amp_disconnect_logical_link(struct hci_chan *hchan);
+void amp_destroy_logical_link(struct hci_chan *hchan, u8 reason);
+
+#endif /* __AMP_H */
diff --git a/include/net/bluetooth/bluetooth.h b/include/net/bluetooth/bluetooth.h
index ede036977ae8..2554b3f5222a 100644
--- a/include/net/bluetooth/bluetooth.h
+++ b/include/net/bluetooth/bluetooth.h
@@ -180,7 +180,6 @@ static inline void bacpy(bdaddr_t *dst, bdaddr_t *src)
 }
 
 void baswap(bdaddr_t *dst, bdaddr_t *src);
-char *batostr(bdaddr_t *ba);
 
 /* Common socket structures and functions */
 
diff --git a/include/net/bluetooth/hci.h b/include/net/bluetooth/hci.h
index 76b2b6bdcf36..45eee08157bb 100644
--- a/include/net/bluetooth/hci.h
+++ b/include/net/bluetooth/hci.h
@@ -33,6 +33,8 @@
 #define HCI_LINK_KEY_SIZE       16
 #define HCI_AMP_LINK_KEY_SIZE   (2 * HCI_LINK_KEY_SIZE)
 
+#define HCI_MAX_AMP_ASSOC_SIZE  672
+
 /* HCI dev events */
 #define HCI_DEV_REG                     1
 #define HCI_DEV_UNREG                   2
@@ -113,6 +115,7 @@ enum {
         HCI_SSP_ENABLED,
         HCI_HS_ENABLED,
         HCI_LE_ENABLED,
+        HCI_LE_PERIPHERAL,
         HCI_CONNECTABLE,
         HCI_DISCOVERABLE,
         HCI_LINK_SECURITY,
@@ -151,7 +154,7 @@ enum {
 #define HCI_DISCONN_TIMEOUT     msecs_to_jiffies(2000)  /* 2 seconds */
 #define HCI_PAIRING_TIMEOUT     msecs_to_jiffies(60000) /* 60 seconds */
 #define HCI_INIT_TIMEOUT        msecs_to_jiffies(10000) /* 10 seconds */
-#define HCI_CMD_TIMEOUT         msecs_to_jiffies(1000)  /* 1 second */
+#define HCI_CMD_TIMEOUT         msecs_to_jiffies(2000)  /* 2 seconds */
 #define HCI_ACL_TX_TIMEOUT      msecs_to_jiffies(45000) /* 45 seconds */
 #define HCI_AUTO_OFF_TIMEOUT    msecs_to_jiffies(2000)  /* 2 seconds */
 
@@ -196,6 +199,7 @@ enum {
 #define ACL_START_NO_FLUSH      0x00
 #define ACL_CONT                0x01
 #define ACL_START               0x02
+#define ACL_COMPLETE            0x03
 #define ACL_ACTIVE_BCAST        0x04
 #define ACL_PICO_BCAST          0x08
 
@@ -205,6 +209,7 @@ enum {
 #define ESCO_LINK       0x02
 /* Low Energy links do not have defined link type. Use invented one */
 #define LE_LINK         0x80
+#define AMP_LINK        0x81
 
 /* LMP features */
 #define LMP_3SLOT       0x01
@@ -314,6 +319,9 @@ enum {
 #define HCI_FLOW_CTL_MODE_PACKET_BASED  0x00
 #define HCI_FLOW_CTL_MODE_BLOCK_BASED   0x01
 
+/* The core spec defines 127 as the "not available" value */
+#define HCI_TX_POWER_INVALID    127
+
 /* Extended Inquiry Response field types */
 #define EIR_FLAGS               0x01 /* flags */
 #define EIR_UUID16_SOME         0x02 /* 16-bit UUID, more available */
@@ -330,6 +338,13 @@ enum {
 #define EIR_SSP_RAND_R          0x0F /* Simple Pairing Randomizer R */
 #define EIR_DEVICE_ID           0x10 /* device ID */
 
+/* Low Energy Advertising Flags */
+#define LE_AD_LIMITED           0x01 /* Limited Discoverable */
+#define LE_AD_GENERAL           0x02 /* General Discoverable */
+#define LE_AD_NO_BREDR          0x04 /* BR/EDR not supported */
+#define LE_AD_SIM_LE_BREDR_CTRL 0x08 /* Simultaneous LE & BR/EDR Controller */
+#define LE_AD_SIM_LE_BREDR_HOST 0x10 /* Simultaneous LE & BR/EDR Host */
+
 /* -----  HCI Commands ---- */
 #define HCI_OP_NOP                      0x0000
 
@@ -556,12 +571,46 @@ struct hci_cp_accept_phy_link {
         __u8     key[HCI_AMP_LINK_KEY_SIZE];
 } __packed;
 
-#define HCI_OP_DISCONN_PHY_LINK 0x0437
+#define HCI_OP_DISCONN_PHY_LINK         0x0437
 struct hci_cp_disconn_phy_link {
         __u8     phy_handle;
         __u8     reason;
 } __packed;
 
+struct ext_flow_spec {
+        __u8       id;
+        __u8       stype;
+        __le16     msdu;
+        __le32     sdu_itime;
+        __le32     acc_lat;
+        __le32     flush_to;
+} __packed;
+
+#define HCI_OP_CREATE_LOGICAL_LINK      0x0438
+#define HCI_OP_ACCEPT_LOGICAL_LINK      0x0439
+struct hci_cp_create_accept_logical_link {
+        __u8                  phy_handle;
+        struct ext_flow_spec  tx_flow_spec;
+        struct ext_flow_spec  rx_flow_spec;
+} __packed;
+
+#define HCI_OP_DISCONN_LOGICAL_LINK     0x043a
+struct hci_cp_disconn_logical_link {
+        __le16   log_handle;
+} __packed;
+
+#define HCI_OP_LOGICAL_LINK_CANCEL      0x043b
+struct hci_cp_logical_link_cancel {
+        __u8     phy_handle;
+        __u8     flow_spec_id;
+} __packed;
+
+struct hci_rp_logical_link_cancel {
+        __u8     status;
+        __u8     phy_handle;
+        __u8     flow_spec_id;
+} __packed;
+
 #define HCI_OP_SNIFF_MODE               0x0803
 struct hci_cp_sniff_mode {
         __le16   handle;
@@ -894,6 +943,22 @@ struct hci_rp_le_read_buffer_size {
         __u8     le_max_pkt;
 } __packed;
 
+#define HCI_OP_LE_READ_ADV_TX_POWER     0x2007
+struct hci_rp_le_read_adv_tx_power {
+        __u8    status;
+        __s8    tx_power;
+} __packed;
+
+#define HCI_MAX_AD_LENGTH               31
+
+#define HCI_OP_LE_SET_ADV_DATA          0x2008
+struct hci_cp_le_set_adv_data {
+        __u8    length;
+        __u8    data[HCI_MAX_AD_LENGTH];
+} __packed;
+
+#define HCI_OP_LE_SET_ADV_ENABLE        0x200a
+
 #define HCI_OP_LE_SET_SCAN_PARAM        0x200b
 struct hci_cp_le_set_scan_param {
         __u8    type;
diff --git a/include/net/bluetooth/hci_core.h b/include/net/bluetooth/hci_core.h
index e7d454609881..014a2eaa5389 100644
--- a/include/net/bluetooth/hci_core.h
+++ b/include/net/bluetooth/hci_core.h
@@ -73,6 +73,7 @@ struct discovery_state {
 struct hci_conn_hash {
         struct list_head list;
         unsigned int     acl_num;
+        unsigned int     amp_num;
         unsigned int     sco_num;
         unsigned int     le_num;
 };
@@ -124,6 +125,14 @@ struct le_scan_params {
 
 #define HCI_MAX_SHORT_NAME_LENGTH       10
 
+struct amp_assoc {
+        __u16   len;
+        __u16   offset;
+        __u16   rem_len;
+        __u16   len_so_far;
+        __u8    data[HCI_MAX_AMP_ASSOC_SIZE];
+};
+
 #define NUM_REASSEMBLY 4
 struct hci_dev {
         struct list_head list;
@@ -177,6 +186,8 @@ struct hci_dev {
         __u32           amp_max_flush_to;
         __u32           amp_be_flush_to;
 
+        struct amp_assoc        loc_assoc;
+
         __u8            flow_ctl_mode;
 
         unsigned int    auto_accept_delay;
@@ -252,8 +263,6 @@ struct hci_dev {
 
         struct sk_buff_head     driver_init;
 
-        void                    *core_data;
-
         atomic_t                promisc;
 
         struct dentry           *debugfs;
@@ -269,6 +278,10 @@ struct hci_dev {
         struct work_struct      le_scan;
         struct le_scan_params   le_scan_params;
 
+        __s8                    adv_tx_power;
+        __u8                    adv_data[HCI_MAX_AD_LENGTH];
+        __u8                    adv_data_len;
+
         int (*open)(struct hci_dev *hdev);
         int (*close)(struct hci_dev *hdev);
         int (*flush)(struct hci_dev *hdev);
@@ -277,6 +290,8 @@ struct hci_dev {
         int (*ioctl)(struct hci_dev *hdev, unsigned int cmd, unsigned long arg);
 };
 
+#define HCI_PHY_HANDLE(handle)  (handle & 0xff)
+
 struct hci_conn {
         struct list_head list;
 
@@ -310,6 +325,7 @@ struct hci_conn {
 
         __u8            remote_cap;
         __u8            remote_auth;
+        __u8            remote_id;
         bool            flush_key;
 
         unsigned int    sent;
@@ -339,10 +355,11 @@ struct hci_conn {
 
 struct hci_chan {
         struct list_head list;
-
+        __u16 handle;
         struct hci_conn *conn;
         struct sk_buff_head data_q;
         unsigned int    sent;
+        __u8            state;
 };
 
 extern struct list_head hci_dev_list;
@@ -359,7 +376,7 @@ extern int l2cap_security_cfm(struct hci_conn *hcon, u8 status, u8 encrypt);
 extern int l2cap_recv_acldata(struct hci_conn *hcon, struct sk_buff *skb,
                               u16 flags);
 
-extern int sco_connect_ind(struct hci_dev *hdev, bdaddr_t *bdaddr);
+extern int sco_connect_ind(struct hci_dev *hdev, bdaddr_t *bdaddr, __u8 *flags);
 extern void sco_connect_cfm(struct hci_conn *hcon, __u8 status);
 extern void sco_disconn_cfm(struct hci_conn *hcon, __u8 reason);
 extern int sco_recv_scodata(struct hci_conn *hcon, struct sk_buff *skb);
@@ -438,6 +455,9 @@ static inline void hci_conn_hash_add(struct hci_dev *hdev, struct hci_conn *c)
         case ACL_LINK:
                 h->acl_num++;
                 break;
+        case AMP_LINK:
+                h->amp_num++;
+                break;
         case LE_LINK:
                 h->le_num++;
                 break;
@@ -459,6 +479,9 @@ static inline void hci_conn_hash_del(struct hci_dev *hdev, struct hci_conn *c)
         case ACL_LINK:
                 h->acl_num--;
                 break;
+        case AMP_LINK:
+                h->amp_num--;
+                break;
         case LE_LINK:
                 h->le_num--;
                 break;
@@ -475,6 +498,8 @@ static inline unsigned int hci_conn_num(struct hci_dev *hdev, __u8 type)
         switch (type) {
         case ACL_LINK:
                 return h->acl_num;
+        case AMP_LINK:
+                return h->amp_num;
         case LE_LINK:
                 return h->le_num;
         case SCO_LINK:
@@ -552,10 +577,12 @@ struct hci_conn *hci_conn_add(struct hci_dev *hdev, int type, bdaddr_t *dst);
 int hci_conn_del(struct hci_conn *conn);
 void hci_conn_hash_flush(struct hci_dev *hdev);
 void hci_conn_check_pending(struct hci_dev *hdev);
+void hci_conn_accept(struct hci_conn *conn, int mask);
 
 struct hci_chan *hci_chan_create(struct hci_conn *conn);
 void hci_chan_del(struct hci_chan *chan);
 void hci_chan_list_flush(struct hci_conn *conn);
+struct hci_chan *hci_chan_lookup_handle(struct hci_dev *hdev, __u16 handle);
 
 struct hci_conn *hci_connect(struct hci_dev *hdev, int type, bdaddr_t *dst,
                              __u8 dst_type, __u8 sec_level, __u8 auth_type);
@@ -584,7 +611,10 @@ static inline void hci_conn_put(struct hci_conn *conn)
 
         if (atomic_dec_and_test(&conn->refcnt)) {
                 unsigned long timeo;
-                if (conn->type == ACL_LINK || conn->type == LE_LINK) {
+
+                switch (conn->type) {
+                case ACL_LINK:
+                case LE_LINK:
                         del_timer(&conn->idle_timer);
                         if (conn->state == BT_CONNECTED) {
                                 timeo = conn->disc_timeout;
@@ -593,12 +623,20 @@ static inline void hci_conn_put(struct hci_conn *conn)
                         } else {
                                 timeo = msecs_to_jiffies(10);
                         }
-                } else {
+                        break;
+
+                case AMP_LINK:
+                        timeo = conn->disc_timeout;
+                        break;
+
+                default:
                         timeo = msecs_to_jiffies(10);
+                        break;
                 }
+
                 cancel_delayed_work(&conn->disc_work);
                 queue_delayed_work(conn->hdev->workqueue,
-                                        &conn->disc_work, timeo);
+                                   &conn->disc_work, timeo);
         }
 }
 
@@ -650,7 +688,7 @@ static inline uint8_t __hci_num_ctrl(void)
 }
 
 struct hci_dev *hci_dev_get(int index);
-struct hci_dev *hci_get_route(bdaddr_t *src, bdaddr_t *dst);
+struct hci_dev *hci_get_route(bdaddr_t *dst, bdaddr_t *src);
 
 struct hci_dev *hci_alloc_dev(void);
 void hci_free_dev(struct hci_dev *hdev);
@@ -699,6 +737,8 @@ int hci_add_remote_oob_data(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 *hash,
                                                                 u8 *randomizer);
 int hci_remove_remote_oob_data(struct hci_dev *hdev, bdaddr_t *bdaddr);
 
+int hci_update_ad(struct hci_dev *hdev);
+
 void hci_event_packet(struct hci_dev *hdev, struct sk_buff *skb);
 
 int hci_recv_frame(struct sk_buff *skb);
@@ -715,22 +755,51 @@ void hci_conn_del_sysfs(struct hci_conn *conn);
 #define SET_HCIDEV_DEV(hdev, pdev) ((hdev)->dev.parent = (pdev))
 
 /* ----- LMP capabilities ----- */
-#define lmp_rswitch_capable(dev)   ((dev)->features[0] & LMP_RSWITCH)
 #define lmp_encrypt_capable(dev)   ((dev)->features[0] & LMP_ENCRYPT)
+#define lmp_rswitch_capable(dev)   ((dev)->features[0] & LMP_RSWITCH)
+#define lmp_hold_capable(dev)      ((dev)->features[0] & LMP_HOLD)
 #define lmp_sniff_capable(dev)     ((dev)->features[0] & LMP_SNIFF)
-#define lmp_sniffsubr_capable(dev) ((dev)->features[5] & LMP_SNIFF_SUBR)
+#define lmp_park_capable(dev)      ((dev)->features[1] & LMP_PARK)
+#define lmp_inq_rssi_capable(dev)  ((dev)->features[3] & LMP_RSSI_INQ)
 #define lmp_esco_capable(dev)      ((dev)->features[3] & LMP_ESCO)
+#define lmp_bredr_capable(dev)     (!((dev)->features[4] & LMP_NO_BREDR))
+#define lmp_le_capable(dev)        ((dev)->features[4] & LMP_LE)
+#define lmp_sniffsubr_capable(dev) ((dev)->features[5] & LMP_SNIFF_SUBR)
+#define lmp_pause_enc_capable(dev) ((dev)->features[5] & LMP_PAUSE_ENC)
+#define lmp_ext_inq_capable(dev)   ((dev)->features[6] & LMP_EXT_INQ)
+#define lmp_le_br_capable(dev)     !!((dev)->features[6] & LMP_SIMUL_LE_BR)
 #define lmp_ssp_capable(dev)       ((dev)->features[6] & LMP_SIMPLE_PAIR)
 #define lmp_no_flush_capable(dev)  ((dev)->features[6] & LMP_NO_FLUSH)
-#define lmp_le_capable(dev)        ((dev)->features[4] & LMP_LE)
-#define lmp_bredr_capable(dev)     (!((dev)->features[4] & LMP_NO_BREDR))
+#define lmp_lsto_capable(dev)      ((dev)->features[7] & LMP_LSTO)
+#define lmp_inq_tx_pwr_capable(dev) ((dev)->features[7] & LMP_INQ_TX_PWR)
+#define lmp_ext_feat_capable(dev)  ((dev)->features[7] & LMP_EXTFEATURES)
 
 /* ----- Extended LMP capabilities ----- */
-#define lmp_host_le_capable(dev)   ((dev)->host_features[0] & LMP_HOST_LE)
+#define lmp_host_ssp_capable(dev)  ((dev)->host_features[0] & LMP_HOST_SSP)
+#define lmp_host_le_capable(dev)   !!((dev)->host_features[0] & LMP_HOST_LE)
+#define lmp_host_le_br_capable(dev) !!((dev)->host_features[0] & LMP_HOST_LE_BREDR)
+
+/* returns true if at least one AMP active */
+static inline bool hci_amp_capable(void)
+{
+        struct hci_dev *hdev;
+        bool ret = false;
+
+        read_lock(&hci_dev_list_lock);
+        list_for_each_entry(hdev, &hci_dev_list, list)
+                if (hdev->amp_type == HCI_AMP &&
+                    test_bit(HCI_UP, &hdev->flags))
+                        ret = true;
+        read_unlock(&hci_dev_list_lock);
+
+        return ret;
+}
 
 /* ----- HCI protocols ----- */
+#define HCI_PROTO_DEFER             0x01
+
 static inline int hci_proto_connect_ind(struct hci_dev *hdev, bdaddr_t *bdaddr,
-                                                                __u8 type)
+                                        __u8 type, __u8 *flags)
 {
         switch (type) {
         case ACL_LINK:
@@ -738,7 +807,7 @@ static inline int hci_proto_connect_ind(struct hci_dev *hdev, bdaddr_t *bdaddr,
 
         case SCO_LINK:
         case ESCO_LINK:
-                return sco_connect_ind(hdev, bdaddr);
+                return sco_connect_ind(hdev, bdaddr, flags);
 
         default:
                 BT_ERR("unknown link type %d", type);
@@ -789,6 +858,10 @@ static inline void hci_proto_disconn_cfm(struct hci_conn *conn, __u8 reason)
                 sco_disconn_cfm(conn, reason);
                 break;
 
+        /* L2CAP would be handled for BREDR chan */
+        case AMP_LINK:
+                break;
+
         default:
                 BT_ERR("unknown link type %d", conn->type);
                 break;
@@ -841,7 +914,7 @@ struct hci_cb {
 
 static inline void hci_auth_cfm(struct hci_conn *conn, __u8 status)
 {
-        struct list_head *p;
+        struct hci_cb *cb;
         __u8 encrypt;
 
         hci_proto_auth_cfm(conn, status);
@@ -852,8 +925,7 @@ static inline void hci_auth_cfm(struct hci_conn *conn, __u8 status)
         encrypt = (conn->link_mode & HCI_LM_ENCRYPT) ? 0x01 : 0x00;
 
         read_lock(&hci_cb_list_lock);
-        list_for_each(p, &hci_cb_list) {
-                struct hci_cb *cb = list_entry(p, struct hci_cb, list);
+        list_for_each_entry(cb, &hci_cb_list, list) {
                 if (cb->security_cfm)
                         cb->security_cfm(conn, status, encrypt);
         }
@@ -863,7 +935,7 @@ static inline void hci_auth_cfm(struct hci_conn *conn, __u8 status)
 static inline void hci_encrypt_cfm(struct hci_conn *conn, __u8 status,
                                                                 __u8 encrypt)
 {
-        struct list_head *p;
+        struct hci_cb *cb;
 
         if (conn->sec_level == BT_SECURITY_SDP)
                 conn->sec_level = BT_SECURITY_LOW;
@@ -874,8 +946,7 @@ static inline void hci_encrypt_cfm(struct hci_conn *conn, __u8 status,
         hci_proto_encrypt_cfm(conn, status, encrypt);
 
         read_lock(&hci_cb_list_lock);
-        list_for_each(p, &hci_cb_list) {
-                struct hci_cb *cb = list_entry(p, struct hci_cb, list);
+        list_for_each_entry(cb, &hci_cb_list, list) {
                 if (cb->security_cfm)
                         cb->security_cfm(conn, status, encrypt);
         }
@@ -884,11 +955,10 @@ static inline void hci_encrypt_cfm(struct hci_conn *conn, __u8 status,
 
 static inline void hci_key_change_cfm(struct hci_conn *conn, __u8 status)
 {
-        struct list_head *p;
+        struct hci_cb *cb;
 
         read_lock(&hci_cb_list_lock);
-        list_for_each(p, &hci_cb_list) {
-                struct hci_cb *cb = list_entry(p, struct hci_cb, list);
+        list_for_each_entry(cb, &hci_cb_list, list) {
                 if (cb->key_change_cfm)
                         cb->key_change_cfm(conn, status);
         }
@@ -898,11 +968,10 @@ static inline void hci_key_change_cfm(struct hci_conn *conn, __u8 status)
 static inline void hci_role_switch_cfm(struct hci_conn *conn, __u8 status,
                                                                 __u8 role)
 {
-        struct list_head *p;
+        struct hci_cb *cb;
 
         read_lock(&hci_cb_list_lock);
-        list_for_each(p, &hci_cb_list) {
-                struct hci_cb *cb = list_entry(p, struct hci_cb, list);
+        list_for_each_entry(cb, &hci_cb_list, list) {
                 if (cb->role_switch_cfm)
                         cb->role_switch_cfm(conn, status, role);
         }
diff --git a/include/net/bluetooth/l2cap.h b/include/net/bluetooth/l2cap.h
index 7ed8e356425a..7588ef44ebaf 100644
--- a/include/net/bluetooth/l2cap.h
+++ b/include/net/bluetooth/l2cap.h
@@ -32,13 +32,14 @@
 /* L2CAP defaults */
 #define L2CAP_DEFAULT_MTU               672
 #define L2CAP_DEFAULT_MIN_MTU           48
-#define L2CAP_DEFAULT_FLUSH_TO          0xffff
+#define L2CAP_DEFAULT_FLUSH_TO          0xFFFF
+#define L2CAP_EFS_DEFAULT_FLUSH_TO      0xFFFFFFFF
 #define L2CAP_DEFAULT_TX_WINDOW         63
 #define L2CAP_DEFAULT_EXT_WINDOW        0x3FFF
 #define L2CAP_DEFAULT_MAX_TX            3
 #define L2CAP_DEFAULT_RETRANS_TO        2000    /* 2 seconds */
 #define L2CAP_DEFAULT_MONITOR_TO        12000   /* 12 seconds */
-#define L2CAP_DEFAULT_MAX_PDU_SIZE      1009    /* Sized for 3-DH5 packet */
+#define L2CAP_DEFAULT_MAX_PDU_SIZE      1492    /* Sized for AMP packet */
 #define L2CAP_DEFAULT_ACK_TO            200
 #define L2CAP_DEFAULT_MAX_SDU_SIZE      0xFFFF
 #define L2CAP_DEFAULT_SDU_ITIME         0xFFFFFFFF
@@ -51,6 +52,8 @@
 #define L2CAP_ENC_TIMEOUT               msecs_to_jiffies(5000)
 #define L2CAP_CONN_TIMEOUT              msecs_to_jiffies(40000)
 #define L2CAP_INFO_TIMEOUT              msecs_to_jiffies(4000)
+#define L2CAP_MOVE_TIMEOUT              msecs_to_jiffies(4000)
+#define L2CAP_MOVE_ERTX_TIMEOUT         msecs_to_jiffies(60000)
 
 #define L2CAP_A2MP_DEFAULT_MTU          670
 
@@ -433,6 +436,8 @@ struct l2cap_chan {
         struct sock *sk;
 
         struct l2cap_conn       *conn;
+        struct hci_conn         *hs_hcon;
+        struct hci_chan         *hs_hchan;
         struct kref     kref;
 
         __u8            state;
@@ -476,6 +481,12 @@ struct l2cap_chan {
         unsigned long   conn_state;
         unsigned long   flags;
 
+        __u8            remote_amp_id;
+        __u8            local_amp_id;
+        __u8            move_id;
+        __u8            move_state;
+        __u8            move_role;
+
         __u16           next_tx_seq;
         __u16           expected_ack_seq;
         __u16           expected_tx_seq;
@@ -538,6 +549,7 @@ struct l2cap_ops {
         void                    (*state_change) (struct l2cap_chan *chan,
                                                  int state);
         void                    (*ready) (struct l2cap_chan *chan);
+        void                    (*defer) (struct l2cap_chan *chan);
         struct sk_buff          *(*alloc_skb) (struct l2cap_chan *chan,
                                                unsigned long len, int nb);
 };
@@ -599,7 +611,7 @@ enum {
         CONF_MTU_DONE,
         CONF_MODE_DONE,
         CONF_CONNECT_PEND,
-        CONF_NO_FCS_RECV,
+        CONF_RECV_NO_FCS,
         CONF_STATE2_DEVICE,
         CONF_EWS_RECV,
         CONF_LOC_CONF_PEND,
@@ -640,6 +652,9 @@ enum {
 enum {
         L2CAP_RX_STATE_RECV,
         L2CAP_RX_STATE_SREJ_SENT,
+        L2CAP_RX_STATE_MOVE,
+        L2CAP_RX_STATE_WAIT_P,
+        L2CAP_RX_STATE_WAIT_F,
 };
 
 enum {
@@ -670,6 +685,25 @@ enum {
         L2CAP_EV_RECV_FRAME,
 };
 
+enum {
+        L2CAP_MOVE_ROLE_NONE,
+        L2CAP_MOVE_ROLE_INITIATOR,
+        L2CAP_MOVE_ROLE_RESPONDER,
+};
+
+enum {
+        L2CAP_MOVE_STABLE,
+        L2CAP_MOVE_WAIT_REQ,
+        L2CAP_MOVE_WAIT_RSP,
+        L2CAP_MOVE_WAIT_RSP_SUCCESS,
+        L2CAP_MOVE_WAIT_CONFIRM,
+        L2CAP_MOVE_WAIT_CONFIRM_RSP,
+        L2CAP_MOVE_WAIT_LOGICAL_COMP,
+        L2CAP_MOVE_WAIT_LOGICAL_CFM,
+        L2CAP_MOVE_WAIT_LOCAL_BUSY,
+        L2CAP_MOVE_WAIT_PREPARE,
+};
+
 void l2cap_chan_hold(struct l2cap_chan *c);
 void l2cap_chan_put(struct l2cap_chan *c);
 
@@ -745,6 +779,10 @@ static inline void l2cap_chan_no_ready(struct l2cap_chan *chan)
 {
 }
 
+static inline void l2cap_chan_no_defer(struct l2cap_chan *chan)
+{
+}
+
 extern bool disable_ertm;
 
 int l2cap_init_sockets(void);
@@ -767,6 +805,12 @@ int l2cap_chan_check_security(struct l2cap_chan *chan);
 void l2cap_chan_set_defaults(struct l2cap_chan *chan);
 int l2cap_ertm_init(struct l2cap_chan *chan);
 void l2cap_chan_add(struct l2cap_conn *conn, struct l2cap_chan *chan);
+void __l2cap_chan_add(struct l2cap_conn *conn, struct l2cap_chan *chan);
 void l2cap_chan_del(struct l2cap_chan *chan, int err);
+void l2cap_send_conn_req(struct l2cap_chan *chan);
+void l2cap_move_start(struct l2cap_chan *chan);
+void l2cap_logical_cfm(struct l2cap_chan *chan, struct hci_chan *hchan,
+                       u8 status);
+void __l2cap_physical_cfm(struct l2cap_chan *chan, int result);
 
 #endif /* __L2CAP_H */
diff --git a/include/net/cfg80211.h b/include/net/cfg80211.h
index 7d5b6000378b..8e6a6b73b9c9 100644
--- a/include/net/cfg80211.h
+++ b/include/net/cfg80211.h
@@ -58,6 +58,8 @@
  * structures here describe these capabilities in detail.
  */
 
+struct wiphy;
+
 /*
  * wireless hardware capability structures
  */
@@ -306,6 +308,104 @@ struct key_params {
 };
 
 /**
+ * struct cfg80211_chan_def - channel definition
+ * @chan: the (control) channel
+ * @width: channel width
+ * @center_freq1: center frequency of first segment
+ * @center_freq2: center frequency of second segment
+ *      (only with 80+80 MHz)
+ */
+struct cfg80211_chan_def {
+        struct ieee80211_channel *chan;
+        enum nl80211_chan_width width;
+        u32 center_freq1;
+        u32 center_freq2;
+};
+
+/**
+ * cfg80211_get_chandef_type - return old channel type from chandef
+ * @chandef: the channel definition
+ *
+ * Returns the old channel type (NOHT, HT20, HT40+/-) from a given
+ * chandef, which must have a bandwidth allowing this conversion.
+ */
+static inline enum nl80211_channel_type
+cfg80211_get_chandef_type(const struct cfg80211_chan_def *chandef)
+{
+        switch (chandef->width) {
+        case NL80211_CHAN_WIDTH_20_NOHT:
+                return NL80211_CHAN_NO_HT;
+        case NL80211_CHAN_WIDTH_20:
+                return NL80211_CHAN_HT20;
+        case NL80211_CHAN_WIDTH_40:
+                if (chandef->center_freq1 > chandef->chan->center_freq)
+                        return NL80211_CHAN_HT40PLUS;
+                return NL80211_CHAN_HT40MINUS;
+        default:
+                WARN_ON(1);
+                return NL80211_CHAN_NO_HT;
+        }
+}
+
+/**
+ * cfg80211_chandef_create - create channel definition using channel type
+ * @chandef: the channel definition struct to fill
+ * @channel: the control channel
+ * @chantype: the channel type
+ *
+ * Given a channel type, create a channel definition.
+ */
+void cfg80211_chandef_create(struct cfg80211_chan_def *chandef,
+                             struct ieee80211_channel *channel,
+                             enum nl80211_channel_type chantype);
+
+/**
+ * cfg80211_chandef_identical - check if two channel definitions are identical
+ * @chandef1: first channel definition
+ * @chandef2: second channel definition
+ *
+ * Returns %true if the channels defined by the channel definitions are
+ * identical, %false otherwise.
+ */
+static inline bool
+cfg80211_chandef_identical(const struct cfg80211_chan_def *chandef1,
+                           const struct cfg80211_chan_def *chandef2)
+{
+        return (chandef1->chan == chandef2->chan &&
+                chandef1->width == chandef2->width &&
+                chandef1->center_freq1 == chandef2->center_freq1 &&
+                chandef1->center_freq2 == chandef2->center_freq2);
+}
+
+/**
+ * cfg80211_chandef_compatible - check if two channel definitions are compatible
+ * @chandef1: first channel definition
+ * @chandef2: second channel definition
+ *
+ * Returns %NULL if the given channel definitions are incompatible,
+ * chandef1 or chandef2 otherwise.
+ */
+const struct cfg80211_chan_def *
+cfg80211_chandef_compatible(const struct cfg80211_chan_def *chandef1,
+                            const struct cfg80211_chan_def *chandef2);
+
+/**
+ * cfg80211_chandef_valid - check if a channel definition is valid
+ * @chandef: the channel definition to check
+ */
+bool cfg80211_chandef_valid(const struct cfg80211_chan_def *chandef);
+
+/**
+ * cfg80211_chandef_usable - check if secondary channels can be used
+ * @wiphy: the wiphy to validate against
+ * @chandef: the channel definition to check
+ * @prohibited_flags: the regulatory chanenl flags that must not be set
+ */
+bool cfg80211_chandef_usable(struct wiphy *wiphy,
+                             const struct cfg80211_chan_def *chandef,
+                             u32 prohibited_flags);
+
+/**
  * enum survey_info_flags - survey information flags
  *
  * @SURVEY_INFO_NOISE_DBM: noise (in dBm) was filled in
@@ -426,8 +526,7 @@ struct cfg80211_beacon_data {
  *
  * Used to configure an AP interface.
  *
- * @channel: the channel to start the AP on
- * @channel_type: the channel type to use
+ * @chandef: defines the channel to use
  * @beacon: beacon data
  * @beacon_interval: beacon interval
  * @dtim_period: DTIM period
@@ -439,10 +538,11 @@ struct cfg80211_beacon_data {
  * @privacy: the BSS uses privacy
  * @auth_type: Authentication type (algorithm)
  * @inactivity_timeout: time in seconds to determine station's inactivity.
+ * @p2p_ctwindow: P2P CT Window
+ * @p2p_opp_ps: P2P opportunistic PS
  */
 struct cfg80211_ap_settings {
-        struct ieee80211_channel *channel;
-        enum nl80211_channel_type channel_type;
+        struct cfg80211_chan_def chandef;
 
         struct cfg80211_beacon_data beacon;
 
@@ -454,6 +554,8 @@ struct cfg80211_ap_settings {
         bool privacy;
         enum nl80211_auth_type auth_type;
         int inactivity_timeout;
+        u8 p2p_ctwindow;
+        bool p2p_opp_ps;
 };
 
 /**
@@ -498,6 +600,7 @@ enum station_parameters_apply_mask {
  * @plink_action: plink action to take
  * @plink_state: set the peer link state for a station
  * @ht_capa: HT capabilities of station
+ * @vht_capa: VHT capabilities of station
  * @uapsd_queues: bitmap of queues configured for uapsd. same format
  *      as the AC bitmap in the QoS info field
  * @max_sp: max Service Period. same format as the MAX_SP in the
@@ -517,6 +620,7 @@ struct station_parameters {
         u8 plink_action;
         u8 plink_state;
         struct ieee80211_ht_cap *ht_capa;
+        struct ieee80211_vht_cap *vht_capa;
         u8 uapsd_queues;
         u8 max_sp;
 };
@@ -580,16 +684,24 @@ enum station_info_flags {
  * Used by the driver to indicate the specific rate transmission
  * type for 802.11n transmissions.
  *
- * @RATE_INFO_FLAGS_MCS: @tx_bitrate_mcs filled
- * @RATE_INFO_FLAGS_40_MHZ_WIDTH: 40 Mhz width transmission
+ * @RATE_INFO_FLAGS_MCS: mcs field filled with HT MCS
+ * @RATE_INFO_FLAGS_VHT_MCS: mcs field filled with VHT MCS
+ * @RATE_INFO_FLAGS_40_MHZ_WIDTH: 40 MHz width transmission
+ * @RATE_INFO_FLAGS_80_MHZ_WIDTH: 80 MHz width transmission
+ * @RATE_INFO_FLAGS_80P80_MHZ_WIDTH: 80+80 MHz width transmission
+ * @RATE_INFO_FLAGS_160_MHZ_WIDTH: 160 MHz width transmission
  * @RATE_INFO_FLAGS_SHORT_GI: 400ns guard interval
- * @RATE_INFO_FLAGS_60G: 60gHz MCS
+ * @RATE_INFO_FLAGS_60G: 60GHz MCS
  */
 enum rate_info_flags {
-        RATE_INFO_FLAGS_MCS             = 1<<0,
-        RATE_INFO_FLAGS_40_MHZ_WIDTH    = 1<<1,
-        RATE_INFO_FLAGS_SHORT_GI        = 1<<2,
-        RATE_INFO_FLAGS_60G             = 1<<3,
+        RATE_INFO_FLAGS_MCS                     = BIT(0),
+        RATE_INFO_FLAGS_VHT_MCS                 = BIT(1),
+        RATE_INFO_FLAGS_40_MHZ_WIDTH            = BIT(2),
+        RATE_INFO_FLAGS_80_MHZ_WIDTH            = BIT(3),
+        RATE_INFO_FLAGS_80P80_MHZ_WIDTH         = BIT(4),
+        RATE_INFO_FLAGS_160_MHZ_WIDTH           = BIT(5),
+        RATE_INFO_FLAGS_SHORT_GI                = BIT(6),
+        RATE_INFO_FLAGS_60G                     = BIT(7),
 };
 
 /**
@@ -600,11 +712,13 @@ enum rate_info_flags {
  * @flags: bitflag of flags from &enum rate_info_flags
  * @mcs: mcs index if struct describes a 802.11n bitrate
  * @legacy: bitrate in 100kbit/s for 802.11abg
+ * @nss: number of streams (VHT only)
  */
 struct rate_info {
         u8 flags;
         u8 mcs;
         u16 legacy;
+        u8 nss;
 };
 
 /**
@@ -803,6 +917,8 @@ struct mpath_info {
  * @ap_isolate: do not forward packets between connected stations
  * @ht_opmode: HT Operation mode
  *      (u16 = opmode, -1 = do not change)
+ * @p2p_ctwindow: P2P CT Window (-1 = no change)
+ * @p2p_opp_ps: P2P opportunistic PS (-1 = no change)
  */
 struct bss_parameters {
         int use_cts_prot;
@@ -812,6 +928,7 @@ struct bss_parameters {
         u8 basic_rates_len;
         int ap_isolate;
         int ht_opmode;
+        s8 p2p_ctwindow, p2p_opp_ps;
 };
 
 /**
@@ -907,8 +1024,7 @@ struct mesh_config {
 
 /**
  * struct mesh_setup - 802.11s mesh setup configuration
- * @channel: the channel to start the mesh network on
- * @channel_type: the channel type to use
+ * @chandef: defines the channel to use
  * @mesh_id: the mesh ID
  * @mesh_id_len: length of the mesh ID, at least 1 and at most 32 bytes
  * @sync_method: which synchronization method to use
@@ -923,8 +1039,7 @@ struct mesh_config {
  * These parameters are fixed when the mesh is created.
  */
 struct mesh_setup {
-        struct ieee80211_channel *channel;
-        enum nl80211_channel_type channel_type;
+        struct cfg80211_chan_def chandef;
         const u8 *mesh_id;
         u8 mesh_id_len;
         u8 sync_method;
@@ -955,9 +1070,6 @@ struct ieee80211_txq_params {
         u8 aifs;
 };
 
-/* from net/wireless.h */
-struct wiphy;
-
 /**
  * DOC: Scanning and BSS list handling
  *
@@ -1000,8 +1112,10 @@ struct cfg80211_ssid {
  * @n_channels: total number of channels to scan
  * @ie: optional information element(s) to add into Probe Request or %NULL
  * @ie_len: length of ie in octets
+ * @flags: bit field of flags controlling operation
  * @rates: bitmap of rates to advertise for each band
  * @wiphy: the wiphy this was for
+ * @scan_start: time (in jiffies) when the scan started
  * @wdev: the wireless device to scan for
  * @aborted: (internal) scan request was notified as aborted
  * @no_cck: used to send probe requests at non CCK rate in 2GHz band
@@ -1012,6 +1126,7 @@ struct cfg80211_scan_request {
         u32 n_channels;
         const u8 *ie;
         size_t ie_len;
+        u32 flags;
 
         u32 rates[IEEE80211_NUM_BANDS];
 
@@ -1019,6 +1134,7 @@ struct cfg80211_scan_request {
 
         /* internal */
         struct wiphy *wiphy;
+        unsigned long scan_start;
         bool aborted;
         bool no_cck;
 
@@ -1044,6 +1160,7 @@ struct cfg80211_match_set {
  * @interval: interval between each scheduled scan cycle
  * @ie: optional information element(s) to add into Probe Request or %NULL
  * @ie_len: length of ie in octets
+ * @flags: bit field of flags controlling operation
  * @match_sets: sets of parameters to be matched for a scan result
  *      entry to be considered valid and to be passed to the host
  *      (others are filtered out).
@@ -1061,6 +1178,7 @@ struct cfg80211_sched_scan_request {
         u32 interval;
         const u8 *ie;
         size_t ie_len;
+        u32 flags;
         struct cfg80211_match_set *match_sets;
         int n_match_sets;
         s32 rssi_thold;
@@ -1068,6 +1186,7 @@ struct cfg80211_sched_scan_request {
         /* internal */
         struct wiphy *wiphy;
         struct net_device *dev;
+        unsigned long scan_start;
 
         /* keep last */
         struct ieee80211_channel *channels[0];
@@ -1087,6 +1206,18 @@ enum cfg80211_signal_type {
 };
 
 /**
+ * struct cfg80211_bss_ie_data - BSS entry IE data
+ * @rcu_head: internal use, for freeing
+ * @len: length of the IEs
+ * @data: IE data
+ */
+struct cfg80211_bss_ies {
+        struct rcu_head rcu_head;
+        int len;
+        u8 data[];
+};
+
+/**
  * struct cfg80211_bss - BSS description
  *
  * This structure describes a BSS (which may also be a mesh network)
@@ -1097,36 +1228,34 @@ enum cfg80211_signal_type {
  * @tsf: timestamp of last received update
  * @beacon_interval: the beacon interval as from the frame
  * @capability: the capability field in host byte order
- * @information_elements: the information elements (Note that there
+ * @ies: the information elements (Note that there
  *      is no guarantee that these are well-formed!); this is a pointer to
  *      either the beacon_ies or proberesp_ies depending on whether Probe
  *      Response frame has been received
- * @len_information_elements: total length of the information elements
  * @beacon_ies: the information elements from the last Beacon frame
- * @len_beacon_ies: total length of the beacon_ies
  * @proberesp_ies: the information elements from the last Probe Response frame
- * @len_proberesp_ies: total length of the proberesp_ies
  * @signal: signal strength value (type depends on the wiphy's signal_type)
  * @free_priv: function pointer to free private data
  * @priv: private area for driver use, has at least wiphy->bss_priv_size bytes
  */
 struct cfg80211_bss {
+        u64 tsf;
+
         struct ieee80211_channel *channel;
 
-        u8 bssid[ETH_ALEN];
-        u64 tsf;
+        const struct cfg80211_bss_ies __rcu *ies;
+        const struct cfg80211_bss_ies __rcu *beacon_ies;
+        const struct cfg80211_bss_ies __rcu *proberesp_ies;
+
+        void (*free_priv)(struct cfg80211_bss *bss);
+
+        s32 signal;
+
         u16 beacon_interval;
         u16 capability;
-        u8 *information_elements;
-        size_t len_information_elements;
-        u8 *beacon_ies;
-        size_t len_beacon_ies;
-        u8 *proberesp_ies;
-        size_t len_proberesp_ies;
 
-        s32 signal;
+        u8 bssid[ETH_ALEN];
 
-        void (*free_priv)(struct cfg80211_bss *bss);
         u8 priv[0] __attribute__((__aligned__(sizeof(void *))));
 };
 
@@ -1134,6 +1263,9 @@ struct cfg80211_bss {
  * ieee80211_bss_get_ie - find IE with given ID
  * @bss: the bss to search
  * @ie: the IE ID
+ *
+ * Note that the return value is an RCU-protected pointer, so
+ * rcu_read_lock() must be held when calling this function.
  * Returns %NULL if not found.
  */
 const u8 *ieee80211_bss_get_ie(struct cfg80211_bss *bss, u8 ie);
@@ -1152,6 +1284,9 @@ const u8 *ieee80211_bss_get_ie(struct cfg80211_bss *bss, u8 ie);
  * @key_len: length of WEP key for shared key authentication
  * @key_idx: index of WEP key for shared key authentication
  * @key: WEP key for shared key authentication
+ * @sae_data: Non-IE data to use with SAE or %NULL. This starts with
+ *      Authentication transaction sequence number field.
+ * @sae_data_len: Length of sae_data buffer in octets
  */
 struct cfg80211_auth_request {
         struct cfg80211_bss *bss;
@@ -1160,6 +1295,8 @@ struct cfg80211_auth_request {
         enum nl80211_auth_type auth_type;
         const u8 *key;
         u8 key_len, key_idx;
+        const u8 *sae_data;
+        size_t sae_data_len;
 };
 
 /**
@@ -1252,8 +1389,7 @@ struct cfg80211_disassoc_request {
  * @ssid_len: The length of the SSID, will always be non-zero.
  * @bssid: Fixed BSSID requested, maybe be %NULL, if set do not
  *      search for IBSSs with a different BSSID.
- * @channel: The channel to use if no IBSS can be found to join.
- * @channel_type: channel type (HT mode)
+ * @chandef: defines the channel to use if no other IBSS to join can be found
  * @channel_fixed: The channel should be fixed -- do not search for
  *      IBSSs to join on other channels.
  * @ie: information element(s) to include in the beacon
@@ -1271,8 +1407,7 @@ struct cfg80211_disassoc_request {
 struct cfg80211_ibss_params {
         u8 *ssid;
         u8 *bssid;
-        struct ieee80211_channel *channel;
-        enum nl80211_channel_type channel_type;
+        struct cfg80211_chan_def chandef;
         u8 *ie;
         u8 ssid_len, ie_len;
         u16 beacon_interval;
@@ -1531,13 +1666,19 @@ struct cfg80211_gtk_rekey_data {
  *      to a merge.
  * @leave_ibss: Leave the IBSS.
  *
+ * @set_mcast_rate: Set the specified multicast rate (only if vif is in ADHOC or
+ *      MESH mode)
+ *
  * @set_wiphy_params: Notify that wiphy parameters have changed;
  *      @changed bitfield (see &enum wiphy_params_flags) describes which values
  *      have changed. The actual parameter values are available in
  *      struct wiphy. If returning an error, no value should be changed.
  *
  * @set_tx_power: set the transmit power according to the parameters,
- *      the power passed is in mBm, to get dBm use MBM_TO_DBM().
+ *      the power passed is in mBm, to get dBm use MBM_TO_DBM(). The
+ *      wdev may be %NULL if power was set for the wiphy, and will
+ *      always be %NULL unless the driver supports per-vif TX power
+ *      (as advertised by the nl80211 feature flag.)
  * @get_tx_power: store the current TX power into the dbm variable;
  *      return 0 if successful
  *
@@ -1708,8 +1849,7 @@ struct cfg80211_ops {
                                              struct ieee80211_channel *chan);
 
         int     (*set_monitor_channel)(struct wiphy *wiphy,
-                                       struct ieee80211_channel *chan,
-                                       enum nl80211_channel_type channel_type);
+                                       struct cfg80211_chan_def *chandef);
 
         int     (*scan)(struct wiphy *wiphy,
                         struct cfg80211_scan_request *request);
@@ -1732,11 +1872,15 @@ struct cfg80211_ops {
                              struct cfg80211_ibss_params *params);
         int     (*leave_ibss)(struct wiphy *wiphy, struct net_device *dev);
 
+        int     (*set_mcast_rate)(struct wiphy *wiphy, struct net_device *dev,
+                                  int rate[IEEE80211_NUM_BANDS]);
+
         int     (*set_wiphy_params)(struct wiphy *wiphy, u32 changed);
 
-        int     (*set_tx_power)(struct wiphy *wiphy,
+        int     (*set_tx_power)(struct wiphy *wiphy, struct wireless_dev *wdev,
                                 enum nl80211_tx_power_setting type, int mbm);
-        int     (*get_tx_power)(struct wiphy *wiphy, int *dbm);
+        int     (*get_tx_power)(struct wiphy *wiphy, struct wireless_dev *wdev,
+                                int *dbm);
 
         int     (*set_wds_peer)(struct wiphy *wiphy, struct net_device *dev,
                                 const u8 *addr);
@@ -1767,7 +1911,6 @@ struct cfg80211_ops {
         int     (*remain_on_channel)(struct wiphy *wiphy,
                                      struct wireless_dev *wdev,
                                      struct ieee80211_channel *chan,
-                                     enum nl80211_channel_type channel_type,
                                      unsigned int duration,
                                      u64 *cookie);
         int     (*cancel_remain_on_channel)(struct wiphy *wiphy,
@@ -1776,10 +1919,8 @@ struct cfg80211_ops {
 
         int     (*mgmt_tx)(struct wiphy *wiphy, struct wireless_dev *wdev,
                           struct ieee80211_channel *chan, bool offchan,
-                          enum nl80211_channel_type channel_type,
-                          bool channel_type_valid, unsigned int wait,
-                          const u8 *buf, size_t len, bool no_cck,
-                          bool dont_wait_for_ack, u64 *cookie);
+                          unsigned int wait, const u8 *buf, size_t len,
+                          bool no_cck, bool dont_wait_for_ack, u64 *cookie);
         int     (*mgmt_tx_cancel_wait)(struct wiphy *wiphy,
                                        struct wireless_dev *wdev,
                                        u64 cookie);
@@ -1834,10 +1975,9 @@ struct cfg80211_ops {
         void    (*get_et_strings)(struct wiphy *wiphy, struct net_device *dev,
                                   u32 sset, u8 *data);
 
-        struct ieee80211_channel *
-                (*get_channel)(struct wiphy *wiphy,
+        int     (*get_channel)(struct wiphy *wiphy,
                                struct wireless_dev *wdev,
-                               enum nl80211_channel_type *type);
+                               struct cfg80211_chan_def *chandef);
 
         int     (*start_p2p_device)(struct wiphy *wiphy,
                                     struct wireless_dev *wdev);
@@ -2445,8 +2585,7 @@ struct wireless_dev {
         spinlock_t event_lock;
 
         struct cfg80211_internal_bss *current_bss; /* associated / joined */
-        struct ieee80211_channel *preset_chan;
-        enum nl80211_channel_type preset_chantype;
+        struct cfg80211_chan_def preset_chandef;
 
         /* for AP and mesh channel tracking */
         struct ieee80211_channel *channel;
@@ -3326,14 +3465,12 @@ void cfg80211_disconnected(struct net_device *dev, u16 reason,
  * @wdev: wireless device
  * @cookie: the request cookie
  * @chan: The current channel (from remain_on_channel request)
- * @channel_type: Channel type
  * @duration: Duration in milliseconds that the driver intents to remain on the
  *      channel
  * @gfp: allocation flags
  */
 void cfg80211_ready_on_channel(struct wireless_dev *wdev, u64 cookie,
                                struct ieee80211_channel *chan,
-                               enum nl80211_channel_type channel_type,
                                unsigned int duration, gfp_t gfp);
 
 /**
@@ -3341,12 +3478,10 @@ void cfg80211_ready_on_channel(struct wireless_dev *wdev, u64 cookie,
  * @wdev: wireless device
  * @cookie: the request cookie
  * @chan: The current channel (from remain_on_channel request)
- * @channel_type: Channel type
  * @gfp: allocation flags
  */
 void cfg80211_remain_on_channel_expired(struct wireless_dev *wdev, u64 cookie,
                                         struct ieee80211_channel *chan,
-                                        enum nl80211_channel_type channel_type,
                                         gfp_t gfp);
 
 
@@ -3536,7 +3671,6 @@ void cfg80211_probe_status(struct net_device *dev, const u8 *addr,
  * @len: length of the frame
  * @freq: frequency the frame was received on
  * @sig_dbm: signal strength in mBm, or 0 if unknown
- * @gfp: allocation flags
  *
  * Use this function to report to userspace when a beacon was
  * received. It is not useful to call this when there is no
@@ -3544,31 +3678,47 @@ void cfg80211_probe_status(struct net_device *dev, const u8 *addr,
  */
 void cfg80211_report_obss_beacon(struct wiphy *wiphy,
                                  const u8 *frame, size_t len,
-                                 int freq, int sig_dbm, gfp_t gfp);
+                                 int freq, int sig_dbm);
 
 /**
- * cfg80211_can_beacon_sec_chan - test if ht40 on extension channel can be used
+ * cfg80211_reg_can_beacon - check if beaconing is allowed
  * @wiphy: the wiphy
- * @chan: main channel
- * @channel_type: HT mode
+ * @chandef: the channel definition
  *
  * This function returns true if there is no secondary channel or the secondary
- * channel can be used for beaconing (i.e. is not a radar channel etc.)
+ * channel(s) can be used for beaconing (i.e. is not a radar channel etc.)
  */
-bool cfg80211_can_beacon_sec_chan(struct wiphy *wiphy,
-                                  struct ieee80211_channel *chan,
-                                  enum nl80211_channel_type channel_type);
+bool cfg80211_reg_can_beacon(struct wiphy *wiphy,
+                             struct cfg80211_chan_def *chandef);
 
 /*
  * cfg80211_ch_switch_notify - update wdev channel and notify userspace
  * @dev: the device which switched channels
- * @freq: new channel frequency (in MHz)
- * @type: channel type
+ * @chandef: the new channel definition
  *
  * Acquires wdev_lock, so must only be called from sleepable driver context!
  */
-void cfg80211_ch_switch_notify(struct net_device *dev, int freq,
-                               enum nl80211_channel_type type);
+void cfg80211_ch_switch_notify(struct net_device *dev,
+                               struct cfg80211_chan_def *chandef);
+
+/*
+ * cfg80211_tdls_oper_request - request userspace to perform TDLS operation
+ * @dev: the device on which the operation is requested
+ * @peer: the MAC address of the peer device
+ * @oper: the requested TDLS operation (NL80211_TDLS_SETUP or
+ *      NL80211_TDLS_TEARDOWN)
+ * @reason_code: the reason code for teardown request
+ * @gfp: allocation flags
+ *
+ * This function is used to request userspace to perform TDLS operation that
+ * requires knowledge of keys, i.e., link setup or teardown when the AP
+ * connection uses encryption. This is optional mechanism for the driver to use
+ * if it can automatically determine when a TDLS link could be useful (e.g.,
+ * based on traffic and signal strength for a peer).
+ */
+void cfg80211_tdls_oper_request(struct net_device *dev, const u8 *peer,
+                                enum nl80211_tdls_operation oper,
+                                u16 reason_code, gfp_t gfp);
 
 /*
  * cfg80211_calculate_bitrate - calculate actual bitrate (in 100Kbps units)
@@ -3594,6 +3744,26 @@ u32 cfg80211_calculate_bitrate(struct rate_info *rate);
  */
 void cfg80211_unregister_wdev(struct wireless_dev *wdev);
 
+/**
+ * cfg80211_get_p2p_attr - find and copy a P2P attribute from IE buffer
+ * @ies: the input IE buffer
+ * @len: the input length
+ * @attr: the attribute ID to find
+ * @buf: output buffer, can be %NULL if the data isn't needed, e.g.
+ *      if the function is only called to get the needed buffer size
+ * @bufsize: size of the output buffer
+ *
+ * The function finds a given P2P attribute in the (vendor) IEs and
+ * copies its contents to the given buffer.
+ *
+ * The return value is a negative error code (-%EILSEQ or -%ENOENT) if
+ * the data is malformed or the attribute can't be found (respectively),
+ * or the length of the found attribute (which can be zero).
+ */
+int cfg80211_get_p2p_attr(const u8 *ies, unsigned int len,
+                          enum ieee80211_p2p_attr_id attr,
+                          u8 *buf, unsigned int bufsize);
+
 /* Logging, debugging and troubleshooting/diagnostic helpers. */
 
 /* wiphy_printk helpers, similar to dev_printk */
diff --git a/include/net/cls_cgroup.h b/include/net/cls_cgroup.h
index b6a6eeb3905f..2581638f4a3d 100644
--- a/include/net/cls_cgroup.h
+++ b/include/net/cls_cgroup.h
@@ -24,12 +24,12 @@ struct cgroup_cls_state
         u32 classid;
 };
 
-extern void sock_update_classid(struct sock *sk);
+extern void sock_update_classid(struct sock *sk, struct task_struct *task);
 
 #if IS_BUILTIN(CONFIG_NET_CLS_CGROUP)
 static inline u32 task_cls_classid(struct task_struct *p)
 {
-        int classid;
+        u32 classid;
 
         if (in_interrupt())
                 return 0;
@@ -61,7 +61,7 @@ static inline u32 task_cls_classid(struct task_struct *p)
 }
 #endif
 #else /* !CGROUP_NET_CLS_CGROUP */
-static inline void sock_update_classid(struct sock *sk)
+static inline void sock_update_classid(struct sock *sk, struct task_struct *task)
 {
 }
 
diff --git a/include/net/gro_cells.h b/include/net/gro_cells.h
index 4fd8a4b4b7ee..e5062c955ea6 100644
--- a/include/net/gro_cells.h
+++ b/include/net/gro_cells.h
@@ -17,7 +17,6 @@ struct gro_cells {
 
 static inline void gro_cells_receive(struct gro_cells *gcells, struct sk_buff *skb)
 {
-        unsigned long flags;
         struct gro_cell *cell = gcells->cells;
         struct net_device *dev = skb->dev;
 
@@ -35,32 +34,37 @@ static inline void gro_cells_receive(struct gro_cells *gcells, struct sk_buff *s
                 return;
         }
 
-        spin_lock_irqsave(&cell->napi_skbs.lock, flags);
+        /* We run in BH context */
+        spin_lock(&cell->napi_skbs.lock);
 
         __skb_queue_tail(&cell->napi_skbs, skb);
         if (skb_queue_len(&cell->napi_skbs) == 1)
                 napi_schedule(&cell->napi);
 
-        spin_unlock_irqrestore(&cell->napi_skbs.lock, flags);
+        spin_unlock(&cell->napi_skbs.lock);
 }
 
+/* called unser BH context */
 static inline int gro_cell_poll(struct napi_struct *napi, int budget)
 {
         struct gro_cell *cell = container_of(napi, struct gro_cell, napi);
         struct sk_buff *skb;
         int work_done = 0;
 
+        spin_lock(&cell->napi_skbs.lock);
         while (work_done < budget) {
-                skb = skb_dequeue(&cell->napi_skbs);
+                skb = __skb_dequeue(&cell->napi_skbs);
                 if (!skb)
                         break;
-
+                spin_unlock(&cell->napi_skbs.lock);
                 napi_gro_receive(napi, skb);
                 work_done++;
+                spin_lock(&cell->napi_skbs.lock);
         }
 
         if (work_done < budget)
                 napi_complete(napi);
+        spin_unlock(&cell->napi_skbs.lock);
         return work_done;
 }
 
diff --git a/include/net/ieee80211_radiotap.h b/include/net/ieee80211_radiotap.h
index 7f0df133d119..c3999632e616 100644
--- a/include/net/ieee80211_radiotap.h
+++ b/include/net/ieee80211_radiotap.h
@@ -186,6 +186,10 @@ struct ieee80211_radiotap_header {
  * IEEE80211_RADIOTAP_AMPDU_STATUS      u32, u16, u8, u8        unitless
  *
  *      Contains the AMPDU information for the subframe.
+ *
+ * IEEE80211_RADIOTAP_VHT       u16, u8, u8, u8[4], u8, u8, u16
+ *
+ *      Contains VHT information about this frame.
  */
 enum ieee80211_radiotap_type {
         IEEE80211_RADIOTAP_TSFT = 0,
@@ -209,6 +213,7 @@ enum ieee80211_radiotap_type {
 
         IEEE80211_RADIOTAP_MCS = 19,
         IEEE80211_RADIOTAP_AMPDU_STATUS = 20,
+        IEEE80211_RADIOTAP_VHT = 21,
 
         /* valid in every it_present bitmap, even vendor namespaces */
         IEEE80211_RADIOTAP_RADIOTAP_NAMESPACE = 29,
@@ -282,6 +287,25 @@ enum ieee80211_radiotap_type {
 #define IEEE80211_RADIOTAP_AMPDU_DELIM_CRC_ERR          0x0010
 #define IEEE80211_RADIOTAP_AMPDU_DELIM_CRC_KNOWN        0x0020
 
+/* For IEEE80211_RADIOTAP_VHT */
+#define IEEE80211_RADIOTAP_VHT_KNOWN_STBC                       0x0001
+#define IEEE80211_RADIOTAP_VHT_KNOWN_TXOP_PS_NA                 0x0002
+#define IEEE80211_RADIOTAP_VHT_KNOWN_GI                         0x0004
+#define IEEE80211_RADIOTAP_VHT_KNOWN_SGI_NSYM_DIS               0x0008
+#define IEEE80211_RADIOTAP_VHT_KNOWN_LDPC_EXTRA_OFDM_SYM        0x0010
+#define IEEE80211_RADIOTAP_VHT_KNOWN_BEAMFORMED                 0x0020
+#define IEEE80211_RADIOTAP_VHT_KNOWN_BANDWIDTH                  0x0040
+#define IEEE80211_RADIOTAP_VHT_KNOWN_GROUP_ID                   0x0080
+#define IEEE80211_RADIOTAP_VHT_KNOWN_PARTIAL_AID                0x0100
+
+#define IEEE80211_RADIOTAP_VHT_FLAG_STBC                        0x01
+#define IEEE80211_RADIOTAP_VHT_FLAG_TXOP_PS_NA                  0x02
+#define IEEE80211_RADIOTAP_VHT_FLAG_SGI                         0x04
+#define IEEE80211_RADIOTAP_VHT_FLAG_SGI_NSYM_M10_9              0x08
+#define IEEE80211_RADIOTAP_VHT_FLAG_LDPC_EXTRA_OFDM_SYM         0x10
+#define IEEE80211_RADIOTAP_VHT_FLAG_BEAMFORMED                  0x20
+
+
 /* helpers */
 static inline int ieee80211_get_radiotap_len(unsigned char *data)
 {
diff --git a/include/net/inet_hashtables.h b/include/net/inet_hashtables.h
index 54be0287eb98..67a8fa098e3a 100644
--- a/include/net/inet_hashtables.h
+++ b/include/net/inet_hashtables.h
@@ -277,7 +277,6 @@ static inline struct sock *inet_lookup_listener(struct net *net,
    On 64bit targets we combine comparisons with pair of adjacent __be32
    fields in the same way.
 */
-typedef __u32 __bitwise __portpair;
 #ifdef __BIG_ENDIAN
 #define INET_COMBINED_PORTS(__sport, __dport) \
         ((__force __portpair)(((__force __u32)(__be16)(__sport) << 16) | (__u32)(__dport)))
@@ -287,7 +286,6 @@ typedef __u32 __bitwise __portpair;
 #endif
 
 #if (BITS_PER_LONG == 64)
-typedef __u64 __bitwise __addrpair;
 #ifdef __BIG_ENDIAN
 #define INET_ADDR_COOKIE(__name, __saddr, __daddr) \
         const __addrpair __name = (__force __addrpair) ( \
@@ -299,30 +297,34 @@ typedef __u64 __bitwise __addrpair;
                                    (((__force __u64)(__be32)(__daddr)) << 32) | \
                                    ((__force __u64)(__be32)(__saddr)));
 #endif /* __BIG_ENDIAN */
-#define INET_MATCH(__sk, __net, __hash, __cookie, __saddr, __daddr, __ports, __dif)\
-        (((__sk)->sk_hash == (__hash)) && net_eq(sock_net(__sk), (__net)) &&    \
-         ((*((__addrpair *)&(inet_sk(__sk)->inet_daddr))) == (__cookie))  &&    \
-         ((*((__portpair *)&(inet_sk(__sk)->inet_dport))) == (__ports))   &&    \
-         (!((__sk)->sk_bound_dev_if) || ((__sk)->sk_bound_dev_if == (__dif))))
-#define INET_TW_MATCH(__sk, __net, __hash, __cookie, __saddr, __daddr, __ports, __dif)\
-        (((__sk)->sk_hash == (__hash)) && net_eq(sock_net(__sk), (__net)) &&    \
-         ((*((__addrpair *)&(inet_twsk(__sk)->tw_daddr))) == (__cookie)) &&     \
-         ((*((__portpair *)&(inet_twsk(__sk)->tw_dport))) == (__ports)) &&      \
-         (!((__sk)->sk_bound_dev_if) || ((__sk)->sk_bound_dev_if == (__dif))))
+#define INET_MATCH(__sk, __net, __cookie, __saddr, __daddr, __ports, __dif)     \
+        ((inet_sk(__sk)->inet_portpair == (__ports))            &&      \
+         (inet_sk(__sk)->inet_addrpair == (__cookie))           &&      \
+         (!(__sk)->sk_bound_dev_if      ||                              \
+           ((__sk)->sk_bound_dev_if == (__dif)))                &&      \
+         net_eq(sock_net(__sk), (__net)))
+#define INET_TW_MATCH(__sk, __net, __cookie, __saddr, __daddr, __ports, __dif)\
+        ((inet_twsk(__sk)->tw_portpair == (__ports))    &&              \
+         (inet_twsk(__sk)->tw_addrpair == (__cookie))   &&              \
+         (!(__sk)->sk_bound_dev_if      ||                              \
+           ((__sk)->sk_bound_dev_if == (__dif)))        &&              \
+         net_eq(sock_net(__sk), (__net)))
 #else /* 32-bit arch */
 #define INET_ADDR_COOKIE(__name, __saddr, __daddr)
-#define INET_MATCH(__sk, __net, __hash, __cookie, __saddr, __daddr, __ports, __dif)     \
-        (((__sk)->sk_hash == (__hash)) && net_eq(sock_net(__sk), (__net))       &&      \
-         (inet_sk(__sk)->inet_daddr     == (__saddr))           &&      \
-         (inet_sk(__sk)->inet_rcv_saddr == (__daddr))           &&      \
-         ((*((__portpair *)&(inet_sk(__sk)->inet_dport))) == (__ports)) &&      \
-         (!((__sk)->sk_bound_dev_if) || ((__sk)->sk_bound_dev_if == (__dif))))
-#define INET_TW_MATCH(__sk, __net, __hash,__cookie, __saddr, __daddr, __ports, __dif)   \
-        (((__sk)->sk_hash == (__hash)) && net_eq(sock_net(__sk), (__net))       &&      \
-         (inet_twsk(__sk)->tw_daddr     == (__saddr))           &&      \
-         (inet_twsk(__sk)->tw_rcv_saddr == (__daddr))           &&      \
-         ((*((__portpair *)&(inet_twsk(__sk)->tw_dport))) == (__ports)) &&      \
-         (!((__sk)->sk_bound_dev_if) || ((__sk)->sk_bound_dev_if == (__dif))))
+#define INET_MATCH(__sk, __net, __cookie, __saddr, __daddr, __ports, __dif) \
+        ((inet_sk(__sk)->inet_portpair == (__ports))    &&              \
+         (inet_sk(__sk)->inet_daddr     == (__saddr))   &&              \
+         (inet_sk(__sk)->inet_rcv_saddr == (__daddr))   &&              \
+         (!(__sk)->sk_bound_dev_if      ||                              \
+           ((__sk)->sk_bound_dev_if == (__dif)))        &&              \
+         net_eq(sock_net(__sk), (__net)))
+#define INET_TW_MATCH(__sk, __net, __cookie, __saddr, __daddr, __ports, __dif) \
+        ((inet_twsk(__sk)->tw_portpair == (__ports))    &&              \
+         (inet_twsk(__sk)->tw_daddr     == (__saddr))   &&              \
+         (inet_twsk(__sk)->tw_rcv_saddr == (__daddr))   &&              \
+         (!(__sk)->sk_bound_dev_if      ||                              \
+           ((__sk)->sk_bound_dev_if == (__dif)))        &&              \
+         net_eq(sock_net(__sk), (__net)))
 #endif /* 64-bit arch */
 
 /*
diff --git a/include/net/inet_sock.h b/include/net/inet_sock.h
index 256c1ed2d69a..a4196cbc84ec 100644
--- a/include/net/inet_sock.h
+++ b/include/net/inet_sock.h
@@ -144,9 +144,11 @@ struct inet_sock {
         /* Socket demultiplex comparisons on incoming packets. */
 #define inet_daddr              sk.__sk_common.skc_daddr
 #define inet_rcv_saddr          sk.__sk_common.skc_rcv_saddr
+#define inet_addrpair           sk.__sk_common.skc_addrpair
+#define inet_dport              sk.__sk_common.skc_dport
+#define inet_num                sk.__sk_common.skc_num
+#define inet_portpair           sk.__sk_common.skc_portpair
 
-        __be16                  inet_dport;
-        __u16                   inet_num;
         __be32                  inet_saddr;
         __s16                   uc_ttl;
         __u16                   cmsg_flags;
@@ -154,6 +156,7 @@ struct inet_sock {
         __u16                   inet_id;
 
         struct ip_options_rcu __rcu     *inet_opt;
+        int                     rx_dst_ifindex;
         __u8                    tos;
         __u8                    min_ttl;
         __u8                    mc_ttl;
@@ -170,7 +173,6 @@ struct inet_sock {
         int                     uc_index;
         int                     mc_index;
         __be32                  mc_addr;
-        int                     rx_dst_ifindex;
         struct ip_mc_socklist __rcu     *mc_list;
         struct inet_cork_full   cork;
 };
diff --git a/include/net/inet_timewait_sock.h b/include/net/inet_timewait_sock.h
index ba52c830a7a5..7d658d577368 100644
--- a/include/net/inet_timewait_sock.h
+++ b/include/net/inet_timewait_sock.h
@@ -112,6 +112,11 @@ struct inet_timewait_sock {
 #define tw_net                  __tw_common.skc_net
 #define tw_daddr                __tw_common.skc_daddr
 #define tw_rcv_saddr            __tw_common.skc_rcv_saddr
+#define tw_addrpair             __tw_common.skc_addrpair
+#define tw_dport                __tw_common.skc_dport
+#define tw_num                  __tw_common.skc_num
+#define tw_portpair             __tw_common.skc_portpair
+
         int                     tw_timeout;
         volatile unsigned char  tw_substate;
         unsigned char           tw_rcv_wscale;
@@ -119,8 +124,6 @@ struct inet_timewait_sock {
         /* Socket demultiplex comparisons on incoming packets. */
         /* these three are in inet_sock */
         __be16                  tw_sport;
-        __be16                  tw_dport;
-        __u16                   tw_num;
         kmemcheck_bitfield_begin(flags);
         /* And these are ours. */
         unsigned int            tw_ipv6only     : 1,
diff --git a/include/net/ip6_checksum.h b/include/net/ip6_checksum.h
index bc1b0fda2b04..652d3d309357 100644
--- a/include/net/ip6_checksum.h
+++ b/include/net/ip6_checksum.h
@@ -31,6 +31,8 @@
 #include <net/ip.h>
 #include <asm/checksum.h>
 #include <linux/in6.h>
+#include <linux/tcp.h>
+#include <linux/ipv6.h>
 
 #ifndef _HAVE_ARCH_IPV6_CSUM
 
@@ -91,4 +93,37 @@ static __inline__ __sum16 csum_ipv6_magic(const struct in6_addr *saddr,
 }
 
 #endif
+
+static __inline__ __sum16 tcp_v6_check(int len,
+                                   const struct in6_addr *saddr,
+                                   const struct in6_addr *daddr,
+                                   __wsum base)
+{
+        return csum_ipv6_magic(saddr, daddr, len, IPPROTO_TCP, base);
+}
+
+static inline void __tcp_v6_send_check(struct sk_buff *skb,
+                                       const struct in6_addr *saddr,
+                                       const struct in6_addr *daddr)
+{
+        struct tcphdr *th = tcp_hdr(skb);
+
+        if (skb->ip_summed == CHECKSUM_PARTIAL) {
+                th->check = ~tcp_v6_check(skb->len, saddr, daddr, 0);
+                skb->csum_start = skb_transport_header(skb) - skb->head;
+                skb->csum_offset = offsetof(struct tcphdr, check);
+        } else {
+                th->check = tcp_v6_check(skb->len, saddr, daddr,
+                                         csum_partial(th, th->doff << 2,
+                                                      skb->csum));
+        }
+}
+
+static inline void tcp_v6_send_check(struct sock *sk, struct sk_buff *skb)
+{
+        struct ipv6_pinfo *np = inet6_sk(sk);
+
+        __tcp_v6_send_check(skb, &np->saddr, &np->daddr);
+}
+
 #endif
diff --git a/include/net/ip6_fib.h b/include/net/ip6_fib.h
index 8a2a203eb15d..fdc48a94a063 100644
--- a/include/net/ip6_fib.h
+++ b/include/net/ip6_fib.h
@@ -47,6 +47,8 @@ struct fib6_config {
         unsigned long   fc_expires;
         struct nlattr   *fc_mx;
         int             fc_mx_len;
+        int             fc_mp_len;
+        struct nlattr   *fc_mp;
 
         struct nl_info  fc_nlinfo;
 };
@@ -99,6 +101,14 @@ struct rt6_info {
 
         struct in6_addr                 rt6i_gateway;
 
+        /* Multipath routes:
+         * siblings is a list of rt6_info that have the the same metric/weight,
+         * destination, but not the same gateway. nsiblings is just a cache
+         * to speed up lookup.
+         */
+        struct list_head                rt6i_siblings;
+        unsigned int                    rt6i_nsiblings;
+
         atomic_t                        rt6i_ref;
 
         /* These are in a separate cache line. */
@@ -107,7 +117,6 @@ struct rt6_info {
         struct rt6key                   rt6i_src;
         struct rt6key                   rt6i_prefsrc;
         u32                             rt6i_metric;
-        u32                             rt6i_peer_genid;
 
         struct inet6_dev                *rt6i_idev;
         unsigned long                   _rt6i_peer;
@@ -203,6 +212,15 @@ static inline void rt6_set_from(struct rt6_info *rt, struct rt6_info *from)
         dst_hold(new);
 }
 
+static inline void ip6_rt_put(struct rt6_info *rt)
+{
+        /* dst_release() accepts a NULL parameter.
+         * We rely on dst being first structure in struct rt6_info
+         */
+        BUILD_BUG_ON(offsetof(struct rt6_info, dst) != 0);
+        dst_release(&rt->dst);
+}
+
 struct fib6_walker_t {
         struct list_head lh;
         struct fib6_node *root, *node;
diff --git a/include/net/ip6_route.h b/include/net/ip6_route.h
index 5fa2af00634a..27d83183e615 100644
--- a/include/net/ip6_route.h
+++ b/include/net/ip6_route.h
@@ -1,9 +1,6 @@
 #ifndef _NET_IP6_ROUTE_H
 #define _NET_IP6_ROUTE_H
 
-#define IP6_RT_PRIO_USER        1024
-#define IP6_RT_PRIO_ADDRCONF    256
-
 struct route_info {
         __u8                    type;
         __u8                    length;
diff --git a/include/net/ip_vs.h b/include/net/ip_vs.h
index ee75ccdf5188..68c69d54d392 100644
--- a/include/net/ip_vs.h
+++ b/include/net/ip_vs.h
@@ -22,7 +22,10 @@
 #include <linux/ip.h>
 #include <linux/ipv6.h>                 /* for struct ipv6hdr */
 #include <net/ipv6.h>
-#if defined(CONFIG_NF_CONNTRACK) || defined(CONFIG_NF_CONNTRACK_MODULE)
+#if IS_ENABLED(CONFIG_IP_VS_IPV6)
+#include <linux/netfilter_ipv6/ip6_tables.h>
+#endif
+#if IS_ENABLED(CONFIG_NF_CONNTRACK)
 #include <net/netfilter/nf_conntrack.h>
 #endif
 #include <net/net_namespace.h>          /* Netw namespace */
@@ -103,30 +106,117 @@ static inline struct net *seq_file_single_net(struct seq_file *seq)
 /* Connections' size value needed by ip_vs_ctl.c */
 extern int ip_vs_conn_tab_size;
 
-
 struct ip_vs_iphdr {
-        int len;
-        __u8 protocol;
+        __u32 len;      /* IPv4 simply where L4 starts
+                           IPv6 where L4 Transport Header starts */
+        __u32 thoff_reasm; /* Transport Header Offset in nfct_reasm skb */
+        __u16 fragoffs; /* IPv6 fragment offset, 0 if first frag (or not frag)*/
+        __s16 protocol;
+        __s32 flags;
         union nf_inet_addr saddr;
         union nf_inet_addr daddr;
 };
 
+/* Dependency to module: nf_defrag_ipv6 */
+#if defined(CONFIG_NF_DEFRAG_IPV6) || defined(CONFIG_NF_DEFRAG_IPV6_MODULE)
+static inline struct sk_buff *skb_nfct_reasm(const struct sk_buff *skb)
+{
+        return skb->nfct_reasm;
+}
+static inline void *frag_safe_skb_hp(const struct sk_buff *skb, int offset,
+                                      int len, void *buffer,
+                                      const struct ip_vs_iphdr *ipvsh)
+{
+        if (unlikely(ipvsh->fragoffs && skb_nfct_reasm(skb)))
+                return skb_header_pointer(skb_nfct_reasm(skb),
+                                          ipvsh->thoff_reasm, len, buffer);
+
+        return skb_header_pointer(skb, offset, len, buffer);
+}
+#else
+static inline struct sk_buff *skb_nfct_reasm(const struct sk_buff *skb)
+{
+        return NULL;
+}
+static inline void *frag_safe_skb_hp(const struct sk_buff *skb, int offset,
+                                      int len, void *buffer,
+                                      const struct ip_vs_iphdr *ipvsh)
+{
+        return skb_header_pointer(skb, offset, len, buffer);
+}
+#endif
+
 static inline void
-ip_vs_fill_iphdr(int af, const void *nh, struct ip_vs_iphdr *iphdr)
+ip_vs_fill_ip4hdr(const void *nh, struct ip_vs_iphdr *iphdr)
+{
+        const struct iphdr *iph = nh;
+
+        iphdr->len      = iph->ihl * 4;
+        iphdr->fragoffs = 0;
+        iphdr->protocol = iph->protocol;
+        iphdr->saddr.ip = iph->saddr;
+        iphdr->daddr.ip = iph->daddr;
+}
+
+/* This function handles filling *ip_vs_iphdr, both for IPv4 and IPv6.
+ * IPv6 requires some extra work, as finding proper header position,
+ * depend on the IPv6 extension headers.
+ */
+static inline void
+ip_vs_fill_iph_skb(int af, const struct sk_buff *skb, struct ip_vs_iphdr *iphdr)
 {
 #ifdef CONFIG_IP_VS_IPV6
         if (af == AF_INET6) {
-                const struct ipv6hdr *iph = nh;
-                iphdr->len = sizeof(struct ipv6hdr);
-                iphdr->protocol = iph->nexthdr;
+                const struct ipv6hdr *iph =
+                        (struct ipv6hdr *)skb_network_header(skb);
                 iphdr->saddr.in6 = iph->saddr;
                 iphdr->daddr.in6 = iph->daddr;
+                /* ipv6_find_hdr() updates len, flags, thoff_reasm */
+                iphdr->thoff_reasm = 0;
+                iphdr->len       = 0;
+                iphdr->flags     = 0;
+                iphdr->protocol  = ipv6_find_hdr(skb, &iphdr->len, -1,
+                                                 &iphdr->fragoffs,
+                                                 &iphdr->flags);
+                /* get proto from re-assembled packet and it's offset */
+                if (skb_nfct_reasm(skb))
+                        iphdr->protocol = ipv6_find_hdr(skb_nfct_reasm(skb),
+                                                        &iphdr->thoff_reasm,
+                                                        -1, NULL, NULL);
+
         } else
 #endif
         {
-                const struct iphdr *iph = nh;
-                iphdr->len = iph->ihl * 4;
-                iphdr->protocol = iph->protocol;
+                const struct iphdr *iph =
+                        (struct iphdr *)skb_network_header(skb);
+                iphdr->len      = iph->ihl * 4;
+                iphdr->fragoffs = 0;
+                iphdr->protocol = iph->protocol;
+                iphdr->saddr.ip = iph->saddr;
+                iphdr->daddr.ip = iph->daddr;
+        }
+}
+
+/* This function is a faster version of ip_vs_fill_iph_skb().
+ * Where we only populate {s,d}addr (and avoid calling ipv6_find_hdr()).
+ * This is used by the some of the ip_vs_*_schedule() functions.
+ * (Mostly done to avoid ABI breakage of external schedulers)
+ */
+static inline void
+ip_vs_fill_iph_addr_only(int af, const struct sk_buff *skb,
+                         struct ip_vs_iphdr *iphdr)
+{
+#ifdef CONFIG_IP_VS_IPV6
+        if (af == AF_INET6) {
+                const struct ipv6hdr *iph =
+                        (struct ipv6hdr *)skb_network_header(skb);
+                iphdr->saddr.in6 = iph->saddr;
+                iphdr->daddr.in6 = iph->daddr;
+        } else
+#endif
+        {
+                const struct iphdr *iph =
+                        (struct iphdr *)skb_network_header(skb);
                 iphdr->saddr.ip = iph->saddr;
                 iphdr->daddr.ip = iph->daddr;
         }
@@ -165,7 +255,7 @@ static inline const char *ip_vs_dbg_addr(int af, char *buf, size_t buf_len,
         int len;
 #ifdef CONFIG_IP_VS_IPV6
         if (af == AF_INET6)
-                len = snprintf(&buf[*idx], buf_len - *idx, "[%pI6]",
+                len = snprintf(&buf[*idx], buf_len - *idx, "[%pI6c]",
                                &addr->in6) + 1;
         else
 #endif
@@ -398,27 +488,26 @@ struct ip_vs_protocol {
 
         int (*conn_schedule)(int af, struct sk_buff *skb,
                              struct ip_vs_proto_data *pd,
-                             int *verdict, struct ip_vs_conn **cpp);
+                             int *verdict, struct ip_vs_conn **cpp,
+                             struct ip_vs_iphdr *iph);
 
         struct ip_vs_conn *
         (*conn_in_get)(int af,
                        const struct sk_buff *skb,
                        const struct ip_vs_iphdr *iph,
-                       unsigned int proto_off,
                        int inverse);
 
         struct ip_vs_conn *
         (*conn_out_get)(int af,
                         const struct sk_buff *skb,
                         const struct ip_vs_iphdr *iph,
-                        unsigned int proto_off,
                         int inverse);
 
-        int (*snat_handler)(struct sk_buff *skb,
-                            struct ip_vs_protocol *pp, struct ip_vs_conn *cp);
+        int (*snat_handler)(struct sk_buff *skb, struct ip_vs_protocol *pp,
+                            struct ip_vs_conn *cp, struct ip_vs_iphdr *iph);
 
-        int (*dnat_handler)(struct sk_buff *skb,
-                            struct ip_vs_protocol *pp, struct ip_vs_conn *cp);
+        int (*dnat_handler)(struct sk_buff *skb, struct ip_vs_protocol *pp,
+                            struct ip_vs_conn *cp, struct ip_vs_iphdr *iph);
 
         int (*csum_check)(int af, struct sk_buff *skb,
                           struct ip_vs_protocol *pp);
@@ -518,7 +607,7 @@ struct ip_vs_conn {
            NF_ACCEPT can be returned when destination is local.
          */
         int (*packet_xmit)(struct sk_buff *skb, struct ip_vs_conn *cp,
-                           struct ip_vs_protocol *pp);
+                           struct ip_vs_protocol *pp, struct ip_vs_iphdr *iph);
 
         /* Note: we can group the following members into a structure,
            in order to save more space, and the following members are
@@ -769,13 +858,11 @@ struct ip_vs_app {
 
         struct ip_vs_conn *
         (*conn_in_get)(const struct sk_buff *skb, struct ip_vs_app *app,
-                       const struct iphdr *iph, unsigned int proto_off,
-                       int inverse);
+                       const struct iphdr *iph, int inverse);
 
         struct ip_vs_conn *
         (*conn_out_get)(const struct sk_buff *skb, struct ip_vs_app *app,
-                        const struct iphdr *iph, unsigned int proto_off,
-                        int inverse);
+                        const struct iphdr *iph, int inverse);
 
         int (*state_transition)(struct ip_vs_conn *cp, int direction,
                                 const struct sk_buff *skb,
@@ -1074,14 +1161,12 @@ struct ip_vs_conn *ip_vs_ct_in_get(const struct ip_vs_conn_param *p);
 
 struct ip_vs_conn * ip_vs_conn_in_get_proto(int af, const struct sk_buff *skb,
                                             const struct ip_vs_iphdr *iph,
-                                            unsigned int proto_off,
                                             int inverse);
 
 struct ip_vs_conn *ip_vs_conn_out_get(const struct ip_vs_conn_param *p);
 
 struct ip_vs_conn * ip_vs_conn_out_get_proto(int af, const struct sk_buff *skb,
                                              const struct ip_vs_iphdr *iph,
-                                             unsigned int proto_off,
                                              int inverse);
 
 /* put back the conn without restarting its timer */
@@ -1254,9 +1339,10 @@ extern struct ip_vs_scheduler *ip_vs_scheduler_get(const char *sched_name);
 extern void ip_vs_scheduler_put(struct ip_vs_scheduler *scheduler);
 extern struct ip_vs_conn *
 ip_vs_schedule(struct ip_vs_service *svc, struct sk_buff *skb,
-               struct ip_vs_proto_data *pd, int *ignored);
+               struct ip_vs_proto_data *pd, int *ignored,
+               struct ip_vs_iphdr *iph);
 extern int ip_vs_leave(struct ip_vs_service *svc, struct sk_buff *skb,
-                        struct ip_vs_proto_data *pd);
+                        struct ip_vs_proto_data *pd, struct ip_vs_iphdr *iph);
 
 extern void ip_vs_scheduler_err(struct ip_vs_service *svc, const char *msg);
 
@@ -1315,33 +1401,38 @@ extern void ip_vs_read_estimator(struct ip_vs_stats_user *dst,
 /*
  *      Various IPVS packet transmitters (from ip_vs_xmit.c)
  */
-extern int ip_vs_null_xmit
-(struct sk_buff *skb, struct ip_vs_conn *cp, struct ip_vs_protocol *pp);
-extern int ip_vs_bypass_xmit
-(struct sk_buff *skb, struct ip_vs_conn *cp, struct ip_vs_protocol *pp);
-extern int ip_vs_nat_xmit
-(struct sk_buff *skb, struct ip_vs_conn *cp, struct ip_vs_protocol *pp);
-extern int ip_vs_tunnel_xmit
-(struct sk_buff *skb, struct ip_vs_conn *cp, struct ip_vs_protocol *pp);
-extern int ip_vs_dr_xmit
-(struct sk_buff *skb, struct ip_vs_conn *cp, struct ip_vs_protocol *pp);
-extern int ip_vs_icmp_xmit
-(struct sk_buff *skb, struct ip_vs_conn *cp, struct ip_vs_protocol *pp,
- int offset, unsigned int hooknum);
+extern int ip_vs_null_xmit(struct sk_buff *skb, struct ip_vs_conn *cp,
+                           struct ip_vs_protocol *pp, struct ip_vs_iphdr *iph);
+extern int ip_vs_bypass_xmit(struct sk_buff *skb, struct ip_vs_conn *cp,
+                             struct ip_vs_protocol *pp,
+                             struct ip_vs_iphdr *iph);
+extern int ip_vs_nat_xmit(struct sk_buff *skb, struct ip_vs_conn *cp,
+                          struct ip_vs_protocol *pp, struct ip_vs_iphdr *iph);
+extern int ip_vs_tunnel_xmit(struct sk_buff *skb, struct ip_vs_conn *cp,
+                             struct ip_vs_protocol *pp,
+                             struct ip_vs_iphdr *iph);
+extern int ip_vs_dr_xmit(struct sk_buff *skb, struct ip_vs_conn *cp,
+                         struct ip_vs_protocol *pp, struct ip_vs_iphdr *iph);
+extern int ip_vs_icmp_xmit(struct sk_buff *skb, struct ip_vs_conn *cp,
+                           struct ip_vs_protocol *pp, int offset,
+                           unsigned int hooknum, struct ip_vs_iphdr *iph);
 extern void ip_vs_dst_reset(struct ip_vs_dest *dest);
 
 #ifdef CONFIG_IP_VS_IPV6
-extern int ip_vs_bypass_xmit_v6
-(struct sk_buff *skb, struct ip_vs_conn *cp, struct ip_vs_protocol *pp);
-extern int ip_vs_nat_xmit_v6
-(struct sk_buff *skb, struct ip_vs_conn *cp, struct ip_vs_protocol *pp);
-extern int ip_vs_tunnel_xmit_v6
-(struct sk_buff *skb, struct ip_vs_conn *cp, struct ip_vs_protocol *pp);
-extern int ip_vs_dr_xmit_v6
-(struct sk_buff *skb, struct ip_vs_conn *cp, struct ip_vs_protocol *pp);
-extern int ip_vs_icmp_xmit_v6
-(struct sk_buff *skb, struct ip_vs_conn *cp, struct ip_vs_protocol *pp,
- int offset, unsigned int hooknum);
+extern int ip_vs_bypass_xmit_v6(struct sk_buff *skb, struct ip_vs_conn *cp,
+                                struct ip_vs_protocol *pp,
+                                struct ip_vs_iphdr *iph);
+extern int ip_vs_nat_xmit_v6(struct sk_buff *skb, struct ip_vs_conn *cp,
+                             struct ip_vs_protocol *pp,
+                             struct ip_vs_iphdr *iph);
+extern int ip_vs_tunnel_xmit_v6(struct sk_buff *skb, struct ip_vs_conn *cp,
+                                struct ip_vs_protocol *pp,
+                                struct ip_vs_iphdr *iph);
+extern int ip_vs_dr_xmit_v6(struct sk_buff *skb, struct ip_vs_conn *cp,
+                            struct ip_vs_protocol *pp, struct ip_vs_iphdr *iph);
+extern int ip_vs_icmp_xmit_v6(struct sk_buff *skb, struct ip_vs_conn *cp,
+                              struct ip_vs_protocol *pp, int offset,
+                              unsigned int hooknum, struct ip_vs_iphdr *iph);
 #endif
 
 #ifdef CONFIG_SYSCTL
diff --git a/include/net/ipip.h b/include/net/ipip.h
index ddc077c51f32..21947cf4fa46 100644
--- a/include/net/ipip.h
+++ b/include/net/ipip.h
@@ -48,25 +48,27 @@ struct ip_tunnel_prl_entry {
         struct rcu_head                 rcu_head;
 };
 
-#define __IPTUNNEL_XMIT(stats1, stats2) do {                            \
-        int err;                                                        \
-        int pkt_len = skb->len - skb_transport_offset(skb);             \
-                                                                        \
-        skb->ip_summed = CHECKSUM_NONE;                                 \
-        ip_select_ident(iph, &rt->dst, NULL);                           \
-                                                                        \
-        err = ip_local_out(skb);                                        \
-        if (likely(net_xmit_eval(err) == 0)) {                          \
-                u64_stats_update_begin(&(stats1)->syncp);               \
-                (stats1)->tx_bytes += pkt_len;                          \
-                (stats1)->tx_packets++;                                 \
-                u64_stats_update_end(&(stats1)->syncp);                 \
-        } else {                                                        \
-                (stats2)->tx_errors++;                                  \
-                (stats2)->tx_aborted_errors++;                          \
-        }                                                               \
-} while (0)
+static inline void iptunnel_xmit(struct sk_buff *skb, struct net_device *dev)
+{
+        int err;
+        struct iphdr *iph = ip_hdr(skb);
+        int pkt_len = skb->len - skb_transport_offset(skb);
+        struct pcpu_tstats *tstats = this_cpu_ptr(dev->tstats);
 
-#define IPTUNNEL_XMIT() __IPTUNNEL_XMIT(txq, stats)
+        nf_reset(skb);
+        skb->ip_summed = CHECKSUM_NONE;
+        ip_select_ident(iph, skb_dst(skb), NULL);
+
+        err = ip_local_out(skb);
+        if (likely(net_xmit_eval(err) == 0)) {
+                u64_stats_update_begin(&tstats->syncp);
+                tstats->tx_bytes += pkt_len;
+                tstats->tx_packets++;
+                u64_stats_update_end(&tstats->syncp);
+        } else {
+                dev->stats.tx_errors++;
+                dev->stats.tx_aborted_errors++;
+        }
+}
 
 #endif
diff --git a/include/net/ipv6.h b/include/net/ipv6.h
index 979bf6c13141..5af66b26ebdd 100644
--- a/include/net/ipv6.h
+++ b/include/net/ipv6.h
@@ -271,6 +271,15 @@ struct ipv6_txoptions *ipv6_fixup_options(struct ipv6_txoptions *opt_space,
 
 extern bool ipv6_opt_accepted(const struct sock *sk, const struct sk_buff *skb);
 
+static inline bool ipv6_accept_ra(struct inet6_dev *idev)
+{
+        /* If forwarding is enabled, RA are not accepted unless the special
+         * hybrid mode (accept_ra=2) is enabled.
+         */
+        return idev->cnf.forwarding ? idev->cnf.accept_ra == 2 :
+            idev->cnf.accept_ra;
+}
+
 #if IS_ENABLED(CONFIG_IPV6)
 static inline int ip6_frag_nqueues(struct net *net)
 {
@@ -630,6 +639,16 @@ extern int			ipv6_skip_exthdr(const struct sk_buff *, int start,
 
 extern bool                     ipv6_ext_hdr(u8 nexthdr);
 
+enum {
+        IP6_FH_F_FRAG           = (1 << 0),
+        IP6_FH_F_AUTH           = (1 << 1),
+        IP6_FH_F_SKIP_RH        = (1 << 2),
+};
+
+/* find specified header and get offset to it */
+extern int ipv6_find_hdr(const struct sk_buff *skb, unsigned int *offset,
+                         int target, unsigned short *fragoff, int *fragflg);
+
 extern int ipv6_find_tlv(struct sk_buff *skb, int offset, int type);
 
 extern struct in6_addr *fl6_update_dst(struct flowi6 *fl6,
diff --git a/include/net/mac80211.h b/include/net/mac80211.h
index 82558c8decf8..ee50c5eba50c 100644
--- a/include/net/mac80211.h
+++ b/include/net/mac80211.h
@@ -144,6 +144,39 @@ struct ieee80211_low_level_stats {
 };
 
 /**
+ * enum ieee80211_chanctx_change - change flag for channel context
+ * @IEEE80211_CHANCTX_CHANGE_WIDTH: The channel width changed
+ * @IEEE80211_CHANCTX_CHANGE_RX_CHAINS: The number of RX chains changed
+ */
+enum ieee80211_chanctx_change {
+        IEEE80211_CHANCTX_CHANGE_WIDTH          = BIT(0),
+        IEEE80211_CHANCTX_CHANGE_RX_CHAINS      = BIT(1),
+};
+
+/**
+ * struct ieee80211_chanctx_conf - channel context that vifs may be tuned to
+ *
+ * This is the driver-visible part. The ieee80211_chanctx
+ * that contains it is visible in mac80211 only.
+ *
+ * @def: the channel definition
+ * @rx_chains_static: The number of RX chains that must always be
+ *      active on the channel to receive MIMO transmissions
+ * @rx_chains_dynamic: The number of RX chains that must be enabled
+ *      after RTS/CTS handshake to receive SMPS MIMO transmissions;
+ *      this will always be >= @rx_chains_static.
+ * @drv_priv: data area for driver use, will always be aligned to
+ *      sizeof(void *), size is determined in hw information.
+ */
+struct ieee80211_chanctx_conf {
+        struct cfg80211_chan_def def;
+
+        u8 rx_chains_static, rx_chains_dynamic;
+
+        u8 drv_priv[0] __attribute__((__aligned__(sizeof(void *))));
+};
+
+/**
  * enum ieee80211_bss_change - BSS change notification flags
  *
  * These flags are used with the bss_info_changed() callback
@@ -172,6 +205,9 @@ struct ieee80211_low_level_stats {
  * @BSS_CHANGED_SSID: SSID changed for this BSS (AP mode)
  * @BSS_CHANGED_AP_PROBE_RESP: Probe Response changed for this BSS (AP mode)
  * @BSS_CHANGED_PS: PS changed for this BSS (STA mode)
+ * @BSS_CHANGED_TXPOWER: TX power setting changed for this interface
+ * @BSS_CHANGED_P2P_PS: P2P powersave settings (CTWindow, opportunistic PS)
+ *      changed (currently only in P2P client mode, GO mode will be later)
  */
 enum ieee80211_bss_change {
         BSS_CHANGED_ASSOC               = 1<<0,
@@ -192,6 +228,8 @@ enum ieee80211_bss_change {
         BSS_CHANGED_SSID                = 1<<15,
         BSS_CHANGED_AP_PROBE_RESP       = 1<<16,
         BSS_CHANGED_PS                  = 1<<17,
+        BSS_CHANGED_TXPOWER             = 1<<18,
+        BSS_CHANGED_P2P_PS              = 1<<19,
 
         /* when adding here, make sure to change ieee80211_reconfig */
 };
@@ -223,6 +261,7 @@ enum ieee80211_rssi_event {
  * @assoc: association status
  * @ibss_joined: indicates whether this station is part of an IBSS
  *      or not
+ * @ibss_creator: indicates if a new IBSS network is being created
  * @aid: association ID number, valid only when @assoc is true
  * @use_cts_prot: use CTS protection
  * @use_short_preamble: use 802.11b short preamble;
@@ -247,9 +286,8 @@ enum ieee80211_rssi_event {
  * @mcast_rate: per-band multicast rate index + 1 (0: disabled)
  * @bssid: The BSSID for this BSS
  * @enable_beacon: whether beaconing should be enabled or not
- * @channel_type: Channel type for this BSS -- the hardware might be
- *      configured for HT40+ while this BSS only uses no-HT, for
- *      example.
+ * @chandef: Channel definition for this BSS -- the hardware might be
+ *      configured a higher bandwidth than this BSS uses, for example.
  * @ht_operation_mode: HT operation mode like in &struct ieee80211_ht_operation.
  *      This field is only valid when the channel type is one of the HT types.
  * @cqm_rssi_thold: Connection quality monitor RSSI threshold, a zero value
@@ -273,11 +311,15 @@ enum ieee80211_rssi_event {
  * @ssid: The SSID of the current vif. Only valid in AP-mode.
  * @ssid_len: Length of SSID given in @ssid.
  * @hidden_ssid: The SSID of the current vif is hidden. Only valid in AP-mode.
+ * @txpower: TX power in dBm
+ * @p2p_ctwindow: P2P CTWindow, only for P2P client interfaces
+ * @p2p_oppps: P2P opportunistic PS is enabled
  */
 struct ieee80211_bss_conf {
         const u8 *bssid;
         /* association related data */
         bool assoc, ibss_joined;
+        bool ibss_creator;
         u16 aid;
         /* erp related data */
         bool use_cts_prot;
@@ -294,7 +336,7 @@ struct ieee80211_bss_conf {
         u16 ht_operation_mode;
         s32 cqm_rssi_thold;
         u32 cqm_rssi_hyst;
-        enum nl80211_channel_type channel_type;
+        struct cfg80211_chan_def chandef;
         __be32 arp_addr_list[IEEE80211_BSS_ARP_ADDR_LIST_LEN];
         u8 arp_addr_cnt;
         bool arp_filter_enabled;
@@ -304,6 +346,9 @@ struct ieee80211_bss_conf {
         u8 ssid[IEEE80211_MAX_SSID_LEN];
         size_t ssid_len;
         bool hidden_ssid;
+        int txpower;
+        u8 p2p_ctwindow;
+        bool p2p_oppps;
 };
 
 /**
@@ -454,9 +499,14 @@ enum mac80211_tx_control_flags {
  *      This is set if the current BSS requires ERP protection.
  * @IEEE80211_TX_RC_USE_SHORT_PREAMBLE: Use short preamble.
  * @IEEE80211_TX_RC_MCS: HT rate.
+ * @IEEE80211_TX_RC_VHT_MCS: VHT MCS rate, in this case the idx field is split
+ *      into a higher 4 bits (Nss) and lower 4 bits (MCS number)
  * @IEEE80211_TX_RC_GREEN_FIELD: Indicates whether this rate should be used in
  *      Greenfield mode.
  * @IEEE80211_TX_RC_40_MHZ_WIDTH: Indicates if the Channel Width should be 40 MHz.
+ * @IEEE80211_TX_RC_80_MHZ_WIDTH: Indicates 80 MHz transmission
+ * @IEEE80211_TX_RC_160_MHZ_WIDTH: Indicates 160 MHz transmission
+ *      (80+80 isn't supported yet)
  * @IEEE80211_TX_RC_DUP_DATA: The frame should be transmitted on both of the
  *      adjacent 20 MHz channels, if the current channel type is
  *      NL80211_CHAN_HT40MINUS or NL80211_CHAN_HT40PLUS.
@@ -467,12 +517,15 @@ enum mac80211_rate_control_flags {
         IEEE80211_TX_RC_USE_CTS_PROTECT         = BIT(1),
         IEEE80211_TX_RC_USE_SHORT_PREAMBLE      = BIT(2),
 
-        /* rate index is an MCS rate number instead of an index */
+        /* rate index is an HT/VHT MCS instead of an index */
         IEEE80211_TX_RC_MCS                     = BIT(3),
         IEEE80211_TX_RC_GREEN_FIELD             = BIT(4),
         IEEE80211_TX_RC_40_MHZ_WIDTH            = BIT(5),
         IEEE80211_TX_RC_DUP_DATA                = BIT(6),
         IEEE80211_TX_RC_SHORT_GI                = BIT(7),
+        IEEE80211_TX_RC_VHT_MCS                 = BIT(8),
+        IEEE80211_TX_RC_80_MHZ_WIDTH            = BIT(9),
+        IEEE80211_TX_RC_160_MHZ_WIDTH           = BIT(10),
 };
 
 
@@ -515,10 +568,32 @@ enum mac80211_rate_control_flags {
  */
 struct ieee80211_tx_rate {
         s8 idx;
-        u8 count;
-        u8 flags;
+        u16 count:5,
+            flags:11;
 } __packed;
 
+#define IEEE80211_MAX_TX_RETRY          31
+
+static inline void ieee80211_rate_set_vht(struct ieee80211_tx_rate *rate,
+                                          u8 mcs, u8 nss)
+{
+        WARN_ON(mcs & ~0xF);
+        WARN_ON(nss & ~0x7);
+        rate->idx = (nss << 4) | mcs;
+}
+
+static inline u8
+ieee80211_rate_get_vht_mcs(const struct ieee80211_tx_rate *rate)
+{
+        return rate->idx & 0xF;
+}
+
+static inline u8
+ieee80211_rate_get_vht_nss(const struct ieee80211_tx_rate *rate)
+{
+        return rate->idx >> 4;
+}
+
 /**
  * struct ieee80211_tx_info - skb transmit information
  *
@@ -663,13 +738,20 @@ ieee80211_tx_info_clear_status(struct ieee80211_tx_info *info)
  *      the frame.
  * @RX_FLAG_FAILED_PLCP_CRC: Set this flag if the PCLP check failed on
  *      the frame.
- * @RX_FLAG_MACTIME_MPDU: The timestamp passed in the RX status (@mactime
+ * @RX_FLAG_MACTIME_START: The timestamp passed in the RX status (@mactime
  *      field) is valid and contains the time the first symbol of the MPDU
  *      was received. This is useful in monitor mode and for proper IBSS
  *      merging.
+ * @RX_FLAG_MACTIME_END: The timestamp passed in the RX status (@mactime
+ *      field) is valid and contains the time the last symbol of the MPDU
+ *      (including FCS) was received.
  * @RX_FLAG_SHORTPRE: Short preamble was used for this frame
  * @RX_FLAG_HT: HT MCS was used and rate_idx is MCS index
+ * @RX_FLAG_VHT: VHT MCS was used and rate_index is MCS index
  * @RX_FLAG_40MHZ: HT40 (40 MHz) was used
+ * @RX_FLAG_80MHZ: 80 MHz was used
+ * @RX_FLAG_80P80MHZ: 80+80 MHz was used
+ * @RX_FLAG_160MHZ: 160 MHz was used
  * @RX_FLAG_SHORT_GI: Short guard interval was used
  * @RX_FLAG_NO_SIGNAL_VAL: The signal strength value is not present.
  *      Valid only for data frames (mainly A-MPDU)
@@ -697,7 +779,7 @@ enum mac80211_rx_flags {
         RX_FLAG_IV_STRIPPED             = BIT(4),
         RX_FLAG_FAILED_FCS_CRC          = BIT(5),
         RX_FLAG_FAILED_PLCP_CRC         = BIT(6),
-        RX_FLAG_MACTIME_MPDU            = BIT(7),
+        RX_FLAG_MACTIME_START           = BIT(7),
         RX_FLAG_SHORTPRE                = BIT(8),
         RX_FLAG_HT                      = BIT(9),
         RX_FLAG_40MHZ                   = BIT(10),
@@ -711,6 +793,11 @@ enum mac80211_rx_flags {
         RX_FLAG_AMPDU_IS_LAST           = BIT(18),
         RX_FLAG_AMPDU_DELIM_CRC_ERROR   = BIT(19),
         RX_FLAG_AMPDU_DELIM_CRC_KNOWN   = BIT(20),
+        RX_FLAG_MACTIME_END             = BIT(21),
+        RX_FLAG_VHT                     = BIT(22),
+        RX_FLAG_80MHZ                   = BIT(23),
+        RX_FLAG_80P80MHZ                = BIT(24),
+        RX_FLAG_160MHZ                  = BIT(25),
 };
 
 /**
@@ -731,25 +818,39 @@ enum mac80211_rx_flags {
  *      @IEEE80211_HW_SIGNAL_*
  * @antenna: antenna used
  * @rate_idx: index of data rate into band's supported rates or MCS index if
- *      HT rates are use (RX_FLAG_HT)
+ *      HT or VHT is used (%RX_FLAG_HT/%RX_FLAG_VHT)
+ * @vht_nss: number of streams (VHT only)
  * @flag: %RX_FLAG_*
  * @rx_flags: internal RX flags for mac80211
  * @ampdu_reference: A-MPDU reference number, must be a different value for
  *      each A-MPDU but the same for each subframe within one A-MPDU
  * @ampdu_delimiter_crc: A-MPDU delimiter CRC
+ * @vendor_radiotap_bitmap: radiotap vendor namespace presence bitmap
+ * @vendor_radiotap_len: radiotap vendor namespace length
+ * @vendor_radiotap_align: radiotap vendor namespace alignment. Note
+ *      that the actual data must be at the start of the SKB data
+ *      already.
+ * @vendor_radiotap_oui: radiotap vendor namespace OUI
+ * @vendor_radiotap_subns: radiotap vendor sub namespace
  */
 struct ieee80211_rx_status {
         u64 mactime;
         u32 device_timestamp;
         u32 ampdu_reference;
         u32 flag;
+        u32 vendor_radiotap_bitmap;
+        u16 vendor_radiotap_len;
         u16 freq;
         u8 rate_idx;
+        u8 vht_nss;
         u8 rx_flags;
         u8 band;
         u8 antenna;
         s8 signal;
         u8 ampdu_delimiter_crc;
+        u8 vendor_radiotap_align;
+        u8 vendor_radiotap_oui[3];
+        u8 vendor_radiotap_subns;
 };
 
 /**
@@ -794,6 +895,8 @@ enum ieee80211_conf_flags {
  * @IEEE80211_CONF_CHANGE_RETRY_LIMITS: retry limits changed
  * @IEEE80211_CONF_CHANGE_IDLE: Idle flag changed
  * @IEEE80211_CONF_CHANGE_SMPS: Spatial multiplexing powersave mode changed
+ *      Note that this is only valid if channel contexts are not used,
+ *      otherwise each channel context has the number of chains listed.
  */
 enum ieee80211_conf_changed {
         IEEE80211_CONF_CHANGE_SMPS              = BIT(1),
@@ -845,7 +948,8 @@ enum ieee80211_smps_mode {
  *      powersave documentation below. This variable is valid only when
  *      the CONF_PS flag is set.
  *
- * @power_level: requested transmit power (in dBm)
+ * @power_level: requested transmit power (in dBm), backward compatibility
+ *      value only that is set to the minimum of all interfaces
  *
  * @channel: the channel to tune to
  * @channel_type: the channel (HT) type
@@ -859,7 +963,9 @@ enum ieee80211_smps_mode {
  *
  * @smps_mode: spatial multiplexing powersave mode; note that
  *      %IEEE80211_SMPS_STATIC is used when the device is not
- *      configured for an HT channel
+ *      configured for an HT channel.
+ *      Note that this is only valid if channel contexts are not used,
+ *      otherwise each channel context has the number of chains listed.
  */
 struct ieee80211_conf {
         u32 flags;
@@ -931,6 +1037,11 @@ enum ieee80211_vif_flags {
  *      at runtime, mac80211 will never touch this field
  * @hw_queue: hardware queue for each AC
  * @cab_queue: content-after-beacon (DTIM beacon really) queue, AP mode only
+ * @chanctx_conf: The channel context this interface is assigned to, or %NULL
+ *      when it is not assigned. This pointer is RCU-protected due to the TX
+ *      path needing to access it; even though the netdev carrier will always
+ *      be off when it is %NULL there can still be races and packets could be
+ *      processed after it switches back to %NULL.
  * @drv_priv: data area for driver use, will always be aligned to
  *      sizeof(void *).
  */
@@ -943,6 +1054,8 @@ struct ieee80211_vif {
         u8 cab_queue;
         u8 hw_queue[IEEE80211_NUM_ACS];
 
+        struct ieee80211_chanctx_conf __rcu *chanctx_conf;
+
         u32 driver_flags;
 
         /* must be last */
@@ -1076,6 +1189,8 @@ enum ieee80211_sta_state {
  * @aid: AID we assigned to the station if we're an AP
  * @supp_rates: Bitmap of supported rates (per band)
  * @ht_cap: HT capabilities of this STA; restricted to our own TX capabilities
+ * @vht_cap: VHT capabilities of this STA; Not restricting any capabilities
+ *      of remote STA. Taking as is.
  * @wme: indicates whether the STA supports WME. Only valid during AP-mode.
  * @drv_priv: data area for driver use, will always be aligned to
  *      sizeof(void *), size is determined in hw information.
@@ -1088,6 +1203,7 @@ struct ieee80211_sta {
         u8 addr[ETH_ALEN];
         u16 aid;
         struct ieee80211_sta_ht_cap ht_cap;
+        struct ieee80211_sta_vht_cap vht_cap;
         bool wme;
         u8 uapsd_queues;
         u8 max_sp;
@@ -1253,6 +1369,10 @@ struct ieee80211_tx_control {
  * @IEEE80211_HW_P2P_DEV_ADDR_FOR_INTF: Use the P2P Device address for any
  *      P2P Interface. This will be honoured even if more than one interface
  *      is supported.
+ *
+ * @IEEE80211_HW_TEARDOWN_AGGR_ON_BAR_FAIL: On this hardware TX BA session
+ *      should be tear down once BAR frame will not be acked.
+ *
  */
 enum ieee80211_hw_flags {
         IEEE80211_HW_HAS_RATE_CONTROL                   = 1<<0,
@@ -1281,6 +1401,7 @@ enum ieee80211_hw_flags {
         IEEE80211_HW_TX_AMPDU_SETUP_IN_HW               = 1<<23,
         IEEE80211_HW_SCAN_WHILE_IDLE                    = 1<<24,
         IEEE80211_HW_P2P_DEV_ADDR_FOR_INTF              = 1<<25,
+        IEEE80211_HW_TEARDOWN_AGGR_ON_BAR_FAIL          = 1<<26,
 };
 
 /**
@@ -1325,6 +1446,8 @@ enum ieee80211_hw_flags {
  *      within &struct ieee80211_vif.
  * @sta_data_size: size (in bytes) of the drv_priv data area
  *      within &struct ieee80211_sta.
+ * @chanctx_data_size: size (in bytes) of the drv_priv data area
+ *      within &struct ieee80211_chanctx_conf.
  *
  * @max_rates: maximum number of alternate rate retry stages the hw
  *      can handle.
@@ -1355,6 +1478,10 @@ enum ieee80211_hw_flags {
  *      include _FMT. Use %IEEE80211_RADIOTAP_MCS_HAVE_* values, only
  *      adding _BW is supported today.
  *
+ * @radiotap_vht_details: lists which VHT MCS information the HW reports,
+ *      the default is _GI | _BANDWIDTH.
+ *      Use the %IEEE80211_RADIOTAP_VHT_KNOWN_* values.
+ *
  * @netdev_features: netdev features to be set in each netdev created
  *      from this HW. Note only HW checksum features are currently
  *      compatible with mac80211. Other feature bits will be rejected.
@@ -1369,6 +1496,7 @@ struct ieee80211_hw {
         int channel_change_time;
         int vif_data_size;
         int sta_data_size;
+        int chanctx_data_size;
         int napi_weight;
         u16 queues;
         u16 max_listen_interval;
@@ -1380,6 +1508,7 @@ struct ieee80211_hw {
         u8 max_tx_aggregation_subframes;
         u8 offchannel_tx_hw_queue;
         u8 radiotap_mcs_details;
+        u16 radiotap_vht_details;
         netdev_features_t netdev_features;
 };
 
@@ -2126,6 +2255,14 @@ enum ieee80211_rate_control_changed {
  * @sta_remove: Notifies low level driver about removal of an associated
  *      station, AP, IBSS/WDS/mesh peer etc. This callback can sleep.
  *
+ * @sta_add_debugfs: Drivers can use this callback to add debugfs files
+ *      when a station is added to mac80211's station list. This callback
+ *      and @sta_remove_debugfs should be within a CONFIG_MAC80211_DEBUGFS
+ *      conditional. This callback can sleep.
+ *
+ * @sta_remove_debugfs: Remove the debugfs files which were added using
+ *      @sta_add_debugfs. This callback can sleep.
+ *
  * @sta_notify: Notifies low level driver about power state transition of an
  *      associated station, AP,  IBSS/WDS/mesh peer etc. For a VIF operating
  *      in AP mode, this callback will not be called when the flag
@@ -2317,6 +2454,27 @@ enum ieee80211_rate_control_changed {
  *      The callback will be called before each transmission and upon return
  *      mac80211 will transmit the frame right away.
  *      The callback is optional and can (should!) sleep.
+ *
+ * @add_chanctx: Notifies device driver about new channel context creation.
+ * @remove_chanctx: Notifies device driver about channel context destruction.
+ * @change_chanctx: Notifies device driver about channel context changes that
+ *      may happen when combining different virtual interfaces on the same
+ *      channel context with different settings
+ * @assign_vif_chanctx: Notifies device driver about channel context being bound
+ *      to vif. Possible use is for hw queue remapping.
+ * @unassign_vif_chanctx: Notifies device driver about channel context being
+ *      unbound from vif.
+ * @start_ap: Start operation on the AP interface, this is called after all the
+ *      information in bss_conf is set and beacon can be retrieved. A channel
+ *      context is bound before this is called. Note that if the driver uses
+ *      software scan or ROC, this (and @stop_ap) isn't called when the AP is
+ *      just "paused" for scanning/ROC, which is indicated by the beacon being
+ *      disabled/enabled via @bss_info_changed.
+ * @stop_ap: Stop operation on the AP interface.
+ *
+ * @restart_complete: Called after a call to ieee80211_restart_hw(), when the
+ *      reconfiguration has completed. This can help the driver implement the
+ *      reconfiguration step. This callback may sleep.
  */
 struct ieee80211_ops {
         void (*tx)(struct ieee80211_hw *hw,
@@ -2342,6 +2500,9 @@ struct ieee80211_ops {
                                  struct ieee80211_bss_conf *info,
                                  u32 changed);
 
+        int (*start_ap)(struct ieee80211_hw *hw, struct ieee80211_vif *vif);
+        void (*stop_ap)(struct ieee80211_hw *hw, struct ieee80211_vif *vif);
+
         u64 (*prepare_multicast)(struct ieee80211_hw *hw,
                                  struct netdev_hw_addr_list *mc_list);
         void (*configure_filter)(struct ieee80211_hw *hw,
@@ -2383,6 +2544,16 @@ struct ieee80211_ops {
                        struct ieee80211_sta *sta);
         int (*sta_remove)(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
                           struct ieee80211_sta *sta);
+#ifdef CONFIG_MAC80211_DEBUGFS
+        void (*sta_add_debugfs)(struct ieee80211_hw *hw,
+                                struct ieee80211_vif *vif,
+                                struct ieee80211_sta *sta,
+                                struct dentry *dir);
+        void (*sta_remove_debugfs)(struct ieee80211_hw *hw,
+                                   struct ieee80211_vif *vif,
+                                   struct ieee80211_sta *sta,
+                                   struct dentry *dir);
+#endif
         void (*sta_notify)(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
                         enum sta_notify_cmd, struct ieee80211_sta *sta);
         int (*sta_state)(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
@@ -2424,8 +2595,8 @@ struct ieee80211_ops {
         int (*get_antenna)(struct ieee80211_hw *hw, u32 *tx_ant, u32 *rx_ant);
 
         int (*remain_on_channel)(struct ieee80211_hw *hw,
+                                 struct ieee80211_vif *vif,
                                  struct ieee80211_channel *chan,
-                                 enum nl80211_channel_type channel_type,
                                  int duration);
         int (*cancel_remain_on_channel)(struct ieee80211_hw *hw);
         int (*set_ringparam)(struct ieee80211_hw *hw, u32 tx, u32 rx);
@@ -2461,6 +2632,22 @@ struct ieee80211_ops {
 
         void    (*mgd_prepare_tx)(struct ieee80211_hw *hw,
                                   struct ieee80211_vif *vif);
+
+        int (*add_chanctx)(struct ieee80211_hw *hw,
+                           struct ieee80211_chanctx_conf *ctx);
+        void (*remove_chanctx)(struct ieee80211_hw *hw,
+                               struct ieee80211_chanctx_conf *ctx);
+        void (*change_chanctx)(struct ieee80211_hw *hw,
+                               struct ieee80211_chanctx_conf *ctx,
+                               u32 changed);
+        int (*assign_vif_chanctx)(struct ieee80211_hw *hw,
+                                  struct ieee80211_vif *vif,
+                                  struct ieee80211_chanctx_conf *ctx);
+        void (*unassign_vif_chanctx)(struct ieee80211_hw *hw,
+                                     struct ieee80211_vif *vif,
+                                     struct ieee80211_chanctx_conf *ctx);
+
+        void (*restart_complete)(struct ieee80211_hw *hw);
 };
 
 /**
@@ -2962,8 +3149,7 @@ struct sk_buff *ieee80211_nullfunc_get(struct ieee80211_hw *hw,
  * @vif: &struct ieee80211_vif pointer from the add_interface callback.
  * @ssid: SSID buffer
  * @ssid_len: length of SSID
- * @ie: buffer containing all IEs except SSID for the template
- * @ie_len: length of the IE buffer
+ * @tailroom: tailroom to reserve at end of SKB for IEs
  *
  * Creates a Probe Request template which can, for example, be uploaded to
  * hardware.
@@ -2971,7 +3157,7 @@ struct sk_buff *ieee80211_nullfunc_get(struct ieee80211_hw *hw,
 struct sk_buff *ieee80211_probereq_get(struct ieee80211_hw *hw,
                                        struct ieee80211_vif *vif,
                                        const u8 *ssid, size_t ssid_len,
-                                       const u8 *ie, size_t ie_len);
+                                       size_t tailroom);
 
 /**
  * ieee80211_rts_get - RTS frame generation function
@@ -3145,6 +3331,19 @@ void ieee80211_get_tkip_p2k(struct ieee80211_key_conf *keyconf,
                             struct sk_buff *skb, u8 *p2k);
 
 /**
+ * ieee80211_aes_cmac_calculate_k1_k2 - calculate the AES-CMAC sub keys
+ *
+ * This function computes the two AES-CMAC sub-keys, based on the
+ * previously installed master key.
+ *
+ * @keyconf: the parameter passed with the set key
+ * @k1: a buffer to be filled with the 1st sub-key
+ * @k2: a buffer to be filled with the 2nd sub-key
+ */
+void ieee80211_aes_cmac_calculate_k1_k2(struct ieee80211_key_conf *keyconf,
+                                        u8 *k1, u8 *k2);
+
+/**
  * struct ieee80211_key_seq - key sequence counter
  *
  * @tkip: TKIP data, containing IV32 and IV16 in host byte order
@@ -3294,6 +3493,21 @@ void ieee80211_sched_scan_results(struct ieee80211_hw *hw);
 void ieee80211_sched_scan_stopped(struct ieee80211_hw *hw);
 
 /**
+ * enum ieee80211_interface_iteration_flags - interface iteration flags
+ * @IEEE80211_IFACE_ITER_NORMAL: Iterate over all interfaces that have
+ *      been added to the driver; However, note that during hardware
+ *      reconfiguration (after restart_hw) it will iterate over a new
+ *      interface and over all the existing interfaces even if they
+ *      haven't been re-added to the driver yet.
+ * @IEEE80211_IFACE_ITER_RESUME_ALL: During resume, iterate over all
+ *      interfaces, even if they haven't been re-added to the driver yet.
+ */
+enum ieee80211_interface_iteration_flags {
+        IEEE80211_IFACE_ITER_NORMAL     = 0,
+        IEEE80211_IFACE_ITER_RESUME_ALL = BIT(0),
+};
+
+/**
  * ieee80211_iterate_active_interfaces - iterate active interfaces
  *
  * This function iterates over the interfaces associated with a given
@@ -3301,13 +3515,15 @@ void ieee80211_sched_scan_stopped(struct ieee80211_hw *hw);
  * This function allows the iterator function to sleep, when the iterator
  * function is atomic @ieee80211_iterate_active_interfaces_atomic can
  * be used.
- * Does not iterate over a new interface during add_interface()
+ * Does not iterate over a new interface during add_interface().
  *
  * @hw: the hardware struct of which the interfaces should be iterated over
+ * @iter_flags: iteration flags, see &enum ieee80211_interface_iteration_flags
  * @iterator: the iterator function to call
  * @data: first argument of the iterator function
  */
 void ieee80211_iterate_active_interfaces(struct ieee80211_hw *hw,
+                                         u32 iter_flags,
                                          void (*iterator)(void *data, u8 *mac,
                                                 struct ieee80211_vif *vif),
                                          void *data);
@@ -3319,13 +3535,15 @@ void ieee80211_iterate_active_interfaces(struct ieee80211_hw *hw,
  * hardware that are currently active and calls the callback for them.
  * This function requires the iterator callback function to be atomic,
  * if that is not desired, use @ieee80211_iterate_active_interfaces instead.
- * Does not iterate over a new interface during add_interface()
+ * Does not iterate over a new interface during add_interface().
  *
  * @hw: the hardware struct of which the interfaces should be iterated over
+ * @iter_flags: iteration flags, see &enum ieee80211_interface_iteration_flags
  * @iterator: the iterator function to call, cannot sleep
  * @data: first argument of the iterator function
  */
 void ieee80211_iterate_active_interfaces_atomic(struct ieee80211_hw *hw,
+                                                u32 iter_flags,
                                                 void (*iterator)(void *data,
                                                     u8 *mac,
                                                     struct ieee80211_vif *vif),
@@ -3524,6 +3742,27 @@ void ieee80211_iter_keys(struct ieee80211_hw *hw,
                          void *iter_data);
 
 /**
+ * ieee80211_iter_chan_contexts_atomic - iterate channel contexts
+ * @hw: pointre obtained from ieee80211_alloc_hw().
+ * @iter: iterator function
+ * @iter_data: data passed to iterator function
+ *
+ * Iterate all active channel contexts. This function is atomic and
+ * doesn't acquire any locks internally that might be held in other
+ * places while calling into the driver.
+ *
+ * The iterator will not find a context that's being added (during
+ * the driver callback to add it) but will find it while it's being
+ * removed.
+ */
+void ieee80211_iter_chan_contexts_atomic(
+        struct ieee80211_hw *hw,
+        void (*iter)(struct ieee80211_hw *hw,
+                     struct ieee80211_chanctx_conf *chanctx_conf,
+                     void *data),
+        void *iter_data);
+
+/**
  * ieee80211_ap_probereq_get - retrieve a Probe Request template
  * @hw: pointer obtained from ieee80211_alloc_hw().
  * @vif: &struct ieee80211_vif pointer from the add_interface callback.
diff --git a/include/net/ndisc.h b/include/net/ndisc.h
index 980d263765cf..7af1ea893038 100644
--- a/include/net/ndisc.h
+++ b/include/net/ndisc.h
@@ -190,21 +190,6 @@ extern void			ndisc_send_redirect(struct sk_buff *skb,
 extern int                      ndisc_mc_map(const struct in6_addr *addr, char *buf,
                                              struct net_device *dev, int dir);
 
-extern struct sk_buff           *ndisc_build_skb(struct net_device *dev,
-                                                 const struct in6_addr *daddr,
-                                                 const struct in6_addr *saddr,
-                                                 struct icmp6hdr *icmp6h,
-                                                 const struct in6_addr *target,
-                                                 int llinfo);
-
-extern void                     ndisc_send_skb(struct sk_buff *skb,
-                                               struct net_device *dev,
-                                               struct neighbour *neigh,
-                                               const struct in6_addr *daddr,
-                                               const struct in6_addr *saddr,
-                                               struct icmp6hdr *icmp6h);
-
-
 
 /*
  *      IGMP
diff --git a/include/net/net_namespace.h b/include/net/net_namespace.h
index 95e646641184..c5a43f56b796 100644
--- a/include/net/net_namespace.h
+++ b/include/net/net_namespace.h
@@ -23,6 +23,7 @@
 #endif
 #include <net/netns/xfrm.h>
 
+struct user_namespace;
 struct proc_dir_entry;
 struct net_device;
 struct sock;
@@ -53,6 +54,8 @@ struct net {
         struct list_head        cleanup_list;   /* namespaces on death row */
         struct list_head        exit_list;      /* Use only net_mutex */
 
+        struct user_namespace   *user_ns;       /* Owning user namespace */
+
         struct proc_dir_entry   *proc_net;
         struct proc_dir_entry   *proc_net_stat;
 
@@ -126,16 +129,21 @@ struct net {
 /* Init's network namespace */
 extern struct net init_net;
 
-#ifdef CONFIG_NET
-extern struct net *copy_net_ns(unsigned long flags, struct net *net_ns);
-
-#else /* CONFIG_NET */
-static inline struct net *copy_net_ns(unsigned long flags, struct net *net_ns)
+#ifdef CONFIG_NET_NS
+extern struct net *copy_net_ns(unsigned long flags,
+        struct user_namespace *user_ns, struct net *old_net);
+
+#else /* CONFIG_NET_NS */
+#include <linux/sched.h>
+#include <linux/nsproxy.h>
+static inline struct net *copy_net_ns(unsigned long flags,
+        struct user_namespace *user_ns, struct net *old_net)
 {
-        /* There is nothing to copy so this is a noop */
-        return net_ns;
+        if (flags & CLONE_NEWNET)
+                return ERR_PTR(-EINVAL);
+        return old_net;
 }
-#endif /* CONFIG_NET */
+#endif /* CONFIG_NET_NS */
 
 
 extern struct list_head net_namespace_list;
diff --git a/include/net/netfilter/nf_conntrack.h b/include/net/netfilter/nf_conntrack.h
index f1494feba79f..caca0c4d6b4b 100644
--- a/include/net/netfilter/nf_conntrack.h
+++ b/include/net/netfilter/nf_conntrack.h
@@ -182,7 +182,7 @@ __nf_conntrack_find(struct net *net, u16 zone,
 
 extern int nf_conntrack_hash_check_insert(struct nf_conn *ct);
 extern void nf_ct_delete_from_lists(struct nf_conn *ct);
-extern void nf_ct_insert_dying_list(struct nf_conn *ct);
+extern void nf_ct_dying_timeout(struct nf_conn *ct);
 
 extern void nf_conntrack_flush_report(struct net *net, u32 pid, int report);
 
diff --git a/include/net/netfilter/nf_nat.h b/include/net/netfilter/nf_nat.h
index bd8eea720f2e..ad14a799fd2e 100644
--- a/include/net/netfilter/nf_nat.h
+++ b/include/net/netfilter/nf_nat.h
@@ -68,4 +68,19 @@ static inline struct nf_conn_nat *nfct_nat(const struct nf_conn *ct)
 #endif
 }
 
+static inline bool nf_nat_oif_changed(unsigned int hooknum,
+                                      enum ip_conntrack_info ctinfo,
+                                      struct nf_conn_nat *nat,
+                                      const struct net_device *out)
+{
+#if IS_ENABLED(CONFIG_IP_NF_TARGET_MASQUERADE) || \
+    IS_ENABLED(CONFIG_IP6_NF_TARGET_MASQUERADE)
+        return nat->masq_index && hooknum == NF_INET_POST_ROUTING &&
+               CTINFO2DIR(ctinfo) == IP_CT_DIR_ORIGINAL &&
+               nat->masq_index != out->ifindex;
+#else
+        return false;
+#endif
+}
+
 #endif
diff --git a/include/net/netfilter/nf_queue.h b/include/net/netfilter/nf_queue.h
index 252fd1010b77..fb1c0be38b6d 100644
--- a/include/net/netfilter/nf_queue.h
+++ b/include/net/netfilter/nf_queue.h
@@ -21,14 +21,10 @@ struct nf_queue_entry {
 struct nf_queue_handler {
         int                     (*outfn)(struct nf_queue_entry *entry,
                                          unsigned int queuenum);
-        char                    *name;
 };
 
-extern int nf_register_queue_handler(u_int8_t pf,
-                                     const struct nf_queue_handler *qh);
-extern int nf_unregister_queue_handler(u_int8_t pf,
-                                       const struct nf_queue_handler *qh);
-extern void nf_unregister_queue_handlers(const struct nf_queue_handler *qh);
+void nf_register_queue_handler(const struct nf_queue_handler *qh);
+void nf_unregister_queue_handler(void);
 extern void nf_reinject(struct nf_queue_entry *entry, unsigned int verdict);
 
 #endif /* _NF_QUEUE_H */
diff --git a/include/net/netns/sctp.h b/include/net/netns/sctp.h
index 5e5eb1f9f14b..3573a81815ad 100644
--- a/include/net/netns/sctp.h
+++ b/include/net/netns/sctp.h
@@ -62,6 +62,9 @@ struct netns_sctp {
         /* Whether Cookie Preservative is enabled(1) or not(0) */
         int cookie_preserve_enable;
 
+        /* The namespace default hmac alg */
+        char *sctp_hmac_alg;
+
         /* Valid.Cookie.Life        - 60  seconds  */
         unsigned int valid_cookie_life;
 
diff --git a/include/net/nfc/hci.h b/include/net/nfc/hci.h
index e900072950cb..671953e11575 100644
--- a/include/net/nfc/hci.h
+++ b/include/net/nfc/hci.h
@@ -24,6 +24,12 @@
 
 #include <net/nfc/nfc.h>
 
+struct nfc_phy_ops {
+        int (*write)(void *dev_id, struct sk_buff *skb);
+        int (*enable)(void *dev_id);
+        void (*disable)(void *dev_id);
+};
+
 struct nfc_hci_dev;
 
 struct nfc_hci_ops {
@@ -38,15 +44,21 @@ struct nfc_hci_ops {
         int (*xmit) (struct nfc_hci_dev *hdev, struct sk_buff *skb);
         int (*start_poll) (struct nfc_hci_dev *hdev,
                            u32 im_protocols, u32 tm_protocols);
+        int (*dep_link_up)(struct nfc_hci_dev *hdev, struct nfc_target *target,
+                           u8 comm_mode, u8 *gb, size_t gb_len);
+        int (*dep_link_down)(struct nfc_hci_dev *hdev);
         int (*target_from_gate) (struct nfc_hci_dev *hdev, u8 gate,
                                  struct nfc_target *target);
         int (*complete_target_discovered) (struct nfc_hci_dev *hdev, u8 gate,
                                            struct nfc_target *target);
-        int (*data_exchange) (struct nfc_hci_dev *hdev,
+        int (*im_transceive) (struct nfc_hci_dev *hdev,
                               struct nfc_target *target, struct sk_buff *skb,
                               data_exchange_cb_t cb, void *cb_context);
+        int (*tm_send)(struct nfc_hci_dev *hdev, struct sk_buff *skb);
         int (*check_presence)(struct nfc_hci_dev *hdev,
                               struct nfc_target *target);
+        void (*event_received)(struct nfc_hci_dev *hdev, u8 gate, u8 event,
+                                struct sk_buff *skb);
 };
 
 /* Pipes */
@@ -114,6 +126,9 @@ struct nfc_hci_dev {
         int async_cb_type;
         data_exchange_cb_t async_cb;
         void *async_cb_context;
+
+        u8 *gb;
+        size_t gb_len;
 };
 
 /* hci device allocation */
@@ -134,6 +149,8 @@ void *nfc_hci_get_clientdata(struct nfc_hci_dev *hdev);
 
 void nfc_hci_driver_failure(struct nfc_hci_dev *hdev, int err);
 
+int nfc_hci_result_to_errno(u8 result);
+
 /* Host IDs */
 #define NFC_HCI_HOST_CONTROLLER_ID      0x00
 #define NFC_HCI_TERMINAL_HOST_ID        0x01
@@ -219,5 +236,7 @@ int nfc_hci_send_response(struct nfc_hci_dev *hdev, u8 gate, u8 response,
                           const u8 *param, size_t param_len);
 int nfc_hci_send_event(struct nfc_hci_dev *hdev, u8 gate, u8 event,
                        const u8 *param, size_t param_len);
+int nfc_hci_target_discovered(struct nfc_hci_dev *hdev, u8 gate);
+u32 nfc_hci_sak_to_protocol(u8 sak);
 
 #endif /* __NET_HCI_H */
diff --git a/include/net/nfc/nfc.h b/include/net/nfc/nfc.h
index f05b10682c9d..fce80b2f9be7 100644
--- a/include/net/nfc/nfc.h
+++ b/include/net/nfc/nfc.h
@@ -95,7 +95,7 @@ struct nfc_genl_data {
 };
 
 struct nfc_dev {
-        unsigned int idx;
+        int idx;
         u32 target_next_idx;
         struct nfc_target *targets;
         int n_targets;
diff --git a/include/net/protocol.h b/include/net/protocol.h
index 929528c73fe8..047c0476c0a0 100644
--- a/include/net/protocol.h
+++ b/include/net/protocol.h
@@ -25,9 +25,11 @@
 #define _PROTOCOL_H
 
 #include <linux/in6.h>
+#include <linux/skbuff.h>
 #if IS_ENABLED(CONFIG_IPV6)
 #include <linux/ipv6.h>
 #endif
+#include <linux/netdevice.h>
 
 /* This is one larger than the largest protocol value that can be
  * found in an ipv4 or ipv6 header.  Since in both cases the protocol
@@ -40,12 +42,6 @@ struct net_protocol {
         void                    (*early_demux)(struct sk_buff *skb);
         int                     (*handler)(struct sk_buff *skb);
         void                    (*err_handler)(struct sk_buff *skb, u32 info);
-        int                     (*gso_send_check)(struct sk_buff *skb);
-        struct sk_buff         *(*gso_segment)(struct sk_buff *skb,
-                                               netdev_features_t features);
-        struct sk_buff        **(*gro_receive)(struct sk_buff **head,
-                                               struct sk_buff *skb);
-        int                     (*gro_complete)(struct sk_buff *skb);
         unsigned int            no_policy:1,
                                 netns_ok:1;
 };
@@ -60,23 +56,20 @@ struct inet6_protocol {
                                struct inet6_skb_parm *opt,
                                u8 type, u8 code, int offset,
                                __be32 info);
-
-        int     (*gso_send_check)(struct sk_buff *skb);
-        struct sk_buff *(*gso_segment)(struct sk_buff *skb,
-                                       netdev_features_t features);
-        struct sk_buff **(*gro_receive)(struct sk_buff **head,
-                                        struct sk_buff *skb);
-        int     (*gro_complete)(struct sk_buff *skb);
-
         unsigned int    flags;  /* INET6_PROTO_xxx */
 };
 
 #define INET6_PROTO_NOPOLICY    0x1
 #define INET6_PROTO_FINAL       0x2
-/* This should be set for any extension header which is compatible with GSO. */
-#define INET6_PROTO_GSO_EXTHDR  0x4
 #endif
 
+struct net_offload {
+        struct offload_callbacks callbacks;
+        unsigned int             flags; /* Flags used by IPv6 for now */
+};
+/* This should be set for any extension header which is compatible with GSO. */
+#define INET6_PROTO_GSO_EXTHDR  0x1
+
 /* This is used to register socket interfaces for IP protocols.  */
 struct inet_protosw {
         struct list_head list;
@@ -96,6 +89,8 @@ struct inet_protosw {
 #define INET_PROTOSW_ICSK      0x04  /* Is this an inet_connection_sock? */
 
 extern const struct net_protocol __rcu *inet_protos[MAX_INET_PROTOS];
+extern const struct net_offload __rcu *inet_offloads[MAX_INET_PROTOS];
+extern const struct net_offload __rcu *inet6_offloads[MAX_INET_PROTOS];
 
 #if IS_ENABLED(CONFIG_IPV6)
 extern const struct inet6_protocol __rcu *inet6_protos[MAX_INET_PROTOS];
@@ -103,6 +98,8 @@ extern const struct inet6_protocol __rcu *inet6_protos[MAX_INET_PROTOS];
 
 extern int      inet_add_protocol(const struct net_protocol *prot, unsigned char num);
 extern int      inet_del_protocol(const struct net_protocol *prot, unsigned char num);
+extern int      inet_add_offload(const struct net_offload *prot, unsigned char num);
+extern int      inet_del_offload(const struct net_offload *prot, unsigned char num);
 extern void     inet_register_protosw(struct inet_protosw *p);
 extern void     inet_unregister_protosw(struct inet_protosw *p);
 
@@ -112,5 +109,7 @@ extern int	inet6_del_protocol(const struct inet6_protocol *prot, unsigned char n
 extern int      inet6_register_protosw(struct inet_protosw *p);
 extern void     inet6_unregister_protosw(struct inet_protosw *p);
 #endif
+extern int      inet6_add_offload(const struct net_offload *prot, unsigned char num);
+extern int      inet6_del_offload(const struct net_offload *prot, unsigned char num);
 
 #endif  /* _PROTOCOL_H */
diff --git a/include/net/request_sock.h b/include/net/request_sock.h
index b01d8dd9ee7c..a51dbd17c2de 100644
--- a/include/net/request_sock.h
+++ b/include/net/request_sock.h
@@ -49,13 +49,16 @@ struct request_sock_ops {
                                            struct request_sock *req);
 };
 
+extern int inet_rtx_syn_ack(struct sock *parent, struct request_sock *req);
+
 /* struct request_sock - mini sock to represent a connection request
  */
 struct request_sock {
         struct request_sock             *dl_next; /* Must be first member! */
         u16                             mss;
-        u8                              retrans;
-        u8                              cookie_ts; /* syncookie: encode tcpopts in timestamp */
+        u8                              num_retrans; /* number of retransmits */
+        u8                              cookie_ts:1; /* syncookie: encode tcpopts in timestamp */
+        u8                              num_timeout:7; /* number of timeouts */
         /* The following two fields can be easily recomputed I think -AK */
         u32                             window_clamp; /* window clamp at creation time */
         u32                             rcv_wnd;          /* rcv_wnd offered first time */
@@ -231,7 +234,7 @@ static inline int reqsk_queue_removed(struct request_sock_queue *queue,
 {
         struct listen_sock *lopt = queue->listen_opt;
 
-        if (req->retrans == 0)
+        if (req->num_timeout == 0)
                 --lopt->qlen_young;
 
         return --lopt->qlen;
@@ -269,7 +272,8 @@ static inline void reqsk_queue_hash_req(struct request_sock_queue *queue,
         struct listen_sock *lopt = queue->listen_opt;
 
         req->expires = jiffies + timeout;
-        req->retrans = 0;
+        req->num_retrans = 0;
+        req->num_timeout = 0;
         req->sk = NULL;
         req->dl_next = lopt->syn_table[hash];
 
diff --git a/include/net/route.h b/include/net/route.h
index bc40b633a5c4..2ea40c1b5e00 100644
--- a/include/net/route.h
+++ b/include/net/route.h
@@ -198,10 +198,13 @@ struct in_ifaddr;
 extern void fib_add_ifaddr(struct in_ifaddr *);
 extern void fib_del_ifaddr(struct in_ifaddr *, struct in_ifaddr *);
 
-static inline void ip_rt_put(struct rtable * rt)
+static inline void ip_rt_put(struct rtable *rt)
 {
-        if (rt)
-                dst_release(&rt->dst);
+        /* dst_release() accepts a NULL parameter.
+         * We rely on dst being first structure in struct rtable
+         */
+        BUILD_BUG_ON(offsetof(struct rtable, dst) != 0);
+        dst_release(&rt->dst);
 }
 
 #define IPTOS_RT_MASK   (IPTOS_TOS_MASK & ~3)
diff --git a/include/net/rtnetlink.h b/include/net/rtnetlink.h
index 6b00c4fc4291..5a15fabd6a75 100644
--- a/include/net/rtnetlink.h
+++ b/include/net/rtnetlink.h
@@ -125,7 +125,7 @@ extern void	rtnl_af_unregister(struct rtnl_af_ops *ops);
 
 
 extern struct net *rtnl_link_get_net(struct net *src_net, struct nlattr *tb[]);
-extern struct net_device *rtnl_create_link(struct net *src_net, struct net *net,
+extern struct net_device *rtnl_create_link(struct net *net,
         char *ifname, const struct rtnl_link_ops *ops, struct nlattr *tb[]);
 extern int rtnl_configure_link(struct net_device *dev,
                                const struct ifinfomsg *ifm);
diff --git a/include/net/sch_generic.h b/include/net/sch_generic.h
index 4616f468d599..1540f9c2fcf4 100644
--- a/include/net/sch_generic.h
+++ b/include/net/sch_generic.h
@@ -50,6 +50,13 @@ struct Qdisc {
 #define TCQ_F_INGRESS           2
 #define TCQ_F_CAN_BYPASS        4
 #define TCQ_F_MQROOT            8
+#define TCQ_F_ONETXQUEUE        0x10 /* dequeue_skb() can assume all skbs are for
+                                      * q->dev_queue : It can test
+                                      * netif_xmit_frozen_or_stopped() before
+                                      * dequeueing next packet.
+                                      * Its true for MQ/MQPRIO slaves, or non
+                                      * multiqueue device.
+                                      */
 #define TCQ_F_WARN_NONWC        (1 << 16)
         int                     padded;
         const struct Qdisc_ops  *ops;
diff --git a/include/net/sctp/command.h b/include/net/sctp/command.h
index 712b3bebeda7..35247271e557 100644
--- a/include/net/sctp/command.h
+++ b/include/net/sctp/command.h
@@ -130,8 +130,6 @@ typedef union {
         __be16 err;
         sctp_state_t state;
         sctp_event_timeout_t to;
-        unsigned long zero;
-        void *ptr;
         struct sctp_chunk *chunk;
         struct sctp_association *asoc;
         struct sctp_transport *transport;
@@ -154,23 +152,15 @@ typedef union {
  * which takes an __s32 and returns a sctp_arg_t containing the
  * __s32.  So, after foo = SCTP_I32(arg), foo.i32 == arg.
  */
-static inline sctp_arg_t SCTP_NULL(void)
-{
-        sctp_arg_t retval; retval.ptr = NULL; return retval;
-}
-static inline sctp_arg_t SCTP_NOFORCE(void)
-{
-        sctp_arg_t retval = {.zero = 0UL}; retval.i32 = 0; return retval;
-}
-static inline sctp_arg_t SCTP_FORCE(void)
-{
-        sctp_arg_t retval = {.zero = 0UL}; retval.i32 = 1; return retval;
-}
 
 #define SCTP_ARG_CONSTRUCTOR(name, type, elt) \
 static inline sctp_arg_t        \
 SCTP_## name (type arg)         \
-{ sctp_arg_t retval = {.zero = 0UL}; retval.elt = arg; return retval; }
+{ sctp_arg_t retval;\
+  memset(&retval, 0, sizeof(sctp_arg_t));\
+  retval.elt = arg;\
+  return retval;\
+}
 
 SCTP_ARG_CONSTRUCTOR(I32,       __s32, i32)
 SCTP_ARG_CONSTRUCTOR(U32,       __u32, u32)
@@ -181,7 +171,6 @@ SCTP_ARG_CONSTRUCTOR(ERROR,     int, error)
 SCTP_ARG_CONSTRUCTOR(PERR,      __be16, err)    /* protocol error */
 SCTP_ARG_CONSTRUCTOR(STATE,     sctp_state_t, state)
 SCTP_ARG_CONSTRUCTOR(TO,        sctp_event_timeout_t, to)
-SCTP_ARG_CONSTRUCTOR(PTR,       void *, ptr)
 SCTP_ARG_CONSTRUCTOR(CHUNK,     struct sctp_chunk *, chunk)
 SCTP_ARG_CONSTRUCTOR(ASOC,      struct sctp_association *, asoc)
 SCTP_ARG_CONSTRUCTOR(TRANSPORT, struct sctp_transport *, transport)
@@ -192,6 +181,23 @@ SCTP_ARG_CONSTRUCTOR(PACKET,	struct sctp_packet *, packet)
 SCTP_ARG_CONSTRUCTOR(SACKH,     sctp_sackhdr_t *, sackh)
 SCTP_ARG_CONSTRUCTOR(DATAMSG,   struct sctp_datamsg *, msg)
 
+static inline sctp_arg_t SCTP_FORCE(void)
+{
+        return SCTP_I32(1);
+}
+
+static inline sctp_arg_t SCTP_NOFORCE(void)
+{
+        return SCTP_I32(0);
+}
+
+static inline sctp_arg_t SCTP_NULL(void)
+{
+        sctp_arg_t retval;
+        memset(&retval, 0, sizeof(sctp_arg_t));
+        return retval;
+}
+
 typedef struct {
         sctp_arg_t obj;
         sctp_verb_t verb;
diff --git a/include/net/sctp/constants.h b/include/net/sctp/constants.h
index d053d2e99876..c29707d654c0 100644
--- a/include/net/sctp/constants.h
+++ b/include/net/sctp/constants.h
@@ -312,14 +312,6 @@ enum { SCTP_MAX_GABS = 16 };
                                  * functions simpler to write.
                                  */
 
-#if defined (CONFIG_SCTP_HMAC_MD5)
-#define SCTP_COOKIE_HMAC_ALG "hmac(md5)"
-#elif defined (CONFIG_SCTP_HMAC_SHA1)
-#define SCTP_COOKIE_HMAC_ALG "hmac(sha1)"
-#else
-#define SCTP_COOKIE_HMAC_ALG NULL
-#endif
-
 /* These return values describe the success or failure of a number of
  * routines which form the lower interface to SCTP_outqueue.
  */
diff --git a/include/net/sctp/sctp.h b/include/net/sctp/sctp.h
index 9c6414f553f9..7fdf298a47ef 100644
--- a/include/net/sctp/sctp.h
+++ b/include/net/sctp/sctp.h
@@ -272,6 +272,18 @@ struct sctp_mib {
         unsigned long   mibs[SCTP_MIB_MAX];
 };
 
+/* helper function to track stats about max rto and related transport */
+static inline void sctp_max_rto(struct sctp_association *asoc,
+                                struct sctp_transport *trans)
+{
+        if (asoc->stats.max_obs_rto < (__u64)trans->rto) {
+                asoc->stats.max_obs_rto = trans->rto;
+                memset(&asoc->stats.obs_rto_ipaddr, 0,
+                        sizeof(struct sockaddr_storage));
+                memcpy(&asoc->stats.obs_rto_ipaddr, &trans->ipaddr,
+                        trans->af_specific->sockaddr_len);
+        }
+}
 
 /* Print debugging messages.  */
 #if SCTP_DEBUG
diff --git a/include/net/sctp/sm.h b/include/net/sctp/sm.h
index b5887e1677e4..2a82d1384706 100644
--- a/include/net/sctp/sm.h
+++ b/include/net/sctp/sm.h
@@ -234,6 +234,8 @@ struct sctp_chunk *sctp_make_abort_violation(const struct sctp_association *,
 struct sctp_chunk *sctp_make_violation_paramlen(const struct sctp_association *,
                                    const struct sctp_chunk *,
                                    struct sctp_paramhdr *);
+struct sctp_chunk *sctp_make_violation_max_retrans(const struct sctp_association *,
+                                                   const struct sctp_chunk *);
 struct sctp_chunk *sctp_make_heartbeat(const struct sctp_association *,
                                   const struct sctp_transport *);
 struct sctp_chunk *sctp_make_heartbeat_ack(const struct sctp_association *,
diff --git a/include/net/sctp/structs.h b/include/net/sctp/structs.h
index 64158aa1bb5f..fdeb85a970fc 100644
--- a/include/net/sctp/structs.h
+++ b/include/net/sctp/structs.h
@@ -177,6 +177,7 @@ struct sctp_sock {
 
         /* Access to HMAC transform. */
         struct crypto_hash *hmac;
+        char *sctp_hmac_alg;
 
         /* What is our base endpointer? */
         struct sctp_endpoint *ep;
@@ -948,6 +949,8 @@ struct sctp_transport {
 
         /* 64-bit random number sent with heartbeat. */
         __u64 hb_nonce;
+
+        struct rcu_head rcu;
 };
 
 struct sctp_transport *sctp_transport_new(struct net *, const union sctp_addr *,
@@ -1311,6 +1314,40 @@ struct sctp_inithdr_host {
         __u32 initial_tsn;
 };
 
+/* SCTP_GET_ASSOC_STATS counters */
+struct sctp_priv_assoc_stats {
+        /* Maximum observed rto in the association during subsequent
+         * observations. Value is set to 0 if no RTO measurement took place
+         * The transport where the max_rto was observed is returned in
+         * obs_rto_ipaddr
+         */
+        struct sockaddr_storage obs_rto_ipaddr;
+        __u64 max_obs_rto;
+        /* Total In and Out SACKs received and sent */
+        __u64 isacks;
+        __u64 osacks;
+        /* Total In and Out packets received and sent */
+        __u64 opackets;
+        __u64 ipackets;
+        /* Total retransmitted chunks */
+        __u64 rtxchunks;
+        /* TSN received > next expected */
+        __u64 outofseqtsns;
+        /* Duplicate Chunks received */
+        __u64 idupchunks;
+        /* Gap Ack Blocks received */
+        __u64 gapcnt;
+        /* Unordered data chunks sent and received */
+        __u64 ouodchunks;
+        __u64 iuodchunks;
+        /* Ordered data chunks sent and received */
+        __u64 oodchunks;
+        __u64 iodchunks;
+        /* Control chunks sent and received */
+        __u64 octrlchunks;
+        __u64 ictrlchunks;
+};
+
 /* RFC2960
  *
  * 12. Recommended Transmission Control Block (TCB) Parameters
@@ -1829,6 +1866,8 @@ struct sctp_association {
 
         __u8 need_ecne:1,       /* Need to send an ECNE Chunk? */
              temp:1;            /* Is it a temporary association? */
+
+        struct sctp_priv_assoc_stats stats;
 };
 
 
diff --git a/include/net/sctp/ulpqueue.h b/include/net/sctp/ulpqueue.h
index 2e5ee0d8458d..ff1b8ba73ab1 100644
--- a/include/net/sctp/ulpqueue.h
+++ b/include/net/sctp/ulpqueue.h
@@ -72,7 +72,7 @@ int sctp_ulpq_tail_event(struct sctp_ulpq *, struct sctp_ulpevent *ev);
 void sctp_ulpq_renege(struct sctp_ulpq *, struct sctp_chunk *, gfp_t);
 
 /* Perform partial delivery. */
-void sctp_ulpq_partial_delivery(struct sctp_ulpq *, struct sctp_chunk *, gfp_t);
+void sctp_ulpq_partial_delivery(struct sctp_ulpq *, gfp_t);
 
 /* Abort the partial delivery. */
 void sctp_ulpq_abort_pd(struct sctp_ulpq *, gfp_t);
diff --git a/include/net/sctp/user.h b/include/net/sctp/user.h
index 1b02d7ad453b..9a0ae091366d 100644
--- a/include/net/sctp/user.h
+++ b/include/net/sctp/user.h
@@ -107,6 +107,7 @@ typedef __s32 sctp_assoc_t;
 #define SCTP_GET_LOCAL_ADDRS    109             /* Get all local address. */
 #define SCTP_SOCKOPT_CONNECTX   110             /* CONNECTX requests. */
 #define SCTP_SOCKOPT_CONNECTX3  111     /* CONNECTX requests (updated) */
+#define SCTP_GET_ASSOC_STATS    112     /* Read only */
 
 /*
  * 5.2.1 SCTP Initiation Structure (SCTP_INIT)
@@ -719,6 +720,32 @@ struct sctp_getaddrs {
         __u8                    addrs[0]; /*output, variable size*/
 };
 
+/* A socket user request obtained via SCTP_GET_ASSOC_STATS that retrieves
+ * association stats. All stats are counts except sas_maxrto and
+ * sas_obs_rto_ipaddr. maxrto is the max observed rto + transport since
+ * the last call. Will return 0 when RTO was not update since last call
+ */
+struct sctp_assoc_stats {
+        sctp_assoc_t    sas_assoc_id;    /* Input */
+                                         /* Transport of observed max RTO */
+        struct sockaddr_storage sas_obs_rto_ipaddr;
+        __u64           sas_maxrto;      /* Maximum Observed RTO for period */
+        __u64           sas_isacks;      /* SACKs received */
+        __u64           sas_osacks;      /* SACKs sent */
+        __u64           sas_opackets;    /* Packets sent */
+        __u64           sas_ipackets;    /* Packets received */
+        __u64           sas_rtxchunks;   /* Retransmitted Chunks */
+        __u64           sas_outofseqtsns;/* TSN received > next expected */
+        __u64           sas_idupchunks;  /* Dups received (ordered+unordered) */
+        __u64           sas_gapcnt;      /* Gap Acknowledgements Received */
+        __u64           sas_ouodchunks;  /* Unordered data chunks sent */
+        __u64           sas_iuodchunks;  /* Unordered data chunks received */
+        __u64           sas_oodchunks;   /* Ordered data chunks sent */
+        __u64           sas_iodchunks;   /* Ordered data chunks received */
+        __u64           sas_octrlchunks; /* Control chunks sent */
+        __u64           sas_ictrlchunks; /* Control chunks received */
+};
+
 /* These are bit fields for msghdr->msg_flags.  See section 5.1.  */
 /* On user space Linux, these live in <bits/socket.h> as an enum.  */
 enum sctp_msg_flags {
diff --git a/include/net/sock.h b/include/net/sock.h
index c945fba4f543..0a9a01a5b0d7 100644
--- a/include/net/sock.h
+++ b/include/net/sock.h
@@ -126,12 +126,17 @@ struct sock;
 struct proto;
 struct net;
 
+typedef __u32 __bitwise __portpair;
+typedef __u64 __bitwise __addrpair;
+
 /**
  *      struct sock_common - minimal network layer representation of sockets
  *      @skc_daddr: Foreign IPv4 addr
  *      @skc_rcv_saddr: Bound local IPv4 addr
  *      @skc_hash: hash value used with various protocol lookup tables
  *      @skc_u16hashes: two u16 hash values used by UDP lookup tables
+ *      @skc_dport: placeholder for inet_dport/tw_dport
+ *      @skc_num: placeholder for inet_num/tw_num
  *      @skc_family: network address family
  *      @skc_state: Connection state
  *      @skc_reuse: %SO_REUSEADDR setting
@@ -149,16 +154,29 @@ struct net;
  *      for struct sock and struct inet_timewait_sock.
  */
 struct sock_common {
-        /* skc_daddr and skc_rcv_saddr must be grouped :
-         * cf INET_MATCH() and INET_TW_MATCH()
+        /* skc_daddr and skc_rcv_saddr must be grouped on a 8 bytes aligned
+         * address on 64bit arches : cf INET_MATCH() and INET_TW_MATCH()
          */
-        __be32                  skc_daddr;
-        __be32                  skc_rcv_saddr;
-
+        union {
+                __addrpair      skc_addrpair;
+                struct {
+                        __be32  skc_daddr;
+                        __be32  skc_rcv_saddr;
+                };
+        };
         union  {
                 unsigned int    skc_hash;
                 __u16           skc_u16hashes[2];
         };
+        /* skc_dport && skc_num must be grouped as well */
+        union {
+                __portpair      skc_portpair;
+                struct {
+                        __be16  skc_dport;
+                        __u16   skc_num;
+                };
+        };
+
         unsigned short          skc_family;
         volatile unsigned char  skc_state;
         unsigned char           skc_reuse;
diff --git a/include/net/tcp.h b/include/net/tcp.h
index 4af45e33105d..aed42c785153 100644
--- a/include/net/tcp.h
+++ b/include/net/tcp.h
@@ -369,7 +369,6 @@ extern void tcp_shutdown (struct sock *sk, int how);
 extern void tcp_v4_early_demux(struct sk_buff *skb);
 extern int tcp_v4_rcv(struct sk_buff *skb);
 
-extern struct inet_peer *tcp_v4_get_peer(struct sock *sk);
 extern int tcp_v4_tw_remember_stamp(struct inet_timewait_sock *tw);
 extern int tcp_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
                        size_t size);
diff --git a/include/uapi/asm-generic/socket.h b/include/uapi/asm-generic/socket.h
index b1bea03274d5..2d32d073a6f9 100644
--- a/include/uapi/asm-generic/socket.h
+++ b/include/uapi/asm-generic/socket.h
@@ -43,6 +43,7 @@
 /* Socket filtering */
 #define SO_ATTACH_FILTER        26
 #define SO_DETACH_FILTER        27
+#define SO_GET_FILTER           SO_ATTACH_FILTER
 
 #define SO_PEERNAME             28
 #define SO_TIMESTAMP            29
diff --git a/include/uapi/linux/Kbuild b/include/uapi/linux/Kbuild
index 19e765fbfef7..4e67194fd2c3 100644
--- a/include/uapi/linux/Kbuild
+++ b/include/uapi/linux/Kbuild
@@ -258,6 +258,7 @@ header-y += neighbour.h
 header-y += net.h
 header-y += net_dropmon.h
 header-y += net_tstamp.h
+header-y += netconf.h
 header-y += netdevice.h
 header-y += netfilter.h
 header-y += netfilter_arp.h
diff --git a/include/uapi/linux/ethtool.h b/include/uapi/linux/ethtool.h
index d3eaaaf1009e..be8c41e2dc15 100644
--- a/include/uapi/linux/ethtool.h
+++ b/include/uapi/linux/ethtool.h
@@ -500,13 +500,15 @@ union ethtool_flow_union {
         struct ethtool_ah_espip4_spec           esp_ip4_spec;
         struct ethtool_usrip4_spec              usr_ip4_spec;
         struct ethhdr                           ether_spec;
-        __u8                                    hdata[60];
+        __u8                                    hdata[52];
 };
 
 struct ethtool_flow_ext {
-        __be16  vlan_etype;
-        __be16  vlan_tci;
-        __be32  data[2];
+        __u8            padding[2];
+        unsigned char   h_dest[ETH_ALEN];       /* destination eth addr */
+        __be16          vlan_etype;
+        __be16          vlan_tci;
+        __be32          data[2];
 };
 
 /**
@@ -1027,6 +1029,7 @@ enum ethtool_sfeatures_retval_bits {
 #define ETHER_FLOW      0x12    /* spec only (ether_spec) */
 /* Flag to enable additional fields in struct ethtool_rx_flow_spec */
 #define FLOW_EXT        0x80000000
+#define FLOW_MAC_EXT    0x40000000
 
 /* L3-L4 network traffic flow hash options */
 #define RXH_L2DA        (1 << 1)
diff --git a/include/uapi/linux/filter.h b/include/uapi/linux/filter.h
index 3d7922433aba..9cfde6941099 100644
--- a/include/uapi/linux/filter.h
+++ b/include/uapi/linux/filter.h
@@ -127,7 +127,9 @@ struct sock_fprog {	/* Required for SO_ATTACH_FILTER. */
 #define SKF_AD_RXHASH   32
 #define SKF_AD_CPU      36
 #define SKF_AD_ALU_XOR_X        40
-#define SKF_AD_MAX      44
+#define SKF_AD_VLAN_TAG 44
+#define SKF_AD_VLAN_TAG_PRESENT 48
+#define SKF_AD_MAX      52
 #define SKF_NET_OFF   (-0x100000)
 #define SKF_LL_OFF    (-0x200000)
 
diff --git a/include/uapi/linux/hdlc/Kbuild b/include/uapi/linux/hdlc/Kbuild
index aafaa5aa54d4..8c1d2cb75e33 100644
--- a/include/uapi/linux/hdlc/Kbuild
+++ b/include/uapi/linux/hdlc/Kbuild
@@ -1 +1,2 @@
 # UAPI Header export list
+header-y += ioctl.h
diff --git a/include/linux/hdlc/ioctl.h b/include/uapi/linux/hdlc/ioctl.h
index 583972364357..04bc0274a189 100644
--- a/include/linux/hdlc/ioctl.h
+++ b/include/uapi/linux/hdlc/ioctl.h
@@ -34,13 +34,15 @@
 #define LMI_CCITT               3 /* ITU-T Annex A */
 #define LMI_CISCO               4 /* The "original" LMI, aka Gang of Four */
 
-typedef struct { 
+#ifndef __ASSEMBLY__
+
+typedef struct {
         unsigned int clock_rate; /* bits per second */
         unsigned int clock_type; /* internal, external, TX-internal etc. */
         unsigned short loopback;
 } sync_serial_settings;          /* V.35, V.24, X.21 */
 
-typedef struct { 
+typedef struct {
         unsigned int clock_rate; /* bits per second */
         unsigned int clock_type; /* internal, external, TX-internal etc. */
         unsigned short loopback;
@@ -78,4 +80,5 @@ typedef struct {
 
 /* PPP doesn't need any info now - supply length = 0 to ioctl */
 
+#endif /* __ASSEMBLY__ */
 #endif /* __HDLC_IOCTL_H__ */
diff --git a/include/uapi/linux/if_bridge.h b/include/uapi/linux/if_bridge.h
index a8fe9549ddbc..afbb18a0227c 100644
--- a/include/uapi/linux/if_bridge.h
+++ b/include/uapi/linux/if_bridge.h
@@ -97,5 +97,86 @@ struct __fdb_entry {
         __u16 unused;
 };
 
+/* Bridge Flags */
+#define BRIDGE_FLAGS_MASTER     1       /* Bridge command to/from master */
+#define BRIDGE_FLAGS_SELF       2       /* Bridge command to/from lowerdev */
+
+#define BRIDGE_MODE_VEB         0       /* Default loopback mode */
+#define BRIDGE_MODE_VEPA        1       /* 802.1Qbg defined VEPA mode */
+
+/* Bridge management nested attributes
+ * [IFLA_AF_SPEC] = {
+ *     [IFLA_BRIDGE_FLAGS]
+ *     [IFLA_BRIDGE_MODE]
+ * }
+ */
+enum {
+        IFLA_BRIDGE_FLAGS,
+        IFLA_BRIDGE_MODE,
+        __IFLA_BRIDGE_MAX,
+};
+#define IFLA_BRIDGE_MAX (__IFLA_BRIDGE_MAX - 1)
+
+/* Bridge multicast database attributes
+ * [MDBA_MDB] = {
+ *     [MDBA_MDB_ENTRY] = {
+ *         [MDBA_MDB_ENTRY_INFO]
+ *     }
+ * }
+ * [MDBA_ROUTER] = {
+ *    [MDBA_ROUTER_PORT]
+ * }
+ */
+enum {
+        MDBA_UNSPEC,
+        MDBA_MDB,
+        MDBA_ROUTER,
+        __MDBA_MAX,
+};
+#define MDBA_MAX (__MDBA_MAX - 1)
+
+enum {
+        MDBA_MDB_UNSPEC,
+        MDBA_MDB_ENTRY,
+        __MDBA_MDB_MAX,
+};
+#define MDBA_MDB_MAX (__MDBA_MDB_MAX - 1)
+
+enum {
+        MDBA_MDB_ENTRY_UNSPEC,
+        MDBA_MDB_ENTRY_INFO,
+        __MDBA_MDB_ENTRY_MAX,
+};
+#define MDBA_MDB_ENTRY_MAX (__MDBA_MDB_ENTRY_MAX - 1)
+
+enum {
+        MDBA_ROUTER_UNSPEC,
+        MDBA_ROUTER_PORT,
+        __MDBA_ROUTER_MAX,
+};
+#define MDBA_ROUTER_MAX (__MDBA_ROUTER_MAX - 1)
+
+struct br_port_msg {
+        __u8  family;
+        __u32 ifindex;
+};
+
+struct br_mdb_entry {
+        __u32 ifindex;
+        struct {
+                union {
+                        __be32  ip4;
+                        struct in6_addr ip6;
+                } u;
+                __be16          proto;
+        } addr;
+};
+
+enum {
+        MDBA_SET_ENTRY_UNSPEC,
+        MDBA_SET_ENTRY,
+        __MDBA_SET_ENTRY_MAX,
+};
+#define MDBA_SET_ENTRY_MAX (__MDBA_SET_ENTRY_MAX - 1)
 
 #endif /* _UAPI_LINUX_IF_BRIDGE_H */
diff --git a/include/uapi/linux/if_ether.h b/include/uapi/linux/if_ether.h
index 0343e1f0582c..67fb87ca1094 100644
--- a/include/uapi/linux/if_ether.h
+++ b/include/uapi/linux/if_ether.h
@@ -48,6 +48,7 @@
 #define ETH_P_BPQ       0x08FF          /* G8BPQ AX.25 Ethernet Packet  [ NOT AN OFFICIALLY REGISTERED ID ] */
 #define ETH_P_IEEEPUP   0x0a00          /* Xerox IEEE802.3 PUP packet */
 #define ETH_P_IEEEPUPAT 0x0a01          /* Xerox IEEE802.3 PUP Addr Trans packet */
+#define ETH_P_BATMAN    0x4305          /* B.A.T.M.A.N.-Advanced packet [ NOT AN OFFICIALLY REGISTERED ID ] */
 #define ETH_P_DEC       0x6000          /* DEC Assigned proto           */
 #define ETH_P_DNA_DL    0x6001          /* DEC DNA Dump/Load            */
 #define ETH_P_DNA_RC    0x6002          /* DEC DNA Remote Console       */
diff --git a/include/uapi/linux/if_link.h b/include/uapi/linux/if_link.h
index 5c80cb11518b..60f3b6b90602 100644
--- a/include/uapi/linux/if_link.h
+++ b/include/uapi/linux/if_link.h
@@ -205,6 +205,24 @@ enum {
 
 #define IFLA_INET6_MAX  (__IFLA_INET6_MAX - 1)
 
+enum {
+        BRIDGE_MODE_UNSPEC,
+        BRIDGE_MODE_HAIRPIN,
+};
+
+enum {
+        IFLA_BRPORT_UNSPEC,
+        IFLA_BRPORT_STATE,      /* Spanning tree state     */
+        IFLA_BRPORT_PRIORITY,   /* "             priority  */
+        IFLA_BRPORT_COST,       /* "             cost      */
+        IFLA_BRPORT_MODE,       /* mode (hairpin)          */
+        IFLA_BRPORT_GUARD,      /* bpdu guard              */
+        IFLA_BRPORT_PROTECT,    /* root port protection    */
+        IFLA_BRPORT_FAST_LEAVE, /* multicast fast leave    */
+        __IFLA_BRPORT_MAX
+};
+#define IFLA_BRPORT_MAX (__IFLA_BRPORT_MAX - 1)
+
 struct ifla_cacheinfo {
         __u32   max_reasm_len;
         __u32   tstamp;         /* ipv6InterfaceTable updated timestamp */
@@ -285,6 +303,10 @@ enum {
         IFLA_VXLAN_AGEING,
         IFLA_VXLAN_LIMIT,
         IFLA_VXLAN_PORT_RANGE,
+        IFLA_VXLAN_PROXY,
+        IFLA_VXLAN_RSC,
+        IFLA_VXLAN_L2MISS,
+        IFLA_VXLAN_L3MISS,
         __IFLA_VXLAN_MAX
 };
 #define IFLA_VXLAN_MAX  (__IFLA_VXLAN_MAX - 1)
diff --git a/include/uapi/linux/if_packet.h b/include/uapi/linux/if_packet.h
index f3799295d231..f9a60375f0d0 100644
--- a/include/uapi/linux/if_packet.h
+++ b/include/uapi/linux/if_packet.h
@@ -50,6 +50,7 @@ struct sockaddr_ll {
 #define PACKET_TX_TIMESTAMP             16
 #define PACKET_TIMESTAMP                17
 #define PACKET_FANOUT                   18
+#define PACKET_TX_HAS_OFF               19
 
 #define PACKET_FANOUT_HASH              0
 #define PACKET_FANOUT_LB                1
diff --git a/include/uapi/linux/if_tun.h b/include/uapi/linux/if_tun.h
index 25a585ce23e6..2835b85fd46d 100644
--- a/include/uapi/linux/if_tun.h
+++ b/include/uapi/linux/if_tun.h
@@ -31,9 +31,11 @@
 #define TUN_FASYNC      0x0010
 #define TUN_NOCHECKSUM  0x0020
 #define TUN_NO_PI       0x0040
+/* This flag has no real effect */
 #define TUN_ONE_QUEUE   0x0080
 #define TUN_PERSIST     0x0100  
 #define TUN_VNET_HDR    0x0200
+#define TUN_TAP_MQ      0x0400
 
 /* Ioctl defines */
 #define TUNSETNOCSUM  _IOW('T', 200, int) 
@@ -53,14 +55,19 @@
 #define TUNDETACHFILTER _IOW('T', 214, struct sock_fprog)
 #define TUNGETVNETHDRSZ _IOR('T', 215, int)
 #define TUNSETVNETHDRSZ _IOW('T', 216, int)
+#define TUNSETQUEUE  _IOW('T', 217, int)
 
 /* TUNSETIFF ifr flags */
 #define IFF_TUN         0x0001
 #define IFF_TAP         0x0002
 #define IFF_NO_PI       0x1000
+/* This flag has no real effect */
 #define IFF_ONE_QUEUE   0x2000
 #define IFF_VNET_HDR    0x4000
 #define IFF_TUN_EXCL    0x8000
+#define IFF_MULTI_QUEUE 0x0100
+#define IFF_ATTACH_QUEUE 0x0200
+#define IFF_DETACH_QUEUE 0x0400
 
 /* Features for GSO (TUNSETOFFLOAD). */
 #define TUN_F_CSUM      0x01    /* You can hand me unchecksummed packets. */
diff --git a/include/uapi/linux/if_tunnel.h b/include/uapi/linux/if_tunnel.h
index 5db5942575fe..aee73d0611fb 100644
--- a/include/uapi/linux/if_tunnel.h
+++ b/include/uapi/linux/if_tunnel.h
@@ -37,6 +37,26 @@ struct ip_tunnel_parm {
         struct iphdr            iph;
 };
 
+enum {
+        IFLA_IPTUN_UNSPEC,
+        IFLA_IPTUN_LINK,
+        IFLA_IPTUN_LOCAL,
+        IFLA_IPTUN_REMOTE,
+        IFLA_IPTUN_TTL,
+        IFLA_IPTUN_TOS,
+        IFLA_IPTUN_ENCAP_LIMIT,
+        IFLA_IPTUN_FLOWINFO,
+        IFLA_IPTUN_FLAGS,
+        IFLA_IPTUN_PROTO,
+        IFLA_IPTUN_PMTUDISC,
+        IFLA_IPTUN_6RD_PREFIX,
+        IFLA_IPTUN_6RD_RELAY_PREFIX,
+        IFLA_IPTUN_6RD_PREFIXLEN,
+        IFLA_IPTUN_6RD_RELAY_PREFIXLEN,
+        __IFLA_IPTUN_MAX,
+};
+#define IFLA_IPTUN_MAX  (__IFLA_IPTUN_MAX - 1)
+
 /* SIT-mode i_flags */
 #define SIT_ISATAP      0x0001
 
diff --git a/include/uapi/linux/in6.h b/include/uapi/linux/in6.h
index 1e3159989958..f79c3721da6e 100644
--- a/include/uapi/linux/in6.h
+++ b/include/uapi/linux/in6.h
@@ -240,6 +240,7 @@ struct in6_flowlabel_req {
  *
  * IP6T_SO_GET_REVISION_MATCH   68
  * IP6T_SO_GET_REVISION_TARGET  69
+ * IP6T_SO_ORIGINAL_DST         80
  */
 
 /* RFC5014: Source address selection */
diff --git a/include/uapi/linux/inet_diag.h b/include/uapi/linux/inet_diag.h
index 8c469af939aa..bbde90fa5838 100644
--- a/include/uapi/linux/inet_diag.h
+++ b/include/uapi/linux/inet_diag.h
@@ -109,9 +109,10 @@ enum {
         INET_DIAG_TOS,
         INET_DIAG_TCLASS,
         INET_DIAG_SKMEMINFO,
+        INET_DIAG_SHUTDOWN,
 };
 
-#define INET_DIAG_MAX INET_DIAG_SKMEMINFO
+#define INET_DIAG_MAX INET_DIAG_SHUTDOWN
 
 
 /* INET_DIAG_MEM */
diff --git a/include/uapi/linux/ipv6.h b/include/uapi/linux/ipv6.h
index a6d7d1c536c3..5a2991cf0251 100644
--- a/include/uapi/linux/ipv6.h
+++ b/include/uapi/linux/ipv6.h
@@ -157,6 +157,7 @@ enum {
         DEVCONF_DISABLE_IPV6,
         DEVCONF_ACCEPT_DAD,
         DEVCONF_FORCE_TLLAO,
+        DEVCONF_NDISC_NOTIFY,
         DEVCONF_MAX
 };
 
diff --git a/include/uapi/linux/ipv6_route.h b/include/uapi/linux/ipv6_route.h
index 0459664c2636..2be7bd174751 100644
--- a/include/uapi/linux/ipv6_route.h
+++ b/include/uapi/linux/ipv6_route.h
@@ -55,4 +55,7 @@ struct in6_rtmsg {
 #define RTMSG_NEWROUTE          0x21
 #define RTMSG_DELROUTE          0x22
 
+#define IP6_RT_PRIO_USER        1024
+#define IP6_RT_PRIO_ADDRCONF    256
+
 #endif /* _UAPI_LINUX_IPV6_ROUTE_H */
diff --git a/include/uapi/linux/netconf.h b/include/uapi/linux/netconf.h
new file mode 100644
index 000000000000..64804a798b0c
--- /dev/null
+++ b/include/uapi/linux/netconf.h
@@ -0,0 +1,24 @@
+#ifndef _UAPI_LINUX_NETCONF_H_
+#define _UAPI_LINUX_NETCONF_H_
+
+#include <linux/types.h>
+#include <linux/netlink.h>
+
+struct netconfmsg {
+        __u8    ncm_family;
+};
+
+enum {
+        NETCONFA_UNSPEC,
+        NETCONFA_IFINDEX,
+        NETCONFA_FORWARDING,
+        NETCONFA_RP_FILTER,
+        NETCONFA_MC_FORWARDING,
+        __NETCONFA_MAX
+};
+#define NETCONFA_MAX    (__NETCONFA_MAX - 1)
+
+#define NETCONFA_IFINDEX_ALL            -1
+#define NETCONFA_IFINDEX_DEFAULT        -2
+
+#endif /* _UAPI_LINUX_NETCONF_H_ */
diff --git a/include/uapi/linux/netfilter/nfnetlink_conntrack.h b/include/uapi/linux/netfilter/nfnetlink_conntrack.h
index 43bfe3e1685b..86e930cf3dfb 100644
--- a/include/uapi/linux/netfilter/nfnetlink_conntrack.h
+++ b/include/uapi/linux/netfilter/nfnetlink_conntrack.h
@@ -9,6 +9,8 @@ enum cntl_msg_types {
         IPCTNL_MSG_CT_GET_CTRZERO,
         IPCTNL_MSG_CT_GET_STATS_CPU,
         IPCTNL_MSG_CT_GET_STATS,
+        IPCTNL_MSG_CT_GET_DYING,
+        IPCTNL_MSG_CT_GET_UNCONFIRMED,
 
         IPCTNL_MSG_MAX
 };
diff --git a/include/uapi/linux/netfilter_ipv6/ip6_tables.h b/include/uapi/linux/netfilter_ipv6/ip6_tables.h
index bf1ef65cc582..649c68062dca 100644
--- a/include/uapi/linux/netfilter_ipv6/ip6_tables.h
+++ b/include/uapi/linux/netfilter_ipv6/ip6_tables.h
@@ -178,6 +178,9 @@ struct ip6t_error {
 #define IP6T_SO_GET_REVISION_TARGET     (IP6T_BASE_CTL + 5)
 #define IP6T_SO_GET_MAX                 IP6T_SO_GET_REVISION_TARGET
 
+/* obtain original address if REDIRECT'd connection */
+#define IP6T_SO_ORIGINAL_DST            80
+
 /* ICMP matching stuff */
 struct ip6t_icmp {
         __u8 type;                              /* type to match */
diff --git a/include/uapi/linux/nfc.h b/include/uapi/linux/nfc.h
index d908d17da56d..0e63cee8d810 100644
--- a/include/uapi/linux/nfc.h
+++ b/include/uapi/linux/nfc.h
@@ -60,6 +60,13 @@
  *      target mode.
  * @NFC_EVENT_DEVICE_DEACTIVATED: event emitted when the adapter is deactivated
  *      from target mode.
+ * @NFC_CMD_LLC_GET_PARAMS: request LTO, RW, and MIUX parameters for a device
+ * @NFC_CMD_LLC_SET_PARAMS: set one or more of LTO, RW, and MIUX parameters for
+ *      a device. LTO must be set before the link is up otherwise -EINPROGRESS
+ *      is returned. RW and MIUX can be set at anytime and will be passed in
+ *      subsequent CONNECT and CC messages.
+ *      If one of the passed parameters is wrong none is set and -EINVAL is
+ *      returned.
  */
 enum nfc_commands {
         NFC_CMD_UNSPEC,
@@ -77,6 +84,8 @@ enum nfc_commands {
         NFC_EVENT_TARGET_LOST,
         NFC_EVENT_TM_ACTIVATED,
         NFC_EVENT_TM_DEACTIVATED,
+        NFC_CMD_LLC_GET_PARAMS,
+        NFC_CMD_LLC_SET_PARAMS,
 /* private: internal use only */
         __NFC_CMD_AFTER_LAST
 };
@@ -102,6 +111,9 @@ enum nfc_commands {
  * @NFC_ATTR_RF_MODE: Initiator or target
  * @NFC_ATTR_IM_PROTOCOLS: Initiator mode protocols to poll for
  * @NFC_ATTR_TM_PROTOCOLS: Target mode protocols to listen for
+ * @NFC_ATTR_LLC_PARAM_LTO: Link TimeOut parameter
+ * @NFC_ATTR_LLC_PARAM_RW: Receive Window size parameter
+ * @NFC_ATTR_LLC_PARAM_MIUX: MIU eXtension parameter
  */
 enum nfc_attrs {
         NFC_ATTR_UNSPEC,
@@ -119,6 +131,9 @@ enum nfc_attrs {
         NFC_ATTR_DEVICE_POWERED,
         NFC_ATTR_IM_PROTOCOLS,
         NFC_ATTR_TM_PROTOCOLS,
+        NFC_ATTR_LLC_PARAM_LTO,
+        NFC_ATTR_LLC_PARAM_RW,
+        NFC_ATTR_LLC_PARAM_MIUX,
 /* private: internal use only */
         __NFC_ATTR_AFTER_LAST
 };
diff --git a/include/uapi/linux/nl80211.h b/include/uapi/linux/nl80211.h
index 7df9b500c804..e3e19f8b16f2 100644
--- a/include/uapi/linux/nl80211.h
+++ b/include/uapi/linux/nl80211.h
@@ -118,8 +118,9 @@
  *      to get a list of all present wiphys.
  * @NL80211_CMD_SET_WIPHY: set wiphy parameters, needs %NL80211_ATTR_WIPHY or
  *      %NL80211_ATTR_IFINDEX; can be used to set %NL80211_ATTR_WIPHY_NAME,
- *      %NL80211_ATTR_WIPHY_TXQ_PARAMS, %NL80211_ATTR_WIPHY_FREQ,
- *      %NL80211_ATTR_WIPHY_CHANNEL_TYPE, %NL80211_ATTR_WIPHY_RETRY_SHORT,
+ *      %NL80211_ATTR_WIPHY_TXQ_PARAMS, %NL80211_ATTR_WIPHY_FREQ (and the
+ *      attributes determining the channel width; this is used for setting
+ *      monitor mode channel),  %NL80211_ATTR_WIPHY_RETRY_SHORT,
  *      %NL80211_ATTR_WIPHY_RETRY_LONG, %NL80211_ATTR_WIPHY_FRAG_THRESHOLD,
  *      and/or %NL80211_ATTR_WIPHY_RTS_THRESHOLD.
  *      However, for setting the channel, see %NL80211_CMD_SET_CHANNEL
@@ -171,7 +172,7 @@
  *      %NL80211_ATTR_AKM_SUITES, %NL80211_ATTR_PRIVACY,
  *      %NL80211_ATTR_AUTH_TYPE and %NL80211_ATTR_INACTIVITY_TIMEOUT.
  *      The channel to use can be set on the interface or be given using the
- *      %NL80211_ATTR_WIPHY_FREQ and %NL80211_ATTR_WIPHY_CHANNEL_TYPE attrs.
+ *      %NL80211_ATTR_WIPHY_FREQ and the attributes determining channel width.
  * @NL80211_CMD_NEW_BEACON: old alias for %NL80211_CMD_START_AP
  * @NL80211_CMD_STOP_AP: Stop AP operation on the given interface
  * @NL80211_CMD_DEL_BEACON: old alias for %NL80211_CMD_STOP_AP
@@ -401,8 +402,7 @@
  *      a response while being associated to an AP on another channel.
  *      %NL80211_ATTR_IFINDEX is used to specify which interface (and thus
  *      radio) is used. %NL80211_ATTR_WIPHY_FREQ is used to specify the
- *      frequency for the operation and %NL80211_ATTR_WIPHY_CHANNEL_TYPE may be
- *      optionally used to specify additional channel parameters.
+ *      frequency for the operation.
  *      %NL80211_ATTR_DURATION is used to specify the duration in milliseconds
  *      to remain on the channel. This command is also used as an event to
  *      notify when the requested duration starts (it may take a while for the
@@ -440,12 +440,11 @@
  *      as an event indicating reception of a frame that was not processed in
  *      kernel code, but is for us (i.e., which may need to be processed in a
  *      user space application). %NL80211_ATTR_FRAME is used to specify the
- *      frame contents (including header). %NL80211_ATTR_WIPHY_FREQ (and
- *      optionally %NL80211_ATTR_WIPHY_CHANNEL_TYPE) is used to indicate on
- *      which channel the frame is to be transmitted or was received. If this
- *      channel is not the current channel (remain-on-channel or the
- *      operational channel) the device will switch to the given channel and
- *      transmit the frame, optionally waiting for a response for the time
+ *      frame contents (including header). %NL80211_ATTR_WIPHY_FREQ is used
+ *      to indicate on which channel the frame is to be transmitted or was
+ *      received. If this channel is not the current channel (remain-on-channel
+ *      or the operational channel) the device will switch to the given channel
+ *      and transmit the frame, optionally waiting for a response for the time
  *      specified using %NL80211_ATTR_DURATION. When called, this operation
  *      returns a cookie (%NL80211_ATTR_COOKIE) that will be included with the
  *      TX status event pertaining to the TX request.
@@ -473,8 +472,8 @@
  *      command is used as an event to indicate the that a trigger level was
  *      reached.
  * @NL80211_CMD_SET_CHANNEL: Set the channel (using %NL80211_ATTR_WIPHY_FREQ
- *      and %NL80211_ATTR_WIPHY_CHANNEL_TYPE) the given interface (identifed
- *      by %NL80211_ATTR_IFINDEX) shall operate on.
+ *      and the attributes determining channel width) the given interface
+ *      (identifed by %NL80211_ATTR_IFINDEX) shall operate on.
  *      In case multiple channels are supported by the device, the mechanism
  *      with which it switches channels is implementation-defined.
  *      When a monitor interface is given, it can only switch channel while
@@ -526,6 +525,12 @@
  *      of PMKSA caching dandidates.
  *
  * @NL80211_CMD_TDLS_OPER: Perform a high-level TDLS command (e.g. link setup).
+ *      In addition, this can be used as an event to request userspace to take
+ *      actions on TDLS links (set up a new link or tear down an existing one).
+ *      In such events, %NL80211_ATTR_TDLS_OPERATION indicates the requested
+ *      operation, %NL80211_ATTR_MAC contains the peer MAC address, and
+ *      %NL80211_ATTR_REASON_CODE the reason code to be used (only with
+ *      %NL80211_TDLS_TEARDOWN).
  * @NL80211_CMD_TDLS_MGMT: Send a TDLS management frame.
  *
  * @NL80211_CMD_UNEXPECTED_FRAME: Used by an application controlling an AP
@@ -562,8 +567,8 @@
  *
  * @NL80211_CMD_CH_SWITCH_NOTIFY: An AP or GO may decide to switch channels
  *      independently of the userspace SME, send this event indicating
- *      %NL80211_ATTR_IFINDEX is now on %NL80211_ATTR_WIPHY_FREQ with
- *      %NL80211_ATTR_WIPHY_CHANNEL_TYPE.
+ *      %NL80211_ATTR_IFINDEX is now on %NL80211_ATTR_WIPHY_FREQ and the
+ *      attributes determining channel width.
  *
  * @NL80211_CMD_START_P2P_DEVICE: Start the given P2P Device, identified by
  *      its %NL80211_ATTR_WDEV identifier. It must have been created with
@@ -578,6 +583,9 @@
  *      station, due to particular reason. %NL80211_ATTR_CONN_FAILED_REASON
  *      is used for this.
  *
+ * @NL80211_CMD_SET_MCAST_RATE: Change the rate used to send multicast frames
+ *      for IBSS or MESH vif.
+ *
  * @NL80211_CMD_MAX: highest used command number
  * @__NL80211_CMD_AFTER_LAST: internal use
  */
@@ -726,6 +734,8 @@ enum nl80211_commands {
 
         NL80211_CMD_CONN_FAILED,
 
+        NL80211_CMD_SET_MCAST_RATE,
+
         /* add new commands above here */
 
         /* used to define NL80211_CMD_MAX below */
@@ -762,14 +772,26 @@ enum nl80211_commands {
  *      /sys/class/ieee80211/<phyname>/index
  * @NL80211_ATTR_WIPHY_NAME: wiphy name (used for renaming)
  * @NL80211_ATTR_WIPHY_TXQ_PARAMS: a nested array of TX queue parameters
- * @NL80211_ATTR_WIPHY_FREQ: frequency of the selected channel in MHz
+ * @NL80211_ATTR_WIPHY_FREQ: frequency of the selected channel in MHz,
+ *      defines the channel together with the (deprecated)
+ *      %NL80211_ATTR_WIPHY_CHANNEL_TYPE attribute or the attributes
+ *      %NL80211_ATTR_CHANNEL_WIDTH and if needed %NL80211_ATTR_CENTER_FREQ1
+ *      and %NL80211_ATTR_CENTER_FREQ2
+ * @NL80211_ATTR_CHANNEL_WIDTH: u32 attribute containing one of the values
+ *      of &enum nl80211_chan_width, describing the channel width. See the
+ *      documentation of the enum for more information.
+ * @NL80211_ATTR_CENTER_FREQ1: Center frequency of the first part of the
+ *      channel, used for anything but 20 MHz bandwidth
+ * @NL80211_ATTR_CENTER_FREQ2: Center frequency of the second part of the
+ *      channel, used only for 80+80 MHz bandwidth
  * @NL80211_ATTR_WIPHY_CHANNEL_TYPE: included with NL80211_ATTR_WIPHY_FREQ
- *      if HT20 or HT40 are allowed (i.e., 802.11n disabled if not included):
+ *      if HT20 or HT40 are to be used (i.e., HT disabled if not included):
  *      NL80211_CHAN_NO_HT = HT not allowed (i.e., same as not including
  *              this attribute)
  *      NL80211_CHAN_HT20 = HT20 only
  *      NL80211_CHAN_HT40MINUS = secondary channel is below the primary channel
  *      NL80211_CHAN_HT40PLUS = secondary channel is above the primary channel
+ *      This attribute is now deprecated.
  * @NL80211_ATTR_WIPHY_RETRY_SHORT: TX retry limit for frames whose length is
  *      less than or equal to the RTS threshold; allowed range: 1..255;
  *      dot11ShortRetryLimit; u8
@@ -1273,6 +1295,21 @@ enum nl80211_commands {
  *      the connection request from a station. nl80211_connect_failed_reason
  *      enum has different reasons of connection failure.
  *
+ * @NL80211_ATTR_SAE_DATA: SAE elements in Authentication frames. This starts
+ *      with the Authentication transaction sequence number field.
+ *
+ * @NL80211_ATTR_VHT_CAPABILITY: VHT Capability information element (from
+ *      association request when used with NL80211_CMD_NEW_STATION)
+ *
+ * @NL80211_ATTR_SCAN_FLAGS: scan request control flags (u32)
+ *
+ * @NL80211_ATTR_P2P_CTWINDOW: P2P GO Client Traffic Window (u8), used with
+ *      the START_AP and SET_BSS commands
+ * @NL80211_ATTR_P2P_OPPPS: P2P GO opportunistic PS (u8), used with the
+ *      START_AP and SET_BSS commands. This can have the values 0 or 1;
+ *      if not given in START_AP 0 is assumed, if not given in SET_BSS
+ *      no change is made.
+ *
  * @NL80211_ATTR_MAX: highest attribute number currently defined
  * @__NL80211_ATTR_AFTER_LAST: internal use
  */
@@ -1530,6 +1567,19 @@ enum nl80211_attrs {
 
         NL80211_ATTR_CONN_FAILED_REASON,
 
+        NL80211_ATTR_SAE_DATA,
+
+        NL80211_ATTR_VHT_CAPABILITY,
+
+        NL80211_ATTR_SCAN_FLAGS,
+
+        NL80211_ATTR_CHANNEL_WIDTH,
+        NL80211_ATTR_CENTER_FREQ1,
+        NL80211_ATTR_CENTER_FREQ2,
+
+        NL80211_ATTR_P2P_CTWINDOW,
+        NL80211_ATTR_P2P_OPPPS,
+
         /* add attributes here, update the policy in nl80211.c */
 
         __NL80211_ATTR_AFTER_LAST,
@@ -1573,6 +1623,7 @@ enum nl80211_attrs {
 #define NL80211_TKIP_DATA_OFFSET_TX_MIC_KEY     16
 #define NL80211_TKIP_DATA_OFFSET_RX_MIC_KEY     24
 #define NL80211_HT_CAPABILITY_LEN               26
+#define NL80211_VHT_CAPABILITY_LEN              12
 
 #define NL80211_MAX_NR_CIPHER_SUITES            5
 #define NL80211_MAX_NR_AKM_SUITES               2
@@ -1693,10 +1744,15 @@ struct nl80211_sta_flag_update {
  * @__NL80211_RATE_INFO_INVALID: attribute number 0 is reserved
  * @NL80211_RATE_INFO_BITRATE: total bitrate (u16, 100kbit/s)
  * @NL80211_RATE_INFO_MCS: mcs index for 802.11n (u8)
- * @NL80211_RATE_INFO_40_MHZ_WIDTH: 40 Mhz dualchannel bitrate
+ * @NL80211_RATE_INFO_40_MHZ_WIDTH: 40 MHz dualchannel bitrate
  * @NL80211_RATE_INFO_SHORT_GI: 400ns guard interval
  * @NL80211_RATE_INFO_BITRATE32: total bitrate (u32, 100kbit/s)
  * @NL80211_RATE_INFO_MAX: highest rate_info number currently defined
+ * @NL80211_RATE_INFO_VHT_MCS: MCS index for VHT (u8)
+ * @NL80211_RATE_INFO_VHT_NSS: number of streams in VHT (u8)
+ * @NL80211_RATE_INFO_80_MHZ_WIDTH: 80 MHz VHT rate
+ * @NL80211_RATE_INFO_80P80_MHZ_WIDTH: 80+80 MHz VHT rate
+ * @NL80211_RATE_INFO_160_MHZ_WIDTH: 160 MHz VHT rate
  * @__NL80211_RATE_INFO_AFTER_LAST: internal use
  */
 enum nl80211_rate_info {
@@ -1706,6 +1762,11 @@ enum nl80211_rate_info {
         NL80211_RATE_INFO_40_MHZ_WIDTH,
         NL80211_RATE_INFO_SHORT_GI,
         NL80211_RATE_INFO_BITRATE32,
+        NL80211_RATE_INFO_VHT_MCS,
+        NL80211_RATE_INFO_VHT_NSS,
+        NL80211_RATE_INFO_80_MHZ_WIDTH,
+        NL80211_RATE_INFO_80P80_MHZ_WIDTH,
+        NL80211_RATE_INFO_160_MHZ_WIDTH,
 
         /* keep last */
         __NL80211_RATE_INFO_AFTER_LAST,
@@ -2414,6 +2475,15 @@ enum nl80211_ac {
 #define NL80211_TXQ_Q_BE        NL80211_AC_BE
 #define NL80211_TXQ_Q_BK        NL80211_AC_BK
 
+/**
+ * enum nl80211_channel_type - channel type
+ * @NL80211_CHAN_NO_HT: 20 MHz, non-HT channel
+ * @NL80211_CHAN_HT20: 20 MHz HT channel
+ * @NL80211_CHAN_HT40MINUS: HT40 channel, secondary channel
+ *      below the control channel
+ * @NL80211_CHAN_HT40PLUS: HT40 channel, secondary channel
+ *      above the control channel
+ */
 enum nl80211_channel_type {
         NL80211_CHAN_NO_HT,
         NL80211_CHAN_HT20,
@@ -2422,6 +2492,32 @@ enum nl80211_channel_type {
 };
 
 /**
+ * enum nl80211_chan_width - channel width definitions
+ *
+ * These values are used with the %NL80211_ATTR_CHANNEL_WIDTH
+ * attribute.
+ *
+ * @NL80211_CHAN_WIDTH_20_NOHT: 20 MHz, non-HT channel
+ * @NL80211_CHAN_WIDTH_20: 20 MHz HT channel
+ * @NL80211_CHAN_WIDTH_40: 40 MHz channel, the %NL80211_ATTR_CENTER_FREQ1
+ *      attribute must be provided as well
+ * @NL80211_CHAN_WIDTH_80: 80 MHz channel, the %NL80211_ATTR_CENTER_FREQ1
+ *      attribute must be provided as well
+ * @NL80211_CHAN_WIDTH_80P80: 80+80 MHz channel, the %NL80211_ATTR_CENTER_FREQ1
+ *      and %NL80211_ATTR_CENTER_FREQ2 attributes must be provided as well
+ * @NL80211_CHAN_WIDTH_160: 160 MHz channel, the %NL80211_ATTR_CENTER_FREQ1
+ *      attribute must be provided as well
+ */
+enum nl80211_chan_width {
+        NL80211_CHAN_WIDTH_20_NOHT,
+        NL80211_CHAN_WIDTH_20,
+        NL80211_CHAN_WIDTH_40,
+        NL80211_CHAN_WIDTH_80,
+        NL80211_CHAN_WIDTH_80P80,
+        NL80211_CHAN_WIDTH_160,
+};
+
+/**
  * enum nl80211_bss - netlink attributes for a BSS
  *
  * @__NL80211_BSS_INVALID: invalid
@@ -2489,6 +2585,7 @@ enum nl80211_bss_status {
  * @NL80211_AUTHTYPE_SHARED_KEY: Shared Key authentication (WEP only)
  * @NL80211_AUTHTYPE_FT: Fast BSS Transition (IEEE 802.11r)
  * @NL80211_AUTHTYPE_NETWORK_EAP: Network EAP (some Cisco APs and mainly LEAP)
+ * @NL80211_AUTHTYPE_SAE: Simultaneous authentication of equals
  * @__NL80211_AUTHTYPE_NUM: internal
  * @NL80211_AUTHTYPE_MAX: maximum valid auth algorithm
  * @NL80211_AUTHTYPE_AUTOMATIC: determine automatically (if necessary by
@@ -2500,6 +2597,7 @@ enum nl80211_auth_type {
         NL80211_AUTHTYPE_SHARED_KEY,
         NL80211_AUTHTYPE_FT,
         NL80211_AUTHTYPE_NETWORK_EAP,
+        NL80211_AUTHTYPE_SAE,
 
         /* keep last */
         __NL80211_AUTHTYPE_NUM,
@@ -3028,6 +3126,20 @@ enum nl80211_ap_sme_features {
  *      in the interface combinations, even when it's only used for scan
  *      and remain-on-channel. This could be due to, for example, the
  *      remain-on-channel implementation requiring a channel context.
+ * @NL80211_FEATURE_SAE: This driver supports simultaneous authentication of
+ *      equals (SAE) with user space SME (NL80211_CMD_AUTHENTICATE) in station
+ *      mode
+ * @NL80211_FEATURE_LOW_PRIORITY_SCAN: This driver supports low priority scan
+ * @NL80211_FEATURE_SCAN_FLUSH: Scan flush is supported
+ * @NL80211_FEATURE_AP_SCAN: Support scanning using an AP vif
+ * @NL80211_FEATURE_VIF_TXPOWER: The driver supports per-vif TX power setting
+ * @NL80211_FEATURE_NEED_OBSS_SCAN: The driver expects userspace to perform
+ *      OBSS scans and generate 20/40 BSS coex reports. This flag is used only
+ *      for drivers implementing the CONNECT API, for AUTH/ASSOC it is implied.
+ * @NL80211_FEATURE_P2P_GO_CTWIN: P2P GO implementation supports CT Window
+ *      setting
+ * @NL80211_FEATURE_P2P_GO_OPPPS: P2P GO implementation supports opportunistic
+ *      powersave
  */
 enum nl80211_feature_flags {
         NL80211_FEATURE_SK_TX_STATUS                    = 1 << 0,
@@ -3035,6 +3147,14 @@ enum nl80211_feature_flags {
         NL80211_FEATURE_INACTIVITY_TIMER                = 1 << 2,
         NL80211_FEATURE_CELL_BASE_REG_HINTS             = 1 << 3,
         NL80211_FEATURE_P2P_DEVICE_NEEDS_CHANNEL        = 1 << 4,
+        NL80211_FEATURE_SAE                             = 1 << 5,
+        NL80211_FEATURE_LOW_PRIORITY_SCAN               = 1 << 6,
+        NL80211_FEATURE_SCAN_FLUSH                      = 1 << 7,
+        NL80211_FEATURE_AP_SCAN                         = 1 << 8,
+        NL80211_FEATURE_VIF_TXPOWER                     = 1 << 9,
+        NL80211_FEATURE_NEED_OBSS_SCAN                  = 1 << 10,
+        NL80211_FEATURE_P2P_GO_CTWIN                    = 1 << 11,
+        NL80211_FEATURE_P2P_GO_OPPPS                    = 1 << 12,
 };
 
 /**
@@ -3069,4 +3189,25 @@ enum nl80211_connect_failed_reason {
         NL80211_CONN_FAIL_BLOCKED_CLIENT,
 };
 
+/**
+ * enum nl80211_scan_flags -  scan request control flags
+ *
+ * Scan request control flags are used to control the handling
+ * of NL80211_CMD_TRIGGER_SCAN and NL80211_CMD_START_SCHED_SCAN
+ * requests.
+ *
+ * @NL80211_SCAN_FLAG_LOW_PRIORITY: scan request has low priority
+ * @NL80211_SCAN_FLAG_FLUSH: flush cache before scanning
+ * @NL80211_SCAN_FLAG_AP: force a scan even if the interface is configured
+ *      as AP and the beaconing has already been configured. This attribute is
+ *      dangerous because will destroy stations performance as a lot of frames
+ *      will be lost while scanning off-channel, therefore it must be used only
+ *      when really needed
+ */
+enum nl80211_scan_flags {
+        NL80211_SCAN_FLAG_LOW_PRIORITY                  = 1<<0,
+        NL80211_SCAN_FLAG_FLUSH                         = 1<<1,
+        NL80211_SCAN_FLAG_AP                            = 1<<2,
+};
+
 #endif /* __LINUX_NL80211_H */
diff --git a/include/uapi/linux/ptp_clock.h b/include/uapi/linux/ptp_clock.h
index 94e981f810a2..b65c834f83e9 100644
--- a/include/uapi/linux/ptp_clock.h
+++ b/include/uapi/linux/ptp_clock.h
@@ -67,12 +67,26 @@ struct ptp_perout_request {
         unsigned int rsv[4];          /* Reserved for future use. */
 };
 
+#define PTP_MAX_SAMPLES 25 /* Maximum allowed offset measurement samples. */
+
+struct ptp_sys_offset {
+        unsigned int n_samples; /* Desired number of measurements. */
+        unsigned int rsv[3];    /* Reserved for future use. */
+        /*
+         * Array of interleaved system/phc time stamps. The kernel
+         * will provide 2*n_samples + 1 time stamps, with the last
+         * one as a system time stamp.
+         */
+        struct ptp_clock_time ts[2 * PTP_MAX_SAMPLES + 1];
+};
+
 #define PTP_CLK_MAGIC '='
 
 #define PTP_CLOCK_GETCAPS  _IOR(PTP_CLK_MAGIC, 1, struct ptp_clock_caps)
 #define PTP_EXTTS_REQUEST  _IOW(PTP_CLK_MAGIC, 2, struct ptp_extts_request)
 #define PTP_PEROUT_REQUEST _IOW(PTP_CLK_MAGIC, 3, struct ptp_perout_request)
 #define PTP_ENABLE_PPS     _IOW(PTP_CLK_MAGIC, 4, int)
+#define PTP_SYS_OFFSET     _IOW(PTP_CLK_MAGIC, 5, struct ptp_sys_offset)
 
 struct ptp_extts_event {
         struct ptp_clock_time t; /* Time event occured. */
diff --git a/include/uapi/linux/rtnetlink.h b/include/uapi/linux/rtnetlink.h
index fcd768b09f6e..7a5eb196ade9 100644
--- a/include/uapi/linux/rtnetlink.h
+++ b/include/uapi/linux/rtnetlink.h
@@ -120,6 +120,18 @@ enum {
         RTM_SETDCB,
 #define RTM_SETDCB RTM_SETDCB
 
+        RTM_NEWNETCONF = 80,
+#define RTM_NEWNETCONF RTM_NEWNETCONF
+        RTM_GETNETCONF = 82,
+#define RTM_GETNETCONF RTM_GETNETCONF
+
+        RTM_NEWMDB = 84,
+#define RTM_NEWMDB RTM_NEWMDB
+        RTM_DELMDB = 85,
+#define RTM_DELMDB RTM_DELMDB
+        RTM_GETMDB = 86,
+#define RTM_GETMDB RTM_GETMDB
+
         __RTM_MAX,
 #define RTM_MAX         (((__RTM_MAX + 3) & ~3) - 1)
 };
@@ -222,6 +234,7 @@ enum {
 #define RTPROT_XORP     14      /* XORP */
 #define RTPROT_NTK      15      /* Netsukuku */
 #define RTPROT_DHCP     16      /* DHCP client */
+#define RTPROT_MROUTED  17      /* Multicast daemon */
 
 /* rtm_scope
 
@@ -283,6 +296,7 @@ enum rtattr_type_t {
         RTA_MP_ALGO, /* no longer used */
         RTA_TABLE,
         RTA_MARK,
+        RTA_MFC_STATS,
         __RTA_MAX
 };
 
@@ -403,6 +417,12 @@ struct rta_session {
         } u;
 };
 
+struct rta_mfc_stats {
+        __u64   mfcs_packets;
+        __u64   mfcs_bytes;
+        __u64   mfcs_wrong_if;
+};
+
 /****
  *              General form of address family dependent message.
  ****/
@@ -587,6 +607,12 @@ enum rtnetlink_groups {
 #define RTNLGRP_PHONET_ROUTE    RTNLGRP_PHONET_ROUTE
         RTNLGRP_DCB,
 #define RTNLGRP_DCB             RTNLGRP_DCB
+        RTNLGRP_IPV4_NETCONF,
+#define RTNLGRP_IPV4_NETCONF    RTNLGRP_IPV4_NETCONF
+        RTNLGRP_IPV6_NETCONF,
+#define RTNLGRP_IPV6_NETCONF    RTNLGRP_IPV6_NETCONF
+        RTNLGRP_MDB,
+#define RTNLGRP_MDB             RTNLGRP_MDB
         __RTNLGRP_MAX
 };
 #define RTNLGRP_MAX     (__RTNLGRP_MAX - 1)
diff --git a/include/uapi/linux/unix_diag.h b/include/uapi/linux/unix_diag.h
index b1d2bf16b33c..b8a24941db21 100644
--- a/include/uapi/linux/unix_diag.h
+++ b/include/uapi/linux/unix_diag.h
@@ -37,6 +37,7 @@ enum {
         UNIX_DIAG_ICONS,
         UNIX_DIAG_RQLEN,
         UNIX_DIAG_MEMINFO,
+        UNIX_DIAG_SHUTDOWN,
 
         UNIX_DIAG_MAX,
 };
diff --git a/include/uapi/linux/usb/cdc.h b/include/uapi/linux/usb/cdc.h
index 81a927930bfd..f35aa0a338c7 100644
--- a/include/uapi/linux/usb/cdc.h
+++ b/include/uapi/linux/usb/cdc.h
@@ -19,6 +19,7 @@
 #define USB_CDC_SUBCLASS_OBEX                   0x0b
 #define USB_CDC_SUBCLASS_EEM                    0x0c
 #define USB_CDC_SUBCLASS_NCM                    0x0d
+#define USB_CDC_SUBCLASS_MBIM                   0x0e
 
 #define USB_CDC_PROTO_NONE                      0
 
@@ -33,6 +34,7 @@
 #define USB_CDC_PROTO_EEM                       7
 
 #define USB_CDC_NCM_PROTO_NTB                   1
+#define USB_CDC_MBIM_PROTO_NTB                  2
 
 /*-------------------------------------------------------------------------*/
 
@@ -53,6 +55,7 @@
 #define USB_CDC_DMM_TYPE                0x14
 #define USB_CDC_OBEX_TYPE               0x15
 #define USB_CDC_NCM_TYPE                0x1a
+#define USB_CDC_MBIM_TYPE               0x1b
 
 /* "Header Functional Descriptor" from CDC spec  5.2.3.1 */
 struct usb_cdc_header_desc {
@@ -187,6 +190,21 @@ struct usb_cdc_ncm_desc {
         __le16  bcdNcmVersion;
         __u8    bmNetworkCapabilities;
 } __attribute__ ((packed));
+
+/* "MBIM Control Model Functional Descriptor" */
+struct usb_cdc_mbim_desc {
+        __u8    bLength;
+        __u8    bDescriptorType;
+        __u8    bDescriptorSubType;
+
+        __le16  bcdMBIMVersion;
+        __le16  wMaxControlMessage;
+        __u8    bNumberFilters;
+        __u8    bMaxFilterSize;
+        __le16  wMaxSegmentSize;
+        __u8    bmNetworkCapabilities;
+} __attribute__ ((packed));
+
 /*-------------------------------------------------------------------------*/
 
 /*
@@ -332,6 +350,11 @@ struct usb_cdc_ncm_nth32 {
 #define USB_CDC_NCM_NDP32_CRC_SIGN      0x316D636E /* ncm1 */
 #define USB_CDC_NCM_NDP32_NOCRC_SIGN    0x306D636E /* ncm0 */
 
+#define USB_CDC_MBIM_NDP16_IPS_SIGN     0x00535049 /* IPS<sessionID> : IPS0 for now */
+#define USB_CDC_MBIM_NDP32_IPS_SIGN     0x00737069 /* ips<sessionID> : ips0 for now */
+#define USB_CDC_MBIM_NDP16_DSS_SIGN     0x00535344 /* DSS<sessionID> */
+#define USB_CDC_MBIM_NDP32_DSS_SIGN     0x00737364 /* dss<sessionID> */
+
 /* 16-bit NCM Datagram Pointer Entry */
 struct usb_cdc_ncm_dpe16 {
         __le16  wDatagramIndex;
diff --git a/include/uapi/linux/virtio_net.h b/include/uapi/linux/virtio_net.h
index 2470f541af50..848e3584d7c8 100644
--- a/include/uapi/linux/virtio_net.h
+++ b/include/uapi/linux/virtio_net.h
@@ -51,6 +51,8 @@
 #define VIRTIO_NET_F_CTRL_RX_EXTRA 20   /* Extra RX mode control support */
 #define VIRTIO_NET_F_GUEST_ANNOUNCE 21  /* Guest can announce device on the
                                          * network */
+#define VIRTIO_NET_F_MQ 22      /* Device supports Receive Flow
+                                         * Steering */
 
 #define VIRTIO_NET_S_LINK_UP    1       /* Link is up */
 #define VIRTIO_NET_S_ANNOUNCE   2       /* Announcement is needed */
@@ -60,6 +62,11 @@ struct virtio_net_config {
         __u8 mac[6];
         /* See VIRTIO_NET_F_STATUS and VIRTIO_NET_S_* above */
         __u16 status;
+        /* Maximum number of each of transmit and receive queues;
+         * see VIRTIO_NET_F_MQ and VIRTIO_NET_CTRL_MQ.
+         * Legal values are between 1 and 0x8000
+         */
+        __u16 max_virtqueue_pairs;
 } __attribute__((packed));
 
 /* This is the first element of the scatter-gather list.  If you don't
@@ -166,4 +173,24 @@ struct virtio_net_ctrl_mac {
 #define VIRTIO_NET_CTRL_ANNOUNCE       3
  #define VIRTIO_NET_CTRL_ANNOUNCE_ACK         0
 
+/*
+ * Control Receive Flow Steering
+ *
+ * The command VIRTIO_NET_CTRL_MQ_VQ_PAIRS_SET
+ * enables Receive Flow Steering, specifying the number of the transmit and
+ * receive queues that will be used. After the command is consumed and acked by
+ * the device, the device will not steer new packets on receive virtqueues
+ * other than specified nor read from transmit virtqueues other than specified.
+ * Accordingly, driver should not transmit new packets  on virtqueues other than
+ * specified.
+ */
+struct virtio_net_ctrl_mq {
+        u16 virtqueue_pairs;
+};
+
+#define VIRTIO_NET_CTRL_MQ   4
+ #define VIRTIO_NET_CTRL_MQ_VQ_PAIRS_SET        0
+ #define VIRTIO_NET_CTRL_MQ_VQ_PAIRS_MIN        1
+ #define VIRTIO_NET_CTRL_MQ_VQ_PAIRS_MAX        0x8000
+
 #endif /* _LINUX_VIRTIO_NET_H */