77 files changed, 1759 insertions, 534 deletions
diff --git a/include/linux/bcma/bcma.h b/include/linux/bcma/bcma.h
index 4180eb78d575..93b1e091b1e9 100644
--- a/include/linux/bcma/bcma.h
+++ b/include/linux/bcma/bcma.h
@@ -157,6 +157,7 @@ struct bcma_host_ops {
 /* Chip IDs of SoCs */
 #define BCMA_CHIP_ID_BCM4706    0x5300
+#define  BCMA_PKG_ID_BCM4706L   1
 #define BCMA_CHIP_ID_BCM4716    0x4716
 #define  BCMA_PKG_ID_BCM4716    8
 #define  BCMA_PKG_ID_BCM4717    9
@@ -166,7 +167,11 @@ struct bcma_host_ops {
 #define BCMA_CHIP_ID_BCM4749    0x4749
 #define BCMA_CHIP_ID_BCM5356    0x5356
 #define BCMA_CHIP_ID_BCM5357    0x5357
+#define  BCMA_PKG_ID_BCM5358    9
+#define  BCMA_PKG_ID_BCM47186   10
+#define  BCMA_PKG_ID_BCM5357    11
 #define BCMA_CHIP_ID_BCM53572   53572
+#define  BCMA_PKG_ID_BCM47188   9
 struct bcma_device {
        struct bcma_bus *bus;
@@ -251,7 +256,7 @@ struct bcma_bus {
        u8 num;
        struct bcma_drv_cc drv_cc;
-        struct bcma_drv_pci drv_pci;
+        struct bcma_drv_pci drv_pci[2];
        struct bcma_drv_mips drv_mips;
        struct bcma_drv_gmac_cmn drv_gmac_cmn;
diff --git a/include/linux/bcma/bcma_driver_chipcommon.h b/include/linux/bcma/bcma_driver_chipcommon.h
index 1cf1749440ac..145f3c56227f 100644
--- a/include/linux/bcma/bcma_driver_chipcommon.h
+++ b/include/linux/bcma/bcma_driver_chipcommon.h
@@ -510,6 +510,7 @@ struct bcma_chipcommon_pmu {
 #ifdef CONFIG_BCMA_DRIVER_MIPS
 struct bcma_pflash {
+        bool present;
        u8 buswidth;
        u32 window;
        u32 window_size;
@@ -532,6 +533,7 @@ struct mtd_info;
 struct bcma_nflash {
        bool present;
+        bool boot;              /* This is the flash the SoC boots from */
        struct mtd_info *mtd;
 };
@@ -552,6 +554,7 @@ struct bcma_drv_cc {
        u32 capabilities;
        u32 capabilities_ext;
        u8 setup_done:1;
+        u8 early_setup_done:1;
        /* Fast Powerup Delay constant */
        u16 fast_pwrup_delay;
        struct bcma_chipcommon_pmu pmu;
@@ -583,6 +586,7 @@ struct bcma_drv_cc {
        bcma_cc_write32(cc, offset, (bcma_cc_read32(cc, offset) & (mask)) | (set))
 extern void bcma_core_chipcommon_init(struct bcma_drv_cc *cc);
+extern void bcma_core_chipcommon_early_init(struct bcma_drv_cc *cc);
 extern void bcma_chipco_suspend(struct bcma_drv_cc *cc);
 extern void bcma_chipco_resume(struct bcma_drv_cc *cc);
@@ -606,6 +610,7 @@ u32 bcma_chipco_gpio_polarity(struct bcma_drv_cc *cc, u32 mask, u32 value);
 /* PMU support */
 extern void bcma_pmu_init(struct bcma_drv_cc *cc);
+extern void bcma_pmu_early_init(struct bcma_drv_cc *cc);
 extern void bcma_chipco_pll_write(struct bcma_drv_cc *cc, u32 offset,
                                  u32 value);
diff --git a/include/linux/bcma/bcma_driver_mips.h b/include/linux/bcma/bcma_driver_mips.h
index c0043645cdcb..0baf8a56b794 100644
--- a/include/linux/bcma/bcma_driver_mips.h
+++ b/include/linux/bcma/bcma_driver_mips.h
@@ -35,13 +35,16 @@ struct bcma_device;
 struct bcma_drv_mips {
        struct bcma_device *core;
        u8 setup_done:1;
+        u8 early_setup_done:1;
        unsigned int assigned_irqs;
 };
 #ifdef CONFIG_BCMA_DRIVER_MIPS
 extern void bcma_core_mips_init(struct bcma_drv_mips *mcore);
+extern void bcma_core_mips_early_init(struct bcma_drv_mips *mcore);
 #else
 static inline void bcma_core_mips_init(struct bcma_drv_mips *mcore) { }
+static inline void bcma_core_mips_early_init(struct bcma_drv_mips *mcore) { }
 #endif
 extern u32 bcma_cpu_clock(struct bcma_drv_mips *mcore);
diff --git a/include/linux/bcma/bcma_regs.h b/include/linux/bcma/bcma_regs.h
index 6c9cb93ae3de..7e8104bb7a7e 100644
--- a/include/linux/bcma/bcma_regs.h
+++ b/include/linux/bcma/bcma_regs.h
@@ -85,6 +85,9 @@
                                                         * (2 ZettaBytes), high 32 bits
                                                         */
-#define BCMA_SFLASH                     0x1c000000
+#define BCMA_SOC_FLASH1                 0x1fc00000      /* MIPS Flash Region 1 */
+#define BCMA_SOC_FLASH1_SZ              0x00400000      /* MIPS Size of Flash Region 1 */
+#define BCMA_SOC_FLASH2                 0x1c000000      /* Flash Region 2 (region 1 shadowed here) */
+#define BCMA_SOC_FLASH2_SZ              0x02000000      /* Size of Flash Region 2 */
 #endif /* LINUX_BCMA_REGS_H_ */
diff --git a/include/linux/etherdevice.h b/include/linux/etherdevice.h
index b006ba0a9f42..243eea1e33d8 100644
--- a/include/linux/etherdevice.h
+++ b/include/linux/etherdevice.h
@@ -51,6 +51,26 @@ extern struct net_device *alloc_etherdev_mqs(int sizeof_priv, unsigned int txqs,
 #define alloc_etherdev(sizeof_priv) alloc_etherdev_mq(sizeof_priv, 1)
 #define alloc_etherdev_mq(sizeof_priv, count) alloc_etherdev_mqs(sizeof_priv, count, count)
+/* Reserved Ethernet Addresses per IEEE 802.1Q */
+static const u8 eth_reserved_addr_base[ETH_ALEN] __aligned(2) =
+{ 0x01, 0x80, 0xc2, 0x00, 0x00, 0x00 };
+/**
+ * is_link_local_ether_addr - Determine if given Ethernet address is link-local
+ * @addr: Pointer to a six-byte array containing the Ethernet address
+ *
+ * Return true if address is link local reserved addr (01:80:c2:00:00:0X) per
+ * IEEE 802.1Q 8.6.3 Frame filtering.
+ */
+static inline bool is_link_local_ether_addr(const u8 *addr)
+{
+        __be16 *a = (__be16 *)addr;
+        static const __be16 *b = (const __be16 *)eth_reserved_addr_base;
+        static const __be16 m = cpu_to_be16(0xfff0);
+        return ((a[0] ^ b[0]) | (a[1] ^ b[1]) | ((a[2] ^ b[2]) & m)) == 0;
+}
 /**
 * is_zero_ether_addr - Determine if give Ethernet address is all zeros.
 * @addr: Pointer to a six-byte array containing the Ethernet address
diff --git a/include/linux/filter.h b/include/linux/filter.h
index 24d251f3bab0..c45eabc135e1 100644
--- a/include/linux/filter.h
+++ b/include/linux/filter.h
@@ -45,6 +45,7 @@ extern void sk_unattached_filter_destroy(struct sk_filter *fp);
 extern int sk_attach_filter(struct sock_fprog *fprog, struct sock *sk);
 extern int sk_detach_filter(struct sock *sk);
 extern int sk_chk_filter(struct sock_filter *filter, unsigned int flen);
+extern int sk_get_filter(struct sock *sk, struct sock_filter __user *filter, unsigned len);
 #ifdef CONFIG_BPF_JIT
 extern void bpf_jit_compile(struct sk_filter *fp);
@@ -123,6 +124,8 @@ enum {
        BPF_S_ANC_CPU,
        BPF_S_ANC_ALU_XOR_X,
        BPF_S_ANC_SECCOMP_LD_W,
+        BPF_S_ANC_VLAN_TAG,
+        BPF_S_ANC_VLAN_TAG_PRESENT,
 };
 #endif /* __LINUX_FILTER_H__ */
diff --git a/include/linux/hdlc/Kbuild b/include/linux/hdlc/Kbuild
index 1fb26448faa9..e69de29bb2d1 100644
--- a/include/linux/hdlc/Kbuild
+++ b/include/linux/hdlc/Kbuild
@@ -1 +0,0 @@
-header-y += ioctl.h
diff --git a/include/linux/ieee80211.h b/include/linux/ieee80211.h
index 2385119f8bb0..f9c5a787d350 100644
--- a/include/linux/ieee80211.h
+++ b/include/linux/ieee80211.h
@@ -131,6 +131,8 @@
 #define IEEE80211_MAX_MESH_ID_LEN       32
+#define IEEE80211_NUM_TIDS              16
 #define IEEE80211_QOS_CTL_LEN           2
 /* 1d tag mask */
 #define IEEE80211_QOS_CTL_TAG1D_MASK            0x0007
@@ -666,6 +668,21 @@ struct ieee80211_meshconf_ie {
 } __attribute__ ((packed));
 /**
+ * enum mesh_config_capab_flags - Mesh Configuration IE capability field flags
+ *
+ * @IEEE80211_MESHCONF_CAPAB_ACCEPT_PLINKS: STA is willing to establish
+ *      additional mesh peerings with other mesh STAs
+ * @IEEE80211_MESHCONF_CAPAB_FORWARDING: the STA forwards MSDUs
+ * @IEEE80211_MESHCONF_CAPAB_TBTT_ADJUSTING: TBTT adjustment procedure
+ *      is ongoing
+ */
+enum mesh_config_capab_flags {
+        IEEE80211_MESHCONF_CAPAB_ACCEPT_PLINKS          = 0x01,
+        IEEE80211_MESHCONF_CAPAB_FORWARDING             = 0x08,
+        IEEE80211_MESHCONF_CAPAB_TBTT_ADJUSTING         = 0x20,
+};
+/**
 * struct ieee80211_rann_ie
 *
 * This structure refers to "Root Announcement information element"
@@ -905,6 +922,38 @@ struct ieee80211_tdls_data {
        } u;
 } __packed;
+/*
+ * Peer-to-Peer IE attribute related definitions.
+ */
+/**
+ * enum ieee80211_p2p_attr_id - identifies type of peer-to-peer attribute.
+ */
+enum ieee80211_p2p_attr_id {
+        IEEE80211_P2P_ATTR_STATUS = 0,
+        IEEE80211_P2P_ATTR_MINOR_REASON,
+        IEEE80211_P2P_ATTR_CAPABILITY,
+        IEEE80211_P2P_ATTR_DEVICE_ID,
+        IEEE80211_P2P_ATTR_GO_INTENT,
+        IEEE80211_P2P_ATTR_GO_CONFIG_TIMEOUT,
+        IEEE80211_P2P_ATTR_LISTEN_CHANNEL,
+        IEEE80211_P2P_ATTR_GROUP_BSSID,
+        IEEE80211_P2P_ATTR_EXT_LISTEN_TIMING,
+        IEEE80211_P2P_ATTR_INTENDED_IFACE_ADDR,
+        IEEE80211_P2P_ATTR_MANAGABILITY,
+        IEEE80211_P2P_ATTR_CHANNEL_LIST,
+        IEEE80211_P2P_ATTR_ABSENCE_NOTICE,
+        IEEE80211_P2P_ATTR_DEVICE_INFO,
+        IEEE80211_P2P_ATTR_GROUP_INFO,
+        IEEE80211_P2P_ATTR_GROUP_ID,
+        IEEE80211_P2P_ATTR_INTERFACE,
+        IEEE80211_P2P_ATTR_OPER_CHANNEL,
+        IEEE80211_P2P_ATTR_INVITE_FLAGS,
+        /* 19 - 220: Reserved */
+        IEEE80211_P2P_ATTR_VENDOR_SPECIFIC = 221,
+        IEEE80211_P2P_ATTR_MAX
+};
 /**
 * struct ieee80211_bar - HT Block Ack Request
 *
@@ -1107,20 +1156,6 @@ struct ieee80211_ht_operation {
 #define WLAN_HT_SMPS_CONTROL_STATIC     1
 #define WLAN_HT_SMPS_CONTROL_DYNAMIC    3
-#define VHT_MCS_SUPPORTED_SET_SIZE      8
-struct ieee80211_vht_capabilities {
-        __le32 vht_capabilities_info;
-        u8 vht_supported_mcs_set[VHT_MCS_SUPPORTED_SET_SIZE];
-} __packed;
-struct ieee80211_vht_operation {
-        u8 vht_op_info_chwidth;
-        u8 vht_op_info_chan_center_freq_seg1_idx;
-        u8 vht_op_info_chan_center_freq_seg2_idx;
-        __le16 vht_basic_mcs_set;
-} __packed;
 /**
 * struct ieee80211_vht_mcs_info - VHT MCS information
 * @rx_mcs_map: RX MCS map 2 bits for each stream, total 8 streams
@@ -1128,11 +1163,13 @@ struct ieee80211_vht_operation {
 *      STA can receive. Rate expressed in units of 1 Mbps.
 *      If this field is 0 this value should not be used to
 *      consider the highest RX data rate supported.
+ *      The top 3 bits of this field are reserved.
 * @tx_mcs_map: TX MCS map 2 bits for each stream, total 8 streams
 * @tx_highest: Indicates highest long GI VHT PPDU data rate
 *      STA can transmit. Rate expressed in units of 1 Mbps.
 *      If this field is 0 this value should not be used to
 *      consider the highest TX data rate supported.
+ *      The top 3 bits of this field are reserved.
 */
 struct ieee80211_vht_mcs_info {
        __le16 rx_mcs_map;
@@ -1141,6 +1178,58 @@ struct ieee80211_vht_mcs_info {
        __le16 tx_highest;
 } __packed;
+/**
+ * enum ieee80211_vht_mcs_support - VHT MCS support definitions
+ * @IEEE80211_VHT_MCS_SUPPORT_0_7: MCSes 0-7 are supported for the
+ *      number of streams
+ * @IEEE80211_VHT_MCS_SUPPORT_0_8: MCSes 0-8 are supported
+ * @IEEE80211_VHT_MCS_SUPPORT_0_9: MCSes 0-9 are supported
+ * @IEEE80211_VHT_MCS_NOT_SUPPORTED: This number of streams isn't supported
+ *
+ * These definitions are used in each 2-bit subfield of the @rx_mcs_map
+ * and @tx_mcs_map fields of &struct ieee80211_vht_mcs_info, which are
+ * both split into 8 subfields by number of streams. These values indicate
+ * which MCSes are supported for the number of streams the value appears
+ * for.
+ */
+enum ieee80211_vht_mcs_support {
+        IEEE80211_VHT_MCS_SUPPORT_0_7   = 0,
+        IEEE80211_VHT_MCS_SUPPORT_0_8   = 1,
+        IEEE80211_VHT_MCS_SUPPORT_0_9   = 2,
+        IEEE80211_VHT_MCS_NOT_SUPPORTED = 3,
+};
+/**
+ * struct ieee80211_vht_cap - VHT capabilities
+ *
+ * This structure is the "VHT capabilities element" as
+ * described in 802.11ac D3.0 8.4.2.160
+ * @vht_cap_info: VHT capability info
+ * @supp_mcs: VHT MCS supported rates
+ */
+struct ieee80211_vht_cap {
+        __le32 vht_cap_info;
+        struct ieee80211_vht_mcs_info supp_mcs;
+} __packed;
+/**
+ * struct ieee80211_vht_operation - VHT operation IE
+ *
+ * This structure is the "VHT operation element" as
+ * described in 802.11ac D3.0 8.4.2.161
+ * @chan_width: Operating channel width
+ * @center_freq_seg1_idx: center freq segment 1 index
+ * @center_freq_seg2_idx: center freq segment 2 index
+ * @basic_mcs_set: VHT Basic MCS rate set
+ */
+struct ieee80211_vht_operation {
+        u8 chan_width;
+        u8 center_freq_seg1_idx;
+        u8 center_freq_seg2_idx;
+        __le16 basic_mcs_set;
+} __packed;
 #define IEEE80211_VHT_MCS_ZERO_TO_SEVEN_SUPPORT 0
 #define IEEE80211_VHT_MCS_ZERO_TO_EIGHT_SUPPORT 1
 #define IEEE80211_VHT_MCS_ZERO_TO_NINE_SUPPORT  2
@@ -1440,8 +1529,6 @@ enum ieee80211_eid {
        WLAN_EID_RSN = 48,
        WLAN_EID_MMIE = 76,
-        WLAN_EID_WPA = 221,
-        WLAN_EID_GENERIC = 221,
        WLAN_EID_VENDOR_SPECIFIC = 221,
        WLAN_EID_QOS_PARAMETER = 222,
diff --git a/include/linux/if_tunnel.h b/include/linux/if_tunnel.h
index 1cc595a67cc9..f4e56ecd0b1a 100644
--- a/include/linux/if_tunnel.h
+++ b/include/linux/if_tunnel.h
@@ -4,5 +4,22 @@
 #include <linux/ip.h>
 #include <linux/in6.h>
 #include <uapi/linux/if_tunnel.h>
+#include <linux/u64_stats_sync.h>
+/*
+ * Locking : hash tables are protected by RCU and RTNL
+ */
+#define for_each_ip_tunnel_rcu(pos, start) \
+        for (pos = rcu_dereference(start); pos; pos = rcu_dereference(pos->next))
+/* often modified stats are per cpu, other are shared (netdev->stats) */
+struct pcpu_tstats {
+        u64     rx_packets;
+        u64     rx_bytes;
+        u64     tx_packets;
+        u64     tx_bytes;
+        struct u64_stats_sync   syncp;
+};
 #endif /* _IF_TUNNEL_H_ */
diff --git a/include/linux/ipv6.h b/include/linux/ipv6.h
index bcba48a97868..5e11905a4f01 100644
--- a/include/linux/ipv6.h
+++ b/include/linux/ipv6.h
@@ -47,6 +47,7 @@ struct ipv6_devconf {
        __s32           disable_ipv6;
        __s32           accept_dad;
        __s32           force_tllao;
+        __s32           ndisc_notify;
        void            *sysctl;
 };
diff --git a/include/linux/ktime.h b/include/linux/ktime.h
index 06177ba10a16..e83512f63df5 100644
--- a/include/linux/ktime.h
+++ b/include/linux/ktime.h
@@ -282,6 +282,25 @@ static inline int ktime_equal(const ktime_t cmp1, const ktime_t cmp2)
        return cmp1.tv64 == cmp2.tv64;
 }
+/**
+ * ktime_compare - Compares two ktime_t variables for less, greater or equal
+ * @cmp1:       comparable1
+ * @cmp2:       comparable2
+ *
+ * Returns ...
+ *   cmp1  < cmp2: return <0
+ *   cmp1 == cmp2: return 0
+ *   cmp1  > cmp2: return >0
+ */
+static inline int ktime_compare(const ktime_t cmp1, const ktime_t cmp2)
+{
+        if (cmp1.tv64 < cmp2.tv64)
+                return -1;
+        if (cmp1.tv64 > cmp2.tv64)
+                return 1;
+        return 0;
+}
 static inline s64 ktime_to_us(const ktime_t kt)
 {
        struct timeval tv = ktime_to_timeval(kt);
diff --git a/include/linux/micrel_phy.h b/include/linux/micrel_phy.h
index de201203bc7c..adfe8c058f29 100644
--- a/include/linux/micrel_phy.h
+++ b/include/linux/micrel_phy.h
@@ -15,6 +15,7 @@
 #define MICREL_PHY_ID_MASK      0x00fffff0
+#define PHY_ID_KSZ8873MLL       0x000e7237
 #define PHY_ID_KSZ9021          0x00221610
 #define PHY_ID_KS8737           0x00221720
 #define PHY_ID_KSZ8021          0x00221555
diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h
index f8eda0276f03..e9929abeb932 100644
--- a/include/linux/netdevice.h
+++ b/include/linux/netdevice.h
@@ -887,6 +887,10 @@ struct netdev_fcoe_hbainfo {
 *                     struct net_device *dev, int idx)
 *      Used to add FDB entries to dump requests. Implementers should add
 *      entries to skb and update idx with the number of entries.
+ *
+ * int (*ndo_bridge_setlink)(struct net_device *dev, struct nlmsghdr *nlh)
+ * int (*ndo_bridge_getlink)(struct sk_buff *skb, u32 pid, u32 seq,
+ *                           struct net_device *dev)
 */
 struct net_device_ops {
        int                     (*ndo_init)(struct net_device *dev);
@@ -998,6 +1002,12 @@ struct net_device_ops {
                                                struct netlink_callback *cb,
                                                struct net_device *dev,
                                                int idx);
+        int                     (*ndo_bridge_setlink)(struct net_device *dev,
+                                                      struct nlmsghdr *nlh);
+        int                     (*ndo_bridge_getlink)(struct sk_buff *skb,
+                                                      u32 pid, u32 seq,
+                                                      struct net_device *dev);
 };
 /*
@@ -1499,16 +1509,25 @@ struct packet_type {
                                         struct net_device *,
                                         struct packet_type *,
                                         struct net_device *);
+        bool                    (*id_match)(struct packet_type *ptype,
+                                            struct sock *sk);
+        void                    *af_packet_priv;
+        struct list_head        list;
+};
+struct offload_callbacks {
        struct sk_buff          *(*gso_segment)(struct sk_buff *skb,
                                                netdev_features_t features);
        int                     (*gso_send_check)(struct sk_buff *skb);
        struct sk_buff          **(*gro_receive)(struct sk_buff **head,
                                               struct sk_buff *skb);
        int                     (*gro_complete)(struct sk_buff *skb);
-        bool                    (*id_match)(struct packet_type *ptype,
+};
-                                            struct sock *sk);
-        void                    *af_packet_priv;
+struct packet_offload {
-        struct list_head        list;
+        __be16                   type;  /* This is really htons(ether_type). */
+        struct offload_callbacks callbacks;
+        struct list_head         list;
 };
 #include <linux/notifier.h>
@@ -1548,6 +1567,8 @@ extern int call_netdevice_notifiers(unsigned long val, struct net_device *dev);
 extern rwlock_t                         dev_base_lock;          /* Device list lock */
+extern seqlock_t        devnet_rename_seq;      /* Device rename lock */
 #define for_each_netdev(net, d)         \
                list_for_each_entry(d, &(net)->dev_base_head, dev_list)
@@ -1605,6 +1626,9 @@ extern struct net_device *__dev_getfirstbyhwtype(struct net *net, unsigned short
 extern void             dev_add_pack(struct packet_type *pt);
 extern void             dev_remove_pack(struct packet_type *pt);
 extern void             __dev_remove_pack(struct packet_type *pt);
+extern void             dev_add_offload(struct packet_offload *po);
+extern void             dev_remove_offload(struct packet_offload *po);
+extern void             __dev_remove_offload(struct packet_offload *po);
 extern struct net_device        *dev_get_by_flags_rcu(struct net *net, unsigned short flags,
                                                      unsigned short mask);
diff --git a/include/linux/nfc/pn544.h b/include/linux/nfc/pn544.h
deleted file mode 100644
index 9890bbaf4328..000000000000
--- a/include/linux/nfc/pn544.h
+++ /dev/null
@@ -1,104 +0,0 @@
-/*
- * Driver include for the PN544 NFC chip.
- *
- * Copyright (C) Nokia Corporation
- *
- * Author: Jari Vanhala <ext-jari.vanhala@nokia.com>
- * Contact: Matti Aaltoenn <matti.j.aaltonen@nokia.com>
- *
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of the GNU General Public License
- * version 2 as published by the Free Software Foundation.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
- */
-#ifndef _PN544_H_
-#define _PN544_H_
-#include <linux/i2c.h>
-#define PN544_DRIVER_NAME       "pn544"
-#define PN544_MAXWINDOW_SIZE    7
-#define PN544_WINDOW_SIZE       4
-#define PN544_RETRIES           10
-#define PN544_MAX_I2C_TRANSFER  0x0400
-#define PN544_MSG_MAX_SIZE      0x21 /* at normal HCI mode */
-/* ioctl */
-#define PN544_CHAR_BASE         'P'
-#define PN544_IOR(num, dtype)   _IOR(PN544_CHAR_BASE, num, dtype)
-#define PN544_IOW(num, dtype)   _IOW(PN544_CHAR_BASE, num, dtype)
-#define PN544_GET_FW_MODE       PN544_IOW(1, unsigned int)
-#define PN544_SET_FW_MODE       PN544_IOW(2, unsigned int)
-#define PN544_GET_DEBUG         PN544_IOW(3, unsigned int)
-#define PN544_SET_DEBUG         PN544_IOW(4, unsigned int)
-/* Timing restrictions (ms) */
-#define PN544_RESETVEN_TIME     30 /* 7 */
-#define PN544_PVDDVEN_TIME      0
-#define PN544_VBATVEN_TIME      0
-#define PN544_GPIO4VEN_TIME     0
-#define PN544_WAKEUP_ACK        5
-#define PN544_WAKEUP_GUARD      (PN544_WAKEUP_ACK + 1)
-#define PN544_INACTIVITY_TIME   1000
-#define PN544_INTERFRAME_DELAY  200 /* us */
-#define PN544_BAUDRATE_CHANGE   150 /* us */
-/* Debug bits */
-#define PN544_DEBUG_BUF         0x01
-#define PN544_DEBUG_READ        0x02
-#define PN544_DEBUG_WRITE       0x04
-#define PN544_DEBUG_IRQ         0x08
-#define PN544_DEBUG_CALLS       0x10
-#define PN544_DEBUG_MODE        0x20
-/* Normal (HCI) mode */
-#define PN544_LLC_HCI_OVERHEAD  3 /* header + crc (to length) */
-#define PN544_LLC_MIN_SIZE      (1 + PN544_LLC_HCI_OVERHEAD) /* length + */
-#define PN544_LLC_MAX_DATA      (PN544_MSG_MAX_SIZE - 2)
-#define PN544_LLC_MAX_HCI_SIZE  (PN544_LLC_MAX_DATA - 2)
-struct pn544_llc_packet {
-        unsigned char length; /* of rest of packet */
-        unsigned char header;
-        unsigned char data[PN544_LLC_MAX_DATA]; /* includes crc-ccitt */
-};
-/* Firmware upgrade mode */
-#define PN544_FW_HEADER_SIZE    3
-/* max fw transfer is 1024bytes, but I2C limits it to 0xC0 */
-#define PN544_MAX_FW_DATA       (PN544_MAX_I2C_TRANSFER - PN544_FW_HEADER_SIZE)
-struct pn544_fw_packet {
-        unsigned char command; /* status in answer */
-        unsigned char length[2]; /* big-endian order (msf) */
-        unsigned char data[PN544_MAX_FW_DATA];
-};
-#ifdef __KERNEL__
-enum {
-        NFC_GPIO_ENABLE,
-        NFC_GPIO_FW_RESET,
-        NFC_GPIO_IRQ
-};
-/* board config */
-struct pn544_nfc_platform_data {
-        int (*request_resources) (struct i2c_client *client);
-        void (*free_resources) (void);
-        void (*enable) (int fw);
-        int (*test) (void);
-        void (*disable) (void);
-        int (*get_gpio)(int type);
-};
-#endif /* __KERNEL__ */
-#endif /* _PN544_H_ */
diff --git a/include/linux/pci.h b/include/linux/pci.h
index ee2179546c63..9cbd6705d033 100644
--- a/include/linux/pci.h
+++ b/include/linux/pci.h
@@ -604,6 +604,20 @@ struct pci_driver {
        .subvendor = PCI_ANY_ID, .subdevice = PCI_ANY_ID
 /**
+ * PCI_DEVICE_SUB - macro used to describe a specific pci device with subsystem
+ * @vend: the 16 bit PCI Vendor ID
+ * @dev: the 16 bit PCI Device ID
+ * @subvend: the 16 bit PCI Subvendor ID
+ * @subdev: the 16 bit PCI Subdevice ID
+ *
+ * This macro is used to create a struct pci_device_id that matches a
+ * specific device with subsystem information.
+ */
+#define PCI_DEVICE_SUB(vend, dev, subvend, subdev) \
+        .vendor = (vend), .device = (dev), \
+        .subvendor = (subvend), .subdevice = (subdev)
+/**
 * PCI_DEVICE_CLASS - macro used to describe a specific pci device class
 * @dev_class: the class, subclass, prog-if triple for this device
 * @dev_class_mask: the class mask for this device
diff --git a/include/linux/platform_data/cpsw.h b/include/linux/platform_data/cpsw.h
index c4e23d029498..24368a2e8b87 100644
--- a/include/linux/platform_data/cpsw.h
+++ b/include/linux/platform_data/cpsw.h
@@ -18,9 +18,7 @@
 #include <linux/if_ether.h>
 struct cpsw_slave_data {
-        u32             slave_reg_ofs;
+        char            phy_id[MII_BUS_ID_SIZE];
-        u32             sliver_reg_ofs;
-        const char      *phy_id;
        int             phy_if;
        u8              mac_addr[ETH_ALEN];
 };
@@ -28,27 +26,14 @@ struct cpsw_slave_data {
 struct cpsw_platform_data {
        u32     ss_reg_ofs;     /* Subsystem control register offset */
        u32     channels;       /* number of cpdma channels (symmetric) */
-        u32     cpdma_reg_ofs;  /* cpdma register offset */
-        u32     cpdma_sram_ofs; /* cpdma sram offset */
        u32     slaves;         /* number of slave cpgmac ports */
        struct cpsw_slave_data  *slave_data;
+        u32     cpts_active_slave; /* time stamping slave */
-        u32     ale_reg_ofs;    /* address lookup engine reg offset */
+        u32     cpts_clock_mult;  /* convert input clock ticks to nanoseconds */
+        u32     cpts_clock_shift; /* convert input clock ticks to nanoseconds */
        u32     ale_entries;    /* ale table size */
-        u32     host_port_reg_ofs; /* cpsw cpdma host port registers */
-        u32     host_port_num; /* The port number for the host port */
-        u32     hw_stats_reg_ofs;  /* cpsw hardware statistics counters */
-        u32     bd_ram_ofs;   /* embedded buffer descriptor RAM offset*/
        u32     bd_ram_size;  /*buffer descriptor ram size */
-        u32     hw_ram_addr; /*if the HW address for BD RAM is different */
-        bool    no_bd_ram; /* no embedded BD ram*/
        u32     rx_descs;       /* Number of Rx Descriptios */
        u32     mac_control;    /* Mac control register */
 };
diff --git a/include/linux/platform_data/macb.h b/include/linux/platform_data/macb.h
index b081c7245ec8..044a124bfbbc 100644
--- a/include/linux/platform_data/macb.h
+++ b/include/linux/platform_data/macb.h
@@ -12,6 +12,7 @@ struct macb_platform_data {
        u32             phy_mask;
        int             phy_irq_pin;    /* PHY IRQ */
        u8              is_rmii;        /* using RMII interface? */
+        u8              rev_eth_addr;   /* reverse Ethernet address byte order */
 };
 #endif /* __MACB_PDATA_H__ */
diff --git a/include/linux/platform_data/pn544.h b/include/linux/platform_data/pn544.h
new file mode 100644
index 000000000000..713bfd703342
--- /dev/null
+++ b/include/linux/platform_data/pn544.h
@@ -0,0 +1,44 @@
+/*
+ * Driver include for the PN544 NFC chip.
+ *
+ * Copyright (C) Nokia Corporation
+ *
+ * Author: Jari Vanhala <ext-jari.vanhala@nokia.com>
+ * Contact: Matti Aaltoenn <matti.j.aaltonen@nokia.com>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
+ */
+#ifndef _PN544_H_
+#define _PN544_H_
+#include <linux/i2c.h>
+enum {
+        NFC_GPIO_ENABLE,
+        NFC_GPIO_FW_RESET,
+        NFC_GPIO_IRQ
+};
+/* board config */
+struct pn544_nfc_platform_data {
+        int (*request_resources) (struct i2c_client *client);
+        void (*free_resources) (void);
+        void (*enable) (int fw);
+        int (*test) (void);
+        void (*disable) (void);
+        int (*get_gpio)(int type);
+};
+#endif /* _PN544_H_ */
diff --git a/include/linux/rtnetlink.h b/include/linux/rtnetlink.h
index 7002bbfd5d4a..489dd7bb28ec 100644
--- a/include/linux/rtnetlink.h
+++ b/include/linux/rtnetlink.h
@@ -69,4 +69,7 @@ extern int ndo_dflt_fdb_dump(struct sk_buff *skb,
                             struct netlink_callback *cb,
                             struct net_device *dev,
                             int idx);
+extern int ndo_dflt_bridge_getlink(struct sk_buff *skb, u32 pid, u32 seq,
+                                   struct net_device *dev, u16 mode);
 #endif  /* __LINUX_RTNETLINK_H */
diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h
index 6a2c34e6d962..f2af494330ab 100644
--- a/include/linux/skbuff.h
+++ b/include/linux/skbuff.h
@@ -235,11 +235,13 @@ enum {
 /*
 * The callback notifies userspace to release buffers when skb DMA is done in
 * lower device, the skb last reference should be 0 when calling this.
+ * The zerocopy_success argument is true if zero copy transmit occurred,
+ * false on data copy or out of memory error caused by data copy attempt.
 * The ctx field is used to track device context.
 * The desc field is used to track userspace buffer index.
 */
 struct ubuf_info {
-        void (*callback)(struct ubuf_info *);
+        void (*callback)(struct ubuf_info *, bool zerocopy_success);
        void *ctx;
        unsigned long desc;
 };
@@ -566,6 +568,7 @@ static inline struct rtable *skb_rtable(const struct sk_buff *skb)
 }
 extern void kfree_skb(struct sk_buff *skb);
+extern void skb_tx_error(struct sk_buff *skb);
 extern void consume_skb(struct sk_buff *skb);
 extern void            __kfree_skb(struct sk_buff *skb);
 extern struct kmem_cache *skbuff_head_cache;
@@ -643,7 +646,7 @@ extern unsigned int   skb_find_text(struct sk_buff *skb, unsigned int from,
 extern void __skb_get_rxhash(struct sk_buff *skb);
 static inline __u32 skb_get_rxhash(struct sk_buff *skb)
 {
-        if (!skb->rxhash)
+        if (!skb->l4_rxhash)
                __skb_get_rxhash(skb);
        return skb->rxhash;
diff --git a/include/linux/ssb/ssb_driver_mips.h b/include/linux/ssb/ssb_driver_mips.h
index 5f44e9740cd2..07a9c7a2e088 100644
--- a/include/linux/ssb/ssb_driver_mips.h
+++ b/include/linux/ssb/ssb_driver_mips.h
@@ -13,6 +13,12 @@ struct ssb_serial_port {
        unsigned int reg_shift;
 };
+struct ssb_pflash {
+        bool present;
+        u8 buswidth;
+        u32 window;
+        u32 window_size;
+};
 struct ssb_mipscore {
        struct ssb_device *dev;
@@ -20,9 +26,7 @@ struct ssb_mipscore {
        int nr_serial_ports;
        struct ssb_serial_port serial_ports[4];
-        u8 flash_buswidth;
+        struct ssb_pflash pflash;
-        u32 flash_window;
-        u32 flash_window_size;
 };
 extern void ssb_mipscore_init(struct ssb_mipscore *mcore);
diff --git a/include/linux/ssb/ssb_regs.h b/include/linux/ssb/ssb_regs.h
index a0525019e1d1..6ecfa02ddbac 100644
--- a/include/linux/ssb/ssb_regs.h
+++ b/include/linux/ssb/ssb_regs.h
@@ -485,7 +485,7 @@
 #define  SSB_SPROM8_HWIQ_IQSWP_IQCAL_SWP_SHIFT  4
 #define  SSB_SPROM8_HWIQ_IQSWP_HW_IQCAL 0x0020
 #define  SSB_SPROM8_HWIQ_IQSWP_HW_IQCAL_SHIFT   5
-#define SSB_SPROM8_TEMPDELTA            0x00BA
+#define SSB_SPROM8_TEMPDELTA            0x00BC
 #define  SSB_SPROM8_TEMPDELTA_PHYCAL    0x00ff
 #define  SSB_SPROM8_TEMPDELTA_PHYCAL_SHIFT      0
 #define  SSB_SPROM8_TEMPDELTA_PERIOD    0x0f00
diff --git a/include/linux/stmmac.h b/include/linux/stmmac.h
index a1547ea3920d..de5b2f8176ce 100644
--- a/include/linux/stmmac.h
+++ b/include/linux/stmmac.h
@@ -104,6 +104,7 @@ struct plat_stmmacenet_data {
        int bugged_jumbo;
        int pmt;
        int force_sf_dma_mode;
+        int riwt_off;
        void (*fix_mac_speed)(void *priv, unsigned int speed);
        void (*bus_setup)(void __iomem *ioaddr);
        int (*init)(struct platform_device *pdev);
diff --git a/include/linux/sysctl.h b/include/linux/sysctl.h
index cd844a6a8d5f..14a8ff2de11e 100644
--- a/include/linux/sysctl.h
+++ b/include/linux/sysctl.h
@@ -158,8 +158,7 @@ struct ctl_table_root {
        struct ctl_table_set default_set;
        struct ctl_table_set *(*lookup)(struct ctl_table_root *root,
                                           struct nsproxy *namespaces);
-        int (*permissions)(struct ctl_table_root *root,
+        int (*permissions)(struct ctl_table_header *head, struct ctl_table *table);
-                        struct nsproxy *namespaces, struct ctl_table *table);
 };
 /* struct ctl_path describes where in the hierarchy a table is added */
diff --git a/include/linux/timecompare.h b/include/linux/timecompare.h
deleted file mode 100644
index 546e2234e4b3..000000000000
--- a/include/linux/timecompare.h
+++ /dev/null
@@ -1,125 +0,0 @@
-/*
- * Utility code which helps transforming between two different time
- * bases, called "source" and "target" time in this code.
- *
- * Source time has to be provided via the timecounter API while target
- * time is accessed via a function callback whose prototype
- * intentionally matches ktime_get() and ktime_get_real(). These
- * interfaces where chosen like this so that the code serves its
- * initial purpose without additional glue code.
- *
- * This purpose is synchronizing a hardware clock in a NIC with system
- * time, in order to implement the Precision Time Protocol (PTP,
- * IEEE1588) with more accurate hardware assisted time stamping.  In
- * that context only synchronization against system time (=
- * ktime_get_real()) is currently needed. But this utility code might
- * become useful in other situations, which is why it was written as
- * general purpose utility code.
- *
- * The source timecounter is assumed to return monotonically
- * increasing time (but this code does its best to compensate if that
- * is not the case) whereas target time may jump.
- *
- * The target time corresponding to a source time is determined by
- * reading target time, reading source time, reading target time
- * again, then assuming that average target time corresponds to source
- * time. In other words, the assumption is that reading the source
- * time is slow and involves equal time for sending the request and
- * receiving the reply, whereas reading target time is assumed to be
- * fast.
- *
- * Copyright (C) 2009 Intel Corporation.
- * Author: Patrick Ohly <patrick.ohly@intel.com>
- *
- * This program is free software; you can redistribute it and/or modify it
- * under the terms and conditions of the GNU General Public License,
- * version 2, as published by the Free Software Foundation.
- *
- * This program is distributed in the hope it will be useful, but WITHOUT
- * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
- * FITNESS FOR A PARTICULAR PURPOSE. * See the GNU General Public License for
- * more details.
- *
- * You should have received a copy of the GNU General Public License along with
- * this program; if not, write to the Free Software Foundation, Inc.,
- * 51 Franklin St - Fifth Floor, Boston, MA 02110-1301 USA.
- */
-#ifndef _LINUX_TIMECOMPARE_H
-#define _LINUX_TIMECOMPARE_H
-#include <linux/clocksource.h>
-#include <linux/ktime.h>
-/**
- * struct timecompare - stores state and configuration for the two clocks
- *
- * Initialize to zero, then set source/target/num_samples.
- *
- * Transformation between source time and target time is done with:
- * target_time = source_time + offset +
- *               (source_time - last_update) * skew /
- *               TIMECOMPARE_SKEW_RESOLUTION
- *
- * @source:          used to get source time stamps via timecounter_read()
- * @target:          function returning target time (for example, ktime_get
- *                   for monotonic time, or ktime_get_real for wall clock)
- * @num_samples:     number of times that source time and target time are to
- *                   be compared when determining their offset
- * @offset:          (target time - source time) at the time of the last update
- * @skew:            average (target time - source time) / delta source time *
- *                   TIMECOMPARE_SKEW_RESOLUTION
- * @last_update:     last source time stamp when time offset was measured
- */
-struct timecompare {
-        struct timecounter *source;
-        ktime_t (*target)(void);
-        int num_samples;
-        s64 offset;
-        s64 skew;
-        u64 last_update;
-};
-/**
- * timecompare_transform - transform source time stamp into target time base
- * @sync:            context for time sync
- * @source_tstamp:   the result of timecounter_read() or
- *                   timecounter_cyc2time()
- */
-extern ktime_t timecompare_transform(struct timecompare *sync,
-                                     u64 source_tstamp);
-/**
- * timecompare_offset - measure current (target time - source time) offset
- * @sync:            context for time sync
- * @offset:          average offset during sample period returned here
- * @source_tstamp:   average source time during sample period returned here
- *
- * Returns number of samples used. Might be zero (= no result) in the
- * unlikely case that target time was monotonically decreasing for all
- * samples (= broken).
- */
-extern int timecompare_offset(struct timecompare *sync,
-                              s64 *offset,
-                              u64 *source_tstamp);
-extern void __timecompare_update(struct timecompare *sync,
-                                 u64 source_tstamp);
-/**
- * timecompare_update - update offset and skew by measuring current offset
- * @sync:            context for time sync
- * @source_tstamp:   the result of timecounter_read() or
- *                   timecounter_cyc2time(), pass zero to force update
- *
- * Updates are only done at most once per second.
- */
-static inline void timecompare_update(struct timecompare *sync,
-                                      u64 source_tstamp)
-{
-        if (!source_tstamp ||
-            (s64)(source_tstamp - sync->last_update) >= NSEC_PER_SEC)
-                __timecompare_update(sync, source_tstamp);
-}
-#endif /* _LINUX_TIMECOMPARE_H */
diff --git a/include/linux/usb/cdc_ncm.h b/include/linux/usb/cdc_ncm.h
new file mode 100644
index 000000000000..3b8f9d4fc3fe
--- /dev/null
+++ b/include/linux/usb/cdc_ncm.h
@@ -0,0 +1,134 @@
+/*
+ * Copyright (C) ST-Ericsson 2010-2012
+ * Contact: Alexey Orishko <alexey.orishko@stericsson.com>
+ * Original author: Hans Petter Selasky <hans.petter.selasky@stericsson.com>
+ *
+ * USB Host Driver for Network Control Model (NCM)
+ * http://www.usb.org/developers/devclass_docs/NCM10.zip
+ *
+ * The NCM encoding, decoding and initialization logic
+ * derives from FreeBSD 8.x. if_cdce.c and if_cdcereg.h
+ *
+ * This software is available to you under a choice of one of two
+ * licenses. You may choose this file to be licensed under the terms
+ * of the GNU General Public License (GPL) Version 2 or the 2-clause
+ * BSD license listed below:
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+#define CDC_NCM_COMM_ALTSETTING_NCM             0
+#define CDC_NCM_COMM_ALTSETTING_MBIM            1
+#define CDC_NCM_DATA_ALTSETTING_NCM             1
+#define CDC_NCM_DATA_ALTSETTING_MBIM            2
+/* CDC NCM subclass 3.2.1 */
+#define USB_CDC_NCM_NDP16_LENGTH_MIN            0x10
+/* Maximum NTB length */
+#define CDC_NCM_NTB_MAX_SIZE_TX                 32768   /* bytes */
+#define CDC_NCM_NTB_MAX_SIZE_RX                 32768   /* bytes */
+/* Minimum value for MaxDatagramSize, ch. 6.2.9 */
+#define CDC_NCM_MIN_DATAGRAM_SIZE               1514    /* bytes */
+/* Minimum value for MaxDatagramSize, ch. 8.1.3 */
+#define CDC_MBIM_MIN_DATAGRAM_SIZE              2048    /* bytes */
+#define CDC_NCM_MIN_TX_PKT                      512     /* bytes */
+/* Default value for MaxDatagramSize */
+#define CDC_NCM_MAX_DATAGRAM_SIZE               8192    /* bytes */
+/*
+ * Maximum amount of datagrams in NCM Datagram Pointer Table, not counting
+ * the last NULL entry.
+ */
+#define CDC_NCM_DPT_DATAGRAMS_MAX               40
+/* Restart the timer, if amount of datagrams is less than given value */
+#define CDC_NCM_RESTART_TIMER_DATAGRAM_CNT      3
+#define CDC_NCM_TIMER_PENDING_CNT               2
+#define CDC_NCM_TIMER_INTERVAL                  (400UL * NSEC_PER_USEC)
+/* The following macro defines the minimum header space */
+#define CDC_NCM_MIN_HDR_SIZE \
+        (sizeof(struct usb_cdc_ncm_nth16) + sizeof(struct usb_cdc_ncm_ndp16) + \
+        (CDC_NCM_DPT_DATAGRAMS_MAX + 1) * sizeof(struct usb_cdc_ncm_dpe16))
+#define CDC_NCM_NDP_SIZE \
+        (sizeof(struct usb_cdc_ncm_ndp16) +                             \
+              (CDC_NCM_DPT_DATAGRAMS_MAX + 1) * sizeof(struct usb_cdc_ncm_dpe16))
+#define cdc_ncm_comm_intf_is_mbim(x)  ((x)->desc.bInterfaceSubClass == USB_CDC_SUBCLASS_MBIM && \
+                                       (x)->desc.bInterfaceProtocol == USB_CDC_PROTO_NONE)
+#define cdc_ncm_data_intf_is_mbim(x)  ((x)->desc.bInterfaceProtocol == USB_CDC_MBIM_PROTO_NTB)
+struct cdc_ncm_ctx {
+        struct usb_cdc_ncm_ntb_parameters ncm_parm;
+        struct hrtimer tx_timer;
+        struct tasklet_struct bh;
+        const struct usb_cdc_ncm_desc *func_desc;
+        const struct usb_cdc_mbim_desc   *mbim_desc;
+        const struct usb_cdc_header_desc *header_desc;
+        const struct usb_cdc_union_desc *union_desc;
+        const struct usb_cdc_ether_desc *ether_desc;
+        struct net_device *netdev;
+        struct usb_device *udev;
+        struct usb_host_endpoint *in_ep;
+        struct usb_host_endpoint *out_ep;
+        struct usb_host_endpoint *status_ep;
+        struct usb_interface *intf;
+        struct usb_interface *control;
+        struct usb_interface *data;
+        struct sk_buff *tx_curr_skb;
+        struct sk_buff *tx_rem_skb;
+        __le32 tx_rem_sign;
+        spinlock_t mtx;
+        atomic_t stop;
+        u32 tx_timer_pending;
+        u32 tx_curr_frame_num;
+        u32 rx_speed;
+        u32 tx_speed;
+        u32 rx_max;
+        u32 tx_max;
+        u32 max_datagram_size;
+        u16 tx_max_datagrams;
+        u16 tx_remainder;
+        u16 tx_modulus;
+        u16 tx_ndp_modulus;
+        u16 tx_seq;
+        u16 rx_seq;
+        u16 connected;
+};
+extern int cdc_ncm_bind_common(struct usbnet *dev, struct usb_interface *intf, u8 data_altsetting);
+extern void cdc_ncm_unbind(struct usbnet *dev, struct usb_interface *intf);
+extern struct sk_buff *cdc_ncm_fill_tx_frame(struct cdc_ncm_ctx *ctx, struct sk_buff *skb, __le32 sign);
+extern int cdc_ncm_rx_verify_nth16(struct cdc_ncm_ctx *ctx, struct sk_buff *skb_in);
+extern int cdc_ncm_rx_verify_ndp16(struct sk_buff *skb_in, int ndpoffset);
diff --git a/include/linux/usb/usbnet.h b/include/linux/usb/usbnet.h
index ddbbb7de894b..9bbeabf66c54 100644
--- a/include/linux/usb/usbnet.h
+++ b/include/linux/usb/usbnet.h
@@ -163,6 +163,16 @@ extern int usbnet_resume(struct usb_interface *);
 extern void usbnet_disconnect(struct usb_interface *);
 extern void usbnet_device_suggests_idle(struct usbnet *dev);
+extern int usbnet_read_cmd(struct usbnet *dev, u8 cmd, u8 reqtype,
+                    u16 value, u16 index, void *data, u16 size);
+extern int usbnet_write_cmd(struct usbnet *dev, u8 cmd, u8 reqtype,
+                    u16 value, u16 index, const void *data, u16 size);
+extern int usbnet_read_cmd_nopm(struct usbnet *dev, u8 cmd, u8 reqtype,
+                    u16 value, u16 index, void *data, u16 size);
+extern int usbnet_write_cmd_nopm(struct usbnet *dev, u8 cmd, u8 reqtype,
+                    u16 value, u16 index, const void *data, u16 size);
+extern int usbnet_write_cmd_async(struct usbnet *dev, u8 cmd, u8 reqtype,
+                    u16 value, u16 index, const void *data, u16 size);
 /* Drivers that reuse some of the standard USB CDC infrastructure
 * (notably, using multiple interfaces according to the CDC
diff --git a/include/net/af_unix.h b/include/net/af_unix.h
index b5f8988e4283..0a996a3517ed 100644
--- a/include/net/af_unix.h
+++ b/include/net/af_unix.h
@@ -53,7 +53,6 @@ struct unix_sock {
        struct path             path;
        struct mutex            readlock;
        struct sock             *peer;
-        struct sock             *other;
        struct list_head        link;
        atomic_long_t           inflight;
        spinlock_t              lock;
diff --git a/include/net/bluetooth/a2mp.h b/include/net/bluetooth/a2mp.h
index 6a76e0a0705e..42f21766c538 100644
--- a/include/net/bluetooth/a2mp.h
+++ b/include/net/bluetooth/a2mp.h
@@ -19,13 +19,25 @@
 #define A2MP_FEAT_EXT   0x8000
+enum amp_mgr_state {
+        READ_LOC_AMP_INFO,
+        READ_LOC_AMP_ASSOC,
+        READ_LOC_AMP_ASSOC_FINAL,
+};
 struct amp_mgr {
+        struct list_head        list;
        struct l2cap_conn       *l2cap_conn;
        struct l2cap_chan       *a2mp_chan;
+        struct l2cap_chan       *bredr_chan;
        struct kref             kref;
        __u8                    ident;
        __u8                    handle;
+        enum amp_mgr_state      state;
        unsigned long           flags;
+        struct list_head        amp_ctrls;
+        struct mutex            amp_ctrls_lock;
 };
 struct a2mp_cmd {
@@ -118,9 +130,19 @@ struct a2mp_physlink_rsp {
 #define A2MP_STATUS_PHYS_LINK_EXISTS            0x05
 #define A2MP_STATUS_SECURITY_VIOLATION          0x06
-void amp_mgr_get(struct amp_mgr *mgr);
+extern struct list_head amp_mgr_list;
+extern struct mutex amp_mgr_list_lock;
+struct amp_mgr *amp_mgr_get(struct amp_mgr *mgr);
 int amp_mgr_put(struct amp_mgr *mgr);
+u8 __next_ident(struct amp_mgr *mgr);
 struct l2cap_chan *a2mp_channel_create(struct l2cap_conn *conn,
                                       struct sk_buff *skb);
+struct amp_mgr *amp_mgr_lookup_by_state(u8 state);
+void a2mp_send(struct amp_mgr *mgr, u8 code, u8 ident, u16 len, void *data);
+void a2mp_discover_amp(struct l2cap_chan *chan);
+void a2mp_send_getinfo_rsp(struct hci_dev *hdev);
+void a2mp_send_getampassoc_rsp(struct hci_dev *hdev, u8 status);
+void a2mp_send_create_phy_link_req(struct hci_dev *hdev, u8 status);
 #endif /* __A2MP_H */
diff --git a/include/net/bluetooth/amp.h b/include/net/bluetooth/amp.h
new file mode 100644
index 000000000000..7ea3db77ba89
--- /dev/null
+++ b/include/net/bluetooth/amp.h
@@ -0,0 +1,54 @@
+/*
+   Copyright (c) 2011,2012 Intel Corp.
+   This program is free software; you can redistribute it and/or modify
+   it under the terms of the GNU General Public License version 2 and
+   only version 2 as published by the Free Software Foundation.
+   This program is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+   GNU General Public License for more details.
+*/
+#ifndef __AMP_H
+#define __AMP_H
+struct amp_ctrl {
+        struct list_head        list;
+        struct kref             kref;
+        __u8                    id;
+        __u16                   assoc_len_so_far;
+        __u16                   assoc_rem_len;
+        __u16                   assoc_len;
+        __u8                    *assoc;
+};
+int amp_ctrl_put(struct amp_ctrl *ctrl);
+void amp_ctrl_get(struct amp_ctrl *ctrl);
+struct amp_ctrl *amp_ctrl_add(struct amp_mgr *mgr, u8 id);
+struct amp_ctrl *amp_ctrl_lookup(struct amp_mgr *mgr, u8 id);
+void amp_ctrl_list_flush(struct amp_mgr *mgr);
+struct hci_conn *phylink_add(struct hci_dev *hdev, struct amp_mgr *mgr,
+                             u8 remote_id, bool out);
+int phylink_gen_key(struct hci_conn *hcon, u8 *data, u8 *len, u8 *type);
+void amp_read_loc_info(struct hci_dev *hdev, struct amp_mgr *mgr);
+void amp_read_loc_assoc_frag(struct hci_dev *hdev, u8 phy_handle);
+void amp_read_loc_assoc(struct hci_dev *hdev, struct amp_mgr *mgr);
+void amp_read_loc_assoc_final_data(struct hci_dev *hdev,
+                                   struct hci_conn *hcon);
+void amp_create_phylink(struct hci_dev *hdev, struct amp_mgr *mgr,
+                        struct hci_conn *hcon);
+void amp_accept_phylink(struct hci_dev *hdev, struct amp_mgr *mgr,
+                        struct hci_conn *hcon);
+void amp_write_remote_assoc(struct hci_dev *hdev, u8 handle);
+void amp_write_rem_assoc_continue(struct hci_dev *hdev, u8 handle);
+void amp_physical_cfm(struct hci_conn *bredr_hcon, struct hci_conn *hs_hcon);
+void amp_create_logical_link(struct l2cap_chan *chan);
+void amp_disconnect_logical_link(struct hci_chan *hchan);
+void amp_destroy_logical_link(struct hci_chan *hchan, u8 reason);
+#endif /* __AMP_H */
diff --git a/include/net/bluetooth/bluetooth.h b/include/net/bluetooth/bluetooth.h
index ede036977ae8..2554b3f5222a 100644
--- a/include/net/bluetooth/bluetooth.h
+++ b/include/net/bluetooth/bluetooth.h
@@ -180,7 +180,6 @@ static inline void bacpy(bdaddr_t *dst, bdaddr_t *src)
 }
 void baswap(bdaddr_t *dst, bdaddr_t *src);
-char *batostr(bdaddr_t *ba);
 /* Common socket structures and functions */
diff --git a/include/net/bluetooth/hci.h b/include/net/bluetooth/hci.h
index 76b2b6bdcf36..45eee08157bb 100644
--- a/include/net/bluetooth/hci.h
+++ b/include/net/bluetooth/hci.h
@@ -33,6 +33,8 @@
 #define HCI_LINK_KEY_SIZE       16
 #define HCI_AMP_LINK_KEY_SIZE   (2 * HCI_LINK_KEY_SIZE)
+#define HCI_MAX_AMP_ASSOC_SIZE  672
 /* HCI dev events */
 #define HCI_DEV_REG                     1
 #define HCI_DEV_UNREG                   2
@@ -113,6 +115,7 @@ enum {
        HCI_SSP_ENABLED,
        HCI_HS_ENABLED,
        HCI_LE_ENABLED,
+        HCI_LE_PERIPHERAL,
        HCI_CONNECTABLE,
        HCI_DISCOVERABLE,
        HCI_LINK_SECURITY,
@@ -151,7 +154,7 @@ enum {
 #define HCI_DISCONN_TIMEOUT     msecs_to_jiffies(2000)  /* 2 seconds */
 #define HCI_PAIRING_TIMEOUT     msecs_to_jiffies(60000) /* 60 seconds */
 #define HCI_INIT_TIMEOUT        msecs_to_jiffies(10000) /* 10 seconds */
-#define HCI_CMD_TIMEOUT         msecs_to_jiffies(1000)  /* 1 second */
+#define HCI_CMD_TIMEOUT         msecs_to_jiffies(2000)  /* 2 seconds */
 #define HCI_ACL_TX_TIMEOUT      msecs_to_jiffies(45000) /* 45 seconds */
 #define HCI_AUTO_OFF_TIMEOUT    msecs_to_jiffies(2000)  /* 2 seconds */
@@ -196,6 +199,7 @@ enum {
 #define ACL_START_NO_FLUSH      0x00
 #define ACL_CONT                0x01
 #define ACL_START               0x02
+#define ACL_COMPLETE            0x03
 #define ACL_ACTIVE_BCAST        0x04
 #define ACL_PICO_BCAST          0x08
@@ -205,6 +209,7 @@ enum {
 #define ESCO_LINK       0x02
 /* Low Energy links do not have defined link type. Use invented one */
 #define LE_LINK         0x80
+#define AMP_LINK        0x81
 /* LMP features */
 #define LMP_3SLOT       0x01
@@ -314,6 +319,9 @@ enum {
 #define HCI_FLOW_CTL_MODE_PACKET_BASED  0x00
 #define HCI_FLOW_CTL_MODE_BLOCK_BASED   0x01
+/* The core spec defines 127 as the "not available" value */
+#define HCI_TX_POWER_INVALID    127
 /* Extended Inquiry Response field types */
 #define EIR_FLAGS               0x01 /* flags */
 #define EIR_UUID16_SOME         0x02 /* 16-bit UUID, more available */
@@ -330,6 +338,13 @@ enum {
 #define EIR_SSP_RAND_R          0x0F /* Simple Pairing Randomizer R */
 #define EIR_DEVICE_ID           0x10 /* device ID */
+/* Low Energy Advertising Flags */
+#define LE_AD_LIMITED           0x01 /* Limited Discoverable */
+#define LE_AD_GENERAL           0x02 /* General Discoverable */
+#define LE_AD_NO_BREDR          0x04 /* BR/EDR not supported */
+#define LE_AD_SIM_LE_BREDR_CTRL 0x08 /* Simultaneous LE & BR/EDR Controller */
+#define LE_AD_SIM_LE_BREDR_HOST 0x10 /* Simultaneous LE & BR/EDR Host */
 /* -----  HCI Commands ---- */
 #define HCI_OP_NOP                      0x0000
@@ -556,12 +571,46 @@ struct hci_cp_accept_phy_link {
        __u8     key[HCI_AMP_LINK_KEY_SIZE];
 } __packed;
-#define HCI_OP_DISCONN_PHY_LINK 0x0437
+#define HCI_OP_DISCONN_PHY_LINK         0x0437
 struct hci_cp_disconn_phy_link {
        __u8     phy_handle;
        __u8     reason;
 } __packed;
+struct ext_flow_spec {
+        __u8       id;
+        __u8       stype;
+        __le16     msdu;
+        __le32     sdu_itime;
+        __le32     acc_lat;
+        __le32     flush_to;
+} __packed;
+#define HCI_OP_CREATE_LOGICAL_LINK      0x0438
+#define HCI_OP_ACCEPT_LOGICAL_LINK      0x0439
+struct hci_cp_create_accept_logical_link {
+        __u8                  phy_handle;
+        struct ext_flow_spec  tx_flow_spec;
+        struct ext_flow_spec  rx_flow_spec;
+} __packed;
+#define HCI_OP_DISCONN_LOGICAL_LINK     0x043a
+struct hci_cp_disconn_logical_link {
+        __le16   log_handle;
+} __packed;
+#define HCI_OP_LOGICAL_LINK_CANCEL      0x043b
+struct hci_cp_logical_link_cancel {
+        __u8     phy_handle;
+        __u8     flow_spec_id;
+} __packed;
+struct hci_rp_logical_link_cancel {
+        __u8     status;
+        __u8     phy_handle;
+        __u8     flow_spec_id;
+} __packed;
 #define HCI_OP_SNIFF_MODE               0x0803
 struct hci_cp_sniff_mode {
        __le16   handle;
@@ -894,6 +943,22 @@ struct hci_rp_le_read_buffer_size {
        __u8     le_max_pkt;
 } __packed;
+#define HCI_OP_LE_READ_ADV_TX_POWER     0x2007
+struct hci_rp_le_read_adv_tx_power {
+        __u8    status;
+        __s8    tx_power;
+} __packed;
+#define HCI_MAX_AD_LENGTH               31
+#define HCI_OP_LE_SET_ADV_DATA          0x2008
+struct hci_cp_le_set_adv_data {
+        __u8    length;
+        __u8    data[HCI_MAX_AD_LENGTH];
+} __packed;
+#define HCI_OP_LE_SET_ADV_ENABLE        0x200a
 #define HCI_OP_LE_SET_SCAN_PARAM        0x200b
 struct hci_cp_le_set_scan_param {
        __u8    type;
diff --git a/include/net/bluetooth/hci_core.h b/include/net/bluetooth/hci_core.h
index e7d454609881..ef5b85dac3f7 100644
--- a/include/net/bluetooth/hci_core.h
+++ b/include/net/bluetooth/hci_core.h
@@ -73,6 +73,7 @@ struct discovery_state {
 struct hci_conn_hash {
        struct list_head list;
        unsigned int     acl_num;
+        unsigned int     amp_num;
        unsigned int     sco_num;
        unsigned int     le_num;
 };
@@ -124,6 +125,14 @@ struct le_scan_params {
 #define HCI_MAX_SHORT_NAME_LENGTH       10
+struct amp_assoc {
+        __u16   len;
+        __u16   offset;
+        __u16   rem_len;
+        __u16   len_so_far;
+        __u8    data[HCI_MAX_AMP_ASSOC_SIZE];
+};
 #define NUM_REASSEMBLY 4
 struct hci_dev {
        struct list_head list;
@@ -177,6 +186,8 @@ struct hci_dev {
        __u32           amp_max_flush_to;
        __u32           amp_be_flush_to;
+        struct amp_assoc        loc_assoc;
        __u8            flow_ctl_mode;
        unsigned int    auto_accept_delay;
@@ -252,8 +263,6 @@ struct hci_dev {
        struct sk_buff_head     driver_init;
-        void                    *core_data;
        atomic_t                promisc;
        struct dentry           *debugfs;
@@ -269,6 +278,10 @@ struct hci_dev {
        struct work_struct      le_scan;
        struct le_scan_params   le_scan_params;
+        __s8                    adv_tx_power;
+        __u8                    adv_data[HCI_MAX_AD_LENGTH];
+        __u8                    adv_data_len;
        int (*open)(struct hci_dev *hdev);
        int (*close)(struct hci_dev *hdev);
        int (*flush)(struct hci_dev *hdev);
@@ -277,6 +290,8 @@ struct hci_dev {
        int (*ioctl)(struct hci_dev *hdev, unsigned int cmd, unsigned long arg);
 };
+#define HCI_PHY_HANDLE(handle)  (handle & 0xff)
 struct hci_conn {
        struct list_head list;
@@ -310,6 +325,7 @@ struct hci_conn {
        __u8            remote_cap;
        __u8            remote_auth;
+        __u8            remote_id;
        bool            flush_key;
        unsigned int    sent;
@@ -339,10 +355,11 @@ struct hci_conn {
 struct hci_chan {
        struct list_head list;
+        __u16 handle;
        struct hci_conn *conn;
        struct sk_buff_head data_q;
        unsigned int    sent;
+        __u8            state;
 };
 extern struct list_head hci_dev_list;
@@ -438,6 +455,9 @@ static inline void hci_conn_hash_add(struct hci_dev *hdev, struct hci_conn *c)
        case ACL_LINK:
                h->acl_num++;
                break;
+        case AMP_LINK:
+                h->amp_num++;
+                break;
        case LE_LINK:
                h->le_num++;
                break;
@@ -459,6 +479,9 @@ static inline void hci_conn_hash_del(struct hci_dev *hdev, struct hci_conn *c)
        case ACL_LINK:
                h->acl_num--;
                break;
+        case AMP_LINK:
+                h->amp_num--;
+                break;
        case LE_LINK:
                h->le_num--;
                break;
@@ -475,6 +498,8 @@ static inline unsigned int hci_conn_num(struct hci_dev *hdev, __u8 type)
        switch (type) {
        case ACL_LINK:
                return h->acl_num;
+        case AMP_LINK:
+                return h->amp_num;
        case LE_LINK:
                return h->le_num;
        case SCO_LINK:
@@ -556,6 +581,7 @@ void hci_conn_check_pending(struct hci_dev *hdev);
 struct hci_chan *hci_chan_create(struct hci_conn *conn);
 void hci_chan_del(struct hci_chan *chan);
 void hci_chan_list_flush(struct hci_conn *conn);
+struct hci_chan *hci_chan_lookup_handle(struct hci_dev *hdev, __u16 handle);
 struct hci_conn *hci_connect(struct hci_dev *hdev, int type, bdaddr_t *dst,
                             __u8 dst_type, __u8 sec_level, __u8 auth_type);
@@ -584,7 +610,10 @@ static inline void hci_conn_put(struct hci_conn *conn)
        if (atomic_dec_and_test(&conn->refcnt)) {
                unsigned long timeo;
-                if (conn->type == ACL_LINK || conn->type == LE_LINK) {
+                switch (conn->type) {
+                case ACL_LINK:
+                case LE_LINK:
                        del_timer(&conn->idle_timer);
                        if (conn->state == BT_CONNECTED) {
                                timeo = conn->disc_timeout;
@@ -593,12 +622,20 @@ static inline void hci_conn_put(struct hci_conn *conn)
                        } else {
                                timeo = msecs_to_jiffies(10);
                        }
-                } else {
+                        break;
+                case AMP_LINK:
+                        timeo = conn->disc_timeout;
+                        break;
+                default:
                        timeo = msecs_to_jiffies(10);
+                        break;
                }
                cancel_delayed_work(&conn->disc_work);
                queue_delayed_work(conn->hdev->workqueue,
-                                        &conn->disc_work, timeo);
+                                   &conn->disc_work, timeo);
        }
 }
@@ -650,7 +687,7 @@ static inline uint8_t __hci_num_ctrl(void)
 }
 struct hci_dev *hci_dev_get(int index);
-struct hci_dev *hci_get_route(bdaddr_t *src, bdaddr_t *dst);
+struct hci_dev *hci_get_route(bdaddr_t *dst, bdaddr_t *src);
 struct hci_dev *hci_alloc_dev(void);
 void hci_free_dev(struct hci_dev *hdev);
@@ -699,6 +736,8 @@ int hci_add_remote_oob_data(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 *hash,
                                                                u8 *randomizer);
 int hci_remove_remote_oob_data(struct hci_dev *hdev, bdaddr_t *bdaddr);
+int hci_update_ad(struct hci_dev *hdev);
 void hci_event_packet(struct hci_dev *hdev, struct sk_buff *skb);
 int hci_recv_frame(struct sk_buff *skb);
@@ -715,18 +754,29 @@ void hci_conn_del_sysfs(struct hci_conn *conn);
 #define SET_HCIDEV_DEV(hdev, pdev) ((hdev)->dev.parent = (pdev))
 /* ----- LMP capabilities ----- */
-#define lmp_rswitch_capable(dev)   ((dev)->features[0] & LMP_RSWITCH)
 #define lmp_encrypt_capable(dev)   ((dev)->features[0] & LMP_ENCRYPT)
+#define lmp_rswitch_capable(dev)   ((dev)->features[0] & LMP_RSWITCH)
+#define lmp_hold_capable(dev)      ((dev)->features[0] & LMP_HOLD)
 #define lmp_sniff_capable(dev)     ((dev)->features[0] & LMP_SNIFF)
-#define lmp_sniffsubr_capable(dev) ((dev)->features[5] & LMP_SNIFF_SUBR)
+#define lmp_park_capable(dev)      ((dev)->features[1] & LMP_PARK)
+#define lmp_inq_rssi_capable(dev)  ((dev)->features[3] & LMP_RSSI_INQ)
 #define lmp_esco_capable(dev)      ((dev)->features[3] & LMP_ESCO)
+#define lmp_bredr_capable(dev)     (!((dev)->features[4] & LMP_NO_BREDR))
+#define lmp_le_capable(dev)        ((dev)->features[4] & LMP_LE)
+#define lmp_sniffsubr_capable(dev) ((dev)->features[5] & LMP_SNIFF_SUBR)
+#define lmp_pause_enc_capable(dev) ((dev)->features[5] & LMP_PAUSE_ENC)
+#define lmp_ext_inq_capable(dev)   ((dev)->features[6] & LMP_EXT_INQ)
+#define lmp_le_br_capable(dev)     ((dev)->features[6] & LMP_SIMUL_LE_BR)
 #define lmp_ssp_capable(dev)       ((dev)->features[6] & LMP_SIMPLE_PAIR)
 #define lmp_no_flush_capable(dev)  ((dev)->features[6] & LMP_NO_FLUSH)
-#define lmp_le_capable(dev)        ((dev)->features[4] & LMP_LE)
+#define lmp_lsto_capable(dev)      ((dev)->features[7] & LMP_LSTO)
-#define lmp_bredr_capable(dev)     (!((dev)->features[4] & LMP_NO_BREDR))
+#define lmp_inq_tx_pwr_capable(dev) ((dev)->features[7] & LMP_INQ_TX_PWR)
+#define lmp_ext_feat_capable(dev)  ((dev)->features[7] & LMP_EXTFEATURES)
 /* ----- Extended LMP capabilities ----- */
+#define lmp_host_ssp_capable(dev)  ((dev)->host_features[0] & LMP_HOST_SSP)
 #define lmp_host_le_capable(dev)   ((dev)->host_features[0] & LMP_HOST_LE)
+#define lmp_host_le_br_capable(dev) ((dev)->host_features[0] & LMP_HOST_LE_BREDR)
 /* ----- HCI protocols ----- */
 static inline int hci_proto_connect_ind(struct hci_dev *hdev, bdaddr_t *bdaddr,
@@ -789,6 +839,10 @@ static inline void hci_proto_disconn_cfm(struct hci_conn *conn, __u8 reason)
                sco_disconn_cfm(conn, reason);
                break;
+        /* L2CAP would be handled for BREDR chan */
+        case AMP_LINK:
+                break;
        default:
                BT_ERR("unknown link type %d", conn->type);
                break;
@@ -841,7 +895,7 @@ struct hci_cb {
 static inline void hci_auth_cfm(struct hci_conn *conn, __u8 status)
 {
-        struct list_head *p;
+        struct hci_cb *cb;
        __u8 encrypt;
        hci_proto_auth_cfm(conn, status);
@@ -852,8 +906,7 @@ static inline void hci_auth_cfm(struct hci_conn *conn, __u8 status)
        encrypt = (conn->link_mode & HCI_LM_ENCRYPT) ? 0x01 : 0x00;
        read_lock(&hci_cb_list_lock);
-        list_for_each(p, &hci_cb_list) {
+        list_for_each_entry(cb, &hci_cb_list, list) {
-                struct hci_cb *cb = list_entry(p, struct hci_cb, list);
                if (cb->security_cfm)
                        cb->security_cfm(conn, status, encrypt);
        }
@@ -863,7 +916,7 @@ static inline void hci_auth_cfm(struct hci_conn *conn, __u8 status)
 static inline void hci_encrypt_cfm(struct hci_conn *conn, __u8 status,
                                                                __u8 encrypt)
 {
-        struct list_head *p;
+        struct hci_cb *cb;
        if (conn->sec_level == BT_SECURITY_SDP)
                conn->sec_level = BT_SECURITY_LOW;
@@ -874,8 +927,7 @@ static inline void hci_encrypt_cfm(struct hci_conn *conn, __u8 status,
        hci_proto_encrypt_cfm(conn, status, encrypt);
        read_lock(&hci_cb_list_lock);
-        list_for_each(p, &hci_cb_list) {
+        list_for_each_entry(cb, &hci_cb_list, list) {
-                struct hci_cb *cb = list_entry(p, struct hci_cb, list);
                if (cb->security_cfm)
                        cb->security_cfm(conn, status, encrypt);
        }
@@ -884,11 +936,10 @@ static inline void hci_encrypt_cfm(struct hci_conn *conn, __u8 status,
 static inline void hci_key_change_cfm(struct hci_conn *conn, __u8 status)
 {
-        struct list_head *p;
+        struct hci_cb *cb;
        read_lock(&hci_cb_list_lock);
-        list_for_each(p, &hci_cb_list) {
+        list_for_each_entry(cb, &hci_cb_list, list) {
-                struct hci_cb *cb = list_entry(p, struct hci_cb, list);
                if (cb->key_change_cfm)
                        cb->key_change_cfm(conn, status);
        }
@@ -898,11 +949,10 @@ static inline void hci_key_change_cfm(struct hci_conn *conn, __u8 status)
 static inline void hci_role_switch_cfm(struct hci_conn *conn, __u8 status,
                                                                __u8 role)
 {
-        struct list_head *p;
+        struct hci_cb *cb;
        read_lock(&hci_cb_list_lock);
-        list_for_each(p, &hci_cb_list) {
+        list_for_each_entry(cb, &hci_cb_list, list) {
-                struct hci_cb *cb = list_entry(p, struct hci_cb, list);
                if (cb->role_switch_cfm)
                        cb->role_switch_cfm(conn, status, role);
        }
diff --git a/include/net/bluetooth/l2cap.h b/include/net/bluetooth/l2cap.h
index 7ed8e356425a..f57fab04e7c5 100644
--- a/include/net/bluetooth/l2cap.h
+++ b/include/net/bluetooth/l2cap.h
@@ -32,13 +32,14 @@
 /* L2CAP defaults */
 #define L2CAP_DEFAULT_MTU               672
 #define L2CAP_DEFAULT_MIN_MTU           48
-#define L2CAP_DEFAULT_FLUSH_TO          0xffff
+#define L2CAP_DEFAULT_FLUSH_TO          0xFFFF
+#define L2CAP_EFS_DEFAULT_FLUSH_TO      0xFFFFFFFF
 #define L2CAP_DEFAULT_TX_WINDOW         63
 #define L2CAP_DEFAULT_EXT_WINDOW        0x3FFF
 #define L2CAP_DEFAULT_MAX_TX            3
 #define L2CAP_DEFAULT_RETRANS_TO        2000    /* 2 seconds */
 #define L2CAP_DEFAULT_MONITOR_TO        12000   /* 12 seconds */
-#define L2CAP_DEFAULT_MAX_PDU_SIZE      1009    /* Sized for 3-DH5 packet */
+#define L2CAP_DEFAULT_MAX_PDU_SIZE      1492    /* Sized for AMP packet */
 #define L2CAP_DEFAULT_ACK_TO            200
 #define L2CAP_DEFAULT_MAX_SDU_SIZE      0xFFFF
 #define L2CAP_DEFAULT_SDU_ITIME         0xFFFFFFFF
@@ -51,6 +52,8 @@
 #define L2CAP_ENC_TIMEOUT               msecs_to_jiffies(5000)
 #define L2CAP_CONN_TIMEOUT              msecs_to_jiffies(40000)
 #define L2CAP_INFO_TIMEOUT              msecs_to_jiffies(4000)
+#define L2CAP_MOVE_TIMEOUT              msecs_to_jiffies(4000)
+#define L2CAP_MOVE_ERTX_TIMEOUT         msecs_to_jiffies(60000)
 #define L2CAP_A2MP_DEFAULT_MTU          670
@@ -433,6 +436,8 @@ struct l2cap_chan {
        struct sock *sk;
        struct l2cap_conn       *conn;
+        struct hci_conn         *hs_hcon;
+        struct hci_chan         *hs_hchan;
        struct kref     kref;
        __u8            state;
@@ -476,6 +481,12 @@ struct l2cap_chan {
        unsigned long   conn_state;
        unsigned long   flags;
+        __u8            remote_amp_id;
+        __u8            local_amp_id;
+        __u8            move_id;
+        __u8            move_state;
+        __u8            move_role;
        __u16           next_tx_seq;
        __u16           expected_ack_seq;
        __u16           expected_tx_seq;
@@ -538,6 +549,7 @@ struct l2cap_ops {
        void                    (*state_change) (struct l2cap_chan *chan,
                                                 int state);
        void                    (*ready) (struct l2cap_chan *chan);
+        void                    (*defer) (struct l2cap_chan *chan);
        struct sk_buff          *(*alloc_skb) (struct l2cap_chan *chan,
                                               unsigned long len, int nb);
 };
@@ -640,6 +652,9 @@ enum {
 enum {
        L2CAP_RX_STATE_RECV,
        L2CAP_RX_STATE_SREJ_SENT,
+        L2CAP_RX_STATE_MOVE,
+        L2CAP_RX_STATE_WAIT_P,
+        L2CAP_RX_STATE_WAIT_F,
 };
 enum {
@@ -670,6 +685,25 @@ enum {
        L2CAP_EV_RECV_FRAME,
 };
+enum {
+        L2CAP_MOVE_ROLE_NONE,
+        L2CAP_MOVE_ROLE_INITIATOR,
+        L2CAP_MOVE_ROLE_RESPONDER,
+};
+enum {
+        L2CAP_MOVE_STABLE,
+        L2CAP_MOVE_WAIT_REQ,
+        L2CAP_MOVE_WAIT_RSP,
+        L2CAP_MOVE_WAIT_RSP_SUCCESS,
+        L2CAP_MOVE_WAIT_CONFIRM,
+        L2CAP_MOVE_WAIT_CONFIRM_RSP,
+        L2CAP_MOVE_WAIT_LOGICAL_COMP,
+        L2CAP_MOVE_WAIT_LOGICAL_CFM,
+        L2CAP_MOVE_WAIT_LOCAL_BUSY,
+        L2CAP_MOVE_WAIT_PREPARE,
+};
 void l2cap_chan_hold(struct l2cap_chan *c);
 void l2cap_chan_put(struct l2cap_chan *c);
@@ -745,6 +779,10 @@ static inline void l2cap_chan_no_ready(struct l2cap_chan *chan)
 {
 }
+static inline void l2cap_chan_no_defer(struct l2cap_chan *chan)
+{
+}
 extern bool disable_ertm;
 int l2cap_init_sockets(void);
@@ -767,6 +805,12 @@ int l2cap_chan_check_security(struct l2cap_chan *chan);
 void l2cap_chan_set_defaults(struct l2cap_chan *chan);
 int l2cap_ertm_init(struct l2cap_chan *chan);
 void l2cap_chan_add(struct l2cap_conn *conn, struct l2cap_chan *chan);
+void __l2cap_chan_add(struct l2cap_conn *conn, struct l2cap_chan *chan);
 void l2cap_chan_del(struct l2cap_chan *chan, int err);
+void l2cap_send_conn_req(struct l2cap_chan *chan);
+void l2cap_move_start(struct l2cap_chan *chan);
+void l2cap_logical_cfm(struct l2cap_chan *chan, struct hci_chan *hchan,
+                       u8 status);
+void __l2cap_physical_cfm(struct l2cap_chan *chan, int result);
 #endif /* __L2CAP_H */
diff --git a/include/net/cfg80211.h b/include/net/cfg80211.h
index 7d5b6000378b..e78db2cf3d1b 100644
--- a/include/net/cfg80211.h
+++ b/include/net/cfg80211.h
@@ -306,6 +306,88 @@ struct key_params {
 };
 /**
+ * struct cfg80211_chan_def - channel definition
+ * @chan: the (control) channel
+ * @width: channel width
+ * @center_freq1: center frequency of first segment
+ * @center_freq2: center frequency of second segment
+ *      (only with 80+80 MHz)
+ */
+struct cfg80211_chan_def {
+        struct ieee80211_channel *chan;
+        enum nl80211_chan_width width;
+        u32 center_freq1;
+        u32 center_freq2;
+};
+/**
+ * cfg80211_get_chandef_type - return old channel type from chandef
+ * @chandef: the channel definition
+ *
+ * Returns the old channel type (NOHT, HT20, HT40+/-) from a given
+ * chandef, which must have a bandwidth allowing this conversion.
+ */
+static inline enum nl80211_channel_type
+cfg80211_get_chandef_type(const struct cfg80211_chan_def *chandef)
+{
+        switch (chandef->width) {
+        case NL80211_CHAN_WIDTH_20_NOHT:
+                return NL80211_CHAN_NO_HT;
+        case NL80211_CHAN_WIDTH_20:
+                return NL80211_CHAN_HT20;
+        case NL80211_CHAN_WIDTH_40:
+                if (chandef->center_freq1 > chandef->chan->center_freq)
+                        return NL80211_CHAN_HT40PLUS;
+                return NL80211_CHAN_HT40MINUS;
+        default:
+                WARN_ON(1);
+                return NL80211_CHAN_NO_HT;
+        }
+}
+/**
+ * cfg80211_chandef_create - create channel definition using channel type
+ * @chandef: the channel definition struct to fill
+ * @channel: the control channel
+ * @chantype: the channel type
+ *
+ * Given a channel type, create a channel definition.
+ */
+void cfg80211_chandef_create(struct cfg80211_chan_def *chandef,
+                             struct ieee80211_channel *channel,
+                             enum nl80211_channel_type chantype);
+/**
+ * cfg80211_chandef_identical - check if two channel definitions are identical
+ * @chandef1: first channel definition
+ * @chandef2: second channel definition
+ *
+ * Returns %true if the channels defined by the channel definitions are
+ * identical, %false otherwise.
+ */
+static inline bool
+cfg80211_chandef_identical(const struct cfg80211_chan_def *chandef1,
+                           const struct cfg80211_chan_def *chandef2)
+{
+        return (chandef1->chan == chandef2->chan &&
+                chandef1->width == chandef2->width &&
+                chandef1->center_freq1 == chandef2->center_freq1 &&
+                chandef1->center_freq2 == chandef2->center_freq2);
+}
+/**
+ * cfg80211_chandef_compatible - check if two channel definitions are compatible
+ * @chandef1: first channel definition
+ * @chandef2: second channel definition
+ *
+ * Returns %NULL if the given channel definitions are incompatible,
+ * chandef1 or chandef2 otherwise.
+ */
+const struct cfg80211_chan_def *
+cfg80211_chandef_compatible(const struct cfg80211_chan_def *chandef1,
+                            const struct cfg80211_chan_def *chandef2);
+/**
 * enum survey_info_flags - survey information flags
 *
 * @SURVEY_INFO_NOISE_DBM: noise (in dBm) was filled in
@@ -426,8 +508,7 @@ struct cfg80211_beacon_data {
 *
 * Used to configure an AP interface.
 *
- * @channel: the channel to start the AP on
+ * @chandef: defines the channel to use
- * @channel_type: the channel type to use
 * @beacon: beacon data
 * @beacon_interval: beacon interval
 * @dtim_period: DTIM period
@@ -441,8 +522,7 @@ struct cfg80211_beacon_data {
 * @inactivity_timeout: time in seconds to determine station's inactivity.
 */
 struct cfg80211_ap_settings {
-        struct ieee80211_channel *channel;
+        struct cfg80211_chan_def chandef;
-        enum nl80211_channel_type channel_type;
        struct cfg80211_beacon_data beacon;
@@ -498,6 +578,7 @@ enum station_parameters_apply_mask {
 * @plink_action: plink action to take
 * @plink_state: set the peer link state for a station
 * @ht_capa: HT capabilities of station
+ * @vht_capa: VHT capabilities of station
 * @uapsd_queues: bitmap of queues configured for uapsd. same format
 *      as the AC bitmap in the QoS info field
 * @max_sp: max Service Period. same format as the MAX_SP in the
@@ -517,6 +598,7 @@ struct station_parameters {
        u8 plink_action;
        u8 plink_state;
        struct ieee80211_ht_cap *ht_capa;
+        struct ieee80211_vht_cap *vht_capa;
        u8 uapsd_queues;
        u8 max_sp;
 };
@@ -580,16 +662,24 @@ enum station_info_flags {
 * Used by the driver to indicate the specific rate transmission
 * type for 802.11n transmissions.
 *
- * @RATE_INFO_FLAGS_MCS: @tx_bitrate_mcs filled
+ * @RATE_INFO_FLAGS_MCS: mcs field filled with HT MCS
- * @RATE_INFO_FLAGS_40_MHZ_WIDTH: 40 Mhz width transmission
+ * @RATE_INFO_FLAGS_VHT_MCS: mcs field filled with VHT MCS
+ * @RATE_INFO_FLAGS_40_MHZ_WIDTH: 40 MHz width transmission
+ * @RATE_INFO_FLAGS_80_MHZ_WIDTH: 80 MHz width transmission
+ * @RATE_INFO_FLAGS_80P80_MHZ_WIDTH: 80+80 MHz width transmission
+ * @RATE_INFO_FLAGS_160_MHZ_WIDTH: 160 MHz width transmission
 * @RATE_INFO_FLAGS_SHORT_GI: 400ns guard interval
- * @RATE_INFO_FLAGS_60G: 60gHz MCS
+ * @RATE_INFO_FLAGS_60G: 60GHz MCS
 */
 enum rate_info_flags {
-        RATE_INFO_FLAGS_MCS             = 1<<0,
+        RATE_INFO_FLAGS_MCS                     = BIT(0),
-        RATE_INFO_FLAGS_40_MHZ_WIDTH    = 1<<1,
+        RATE_INFO_FLAGS_VHT_MCS                 = BIT(1),
-        RATE_INFO_FLAGS_SHORT_GI        = 1<<2,
+        RATE_INFO_FLAGS_40_MHZ_WIDTH            = BIT(2),
-        RATE_INFO_FLAGS_60G             = 1<<3,
+        RATE_INFO_FLAGS_80_MHZ_WIDTH            = BIT(3),
+        RATE_INFO_FLAGS_80P80_MHZ_WIDTH         = BIT(4),
+        RATE_INFO_FLAGS_160_MHZ_WIDTH           = BIT(5),
+        RATE_INFO_FLAGS_SHORT_GI                = BIT(6),
+        RATE_INFO_FLAGS_60G                     = BIT(7),
 };
 /**
@@ -600,11 +690,13 @@ enum rate_info_flags {
 * @flags: bitflag of flags from &enum rate_info_flags
 * @mcs: mcs index if struct describes a 802.11n bitrate
 * @legacy: bitrate in 100kbit/s for 802.11abg
+ * @nss: number of streams (VHT only)
 */
 struct rate_info {
        u8 flags;
        u8 mcs;
        u16 legacy;
+        u8 nss;
 };
 /**
@@ -907,8 +999,7 @@ struct mesh_config {
 /**
 * struct mesh_setup - 802.11s mesh setup configuration
- * @channel: the channel to start the mesh network on
+ * @chandef: defines the channel to use
- * @channel_type: the channel type to use
 * @mesh_id: the mesh ID
 * @mesh_id_len: length of the mesh ID, at least 1 and at most 32 bytes
 * @sync_method: which synchronization method to use
@@ -923,8 +1014,7 @@ struct mesh_config {
 * These parameters are fixed when the mesh is created.
 */
 struct mesh_setup {
-        struct ieee80211_channel *channel;
+        struct cfg80211_chan_def chandef;
-        enum nl80211_channel_type channel_type;
        const u8 *mesh_id;
        u8 mesh_id_len;
        u8 sync_method;
@@ -1000,8 +1090,10 @@ struct cfg80211_ssid {
 * @n_channels: total number of channels to scan
 * @ie: optional information element(s) to add into Probe Request or %NULL
 * @ie_len: length of ie in octets
+ * @flags: bit field of flags controlling operation
 * @rates: bitmap of rates to advertise for each band
 * @wiphy: the wiphy this was for
+ * @scan_start: time (in jiffies) when the scan started
 * @wdev: the wireless device to scan for
 * @aborted: (internal) scan request was notified as aborted
 * @no_cck: used to send probe requests at non CCK rate in 2GHz band
@@ -1012,6 +1104,7 @@ struct cfg80211_scan_request {
        u32 n_channels;
        const u8 *ie;
        size_t ie_len;
+        u32 flags;
        u32 rates[IEEE80211_NUM_BANDS];
@@ -1019,6 +1112,7 @@ struct cfg80211_scan_request {
        /* internal */
        struct wiphy *wiphy;
+        unsigned long scan_start;
        bool aborted;
        bool no_cck;
@@ -1044,6 +1138,7 @@ struct cfg80211_match_set {
 * @interval: interval between each scheduled scan cycle
 * @ie: optional information element(s) to add into Probe Request or %NULL
 * @ie_len: length of ie in octets
+ * @flags: bit field of flags controlling operation
 * @match_sets: sets of parameters to be matched for a scan result
 *      entry to be considered valid and to be passed to the host
 *      (others are filtered out).
@@ -1061,6 +1156,7 @@ struct cfg80211_sched_scan_request {
        u32 interval;
        const u8 *ie;
        size_t ie_len;
+        u32 flags;
        struct cfg80211_match_set *match_sets;
        int n_match_sets;
        s32 rssi_thold;
@@ -1068,6 +1164,7 @@ struct cfg80211_sched_scan_request {
        /* internal */
        struct wiphy *wiphy;
        struct net_device *dev;
+        unsigned long scan_start;
        /* keep last */
        struct ieee80211_channel *channels[0];
@@ -1152,6 +1249,9 @@ const u8 *ieee80211_bss_get_ie(struct cfg80211_bss *bss, u8 ie);
 * @key_len: length of WEP key for shared key authentication
 * @key_idx: index of WEP key for shared key authentication
 * @key: WEP key for shared key authentication
+ * @sae_data: Non-IE data to use with SAE or %NULL. This starts with
+ *      Authentication transaction sequence number field.
+ * @sae_data_len: Length of sae_data buffer in octets
 */
 struct cfg80211_auth_request {
        struct cfg80211_bss *bss;
@@ -1160,6 +1260,8 @@ struct cfg80211_auth_request {
        enum nl80211_auth_type auth_type;
        const u8 *key;
        u8 key_len, key_idx;
+        const u8 *sae_data;
+        size_t sae_data_len;
 };
 /**
@@ -1252,8 +1354,7 @@ struct cfg80211_disassoc_request {
 * @ssid_len: The length of the SSID, will always be non-zero.
 * @bssid: Fixed BSSID requested, maybe be %NULL, if set do not
 *      search for IBSSs with a different BSSID.
- * @channel: The channel to use if no IBSS can be found to join.
+ * @chandef: defines the channel to use if no other IBSS to join can be found
- * @channel_type: channel type (HT mode)
 * @channel_fixed: The channel should be fixed -- do not search for
 *      IBSSs to join on other channels.
 * @ie: information element(s) to include in the beacon
@@ -1271,8 +1372,7 @@ struct cfg80211_disassoc_request {
 struct cfg80211_ibss_params {
        u8 *ssid;
        u8 *bssid;
-        struct ieee80211_channel *channel;
+        struct cfg80211_chan_def chandef;
-        enum nl80211_channel_type channel_type;
        u8 *ie;
        u8 ssid_len, ie_len;
        u16 beacon_interval;
@@ -1531,13 +1631,19 @@ struct cfg80211_gtk_rekey_data {
 *      to a merge.
 * @leave_ibss: Leave the IBSS.
 *
+ * @set_mcast_rate: Set the specified multicast rate (only if vif is in ADHOC or
+ *      MESH mode)
+ *
 * @set_wiphy_params: Notify that wiphy parameters have changed;
 *      @changed bitfield (see &enum wiphy_params_flags) describes which values
 *      have changed. The actual parameter values are available in
 *      struct wiphy. If returning an error, no value should be changed.
 *
 * @set_tx_power: set the transmit power according to the parameters,
- *      the power passed is in mBm, to get dBm use MBM_TO_DBM().
+ *      the power passed is in mBm, to get dBm use MBM_TO_DBM(). The
+ *      wdev may be %NULL if power was set for the wiphy, and will
+ *      always be %NULL unless the driver supports per-vif TX power
+ *      (as advertised by the nl80211 feature flag.)
 * @get_tx_power: store the current TX power into the dbm variable;
 *      return 0 if successful
 *
@@ -1708,8 +1814,7 @@ struct cfg80211_ops {
                                             struct ieee80211_channel *chan);
        int     (*set_monitor_channel)(struct wiphy *wiphy,
-                                       struct ieee80211_channel *chan,
+                                       struct cfg80211_chan_def *chandef);
-                                       enum nl80211_channel_type channel_type);
        int     (*scan)(struct wiphy *wiphy,
                        struct cfg80211_scan_request *request);
@@ -1732,11 +1837,15 @@ struct cfg80211_ops {
                             struct cfg80211_ibss_params *params);
        int     (*leave_ibss)(struct wiphy *wiphy, struct net_device *dev);
+        int     (*set_mcast_rate)(struct wiphy *wiphy, struct net_device *dev,
+                                  int rate[IEEE80211_NUM_BANDS]);
        int     (*set_wiphy_params)(struct wiphy *wiphy, u32 changed);
-        int     (*set_tx_power)(struct wiphy *wiphy,
+        int     (*set_tx_power)(struct wiphy *wiphy, struct wireless_dev *wdev,
                                enum nl80211_tx_power_setting type, int mbm);
-        int     (*get_tx_power)(struct wiphy *wiphy, int *dbm);
+        int     (*get_tx_power)(struct wiphy *wiphy, struct wireless_dev *wdev,
+                                int *dbm);
        int     (*set_wds_peer)(struct wiphy *wiphy, struct net_device *dev,
                                const u8 *addr);
@@ -1767,7 +1876,6 @@ struct cfg80211_ops {
        int     (*remain_on_channel)(struct wiphy *wiphy,
                                     struct wireless_dev *wdev,
                                     struct ieee80211_channel *chan,
-                                     enum nl80211_channel_type channel_type,
                                     unsigned int duration,
                                     u64 *cookie);
        int     (*cancel_remain_on_channel)(struct wiphy *wiphy,
@@ -1776,10 +1884,8 @@ struct cfg80211_ops {
        int     (*mgmt_tx)(struct wiphy *wiphy, struct wireless_dev *wdev,
                          struct ieee80211_channel *chan, bool offchan,
-                          enum nl80211_channel_type channel_type,
+                          unsigned int wait, const u8 *buf, size_t len,
-                          bool channel_type_valid, unsigned int wait,
+                          bool no_cck, bool dont_wait_for_ack, u64 *cookie);
-                          const u8 *buf, size_t len, bool no_cck,
-                          bool dont_wait_for_ack, u64 *cookie);
        int     (*mgmt_tx_cancel_wait)(struct wiphy *wiphy,
                                       struct wireless_dev *wdev,
                                       u64 cookie);
@@ -1834,10 +1940,9 @@ struct cfg80211_ops {
        void    (*get_et_strings)(struct wiphy *wiphy, struct net_device *dev,
                                  u32 sset, u8 *data);
-        struct ieee80211_channel *
+        int     (*get_channel)(struct wiphy *wiphy,
-                (*get_channel)(struct wiphy *wiphy,
                               struct wireless_dev *wdev,
-                               enum nl80211_channel_type *type);
+                               struct cfg80211_chan_def *chandef);
        int     (*start_p2p_device)(struct wiphy *wiphy,
                                    struct wireless_dev *wdev);
@@ -2445,8 +2550,7 @@ struct wireless_dev {
        spinlock_t event_lock;
        struct cfg80211_internal_bss *current_bss; /* associated / joined */
-        struct ieee80211_channel *preset_chan;
+        struct cfg80211_chan_def preset_chandef;
-        enum nl80211_channel_type preset_chantype;
        /* for AP and mesh channel tracking */
        struct ieee80211_channel *channel;
@@ -3326,14 +3430,12 @@ void cfg80211_disconnected(struct net_device *dev, u16 reason,
 * @wdev: wireless device
 * @cookie: the request cookie
 * @chan: The current channel (from remain_on_channel request)
- * @channel_type: Channel type
 * @duration: Duration in milliseconds that the driver intents to remain on the
 *      channel
 * @gfp: allocation flags
 */
 void cfg80211_ready_on_channel(struct wireless_dev *wdev, u64 cookie,
                               struct ieee80211_channel *chan,
-                               enum nl80211_channel_type channel_type,
                               unsigned int duration, gfp_t gfp);
 /**
@@ -3341,12 +3443,10 @@ void cfg80211_ready_on_channel(struct wireless_dev *wdev, u64 cookie,
 * @wdev: wireless device
 * @cookie: the request cookie
 * @chan: The current channel (from remain_on_channel request)
- * @channel_type: Channel type
 * @gfp: allocation flags
 */
 void cfg80211_remain_on_channel_expired(struct wireless_dev *wdev, u64 cookie,
                                        struct ieee80211_channel *chan,
-                                        enum nl80211_channel_type channel_type,
                                        gfp_t gfp);
@@ -3536,7 +3636,6 @@ void cfg80211_probe_status(struct net_device *dev, const u8 *addr,
 * @len: length of the frame
 * @freq: frequency the frame was received on
 * @sig_dbm: signal strength in mBm, or 0 if unknown
- * @gfp: allocation flags
 *
 * Use this function to report to userspace when a beacon was
 * received. It is not useful to call this when there is no
@@ -3544,31 +3643,47 @@ void cfg80211_probe_status(struct net_device *dev, const u8 *addr,
 */
 void cfg80211_report_obss_beacon(struct wiphy *wiphy,
                                 const u8 *frame, size_t len,
-                                 int freq, int sig_dbm, gfp_t gfp);
+                                 int freq, int sig_dbm);
 /**
- * cfg80211_can_beacon_sec_chan - test if ht40 on extension channel can be used
+ * cfg80211_reg_can_beacon - check if beaconing is allowed
 * @wiphy: the wiphy
- * @chan: main channel
+ * @chandef: the channel definition
- * @channel_type: HT mode
 *
 * This function returns true if there is no secondary channel or the secondary
- * channel can be used for beaconing (i.e. is not a radar channel etc.)
+ * channel(s) can be used for beaconing (i.e. is not a radar channel etc.)
 */
-bool cfg80211_can_beacon_sec_chan(struct wiphy *wiphy,
+bool cfg80211_reg_can_beacon(struct wiphy *wiphy,
-                                  struct ieee80211_channel *chan,
+                             struct cfg80211_chan_def *chandef);
-                                  enum nl80211_channel_type channel_type);
 /*
 * cfg80211_ch_switch_notify - update wdev channel and notify userspace
 * @dev: the device which switched channels
- * @freq: new channel frequency (in MHz)
+ * @chandef: the new channel definition
- * @type: channel type
 *
 * Acquires wdev_lock, so must only be called from sleepable driver context!
 */
-void cfg80211_ch_switch_notify(struct net_device *dev, int freq,
+void cfg80211_ch_switch_notify(struct net_device *dev,
-                               enum nl80211_channel_type type);
+                               struct cfg80211_chan_def *chandef);
+/*
+ * cfg80211_tdls_oper_request - request userspace to perform TDLS operation
+ * @dev: the device on which the operation is requested
+ * @peer: the MAC address of the peer device
+ * @oper: the requested TDLS operation (NL80211_TDLS_SETUP or
+ *      NL80211_TDLS_TEARDOWN)
+ * @reason_code: the reason code for teardown request
+ * @gfp: allocation flags
+ *
+ * This function is used to request userspace to perform TDLS operation that
+ * requires knowledge of keys, i.e., link setup or teardown when the AP
+ * connection uses encryption. This is optional mechanism for the driver to use
+ * if it can automatically determine when a TDLS link could be useful (e.g.,
+ * based on traffic and signal strength for a peer).
+ */
+void cfg80211_tdls_oper_request(struct net_device *dev, const u8 *peer,
+                                enum nl80211_tdls_operation oper,
+                                u16 reason_code, gfp_t gfp);
 /*
 * cfg80211_calculate_bitrate - calculate actual bitrate (in 100Kbps units)
@@ -3594,6 +3709,26 @@ u32 cfg80211_calculate_bitrate(struct rate_info *rate);
 */
 void cfg80211_unregister_wdev(struct wireless_dev *wdev);
+/**
+ * cfg80211_get_p2p_attr - find and copy a P2P attribute from IE buffer
+ * @ies: the input IE buffer
+ * @len: the input length
+ * @attr: the attribute ID to find
+ * @buf: output buffer, can be %NULL if the data isn't needed, e.g.
+ *      if the function is only called to get the needed buffer size
+ * @bufsize: size of the output buffer
+ *
+ * The function finds a given P2P attribute in the (vendor) IEs and
+ * copies its contents to the given buffer.
+ *
+ * The return value is a negative error code (-%EILSEQ or -%ENOENT) if
+ * the data is malformed or the attribute can't be found (respectively),
+ * or the length of the found attribute (which can be zero).
+ */
+int cfg80211_get_p2p_attr(const u8 *ies, unsigned int len,
+                          enum ieee80211_p2p_attr_id attr,
+                          u8 *buf, unsigned int bufsize);
 /* Logging, debugging and troubleshooting/diagnostic helpers. */
 /* wiphy_printk helpers, similar to dev_printk */
diff --git a/include/net/cls_cgroup.h b/include/net/cls_cgroup.h
index b6a6eeb3905f..2581638f4a3d 100644
--- a/include/net/cls_cgroup.h
+++ b/include/net/cls_cgroup.h
@@ -24,12 +24,12 @@ struct cgroup_cls_state
        u32 classid;
 };
-extern void sock_update_classid(struct sock *sk);
+extern void sock_update_classid(struct sock *sk, struct task_struct *task);
 #if IS_BUILTIN(CONFIG_NET_CLS_CGROUP)
 static inline u32 task_cls_classid(struct task_struct *p)
 {
-        int classid;
+        u32 classid;
        if (in_interrupt())
                return 0;
@@ -61,7 +61,7 @@ static inline u32 task_cls_classid(struct task_struct *p)
 }
 #endif
 #else /* !CGROUP_NET_CLS_CGROUP */
-static inline void sock_update_classid(struct sock *sk)
+static inline void sock_update_classid(struct sock *sk, struct task_struct *task)
 {
 }
diff --git a/include/net/ip6_checksum.h b/include/net/ip6_checksum.h
index bc1b0fda2b04..652d3d309357 100644
--- a/include/net/ip6_checksum.h
+++ b/include/net/ip6_checksum.h
@@ -31,6 +31,8 @@
 #include <net/ip.h>
 #include <asm/checksum.h>
 #include <linux/in6.h>
+#include <linux/tcp.h>
+#include <linux/ipv6.h>
 #ifndef _HAVE_ARCH_IPV6_CSUM
@@ -91,4 +93,37 @@ static __inline__ __sum16 csum_ipv6_magic(const struct in6_addr *saddr,
 }
 #endif
+static __inline__ __sum16 tcp_v6_check(int len,
+                                   const struct in6_addr *saddr,
+                                   const struct in6_addr *daddr,
+                                   __wsum base)
+{
+        return csum_ipv6_magic(saddr, daddr, len, IPPROTO_TCP, base);
+}
+static inline void __tcp_v6_send_check(struct sk_buff *skb,
+                                       const struct in6_addr *saddr,
+                                       const struct in6_addr *daddr)
+{
+        struct tcphdr *th = tcp_hdr(skb);
+        if (skb->ip_summed == CHECKSUM_PARTIAL) {
+                th->check = ~tcp_v6_check(skb->len, saddr, daddr, 0);
+                skb->csum_start = skb_transport_header(skb) - skb->head;
+                skb->csum_offset = offsetof(struct tcphdr, check);
+        } else {
+                th->check = tcp_v6_check(skb->len, saddr, daddr,
+                                         csum_partial(th, th->doff << 2,
+                                                      skb->csum));
+        }
+}
+static inline void tcp_v6_send_check(struct sock *sk, struct sk_buff *skb)
+{
+        struct ipv6_pinfo *np = inet6_sk(sk);
+        __tcp_v6_send_check(skb, &np->saddr, &np->daddr);
+}
 #endif
diff --git a/include/net/ip6_fib.h b/include/net/ip6_fib.h
index 8a2a203eb15d..fdc48a94a063 100644
--- a/include/net/ip6_fib.h
+++ b/include/net/ip6_fib.h
@@ -47,6 +47,8 @@ struct fib6_config {
        unsigned long   fc_expires;
        struct nlattr   *fc_mx;
        int             fc_mx_len;
+        int             fc_mp_len;
+        struct nlattr   *fc_mp;
        struct nl_info  fc_nlinfo;
 };
@@ -99,6 +101,14 @@ struct rt6_info {
        struct in6_addr                 rt6i_gateway;
+        /* Multipath routes:
+         * siblings is a list of rt6_info that have the the same metric/weight,
+         * destination, but not the same gateway. nsiblings is just a cache
+         * to speed up lookup.
+         */
+        struct list_head                rt6i_siblings;
+        unsigned int                    rt6i_nsiblings;
        atomic_t                        rt6i_ref;
        /* These are in a separate cache line. */
@@ -107,7 +117,6 @@ struct rt6_info {
        struct rt6key                   rt6i_src;
        struct rt6key                   rt6i_prefsrc;
        u32                             rt6i_metric;
-        u32                             rt6i_peer_genid;
        struct inet6_dev                *rt6i_idev;
        unsigned long                   _rt6i_peer;
@@ -203,6 +212,15 @@ static inline void rt6_set_from(struct rt6_info *rt, struct rt6_info *from)
        dst_hold(new);
 }
+static inline void ip6_rt_put(struct rt6_info *rt)
+{
+        /* dst_release() accepts a NULL parameter.
+         * We rely on dst being first structure in struct rt6_info
+         */
+        BUILD_BUG_ON(offsetof(struct rt6_info, dst) != 0);
+        dst_release(&rt->dst);
+}
 struct fib6_walker_t {
        struct list_head lh;
        struct fib6_node *root, *node;
diff --git a/include/net/ip6_route.h b/include/net/ip6_route.h
index 5fa2af00634a..27d83183e615 100644
--- a/include/net/ip6_route.h
+++ b/include/net/ip6_route.h
@@ -1,9 +1,6 @@
 #ifndef _NET_IP6_ROUTE_H
 #define _NET_IP6_ROUTE_H
-#define IP6_RT_PRIO_USER        1024
-#define IP6_RT_PRIO_ADDRCONF    256
 struct route_info {
        __u8                    type;
        __u8                    length;
diff --git a/include/net/ip_vs.h b/include/net/ip_vs.h
index ee75ccdf5188..68c69d54d392 100644
--- a/include/net/ip_vs.h
+++ b/include/net/ip_vs.h
@@ -22,7 +22,10 @@
 #include <linux/ip.h>
 #include <linux/ipv6.h>                 /* for struct ipv6hdr */
 #include <net/ipv6.h>
-#if defined(CONFIG_NF_CONNTRACK) || defined(CONFIG_NF_CONNTRACK_MODULE)
+#if IS_ENABLED(CONFIG_IP_VS_IPV6)
+#include <linux/netfilter_ipv6/ip6_tables.h>
+#endif
+#if IS_ENABLED(CONFIG_NF_CONNTRACK)
 #include <net/netfilter/nf_conntrack.h>
 #endif
 #include <net/net_namespace.h>          /* Netw namespace */
@@ -103,30 +106,117 @@ static inline struct net *seq_file_single_net(struct seq_file *seq)
 /* Connections' size value needed by ip_vs_ctl.c */
 extern int ip_vs_conn_tab_size;
 struct ip_vs_iphdr {
-        int len;
+        __u32 len;      /* IPv4 simply where L4 starts
-        __u8 protocol;
+                           IPv6 where L4 Transport Header starts */
+        __u32 thoff_reasm; /* Transport Header Offset in nfct_reasm skb */
+        __u16 fragoffs; /* IPv6 fragment offset, 0 if first frag (or not frag)*/
+        __s16 protocol;
+        __s32 flags;
        union nf_inet_addr saddr;
        union nf_inet_addr daddr;
 };
+/* Dependency to module: nf_defrag_ipv6 */
+#if defined(CONFIG_NF_DEFRAG_IPV6) || defined(CONFIG_NF_DEFRAG_IPV6_MODULE)
+static inline struct sk_buff *skb_nfct_reasm(const struct sk_buff *skb)
+{
+        return skb->nfct_reasm;
+}
+static inline void *frag_safe_skb_hp(const struct sk_buff *skb, int offset,
+                                      int len, void *buffer,
+                                      const struct ip_vs_iphdr *ipvsh)
+{
+        if (unlikely(ipvsh->fragoffs && skb_nfct_reasm(skb)))
+                return skb_header_pointer(skb_nfct_reasm(skb),
+                                          ipvsh->thoff_reasm, len, buffer);
+        return skb_header_pointer(skb, offset, len, buffer);
+}
+#else
+static inline struct sk_buff *skb_nfct_reasm(const struct sk_buff *skb)
+{
+        return NULL;
+}
+static inline void *frag_safe_skb_hp(const struct sk_buff *skb, int offset,
+                                      int len, void *buffer,
+                                      const struct ip_vs_iphdr *ipvsh)
+{
+        return skb_header_pointer(skb, offset, len, buffer);
+}
+#endif
 static inline void
-ip_vs_fill_iphdr(int af, const void *nh, struct ip_vs_iphdr *iphdr)
+ip_vs_fill_ip4hdr(const void *nh, struct ip_vs_iphdr *iphdr)
+{
+        const struct iphdr *iph = nh;
+        iphdr->len      = iph->ihl * 4;
+        iphdr->fragoffs = 0;
+        iphdr->protocol = iph->protocol;
+        iphdr->saddr.ip = iph->saddr;
+        iphdr->daddr.ip = iph->daddr;
+}
+/* This function handles filling *ip_vs_iphdr, both for IPv4 and IPv6.
+ * IPv6 requires some extra work, as finding proper header position,
+ * depend on the IPv6 extension headers.
+ */
+static inline void
+ip_vs_fill_iph_skb(int af, const struct sk_buff *skb, struct ip_vs_iphdr *iphdr)
 {
 #ifdef CONFIG_IP_VS_IPV6
        if (af == AF_INET6) {
-                const struct ipv6hdr *iph = nh;
+                const struct ipv6hdr *iph =
-                iphdr->len = sizeof(struct ipv6hdr);
+                        (struct ipv6hdr *)skb_network_header(skb);
-                iphdr->protocol = iph->nexthdr;
                iphdr->saddr.in6 = iph->saddr;
                iphdr->daddr.in6 = iph->daddr;
+                /* ipv6_find_hdr() updates len, flags, thoff_reasm */
+                iphdr->thoff_reasm = 0;
+                iphdr->len       = 0;
+                iphdr->flags     = 0;
+                iphdr->protocol  = ipv6_find_hdr(skb, &iphdr->len, -1,
+                                                 &iphdr->fragoffs,
+                                                 &iphdr->flags);
+                /* get proto from re-assembled packet and it's offset */
+                if (skb_nfct_reasm(skb))
+                        iphdr->protocol = ipv6_find_hdr(skb_nfct_reasm(skb),
+                                                        &iphdr->thoff_reasm,
+                                                        -1, NULL, NULL);
        } else
 #endif
        {
-                const struct iphdr *iph = nh;
+                const struct iphdr *iph =
-                iphdr->len = iph->ihl * 4;
+                        (struct iphdr *)skb_network_header(skb);
-                iphdr->protocol = iph->protocol;
+                iphdr->len      = iph->ihl * 4;
+                iphdr->fragoffs = 0;
+                iphdr->protocol = iph->protocol;
+                iphdr->saddr.ip = iph->saddr;
+                iphdr->daddr.ip = iph->daddr;
+        }
+}
+/* This function is a faster version of ip_vs_fill_iph_skb().
+ * Where we only populate {s,d}addr (and avoid calling ipv6_find_hdr()).
+ * This is used by the some of the ip_vs_*_schedule() functions.
+ * (Mostly done to avoid ABI breakage of external schedulers)
+ */
+static inline void
+ip_vs_fill_iph_addr_only(int af, const struct sk_buff *skb,
+                         struct ip_vs_iphdr *iphdr)
+{
+#ifdef CONFIG_IP_VS_IPV6
+        if (af == AF_INET6) {
+                const struct ipv6hdr *iph =
+                        (struct ipv6hdr *)skb_network_header(skb);
+                iphdr->saddr.in6 = iph->saddr;
+                iphdr->daddr.in6 = iph->daddr;
+        } else
+#endif
+        {
+                const struct iphdr *iph =
+                        (struct iphdr *)skb_network_header(skb);
                iphdr->saddr.ip = iph->saddr;
                iphdr->daddr.ip = iph->daddr;
        }
@@ -165,7 +255,7 @@ static inline const char *ip_vs_dbg_addr(int af, char *buf, size_t buf_len,
        int len;
 #ifdef CONFIG_IP_VS_IPV6
        if (af == AF_INET6)
-                len = snprintf(&buf[*idx], buf_len - *idx, "[%pI6]",
+                len = snprintf(&buf[*idx], buf_len - *idx, "[%pI6c]",
                               &addr->in6) + 1;
        else
 #endif
@@ -398,27 +488,26 @@ struct ip_vs_protocol {
        int (*conn_schedule)(int af, struct sk_buff *skb,
                             struct ip_vs_proto_data *pd,
-                             int *verdict, struct ip_vs_conn **cpp);
+                             int *verdict, struct ip_vs_conn **cpp,
+                             struct ip_vs_iphdr *iph);
        struct ip_vs_conn *
        (*conn_in_get)(int af,
                       const struct sk_buff *skb,
                       const struct ip_vs_iphdr *iph,
-                       unsigned int proto_off,
                       int inverse);
        struct ip_vs_conn *
        (*conn_out_get)(int af,
                        const struct sk_buff *skb,
                        const struct ip_vs_iphdr *iph,
-                        unsigned int proto_off,
                        int inverse);
-        int (*snat_handler)(struct sk_buff *skb,
+        int (*snat_handler)(struct sk_buff *skb, struct ip_vs_protocol *pp,
-                            struct ip_vs_protocol *pp, struct ip_vs_conn *cp);
+                            struct ip_vs_conn *cp, struct ip_vs_iphdr *iph);
-        int (*dnat_handler)(struct sk_buff *skb,
+        int (*dnat_handler)(struct sk_buff *skb, struct ip_vs_protocol *pp,
-                            struct ip_vs_protocol *pp, struct ip_vs_conn *cp);
+                            struct ip_vs_conn *cp, struct ip_vs_iphdr *iph);
        int (*csum_check)(int af, struct sk_buff *skb,
                          struct ip_vs_protocol *pp);
@@ -518,7 +607,7 @@ struct ip_vs_conn {
           NF_ACCEPT can be returned when destination is local.
         */
        int (*packet_xmit)(struct sk_buff *skb, struct ip_vs_conn *cp,
-                           struct ip_vs_protocol *pp);
+                           struct ip_vs_protocol *pp, struct ip_vs_iphdr *iph);
        /* Note: we can group the following members into a structure,
           in order to save more space, and the following members are
@@ -769,13 +858,11 @@ struct ip_vs_app {
        struct ip_vs_conn *
        (*conn_in_get)(const struct sk_buff *skb, struct ip_vs_app *app,
-                       const struct iphdr *iph, unsigned int proto_off,
+                       const struct iphdr *iph, int inverse);
-                       int inverse);
        struct ip_vs_conn *
        (*conn_out_get)(const struct sk_buff *skb, struct ip_vs_app *app,
-                        const struct iphdr *iph, unsigned int proto_off,
+                        const struct iphdr *iph, int inverse);
-                        int inverse);
        int (*state_transition)(struct ip_vs_conn *cp, int direction,
                                const struct sk_buff *skb,
@@ -1074,14 +1161,12 @@ struct ip_vs_conn *ip_vs_ct_in_get(const struct ip_vs_conn_param *p);
 struct ip_vs_conn * ip_vs_conn_in_get_proto(int af, const struct sk_buff *skb,
                                            const struct ip_vs_iphdr *iph,
-                                            unsigned int proto_off,
                                            int inverse);
 struct ip_vs_conn *ip_vs_conn_out_get(const struct ip_vs_conn_param *p);
 struct ip_vs_conn * ip_vs_conn_out_get_proto(int af, const struct sk_buff *skb,
                                             const struct ip_vs_iphdr *iph,
-                                             unsigned int proto_off,
                                             int inverse);
 /* put back the conn without restarting its timer */
@@ -1254,9 +1339,10 @@ extern struct ip_vs_scheduler *ip_vs_scheduler_get(const char *sched_name);
 extern void ip_vs_scheduler_put(struct ip_vs_scheduler *scheduler);
 extern struct ip_vs_conn *
 ip_vs_schedule(struct ip_vs_service *svc, struct sk_buff *skb,
-               struct ip_vs_proto_data *pd, int *ignored);
+               struct ip_vs_proto_data *pd, int *ignored,
+               struct ip_vs_iphdr *iph);
 extern int ip_vs_leave(struct ip_vs_service *svc, struct sk_buff *skb,
-                        struct ip_vs_proto_data *pd);
+                        struct ip_vs_proto_data *pd, struct ip_vs_iphdr *iph);
 extern void ip_vs_scheduler_err(struct ip_vs_service *svc, const char *msg);
@@ -1315,33 +1401,38 @@ extern void ip_vs_read_estimator(struct ip_vs_stats_user *dst,
 /*
 *      Various IPVS packet transmitters (from ip_vs_xmit.c)
 */
-extern int ip_vs_null_xmit
+extern int ip_vs_null_xmit(struct sk_buff *skb, struct ip_vs_conn *cp,
-(struct sk_buff *skb, struct ip_vs_conn *cp, struct ip_vs_protocol *pp);
+                           struct ip_vs_protocol *pp, struct ip_vs_iphdr *iph);
-extern int ip_vs_bypass_xmit
+extern int ip_vs_bypass_xmit(struct sk_buff *skb, struct ip_vs_conn *cp,
-(struct sk_buff *skb, struct ip_vs_conn *cp, struct ip_vs_protocol *pp);
+                             struct ip_vs_protocol *pp,
-extern int ip_vs_nat_xmit
+                             struct ip_vs_iphdr *iph);
-(struct sk_buff *skb, struct ip_vs_conn *cp, struct ip_vs_protocol *pp);
+extern int ip_vs_nat_xmit(struct sk_buff *skb, struct ip_vs_conn *cp,
-extern int ip_vs_tunnel_xmit
+                          struct ip_vs_protocol *pp, struct ip_vs_iphdr *iph);
-(struct sk_buff *skb, struct ip_vs_conn *cp, struct ip_vs_protocol *pp);
+extern int ip_vs_tunnel_xmit(struct sk_buff *skb, struct ip_vs_conn *cp,
-extern int ip_vs_dr_xmit
+                             struct ip_vs_protocol *pp,
-(struct sk_buff *skb, struct ip_vs_conn *cp, struct ip_vs_protocol *pp);
+                             struct ip_vs_iphdr *iph);
-extern int ip_vs_icmp_xmit
+extern int ip_vs_dr_xmit(struct sk_buff *skb, struct ip_vs_conn *cp,
-(struct sk_buff *skb, struct ip_vs_conn *cp, struct ip_vs_protocol *pp,
+                         struct ip_vs_protocol *pp, struct ip_vs_iphdr *iph);
- int offset, unsigned int hooknum);
+extern int ip_vs_icmp_xmit(struct sk_buff *skb, struct ip_vs_conn *cp,
+                           struct ip_vs_protocol *pp, int offset,
+                           unsigned int hooknum, struct ip_vs_iphdr *iph);
 extern void ip_vs_dst_reset(struct ip_vs_dest *dest);
 #ifdef CONFIG_IP_VS_IPV6
-extern int ip_vs_bypass_xmit_v6
+extern int ip_vs_bypass_xmit_v6(struct sk_buff *skb, struct ip_vs_conn *cp,
-(struct sk_buff *skb, struct ip_vs_conn *cp, struct ip_vs_protocol *pp);
+                                struct ip_vs_protocol *pp,
-extern int ip_vs_nat_xmit_v6
+                                struct ip_vs_iphdr *iph);
-(struct sk_buff *skb, struct ip_vs_conn *cp, struct ip_vs_protocol *pp);
+extern int ip_vs_nat_xmit_v6(struct sk_buff *skb, struct ip_vs_conn *cp,
-extern int ip_vs_tunnel_xmit_v6
+                             struct ip_vs_protocol *pp,
-(struct sk_buff *skb, struct ip_vs_conn *cp, struct ip_vs_protocol *pp);
+                             struct ip_vs_iphdr *iph);
-extern int ip_vs_dr_xmit_v6
+extern int ip_vs_tunnel_xmit_v6(struct sk_buff *skb, struct ip_vs_conn *cp,
-(struct sk_buff *skb, struct ip_vs_conn *cp, struct ip_vs_protocol *pp);
+                                struct ip_vs_protocol *pp,
-extern int ip_vs_icmp_xmit_v6
+                                struct ip_vs_iphdr *iph);
-(struct sk_buff *skb, struct ip_vs_conn *cp, struct ip_vs_protocol *pp,
+extern int ip_vs_dr_xmit_v6(struct sk_buff *skb, struct ip_vs_conn *cp,
- int offset, unsigned int hooknum);
+                            struct ip_vs_protocol *pp, struct ip_vs_iphdr *iph);
+extern int ip_vs_icmp_xmit_v6(struct sk_buff *skb, struct ip_vs_conn *cp,
+                              struct ip_vs_protocol *pp, int offset,
+                              unsigned int hooknum, struct ip_vs_iphdr *iph);
 #endif
 #ifdef CONFIG_SYSCTL
diff --git a/include/net/ipip.h b/include/net/ipip.h
index ddc077c51f32..21947cf4fa46 100644
--- a/include/net/ipip.h
+++ b/include/net/ipip.h
@@ -48,25 +48,27 @@ struct ip_tunnel_prl_entry {
        struct rcu_head                 rcu_head;
 };
-#define __IPTUNNEL_XMIT(stats1, stats2) do {                            \
+static inline void iptunnel_xmit(struct sk_buff *skb, struct net_device *dev)
-        int err;                                                        \
+{
-        int pkt_len = skb->len - skb_transport_offset(skb);             \
+        int err;
-                                                                        \
+        struct iphdr *iph = ip_hdr(skb);
-        skb->ip_summed = CHECKSUM_NONE;                                 \
+        int pkt_len = skb->len - skb_transport_offset(skb);
-        ip_select_ident(iph, &rt->dst, NULL);                           \
+        struct pcpu_tstats *tstats = this_cpu_ptr(dev->tstats);
-                                                                        \
-        err = ip_local_out(skb);                                        \
-        if (likely(net_xmit_eval(err) == 0)) {                          \
-                u64_stats_update_begin(&(stats1)->syncp);               \
-                (stats1)->tx_bytes += pkt_len;                          \
-                (stats1)->tx_packets++;                                 \
-                u64_stats_update_end(&(stats1)->syncp);                 \
-        } else {                                                        \
-                (stats2)->tx_errors++;                                  \
-                (stats2)->tx_aborted_errors++;                          \
-        }                                                               \
-} while (0)
-#define IPTUNNEL_XMIT() __IPTUNNEL_XMIT(txq, stats)
+        nf_reset(skb);
+        skb->ip_summed = CHECKSUM_NONE;
+        ip_select_ident(iph, skb_dst(skb), NULL);
+        err = ip_local_out(skb);
+        if (likely(net_xmit_eval(err) == 0)) {
+                u64_stats_update_begin(&tstats->syncp);
+                tstats->tx_bytes += pkt_len;
+                tstats->tx_packets++;
+                u64_stats_update_end(&tstats->syncp);
+        } else {
+                dev->stats.tx_errors++;
+                dev->stats.tx_aborted_errors++;
+        }
+}
 #endif
diff --git a/include/net/mac80211.h b/include/net/mac80211.h
index 82558c8decf8..db7680acd0da 100644
--- a/include/net/mac80211.h
+++ b/include/net/mac80211.h
@@ -144,6 +144,39 @@ struct ieee80211_low_level_stats {
 };
 /**
+ * enum ieee80211_chanctx_change - change flag for channel context
+ * @IEEE80211_CHANCTX_CHANGE_WIDTH: The channel width changed
+ * @IEEE80211_CHANCTX_CHANGE_RX_CHAINS: The number of RX chains changed
+ */
+enum ieee80211_chanctx_change {
+        IEEE80211_CHANCTX_CHANGE_WIDTH          = BIT(0),
+        IEEE80211_CHANCTX_CHANGE_RX_CHAINS      = BIT(1),
+};
+/**
+ * struct ieee80211_chanctx_conf - channel context that vifs may be tuned to
+ *
+ * This is the driver-visible part. The ieee80211_chanctx
+ * that contains it is visible in mac80211 only.
+ *
+ * @def: the channel definition
+ * @rx_chains_static: The number of RX chains that must always be
+ *      active on the channel to receive MIMO transmissions
+ * @rx_chains_dynamic: The number of RX chains that must be enabled
+ *      after RTS/CTS handshake to receive SMPS MIMO transmissions;
+ *      this will always be >= @rx_chains_always.
+ * @drv_priv: data area for driver use, will always be aligned to
+ *      sizeof(void *), size is determined in hw information.
+ */
+struct ieee80211_chanctx_conf {
+        struct cfg80211_chan_def def;
+        u8 rx_chains_static, rx_chains_dynamic;
+        u8 drv_priv[0] __attribute__((__aligned__(sizeof(void *))));
+};
+/**
 * enum ieee80211_bss_change - BSS change notification flags
 *
 * These flags are used with the bss_info_changed() callback
@@ -172,6 +205,9 @@ struct ieee80211_low_level_stats {
 * @BSS_CHANGED_SSID: SSID changed for this BSS (AP mode)
 * @BSS_CHANGED_AP_PROBE_RESP: Probe Response changed for this BSS (AP mode)
 * @BSS_CHANGED_PS: PS changed for this BSS (STA mode)
+ * @BSS_CHANGED_TXPOWER: TX power setting changed for this interface
+ * @BSS_CHANGED_P2P_PS: P2P powersave settings (CTWindow, opportunistic PS)
+ *      changed (currently only in P2P client mode, GO mode will be later)
 */
 enum ieee80211_bss_change {
        BSS_CHANGED_ASSOC               = 1<<0,
@@ -192,6 +228,8 @@ enum ieee80211_bss_change {
        BSS_CHANGED_SSID                = 1<<15,
        BSS_CHANGED_AP_PROBE_RESP       = 1<<16,
        BSS_CHANGED_PS                  = 1<<17,
+        BSS_CHANGED_TXPOWER             = 1<<18,
+        BSS_CHANGED_P2P_PS              = 1<<19,
        /* when adding here, make sure to change ieee80211_reconfig */
 };
@@ -223,6 +261,7 @@ enum ieee80211_rssi_event {
 * @assoc: association status
 * @ibss_joined: indicates whether this station is part of an IBSS
 *      or not
+ * @ibss_creator: indicates if a new IBSS network is being created
 * @aid: association ID number, valid only when @assoc is true
 * @use_cts_prot: use CTS protection
 * @use_short_preamble: use 802.11b short preamble;
@@ -247,9 +286,8 @@ enum ieee80211_rssi_event {
 * @mcast_rate: per-band multicast rate index + 1 (0: disabled)
 * @bssid: The BSSID for this BSS
 * @enable_beacon: whether beaconing should be enabled or not
- * @channel_type: Channel type for this BSS -- the hardware might be
+ * @chandef: Channel definition for this BSS -- the hardware might be
- *      configured for HT40+ while this BSS only uses no-HT, for
+ *      configured a higher bandwidth than this BSS uses, for example.
- *      example.
 * @ht_operation_mode: HT operation mode like in &struct ieee80211_ht_operation.
 *      This field is only valid when the channel type is one of the HT types.
 * @cqm_rssi_thold: Connection quality monitor RSSI threshold, a zero value
@@ -273,11 +311,15 @@ enum ieee80211_rssi_event {
 * @ssid: The SSID of the current vif. Only valid in AP-mode.
 * @ssid_len: Length of SSID given in @ssid.
 * @hidden_ssid: The SSID of the current vif is hidden. Only valid in AP-mode.
+ * @txpower: TX power in dBm
+ * @p2p_ctwindow: P2P CTWindow, only for P2P client interfaces
+ * @p2p_oppps: P2P opportunistic PS is enabled
 */
 struct ieee80211_bss_conf {
        const u8 *bssid;
        /* association related data */
        bool assoc, ibss_joined;
+        bool ibss_creator;
        u16 aid;
        /* erp related data */
        bool use_cts_prot;
@@ -294,7 +336,7 @@ struct ieee80211_bss_conf {
        u16 ht_operation_mode;
        s32 cqm_rssi_thold;
        u32 cqm_rssi_hyst;
-        enum nl80211_channel_type channel_type;
+        struct cfg80211_chan_def chandef;
        __be32 arp_addr_list[IEEE80211_BSS_ARP_ADDR_LIST_LEN];
        u8 arp_addr_cnt;
        bool arp_filter_enabled;
@@ -304,6 +346,9 @@ struct ieee80211_bss_conf {
        u8 ssid[IEEE80211_MAX_SSID_LEN];
        size_t ssid_len;
        bool hidden_ssid;
+        int txpower;
+        u8 p2p_ctwindow;
+        bool p2p_oppps;
 };
 /**
@@ -454,9 +499,14 @@ enum mac80211_tx_control_flags {
 *      This is set if the current BSS requires ERP protection.
 * @IEEE80211_TX_RC_USE_SHORT_PREAMBLE: Use short preamble.
 * @IEEE80211_TX_RC_MCS: HT rate.
+ * @IEEE80211_TX_RC_VHT_MCS: VHT MCS rate, in this case the idx field is split
+ *      into a higher 4 bits (Nss) and lower 4 bits (MCS number)
 * @IEEE80211_TX_RC_GREEN_FIELD: Indicates whether this rate should be used in
 *      Greenfield mode.
 * @IEEE80211_TX_RC_40_MHZ_WIDTH: Indicates if the Channel Width should be 40 MHz.
+ * @IEEE80211_TX_RC_80_MHZ_WIDTH: Indicates 80 MHz transmission
+ * @IEEE80211_TX_RC_160_MHZ_WIDTH: Indicates 160 MHz transmission
+ *      (80+80 isn't supported yet)
 * @IEEE80211_TX_RC_DUP_DATA: The frame should be transmitted on both of the
 *      adjacent 20 MHz channels, if the current channel type is
 *      NL80211_CHAN_HT40MINUS or NL80211_CHAN_HT40PLUS.
@@ -467,12 +517,15 @@ enum mac80211_rate_control_flags {
        IEEE80211_TX_RC_USE_CTS_PROTECT         = BIT(1),
        IEEE80211_TX_RC_USE_SHORT_PREAMBLE      = BIT(2),
-        /* rate index is an MCS rate number instead of an index */
+        /* rate index is an HT/VHT MCS instead of an index */
        IEEE80211_TX_RC_MCS                     = BIT(3),
        IEEE80211_TX_RC_GREEN_FIELD             = BIT(4),
        IEEE80211_TX_RC_40_MHZ_WIDTH            = BIT(5),
        IEEE80211_TX_RC_DUP_DATA                = BIT(6),
        IEEE80211_TX_RC_SHORT_GI                = BIT(7),
+        IEEE80211_TX_RC_VHT_MCS                 = BIT(8),
+        IEEE80211_TX_RC_80_MHZ_WIDTH            = BIT(9),
+        IEEE80211_TX_RC_160_MHZ_WIDTH           = BIT(10),
 };
@@ -515,10 +568,32 @@ enum mac80211_rate_control_flags {
 */
 struct ieee80211_tx_rate {
        s8 idx;
-        u8 count;
+        u16 count:5,
-        u8 flags;
+            flags:11;
 } __packed;
+#define IEEE80211_MAX_TX_RETRY          31
+static inline void ieee80211_rate_set_vht(struct ieee80211_tx_rate *rate,
+                                          u8 mcs, u8 nss)
+{
+        WARN_ON(mcs & ~0xF);
+        WARN_ON(nss & ~0x7);
+        rate->idx = (nss << 4) | mcs;
+}
+static inline u8
+ieee80211_rate_get_vht_mcs(const struct ieee80211_tx_rate *rate)
+{
+        return rate->idx & 0xF;
+}
+static inline u8
+ieee80211_rate_get_vht_nss(const struct ieee80211_tx_rate *rate)
+{
+        return rate->idx >> 4;
+}
 /**
 * struct ieee80211_tx_info - skb transmit information
 *
@@ -663,13 +738,20 @@ ieee80211_tx_info_clear_status(struct ieee80211_tx_info *info)
 *      the frame.
 * @RX_FLAG_FAILED_PLCP_CRC: Set this flag if the PCLP check failed on
 *      the frame.
- * @RX_FLAG_MACTIME_MPDU: The timestamp passed in the RX status (@mactime
+ * @RX_FLAG_MACTIME_START: The timestamp passed in the RX status (@mactime
 *      field) is valid and contains the time the first symbol of the MPDU
 *      was received. This is useful in monitor mode and for proper IBSS
 *      merging.
+ * @RX_FLAG_MACTIME_END: The timestamp passed in the RX status (@mactime
+ *      field) is valid and contains the time the last symbol of the MPDU
+ *      (including FCS) was received.
 * @RX_FLAG_SHORTPRE: Short preamble was used for this frame
 * @RX_FLAG_HT: HT MCS was used and rate_idx is MCS index
+ * @RX_FLAG_VHT: VHT MCS was used and rate_index is MCS index
 * @RX_FLAG_40MHZ: HT40 (40 MHz) was used
+ * @RX_FLAG_80MHZ: 80 MHz was used
+ * @RX_FLAG_80P80MHZ: 80+80 MHz was used
+ * @RX_FLAG_160MHZ: 160 MHz was used
 * @RX_FLAG_SHORT_GI: Short guard interval was used
 * @RX_FLAG_NO_SIGNAL_VAL: The signal strength value is not present.
 *      Valid only for data frames (mainly A-MPDU)
@@ -697,7 +779,7 @@ enum mac80211_rx_flags {
        RX_FLAG_IV_STRIPPED             = BIT(4),
        RX_FLAG_FAILED_FCS_CRC          = BIT(5),
        RX_FLAG_FAILED_PLCP_CRC         = BIT(6),
-        RX_FLAG_MACTIME_MPDU            = BIT(7),
+        RX_FLAG_MACTIME_START           = BIT(7),
        RX_FLAG_SHORTPRE                = BIT(8),
        RX_FLAG_HT                      = BIT(9),
        RX_FLAG_40MHZ                   = BIT(10),
@@ -711,6 +793,11 @@ enum mac80211_rx_flags {
        RX_FLAG_AMPDU_IS_LAST           = BIT(18),
        RX_FLAG_AMPDU_DELIM_CRC_ERROR   = BIT(19),
        RX_FLAG_AMPDU_DELIM_CRC_KNOWN   = BIT(20),
+        RX_FLAG_MACTIME_END             = BIT(21),
+        RX_FLAG_VHT                     = BIT(22),
+        RX_FLAG_80MHZ                   = BIT(23),
+        RX_FLAG_80P80MHZ                = BIT(24),
+        RX_FLAG_160MHZ                  = BIT(25),
 };
 /**
@@ -731,25 +818,39 @@ enum mac80211_rx_flags {
 *      @IEEE80211_HW_SIGNAL_*
 * @antenna: antenna used
 * @rate_idx: index of data rate into band's supported rates or MCS index if
- *      HT rates are use (RX_FLAG_HT)
+ *      HT or VHT is used (%RX_FLAG_HT/%RX_FLAG_VHT)
+ * @vht_nss: number of streams (VHT only)
 * @flag: %RX_FLAG_*
 * @rx_flags: internal RX flags for mac80211
 * @ampdu_reference: A-MPDU reference number, must be a different value for
 *      each A-MPDU but the same for each subframe within one A-MPDU
 * @ampdu_delimiter_crc: A-MPDU delimiter CRC
+ * @vendor_radiotap_bitmap: radiotap vendor namespace presence bitmap
+ * @vendor_radiotap_len: radiotap vendor namespace length
+ * @vendor_radiotap_align: radiotap vendor namespace alignment. Note
+ *      that the actual data must be at the start of the SKB data
+ *      already.
+ * @vendor_radiotap_oui: radiotap vendor namespace OUI
+ * @vendor_radiotap_subns: radiotap vendor sub namespace
 */
 struct ieee80211_rx_status {
        u64 mactime;
        u32 device_timestamp;
        u32 ampdu_reference;
        u32 flag;
+        u32 vendor_radiotap_bitmap;
+        u16 vendor_radiotap_len;
        u16 freq;
        u8 rate_idx;
+        u8 vht_nss;
        u8 rx_flags;
        u8 band;
        u8 antenna;
        s8 signal;
        u8 ampdu_delimiter_crc;
+        u8 vendor_radiotap_align;
+        u8 vendor_radiotap_oui[3];
+        u8 vendor_radiotap_subns;
 };
 /**
@@ -794,6 +895,8 @@ enum ieee80211_conf_flags {
 * @IEEE80211_CONF_CHANGE_RETRY_LIMITS: retry limits changed
 * @IEEE80211_CONF_CHANGE_IDLE: Idle flag changed
 * @IEEE80211_CONF_CHANGE_SMPS: Spatial multiplexing powersave mode changed
+ *      Note that this is only valid if channel contexts are not used,
+ *      otherwise each channel context has the number of chains listed.
 */
 enum ieee80211_conf_changed {
        IEEE80211_CONF_CHANGE_SMPS              = BIT(1),
@@ -845,7 +948,8 @@ enum ieee80211_smps_mode {
 *      powersave documentation below. This variable is valid only when
 *      the CONF_PS flag is set.
 *
- * @power_level: requested transmit power (in dBm)
+ * @power_level: requested transmit power (in dBm), backward compatibility
+ *      value only that is set to the minimum of all interfaces
 *
 * @channel: the channel to tune to
 * @channel_type: the channel (HT) type
@@ -859,7 +963,9 @@ enum ieee80211_smps_mode {
 *
 * @smps_mode: spatial multiplexing powersave mode; note that
 *      %IEEE80211_SMPS_STATIC is used when the device is not
- *      configured for an HT channel
+ *      configured for an HT channel.
+ *      Note that this is only valid if channel contexts are not used,
+ *      otherwise each channel context has the number of chains listed.
 */
 struct ieee80211_conf {
        u32 flags;
@@ -931,6 +1037,11 @@ enum ieee80211_vif_flags {
 *      at runtime, mac80211 will never touch this field
 * @hw_queue: hardware queue for each AC
 * @cab_queue: content-after-beacon (DTIM beacon really) queue, AP mode only
+ * @chanctx_conf: The channel context this interface is assigned to, or %NULL
+ *      when it is not assigned. This pointer is RCU-protected due to the TX
+ *      path needing to access it; even though the netdev carrier will always
+ *      be off when it is %NULL there can still be races and packets could be
+ *      processed after it switches back to %NULL.
 * @drv_priv: data area for driver use, will always be aligned to
 *      sizeof(void *).
 */
@@ -943,6 +1054,8 @@ struct ieee80211_vif {
        u8 cab_queue;
        u8 hw_queue[IEEE80211_NUM_ACS];
+        struct ieee80211_chanctx_conf __rcu *chanctx_conf;
        u32 driver_flags;
        /* must be last */
@@ -1076,6 +1189,8 @@ enum ieee80211_sta_state {
 * @aid: AID we assigned to the station if we're an AP
 * @supp_rates: Bitmap of supported rates (per band)
 * @ht_cap: HT capabilities of this STA; restricted to our own TX capabilities
+ * @vht_cap: VHT capabilities of this STA; Not restricting any capabilities
+ *      of remote STA. Taking as is.
 * @wme: indicates whether the STA supports WME. Only valid during AP-mode.
 * @drv_priv: data area for driver use, will always be aligned to
 *      sizeof(void *), size is determined in hw information.
@@ -1088,6 +1203,7 @@ struct ieee80211_sta {
        u8 addr[ETH_ALEN];
        u16 aid;
        struct ieee80211_sta_ht_cap ht_cap;
+        struct ieee80211_sta_vht_cap vht_cap;
        bool wme;
        u8 uapsd_queues;
        u8 max_sp;
@@ -1325,6 +1441,8 @@ enum ieee80211_hw_flags {
 *      within &struct ieee80211_vif.
 * @sta_data_size: size (in bytes) of the drv_priv data area
 *      within &struct ieee80211_sta.
+ * @chanctx_data_size: size (in bytes) of the drv_priv data area
+ *      within &struct ieee80211_chanctx_conf.
 *
 * @max_rates: maximum number of alternate rate retry stages the hw
 *      can handle.
@@ -1369,6 +1487,7 @@ struct ieee80211_hw {
        int channel_change_time;
        int vif_data_size;
        int sta_data_size;
+        int chanctx_data_size;
        int napi_weight;
        u16 queues;
        u16 max_listen_interval;
@@ -2126,6 +2245,14 @@ enum ieee80211_rate_control_changed {
 * @sta_remove: Notifies low level driver about removal of an associated
 *      station, AP, IBSS/WDS/mesh peer etc. This callback can sleep.
 *
+ * @sta_add_debugfs: Drivers can use this callback to add debugfs files
+ *      when a station is added to mac80211's station list. This callback
+ *      and @sta_remove_debugfs should be within a CONFIG_MAC80211_DEBUGFS
+ *      conditional. This callback can sleep.
+ *
+ * @sta_remove_debugfs: Remove the debugfs files which were added using
+ *      @sta_add_debugfs. This callback can sleep.
+ *
 * @sta_notify: Notifies low level driver about power state transition of an
 *      associated station, AP,  IBSS/WDS/mesh peer etc. For a VIF operating
 *      in AP mode, this callback will not be called when the flag
@@ -2317,6 +2444,27 @@ enum ieee80211_rate_control_changed {
 *      The callback will be called before each transmission and upon return
 *      mac80211 will transmit the frame right away.
 *      The callback is optional and can (should!) sleep.
+ *
+ * @add_chanctx: Notifies device driver about new channel context creation.
+ * @remove_chanctx: Notifies device driver about channel context destruction.
+ * @change_chanctx: Notifies device driver about channel context changes that
+ *      may happen when combining different virtual interfaces on the same
+ *      channel context with different settings
+ * @assign_vif_chanctx: Notifies device driver about channel context being bound
+ *      to vif. Possible use is for hw queue remapping.
+ * @unassign_vif_chanctx: Notifies device driver about channel context being
+ *      unbound from vif.
+ * @start_ap: Start operation on the AP interface, this is called after all the
+ *      information in bss_conf is set and beacon can be retrieved. A channel
+ *      context is bound before this is called. Note that if the driver uses
+ *      software scan or ROC, this (and @stop_ap) isn't called when the AP is
+ *      just "paused" for scanning/ROC, which is indicated by the beacon being
+ *      disabled/enabled via @bss_info_changed.
+ * @stop_ap: Stop operation on the AP interface.
+ *
+ * @restart_complete: Called after a call to ieee80211_restart_hw(), when the
+ *      reconfiguration has completed. This can help the driver implement the
+ *      reconfiguration step. This callback may sleep.
 */
 struct ieee80211_ops {
        void (*tx)(struct ieee80211_hw *hw,
@@ -2342,6 +2490,9 @@ struct ieee80211_ops {
                                 struct ieee80211_bss_conf *info,
                                 u32 changed);
+        int (*start_ap)(struct ieee80211_hw *hw, struct ieee80211_vif *vif);
+        void (*stop_ap)(struct ieee80211_hw *hw, struct ieee80211_vif *vif);
        u64 (*prepare_multicast)(struct ieee80211_hw *hw,
                                 struct netdev_hw_addr_list *mc_list);
        void (*configure_filter)(struct ieee80211_hw *hw,
@@ -2383,6 +2534,16 @@ struct ieee80211_ops {
                       struct ieee80211_sta *sta);
        int (*sta_remove)(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
                          struct ieee80211_sta *sta);
+#ifdef CONFIG_MAC80211_DEBUGFS
+        void (*sta_add_debugfs)(struct ieee80211_hw *hw,
+                                struct ieee80211_vif *vif,
+                                struct ieee80211_sta *sta,
+                                struct dentry *dir);
+        void (*sta_remove_debugfs)(struct ieee80211_hw *hw,
+                                   struct ieee80211_vif *vif,
+                                   struct ieee80211_sta *sta,
+                                   struct dentry *dir);
+#endif
        void (*sta_notify)(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
                        enum sta_notify_cmd, struct ieee80211_sta *sta);
        int (*sta_state)(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
@@ -2424,8 +2585,8 @@ struct ieee80211_ops {
        int (*get_antenna)(struct ieee80211_hw *hw, u32 *tx_ant, u32 *rx_ant);
        int (*remain_on_channel)(struct ieee80211_hw *hw,
+                                 struct ieee80211_vif *vif,
                                 struct ieee80211_channel *chan,
-                                 enum nl80211_channel_type channel_type,
                                 int duration);
        int (*cancel_remain_on_channel)(struct ieee80211_hw *hw);
        int (*set_ringparam)(struct ieee80211_hw *hw, u32 tx, u32 rx);
@@ -2461,6 +2622,22 @@ struct ieee80211_ops {
        void    (*mgd_prepare_tx)(struct ieee80211_hw *hw,
                                  struct ieee80211_vif *vif);
+        int (*add_chanctx)(struct ieee80211_hw *hw,
+                           struct ieee80211_chanctx_conf *ctx);
+        void (*remove_chanctx)(struct ieee80211_hw *hw,
+                               struct ieee80211_chanctx_conf *ctx);
+        void (*change_chanctx)(struct ieee80211_hw *hw,
+                               struct ieee80211_chanctx_conf *ctx,
+                               u32 changed);
+        int (*assign_vif_chanctx)(struct ieee80211_hw *hw,
+                                  struct ieee80211_vif *vif,
+                                  struct ieee80211_chanctx_conf *ctx);
+        void (*unassign_vif_chanctx)(struct ieee80211_hw *hw,
+                                     struct ieee80211_vif *vif,
+                                     struct ieee80211_chanctx_conf *ctx);
+        void (*restart_complete)(struct ieee80211_hw *hw);
 };
 /**
@@ -3145,6 +3322,19 @@ void ieee80211_get_tkip_p2k(struct ieee80211_key_conf *keyconf,
                            struct sk_buff *skb, u8 *p2k);
 /**
+ * ieee80211_aes_cmac_calculate_k1_k2 - calculate the AES-CMAC sub keys
+ *
+ * This function computes the two AES-CMAC sub-keys, based on the
+ * previously installed master key.
+ *
+ * @keyconf: the parameter passed with the set key
+ * @k1: a buffer to be filled with the 1st sub-key
+ * @k2: a buffer to be filled with the 2nd sub-key
+ */
+void ieee80211_aes_cmac_calculate_k1_k2(struct ieee80211_key_conf *keyconf,
+                                        u8 *k1, u8 *k2);
+/**
 * struct ieee80211_key_seq - key sequence counter
 *
 * @tkip: TKIP data, containing IV32 and IV16 in host byte order
@@ -3294,6 +3484,21 @@ void ieee80211_sched_scan_results(struct ieee80211_hw *hw);
 void ieee80211_sched_scan_stopped(struct ieee80211_hw *hw);
 /**
+ * enum ieee80211_interface_iteration_flags - interface iteration flags
+ * @IEEE80211_IFACE_ITER_NORMAL: Iterate over all interfaces that have
+ *      been added to the driver; However, note that during hardware
+ *      reconfiguration (after restart_hw) it will iterate over a new
+ *      interface and over all the existing interfaces even if they
+ *      haven't been re-added to the driver yet.
+ * @IEEE80211_IFACE_ITER_RESUME_ALL: During resume, iterate over all
+ *      interfaces, even if they haven't been re-added to the driver yet.
+ */
+enum ieee80211_interface_iteration_flags {
+        IEEE80211_IFACE_ITER_NORMAL     = 0,
+        IEEE80211_IFACE_ITER_RESUME_ALL = BIT(0),
+};
+/**
 * ieee80211_iterate_active_interfaces - iterate active interfaces
 *
 * This function iterates over the interfaces associated with a given
@@ -3301,13 +3506,15 @@ void ieee80211_sched_scan_stopped(struct ieee80211_hw *hw);
 * This function allows the iterator function to sleep, when the iterator
 * function is atomic @ieee80211_iterate_active_interfaces_atomic can
 * be used.
- * Does not iterate over a new interface during add_interface()
+ * Does not iterate over a new interface during add_interface().
 *
 * @hw: the hardware struct of which the interfaces should be iterated over
+ * @iter_flags: iteration flags, see &enum ieee80211_interface_iteration_flags
 * @iterator: the iterator function to call
 * @data: first argument of the iterator function
 */
 void ieee80211_iterate_active_interfaces(struct ieee80211_hw *hw,
+                                         u32 iter_flags,
                                         void (*iterator)(void *data, u8 *mac,
                                                struct ieee80211_vif *vif),
                                         void *data);
@@ -3319,13 +3526,15 @@ void ieee80211_iterate_active_interfaces(struct ieee80211_hw *hw,
 * hardware that are currently active and calls the callback for them.
 * This function requires the iterator callback function to be atomic,
 * if that is not desired, use @ieee80211_iterate_active_interfaces instead.
- * Does not iterate over a new interface during add_interface()
+ * Does not iterate over a new interface during add_interface().
 *
 * @hw: the hardware struct of which the interfaces should be iterated over
+ * @iter_flags: iteration flags, see &enum ieee80211_interface_iteration_flags
 * @iterator: the iterator function to call, cannot sleep
 * @data: first argument of the iterator function
 */
 void ieee80211_iterate_active_interfaces_atomic(struct ieee80211_hw *hw,
+                                                u32 iter_flags,
                                                void (*iterator)(void *data,
                                                    u8 *mac,
                                                    struct ieee80211_vif *vif),
@@ -3524,6 +3733,27 @@ void ieee80211_iter_keys(struct ieee80211_hw *hw,
                         void *iter_data);
 /**
+ * ieee80211_iter_chan_contexts_atomic - iterate channel contexts
+ * @hw: pointre obtained from ieee80211_alloc_hw().
+ * @iter: iterator function
+ * @iter_data: data passed to iterator function
+ *
+ * Iterate all active channel contexts. This function is atomic and
+ * doesn't acquire any locks internally that might be held in other
+ * places while calling into the driver.
+ *
+ * The iterator will not find a context that's being added (during
+ * the driver callback to add it) but will find it while it's being
+ * removed.
+ */
+void ieee80211_iter_chan_contexts_atomic(
+        struct ieee80211_hw *hw,
+        void (*iter)(struct ieee80211_hw *hw,
+                     struct ieee80211_chanctx_conf *chanctx_conf,
+                     void *data),
+        void *iter_data);
+/**
 * ieee80211_ap_probereq_get - retrieve a Probe Request template
 * @hw: pointer obtained from ieee80211_alloc_hw().
 * @vif: &struct ieee80211_vif pointer from the add_interface callback.
diff --git a/include/net/net_namespace.h b/include/net/net_namespace.h
index 95e646641184..c5a43f56b796 100644
--- a/include/net/net_namespace.h
+++ b/include/net/net_namespace.h
@@ -23,6 +23,7 @@
 #endif
 #include <net/netns/xfrm.h>
+struct user_namespace;
 struct proc_dir_entry;
 struct net_device;
 struct sock;
@@ -53,6 +54,8 @@ struct net {
        struct list_head        cleanup_list;   /* namespaces on death row */
        struct list_head        exit_list;      /* Use only net_mutex */
+        struct user_namespace   *user_ns;       /* Owning user namespace */
        struct proc_dir_entry   *proc_net;
        struct proc_dir_entry   *proc_net_stat;
@@ -126,16 +129,21 @@ struct net {
 /* Init's network namespace */
 extern struct net init_net;
-#ifdef CONFIG_NET
+#ifdef CONFIG_NET_NS
-extern struct net *copy_net_ns(unsigned long flags, struct net *net_ns);
+extern struct net *copy_net_ns(unsigned long flags,
+        struct user_namespace *user_ns, struct net *old_net);
-#else /* CONFIG_NET */
-static inline struct net *copy_net_ns(unsigned long flags, struct net *net_ns)
+#else /* CONFIG_NET_NS */
+#include <linux/sched.h>
+#include <linux/nsproxy.h>
+static inline struct net *copy_net_ns(unsigned long flags,
+        struct user_namespace *user_ns, struct net *old_net)
 {
-        /* There is nothing to copy so this is a noop */
+        if (flags & CLONE_NEWNET)
-        return net_ns;
+                return ERR_PTR(-EINVAL);
+        return old_net;
 }
-#endif /* CONFIG_NET */
+#endif /* CONFIG_NET_NS */
 extern struct list_head net_namespace_list;
diff --git a/include/net/netns/sctp.h b/include/net/netns/sctp.h
index 5e5eb1f9f14b..3573a81815ad 100644
--- a/include/net/netns/sctp.h
+++ b/include/net/netns/sctp.h
@@ -62,6 +62,9 @@ struct netns_sctp {
        /* Whether Cookie Preservative is enabled(1) or not(0) */
        int cookie_preserve_enable;
+        /* The namespace default hmac alg */
+        char *sctp_hmac_alg;
        /* Valid.Cookie.Life        - 60  seconds  */
        unsigned int valid_cookie_life;
diff --git a/include/net/nfc/hci.h b/include/net/nfc/hci.h
index e900072950cb..671953e11575 100644
--- a/include/net/nfc/hci.h
+++ b/include/net/nfc/hci.h
@@ -24,6 +24,12 @@
 #include <net/nfc/nfc.h>
+struct nfc_phy_ops {
+        int (*write)(void *dev_id, struct sk_buff *skb);
+        int (*enable)(void *dev_id);
+        void (*disable)(void *dev_id);
+};
 struct nfc_hci_dev;
 struct nfc_hci_ops {
@@ -38,15 +44,21 @@ struct nfc_hci_ops {
        int (*xmit) (struct nfc_hci_dev *hdev, struct sk_buff *skb);
        int (*start_poll) (struct nfc_hci_dev *hdev,
                           u32 im_protocols, u32 tm_protocols);
+        int (*dep_link_up)(struct nfc_hci_dev *hdev, struct nfc_target *target,
+                           u8 comm_mode, u8 *gb, size_t gb_len);
+        int (*dep_link_down)(struct nfc_hci_dev *hdev);
        int (*target_from_gate) (struct nfc_hci_dev *hdev, u8 gate,
                                 struct nfc_target *target);
        int (*complete_target_discovered) (struct nfc_hci_dev *hdev, u8 gate,
                                           struct nfc_target *target);
-        int (*data_exchange) (struct nfc_hci_dev *hdev,
+        int (*im_transceive) (struct nfc_hci_dev *hdev,
                              struct nfc_target *target, struct sk_buff *skb,
                              data_exchange_cb_t cb, void *cb_context);
+        int (*tm_send)(struct nfc_hci_dev *hdev, struct sk_buff *skb);
        int (*check_presence)(struct nfc_hci_dev *hdev,
                              struct nfc_target *target);
+        void (*event_received)(struct nfc_hci_dev *hdev, u8 gate, u8 event,
+                                struct sk_buff *skb);
 };
 /* Pipes */
@@ -114,6 +126,9 @@ struct nfc_hci_dev {
        int async_cb_type;
        data_exchange_cb_t async_cb;
        void *async_cb_context;
+        u8 *gb;
+        size_t gb_len;
 };
 /* hci device allocation */
@@ -134,6 +149,8 @@ void *nfc_hci_get_clientdata(struct nfc_hci_dev *hdev);
 void nfc_hci_driver_failure(struct nfc_hci_dev *hdev, int err);
+int nfc_hci_result_to_errno(u8 result);
 /* Host IDs */
 #define NFC_HCI_HOST_CONTROLLER_ID      0x00
 #define NFC_HCI_TERMINAL_HOST_ID        0x01
@@ -219,5 +236,7 @@ int nfc_hci_send_response(struct nfc_hci_dev *hdev, u8 gate, u8 response,
                          const u8 *param, size_t param_len);
 int nfc_hci_send_event(struct nfc_hci_dev *hdev, u8 gate, u8 event,
                       const u8 *param, size_t param_len);
+int nfc_hci_target_discovered(struct nfc_hci_dev *hdev, u8 gate);
+u32 nfc_hci_sak_to_protocol(u8 sak);
 #endif /* __NET_HCI_H */
diff --git a/include/net/nfc/nfc.h b/include/net/nfc/nfc.h
index f05b10682c9d..fce80b2f9be7 100644
--- a/include/net/nfc/nfc.h
+++ b/include/net/nfc/nfc.h
@@ -95,7 +95,7 @@ struct nfc_genl_data {
 };
 struct nfc_dev {
-        unsigned int idx;
+        int idx;
        u32 target_next_idx;
        struct nfc_target *targets;
        int n_targets;
diff --git a/include/net/protocol.h b/include/net/protocol.h
index 929528c73fe8..047c0476c0a0 100644
--- a/include/net/protocol.h
+++ b/include/net/protocol.h
@@ -25,9 +25,11 @@
 #define _PROTOCOL_H
 #include <linux/in6.h>
+#include <linux/skbuff.h>
 #if IS_ENABLED(CONFIG_IPV6)
 #include <linux/ipv6.h>
 #endif
+#include <linux/netdevice.h>
 /* This is one larger than the largest protocol value that can be
 * found in an ipv4 or ipv6 header.  Since in both cases the protocol
@@ -40,12 +42,6 @@ struct net_protocol {
        void                    (*early_demux)(struct sk_buff *skb);
        int                     (*handler)(struct sk_buff *skb);
        void                    (*err_handler)(struct sk_buff *skb, u32 info);
-        int                     (*gso_send_check)(struct sk_buff *skb);
-        struct sk_buff         *(*gso_segment)(struct sk_buff *skb,
-                                               netdev_features_t features);
-        struct sk_buff        **(*gro_receive)(struct sk_buff **head,
-                                               struct sk_buff *skb);
-        int                     (*gro_complete)(struct sk_buff *skb);
        unsigned int            no_policy:1,
                                netns_ok:1;
 };
@@ -60,23 +56,20 @@ struct inet6_protocol {
                               struct inet6_skb_parm *opt,
                               u8 type, u8 code, int offset,
                               __be32 info);
-        int     (*gso_send_check)(struct sk_buff *skb);
-        struct sk_buff *(*gso_segment)(struct sk_buff *skb,
-                                       netdev_features_t features);
-        struct sk_buff **(*gro_receive)(struct sk_buff **head,
-                                        struct sk_buff *skb);
-        int     (*gro_complete)(struct sk_buff *skb);
        unsigned int    flags;  /* INET6_PROTO_xxx */
 };
 #define INET6_PROTO_NOPOLICY    0x1
 #define INET6_PROTO_FINAL       0x2
-/* This should be set for any extension header which is compatible with GSO. */
-#define INET6_PROTO_GSO_EXTHDR  0x4
 #endif
+struct net_offload {
+        struct offload_callbacks callbacks;
+        unsigned int             flags; /* Flags used by IPv6 for now */
+};
+/* This should be set for any extension header which is compatible with GSO. */
+#define INET6_PROTO_GSO_EXTHDR  0x1
 /* This is used to register socket interfaces for IP protocols.  */
 struct inet_protosw {
        struct list_head list;
@@ -96,6 +89,8 @@ struct inet_protosw {
 #define INET_PROTOSW_ICSK      0x04  /* Is this an inet_connection_sock? */
 extern const struct net_protocol __rcu *inet_protos[MAX_INET_PROTOS];
+extern const struct net_offload __rcu *inet_offloads[MAX_INET_PROTOS];
+extern const struct net_offload __rcu *inet6_offloads[MAX_INET_PROTOS];
 #if IS_ENABLED(CONFIG_IPV6)
 extern const struct inet6_protocol __rcu *inet6_protos[MAX_INET_PROTOS];
@@ -103,6 +98,8 @@ extern const struct inet6_protocol __rcu *inet6_protos[MAX_INET_PROTOS];
 extern int      inet_add_protocol(const struct net_protocol *prot, unsigned char num);
 extern int      inet_del_protocol(const struct net_protocol *prot, unsigned char num);
+extern int      inet_add_offload(const struct net_offload *prot, unsigned char num);
+extern int      inet_del_offload(const struct net_offload *prot, unsigned char num);
 extern void     inet_register_protosw(struct inet_protosw *p);
 extern void     inet_unregister_protosw(struct inet_protosw *p);
@@ -112,5 +109,7 @@ extern int	inet6_del_protocol(const struct inet6_protocol *prot, unsigned char n
 extern int      inet6_register_protosw(struct inet_protosw *p);
 extern void     inet6_unregister_protosw(struct inet_protosw *p);
 #endif
+extern int      inet6_add_offload(const struct net_offload *prot, unsigned char num);
+extern int      inet6_del_offload(const struct net_offload *prot, unsigned char num);
 #endif  /* _PROTOCOL_H */
diff --git a/include/net/request_sock.h b/include/net/request_sock.h
index b01d8dd9ee7c..a51dbd17c2de 100644
--- a/include/net/request_sock.h
+++ b/include/net/request_sock.h
@@ -49,13 +49,16 @@ struct request_sock_ops {
                                           struct request_sock *req);
 };
+extern int inet_rtx_syn_ack(struct sock *parent, struct request_sock *req);
 /* struct request_sock - mini sock to represent a connection request
 */
 struct request_sock {
        struct request_sock             *dl_next; /* Must be first member! */
        u16                             mss;
-        u8                              retrans;
+        u8                              num_retrans; /* number of retransmits */
-        u8                              cookie_ts; /* syncookie: encode tcpopts in timestamp */
+        u8                              cookie_ts:1; /* syncookie: encode tcpopts in timestamp */
+        u8                              num_timeout:7; /* number of timeouts */
        /* The following two fields can be easily recomputed I think -AK */
        u32                             window_clamp; /* window clamp at creation time */
        u32                             rcv_wnd;          /* rcv_wnd offered first time */
@@ -231,7 +234,7 @@ static inline int reqsk_queue_removed(struct request_sock_queue *queue,
 {
        struct listen_sock *lopt = queue->listen_opt;
-        if (req->retrans == 0)
+        if (req->num_timeout == 0)
                --lopt->qlen_young;
        return --lopt->qlen;
@@ -269,7 +272,8 @@ static inline void reqsk_queue_hash_req(struct request_sock_queue *queue,
        struct listen_sock *lopt = queue->listen_opt;
        req->expires = jiffies + timeout;
-        req->retrans = 0;
+        req->num_retrans = 0;
+        req->num_timeout = 0;
        req->sk = NULL;
        req->dl_next = lopt->syn_table[hash];
diff --git a/include/net/route.h b/include/net/route.h
index bc40b633a5c4..2ea40c1b5e00 100644
--- a/include/net/route.h
+++ b/include/net/route.h
@@ -198,10 +198,13 @@ struct in_ifaddr;
 extern void fib_add_ifaddr(struct in_ifaddr *);
 extern void fib_del_ifaddr(struct in_ifaddr *, struct in_ifaddr *);
-static inline void ip_rt_put(struct rtable * rt)
+static inline void ip_rt_put(struct rtable *rt)
 {
-        if (rt)
+        /* dst_release() accepts a NULL parameter.
-                dst_release(&rt->dst);
+         * We rely on dst being first structure in struct rtable
+         */
+        BUILD_BUG_ON(offsetof(struct rtable, dst) != 0);
+        dst_release(&rt->dst);
 }
 #define IPTOS_RT_MASK   (IPTOS_TOS_MASK & ~3)
diff --git a/include/net/sctp/command.h b/include/net/sctp/command.h
index 712b3bebeda7..35247271e557 100644
--- a/include/net/sctp/command.h
+++ b/include/net/sctp/command.h
@@ -130,8 +130,6 @@ typedef union {
        __be16 err;
        sctp_state_t state;
        sctp_event_timeout_t to;
-        unsigned long zero;
-        void *ptr;
        struct sctp_chunk *chunk;
        struct sctp_association *asoc;
        struct sctp_transport *transport;
@@ -154,23 +152,15 @@ typedef union {
 * which takes an __s32 and returns a sctp_arg_t containing the
 * __s32.  So, after foo = SCTP_I32(arg), foo.i32 == arg.
 */
-static inline sctp_arg_t SCTP_NULL(void)
-{
-        sctp_arg_t retval; retval.ptr = NULL; return retval;
-}
-static inline sctp_arg_t SCTP_NOFORCE(void)
-{
-        sctp_arg_t retval = {.zero = 0UL}; retval.i32 = 0; return retval;
-}
-static inline sctp_arg_t SCTP_FORCE(void)
-{
-        sctp_arg_t retval = {.zero = 0UL}; retval.i32 = 1; return retval;
-}
 #define SCTP_ARG_CONSTRUCTOR(name, type, elt) \
 static inline sctp_arg_t        \
 SCTP_## name (type arg)         \
-{ sctp_arg_t retval = {.zero = 0UL}; retval.elt = arg; return retval; }
+{ sctp_arg_t retval;\
+  memset(&retval, 0, sizeof(sctp_arg_t));\
+  retval.elt = arg;\
+  return retval;\
+}
 SCTP_ARG_CONSTRUCTOR(I32,       __s32, i32)
 SCTP_ARG_CONSTRUCTOR(U32,       __u32, u32)
@@ -181,7 +171,6 @@ SCTP_ARG_CONSTRUCTOR(ERROR,     int, error)
 SCTP_ARG_CONSTRUCTOR(PERR,      __be16, err)    /* protocol error */
 SCTP_ARG_CONSTRUCTOR(STATE,     sctp_state_t, state)
 SCTP_ARG_CONSTRUCTOR(TO,        sctp_event_timeout_t, to)
-SCTP_ARG_CONSTRUCTOR(PTR,       void *, ptr)
 SCTP_ARG_CONSTRUCTOR(CHUNK,     struct sctp_chunk *, chunk)
 SCTP_ARG_CONSTRUCTOR(ASOC,      struct sctp_association *, asoc)
 SCTP_ARG_CONSTRUCTOR(TRANSPORT, struct sctp_transport *, transport)
@@ -192,6 +181,23 @@ SCTP_ARG_CONSTRUCTOR(PACKET,	struct sctp_packet *, packet)
 SCTP_ARG_CONSTRUCTOR(SACKH,     sctp_sackhdr_t *, sackh)
 SCTP_ARG_CONSTRUCTOR(DATAMSG,   struct sctp_datamsg *, msg)
+static inline sctp_arg_t SCTP_FORCE(void)
+{
+        return SCTP_I32(1);
+}
+static inline sctp_arg_t SCTP_NOFORCE(void)
+{
+        return SCTP_I32(0);
+}
+static inline sctp_arg_t SCTP_NULL(void)
+{
+        sctp_arg_t retval;
+        memset(&retval, 0, sizeof(sctp_arg_t));
+        return retval;
+}
 typedef struct {
        sctp_arg_t obj;
        sctp_verb_t verb;
diff --git a/include/net/sctp/constants.h b/include/net/sctp/constants.h
index d053d2e99876..c29707d654c0 100644
--- a/include/net/sctp/constants.h
+++ b/include/net/sctp/constants.h
@@ -312,14 +312,6 @@ enum { SCTP_MAX_GABS = 16 };
                                 * functions simpler to write.
                                 */
-#if defined (CONFIG_SCTP_HMAC_MD5)
-#define SCTP_COOKIE_HMAC_ALG "hmac(md5)"
-#elif defined (CONFIG_SCTP_HMAC_SHA1)
-#define SCTP_COOKIE_HMAC_ALG "hmac(sha1)"
-#else
-#define SCTP_COOKIE_HMAC_ALG NULL
-#endif
 /* These return values describe the success or failure of a number of
 * routines which form the lower interface to SCTP_outqueue.
 */
diff --git a/include/net/sctp/sm.h b/include/net/sctp/sm.h
index b5887e1677e4..2a82d1384706 100644
--- a/include/net/sctp/sm.h
+++ b/include/net/sctp/sm.h
@@ -234,6 +234,8 @@ struct sctp_chunk *sctp_make_abort_violation(const struct sctp_association *,
 struct sctp_chunk *sctp_make_violation_paramlen(const struct sctp_association *,
                                   const struct sctp_chunk *,
                                   struct sctp_paramhdr *);
+struct sctp_chunk *sctp_make_violation_max_retrans(const struct sctp_association *,
+                                                   const struct sctp_chunk *);
 struct sctp_chunk *sctp_make_heartbeat(const struct sctp_association *,
                                  const struct sctp_transport *);
 struct sctp_chunk *sctp_make_heartbeat_ack(const struct sctp_association *,
diff --git a/include/net/sctp/structs.h b/include/net/sctp/structs.h
index 64158aa1bb5f..2b2f61dd4036 100644
--- a/include/net/sctp/structs.h
+++ b/include/net/sctp/structs.h
@@ -177,6 +177,7 @@ struct sctp_sock {
        /* Access to HMAC transform. */
        struct crypto_hash *hmac;
+        char *sctp_hmac_alg;
        /* What is our base endpointer? */
        struct sctp_endpoint *ep;
diff --git a/include/net/sctp/ulpqueue.h b/include/net/sctp/ulpqueue.h
index 2e5ee0d8458d..ff1b8ba73ab1 100644
--- a/include/net/sctp/ulpqueue.h
+++ b/include/net/sctp/ulpqueue.h
@@ -72,7 +72,7 @@ int sctp_ulpq_tail_event(struct sctp_ulpq *, struct sctp_ulpevent *ev);
 void sctp_ulpq_renege(struct sctp_ulpq *, struct sctp_chunk *, gfp_t);
 /* Perform partial delivery. */
-void sctp_ulpq_partial_delivery(struct sctp_ulpq *, struct sctp_chunk *, gfp_t);
+void sctp_ulpq_partial_delivery(struct sctp_ulpq *, gfp_t);
 /* Abort the partial delivery. */
 void sctp_ulpq_abort_pd(struct sctp_ulpq *, gfp_t);
diff --git a/include/net/tcp.h b/include/net/tcp.h
index 6feeccd83dd7..3202bde2a741 100644
--- a/include/net/tcp.h
+++ b/include/net/tcp.h
@@ -369,7 +369,6 @@ extern void tcp_shutdown (struct sock *sk, int how);
 extern void tcp_v4_early_demux(struct sk_buff *skb);
 extern int tcp_v4_rcv(struct sk_buff *skb);
-extern struct inet_peer *tcp_v4_get_peer(struct sock *sk);
 extern int tcp_v4_tw_remember_stamp(struct inet_timewait_sock *tw);
 extern int tcp_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
                       size_t size);
diff --git a/include/uapi/asm-generic/socket.h b/include/uapi/asm-generic/socket.h
index b1bea03274d5..2d32d073a6f9 100644
--- a/include/uapi/asm-generic/socket.h
+++ b/include/uapi/asm-generic/socket.h
@@ -43,6 +43,7 @@
 /* Socket filtering */
 #define SO_ATTACH_FILTER        26
 #define SO_DETACH_FILTER        27
+#define SO_GET_FILTER           SO_ATTACH_FILTER
 #define SO_PEERNAME             28
 #define SO_TIMESTAMP            29
diff --git a/include/uapi/linux/filter.h b/include/uapi/linux/filter.h
index 3d7922433aba..9cfde6941099 100644
--- a/include/uapi/linux/filter.h
+++ b/include/uapi/linux/filter.h
@@ -127,7 +127,9 @@ struct sock_fprog {	/* Required for SO_ATTACH_FILTER. */
 #define SKF_AD_RXHASH   32
 #define SKF_AD_CPU      36
 #define SKF_AD_ALU_XOR_X        40
-#define SKF_AD_MAX      44
+#define SKF_AD_VLAN_TAG 44
+#define SKF_AD_VLAN_TAG_PRESENT 48
+#define SKF_AD_MAX      52
 #define SKF_NET_OFF   (-0x100000)
 #define SKF_LL_OFF    (-0x200000)
diff --git a/include/uapi/linux/hdlc/Kbuild b/include/uapi/linux/hdlc/Kbuild
index aafaa5aa54d4..8c1d2cb75e33 100644
--- a/include/uapi/linux/hdlc/Kbuild
+++ b/include/uapi/linux/hdlc/Kbuild
@@ -1 +1,2 @@
 # UAPI Header export list
+header-y += ioctl.h
diff --git a/include/linux/hdlc/ioctl.h b/include/uapi/linux/hdlc/ioctl.h
index 583972364357..04bc0274a189 100644
--- a/include/linux/hdlc/ioctl.h
+++ b/include/uapi/linux/hdlc/ioctl.h
@@ -34,13 +34,15 @@
 #define LMI_CCITT               3 /* ITU-T Annex A */
 #define LMI_CISCO               4 /* The "original" LMI, aka Gang of Four */
-typedef struct { 
+#ifndef __ASSEMBLY__
+typedef struct {
        unsigned int clock_rate; /* bits per second */
        unsigned int clock_type; /* internal, external, TX-internal etc. */
        unsigned short loopback;
 } sync_serial_settings;          /* V.35, V.24, X.21 */
-typedef struct { 
+typedef struct {
        unsigned int clock_rate; /* bits per second */
        unsigned int clock_type; /* internal, external, TX-internal etc. */
        unsigned short loopback;
@@ -78,4 +80,5 @@ typedef struct {
 /* PPP doesn't need any info now - supply length = 0 to ioctl */
+#endif /* __ASSEMBLY__ */
 #endif /* __HDLC_IOCTL_H__ */
diff --git a/include/uapi/linux/if_bridge.h b/include/uapi/linux/if_bridge.h
index a8fe9549ddbc..b3885791e11e 100644
--- a/include/uapi/linux/if_bridge.h
+++ b/include/uapi/linux/if_bridge.h
@@ -97,5 +97,23 @@ struct __fdb_entry {
        __u16 unused;
 };
+/* Bridge Flags */
+#define BRIDGE_FLAGS_MASTER     1       /* Bridge command to/from master */
+#define BRIDGE_FLAGS_SELF       2       /* Bridge command to/from lowerdev */
+#define BRIDGE_MODE_VEB         0       /* Default loopback mode */
+#define BRIDGE_MODE_VEPA        1       /* 802.1Qbg defined VEPA mode */
+/* Bridge management nested attributes
+ * [IFLA_AF_SPEC] = {
+ *     [IFLA_BRIDGE_FLAGS]
+ *     [IFLA_BRIDGE_MODE]
+ * }
+ */
+enum {
+        IFLA_BRIDGE_FLAGS,
+        IFLA_BRIDGE_MODE,
+        __IFLA_BRIDGE_MAX,
+};
+#define IFLA_BRIDGE_MAX (__IFLA_BRIDGE_MAX - 1)
 #endif /* _UAPI_LINUX_IF_BRIDGE_H */
diff --git a/include/uapi/linux/if_ether.h b/include/uapi/linux/if_ether.h
index 0343e1f0582c..67fb87ca1094 100644
--- a/include/uapi/linux/if_ether.h
+++ b/include/uapi/linux/if_ether.h
@@ -48,6 +48,7 @@
 #define ETH_P_BPQ       0x08FF          /* G8BPQ AX.25 Ethernet Packet  [ NOT AN OFFICIALLY REGISTERED ID ] */
 #define ETH_P_IEEEPUP   0x0a00          /* Xerox IEEE802.3 PUP packet */
 #define ETH_P_IEEEPUPAT 0x0a01          /* Xerox IEEE802.3 PUP Addr Trans packet */
+#define ETH_P_BATMAN    0x4305          /* B.A.T.M.A.N.-Advanced packet [ NOT AN OFFICIALLY REGISTERED ID ] */
 #define ETH_P_DEC       0x6000          /* DEC Assigned proto           */
 #define ETH_P_DNA_DL    0x6001          /* DEC DNA Dump/Load            */
 #define ETH_P_DNA_RC    0x6002          /* DEC DNA Remote Console       */
diff --git a/include/uapi/linux/if_link.h b/include/uapi/linux/if_link.h
index 5c80cb11518b..bb58aeb7f34d 100644
--- a/include/uapi/linux/if_link.h
+++ b/include/uapi/linux/if_link.h
@@ -205,6 +205,23 @@ enum {
 #define IFLA_INET6_MAX  (__IFLA_INET6_MAX - 1)
+enum {
+        BRIDGE_MODE_UNSPEC,
+        BRIDGE_MODE_HAIRPIN,
+};
+enum {
+        IFLA_BRPORT_UNSPEC,
+        IFLA_BRPORT_STATE,      /* Spanning tree state     */
+        IFLA_BRPORT_PRIORITY,   /* "             priority  */
+        IFLA_BRPORT_COST,       /* "             cost      */
+        IFLA_BRPORT_MODE,       /* mode (hairpin)          */
+        IFLA_BRPORT_GUARD,      /* bpdu guard              */
+        IFLA_BRPORT_PROTECT,    /* root port protection    */
+        __IFLA_BRPORT_MAX
+};
+#define IFLA_BRPORT_MAX (__IFLA_BRPORT_MAX - 1)
 struct ifla_cacheinfo {
        __u32   max_reasm_len;
        __u32   tstamp;         /* ipv6InterfaceTable updated timestamp */
@@ -285,6 +302,10 @@ enum {
        IFLA_VXLAN_AGEING,
        IFLA_VXLAN_LIMIT,
        IFLA_VXLAN_PORT_RANGE,
+        IFLA_VXLAN_PROXY,
+        IFLA_VXLAN_RSC,
+        IFLA_VXLAN_L2MISS,
+        IFLA_VXLAN_L3MISS,
        __IFLA_VXLAN_MAX
 };
 #define IFLA_VXLAN_MAX  (__IFLA_VXLAN_MAX - 1)
diff --git a/include/uapi/linux/if_packet.h b/include/uapi/linux/if_packet.h
index f3799295d231..f9a60375f0d0 100644
--- a/include/uapi/linux/if_packet.h
+++ b/include/uapi/linux/if_packet.h
@@ -50,6 +50,7 @@ struct sockaddr_ll {
 #define PACKET_TX_TIMESTAMP             16
 #define PACKET_TIMESTAMP                17
 #define PACKET_FANOUT                   18
+#define PACKET_TX_HAS_OFF               19
 #define PACKET_FANOUT_HASH              0
 #define PACKET_FANOUT_LB                1
diff --git a/include/uapi/linux/if_tun.h b/include/uapi/linux/if_tun.h
index 25a585ce23e6..958497ad5bb5 100644
--- a/include/uapi/linux/if_tun.h
+++ b/include/uapi/linux/if_tun.h
@@ -34,6 +34,7 @@
 #define TUN_ONE_QUEUE   0x0080
 #define TUN_PERSIST     0x0100  
 #define TUN_VNET_HDR    0x0200
+#define TUN_TAP_MQ      0x0400
 /* Ioctl defines */
 #define TUNSETNOCSUM  _IOW('T', 200, int) 
@@ -53,6 +54,7 @@
 #define TUNDETACHFILTER _IOW('T', 214, struct sock_fprog)
 #define TUNGETVNETHDRSZ _IOR('T', 215, int)
 #define TUNSETVNETHDRSZ _IOW('T', 216, int)
+#define TUNSETQUEUE  _IOW('T', 217, int)
 /* TUNSETIFF ifr flags */
 #define IFF_TUN         0x0001
@@ -61,6 +63,9 @@
 #define IFF_ONE_QUEUE   0x2000
 #define IFF_VNET_HDR    0x4000
 #define IFF_TUN_EXCL    0x8000
+#define IFF_MULTI_QUEUE 0x0100
+#define IFF_ATTACH_QUEUE 0x0200
+#define IFF_DETACH_QUEUE 0x0400
 /* Features for GSO (TUNSETOFFLOAD). */
 #define TUN_F_CSUM      0x01    /* You can hand me unchecksummed packets. */
diff --git a/include/uapi/linux/if_tunnel.h b/include/uapi/linux/if_tunnel.h
index 5db5942575fe..aee73d0611fb 100644
--- a/include/uapi/linux/if_tunnel.h
+++ b/include/uapi/linux/if_tunnel.h
@@ -37,6 +37,26 @@ struct ip_tunnel_parm {
        struct iphdr            iph;
 };
+enum {
+        IFLA_IPTUN_UNSPEC,
+        IFLA_IPTUN_LINK,
+        IFLA_IPTUN_LOCAL,
+        IFLA_IPTUN_REMOTE,
+        IFLA_IPTUN_TTL,
+        IFLA_IPTUN_TOS,
+        IFLA_IPTUN_ENCAP_LIMIT,
+        IFLA_IPTUN_FLOWINFO,
+        IFLA_IPTUN_FLAGS,
+        IFLA_IPTUN_PROTO,
+        IFLA_IPTUN_PMTUDISC,
+        IFLA_IPTUN_6RD_PREFIX,
+        IFLA_IPTUN_6RD_RELAY_PREFIX,
+        IFLA_IPTUN_6RD_PREFIXLEN,
+        IFLA_IPTUN_6RD_RELAY_PREFIXLEN,
+        __IFLA_IPTUN_MAX,
+};
+#define IFLA_IPTUN_MAX  (__IFLA_IPTUN_MAX - 1)
 /* SIT-mode i_flags */
 #define SIT_ISATAP      0x0001
diff --git a/include/uapi/linux/in6.h b/include/uapi/linux/in6.h
index 1e3159989958..f79c3721da6e 100644
--- a/include/uapi/linux/in6.h
+++ b/include/uapi/linux/in6.h
@@ -240,6 +240,7 @@ struct in6_flowlabel_req {
 *
 * IP6T_SO_GET_REVISION_MATCH   68
 * IP6T_SO_GET_REVISION_TARGET  69
+ * IP6T_SO_ORIGINAL_DST         80
 */
 /* RFC5014: Source address selection */
diff --git a/include/uapi/linux/inet_diag.h b/include/uapi/linux/inet_diag.h
index 8c469af939aa..bbde90fa5838 100644
--- a/include/uapi/linux/inet_diag.h
+++ b/include/uapi/linux/inet_diag.h
@@ -109,9 +109,10 @@ enum {
        INET_DIAG_TOS,
        INET_DIAG_TCLASS,
        INET_DIAG_SKMEMINFO,
+        INET_DIAG_SHUTDOWN,
 };
-#define INET_DIAG_MAX INET_DIAG_SKMEMINFO
+#define INET_DIAG_MAX INET_DIAG_SHUTDOWN
 /* INET_DIAG_MEM */
diff --git a/include/uapi/linux/ipv6.h b/include/uapi/linux/ipv6.h
index a6d7d1c536c3..5a2991cf0251 100644
--- a/include/uapi/linux/ipv6.h
+++ b/include/uapi/linux/ipv6.h
@@ -157,6 +157,7 @@ enum {
        DEVCONF_DISABLE_IPV6,
        DEVCONF_ACCEPT_DAD,
        DEVCONF_FORCE_TLLAO,
+        DEVCONF_NDISC_NOTIFY,
        DEVCONF_MAX
 };
diff --git a/include/uapi/linux/ipv6_route.h b/include/uapi/linux/ipv6_route.h
index 0459664c2636..2be7bd174751 100644
--- a/include/uapi/linux/ipv6_route.h
+++ b/include/uapi/linux/ipv6_route.h
@@ -55,4 +55,7 @@ struct in6_rtmsg {
 #define RTMSG_NEWROUTE          0x21
 #define RTMSG_DELROUTE          0x22
+#define IP6_RT_PRIO_USER        1024
+#define IP6_RT_PRIO_ADDRCONF    256
 #endif /* _UAPI_LINUX_IPV6_ROUTE_H */
diff --git a/include/uapi/linux/netconf.h b/include/uapi/linux/netconf.h
new file mode 100644
index 000000000000..75dcbc587fb5
--- /dev/null
+++ b/include/uapi/linux/netconf.h
@@ -0,0 +1,23 @@
+#ifndef _UAPI_LINUX_NETCONF_H_
+#define _UAPI_LINUX_NETCONF_H_
+#include <linux/types.h>
+#include <linux/netlink.h>
+struct netconfmsg {
+        __u8    ncm_family;
+};
+enum {
+        NETCONFA_UNSPEC,
+        NETCONFA_IFINDEX,
+        NETCONFA_FORWARDING,
+        NETCONFA_RP_FILTER,
+        __NETCONFA_MAX
+};
+#define NETCONFA_MAX    (__NETCONFA_MAX - 1)
+#define NETCONFA_IFINDEX_ALL            -1
+#define NETCONFA_IFINDEX_DEFAULT        -2
+#endif /* _UAPI_LINUX_NETCONF_H_ */
diff --git a/include/uapi/linux/netfilter_ipv6/ip6_tables.h b/include/uapi/linux/netfilter_ipv6/ip6_tables.h
index bf1ef65cc582..649c68062dca 100644
--- a/include/uapi/linux/netfilter_ipv6/ip6_tables.h
+++ b/include/uapi/linux/netfilter_ipv6/ip6_tables.h
@@ -178,6 +178,9 @@ struct ip6t_error {
 #define IP6T_SO_GET_REVISION_TARGET     (IP6T_BASE_CTL + 5)
 #define IP6T_SO_GET_MAX                 IP6T_SO_GET_REVISION_TARGET
+/* obtain original address if REDIRECT'd connection */
+#define IP6T_SO_ORIGINAL_DST            80
 /* ICMP matching stuff */
 struct ip6t_icmp {
        __u8 type;                              /* type to match */
diff --git a/include/uapi/linux/nfc.h b/include/uapi/linux/nfc.h
index d908d17da56d..0e63cee8d810 100644
--- a/include/uapi/linux/nfc.h
+++ b/include/uapi/linux/nfc.h
@@ -60,6 +60,13 @@
 *      target mode.
 * @NFC_EVENT_DEVICE_DEACTIVATED: event emitted when the adapter is deactivated
 *      from target mode.
+ * @NFC_CMD_LLC_GET_PARAMS: request LTO, RW, and MIUX parameters for a device
+ * @NFC_CMD_LLC_SET_PARAMS: set one or more of LTO, RW, and MIUX parameters for
+ *      a device. LTO must be set before the link is up otherwise -EINPROGRESS
+ *      is returned. RW and MIUX can be set at anytime and will be passed in
+ *      subsequent CONNECT and CC messages.
+ *      If one of the passed parameters is wrong none is set and -EINVAL is
+ *      returned.
 */
 enum nfc_commands {
        NFC_CMD_UNSPEC,
@@ -77,6 +84,8 @@ enum nfc_commands {
        NFC_EVENT_TARGET_LOST,
        NFC_EVENT_TM_ACTIVATED,
        NFC_EVENT_TM_DEACTIVATED,
+        NFC_CMD_LLC_GET_PARAMS,
+        NFC_CMD_LLC_SET_PARAMS,
 /* private: internal use only */
        __NFC_CMD_AFTER_LAST
 };
@@ -102,6 +111,9 @@ enum nfc_commands {
 * @NFC_ATTR_RF_MODE: Initiator or target
 * @NFC_ATTR_IM_PROTOCOLS: Initiator mode protocols to poll for
 * @NFC_ATTR_TM_PROTOCOLS: Target mode protocols to listen for
+ * @NFC_ATTR_LLC_PARAM_LTO: Link TimeOut parameter
+ * @NFC_ATTR_LLC_PARAM_RW: Receive Window size parameter
+ * @NFC_ATTR_LLC_PARAM_MIUX: MIU eXtension parameter
 */
 enum nfc_attrs {
        NFC_ATTR_UNSPEC,
@@ -119,6 +131,9 @@ enum nfc_attrs {
        NFC_ATTR_DEVICE_POWERED,
        NFC_ATTR_IM_PROTOCOLS,
        NFC_ATTR_TM_PROTOCOLS,
+        NFC_ATTR_LLC_PARAM_LTO,
+        NFC_ATTR_LLC_PARAM_RW,
+        NFC_ATTR_LLC_PARAM_MIUX,
 /* private: internal use only */
        __NFC_ATTR_AFTER_LAST
 };
diff --git a/include/uapi/linux/nl80211.h b/include/uapi/linux/nl80211.h
index 7df9b500c804..33a417481ad8 100644
--- a/include/uapi/linux/nl80211.h
+++ b/include/uapi/linux/nl80211.h
@@ -118,8 +118,9 @@
 *      to get a list of all present wiphys.
 * @NL80211_CMD_SET_WIPHY: set wiphy parameters, needs %NL80211_ATTR_WIPHY or
 *      %NL80211_ATTR_IFINDEX; can be used to set %NL80211_ATTR_WIPHY_NAME,
- *      %NL80211_ATTR_WIPHY_TXQ_PARAMS, %NL80211_ATTR_WIPHY_FREQ,
+ *      %NL80211_ATTR_WIPHY_TXQ_PARAMS, %NL80211_ATTR_WIPHY_FREQ (and the
- *      %NL80211_ATTR_WIPHY_CHANNEL_TYPE, %NL80211_ATTR_WIPHY_RETRY_SHORT,
+ *      attributes determining the channel width; this is used for setting
+ *      monitor mode channel),  %NL80211_ATTR_WIPHY_RETRY_SHORT,
 *      %NL80211_ATTR_WIPHY_RETRY_LONG, %NL80211_ATTR_WIPHY_FRAG_THRESHOLD,
 *      and/or %NL80211_ATTR_WIPHY_RTS_THRESHOLD.
 *      However, for setting the channel, see %NL80211_CMD_SET_CHANNEL
@@ -171,7 +172,7 @@
 *      %NL80211_ATTR_AKM_SUITES, %NL80211_ATTR_PRIVACY,
 *      %NL80211_ATTR_AUTH_TYPE and %NL80211_ATTR_INACTIVITY_TIMEOUT.
 *      The channel to use can be set on the interface or be given using the
- *      %NL80211_ATTR_WIPHY_FREQ and %NL80211_ATTR_WIPHY_CHANNEL_TYPE attrs.
+ *      %NL80211_ATTR_WIPHY_FREQ and the attributes determining channel width.
 * @NL80211_CMD_NEW_BEACON: old alias for %NL80211_CMD_START_AP
 * @NL80211_CMD_STOP_AP: Stop AP operation on the given interface
 * @NL80211_CMD_DEL_BEACON: old alias for %NL80211_CMD_STOP_AP
@@ -401,8 +402,7 @@
 *      a response while being associated to an AP on another channel.
 *      %NL80211_ATTR_IFINDEX is used to specify which interface (and thus
 *      radio) is used. %NL80211_ATTR_WIPHY_FREQ is used to specify the
- *      frequency for the operation and %NL80211_ATTR_WIPHY_CHANNEL_TYPE may be
+ *      frequency for the operation.
- *      optionally used to specify additional channel parameters.
 *      %NL80211_ATTR_DURATION is used to specify the duration in milliseconds
 *      to remain on the channel. This command is also used as an event to
 *      notify when the requested duration starts (it may take a while for the
@@ -440,12 +440,11 @@
 *      as an event indicating reception of a frame that was not processed in
 *      kernel code, but is for us (i.e., which may need to be processed in a
 *      user space application). %NL80211_ATTR_FRAME is used to specify the
- *      frame contents (including header). %NL80211_ATTR_WIPHY_FREQ (and
+ *      frame contents (including header). %NL80211_ATTR_WIPHY_FREQ is used
- *      optionally %NL80211_ATTR_WIPHY_CHANNEL_TYPE) is used to indicate on
+ *      to indicate on which channel the frame is to be transmitted or was
- *      which channel the frame is to be transmitted or was received. If this
+ *      received. If this channel is not the current channel (remain-on-channel
- *      channel is not the current channel (remain-on-channel or the
+ *      or the operational channel) the device will switch to the given channel
- *      operational channel) the device will switch to the given channel and
+ *      and transmit the frame, optionally waiting for a response for the time
- *      transmit the frame, optionally waiting for a response for the time
 *      specified using %NL80211_ATTR_DURATION. When called, this operation
 *      returns a cookie (%NL80211_ATTR_COOKIE) that will be included with the
 *      TX status event pertaining to the TX request.
@@ -473,8 +472,8 @@
 *      command is used as an event to indicate the that a trigger level was
 *      reached.
 * @NL80211_CMD_SET_CHANNEL: Set the channel (using %NL80211_ATTR_WIPHY_FREQ
- *      and %NL80211_ATTR_WIPHY_CHANNEL_TYPE) the given interface (identifed
+ *      and the attributes determining channel width) the given interface
- *      by %NL80211_ATTR_IFINDEX) shall operate on.
+ *      (identifed by %NL80211_ATTR_IFINDEX) shall operate on.
 *      In case multiple channels are supported by the device, the mechanism
 *      with which it switches channels is implementation-defined.
 *      When a monitor interface is given, it can only switch channel while
@@ -526,6 +525,12 @@
 *      of PMKSA caching dandidates.
 *
 * @NL80211_CMD_TDLS_OPER: Perform a high-level TDLS command (e.g. link setup).
+ *      In addition, this can be used as an event to request userspace to take
+ *      actions on TDLS links (set up a new link or tear down an existing one).
+ *      In such events, %NL80211_ATTR_TDLS_OPERATION indicates the requested
+ *      operation, %NL80211_ATTR_MAC contains the peer MAC address, and
+ *      %NL80211_ATTR_REASON_CODE the reason code to be used (only with
+ *      %NL80211_TDLS_TEARDOWN).
 * @NL80211_CMD_TDLS_MGMT: Send a TDLS management frame.
 *
 * @NL80211_CMD_UNEXPECTED_FRAME: Used by an application controlling an AP
@@ -562,8 +567,8 @@
 *
 * @NL80211_CMD_CH_SWITCH_NOTIFY: An AP or GO may decide to switch channels
 *      independently of the userspace SME, send this event indicating
- *      %NL80211_ATTR_IFINDEX is now on %NL80211_ATTR_WIPHY_FREQ with
+ *      %NL80211_ATTR_IFINDEX is now on %NL80211_ATTR_WIPHY_FREQ and the
- *      %NL80211_ATTR_WIPHY_CHANNEL_TYPE.
+ *      attributes determining channel width.
 *
 * @NL80211_CMD_START_P2P_DEVICE: Start the given P2P Device, identified by
 *      its %NL80211_ATTR_WDEV identifier. It must have been created with
@@ -578,6 +583,9 @@
 *      station, due to particular reason. %NL80211_ATTR_CONN_FAILED_REASON
 *      is used for this.
 *
+ * @NL80211_CMD_SET_MCAST_RATE: Change the rate used to send multicast frames
+ *      for IBSS or MESH vif.
+ *
 * @NL80211_CMD_MAX: highest used command number
 * @__NL80211_CMD_AFTER_LAST: internal use
 */
@@ -726,6 +734,8 @@ enum nl80211_commands {
        NL80211_CMD_CONN_FAILED,
+        NL80211_CMD_SET_MCAST_RATE,
        /* add new commands above here */
        /* used to define NL80211_CMD_MAX below */
@@ -762,14 +772,26 @@ enum nl80211_commands {
 *      /sys/class/ieee80211/<phyname>/index
 * @NL80211_ATTR_WIPHY_NAME: wiphy name (used for renaming)
 * @NL80211_ATTR_WIPHY_TXQ_PARAMS: a nested array of TX queue parameters
- * @NL80211_ATTR_WIPHY_FREQ: frequency of the selected channel in MHz
+ * @NL80211_ATTR_WIPHY_FREQ: frequency of the selected channel in MHz,
+ *      defines the channel together with the (deprecated)
+ *      %NL80211_ATTR_WIPHY_CHANNEL_TYPE attribute or the attributes
+ *      %NL80211_ATTR_CHANNEL_WIDTH and if needed %NL80211_ATTR_CENTER_FREQ1
+ *      and %NL80211_ATTR_CENTER_FREQ2
+ * @NL80211_ATTR_CHANNEL_WIDTH: u32 attribute containing one of the values
+ *      of &enum nl80211_chan_width, describing the channel width. See the
+ *      documentation of the enum for more information.
+ * @NL80211_ATTR_CENTER_FREQ1: Center frequency of the first part of the
+ *      channel, used for anything but 20 MHz bandwidth
+ * @NL80211_ATTR_CENTER_FREQ2: Center frequency of the second part of the
+ *      channel, used only for 80+80 MHz bandwidth
 * @NL80211_ATTR_WIPHY_CHANNEL_TYPE: included with NL80211_ATTR_WIPHY_FREQ
- *      if HT20 or HT40 are allowed (i.e., 802.11n disabled if not included):
+ *      if HT20 or HT40 are to be used (i.e., HT disabled if not included):
 *      NL80211_CHAN_NO_HT = HT not allowed (i.e., same as not including
 *              this attribute)
 *      NL80211_CHAN_HT20 = HT20 only
 *      NL80211_CHAN_HT40MINUS = secondary channel is below the primary channel
 *      NL80211_CHAN_HT40PLUS = secondary channel is above the primary channel
+ *      This attribute is now deprecated.
 * @NL80211_ATTR_WIPHY_RETRY_SHORT: TX retry limit for frames whose length is
 *      less than or equal to the RTS threshold; allowed range: 1..255;
 *      dot11ShortRetryLimit; u8
@@ -1273,6 +1295,14 @@ enum nl80211_commands {
 *      the connection request from a station. nl80211_connect_failed_reason
 *      enum has different reasons of connection failure.
 *
+ * @NL80211_ATTR_SAE_DATA: SAE elements in Authentication frames. This starts
+ *      with the Authentication transaction sequence number field.
+ *
+ * @NL80211_ATTR_VHT_CAPABILITY: VHT Capability information element (from
+ *      association request when used with NL80211_CMD_NEW_STATION)
+ *
+ * @NL80211_ATTR_SCAN_FLAGS: scan request control flags (u32)
+ *
 * @NL80211_ATTR_MAX: highest attribute number currently defined
 * @__NL80211_ATTR_AFTER_LAST: internal use
 */
@@ -1530,6 +1560,16 @@ enum nl80211_attrs {
        NL80211_ATTR_CONN_FAILED_REASON,
+        NL80211_ATTR_SAE_DATA,
+        NL80211_ATTR_VHT_CAPABILITY,
+        NL80211_ATTR_SCAN_FLAGS,
+        NL80211_ATTR_CHANNEL_WIDTH,
+        NL80211_ATTR_CENTER_FREQ1,
+        NL80211_ATTR_CENTER_FREQ2,
        /* add attributes here, update the policy in nl80211.c */
        __NL80211_ATTR_AFTER_LAST,
@@ -1573,6 +1613,7 @@ enum nl80211_attrs {
 #define NL80211_TKIP_DATA_OFFSET_TX_MIC_KEY     16
 #define NL80211_TKIP_DATA_OFFSET_RX_MIC_KEY     24
 #define NL80211_HT_CAPABILITY_LEN               26
+#define NL80211_VHT_CAPABILITY_LEN              12
 #define NL80211_MAX_NR_CIPHER_SUITES            5
 #define NL80211_MAX_NR_AKM_SUITES               2
@@ -1693,10 +1734,15 @@ struct nl80211_sta_flag_update {
 * @__NL80211_RATE_INFO_INVALID: attribute number 0 is reserved
 * @NL80211_RATE_INFO_BITRATE: total bitrate (u16, 100kbit/s)
 * @NL80211_RATE_INFO_MCS: mcs index for 802.11n (u8)
- * @NL80211_RATE_INFO_40_MHZ_WIDTH: 40 Mhz dualchannel bitrate
+ * @NL80211_RATE_INFO_40_MHZ_WIDTH: 40 MHz dualchannel bitrate
 * @NL80211_RATE_INFO_SHORT_GI: 400ns guard interval
 * @NL80211_RATE_INFO_BITRATE32: total bitrate (u32, 100kbit/s)
 * @NL80211_RATE_INFO_MAX: highest rate_info number currently defined
+ * @NL80211_RATE_INFO_VHT_MCS: MCS index for VHT (u8)
+ * @NL80211_RATE_INFO_VHT_NSS: number of streams in VHT (u8)
+ * @NL80211_RATE_INFO_80_MHZ_WIDTH: 80 MHz VHT rate
+ * @NL80211_RATE_INFO_80P80_MHZ_WIDTH: 80+80 MHz VHT rate
+ * @NL80211_RATE_INFO_160_MHZ_WIDTH: 160 MHz VHT rate
 * @__NL80211_RATE_INFO_AFTER_LAST: internal use
 */
 enum nl80211_rate_info {
@@ -1706,6 +1752,11 @@ enum nl80211_rate_info {
        NL80211_RATE_INFO_40_MHZ_WIDTH,
        NL80211_RATE_INFO_SHORT_GI,
        NL80211_RATE_INFO_BITRATE32,
+        NL80211_RATE_INFO_VHT_MCS,
+        NL80211_RATE_INFO_VHT_NSS,
+        NL80211_RATE_INFO_80_MHZ_WIDTH,
+        NL80211_RATE_INFO_80P80_MHZ_WIDTH,
+        NL80211_RATE_INFO_160_MHZ_WIDTH,
        /* keep last */
        __NL80211_RATE_INFO_AFTER_LAST,
@@ -2414,6 +2465,15 @@ enum nl80211_ac {
 #define NL80211_TXQ_Q_BE        NL80211_AC_BE
 #define NL80211_TXQ_Q_BK        NL80211_AC_BK
+/**
+ * enum nl80211_channel_type - channel type
+ * @NL80211_CHAN_NO_HT: 20 MHz, non-HT channel
+ * @NL80211_CHAN_HT20: 20 MHz HT channel
+ * @NL80211_CHAN_HT40MINUS: HT40 channel, secondary channel
+ *      below the control channel
+ * @NL80211_CHAN_HT40PLUS: HT40 channel, secondary channel
+ *      above the control channel
+ */
 enum nl80211_channel_type {
        NL80211_CHAN_NO_HT,
        NL80211_CHAN_HT20,
@@ -2422,6 +2482,32 @@ enum nl80211_channel_type {
 };
 /**
+ * enum nl80211_chan_width - channel width definitions
+ *
+ * These values are used with the %NL80211_ATTR_CHANNEL_WIDTH
+ * attribute.
+ *
+ * @NL80211_CHAN_WIDTH_20_NOHT: 20 MHz, non-HT channel
+ * @NL80211_CHAN_WIDTH_20: 20 MHz HT channel
+ * @NL80211_CHAN_WIDTH_40: 40 MHz channel, the %NL80211_ATTR_CENTER_FREQ1
+ *      attribute must be provided as well
+ * @NL80211_CHAN_WIDTH_80: 80 MHz channel, the %NL80211_ATTR_CENTER_FREQ1
+ *      attribute must be provided as well
+ * @NL80211_CHAN_WIDTH_80P80: 80+80 MHz channel, the %NL80211_ATTR_CENTER_FREQ1
+ *      and %NL80211_ATTR_CENTER_FREQ2 attributes must be provided as well
+ * @NL80211_CHAN_WIDTH_160: 160 MHz channel, the %NL80211_ATTR_CENTER_FREQ1
+ *      attribute must be provided as well
+ */
+enum nl80211_chan_width {
+        NL80211_CHAN_WIDTH_20_NOHT,
+        NL80211_CHAN_WIDTH_20,
+        NL80211_CHAN_WIDTH_40,
+        NL80211_CHAN_WIDTH_80,
+        NL80211_CHAN_WIDTH_80P80,
+        NL80211_CHAN_WIDTH_160,
+};
+/**
 * enum nl80211_bss - netlink attributes for a BSS
 *
 * @__NL80211_BSS_INVALID: invalid
@@ -2489,6 +2575,7 @@ enum nl80211_bss_status {
 * @NL80211_AUTHTYPE_SHARED_KEY: Shared Key authentication (WEP only)
 * @NL80211_AUTHTYPE_FT: Fast BSS Transition (IEEE 802.11r)
 * @NL80211_AUTHTYPE_NETWORK_EAP: Network EAP (some Cisco APs and mainly LEAP)
+ * @NL80211_AUTHTYPE_SAE: Simultaneous authentication of equals
 * @__NL80211_AUTHTYPE_NUM: internal
 * @NL80211_AUTHTYPE_MAX: maximum valid auth algorithm
 * @NL80211_AUTHTYPE_AUTOMATIC: determine automatically (if necessary by
@@ -2500,6 +2587,7 @@ enum nl80211_auth_type {
        NL80211_AUTHTYPE_SHARED_KEY,
        NL80211_AUTHTYPE_FT,
        NL80211_AUTHTYPE_NETWORK_EAP,
+        NL80211_AUTHTYPE_SAE,
        /* keep last */
        __NL80211_AUTHTYPE_NUM,
@@ -3028,6 +3116,16 @@ enum nl80211_ap_sme_features {
 *      in the interface combinations, even when it's only used for scan
 *      and remain-on-channel. This could be due to, for example, the
 *      remain-on-channel implementation requiring a channel context.
+ * @NL80211_FEATURE_SAE: This driver supports simultaneous authentication of
+ *      equals (SAE) with user space SME (NL80211_CMD_AUTHENTICATE) in station
+ *      mode
+ * @NL80211_FEATURE_LOW_PRIORITY_SCAN: This driver supports low priority scan
+ * @NL80211_FEATURE_SCAN_FLUSH: Scan flush is supported
+ * @NL80211_FEATURE_AP_SCAN: Support scanning using an AP vif
+ * @NL80211_FEATURE_VIF_TXPOWER: The driver supports per-vif TX power setting
+ * @NL80211_FEATURE_NEED_OBSS_SCAN: The driver expects userspace to perform
+ *      OBSS scans and generate 20/40 BSS coex reports. This flag is used only
+ *      for drivers implementing the CONNECT API, for AUTH/ASSOC it is implied.
 */
 enum nl80211_feature_flags {
        NL80211_FEATURE_SK_TX_STATUS                    = 1 << 0,
@@ -3035,6 +3133,12 @@ enum nl80211_feature_flags {
        NL80211_FEATURE_INACTIVITY_TIMER                = 1 << 2,
        NL80211_FEATURE_CELL_BASE_REG_HINTS             = 1 << 3,
        NL80211_FEATURE_P2P_DEVICE_NEEDS_CHANNEL        = 1 << 4,
+        NL80211_FEATURE_SAE                             = 1 << 5,
+        NL80211_FEATURE_LOW_PRIORITY_SCAN               = 1 << 6,
+        NL80211_FEATURE_SCAN_FLUSH                      = 1 << 7,
+        NL80211_FEATURE_AP_SCAN                         = 1 << 8,
+        NL80211_FEATURE_VIF_TXPOWER                     = 1 << 9,
+        NL80211_FEATURE_NEED_OBSS_SCAN                  = 1 << 10,
 };
 /**
@@ -3069,4 +3173,25 @@ enum nl80211_connect_failed_reason {
        NL80211_CONN_FAIL_BLOCKED_CLIENT,
 };
+/**
+ * enum nl80211_scan_flags -  scan request control flags
+ *
+ * Scan request control flags are used to control the handling
+ * of NL80211_CMD_TRIGGER_SCAN and NL80211_CMD_START_SCHED_SCAN
+ * requests.
+ *
+ * @NL80211_SCAN_FLAG_LOW_PRIORITY: scan request has low priority
+ * @NL80211_SCAN_FLAG_FLUSH: flush cache before scanning
+ * @NL80211_SCAN_FLAG_AP: force a scan even if the interface is configured
+ *      as AP and the beaconing has already been configured. This attribute is
+ *      dangerous because will destroy stations performance as a lot of frames
+ *      will be lost while scanning off-channel, therefore it must be used only
+ *      when really needed
+ */
+enum nl80211_scan_flags {
+        NL80211_SCAN_FLAG_LOW_PRIORITY                  = 1<<0,
+        NL80211_SCAN_FLAG_FLUSH                         = 1<<1,
+        NL80211_SCAN_FLAG_AP                            = 1<<2,
+};
 #endif /* __LINUX_NL80211_H */
diff --git a/include/uapi/linux/ptp_clock.h b/include/uapi/linux/ptp_clock.h
index 94e981f810a2..b65c834f83e9 100644
--- a/include/uapi/linux/ptp_clock.h
+++ b/include/uapi/linux/ptp_clock.h
@@ -67,12 +67,26 @@ struct ptp_perout_request {
        unsigned int rsv[4];          /* Reserved for future use. */
 };
+#define PTP_MAX_SAMPLES 25 /* Maximum allowed offset measurement samples. */
+struct ptp_sys_offset {
+        unsigned int n_samples; /* Desired number of measurements. */
+        unsigned int rsv[3];    /* Reserved for future use. */
+        /*
+         * Array of interleaved system/phc time stamps. The kernel
+         * will provide 2*n_samples + 1 time stamps, with the last
+         * one as a system time stamp.
+         */
+        struct ptp_clock_time ts[2 * PTP_MAX_SAMPLES + 1];
+};
 #define PTP_CLK_MAGIC '='
 #define PTP_CLOCK_GETCAPS  _IOR(PTP_CLK_MAGIC, 1, struct ptp_clock_caps)
 #define PTP_EXTTS_REQUEST  _IOW(PTP_CLK_MAGIC, 2, struct ptp_extts_request)
 #define PTP_PEROUT_REQUEST _IOW(PTP_CLK_MAGIC, 3, struct ptp_perout_request)
 #define PTP_ENABLE_PPS     _IOW(PTP_CLK_MAGIC, 4, int)
+#define PTP_SYS_OFFSET     _IOW(PTP_CLK_MAGIC, 5, struct ptp_sys_offset)
 struct ptp_extts_event {
        struct ptp_clock_time t; /* Time event occured. */
diff --git a/include/uapi/linux/rtnetlink.h b/include/uapi/linux/rtnetlink.h
index fcd768b09f6e..3dee071770d5 100644
--- a/include/uapi/linux/rtnetlink.h
+++ b/include/uapi/linux/rtnetlink.h
@@ -120,6 +120,11 @@ enum {
        RTM_SETDCB,
 #define RTM_SETDCB RTM_SETDCB
+        RTM_NEWNETCONF = 80,
+#define RTM_NEWNETCONF RTM_NEWNETCONF
+        RTM_GETNETCONF = 82,
+#define RTM_GETNETCONF RTM_GETNETCONF
        __RTM_MAX,
 #define RTM_MAX         (((__RTM_MAX + 3) & ~3) - 1)
 };
@@ -587,6 +592,10 @@ enum rtnetlink_groups {
 #define RTNLGRP_PHONET_ROUTE    RTNLGRP_PHONET_ROUTE
        RTNLGRP_DCB,
 #define RTNLGRP_DCB             RTNLGRP_DCB
+        RTNLGRP_IPV4_NETCONF,
+#define RTNLGRP_IPV4_NETCONF    RTNLGRP_IPV4_NETCONF
+        RTNLGRP_IPV6_NETCONF,
+#define RTNLGRP_IPV6_NETCONF    RTNLGRP_IPV6_NETCONF
        __RTNLGRP_MAX
 };
 #define RTNLGRP_MAX     (__RTNLGRP_MAX - 1)
diff --git a/include/uapi/linux/unix_diag.h b/include/uapi/linux/unix_diag.h
index b1d2bf16b33c..b8a24941db21 100644
--- a/include/uapi/linux/unix_diag.h
+++ b/include/uapi/linux/unix_diag.h
@@ -37,6 +37,7 @@ enum {
        UNIX_DIAG_ICONS,
        UNIX_DIAG_RQLEN,
        UNIX_DIAG_MEMINFO,
+        UNIX_DIAG_SHUTDOWN,
        UNIX_DIAG_MAX,
 };
diff --git a/include/uapi/linux/usb/cdc.h b/include/uapi/linux/usb/cdc.h
index 81a927930bfd..f35aa0a338c7 100644
--- a/include/uapi/linux/usb/cdc.h
+++ b/include/uapi/linux/usb/cdc.h
@@ -19,6 +19,7 @@
 #define USB_CDC_SUBCLASS_OBEX                   0x0b
 #define USB_CDC_SUBCLASS_EEM                    0x0c
 #define USB_CDC_SUBCLASS_NCM                    0x0d
+#define USB_CDC_SUBCLASS_MBIM                   0x0e
 #define USB_CDC_PROTO_NONE                      0
@@ -33,6 +34,7 @@
 #define USB_CDC_PROTO_EEM                       7
 #define USB_CDC_NCM_PROTO_NTB                   1
+#define USB_CDC_MBIM_PROTO_NTB                  2
 /*-------------------------------------------------------------------------*/
@@ -53,6 +55,7 @@
 #define USB_CDC_DMM_TYPE                0x14
 #define USB_CDC_OBEX_TYPE               0x15
 #define USB_CDC_NCM_TYPE                0x1a
+#define USB_CDC_MBIM_TYPE               0x1b
 /* "Header Functional Descriptor" from CDC spec  5.2.3.1 */
 struct usb_cdc_header_desc {
@@ -187,6 +190,21 @@ struct usb_cdc_ncm_desc {
        __le16  bcdNcmVersion;
        __u8    bmNetworkCapabilities;
 } __attribute__ ((packed));
+/* "MBIM Control Model Functional Descriptor" */
+struct usb_cdc_mbim_desc {
+        __u8    bLength;
+        __u8    bDescriptorType;
+        __u8    bDescriptorSubType;
+        __le16  bcdMBIMVersion;
+        __le16  wMaxControlMessage;
+        __u8    bNumberFilters;
+        __u8    bMaxFilterSize;
+        __le16  wMaxSegmentSize;
+        __u8    bmNetworkCapabilities;
+} __attribute__ ((packed));
 /*-------------------------------------------------------------------------*/
 /*
@@ -332,6 +350,11 @@ struct usb_cdc_ncm_nth32 {
 #define USB_CDC_NCM_NDP32_CRC_SIGN      0x316D636E /* ncm1 */
 #define USB_CDC_NCM_NDP32_NOCRC_SIGN    0x306D636E /* ncm0 */
+#define USB_CDC_MBIM_NDP16_IPS_SIGN     0x00535049 /* IPS<sessionID> : IPS0 for now */
+#define USB_CDC_MBIM_NDP32_IPS_SIGN     0x00737069 /* ips<sessionID> : ips0 for now */
+#define USB_CDC_MBIM_NDP16_DSS_SIGN     0x00535344 /* DSS<sessionID> */
+#define USB_CDC_MBIM_NDP32_DSS_SIGN     0x00737364 /* dss<sessionID> */
 /* 16-bit NCM Datagram Pointer Entry */
 struct usb_cdc_ncm_dpe16 {
        __le16  wDatagramIndex;