109 files changed, 2259 insertions, 665 deletions

diff --git a/include/clocksource/arm_arch_timer.h b/include/clocksource/arm_arch_timer.h
index 6d26b40cbf5d..9916d0e4eff5 100644
--- a/include/clocksource/arm_arch_timer.h
+++ b/include/clocksource/arm_arch_timer.h
@@ -16,7 +16,7 @@
 #ifndef __CLKSOURCE_ARM_ARCH_TIMER_H
 #define __CLKSOURCE_ARM_ARCH_TIMER_H
 
-#include <linux/clocksource.h>
+#include <linux/timecounter.h>
 #include <linux/types.h>
 
 #define ARCH_TIMER_CTRL_ENABLE          (1 << 0)
diff --git a/include/crypto/if_alg.h b/include/crypto/if_alg.h
index cd62bf4289e9..88ea64e9a91c 100644
--- a/include/crypto/if_alg.h
+++ b/include/crypto/if_alg.h
@@ -67,8 +67,7 @@ int af_alg_unregister_type(const struct af_alg_type *type);
 int af_alg_release(struct socket *sock);
 int af_alg_accept(struct sock *sk, struct socket *newsock);
 
-int af_alg_make_sg(struct af_alg_sgl *sgl, void __user *addr, int len,
-                   int write);
+int af_alg_make_sg(struct af_alg_sgl *sgl, struct iov_iter *iter, int len);
 void af_alg_free_sg(struct af_alg_sgl *sgl);
 
 int af_alg_cmsg_send(struct msghdr *msg, struct af_alg_control *con);
diff --git a/include/dt-bindings/clock/rk3288-cru.h b/include/dt-bindings/clock/rk3288-cru.h
index f60ce72a2b2c..1c34c24efe08 100644
--- a/include/dt-bindings/clock/rk3288-cru.h
+++ b/include/dt-bindings/clock/rk3288-cru.h
@@ -81,6 +81,9 @@
 #define SCLK_SDIO1_SAMPLE       120
 #define SCLK_EMMC_SAMPLE        121
 
+#define SCLK_MAC                151
+#define SCLK_MACREF_OUT         152
+
 #define DCLK_VOP0               190
 #define DCLK_VOP1               191
 
diff --git a/include/linux/bcma/bcma.h b/include/linux/bcma/bcma.h
index eb1c6a47b67f..994739da827f 100644
--- a/include/linux/bcma/bcma.h
+++ b/include/linux/bcma/bcma.h
@@ -318,6 +318,7 @@ struct bcma_bus {
         const struct bcma_host_ops *ops;
 
         enum bcma_hosttype hosttype;
+        bool host_is_pcie2; /* Used for BCMA_HOSTTYPE_PCI only */
         union {
                 /* Pointer to the PCI bus (only for BCMA_HOSTTYPE_PCI) */
                 struct pci_dev *host_pci;
diff --git a/include/linux/bcma/bcma_driver_pci.h b/include/linux/bcma/bcma_driver_pci.h
index 0333e605ea0d..3f809ae372c4 100644
--- a/include/linux/bcma/bcma_driver_pci.h
+++ b/include/linux/bcma/bcma_driver_pci.h
@@ -223,6 +223,7 @@ struct bcma_drv_pci_host {
 
 struct bcma_drv_pci {
         struct bcma_device *core;
+        u8 early_setup_done:1;
         u8 setup_done:1;
         u8 hostmode:1;
 
@@ -237,6 +238,7 @@ struct bcma_drv_pci {
 #define pcicore_write16(pc, offset, val)        bcma_write16((pc)->core, offset, val)
 #define pcicore_write32(pc, offset, val)        bcma_write32((pc)->core, offset, val)
 
+extern void bcma_core_pci_early_init(struct bcma_drv_pci *pc);
 extern void bcma_core_pci_init(struct bcma_drv_pci *pc);
 extern int bcma_core_pci_irq_ctl(struct bcma_drv_pci *pc,
                                  struct bcma_device *core, bool enable);
diff --git a/include/linux/bcma/bcma_regs.h b/include/linux/bcma/bcma_regs.h
index e64ae7bf80a1..ebd5c1fcdea4 100644
--- a/include/linux/bcma/bcma_regs.h
+++ b/include/linux/bcma/bcma_regs.h
@@ -64,6 +64,8 @@
 #define  BCMA_PCI_GPIO_XTAL             0x40    /* PCI config space GPIO 14 for Xtal powerup */
 #define  BCMA_PCI_GPIO_PLL              0x80    /* PCI config space GPIO 15 for PLL powerdown */
 
+#define BCMA_PCIE2_BAR0_WIN2            0x70
+
 /* SiliconBackplane Address Map.
  * All regions may not exist on all chips.
  */
diff --git a/include/linux/bcma/bcma_soc.h b/include/linux/bcma/bcma_soc.h
index f24d245f8394..1b5fc0c3b1b5 100644
--- a/include/linux/bcma/bcma_soc.h
+++ b/include/linux/bcma/bcma_soc.h
@@ -5,8 +5,6 @@
 
 struct bcma_soc {
         struct bcma_bus bus;
-        struct bcma_device core_cc;
-        struct bcma_device core_mips;
 };
 
 int __init bcma_host_soc_register(struct bcma_soc *soc);
diff --git a/include/linux/clocksource.h b/include/linux/clocksource.h
index abcafaa20b86..9c78d15d33e4 100644
--- a/include/linux/clocksource.h
+++ b/include/linux/clocksource.h
@@ -18,8 +18,6 @@
 #include <asm/div64.h>
 #include <asm/io.h>
 
-/* clocksource cycle base type */
-typedef u64 cycle_t;
 struct clocksource;
 struct module;
 
@@ -28,106 +26,6 @@ struct module;
 #endif
 
 /**
- * struct cyclecounter - hardware abstraction for a free running counter
- *      Provides completely state-free accessors to the underlying hardware.
- *      Depending on which hardware it reads, the cycle counter may wrap
- *      around quickly. Locking rules (if necessary) have to be defined
- *      by the implementor and user of specific instances of this API.
- *
- * @read:               returns the current cycle value
- * @mask:               bitmask for two's complement
- *                      subtraction of non 64 bit counters,
- *                      see CLOCKSOURCE_MASK() helper macro
- * @mult:               cycle to nanosecond multiplier
- * @shift:              cycle to nanosecond divisor (power of two)
- */
-struct cyclecounter {
-        cycle_t (*read)(const struct cyclecounter *cc);
-        cycle_t mask;
-        u32 mult;
-        u32 shift;
-};
-
-/**
- * struct timecounter - layer above a %struct cyclecounter which counts nanoseconds
- *      Contains the state needed by timecounter_read() to detect
- *      cycle counter wrap around. Initialize with
- *      timecounter_init(). Also used to convert cycle counts into the
- *      corresponding nanosecond counts with timecounter_cyc2time(). Users
- *      of this code are responsible for initializing the underlying
- *      cycle counter hardware, locking issues and reading the time
- *      more often than the cycle counter wraps around. The nanosecond
- *      counter will only wrap around after ~585 years.
- *
- * @cc:                 the cycle counter used by this instance
- * @cycle_last:         most recent cycle counter value seen by
- *                      timecounter_read()
- * @nsec:               continuously increasing count
- */
-struct timecounter {
-        const struct cyclecounter *cc;
-        cycle_t cycle_last;
-        u64 nsec;
-};
-
-/**
- * cyclecounter_cyc2ns - converts cycle counter cycles to nanoseconds
- * @cc:         Pointer to cycle counter.
- * @cycles:     Cycles
- *
- * XXX - This could use some mult_lxl_ll() asm optimization. Same code
- * as in cyc2ns, but with unsigned result.
- */
-static inline u64 cyclecounter_cyc2ns(const struct cyclecounter *cc,
-                                      cycle_t cycles)
-{
-        u64 ret = (u64)cycles;
-        ret = (ret * cc->mult) >> cc->shift;
-        return ret;
-}
-
-/**
- * timecounter_init - initialize a time counter
- * @tc:                 Pointer to time counter which is to be initialized/reset
- * @cc:                 A cycle counter, ready to be used.
- * @start_tstamp:       Arbitrary initial time stamp.
- *
- * After this call the current cycle register (roughly) corresponds to
- * the initial time stamp. Every call to timecounter_read() increments
- * the time stamp counter by the number of elapsed nanoseconds.
- */
-extern void timecounter_init(struct timecounter *tc,
-                             const struct cyclecounter *cc,
-                             u64 start_tstamp);
-
-/**
- * timecounter_read - return nanoseconds elapsed since timecounter_init()
- *                    plus the initial time stamp
- * @tc:          Pointer to time counter.
- *
- * In other words, keeps track of time since the same epoch as
- * the function which generated the initial time stamp.
- */
-extern u64 timecounter_read(struct timecounter *tc);
-
-/**
- * timecounter_cyc2time - convert a cycle counter to same
- *                        time base as values returned by
- *                        timecounter_read()
- * @tc:         Pointer to time counter.
- * @cycle_tstamp:       a value returned by tc->cc->read()
- *
- * Cycle counts that are converted correctly as long as they
- * fall into the interval [-1/2 max cycle count, +1/2 max cycle count],
- * with "max cycle count" == cs->mask+1.
- *
- * This allows conversion of cycle counter values which were generated
- * in the past.
- */
-extern u64 timecounter_cyc2time(struct timecounter *tc,
-                                cycle_t cycle_tstamp);
-
-/**
  * struct clocksource - hardware abstraction for a free running counter
  *      Provides mostly state-free accessors to the underlying hardware.
  *      This is the structure used for system time.
diff --git a/include/linux/etherdevice.h b/include/linux/etherdevice.h
index 41c891d05f04..1d869d185a0d 100644
--- a/include/linux/etherdevice.h
+++ b/include/linux/etherdevice.h
@@ -52,6 +52,10 @@ struct net_device *alloc_etherdev_mqs(int sizeof_priv, unsigned int txqs,
 #define alloc_etherdev(sizeof_priv) alloc_etherdev_mq(sizeof_priv, 1)
 #define alloc_etherdev_mq(sizeof_priv, count) alloc_etherdev_mqs(sizeof_priv, count, count)
 
+struct sk_buff **eth_gro_receive(struct sk_buff **head,
+                                 struct sk_buff *skb);
+int eth_gro_complete(struct sk_buff *skb, int nhoff);
+
 /* Reserved Ethernet Addresses per IEEE 802.1Q */
 static const u8 eth_reserved_addr_base[ETH_ALEN] __aligned(2) =
 { 0x01, 0x80, 0xc2, 0x00, 0x00, 0x00 };
diff --git a/include/linux/fec.h b/include/linux/fec.h
index bcff455d1d53..1454a503622d 100644
--- a/include/linux/fec.h
+++ b/include/linux/fec.h
@@ -19,6 +19,7 @@
 struct fec_platform_data {
         phy_interface_t phy;
         unsigned char mac[ETH_ALEN];
+        void (*sleep_mode_enable)(int enabled);
 };
 
 #endif
diff --git a/include/linux/ieee80211.h b/include/linux/ieee80211.h
index 4f4eea8a6288..b9c7897dc566 100644
--- a/include/linux/ieee80211.h
+++ b/include/linux/ieee80211.h
@@ -1017,6 +1017,15 @@ struct ieee80211_mmie {
         u8 mic[8];
 } __packed;
 
+/* Management MIC information element (IEEE 802.11w) for GMAC and CMAC-256 */
+struct ieee80211_mmie_16 {
+        u8 element_id;
+        u8 length;
+        __le16 key_id;
+        u8 sequence_number[6];
+        u8 mic[16];
+} __packed;
+
 struct ieee80211_vendor_ie {
         u8 element_id;
         u8 len;
@@ -1994,9 +2003,15 @@ enum ieee80211_key_len {
         WLAN_KEY_LEN_WEP40 = 5,
         WLAN_KEY_LEN_WEP104 = 13,
         WLAN_KEY_LEN_CCMP = 16,
+        WLAN_KEY_LEN_CCMP_256 = 32,
         WLAN_KEY_LEN_TKIP = 32,
         WLAN_KEY_LEN_AES_CMAC = 16,
         WLAN_KEY_LEN_SMS4 = 32,
+        WLAN_KEY_LEN_GCMP = 16,
+        WLAN_KEY_LEN_GCMP_256 = 32,
+        WLAN_KEY_LEN_BIP_CMAC_256 = 32,
+        WLAN_KEY_LEN_BIP_GMAC_128 = 16,
+        WLAN_KEY_LEN_BIP_GMAC_256 = 32,
 };
 
 #define IEEE80211_WEP_IV_LEN            4
@@ -2004,9 +2019,16 @@ enum ieee80211_key_len {
 #define IEEE80211_CCMP_HDR_LEN          8
 #define IEEE80211_CCMP_MIC_LEN          8
 #define IEEE80211_CCMP_PN_LEN           6
+#define IEEE80211_CCMP_256_HDR_LEN      8
+#define IEEE80211_CCMP_256_MIC_LEN      16
+#define IEEE80211_CCMP_256_PN_LEN       6
 #define IEEE80211_TKIP_IV_LEN           8
 #define IEEE80211_TKIP_ICV_LEN          4
 #define IEEE80211_CMAC_PN_LEN           6
+#define IEEE80211_GMAC_PN_LEN           6
+#define IEEE80211_GCMP_HDR_LEN          8
+#define IEEE80211_GCMP_MIC_LEN          16
+#define IEEE80211_GCMP_PN_LEN           6
 
 /* Public action codes */
 enum ieee80211_pub_actioncode {
@@ -2230,6 +2252,11 @@ enum ieee80211_sa_query_action {
 #define WLAN_CIPHER_SUITE_WEP104        0x000FAC05
 #define WLAN_CIPHER_SUITE_AES_CMAC      0x000FAC06
 #define WLAN_CIPHER_SUITE_GCMP          0x000FAC08
+#define WLAN_CIPHER_SUITE_GCMP_256      0x000FAC09
+#define WLAN_CIPHER_SUITE_CCMP_256      0x000FAC0A
+#define WLAN_CIPHER_SUITE_BIP_GMAC_128  0x000FAC0B
+#define WLAN_CIPHER_SUITE_BIP_GMAC_256  0x000FAC0C
+#define WLAN_CIPHER_SUITE_BIP_CMAC_256  0x000FAC0D
 
 #define WLAN_CIPHER_SUITE_SMS4          0x00147201
 
diff --git a/include/linux/if_bridge.h b/include/linux/if_bridge.h
index 0a8ce762a47f..a57bca2ea97e 100644
--- a/include/linux/if_bridge.h
+++ b/include/linux/if_bridge.h
@@ -50,24 +50,6 @@ extern void brioctl_set(int (*ioctl_hook)(struct net *, unsigned int, void __use
 typedef int br_should_route_hook_t(struct sk_buff *skb);
 extern br_should_route_hook_t __rcu *br_should_route_hook;
 
-#if IS_ENABLED(CONFIG_BRIDGE)
-int br_fdb_external_learn_add(struct net_device *dev,
-                              const unsigned char *addr, u16 vid);
-int br_fdb_external_learn_del(struct net_device *dev,
-                              const unsigned char *addr, u16 vid);
-#else
-static inline int br_fdb_external_learn_add(struct net_device *dev,
-                                            const unsigned char *addr, u16 vid)
-{
-        return 0;
-}
-static inline int br_fdb_external_learn_del(struct net_device *dev,
-                                            const unsigned char *addr, u16 vid)
-{
-        return 0;
-}
-#endif
-
 #if IS_ENABLED(CONFIG_BRIDGE) && IS_ENABLED(CONFIG_BRIDGE_IGMP_SNOOPING)
 int br_multicast_list_adjacent(struct net_device *dev,
                                struct list_head *br_ip_list);
diff --git a/include/linux/if_vlan.h b/include/linux/if_vlan.h
index 960e666c51e4..b11b28a30b9e 100644
--- a/include/linux/if_vlan.h
+++ b/include/linux/if_vlan.h
@@ -78,9 +78,9 @@ static inline bool is_vlan_dev(struct net_device *dev)
         return dev->priv_flags & IFF_802_1Q_VLAN;
 }
 
-#define vlan_tx_tag_present(__skb)      ((__skb)->vlan_tci & VLAN_TAG_PRESENT)
-#define vlan_tx_tag_get(__skb)          ((__skb)->vlan_tci & ~VLAN_TAG_PRESENT)
-#define vlan_tx_tag_get_id(__skb)       ((__skb)->vlan_tci & VLAN_VID_MASK)
+#define skb_vlan_tag_present(__skb)     ((__skb)->vlan_tci & VLAN_TAG_PRESENT)
+#define skb_vlan_tag_get(__skb)         ((__skb)->vlan_tci & ~VLAN_TAG_PRESENT)
+#define skb_vlan_tag_get_id(__skb)      ((__skb)->vlan_tci & VLAN_VID_MASK)
 
 /**
  *      struct vlan_pcpu_stats - VLAN percpu rx/tx stats
@@ -376,7 +376,7 @@ static inline struct sk_buff *vlan_insert_tag_set_proto(struct sk_buff *skb,
 static inline struct sk_buff *__vlan_hwaccel_push_inside(struct sk_buff *skb)
 {
         skb = vlan_insert_tag_set_proto(skb, skb->vlan_proto,
-                                        vlan_tx_tag_get(skb));
+                                        skb_vlan_tag_get(skb));
         if (likely(skb))
                 skb->vlan_tci = 0;
         return skb;
@@ -393,7 +393,7 @@ static inline struct sk_buff *__vlan_hwaccel_push_inside(struct sk_buff *skb)
  */
 static inline struct sk_buff *vlan_hwaccel_push_inside(struct sk_buff *skb)
 {
-        if (vlan_tx_tag_present(skb))
+        if (skb_vlan_tag_present(skb))
                 skb = __vlan_hwaccel_push_inside(skb);
         return skb;
 }
@@ -442,8 +442,8 @@ static inline int __vlan_get_tag(const struct sk_buff *skb, u16 *vlan_tci)
 static inline int __vlan_hwaccel_get_tag(const struct sk_buff *skb,
                                          u16 *vlan_tci)
 {
-        if (vlan_tx_tag_present(skb)) {
-                *vlan_tci = vlan_tx_tag_get(skb);
+        if (skb_vlan_tag_present(skb)) {
+                *vlan_tci = skb_vlan_tag_get(skb);
                 return 0;
         } else {
                 *vlan_tci = 0;
diff --git a/include/linux/ipv6.h b/include/linux/ipv6.h
index c694e7baa621..4d5169f5d7d1 100644
--- a/include/linux/ipv6.h
+++ b/include/linux/ipv6.h
@@ -52,6 +52,7 @@ struct ipv6_devconf {
         __s32           force_tllao;
         __s32           ndisc_notify;
         __s32           suppress_frag_ndisc;
+        __s32           accept_ra_mtu;
         void            *sysctl;
 };
 
@@ -124,6 +125,12 @@ struct ipv6_mc_socklist;
 struct ipv6_ac_socklist;
 struct ipv6_fl_socklist;
 
+struct inet6_cork {
+        struct ipv6_txoptions *opt;
+        u8 hop_limit;
+        u8 tclass;
+};
+
 /**
  * struct ipv6_pinfo - ipv6 private area
  *
@@ -216,11 +223,7 @@ struct ipv6_pinfo {
         struct ipv6_txoptions   *opt;
         struct sk_buff          *pktoptions;
         struct sk_buff          *rxpmtu;
-        struct {
-                struct ipv6_txoptions *opt;
-                u8 hop_limit;
-                u8 tclass;
-        } cork;
+        struct inet6_cork       cork;
 };
 
 /* WARNING: don't change the layout of the members in {raw,udp,tcp}6_sock! */
diff --git a/include/linux/list_nulls.h b/include/linux/list_nulls.h
index 5d10ae364b5e..f266661d2666 100644
--- a/include/linux/list_nulls.h
+++ b/include/linux/list_nulls.h
@@ -1,6 +1,9 @@
 #ifndef _LINUX_LIST_NULLS_H
 #define _LINUX_LIST_NULLS_H
 
+#include <linux/poison.h>
+#include <linux/const.h>
+
 /*
  * Special version of lists, where end of list is not a NULL pointer,
  * but a 'nulls' marker, which can have many different values.
@@ -21,8 +24,9 @@ struct hlist_nulls_head {
 struct hlist_nulls_node {
         struct hlist_nulls_node *next, **pprev;
 };
+#define NULLS_MARKER(value) (1UL | (((long)value) << 1))
 #define INIT_HLIST_NULLS_HEAD(ptr, nulls) \
-        ((ptr)->first = (struct hlist_nulls_node *) (1UL | (((long)nulls) << 1)))
+        ((ptr)->first = (struct hlist_nulls_node *) NULLS_MARKER(nulls))
 
 #define hlist_nulls_entry(ptr, type, member) container_of(ptr,type,member)
 /**
diff --git a/include/linux/mlx4/cmd.h b/include/linux/mlx4/cmd.h
index 64d25941b329..7b6d4e9ff603 100644
--- a/include/linux/mlx4/cmd.h
+++ b/include/linux/mlx4/cmd.h
@@ -71,6 +71,7 @@ enum {
 
         /*master notify fw on finish for slave's flr*/
         MLX4_CMD_INFORM_FLR_DONE = 0x5b,
+        MLX4_CMD_VIRT_PORT_MAP   = 0x5c,
         MLX4_CMD_GET_OP_REQ      = 0x59,
 
         /* TPT commands */
@@ -165,9 +166,15 @@ enum {
 };
 
 enum {
-        MLX4_CMD_TIME_CLASS_A   = 10000,
-        MLX4_CMD_TIME_CLASS_B   = 10000,
-        MLX4_CMD_TIME_CLASS_C   = 10000,
+        MLX4_CMD_TIME_CLASS_A   = 60000,
+        MLX4_CMD_TIME_CLASS_B   = 60000,
+        MLX4_CMD_TIME_CLASS_C   = 60000,
+};
+
+enum {
+        /* virtual to physical port mapping opcode modifiers */
+        MLX4_GET_PORT_VIRT2PHY = 0x0,
+        MLX4_SET_PORT_VIRT2PHY = 0x1,
 };
 
 enum {
@@ -279,6 +286,8 @@ int mlx4_get_vf_config(struct mlx4_dev *dev, int port, int vf, struct ifla_vf_in
 int mlx4_set_vf_link_state(struct mlx4_dev *dev, int port, int vf, int link_state);
 int mlx4_config_dev_retrieval(struct mlx4_dev *dev,
                               struct mlx4_config_dev_params *params);
+void mlx4_cmd_wake_completions(struct mlx4_dev *dev);
+void mlx4_report_internal_err_comm_event(struct mlx4_dev *dev);
 /*
  * mlx4_get_slave_default_vlan -
  * return true if VST ( default vlan)
@@ -288,5 +297,6 @@ bool mlx4_get_slave_default_vlan(struct mlx4_dev *dev, int port, int slave,
                                  u16 *vlan, u8 *qos);
 
 #define MLX4_COMM_GET_IF_REV(cmd_chan_ver) (u8)((cmd_chan_ver) >> 8)
+#define COMM_CHAN_EVENT_INTERNAL_ERR (1 << 17)
 
 #endif /* MLX4_CMD_H */
diff --git a/include/linux/mlx4/device.h b/include/linux/mlx4/device.h
index 5f3a9aa7225d..e4ebff7e9d02 100644
--- a/include/linux/mlx4/device.h
+++ b/include/linux/mlx4/device.h
@@ -42,7 +42,7 @@
 
 #include <linux/atomic.h>
 
-#include <linux/clocksource.h>
+#include <linux/timecounter.h>
 
 #define MAX_MSIX_P_PORT         17
 #define MAX_MSIX                64
@@ -70,6 +70,7 @@ enum {
         MLX4_FLAG_SLAVE         = 1 << 3,
         MLX4_FLAG_SRIOV         = 1 << 4,
         MLX4_FLAG_OLD_REG_MAC   = 1 << 6,
+        MLX4_FLAG_BONDED        = 1 << 7
 };
 
 enum {
@@ -200,7 +201,9 @@ enum {
         MLX4_DEV_CAP_FLAG2_CONFIG_DEV           = 1LL <<  16,
         MLX4_DEV_CAP_FLAG2_SYS_EQS              = 1LL <<  17,
         MLX4_DEV_CAP_FLAG2_80_VFS               = 1LL <<  18,
-        MLX4_DEV_CAP_FLAG2_FS_A0                = 1LL <<  19
+        MLX4_DEV_CAP_FLAG2_FS_A0                = 1LL <<  19,
+        MLX4_DEV_CAP_FLAG2_RECOVERABLE_ERROR_EVENT = 1LL << 20,
+        MLX4_DEV_CAP_FLAG2_PORT_REMAP           = 1LL <<  21
 };
 
 enum {
@@ -208,6 +211,10 @@ enum {
         MLX4_QUERY_FUNC_FLAGS_A0_RES_QP         = 1LL << 1
 };
 
+enum {
+        MLX4_VF_CAP_FLAG_RESET                  = 1 << 0
+};
+
 /* bit enums for an 8-bit flags field indicating special use
  * QPs which require special handling in qp_reserve_range.
  * Currently, this only includes QPs used by the ETH interface,
@@ -248,9 +255,14 @@ enum {
         MLX4_BMME_FLAG_TYPE_2_WIN       = 1 <<  9,
         MLX4_BMME_FLAG_RESERVED_LKEY    = 1 << 10,
         MLX4_BMME_FLAG_FAST_REG_WR      = 1 << 11,
+        MLX4_BMME_FLAG_PORT_REMAP       = 1 << 24,
         MLX4_BMME_FLAG_VSD_INIT2RTR     = 1 << 28,
 };
 
+enum {
+        MLX4_FLAG_PORT_REMAP            = MLX4_BMME_FLAG_PORT_REMAP
+};
+
 enum mlx4_event {
         MLX4_EVENT_TYPE_COMP               = 0x00,
         MLX4_EVENT_TYPE_PATH_MIG           = 0x01,
@@ -276,6 +288,7 @@ enum mlx4_event {
         MLX4_EVENT_TYPE_FATAL_WARNING      = 0x1b,
         MLX4_EVENT_TYPE_FLR_EVENT          = 0x1c,
         MLX4_EVENT_TYPE_PORT_MNG_CHG_EVENT = 0x1d,
+        MLX4_EVENT_TYPE_RECOVERABLE_ERROR_EVENT  = 0x3e,
         MLX4_EVENT_TYPE_NONE               = 0xff,
 };
 
@@ -285,6 +298,11 @@ enum {
 };
 
 enum {
+        MLX4_RECOVERABLE_ERROR_EVENT_SUBTYPE_BAD_CABLE          = 1,
+        MLX4_RECOVERABLE_ERROR_EVENT_SUBTYPE_UNSUPPORTED_CABLE  = 2,
+};
+
+enum {
         MLX4_FATAL_WARNING_SUBTYPE_WARMING = 0,
 };
 
@@ -411,6 +429,16 @@ enum {
         MLX4_EQ_PORT_INFO_MSTR_SM_SL_CHANGE_MASK        = 1 << 4,
 };
 
+enum {
+        MLX4_DEVICE_STATE_UP                    = 1 << 0,
+        MLX4_DEVICE_STATE_INTERNAL_ERROR        = 1 << 1,
+};
+
+enum {
+        MLX4_INTERFACE_STATE_UP         = 1 << 0,
+        MLX4_INTERFACE_STATE_DELETION   = 1 << 1,
+};
+
 #define MSTR_SM_CHANGE_MASK (MLX4_EQ_PORT_INFO_MSTR_SM_SL_CHANGE_MASK | \
                              MLX4_EQ_PORT_INFO_MSTR_SM_LID_CHANGE_MASK)
 
@@ -535,6 +563,7 @@ struct mlx4_caps {
         u8                      alloc_res_qp_mask;
         u32                     dmfs_high_rate_qpn_base;
         u32                     dmfs_high_rate_qpn_range;
+        u32                     vf_caps;
 };
 
 struct mlx4_buf_list {
@@ -660,6 +689,8 @@ struct mlx4_cq {
                 void (*comp)(struct mlx4_cq *);
                 void            *priv;
         } tasklet_ctx;
+        int             reset_notify_added;
+        struct list_head        reset_notify;
 };
 
 struct mlx4_qp {
@@ -744,8 +775,23 @@ struct mlx4_vf_dev {
         u8                      n_ports;
 };
 
-struct mlx4_dev {
+struct mlx4_dev_persistent {
         struct pci_dev         *pdev;
+        struct mlx4_dev        *dev;
+        int                     nvfs[MLX4_MAX_PORTS + 1];
+        int                     num_vfs;
+        enum mlx4_port_type curr_port_type[MLX4_MAX_PORTS + 1];
+        enum mlx4_port_type curr_port_poss_type[MLX4_MAX_PORTS + 1];
+        struct work_struct      catas_work;
+        struct workqueue_struct *catas_wq;
+        struct mutex    device_state_mutex; /* protect HW state */
+        u8              state;
+        struct mutex    interface_state_mutex; /* protect SW state */
+        u8      interface_state;
+};
+
+struct mlx4_dev {
+        struct mlx4_dev_persistent *persist;
         unsigned long           flags;
         unsigned long           num_slaves;
         struct mlx4_caps        caps;
@@ -754,13 +800,11 @@ struct mlx4_dev {
         struct radix_tree_root  qp_table_tree;
         u8                      rev_id;
         char                    board_id[MLX4_BOARD_ID_LEN];
-        int                     num_vfs;
         int                     numa_node;
         int                     oper_log_mgm_entry_size;
         u64                     regid_promisc_array[MLX4_MAX_PORTS + 1];
         u64                     regid_allmulti_array[MLX4_MAX_PORTS + 1];
         struct mlx4_vf_dev     *dev_vfs;
-        int                     nvfs[MLX4_MAX_PORTS + 1];
 };
 
 struct mlx4_eqe {
@@ -832,6 +876,11 @@ struct mlx4_eqe {
                                 } __packed tbl_change_info;
                         } params;
                 } __packed port_mgmt_change;
+                struct {
+                        u8 reserved[3];
+                        u8 port;
+                        u32 reserved1[5];
+                } __packed bad_cable;
         }                       event;
         u8                      slave_id;
         u8                      reserved3[2];
@@ -1338,6 +1387,8 @@ int mlx4_phys_to_slave_port(struct mlx4_dev *dev, int slave, int port);
 int mlx4_get_base_gid_ix(struct mlx4_dev *dev, int slave, int port);
 
 int mlx4_config_vxlan_port(struct mlx4_dev *dev, __be16 udp_port);
+int mlx4_disable_rx_port_check(struct mlx4_dev *dev, bool dis);
+int mlx4_virt2phy_port_map(struct mlx4_dev *dev, u32 port1, u32 port2);
 int mlx4_vf_smi_enabled(struct mlx4_dev *dev, int slave, int port);
 int mlx4_vf_get_enable_smi_admin(struct mlx4_dev *dev, int slave, int port);
 int mlx4_vf_set_enable_smi_admin(struct mlx4_dev *dev, int slave, int port,
diff --git a/include/linux/mlx4/driver.h b/include/linux/mlx4/driver.h
index 022055c8fb26..9553a73d2049 100644
--- a/include/linux/mlx4/driver.h
+++ b/include/linux/mlx4/driver.h
@@ -49,6 +49,10 @@ enum mlx4_dev_event {
         MLX4_DEV_EVENT_SLAVE_SHUTDOWN,
 };
 
+enum {
+        MLX4_INTFF_BONDING      = 1 << 0
+};
+
 struct mlx4_interface {
         void *                  (*add)   (struct mlx4_dev *dev);
         void                    (*remove)(struct mlx4_dev *dev, void *context);
@@ -57,11 +61,26 @@ struct mlx4_interface {
         void *                  (*get_dev)(struct mlx4_dev *dev, void *context, u8 port);
         struct list_head        list;
         enum mlx4_protocol      protocol;
+        int                     flags;
 };
 
 int mlx4_register_interface(struct mlx4_interface *intf);
 void mlx4_unregister_interface(struct mlx4_interface *intf);
 
+int mlx4_bond(struct mlx4_dev *dev);
+int mlx4_unbond(struct mlx4_dev *dev);
+static inline int mlx4_is_bonded(struct mlx4_dev *dev)
+{
+        return !!(dev->flags & MLX4_FLAG_BONDED);
+}
+
+struct mlx4_port_map {
+        u8      port1;
+        u8      port2;
+};
+
+int mlx4_port_map_set(struct mlx4_dev *dev, struct mlx4_port_map *v2p);
+
 void *mlx4_get_protocol_dev(struct mlx4_dev *dev, enum mlx4_protocol proto, int port);
 
 static inline u64 mlx4_mac_to_u64(u8 *addr)
diff --git a/include/linux/mlx4/qp.h b/include/linux/mlx4/qp.h
index 467ccdf94c98..2bbc62aa818a 100644
--- a/include/linux/mlx4/qp.h
+++ b/include/linux/mlx4/qp.h
@@ -96,6 +96,7 @@ enum {
         MLX4_QP_BIT_RRE                         = 1 << 15,
         MLX4_QP_BIT_RWE                         = 1 << 14,
         MLX4_QP_BIT_RAE                         = 1 << 13,
+        MLX4_QP_BIT_FPP                         = 1 <<  3,
         MLX4_QP_BIT_RIC                         = 1 <<  4,
 };
 
diff --git a/include/linux/mmc/sdio_ids.h b/include/linux/mmc/sdio_ids.h
index 0f01fe065424..996807963716 100644
--- a/include/linux/mmc/sdio_ids.h
+++ b/include/linux/mmc/sdio_ids.h
@@ -24,13 +24,15 @@
  * Vendors and devices.  Sort key: vendor first, device next.
  */
 #define SDIO_VENDOR_ID_BROADCOM                 0x02d0
-#define SDIO_DEVICE_ID_BROADCOM_43143           43143
+#define SDIO_DEVICE_ID_BROADCOM_43143           0xa887
 #define SDIO_DEVICE_ID_BROADCOM_43241           0x4324
 #define SDIO_DEVICE_ID_BROADCOM_4329            0x4329
 #define SDIO_DEVICE_ID_BROADCOM_4330            0x4330
 #define SDIO_DEVICE_ID_BROADCOM_4334            0x4334
+#define SDIO_DEVICE_ID_BROADCOM_43340           0xa94c
+#define SDIO_DEVICE_ID_BROADCOM_43341           0xa94d
 #define SDIO_DEVICE_ID_BROADCOM_4335_4339       0x4335
-#define SDIO_DEVICE_ID_BROADCOM_43362           43362
+#define SDIO_DEVICE_ID_BROADCOM_43362           0xa962
 #define SDIO_DEVICE_ID_BROADCOM_4354            0x4354
 
 #define SDIO_VENDOR_ID_INTEL                    0x0089
diff --git a/include/linux/netdev_features.h b/include/linux/netdev_features.h
index 8e30685affeb..7d59dc6ab789 100644
--- a/include/linux/netdev_features.h
+++ b/include/linux/netdev_features.h
@@ -66,6 +66,7 @@ enum {
         NETIF_F_HW_VLAN_STAG_FILTER_BIT,/* Receive filtering on VLAN STAGs */
         NETIF_F_HW_L2FW_DOFFLOAD_BIT,   /* Allow L2 Forwarding in Hardware */
         NETIF_F_BUSY_POLL_BIT,          /* Busy poll */
+        NETIF_F_HW_SWITCH_OFFLOAD_BIT,  /* HW switch offload */
 
         /*
          * Add your fresh new feature above and remember to update
@@ -124,6 +125,7 @@ enum {
 #define NETIF_F_HW_VLAN_STAG_TX __NETIF_F(HW_VLAN_STAG_TX)
 #define NETIF_F_HW_L2FW_DOFFLOAD        __NETIF_F(HW_L2FW_DOFFLOAD)
 #define NETIF_F_BUSY_POLL       __NETIF_F(BUSY_POLL)
+#define NETIF_F_HW_SWITCH_OFFLOAD       __NETIF_F(HW_SWITCH_OFFLOAD)
 
 /* Features valid for ethtool to change */
 /* = all defined minus driver/device-class-related */
@@ -159,7 +161,9 @@ enum {
  */
 #define NETIF_F_ONE_FOR_ALL     (NETIF_F_GSO_SOFTWARE | NETIF_F_GSO_ROBUST | \
                                  NETIF_F_SG | NETIF_F_HIGHDMA |         \
-                                 NETIF_F_FRAGLIST | NETIF_F_VLAN_CHALLENGED)
+                                 NETIF_F_FRAGLIST | NETIF_F_VLAN_CHALLENGED | \
+                                 NETIF_F_HW_SWITCH_OFFLOAD)
+
 /*
  * If one device doesn't support one of these features, then disable it
  * for all in netdev_increment_features.
diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h
index 52fd8e8694cf..d115256ed5a2 100644
--- a/include/linux/netdevice.h
+++ b/include/linux/netdevice.h
@@ -51,6 +51,7 @@
 #include <linux/netdev_features.h>
 #include <linux/neighbour.h>
 #include <uapi/linux/netdevice.h>
+#include <uapi/linux/if_bonding.h>
 
 struct netpoll_info;
 struct device;
@@ -643,39 +644,40 @@ struct rps_dev_flow_table {
 /*
  * The rps_sock_flow_table contains mappings of flows to the last CPU
  * on which they were processed by the application (set in recvmsg).
+ * Each entry is a 32bit value. Upper part is the high order bits
+ * of flow hash, lower part is cpu number.
+ * rps_cpu_mask is used to partition the space, depending on number of
+ * possible cpus : rps_cpu_mask = roundup_pow_of_two(nr_cpu_ids) - 1
+ * For example, if 64 cpus are possible, rps_cpu_mask = 0x3f,
+ * meaning we use 32-6=26 bits for the hash.
  */
 struct rps_sock_flow_table {
-        unsigned int mask;
-        u16 ents[0];
+        u32     mask;
+
+        u32     ents[0] ____cacheline_aligned_in_smp;
 };
-#define RPS_SOCK_FLOW_TABLE_SIZE(_num) (sizeof(struct rps_sock_flow_table) + \
-    ((_num) * sizeof(u16)))
+#define RPS_SOCK_FLOW_TABLE_SIZE(_num) (offsetof(struct rps_sock_flow_table, ents[_num]))
 
 #define RPS_NO_CPU 0xffff
 
+extern u32 rps_cpu_mask;
+extern struct rps_sock_flow_table __rcu *rps_sock_flow_table;
+
 static inline void rps_record_sock_flow(struct rps_sock_flow_table *table,
                                         u32 hash)
 {
         if (table && hash) {
-                unsigned int cpu, index = hash & table->mask;
+                unsigned int index = hash & table->mask;
+                u32 val = hash & ~rps_cpu_mask;
 
                 /* We only give a hint, preemption can change cpu under us */
-                cpu = raw_smp_processor_id();
+                val |= raw_smp_processor_id();
 
-                if (table->ents[index] != cpu)
-                        table->ents[index] = cpu;
+                if (table->ents[index] != val)
+                        table->ents[index] = val;
         }
 }
 
-static inline void rps_reset_sock_flow(struct rps_sock_flow_table *table,
-                                       u32 hash)
-{
-        if (table && hash)
-                table->ents[hash & table->mask] = RPS_NO_CPU;
-}
-
-extern struct rps_sock_flow_table __rcu *rps_sock_flow_table;
-
 #ifdef CONFIG_RFS_ACCEL
 bool rps_may_expire_flow(struct net_device *dev, u16 rxq_index, u32 flow_id,
                          u16 filter_id);
@@ -1154,13 +1156,15 @@ struct net_device_ops {
                                                 int idx);
 
         int                     (*ndo_bridge_setlink)(struct net_device *dev,
-                                                      struct nlmsghdr *nlh);
+                                                      struct nlmsghdr *nlh,
+                                                      u16 flags);
         int                     (*ndo_bridge_getlink)(struct sk_buff *skb,
                                                       u32 pid, u32 seq,
                                                       struct net_device *dev,
                                                       u32 filter_mask);
         int                     (*ndo_bridge_dellink)(struct net_device *dev,
-                                                      struct nlmsghdr *nlh);
+                                                      struct nlmsghdr *nlh,
+                                                      u16 flags);
         int                     (*ndo_change_carrier)(struct net_device *dev,
                                                       bool new_carrier);
         int                     (*ndo_get_phys_port_id)(struct net_device *dev,
@@ -1514,6 +1518,8 @@ struct net_device {
         struct list_head        napi_list;
         struct list_head        unreg_list;
         struct list_head        close_list;
+        struct list_head        ptype_all;
+        struct list_head        ptype_specific;
 
         struct {
                 struct list_head upper;
@@ -1969,7 +1975,7 @@ struct offload_callbacks {
         struct sk_buff          *(*gso_segment)(struct sk_buff *skb,
                                                 netdev_features_t features);
         struct sk_buff          **(*gro_receive)(struct sk_buff **head,
-                                               struct sk_buff *skb);
+                                                 struct sk_buff *skb);
         int                     (*gro_complete)(struct sk_buff *skb, int nhoff);
 };
 
@@ -1979,10 +1985,21 @@ struct packet_offload {
         struct list_head         list;
 };
 
+struct udp_offload;
+
+struct udp_offload_callbacks {
+        struct sk_buff          **(*gro_receive)(struct sk_buff **head,
+                                                 struct sk_buff *skb,
+                                                 struct udp_offload *uoff);
+        int                     (*gro_complete)(struct sk_buff *skb,
+                                                int nhoff,
+                                                struct udp_offload *uoff);
+};
+
 struct udp_offload {
         __be16                   port;
         u8                       ipproto;
-        struct offload_callbacks callbacks;
+        struct udp_offload_callbacks callbacks;
 };
 
 /* often modified stats are per cpu, other are shared (netdev->stats) */
@@ -2041,6 +2058,7 @@ struct pcpu_sw_netstats {
 #define NETDEV_RESEND_IGMP      0x0016
 #define NETDEV_PRECHANGEMTU     0x0017 /* notify before mtu change happened */
 #define NETDEV_CHANGEINFODATA   0x0018
+#define NETDEV_BONDING_INFO     0x0019
 
 int register_netdevice_notifier(struct notifier_block *nb);
 int unregister_netdevice_notifier(struct notifier_block *nb);
@@ -2303,6 +2321,21 @@ do {									\
                                            compute_pseudo(skb, proto)); \
 } while (0)
 
+static inline void skb_gro_remcsum_process(struct sk_buff *skb, void *ptr,
+                                           int start, int offset)
+{
+        __wsum delta;
+
+        BUG_ON(!NAPI_GRO_CB(skb)->csum_valid);
+
+        delta = remcsum_adjust(ptr, NAPI_GRO_CB(skb)->csum, start, offset);
+
+        /* Adjust skb->csum since we changed the packet */
+        skb->csum = csum_add(skb->csum, delta);
+        NAPI_GRO_CB(skb)->csum = csum_add(NAPI_GRO_CB(skb)->csum, delta);
+}
+
+
 static inline int dev_hard_header(struct sk_buff *skb, struct net_device *dev,
                                   unsigned short type,
                                   const void *daddr, const void *saddr,
@@ -3464,6 +3497,19 @@ struct sk_buff *__skb_gso_segment(struct sk_buff *skb,
 struct sk_buff *skb_mac_gso_segment(struct sk_buff *skb,
                                     netdev_features_t features);
 
+struct netdev_bonding_info {
+        ifslave slave;
+        ifbond  master;
+};
+
+struct netdev_notifier_bonding_info {
+        struct netdev_notifier_info info; /* must be first */
+        struct netdev_bonding_info  bonding_info;
+};
+
+void netdev_bonding_info_change(struct net_device *dev,
+                                struct netdev_bonding_info *bonding_info);
+
 static inline
 struct sk_buff *skb_gso_segment(struct sk_buff *skb, netdev_features_t features)
 {
diff --git a/include/linux/phy.h b/include/linux/phy.h
index 22af8f8f5802..685809835b5c 100644
--- a/include/linux/phy.h
+++ b/include/linux/phy.h
@@ -327,6 +327,8 @@ struct phy_c45_device_ids {
  * c45_ids: 802.3-c45 Device Identifers if is_c45.
  * is_c45:  Set to true if this phy uses clause 45 addressing.
  * is_internal: Set to true if this phy is internal to a MAC.
+ * has_fixups: Set to true if this phy has fixups/quirks.
+ * suspended: Set to true if this phy has been suspended successfully.
  * state: state of the PHY for management purposes
  * dev_flags: Device-specific flags used by the PHY driver.
  * addr: Bus address of PHY
@@ -364,6 +366,7 @@ struct phy_device {
         bool is_c45;
         bool is_internal;
         bool has_fixups;
+        bool suspended;
 
         enum phy_state state;
 
@@ -565,6 +568,15 @@ struct phy_driver {
         void (*write_mmd_indirect)(struct phy_device *dev, int ptrad,
                                    int devnum, int regnum, u32 val);
 
+        /* Get the size and type of the eeprom contained within a plug-in
+         * module */
+        int (*module_info)(struct phy_device *dev,
+                           struct ethtool_modinfo *modinfo);
+
+        /* Get the eeprom information from the plug-in module */
+        int (*module_eeprom)(struct phy_device *dev,
+                             struct ethtool_eeprom *ee, u8 *data);
+
         struct device_driver driver;
 };
 #define to_phy_driver(d) container_of(d, struct phy_driver, driver)
diff --git a/include/linux/platform_data/irda-sa11x0.h b/include/linux/platform_data/irda-sa11x0.h
new file mode 100644
index 000000000000..38f77b5e56cf
--- /dev/null
+++ b/include/linux/platform_data/irda-sa11x0.h
@@ -0,0 +1,20 @@
+/*
+ *  arch/arm/include/asm/mach/irda.h
+ *
+ *  Copyright (C) 2004 Russell King.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+#ifndef __ASM_ARM_MACH_IRDA_H
+#define __ASM_ARM_MACH_IRDA_H
+
+struct irda_platform_data {
+        int (*startup)(struct device *);
+        void (*shutdown)(struct device *);
+        int (*set_power)(struct device *, unsigned int state);
+        void (*set_speed)(struct device *, unsigned int speed);
+};
+
+#endif
diff --git a/include/linux/platform_data/st21nfca.h b/include/linux/platform_data/st21nfca.h
index 5087fff96d86..cc2bdafb0c69 100644
--- a/include/linux/platform_data/st21nfca.h
+++ b/include/linux/platform_data/st21nfca.h
@@ -26,6 +26,8 @@
 struct st21nfca_nfc_platform_data {
         unsigned int gpio_ena;
         unsigned int irq_polarity;
+        bool is_ese_present;
+        bool is_uicc_present;
 };
 
 #endif /* _ST21NFCA_HCI_H_ */
diff --git a/include/linux/platform_data/st21nfcb.h b/include/linux/platform_data/st21nfcb.h
index c3b432f5b63e..b023373d9874 100644
--- a/include/linux/platform_data/st21nfcb.h
+++ b/include/linux/platform_data/st21nfcb.h
@@ -19,8 +19,6 @@
 #ifndef _ST21NFCB_NCI_H_
 #define _ST21NFCB_NCI_H_
 
-#include <linux/i2c.h>
-
 #define ST21NFCB_NCI_DRIVER_NAME "st21nfcb_nci"
 
 struct st21nfcb_nfc_platform_data {
@@ -28,4 +26,4 @@ struct st21nfcb_nfc_platform_data {
         unsigned int irq_polarity;
 };
 
-#endif /* _ST21NFCA_HCI_H_ */
+#endif /* _ST21NFCB_NCI_H_ */
diff --git a/include/linux/rhashtable.h b/include/linux/rhashtable.h
index b93fd89b2e5e..58851275fed9 100644
--- a/include/linux/rhashtable.h
+++ b/include/linux/rhashtable.h
@@ -18,16 +18,45 @@
 #ifndef _LINUX_RHASHTABLE_H
 #define _LINUX_RHASHTABLE_H
 
-#include <linux/rculist.h>
+#include <linux/compiler.h>
+#include <linux/list_nulls.h>
+#include <linux/workqueue.h>
+#include <linux/mutex.h>
+
+/*
+ * The end of the chain is marked with a special nulls marks which has
+ * the following format:
+ *
+ * +-------+-----------------------------------------------------+-+
+ * | Base  |                      Hash                           |1|
+ * +-------+-----------------------------------------------------+-+
+ *
+ * Base (4 bits) : Reserved to distinguish between multiple tables.
+ *                 Specified via &struct rhashtable_params.nulls_base.
+ * Hash (27 bits): Full hash (unmasked) of first element added to bucket
+ * 1 (1 bit)     : Nulls marker (always set)
+ *
+ * The remaining bits of the next pointer remain unused for now.
+ */
+#define RHT_BASE_BITS           4
+#define RHT_HASH_BITS           27
+#define RHT_BASE_SHIFT          RHT_HASH_BITS
 
 struct rhash_head {
         struct rhash_head __rcu         *next;
 };
 
-#define INIT_HASH_HEAD(ptr) ((ptr)->next = NULL)
-
+/**
+ * struct bucket_table - Table of hash buckets
+ * @size: Number of hash buckets
+ * @locks_mask: Mask to apply before accessing locks[]
+ * @locks: Array of spinlocks protecting individual buckets
+ * @buckets: size * hash buckets
+ */
 struct bucket_table {
         size_t                          size;
+        unsigned int                    locks_mask;
+        spinlock_t                      *locks;
         struct rhash_head __rcu         *buckets[];
 };
 
@@ -45,11 +74,16 @@ struct rhashtable;
  * @hash_rnd: Seed to use while hashing
  * @max_shift: Maximum number of shifts while expanding
  * @min_shift: Minimum number of shifts while shrinking
+ * @nulls_base: Base value to generate nulls marker
+ * @locks_mul: Number of bucket locks to allocate per cpu (default: 128)
  * @hashfn: Function to hash key
  * @obj_hashfn: Function to hash object
  * @grow_decision: If defined, may return true if table should expand
  * @shrink_decision: If defined, may return true if table should shrink
- * @mutex_is_held: Must return true if protecting mutex is held
+ *
+ * Note: when implementing the grow and shrink decision function, min/max
+ * shift must be enforced, otherwise, resizing watermarks they set may be
+ * useless.
  */
 struct rhashtable_params {
         size_t                  nelem_hint;
@@ -59,36 +93,95 @@ struct rhashtable_params {
         u32                     hash_rnd;
         size_t                  max_shift;
         size_t                  min_shift;
+        u32                     nulls_base;
+        size_t                  locks_mul;
         rht_hashfn_t            hashfn;
         rht_obj_hashfn_t        obj_hashfn;
         bool                    (*grow_decision)(const struct rhashtable *ht,
                                                  size_t new_size);
         bool                    (*shrink_decision)(const struct rhashtable *ht,
                                                    size_t new_size);
-#ifdef CONFIG_PROVE_LOCKING
-        int                     (*mutex_is_held)(void *parent);
-        void                    *parent;
-#endif
 };
 
 /**
  * struct rhashtable - Hash table handle
  * @tbl: Bucket table
+ * @future_tbl: Table under construction during expansion/shrinking
  * @nelems: Number of elements in table
  * @shift: Current size (1 << shift)
  * @p: Configuration parameters
+ * @run_work: Deferred worker to expand/shrink asynchronously
+ * @mutex: Mutex to protect current/future table swapping
+ * @walkers: List of active walkers
+ * @being_destroyed: True if table is set up for destruction
  */
 struct rhashtable {
         struct bucket_table __rcu       *tbl;
-        size_t                          nelems;
-        size_t                          shift;
+        struct bucket_table __rcu       *future_tbl;
+        atomic_t                        nelems;
+        atomic_t                        shift;
         struct rhashtable_params        p;
+        struct work_struct              run_work;
+        struct mutex                    mutex;
+        struct list_head                walkers;
+        bool                            being_destroyed;
+};
+
+/**
+ * struct rhashtable_walker - Hash table walker
+ * @list: List entry on list of walkers
+ * @resize: Resize event occured
+ */
+struct rhashtable_walker {
+        struct list_head list;
+        bool resize;
 };
 
+/**
+ * struct rhashtable_iter - Hash table iterator, fits into netlink cb
+ * @ht: Table to iterate through
+ * @p: Current pointer
+ * @walker: Associated rhashtable walker
+ * @slot: Current slot
+ * @skip: Number of entries to skip in slot
+ */
+struct rhashtable_iter {
+        struct rhashtable *ht;
+        struct rhash_head *p;
+        struct rhashtable_walker *walker;
+        unsigned int slot;
+        unsigned int skip;
+};
+
+static inline unsigned long rht_marker(const struct rhashtable *ht, u32 hash)
+{
+        return NULLS_MARKER(ht->p.nulls_base + hash);
+}
+
+#define INIT_RHT_NULLS_HEAD(ptr, ht, hash) \
+        ((ptr) = (typeof(ptr)) rht_marker(ht, hash))
+
+static inline bool rht_is_a_nulls(const struct rhash_head *ptr)
+{
+        return ((unsigned long) ptr & 1);
+}
+
+static inline unsigned long rht_get_nulls_value(const struct rhash_head *ptr)
+{
+        return ((unsigned long) ptr) >> 1;
+}
+
 #ifdef CONFIG_PROVE_LOCKING
-int lockdep_rht_mutex_is_held(const struct rhashtable *ht);
+int lockdep_rht_mutex_is_held(struct rhashtable *ht);
+int lockdep_rht_bucket_is_held(const struct bucket_table *tbl, u32 hash);
 #else
-static inline int lockdep_rht_mutex_is_held(const struct rhashtable *ht)
+static inline int lockdep_rht_mutex_is_held(struct rhashtable *ht)
+{
+        return 1;
+}
+
+static inline int lockdep_rht_bucket_is_held(const struct bucket_table *tbl,
+                                             u32 hash)
 {
         return 1;
 }
@@ -96,13 +189,8 @@ static inline int lockdep_rht_mutex_is_held(const struct rhashtable *ht)
 
 int rhashtable_init(struct rhashtable *ht, struct rhashtable_params *params);
 
-u32 rhashtable_hashfn(const struct rhashtable *ht, const void *key, u32 len);
-u32 rhashtable_obj_hashfn(const struct rhashtable *ht, void *ptr);
-
 void rhashtable_insert(struct rhashtable *ht, struct rhash_head *node);
 bool rhashtable_remove(struct rhashtable *ht, struct rhash_head *node);
-void rhashtable_remove_pprev(struct rhashtable *ht, struct rhash_head *obj,
-                             struct rhash_head __rcu **pprev);
 
 bool rht_grow_above_75(const struct rhashtable *ht, size_t new_size);
 bool rht_shrink_below_30(const struct rhashtable *ht, size_t new_size);
@@ -110,11 +198,23 @@ bool rht_shrink_below_30(const struct rhashtable *ht, size_t new_size);
 int rhashtable_expand(struct rhashtable *ht);
 int rhashtable_shrink(struct rhashtable *ht);
 
-void *rhashtable_lookup(const struct rhashtable *ht, const void *key);
-void *rhashtable_lookup_compare(const struct rhashtable *ht, u32 hash,
+void *rhashtable_lookup(struct rhashtable *ht, const void *key);
+void *rhashtable_lookup_compare(struct rhashtable *ht, const void *key,
                                 bool (*compare)(void *, void *), void *arg);
 
-void rhashtable_destroy(const struct rhashtable *ht);
+bool rhashtable_lookup_insert(struct rhashtable *ht, struct rhash_head *obj);
+bool rhashtable_lookup_compare_insert(struct rhashtable *ht,
+                                      struct rhash_head *obj,
+                                      bool (*compare)(void *, void *),
+                                      void *arg);
+
+int rhashtable_walk_init(struct rhashtable *ht, struct rhashtable_iter *iter);
+void rhashtable_walk_exit(struct rhashtable_iter *iter);
+int rhashtable_walk_start(struct rhashtable_iter *iter) __acquires(RCU);
+void *rhashtable_walk_next(struct rhashtable_iter *iter);
+void rhashtable_walk_stop(struct rhashtable_iter *iter) __releases(RCU);
+
+void rhashtable_destroy(struct rhashtable *ht);
 
 #define rht_dereference(p, ht) \
         rcu_dereference_protected(p, lockdep_rht_mutex_is_held(ht))
@@ -122,92 +222,146 @@ void rhashtable_destroy(const struct rhashtable *ht);
 #define rht_dereference_rcu(p, ht) \
         rcu_dereference_check(p, lockdep_rht_mutex_is_held(ht))
 
-#define rht_entry(ptr, type, member) container_of(ptr, type, member)
-#define rht_entry_safe(ptr, type, member) \
-({ \
-        typeof(ptr) __ptr = (ptr); \
-           __ptr ? rht_entry(__ptr, type, member) : NULL; \
-})
+#define rht_dereference_bucket(p, tbl, hash) \
+        rcu_dereference_protected(p, lockdep_rht_bucket_is_held(tbl, hash))
+
+#define rht_dereference_bucket_rcu(p, tbl, hash) \
+        rcu_dereference_check(p, lockdep_rht_bucket_is_held(tbl, hash))
 
-#define rht_next_entry_safe(pos, ht, member) \
-({ \
-        pos ? rht_entry_safe(rht_dereference((pos)->member.next, ht), \
-                             typeof(*(pos)), member) : NULL; \
-})
+#define rht_entry(tpos, pos, member) \
+        ({ tpos = container_of(pos, typeof(*tpos), member); 1; })
+
+/**
+ * rht_for_each_continue - continue iterating over hash chain
+ * @pos:        the &struct rhash_head to use as a loop cursor.
+ * @head:       the previous &struct rhash_head to continue from
+ * @tbl:        the &struct bucket_table
+ * @hash:       the hash value / bucket index
+ */
+#define rht_for_each_continue(pos, head, tbl, hash) \
+        for (pos = rht_dereference_bucket(head, tbl, hash); \
+             !rht_is_a_nulls(pos); \
+             pos = rht_dereference_bucket((pos)->next, tbl, hash))
 
 /**
  * rht_for_each - iterate over hash chain
- * @pos:        &struct rhash_head to use as a loop cursor.
- * @head:       head of the hash chain (struct rhash_head *)
- * @ht:         pointer to your struct rhashtable
+ * @pos:        the &struct rhash_head to use as a loop cursor.
+ * @tbl:        the &struct bucket_table
+ * @hash:       the hash value / bucket index
  */
-#define rht_for_each(pos, head, ht) \
-        for (pos = rht_dereference(head, ht); \
-             pos; \
-             pos = rht_dereference((pos)->next, ht))
+#define rht_for_each(pos, tbl, hash) \
+        rht_for_each_continue(pos, (tbl)->buckets[hash], tbl, hash)
+
+/**
+ * rht_for_each_entry_continue - continue iterating over hash chain
+ * @tpos:       the type * to use as a loop cursor.
+ * @pos:        the &struct rhash_head to use as a loop cursor.
+ * @head:       the previous &struct rhash_head to continue from
+ * @tbl:        the &struct bucket_table
+ * @hash:       the hash value / bucket index
+ * @member:     name of the &struct rhash_head within the hashable struct.
+ */
+#define rht_for_each_entry_continue(tpos, pos, head, tbl, hash, member) \
+        for (pos = rht_dereference_bucket(head, tbl, hash);             \
+             (!rht_is_a_nulls(pos)) && rht_entry(tpos, pos, member);    \
+             pos = rht_dereference_bucket((pos)->next, tbl, hash))
 
 /**
  * rht_for_each_entry - iterate over hash chain of given type
- * @pos:        type * to use as a loop cursor.
- * @head:       head of the hash chain (struct rhash_head *)
- * @ht:         pointer to your struct rhashtable
- * @member:     name of the rhash_head within the hashable struct.
+ * @tpos:       the type * to use as a loop cursor.
+ * @pos:        the &struct rhash_head to use as a loop cursor.
+ * @tbl:        the &struct bucket_table
+ * @hash:       the hash value / bucket index
+ * @member:     name of the &struct rhash_head within the hashable struct.
  */
-#define rht_for_each_entry(pos, head, ht, member) \
-        for (pos = rht_entry_safe(rht_dereference(head, ht), \
-                                   typeof(*(pos)), member); \
-             pos; \
-             pos = rht_next_entry_safe(pos, ht, member))
+#define rht_for_each_entry(tpos, pos, tbl, hash, member)                \
+        rht_for_each_entry_continue(tpos, pos, (tbl)->buckets[hash],    \
+                                    tbl, hash, member)
 
 /**
  * rht_for_each_entry_safe - safely iterate over hash chain of given type
- * @pos:        type * to use as a loop cursor.
- * @n:          type * to use for temporary next object storage
- * @head:       head of the hash chain (struct rhash_head *)
- * @ht:         pointer to your struct rhashtable
- * @member:     name of the rhash_head within the hashable struct.
+ * @tpos:       the type * to use as a loop cursor.
+ * @pos:        the &struct rhash_head to use as a loop cursor.
+ * @next:       the &struct rhash_head to use as next in loop cursor.
+ * @tbl:        the &struct bucket_table
+ * @hash:       the hash value / bucket index
+ * @member:     name of the &struct rhash_head within the hashable struct.
  *
  * This hash chain list-traversal primitive allows for the looped code to
  * remove the loop cursor from the list.
  */
-#define rht_for_each_entry_safe(pos, n, head, ht, member)               \
-        for (pos = rht_entry_safe(rht_dereference(head, ht), \
-                                  typeof(*(pos)), member), \
-             n = rht_next_entry_safe(pos, ht, member); \
-             pos; \
-             pos = n, \
-             n = rht_next_entry_safe(pos, ht, member))
+#define rht_for_each_entry_safe(tpos, pos, next, tbl, hash, member)         \
+        for (pos = rht_dereference_bucket((tbl)->buckets[hash], tbl, hash), \
+             next = !rht_is_a_nulls(pos) ?                                  \
+                       rht_dereference_bucket(pos->next, tbl, hash) : NULL; \
+             (!rht_is_a_nulls(pos)) && rht_entry(tpos, pos, member);        \
+             pos = next,                                                    \
+             next = !rht_is_a_nulls(pos) ?                                  \
+                       rht_dereference_bucket(pos->next, tbl, hash) : NULL)
+
+/**
+ * rht_for_each_rcu_continue - continue iterating over rcu hash chain
+ * @pos:        the &struct rhash_head to use as a loop cursor.
+ * @head:       the previous &struct rhash_head to continue from
+ * @tbl:        the &struct bucket_table
+ * @hash:       the hash value / bucket index
+ *
+ * This hash chain list-traversal primitive may safely run concurrently with
+ * the _rcu mutation primitives such as rhashtable_insert() as long as the
+ * traversal is guarded by rcu_read_lock().
+ */
+#define rht_for_each_rcu_continue(pos, head, tbl, hash)                 \
+        for (({barrier(); }),                                           \
+             pos = rht_dereference_bucket_rcu(head, tbl, hash);         \
+             !rht_is_a_nulls(pos);                                      \
+             pos = rcu_dereference_raw(pos->next))
 
 /**
  * rht_for_each_rcu - iterate over rcu hash chain
- * @pos:        &struct rhash_head to use as a loop cursor.
- * @head:       head of the hash chain (struct rhash_head *)
- * @ht:         pointer to your struct rhashtable
+ * @pos:        the &struct rhash_head to use as a loop cursor.
+ * @tbl:        the &struct bucket_table
+ * @hash:       the hash value / bucket index
+ *
+ * This hash chain list-traversal primitive may safely run concurrently with
+ * the _rcu mutation primitives such as rhashtable_insert() as long as the
+ * traversal is guarded by rcu_read_lock().
+ */
+#define rht_for_each_rcu(pos, tbl, hash)                                \
+        rht_for_each_rcu_continue(pos, (tbl)->buckets[hash], tbl, hash)
+
+/**
+ * rht_for_each_entry_rcu_continue - continue iterating over rcu hash chain
+ * @tpos:       the type * to use as a loop cursor.
+ * @pos:        the &struct rhash_head to use as a loop cursor.
+ * @head:       the previous &struct rhash_head to continue from
+ * @tbl:        the &struct bucket_table
+ * @hash:       the hash value / bucket index
+ * @member:     name of the &struct rhash_head within the hashable struct.
  *
  * This hash chain list-traversal primitive may safely run concurrently with
- * the _rcu fkht mutation primitives such as rht_insert() as long as the
+ * the _rcu mutation primitives such as rhashtable_insert() as long as the
  * traversal is guarded by rcu_read_lock().
  */
-#define rht_for_each_rcu(pos, head, ht) \
-        for (pos = rht_dereference_rcu(head, ht); \
-             pos; \
-             pos = rht_dereference_rcu((pos)->next, ht))
+#define rht_for_each_entry_rcu_continue(tpos, pos, head, tbl, hash, member) \
+        for (({barrier(); }),                                               \
+             pos = rht_dereference_bucket_rcu(head, tbl, hash);             \
+             (!rht_is_a_nulls(pos)) && rht_entry(tpos, pos, member);        \
+             pos = rht_dereference_bucket_rcu(pos->next, tbl, hash))
 
 /**
  * rht_for_each_entry_rcu - iterate over rcu hash chain of given type
- * @pos:        type * to use as a loop cursor.
- * @head:       head of the hash chain (struct rhash_head *)
- * @member:     name of the rhash_head within the hashable struct.
+ * @tpos:       the type * to use as a loop cursor.
+ * @pos:        the &struct rhash_head to use as a loop cursor.
+ * @tbl:        the &struct bucket_table
+ * @hash:       the hash value / bucket index
+ * @member:     name of the &struct rhash_head within the hashable struct.
  *
  * This hash chain list-traversal primitive may safely run concurrently with
- * the _rcu fkht mutation primitives such as rht_insert() as long as the
+ * the _rcu mutation primitives such as rhashtable_insert() as long as the
  * traversal is guarded by rcu_read_lock().
  */
-#define rht_for_each_entry_rcu(pos, head, member) \
-        for (pos = rht_entry_safe(rcu_dereference_raw(head), \
-                                  typeof(*(pos)), member); \
-             pos; \
-             pos = rht_entry_safe(rcu_dereference_raw((pos)->member.next), \
-                                  typeof(*(pos)), member))
+#define rht_for_each_entry_rcu(tpos, pos, tbl, hash, member)            \
+        rht_for_each_entry_rcu_continue(tpos, pos, (tbl)->buckets[hash],\
+                                        tbl, hash, member)
 
 #endif /* _LINUX_RHASHTABLE_H */
diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h
index 85ab7d72b54c..1bb36edb66b9 100644
--- a/include/linux/skbuff.h
+++ b/include/linux/skbuff.h
@@ -626,8 +626,11 @@ struct sk_buff {
         __u32                   hash;
         __be16                  vlan_proto;
         __u16                   vlan_tci;
-#ifdef CONFIG_NET_RX_BUSY_POLL
-        unsigned int    napi_id;
+#if defined(CONFIG_NET_RX_BUSY_POLL) || defined(CONFIG_XPS)
+        union {
+                unsigned int    napi_id;
+                unsigned int    sender_cpu;
+        };
 #endif
 #ifdef CONFIG_NETWORK_SECMARK
         __u32                   secmark;
@@ -2484,19 +2487,18 @@ static inline int skb_put_padto(struct sk_buff *skb, unsigned int len)
 }
 
 static inline int skb_add_data(struct sk_buff *skb,
-                               char __user *from, int copy)
+                               struct iov_iter *from, int copy)
 {
         const int off = skb->len;
 
         if (skb->ip_summed == CHECKSUM_NONE) {
-                int err = 0;
-                __wsum csum = csum_and_copy_from_user(from, skb_put(skb, copy),
-                                                            copy, 0, &err);
-                if (!err) {
+                __wsum csum = 0;
+                if (csum_and_copy_from_iter(skb_put(skb, copy), copy,
+                                            &csum, from) == copy) {
                         skb->csum = csum_block_add(skb->csum, csum, off);
                         return 0;
                 }
-        } else if (!copy_from_user(skb_put(skb, copy), from, copy))
+        } else if (copy_from_iter(skb_put(skb, copy), copy, from) == copy)
                 return 0;
 
         __skb_trim(skb, off);
@@ -2693,8 +2695,7 @@ int skb_vlan_push(struct sk_buff *skb, __be16 vlan_proto, u16 vlan_tci);
 
 static inline int memcpy_from_msg(void *data, struct msghdr *msg, int len)
 {
-        /* XXX: stripping const */
-        return memcpy_fromiovec(data, (struct iovec *)msg->msg_iter.iov, len);
+        return copy_from_iter(data, len, &msg->msg_iter) == len ? 0 : -EFAULT;
 }
 
 static inline int memcpy_to_msg(struct msghdr *msg, void *data, int len)
@@ -3071,7 +3072,7 @@ static inline __wsum null_compute_pseudo(struct sk_buff *skb, int proto)
 
 #define skb_checksum_validate_zero_check(skb, proto, check,             \
                                          compute_pseudo)                \
-        __skb_checksum_validate_(skb, proto, true, true, check, compute_pseudo)
+        __skb_checksum_validate(skb, proto, true, true, check, compute_pseudo)
 
 #define skb_checksum_simple_validate(skb)                               \
         __skb_checksum_validate(skb, 0, true, false, 0, null_compute_pseudo)
@@ -3096,6 +3097,27 @@ do {									\
                                        compute_pseudo(skb, proto));     \
 } while (0)
 
+/* Update skbuf and packet to reflect the remote checksum offload operation.
+ * When called, ptr indicates the starting point for skb->csum when
+ * ip_summed is CHECKSUM_COMPLETE. If we need create checksum complete
+ * here, skb_postpull_rcsum is done so skb->csum start is ptr.
+ */
+static inline void skb_remcsum_process(struct sk_buff *skb, void *ptr,
+                                       int start, int offset)
+{
+        __wsum delta;
+
+         if (unlikely(skb->ip_summed != CHECKSUM_COMPLETE)) {
+                __skb_checksum_complete(skb);
+                skb_postpull_rcsum(skb, skb->data, ptr - (void *)skb->data);
+        }
+
+        delta = remcsum_adjust(ptr, skb->csum, start, offset);
+
+        /* Adjust skb->csum since we changed the packet */
+        skb->csum = csum_add(skb->csum, delta);
+}
+
 #if defined(CONFIG_NF_CONNTRACK) || defined(CONFIG_NF_CONNTRACK_MODULE)
 void nf_conntrack_destroy(struct nf_conntrack *nfct);
 static inline void nf_conntrack_put(struct nf_conntrack *nfct)
diff --git a/include/linux/socket.h b/include/linux/socket.h
index 6e49a14365dc..5c19cba34dce 100644
--- a/include/linux/socket.h
+++ b/include/linux/socket.h
@@ -318,13 +318,6 @@ struct ucred {
 /* IPX options */
 #define IPX_TYPE        1
 
-extern int csum_partial_copy_fromiovecend(unsigned char *kdata, 
-                                          struct iovec *iov, 
-                                          int offset, 
-                                          unsigned int len, __wsum *csump);
-extern unsigned long iov_pages(const struct iovec *iov, int offset,
-                               unsigned long nr_segs);
-
 extern int move_addr_to_kernel(void __user *uaddr, int ulen, struct sockaddr_storage *kaddr);
 extern int put_cmsg(struct msghdr*, int level, int type, int len, void *data);
 
diff --git a/include/linux/spinlock.h b/include/linux/spinlock.h
index 262ba4ef9a8e..3e18379dfa6f 100644
--- a/include/linux/spinlock.h
+++ b/include/linux/spinlock.h
@@ -190,6 +190,8 @@ static inline void do_raw_spin_unlock(raw_spinlock_t *lock) __releases(lock)
 #ifdef CONFIG_DEBUG_LOCK_ALLOC
 # define raw_spin_lock_nested(lock, subclass) \
         _raw_spin_lock_nested(lock, subclass)
+# define raw_spin_lock_bh_nested(lock, subclass) \
+        _raw_spin_lock_bh_nested(lock, subclass)
 
 # define raw_spin_lock_nest_lock(lock, nest_lock)                       \
          do {                                                           \
@@ -205,6 +207,7 @@ static inline void do_raw_spin_unlock(raw_spinlock_t *lock) __releases(lock)
 # define raw_spin_lock_nested(lock, subclass)           \
         _raw_spin_lock(((void)(subclass), (lock)))
 # define raw_spin_lock_nest_lock(lock, nest_lock)       _raw_spin_lock(lock)
+# define raw_spin_lock_bh_nested(lock, subclass)        _raw_spin_lock_bh(lock)
 #endif
 
 #if defined(CONFIG_SMP) || defined(CONFIG_DEBUG_SPINLOCK)
@@ -324,6 +327,11 @@ do {								\
         raw_spin_lock_nested(spinlock_check(lock), subclass);   \
 } while (0)
 
+#define spin_lock_bh_nested(lock, subclass)                     \
+do {                                                            \
+        raw_spin_lock_bh_nested(spinlock_check(lock), subclass);\
+} while (0)
+
 #define spin_lock_nest_lock(lock, nest_lock)                            \
 do {                                                                    \
         raw_spin_lock_nest_lock(spinlock_check(lock), nest_lock);       \
diff --git a/include/linux/spinlock_api_smp.h b/include/linux/spinlock_api_smp.h
index 42dfab89e740..5344268e6e62 100644
--- a/include/linux/spinlock_api_smp.h
+++ b/include/linux/spinlock_api_smp.h
@@ -22,6 +22,8 @@ int in_lock_functions(unsigned long addr);
 void __lockfunc _raw_spin_lock(raw_spinlock_t *lock)            __acquires(lock);
 void __lockfunc _raw_spin_lock_nested(raw_spinlock_t *lock, int subclass)
                                                                 __acquires(lock);
+void __lockfunc _raw_spin_lock_bh_nested(raw_spinlock_t *lock, int subclass)
+                                                                __acquires(lock);
 void __lockfunc
 _raw_spin_lock_nest_lock(raw_spinlock_t *lock, struct lockdep_map *map)
                                                                 __acquires(lock);
diff --git a/include/linux/spinlock_api_up.h b/include/linux/spinlock_api_up.h
index d0d188861ad6..d3afef9d8dbe 100644
--- a/include/linux/spinlock_api_up.h
+++ b/include/linux/spinlock_api_up.h
@@ -57,6 +57,7 @@
 
 #define _raw_spin_lock(lock)                    __LOCK(lock)
 #define _raw_spin_lock_nested(lock, subclass)   __LOCK(lock)
+#define _raw_spin_lock_bh_nested(lock, subclass) __LOCK(lock)
 #define _raw_read_lock(lock)                    __LOCK(lock)
 #define _raw_write_lock(lock)                   __LOCK(lock)
 #define _raw_spin_lock_bh(lock)                 __LOCK_BH(lock)
diff --git a/include/linux/ssb/ssb_regs.h b/include/linux/ssb/ssb_regs.h
index f7b9100686c3..c0f707ac192b 100644
--- a/include/linux/ssb/ssb_regs.h
+++ b/include/linux/ssb/ssb_regs.h
@@ -173,6 +173,7 @@
 #define SSB_SPROMSIZE_BYTES_R123        (SSB_SPROMSIZE_WORDS_R123 * sizeof(u16))
 #define SSB_SPROMSIZE_BYTES_R4          (SSB_SPROMSIZE_WORDS_R4 * sizeof(u16))
 #define SSB_SPROMSIZE_WORDS_R10         230
+#define SSB_SPROMSIZE_WORDS_R11         234
 #define SSB_SPROM_BASE1                 0x1000
 #define SSB_SPROM_BASE31                0x0800
 #define SSB_SPROM_REVISION              0x007E
diff --git a/include/linux/tcp.h b/include/linux/tcp.h
index 67309ece0772..1a7adb411647 100644
--- a/include/linux/tcp.h
+++ b/include/linux/tcp.h
@@ -115,6 +115,7 @@ struct tcp_request_sock {
         u32                             rcv_isn;
         u32                             snt_isn;
         u32                             snt_synack; /* synack sent time */
+        u32                             last_oow_ack_time; /* last SYNACK */
         u32                             rcv_nxt; /* the ack # by SYNACK. For
                                                   * FastOpen it's the seq#
                                                   * after data-in-SYN.
@@ -152,6 +153,7 @@ struct tcp_sock {
         u32     snd_sml;        /* Last byte of the most recently transmitted small packet */
         u32     rcv_tstamp;     /* timestamp of last received ACK (for keepalives) */
         u32     lsndtime;       /* timestamp of last sent data packet (for restart window) */
+        u32     last_oow_ack_time;  /* timestamp of last out-of-window ACK */
 
         u32     tsoffset;       /* timestamp offset */
 
@@ -340,6 +342,10 @@ struct tcp_timewait_sock {
         u32                       tw_rcv_wnd;
         u32                       tw_ts_offset;
         u32                       tw_ts_recent;
+
+        /* The time we sent the last out-of-window ACK: */
+        u32                       tw_last_oow_ack_time;
+
         long                      tw_ts_recent_stamp;
 #ifdef CONFIG_TCP_MD5SIG
         struct tcp_md5sig_key     *tw_md5_key;
diff --git a/include/linux/timecounter.h b/include/linux/timecounter.h
new file mode 100644
index 000000000000..4382035a75bb
--- /dev/null
+++ b/include/linux/timecounter.h
@@ -0,0 +1,139 @@
+/*
+ * linux/include/linux/timecounter.h
+ *
+ * based on code that migrated away from
+ * linux/include/linux/clocksource.h
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+#ifndef _LINUX_TIMECOUNTER_H
+#define _LINUX_TIMECOUNTER_H
+
+#include <linux/types.h>
+
+/* simplify initialization of mask field */
+#define CYCLECOUNTER_MASK(bits) (cycle_t)((bits) < 64 ? ((1ULL<<(bits))-1) : -1)
+
+/**
+ * struct cyclecounter - hardware abstraction for a free running counter
+ *      Provides completely state-free accessors to the underlying hardware.
+ *      Depending on which hardware it reads, the cycle counter may wrap
+ *      around quickly. Locking rules (if necessary) have to be defined
+ *      by the implementor and user of specific instances of this API.
+ *
+ * @read:               returns the current cycle value
+ * @mask:               bitmask for two's complement
+ *                      subtraction of non 64 bit counters,
+ *                      see CYCLECOUNTER_MASK() helper macro
+ * @mult:               cycle to nanosecond multiplier
+ * @shift:              cycle to nanosecond divisor (power of two)
+ */
+struct cyclecounter {
+        cycle_t (*read)(const struct cyclecounter *cc);
+        cycle_t mask;
+        u32 mult;
+        u32 shift;
+};
+
+/**
+ * struct timecounter - layer above a %struct cyclecounter which counts nanoseconds
+ *      Contains the state needed by timecounter_read() to detect
+ *      cycle counter wrap around. Initialize with
+ *      timecounter_init(). Also used to convert cycle counts into the
+ *      corresponding nanosecond counts with timecounter_cyc2time(). Users
+ *      of this code are responsible for initializing the underlying
+ *      cycle counter hardware, locking issues and reading the time
+ *      more often than the cycle counter wraps around. The nanosecond
+ *      counter will only wrap around after ~585 years.
+ *
+ * @cc:                 the cycle counter used by this instance
+ * @cycle_last:         most recent cycle counter value seen by
+ *                      timecounter_read()
+ * @nsec:               continuously increasing count
+ * @mask:               bit mask for maintaining the 'frac' field
+ * @frac:               accumulated fractional nanoseconds
+ */
+struct timecounter {
+        const struct cyclecounter *cc;
+        cycle_t cycle_last;
+        u64 nsec;
+        u64 mask;
+        u64 frac;
+};
+
+/**
+ * cyclecounter_cyc2ns - converts cycle counter cycles to nanoseconds
+ * @cc:         Pointer to cycle counter.
+ * @cycles:     Cycles
+ * @mask:       bit mask for maintaining the 'frac' field
+ * @frac:       pointer to storage for the fractional nanoseconds.
+ */
+static inline u64 cyclecounter_cyc2ns(const struct cyclecounter *cc,
+                                      cycle_t cycles, u64 mask, u64 *frac)
+{
+        u64 ns = (u64) cycles;
+
+        ns = (ns * cc->mult) + *frac;
+        *frac = ns & mask;
+        return ns >> cc->shift;
+}
+
+/**
+ * timecounter_adjtime - Shifts the time of the clock.
+ * @delta:      Desired change in nanoseconds.
+ */
+static inline void timecounter_adjtime(struct timecounter *tc, s64 delta)
+{
+        tc->nsec += delta;
+}
+
+/**
+ * timecounter_init - initialize a time counter
+ * @tc:                 Pointer to time counter which is to be initialized/reset
+ * @cc:                 A cycle counter, ready to be used.
+ * @start_tstamp:       Arbitrary initial time stamp.
+ *
+ * After this call the current cycle register (roughly) corresponds to
+ * the initial time stamp. Every call to timecounter_read() increments
+ * the time stamp counter by the number of elapsed nanoseconds.
+ */
+extern void timecounter_init(struct timecounter *tc,
+                             const struct cyclecounter *cc,
+                             u64 start_tstamp);
+
+/**
+ * timecounter_read - return nanoseconds elapsed since timecounter_init()
+ *                    plus the initial time stamp
+ * @tc:          Pointer to time counter.
+ *
+ * In other words, keeps track of time since the same epoch as
+ * the function which generated the initial time stamp.
+ */
+extern u64 timecounter_read(struct timecounter *tc);
+
+/**
+ * timecounter_cyc2time - convert a cycle counter to same
+ *                        time base as values returned by
+ *                        timecounter_read()
+ * @tc:         Pointer to time counter.
+ * @cycle_tstamp:       a value returned by tc->cc->read()
+ *
+ * Cycle counts that are converted correctly as long as they
+ * fall into the interval [-1/2 max cycle count, +1/2 max cycle count],
+ * with "max cycle count" == cs->mask+1.
+ *
+ * This allows conversion of cycle counter values which were generated
+ * in the past.
+ */
+extern u64 timecounter_cyc2time(struct timecounter *tc,
+                                cycle_t cycle_tstamp);
+
+#endif
diff --git a/include/linux/types.h b/include/linux/types.h
index a0bb7048687f..62323825cff9 100644
--- a/include/linux/types.h
+++ b/include/linux/types.h
@@ -213,5 +213,8 @@ struct callback_head {
 };
 #define rcu_head callback_head
 
+/* clocksource cycle base type */
+typedef u64 cycle_t;
+
 #endif /*  __ASSEMBLY__ */
 #endif /* _LINUX_TYPES_H */
diff --git a/include/linux/udp.h b/include/linux/udp.h
index ee3277593222..247cfdcc4b08 100644
--- a/include/linux/udp.h
+++ b/include/linux/udp.h
@@ -49,11 +49,7 @@ struct udp_sock {
         unsigned int     corkflag;      /* Cork is required */
         __u8             encap_type;    /* Is this an Encapsulation socket? */
         unsigned char    no_check6_tx:1,/* Send zero UDP6 checksums on TX? */
-                         no_check6_rx:1,/* Allow zero UDP6 checksums on RX? */
-                         convert_csum:1;/* On receive, convert checksum
-                                         * unnecessary to checksum complete
-                                         * if possible.
-                                         */
+                         no_check6_rx:1;/* Allow zero UDP6 checksums on RX? */
         /*
          * Following member retains the information to create a UDP header
          * when the socket is uncorked.
@@ -102,16 +98,6 @@ static inline bool udp_get_no_check6_rx(struct sock *sk)
         return udp_sk(sk)->no_check6_rx;
 }
 
-static inline void udp_set_convert_csum(struct sock *sk, bool val)
-{
-        udp_sk(sk)->convert_csum = val;
-}
-
-static inline bool udp_get_convert_csum(struct sock *sk)
-{
-        return udp_sk(sk)->convert_csum;
-}
-
 #define udp_portaddr_for_each_entry(__sk, node, list) \
         hlist_nulls_for_each_entry(__sk, node, list, __sk_common.skc_portaddr_node)
 
diff --git a/include/linux/uio.h b/include/linux/uio.h
index 1c5e453f7ea9..3e0cb4ea3905 100644
--- a/include/linux/uio.h
+++ b/include/linux/uio.h
@@ -135,10 +135,4 @@ static inline void iov_iter_reexpand(struct iov_iter *i, size_t count)
 size_t csum_and_copy_to_iter(void *addr, size_t bytes, __wsum *csum, struct iov_iter *i);
 size_t csum_and_copy_from_iter(void *addr, size_t bytes, __wsum *csum, struct iov_iter *i);
 
-int memcpy_fromiovec(unsigned char *kdata, struct iovec *iov, int len);
-int memcpy_fromiovecend(unsigned char *kdata, const struct iovec *iov,
-                        int offset, int len);
-int memcpy_toiovecend(const struct iovec *v, unsigned char *kdata,
-                      int offset, int len);
-
 #endif
diff --git a/include/linux/vmw_vmci_api.h b/include/linux/vmw_vmci_api.h
index 5691f752ce8f..63df3a2a8ce5 100644
--- a/include/linux/vmw_vmci_api.h
+++ b/include/linux/vmw_vmci_api.h
@@ -74,7 +74,7 @@ ssize_t vmci_qpair_dequeue(struct vmci_qp *qpair,
 ssize_t vmci_qpair_peek(struct vmci_qp *qpair, void *buf, size_t buf_size,
                         int mode);
 ssize_t vmci_qpair_enquev(struct vmci_qp *qpair,
-                          void *iov, size_t iov_size, int mode);
+                          struct msghdr *msg, size_t iov_size, int mode);
 ssize_t vmci_qpair_dequev(struct vmci_qp *qpair,
                           struct msghdr *msg, size_t iov_size, int mode);
 ssize_t vmci_qpair_peekv(struct vmci_qp *qpair, struct msghdr *msg, size_t iov_size,
diff --git a/include/net/addrconf.h b/include/net/addrconf.h
index d13573bb879e..80456f72d70a 100644
--- a/include/net/addrconf.h
+++ b/include/net/addrconf.h
@@ -62,6 +62,9 @@ int addrconf_set_dstaddr(struct net *net, void __user *arg);
 
 int ipv6_chk_addr(struct net *net, const struct in6_addr *addr,
                   const struct net_device *dev, int strict);
+int ipv6_chk_addr_and_flags(struct net *net, const struct in6_addr *addr,
+                            const struct net_device *dev, int strict,
+                            u32 banned_flags);
 
 #if defined(CONFIG_IPV6_MIP6) || defined(CONFIG_IPV6_MIP6_MODULE)
 int ipv6_chk_home_addr(struct net *net, const struct in6_addr *addr);
diff --git a/include/net/bluetooth/bluetooth.h b/include/net/bluetooth/bluetooth.h
index 58695ffeb138..e00455aab18c 100644
--- a/include/net/bluetooth/bluetooth.h
+++ b/include/net/bluetooth/bluetooth.h
@@ -273,7 +273,7 @@ struct l2cap_ctrl {
 
 struct hci_dev;
 
-typedef void (*hci_req_complete_t)(struct hci_dev *hdev, u8 status);
+typedef void (*hci_req_complete_t)(struct hci_dev *hdev, u8 status, u16 opcode);
 
 struct hci_req_ctrl {
         bool                    start;
diff --git a/include/net/bluetooth/hci.h b/include/net/bluetooth/hci.h
index 40129b3838b2..8e54f825153c 100644
--- a/include/net/bluetooth/hci.h
+++ b/include/net/bluetooth/hci.h
@@ -102,6 +102,28 @@ enum {
          */
         HCI_QUIRK_FIXUP_BUFFER_SIZE,
 
+        /* When this quirk is set, then a controller that does not
+         * indicate support for Inquiry Result with RSSI is assumed to
+         * support it anyway. Some early Bluetooth 1.2 controllers had
+         * wrongly configured local features that will require forcing
+         * them to enable this mode. Getting RSSI information with the
+         * inquiry responses is preferred since it allows for a better
+         * user expierence.
+         *
+         * This quirk must be set before hci_register_dev is called.
+         */
+        HCI_QUIRK_FIXUP_INQUIRY_MODE,
+
+        /* When this quirk is set, then the HCI Read Local Supported
+         * Commands command is not supported. In general Bluetooth 1.2
+         * and later controllers should support this command. However
+         * some controllers indicate Bluetooth 1.2 support, but do
+         * not support this command.
+         *
+         * This quirk must be set before hci_register_dev is called.
+         */
+        HCI_QUIRK_BROKEN_LOCAL_COMMANDS,
+
         /* When this quirk is set, then no stored link key handling
          * is performed. This is mainly due to the fact that the
          * HCI Delete Stored Link Key command is advertised, but
@@ -162,8 +184,7 @@ enum {
  */
 enum {
         HCI_DUT_MODE,
-        HCI_FORCE_SC,
-        HCI_FORCE_LESC,
+        HCI_FORCE_BREDR_SMP,
         HCI_FORCE_STATIC_ADDR,
 };
 
@@ -343,6 +364,7 @@ enum {
 #define HCI_LE_ENCRYPTION               0x01
 #define HCI_LE_CONN_PARAM_REQ_PROC      0x02
 #define HCI_LE_PING                     0x10
+#define HCI_LE_DATA_LEN_EXT             0x20
 #define HCI_LE_EXT_SCAN_POLICY          0x80
 
 /* Connection modes */
@@ -833,11 +855,26 @@ struct hci_cp_set_event_flt {
 #define HCI_CONN_SETUP_AUTO_OFF 0x01
 #define HCI_CONN_SETUP_AUTO_ON  0x02
 
+#define HCI_OP_READ_STORED_LINK_KEY     0x0c0d
+struct hci_cp_read_stored_link_key {
+        bdaddr_t bdaddr;
+        __u8     read_all;
+} __packed;
+struct hci_rp_read_stored_link_key {
+        __u8     status;
+        __u8     max_keys;
+        __u8     num_keys;
+} __packed;
+
 #define HCI_OP_DELETE_STORED_LINK_KEY   0x0c12
 struct hci_cp_delete_stored_link_key {
         bdaddr_t bdaddr;
         __u8     delete_all;
 } __packed;
+struct hci_rp_delete_stored_link_key {
+        __u8     status;
+        __u8     num_keys;
+} __packed;
 
 #define HCI_MAX_NAME_LENGTH             248
 
@@ -1371,6 +1408,39 @@ struct hci_cp_le_conn_param_req_neg_reply {
         __u8    reason;
 } __packed;
 
+#define HCI_OP_LE_SET_DATA_LEN          0x2022
+struct hci_cp_le_set_data_len {
+        __le16  handle;
+        __le16  tx_len;
+        __le16  tx_time;
+} __packed;
+struct hci_rp_le_set_data_len {
+        __u8    status;
+        __le16  handle;
+} __packed;
+
+#define HCI_OP_LE_READ_DEF_DATA_LEN     0x2023
+struct hci_rp_le_read_def_data_len {
+        __u8    status;
+        __le16  tx_len;
+        __le16  tx_time;
+} __packed;
+
+#define HCI_OP_LE_WRITE_DEF_DATA_LEN    0x2024
+struct hci_cp_le_write_def_data_len {
+        __le16  tx_len;
+        __le16  tx_time;
+} __packed;
+
+#define HCI_OP_LE_READ_MAX_DATA_LEN     0x202f
+struct hci_rp_le_read_max_data_len {
+        __u8    status;
+        __le16  tx_len;
+        __le16  tx_time;
+        __le16  rx_len;
+        __le16  rx_time;
+} __packed;
+
 /* ---- HCI Events ---- */
 #define HCI_EV_INQUIRY_COMPLETE         0x01
 
@@ -1796,6 +1866,15 @@ struct hci_ev_le_remote_conn_param_req {
         __le16 timeout;
 } __packed;
 
+#define HCI_EV_LE_DATA_LEN_CHANGE       0x07
+struct hci_ev_le_data_len_change {
+        __le16  handle;
+        __le16  tx_len;
+        __le16  tx_time;
+        __le16  rx_len;
+        __le16  rx_time;
+} __packed;
+
 #define HCI_EV_LE_DIRECT_ADV_REPORT     0x0B
 struct hci_ev_le_direct_adv_info {
         __u8     evt_type;
diff --git a/include/net/bluetooth/hci_core.h b/include/net/bluetooth/hci_core.h
index 3c7827005c25..52863c3e0b13 100644
--- a/include/net/bluetooth/hci_core.h
+++ b/include/net/bluetooth/hci_core.h
@@ -79,6 +79,8 @@ struct discovery_state {
         s8                      rssi;
         u16                     uuid_count;
         u8                      (*uuids)[16];
+        unsigned long           scan_start;
+        unsigned long           scan_duration;
 };
 
 struct hci_conn_hash {
@@ -145,6 +147,7 @@ struct oob_data {
         struct list_head list;
         bdaddr_t bdaddr;
         u8 bdaddr_type;
+        u8 present;
         u8 hash192[16];
         u8 rand192[16];
         u8 hash256[16];
@@ -205,6 +208,8 @@ struct hci_dev {
         __u16           lmp_subver;
         __u16           voice_setting;
         __u8            num_iac;
+        __u8            stored_max_keys;
+        __u8            stored_num_keys;
         __u8            io_capability;
         __s8            inq_tx_power;
         __u16           page_scan_interval;
@@ -220,10 +225,17 @@ struct hci_dev {
         __u16           le_conn_max_interval;
         __u16           le_conn_latency;
         __u16           le_supv_timeout;
+        __u16           le_def_tx_len;
+        __u16           le_def_tx_time;
+        __u16           le_max_tx_len;
+        __u16           le_max_tx_time;
+        __u16           le_max_rx_len;
+        __u16           le_max_rx_time;
         __u16           discov_interleaved_timeout;
         __u16           conn_info_min_age;
         __u16           conn_info_max_age;
         __u8            ssp_debug_mode;
+        __u8            hw_error_code;
         __u32           clock;
 
         __u16           devid_source;
@@ -285,6 +297,7 @@ struct hci_dev {
 
         struct work_struct      power_on;
         struct delayed_work     power_off;
+        struct work_struct      error_reset;
 
         __u16                   discov_timeout;
         struct delayed_work     discov_off;
@@ -343,6 +356,7 @@ struct hci_dev {
         unsigned long           dev_flags;
 
         struct delayed_work     le_scan_disable;
+        struct delayed_work     le_scan_restart;
 
         __s8                    adv_tx_power;
         __u8                    adv_data[HCI_MAX_AD_LENGTH];
@@ -361,6 +375,7 @@ struct hci_dev {
         int (*setup)(struct hci_dev *hdev);
         int (*send)(struct hci_dev *hdev, struct sk_buff *skb);
         void (*notify)(struct hci_dev *hdev, unsigned int evt);
+        void (*hw_error)(struct hci_dev *hdev, u8 code);
         int (*set_bdaddr)(struct hci_dev *hdev, const bdaddr_t *bdaddr);
 };
 
@@ -434,6 +449,7 @@ struct hci_conn {
         struct delayed_work le_conn_timeout;
 
         struct device   dev;
+        struct dentry   *debugfs;
 
         struct hci_dev  *hdev;
         void            *l2cap_data;
@@ -518,6 +534,8 @@ static inline void hci_discovery_filter_clear(struct hci_dev *hdev)
         hdev->discovery.uuid_count = 0;
         kfree(hdev->discovery.uuids);
         hdev->discovery.uuids = NULL;
+        hdev->discovery.scan_start = 0;
+        hdev->discovery.scan_duration = 0;
 }
 
 bool hci_discovery_active(struct hci_dev *hdev);
@@ -772,7 +790,6 @@ int hci_conn_check_link_mode(struct hci_conn *conn);
 int hci_conn_check_secure(struct hci_conn *conn, __u8 sec_level);
 int hci_conn_security(struct hci_conn *conn, __u8 sec_level, __u8 auth_type,
                       bool initiator);
-int hci_conn_change_link_key(struct hci_conn *conn);
 int hci_conn_switch_role(struct hci_conn *conn, __u8 role);
 
 void hci_conn_enter_active_mode(struct hci_conn *conn, __u8 force_active);
@@ -920,8 +937,6 @@ struct hci_conn_params *hci_conn_params_lookup(struct hci_dev *hdev,
                                                bdaddr_t *addr, u8 addr_type);
 struct hci_conn_params *hci_conn_params_add(struct hci_dev *hdev,
                                             bdaddr_t *addr, u8 addr_type);
-int hci_conn_params_set(struct hci_dev *hdev, bdaddr_t *addr, u8 addr_type,
-                        u8 auto_connect);
 void hci_conn_params_del(struct hci_dev *hdev, bdaddr_t *addr, u8 addr_type);
 void hci_conn_params_clear_all(struct hci_dev *hdev);
 void hci_conn_params_clear_disabled(struct hci_dev *hdev);
@@ -930,8 +945,6 @@ struct hci_conn_params *hci_pend_le_action_lookup(struct list_head *list,
                                                   bdaddr_t *addr,
                                                   u8 addr_type);
 
-void hci_update_background_scan(struct hci_dev *hdev);
-
 void hci_uuids_clear(struct hci_dev *hdev);
 
 void hci_link_keys_clear(struct hci_dev *hdev);
@@ -1014,8 +1027,7 @@ void hci_conn_del_sysfs(struct hci_conn *conn);
 
 #define hdev_is_powered(hdev) (test_bit(HCI_UP, &hdev->flags) && \
                                 !test_bit(HCI_AUTO_OFF, &hdev->dev_flags))
-#define bredr_sc_enabled(dev) ((lmp_sc_capable(dev) || \
-                                test_bit(HCI_FORCE_SC, &(dev)->dbg_flags)) && \
+#define bredr_sc_enabled(dev) (lmp_sc_capable(dev) && \
                                test_bit(HCI_SC_ENABLED, &(dev)->dev_flags))
 
 /* ----- HCI protocols ----- */
@@ -1284,30 +1296,8 @@ static inline int hci_check_conn_params(u16 min, u16 max, u16 latency,
 int hci_register_cb(struct hci_cb *hcb);
 int hci_unregister_cb(struct hci_cb *hcb);
 
-struct hci_request {
-        struct hci_dev          *hdev;
-        struct sk_buff_head     cmd_q;
-
-        /* If something goes wrong when building the HCI request, the error
-         * value is stored in this field.
-         */
-        int                     err;
-};
-
-void hci_req_init(struct hci_request *req, struct hci_dev *hdev);
-int hci_req_run(struct hci_request *req, hci_req_complete_t complete);
-void hci_req_add(struct hci_request *req, u16 opcode, u32 plen,
-                 const void *param);
-void hci_req_add_ev(struct hci_request *req, u16 opcode, u32 plen,
-                    const void *param, u8 event);
-void hci_req_cmd_complete(struct hci_dev *hdev, u16 opcode, u8 status);
 bool hci_req_pending(struct hci_dev *hdev);
 
-void hci_req_add_le_scan_disable(struct hci_request *req);
-void hci_req_add_le_passive_scan(struct hci_request *req);
-
-void hci_update_page_scan(struct hci_dev *hdev, struct hci_request *req);
-
 struct sk_buff *__hci_cmd_sync(struct hci_dev *hdev, u16 opcode, u32 plen,
                                const void *param, u32 timeout);
 struct sk_buff *__hci_cmd_sync_ev(struct hci_dev *hdev, u16 opcode, u32 plen,
@@ -1344,6 +1334,7 @@ void hci_sock_dev_event(struct hci_dev *hdev, int event);
 #define DISCOV_INTERLEAVED_TIMEOUT      5120    /* msec */
 #define DISCOV_INTERLEAVED_INQUIRY_LEN  0x04
 #define DISCOV_BREDR_INQUIRY_LEN        0x08
+#define DISCOV_LE_RESTART_DELAY         msecs_to_jiffies(200)   /* msec */
 
 int mgmt_control(struct sock *sk, struct msghdr *msg, size_t len);
 int mgmt_new_settings(struct hci_dev *hdev);
@@ -1388,7 +1379,6 @@ int mgmt_user_passkey_notify(struct hci_dev *hdev, bdaddr_t *bdaddr,
 void mgmt_auth_failed(struct hci_conn *conn, u8 status);
 void mgmt_auth_enable_complete(struct hci_dev *hdev, u8 status);
 void mgmt_ssp_enable_complete(struct hci_dev *hdev, u8 enable, u8 status);
-void mgmt_sc_enable_complete(struct hci_dev *hdev, u8 enable, u8 status);
 void mgmt_set_class_of_dev_complete(struct hci_dev *hdev, u8 *dev_class,
                                     u8 status);
 void mgmt_set_local_name_complete(struct hci_dev *hdev, u8 *name, u8 status);
@@ -1417,8 +1407,6 @@ u8 hci_le_conn_update(struct hci_conn *conn, u16 min, u16 max, u16 latency,
 void hci_le_start_enc(struct hci_conn *conn, __le16 ediv, __le64 rand,
                                                         __u8 ltk[16]);
 
-int hci_update_random_address(struct hci_request *req, bool require_privacy,
-                              u8 *own_addr_type);
 void hci_copy_identity_address(struct hci_dev *hdev, bdaddr_t *bdaddr,
                                u8 *bdaddr_type);
 
diff --git a/include/net/bluetooth/l2cap.h b/include/net/bluetooth/l2cap.h
index d1bb342d083f..2239a3753092 100644
--- a/include/net/bluetooth/l2cap.h
+++ b/include/net/bluetooth/l2cap.h
@@ -248,6 +248,7 @@ struct l2cap_conn_rsp {
 #define L2CAP_PSM_SDP           0x0001
 #define L2CAP_PSM_RFCOMM        0x0003
 #define L2CAP_PSM_3DSP          0x0021
+#define L2CAP_PSM_IPSP          0x0023 /* 6LoWPAN */
 
 /* channel identifier */
 #define L2CAP_CID_SIGNALING     0x0001
diff --git a/include/net/bluetooth/mgmt.h b/include/net/bluetooth/mgmt.h
index 95c34d5180fa..e218a30f2061 100644
--- a/include/net/bluetooth/mgmt.h
+++ b/include/net/bluetooth/mgmt.h
@@ -301,10 +301,6 @@ struct mgmt_cp_user_passkey_neg_reply {
 #define MGMT_OP_READ_LOCAL_OOB_DATA     0x0020
 #define MGMT_READ_LOCAL_OOB_DATA_SIZE   0
 struct mgmt_rp_read_local_oob_data {
-        __u8    hash[16];
-        __u8    rand[16];
-} __packed;
-struct mgmt_rp_read_local_oob_ext_data {
         __u8    hash192[16];
         __u8    rand192[16];
         __u8    hash256[16];
diff --git a/include/net/bluetooth/rfcomm.h b/include/net/bluetooth/rfcomm.h
index 578b83127af1..4190af53a46a 100644
--- a/include/net/bluetooth/rfcomm.h
+++ b/include/net/bluetooth/rfcomm.h
@@ -24,8 +24,6 @@
 #ifndef __RFCOMM_H
 #define __RFCOMM_H
 
-#define RFCOMM_PSM 3
-
 #define RFCOMM_CONN_TIMEOUT (HZ * 30)
 #define RFCOMM_DISC_TIMEOUT (HZ * 20)
 #define RFCOMM_AUTH_TIMEOUT (HZ * 25)
diff --git a/include/net/bond_3ad.h b/include/net/bond_3ad.h
index e01d903633ef..f04cdbb7848e 100644
--- a/include/net/bond_3ad.h
+++ b/include/net/bond_3ad.h
@@ -274,7 +274,6 @@ void bond_3ad_handle_link_change(struct slave *slave, char link);
 int  bond_3ad_get_active_agg_info(struct bonding *bond, struct ad_info *ad_info);
 int  __bond_3ad_get_active_agg_info(struct bonding *bond,
                                     struct ad_info *ad_info);
-int bond_3ad_xmit_xor(struct sk_buff *skb, struct net_device *dev);
 int bond_3ad_lacpdu_recv(const struct sk_buff *skb, struct bonding *bond,
                          struct slave *slave);
 int bond_3ad_set_carrier(struct bonding *bond);
diff --git a/include/net/bonding.h b/include/net/bonding.h
index 983a94b86b95..fda6feeb6c1f 100644
--- a/include/net/bonding.h
+++ b/include/net/bonding.h
@@ -150,6 +150,12 @@ struct bond_parm_tbl {
         int mode;
 };
 
+struct netdev_notify_work {
+        struct delayed_work     work;
+        struct net_device       *dev;
+        struct netdev_bonding_info bonding_info;
+};
+
 struct slave {
         struct net_device *dev; /* first - useful for panic debug */
         struct bonding *bond; /* our master */
@@ -243,6 +249,8 @@ struct bonding {
 #define bond_slave_get_rtnl(dev) \
         ((struct slave *) rtnl_dereference(dev->rx_handler_data))
 
+void bond_queue_slave_event(struct slave *slave);
+
 struct bond_vlan_tag {
         __be16          vlan_proto;
         unsigned short  vlan_id;
@@ -315,6 +323,7 @@ static inline void bond_set_active_slave(struct slave *slave)
 {
         if (slave->backup) {
                 slave->backup = 0;
+                bond_queue_slave_event(slave);
                 rtmsg_ifinfo(RTM_NEWLINK, slave->dev, 0, GFP_ATOMIC);
         }
 }
@@ -323,6 +332,7 @@ static inline void bond_set_backup_slave(struct slave *slave)
 {
         if (!slave->backup) {
                 slave->backup = 1;
+                bond_queue_slave_event(slave);
                 rtmsg_ifinfo(RTM_NEWLINK, slave->dev, 0, GFP_ATOMIC);
         }
 }
@@ -336,6 +346,7 @@ static inline void bond_set_slave_state(struct slave *slave,
         slave->backup = slave_state;
         if (notify) {
                 rtmsg_ifinfo(RTM_NEWLINK, slave->dev, 0, GFP_ATOMIC);
+                bond_queue_slave_event(slave);
                 slave->should_notify = 0;
         } else {
                 if (slave->should_notify)
@@ -490,6 +501,12 @@ static inline bool bond_is_slave_inactive(struct slave *slave)
         return slave->inactive;
 }
 
+static inline void bond_set_slave_link_state(struct slave *slave, int state)
+{
+        slave->link = state;
+        bond_queue_slave_event(slave);
+}
+
 static inline __be32 bond_confirm_addr(struct net_device *dev, __be32 dst, __be32 local)
 {
         struct in_device *in_dev;
@@ -525,6 +542,7 @@ void bond_sysfs_slave_del(struct slave *slave);
 int bond_enslave(struct net_device *bond_dev, struct net_device *slave_dev);
 int bond_release(struct net_device *bond_dev, struct net_device *slave_dev);
 u32 bond_xmit_hash(struct bonding *bond, struct sk_buff *skb);
+int bond_set_carrier(struct bonding *bond);
 void bond_select_active_slave(struct bonding *bond);
 void bond_change_active_slave(struct bonding *bond, struct slave *new_active);
 void bond_create_debugfs(void);
diff --git a/include/net/cfg80211.h b/include/net/cfg80211.h
index 4ebb816241fa..64e09e1e8099 100644
--- a/include/net/cfg80211.h
+++ b/include/net/cfg80211.h
@@ -520,37 +520,41 @@ ieee80211_chandef_max_power(struct cfg80211_chan_def *chandef)
  *
  * @SURVEY_INFO_NOISE_DBM: noise (in dBm) was filled in
  * @SURVEY_INFO_IN_USE: channel is currently being used
- * @SURVEY_INFO_CHANNEL_TIME: channel active time (in ms) was filled in
- * @SURVEY_INFO_CHANNEL_TIME_BUSY: channel busy time was filled in
- * @SURVEY_INFO_CHANNEL_TIME_EXT_BUSY: extension channel busy time was filled in
- * @SURVEY_INFO_CHANNEL_TIME_RX: channel receive time was filled in
- * @SURVEY_INFO_CHANNEL_TIME_TX: channel transmit time was filled in
+ * @SURVEY_INFO_TIME: active time (in ms) was filled in
+ * @SURVEY_INFO_TIME_BUSY: busy time was filled in
+ * @SURVEY_INFO_TIME_EXT_BUSY: extension channel busy time was filled in
+ * @SURVEY_INFO_TIME_RX: receive time was filled in
+ * @SURVEY_INFO_TIME_TX: transmit time was filled in
+ * @SURVEY_INFO_TIME_SCAN: scan time was filled in
  *
  * Used by the driver to indicate which info in &struct survey_info
  * it has filled in during the get_survey().
  */
 enum survey_info_flags {
-        SURVEY_INFO_NOISE_DBM = 1<<0,
-        SURVEY_INFO_IN_USE = 1<<1,
-        SURVEY_INFO_CHANNEL_TIME = 1<<2,
-        SURVEY_INFO_CHANNEL_TIME_BUSY = 1<<3,
-        SURVEY_INFO_CHANNEL_TIME_EXT_BUSY = 1<<4,
-        SURVEY_INFO_CHANNEL_TIME_RX = 1<<5,
-        SURVEY_INFO_CHANNEL_TIME_TX = 1<<6,
+        SURVEY_INFO_NOISE_DBM           = BIT(0),
+        SURVEY_INFO_IN_USE              = BIT(1),
+        SURVEY_INFO_TIME                = BIT(2),
+        SURVEY_INFO_TIME_BUSY           = BIT(3),
+        SURVEY_INFO_TIME_EXT_BUSY       = BIT(4),
+        SURVEY_INFO_TIME_RX             = BIT(5),
+        SURVEY_INFO_TIME_TX             = BIT(6),
+        SURVEY_INFO_TIME_SCAN           = BIT(7),
 };
 
 /**
  * struct survey_info - channel survey response
  *
- * @channel: the channel this survey record reports, mandatory
+ * @channel: the channel this survey record reports, may be %NULL for a single
+ *      record to report global statistics
  * @filled: bitflag of flags from &enum survey_info_flags
  * @noise: channel noise in dBm. This and all following fields are
  *      optional
- * @channel_time: amount of time in ms the radio spent on the channel
- * @channel_time_busy: amount of time the primary channel was sensed busy
- * @channel_time_ext_busy: amount of time the extension channel was sensed busy
- * @channel_time_rx: amount of time the radio spent receiving data
- * @channel_time_tx: amount of time the radio spent transmitting data
+ * @time: amount of time in ms the radio was turn on (on the channel)
+ * @time_busy: amount of time the primary channel was sensed busy
+ * @time_ext_busy: amount of time the extension channel was sensed busy
+ * @time_rx: amount of time the radio spent receiving data
+ * @time_tx: amount of time the radio spent transmitting data
+ * @time_scan: amount of time the radio spent for scanning
  *
  * Used by dump_survey() to report back per-channel survey information.
  *
@@ -559,11 +563,12 @@ enum survey_info_flags {
  */
 struct survey_info {
         struct ieee80211_channel *channel;
-        u64 channel_time;
-        u64 channel_time_busy;
-        u64 channel_time_ext_busy;
-        u64 channel_time_rx;
-        u64 channel_time_tx;
+        u64 time;
+        u64 time_busy;
+        u64 time_ext_busy;
+        u64 time_rx;
+        u64 time_tx;
+        u64 time_scan;
         u32 filled;
         s8 noise;
 };
@@ -861,75 +866,6 @@ int cfg80211_check_station_change(struct wiphy *wiphy,
                                   enum cfg80211_station_type statype);
 
 /**
- * enum station_info_flags - station information flags
- *
- * Used by the driver to indicate which info in &struct station_info
- * it has filled in during get_station() or dump_station().
- *
- * @STATION_INFO_INACTIVE_TIME: @inactive_time filled
- * @STATION_INFO_RX_BYTES: @rx_bytes filled
- * @STATION_INFO_TX_BYTES: @tx_bytes filled
- * @STATION_INFO_RX_BYTES64: @rx_bytes filled with 64-bit value
- * @STATION_INFO_TX_BYTES64: @tx_bytes filled with 64-bit value
- * @STATION_INFO_LLID: @llid filled
- * @STATION_INFO_PLID: @plid filled
- * @STATION_INFO_PLINK_STATE: @plink_state filled
- * @STATION_INFO_SIGNAL: @signal filled
- * @STATION_INFO_TX_BITRATE: @txrate fields are filled
- *      (tx_bitrate, tx_bitrate_flags and tx_bitrate_mcs)
- * @STATION_INFO_RX_PACKETS: @rx_packets filled with 32-bit value
- * @STATION_INFO_TX_PACKETS: @tx_packets filled with 32-bit value
- * @STATION_INFO_TX_RETRIES: @tx_retries filled
- * @STATION_INFO_TX_FAILED: @tx_failed filled
- * @STATION_INFO_RX_DROP_MISC: @rx_dropped_misc filled
- * @STATION_INFO_SIGNAL_AVG: @signal_avg filled
- * @STATION_INFO_RX_BITRATE: @rxrate fields are filled
- * @STATION_INFO_BSS_PARAM: @bss_param filled
- * @STATION_INFO_CONNECTED_TIME: @connected_time filled
- * @STATION_INFO_ASSOC_REQ_IES: @assoc_req_ies filled
- * @STATION_INFO_STA_FLAGS: @sta_flags filled
- * @STATION_INFO_BEACON_LOSS_COUNT: @beacon_loss_count filled
- * @STATION_INFO_T_OFFSET: @t_offset filled
- * @STATION_INFO_LOCAL_PM: @local_pm filled
- * @STATION_INFO_PEER_PM: @peer_pm filled
- * @STATION_INFO_NONPEER_PM: @nonpeer_pm filled
- * @STATION_INFO_CHAIN_SIGNAL: @chain_signal filled
- * @STATION_INFO_CHAIN_SIGNAL_AVG: @chain_signal_avg filled
- * @STATION_INFO_EXPECTED_THROUGHPUT: @expected_throughput filled
- */
-enum station_info_flags {
-        STATION_INFO_INACTIVE_TIME              = BIT(0),
-        STATION_INFO_RX_BYTES                   = BIT(1),
-        STATION_INFO_TX_BYTES                   = BIT(2),
-        STATION_INFO_LLID                       = BIT(3),
-        STATION_INFO_PLID                       = BIT(4),
-        STATION_INFO_PLINK_STATE                = BIT(5),
-        STATION_INFO_SIGNAL                     = BIT(6),
-        STATION_INFO_TX_BITRATE                 = BIT(7),
-        STATION_INFO_RX_PACKETS                 = BIT(8),
-        STATION_INFO_TX_PACKETS                 = BIT(9),
-        STATION_INFO_TX_RETRIES                 = BIT(10),
-        STATION_INFO_TX_FAILED                  = BIT(11),
-        STATION_INFO_RX_DROP_MISC               = BIT(12),
-        STATION_INFO_SIGNAL_AVG                 = BIT(13),
-        STATION_INFO_RX_BITRATE                 = BIT(14),
-        STATION_INFO_BSS_PARAM                  = BIT(15),
-        STATION_INFO_CONNECTED_TIME             = BIT(16),
-        STATION_INFO_ASSOC_REQ_IES              = BIT(17),
-        STATION_INFO_STA_FLAGS                  = BIT(18),
-        STATION_INFO_BEACON_LOSS_COUNT          = BIT(19),
-        STATION_INFO_T_OFFSET                   = BIT(20),
-        STATION_INFO_LOCAL_PM                   = BIT(21),
-        STATION_INFO_PEER_PM                    = BIT(22),
-        STATION_INFO_NONPEER_PM                 = BIT(23),
-        STATION_INFO_RX_BYTES64                 = BIT(24),
-        STATION_INFO_TX_BYTES64                 = BIT(25),
-        STATION_INFO_CHAIN_SIGNAL               = BIT(26),
-        STATION_INFO_CHAIN_SIGNAL_AVG           = BIT(27),
-        STATION_INFO_EXPECTED_THROUGHPUT        = BIT(28),
-};
-
-/**
  * enum station_info_rate_flags - bitrate info flags
  *
  * Used by the driver to indicate the specific rate transmission
@@ -937,22 +873,35 @@ enum station_info_flags {
  *
  * @RATE_INFO_FLAGS_MCS: mcs field filled with HT MCS
  * @RATE_INFO_FLAGS_VHT_MCS: mcs field filled with VHT MCS
- * @RATE_INFO_FLAGS_40_MHZ_WIDTH: 40 MHz width transmission
- * @RATE_INFO_FLAGS_80_MHZ_WIDTH: 80 MHz width transmission
- * @RATE_INFO_FLAGS_80P80_MHZ_WIDTH: 80+80 MHz width transmission
- * @RATE_INFO_FLAGS_160_MHZ_WIDTH: 160 MHz width transmission
  * @RATE_INFO_FLAGS_SHORT_GI: 400ns guard interval
  * @RATE_INFO_FLAGS_60G: 60GHz MCS
  */
 enum rate_info_flags {
         RATE_INFO_FLAGS_MCS                     = BIT(0),
         RATE_INFO_FLAGS_VHT_MCS                 = BIT(1),
-        RATE_INFO_FLAGS_40_MHZ_WIDTH            = BIT(2),
-        RATE_INFO_FLAGS_80_MHZ_WIDTH            = BIT(3),
-        RATE_INFO_FLAGS_80P80_MHZ_WIDTH         = BIT(4),
-        RATE_INFO_FLAGS_160_MHZ_WIDTH           = BIT(5),
-        RATE_INFO_FLAGS_SHORT_GI                = BIT(6),
-        RATE_INFO_FLAGS_60G                     = BIT(7),
+        RATE_INFO_FLAGS_SHORT_GI                = BIT(2),
+        RATE_INFO_FLAGS_60G                     = BIT(3),
+};
+
+/**
+ * enum rate_info_bw - rate bandwidth information
+ *
+ * Used by the driver to indicate the rate bandwidth.
+ *
+ * @RATE_INFO_BW_5: 5 MHz bandwidth
+ * @RATE_INFO_BW_10: 10 MHz bandwidth
+ * @RATE_INFO_BW_20: 20 MHz bandwidth
+ * @RATE_INFO_BW_40: 40 MHz bandwidth
+ * @RATE_INFO_BW_80: 80 MHz bandwidth
+ * @RATE_INFO_BW_160: 160 MHz bandwidth
+ */
+enum rate_info_bw {
+        RATE_INFO_BW_5,
+        RATE_INFO_BW_10,
+        RATE_INFO_BW_20,
+        RATE_INFO_BW_40,
+        RATE_INFO_BW_80,
+        RATE_INFO_BW_160,
 };
 
 /**
@@ -964,12 +913,14 @@ enum rate_info_flags {
  * @mcs: mcs index if struct describes a 802.11n bitrate
  * @legacy: bitrate in 100kbit/s for 802.11abg
  * @nss: number of streams (VHT only)
+ * @bw: bandwidth (from &enum rate_info_bw)
  */
 struct rate_info {
         u8 flags;
         u8 mcs;
         u16 legacy;
         u8 nss;
+        u8 bw;
 };
 
 /**
@@ -1003,6 +954,24 @@ struct sta_bss_parameters {
         u16 beacon_interval;
 };
 
+/**
+ * struct cfg80211_tid_stats - per-TID statistics
+ * @filled: bitmap of flags using the bits of &enum nl80211_tid_stats to
+ *      indicate the relevant values in this struct are filled
+ * @rx_msdu: number of received MSDUs
+ * @tx_msdu: number of (attempted) transmitted MSDUs
+ * @tx_msdu_retries: number of retries (not counting the first) for
+ *      transmitted MSDUs
+ * @tx_msdu_failed: number of failed transmitted MSDUs
+ */
+struct cfg80211_tid_stats {
+        u32 filled;
+        u64 rx_msdu;
+        u64 tx_msdu;
+        u64 tx_msdu_retries;
+        u64 tx_msdu_failed;
+};
+
 #define IEEE80211_MAX_CHAINS    4
 
 /**
@@ -1010,11 +979,12 @@ struct sta_bss_parameters {
  *
  * Station information filled by driver for get_station() and dump_station.
  *
- * @filled: bitflag of flags from &enum station_info_flags
+ * @filled: bitflag of flags using the bits of &enum nl80211_sta_info to
+ *      indicate the relevant values in this struct for them
  * @connected_time: time(in secs) since a station is last connected
  * @inactive_time: time since last station activity (tx/rx) in milliseconds
- * @rx_bytes: bytes received from this station
- * @tx_bytes: bytes transmitted to this station
+ * @rx_bytes: bytes (size of MPDUs) received from this station
+ * @tx_bytes: bytes (size of MPDUs) transmitted to this station
  * @llid: mesh local link id
  * @plid: mesh peer link id
  * @plink_state: mesh peer link state
@@ -1027,10 +997,10 @@ struct sta_bss_parameters {
  * @chain_signal_avg: per-chain signal strength average in dBm
  * @txrate: current unicast bitrate from this station
  * @rxrate: current unicast bitrate to this station
- * @rx_packets: packets received from this station
- * @tx_packets: packets transmitted to this station
- * @tx_retries: cumulative retry counts
- * @tx_failed: number of failed transmissions (retries exceeded, no ACK)
+ * @rx_packets: packets (MSDUs & MMPDUs) received from this station
+ * @tx_packets: packets (MSDUs & MMPDUs) transmitted to this station
+ * @tx_retries: cumulative retry counts (MPDUs)
+ * @tx_failed: number of failed transmissions (MPDUs) (retries exceeded, no ACK)
  * @rx_dropped_misc:  Dropped for un-specified reason.
  * @bss_param: current BSS parameters
  * @generation: generation number for nl80211 dumps.
@@ -1050,6 +1020,11 @@ struct sta_bss_parameters {
  * @nonpeer_pm: non-peer mesh STA power save mode
  * @expected_throughput: expected throughput in kbps (including 802.11 headers)
  *      towards this station.
+ * @rx_beacon: number of beacons received from this peer
+ * @rx_beacon_signal_avg: signal strength average (in dBm) for beacons received
+ *      from this peer
+ * @pertid: per-TID statistics, see &struct cfg80211_tid_stats, using the last
+ *      (IEEE80211_NUM_TIDS) index for MSDUs not encapsulated in QoS-MPDUs.
  */
 struct station_info {
         u32 filled;
@@ -1090,10 +1065,9 @@ struct station_info {
 
         u32 expected_throughput;
 
-        /*
-         * Note: Add a new enum station_info_flags value for each new field and
-         * use it to check which fields are initialized.
-         */
+        u64 rx_beacon;
+        u8 rx_beacon_signal_avg;
+        struct cfg80211_tid_stats pertid[IEEE80211_NUM_TIDS + 1];
 };
 
 /**
@@ -1516,6 +1490,13 @@ struct cfg80211_match_set {
  * @mac_addr_mask: MAC address mask used with randomisation, bits that
  *      are 0 in the mask should be randomised, bits that are 1 should
  *      be taken from the @mac_addr
+ * @rcu_head: RCU callback used to free the struct
+ * @owner_nlportid: netlink portid of owner (if this should is a request
+ *      owned by a particular socket)
+ * @delay: delay in seconds to use before starting the first scan
+ *      cycle.  The driver may ignore this parameter and start
+ *      immediately (or at any other time), if this feature is not
+ *      supported.
  */
 struct cfg80211_sched_scan_request {
         struct cfg80211_ssid *ssids;
@@ -1529,6 +1510,7 @@ struct cfg80211_sched_scan_request {
         struct cfg80211_match_set *match_sets;
         int n_match_sets;
         s32 min_rssi_thold;
+        u32 delay;
 
         u8 mac_addr[ETH_ALEN] __aligned(2);
         u8 mac_addr_mask[ETH_ALEN] __aligned(2);
@@ -1537,6 +1519,8 @@ struct cfg80211_sched_scan_request {
         struct wiphy *wiphy;
         struct net_device *dev;
         unsigned long scan_start;
+        struct rcu_head rcu_head;
+        u32 owner_nlportid;
 
         /* keep last */
         struct ieee80211_channel *channels[0];
@@ -3011,6 +2995,8 @@ struct wiphy_vendor_command {
  * @regulatory_flags: wiphy regulatory flags, see
  *      &enum ieee80211_regulatory_flags
  * @features: features advertised to nl80211, see &enum nl80211_feature_flags.
+ * @ext_features: extended features advertised to nl80211, see
+ *      &enum nl80211_ext_feature_index.
  * @bss_priv_size: each BSS struct has private data allocated with it,
  *      this variable determines its size
  * @max_scan_ssids: maximum number of SSIDs the device can scan for in
@@ -3120,6 +3106,7 @@ struct wiphy {
         u16 max_acl_mac_addrs;
 
         u32 flags, regulatory_flags, features;
+        u8 ext_features[DIV_ROUND_UP(NUM_NL80211_EXT_FEATURES, 8)];
 
         u32 ap_sme_capa;
 
@@ -3808,6 +3795,34 @@ const u8 *cfg80211_find_vendor_ie(unsigned int oui, u8 oui_type,
 int regulatory_hint(struct wiphy *wiphy, const char *alpha2);
 
 /**
+ * regulatory_set_wiphy_regd - set regdom info for self managed drivers
+ * @wiphy: the wireless device we want to process the regulatory domain on
+ * @rd: the regulatory domain informatoin to use for this wiphy
+ *
+ * Set the regulatory domain information for self-managed wiphys, only they
+ * may use this function. See %REGULATORY_WIPHY_SELF_MANAGED for more
+ * information.
+ *
+ * Return: 0 on success. -EINVAL, -EPERM
+ */
+int regulatory_set_wiphy_regd(struct wiphy *wiphy,
+                              struct ieee80211_regdomain *rd);
+
+/**
+ * regulatory_set_wiphy_regd_sync_rtnl - set regdom for self-managed drivers
+ * @wiphy: the wireless device we want to process the regulatory domain on
+ * @rd: the regulatory domain information to use for this wiphy
+ *
+ * This functions requires the RTNL to be held and applies the new regdomain
+ * synchronously to this wiphy. For more details see
+ * regulatory_set_wiphy_regd().
+ *
+ * Return: 0 on success. -EINVAL, -EPERM
+ */
+int regulatory_set_wiphy_regd_sync_rtnl(struct wiphy *wiphy,
+                                        struct ieee80211_regdomain *rd);
+
+/**
  * wiphy_apply_custom_regulatory - apply a custom driver regulatory domain
  * @wiphy: the wireless device we want to process the regulatory domain on
  * @regd: the custom regulatory domain to use for this wiphy
@@ -4565,13 +4580,27 @@ void cfg80211_new_sta(struct net_device *dev, const u8 *mac_addr,
                       struct station_info *sinfo, gfp_t gfp);
 
 /**
+ * cfg80211_del_sta_sinfo - notify userspace about deletion of a station
+ * @dev: the netdev
+ * @mac_addr: the station's address
+ * @sinfo: the station information/statistics
+ * @gfp: allocation flags
+ */
+void cfg80211_del_sta_sinfo(struct net_device *dev, const u8 *mac_addr,
+                            struct station_info *sinfo, gfp_t gfp);
+
+/**
  * cfg80211_del_sta - notify userspace about deletion of a station
  *
  * @dev: the netdev
  * @mac_addr: the station's address
  * @gfp: allocation flags
  */
-void cfg80211_del_sta(struct net_device *dev, const u8 *mac_addr, gfp_t gfp);
+static inline void cfg80211_del_sta(struct net_device *dev,
+                                    const u8 *mac_addr, gfp_t gfp)
+{
+        cfg80211_del_sta_sinfo(dev, mac_addr, NULL, gfp);
+}
 
 /**
  * cfg80211_conn_failed - connection request failed notification
@@ -5033,6 +5062,42 @@ void cfg80211_stop_iface(struct wiphy *wiphy, struct wireless_dev *wdev,
  */
 void cfg80211_shutdown_all_interfaces(struct wiphy *wiphy);
 
+/**
+ * wiphy_ext_feature_set - set the extended feature flag
+ *
+ * @wiphy: the wiphy to modify.
+ * @ftidx: extended feature bit index.
+ *
+ * The extended features are flagged in multiple bytes (see
+ * &struct wiphy.@ext_features)
+ */
+static inline void wiphy_ext_feature_set(struct wiphy *wiphy,
+                                         enum nl80211_ext_feature_index ftidx)
+{
+        u8 *ft_byte;
+
+        ft_byte = &wiphy->ext_features[ftidx / 8];
+        *ft_byte |= BIT(ftidx % 8);
+}
+
+/**
+ * wiphy_ext_feature_isset - check the extended feature flag
+ *
+ * @wiphy: the wiphy to modify.
+ * @ftidx: extended feature bit index.
+ *
+ * The extended features are flagged in multiple bytes (see
+ * &struct wiphy.@ext_features)
+ */
+static inline bool
+wiphy_ext_feature_isset(struct wiphy *wiphy,
+                        enum nl80211_ext_feature_index ftidx)
+{
+        u8 ft_byte;
+
+        ft_byte = wiphy->ext_features[ftidx / 8];
+        return (ft_byte & BIT(ftidx % 8)) != 0;
+}
 
 /* ethtool helper */
 void cfg80211_get_drvinfo(struct net_device *dev, struct ethtool_drvinfo *info);
diff --git a/include/net/cfg802154.h b/include/net/cfg802154.h
index 7f713acfa106..eeda67652766 100644
--- a/include/net/cfg802154.h
+++ b/include/net/cfg802154.h
@@ -25,6 +25,7 @@
 #include <net/nl802154.h>
 
 struct wpan_phy;
+struct wpan_phy_cca;
 
 struct cfg802154_ops {
         struct net_device * (*add_virtual_intf_deprecated)(struct wpan_phy *wpan_phy,
@@ -39,6 +40,8 @@ struct cfg802154_ops {
         int     (*del_virtual_intf)(struct wpan_phy *wpan_phy,
                                     struct wpan_dev *wpan_dev);
         int     (*set_channel)(struct wpan_phy *wpan_phy, u8 page, u8 channel);
+        int     (*set_cca_mode)(struct wpan_phy *wpan_phy,
+                                const struct wpan_phy_cca *cca);
         int     (*set_pan_id)(struct wpan_phy *wpan_phy,
                               struct wpan_dev *wpan_dev, __le16 pan_id);
         int     (*set_short_addr)(struct wpan_phy *wpan_phy,
@@ -56,6 +59,11 @@ struct cfg802154_ops {
                                 struct wpan_dev *wpan_dev, bool mode);
 };
 
+struct wpan_phy_cca {
+        enum nl802154_cca_modes mode;
+        enum nl802154_cca_opts opt;
+};
+
 struct wpan_phy {
         struct mutex pib_lock;
 
@@ -76,7 +84,7 @@ struct wpan_phy {
         u8 current_page;
         u32 channels_supported[IEEE802154_MAX_PAGE + 1];
         s8 transmit_power;
-        u8 cca_mode;
+        struct wpan_phy_cca cca;
 
         __le64 perm_extended_addr;
 
diff --git a/include/net/genetlink.h b/include/net/genetlink.h
index 6c92415311ca..0574abd3db86 100644
--- a/include/net/genetlink.h
+++ b/include/net/genetlink.h
@@ -211,6 +211,23 @@ static inline struct nlmsghdr *genlmsg_nlhdr(void *user_hdr,
 }
 
 /**
+ * genlmsg_parse - parse attributes of a genetlink message
+ * @nlh: netlink message header
+ * @family: genetlink message family
+ * @tb: destination array with maxtype+1 elements
+ * @maxtype: maximum attribute type to be expected
+ * @policy: validation policy
+ * */
+static inline int genlmsg_parse(const struct nlmsghdr *nlh,
+                                const struct genl_family *family,
+                                struct nlattr *tb[], int maxtype,
+                                const struct nla_policy *policy)
+{
+        return nlmsg_parse(nlh, family->hdrsize + GENL_HDRLEN, tb, maxtype,
+                           policy);
+}
+
+/**
  * genl_dump_check_consistent - check if sequence is consistent and advertise if not
  * @cb: netlink callback structure that stores the sequence number
  * @user_hdr: user header as returned from genlmsg_put()
@@ -250,9 +267,9 @@ static inline void *genlmsg_put_reply(struct sk_buff *skb,
  * @skb: socket buffer the message is stored in
  * @hdr: user specific header
  */
-static inline int genlmsg_end(struct sk_buff *skb, void *hdr)
+static inline void genlmsg_end(struct sk_buff *skb, void *hdr)
 {
-        return nlmsg_end(skb, hdr - GENL_HDRLEN - NLMSG_HDRLEN);
+        nlmsg_end(skb, hdr - GENL_HDRLEN - NLMSG_HDRLEN);
 }
 
 /**
diff --git a/include/net/geneve.h b/include/net/geneve.h
index 112132cf8e2e..14fb8d3390b4 100644
--- a/include/net/geneve.h
+++ b/include/net/geneve.h
@@ -68,13 +68,12 @@ struct geneve_sock;
 typedef void (geneve_rcv_t)(struct geneve_sock *gs, struct sk_buff *skb);
 
 struct geneve_sock {
-        struct hlist_node       hlist;
+        struct list_head        list;
         geneve_rcv_t            *rcv;
         void                    *rcv_data;
-        struct work_struct      del_work;
         struct socket           *sock;
         struct rcu_head         rcu;
-        atomic_t                refcnt;
+        int                     refcnt;
         struct udp_offload      udp_offloads;
 };
 
@@ -91,7 +90,7 @@ int geneve_xmit_skb(struct geneve_sock *gs, struct rtable *rt,
                     struct sk_buff *skb, __be32 src, __be32 dst, __u8 tos,
                     __u8 ttl, __be16 df, __be16 src_port, __be16 dst_port,
                     __be16 tun_flags, u8 vni[3], u8 opt_len, u8 *opt,
-                    bool xnet);
+                    bool csum, bool xnet);
 #endif /*ifdef CONFIG_INET */
 
 #endif /*ifdef__NET_GENEVE_H */
diff --git a/include/net/gro_cells.h b/include/net/gro_cells.h
index 734d9b5f577a..0f712c0bc0bf 100644
--- a/include/net/gro_cells.h
+++ b/include/net/gro_cells.h
@@ -8,25 +8,23 @@
 struct gro_cell {
         struct sk_buff_head     napi_skbs;
         struct napi_struct      napi;
-} ____cacheline_aligned_in_smp;
+};
 
 struct gro_cells {
-        unsigned int            gro_cells_mask;
-        struct gro_cell         *cells;
+        struct gro_cell __percpu        *cells;
 };
 
 static inline void gro_cells_receive(struct gro_cells *gcells, struct sk_buff *skb)
 {
-        struct gro_cell *cell = gcells->cells;
+        struct gro_cell *cell;
         struct net_device *dev = skb->dev;
 
-        if (!cell || skb_cloned(skb) || !(dev->features & NETIF_F_GRO)) {
+        if (!gcells->cells || skb_cloned(skb) || !(dev->features & NETIF_F_GRO)) {
                 netif_rx(skb);
                 return;
         }
 
-        if (skb_rx_queue_recorded(skb))
-                cell += skb_get_rx_queue(skb) & gcells->gro_cells_mask;
+        cell = this_cpu_ptr(gcells->cells);
 
         if (skb_queue_len(&cell->napi_skbs) > netdev_max_backlog) {
                 atomic_long_inc(&dev->rx_dropped);
@@ -72,15 +70,12 @@ static inline int gro_cells_init(struct gro_cells *gcells, struct net_device *de
 {
         int i;
 
-        gcells->gro_cells_mask = roundup_pow_of_two(netif_get_num_default_rss_queues()) - 1;
-        gcells->cells = kcalloc(gcells->gro_cells_mask + 1,
-                                sizeof(struct gro_cell),
-                                GFP_KERNEL);
+        gcells->cells = alloc_percpu(struct gro_cell);
         if (!gcells->cells)
                 return -ENOMEM;
 
-        for (i = 0; i <= gcells->gro_cells_mask; i++) {
-                struct gro_cell *cell = gcells->cells + i;
+        for_each_possible_cpu(i) {
+                struct gro_cell *cell = per_cpu_ptr(gcells->cells, i);
 
                 skb_queue_head_init(&cell->napi_skbs);
                 netif_napi_add(dev, &cell->napi, gro_cell_poll, 64);
@@ -91,16 +86,16 @@ static inline int gro_cells_init(struct gro_cells *gcells, struct net_device *de
 
 static inline void gro_cells_destroy(struct gro_cells *gcells)
 {
-        struct gro_cell *cell = gcells->cells;
         int i;
 
-        if (!cell)
+        if (!gcells->cells)
                 return;
-        for (i = 0; i <= gcells->gro_cells_mask; i++,cell++) {
+        for_each_possible_cpu(i) {
+                struct gro_cell *cell = per_cpu_ptr(gcells->cells, i);
                 netif_napi_del(&cell->napi);
                 skb_queue_purge(&cell->napi_skbs);
         }
-        kfree(gcells->cells);
+        free_percpu(gcells->cells);
         gcells->cells = NULL;
 }
 
diff --git a/include/net/ieee802154_netdev.h b/include/net/ieee802154_netdev.h
index 83bb8a73d23c..94a297052442 100644
--- a/include/net/ieee802154_netdev.h
+++ b/include/net/ieee802154_netdev.h
@@ -28,6 +28,8 @@
 #include <linux/skbuff.h>
 #include <linux/ieee802154.h>
 
+#include <net/cfg802154.h>
+
 struct ieee802154_sechdr {
 #if defined(__LITTLE_ENDIAN_BITFIELD)
         u8 level:3,
@@ -337,7 +339,7 @@ struct ieee802154_mac_params {
         s8 frame_retries;
 
         bool lbt;
-        u8 cca_mode;
+        struct wpan_phy_cca cca;
         s32 cca_ed_level;
 };
 
diff --git a/include/net/inet_connection_sock.h b/include/net/inet_connection_sock.h
index 848e85cb5c61..5976bdecf58b 100644
--- a/include/net/inet_connection_sock.h
+++ b/include/net/inet_connection_sock.h
@@ -98,7 +98,8 @@ struct inet_connection_sock {
         const struct tcp_congestion_ops *icsk_ca_ops;
         const struct inet_connection_sock_af_ops *icsk_af_ops;
         unsigned int              (*icsk_sync_mss)(struct sock *sk, u32 pmtu);
-        __u8                      icsk_ca_state;
+        __u8                      icsk_ca_state:7,
+                                  icsk_ca_dst_locked:1;
         __u8                      icsk_retransmits;
         __u8                      icsk_pending;
         __u8                      icsk_backoff;
diff --git a/include/net/inet_sock.h b/include/net/inet_sock.h
index a829b77523cf..eb16c7beed1e 100644
--- a/include/net/inet_sock.h
+++ b/include/net/inet_sock.h
@@ -16,7 +16,7 @@
 #ifndef _INET_SOCK_H
 #define _INET_SOCK_H
 
-
+#include <linux/bitops.h>
 #include <linux/kmemcheck.h>
 #include <linux/string.h>
 #include <linux/types.h>
@@ -184,6 +184,7 @@ struct inet_sock {
                                 mc_all:1,
                                 nodefrag:1;
         __u8                    rcv_tos;
+        __u8                    convert_csum;
         int                     uc_index;
         int                     mc_index;
         __be32                  mc_addr;
@@ -194,6 +195,16 @@ struct inet_sock {
 #define IPCORK_OPT      1       /* ip-options has been held in ipcork.opt */
 #define IPCORK_ALLFRAG  2       /* always fragment (for ipv6 for now) */
 
+/* cmsg flags for inet */
+#define IP_CMSG_PKTINFO         BIT(0)
+#define IP_CMSG_TTL             BIT(1)
+#define IP_CMSG_TOS             BIT(2)
+#define IP_CMSG_RECVOPTS        BIT(3)
+#define IP_CMSG_RETOPTS         BIT(4)
+#define IP_CMSG_PASSSEC         BIT(5)
+#define IP_CMSG_ORIGDSTADDR     BIT(6)
+#define IP_CMSG_CHECKSUM        BIT(7)
+
 static inline struct inet_sock *inet_sk(const struct sock *sk)
 {
         return (struct inet_sock *)sk;
@@ -250,4 +261,20 @@ static inline __u8 inet_sk_flowi_flags(const struct sock *sk)
         return flags;
 }
 
+static inline void inet_inc_convert_csum(struct sock *sk)
+{
+        inet_sk(sk)->convert_csum++;
+}
+
+static inline void inet_dec_convert_csum(struct sock *sk)
+{
+        if (inet_sk(sk)->convert_csum > 0)
+                inet_sk(sk)->convert_csum--;
+}
+
+static inline bool inet_get_convert_csum(struct sock *sk)
+{
+        return !!inet_sk(sk)->convert_csum;
+}
+
 #endif  /* _INET_SOCK_H */
diff --git a/include/net/ip.h b/include/net/ip.h
index 09cf5aebb283..025c61c0dffb 100644
--- a/include/net/ip.h
+++ b/include/net/ip.h
@@ -538,7 +538,7 @@ int ip_options_rcv_srr(struct sk_buff *skb);
  */
 
 void ipv4_pktinfo_prepare(const struct sock *sk, struct sk_buff *skb);
-void ip_cmsg_recv(struct msghdr *msg, struct sk_buff *skb);
+void ip_cmsg_recv_offset(struct msghdr *msg, struct sk_buff *skb, int offset);
 int ip_cmsg_send(struct net *net, struct msghdr *msg,
                  struct ipcm_cookie *ipc, bool allow_ipv6);
 int ip_setsockopt(struct sock *sk, int level, int optname, char __user *optval,
@@ -558,6 +558,11 @@ void ip_icmp_error(struct sock *sk, struct sk_buff *skb, int err, __be16 port,
 void ip_local_error(struct sock *sk, int err, __be32 daddr, __be16 dport,
                     u32 info);
 
+static inline void ip_cmsg_recv(struct msghdr *msg, struct sk_buff *skb)
+{
+        ip_cmsg_recv_offset(msg, skb, 0);
+}
+
 bool icmp_global_allow(void);
 extern int sysctl_icmp_msgs_per_sec;
 extern int sysctl_icmp_msgs_burst;
diff --git a/include/net/ip6_fib.h b/include/net/ip6_fib.h
index 8eea35d32a75..20e80fa7bbdd 100644
--- a/include/net/ip6_fib.h
+++ b/include/net/ip6_fib.h
@@ -74,6 +74,11 @@ struct fib6_node {
 #define FIB6_SUBTREE(fn)        ((fn)->subtree)
 #endif
 
+struct mx6_config {
+        const u32 *mx;
+        DECLARE_BITMAP(mx_valid, RTAX_MAX);
+};
+
 /*
  *      routing information
  *
@@ -291,9 +296,8 @@ struct fib6_node *fib6_locate(struct fib6_node *root,
 void fib6_clean_all(struct net *net, int (*func)(struct rt6_info *, void *arg),
                     void *arg);
 
-int fib6_add(struct fib6_node *root, struct rt6_info *rt, struct nl_info *info,
-             struct nlattr *mx, int mx_len);
-
+int fib6_add(struct fib6_node *root, struct rt6_info *rt,
+             struct nl_info *info, struct mx6_config *mxc);
 int fib6_del(struct rt6_info *rt, struct nl_info *info);
 
 void inet6_rt_notify(int event, struct rt6_info *rt, struct nl_info *info);
diff --git a/include/net/ip6_tunnel.h b/include/net/ip6_tunnel.h
index 9326c41c2d7f..76c091b53dae 100644
--- a/include/net/ip6_tunnel.h
+++ b/include/net/ip6_tunnel.h
@@ -70,6 +70,7 @@ int ip6_tnl_xmit_ctl(struct ip6_tnl *t, const struct in6_addr *laddr,
 __u16 ip6_tnl_parse_tlv_enc_lim(struct sk_buff *skb, __u8 *raw);
 __u32 ip6_tnl_get_cap(struct ip6_tnl *t, const struct in6_addr *laddr,
                              const struct in6_addr *raddr);
+struct net *ip6_tnl_get_link_net(const struct net_device *dev);
 
 static inline void ip6tunnel_xmit(struct sk_buff *skb, struct net_device *dev)
 {
diff --git a/include/net/ip_fib.h b/include/net/ip_fib.h
index 09a819ee2151..5bd120e4bc0a 100644
--- a/include/net/ip_fib.h
+++ b/include/net/ip_fib.h
@@ -222,16 +222,19 @@ static inline struct fib_table *fib_new_table(struct net *net, u32 id)
 static inline int fib_lookup(struct net *net, const struct flowi4 *flp,
                              struct fib_result *res)
 {
-        struct fib_table *table;
+        int err = -ENETUNREACH;
+
+        rcu_read_lock();
+
+        if (!fib_table_lookup(fib_get_table(net, RT_TABLE_LOCAL), flp, res,
+                              FIB_LOOKUP_NOREF) ||
+            !fib_table_lookup(fib_get_table(net, RT_TABLE_MAIN), flp, res,
+                              FIB_LOOKUP_NOREF))
+                err = 0;
 
-        table = fib_get_table(net, RT_TABLE_LOCAL);
-        if (!fib_table_lookup(table, flp, res, FIB_LOOKUP_NOREF))
-                return 0;
+        rcu_read_unlock();
 
-        table = fib_get_table(net, RT_TABLE_MAIN);
-        if (!fib_table_lookup(table, flp, res, FIB_LOOKUP_NOREF))
-                return 0;
-        return -ENETUNREACH;
+        return err;
 }
 
 #else /* CONFIG_IP_MULTIPLE_TABLES */
@@ -247,20 +250,25 @@ static inline int fib_lookup(struct net *net, struct flowi4 *flp,
                              struct fib_result *res)
 {
         if (!net->ipv4.fib_has_custom_rules) {
+                int err = -ENETUNREACH;
+
+                rcu_read_lock();
+
                 res->tclassid = 0;
-                if (net->ipv4.fib_local &&
-                    !fib_table_lookup(net->ipv4.fib_local, flp, res,
-                                      FIB_LOOKUP_NOREF))
-                        return 0;
-                if (net->ipv4.fib_main &&
-                    !fib_table_lookup(net->ipv4.fib_main, flp, res,
-                                      FIB_LOOKUP_NOREF))
-                        return 0;
-                if (net->ipv4.fib_default &&
-                    !fib_table_lookup(net->ipv4.fib_default, flp, res,
-                                      FIB_LOOKUP_NOREF))
-                        return 0;
-                return -ENETUNREACH;
+                if ((net->ipv4.fib_local &&
+                     !fib_table_lookup(net->ipv4.fib_local, flp, res,
+                                       FIB_LOOKUP_NOREF)) ||
+                    (net->ipv4.fib_main &&
+                     !fib_table_lookup(net->ipv4.fib_main, flp, res,
+                                       FIB_LOOKUP_NOREF)) ||
+                    (net->ipv4.fib_default &&
+                     !fib_table_lookup(net->ipv4.fib_default, flp, res,
+                                       FIB_LOOKUP_NOREF)))
+                        err = 0;
+
+                rcu_read_unlock();
+
+                return err;
         }
         return __fib_lookup(net, flp, res);
 }
diff --git a/include/net/ip_tunnels.h b/include/net/ip_tunnels.h
index 25a59eb388a6..2c47061a6954 100644
--- a/include/net/ip_tunnels.h
+++ b/include/net/ip_tunnels.h
@@ -97,7 +97,10 @@ struct ip_tunnel {
 #define TUNNEL_DONT_FRAGMENT    __cpu_to_be16(0x0100)
 #define TUNNEL_OAM              __cpu_to_be16(0x0200)
 #define TUNNEL_CRIT_OPT         __cpu_to_be16(0x0400)
-#define TUNNEL_OPTIONS_PRESENT  __cpu_to_be16(0x0800)
+#define TUNNEL_GENEVE_OPT       __cpu_to_be16(0x0800)
+#define TUNNEL_VXLAN_OPT        __cpu_to_be16(0x1000)
+
+#define TUNNEL_OPTIONS_PRESENT  (TUNNEL_GENEVE_OPT | TUNNEL_VXLAN_OPT)
 
 struct tnl_ptk_info {
         __be16 flags;
@@ -138,6 +141,7 @@ int ip_tunnel_encap_del_ops(const struct ip_tunnel_encap_ops *op,
 int ip_tunnel_init(struct net_device *dev);
 void ip_tunnel_uninit(struct net_device *dev);
 void  ip_tunnel_dellink(struct net_device *dev, struct list_head *head);
+struct net *ip_tunnel_get_link_net(const struct net_device *dev);
 int ip_tunnel_init_net(struct net *net, int ip_tnl_net_id,
                        struct rtnl_link_ops *ops, char *devname);
 
diff --git a/include/net/ipv6.h b/include/net/ipv6.h
index 6e416f6d3e3c..4c9fe224d73b 100644
--- a/include/net/ipv6.h
+++ b/include/net/ipv6.h
@@ -671,8 +671,6 @@ static inline int ipv6_addr_diff(const struct in6_addr *a1, const struct in6_add
         return __ipv6_addr_diff(a1, a2, sizeof(struct in6_addr));
 }
 
-u32 __ipv6_select_ident(u32 hashrnd, struct in6_addr *dst,
-                        struct in6_addr *src);
 void ipv6_select_ident(struct frag_hdr *fhdr, struct rt6_info *rt);
 void ipv6_proxy_select_ident(struct sk_buff *skb);
 
@@ -791,6 +789,25 @@ int ip6_push_pending_frames(struct sock *sk);
 
 void ip6_flush_pending_frames(struct sock *sk);
 
+int ip6_send_skb(struct sk_buff *skb);
+
+struct sk_buff *__ip6_make_skb(struct sock *sk, struct sk_buff_head *queue,
+                               struct inet_cork_full *cork,
+                               struct inet6_cork *v6_cork);
+struct sk_buff *ip6_make_skb(struct sock *sk,
+                             int getfrag(void *from, char *to, int offset,
+                                         int len, int odd, struct sk_buff *skb),
+                             void *from, int length, int transhdrlen,
+                             int hlimit, int tclass, struct ipv6_txoptions *opt,
+                             struct flowi6 *fl6, struct rt6_info *rt,
+                             unsigned int flags, int dontfrag);
+
+static inline struct sk_buff *ip6_finish_skb(struct sock *sk)
+{
+        return __ip6_make_skb(sk, &sk->sk_write_queue, &inet_sk(sk)->cork,
+                              &inet6_sk(sk)->cork);
+}
+
 int ip6_dst_lookup(struct sock *sk, struct dst_entry **dst, struct flowi6 *fl6);
 struct dst_entry *ip6_dst_lookup_flow(struct sock *sk, struct flowi6 *fl6,
                                       const struct in6_addr *final_dst);
diff --git a/include/net/mac80211.h b/include/net/mac80211.h
index 29c7be8808d5..d52914b75331 100644
--- a/include/net/mac80211.h
+++ b/include/net/mac80211.h
@@ -376,6 +376,12 @@ enum ieee80211_rssi_event {
  * @ssid_len: Length of SSID given in @ssid.
  * @hidden_ssid: The SSID of the current vif is hidden. Only valid in AP-mode.
  * @txpower: TX power in dBm
+ * @txpower_type: TX power adjustment used to control per packet Transmit
+ *      Power Control (TPC) in lower driver for the current vif. In particular
+ *      TPC is enabled if value passed in %txpower_type is
+ *      NL80211_TX_POWER_LIMITED (allow using less than specified from
+ *      userspace), whereas TPC is disabled if %txpower_type is set to
+ *      NL80211_TX_POWER_FIXED (use value configured from userspace)
  * @p2p_noa_attr: P2P NoA attribute for P2P powersave
  */
 struct ieee80211_bss_conf {
@@ -411,6 +417,7 @@ struct ieee80211_bss_conf {
         size_t ssid_len;
         bool hidden_ssid;
         int txpower;
+        enum nl80211_tx_power_setting txpower_type;
         struct ieee80211_p2p_noa_attr p2p_noa_attr;
 };
 
@@ -505,8 +512,11 @@ struct ieee80211_bss_conf {
  * @IEEE80211_TX_CTL_DONTFRAG: Don't fragment this packet even if it
  *      would be fragmented by size (this is optional, only used for
  *      monitor injection).
- * @IEEE80211_TX_CTL_PS_RESPONSE: This frame is a response to a poll
- *      frame (PS-Poll or uAPSD).
+ * @IEEE80211_TX_STAT_NOACK_TRANSMITTED: A frame that was marked with
+ *      IEEE80211_TX_CTL_NO_ACK has been successfully transmitted without
+ *      any errors (like issues specific to the driver/HW).
+ *      This flag must not be set for frames that don't request no-ack
+ *      behaviour with IEEE80211_TX_CTL_NO_ACK.
  *
  * Note: If you have to add new flags to the enumeration, then don't
  *       forget to update %IEEE80211_TX_TEMPORARY_FLAGS when necessary.
@@ -542,7 +552,7 @@ enum mac80211_tx_info_flags {
         IEEE80211_TX_STATUS_EOSP                = BIT(28),
         IEEE80211_TX_CTL_USE_MINRATE            = BIT(29),
         IEEE80211_TX_CTL_DONTFRAG               = BIT(30),
-        IEEE80211_TX_CTL_PS_RESPONSE            = BIT(31),
+        IEEE80211_TX_STAT_NOACK_TRANSMITTED     = BIT(31),
 };
 
 #define IEEE80211_TX_CTL_STBC_SHIFT             23
@@ -552,11 +562,14 @@ enum mac80211_tx_info_flags {
  *
  * @IEEE80211_TX_CTRL_PORT_CTRL_PROTO: this frame is a port control
  *      protocol frame (e.g. EAP)
+ * @IEEE80211_TX_CTRL_PS_RESPONSE: This frame is a response to a poll
+ *      frame (PS-Poll or uAPSD).
  *
  * These flags are used in tx_info->control.flags.
  */
 enum mac80211_tx_control_flags {
         IEEE80211_TX_CTRL_PORT_CTRL_PROTO       = BIT(0),
+        IEEE80211_TX_CTRL_PS_RESPONSE           = BIT(1),
 };
 
 /*
@@ -925,15 +938,13 @@ enum mac80211_rx_flags {
  * These flags are used with the @vht_flag member of
  *      &struct ieee80211_rx_status.
  * @RX_VHT_FLAG_80MHZ: 80 MHz was used
- * @RX_VHT_FLAG_80P80MHZ: 80+80 MHz was used
  * @RX_VHT_FLAG_160MHZ: 160 MHz was used
  * @RX_VHT_FLAG_BF: packet was beamformed
  */
 enum mac80211_rx_vht_flags {
         RX_VHT_FLAG_80MHZ               = BIT(0),
-        RX_VHT_FLAG_80P80MHZ            = BIT(1),
-        RX_VHT_FLAG_160MHZ              = BIT(2),
-        RX_VHT_FLAG_BF                  = BIT(3),
+        RX_VHT_FLAG_160MHZ              = BIT(1),
+        RX_VHT_FLAG_BF                  = BIT(2),
 };
 
 /**
@@ -1181,10 +1192,15 @@ struct ieee80211_channel_switch {
  *      monitoring on this virtual interface -- i.e. it can monitor
  *      connection quality related parameters, such as the RSSI level and
  *      provide notifications if configured trigger levels are reached.
+ * @IEEE80211_VIF_SUPPORTS_UAPSD: The device can do U-APSD for this
+ *      interface. This flag should be set during interface addition,
+ *      but may be set/cleared as late as authentication to an AP. It is
+ *      only valid for managed/station mode interfaces.
  */
 enum ieee80211_vif_flags {
         IEEE80211_VIF_BEACON_FILTER             = BIT(0),
         IEEE80211_VIF_SUPPORTS_CQM_RSSI         = BIT(1),
+        IEEE80211_VIF_SUPPORTS_UAPSD            = BIT(2),
 };
 
 /**
@@ -1270,19 +1286,22 @@ struct ieee80211_vif *wdev_to_ieee80211_vif(struct wireless_dev *wdev);
  *
  * @IEEE80211_KEY_FLAG_GENERATE_IV: This flag should be set by the
  *      driver to indicate that it requires IV generation for this
- *      particular key.
+ *      particular key. Setting this flag does not necessarily mean that SKBs
+ *      will have sufficient tailroom for ICV or MIC.
  * @IEEE80211_KEY_FLAG_GENERATE_MMIC: This flag should be set by
  *      the driver for a TKIP key if it requires Michael MIC
  *      generation in software.
  * @IEEE80211_KEY_FLAG_PAIRWISE: Set by mac80211, this flag indicates
  *      that the key is pairwise rather then a shared key.
  * @IEEE80211_KEY_FLAG_SW_MGMT_TX: This flag should be set by the driver for a
- *      CCMP key if it requires CCMP encryption of management frames (MFP) to
- *      be done in software.
+ *      CCMP/GCMP key if it requires CCMP/GCMP encryption of management frames
+ *      (MFP) to be done in software.
  * @IEEE80211_KEY_FLAG_PUT_IV_SPACE: This flag should be set by the driver
  *      if space should be prepared for the IV, but the IV
  *      itself should not be generated. Do not set together with
- *      @IEEE80211_KEY_FLAG_GENERATE_IV on the same key.
+ *      @IEEE80211_KEY_FLAG_GENERATE_IV on the same key. Setting this flag does
+ *      not necessarily mean that SKBs will have sufficient tailroom for ICV or
+ *      MIC.
  * @IEEE80211_KEY_FLAG_RX_MGMT: This key will be used to decrypt received
  *      management frames. The flag can help drivers that have a hardware
  *      crypto implementation that doesn't deal with management frames
@@ -1291,8 +1310,11 @@ struct ieee80211_vif *wdev_to_ieee80211_vif(struct wireless_dev *wdev);
  *      RX, if your crypto engine can't deal with TX you can also set the
  *      %IEEE80211_KEY_FLAG_SW_MGMT_TX flag to encrypt such frames in SW.
  * @IEEE80211_KEY_FLAG_GENERATE_IV_MGMT: This flag should be set by the
- *      driver for a CCMP key to indicate that is requires IV generation
+ *      driver for a CCMP/GCMP key to indicate that is requires IV generation
  *      only for managment frames (MFP).
+ * @IEEE80211_KEY_FLAG_RESERVE_TAILROOM: This flag should be set by the
+ *      driver for a key to indicate that sufficient tailroom must always
+ *      be reserved for ICV or MIC, even when HW encryption is enabled.
  */
 enum ieee80211_key_flags {
         IEEE80211_KEY_FLAG_GENERATE_IV_MGMT     = BIT(0),
@@ -1302,6 +1324,7 @@ enum ieee80211_key_flags {
         IEEE80211_KEY_FLAG_SW_MGMT_TX           = BIT(4),
         IEEE80211_KEY_FLAG_PUT_IV_SPACE         = BIT(5),
         IEEE80211_KEY_FLAG_RX_MGMT              = BIT(6),
+        IEEE80211_KEY_FLAG_RESERVE_TAILROOM     = BIT(7),
 };
 
 /**
@@ -1580,11 +1603,6 @@ struct ieee80211_tx_control {
  * @IEEE80211_HW_MFP_CAPABLE:
  *      Hardware supports management frame protection (MFP, IEEE 802.11w).
  *
- * @IEEE80211_HW_SUPPORTS_UAPSD:
- *      Hardware supports Unscheduled Automatic Power Save Delivery
- *      (U-APSD) in managed mode. The mode is configured with
- *      conf_tx() operation.
- *
  * @IEEE80211_HW_REPORTS_TX_ACK_STATUS:
  *      Hardware can provide ack status reports of Tx frames to
  *      the stack.
@@ -1623,6 +1641,12 @@ struct ieee80211_tx_control {
  *      be created.  It is expected user-space will create vifs as
  *      desired (and thus have them named as desired).
  *
+ * @IEEE80211_HW_SW_CRYPTO_CONTROL: The driver wants to control which of the
+ *      crypto algorithms can be done in software - so don't automatically
+ *      try to fall back to it if hardware crypto fails, but do so only if
+ *      the driver returns 1. This also forces the driver to advertise its
+ *      supported cipher suites.
+ *
  * @IEEE80211_HW_QUEUE_CONTROL: The driver wants to control per-interface
  *      queue mapping in order to use different queues (not just one per AC)
  *      for different virtual interfaces. See the doc section on HW queue
@@ -1670,8 +1694,8 @@ enum ieee80211_hw_flags {
         IEEE80211_HW_MFP_CAPABLE                        = 1<<13,
         IEEE80211_HW_WANT_MONITOR_VIF                   = 1<<14,
         IEEE80211_HW_NO_AUTO_VIF                        = 1<<15,
-        /* free slot */
-        IEEE80211_HW_SUPPORTS_UAPSD                     = 1<<17,
+        IEEE80211_HW_SW_CRYPTO_CONTROL                  = 1<<16,
+        /* free slots */
         IEEE80211_HW_REPORTS_TX_ACK_STATUS              = 1<<18,
         IEEE80211_HW_CONNECTION_MONITOR                 = 1<<19,
         IEEE80211_HW_QUEUE_CONTROL                      = 1<<20,
@@ -1945,6 +1969,11 @@ void ieee80211_free_txskb(struct ieee80211_hw *hw, struct sk_buff *skb);
  * added; if you return 0 then hw_key_idx must be assigned to the
  * hardware key index, you are free to use the full u8 range.
  *
+ * Note that in the case that the @IEEE80211_HW_SW_CRYPTO_CONTROL flag is
+ * set, mac80211 will not automatically fall back to software crypto if
+ * enabling hardware crypto failed. The set_key() call may also return the
+ * value 1 to permit this specific key/algorithm to be done in software.
+ *
  * When the cmd is %DISABLE_KEY then it must succeed.
  *
  * Note that it is permissible to not decrypt a frame even if a key
@@ -2023,7 +2052,7 @@ void ieee80211_free_txskb(struct ieee80211_hw *hw, struct sk_buff *skb);
  * enabled whenever user has enabled powersave.
  *
  * Driver informs U-APSD client support by enabling
- * %IEEE80211_HW_SUPPORTS_UAPSD flag. The mode is configured through the
+ * %IEEE80211_VIF_SUPPORTS_UAPSD flag. The mode is configured through the
  * uapsd parameter in conf_tx() operation. Hardware needs to send the QoS
  * Nullfunc frames and stay awake until the service period has ended. To
  * utilize U-APSD, dynamic powersave is disabled for voip AC and all frames
@@ -2696,6 +2725,14 @@ enum ieee80211_reconfig_type {
  *      is only used if the configured rate control algorithm actually uses
  *      the new rate table API, and is therefore optional. Must be atomic.
  *
+ * @sta_statistics: Get statistics for this station. For example with beacon
+ *      filtering, the statistics kept by mac80211 might not be accurate, so
+ *      let the driver pre-fill the statistics. The driver can fill most of
+ *      the values (indicating which by setting the filled bitmap), but not
+ *      all of them make sense - see the source for which ones are possible.
+ *      Statistics that the driver doesn't fill will be filled by mac80211.
+ *      The callback can sleep.
+ *
  * @conf_tx: Configure TX queue parameters (EDCF (aifs, cw_min, cw_max),
  *      bursting) for a hardware TX queue.
  *      Returns a negative error code on failure.
@@ -2856,9 +2893,6 @@ enum ieee80211_reconfig_type {
  * @get_et_strings:  Ethtool API to get a set of strings to describe stats
  *      and perhaps other supported types of ethtool data-sets.
  *
- * @get_rssi: Get current signal strength in dBm, the function is optional
- *      and can sleep.
- *
  * @mgd_prepare_tx: Prepare for transmitting a management frame for association
  *      before associated. In multi-channel scenarios, a virtual interface is
  *      bound to a channel before it is associated, but as it isn't associated
@@ -3059,6 +3093,10 @@ struct ieee80211_ops {
         void (*sta_rate_tbl_update)(struct ieee80211_hw *hw,
                                     struct ieee80211_vif *vif,
                                     struct ieee80211_sta *sta);
+        void (*sta_statistics)(struct ieee80211_hw *hw,
+                               struct ieee80211_vif *vif,
+                               struct ieee80211_sta *sta,
+                               struct station_info *sinfo);
         int (*conf_tx)(struct ieee80211_hw *hw,
                        struct ieee80211_vif *vif, u16 ac,
                        const struct ieee80211_tx_queue_params *params);
@@ -3126,8 +3164,6 @@ struct ieee80211_ops {
         void    (*get_et_strings)(struct ieee80211_hw *hw,
                                   struct ieee80211_vif *vif,
                                   u32 sset, u8 *data);
-        int     (*get_rssi)(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
-                            struct ieee80211_sta *sta, s8 *rssi_dbm);
 
         void    (*mgd_prepare_tx)(struct ieee80211_hw *hw,
                                   struct ieee80211_vif *vif);
@@ -4062,6 +4098,10 @@ void ieee80211_aes_cmac_calculate_k1_k2(struct ieee80211_key_conf *keyconf,
  *      reverse order than in packet)
  * @aes_cmac: PN data, most significant byte first (big endian,
  *      reverse order than in packet)
+ * @aes_gmac: PN data, most significant byte first (big endian,
+ *      reverse order than in packet)
+ * @gcmp: PN data, most significant byte first (big endian,
+ *      reverse order than in packet)
  */
 struct ieee80211_key_seq {
         union {
@@ -4075,6 +4115,12 @@ struct ieee80211_key_seq {
                 struct {
                         u8 pn[6];
                 } aes_cmac;
+                struct {
+                        u8 pn[6];
+                } aes_gmac;
+                struct {
+                        u8 pn[6];
+                } gcmp;
         };
 };
 
@@ -4099,7 +4145,7 @@ void ieee80211_get_key_tx_seq(struct ieee80211_key_conf *keyconf,
  * ieee80211_get_key_rx_seq - get key RX sequence counter
  *
  * @keyconf: the parameter passed with the set key
- * @tid: The TID, or -1 for the management frame value (CCMP only);
+ * @tid: The TID, or -1 for the management frame value (CCMP/GCMP only);
  *      the value on TID 0 is also used for non-QoS frames. For
  *      CMAC, only TID 0 is valid.
  * @seq: buffer to receive the sequence data
@@ -4135,7 +4181,7 @@ void ieee80211_set_key_tx_seq(struct ieee80211_key_conf *keyconf,
  * ieee80211_set_key_rx_seq - set key RX sequence counter
  *
  * @keyconf: the parameter passed with the set key
- * @tid: The TID, or -1 for the management frame value (CCMP only);
+ * @tid: The TID, or -1 for the management frame value (CCMP/GCMP only);
  *      the value on TID 0 is also used for non-QoS frames. For
  *      CMAC, only TID 0 is valid.
  * @seq: new sequence data
diff --git a/include/net/mac802154.h b/include/net/mac802154.h
index c823d910b46c..850647811749 100644
--- a/include/net/mac802154.h
+++ b/include/net/mac802154.h
@@ -20,6 +20,8 @@
 #include <linux/ieee802154.h>
 #include <linux/skbuff.h>
 
+#include <net/cfg802154.h>
+
 /* General MAC frame format:
  *  2 bytes: Frame Control
  *  1 byte:  Sequence Number
@@ -212,7 +214,8 @@ struct ieee802154_ops {
                                             unsigned long changed);
         int             (*set_txpower)(struct ieee802154_hw *hw, int db);
         int             (*set_lbt)(struct ieee802154_hw *hw, bool on);
-        int             (*set_cca_mode)(struct ieee802154_hw *hw, u8 mode);
+        int             (*set_cca_mode)(struct ieee802154_hw *hw,
+                                        const struct wpan_phy_cca *cca);
         int             (*set_cca_ed_level)(struct ieee802154_hw *hw,
                                             s32 level);
         int             (*set_csma_params)(struct ieee802154_hw *hw,
diff --git a/include/net/net_namespace.h b/include/net/net_namespace.h
index 2e8756b8c775..36faf4990c4b 100644
--- a/include/net/net_namespace.h
+++ b/include/net/net_namespace.h
@@ -60,6 +60,7 @@ struct net {
         struct list_head        exit_list;      /* Use only net_mutex */
 
         struct user_namespace   *user_ns;       /* Owning user namespace */
+        struct idr              netns_ids;
 
         struct ns_common        ns;
 
@@ -290,6 +291,9 @@ static inline struct net *read_pnet(struct net * const *pnet)
 #define __net_initconst __initconst
 #endif
 
+int peernet2id(struct net *net, struct net *peer);
+struct net *get_net_ns_by_id(struct net *net, int id);
+
 struct pernet_operations {
         struct list_head list;
         int (*init)(struct net *net);
diff --git a/include/net/netfilter/nf_conntrack.h b/include/net/netfilter/nf_conntrack.h
index f0daed2b54d1..74f271a172dd 100644
--- a/include/net/netfilter/nf_conntrack.h
+++ b/include/net/netfilter/nf_conntrack.h
@@ -191,8 +191,6 @@ __nf_conntrack_find(struct net *net, u16 zone,
 int nf_conntrack_hash_check_insert(struct nf_conn *ct);
 bool nf_ct_delete(struct nf_conn *ct, u32 pid, int report);
 
-void nf_conntrack_flush_report(struct net *net, u32 portid, int report);
-
 bool nf_ct_get_tuplepr(const struct sk_buff *skb, unsigned int nhoff,
                        u_int16_t l3num, struct nf_conntrack_tuple *tuple);
 bool nf_ct_invert_tuplepr(struct nf_conntrack_tuple *inverse,
diff --git a/include/net/netlink.h b/include/net/netlink.h
index 64158353ecb2..e010ee8da41d 100644
--- a/include/net/netlink.h
+++ b/include/net/netlink.h
@@ -490,14 +490,10 @@ static inline struct sk_buff *nlmsg_new(size_t payload, gfp_t flags)
  * Corrects the netlink message header to include the appeneded
  * attributes. Only necessary if attributes have been added to
  * the message.
- *
- * Returns the total data length of the skb.
  */
-static inline int nlmsg_end(struct sk_buff *skb, struct nlmsghdr *nlh)
+static inline void nlmsg_end(struct sk_buff *skb, struct nlmsghdr *nlh)
 {
         nlh->nlmsg_len = skb_tail_pointer(skb) - (unsigned char *)nlh;
-
-        return skb->len;
 }
 
 /**
@@ -520,8 +516,10 @@ static inline void *nlmsg_get_pos(struct sk_buff *skb)
  */
 static inline void nlmsg_trim(struct sk_buff *skb, const void *mark)
 {
-        if (mark)
+        if (mark) {
+                WARN_ON((unsigned char *) mark < skb->data);
                 skb_trim(skb, (unsigned char *) mark - skb->data);
+        }
 }
 
 /**
diff --git a/include/net/netns/ipv4.h b/include/net/netns/ipv4.h
index 0ffef1a38efc..dbe225478adb 100644
--- a/include/net/netns/ipv4.h
+++ b/include/net/netns/ipv4.h
@@ -48,7 +48,8 @@ struct netns_ipv4 {
         struct hlist_head       *fib_table_hash;
         struct sock             *fibnl;
 
-        struct sock             **icmp_sk;
+        struct sock  * __percpu *icmp_sk;
+
         struct inet_peer_base   *peers;
         struct tcpm_hash_bucket *tcp_metrics_hash;
         unsigned int            tcp_metrics_hash_log;
@@ -81,6 +82,8 @@ struct netns_ipv4 {
 
         int sysctl_fwmark_reflect;
         int sysctl_tcp_fwmark_accept;
+        int sysctl_tcp_mtu_probing;
+        int sysctl_tcp_base_mss;
 
         struct ping_group_range ping_group_range;
 
diff --git a/include/net/nfc/hci.h b/include/net/nfc/hci.h
index 14bd0e1c47fa..ab672b537dd4 100644
--- a/include/net/nfc/hci.h
+++ b/include/net/nfc/hci.h
@@ -51,8 +51,10 @@ struct nfc_hci_ops {
         int (*tm_send)(struct nfc_hci_dev *hdev, struct sk_buff *skb);
         int (*check_presence)(struct nfc_hci_dev *hdev,
                               struct nfc_target *target);
-        int (*event_received)(struct nfc_hci_dev *hdev, u8 gate, u8 event,
+        int (*event_received)(struct nfc_hci_dev *hdev, u8 pipe, u8 event,
                               struct sk_buff *skb);
+        void (*cmd_received)(struct nfc_hci_dev *hdev, u8 pipe, u8 cmd,
+                            struct sk_buff *skb);
         int (*fw_download)(struct nfc_hci_dev *hdev, const char *firmware_name);
         int (*discover_se)(struct nfc_hci_dev *dev);
         int (*enable_se)(struct nfc_hci_dev *dev, u32 se_idx);
@@ -63,8 +65,10 @@ struct nfc_hci_ops {
 };
 
 /* Pipes */
-#define NFC_HCI_INVALID_PIPE    0x80
 #define NFC_HCI_DO_NOT_CREATE_PIPE      0x81
+#define NFC_HCI_INVALID_PIPE    0x80
+#define NFC_HCI_INVALID_GATE    0xFF
+#define NFC_HCI_INVALID_HOST    0x80
 #define NFC_HCI_LINK_MGMT_PIPE  0x00
 #define NFC_HCI_ADMIN_PIPE      0x01
 
@@ -73,7 +77,13 @@ struct nfc_hci_gate {
         u8 pipe;
 };
 
+struct nfc_hci_pipe {
+        u8 gate;
+        u8 dest_host;
+};
+
 #define NFC_HCI_MAX_CUSTOM_GATES        50
+#define NFC_HCI_MAX_PIPES               127
 struct nfc_hci_init_data {
         u8 gate_count;
         struct nfc_hci_gate gates[NFC_HCI_MAX_CUSTOM_GATES];
@@ -125,6 +135,7 @@ struct nfc_hci_dev {
         void *clientdata;
 
         u8 gate2pipe[NFC_HCI_MAX_GATES];
+        struct nfc_hci_pipe pipes[NFC_HCI_MAX_PIPES];
 
         u8 sw_romlib;
         u8 sw_patch;
@@ -167,6 +178,8 @@ void *nfc_hci_get_clientdata(struct nfc_hci_dev *hdev);
 void nfc_hci_driver_failure(struct nfc_hci_dev *hdev, int err);
 
 int nfc_hci_result_to_errno(u8 result);
+void nfc_hci_reset_pipes(struct nfc_hci_dev *dev);
+void nfc_hci_reset_pipes_per_host(struct nfc_hci_dev *hdev, u8 host);
 
 /* Host IDs */
 #define NFC_HCI_HOST_CONTROLLER_ID      0x00
@@ -219,6 +232,12 @@ int nfc_hci_result_to_errno(u8 result);
 #define NFC_HCI_EVT_POST_DATA                   0x02
 #define NFC_HCI_EVT_HOT_PLUG                    0x03
 
+/* Generic commands */
+#define NFC_HCI_ANY_SET_PARAMETER       0x01
+#define NFC_HCI_ANY_GET_PARAMETER       0x02
+#define NFC_HCI_ANY_OPEN_PIPE           0x03
+#define NFC_HCI_ANY_CLOSE_PIPE          0x04
+
 /* Reader RF gates events */
 #define NFC_HCI_EVT_READER_REQUESTED    0x10
 #define NFC_HCI_EVT_END_OPERATION       0x11
@@ -249,8 +268,6 @@ int nfc_hci_send_cmd(struct nfc_hci_dev *hdev, u8 gate, u8 cmd,
 int nfc_hci_send_cmd_async(struct nfc_hci_dev *hdev, u8 gate, u8 cmd,
                            const u8 *param, size_t param_len,
                            data_exchange_cb_t cb, void *cb_context);
-int nfc_hci_send_response(struct nfc_hci_dev *hdev, u8 gate, u8 response,
-                          const u8 *param, size_t param_len);
 int nfc_hci_send_event(struct nfc_hci_dev *hdev, u8 gate, u8 event,
                        const u8 *param, size_t param_len);
 int nfc_hci_target_discovered(struct nfc_hci_dev *hdev, u8 gate);
diff --git a/include/net/nfc/nci.h b/include/net/nfc/nci.h
index e7257a4653b4..a2f2f3d3196d 100644
--- a/include/net/nfc/nci.h
+++ b/include/net/nfc/nci.h
@@ -62,6 +62,25 @@
 #define NCI_STATUS_NFCEE_PROTOCOL_ERROR                         0xc2
 #define NCI_STATUS_NFCEE_TIMEOUT_ERROR                          0xc3
 
+/* NFCEE Interface/Protocols */
+#define NCI_NFCEE_INTERFACE_APDU           0x00
+#define NCI_NFCEE_INTERFACE_HCI_ACCESS     0x01
+#define NCI_NFCEE_INTERFACE_TYPE3_CMD_SET  0x02
+#define NCI_NFCEE_INTERFACE_TRANSPARENT        0x03
+
+/* Destination type */
+#define NCI_DESTINATION_NFCC_LOOPBACK      0x01
+#define NCI_DESTINATION_REMOTE_NFC_ENDPOINT    0x02
+#define NCI_DESTINATION_NFCEE              0x03
+
+/* Destination-specific parameters type */
+#define NCI_DESTINATION_SPECIFIC_PARAM_RF_TYPE     0x00
+#define NCI_DESTINATION_SPECIFIC_PARAM_NFCEE_TYPE  0x01
+
+/* NFCEE Discovery Action */
+#define NCI_NFCEE_DISCOVERY_ACTION_DISABLE                      0x00
+#define NCI_NFCEE_DISCOVERY_ACTION_ENABLE                       0x01
+
 /* NCI RF Technology and Mode */
 #define NCI_NFC_A_PASSIVE_POLL_MODE                             0x00
 #define NCI_NFC_B_PASSIVE_POLL_MODE                             0x01
@@ -224,6 +243,28 @@ struct nci_core_set_config_cmd {
         struct  set_config_param param; /* support 1 param per cmd is enough */
 } __packed;
 
+#define NCI_OP_CORE_CONN_CREATE_CMD     nci_opcode_pack(NCI_GID_CORE, 0x04)
+#define DEST_SPEC_PARAMS_ID_INDEX       0
+#define DEST_SPEC_PARAMS_PROTOCOL_INDEX 1
+struct dest_spec_params {
+        __u8    id;
+        __u8    protocol;
+} __packed;
+
+struct core_conn_create_dest_spec_params {
+        __u8    type;
+        __u8    length;
+        __u8    value[0];
+} __packed;
+
+struct nci_core_conn_create_cmd {
+        __u8    destination_type;
+        __u8    number_destination_params;
+        struct core_conn_create_dest_spec_params params[0];
+} __packed;
+
+#define NCI_OP_CORE_CONN_CLOSE_CMD      nci_opcode_pack(NCI_GID_CORE, 0x05)
+
 #define NCI_OP_RF_DISCOVER_MAP_CMD      nci_opcode_pack(NCI_GID_RF_MGMT, 0x00)
 struct disc_map_config {
         __u8    rf_protocol;
@@ -260,6 +301,19 @@ struct nci_rf_deactivate_cmd {
         __u8    type;
 } __packed;
 
+#define NCI_OP_NFCEE_DISCOVER_CMD nci_opcode_pack(NCI_GID_NFCEE_MGMT, 0x00)
+struct nci_nfcee_discover_cmd {
+        __u8    discovery_action;
+} __packed;
+
+#define NCI_OP_NFCEE_MODE_SET_CMD nci_opcode_pack(NCI_GID_NFCEE_MGMT, 0x01)
+#define NCI_NFCEE_DISABLE       0x00
+#define NCI_NFCEE_ENABLE        0x01
+struct nci_nfcee_mode_set_cmd {
+        __u8    nfcee_id;
+        __u8    nfcee_mode;
+} __packed;
+
 /* ----------------------- */
 /* ---- NCI Responses ---- */
 /* ----------------------- */
@@ -295,6 +349,16 @@ struct nci_core_set_config_rsp {
         __u8    params_id[0];   /* variable size array */
 } __packed;
 
+#define NCI_OP_CORE_CONN_CREATE_RSP     nci_opcode_pack(NCI_GID_CORE, 0x04)
+struct nci_core_conn_create_rsp {
+        __u8    status;
+        __u8    max_ctrl_pkt_payload_len;
+        __u8    credits_cnt;
+        __u8    conn_id;
+} __packed;
+
+#define NCI_OP_CORE_CONN_CLOSE_RSP      nci_opcode_pack(NCI_GID_CORE, 0x05)
+
 #define NCI_OP_RF_DISCOVER_MAP_RSP      nci_opcode_pack(NCI_GID_RF_MGMT, 0x00)
 
 #define NCI_OP_RF_DISCOVER_RSP          nci_opcode_pack(NCI_GID_RF_MGMT, 0x03)
@@ -303,6 +367,13 @@ struct nci_core_set_config_rsp {
 
 #define NCI_OP_RF_DEACTIVATE_RSP        nci_opcode_pack(NCI_GID_RF_MGMT, 0x06)
 
+#define NCI_OP_NFCEE_DISCOVER_RSP nci_opcode_pack(NCI_GID_NFCEE_MGMT, 0x00)
+struct nci_nfcee_discover_rsp {
+        __u8    status;
+        __u8    num_nfcee;
+} __packed;
+
+#define NCI_OP_NFCEE_MODE_SET_RSP nci_opcode_pack(NCI_GID_NFCEE_MGMT, 0x01)
 /* --------------------------- */
 /* ---- NCI Notifications ---- */
 /* --------------------------- */
@@ -430,4 +501,30 @@ struct nci_rf_deactivate_ntf {
         __u8    reason;
 } __packed;
 
+#define NCI_OP_RF_NFCEE_ACTION_NTF      nci_opcode_pack(NCI_GID_RF_MGMT, 0x09)
+struct nci_rf_nfcee_action_ntf {
+        __u8 nfcee_id;
+        __u8 trigger;
+        __u8 supported_data_length;
+        __u8 supported_data[0];
+} __packed;
+
+#define NCI_OP_NFCEE_DISCOVER_NTF nci_opcode_pack(NCI_GID_NFCEE_MGMT, 0x00)
+struct nci_nfcee_supported_protocol {
+        __u8    num_protocol;
+        __u8    supported_protocol[0];
+} __packed;
+
+struct nci_nfcee_information_tlv {
+        __u8    num_tlv;
+        __u8    information_tlv[0];
+} __packed;
+
+struct nci_nfcee_discover_ntf {
+        __u8    nfcee_id;
+        __u8    nfcee_status;
+        struct nci_nfcee_supported_protocol supported_protocols;
+        struct nci_nfcee_information_tlv        information_tlv;
+} __packed;
+
 #endif /* __NCI_H */
diff --git a/include/net/nfc/nci_core.h b/include/net/nfc/nci_core.h
index 9e51bb4d841e..ff87f8611fa3 100644
--- a/include/net/nfc/nci_core.h
+++ b/include/net/nfc/nci_core.h
@@ -78,15 +78,107 @@ struct nci_ops {
         int   (*se_io)(struct nci_dev *ndev, u32 se_idx,
                                 u8 *apdu, size_t apdu_length,
                                 se_io_cb_t cb, void *cb_context);
+        int   (*hci_load_session)(struct nci_dev *ndev);
+        void  (*hci_event_received)(struct nci_dev *ndev, u8 pipe, u8 event,
+                                    struct sk_buff *skb);
+        void  (*hci_cmd_received)(struct nci_dev *ndev, u8 pipe, u8 cmd,
+                                  struct sk_buff *skb);
 };
 
 #define NCI_MAX_SUPPORTED_RF_INTERFACES         4
 #define NCI_MAX_DISCOVERED_TARGETS              10
+#define NCI_MAX_NUM_NFCEE   255
+#define NCI_MAX_CONN_ID         7
+
+struct nci_conn_info {
+        struct list_head list;
+        __u8    id; /* can be an RF Discovery ID or an NFCEE ID */
+        __u8    conn_id;
+        __u8    max_pkt_payload_len;
+
+        atomic_t credits_cnt;
+        __u8     initial_num_credits;
+
+        data_exchange_cb_t      data_exchange_cb;
+        void *data_exchange_cb_context;
+
+        struct sk_buff *rx_skb;
+};
+
+#define NCI_INVALID_CONN_ID 0x80
+
+#define NCI_HCI_ANY_OPEN_PIPE      0x03
+
+/* Gates */
+#define NCI_HCI_ADMIN_GATE         0x00
+#define NCI_HCI_LINK_MGMT_GATE     0x06
+
+/* Pipes */
+#define NCI_HCI_LINK_MGMT_PIPE             0x00
+#define NCI_HCI_ADMIN_PIPE                 0x01
+
+/* Generic responses */
+#define NCI_HCI_ANY_OK                     0x00
+#define NCI_HCI_ANY_E_NOT_CONNECTED        0x01
+#define NCI_HCI_ANY_E_CMD_PAR_UNKNOWN      0x02
+#define NCI_HCI_ANY_E_NOK                  0x03
+#define NCI_HCI_ANY_E_PIPES_FULL           0x04
+#define NCI_HCI_ANY_E_REG_PAR_UNKNOWN      0x05
+#define NCI_HCI_ANY_E_PIPE_NOT_OPENED      0x06
+#define NCI_HCI_ANY_E_CMD_NOT_SUPPORTED    0x07
+#define NCI_HCI_ANY_E_INHIBITED            0x08
+#define NCI_HCI_ANY_E_TIMEOUT              0x09
+#define NCI_HCI_ANY_E_REG_ACCESS_DENIED    0x0a
+#define NCI_HCI_ANY_E_PIPE_ACCESS_DENIED   0x0b
+
+#define NCI_HCI_DO_NOT_OPEN_PIPE           0x81
+#define NCI_HCI_INVALID_PIPE               0x80
+#define NCI_HCI_INVALID_GATE               0xFF
+#define NCI_HCI_INVALID_HOST               0x80
+
+#define NCI_HCI_MAX_CUSTOM_GATES   50
+#define NCI_HCI_MAX_PIPES          127
+
+struct nci_hci_gate {
+        u8 gate;
+        u8 pipe;
+        u8 dest_host;
+} __packed;
+
+struct nci_hci_pipe {
+        u8 gate;
+        u8 host;
+} __packed;
+
+struct nci_hci_init_data {
+        u8 gate_count;
+        struct nci_hci_gate gates[NCI_HCI_MAX_CUSTOM_GATES];
+        char session_id[9];
+};
+
+#define NCI_HCI_MAX_GATES          256
+
+struct nci_hci_dev {
+        u8 nfcee_id;
+        struct nci_dev *ndev;
+        struct nci_conn_info *conn_info;
+
+        struct nci_hci_init_data init_data;
+        struct nci_hci_pipe pipes[NCI_HCI_MAX_PIPES];
+        u8 gate2pipe[NCI_HCI_MAX_GATES];
+        int expected_pipes;
+        int count_pipes;
+
+        struct sk_buff_head rx_hcp_frags;
+        struct work_struct msg_rx_work;
+        struct sk_buff_head msg_rx_queue;
+};
 
 /* NCI Core structures */
 struct nci_dev {
         struct nfc_dev          *nfc_dev;
         struct nci_ops          *ops;
+        struct nci_hci_dev      *hci_dev;
 
         int                     tx_headroom;
         int                     tx_tailroom;
@@ -95,7 +187,10 @@ struct nci_dev {
         unsigned long           flags;
 
         atomic_t                cmd_cnt;
-        atomic_t                credits_cnt;
+        __u8                    cur_conn_id;
+
+        struct list_head        conn_info_list;
+        struct nci_conn_info    *rf_conn_info;
 
         struct timer_list       cmd_timer;
         struct timer_list       data_timer;
@@ -141,13 +236,10 @@ struct nci_dev {
         __u8                    manufact_id;
         __u32                   manufact_specific_info;
 
-        /* received during NCI_OP_RF_INTF_ACTIVATED_NTF */
-        __u8                    max_data_pkt_payload_size;
-        __u8                    initial_num_credits;
+        /* Save RF Discovery ID or NFCEE ID under conn_create */
+        __u8                    cur_id;
 
         /* stored during nci_data_exchange */
-        data_exchange_cb_t      data_exchange_cb;
-        void                    *data_exchange_cb_context;
         struct sk_buff          *rx_data_reassembly;
 
         /* stored during intf_activated_ntf */
@@ -163,9 +255,36 @@ struct nci_dev *nci_allocate_device(struct nci_ops *ops,
 void nci_free_device(struct nci_dev *ndev);
 int nci_register_device(struct nci_dev *ndev);
 void nci_unregister_device(struct nci_dev *ndev);
+int nci_request(struct nci_dev *ndev,
+                void (*req)(struct nci_dev *ndev,
+                            unsigned long opt),
+                unsigned long opt, __u32 timeout);
 int nci_recv_frame(struct nci_dev *ndev, struct sk_buff *skb);
 int nci_set_config(struct nci_dev *ndev, __u8 id, size_t len, __u8 *val);
 
+int nci_nfcee_discover(struct nci_dev *ndev, u8 action);
+int nci_nfcee_mode_set(struct nci_dev *ndev, u8 nfcee_id, u8 nfcee_mode);
+int nci_core_conn_create(struct nci_dev *ndev, u8 destination_type,
+                         u8 number_destination_params,
+                         size_t params_len,
+                         struct core_conn_create_dest_spec_params *params);
+int nci_core_conn_close(struct nci_dev *ndev, u8 conn_id);
+
+struct nci_hci_dev *nci_hci_allocate(struct nci_dev *ndev);
+int nci_hci_send_event(struct nci_dev *ndev, u8 gate, u8 event,
+                       const u8 *param, size_t param_len);
+int nci_hci_send_cmd(struct nci_dev *ndev, u8 gate,
+                     u8 cmd, const u8 *param, size_t param_len,
+                     struct sk_buff **skb);
+int nci_hci_open_pipe(struct nci_dev *ndev, u8 pipe);
+int nci_hci_connect_gate(struct nci_dev *ndev, u8 dest_host,
+                         u8 dest_gate, u8 pipe);
+int nci_hci_set_param(struct nci_dev *ndev, u8 gate, u8 idx,
+                      const u8 *param, size_t param_len);
+int nci_hci_get_param(struct nci_dev *ndev, u8 gate, u8 idx,
+                      struct sk_buff **skb);
+int nci_hci_dev_session_init(struct nci_dev *ndev);
+
 static inline struct sk_buff *nci_skb_alloc(struct nci_dev *ndev,
                                             unsigned int len,
                                             gfp_t how)
@@ -200,7 +319,9 @@ void nci_rx_data_packet(struct nci_dev *ndev, struct sk_buff *skb);
 int nci_send_cmd(struct nci_dev *ndev, __u16 opcode, __u8 plen, void *payload);
 int nci_send_data(struct nci_dev *ndev, __u8 conn_id, struct sk_buff *skb);
 void nci_data_exchange_complete(struct nci_dev *ndev, struct sk_buff *skb,
-                                int err);
+                                __u8 conn_id, int err);
+void nci_hci_data_received_cb(void *context, struct sk_buff *skb, int err);
+
 void nci_clear_target_list(struct nci_dev *ndev);
 
 /* ----- NCI requests ----- */
@@ -209,6 +330,8 @@ void nci_clear_target_list(struct nci_dev *ndev);
 #define NCI_REQ_CANCELED        2
 
 void nci_req_complete(struct nci_dev *ndev, int result);
+struct nci_conn_info *nci_get_conn_info_by_conn_id(struct nci_dev *ndev,
+                                                   int conn_id);
 
 /* ----- NCI status code ----- */
 int nci_to_errno(__u8 code);
diff --git a/include/net/nfc/nfc.h b/include/net/nfc/nfc.h
index 12adb817c27a..73190e65d5c1 100644
--- a/include/net/nfc/nfc.h
+++ b/include/net/nfc/nfc.h
@@ -135,6 +135,31 @@ struct nfc_se {
         u16 state;
 };
 
+/**
+ * nfc_evt_transaction - A struct for NFC secure element event transaction.
+ *
+ * @aid: The application identifier triggering the event
+ *
+ * @aid_len: The application identifier length [5:16]
+ *
+ * @params: The application parameters transmitted during the transaction
+ *
+ * @params_len: The applications parameters length [0:255]
+ *
+ */
+#define NFC_MIN_AID_LENGTH      5
+#define NFC_MAX_AID_LENGTH      16
+#define NFC_MAX_PARAMS_LENGTH   255
+
+#define NFC_EVT_TRANSACTION_AID_TAG     0x81
+#define NFC_EVT_TRANSACTION_PARAMS_TAG  0x82
+struct nfc_evt_transaction {
+        u32 aid_len;
+        u8 aid[NFC_MAX_AID_LENGTH];
+        u8 params_len;
+        u8 params[NFC_MAX_PARAMS_LENGTH];
+} __packed;
+
 struct nfc_genl_data {
         u32 poll_req_portid;
         struct mutex genl_data_mutex;
@@ -262,6 +287,8 @@ int nfc_tm_data_received(struct nfc_dev *dev, struct sk_buff *skb);
 
 void nfc_driver_failure(struct nfc_dev *dev, int err);
 
+int nfc_se_transaction(struct nfc_dev *dev, u8 se_idx,
+                       struct nfc_evt_transaction *evt_transaction);
 int nfc_add_se(struct nfc_dev *dev, u32 se_idx, u16 type);
 int nfc_remove_se(struct nfc_dev *dev, u32 se_idx);
 struct nfc_se *nfc_find_se(struct nfc_dev *dev, u32 se_idx);
diff --git a/include/net/nl802154.h b/include/net/nl802154.h
index 6dbd406ca41b..f8b5bc997959 100644
--- a/include/net/nl802154.h
+++ b/include/net/nl802154.h
@@ -82,7 +82,7 @@ enum nl802154_attrs {
         NL802154_ATTR_TX_POWER,
 
         NL802154_ATTR_CCA_MODE,
-        NL802154_ATTR_CCA_MODE3_AND,
+        NL802154_ATTR_CCA_OPT,
         NL802154_ATTR_CCA_ED_LEVEL,
 
         NL802154_ATTR_MAX_FRAME_RETRIES,
@@ -119,4 +119,47 @@ enum nl802154_iftype {
         NL802154_IFTYPE_MAX = NUM_NL802154_IFTYPES - 1
 };
 
+/**
+ * enum nl802154_cca_modes - cca modes
+ *
+ * @__NL802154_CCA_INVALID: cca mode number 0 is reserved
+ * @NL802154_CCA_ENERGY: Energy above threshold
+ * @NL802154_CCA_CARRIER: Carrier sense only
+ * @NL802154_CCA_ENERGY_CARRIER: Carrier sense with energy above threshold
+ * @NL802154_CCA_ALOHA: CCA shall always report an idle medium
+ * @NL802154_CCA_UWB_SHR: UWB preamble sense based on the SHR of a frame
+ * @NL802154_CCA_UWB_MULTIPEXED: UWB preamble sense based on the packet with
+ *      the multiplexed preamble
+ * @__NL802154_CCA_ATTR_AFTER_LAST: Internal
+ * @NL802154_CCA_ATTR_MAX: Maximum CCA attribute number
+ */
+enum nl802154_cca_modes {
+        __NL802154_CCA_INVALID,
+        NL802154_CCA_ENERGY,
+        NL802154_CCA_CARRIER,
+        NL802154_CCA_ENERGY_CARRIER,
+        NL802154_CCA_ALOHA,
+        NL802154_CCA_UWB_SHR,
+        NL802154_CCA_UWB_MULTIPEXED,
+
+        /* keep last */
+        __NL802154_CCA_ATTR_AFTER_LAST,
+        NL802154_CCA_ATTR_MAX = __NL802154_CCA_ATTR_AFTER_LAST - 1
+};
+
+/**
+ * enum nl802154_cca_opts - additional options for cca modes
+ *
+ * @NL802154_CCA_OPT_ENERGY_CARRIER_OR: NL802154_CCA_ENERGY_CARRIER with OR
+ * @NL802154_CCA_OPT_ENERGY_CARRIER_AND: NL802154_CCA_ENERGY_CARRIER with AND
+ */
+enum nl802154_cca_opts {
+        NL802154_CCA_OPT_ENERGY_CARRIER_AND,
+        NL802154_CCA_OPT_ENERGY_CARRIER_OR,
+
+        /* keep last */
+        __NL802154_CCA_OPT_ATTR_AFTER_LAST,
+        NL802154_CCA_OPT_ATTR_MAX = __NL802154_CCA_OPT_ATTR_AFTER_LAST - 1
+};
+
 #endif /* __NL802154_H */
diff --git a/include/net/ping.h b/include/net/ping.h
index f074060bc5de..cc16d413f681 100644
--- a/include/net/ping.h
+++ b/include/net/ping.h
@@ -59,7 +59,7 @@ extern struct pingv6_ops pingv6_ops;
 
 struct pingfakehdr {
         struct icmphdr icmph;
-        struct iovec *iov;
+        struct msghdr *msg;
         sa_family_t family;
         __wsum wcheck;
 };
diff --git a/include/net/pkt_sched.h b/include/net/pkt_sched.h
index 27a33833ff4a..2342bf12cb78 100644
--- a/include/net/pkt_sched.h
+++ b/include/net/pkt_sched.h
@@ -3,6 +3,7 @@
 
 #include <linux/jiffies.h>
 #include <linux/ktime.h>
+#include <linux/if_vlan.h>
 #include <net/sch_generic.h>
 
 struct qdisc_walker {
@@ -114,6 +115,17 @@ int tc_classify_compat(struct sk_buff *skb, const struct tcf_proto *tp,
 int tc_classify(struct sk_buff *skb, const struct tcf_proto *tp,
                 struct tcf_result *res);
 
+static inline __be16 tc_skb_protocol(const struct sk_buff *skb)
+{
+        /* We need to take extra care in case the skb came via
+         * vlan accelerated path. In that case, use skb->vlan_proto
+         * as the original vlan header was already stripped.
+         */
+        if (skb_vlan_tag_present(skb))
+                return skb->vlan_proto;
+        return skb->protocol;
+}
+
 /* Calculate maximal size of packet seen by hard_start_xmit
    routine of this device.
  */
diff --git a/include/net/regulatory.h b/include/net/regulatory.h
index b776d72d84be..ebc5a2ed8631 100644
--- a/include/net/regulatory.h
+++ b/include/net/regulatory.h
@@ -147,6 +147,24 @@ struct regulatory_request {
  *      NL80211_IFTYPE_P2P_CLIENT, NL80211_IFTYPE_P2P_GO,
  *      NL80211_IFTYPE_P2P_DEVICE. The flag will be set by default if a device
  *      includes any modes unsupported for enforcement checking.
+ * @REGULATORY_WIPHY_SELF_MANAGED: for devices that employ wiphy-specific
+ *      regdom management. These devices will ignore all regdom changes not
+ *      originating from their own wiphy.
+ *      A self-managed wiphys only employs regulatory information obtained from
+ *      the FW and driver and does not use other cfg80211 sources like
+ *      beacon-hints, country-code IEs and hints from other devices on the same
+ *      system. Conversely, a self-managed wiphy does not share its regulatory
+ *      hints with other devices in the system. If a system contains several
+ *      devices, one or more of which are self-managed, there might be
+ *      contradictory regulatory settings between them. Usage of flag is
+ *      generally discouraged. Only use it if the FW/driver is incompatible
+ *      with non-locally originated hints.
+ *      This flag is incompatible with the flags: %REGULATORY_CUSTOM_REG,
+ *      %REGULATORY_STRICT_REG, %REGULATORY_COUNTRY_IE_FOLLOW_POWER,
+ *      %REGULATORY_COUNTRY_IE_IGNORE and %REGULATORY_DISABLE_BEACON_HINTS.
+ *      Mixing any of the above flags with this flag will result in a failure
+ *      to register the wiphy. This flag implies
+ *      %REGULATORY_DISABLE_BEACON_HINTS and %REGULATORY_COUNTRY_IE_IGNORE.
  */
 enum ieee80211_regulatory_flags {
         REGULATORY_CUSTOM_REG                   = BIT(0),
@@ -156,6 +174,7 @@ enum ieee80211_regulatory_flags {
         REGULATORY_COUNTRY_IE_IGNORE            = BIT(4),
         REGULATORY_ENABLE_RELAX_NO_IR           = BIT(5),
         REGULATORY_IGNORE_STALE_KICKOFF         = BIT(6),
+        REGULATORY_WIPHY_SELF_MANAGED           = BIT(7),
 };
 
 struct ieee80211_freq_range {
diff --git a/include/net/route.h b/include/net/route.h
index b17cf28f996e..fe22d03afb6a 100644
--- a/include/net/route.h
+++ b/include/net/route.h
@@ -46,6 +46,7 @@
 
 struct fib_nh;
 struct fib_info;
+struct uncached_list;
 struct rtable {
         struct dst_entry        dst;
 
@@ -64,6 +65,7 @@ struct rtable {
         u32                     rt_pmtu;
 
         struct list_head        rt_uncached;
+        struct uncached_list    *rt_uncached_list;
 };
 
 static inline bool rt_is_input_route(const struct rtable *rt)
diff --git a/include/net/rtnetlink.h b/include/net/rtnetlink.h
index e21b9f9653c0..6c6d5393fc34 100644
--- a/include/net/rtnetlink.h
+++ b/include/net/rtnetlink.h
@@ -46,6 +46,7 @@ static inline int rtnl_msg_family(const struct nlmsghdr *nlh)
  *                          to create when creating a new device.
  *      @get_num_rx_queues: Function to determine number of receive queues
  *                          to create when creating a new device.
+ *      @get_link_net: Function to get the i/o netns of the device
  */
 struct rtnl_link_ops {
         struct list_head        list;
@@ -93,6 +94,7 @@ struct rtnl_link_ops {
         int                     (*fill_slave_info)(struct sk_buff *skb,
                                                    const struct net_device *dev,
                                                    const struct net_device *slave_dev);
+        struct net              *(*get_link_net)(const struct net_device *dev);
 };
 
 int __rtnl_link_register(struct rtnl_link_ops *ops);
diff --git a/include/net/sock.h b/include/net/sock.h
index 2210fec65669..e13824570b0f 100644
--- a/include/net/sock.h
+++ b/include/net/sock.h
@@ -857,18 +857,6 @@ static inline void sock_rps_record_flow_hash(__u32 hash)
 #endif
 }
 
-static inline void sock_rps_reset_flow_hash(__u32 hash)
-{
-#ifdef CONFIG_RPS
-        struct rps_sock_flow_table *sock_flow_table;
-
-        rcu_read_lock();
-        sock_flow_table = rcu_dereference(rps_sock_flow_table);
-        rps_reset_sock_flow(sock_flow_table, hash);
-        rcu_read_unlock();
-#endif
-}
-
 static inline void sock_rps_record_flow(const struct sock *sk)
 {
 #ifdef CONFIG_RPS
@@ -876,28 +864,18 @@ static inline void sock_rps_record_flow(const struct sock *sk)
 #endif
 }
 
-static inline void sock_rps_reset_flow(const struct sock *sk)
-{
-#ifdef CONFIG_RPS
-        sock_rps_reset_flow_hash(sk->sk_rxhash);
-#endif
-}
-
 static inline void sock_rps_save_rxhash(struct sock *sk,
                                         const struct sk_buff *skb)
 {
 #ifdef CONFIG_RPS
-        if (unlikely(sk->sk_rxhash != skb->hash)) {
-                sock_rps_reset_flow(sk);
+        if (unlikely(sk->sk_rxhash != skb->hash))
                 sk->sk_rxhash = skb->hash;
-        }
 #endif
 }
 
 static inline void sock_rps_reset_rxhash(struct sock *sk)
 {
 #ifdef CONFIG_RPS
-        sock_rps_reset_flow(sk);
         sk->sk_rxhash = 0;
 #endif
 }
@@ -1374,29 +1352,6 @@ void sk_prot_clear_portaddr_nulls(struct sock *sk, int size);
 #define SOCK_BINDADDR_LOCK      4
 #define SOCK_BINDPORT_LOCK      8
 
-/* sock_iocb: used to kick off async processing of socket ios */
-struct sock_iocb {
-        struct list_head        list;
-
-        int                     flags;
-        int                     size;
-        struct socket           *sock;
-        struct sock             *sk;
-        struct scm_cookie       *scm;
-        struct msghdr           *msg, async_msg;
-        struct kiocb            *kiocb;
-};
-
-static inline struct sock_iocb *kiocb_to_siocb(struct kiocb *iocb)
-{
-        return (struct sock_iocb *)iocb->private;
-}
-
-static inline struct kiocb *siocb_to_kiocb(struct sock_iocb *si)
-{
-        return si->kiocb;
-}
-
 struct socket_alloc {
         struct socket socket;
         struct inode vfs_inode;
@@ -1826,27 +1781,25 @@ static inline void sk_nocaps_add(struct sock *sk, netdev_features_t flags)
 }
 
 static inline int skb_do_copy_data_nocache(struct sock *sk, struct sk_buff *skb,
-                                           char __user *from, char *to,
+                                           struct iov_iter *from, char *to,
                                            int copy, int offset)
 {
         if (skb->ip_summed == CHECKSUM_NONE) {
-                int err = 0;
-                __wsum csum = csum_and_copy_from_user(from, to, copy, 0, &err);
-                if (err)
-                        return err;
+                __wsum csum = 0;
+                if (csum_and_copy_from_iter(to, copy, &csum, from) != copy)
+                        return -EFAULT;
                 skb->csum = csum_block_add(skb->csum, csum, offset);
         } else if (sk->sk_route_caps & NETIF_F_NOCACHE_COPY) {
-                if (!access_ok(VERIFY_READ, from, copy) ||
-                    __copy_from_user_nocache(to, from, copy))
+                if (copy_from_iter_nocache(to, copy, from) != copy)
                         return -EFAULT;
-        } else if (copy_from_user(to, from, copy))
+        } else if (copy_from_iter(to, copy, from) != copy)
                 return -EFAULT;
 
         return 0;
 }
 
 static inline int skb_add_data_nocache(struct sock *sk, struct sk_buff *skb,
-                                       char __user *from, int copy)
+                                       struct iov_iter *from, int copy)
 {
         int err, offset = skb->len;
 
@@ -1858,7 +1811,7 @@ static inline int skb_add_data_nocache(struct sock *sk, struct sk_buff *skb,
         return err;
 }
 
-static inline int skb_copy_to_page_nocache(struct sock *sk, char __user *from,
+static inline int skb_copy_to_page_nocache(struct sock *sk, struct iov_iter *from,
                                            struct sk_buff *skb,
                                            struct page *page,
                                            int off, int copy)
@@ -2262,6 +2215,7 @@ bool sk_net_capable(const struct sock *sk, int cap);
 extern __u32 sysctl_wmem_max;
 extern __u32 sysctl_rmem_max;
 
+extern int sysctl_tstamp_allow_data;
 extern int sysctl_optmem_max;
 
 extern __u32 sysctl_wmem_default;
diff --git a/include/net/switchdev.h b/include/net/switchdev.h
index 8a6d1641fd9b..cfcdac2e5d25 100644
--- a/include/net/switchdev.h
+++ b/include/net/switchdev.h
@@ -11,13 +11,46 @@
 #define _LINUX_SWITCHDEV_H_
 
 #include <linux/netdevice.h>
+#include <linux/notifier.h>
+
+enum netdev_switch_notifier_type {
+        NETDEV_SWITCH_FDB_ADD = 1,
+        NETDEV_SWITCH_FDB_DEL,
+};
+
+struct netdev_switch_notifier_info {
+        struct net_device *dev;
+};
+
+struct netdev_switch_notifier_fdb_info {
+        struct netdev_switch_notifier_info info; /* must be first */
+        const unsigned char *addr;
+        u16 vid;
+};
+
+static inline struct net_device *
+netdev_switch_notifier_info_to_dev(const struct netdev_switch_notifier_info *info)
+{
+        return info->dev;
+}
 
 #ifdef CONFIG_NET_SWITCHDEV
 
 int netdev_switch_parent_id_get(struct net_device *dev,
                                 struct netdev_phys_item_id *psid);
 int netdev_switch_port_stp_update(struct net_device *dev, u8 state);
-
+int register_netdev_switch_notifier(struct notifier_block *nb);
+int unregister_netdev_switch_notifier(struct notifier_block *nb);
+int call_netdev_switch_notifiers(unsigned long val, struct net_device *dev,
+                                 struct netdev_switch_notifier_info *info);
+int netdev_switch_port_bridge_setlink(struct net_device *dev,
+                                struct nlmsghdr *nlh, u16 flags);
+int netdev_switch_port_bridge_dellink(struct net_device *dev,
+                                struct nlmsghdr *nlh, u16 flags);
+int ndo_dflt_netdev_switch_port_bridge_dellink(struct net_device *dev,
+                                               struct nlmsghdr *nlh, u16 flags);
+int ndo_dflt_netdev_switch_port_bridge_setlink(struct net_device *dev,
+                                               struct nlmsghdr *nlh, u16 flags);
 #else
 
 static inline int netdev_switch_parent_id_get(struct net_device *dev,
@@ -32,6 +65,50 @@ static inline int netdev_switch_port_stp_update(struct net_device *dev,
         return -EOPNOTSUPP;
 }
 
+static inline int register_netdev_switch_notifier(struct notifier_block *nb)
+{
+        return 0;
+}
+
+static inline int unregister_netdev_switch_notifier(struct notifier_block *nb)
+{
+        return 0;
+}
+
+static inline int call_netdev_switch_notifiers(unsigned long val, struct net_device *dev,
+                                               struct netdev_switch_notifier_info *info)
+{
+        return NOTIFY_DONE;
+}
+
+static inline int netdev_switch_port_bridge_setlink(struct net_device *dev,
+                                                    struct nlmsghdr *nlh,
+                                                    u16 flags)
+{
+        return -EOPNOTSUPP;
+}
+
+static inline int netdev_switch_port_bridge_dellink(struct net_device *dev,
+                                                    struct nlmsghdr *nlh,
+                                                    u16 flags)
+{
+        return -EOPNOTSUPP;
+}
+
+static inline int ndo_dflt_netdev_switch_port_bridge_dellink(struct net_device *dev,
+                                                        struct nlmsghdr *nlh,
+                                                        u16 flags)
+{
+        return 0;
+}
+
+static inline int ndo_dflt_netdev_switch_port_bridge_setlink(struct net_device *dev,
+                                                        struct nlmsghdr *nlh,
+                                                        u16 flags)
+{
+        return 0;
+}
+
 #endif
 
 #endif /* _LINUX_SWITCHDEV_H_ */
diff --git a/include/net/tc_act/tc_bpf.h b/include/net/tc_act/tc_bpf.h
new file mode 100644
index 000000000000..86a070ffc930
--- /dev/null
+++ b/include/net/tc_act/tc_bpf.h
@@ -0,0 +1,25 @@
+/*
+ * Copyright (c) 2015 Jiri Pirko <jiri@resnulli.us>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ */
+
+#ifndef __NET_TC_BPF_H
+#define __NET_TC_BPF_H
+
+#include <linux/filter.h>
+#include <net/act_api.h>
+
+struct tcf_bpf {
+        struct tcf_common       common;
+        struct bpf_prog         *filter;
+        struct sock_filter      *bpf_ops;
+        u16                     bpf_num_ops;
+};
+#define to_bpf(a) \
+        container_of(a->priv, struct tcf_bpf, common)
+
+#endif /* __NET_TC_BPF_H */
diff --git a/include/net/tc_act/tc_connmark.h b/include/net/tc_act/tc_connmark.h
new file mode 100644
index 000000000000..5c1104c2e24f
--- /dev/null
+++ b/include/net/tc_act/tc_connmark.h
@@ -0,0 +1,14 @@
+#ifndef __NET_TC_CONNMARK_H
+#define __NET_TC_CONNMARK_H
+
+#include <net/act_api.h>
+
+struct tcf_connmark_info {
+        struct tcf_common common;
+        u16 zone;
+};
+
+#define to_connmark(a) \
+        container_of(a->priv, struct tcf_connmark_info, common)
+
+#endif /* __NET_TC_CONNMARK_H */
diff --git a/include/net/tcp.h b/include/net/tcp.h
index 9d9111ef43ae..8d6b983d5099 100644
--- a/include/net/tcp.h
+++ b/include/net/tcp.h
@@ -262,8 +262,6 @@ extern int sysctl_tcp_low_latency;
 extern int sysctl_tcp_nometrics_save;
 extern int sysctl_tcp_moderate_rcvbuf;
 extern int sysctl_tcp_tso_win_divisor;
-extern int sysctl_tcp_mtu_probing;
-extern int sysctl_tcp_base_mss;
 extern int sysctl_tcp_workaround_signed_windows;
 extern int sysctl_tcp_slow_start_after_idle;
 extern int sysctl_tcp_thin_linear_timeouts;
@@ -274,6 +272,7 @@ extern int sysctl_tcp_challenge_ack_limit;
 extern unsigned int sysctl_tcp_notsent_lowat;
 extern int sysctl_tcp_min_tso_segs;
 extern int sysctl_tcp_autocorking;
+extern int sysctl_tcp_invalid_ratelimit;
 
 extern atomic_long_t tcp_memory_allocated;
 extern struct percpu_counter tcp_sockets_allocated;
@@ -448,6 +447,7 @@ int tcp_v4_conn_request(struct sock *sk, struct sk_buff *skb);
 struct sock *tcp_create_openreq_child(struct sock *sk,
                                       struct request_sock *req,
                                       struct sk_buff *skb);
+void tcp_ca_openreq_child(struct sock *sk, const struct dst_entry *dst);
 struct sock *tcp_v4_syn_recv_sock(struct sock *sk, struct sk_buff *skb,
                                   struct request_sock *req,
                                   struct dst_entry *dst);
@@ -636,6 +636,11 @@ static inline u32 tcp_rto_min_us(struct sock *sk)
         return jiffies_to_usecs(tcp_rto_min(sk));
 }
 
+static inline bool tcp_ca_dst_locked(const struct dst_entry *dst)
+{
+        return dst_metric_locked(dst, RTAX_CC_ALGO);
+}
+
 /* Compute the actual receive window we are currently advertising.
  * Rcv_nxt can be after the window if our peer push more data
  * than the offered window.
@@ -787,6 +792,8 @@ enum tcp_ca_ack_event_flags {
 #define TCP_CA_MAX      128
 #define TCP_CA_BUF_MAX  (TCP_CA_NAME_MAX*TCP_CA_MAX)
 
+#define TCP_CA_UNSPEC   0
+
 /* Algorithm can be set on socket without CAP_NET_ADMIN privileges */
 #define TCP_CONG_NON_RESTRICTED 0x1
 /* Requires ECN/ECT set on all packets */
@@ -794,7 +801,8 @@ enum tcp_ca_ack_event_flags {
 
 struct tcp_congestion_ops {
         struct list_head        list;
-        unsigned long flags;
+        u32 key;
+        u32 flags;
 
         /* initialize private data (optional) */
         void (*init)(struct sock *sk);
@@ -841,6 +849,17 @@ u32 tcp_reno_ssthresh(struct sock *sk);
 void tcp_reno_cong_avoid(struct sock *sk, u32 ack, u32 acked);
 extern struct tcp_congestion_ops tcp_reno;
 
+struct tcp_congestion_ops *tcp_ca_find_key(u32 key);
+u32 tcp_ca_get_key_by_name(const char *name);
+#ifdef CONFIG_INET
+char *tcp_ca_get_name_by_key(u32 key, char *buffer);
+#else
+static inline char *tcp_ca_get_name_by_key(u32 key, char *buffer)
+{
+        return NULL;
+}
+#endif
+
 static inline bool tcp_ca_needs_ecn(const struct sock *sk)
 {
         const struct inet_connection_sock *icsk = inet_csk(sk);
@@ -1124,6 +1143,7 @@ static inline void tcp_openreq_init(struct request_sock *req,
         tcp_rsk(req)->rcv_isn = TCP_SKB_CB(skb)->seq;
         tcp_rsk(req)->rcv_nxt = TCP_SKB_CB(skb)->seq + 1;
         tcp_rsk(req)->snt_synack = tcp_time_stamp;
+        tcp_rsk(req)->last_oow_ack_time = 0;
         req->mss = rx_opt->mss_clamp;
         req->ts_recent = rx_opt->saw_tstamp ? rx_opt->rcv_tsval : 0;
         ireq->tstamp_ok = rx_opt->tstamp_ok;
@@ -1216,6 +1236,37 @@ static inline bool tcp_paws_reject(const struct tcp_options_received *rx_opt,
         return true;
 }
 
+/* Return true if we're currently rate-limiting out-of-window ACKs and
+ * thus shouldn't send a dupack right now. We rate-limit dupacks in
+ * response to out-of-window SYNs or ACKs to mitigate ACK loops or DoS
+ * attacks that send repeated SYNs or ACKs for the same connection. To
+ * do this, we do not send a duplicate SYNACK or ACK if the remote
+ * endpoint is sending out-of-window SYNs or pure ACKs at a high rate.
+ */
+static inline bool tcp_oow_rate_limited(struct net *net,
+                                        const struct sk_buff *skb,
+                                        int mib_idx, u32 *last_oow_ack_time)
+{
+        /* Data packets without SYNs are not likely part of an ACK loop. */
+        if ((TCP_SKB_CB(skb)->seq != TCP_SKB_CB(skb)->end_seq) &&
+            !tcp_hdr(skb)->syn)
+                goto not_rate_limited;
+
+        if (*last_oow_ack_time) {
+                s32 elapsed = (s32)(tcp_time_stamp - *last_oow_ack_time);
+
+                if (0 <= elapsed && elapsed < sysctl_tcp_invalid_ratelimit) {
+                        NET_INC_STATS_BH(net, mib_idx);
+                        return true;    /* rate-limited: don't send yet! */
+                }
+        }
+
+        *last_oow_ack_time = tcp_time_stamp;
+
+not_rate_limited:
+        return false;   /* not rate-limited: go ahead, send dupack now! */
+}
+
 static inline void tcp_mib_init(struct net *net)
 {
         /* See RFC 2012 */
@@ -1693,4 +1744,19 @@ static inline struct ip_options_rcu *tcp_v4_save_options(struct sk_buff *skb)
         return dopt;
 }
 
+/* locally generated TCP pure ACKs have skb->truesize == 2
+ * (check tcp_send_ack() in net/ipv4/tcp_output.c )
+ * This is much faster than dissecting the packet to find out.
+ * (Think of GRE encapsulations, IPv4, IPv6, ...)
+ */
+static inline bool skb_is_tcp_pure_ack(const struct sk_buff *skb)
+{
+        return skb->truesize == 2;
+}
+
+static inline void skb_set_tcp_pure_ack(struct sk_buff *skb)
+{
+        skb->truesize = 2;
+}
+
 #endif  /* _TCP_H */
diff --git a/include/net/udp_tunnel.h b/include/net/udp_tunnel.h
index 2a50a70ef587..1a20d33d56bc 100644
--- a/include/net/udp_tunnel.h
+++ b/include/net/udp_tunnel.h
@@ -77,17 +77,17 @@ void setup_udp_tunnel_sock(struct net *net, struct socket *sock,
                            struct udp_tunnel_sock_cfg *sock_cfg);
 
 /* Transmit the skb using UDP encapsulation. */
-int udp_tunnel_xmit_skb(struct socket *sock, struct rtable *rt,
-                        struct sk_buff *skb, __be32 src, __be32 dst,
-                        __u8 tos, __u8 ttl, __be16 df, __be16 src_port,
-                        __be16 dst_port, bool xnet);
+int udp_tunnel_xmit_skb(struct rtable *rt, struct sk_buff *skb,
+                        __be32 src, __be32 dst, __u8 tos, __u8 ttl,
+                        __be16 df, __be16 src_port, __be16 dst_port,
+                        bool xnet, bool nocheck);
 
 #if IS_ENABLED(CONFIG_IPV6)
-int udp_tunnel6_xmit_skb(struct socket *sock, struct dst_entry *dst,
-                         struct sk_buff *skb, struct net_device *dev,
-                         struct in6_addr *saddr, struct in6_addr *daddr,
+int udp_tunnel6_xmit_skb(struct dst_entry *dst, struct sk_buff *skb,
+                         struct net_device *dev, struct in6_addr *saddr,
+                         struct in6_addr *daddr,
                          __u8 prio, __u8 ttl, __be16 src_port,
-                         __be16 dst_port);
+                         __be16 dst_port, bool nocheck);
 #endif
 
 void udp_tunnel_sock_release(struct socket *sock);
diff --git a/include/net/udplite.h b/include/net/udplite.h
index ae7c8d1fbcad..80761938b9a7 100644
--- a/include/net/udplite.h
+++ b/include/net/udplite.h
@@ -20,8 +20,7 @@ static __inline__ int udplite_getfrag(void *from, char *to, int  offset,
                                       int len, int odd, struct sk_buff *skb)
 {
         struct msghdr *msg = from;
-        /* XXX: stripping const */
-        return memcpy_fromiovecend(to, (struct iovec *)msg->msg_iter.iov, offset, len);
+        return copy_from_iter(to, len, &msg->msg_iter) != len ? -EFAULT : 0;
 }
 
 /* Designate sk as UDP-Lite socket */
diff --git a/include/net/vxlan.h b/include/net/vxlan.h
index 903461aa5644..2927d6244481 100644
--- a/include/net/vxlan.h
+++ b/include/net/vxlan.h
@@ -11,14 +11,96 @@
 #define VNI_HASH_BITS   10
 #define VNI_HASH_SIZE   (1<<VNI_HASH_BITS)
 
-/* VXLAN protocol header */
+/*
+ * VXLAN Group Based Policy Extension:
+ * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ * |1|-|-|-|1|-|-|-|R|D|R|R|A|R|R|R|        Group Policy ID        |
+ * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ * |                VXLAN Network Identifier (VNI) |   Reserved    |
+ * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ *
+ * D = Don't Learn bit. When set, this bit indicates that the egress
+ *     VTEP MUST NOT learn the source address of the encapsulated frame.
+ *
+ * A = Indicates that the group policy has already been applied to
+ *     this packet. Policies MUST NOT be applied by devices when the
+ *     A bit is set.
+ *
+ * [0] https://tools.ietf.org/html/draft-smith-vxlan-group-policy
+ */
+struct vxlanhdr_gbp {
+        __u8    vx_flags;
+#ifdef __LITTLE_ENDIAN_BITFIELD
+        __u8    reserved_flags1:3,
+                policy_applied:1,
+                reserved_flags2:2,
+                dont_learn:1,
+                reserved_flags3:1;
+#elif defined(__BIG_ENDIAN_BITFIELD)
+        __u8    reserved_flags1:1,
+                dont_learn:1,
+                reserved_flags2:2,
+                policy_applied:1,
+                reserved_flags3:3;
+#else
+#error  "Please fix <asm/byteorder.h>"
+#endif
+        __be16  policy_id;
+        __be32  vx_vni;
+};
+
+#define VXLAN_GBP_USED_BITS (VXLAN_HF_GBP | 0xFFFFFF)
+
+/* skb->mark mapping
+ *
+ * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ * |R|R|R|R|R|R|R|R|R|D|R|R|A|R|R|R|        Group Policy ID        |
+ * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ */
+#define VXLAN_GBP_DONT_LEARN            (BIT(6) << 16)
+#define VXLAN_GBP_POLICY_APPLIED        (BIT(3) << 16)
+#define VXLAN_GBP_ID_MASK               (0xFFFF)
+
+/* VXLAN protocol header:
+ * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ * |G|R|R|R|I|R|R|C|               Reserved                        |
+ * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ * |                VXLAN Network Identifier (VNI) |   Reserved    |
+ * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ *
+ * G = 1        Group Policy (VXLAN-GBP)
+ * I = 1        VXLAN Network Identifier (VNI) present
+ * C = 1        Remote checksum offload (RCO)
+ */
 struct vxlanhdr {
         __be32 vx_flags;
         __be32 vx_vni;
 };
 
+/* VXLAN header flags. */
+#define VXLAN_HF_RCO BIT(24)
+#define VXLAN_HF_VNI BIT(27)
+#define VXLAN_HF_GBP BIT(31)
+
+/* Remote checksum offload header option */
+#define VXLAN_RCO_MASK  0x7f    /* Last byte of vni field */
+#define VXLAN_RCO_UDP   0x80    /* Indicate UDP RCO (TCP when not set *) */
+#define VXLAN_RCO_SHIFT 1       /* Left shift of start */
+#define VXLAN_RCO_SHIFT_MASK ((1 << VXLAN_RCO_SHIFT) - 1)
+#define VXLAN_MAX_REMCSUM_START (VXLAN_RCO_MASK << VXLAN_RCO_SHIFT)
+
+#define VXLAN_N_VID     (1u << 24)
+#define VXLAN_VID_MASK  (VXLAN_N_VID - 1)
+#define VXLAN_HLEN (sizeof(struct udphdr) + sizeof(struct vxlanhdr))
+
+struct vxlan_metadata {
+        __be32          vni;
+        u32             gbp;
+};
+
 struct vxlan_sock;
-typedef void (vxlan_rcv_t)(struct vxlan_sock *vh, struct sk_buff *skb, __be32 key);
+typedef void (vxlan_rcv_t)(struct vxlan_sock *vh, struct sk_buff *skb,
+                           struct vxlan_metadata *md);
 
 /* per UDP socket information */
 struct vxlan_sock {
@@ -31,6 +113,7 @@ struct vxlan_sock {
         struct hlist_head vni_list[VNI_HASH_SIZE];
         atomic_t          refcnt;
         struct udp_offload udp_offloads;
+        u32               flags;
 };
 
 #define VXLAN_F_LEARN                   0x01
@@ -42,6 +125,16 @@ struct vxlan_sock {
 #define VXLAN_F_UDP_CSUM                0x40
 #define VXLAN_F_UDP_ZERO_CSUM6_TX       0x80
 #define VXLAN_F_UDP_ZERO_CSUM6_RX       0x100
+#define VXLAN_F_REMCSUM_TX              0x200
+#define VXLAN_F_REMCSUM_RX              0x400
+#define VXLAN_F_GBP                     0x800
+
+/* Flags that are used in the receive patch. These flags must match in
+ * order for a socket to be shareable
+ */
+#define VXLAN_F_RCV_FLAGS               (VXLAN_F_GBP |                  \
+                                         VXLAN_F_UDP_ZERO_CSUM6_RX |    \
+                                         VXLAN_F_REMCSUM_RX)
 
 struct vxlan_sock *vxlan_sock_add(struct net *net, __be16 port,
                                   vxlan_rcv_t *rcv, void *data,
@@ -49,10 +142,10 @@ struct vxlan_sock *vxlan_sock_add(struct net *net, __be16 port,
 
 void vxlan_sock_release(struct vxlan_sock *vs);
 
-int vxlan_xmit_skb(struct vxlan_sock *vs,
-                   struct rtable *rt, struct sk_buff *skb,
+int vxlan_xmit_skb(struct rtable *rt, struct sk_buff *skb,
                    __be32 src, __be32 dst, __u8 tos, __u8 ttl, __be16 df,
-                   __be16 src_port, __be16 dst_port, __be32 vni, bool xnet);
+                   __be16 src_port, __be16 dst_port, struct vxlan_metadata *md,
+                   bool xnet, u32 vxflags);
 
 static inline netdev_features_t vxlan_features_check(struct sk_buff *skb,
                                                      netdev_features_t features)
diff --git a/include/trace/events/net.h b/include/trace/events/net.h
index 1de256b35807..49cc7c3de252 100644
--- a/include/trace/events/net.h
+++ b/include/trace/events/net.h
@@ -40,9 +40,9 @@ TRACE_EVENT(net_dev_start_xmit,
                 __assign_str(name, dev->name);
                 __entry->queue_mapping = skb->queue_mapping;
                 __entry->skbaddr = skb;
-                __entry->vlan_tagged = vlan_tx_tag_present(skb);
+                __entry->vlan_tagged = skb_vlan_tag_present(skb);
                 __entry->vlan_proto = ntohs(skb->vlan_proto);
-                __entry->vlan_tci = vlan_tx_tag_get(skb);
+                __entry->vlan_tci = skb_vlan_tag_get(skb);
                 __entry->protocol = ntohs(skb->protocol);
                 __entry->ip_summed = skb->ip_summed;
                 __entry->len = skb->len;
@@ -174,9 +174,9 @@ DECLARE_EVENT_CLASS(net_dev_rx_verbose_template,
 #endif
                 __entry->queue_mapping = skb->queue_mapping;
                 __entry->skbaddr = skb;
-                __entry->vlan_tagged = vlan_tx_tag_present(skb);
+                __entry->vlan_tagged = skb_vlan_tag_present(skb);
                 __entry->vlan_proto = ntohs(skb->vlan_proto);
-                __entry->vlan_tci = vlan_tx_tag_get(skb);
+                __entry->vlan_tci = skb_vlan_tag_get(skb);
                 __entry->protocol = ntohs(skb->protocol);
                 __entry->ip_summed = skb->ip_summed;
                 __entry->hash = skb->hash;
diff --git a/include/uapi/linux/Kbuild b/include/uapi/linux/Kbuild
index 00b100023c47..14b7b6e44c77 100644
--- a/include/uapi/linux/Kbuild
+++ b/include/uapi/linux/Kbuild
@@ -283,6 +283,7 @@ header-y += net.h
 header-y += netlink_diag.h
 header-y += netlink.h
 header-y += netrom.h
+header-y += net_namespace.h
 header-y += net_tstamp.h
 header-y += nfc.h
 header-y += nfs2.h
diff --git a/include/uapi/linux/ethtool.h b/include/uapi/linux/ethtool.h
index 5f66d9c2889d..2e49fc880d29 100644
--- a/include/uapi/linux/ethtool.h
+++ b/include/uapi/linux/ethtool.h
@@ -139,6 +139,7 @@ static inline __u32 ethtool_cmd_speed(const struct ethtool_cmd *ep)
 
 #define ETHTOOL_FWVERS_LEN      32
 #define ETHTOOL_BUSINFO_LEN     32
+#define ETHTOOL_EROMVERS_LEN    32
 
 /**
  * struct ethtool_drvinfo - general driver and device information
@@ -148,6 +149,7 @@ static inline __u32 ethtool_cmd_speed(const struct ethtool_cmd *ep)
  *      not be an empty string.
  * @version: Driver version string; may be an empty string
  * @fw_version: Firmware version string; may be an empty string
+ * @erom_version: Expansion ROM version string; may be an empty string
  * @bus_info: Device bus address.  This should match the dev_name()
  *      string for the underlying bus device, if there is one.  May be
  *      an empty string.
@@ -176,7 +178,7 @@ struct ethtool_drvinfo {
         char    version[32];
         char    fw_version[ETHTOOL_FWVERS_LEN];
         char    bus_info[ETHTOOL_BUSINFO_LEN];
-        char    reserved1[32];
+        char    erom_version[ETHTOOL_EROMVERS_LEN];
         char    reserved2[12];
         __u32   n_priv_flags;
         __u32   n_stats;
diff --git a/include/uapi/linux/if_bridge.h b/include/uapi/linux/if_bridge.h
index b03ee8f62d3c..eaaea6208b42 100644
--- a/include/uapi/linux/if_bridge.h
+++ b/include/uapi/linux/if_bridge.h
@@ -125,6 +125,8 @@ enum {
 #define BRIDGE_VLAN_INFO_MASTER (1<<0)  /* Operate on Bridge device as well */
 #define BRIDGE_VLAN_INFO_PVID   (1<<1)  /* VLAN is PVID, ingress untagged */
 #define BRIDGE_VLAN_INFO_UNTAGGED       (1<<2)  /* VLAN egresses untagged */
+#define BRIDGE_VLAN_INFO_RANGE_BEGIN    (1<<3) /* VLAN is start of vlan range */
+#define BRIDGE_VLAN_INFO_RANGE_END      (1<<4) /* VLAN is end of vlan range */
 
 struct bridge_vlan_info {
         __u16 flags;
diff --git a/include/uapi/linux/if_link.h b/include/uapi/linux/if_link.h
index f7d0d2d7173a..0deee3eeddbf 100644
--- a/include/uapi/linux/if_link.h
+++ b/include/uapi/linux/if_link.h
@@ -146,6 +146,7 @@ enum {
         IFLA_PHYS_PORT_ID,
         IFLA_CARRIER_CHANGES,
         IFLA_PHYS_SWITCH_ID,
+        IFLA_LINK_NETNSID,
         __IFLA_MAX
 };
 
@@ -370,6 +371,9 @@ enum {
         IFLA_VXLAN_UDP_CSUM,
         IFLA_VXLAN_UDP_ZERO_CSUM6_TX,
         IFLA_VXLAN_UDP_ZERO_CSUM6_RX,
+        IFLA_VXLAN_REMCSUM_TX,
+        IFLA_VXLAN_REMCSUM_RX,
+        IFLA_VXLAN_GBP,
         __IFLA_VXLAN_MAX
 };
 #define IFLA_VXLAN_MAX  (__IFLA_VXLAN_MAX - 1)
diff --git a/include/uapi/linux/in.h b/include/uapi/linux/in.h
index c33a65e3d62c..589ced069e8a 100644
--- a/include/uapi/linux/in.h
+++ b/include/uapi/linux/in.h
@@ -109,6 +109,7 @@ struct in_addr {
 
 #define IP_MINTTL       21
 #define IP_NODEFRAG     22
+#define IP_CHECKSUM     23
 
 /* IP_MTU_DISCOVER values */
 #define IP_PMTUDISC_DONT                0       /* Never send DF frames */
diff --git a/include/uapi/linux/ipv6.h b/include/uapi/linux/ipv6.h
index e863d088b9a5..437a6a4b125a 100644
--- a/include/uapi/linux/ipv6.h
+++ b/include/uapi/linux/ipv6.h
@@ -1,6 +1,7 @@
 #ifndef _UAPI_IPV6_H
 #define _UAPI_IPV6_H
 
+#include <linux/libc-compat.h>
 #include <linux/types.h>
 #include <linux/in6.h>
 #include <asm/byteorder.h>
@@ -15,16 +16,19 @@
  *      *under construction*
  */
 
-
+#if __UAPI_DEF_IN6_PKTINFO
 struct in6_pktinfo {
         struct in6_addr ipi6_addr;
         int             ipi6_ifindex;
 };
+#endif
 
+#if __UAPI_DEF_IP6_MTUINFO
 struct ip6_mtuinfo {
         struct sockaddr_in6     ip6m_addr;
         __u32                   ip6m_mtu;
 };
+#endif
 
 struct in6_ifreq {
         struct in6_addr ifr6_addr;
@@ -165,6 +169,7 @@ enum {
         DEVCONF_SUPPRESS_FRAG_NDISC,
         DEVCONF_ACCEPT_RA_FROM_LOCAL,
         DEVCONF_USE_OPTIMISTIC,
+        DEVCONF_ACCEPT_RA_MTU,
         DEVCONF_MAX
 };
 
diff --git a/include/uapi/linux/l2tp.h b/include/uapi/linux/l2tp.h
index 21caa2631c20..347ef22a964e 100644
--- a/include/uapi/linux/l2tp.h
+++ b/include/uapi/linux/l2tp.h
@@ -178,5 +178,6 @@ enum l2tp_seqmode {
  */
 #define L2TP_GENL_NAME          "l2tp"
 #define L2TP_GENL_VERSION       0x1
+#define L2TP_GENL_MCGROUP       "l2tp"
 
 #endif /* _UAPI_LINUX_L2TP_H_ */
diff --git a/include/uapi/linux/libc-compat.h b/include/uapi/linux/libc-compat.h
index e28807ad17fa..fa673e9cc040 100644
--- a/include/uapi/linux/libc-compat.h
+++ b/include/uapi/linux/libc-compat.h
@@ -70,6 +70,8 @@
 #define __UAPI_DEF_IPV6_MREQ            0
 #define __UAPI_DEF_IPPROTO_V6           0
 #define __UAPI_DEF_IPV6_OPTIONS         0
+#define __UAPI_DEF_IN6_PKTINFO          0
+#define __UAPI_DEF_IP6_MTUINFO          0
 
 #else
 
@@ -84,6 +86,8 @@
 #define __UAPI_DEF_IPV6_MREQ            1
 #define __UAPI_DEF_IPPROTO_V6           1
 #define __UAPI_DEF_IPV6_OPTIONS         1
+#define __UAPI_DEF_IN6_PKTINFO          1
+#define __UAPI_DEF_IP6_MTUINFO          1
 
 #endif /* _NETINET_IN_H */
 
@@ -106,6 +110,8 @@
 #define __UAPI_DEF_IPV6_MREQ            1
 #define __UAPI_DEF_IPPROTO_V6           1
 #define __UAPI_DEF_IPV6_OPTIONS         1
+#define __UAPI_DEF_IN6_PKTINFO          1
+#define __UAPI_DEF_IP6_MTUINFO          1
 
 /* Definitions for xattr.h */
 #define __UAPI_DEF_XATTR                1
diff --git a/include/uapi/linux/neighbour.h b/include/uapi/linux/neighbour.h
index f3d77f9f1e0b..3873a35509aa 100644
--- a/include/uapi/linux/neighbour.h
+++ b/include/uapi/linux/neighbour.h
@@ -25,6 +25,7 @@ enum {
         NDA_VNI,
         NDA_IFINDEX,
         NDA_MASTER,
+        NDA_LINK_NETNSID,
         __NDA_MAX
 };
 
diff --git a/include/uapi/linux/net_namespace.h b/include/uapi/linux/net_namespace.h
new file mode 100644
index 000000000000..778cd2c3ebf4
--- /dev/null
+++ b/include/uapi/linux/net_namespace.h
@@ -0,0 +1,23 @@
+/* Copyright (c) 2015 6WIND S.A.
+ * Author: Nicolas Dichtel <nicolas.dichtel@6wind.com>
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms and conditions of the GNU General Public License,
+ * version 2, as published by the Free Software Foundation.
+ */
+#ifndef _UAPI_LINUX_NET_NAMESPACE_H_
+#define _UAPI_LINUX_NET_NAMESPACE_H_
+
+/* Attributes of RTM_NEWNSID/RTM_GETNSID messages */
+enum {
+        NETNSA_NONE,
+#define NETNSA_NSID_NOT_ASSIGNED -1
+        NETNSA_NSID,
+        NETNSA_PID,
+        NETNSA_FD,
+        __NETNSA_MAX,
+};
+
+#define NETNSA_MAX              (__NETNSA_MAX - 1)
+
+#endif /* _UAPI_LINUX_NET_NAMESPACE_H_ */
diff --git a/include/uapi/linux/net_tstamp.h b/include/uapi/linux/net_tstamp.h
index edbc888ceb51..6d1abea9746e 100644
--- a/include/uapi/linux/net_tstamp.h
+++ b/include/uapi/linux/net_tstamp.h
@@ -24,8 +24,9 @@ enum {
         SOF_TIMESTAMPING_TX_SCHED = (1<<8),
         SOF_TIMESTAMPING_TX_ACK = (1<<9),
         SOF_TIMESTAMPING_OPT_CMSG = (1<<10),
+        SOF_TIMESTAMPING_OPT_TSONLY = (1<<11),
 
-        SOF_TIMESTAMPING_LAST = SOF_TIMESTAMPING_OPT_CMSG,
+        SOF_TIMESTAMPING_LAST = SOF_TIMESTAMPING_OPT_TSONLY,
         SOF_TIMESTAMPING_MASK = (SOF_TIMESTAMPING_LAST - 1) |
                                  SOF_TIMESTAMPING_LAST
 };
diff --git a/include/uapi/linux/nfc.h b/include/uapi/linux/nfc.h
index 8119255feae4..c1e2e63cf9b5 100644
--- a/include/uapi/linux/nfc.h
+++ b/include/uapi/linux/nfc.h
@@ -183,6 +183,7 @@ enum nfc_attrs {
         NFC_ATTR_SE_APDU,
         NFC_ATTR_TARGET_ISO15693_DSFID,
         NFC_ATTR_TARGET_ISO15693_UID,
+        NFC_ATTR_SE_PARAMS,
 /* private: internal use only */
         __NFC_ATTR_AFTER_LAST
 };
diff --git a/include/uapi/linux/nl80211.h b/include/uapi/linux/nl80211.h
index b37bd5a1cb82..68b294e83944 100644
--- a/include/uapi/linux/nl80211.h
+++ b/include/uapi/linux/nl80211.h
@@ -29,6 +29,13 @@
 
 #define NL80211_GENL_NAME "nl80211"
 
+#define NL80211_MULTICAST_GROUP_CONFIG          "config"
+#define NL80211_MULTICAST_GROUP_SCAN            "scan"
+#define NL80211_MULTICAST_GROUP_REG             "regulatory"
+#define NL80211_MULTICAST_GROUP_MLME            "mlme"
+#define NL80211_MULTICAST_GROUP_VENDOR          "vendor"
+#define NL80211_MULTICAST_GROUP_TESTMODE        "testmode"
+
 /**
  * DOC: Station handling
  *
@@ -173,8 +180,8 @@
  *      %NL80211_ATTR_WIPHY and %NL80211_ATTR_WIPHY_NAME.
  *
  * @NL80211_CMD_GET_INTERFACE: Request an interface's configuration;
- *      either a dump request on a %NL80211_ATTR_WIPHY or a specific get
- *      on an %NL80211_ATTR_IFINDEX is supported.
+ *      either a dump request for all interfaces or a specific get with a
+ *      single %NL80211_ATTR_IFINDEX is supported.
  * @NL80211_CMD_SET_INTERFACE: Set type of a virtual interface, requires
  *      %NL80211_ATTR_IFINDEX and %NL80211_ATTR_IFTYPE.
  * @NL80211_CMD_NEW_INTERFACE: Newly created virtual interface or response
@@ -252,7 +259,18 @@
  *      %NL80211_ATTR_IFINDEX.
  *
  * @NL80211_CMD_GET_REG: ask the wireless core to send us its currently set
- *      regulatory domain.
+ *      regulatory domain. If %NL80211_ATTR_WIPHY is specified and the device
+ *      has a private regulatory domain, it will be returned. Otherwise, the
+ *      global regdomain will be returned.
+ *      A device will have a private regulatory domain if it uses the
+ *      regulatory_hint() API. Even when a private regdomain is used the channel
+ *      information will still be mended according to further hints from
+ *      the regulatory core to help with compliance. A dump version of this API
+ *      is now available which will returns the global regdomain as well as
+ *      all private regdomains of present wiphys (for those that have it).
+ *      If a wiphy is self-managed (%NL80211_ATTR_WIPHY_SELF_MANAGED_REG), then
+ *      its private regdomain is the only valid one for it. The regulatory
+ *      core is not used to help with compliance in this case.
  * @NL80211_CMD_SET_REG: Set current regulatory domain. CRDA sends this command
  *      after being queried by the kernel. CRDA replies by sending a regulatory
  *      domain structure which consists of %NL80211_ATTR_REG_ALPHA set to our
@@ -306,7 +324,9 @@
  *      if passed, define which channels should be scanned; if not
  *      passed, all channels allowed for the current regulatory domain
  *      are used.  Extra IEs can also be passed from the userspace by
- *      using the %NL80211_ATTR_IE attribute.
+ *      using the %NL80211_ATTR_IE attribute.  The first cycle of the
+ *      scheduled scan can be delayed by %NL80211_ATTR_SCHED_SCAN_DELAY
+ *      is supplied.
  * @NL80211_CMD_STOP_SCHED_SCAN: stop a scheduled scan. Returns -ENOENT if
  *      scheduled scan is not running. The caller may assume that as soon
  *      as the call returns, it is safe to start a new scheduled scan again.
@@ -774,6 +794,10 @@
  *      peer given by %NL80211_ATTR_MAC. Both peers must be on the base channel
  *      when this command completes.
  *
+ * @NL80211_CMD_WIPHY_REG_CHANGE: Similar to %NL80211_CMD_REG_CHANGE, but used
+ *      as an event to indicate changes for devices with wiphy-specific regdom
+ *      management.
+ *
  * @NL80211_CMD_MAX: highest used command number
  * @__NL80211_CMD_AFTER_LAST: internal use
  */
@@ -958,6 +982,8 @@ enum nl80211_commands {
         NL80211_CMD_TDLS_CHANNEL_SWITCH,
         NL80211_CMD_TDLS_CANCEL_CHANNEL_SWITCH,
 
+        NL80211_CMD_WIPHY_REG_CHANGE,
+
         /* add new commands above here */
 
         /* used to define NL80211_CMD_MAX below */
@@ -1655,6 +1681,9 @@ enum nl80211_commands {
  * @NL80211_ATTR_SOCKET_OWNER: Flag attribute, if set during interface
  *      creation then the new interface will be owned by the netlink socket
  *      that created it and will be destroyed when the socket is closed.
+ *      If set during scheduled scan start then the new scan req will be
+ *      owned by the netlink socket that created it and the scheduled scan will
+ *      be stopped when the socket is closed.
  *
  * @NL80211_ATTR_TDLS_INITIATOR: flag attribute indicating the current end is
  *      the TDLS link initiator.
@@ -1688,6 +1717,29 @@ enum nl80211_commands {
  *
  * @NL80211_ATTR_MAC_MASK: MAC address mask
  *
+ * @NL80211_ATTR_WIPHY_SELF_MANAGED_REG: flag attribute indicating this device
+ *      is self-managing its regulatory information and any regulatory domain
+ *      obtained from it is coming from the device's wiphy and not the global
+ *      cfg80211 regdomain.
+ *
+ * @NL80211_ATTR_EXT_FEATURES: extended feature flags contained in a byte
+ *      array. The feature flags are identified by their bit index (see &enum
+ *      nl80211_ext_feature_index). The bit index is ordered starting at the
+ *      least-significant bit of the first byte in the array, ie. bit index 0
+ *      is located at bit 0 of byte 0. bit index 25 would be located at bit 1
+ *      of byte 3 (u8 array).
+ *
+ * @NL80211_ATTR_SURVEY_RADIO_STATS: Request overall radio statistics to be
+ *      returned along with other survey data. If set, @NL80211_CMD_GET_SURVEY
+ *      may return a survey entry without a channel indicating global radio
+ *      statistics (only some values are valid and make sense.)
+ *      For devices that don't return such an entry even then, the information
+ *      should be contained in the result as the sum of the respective counters
+ *      over all channels.
+ *
+ * @NL80211_ATTR_SCHED_SCAN_DELAY: delay before a scheduled scan (or a
+ *      WoWLAN net-detect scan) is started, u32 in seconds.
+ *
  * @NUM_NL80211_ATTR: total number of nl80211_attrs available
  * @NL80211_ATTR_MAX: highest attribute number currently defined
  * @__NL80211_ATTR_AFTER_LAST: internal use
@@ -2045,6 +2097,16 @@ enum nl80211_attrs {
 
         NL80211_ATTR_MAC_MASK,
 
+        NL80211_ATTR_WIPHY_SELF_MANAGED_REG,
+
+        NL80211_ATTR_EXT_FEATURES,
+
+        NL80211_ATTR_SURVEY_RADIO_STATS,
+
+        NL80211_ATTR_NETNS_FD,
+
+        NL80211_ATTR_SCHED_SCAN_DELAY,
+
         /* add attributes here, update the policy in nl80211.c */
 
         __NL80211_ATTR_AFTER_LAST,
@@ -2085,7 +2147,7 @@ enum nl80211_attrs {
 
 #define NL80211_MAX_SUPP_RATES                  32
 #define NL80211_MAX_SUPP_HT_RATES               77
-#define NL80211_MAX_SUPP_REG_RULES              32
+#define NL80211_MAX_SUPP_REG_RULES              64
 #define NL80211_TKIP_DATA_OFFSET_ENCR_KEY       0
 #define NL80211_TKIP_DATA_OFFSET_TX_MIC_KEY     16
 #define NL80211_TKIP_DATA_OFFSET_RX_MIC_KEY     24
@@ -2225,8 +2287,15 @@ struct nl80211_sta_flag_update {
  * @NL80211_RATE_INFO_VHT_MCS: MCS index for VHT (u8)
  * @NL80211_RATE_INFO_VHT_NSS: number of streams in VHT (u8)
  * @NL80211_RATE_INFO_80_MHZ_WIDTH: 80 MHz VHT rate
- * @NL80211_RATE_INFO_80P80_MHZ_WIDTH: 80+80 MHz VHT rate
+ * @NL80211_RATE_INFO_80P80_MHZ_WIDTH: unused - 80+80 is treated the
+ *      same as 160 for purposes of the bitrates
  * @NL80211_RATE_INFO_160_MHZ_WIDTH: 160 MHz VHT rate
+ * @NL80211_RATE_INFO_10_MHZ_WIDTH: 10 MHz width - note that this is
+ *      a legacy rate and will be reported as the actual bitrate, i.e.
+ *      half the base (20 MHz) rate
+ * @NL80211_RATE_INFO_5_MHZ_WIDTH: 5 MHz width - note that this is
+ *      a legacy rate and will be reported as the actual bitrate, i.e.
+ *      a quarter of the base (20 MHz) rate
  * @__NL80211_RATE_INFO_AFTER_LAST: internal use
  */
 enum nl80211_rate_info {
@@ -2241,6 +2310,8 @@ enum nl80211_rate_info {
         NL80211_RATE_INFO_80_MHZ_WIDTH,
         NL80211_RATE_INFO_80P80_MHZ_WIDTH,
         NL80211_RATE_INFO_160_MHZ_WIDTH,
+        NL80211_RATE_INFO_10_MHZ_WIDTH,
+        NL80211_RATE_INFO_5_MHZ_WIDTH,
 
         /* keep last */
         __NL80211_RATE_INFO_AFTER_LAST,
@@ -2285,18 +2356,24 @@ enum nl80211_sta_bss_param {
  *
  * @__NL80211_STA_INFO_INVALID: attribute number 0 is reserved
  * @NL80211_STA_INFO_INACTIVE_TIME: time since last activity (u32, msecs)
- * @NL80211_STA_INFO_RX_BYTES: total received bytes (u32, from this station)
- * @NL80211_STA_INFO_TX_BYTES: total transmitted bytes (u32, to this station)
- * @NL80211_STA_INFO_RX_BYTES64: total received bytes (u64, from this station)
- * @NL80211_STA_INFO_TX_BYTES64: total transmitted bytes (u64, to this station)
+ * @NL80211_STA_INFO_RX_BYTES: total received bytes (MPDU length)
+ *      (u32, from this station)
+ * @NL80211_STA_INFO_TX_BYTES: total transmitted bytes (MPDU length)
+ *      (u32, to this station)
+ * @NL80211_STA_INFO_RX_BYTES64: total received bytes (MPDU length)
+ *      (u64, from this station)
+ * @NL80211_STA_INFO_TX_BYTES64: total transmitted bytes (MPDU length)
+ *      (u64, to this station)
  * @NL80211_STA_INFO_SIGNAL: signal strength of last received PPDU (u8, dBm)
  * @NL80211_STA_INFO_TX_BITRATE: current unicast tx rate, nested attribute
  *      containing info as possible, see &enum nl80211_rate_info
- * @NL80211_STA_INFO_RX_PACKETS: total received packet (u32, from this station)
- * @NL80211_STA_INFO_TX_PACKETS: total transmitted packets (u32, to this
- *      station)
- * @NL80211_STA_INFO_TX_RETRIES: total retries (u32, to this station)
- * @NL80211_STA_INFO_TX_FAILED: total failed packets (u32, to this station)
+ * @NL80211_STA_INFO_RX_PACKETS: total received packet (MSDUs and MMPDUs)
+ *      (u32, from this station)
+ * @NL80211_STA_INFO_TX_PACKETS: total transmitted packets (MSDUs and MMPDUs)
+ *      (u32, to this station)
+ * @NL80211_STA_INFO_TX_RETRIES: total retries (MPDUs) (u32, to this station)
+ * @NL80211_STA_INFO_TX_FAILED: total failed packets (MPDUs)
+ *      (u32, to this station)
  * @NL80211_STA_INFO_SIGNAL_AVG: signal strength average (u8, dBm)
  * @NL80211_STA_INFO_LLID: the station's mesh LLID
  * @NL80211_STA_INFO_PLID: the station's mesh PLID
@@ -2320,6 +2397,16 @@ enum nl80211_sta_bss_param {
  *      Same format as NL80211_STA_INFO_CHAIN_SIGNAL.
  * @NL80211_STA_EXPECTED_THROUGHPUT: expected throughput considering also the
  *      802.11 header (u32, kbps)
+ * @NL80211_STA_INFO_RX_DROP_MISC: RX packets dropped for unspecified reasons
+ *      (u64)
+ * @NL80211_STA_INFO_BEACON_RX: number of beacons received from this peer (u64)
+ * @NL80211_STA_INFO_BEACON_SIGNAL_AVG: signal strength average
+ *      for beacons only (u8, dBm)
+ * @NL80211_STA_INFO_TID_STATS: per-TID statistics (see &enum nl80211_tid_stats)
+ *      This is a nested attribute where each the inner attribute number is the
+ *      TID+1 and the special TID 16 (i.e. value 17) is used for non-QoS frames;
+ *      each one of those is again nested with &enum nl80211_tid_stats
+ *      attributes carrying the actual values.
  * @__NL80211_STA_INFO_AFTER_LAST: internal
  * @NL80211_STA_INFO_MAX: highest possible station info attribute
  */
@@ -2352,6 +2439,10 @@ enum nl80211_sta_info {
         NL80211_STA_INFO_CHAIN_SIGNAL,
         NL80211_STA_INFO_CHAIN_SIGNAL_AVG,
         NL80211_STA_INFO_EXPECTED_THROUGHPUT,
+        NL80211_STA_INFO_RX_DROP_MISC,
+        NL80211_STA_INFO_BEACON_RX,
+        NL80211_STA_INFO_BEACON_SIGNAL_AVG,
+        NL80211_STA_INFO_TID_STATS,
 
         /* keep last */
         __NL80211_STA_INFO_AFTER_LAST,
@@ -2359,6 +2450,31 @@ enum nl80211_sta_info {
 };
 
 /**
+ * enum nl80211_tid_stats - per TID statistics attributes
+ * @__NL80211_TID_STATS_INVALID: attribute number 0 is reserved
+ * @NL80211_TID_STATS_RX_MSDU: number of MSDUs received (u64)
+ * @NL80211_TID_STATS_TX_MSDU: number of MSDUs transmitted (or
+ *      attempted to transmit; u64)
+ * @NL80211_TID_STATS_TX_MSDU_RETRIES: number of retries for
+ *      transmitted MSDUs (not counting the first attempt; u64)
+ * @NL80211_TID_STATS_TX_MSDU_FAILED: number of failed transmitted
+ *      MSDUs (u64)
+ * @NUM_NL80211_TID_STATS: number of attributes here
+ * @NL80211_TID_STATS_MAX: highest numbered attribute here
+ */
+enum nl80211_tid_stats {
+        __NL80211_TID_STATS_INVALID,
+        NL80211_TID_STATS_RX_MSDU,
+        NL80211_TID_STATS_TX_MSDU,
+        NL80211_TID_STATS_TX_MSDU_RETRIES,
+        NL80211_TID_STATS_TX_MSDU_FAILED,
+
+        /* keep last */
+        NUM_NL80211_TID_STATS,
+        NL80211_TID_STATS_MAX = NUM_NL80211_TID_STATS - 1
+};
+
+/**
  * enum nl80211_mpath_flags - nl80211 mesh path flags
  *
  * @NL80211_MPATH_FLAG_ACTIVE: the mesh path is active
@@ -2772,16 +2888,18 @@ enum nl80211_user_reg_hint_type {
  * @NL80211_SURVEY_INFO_FREQUENCY: center frequency of channel
  * @NL80211_SURVEY_INFO_NOISE: noise level of channel (u8, dBm)
  * @NL80211_SURVEY_INFO_IN_USE: channel is currently being used
- * @NL80211_SURVEY_INFO_CHANNEL_TIME: amount of time (in ms) that the radio
- *      spent on this channel
- * @NL80211_SURVEY_INFO_CHANNEL_TIME_BUSY: amount of the time the primary
+ * @NL80211_SURVEY_INFO_TIME: amount of time (in ms) that the radio
+ *      was turned on (on channel or globally)
+ * @NL80211_SURVEY_INFO_TIME_BUSY: amount of the time the primary
  *      channel was sensed busy (either due to activity or energy detect)
- * @NL80211_SURVEY_INFO_CHANNEL_TIME_EXT_BUSY: amount of time the extension
+ * @NL80211_SURVEY_INFO_TIME_EXT_BUSY: amount of time the extension
  *      channel was sensed busy
- * @NL80211_SURVEY_INFO_CHANNEL_TIME_RX: amount of time the radio spent
- *      receiving data
- * @NL80211_SURVEY_INFO_CHANNEL_TIME_TX: amount of time the radio spent
- *      transmitting data
+ * @NL80211_SURVEY_INFO_TIME_RX: amount of time the radio spent
+ *      receiving data (on channel or globally)
+ * @NL80211_SURVEY_INFO_TIME_TX: amount of time the radio spent
+ *      transmitting data (on channel or globally)
+ * @NL80211_SURVEY_INFO_TIME_SCAN: time the radio spent for scan
+ *      (on this channel or globally)
  * @NL80211_SURVEY_INFO_MAX: highest survey info attribute number
  *      currently defined
  * @__NL80211_SURVEY_INFO_AFTER_LAST: internal use
@@ -2791,17 +2909,25 @@ enum nl80211_survey_info {
         NL80211_SURVEY_INFO_FREQUENCY,
         NL80211_SURVEY_INFO_NOISE,
         NL80211_SURVEY_INFO_IN_USE,
-        NL80211_SURVEY_INFO_CHANNEL_TIME,
-        NL80211_SURVEY_INFO_CHANNEL_TIME_BUSY,
-        NL80211_SURVEY_INFO_CHANNEL_TIME_EXT_BUSY,
-        NL80211_SURVEY_INFO_CHANNEL_TIME_RX,
-        NL80211_SURVEY_INFO_CHANNEL_TIME_TX,
+        NL80211_SURVEY_INFO_TIME,
+        NL80211_SURVEY_INFO_TIME_BUSY,
+        NL80211_SURVEY_INFO_TIME_EXT_BUSY,
+        NL80211_SURVEY_INFO_TIME_RX,
+        NL80211_SURVEY_INFO_TIME_TX,
+        NL80211_SURVEY_INFO_TIME_SCAN,
 
         /* keep last */
         __NL80211_SURVEY_INFO_AFTER_LAST,
         NL80211_SURVEY_INFO_MAX = __NL80211_SURVEY_INFO_AFTER_LAST - 1
 };
 
+/* keep old names for compatibility */
+#define NL80211_SURVEY_INFO_CHANNEL_TIME                NL80211_SURVEY_INFO_TIME
+#define NL80211_SURVEY_INFO_CHANNEL_TIME_BUSY           NL80211_SURVEY_INFO_TIME_BUSY
+#define NL80211_SURVEY_INFO_CHANNEL_TIME_EXT_BUSY       NL80211_SURVEY_INFO_TIME_EXT_BUSY
+#define NL80211_SURVEY_INFO_CHANNEL_TIME_RX             NL80211_SURVEY_INFO_TIME_RX
+#define NL80211_SURVEY_INFO_CHANNEL_TIME_TX             NL80211_SURVEY_INFO_TIME_TX
+
 /**
  * enum nl80211_mntr_flags - monitor configuration flags
  *
@@ -3238,6 +3364,9 @@ enum nl80211_bss {
 /**
  * enum nl80211_bss_status - BSS "status"
  * @NL80211_BSS_STATUS_AUTHENTICATED: Authenticated with this BSS.
+ *      Note that this is no longer used since cfg80211 no longer
+ *      keeps track of whether or not authentication was done with
+ *      a given BSS.
  * @NL80211_BSS_STATUS_ASSOCIATED: Associated with this BSS.
  * @NL80211_BSS_STATUS_IBSS_JOINED: Joined to this IBSS.
  *
@@ -3621,9 +3750,12 @@ struct nl80211_pattern_support {
  * @NL80211_WOWLAN_TRIG_NET_DETECT: wake up when a configured network
  *      is detected.  This is a nested attribute that contains the
  *      same attributes used with @NL80211_CMD_START_SCHED_SCAN.  It
- *      specifies how the scan is performed (e.g. the interval and the
- *      channels to scan) as well as the scan results that will
- *      trigger a wake (i.e. the matchsets).
+ *      specifies how the scan is performed (e.g. the interval, the
+ *      channels to scan and the initial delay) as well as the scan
+ *      results that will trigger a wake (i.e. the matchsets).  This
+ *      attribute is also sent in a response to
+ *      @NL80211_CMD_GET_WIPHY, indicating the number of match sets
+ *      supported by the driver (u32).
  * @NL80211_WOWLAN_TRIG_NET_DETECT_RESULTS: nested attribute
  *      containing an array with information about what triggered the
  *      wake up.  If no elements are present in the array, it means
@@ -4194,6 +4326,19 @@ enum nl80211_feature_flags {
 };
 
 /**
+ * enum nl80211_ext_feature_index - bit index of extended features.
+ *
+ * @NUM_NL80211_EXT_FEATURES: number of extended features.
+ * @MAX_NL80211_EXT_FEATURES: highest extended feature index.
+ */
+enum nl80211_ext_feature_index {
+
+        /* add new features before the definition below */
+        NUM_NL80211_EXT_FEATURES,
+        MAX_NL80211_EXT_FEATURES = NUM_NL80211_EXT_FEATURES - 1
+};
+
+/**
  * enum nl80211_probe_resp_offload_support_attr - optional supported
  *      protocols for probe-response offloading by the driver/FW.
  *      To be used with the %NL80211_ATTR_PROBE_RESP_OFFLOAD attribute.
diff --git a/include/uapi/linux/openvswitch.h b/include/uapi/linux/openvswitch.h
index f714e8633352..bbd49a0c46c7 100644
--- a/include/uapi/linux/openvswitch.h
+++ b/include/uapi/linux/openvswitch.h
@@ -252,11 +252,21 @@ enum ovs_vport_attr {
 
 #define OVS_VPORT_ATTR_MAX (__OVS_VPORT_ATTR_MAX - 1)
 
+enum {
+        OVS_VXLAN_EXT_UNSPEC,
+        OVS_VXLAN_EXT_GBP,      /* Flag or __u32 */
+        __OVS_VXLAN_EXT_MAX,
+};
+
+#define OVS_VXLAN_EXT_MAX (__OVS_VXLAN_EXT_MAX - 1)
+
+
 /* OVS_VPORT_ATTR_OPTIONS attributes for tunnels.
  */
 enum {
         OVS_TUNNEL_ATTR_UNSPEC,
         OVS_TUNNEL_ATTR_DST_PORT, /* 16-bit UDP port, used by L4 tunnels. */
+        OVS_TUNNEL_ATTR_EXTENSION,
         __OVS_TUNNEL_ATTR_MAX
 };
 
@@ -328,6 +338,7 @@ enum ovs_tunnel_key_attr {
         OVS_TUNNEL_KEY_ATTR_GENEVE_OPTS,        /* Array of Geneve options. */
         OVS_TUNNEL_KEY_ATTR_TP_SRC,             /* be16 src Transport Port. */
         OVS_TUNNEL_KEY_ATTR_TP_DST,             /* be16 dst Transport Port. */
+        OVS_TUNNEL_KEY_ATTR_VXLAN_OPTS,         /* Nested OVS_VXLAN_EXT_* */
         __OVS_TUNNEL_KEY_ATTR_MAX
 };
 
@@ -448,6 +459,14 @@ struct ovs_key_nd {
  * a wildcarded match. Omitting attribute is treated as wildcarding all
  * corresponding fields. Optional for all requests. If not present,
  * all flow key bits are exact match bits.
+ * @OVS_FLOW_ATTR_UFID: A value between 1-16 octets specifying a unique
+ * identifier for the flow. Causes the flow to be indexed by this value rather
+ * than the value of the %OVS_FLOW_ATTR_KEY attribute. Optional for all
+ * requests. Present in notifications if the flow was created with this
+ * attribute.
+ * @OVS_FLOW_ATTR_UFID_FLAGS: A 32-bit value of OR'd %OVS_UFID_F_*
+ * flags that provide alternative semantics for flow installation and
+ * retrieval. Optional for all requests.
  *
  * These attributes follow the &struct ovs_header within the Generic Netlink
  * payload for %OVS_FLOW_* commands.
@@ -463,12 +482,24 @@ enum ovs_flow_attr {
         OVS_FLOW_ATTR_MASK,      /* Sequence of OVS_KEY_ATTR_* attributes. */
         OVS_FLOW_ATTR_PROBE,     /* Flow operation is a feature probe, error
                                   * logging should be suppressed. */
+        OVS_FLOW_ATTR_UFID,      /* Variable length unique flow identifier. */
+        OVS_FLOW_ATTR_UFID_FLAGS,/* u32 of OVS_UFID_F_*. */
         __OVS_FLOW_ATTR_MAX
 };
 
 #define OVS_FLOW_ATTR_MAX (__OVS_FLOW_ATTR_MAX - 1)
 
 /**
+ * Omit attributes for notifications.
+ *
+ * If a datapath request contains an %OVS_UFID_F_OMIT_* flag, then the datapath
+ * may omit the corresponding %OVS_FLOW_ATTR_* from the response.
+ */
+#define OVS_UFID_F_OMIT_KEY      (1 << 0)
+#define OVS_UFID_F_OMIT_MASK     (1 << 1)
+#define OVS_UFID_F_OMIT_ACTIONS  (1 << 2)
+
+/**
  * enum ovs_sample_attr - Attributes for %OVS_ACTION_ATTR_SAMPLE action.
  * @OVS_SAMPLE_ATTR_PROBABILITY: 32-bit fraction of packets to sample with
  * @OVS_ACTION_ATTR_SAMPLE.  A value of 0 samples no packets, a value of
@@ -568,6 +599,12 @@ struct ovs_action_hash {
  * @OVS_ACTION_ATTR_SET: Replaces the contents of an existing header.  The
  * single nested %OVS_KEY_ATTR_* attribute specifies a header to modify and its
  * value.
+ * @OVS_ACTION_ATTR_SET_MASKED: Replaces the contents of an existing header.  A
+ * nested %OVS_KEY_ATTR_* attribute specifies a header to modify, its value,
+ * and a mask.  For every bit set in the mask, the corresponding bit value
+ * is copied from the value to the packet header field, rest of the bits are
+ * left unchanged.  The non-masked value bits must be passed in as zeroes.
+ * Masking is not supported for the %OVS_KEY_ATTR_TUNNEL attribute.
  * @OVS_ACTION_ATTR_PUSH_VLAN: Push a new outermost 802.1Q header onto the
  * packet.
  * @OVS_ACTION_ATTR_POP_VLAN: Pop the outermost 802.1Q header off the packet.
@@ -586,6 +623,9 @@ struct ovs_action_hash {
  * Only a single header can be set with a single %OVS_ACTION_ATTR_SET.  Not all
  * fields within a header are modifiable, e.g. the IPv4 protocol and fragment
  * type may not be changed.
+ *
+ * @OVS_ACTION_ATTR_SET_TO_MASKED: Kernel internal masked set action translated
+ * from the @OVS_ACTION_ATTR_SET.
  */
 
 enum ovs_action_attr {
@@ -600,8 +640,19 @@ enum ovs_action_attr {
         OVS_ACTION_ATTR_HASH,         /* struct ovs_action_hash. */
         OVS_ACTION_ATTR_PUSH_MPLS,    /* struct ovs_action_push_mpls. */
         OVS_ACTION_ATTR_POP_MPLS,     /* __be16 ethertype. */
+        OVS_ACTION_ATTR_SET_MASKED,   /* One nested OVS_KEY_ATTR_* including
+                                       * data immediately followed by a mask.
+                                       * The data must be zero for the unmasked
+                                       * bits. */
 
-        __OVS_ACTION_ATTR_MAX
+        __OVS_ACTION_ATTR_MAX,        /* Nothing past this will be accepted
+                                       * from userspace. */
+
+#ifdef __KERNEL__
+        OVS_ACTION_ATTR_SET_TO_MASKED, /* Kernel module internal masked
+                                        * set action converted from
+                                        * OVS_ACTION_ATTR_SET. */
+#endif
 };
 
 #define OVS_ACTION_ATTR_MAX (__OVS_ACTION_ATTR_MAX - 1)
diff --git a/include/uapi/linux/pkt_sched.h b/include/uapi/linux/pkt_sched.h
index d62316baae94..534b84710745 100644
--- a/include/uapi/linux/pkt_sched.h
+++ b/include/uapi/linux/pkt_sched.h
@@ -774,6 +774,8 @@ enum {
 
         TCA_FQ_FLOW_REFILL_DELAY,       /* flow credit refill delay in usec */
 
+        TCA_FQ_ORPHAN_MASK,     /* mask applied to orphaned skb hashes */
+
         __TCA_FQ_MAX
 };
 
diff --git a/include/uapi/linux/rtnetlink.h b/include/uapi/linux/rtnetlink.h
index 9c9b8b4480cd..5cc5d66bf519 100644
--- a/include/uapi/linux/rtnetlink.h
+++ b/include/uapi/linux/rtnetlink.h
@@ -132,6 +132,11 @@ enum {
         RTM_GETMDB = 86,
 #define RTM_GETMDB RTM_GETMDB
 
+        RTM_NEWNSID = 88,
+#define RTM_NEWNSID RTM_NEWNSID
+        RTM_GETNSID = 90,
+#define RTM_GETNSID RTM_GETNSID
+
         __RTM_MAX,
 #define RTM_MAX         (((__RTM_MAX + 3) & ~3) - 1)
 };
@@ -389,6 +394,8 @@ enum {
 #define RTAX_INITRWND RTAX_INITRWND
         RTAX_QUICKACK,
 #define RTAX_QUICKACK RTAX_QUICKACK
+        RTAX_CC_ALGO,
+#define RTAX_CC_ALGO RTAX_CC_ALGO
         __RTAX_MAX
 };
 
@@ -634,6 +641,7 @@ struct tcamsg {
 /* New extended info filters for IFLA_EXT_MASK */
 #define RTEXT_FILTER_VF         (1 << 0)
 #define RTEXT_FILTER_BRVLAN     (1 << 1)
+#define RTEXT_FILTER_BRVLAN_COMPRESSED  (1 << 2)
 
 /* End of information exported to user level */
 
diff --git a/include/uapi/linux/snmp.h b/include/uapi/linux/snmp.h
index b22224100011..6a6fb747c78d 100644
--- a/include/uapi/linux/snmp.h
+++ b/include/uapi/linux/snmp.h
@@ -270,6 +270,12 @@ enum
         LINUX_MIB_TCPHYSTARTTRAINCWND,          /* TCPHystartTrainCwnd */
         LINUX_MIB_TCPHYSTARTDELAYDETECT,        /* TCPHystartDelayDetect */
         LINUX_MIB_TCPHYSTARTDELAYCWND,          /* TCPHystartDelayCwnd */
+        LINUX_MIB_TCPACKSKIPPEDSYNRECV,         /* TCPACKSkippedSynRecv */
+        LINUX_MIB_TCPACKSKIPPEDPAWS,            /* TCPACKSkippedPAWS */
+        LINUX_MIB_TCPACKSKIPPEDSEQ,             /* TCPACKSkippedSeq */
+        LINUX_MIB_TCPACKSKIPPEDFINWAIT2,        /* TCPACKSkippedFinWait2 */
+        LINUX_MIB_TCPACKSKIPPEDTIMEWAIT,        /* TCPACKSkippedTimeWait */
+        LINUX_MIB_TCPACKSKIPPEDCHALLENGE,       /* TCPACKSkippedChallenge */
         __LINUX_MIB_MAX
 };
 
diff --git a/include/uapi/linux/tc_act/Kbuild b/include/uapi/linux/tc_act/Kbuild
index b057da2b87a4..19d5219b0b99 100644
--- a/include/uapi/linux/tc_act/Kbuild
+++ b/include/uapi/linux/tc_act/Kbuild
@@ -8,3 +8,4 @@ header-y += tc_nat.h
 header-y += tc_pedit.h
 header-y += tc_skbedit.h
 header-y += tc_vlan.h
+header-y += tc_bpf.h
diff --git a/include/uapi/linux/tc_act/tc_bpf.h b/include/uapi/linux/tc_act/tc_bpf.h
new file mode 100644
index 000000000000..5288bd77e63b
--- /dev/null
+++ b/include/uapi/linux/tc_act/tc_bpf.h
@@ -0,0 +1,31 @@
+/*
+ * Copyright (c) 2015 Jiri Pirko <jiri@resnulli.us>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ */
+
+#ifndef __LINUX_TC_BPF_H
+#define __LINUX_TC_BPF_H
+
+#include <linux/pkt_cls.h>
+
+#define TCA_ACT_BPF 13
+
+struct tc_act_bpf {
+        tc_gen;
+};
+
+enum {
+        TCA_ACT_BPF_UNSPEC,
+        TCA_ACT_BPF_TM,
+        TCA_ACT_BPF_PARMS,
+        TCA_ACT_BPF_OPS_LEN,
+        TCA_ACT_BPF_OPS,
+        __TCA_ACT_BPF_MAX,
+};
+#define TCA_ACT_BPF_MAX (__TCA_ACT_BPF_MAX - 1)
+
+#endif
diff --git a/include/uapi/linux/tc_act/tc_connmark.h b/include/uapi/linux/tc_act/tc_connmark.h
new file mode 100644
index 000000000000..994b0971bce2
--- /dev/null
+++ b/include/uapi/linux/tc_act/tc_connmark.h
@@ -0,0 +1,22 @@
+#ifndef __UAPI_TC_CONNMARK_H
+#define __UAPI_TC_CONNMARK_H
+
+#include <linux/types.h>
+#include <linux/pkt_cls.h>
+
+#define TCA_ACT_CONNMARK 14
+
+struct tc_connmark {
+        tc_gen;
+        __u16 zone;
+};
+
+enum {
+        TCA_CONNMARK_UNSPEC,
+        TCA_CONNMARK_PARMS,
+        TCA_CONNMARK_TM,
+        __TCA_CONNMARK_MAX
+};
+#define TCA_CONNMARK_MAX (__TCA_CONNMARK_MAX - 1)
+
+#endif
diff --git a/include/uapi/linux/tipc_config.h b/include/uapi/linux/tipc_config.h
index 876d0a14863c..087b0ef82c07 100644
--- a/include/uapi/linux/tipc_config.h
+++ b/include/uapi/linux/tipc_config.h
@@ -272,6 +272,26 @@ static inline int TLV_CHECK(const void *tlv, __u16 space, __u16 exp_type)
                 (ntohs(((struct tlv_desc *)tlv)->tlv_type) == exp_type);
 }
 
+static inline int TLV_GET_LEN(struct tlv_desc *tlv)
+{
+        return ntohs(tlv->tlv_len);
+}
+
+static inline void TLV_SET_LEN(struct tlv_desc *tlv, __u16 len)
+{
+        tlv->tlv_len = htons(len);
+}
+
+static inline int TLV_CHECK_TYPE(struct tlv_desc *tlv,  __u16 type)
+{
+        return (ntohs(tlv->tlv_type) == type);
+}
+
+static inline void TLV_SET_TYPE(struct tlv_desc *tlv, __u16 type)
+{
+        tlv->tlv_type = htons(type);
+}
+
 static inline int TLV_SET(void *tlv, __u16 type, void *data, __u16 len)
 {
         struct tlv_desc *tlv_ptr;
diff --git a/include/xen/page.h b/include/xen/page.h
index 12765b6f9517..c5ed20bb3fe9 100644
--- a/include/xen/page.h
+++ b/include/xen/page.h
@@ -3,6 +3,11 @@
 
 #include <asm/xen/page.h>
 
+static inline unsigned long page_to_mfn(struct page *page)
+{
+        return pfn_to_mfn(page_to_pfn(page));
+}
+
 struct xen_memory_region {
         phys_addr_t start;
         phys_addr_t size;