Merge branch 'main' of https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next.git

85 files changed, 1171 insertions, 1622 deletions

diff --git a/include/linux/bnge/hsi.h b/include/linux/bnge/hsi.h
index 1f7bd96415a5..d4fe662d60b1 100644
--- a/include/linux/bnge/hsi.h
+++ b/include/linux/bnge/hsi.h
@@ -8607,6 +8607,7 @@ struct hwrm_cfa_l2_filter_alloc_input {
 	#define CFA_L2_FILTER_ALLOC_REQ_ENABLES_MIRROR_VNIC_ID      0x10000UL
 	#define CFA_L2_FILTER_ALLOC_REQ_ENABLES_NUM_VLANS           0x20000UL
 	#define CFA_L2_FILTER_ALLOC_REQ_ENABLES_T_NUM_VLANS         0x40000UL
+	#define CFA_L2_FILTER_ALLOC_REQ_ENABLES_RFS_RING_TBL_IDX    0x80000UL
 	u8	l2_addr[6];
 	u8	num_vlans;
 	u8	t_num_vlans;
@@ -8663,7 +8664,8 @@ struct hwrm_cfa_l2_filter_alloc_input {
 	#define CFA_L2_FILTER_ALLOC_REQ_PRI_HINT_MIN          0x4UL
 	#define CFA_L2_FILTER_ALLOC_REQ_PRI_HINT_LAST        CFA_L2_FILTER_ALLOC_REQ_PRI_HINT_MIN
 	u8	unused_5;
-	__le32	unused_6;
+	__le16	rfs_ring_tbl_idx;
+	__le16	unused_6;
 	__le64	l2_filter_id_hint;
 };
 
@@ -8900,6 +8902,95 @@ struct hwrm_cfa_tunnel_filter_free_output {
 	u8	valid;
 };
 
+/* hwrm_cfa_ntuple_filter_alloc_input (size:1024b/128B) */
+struct hwrm_cfa_ntuple_filter_alloc_input {
+	__le16	req_type;
+	__le16	cmpl_ring;
+	__le16	seq_id;
+	__le16	target_id;
+	__le64	resp_addr;
+	__le32	flags;
+	#define CFA_NTUPLE_FILTER_ALLOC_REQ_FLAGS_LOOPBACK              0x1UL
+	#define CFA_NTUPLE_FILTER_ALLOC_REQ_FLAGS_DROP                  0x2UL
+	#define CFA_NTUPLE_FILTER_ALLOC_REQ_FLAGS_METER                 0x4UL
+	#define CFA_NTUPLE_FILTER_ALLOC_REQ_FLAGS_DEST_FID              0x8UL
+	#define CFA_NTUPLE_FILTER_ALLOC_REQ_FLAGS_ARP_REPLY             0x10UL
+	#define CFA_NTUPLE_FILTER_ALLOC_REQ_FLAGS_DEST_RFS_RING_IDX     0x20UL
+	#define CFA_NTUPLE_FILTER_ALLOC_REQ_FLAGS_NO_L2_CONTEXT         0x40UL
+	__le32	enables;
+	#define CFA_NTUPLE_FILTER_ALLOC_REQ_ENABLES_L2_FILTER_ID         0x1UL
+	#define CFA_NTUPLE_FILTER_ALLOC_REQ_ENABLES_ETHERTYPE            0x2UL
+	#define CFA_NTUPLE_FILTER_ALLOC_REQ_ENABLES_TUNNEL_TYPE          0x4UL
+	#define CFA_NTUPLE_FILTER_ALLOC_REQ_ENABLES_SRC_MACADDR          0x8UL
+	#define CFA_NTUPLE_FILTER_ALLOC_REQ_ENABLES_IPADDR_TYPE          0x10UL
+	#define CFA_NTUPLE_FILTER_ALLOC_REQ_ENABLES_SRC_IPADDR           0x20UL
+	#define CFA_NTUPLE_FILTER_ALLOC_REQ_ENABLES_SRC_IPADDR_MASK      0x40UL
+	#define CFA_NTUPLE_FILTER_ALLOC_REQ_ENABLES_DST_IPADDR           0x80UL
+	#define CFA_NTUPLE_FILTER_ALLOC_REQ_ENABLES_DST_IPADDR_MASK      0x100UL
+	#define CFA_NTUPLE_FILTER_ALLOC_REQ_ENABLES_IP_PROTOCOL          0x200UL
+	#define CFA_NTUPLE_FILTER_ALLOC_REQ_ENABLES_SRC_PORT             0x400UL
+	#define CFA_NTUPLE_FILTER_ALLOC_REQ_ENABLES_SRC_PORT_MASK        0x800UL
+	#define CFA_NTUPLE_FILTER_ALLOC_REQ_ENABLES_DST_PORT             0x1000UL
+	#define CFA_NTUPLE_FILTER_ALLOC_REQ_ENABLES_DST_PORT_MASK        0x2000UL
+	#define CFA_NTUPLE_FILTER_ALLOC_REQ_ENABLES_PRI_HINT             0x4000UL
+	#define CFA_NTUPLE_FILTER_ALLOC_REQ_ENABLES_NTUPLE_FILTER_ID     0x8000UL
+	#define CFA_NTUPLE_FILTER_ALLOC_REQ_ENABLES_DST_ID               0x10000UL
+	#define CFA_NTUPLE_FILTER_ALLOC_REQ_ENABLES_MIRROR_VNIC_ID       0x20000UL
+	#define CFA_NTUPLE_FILTER_ALLOC_REQ_ENABLES_DST_MACADDR          0x40000UL
+	#define CFA_NTUPLE_FILTER_ALLOC_REQ_ENABLES_RFS_RING_TBL_IDX     0x80000UL
+	__le64	l2_filter_id;
+	u8	src_macaddr[6];
+	__be16	ethertype;
+	u8	ip_addr_type;
+	#define CFA_NTUPLE_FILTER_ALLOC_REQ_IP_ADDR_TYPE_UNKNOWN 0x0UL
+	#define CFA_NTUPLE_FILTER_ALLOC_REQ_IP_ADDR_TYPE_IPV4    0x4UL
+	#define CFA_NTUPLE_FILTER_ALLOC_REQ_IP_ADDR_TYPE_IPV6    0x6UL
+	#define CFA_NTUPLE_FILTER_ALLOC_REQ_IP_ADDR_TYPE_LAST   CFA_NTUPLE_FILTER_ALLOC_REQ_IP_ADDR_TYPE_IPV6
+	u8	ip_protocol;
+	#define CFA_NTUPLE_FILTER_ALLOC_REQ_IP_PROTOCOL_UNKNOWN 0x0UL
+	#define CFA_NTUPLE_FILTER_ALLOC_REQ_IP_PROTOCOL_TCP     0x6UL
+	#define CFA_NTUPLE_FILTER_ALLOC_REQ_IP_PROTOCOL_UDP     0x11UL
+	#define CFA_NTUPLE_FILTER_ALLOC_REQ_IP_PROTOCOL_ICMP    0x1UL
+	#define CFA_NTUPLE_FILTER_ALLOC_REQ_IP_PROTOCOL_ICMPV6  0x3aUL
+	#define CFA_NTUPLE_FILTER_ALLOC_REQ_IP_PROTOCOL_RSVD    0xffUL
+	#define CFA_NTUPLE_FILTER_ALLOC_REQ_IP_PROTOCOL_LAST   CFA_NTUPLE_FILTER_ALLOC_REQ_IP_PROTOCOL_RSVD
+	__le16	dst_id;
+	__le16	rfs_ring_tbl_idx;
+	u8	tunnel_type;
+	#define CFA_NTUPLE_FILTER_ALLOC_REQ_TUNNEL_TYPE_NONTUNNEL    0x0UL
+	#define CFA_NTUPLE_FILTER_ALLOC_REQ_TUNNEL_TYPE_VXLAN        0x1UL
+	#define CFA_NTUPLE_FILTER_ALLOC_REQ_TUNNEL_TYPE_NVGRE        0x2UL
+	#define CFA_NTUPLE_FILTER_ALLOC_REQ_TUNNEL_TYPE_L2GRE        0x3UL
+	#define CFA_NTUPLE_FILTER_ALLOC_REQ_TUNNEL_TYPE_IPIP         0x4UL
+	#define CFA_NTUPLE_FILTER_ALLOC_REQ_TUNNEL_TYPE_GENEVE       0x5UL
+	#define CFA_NTUPLE_FILTER_ALLOC_REQ_TUNNEL_TYPE_MPLS         0x6UL
+	#define CFA_NTUPLE_FILTER_ALLOC_REQ_TUNNEL_TYPE_STT          0x7UL
+	#define CFA_NTUPLE_FILTER_ALLOC_REQ_TUNNEL_TYPE_IPGRE        0x8UL
+	#define CFA_NTUPLE_FILTER_ALLOC_REQ_TUNNEL_TYPE_VXLAN_V4     0x9UL
+	#define CFA_NTUPLE_FILTER_ALLOC_REQ_TUNNEL_TYPE_IPGRE_V1     0xaUL
+	#define CFA_NTUPLE_FILTER_ALLOC_REQ_TUNNEL_TYPE_L2_ETYPE     0xbUL
+	#define CFA_NTUPLE_FILTER_ALLOC_REQ_TUNNEL_TYPE_VXLAN_GPE_V6 0xcUL
+	#define CFA_NTUPLE_FILTER_ALLOC_REQ_TUNNEL_TYPE_VXLAN_GPE    0x10UL
+	#define CFA_NTUPLE_FILTER_ALLOC_REQ_TUNNEL_TYPE_ANYTUNNEL    0xffUL
+	#define CFA_NTUPLE_FILTER_ALLOC_REQ_TUNNEL_TYPE_LAST        CFA_NTUPLE_FILTER_ALLOC_REQ_TUNNEL_TYPE_ANYTUNNEL
+	u8	pri_hint;
+	#define CFA_NTUPLE_FILTER_ALLOC_REQ_PRI_HINT_NO_PREFER 0x0UL
+	#define CFA_NTUPLE_FILTER_ALLOC_REQ_PRI_HINT_ABOVE     0x1UL
+	#define CFA_NTUPLE_FILTER_ALLOC_REQ_PRI_HINT_BELOW     0x2UL
+	#define CFA_NTUPLE_FILTER_ALLOC_REQ_PRI_HINT_HIGHEST   0x3UL
+	#define CFA_NTUPLE_FILTER_ALLOC_REQ_PRI_HINT_LOWEST    0x4UL
+	#define CFA_NTUPLE_FILTER_ALLOC_REQ_PRI_HINT_LAST     CFA_NTUPLE_FILTER_ALLOC_REQ_PRI_HINT_LOWEST
+	__be32	src_ipaddr[4];
+	__be32	src_ipaddr_mask[4];
+	__be32	dst_ipaddr[4];
+	__be32	dst_ipaddr_mask[4];
+	__be16	src_port;
+	__be16	src_port_mask;
+	__be16	dst_port;
+	__be16	dst_port_mask;
+	__le64	ntuple_filter_id_hint;
+};
+
 /* hwrm_cfa_ntuple_filter_alloc_output (size:192b/24B) */
 struct hwrm_cfa_ntuple_filter_alloc_output {
 	__le16	error_code;
@@ -9014,6 +9105,49 @@ struct hwrm_cfa_ntuple_filter_cfg_output {
 	u8	valid;
 };
 
+/* hwrm_cfa_adv_flow_mgnt_qcaps_input (size:256b/32B) */
+struct hwrm_cfa_adv_flow_mgnt_qcaps_input {
+	__le16	req_type;
+	__le16	cmpl_ring;
+	__le16	seq_id;
+	__le16	target_id;
+	__le64	resp_addr;
+	__le32	unused_0[4];
+};
+
+/* hwrm_cfa_adv_flow_mgnt_qcaps_output (size:128b/16B) */
+struct hwrm_cfa_adv_flow_mgnt_qcaps_output {
+	__le16	error_code;
+	__le16	req_type;
+	__le16	seq_id;
+	__le16	resp_len;
+	__le32	flags;
+	#define CFA_ADV_FLOW_MGNT_QCAPS_RESP_FLAGS_FLOW_HND_16BIT_SUPPORTED                     0x1UL
+	#define CFA_ADV_FLOW_MGNT_QCAPS_RESP_FLAGS_FLOW_HND_64BIT_SUPPORTED                     0x2UL
+	#define CFA_ADV_FLOW_MGNT_QCAPS_RESP_FLAGS_FLOW_BATCH_DELETE_SUPPORTED                  0x4UL
+	#define CFA_ADV_FLOW_MGNT_QCAPS_RESP_FLAGS_FLOW_RESET_ALL_SUPPORTED                     0x8UL
+	#define CFA_ADV_FLOW_MGNT_QCAPS_RESP_FLAGS_NTUPLE_FLOW_DEST_FUNC_SUPPORTED              0x10UL
+	#define CFA_ADV_FLOW_MGNT_QCAPS_RESP_FLAGS_TX_EEM_FLOW_SUPPORTED                        0x20UL
+	#define CFA_ADV_FLOW_MGNT_QCAPS_RESP_FLAGS_RX_EEM_FLOW_SUPPORTED                        0x40UL
+	#define CFA_ADV_FLOW_MGNT_QCAPS_RESP_FLAGS_FLOW_COUNTER_ALLOC_SUPPORTED                 0x80UL
+	#define CFA_ADV_FLOW_MGNT_QCAPS_RESP_FLAGS_RFS_RING_TBL_IDX_SUPPORTED                   0x100UL
+	#define CFA_ADV_FLOW_MGNT_QCAPS_RESP_FLAGS_UNTAGGED_VLAN_SUPPORTED                      0x200UL
+	#define CFA_ADV_FLOW_MGNT_QCAPS_RESP_FLAGS_XDP_SUPPORTED                                0x400UL
+	#define CFA_ADV_FLOW_MGNT_QCAPS_RESP_FLAGS_L2_HEADER_SOURCE_FIELDS_SUPPORTED            0x800UL
+	#define CFA_ADV_FLOW_MGNT_QCAPS_RESP_FLAGS_NTUPLE_FLOW_RX_ARP_SUPPORTED                 0x1000UL
+	#define CFA_ADV_FLOW_MGNT_QCAPS_RESP_FLAGS_RFS_RING_TBL_IDX_V2_SUPPORTED                0x2000UL
+	#define CFA_ADV_FLOW_MGNT_QCAPS_RESP_FLAGS_NTUPLE_FLOW_RX_ETHERTYPE_IP_SUPPORTED        0x4000UL
+	#define CFA_ADV_FLOW_MGNT_QCAPS_RESP_FLAGS_TRUFLOW_CAPABLE                              0x8000UL
+	#define CFA_ADV_FLOW_MGNT_QCAPS_RESP_FLAGS_L2_FILTER_TRAFFIC_TYPE_L2_ROCE_SUPPORTED     0x10000UL
+	#define CFA_ADV_FLOW_MGNT_QCAPS_RESP_FLAGS_LAG_SUPPORTED                                0x20000UL
+	#define CFA_ADV_FLOW_MGNT_QCAPS_RESP_FLAGS_NTUPLE_FLOW_NO_L2CTX_SUPPORTED               0x40000UL
+	#define CFA_ADV_FLOW_MGNT_QCAPS_RESP_FLAGS_NIC_FLOW_STATS_SUPPORTED                     0x80000UL
+	#define CFA_ADV_FLOW_MGNT_QCAPS_RESP_FLAGS_NTUPLE_FLOW_RX_EXT_IP_PROTO_SUPPORTED        0x100000UL
+	#define CFA_ADV_FLOW_MGNT_QCAPS_RESP_FLAGS_RFS_RING_TBL_IDX_V3_SUPPORTED                0x200000UL
+	u8	unused_0[3];
+	u8	valid;
+};
+
 /* hwrm_tunnel_dst_port_alloc_input (size:192b/24B) */
 struct hwrm_tunnel_dst_port_alloc_input {
 	__le16	req_type;
diff --git a/include/linux/dibs.h b/include/linux/dibs.h
index d3e0777f25ae..0c10c224bcca 100644
--- a/include/linux/dibs.h
+++ b/include/linux/dibs.h
@@ -261,12 +261,12 @@ struct dibs_dev_ops {
 	 *	@vlan_id: deprecated, ignored if device does not support vlan
 	 * Upon return in addition the following fields will be valid:
 	 *	@dmb_tok: for usage by remote and local devices and clients
-	 *	@cpu_addr: allocated buffer
+	 *	@cpu_addr: allocated, zerorized buffer
 	 *	@idx: dmb index, unique per dibs device
 	 *	@dma_addr: to be used by device driver,if applicable
 	 *
-	 * Allocate a dmb buffer and register it with this device and for this
-	 * client.
+	 * Allocate and zerorize a dmb buffer and register it with this device
+	 * and for this client.
 	 * Return: zero on success
 	 */
 	int (*register_dmb)(struct dibs_dev *dev, struct dibs_dmb *dmb,
diff --git a/include/linux/ethtool.h b/include/linux/ethtool.h
index c4c9ce038611..c3a41fbd5426 100644
--- a/include/linux/ethtool.h
+++ b/include/linux/ethtool.h
@@ -1025,7 +1025,9 @@ struct kernel_ethtool_ts_info {
  *	types should be set in @supported_coalesce_params.
  *	Returns a negative error code or zero.
  * @get_ringparam: Report ring sizes
- * @set_ringparam: Set ring sizes.  Returns a negative error code or zero.
+ * @set_ringparam: Set ring sizes. The &struct ethtool_ringparam argument is
+ *	also an output; drivers which normalize requested sizes must update it
+ *	with the applied sizes. Returns a negative error code or zero.
  * @get_pause_stats: Report pause frame statistics. Drivers must not zero
  *	statistics which they don't report. The stats structure is initialized
  *	to ETHTOOL_STAT_NOT_SET indicating driver does not report statistics.
diff --git a/include/linux/ieee80211-eht.h b/include/linux/ieee80211-eht.h
index b62297a978e7..a699d108eee6 100644
--- a/include/linux/ieee80211-eht.h
+++ b/include/linux/ieee80211-eht.h
@@ -482,6 +482,7 @@ struct ieee80211_multi_link_elem {
 #define IEEE80211_MLC_BASIC_PRES_MLD_ID			0x0200
 #define IEEE80211_MLC_BASIC_PRES_EXT_MLD_CAPA_OP	0x0400
 #define IEEE80211_MLC_BASIC_PRES_ENH_CRIT_UPD		0x0800
+#define IEEE80211_MLC_BASIC_PRES_AGE_OF_BSS_LOAD	0x1000
 
 #define IEEE80211_MED_SYNC_DELAY_DURATION		0x00ff
 #define IEEE80211_MED_SYNC_DELAY_SYNC_OFDM_ED_THRESH	0x0f00
@@ -550,6 +551,8 @@ struct ieee80211_mle_basic_common_info {
 } __packed;
 
 #define IEEE80211_MLC_PREQ_PRES_MLD_ID			0x0010
+#define IEEE80211_MLC_PREQ_PRES_MLD_MAC_ADDR		0x0020
+#define IEEE80211_MLC_PREQ_PRES_NEIGH_AP_MLD_MAC_ADDR	0x0040
 
 struct ieee80211_mle_preq_common_info {
 	u8 len;
@@ -560,6 +563,7 @@ struct ieee80211_mle_preq_common_info {
 #define IEEE80211_MLC_RECONF_PRES_EML_CAPA		0x0020
 #define IEEE80211_MLC_RECONF_PRES_MLD_CAPA_OP		0x0040
 #define IEEE80211_MLC_RECONF_PRES_EXT_MLD_CAPA_OP	0x0080
+#define IEEE80211_MLC_RECONF_PRES_TARGET_AP_MLD_ADDR	0x0100
 
 /* no fixed fields in RECONF */
 
@@ -766,7 +770,7 @@ static inline u16 ieee80211_mle_get_mld_capa_op(const u8 *data)
 #define IEEE80211_EHT_ML_EXT_MLD_CAPA_NSTR_UPDATE		0x0020
 #define IEEE80211_EHT_ML_EXT_MLD_CAPA_EMLSR_ENA_ON_ONE_LINK	0x0040
 #define IEEE80211_EHT_ML_EXT_MLD_CAPA_BTM_MLD_RECO_MULTI_AP	0x0080
-/* defined by UHR Draft P802.11bn_D1.3 Figure 9-1147 */
+/* defined by UHR Draft P802.11bn_D1.5 Figure 9-1168 */
 #define IEEE80211_UHR_ML_EXT_MLD_CAPA_ML_PM			0x0100
 
 /**
@@ -928,11 +932,17 @@ static inline bool ieee80211_mle_size_ok(const u8 *data, size_t len)
 			common += 2;
 		if (control & IEEE80211_MLC_BASIC_PRES_ENH_CRIT_UPD)
 			common += 1;
+		if (control & IEEE80211_MLC_BASIC_PRES_AGE_OF_BSS_LOAD)
+			common += 1;
 		break;
 	case IEEE80211_ML_CONTROL_TYPE_PREQ:
 		common += sizeof(struct ieee80211_mle_preq_common_info);
 		if (control & IEEE80211_MLC_PREQ_PRES_MLD_ID)
 			common += 1;
+		if (control & IEEE80211_MLC_PREQ_PRES_MLD_MAC_ADDR)
+			common += ETH_ALEN;
+		if (control & IEEE80211_MLC_PREQ_PRES_NEIGH_AP_MLD_MAC_ADDR)
+			common += ETH_ALEN;
 		break;
 	case IEEE80211_ML_CONTROL_TYPE_RECONF:
 		common += 1;
@@ -944,6 +954,8 @@ static inline bool ieee80211_mle_size_ok(const u8 *data, size_t len)
 			common += 2;
 		if (control & IEEE80211_MLC_RECONF_PRES_EXT_MLD_CAPA_OP)
 			common += 2;
+		if (control & IEEE80211_MLC_RECONF_PRES_TARGET_AP_MLD_ADDR)
+			common += ETH_ALEN;
 		break;
 	case IEEE80211_ML_CONTROL_TYPE_TDLS:
 		common += sizeof(struct ieee80211_mle_tdls_common_info);
@@ -1003,6 +1015,7 @@ enum ieee80211_mle_subelems {
 #define IEEE80211_MLE_STA_CONTROL_BSS_PARAM_CHANGE_CNT_PRESENT	0x0800
 #define IEEE80211_MLE_STA_CONTROL_ENH_CRIT_UPD_PRESENT		0x1000
 #define IEEE80211_MLE_STA_CONTROL_AP_CONDUCTED_TX_PWR_PRESENT	0x2000
+#define IEEE80211_MLE_STA_CONTROL_AGE_OF_BSS_LOAD_PRESENT	0x4000
 
 struct ieee80211_mle_per_sta_profile {
 	__le16 control;
@@ -1054,6 +1067,9 @@ static inline bool ieee80211_mle_basic_sta_prof_size_ok(const u8 *data,
 	if (control & IEEE80211_MLE_STA_CONTROL_AP_CONDUCTED_TX_PWR_PRESENT)
 		info_len += 1;
 
+	if (control & IEEE80211_MLE_STA_CONTROL_AGE_OF_BSS_LOAD_PRESENT)
+		info_len += 1;
+
 	return prof->sta_info_len >= info_len &&
 	       fixed + prof->sta_info_len - 1 <= len;
 }
diff --git a/include/linux/ieee80211-nan.h b/include/linux/ieee80211-nan.h
index 455033955e54..7815a6cf8160 100644
--- a/include/linux/ieee80211-nan.h
+++ b/include/linux/ieee80211-nan.h
@@ -40,6 +40,8 @@
 /* NAN attributes, as defined in Wi-Fi Aware (TM) specification 4.0 Table 42 */
 #define NAN_ATTR_MASTER_INDICATION		0x00
 #define NAN_ATTR_CLUSTER_INFO			0x01
+#define NAN_ATTR_SERVICE_ID_LIST		0x02
+#define NAN_ATTR_SUBSCRIBE_SERVICE_ID_LIST	0x28
 
 struct ieee80211_nan_attr {
 	u8 attr;
@@ -74,4 +76,30 @@ struct ieee80211_nan_anchor_master_info {
 	     _attr = (const struct ieee80211_nan_attr *)		\
 		(_attr->data + le16_to_cpu(_attr->length)))
 
+static inline bool ieee80211_is_nan_beacon(const struct ieee80211_mgmt *mgmt,
+					   size_t len)
+{
+	const struct element *elem;
+
+	/* The NAN IE is at least 6 octets */
+	if (len < offsetofend(struct ieee80211_mgmt, u.beacon) + 6)
+		return false;
+
+	if (!ieee80211_is_beacon(mgmt->frame_control))
+		return false;
+
+	/* NAN Cluster IDs range from 50-6F-9A-01-00-00 to 50-6F-9A-01-FF-FF */
+	if (get_unaligned_be32(mgmt->bssid) != ((WLAN_OUI_WFA << 8) | 0x01))
+		return false;
+
+	elem = (const struct element *)mgmt->u.beacon.variable;
+	if (elem->id != WLAN_EID_VENDOR_SPECIFIC ||
+	    elem->datalen < 4 ||
+	    get_unaligned_be32(elem->data) !=
+	    (WLAN_OUI_WFA << 8 | WLAN_OUI_TYPE_WFA_NAN))
+		return false;
+
+	return true;
+}
+
 #endif /* LINUX_IEEE80211_NAN_H */
diff --git a/include/linux/ieee80211-uhr.h b/include/linux/ieee80211-uhr.h
index 665d4b3a5b41..19e9260d0db8 100644
--- a/include/linux/ieee80211-uhr.h
+++ b/include/linux/ieee80211-uhr.h
@@ -17,32 +17,32 @@
 #define IEEE80211_UHR_OPER_PARAMS_PEDCA_ENA		0x0004
 #define IEEE80211_UHR_OPER_PARAMS_DBE_ENA		0x0008
 #define IEEE80211_UHR_OPER_PARAMS_DBE_BW		0x0070
-#define IEEE80211_UHR_OPER_PARAMS_DUO_PRES		0x0080
-#define IEEE80211_UHR_OPER_PARAMS_DPS_PRES		0x0100
-#define IEEE80211_UHR_OPER_PARAMS_NPCA_PRES		0x0200
-#define IEEE80211_UHR_OPER_PARAMS_PEDCA_PRES		0x0400
-#define IEEE80211_UHR_OPER_PARAMS_DBE_PRES		0x0800
+#define IEEE80211_UHR_OPER_PARAMS_ELR_RX		0x0080
+#define IEEE80211_UHR_OPER_PARAMS_DUO_PRES		0x0100
+#define IEEE80211_UHR_OPER_PARAMS_DPS_PRES		0x0200
+#define IEEE80211_UHR_OPER_PARAMS_NPCA_PRES		0x0400
+#define IEEE80211_UHR_OPER_PARAMS_PEDCA_PRES		0x0800
+#define IEEE80211_UHR_OPER_PARAMS_DBE_PRES		0x1000
 
 struct ieee80211_uhr_operation {
 	__le16 params;
-	u8 basic_mcs_nss_set[4];
 	u8 variable[];
 } __packed;
 
-#define IEEE80211_UHR_NPCA_PARAMS_PRIMARY_CHAN_OFFS	0x0000000F
-#define IEEE80211_UHR_NPCA_PARAMS_MIN_DUR_THRESH	0x000000F0
-#define IEEE80211_UHR_NPCA_PARAMS_SWITCH_DELAY		0x00003F00
-#define IEEE80211_UHR_NPCA_PARAMS_SWITCH_BACK_DELAY	0x000FC000
-#define IEEE80211_UHR_NPCA_PARAMS_INIT_QSRC		0x00300000
-#define IEEE80211_UHR_NPCA_PARAMS_MOPLEN		0x00400000
-#define IEEE80211_UHR_NPCA_PARAMS_DIS_SUBCH_BMAP_PRES	0x00800000
+#define IEEE80211_UHR_NPCA_PARAMS_PRIMARY_CHAN		0x000000FF
+#define IEEE80211_UHR_NPCA_PARAMS_MIN_DUR_THRESH	0x00000F00
+#define IEEE80211_UHR_NPCA_PARAMS_SWITCH_DELAY		0x0003F000
+#define IEEE80211_UHR_NPCA_PARAMS_SWITCH_BACK_DELAY	0x00FC0000
+#define IEEE80211_UHR_NPCA_PARAMS_INIT_QSRC		0x03000000
+#define IEEE80211_UHR_NPCA_PARAMS_MOPLEN		0x04000000
+#define IEEE80211_UHR_NPCA_PARAMS_DIS_SUBCH_BMAP_PRES	0x08000000
 
 /**
  * struct ieee80211_uhr_npca_info - npca operation information
  *
  * This structure is the "NPCA Operation Parameters field format" of "UHR
- * Operation Element" fields as described in P802.11bn_D1.3
- * subclause 9.4.2.353. See Figure 9-aa4.
+ * Operation Element" fields as described in P802.11bn_D1.5
+ * subclause 9.4.2.355.2, see Figure 9-aa6.
  *
  * Refer to IEEE80211_UHR_NPCA*
  * @params:
@@ -97,7 +97,7 @@ struct ieee80211_uhr_npca_info {
  * struct ieee80211_uhr_dps_info - DPS operation information
  *
  * This structure is the "DPS Operation Parameter field" of "UHR
- * Operation Element" fields as described in P802.11bn_D1.3
+ * Operation Element" fields as described in P802.11bn_D1.5
  * subclause 9.4.1.87. See Figure 9-207u.
  *
  * Refer to IEEE80211_UHR_DPS*
@@ -211,8 +211,8 @@ static inline int ieee80211_uhr_dbe_bw_mhz(enum ieee80211_uhr_dbe_oper_bw bw)
  * struct ieee80211_uhr_dbe_info - DBE operation information
  *
  * This structure is the "DBE Operation Parameters field" of
- * "UHR Operation Element" fields as described in P802.11bn_D1.3
- * subclause 9.4.2.353. See Figure 9-aa6.
+ * "UHR Operation Element" fields as described in P802.11bn_D1.5
+ * subclause 9.4.2.355.4, see Figure 9-aa9.
  *
  * Refer to IEEE80211_UHR_DBE_OPER*
  * @params:
@@ -234,25 +234,23 @@ struct ieee80211_uhr_dbe_info {
 	__le16 dis_subch_bmap[];
 } __packed;
 
-#define IEEE80211_UHR_P_EDCA_ECWMIN		0x0F
-#define IEEE80211_UHR_P_EDCA_ECWMAX		0xF0
-#define IEEE80211_UHR_P_EDCA_AIFSN		0x000F
-#define IEEE80211_UHR_P_EDCA_CW_DS		0x0030
-#define IEEE80211_UHR_P_EDCA_PSRC_THRESHOLD	0x01C0
-#define IEEE80211_UHR_P_EDCA_QSRC_THRESHOLD	0x0600
+#define IEEE80211_UHR_P_EDCA_ECWMIN		0x0007
+#define IEEE80211_UHR_P_EDCA_ECWMAX		0x0038
+#define IEEE80211_UHR_P_EDCA_AIFSN		0x01C0
+#define IEEE80211_UHR_P_EDCA_CW_DS		0x0600
+#define IEEE80211_UHR_P_EDCA_PSRC_THRESHOLD	0x3800
+#define IEEE80211_UHR_P_EDCA_QSRC_THRESHOLD	0xC000
 
 /**
  * struct ieee80211_uhr_p_edca_info - P-EDCA operation information
  *
  * This structure is the "P-EDCA Operation Parameters field" of
- * "UHR Operation Element" fields as described in P802.11bn_D1.3
- * subclause 9.4.2.353. See Figure 9-aa5.
+ * "UHR Operation Element" fields as described in P802.11bn_D1.5
+ * subclause 9.4.2.355.3, see Figure 9-aa8.
  *
  * Refer to IEEE80211_UHR_P_EDCA*
- * @p_edca_ec: P-EDCA ECWmin and ECWmax.
- *	These fields indicate the CWmin and CWmax values used by a
- *	P-EDCA STA during P-EDCA contention.
- * @params: AIFSN, CW DS, PSRC threshold, and QSRC threshold.
+ * @params: ECWmin, ECWmax, AIFSN, CW DS, PSRC threshold, and QSRC threshold.
+ *	- CWmin/CWmax values used by a P-EDCA STA during P-EDCA contention.
  *	- The AIFSN field indicates the AIFSN value used by a P-EDCA STA
  *	  during P-EDCA contention.
  *	- The CW DS field indicates the value used for randomization of the
@@ -266,7 +264,6 @@ struct ieee80211_uhr_dbe_info {
  *	  value 0 is reserved.
  */
 struct ieee80211_uhr_p_edca_info {
-	u8 p_edca_ec;
 	__le16 params;
 } __packed;
 
@@ -302,7 +299,7 @@ static inline bool ieee80211_uhr_oper_size_ok(const u8 *data, u8 len)
 		}
 	}
 
-	/* P-EDCA Operation Parameters (fixed 3 bytes) */
+	/* P-EDCA Operation Parameters */
 	if (oper->params & cpu_to_le16(IEEE80211_UHR_OPER_PARAMS_PEDCA_PRES)) {
 		needed += sizeof(struct ieee80211_uhr_p_edca_info);
 		if (len < needed)
@@ -341,6 +338,9 @@ ieee80211_uhr_npca_info(const struct ieee80211_uhr_operation *oper)
 	if (!(oper->params & cpu_to_le16(IEEE80211_UHR_OPER_PARAMS_NPCA_ENA)))
 		return NULL;
 
+	if (oper->params & cpu_to_le16(IEEE80211_UHR_OPER_PARAMS_DUO_PRES))
+		pos += 1;
+
 	if (oper->params & cpu_to_le16(IEEE80211_UHR_OPER_PARAMS_DPS_PRES))
 		pos += sizeof(struct ieee80211_uhr_dps_info);
 
@@ -372,6 +372,9 @@ ieee80211_uhr_oper_dbe_info(const struct ieee80211_uhr_operation *oper)
 	if (!(oper->params & cpu_to_le16(IEEE80211_UHR_OPER_PARAMS_DBE_ENA)))
 		return NULL;
 
+	if (oper->params & cpu_to_le16(IEEE80211_UHR_OPER_PARAMS_DUO_PRES))
+		pos += 1;
+
 	if (oper->params & cpu_to_le16(IEEE80211_UHR_OPER_PARAMS_DPS_PRES))
 		pos += sizeof(struct ieee80211_uhr_dps_info);
 
@@ -415,28 +418,42 @@ ieee80211_uhr_oper_dbe_info(const struct ieee80211_uhr_operation *oper)
 #define IEEE80211_UHR_MAC_CAP2_UHR_OM_PU_TO_LOW		0xC0
 
 #define IEEE80211_UHR_MAC_CAP3_UHR_OM_PU_TO_HIGH	0x03
-#define IEEE80211_UHR_MAC_CAP3_PARAM_UPD_ADV_NOTIF_INTV	0x1C
-#define IEEE80211_UHR_MAC_CAP3_UPD_IND_TIM_INTV_LOW	0xE0
+#define IEEE80211_UHR_MAC_CAP3_PARAM_UPD_ADV_NOTIF_INTV	0x7C
+#define IEEE80211_UHR_MAC_CAP3_UPD_IND_TIM_INTV_LOW	0x80
 
-#define IEEE80211_UHR_MAC_CAP4_UPD_IND_TIM_INTV_HIGH	0x03
-#define IEEE80211_UHR_MAC_CAP4_BOUNDED_ESS		0x04
-#define IEEE80211_UHR_MAC_CAP4_BTM_ASSURANCE		0x08
-#define IEEE80211_UHR_MAC_CAP4_CO_BF_SUPP		0x10
+#define IEEE80211_UHR_MAC_CAP4_UPD_IND_TIM_INTV_HIGH	0x0F
+#define IEEE80211_UHR_MAC_CAP4_BOUNDED_ESS		0x10
+#define IEEE80211_UHR_MAC_CAP4_BTM_ASSURANCE		0x20
+#define IEEE80211_UHR_MAC_CAP4_CO_BF_SUPP		0x40
+#define IEEE80211_UHR_MAC_CAP4_CO_SR_SUPP		0x80
+
+#define IEEE80211_UHR_MAC_CAP5_MAPC_ENH_MSRMT_SUPP	0x01
 
 #define IEEE80211_UHR_MAC_CAP_DBE_MAX_BW		0x07
 #define IEEE80211_UHR_MAC_CAP_DBE_EHT_MCS_MAP_160_PRES	0x08
 #define IEEE80211_UHR_MAC_CAP_DBE_EHT_MCS_MAP_320_PRES	0x10
 
+/* struct ieee80211_uhr_cap_dbe::bwcap[].cap */
+#define IEEE80211_UHR_MAC_CAP_DBE_CAP_NUM_SND_DIMS		0x07
+#define IEEE80211_UHR_MAC_CAP_DBE_CAP_NON_OFDMA_UL_MUMIMO	0x08
+#define IEEE80211_UHR_MAC_CAP_DBE_CAP_MU_BEAMFORMER		0x10
+#define IEEE80211_UHR_MAC_CAP_DBE_CAP_BEAMFORMEE_SS		0xe0
+
 struct ieee80211_uhr_cap_dbe {
 	u8 cap;
+	u8 max_switch_time_period;
+	u8 mode_change_intvl;
 	/* present 0, 1 or 2 times depending on _PRES bits */
-	struct ieee80211_eht_mcs_nss_supp_bw eht_mcs_map[];
+	struct {
+		struct ieee80211_eht_mcs_nss_supp_bw eht_mcs_map;
+		u8 cap;
+	} __packed bwcap[];
 } __packed;
 
 /**
  * enum ieee80211_uhr_dbe_max_supported_bw - DBE Maximum Supported Bandwidth
  *
- * As per spec P802.11bn_D1.3 "Table 9-bb5—Encoding of the DBE Maximum
+ * As per spec P802.11bn_D1.5 Table 9-bb8 "Encoding of the DBE Maximum
  * Supported Bandwidth field".
  *
  * @IEEE80211_UHR_DBE_MAX_BW_40: Indicates 40 MHz DBE max supported bw
@@ -520,10 +537,10 @@ static inline bool ieee80211_uhr_capa_size_ok(const u8 *data, u8 len,
 		dbe = (const void *)cap->variable;
 
 		if (dbe->cap & IEEE80211_UHR_MAC_CAP_DBE_EHT_MCS_MAP_160_PRES)
-			needed += sizeof(dbe->eht_mcs_map[0]);
+			needed += sizeof(dbe->bwcap[0]);
 
 		if (dbe->cap & IEEE80211_UHR_MAC_CAP_DBE_EHT_MCS_MAP_320_PRES)
-			needed += sizeof(dbe->eht_mcs_map[0]);
+			needed += sizeof(dbe->bwcap[0]);
 	}
 
 	return len >= needed;
diff --git a/include/linux/ieee80211.h b/include/linux/ieee80211.h
index 26e674038865..66f9ebe79c61 100644
--- a/include/linux/ieee80211.h
+++ b/include/linux/ieee80211.h
@@ -1828,6 +1828,7 @@ enum ieee80211_eid_ext {
 	WLAN_EID_EXT_BANDWIDTH_INDICATION = 135,
 	WLAN_EID_EXT_KNOWN_STA_IDENTIFCATION = 136,
 	WLAN_EID_EXT_NON_AP_STA_REG_CON = 137,
+	WLAN_EID_EXT_CIP_CAPA = 150,
 	WLAN_EID_EXT_UHR_OPER = 151,
 	WLAN_EID_EXT_UHR_CAPA = 152,
 	WLAN_EID_EXT_MACP = 153,
@@ -2421,8 +2422,7 @@ static inline bool ieee80211_is_bufferable_mmpdu(struct sk_buff *skb)
 
 	/* action frame - additionally check for non-bufferable FTM */
 
-	if (mgmt->u.action.category != WLAN_CATEGORY_PUBLIC &&
-	    mgmt->u.action.category != WLAN_CATEGORY_PROTECTED_DUAL_OF_ACTION)
+	if (mgmt->u.action.category != WLAN_CATEGORY_PUBLIC)
 		return true;
 
 	if (mgmt->u.action.action_code == WLAN_PUB_ACTION_FTM_REQUEST ||
@@ -2730,6 +2730,10 @@ struct element {
 	u8 data[];
 } __packed;
 
+/* trigger enum comparison warnings if applicable (constant id) */
+#define element_iteration_typecheck(type, id)				\
+	(((type)0 == (id)) || true)
+
 /* element iteration helpers */
 #define for_each_element(_elem, _data, _datalen)			\
 	for (_elem = (const struct element *)(_data);			\
@@ -2741,11 +2745,15 @@ struct element {
 
 #define for_each_element_id(element, _id, data, datalen)		\
 	for_each_element(element, data, datalen)			\
-		if (element->id == (_id))
+		if (element_iteration_typecheck(enum ieee80211_eid,	\
+						_id) &&			\
+		    element->id == (_id))
 
 #define for_each_element_extid(element, extid, _data, _datalen)		\
 	for_each_element(element, _data, _datalen)			\
-		if (element->id == WLAN_EID_EXTENSION &&		\
+		if (element_iteration_typecheck(enum ieee80211_eid_ext,	\
+						extid) &&		\
+		    element->id == WLAN_EID_EXTENSION &&		\
 		    element->datalen > 0 &&				\
 		    element->data[0] == (extid))
 
@@ -2753,10 +2761,11 @@ struct element {
 	for_each_element(sub, (element)->data, (element)->datalen)
 
 #define for_each_subelement_id(sub, id, element)			\
-	for_each_element_id(sub, id, (element)->data, (element)->datalen)
+	for_each_element_id(sub, (u8)id, (element)->data, (element)->datalen)
 
 #define for_each_subelement_extid(sub, extid, element)			\
-	for_each_element_extid(sub, extid, (element)->data, (element)->datalen)
+	for_each_element_extid(sub, (u8)extid, (element)->data,		\
+			       (element)->datalen)
 
 /**
  * for_each_element_completed - determine if element parsing consumed all data
@@ -2900,4 +2909,25 @@ static inline bool ieee80211_check_tim(const struct ieee80211_tim_ie *tim,
 		     __ieee80211_check_tim(tim, tim_len, aid);
 }
 
+/**
+ * enum ieee80211_cip_cap_fields - CIP Capabilities element fields
+ * @IEEE80211_CIP_CAP_MIC_PADDING: The MIC padding subfield in the CIP
+ *	capabilities
+ * @IEEE80211_CIP_CAP_PROTECTED_CTRL_FRAME_ONLY: The MIC Padding For Protected
+ *	Control Frames Only bit in CIP capabilities
+ */
+enum ieee80211_cip_cap_fields {
+	IEEE80211_CIP_CAP_MIC_PADDING			= 0x0F,
+	IEEE80211_CIP_CAP_PROTECTED_CTRL_FRAME_ONLY	= 0x10,
+};
+
+/**
+ * struct ieee80211_cip_cap - CIP Capabilities element
+ *
+ * @v: The value of the Control Integrity Protocol Capability element
+ */
+struct ieee80211_cip_cap {
+	u8 v;
+} __packed;
+
 #endif /* LINUX_IEEE80211_H */
diff --git a/include/linux/if_vlan.h b/include/linux/if_vlan.h
index 4846032bf4ff..975892367136 100644
--- a/include/linux/if_vlan.h
+++ b/include/linux/if_vlan.h
@@ -698,7 +698,6 @@ static inline void vlan_set_encap_proto(struct sk_buff *skb,
 					struct vlan_hdr *vhdr)
 {
 	__be16 proto;
-	unsigned short *rawp;
 
 	/*
 	 * Was a VLAN packet, grab the encapsulated protocol, which the layer
@@ -711,21 +710,8 @@ static inline void vlan_set_encap_proto(struct sk_buff *skb,
 		return;
 	}
 
-	rawp = (unsigned short *)(vhdr + 1);
-	if (*rawp == 0xFFFF)
-		/*
-		 * This is a magic hack to spot IPX packets. Older Novell
-		 * breaks the protocol design and runs IPX over 802.3 without
-		 * an 802.2 LLC layer. We look for FFFF which isn't a used
-		 * 802.2 SSAP/DSAP. This won't work for fault tolerant netware
-		 * but does for the rest.
-		 */
-		skb->protocol = htons(ETH_P_802_3);
-	else
-		/*
-		 * Real 802.2 LLC
-		 */
-		skb->protocol = htons(ETH_P_802_2);
+	/* No ethertype: this is an 802.2 LLC frame (length field). */
+	skb->protocol = htons(ETH_P_802_2);
 }
 
 /**
diff --git a/include/linux/igmp.h b/include/linux/igmp.h
index a0cf0398519f..e075611344ef 100644
--- a/include/linux/igmp.h
+++ b/include/linux/igmp.h
@@ -14,6 +14,7 @@
 #include <linux/timer.h>
 #include <linux/in.h>
 #include <linux/ip.h>
+#include <linux/net.h>
 #include <linux/refcount.h>
 #include <linux/sockptr.h>
 #include <uapi/linux/igmp.h>
@@ -273,7 +274,7 @@ extern int ip_mc_source(int add, int omode, struct sock *sk,
 		struct ip_mreq_source *mreqs, int ifindex);
 extern int ip_mc_msfilter(struct sock *sk, struct ip_msfilter *msf,int ifindex);
 extern int ip_mc_msfget(struct sock *sk, struct ip_msfilter *msf,
-			sockptr_t optval, sockptr_t optlen);
+			sockopt_t *opt);
 extern int ip_mc_gsfget(struct sock *sk, struct group_filter *gsf,
 			sockptr_t optval, size_t offset);
 extern int ip_mc_sf_allow(const struct sock *sk, __be32 local, __be32 rmt,
diff --git a/include/linux/llc.h b/include/linux/llc.h
index 944e9e213112..c03bb12bcc9c 100644
--- a/include/linux/llc.h
+++ b/include/linux/llc.h
@@ -9,9 +9,4 @@
 
 #include <uapi/linux/llc.h>
 
-#define LLC_SAP_DYN_START	0xC0
-#define LLC_SAP_DYN_STOP	0xDE
-#define LLC_SAP_DYN_TRIES	4
-
-#define llc_ui_skb_cb(__skb) ((struct sockaddr_llc *)&((__skb)->cb[0]))
 #endif /* __LINUX_LLC_H */
diff --git a/include/linux/mdio-mux.h b/include/linux/mdio-mux.h
index a5d58f221939..e2af9cb8e017 100644
--- a/include/linux/mdio-mux.h
+++ b/include/linux/mdio-mux.h
@@ -1,5 +1,5 @@
 /*
- * MDIO bus multiplexer framwork.
+ * MDIO bus multiplexer framework.
  *
  * This file is subject to the terms and conditions of the GNU General Public
  * License.  See the file "COPYING" in the main directory of this archive
diff --git a/include/linux/mlx5/eswitch.h b/include/linux/mlx5/eswitch.h
index a0dd162baa78..03d3620141c8 100644
--- a/include/linux/mlx5/eswitch.h
+++ b/include/linux/mlx5/eswitch.h
@@ -222,6 +222,9 @@ static inline bool is_mdev_switchdev_mode(struct mlx5_core_dev *dev)
 /* The returned number is valid only when the dev is eswitch manager. */
 static inline u16 mlx5_eswitch_manager_vport(struct mlx5_core_dev *dev)
 {
+	if (MLX5_CAP_ESW(dev, esw_manager_vport_number_valid))
+		return MLX5_CAP_ESW(dev, esw_manager_vport_number);
+
 	return mlx5_core_is_ecpf_esw_manager(dev) ?
 		MLX5_VPORT_ECPF : MLX5_VPORT_HOST_PF;
 }
diff --git a/include/linux/mmc/sdio_ids.h b/include/linux/mmc/sdio_ids.h
index afae93f6f245..dfffda3d8002 100644
--- a/include/linux/mmc/sdio_ids.h
+++ b/include/linux/mmc/sdio_ids.h
@@ -123,6 +123,8 @@
 #define SDIO_VENDOR_ID_NXP			0x0471
 #define SDIO_DEVICE_ID_NXP_IW61X_BASE		0x0204
 #define SDIO_DEVICE_ID_NXP_IW61X		0x0205
+#define SDIO_DEVICE_ID_NXP_IW610_BASE		0x0214
+#define SDIO_DEVICE_ID_NXP_IW610		0x0215
 
 #define SDIO_VENDOR_ID_REALTEK			0x024c
 #define SDIO_DEVICE_ID_REALTEK_RTW8723BS	0xb723
diff --git a/include/linux/net.h b/include/linux/net.h
index 3d82966e2243..e2a866fbcfa5 100644
--- a/include/linux/net.h
+++ b/include/linux/net.h
@@ -47,6 +47,9 @@ typedef struct sockopt {
 	int optlen;
 } sockopt_t;
 
+int sockptr_to_sockopt(sockopt_t *opt, sockptr_t optval, sockptr_t optlen,
+		       struct kvec *kvec);
+
 /*
  * Initialize a user-backed sockopt_t from the (optval, optlen) __user pair of
  * a getsockopt() callback. Used by transitional __user getsockopt wrappers
@@ -70,6 +73,35 @@ static inline int sockopt_init_user(sockopt_t *opt, char __user *optval,
 	return 0;
 }
 
+/*
+ * Grow optval to @size, for the options whose reply is sized by a count the
+ * caller left in optval rather than by optlen. Those write past optlen today
+ * and userspace relies on it.
+ *
+ * Call it before writing through opt->iter_out: it re-anchors the iterator at
+ * the head of optval. Only a user buffer can be longer than the optlen the
+ * caller declared, so a kernel-backed optval is refused with -EINVAL.
+ */
+static inline int sockopt_expand_out(sockopt_t *opt, size_t size)
+{
+	if (size <= (size_t)opt->optlen)
+		return 0;
+
+	if (size > INT_MAX)
+		return -EINVAL;
+
+	/* Re-anchoring reads iter_out.ubuf, so the iterator has to be a user
+	 * buffer that nothing has written through yet.
+	 */
+	if (WARN_ON_ONCE(!iter_is_ubuf(&opt->iter_out) ||
+			 iov_iter_count(&opt->iter_out) != (size_t)opt->optlen))
+		return -EINVAL;
+
+	iov_iter_ubuf(&opt->iter_out, ITER_DEST, opt->iter_out.ubuf, size);
+
+	return 0;
+}
+
 struct poll_table_struct;
 struct pipe_inode_info;
 struct inode;
@@ -166,7 +198,7 @@ struct socket {
 
 	struct file		*file;
 	struct sock		*sk;
-	const struct proto_ops	*ops; /* Might change with IPV6_ADDRFORM or MPTCP. */
+	const struct proto_ops	*ops; /* Might change with MPTCP. */
 
 	struct socket_wq	wq;
 };
diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h
index 3cff2174dc03..8fbe3a5d8169 100644
--- a/include/linux/netdevice.h
+++ b/include/linux/netdevice.h
@@ -433,6 +433,7 @@ enum {
 	NAPI_STATE_SCHED_THREADED,	/* Napi is currently scheduled in threaded mode */
 	NAPI_STATE_HAS_NOTIFIER,	/* Napi has an IRQ notifier */
 	NAPI_STATE_THREADED_BUSY_POLL,	/* The threaded NAPI poller will busy poll */
+	NAPI_STATE_PERCPU,		/* NAPI handler is run per-CPU - incompatible with threaded mode */
 };
 
 enum {
@@ -448,6 +449,7 @@ enum {
 	NAPIF_STATE_SCHED_THREADED	= BIT(NAPI_STATE_SCHED_THREADED),
 	NAPIF_STATE_HAS_NOTIFIER	= BIT(NAPI_STATE_HAS_NOTIFIER),
 	NAPIF_STATE_THREADED_BUSY_POLL	= BIT(NAPI_STATE_THREADED_BUSY_POLL),
+	NAPIF_STATE_PERCPU		= BIT(NAPI_STATE_PERCPU),
 };
 
 enum gro_result {
@@ -1138,13 +1140,16 @@ struct netdev_net_notifier {
  *				struct netdev_hw_addr_list *uc,
  *				struct netdev_hw_addr_list *mc);
  *	Async version of ndo_set_rx_mode which runs in process context
- *	with rtnl_lock and netdev_lock_ops(dev) held. The uc/mc parameters
+ *	under the netdev instance lock for "ops locked" drivers, or
+ *	rtnl_lock for all other drivers. The uc/mc parameters
  *	are snapshots of the address lists - iterate with
  *	netdev_hw_addr_list_for_each(ha, uc). Return 0 on success or a
  *	negative errno to request a retry via the core backoff.
  *
  * void (*ndo_work)(struct net_device *dev, unsigned long events);
  *	Run deferred work scheduled with netdev_work_sched(@events).
+ *	Runs in process context under the netdev instance lock for "ops
+ *	locked" drivers, or rtnl_lock for all other drivers.
  *
  * int (*ndo_set_mac_address)(struct net_device *dev, void *addr);
  *	This function  is called when the Media Access Control address
@@ -1154,11 +1159,6 @@ struct netdev_net_notifier {
  * int (*ndo_validate_addr)(struct net_device *dev);
  *	Test if Media Access Control address is valid for the device.
  *
- * int (*ndo_do_ioctl)(struct net_device *dev, struct ifreq *ifr, int cmd);
- *	Old-style ioctl entry point. This is used internally by the
- *	ieee802154 subsystem but is no longer called by the device
- *	ioctl handler.
- *
  * int (*ndo_siocbond)(struct net_device *dev, struct ifreq *ifr, int cmd);
  *	Used by the bonding driver for its device specific ioctls:
  *	SIOCBONDENSLAVE, SIOCBONDRELEASE, SIOCBONDSETHWADDR, SIOCBONDCHANGEACTIVE,
@@ -1480,8 +1480,6 @@ struct net_device_ops {
 	int			(*ndo_set_mac_address)(struct net_device *dev,
 						       void *addr);
 	int			(*ndo_validate_addr)(struct net_device *dev);
-	int			(*ndo_do_ioctl)(struct net_device *dev,
-					        struct ifreq *ifr, int cmd);
 	int			(*ndo_eth_ioctl)(struct net_device *dev,
 						 struct ifreq *ifr, int cmd);
 	int			(*ndo_siocbond)(struct net_device *dev,
@@ -1840,6 +1838,7 @@ enum netdev_reg_state {
  *			drivers. Mainly used by logical interfaces, such as
  *			bonding and tunnels
  *	@netmem_tx:	device netmem TX mode
+ *	@pacing_offload: enable EDT pacing offload.
  *
  *	@name:	This is the first field of the "visible" part of this structure
  *		(i.e. as seen by users in the "Space.c" file).  It is the name
@@ -2170,6 +2169,7 @@ struct net_device {
 		unsigned long		priv_flags:32;
 		unsigned long		lltx:1;
 		unsigned long		netmem_tx:2;
+		unsigned long		pacing_offload:1;
 	);
 	const struct net_device_ops *netdev_ops;
 	const struct header_ops *header_ops;
@@ -3672,7 +3672,11 @@ struct page_pool_bh {
 };
 DECLARE_PER_CPU(struct page_pool_bh, system_page_pool);
 
+#ifdef CONFIG_KASAN
+#define XMIT_RECURSION_LIMIT	4
+#else
 #define XMIT_RECURSION_LIMIT	8
+#endif
 
 #ifndef CONFIG_PREEMPT_RT
 static inline int dev_recursion_level(void)
@@ -5324,7 +5328,6 @@ void netdev_lower_state_changed(struct net_device *lower_dev,
 				void *lower_state_info);
 
 #define NETDEV_RSS_KEY_LEN 256
-extern u8 netdev_rss_key[NETDEV_RSS_KEY_LEN] __read_mostly;
 void netdev_rss_key_fill(void *buffer, size_t len);
 
 int skb_checksum_help(struct sk_buff *skb);
@@ -5497,7 +5500,14 @@ void netif_stacked_transfer_operstate(const struct net_device *rootdev,
 netdev_features_t passthru_features_check(struct sk_buff *skb,
 					  struct net_device *dev,
 					  netdev_features_t features);
-netdev_features_t netif_skb_features(struct sk_buff *skb);
+netdev_features_t __netif_skb_features(struct sk_buff *skb,
+				       bool check_gso_limits);
+
+static inline netdev_features_t netif_skb_features(struct sk_buff *skb)
+{
+	return __netif_skb_features(skb, true);
+}
+
 void skb_warn_bad_offload(const struct sk_buff *skb);
 
 static inline bool net_gso_ok(netdev_features_t features, int gso_type)
@@ -5563,15 +5573,6 @@ netif_get_gro_max_size(const struct net_device *dev, const struct sk_buff *skb)
 	       READ_ONCE(dev->gro_ipv4_max_size);
 }
 
-static inline unsigned int
-netif_get_gso_max_size(const struct net_device *dev, const struct sk_buff *skb)
-{
-	/* pairs with WRITE_ONCE() in netif_set_gso(_ipv4)_max_size() */
-	return skb->protocol == htons(ETH_P_IPV6) ?
-	       READ_ONCE(dev->gso_max_size) :
-	       READ_ONCE(dev->gso_ipv4_max_size);
-}
-
 static inline bool netif_is_macsec(const struct net_device *dev)
 {
 	return dev->priv_flags & IFF_MACSEC;
@@ -5609,12 +5610,12 @@ static inline bool netif_has_l3_rx_handler(const struct net_device *dev)
 
 static inline bool netif_is_l3_master(const struct net_device *dev)
 {
-	return dev->priv_flags & IFF_L3MDEV_MASTER;
+	return IS_ENABLED(CONFIG_NET_VRF) && (dev->priv_flags & IFF_L3MDEV_MASTER);
 }
 
 static inline bool netif_is_l3_slave(const struct net_device *dev)
 {
-	return dev->priv_flags & IFF_L3MDEV_SLAVE;
+	return IS_ENABLED(CONFIG_NET_VRF) && (dev->priv_flags & IFF_L3MDEV_SLAVE);
 }
 
 static inline int dev_sdif(const struct net_device *dev)
@@ -5714,6 +5715,12 @@ static inline const char *netdev_name(const struct net_device *dev)
 	return dev->name;
 }
 
+/* Caller holds RTNL, netdev->lock or RCU */
+static inline bool netif_is_alive(const struct net_device *dev)
+{
+	return READ_ONCE(dev->reg_state) <= NETREG_REGISTERED;
+}
+
 static inline const char *netdev_reg_state(const struct net_device *dev)
 {
 	u8 reg_state = READ_ONCE(dev->reg_state);
diff --git a/include/linux/netpoll.h b/include/linux/netpoll.h
index 1c6b1eec5efd..ec0821a5b02d 100644
--- a/include/linux/netpoll.h
+++ b/include/linux/netpoll.h
@@ -16,11 +16,6 @@
 #include <linux/ip.h>
 #include <linux/udp.h>
 
-union inet_addr {
-	__be32		ip;
-	struct in6_addr	in6;
-};
-
 struct netpoll {
 	struct net_device *dev;
 	netdevice_tracker dev_tracker;
diff --git a/include/linux/phy.h b/include/linux/phy.h
index 5f8d65868e0f..7c5098a0dd6c 100644
--- a/include/linux/phy.h
+++ b/include/linux/phy.h
@@ -376,6 +376,24 @@ struct mii_bus {
 			 int regnum, u16 val);
 	/** @reset: Perform a reset of the bus */
 	int (*reset)(struct mii_bus *bus);
+	/**
+	 * @notify_phy_attach: Perform post-attach handling for MDIO bus
+	 * drivers. Optional and independent of @notify_phy_detach. Called
+	 * in phy_attach_direct() right before phy_resume(). Runs in process
+	 * context, may sleep and may be called with RTNL held. Must not
+	 * acquire or rely on RTNL. Returns 0 on success or negative errno
+	 * on failure. Must unwind its own state on error as attachment is
+	 * aborted.
+	 */
+	int (*notify_phy_attach)(struct phy_device *phydev);
+	/**
+	 * @notify_phy_detach: Perform pre-detach handling for MDIO bus
+	 * drivers. Optional and independent of @notify_phy_attach. Called
+	 * in phy_detach() right after phy_suspend(). Runs in process context,
+	 * may sleep and may be called with RTNL held. Must not acquire or
+	 * rely on RTNL.
+	 */
+	void (*notify_phy_detach)(struct phy_device *phydev);
 
 	/** @stats: Statistic counters per device on the bus */
 	struct mdio_bus_stats stats[PHY_MAX_ADDR];
@@ -1697,7 +1715,7 @@ static inline bool phy_can_wakeup(struct phy_device *phydev)
  * phy_may_wakeup() - indicate whether PHY has wakeup enabled
  * @phydev: The phy_device struct
  *
- * Returns: true/false depending on the PHY driver's device_set_wakeup_enabled()
+ * Returns: true/false depending on the PHY driver's device_set_wakeup_enable()
  * setting if using the driver model, otherwise the legacy determination.
  */
 bool phy_may_wakeup(struct phy_device *phydev);
@@ -2422,10 +2440,10 @@ int phy_get_mac_termination(struct phy_device *phydev, struct device *dev,
 void phy_resolve_pause(unsigned long *local_adv, unsigned long *partner_adv,
 		       bool *tx_pause, bool *rx_pause);
 
-int phy_register_fixup_for_id(const char *bus_id,
-			      int (*run)(struct phy_device *));
-int phy_register_fixup_for_uid(u32 phy_uid, u32 phy_uid_mask,
-			       int (*run)(struct phy_device *));
+void __init phy_register_fixup_for_id(const char *bus_id,
+				      int (*run)(struct phy_device *));
+void __init phy_register_fixup_for_uid(u32 phy_uid, u32 phy_uid_mask,
+				       int (*run)(struct phy_device *));
 
 int phy_eee_tx_clock_stop_capable(struct phy_device *phydev);
 int phy_eee_rx_clock_stop(struct phy_device *phydev, bool clk_stop_enable);
diff --git a/include/linux/phylink.h b/include/linux/phylink.h
index 1dda5c7ed5f1..3a88a69882a6 100644
--- a/include/linux/phylink.h
+++ b/include/linux/phylink.h
@@ -843,4 +843,6 @@ void phylink_replay_link_begin(struct phylink *pl);
 
 void phylink_replay_link_end(struct phylink *pl);
 
+void phylink_update_mac_pause_capabilities(struct phylink *pl, unsigned long mac_pause);
+
 #endif
diff --git a/include/linux/platform_data/microchip-ksz.h b/include/linux/platform_data/microchip-ksz.h
index 028781ad4059..411d5e164383 100644
--- a/include/linux/platform_data/microchip-ksz.h
+++ b/include/linux/platform_data/microchip-ksz.h
@@ -31,9 +31,11 @@ enum ksz_chip_id {
 	KSZ88X3_CHIP_ID = 0x8830,
 	KSZ8864_CHIP_ID = 0x8864,
 	KSZ8895_CHIP_ID = 0x8895,
+	KSZ8995XA_CHIP_ID = 0x8995,
 	KSZ9477_CHIP_ID = 0x00947700,
 	KSZ9896_CHIP_ID = 0x00989600,
 	KSZ9897_CHIP_ID = 0x00989700,
+	KSZ9897S_CHIP_ID = 0x00989701,
 	KSZ9893_CHIP_ID = 0x00989300,
 	KSZ9563_CHIP_ID = 0x00956300,
 	KSZ8567_CHIP_ID = 0x00856700,
diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h
index a3ff380d43f0..27ec1e38c828 100644
--- a/include/linux/skbuff.h
+++ b/include/linux/skbuff.h
@@ -3816,9 +3816,12 @@ static inline dma_addr_t __skb_frag_dma_map(struct device *dev,
 					    size_t offset, size_t size,
 					    enum dma_data_direction dir)
 {
+	dma_addr_t addr;
+
 	if (skb_frag_is_net_iov(frag)) {
-		return netmem_to_net_iov(frag->netmem)->desc.dma_addr +
-		       offset + frag->offset;
+		addr = netmem_dma_addr_decode(
+			netmem_get_dma_addr(frag->netmem));
+		return addr + offset + frag->offset;
 	}
 	return dma_map_page(dev, skb_frag_page(frag),
 			    skb_frag_off(frag) + offset, size, dir);
diff --git a/include/linux/soc/marvell/octeontx2/asm.h b/include/linux/soc/marvell/octeontx2/asm.h
index d683251a0b40..8b572d3d741c 100644
--- a/include/linux/soc/marvell/octeontx2/asm.h
+++ b/include/linux/soc/marvell/octeontx2/asm.h
@@ -17,7 +17,7 @@
 #define otx2_lmt_flush(ioaddr)                          \
 ({                                                      \
 	u64 result = 0;                                 \
-	__asm__ volatile(".cpu  generic+lse\n"          \
+	__asm__ volatile(".arch_extension lse\n"	\
 			 "ldeor xzr, %x[rf], [%[rs]]"   \
 			 : [rf]"=r" (result)            \
 			 : [rs]"r" (ioaddr));           \
@@ -30,7 +30,7 @@
  */
 #define cn10k_lmt_flush(val, addr)			\
 ({							\
-	__asm__ volatile(".cpu  generic+lse\n"		\
+	__asm__ volatile(".arch_extension lse\n"	\
 			 "steorl %x[rf],[%[rs]]"		\
 			 : [rf] "+r"(val)		\
 			 : [rs] "r"(addr));		\
@@ -40,7 +40,7 @@ static inline u64 otx2_atomic64_fetch_add(u64 incr, u64 *ptr)
 {
 	u64 result;
 
-	asm volatile (".cpu  generic+lse\n"
+	asm volatile (".arch_extension lse\n"
 		      "ldadda %x[i], %x[r], [%[b]]"
 		      : [r] "=r" (result), "+m" (*ptr)
 		      : [i] "r" (incr), [b] "r" (ptr)
diff --git a/include/linux/stmmac.h b/include/linux/stmmac.h
index 4430b967abde..00be2df63d22 100644
--- a/include/linux/stmmac.h
+++ b/include/linux/stmmac.h
@@ -242,6 +242,8 @@ struct plat_stmmacenet_data {
 	 * that phylink uses.
 	 */
 	phy_interface_t phy_interface;
+	bool has_internal_tx_delay;
+	bool has_internal_rx_delay;
 	struct stmmac_mdio_bus_data *mdio_bus_data;
 	struct device_node *phy_node;
 	struct device_node *mdio_node;
diff --git a/include/linux/tcp.h b/include/linux/tcp.h
index 6a8c77719322..e4d1720f49f0 100644
--- a/include/linux/tcp.h
+++ b/include/linux/tcp.h
@@ -269,6 +269,9 @@ struct tcp_sock {
 				 */
 	u32	snd_sml;	/* Last byte of the most recently transmitted small packet */
 	u8	chrono_type;	/* current chronograph type */
+	u8	tcp_nospace;	/* mirrors SOCK_NOSPACE, must be set whenever
+				 * SOCK_NOSPACE is set.
+				 */
 	u32	chrono_start;	/* Start time in jiffies of a TCP chrono */
 	u32	chrono_stat[3];	/* Time in jiffies for chrono_stat stats */
 	u32	write_seq;	/* Tail(+1) of data held in tcp send buffer */
diff --git a/include/linux/usb/rndis_host.h b/include/linux/usb/rndis_host.h
index 489cfb1d00f6..3eaf57a9b282 100644
--- a/include/linux/usb/rndis_host.h
+++ b/include/linux/usb/rndis_host.h
@@ -182,8 +182,9 @@ struct rndis_keepalive_c {	/* IN (optionally OUT) */
 #define FLAG_RNDIS_PHYM_WIRELESS	0x0002
 
 /* Flags for driver_info::data */
-#define RNDIS_DRIVER_DATA_POLL_STATUS	1	/* poll status before control */
-#define RNDIS_DRIVER_DATA_DST_MAC_FIXUP	2	/* device ignores configured MAC address */
+#define RNDIS_DRIVER_DATA_POLL_STATUS		1	/* poll status before control */
+#define RNDIS_DRIVER_DATA_DST_MAC_FIXUP		2	/* device ignores configured MAC address */
+#define RNDIS_DRIVER_DATA_RX_AGGREGATION	4	/* needs RX limit > 2048 */
 
 extern void rndis_status(struct usbnet *dev, struct urb *urb);
 extern int
diff --git a/include/net/arp.h b/include/net/arp.h
index e8747e0713c7..329a5456987a 100644
--- a/include/net/arp.h
+++ b/include/net/arp.h
@@ -7,8 +7,10 @@
 #include <linux/hash.h>
 #include <net/neighbour.h>
 
-
-extern struct neigh_table arp_tbl;
+static inline struct neigh_table *arp_table(struct net *net)
+{
+	return net->neigh_tables[NEIGH_ARP_TABLE];
+}
 
 static inline u32 arp_hashfn(const void *pkey, const struct net_device *dev, u32 *hash_rnd)
 {
@@ -21,10 +23,12 @@ static inline u32 arp_hashfn(const void *pkey, const struct net_device *dev, u32
 #ifdef CONFIG_INET
 static inline struct neighbour *__ipv4_neigh_lookup_noref(struct net_device *dev, u32 key)
 {
+	struct neigh_table *tbl = arp_table(dev_net(dev));
+
 	if (dev->flags & (IFF_LOOPBACK | IFF_POINTOPOINT))
 		key = INADDR_ANY;
 
-	return ___neigh_lookup_noref(&arp_tbl, neigh_key_eq32, arp_hashfn, &key, dev);
+	return ___neigh_lookup_noref(tbl, neigh_key_eq32, arp_hashfn, &key, dev);
 }
 #else
 static inline
@@ -47,6 +51,22 @@ static inline struct neighbour *__ipv4_neigh_lookup(struct net_device *dev, u32
 	return n;
 }
 
+static inline struct neighbour *ipv4_neigh_lookup(struct net_device *dev,
+						  const void *pkey)
+{
+	struct neigh_table *tbl = arp_table(dev_net(dev));
+
+	return neigh_lookup(tbl, pkey, dev);
+}
+
+static inline struct neighbour *ipv4_neigh_create(struct net_device *dev,
+						  const void *pkey)
+{
+	struct neigh_table *tbl = arp_table(dev_net(dev));
+
+	return neigh_create(tbl, pkey, dev);
+}
+
 static inline void __ipv4_confirm_neigh(struct net_device *dev, u32 key)
 {
 	struct neighbour *n;
diff --git a/include/net/bond_3ad.h b/include/net/bond_3ad.h
index ef667dff2972..9e548d3dca21 100644
--- a/include/net/bond_3ad.h
+++ b/include/net/bond_3ad.h
@@ -60,12 +60,6 @@ typedef enum {
 	AD_MUX_COLLECTING_DISTRIBUTING	/* mux machine */
 } mux_states_t;
 
-/* tx machine states(43.4.15 in the 802.3ad standard) */
-typedef enum {
-	AD_TX_DUMMY,
-	AD_TRANSMIT		/* tx Machine */
-} tx_states_t;
-
 /* churn machine states(43.4.17 in the 802.3ad standard) */
 typedef enum {
 	 AD_CHURN_MONITOR, /* monitoring for churn */
@@ -231,7 +225,6 @@ typedef struct port {
 	u16 sm_periodic_timer_counter;	/* state machine periodic timer counter */
 	mux_states_t sm_mux_state;	/* state machine mux state */
 	u16 sm_mux_timer_counter;	/* state machine mux timer counter */
-	tx_states_t sm_tx_state;	/* state machine tx state */
 	u16 sm_tx_timer_counter;	/* state machine tx timer counter
 					 * (always on - enter to transmit
 					 *  state 3 time per second)
diff --git a/include/net/bond_alb.h b/include/net/bond_alb.h
index e5945427f38d..32f1981033e4 100644
--- a/include/net/bond_alb.h
+++ b/include/net/bond_alb.h
@@ -57,12 +57,12 @@ struct tlb_client_info {
 				 * packets to a Client that the Hash function
 				 * gave this entry index.
 				 */
-	u32 tx_bytes;		/* Each Client accumulates the BytesTx that
+	u64 tx_bytes;		/* Each Client accumulates the BytesTx that
 				 * were transmitted to it, and after each
 				 * CallBack the LoadHistory is divided
 				 * by the balance interval
 				 */
-	u32 load_history;	/* This field contains the amount of Bytes
+	u64 load_history;	/* This field contains the amount of Bytes
 				 * that were transmitted to this client by
 				 * the server on the previous balance
 				 * interval in Bps.
@@ -118,14 +118,20 @@ struct tlb_slave_info {
 			 * are the entries that were assigned to use this
 			 * slave for transmit.
 			 */
-	u32 load;	/* Each slave sums the loadHistory of all clients
+	u64 load;	/* Each slave sums the loadHistory of all clients
 			 * assigned to it
 			 */
 };
 
+struct unbalanced_load_stats {
+	u64_stats_t		tx_bytes;
+	struct u64_stats_sync	syncp;
+};
+
 struct alb_bond_info {
 	struct tlb_client_info	*tx_hashtbl; /* Dynamically allocated */
-	u32			unbalanced_load;
+	struct unbalanced_load_stats __percpu	*unbalanced_load;
+	u64			prev_total_unbalanced;
 	atomic_t		tx_rebalance_counter;
 	int			lp_counter;
 	/* -------- rlb parameters -------- */
diff --git a/include/net/cfg80211.h b/include/net/cfg80211.h
index 97c16d4ff127..05c625d9e076 100644
--- a/include/net/cfg80211.h
+++ b/include/net/cfg80211.h
@@ -576,7 +576,6 @@ struct ieee80211_sta_s1g_cap {
  * @vht_cap: VHT capabilities in this band
  * @s1g_cap: S1G capabilities in this band
  * @edmg_cap: EDMG capabilities in this band
- * @s1g_cap: S1G capabilities in this band (S1G band only, of course)
  * @n_iftype_data: number of iftype data entries
  * @iftype_data: interface type data entries.  Note that the bits in
  *	@types_mask inside this structure cannot overlap (i.e. only
@@ -901,6 +900,7 @@ struct cfg80211_bitrate_mask {
 		enum nl80211_eht_gi eht_gi;
 		enum nl80211_he_ltf he_ltf;
 		enum nl80211_eht_ltf eht_ltf;
+		bool nonht_dup_6ghz;
 	} control[NUM_NL80211_BANDS];
 };
 
@@ -1821,6 +1821,8 @@ struct sta_txpwr {
  * @s1g_capa: S1G capabilities of station
  * @uhr_capa: UHR capabilities of the station
  * @uhr_capa_len: the length of the UHR capabilities
+ * @cip_cap_set: If CIP capabilities are present, required for CIP stations
+ * @cip_cap: CIP capabilities of station
  */
 struct link_station_parameters {
 	const u8 *mld_mac;
@@ -1842,6 +1844,8 @@ struct link_station_parameters {
 	const struct ieee80211_s1g_cap *s1g_capa;
 	const struct ieee80211_uhr_cap *uhr_capa;
 	u8 uhr_capa_len;
+	bool cip_cap_set;
+	u8 cip_cap;
 };
 
 /**
@@ -3402,6 +3406,8 @@ struct cfg80211_ml_reconf_req {
  *	flag is not set.
  * @ASSOC_REQ_SPP_AMSDU: SPP A-MSDUs will be used on this connection (if any)
  * @ASSOC_REQ_DISABLE_UHR: Disable UHR
+ * @ASSOC_REQ_CIP: Enable Control Integrity Protocol
+ * @ASSOC_REQ_PROTECTED_TWT: Enable protected TWT
  */
 enum cfg80211_assoc_req_flags {
 	ASSOC_REQ_DISABLE_HT			= BIT(0),
@@ -3413,6 +3419,8 @@ enum cfg80211_assoc_req_flags {
 	CONNECT_REQ_MLO_SUPPORT			= BIT(6),
 	ASSOC_REQ_SPP_AMSDU			= BIT(7),
 	ASSOC_REQ_DISABLE_UHR			= BIT(8),
+	ASSOC_REQ_CIP				= BIT(9),
+	ASSOC_REQ_PROTECTED_TWT			= BIT(10),
 };
 
 /**
@@ -4009,6 +4017,7 @@ struct cfg80211_update_ft_ies_params {
  * @link_id: for MLO, the link ID to transmit on, -1 if not given; note
  *	that the link ID isn't validated (much), it's in range but the
  *	link might not exist (or be used by the receiver STA)
+ * @no_sta: set if the frame should not be transmitted using an existing STA
  */
 struct cfg80211_mgmt_tx_params {
 	struct ieee80211_channel *chan;
@@ -4021,6 +4030,7 @@ struct cfg80211_mgmt_tx_params {
 	int n_csa_offsets;
 	const u16 *csa_offsets;
 	int link_id;
+	bool no_sta;
 };
 
 /**
@@ -4183,9 +4193,12 @@ struct cfg80211_nan_band_config {
  *	that can take a value from 50-6F-9A-01-00-00 to 50-6F-9A-01-FF-FF.
  * @scan_period: period (in seconds) between NAN scans.
  * @scan_dwell_time: dwell time (in milliseconds) for NAN scans.
- * @discovery_beacon_interval: interval (in TUs) for discovery beacons.
+ * @discovery_beacon_interval: interval (in TUs) for discovery beacons. Must be
+ *	greater than 0 when @instant_comm is true.
  * @enable_dw_notification: flag to enable/disable discovery window
  *	notifications.
+ * @instant_comm: if true, start Instant Communication (IC) as defined in
+ *	Chapter 13 of the Wi-Fi Aware Specification v4.0.
  * @band_cfgs: array of band specific configurations, indexed by
  *	&enum nl80211_band values.
  * @extra_nan_attrs: pointer to additional NAN attributes.
@@ -4201,6 +4214,7 @@ struct cfg80211_nan_conf {
 	u16 scan_dwell_time;
 	u8 discovery_beacon_interval;
 	bool enable_dw_notification;
+	bool instant_comm;
 	struct cfg80211_nan_band_config band_cfgs[NUM_NL80211_BANDS];
 	const u8 *extra_nan_attrs;
 	u16 extra_nan_attrs_len;
@@ -4257,6 +4271,21 @@ struct cfg80211_nan_local_sched {
 };
 
 /**
+ * struct cfg80211_nan_non_evac_channels - NAN non-evacuable channels
+ *
+ * This struct defines the set of NAN local schedule channels that must not
+ * be evacuated for concurrent operations.
+ *
+ * @n_channels: number of channel definitions in %chandefs.
+ * @chandefs: array of channel definitions that must not be evacuated. Each
+ *	must match a channel of the current local schedule.
+ */
+struct cfg80211_nan_non_evac_channels {
+	u8 n_channels;
+	struct cfg80211_chan_def chandefs[] __counted_by(n_channels);
+};
+
+/**
  * struct cfg80211_nan_peer_map - NAN peer schedule map
  *
  * This struct defines a single NAN peer schedule map
@@ -5204,6 +5233,12 @@ struct mgmt_frame_regs {
  *	schedule, the full new schedule is provided - partial updates are not
  *	supported, and the new schedule completely replaces the previous one.
  *
+ * @nan_set_non_evac_channels: set the list of local schedule channels that
+ *	must not be evacuated for concurrent operations. The provided list
+ *	replaces the previous set; channels of the current schedule that are
+ *	not included become evacuable again. All provided channels are
+ *	guaranteed by cfg80211 to belong to the current local schedule.
+ *
  * @set_multicast_to_unicast: configure multicast to unicast conversion for BSS
  *
  * @get_txq_stats: Get TXQ stats for interface or phy. If wdev is %NULL, this
@@ -5302,14 +5337,17 @@ struct cfg80211_ops {
 				 unsigned int link_id);
 
 	int	(*add_key)(struct wiphy *wiphy, struct wireless_dev *wdev,
-			   int link_id, u8 key_index, bool pairwise,
+			   int link_id, u8 key_index,
+			   enum nl80211_key_type type,
 			   const u8 *mac_addr, struct key_params *params);
 	int	(*get_key)(struct wiphy *wiphy, struct wireless_dev *wdev,
-			   int link_id, u8 key_index, bool pairwise,
+			   int link_id, u8 key_index,
+			   enum nl80211_key_type type,
 			   const u8 *mac_addr, void *cookie,
 			   void (*callback)(void *cookie, struct key_params*));
 	int	(*del_key)(struct wiphy *wiphy, struct wireless_dev *wdev,
-			   int link_id, u8 key_index, bool pairwise,
+			   int link_id, u8 key_index,
+			   enum nl80211_key_type type,
 			   const u8 *mac_addr);
 	int	(*set_default_key)(struct wiphy *wiphy,
 				   struct net_device *netdev, int link_id,
@@ -5590,6 +5628,9 @@ struct cfg80211_ops {
 	int	(*nan_set_peer_sched)(struct wiphy *wiphy,
 				      struct wireless_dev *wdev,
 				      struct cfg80211_nan_peer_sched *sched);
+	int	(*nan_set_non_evac_channels)(struct wiphy *wiphy,
+					     struct wireless_dev *wdev,
+					     struct cfg80211_nan_non_evac_channels *channels);
 	int	(*set_multicast_to_unicast)(struct wiphy *wiphy,
 					    struct net_device *dev,
 					    const bool enabled);
@@ -6043,6 +6084,8 @@ struct wiphy_vendor_command {
  * @eml_capabilities: EML capabilities (for MLO)
  * @mld_capa_and_ops: MLD capabilities and operations (for MLO)
  * @ext_mld_capa_and_ops: Extended MLD capabilities and operations (for MLO)
+ * @cip_supported: CIP is supported and the capabilities are valid
+ * @cip_capabilities: CIP Capabilities element containing the MIC padding delay
  */
 struct wiphy_iftype_ext_capab {
 	enum nl80211_iftype iftype;
@@ -6052,6 +6095,8 @@ struct wiphy_iftype_ext_capab {
 	u16 eml_capabilities;
 	u16 mld_capa_and_ops;
 	u16 ext_mld_capa_and_ops;
+	bool cip_supported;
+	u8 cip_capabilities;
 };
 
 /**
@@ -6266,10 +6311,13 @@ struct wiphy_radio {
  * @WIPHY_NAN_FLAGS_CONFIGURABLE_SYNC: Device supports NAN configurable
  *     synchronization.
  * @WIPHY_NAN_FLAGS_USERSPACE_DE: Device doesn't support DE offload.
+ * @WIPHY_NAN_FLAGS_INSTANT_COMM: Device can switch to Instant Communication
+ *     (IC) mode. Can only be set along with %WIPHY_NAN_FLAGS_CONFIGURABLE_SYNC.
  */
 enum wiphy_nan_flags {
 	WIPHY_NAN_FLAGS_CONFIGURABLE_SYNC = BIT(0),
 	WIPHY_NAN_FLAGS_USERSPACE_DE   = BIT(1),
+	WIPHY_NAN_FLAGS_INSTANT_COMM = BIT(2),
 };
 
 /**
@@ -7332,6 +7380,8 @@ struct wireless_dev {
 		union {
 			struct {
 				unsigned int beacon_interval;
+				enum ieee80211_ap_reg_power reg_power;
+				enum ieee80211_ap_reg_power csa_reg_power;
 				struct cfg80211_chan_def chandef;
 			} ap;
 			struct {
@@ -7817,7 +7867,8 @@ unsigned int cfg80211_classify8021d(struct sk_buff *skb,
  * byte array to match.
  */
 const struct element *
-cfg80211_find_elem_match(u8 eid, const u8 *ies, unsigned int len,
+cfg80211_find_elem_match(enum ieee80211_eid eid,
+			 const u8 *ies, unsigned int len,
 			 const u8 *match, unsigned int match_len,
 			 unsigned int match_offset);
 
@@ -7846,7 +7897,7 @@ cfg80211_find_elem_match(u8 eid, const u8 *ies, unsigned int len,
  * byte array to match.
  */
 static inline const u8 *
-cfg80211_find_ie_match(u8 eid, const u8 *ies, unsigned int len,
+cfg80211_find_ie_match(enum ieee80211_eid eid, const u8 *ies, unsigned int len,
 		       const u8 *match, unsigned int match_len,
 		       unsigned int match_offset)
 {
@@ -7879,7 +7930,7 @@ cfg80211_find_ie_match(u8 eid, const u8 *ies, unsigned int len,
  * having to fit into the given data.
  */
 static inline const struct element *
-cfg80211_find_elem(u8 eid, const u8 *ies, int len)
+cfg80211_find_elem(enum ieee80211_eid eid, const u8 *ies, int len)
 {
 	return cfg80211_find_elem_match(eid, ies, len, NULL, 0, 0);
 }
@@ -7899,7 +7950,8 @@ cfg80211_find_elem(u8 eid, const u8 *ies, int len)
  * Note: There are no checks on the element length other than
  * having to fit into the given data.
  */
-static inline const u8 *cfg80211_find_ie(u8 eid, const u8 *ies, int len)
+static inline const u8 *cfg80211_find_ie(enum ieee80211_eid eid,
+					 const u8 *ies, int len)
 {
 	return cfg80211_find_ie_match(eid, ies, len, NULL, 0, 0);
 }
@@ -7920,10 +7972,13 @@ static inline const u8 *cfg80211_find_ie(u8 eid, const u8 *ies, int len)
  * having to fit into the given data.
  */
 static inline const struct element *
-cfg80211_find_ext_elem(u8 ext_eid, const u8 *ies, int len)
+cfg80211_find_ext_elem(enum ieee80211_eid_ext ext_eid,
+		       const u8 *ies, int len)
 {
+	u8 _ext_eid = ext_eid;
+
 	return cfg80211_find_elem_match(WLAN_EID_EXTENSION, ies, len,
-					&ext_eid, 1, 0);
+					&_ext_eid, 1, 0);
 }
 
 /**
@@ -9501,6 +9556,7 @@ void cfg80211_conn_failed(struct net_device *dev, const u8 *mac_addr,
  * @flags: flags, as defined in &enum nl80211_rxmgmt_flags
  * @rx_tstamp: Hardware timestamp of frame RX in nanoseconds
  * @ack_tstamp: Hardware timestamp of ack TX in nanoseconds
+ * @no_sta: set if no station is known for the frame (relevant for MLD)
  */
 struct cfg80211_rx_info {
 	int freq;
@@ -9512,6 +9568,7 @@ struct cfg80211_rx_info {
 	u32 flags;
 	u64 rx_tstamp;
 	u64 ack_tstamp;
+	bool no_sta;
 };
 
 /**
diff --git a/include/net/cfg802154.h b/include/net/cfg802154.h
index 2e960441ea49..2c5dcf6a106f 100644
--- a/include/net/cfg802154.h
+++ b/include/net/cfg802154.h
@@ -458,15 +458,16 @@ struct ieee802154_llsec_device_key {
 	u32 frame_counter;
 };
 
-struct wpan_dev_header_ops {
+struct wpan_dev_ops {
 	/* TODO create callback currently assumes ieee802154_mac_cb inside
 	 * skb->cb. This should be changed to give these information as
 	 * parameter.
 	 */
-	int	(*create)(struct sk_buff *skb, struct net_device *dev,
+	int	(*header_create)(struct sk_buff *skb, struct net_device *dev,
 			  const struct ieee802154_addr *daddr,
 			  const struct ieee802154_addr *saddr,
 			  unsigned int len);
+	int	(*ioctl)(struct net_device *dev, struct ifreq *ifr, int cmd);
 };
 
 struct wpan_dev {
@@ -477,7 +478,7 @@ struct wpan_dev {
 	struct list_head list;
 	struct net_device *netdev;
 
-	const struct wpan_dev_header_ops *header_ops;
+	const struct wpan_dev_ops *ops;
 
 	/* lowpan interface, set when the wpan_dev belongs to one lowpan_dev */
 	struct net_device *lowpan_dev;
@@ -523,7 +524,7 @@ wpan_dev_hard_header(struct sk_buff *skb, struct net_device *dev,
 {
 	struct wpan_dev *wpan_dev = dev->ieee802154_ptr;
 
-	return wpan_dev->header_ops->create(skb, dev, daddr, saddr, len);
+	return wpan_dev->ops->header_create(skb, dev, daddr, saddr, len);
 }
 #endif
 
diff --git a/include/net/dropreason-core.h b/include/net/dropreason-core.h
index 2f312d1f67d6..664249924219 100644
--- a/include/net/dropreason-core.h
+++ b/include/net/dropreason-core.h
@@ -93,6 +93,7 @@
 	FN(IP_INVALID_SOURCE)		\
 	FN(IP_LOCALNET)			\
 	FN(IP_INVALID_DEST)		\
+	FN(IP_TTL_EXCEEDED)		\
 	FN(PKT_TOO_BIG)			\
 	FN(DUP_FRAG)			\
 	FN(FRAG_REASM_TIMEOUT)		\
@@ -110,8 +111,8 @@
 	FN(PACKET_SOCK_ERROR)		\
 	FN(TC_CHAIN_NOTFOUND)		\
 	FN(TC_RECLASSIFY_LOOP)		\
-	FN(VXLAN_INVALID_HDR)		\
-	FN(VXLAN_VNI_NOT_FOUND)		\
+	FN(TUNNEL_INVALID_HDR)		\
+	FN(TUNNEL_NOT_FOUND)		\
 	FN(MAC_INVALID_SOURCE)		\
 	FN(VXLAN_ENTRY_EXISTS)		\
 	FN(NO_TX_TARGET)		\
@@ -475,6 +476,11 @@ enum skb_drop_reason {
 	 */
 	SKB_DROP_REASON_IP_INVALID_DEST,
 	/**
+	 * @SKB_DROP_REASON_IP_TTL_EXCEEDED: IPv4 TTL or IPv6 hop limit <= 1
+	 * (see IPSTATS_MIB_INHDRERRORS)
+	 */
+	SKB_DROP_REASON_IP_TTL_EXCEEDED,
+	/**
 	 * @SKB_DROP_REASON_PKT_TOO_BIG: packet size is too big (maybe exceed the
 	 * MTU)
 	 */
@@ -533,13 +539,16 @@ enum skb_drop_reason {
 	 */
 	SKB_DROP_REASON_TC_RECLASSIFY_LOOP,
 	/**
-	 * @SKB_DROP_REASON_VXLAN_INVALID_HDR: VXLAN header is invalid. E.g.:
-	 * 1) reserved fields are not zero
-	 * 2) "I" flag is not set
+	 * @SKB_DROP_REASON_TUNNEL_INVALID_HDR: tunnel header is invalid. E.g.:
+	 * 1) VXLAN reserved fields are not zero
+	 * 2) VXLAN "I" flag is not set
+	 */
+	SKB_DROP_REASON_TUNNEL_INVALID_HDR,
+	/**
+	 * @SKB_DROP_REASON_TUNNEL_NOT_FOUND: no tunnel device found for the
+	 * packet, e.g. no VXLAN device for its VNI
 	 */
-	SKB_DROP_REASON_VXLAN_INVALID_HDR,
-	/** @SKB_DROP_REASON_VXLAN_VNI_NOT_FOUND: no VXLAN device found for VNI */
-	SKB_DROP_REASON_VXLAN_VNI_NOT_FOUND,
+	SKB_DROP_REASON_TUNNEL_NOT_FOUND,
 	/** @SKB_DROP_REASON_MAC_INVALID_SOURCE: source mac is invalid */
 	SKB_DROP_REASON_MAC_INVALID_SOURCE,
 	/**
@@ -604,7 +613,11 @@ enum skb_drop_reason {
 	SKB_DROP_REASON_PSP_INPUT,
 	/** @SKB_DROP_REASON_PSP_OUTPUT: PSP output checks failed */
 	SKB_DROP_REASON_PSP_OUTPUT,
-	/** @SKB_DROP_REASON_RECURSION_LIMIT: Dead loop on virtual device. */
+	/**
+	 * @SKB_DROP_REASON_RECURSION_LIMIT: Dead loop on virtual device, e.g. a
+	 * tunnel whose route to its remote end goes out of the tunnel device
+	 * itself.
+	 */
 	SKB_DROP_REASON_RECURSION_LIMIT,
 	/**
 	 * @SKB_DROP_REASON_MAX: the maximum of core drop reasons, which
diff --git a/include/net/dsa.h b/include/net/dsa.h
index 7507d632e7c6..5d12191b6f6f 100644
--- a/include/net/dsa.h
+++ b/include/net/dsa.h
@@ -61,6 +61,7 @@ struct tc_action;
 #define DSA_TAG_PROTO_NETC_VALUE		33
 #define DSA_TAG_PROTO_KSZ8463_VALUE		34
 #define DSA_TAG_PROTO_MT7628_VALUE		35
+#define DSA_TAG_PROTO_KS8995_VALUE		36
 
 enum dsa_tag_protocol {
 	DSA_TAG_PROTO_NONE		= DSA_TAG_PROTO_NONE_VALUE,
@@ -99,6 +100,7 @@ enum dsa_tag_protocol {
 	DSA_TAG_PROTO_NETC		= DSA_TAG_PROTO_NETC_VALUE,
 	DSA_TAG_PROTO_KSZ8463		= DSA_TAG_PROTO_KSZ8463_VALUE,
 	DSA_TAG_PROTO_MT7628		= DSA_TAG_PROTO_MT7628_VALUE,
+	DSA_TAG_PROTO_KS8995		= DSA_TAG_PROTO_KS8995_VALUE,
 };
 
 struct dsa_switch;
diff --git a/include/net/gso.h b/include/net/gso.h
index 0749230d414e..fe3260b381d4 100644
--- a/include/net/gso.h
+++ b/include/net/gso.h
@@ -21,6 +21,8 @@ struct skb_gso_cb {
 	__u16	csum_start;
 	/* Number of IPv4/IPv6 GSO handler entries for this packet. */
 	u8	recursion_counter;
+	/* Max MSS segs per output skb, 0 = no limit */
+	u8	max_segs;
 };
 #define SKB_GSO_CB_OFFSET	32
 #define SKB_GSO_CB(skb) ((struct skb_gso_cb *)((skb)->cb + SKB_GSO_CB_OFFSET))
@@ -83,12 +85,13 @@ static inline __sum16 gso_make_checksum(struct sk_buff *skb, __wsum res)
 }
 
 struct sk_buff *__skb_gso_segment(struct sk_buff *skb,
-				  netdev_features_t features, bool tx_path);
+				  netdev_features_t features, bool tx_path,
+				  unsigned int max_segs);
 
 static inline struct sk_buff *skb_gso_segment(struct sk_buff *skb,
 					      netdev_features_t features)
 {
-	return __skb_gso_segment(skb, features, true);
+	return __skb_gso_segment(skb, features, true, 0);
 }
 
 struct sk_buff *skb_eth_gso_segment(struct sk_buff *skb,
diff --git a/include/net/ieee80211_radiotap.h b/include/net/ieee80211_radiotap.h
index 8bbaf77da7cf..782c3dcd8b52 100644
--- a/include/net/ieee80211_radiotap.h
+++ b/include/net/ieee80211_radiotap.h
@@ -1,6 +1,6 @@
 /*
  * Copyright (c) 2017		Intel Deutschland GmbH
- * Copyright (c) 2018-2019, 2021-2022, 2025 Intel Corporation
+ * Copyright (c) 2018-2019, 2021-2022, 2025-2026 Intel Corporation
  *
  * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -93,6 +93,7 @@ enum ieee80211_radiotap_presence {
 	IEEE80211_RADIOTAP_RADIOTAP_NAMESPACE = 29,
 	IEEE80211_RADIOTAP_VENDOR_NAMESPACE = 30,
 	IEEE80211_RADIOTAP_EXT = 31,
+	IEEE80211_RADIOTAP_S1G = 32,
 	IEEE80211_RADIOTAP_EHT_USIG = 33,
 	IEEE80211_RADIOTAP_EHT = 34,
 	IEEE80211_RADIOTAP_UHR_ELR = 37,
@@ -112,6 +113,9 @@ enum ieee80211_radiotap_flags {
 
 /* for IEEE80211_RADIOTAP_CHANNEL */
 enum ieee80211_radiotap_channel_flags {
+	IEEE80211_CHAN_700MHZ = 0x0001,
+	IEEE80211_CHAN_800MHZ = 0x0002,
+	IEEE80211_CHAN_900MHZ = 0x0004,
 	IEEE80211_CHAN_CCK = 0x0020,
 	IEEE80211_CHAN_OFDM = 0x0040,
 	IEEE80211_CHAN_2GHZ = 0x0080,
@@ -592,7 +596,7 @@ enum ieee80211_radiotap_eht_usig_mu {
 
 enum ieee80211_radiotap_eht_usig_tb {
 	/* TB-USIG-1 */
-	IEEE80211_RADIOTAP_EHT_USIG1_TB_B20_B25_DISREGARD	= 0x0000001f,
+	IEEE80211_RADIOTAP_EHT_USIG1_TB_B20_B25_DISREGARD	= 0x0000003f,
 
 	/* TB-USIG-2 */
 	IEEE80211_RADIOTAP_EHT_USIG2_TB_B0_B1_PPDU_TYPE		= 0x000000c0,
@@ -604,6 +608,49 @@ enum ieee80211_radiotap_eht_usig_tb {
 	IEEE80211_RADIOTAP_EHT_USIG2_TB_B20_B25_TAIL		= 0xfc000000,
 };
 
+enum ieee80211_radiotap_uhr_usig_mu {
+	/* USIG-1 */
+	IEEE80211_RADIOTAP_UHR_USIG1_MU_BSS_COLOR_2		= 0x0000003f,
+	IEEE80211_RADIOTAP_UHR_USIG1_MU_B20_B24_DISREGARD	= 0x0000001f,
+	IEEE80211_RADIOTAP_UHR_USIG1_MU_B25_VALIDATE		= 0x00000020,
+	/* USIG-2 */
+	IEEE80211_RADIOTAP_UHR_USIG2_MU_B0_B1_PPDU_TYPE		= 0x000000c0,
+	IEEE80211_RADIOTAP_UHR_USIG2_MU_B2_COBF_COSR		= 0x00000100,
+	IEEE80211_RADIOTAP_UHR_USIG2_MU_B3_B7_PUNCTURED_INFO	= 0x00003e00,
+	IEEE80211_RADIOTAP_UHR_USIG2_MU_B8_VALIDATE		= 0x00004000,
+	IEEE80211_RADIOTAP_UHR_USIG2_MU_B9_B10_SIG_MCS		= 0x00018000,
+	IEEE80211_RADIOTAP_UHR_USIG2_MU_B11_B15_UHR_SIG_SYMBOLS	= 0x003e0000,
+	IEEE80211_RADIOTAP_UHR_USIG2_MU_B16_B19_CRC		= 0x03c00000,
+	IEEE80211_RADIOTAP_UHR_USIG2_MU_B20_B25_TAIL		= 0xfc000000,
+};
+
+enum ieee80211_radiotap_uhr_usig_tb {
+	/* USIG-1 */
+	IEEE80211_RADIOTAP_UHR_USIG1_TB_B20_B25_DISREGARD	= 0x0000003f,
+
+	/* USIG-2 */
+	IEEE80211_RADIOTAP_UHR_USIG2_TB_B0_B1_PPDU_TYPE		= 0x000000c0,
+	IEEE80211_RADIOTAP_UHR_USIG2_TB_B2_VALIDATE		= 0x00000100,
+	IEEE80211_RADIOTAP_UHR_USIG2_TB_B3_B6_SPATIAL_REUSE_1	= 0x00001e00,
+	IEEE80211_RADIOTAP_UHR_USIG2_TB_B7_B10_SPATIAL_REUSE_2	= 0x0001e000,
+	IEEE80211_RADIOTAP_UHR_USIG2_TB_B11_B15_DISREGARD	= 0x003e0000,
+	IEEE80211_RADIOTAP_UHR_USIG2_TB_B16_B19_CRC		= 0x03c00000,
+	IEEE80211_RADIOTAP_UHR_USIG2_TB_B20_B25_TAIL		= 0xfc000000,
+};
+
+enum ieee80211_radiotap_uhr_usig_elr {
+	/* USIG-1 */
+	IEEE80211_RADIOTAP_UHR_USIG1_ELR_B20_B24_DISREGARD	= 0x0000001f,
+	IEEE80211_RADIOTAP_UHR_USIG1_ELR_B25_VALIDATE		= 0x00000020,
+
+	/* USIG-2 */
+	IEEE80211_RADIOTAP_UHR_USIG2_ELR_B0_B1_PPDU_TYPE	= 0x000000c0,
+	IEEE80211_RADIOTAP_UHR_USIG2_ELR_B2_B12_STA_ID		= 0x0007ff00,
+	IEEE80211_RADIOTAP_UHR_USIG2_ELR_B13_B15_VALIDATE	= 0x00380000,
+	IEEE80211_RADIOTAP_UHR_USIG2_ELR_B16_B19_CRC		= 0x03c00000,
+	IEEE80211_RADIOTAP_UHR_USIG2_ELR_B20_B25_TAIL		= 0xfc000000,
+};
+
 /*
  * ieee80211_radiotap_uhr_elr - content of UHR-ELR TLV (type 37)
  * see https://www.radiotap.org/fields/UHR-ELR for details
@@ -792,6 +839,68 @@ enum ieee80211_radiotap_uhr_user_info {
 	IEEE80211_RADIOTAP_UHR_USER_INFO_2X_LDPC		= 0x02000000,
 };
 
+/*
+ * ieee80211_radiotap_s1g - content of S1G TLV (type 32)
+ * see www.radiotap.org/fields/S1G.html for details
+ */
+struct ieee80211_radiotap_s1g {
+	__le16 known;
+	__le16 data1;
+	__le16 data2;
+} __packed;
+
+enum ieee80211_radiotap_s1g_known {
+	IEEE80211_RADIOTAP_S1G_KNOWN_PPDU_FORMAT	= 0x0001,
+	IEEE80211_RADIOTAP_S1G_KNOWN_RESPONSE_IND	= 0x0002,
+	IEEE80211_RADIOTAP_S1G_KNOWN_GI			= 0x0004,
+	IEEE80211_RADIOTAP_S1G_KNOWN_NSS		= 0x0008,
+	IEEE80211_RADIOTAP_S1G_KNOWN_BW			= 0x0010,
+	IEEE80211_RADIOTAP_S1G_KNOWN_MCS		= 0x0020,
+	IEEE80211_RADIOTAP_S1G_KNOWN_COLOR		= 0x0040,
+	IEEE80211_RADIOTAP_S1G_KNOWN_UPLINK_IND		= 0x0080,
+};
+
+enum ieee80211_radiotap_s1g_data1 {
+	IEEE80211_RADIOTAP_S1G_DATA1_PPDU_FORMAT	= 0x0003,
+	IEEE80211_RADIOTAP_S1G_DATA1_RESPONSE_IND	= 0x000c,
+	IEEE80211_RADIOTAP_S1G_DATA1_GI			= 0x0020,
+	IEEE80211_RADIOTAP_S1G_DATA1_NSS		= 0x00c0,
+	IEEE80211_RADIOTAP_S1G_DATA1_BW			= 0x0f00,
+	IEEE80211_RADIOTAP_S1G_DATA1_MCS		= 0xf000,
+};
+
+enum ieee80211_radiotap_s1g_data2 {
+	IEEE80211_RADIOTAP_S1G_DATA2_COLOR		= 0x0007,
+	IEEE80211_RADIOTAP_S1G_DATA2_UPLINK_IND		= 0x0008,
+	IEEE80211_RADIOTAP_S1G_DATA2_RSSI		= 0xff00,
+};
+
+enum ieee80211_radiotap_s1g_ppdu_format {
+	IEEE80211_RADIOTAP_S1G_PPDU_FORMAT_1M		= 0,
+	IEEE80211_RADIOTAP_S1G_PPDU_FORMAT_SHORT	= 1,
+	IEEE80211_RADIOTAP_S1G_PPDU_FORMAT_LONG		= 2,
+};
+
+enum ieee80211_radiotap_s1g_response_ind {
+	IEEE80211_RADIOTAP_S1G_RESPONSE_IND_NONE	= 0,
+	IEEE80211_RADIOTAP_S1G_RESPONSE_IND_NDP		= 1,
+	IEEE80211_RADIOTAP_S1G_RESPONSE_IND_NORMAL	= 2,
+	IEEE80211_RADIOTAP_S1G_RESPONSE_IND_LONG	= 3,
+};
+
+enum ieee80211_radiotap_s1g_gi {
+	IEEE80211_RADIOTAP_S1G_GI_LONG			= 0,
+	IEEE80211_RADIOTAP_S1G_GI_SHORT			= 1,
+};
+
+enum ieee80211_radiotap_s1g_bw {
+	IEEE80211_RADIOTAP_S1G_BW_1MHZ			= 0,
+	IEEE80211_RADIOTAP_S1G_BW_2MHZ			= 1,
+	IEEE80211_RADIOTAP_S1G_BW_4MHZ			= 2,
+	IEEE80211_RADIOTAP_S1G_BW_8MHZ			= 3,
+	IEEE80211_RADIOTAP_S1G_BW_16MHZ			= 4,
+};
+
 /**
  * ieee80211_get_radiotap_len - get radiotap header length
  * @data: pointer to the header
diff --git a/include/net/inet_connection_sock.h b/include/net/inet_connection_sock.h
index 433c2df23076..903499581db7 100644
--- a/include/net/inet_connection_sock.h
+++ b/include/net/inet_connection_sock.h
@@ -94,6 +94,7 @@ struct inet_connection_sock {
 	u32			  icsk_rto_max;
 	__u32                     icsk_delack_max;
 	__u32			  icsk_pmtu_cookie;
+	unsigned char		  unhashed_state;
 	const struct tcp_congestion_ops *icsk_ca_ops;
 	const struct inet_connection_sock_af_ops *icsk_af_ops;
 	const struct tcp_ulp_ops  *icsk_ulp_ops;
diff --git a/include/net/inet_sock.h b/include/net/inet_sock.h
index 7cdcbed3e5cb..24cbabc24582 100644
--- a/include/net/inet_sock.h
+++ b/include/net/inet_sock.h
@@ -207,7 +207,7 @@ struct rtable;
  * @inet_saddr - Sending source
  * @uc_ttl - Unicast TTL
  * @inet_sport - Source port
- * @inet_id - ID counter for DF pkts
+ * @inet_id - ID counter for non atomic pkts
  * @tos - TOS
  * @mc_ttl - Multicasting TTL
  * @uc_index - Unicast outgoing device index
diff --git a/include/net/ip.h b/include/net/ip.h
index d07c2c573024..618b9806c10b 100644
--- a/include/net/ip.h
+++ b/include/net/ip.h
@@ -591,6 +591,13 @@ static inline void ip_select_ident_segs(struct net *net, struct sk_buff *skb,
 {
 	struct iphdr *iph = ip_hdr(skb);
 
+	/* RFC 6864: the IPv4 ID of atomic datagrams has no meaning.
+	 * DF packets without ignore_df can not be fragmented.
+	 */
+	if ((iph->frag_off & htons(IP_DF)) && !skb->ignore_df) {
+		iph->id = 0;
+		return;
+	}
 	/* We had many attacks based on IPID, use the private
 	 * generator as much as we can.
 	 */
@@ -605,17 +612,13 @@ static inline void ip_select_ident_segs(struct net *net, struct sk_buff *skb,
 			val = atomic_read(&inet_sk(sk)->inet_id);
 			atomic_set(&inet_sk(sk)->inet_id, val + segs);
 		} else {
-			val = atomic_add_return(segs, &inet_sk(sk)->inet_id);
+			val = atomic_fetch_add(segs, &inet_sk(sk)->inet_id);
 		}
 		iph->id = htons(val);
 		return;
 	}
-	if ((iph->frag_off & htons(IP_DF)) && !skb->ignore_df) {
-		iph->id = 0;
-	} else {
-		/* Unfortunately we need the big hammer to get a suitable IPID */
-		__ip_select_ident(net, iph, segs);
-	}
+	/* Unfortunately we need the big hammer to get a suitable IPID */
+	__ip_select_ident(net, iph, segs);
 }
 
 static inline void ip_select_ident(struct net *net, struct sk_buff *skb,
diff --git a/include/net/ip6_route.h b/include/net/ip6_route.h
index 0f9b7a260d25..5f47cef0be46 100644
--- a/include/net/ip6_route.h
+++ b/include/net/ip6_route.h
@@ -231,6 +231,13 @@ void rt6_multipath_rebalance(struct fib6_info *f6i);
 
 void rt6_uncached_list_add(struct rt6_info *rt);
 void rt6_uncached_list_del(struct rt6_info *rt);
+#ifdef CONFIG_IPV6
+void rt6_uncached_list_flush_dev(struct net_device *dev);
+#else
+static inline void rt6_uncached_list_flush_dev(struct net_device *dev)
+{
+}
+#endif
 
 static inline const struct rt6_info *skb_rt6_info(const struct sk_buff *skb)
 {
@@ -430,7 +437,7 @@ u32 ip6_mtu_from_fib6(const struct fib6_result *res,
 		      const struct in6_addr *daddr,
 		      const struct in6_addr *saddr);
 
-struct neighbour *ip6_neigh_lookup(const struct in6_addr *gw,
-				   struct net_device *dev, struct sk_buff *skb,
-				   const void *daddr);
+struct neighbour *__ip6_dst_neigh_lookup(const struct in6_addr *gw,
+					 struct net_device *dev, struct sk_buff *skb,
+					 const void *daddr);
 #endif
diff --git a/include/net/ip6_tunnel.h b/include/net/ip6_tunnel.h
index b99805ee2fd1..d1f0a427e9c8 100644
--- a/include/net/ip6_tunnel.h
+++ b/include/net/ip6_tunnel.h
@@ -45,6 +45,7 @@ struct __ip6_tnl_parm {
 /* IPv6 tunnel */
 struct ip6_tnl {
 	struct ip6_tnl __rcu *next;	/* next tunnel in list */
+	struct hlist_node hash_node;
 	struct net_device *dev;	/* virtual device associated with tunnel */
 	netdevice_tracker dev_tracker;
 	struct net *net;	/* netns for packet i/o */
diff --git a/include/net/ip_fib.h b/include/net/ip_fib.h
index 0a35355fb0f3..fb446f01a65d 100644
--- a/include/net/ip_fib.h
+++ b/include/net/ip_fib.h
@@ -275,8 +275,9 @@ struct fib_dump_filter {
 	struct net_device	*dev;
 };
 
-int fib_table_lookup(struct fib_table *tb, const struct flowi4 *flp,
-		     struct fib_result *res, int fib_flags);
+int fib_table_lookup(struct net *net, struct fib_table *tb,
+		     const struct flowi4 *flp, struct fib_result *res,
+		     int fib_flags);
 int fib_table_insert(struct net *, struct fib_table *, struct fib_config *,
 		     struct netlink_ext_ack *extack);
 int fib_table_delete(struct net *, struct fib_table *, struct fib_config *,
@@ -323,7 +324,8 @@ static inline int fib_lookup(struct net *net, const struct flowi4 *flp,
 
 	tb = fib_get_table(net, RT_TABLE_MAIN);
 	if (tb)
-		err = fib_table_lookup(tb, flp, res, flags | FIB_LOOKUP_NOREF);
+		err = fib_table_lookup(net, tb, flp, res,
+				       flags | FIB_LOOKUP_NOREF);
 
 	if (err == -EAGAIN)
 		err = -ENETUNREACH;
@@ -387,14 +389,14 @@ static inline int fib_lookup(struct net *net, struct flowi4 *flp,
 
 	tb = rcu_dereference_rtnl(net->ipv4.fib_main);
 	if (tb)
-		err = fib_table_lookup(tb, flp, res, flags);
+		err = fib_table_lookup(net, tb, flp, res, flags);
 
 	if (err != -EAGAIN)
 		goto out;
 
 	tb = rcu_dereference_rtnl(net->ipv4.fib_default);
 	if (tb)
-		err = fib_table_lookup(tb, flp, res, flags);
+		err = fib_table_lookup(net, tb, flp, res, flags);
 
 	if (err == -EAGAIN)
 		err = -ENETUNREACH;
diff --git a/include/net/ip_tunnels.h b/include/net/ip_tunnels.h
index 7c9aadfe8fe3..5cccf4c0e691 100644
--- a/include/net/ip_tunnels.h
+++ b/include/net/ip_tunnels.h
@@ -127,6 +127,7 @@ struct ip_tunnel_6rd_parm {
 	__be32			relay_prefix;
 	u16			prefixlen;
 	u16			relay_prefixlen;
+	struct rcu_head		rcu;
 };
 #endif
 
@@ -148,6 +149,7 @@ struct ip_tunnel_parm_kern {
 	__be32			o_key;
 	int			link;
 	struct iphdr		iph;
+	struct rcu_head		rcu;
 };
 
 struct ip_tunnel {
@@ -185,10 +187,11 @@ struct ip_tunnel {
 
 	/* for SIT */
 #ifdef CONFIG_IPV6_SIT_6RD
-	struct ip_tunnel_6rd_parm ip6rd;
+	struct ip_tunnel_6rd_parm __rcu *ip6rd;
 #endif
 	struct ip_tunnel_prl_entry __rcu *prl;	/* potential router list */
 	unsigned int		prl_count;	/* # of entries in PRL */
+	struct ip_tunnel_parm_kern __rcu *sit_parms;
 	unsigned int		ip_tnl_net_id;
 	struct gro_cells	gro_cells;
 	__u32			fwmark;
@@ -215,6 +218,7 @@ struct ip_tunnel_net {
 	struct net_device *fb_tunnel_dev;
 	struct rtnl_link_ops *rtnl_link_ops;
 	struct hlist_head tunnels[IP_TNL_HASH_SIZE];
+	struct mutex tunnels_lock;
 	struct ip_tunnel __rcu *collect_md_tun;
 	int type;
 };
@@ -398,7 +402,6 @@ int ip_tunnel_get_iflink(const struct net_device *dev);
 int ip_tunnel_init_net(struct net *net, unsigned int ip_tnl_net_id,
 		       struct rtnl_link_ops *ops, char *devname);
 void ip_tunnel_delete_net(struct net *net, unsigned int id,
-			  struct rtnl_link_ops *ops,
 			  struct list_head *dev_to_kill);
 
 void ip_tunnel_xmit(struct sk_buff *skb, struct net_device *dev,
@@ -611,11 +614,13 @@ static inline u8 ip_tunnel_ecn_encap(u8 tos, const struct iphdr *iph,
 	return INET_ECN_encapsulate(tos, inner);
 }
 
-int __iptunnel_pull_header(struct sk_buff *skb, int hdr_len,
-			   __be16 inner_proto, bool raw_proto, bool xnet);
+enum skb_drop_reason
+__iptunnel_pull_header(struct sk_buff *skb, int hdr_len,
+		       __be16 inner_proto, bool raw_proto, bool xnet);
 
-static inline int iptunnel_pull_header(struct sk_buff *skb, int hdr_len,
-				       __be16 inner_proto, bool xnet)
+static inline enum skb_drop_reason
+iptunnel_pull_header(struct sk_buff *skb, int hdr_len,
+		     __be16 inner_proto, bool xnet)
 {
 	return __iptunnel_pull_header(skb, hdr_len, inner_proto, false, xnet);
 }
diff --git a/include/net/llc.h b/include/net/llc.h
index 029ba8a22319..ce7db08e8355 100644
--- a/include/net/llc.h
+++ b/include/net/llc.h
@@ -6,112 +6,44 @@
  * 		 2001-2003 by Arnaldo Carvalho de Melo <acme@conectiva.com.br>
  */
 
-#include <linux/if.h>
-#include <linux/if_ether.h>
 #include <linux/list.h>
-#include <linux/spinlock.h>
-#include <linux/rculist_nulls.h>
-#include <linux/hash.h>
-#include <linux/jhash.h>
-
-#include <linux/atomic.h>
+#include <linux/refcount.h>
 
 struct net_device;
 struct packet_type;
 struct sk_buff;
 
-struct llc_addr {
-	unsigned char lsap;
-	unsigned char mac[IFHWADDRLEN];
-};
-
-#define LLC_SAP_STATE_INACTIVE	1
-#define LLC_SAP_STATE_ACTIVE	2
-
-#define LLC_SK_DEV_HASH_BITS 6
-#define LLC_SK_DEV_HASH_ENTRIES (1<<LLC_SK_DEV_HASH_BITS)
-
-#define LLC_SK_LADDR_HASH_BITS 6
-#define LLC_SK_LADDR_HASH_ENTRIES (1<<LLC_SK_LADDR_HASH_BITS)
-
 /**
  * struct llc_sap - Defines the SAP component
  *
- * @station - station this sap belongs to
- * @state - sap state
- * @p_bit - only lowest-order bit used
- * @f_bit - only lowest-order bit used
- * @laddr - SAP value in this 'lsap'
- * @node - entry in station sap_list
- * @sk_list - LLC sockets this one manages
+ * @refcnt: reference count
+ * @lsap: SAP number
+ * @rcv_func: handler for the PDUs addressed to this SAP
+ * @node: entry in the SAP list
+ * @rcu: for deferred freeing
  */
 struct llc_sap {
-	unsigned char	 state;
-	unsigned char	 p_bit;
-	unsigned char	 f_bit;
 	refcount_t		 refcnt;
+	unsigned char	 lsap;
 	int		 (*rcv_func)(struct sk_buff *skb,
 				     struct net_device *dev,
 				     struct packet_type *pt,
 				     struct net_device *orig_dev);
-	struct llc_addr	 laddr;
 	struct list_head node;
-	spinlock_t sk_lock;
-	int sk_count;
-	struct hlist_nulls_head sk_laddr_hash[LLC_SK_LADDR_HASH_ENTRIES];
-	struct hlist_head sk_dev_hash[LLC_SK_DEV_HASH_ENTRIES];
 	struct rcu_head rcu;
 };
 
-static inline
-struct hlist_head *llc_sk_dev_hash(struct llc_sap *sap, int ifindex)
-{
-	u32 bucket = hash_32(ifindex, LLC_SK_DEV_HASH_BITS);
-
-	return &sap->sk_dev_hash[bucket];
-}
-
-static inline
-u32 llc_sk_laddr_hashfn(struct llc_sap *sap, const struct llc_addr *laddr)
-{
-	return hash_32(jhash(laddr->mac, sizeof(laddr->mac), 0),
-		       LLC_SK_LADDR_HASH_BITS);
-}
-
-static inline
-struct hlist_nulls_head *llc_sk_laddr_hash(struct llc_sap *sap,
-					   const struct llc_addr *laddr)
-{
-	return &sap->sk_laddr_hash[llc_sk_laddr_hashfn(sap, laddr)];
-}
-
-#define LLC_DEST_INVALID         0      /* Invalid LLC PDU type */
-#define LLC_DEST_SAP             1      /* Type 1 goes here */
-#define LLC_DEST_CONN            2      /* Type 2 goes here */
-
-extern struct list_head llc_sap_list;
-
 int llc_rcv(struct sk_buff *skb, struct net_device *dev, struct packet_type *pt,
 	    struct net_device *orig_dev);
 
 int llc_mac_hdr_init(struct sk_buff *skb, const unsigned char *sa,
 		     const unsigned char *da);
 
-void llc_add_pack(int type,
-		  void (*handler)(struct llc_sap *sap, struct sk_buff *skb));
-void llc_remove_pack(int type);
-
-void llc_set_station_handler(void (*handler)(struct sk_buff *skb));
-
 struct llc_sap *llc_sap_open(unsigned char lsap,
 			     int (*rcv)(struct sk_buff *skb,
 					struct net_device *dev,
 					struct packet_type *pt,
 					struct net_device *orig_dev));
-static inline void llc_sap_hold(struct llc_sap *sap)
-{
-	refcount_inc(&sap->refcnt);
-}
 
 static inline bool llc_sap_hold_safe(struct llc_sap *sap)
 {
@@ -130,30 +62,4 @@ struct llc_sap *llc_sap_find(unsigned char sap_value);
 
 int llc_build_and_send_ui_pkt(struct llc_sap *sap, struct sk_buff *skb,
 			      const unsigned char *dmac, unsigned char dsap);
-
-void llc_sap_handler(struct llc_sap *sap, struct sk_buff *skb);
-void llc_conn_handler(struct llc_sap *sap, struct sk_buff *skb);
-
-void llc_station_init(void);
-void llc_station_exit(void);
-
-#ifdef CONFIG_PROC_FS
-int llc_proc_init(void);
-void llc_proc_exit(void);
-#else
-#define llc_proc_init()	(0)
-#define llc_proc_exit()	do { } while(0)
-#endif /* CONFIG_PROC_FS */
-#ifdef CONFIG_SYSCTL
-int llc_sysctl_init(void);
-void llc_sysctl_exit(void);
-
-extern int sysctl_llc2_ack_timeout;
-extern int sysctl_llc2_busy_timeout;
-extern int sysctl_llc2_p_timeout;
-extern int sysctl_llc2_rej_timeout;
-#else
-#define llc_sysctl_init() (0)
-#define llc_sysctl_exit() do { } while(0)
-#endif /* CONFIG_SYSCTL */
 #endif /* LLC_H */
diff --git a/include/net/llc_c_ac.h b/include/net/llc_c_ac.h
deleted file mode 100644
index af31a49bebb0..000000000000
--- a/include/net/llc_c_ac.h
+++ /dev/null
@@ -1,180 +0,0 @@
-/* SPDX-License-Identifier: GPL-2.0 */
-#ifndef LLC_C_AC_H
-#define LLC_C_AC_H
-/*
- * Copyright (c) 1997 by Procom Technology,Inc.
- * 		 2001 by Arnaldo Carvalho de Melo <acme@conectiva.com.br>
- */
-/* Connection component state transition actions */
-/*
- * Connection state transition actions
- * (Fb = F bit; Pb = P bit; Xb = X bit)
- */
-
-#include <linux/types.h>
-
-struct sk_buff;
-struct sock;
-struct timer_list;
-
-#define LLC_CONN_AC_CLR_REMOTE_BUSY			 1
-#define LLC_CONN_AC_CONN_IND				 2
-#define LLC_CONN_AC_CONN_CONFIRM			 3
-#define LLC_CONN_AC_DATA_IND				 4
-#define LLC_CONN_AC_DISC_IND				 5
-#define LLC_CONN_AC_RESET_IND				 6
-#define LLC_CONN_AC_RESET_CONFIRM			 7
-#define LLC_CONN_AC_REPORT_STATUS			 8
-#define LLC_CONN_AC_CLR_REMOTE_BUSY_IF_Fb_EQ_1		 9
-#define LLC_CONN_AC_STOP_REJ_TMR_IF_DATA_FLAG_EQ_2	10
-#define LLC_CONN_AC_SEND_DISC_CMD_Pb_SET_X		11
-#define LLC_CONN_AC_SEND_DM_RSP_Fb_SET_Pb		12
-#define LLC_CONN_AC_SEND_DM_RSP_Fb_SET_1		13
-#define LLC_CONN_AC_SEND_DM_RSP_Fb_SET_F_FLAG		14
-#define LLC_CONN_AC_SEND_FRMR_RSP_Fb_SET_X		15
-#define LLC_CONN_AC_RESEND_FRMR_RSP_Fb_SET_0		16
-#define LLC_CONN_AC_RESEND_FRMR_RSP_Fb_SET_Pb		17
-#define LLC_CONN_AC_SEND_I_CMD_Pb_SET_1			18
-#define LLC_CONN_AC_RESEND_I_CMD_Pb_SET_1		19
-#define LLC_CONN_AC_RESEND_I_CMD_Pb_SET_1_OR_SEND_RR	20
-#define LLC_CONN_AC_SEND_I_XXX_Xb_SET_0			21
-#define LLC_CONN_AC_RESEND_I_XXX_Xb_SET_0		22
-#define LLC_CONN_AC_RESEND_I_XXX_Xb_SET_0_OR_SEND_RR	23
-#define LLC_CONN_AC_RESEND_I_RSP_Fb_SET_1		24
-#define LLC_CONN_AC_SEND_REJ_CMD_Pb_SET_1		25
-#define LLC_CONN_AC_SEND_REJ_RSP_Fb_SET_1		26
-#define LLC_CONN_AC_SEND_REJ_XXX_Xb_SET_0		27
-#define LLC_CONN_AC_SEND_RNR_CMD_Pb_SET_1		28
-#define LLC_CONN_AC_SEND_RNR_RSP_Fb_SET_1		29
-#define LLC_CONN_AC_SEND_RNR_XXX_Xb_SET_0		30
-#define LLC_CONN_AC_SET_REMOTE_BUSY			31
-#define LLC_CONN_AC_OPTIONAL_SEND_RNR_XXX_Xb_SET_0	32
-#define LLC_CONN_AC_SEND_RR_CMD_Pb_SET_1		33
-#define LLC_CONN_AC_SEND_ACK_CMD_Pb_SET_1		34
-#define LLC_CONN_AC_SEND_RR_RSP_Fb_SET_1		35
-#define LLC_CONN_AC_SEND_ACK_RSP_Fb_SET_1		36
-#define LLC_CONN_AC_SEND_RR_XXX_Xb_SET_0		37
-#define LLC_CONN_AC_SEND_ACK_XXX_Xb_SET_0		38
-#define LLC_CONN_AC_SEND_SABME_CMD_Pb_SET_X		39
-#define LLC_CONN_AC_SEND_UA_RSP_Fb_SET_Pb		40
-#define LLC_CONN_AC_SEND_UA_RSP_Fb_SET_F_FLAG		41
-#define LLC_CONN_AC_S_FLAG_SET_0			42
-#define LLC_CONN_AC_S_FLAG_SET_1			43
-#define LLC_CONN_AC_START_P_TMR				44
-#define LLC_CONN_AC_START_ACK_TMR			45
-#define LLC_CONN_AC_START_REJ_TMR			46
-#define LLC_CONN_AC_START_ACK_TMR_IF_NOT_RUNNING	47
-#define LLC_CONN_AC_STOP_ACK_TMR			48
-#define LLC_CONN_AC_STOP_P_TMR				49
-#define LLC_CONN_AC_STOP_REJ_TMR			50
-#define LLC_CONN_AC_STOP_ALL_TMRS			51
-#define LLC_CONN_AC_STOP_OTHER_TMRS			52
-#define LLC_CONN_AC_UPDATE_Nr_RECEIVED			53
-#define LLC_CONN_AC_UPDATE_P_FLAG			54
-#define LLC_CONN_AC_DATA_FLAG_SET_2			55
-#define LLC_CONN_AC_DATA_FLAG_SET_0			56
-#define LLC_CONN_AC_DATA_FLAG_SET_1			57
-#define LLC_CONN_AC_DATA_FLAG_SET_1_IF_DATA_FLAG_EQ_0	58
-#define LLC_CONN_AC_P_FLAG_SET_0			59
-#define LLC_CONN_AC_P_FLAG_SET_P			60
-#define LLC_CONN_AC_REMOTE_BUSY_SET_0			61
-#define LLC_CONN_AC_RETRY_CNT_SET_0			62
-#define LLC_CONN_AC_RETRY_CNT_INC_BY_1			63
-#define LLC_CONN_AC_Vr_SET_0				64
-#define LLC_CONN_AC_Vr_INC_BY_1				65
-#define LLC_CONN_AC_Vs_SET_0				66
-#define LLC_CONN_AC_Vs_SET_Nr				67
-#define LLC_CONN_AC_F_FLAG_SET_P			68
-#define LLC_CONN_AC_STOP_SENDACK_TMR			70
-#define LLC_CONN_AC_START_SENDACK_TMR_IF_NOT_RUNNING	71
-
-typedef int (*llc_conn_action_t)(struct sock *sk, struct sk_buff *skb);
-
-int llc_conn_ac_clear_remote_busy(struct sock *sk, struct sk_buff *skb);
-int llc_conn_ac_conn_ind(struct sock *sk, struct sk_buff *skb);
-int llc_conn_ac_conn_confirm(struct sock *sk, struct sk_buff *skb);
-int llc_conn_ac_data_ind(struct sock *sk, struct sk_buff *skb);
-int llc_conn_ac_disc_ind(struct sock *sk, struct sk_buff *skb);
-int llc_conn_ac_rst_ind(struct sock *sk, struct sk_buff *skb);
-int llc_conn_ac_rst_confirm(struct sock *sk, struct sk_buff *skb);
-int llc_conn_ac_clear_remote_busy_if_f_eq_1(struct sock *sk,
-					    struct sk_buff *skb);
-int llc_conn_ac_stop_rej_tmr_if_data_flag_eq_2(struct sock *sk,
-					       struct sk_buff *skb);
-int llc_conn_ac_send_disc_cmd_p_set_x(struct sock *sk, struct sk_buff *skb);
-int llc_conn_ac_send_dm_rsp_f_set_p(struct sock *sk, struct sk_buff *skb);
-int llc_conn_ac_send_dm_rsp_f_set_1(struct sock *sk, struct sk_buff *skb);
-int llc_conn_ac_send_frmr_rsp_f_set_x(struct sock *sk, struct sk_buff *skb);
-int llc_conn_ac_resend_frmr_rsp_f_set_0(struct sock *sk, struct sk_buff *skb);
-int llc_conn_ac_resend_frmr_rsp_f_set_p(struct sock *sk, struct sk_buff *skb);
-int llc_conn_ac_send_i_cmd_p_set_1(struct sock *sk, struct sk_buff *skb);
-int llc_conn_ac_send_i_xxx_x_set_0(struct sock *sk, struct sk_buff *skb);
-int llc_conn_ac_resend_i_xxx_x_set_0(struct sock *sk, struct sk_buff *skb);
-int llc_conn_ac_resend_i_xxx_x_set_0_or_send_rr(struct sock *sk,
-						struct sk_buff *skb);
-int llc_conn_ac_resend_i_rsp_f_set_1(struct sock *sk, struct sk_buff *skb);
-int llc_conn_ac_send_rej_cmd_p_set_1(struct sock *sk, struct sk_buff *skb);
-int llc_conn_ac_send_rej_rsp_f_set_1(struct sock *sk, struct sk_buff *skb);
-int llc_conn_ac_send_rej_xxx_x_set_0(struct sock *sk, struct sk_buff *skb);
-int llc_conn_ac_send_rnr_cmd_p_set_1(struct sock *sk, struct sk_buff *skb);
-int llc_conn_ac_send_rnr_rsp_f_set_1(struct sock *sk, struct sk_buff *skb);
-int llc_conn_ac_send_rnr_xxx_x_set_0(struct sock *sk, struct sk_buff *skb);
-int llc_conn_ac_set_remote_busy(struct sock *sk, struct sk_buff *skb);
-int llc_conn_ac_opt_send_rnr_xxx_x_set_0(struct sock *sk, struct sk_buff *skb);
-int llc_conn_ac_send_rr_cmd_p_set_1(struct sock *sk, struct sk_buff *skb);
-int llc_conn_ac_send_rr_rsp_f_set_1(struct sock *sk, struct sk_buff *skb);
-int llc_conn_ac_send_ack_rsp_f_set_1(struct sock *sk, struct sk_buff *skb);
-int llc_conn_ac_send_rr_xxx_x_set_0(struct sock *sk, struct sk_buff *skb);
-int llc_conn_ac_send_ack_xxx_x_set_0(struct sock *sk, struct sk_buff *skb);
-int llc_conn_ac_send_sabme_cmd_p_set_x(struct sock *sk, struct sk_buff *skb);
-int llc_conn_ac_send_ua_rsp_f_set_p(struct sock *sk, struct sk_buff *skb);
-int llc_conn_ac_set_s_flag_0(struct sock *sk, struct sk_buff *skb);
-int llc_conn_ac_set_s_flag_1(struct sock *sk, struct sk_buff *skb);
-int llc_conn_ac_start_p_timer(struct sock *sk, struct sk_buff *skb);
-int llc_conn_ac_start_ack_timer(struct sock *sk, struct sk_buff *skb);
-int llc_conn_ac_start_rej_timer(struct sock *sk, struct sk_buff *skb);
-int llc_conn_ac_start_ack_tmr_if_not_running(struct sock *sk,
-					     struct sk_buff *skb);
-int llc_conn_ac_stop_ack_timer(struct sock *sk, struct sk_buff *skb);
-int llc_conn_ac_stop_p_timer(struct sock *sk, struct sk_buff *skb);
-int llc_conn_ac_stop_rej_timer(struct sock *sk, struct sk_buff *skb);
-int llc_conn_ac_stop_all_timers(struct sock *sk, struct sk_buff *skb);
-int llc_conn_ac_stop_other_timers(struct sock *sk, struct sk_buff *skb);
-int llc_conn_ac_upd_nr_received(struct sock *sk, struct sk_buff *skb);
-int llc_conn_ac_inc_tx_win_size(struct sock *sk, struct sk_buff *skb);
-int llc_conn_ac_dec_tx_win_size(struct sock *sk, struct sk_buff *skb);
-int llc_conn_ac_upd_p_flag(struct sock *sk, struct sk_buff *skb);
-int llc_conn_ac_set_data_flag_2(struct sock *sk, struct sk_buff *skb);
-int llc_conn_ac_set_data_flag_0(struct sock *sk, struct sk_buff *skb);
-int llc_conn_ac_set_data_flag_1(struct sock *sk, struct sk_buff *skb);
-int llc_conn_ac_set_data_flag_1_if_data_flag_eq_0(struct sock *sk,
-						  struct sk_buff *skb);
-int llc_conn_ac_set_p_flag_0(struct sock *sk, struct sk_buff *skb);
-int llc_conn_ac_set_remote_busy_0(struct sock *sk, struct sk_buff *skb);
-int llc_conn_ac_set_retry_cnt_0(struct sock *sk, struct sk_buff *skb);
-int llc_conn_ac_set_cause_flag_0(struct sock *sk, struct sk_buff *skb);
-int llc_conn_ac_set_cause_flag_1(struct sock *sk, struct sk_buff *skb);
-int llc_conn_ac_inc_retry_cnt_by_1(struct sock *sk, struct sk_buff *skb);
-int llc_conn_ac_set_vr_0(struct sock *sk, struct sk_buff *skb);
-int llc_conn_ac_inc_vr_by_1(struct sock *sk, struct sk_buff *skb);
-int llc_conn_ac_set_vs_0(struct sock *sk, struct sk_buff *skb);
-int llc_conn_ac_set_vs_nr(struct sock *sk, struct sk_buff *skb);
-int llc_conn_ac_rst_vs(struct sock *sk, struct sk_buff *skb);
-int llc_conn_ac_upd_vs(struct sock *sk, struct sk_buff *skb);
-int llc_conn_disc(struct sock *sk, struct sk_buff *skb);
-int llc_conn_reset(struct sock *sk, struct sk_buff *skb);
-int llc_conn_ac_disc_confirm(struct sock *sk, struct sk_buff *skb);
-u8 llc_circular_between(u8 a, u8 b, u8 c);
-int llc_conn_ac_send_ack_if_needed(struct sock *sk, struct sk_buff *skb);
-int llc_conn_ac_adjust_npta_by_rr(struct sock *sk, struct sk_buff *skb);
-int llc_conn_ac_adjust_npta_by_rnr(struct sock *sk, struct sk_buff *skb);
-int llc_conn_ac_rst_sendack_flag(struct sock *sk, struct sk_buff *skb);
-int llc_conn_ac_send_i_as_ack(struct sock *sk, struct sk_buff *skb);
-
-void llc_conn_busy_tmr_cb(struct timer_list *t);
-void llc_conn_pf_cycle_tmr_cb(struct timer_list *t);
-void llc_conn_ack_tmr_cb(struct timer_list *t);
-void llc_conn_rej_tmr_cb(struct timer_list *t);
-
-void llc_conn_set_p_flag(struct sock *sk, u8 value);
-#endif /* LLC_C_AC_H */
diff --git a/include/net/llc_c_ev.h b/include/net/llc_c_ev.h
deleted file mode 100644
index d45140d4289a..000000000000
--- a/include/net/llc_c_ev.h
+++ /dev/null
@@ -1,217 +0,0 @@
-/* SPDX-License-Identifier: GPL-2.0 */
-#ifndef LLC_C_EV_H
-#define LLC_C_EV_H
-/*
- * Copyright (c) 1997 by Procom Technology,Inc.
- *		 2001 by Arnaldo Carvalho de Melo <acme@conectiva.com.br>
- */
-
-#include <net/sock.h>
-
-/* Connection component state transition event qualifiers */
-/* Types of events (possible values in 'ev->type') */
-#define LLC_CONN_EV_TYPE_SIMPLE		 1
-#define LLC_CONN_EV_TYPE_CONDITION	 2
-#define LLC_CONN_EV_TYPE_PRIM		 3
-#define LLC_CONN_EV_TYPE_PDU		 4	/* command/response PDU */
-#define LLC_CONN_EV_TYPE_ACK_TMR	 5
-#define LLC_CONN_EV_TYPE_P_TMR		 6
-#define LLC_CONN_EV_TYPE_REJ_TMR	 7
-#define LLC_CONN_EV_TYPE_BUSY_TMR	 8
-#define LLC_CONN_EV_TYPE_RPT_STATUS	 9
-#define LLC_CONN_EV_TYPE_SENDACK_TMR	10
-
-#define NBR_CONN_EV		   5
-/* Connection events which cause state transitions when fully qualified */
-
-#define LLC_CONN_EV_CONN_REQ				 1
-#define LLC_CONN_EV_CONN_RESP				 2
-#define LLC_CONN_EV_DATA_REQ				 3
-#define LLC_CONN_EV_DISC_REQ				 4
-#define LLC_CONN_EV_RESET_REQ				 5
-#define LLC_CONN_EV_RESET_RESP				 6
-#define LLC_CONN_EV_LOCAL_BUSY_DETECTED			 7
-#define LLC_CONN_EV_LOCAL_BUSY_CLEARED			 8
-#define LLC_CONN_EV_RX_BAD_PDU				 9
-#define LLC_CONN_EV_RX_DISC_CMD_Pbit_SET_X		10
-#define LLC_CONN_EV_RX_DM_RSP_Fbit_SET_X		11
-#define LLC_CONN_EV_RX_FRMR_RSP_Fbit_SET_X		12
-#define LLC_CONN_EV_RX_I_CMD_Pbit_SET_X			13
-#define LLC_CONN_EV_RX_I_CMD_Pbit_SET_X_UNEXPD_Ns	14
-#define LLC_CONN_EV_RX_I_CMD_Pbit_SET_X_INVAL_Ns	15
-#define LLC_CONN_EV_RX_I_RSP_Fbit_SET_X			16
-#define LLC_CONN_EV_RX_I_RSP_Fbit_SET_X_UNEXPD_Ns	17
-#define LLC_CONN_EV_RX_I_RSP_Fbit_SET_X_INVAL_Ns	18
-#define LLC_CONN_EV_RX_REJ_CMD_Pbit_SET_X		19
-#define LLC_CONN_EV_RX_REJ_RSP_Fbit_SET_X		20
-#define LLC_CONN_EV_RX_RNR_CMD_Pbit_SET_X		21
-#define LLC_CONN_EV_RX_RNR_RSP_Fbit_SET_X		22
-#define LLC_CONN_EV_RX_RR_CMD_Pbit_SET_X		23
-#define LLC_CONN_EV_RX_RR_RSP_Fbit_SET_X		24
-#define LLC_CONN_EV_RX_SABME_CMD_Pbit_SET_X		25
-#define LLC_CONN_EV_RX_UA_RSP_Fbit_SET_X		26
-#define LLC_CONN_EV_RX_XXX_CMD_Pbit_SET_X		27
-#define LLC_CONN_EV_RX_XXX_RSP_Fbit_SET_X		28
-#define LLC_CONN_EV_RX_XXX_YYY				29
-#define LLC_CONN_EV_RX_ZZZ_CMD_Pbit_SET_X_INVAL_Nr	30
-#define LLC_CONN_EV_RX_ZZZ_RSP_Fbit_SET_X_INVAL_Nr	31
-#define LLC_CONN_EV_P_TMR_EXP				32
-#define LLC_CONN_EV_ACK_TMR_EXP				33
-#define LLC_CONN_EV_REJ_TMR_EXP				34
-#define LLC_CONN_EV_BUSY_TMR_EXP			35
-#define LLC_CONN_EV_RX_XXX_CMD_Pbit_SET_1		36
-#define LLC_CONN_EV_RX_XXX_CMD_Pbit_SET_0		37
-#define LLC_CONN_EV_RX_I_CMD_Pbit_SET_0_UNEXPD_Ns	38
-#define LLC_CONN_EV_RX_I_RSP_Fbit_SET_0_UNEXPD_Ns	39
-#define LLC_CONN_EV_RX_I_RSP_Fbit_SET_1_UNEXPD_Ns	40
-#define LLC_CONN_EV_RX_I_CMD_Pbit_SET_1_UNEXPD_Ns	41
-#define LLC_CONN_EV_RX_I_CMD_Pbit_SET_0			42
-#define LLC_CONN_EV_RX_I_RSP_Fbit_SET_0			43
-#define LLC_CONN_EV_RX_I_CMD_Pbit_SET_1			44
-#define LLC_CONN_EV_RX_RR_CMD_Pbit_SET_0		45
-#define LLC_CONN_EV_RX_RR_RSP_Fbit_SET_0		46
-#define LLC_CONN_EV_RX_RR_RSP_Fbit_SET_1		47
-#define LLC_CONN_EV_RX_RR_CMD_Pbit_SET_1		48
-#define LLC_CONN_EV_RX_RNR_CMD_Pbit_SET_0		49
-#define LLC_CONN_EV_RX_RNR_RSP_Fbit_SET_0		50
-#define LLC_CONN_EV_RX_RNR_RSP_Fbit_SET_1		51
-#define LLC_CONN_EV_RX_RNR_CMD_Pbit_SET_1		52
-#define LLC_CONN_EV_RX_REJ_CMD_Pbit_SET_0		53
-#define LLC_CONN_EV_RX_REJ_RSP_Fbit_SET_0		54
-#define LLC_CONN_EV_RX_REJ_CMD_Pbit_SET_1		55
-#define LLC_CONN_EV_RX_I_RSP_Fbit_SET_1			56
-#define LLC_CONN_EV_RX_REJ_RSP_Fbit_SET_1		57
-#define LLC_CONN_EV_RX_XXX_RSP_Fbit_SET_1		58
-#define LLC_CONN_EV_TX_BUFF_FULL			59
-
-#define LLC_CONN_EV_INIT_P_F_CYCLE			100
-/*
- * Connection event qualifiers; for some events a certain combination of
- * these qualifiers must be TRUE before event recognized valid for state;
- * these constants act as indexes into the Event Qualifier function
- * table
- */
-#define LLC_CONN_EV_QFY_DATA_FLAG_EQ_1		 1
-#define LLC_CONN_EV_QFY_DATA_FLAG_EQ_0		 2
-#define LLC_CONN_EV_QFY_DATA_FLAG_EQ_2		 3
-#define LLC_CONN_EV_QFY_P_FLAG_EQ_1		 4
-#define LLC_CONN_EV_QFY_P_FLAG_EQ_0		 5
-#define LLC_CONN_EV_QFY_P_FLAG_EQ_Fbit		 6
-#define LLC_CONN_EV_QFY_REMOTE_BUSY_EQ_0	 7
-#define LLC_CONN_EV_QFY_RETRY_CNT_LT_N2		 8
-#define LLC_CONN_EV_QFY_RETRY_CNT_GTE_N2	 9
-#define LLC_CONN_EV_QFY_S_FLAG_EQ_1		10
-#define LLC_CONN_EV_QFY_S_FLAG_EQ_0		11
-#define LLC_CONN_EV_QFY_INIT_P_F_CYCLE		12
-
-struct llc_conn_state_ev {
-	u8 type;
-	u8 prim;
-	u8 prim_type;
-	u8 reason;
-	u8 status;
-	u8 ind_prim;
-	u8 cfm_prim;
-};
-
-static __inline__ struct llc_conn_state_ev *llc_conn_ev(struct sk_buff *skb)
-{
-	return (struct llc_conn_state_ev *)skb->cb;
-}
-
-typedef int (*llc_conn_ev_t)(struct sock *sk, struct sk_buff *skb);
-typedef int (*llc_conn_ev_qfyr_t)(struct sock *sk, struct sk_buff *skb);
-
-int llc_conn_ev_conn_req(struct sock *sk, struct sk_buff *skb);
-int llc_conn_ev_data_req(struct sock *sk, struct sk_buff *skb);
-int llc_conn_ev_disc_req(struct sock *sk, struct sk_buff *skb);
-int llc_conn_ev_rst_req(struct sock *sk, struct sk_buff *skb);
-int llc_conn_ev_local_busy_detected(struct sock *sk, struct sk_buff *skb);
-int llc_conn_ev_local_busy_cleared(struct sock *sk, struct sk_buff *skb);
-int llc_conn_ev_rx_bad_pdu(struct sock *sk, struct sk_buff *skb);
-int llc_conn_ev_rx_disc_cmd_pbit_set_x(struct sock *sk, struct sk_buff *skb);
-int llc_conn_ev_rx_dm_rsp_fbit_set_x(struct sock *sk, struct sk_buff *skb);
-int llc_conn_ev_rx_frmr_rsp_fbit_set_x(struct sock *sk, struct sk_buff *skb);
-int llc_conn_ev_rx_i_cmd_pbit_set_x_inval_ns(struct sock *sk,
-					     struct sk_buff *skb);
-int llc_conn_ev_rx_i_rsp_fbit_set_x(struct sock *sk, struct sk_buff *skb);
-int llc_conn_ev_rx_i_rsp_fbit_set_x_unexpd_ns(struct sock *sk,
-					      struct sk_buff *skb);
-int llc_conn_ev_rx_i_rsp_fbit_set_x_inval_ns(struct sock *sk,
-					     struct sk_buff *skb);
-int llc_conn_ev_rx_rej_rsp_fbit_set_x(struct sock *sk, struct sk_buff *skb);
-int llc_conn_ev_rx_sabme_cmd_pbit_set_x(struct sock *sk, struct sk_buff *skb);
-int llc_conn_ev_rx_ua_rsp_fbit_set_x(struct sock *sk, struct sk_buff *skb);
-int llc_conn_ev_rx_xxx_cmd_pbit_set_x(struct sock *sk, struct sk_buff *skb);
-int llc_conn_ev_rx_xxx_rsp_fbit_set_x(struct sock *sk, struct sk_buff *skb);
-int llc_conn_ev_rx_zzz_cmd_pbit_set_x_inval_nr(struct sock *sk,
-					       struct sk_buff *skb);
-int llc_conn_ev_rx_zzz_rsp_fbit_set_x_inval_nr(struct sock *sk,
-					       struct sk_buff *skb);
-int llc_conn_ev_p_tmr_exp(struct sock *sk, struct sk_buff *skb);
-int llc_conn_ev_ack_tmr_exp(struct sock *sk, struct sk_buff *skb);
-int llc_conn_ev_rej_tmr_exp(struct sock *sk, struct sk_buff *skb);
-int llc_conn_ev_busy_tmr_exp(struct sock *sk, struct sk_buff *skb);
-/* NOT_USED functions and their variations */
-int llc_conn_ev_rx_xxx_cmd_pbit_set_1(struct sock *sk, struct sk_buff *skb);
-int llc_conn_ev_rx_xxx_rsp_fbit_set_1(struct sock *sk, struct sk_buff *skb);
-int llc_conn_ev_rx_i_cmd_pbit_set_0_unexpd_ns(struct sock *sk,
-					      struct sk_buff *skb);
-int llc_conn_ev_rx_i_cmd_pbit_set_1_unexpd_ns(struct sock *sk,
-					      struct sk_buff *skb);
-int llc_conn_ev_rx_i_cmd_pbit_set_0(struct sock *sk, struct sk_buff *skb);
-int llc_conn_ev_rx_i_cmd_pbit_set_1(struct sock *sk, struct sk_buff *skb);
-int llc_conn_ev_rx_i_rsp_fbit_set_0_unexpd_ns(struct sock *sk,
-					      struct sk_buff *skb);
-int llc_conn_ev_rx_i_rsp_fbit_set_1_unexpd_ns(struct sock *sk,
-					      struct sk_buff *skb);
-int llc_conn_ev_rx_i_rsp_fbit_set_0(struct sock *sk, struct sk_buff *skb);
-int llc_conn_ev_rx_i_rsp_fbit_set_1(struct sock *sk, struct sk_buff *skb);
-int llc_conn_ev_rx_rr_cmd_pbit_set_0(struct sock *sk, struct sk_buff *skb);
-int llc_conn_ev_rx_rr_cmd_pbit_set_1(struct sock *sk, struct sk_buff *skb);
-int llc_conn_ev_rx_rr_rsp_fbit_set_0(struct sock *sk, struct sk_buff *skb);
-int llc_conn_ev_rx_rr_rsp_fbit_set_1(struct sock *sk, struct sk_buff *skb);
-int llc_conn_ev_rx_rnr_cmd_pbit_set_0(struct sock *sk, struct sk_buff *skb);
-int llc_conn_ev_rx_rnr_cmd_pbit_set_1(struct sock *sk, struct sk_buff *skb);
-int llc_conn_ev_rx_rnr_rsp_fbit_set_0(struct sock *sk, struct sk_buff *skb);
-int llc_conn_ev_rx_rnr_rsp_fbit_set_1(struct sock *sk, struct sk_buff *skb);
-int llc_conn_ev_rx_rej_cmd_pbit_set_0(struct sock *sk, struct sk_buff *skb);
-int llc_conn_ev_rx_rej_cmd_pbit_set_1(struct sock *sk, struct sk_buff *skb);
-int llc_conn_ev_rx_rej_rsp_fbit_set_0(struct sock *sk, struct sk_buff *skb);
-int llc_conn_ev_rx_rej_rsp_fbit_set_1(struct sock *sk, struct sk_buff *skb);
-int llc_conn_ev_rx_any_frame(struct sock *sk, struct sk_buff *skb);
-int llc_conn_ev_tx_buffer_full(struct sock *sk, struct sk_buff *skb);
-int llc_conn_ev_init_p_f_cycle(struct sock *sk, struct sk_buff *skb);
-
-/* Available connection action qualifiers */
-int llc_conn_ev_qlfy_data_flag_eq_1(struct sock *sk, struct sk_buff *skb);
-int llc_conn_ev_qlfy_data_flag_eq_0(struct sock *sk, struct sk_buff *skb);
-int llc_conn_ev_qlfy_data_flag_eq_2(struct sock *sk, struct sk_buff *skb);
-int llc_conn_ev_qlfy_p_flag_eq_1(struct sock *sk, struct sk_buff *skb);
-int llc_conn_ev_qlfy_last_frame_eq_1(struct sock *sk, struct sk_buff *skb);
-int llc_conn_ev_qlfy_last_frame_eq_0(struct sock *sk, struct sk_buff *skb);
-int llc_conn_ev_qlfy_p_flag_eq_0(struct sock *sk, struct sk_buff *skb);
-int llc_conn_ev_qlfy_p_flag_eq_f(struct sock *sk, struct sk_buff *skb);
-int llc_conn_ev_qlfy_remote_busy_eq_0(struct sock *sk, struct sk_buff *skb);
-int llc_conn_ev_qlfy_remote_busy_eq_1(struct sock *sk, struct sk_buff *skb);
-int llc_conn_ev_qlfy_retry_cnt_lt_n2(struct sock *sk, struct sk_buff *skb);
-int llc_conn_ev_qlfy_retry_cnt_gte_n2(struct sock *sk, struct sk_buff *skb);
-int llc_conn_ev_qlfy_s_flag_eq_1(struct sock *sk, struct sk_buff *skb);
-int llc_conn_ev_qlfy_s_flag_eq_0(struct sock *sk, struct sk_buff *skb);
-int llc_conn_ev_qlfy_cause_flag_eq_1(struct sock *sk, struct sk_buff *skb);
-int llc_conn_ev_qlfy_cause_flag_eq_0(struct sock *sk, struct sk_buff *skb);
-int llc_conn_ev_qlfy_set_status_conn(struct sock *sk, struct sk_buff *skb);
-int llc_conn_ev_qlfy_set_status_disc(struct sock *sk, struct sk_buff *skb);
-int llc_conn_ev_qlfy_set_status_failed(struct sock *sk, struct sk_buff *skb);
-int llc_conn_ev_qlfy_set_status_remote_busy(struct sock *sk,
-					    struct sk_buff *skb);
-int llc_conn_ev_qlfy_set_status_refuse(struct sock *sk, struct sk_buff *skb);
-int llc_conn_ev_qlfy_set_status_conflict(struct sock *sk, struct sk_buff *skb);
-int llc_conn_ev_qlfy_set_status_rst_done(struct sock *sk, struct sk_buff *skb);
-
-static __inline__ int llc_conn_space(struct sock *sk, struct sk_buff *skb)
-{
-	return atomic_read(&sk->sk_rmem_alloc) + skb->truesize <
-	       (unsigned int)sk->sk_rcvbuf;
-}
-#endif /* LLC_C_EV_H */
diff --git a/include/net/llc_c_st.h b/include/net/llc_c_st.h
deleted file mode 100644
index f52a4cc4880d..000000000000
--- a/include/net/llc_c_st.h
+++ /dev/null
@@ -1,46 +0,0 @@
-/* SPDX-License-Identifier: GPL-2.0 */
-#ifndef LLC_C_ST_H
-#define LLC_C_ST_H
-/*
- * Copyright (c) 1997 by Procom Technology,Inc.
- *		2001 by Arnaldo Carvalho de Melo <acme@conectiva.com.br>
- */
-
-#include <net/llc_c_ac.h>
-#include <net/llc_c_ev.h>
-
-/* Connection component state management */
-/* connection states */
-#define LLC_CONN_OUT_OF_SVC		 0	/* prior to allocation */
- 
-#define LLC_CONN_STATE_ADM		 1	/* disc, initial state */
-#define LLC_CONN_STATE_SETUP		 2	/* disconnected state */
-#define LLC_CONN_STATE_NORMAL		 3	/* connected state */
-#define LLC_CONN_STATE_BUSY		 4	/* connected state */
-#define LLC_CONN_STATE_REJ		 5	/* connected state */
-#define LLC_CONN_STATE_AWAIT		 6	/* connected state */
-#define LLC_CONN_STATE_AWAIT_BUSY	 7	/* connected state */
-#define LLC_CONN_STATE_AWAIT_REJ	 8	/* connected state */
-#define LLC_CONN_STATE_D_CONN		 9	/* disconnected state */
-#define LLC_CONN_STATE_RESET		10	/* disconnected state */
-#define LLC_CONN_STATE_ERROR		11	/* disconnected state */
-#define LLC_CONN_STATE_TEMP		12	/* disconnected state */
-
-#define NBR_CONN_STATES			12	/* size of state table */
-#define NO_STATE_CHANGE			100
-
-/* Connection state table structure */
-struct llc_conn_state_trans {
-	llc_conn_ev_t	   ev;
-	u8		   next_state;
-	const llc_conn_ev_qfyr_t *ev_qualifiers;
-	const llc_conn_action_t  *ev_actions;
-};
-
-struct llc_conn_state {
-	u8				  current_state;
-	const struct llc_conn_state_trans **transitions;
-};
-
-extern struct llc_conn_state llc_conn_state_table[];
-#endif /* LLC_C_ST_H */
diff --git a/include/net/llc_conn.h b/include/net/llc_conn.h
deleted file mode 100644
index e1a302696723..000000000000
--- a/include/net/llc_conn.h
+++ /dev/null
@@ -1,114 +0,0 @@
-/* SPDX-License-Identifier: GPL-2.0 */
-#ifndef LLC_CONN_H
-#define LLC_CONN_H
-/*
- * Copyright (c) 1997 by Procom Technology, Inc.
- * 		 2001, 2002 by Arnaldo Carvalho de Melo <acme@conectiva.com.br>
- */
-#include <linux/timer.h>
-#include <net/llc_if.h>
-#include <net/sock.h>
-#include <linux/llc.h>
-
-#define LLC_EVENT                1
-#define LLC_PACKET               2
-
-#define LLC2_P_TIME               2
-#define LLC2_ACK_TIME             1
-#define LLC2_REJ_TIME             3
-#define LLC2_BUSY_TIME            3
-
-struct llc_timer {
-	struct timer_list timer;
-	unsigned long	  expire;	/* timer expire time */
-};
-
-struct llc_sock {
-	/* struct sock must be the first member of llc_sock */
-	struct sock	    sk;
-	struct sockaddr_llc addr;		/* address sock is bound to */
-	u8		    state;		/* state of connection */
-	struct llc_sap	    *sap;		/* pointer to parent SAP */
-	struct llc_addr	    laddr;		/* lsap/mac pair */
-	struct llc_addr	    daddr;		/* dsap/mac pair */
-	struct net_device   *dev;		/* device to send to remote */
-	netdevice_tracker   dev_tracker;
-	u32		    copied_seq;		/* head of yet unread data */
-	u8		    retry_count;	/* number of retries */
-	u8		    ack_must_be_send;
-	u8		    first_pdu_Ns;
-	u8		    npta;
-	struct llc_timer    ack_timer;
-	struct llc_timer    pf_cycle_timer;
-	struct llc_timer    rej_sent_timer;
-	struct llc_timer    busy_state_timer;	/* ind busy clr at remote LLC */
-	u8		    vS;			/* seq# next in-seq I-PDU tx'd*/
-	u8		    vR;			/* seq# next in-seq I-PDU rx'd*/
-	u32		    n2;			/* max nbr re-tx's for timeout*/
-	u32		    n1;			/* max nbr octets in I PDU */
-	u8		    k;			/* tx window size; max = 127 */
-	u8		    rw;			/* rx window size; max = 127 */
-	u8		    p_flag;		/* state flags */
-	u8		    f_flag;
-	u8		    s_flag;
-	u8		    data_flag;
-	u8		    remote_busy_flag;
-	u8		    cause_flag;
-	struct sk_buff_head pdu_unack_q;	/* PUDs sent/waiting ack */
-	u16		    link;		/* network layer link number */
-	u8		    X;			/* a temporary variable */
-	u8		    ack_pf;		/* this flag indicates what is
-						   the P-bit of acknowledge */
-	u8		    failed_data_req; /* recognize that already exist a
-						failed llc_data_req_handler
-						(tx_buffer_full or unacceptable
-						state */
-	u8		    dec_step;
-	u8		    inc_cntr;
-	u8		    dec_cntr;
-	u8		    connect_step;
-	u8		    last_nr;	   /* NR of last pdu received */
-	u32		    rx_pdu_hdr;	   /* used for saving header of last pdu
-					      received and caused sending FRMR.
-					      Used for resending FRMR */
-	u32		    cmsg_flags;
-	struct hlist_node   dev_hash_node;
-};
-
-static inline struct llc_sock *llc_sk(const struct sock *sk)
-{
-	return (struct llc_sock *)sk;
-}
-
-static __inline__ void llc_set_backlog_type(struct sk_buff *skb, char type)
-{
-	skb->cb[sizeof(skb->cb) - 1] = type;
-}
-
-static __inline__ char llc_backlog_type(struct sk_buff *skb)
-{
-	return skb->cb[sizeof(skb->cb) - 1];
-}
-
-struct sock *llc_sk_alloc(struct net *net, int family, gfp_t priority,
-			  struct proto *prot, int kern);
-void llc_sk_stop_all_timers(struct sock *sk, bool sync);
-void llc_sk_free(struct sock *sk);
-
-void llc_sk_reset(struct sock *sk);
-
-/* Access to a connection */
-int llc_conn_state_process(struct sock *sk, struct sk_buff *skb);
-void llc_conn_send_pdu(struct sock *sk, struct sk_buff *skb);
-void llc_conn_rtn_pdu(struct sock *sk, struct sk_buff *skb);
-void llc_conn_resend_i_pdu_as_cmd(struct sock *sk, u8 nr, u8 first_p_bit);
-void llc_conn_resend_i_pdu_as_rsp(struct sock *sk, u8 nr, u8 first_f_bit);
-int llc_conn_remove_acked_pdus(struct sock *conn, u8 nr, u16 *how_many_unacked);
-struct sock *llc_lookup_established(struct llc_sap *sap, struct llc_addr *daddr,
-				    struct llc_addr *laddr, const struct net *net);
-void llc_sap_add_socket(struct llc_sap *sap, struct sock *sk);
-void llc_sap_remove_socket(struct llc_sap *sap, struct sock *sk);
-
-u8 llc_data_accept_state(u8 state);
-void llc_build_offset_table(void);
-#endif /* LLC_CONN_H */
diff --git a/include/net/llc_if.h b/include/net/llc_if.h
deleted file mode 100644
index a333259613ab..000000000000
--- a/include/net/llc_if.h
+++ /dev/null
@@ -1,63 +0,0 @@
-/* SPDX-License-Identifier: GPL-2.0 */
-#ifndef LLC_IF_H
-#define LLC_IF_H
-/*
- * Copyright (c) 1997 by Procom Technology,Inc.
- * 		 2001 by Arnaldo Carvalho de Melo <acme@conectiva.com.br>
- */
-/* Defines LLC interface to network layer */
-/* Available primitives */
-#include <linux/if.h>
-#include <linux/if_arp.h>
-#include <linux/llc.h>
-#include <linux/etherdevice.h>
-#include <net/llc.h>
-
-#define LLC_DATAUNIT_PRIM	1
-#define LLC_CONN_PRIM		2
-#define LLC_DATA_PRIM		3
-#define LLC_DISC_PRIM		4
-#define LLC_RESET_PRIM		5
-#define LLC_FLOWCONTROL_PRIM	6 /* Not supported at this time */
-#define LLC_DISABLE_PRIM	7
-#define LLC_XID_PRIM		8
-#define LLC_TEST_PRIM		9
-#define LLC_SAP_ACTIVATION     10
-#define LLC_SAP_DEACTIVATION   11
-
-#define LLC_NBR_PRIMITIVES     11
-
-#define LLC_IND			1
-#define LLC_CONFIRM		2
-
-/* Primitive type */
-#define LLC_PRIM_TYPE_REQ	1
-#define LLC_PRIM_TYPE_IND	2
-#define LLC_PRIM_TYPE_RESP	3
-#define LLC_PRIM_TYPE_CONFIRM	4
-
-/* Reset reasons, remote entity or local LLC */
-#define LLC_RESET_REASON_REMOTE	1
-#define LLC_RESET_REASON_LOCAL	2
-
-/* Disconnect reasons */
-#define LLC_DISC_REASON_RX_DM_RSP_PDU	0
-#define LLC_DISC_REASON_RX_DISC_CMD_PDU	1
-#define LLC_DISC_REASON_ACK_TMR_EXP	2
-
-/* Confirm reasons */
-#define LLC_STATUS_CONN		0 /* connect confirm & reset confirm */
-#define LLC_STATUS_DISC		1 /* connect confirm & reset confirm */
-#define LLC_STATUS_FAILED	2 /* connect confirm & reset confirm */
-#define LLC_STATUS_IMPOSSIBLE	3 /* connect confirm */
-#define LLC_STATUS_RECEIVED	4 /* data conn */
-#define LLC_STATUS_REMOTE_BUSY	5 /* data conn */
-#define LLC_STATUS_REFUSE	6 /* data conn */
-#define LLC_STATUS_CONFLICT	7 /* disconnect conn */
-#define LLC_STATUS_RESET_DONE	8 /*  */
-
-int llc_establish_connection(struct sock *sk, const u8 *lmac, u8 *dmac,
-			     u8 dsap);
-int llc_build_and_send_pkt(struct sock *sk, struct sk_buff *skb);
-int llc_send_disc(struct sock *sk);
-#endif /* LLC_IF_H */
diff --git a/include/net/llc_pdu.h b/include/net/llc_pdu.h
index f165237a3723..14c76b0d9832 100644
--- a/include/net/llc_pdu.h
+++ b/include/net/llc_pdu.h
@@ -6,201 +6,17 @@
  * 		 2001-2003 by Arnaldo Carvalho de Melo <acme@conectiva.com.br>
  */
 
-#include <linux/if_ether.h>
-
-/* Lengths of frame formats */
-#define LLC_PDU_LEN_I		4       /* header and 2 control bytes */
-#define LLC_PDU_LEN_S		4
-#define LLC_PDU_LEN_U		3       /* header and 1 control byte */
-/* header and 1 control byte and XID info */
-#define LLC_PDU_LEN_U_XID	(LLC_PDU_LEN_U + sizeof(struct llc_xid_info))
-/* Known SAP addresses */
-#define LLC_GLOBAL_SAP	0xFF
-#define LLC_NULL_SAP	0x00	/* not network-layer visible */
-#define LLC_MGMT_INDIV	0x02	/* station LLC mgmt indiv addr */
-#define LLC_MGMT_GRP	0x03	/* station LLC mgmt group addr */
-#define LLC_RDE_SAP	0xA6	/* route ... */
-
-/* SAP field bit masks */
-#define LLC_ISO_RESERVED_SAP	0x02
-#define LLC_SAP_GROUP_DSAP	0x01
-#define LLC_SAP_RESP_SSAP	0x01
-
-/* Group/individual DSAP indicator is DSAP field */
-#define LLC_PDU_GROUP_DSAP_MASK    0x01
-#define LLC_PDU_IS_GROUP_DSAP(pdu)      \
-	((pdu->dsap & LLC_PDU_GROUP_DSAP_MASK) ? 0 : 1)
-#define LLC_PDU_IS_INDIV_DSAP(pdu)      \
-	(!(pdu->dsap & LLC_PDU_GROUP_DSAP_MASK) ? 0 : 1)
+#include <linux/skbuff.h>
 
 /* Command/response PDU indicator in SSAP field */
-#define LLC_PDU_CMD_RSP_MASK	0x01
 #define LLC_PDU_CMD		0
 #define LLC_PDU_RSP		1
-#define LLC_PDU_IS_CMD(pdu)    ((pdu->ssap & LLC_PDU_RSP) ? 0 : 1)
-#define LLC_PDU_IS_RSP(pdu)    ((pdu->ssap & LLC_PDU_RSP) ? 1 : 0)
 
 /* Get PDU type from 2 lowest-order bits of control field first byte */
-#define LLC_PDU_TYPE_I_MASK    0x01	/* 16-bit control field */
-#define LLC_PDU_TYPE_S_MASK    0x03
-#define LLC_PDU_TYPE_U_MASK    0x03	/* 8-bit control field */
 #define LLC_PDU_TYPE_MASK      0x03
-
-#define LLC_PDU_TYPE_I		0	/* first bit */
-#define LLC_PDU_TYPE_S		1	/* first two bits */
 #define LLC_PDU_TYPE_U		3	/* first two bits */
-#define LLC_PDU_TYPE_U_XID	4	/* private type for detecting XID commands */
-
-#define LLC_PDU_TYPE_IS_I(pdu) \
-	((!(pdu->ctrl_1 & LLC_PDU_TYPE_I_MASK)) ? 1 : 0)
-
-#define LLC_PDU_TYPE_IS_U(pdu) \
-	(((pdu->ctrl_1 & LLC_PDU_TYPE_U_MASK) == LLC_PDU_TYPE_U) ? 1 : 0)
-
-#define LLC_PDU_TYPE_IS_S(pdu) \
-	(((pdu->ctrl_1 & LLC_PDU_TYPE_S_MASK) == LLC_PDU_TYPE_S) ? 1 : 0)
-
-/* U-format PDU control field masks */
-#define LLC_U_PF_BIT_MASK      0x10	/* P/F bit mask */
-#define LLC_U_PF_IS_1(pdu)     ((pdu->ctrl_1 & LLC_U_PF_BIT_MASK) ? 1 : 0)
-#define LLC_U_PF_IS_0(pdu)     ((!(pdu->ctrl_1 & LLC_U_PF_BIT_MASK)) ? 1 : 0)
-
-#define LLC_U_PDU_CMD_MASK     0xEC	/* cmd/rsp mask */
-#define LLC_U_PDU_CMD(pdu)     (pdu->ctrl_1 & LLC_U_PDU_CMD_MASK)
-#define LLC_U_PDU_RSP(pdu)     (pdu->ctrl_1 & LLC_U_PDU_CMD_MASK)
 
 #define LLC_1_PDU_CMD_UI       0x00	/* Type 1 cmds/rsps */
-#define LLC_1_PDU_CMD_XID      0xAC
-#define LLC_1_PDU_CMD_TEST     0xE0
-
-#define LLC_2_PDU_CMD_SABME    0x6C	/* Type 2 cmds/rsps */
-#define LLC_2_PDU_CMD_DISC     0x40
-#define LLC_2_PDU_RSP_UA       0x60
-#define LLC_2_PDU_RSP_DM       0x0C
-#define LLC_2_PDU_RSP_FRMR     0x84
-
-/* Type 1 operations */
-
-/* XID information field bit masks */
-
-/* LLC format identifier (byte 1) */
-#define LLC_XID_FMT_ID		0x81	/* first byte must be this */
-
-/* LLC types/classes identifier (byte 2) */
-#define LLC_XID_CLASS_ZEROS_MASK	0xE0	/* these must be zeros */
-#define LLC_XID_CLASS_MASK		0x1F	/* AND with byte to get below */
-
-#define LLC_XID_NULL_CLASS_1	0x01	/* if NULL LSAP...use these */
-#define LLC_XID_NULL_CLASS_2	0x03
-#define LLC_XID_NULL_CLASS_3	0x05
-#define LLC_XID_NULL_CLASS_4	0x07
-
-#define LLC_XID_NNULL_TYPE_1	0x01	/* if non-NULL LSAP...use these */
-#define LLC_XID_NNULL_TYPE_2	0x02
-#define LLC_XID_NNULL_TYPE_3	0x04
-#define LLC_XID_NNULL_TYPE_1_2	0x03
-#define LLC_XID_NNULL_TYPE_1_3	0x05
-#define LLC_XID_NNULL_TYPE_2_3	0x06
-#define LLC_XID_NNULL_ALL		0x07
-
-/* Sender Receive Window (byte 3) */
-#define LLC_XID_RW_MASK	0xFE	/* AND with value to get below */
-
-#define LLC_XID_MIN_RW	0x02	/* lowest-order bit always zero */
-
-/* Type 2 operations */
-
-#define LLC_2_SEQ_NBR_MODULO   ((u8) 128)
-
-/* I-PDU masks ('ctrl' is I-PDU control word) */
-#define LLC_I_GET_NS(pdu)     (u8)((pdu->ctrl_1 & 0xFE) >> 1)
-#define LLC_I_GET_NR(pdu)     (u8)((pdu->ctrl_2 & 0xFE) >> 1)
-
-#define LLC_I_PF_BIT_MASK      0x01
-
-#define LLC_I_PF_IS_0(pdu)     ((!(pdu->ctrl_2 & LLC_I_PF_BIT_MASK)) ? 1 : 0)
-#define LLC_I_PF_IS_1(pdu)     ((pdu->ctrl_2 & LLC_I_PF_BIT_MASK) ? 1 : 0)
-
-/* S-PDU supervisory commands and responses */
-
-#define LLC_S_PDU_CMD_MASK     0x0C
-#define LLC_S_PDU_CMD(pdu)     (pdu->ctrl_1 & LLC_S_PDU_CMD_MASK)
-#define LLC_S_PDU_RSP(pdu)     (pdu->ctrl_1 & LLC_S_PDU_CMD_MASK)
-
-#define LLC_2_PDU_CMD_RR       0x00	/* rx ready cmd */
-#define LLC_2_PDU_RSP_RR       0x00	/* rx ready rsp */
-#define LLC_2_PDU_CMD_REJ      0x08	/* reject PDU cmd */
-#define LLC_2_PDU_RSP_REJ      0x08	/* reject PDU rsp */
-#define LLC_2_PDU_CMD_RNR      0x04	/* rx not ready cmd */
-#define LLC_2_PDU_RSP_RNR      0x04	/* rx not ready rsp */
-
-#define LLC_S_PF_BIT_MASK      0x01
-#define LLC_S_PF_IS_0(pdu)     ((!(pdu->ctrl_2 & LLC_S_PF_BIT_MASK)) ? 1 : 0)
-#define LLC_S_PF_IS_1(pdu)     ((pdu->ctrl_2 & LLC_S_PF_BIT_MASK) ? 1 : 0)
-
-#define PDU_SUPV_GET_Nr(pdu)   ((pdu->ctrl_2 & 0xFE) >> 1)
-#define PDU_GET_NEXT_Vr(sn)    (((sn) + 1) & ~LLC_2_SEQ_NBR_MODULO)
-
-/* FRMR information field macros */
-
-#define FRMR_INFO_LENGTH       5	/* 5 bytes of information */
-
-/*
- * info is pointer to FRMR info field structure; 'rej_ctrl' is byte pointer
- * (if U-PDU) or word pointer to rejected PDU control field
- */
-#define FRMR_INFO_SET_REJ_CNTRL(info,rej_ctrl) \
-	info->rej_pdu_ctrl = ((*((u8 *) rej_ctrl) & \
-				LLC_PDU_TYPE_U) != LLC_PDU_TYPE_U ? \
-				(u16)*((u16 *) rej_ctrl) : \
-				(((u16) *((u8 *) rej_ctrl)) & 0x00FF))
-
-/*
- * Info is pointer to FRMR info field structure; 'vs' is a byte containing
- * send state variable value in low-order 7 bits (insure the lowest-order
- * bit remains zero (0))
- */
-#define FRMR_INFO_SET_Vs(info,vs) (info->curr_ssv = (((u8) vs) << 1))
-#define FRMR_INFO_SET_Vr(info,vr) (info->curr_rsv = (((u8) vr) << 1))
-
-/*
- * Info is pointer to FRMR info field structure; 'cr' is a byte containing
- * the C/R bit value in the low-order bit
- */
-#define FRMR_INFO_SET_C_R_BIT(info, cr)  (info->curr_rsv |= (((u8) cr) & 0x01))
-
-/*
- * In the remaining five macros, 'info' is pointer to FRMR info field
- * structure; 'ind' is a byte containing the bit value to set in the
- * lowest-order bit)
- */
-#define FRMR_INFO_SET_INVALID_PDU_CTRL_IND(info, ind) \
-       (info->ind_bits = ((info->ind_bits & 0xFE) | (((u8) ind) & 0x01)))
-
-#define FRMR_INFO_SET_INVALID_PDU_INFO_IND(info, ind) \
-       (info->ind_bits = ( (info->ind_bits & 0xFD) | (((u8) ind) & 0x02)))
-
-#define FRMR_INFO_SET_PDU_INFO_2LONG_IND(info, ind) \
-       (info->ind_bits = ( (info->ind_bits & 0xFB) | (((u8) ind) & 0x04)))
-
-#define FRMR_INFO_SET_PDU_INVALID_Nr_IND(info, ind) \
-       (info->ind_bits = ( (info->ind_bits & 0xF7) | (((u8) ind) & 0x08)))
-
-#define FRMR_INFO_SET_PDU_INVALID_Ns_IND(info, ind) \
-       (info->ind_bits = ( (info->ind_bits & 0xEF) | (((u8) ind) & 0x10)))
-
-/* Sequence-numbered PDU format (4 bytes in length) */
-struct llc_pdu_sn {
-	u8 dsap;
-	u8 ssap;
-	u8 ctrl_1;
-	u8 ctrl_2;
-} __packed;
-
-static inline struct llc_pdu_sn *llc_pdu_sn_hdr(struct sk_buff *skb)
-{
-	return (struct llc_pdu_sn *)skb_network_header(skb);
-}
 
 /* Un-numbered PDU format (3 bytes in length) */
 struct llc_pdu_un {
@@ -217,29 +33,18 @@ static inline struct llc_pdu_un *llc_pdu_un_hdr(struct sk_buff *skb)
 /**
  *	llc_pdu_header_init - initializes pdu header
  *	@skb: input skb that header must be set into it.
- *	@type: type of PDU (U, I or S).
  *	@ssap: source sap.
  *	@dsap: destination sap.
- *	@cr: command/response bit (0 or 1).
+ *	@cr: command/response bit (%LLC_PDU_CMD or %LLC_PDU_RSP).
  *
  *	This function sets DSAP, SSAP and command/Response bit in LLC header.
  */
-static inline void llc_pdu_header_init(struct sk_buff *skb, u8 type,
-				       u8 ssap, u8 dsap, u8 cr)
+static inline void llc_pdu_header_init(struct sk_buff *skb, u8 ssap, u8 dsap,
+				       u8 cr)
 {
-	int hlen = 4; /* default value for I and S types */
 	struct llc_pdu_un *pdu;
 
-	switch (type) {
-	case LLC_PDU_TYPE_U:
-		hlen = 3;
-		break;
-	case LLC_PDU_TYPE_U_XID:
-		hlen = 6;
-		break;
-	}
-
-	skb_push(skb, hlen);
+	skb_push(skb, sizeof(*pdu));
 	skb_reset_network_header(skb);
 	pdu = llc_pdu_un_hdr(skb);
 	pdu->dsap = dsap;
@@ -248,56 +53,6 @@ static inline void llc_pdu_header_init(struct sk_buff *skb, u8 type,
 }
 
 /**
- *	llc_pdu_decode_sa - extracts, source address (MAC) of input frame
- *	@skb: input skb that source address must be extracted from it.
- *	@sa: pointer to source address (6 byte array).
- *
- *	This function extracts source address(MAC) of input frame.
- */
-static inline void llc_pdu_decode_sa(struct sk_buff *skb, u8 *sa)
-{
-	memcpy(sa, eth_hdr(skb)->h_source, ETH_ALEN);
-}
-
-/**
- *	llc_pdu_decode_da - extracts dest address of input frame
- *	@skb: input skb that destination address must be extracted from it
- *	@da: pointer to destination address (6 byte array).
- *
- *	This function extracts destination address(MAC) of input frame.
- */
-static inline void llc_pdu_decode_da(struct sk_buff *skb, u8 *da)
-{
-	memcpy(da, eth_hdr(skb)->h_dest, ETH_ALEN);
-}
-
-/**
- *	llc_pdu_decode_ssap - extracts source SAP of input frame
- *	@skb: input skb that source SAP must be extracted from it.
- *	@ssap: source SAP (output argument).
- *
- *	This function extracts source SAP of input frame. Right bit of SSAP is
- *	command/response bit.
- */
-static inline void llc_pdu_decode_ssap(struct sk_buff *skb, u8 *ssap)
-{
-	*ssap = llc_pdu_un_hdr(skb)->ssap & 0xFE;
-}
-
-/**
- *	llc_pdu_decode_dsap - extracts dest SAP of input frame
- *	@skb: input skb that destination SAP must be extracted from it.
- *	@dsap: destination SAP (output argument).
- *
- *	This function extracts destination SAP of input frame. right bit of
- *	DSAP designates individual/group SAP.
- */
-static inline void llc_pdu_decode_dsap(struct sk_buff *skb, u8 *dsap)
-{
-	*dsap = llc_pdu_un_hdr(skb)->dsap & 0xFE;
-}
-
-/**
  *	llc_pdu_init_as_ui_cmd - sets LLC header as UI PDU
  *	@skb: input skb that header must be set into it.
  *
@@ -311,128 +66,4 @@ static inline void llc_pdu_init_as_ui_cmd(struct sk_buff *skb)
 	pdu->ctrl_1 |= LLC_1_PDU_CMD_UI;
 }
 
-/**
- *	llc_pdu_init_as_test_cmd - sets PDU as TEST
- *	@skb: Address of the skb to build
- *
- * 	Sets a PDU as TEST
- */
-static inline void llc_pdu_init_as_test_cmd(struct sk_buff *skb)
-{
-	struct llc_pdu_un *pdu = llc_pdu_un_hdr(skb);
-
-	pdu->ctrl_1  = LLC_PDU_TYPE_U;
-	pdu->ctrl_1 |= LLC_1_PDU_CMD_TEST;
-	pdu->ctrl_1 |= LLC_U_PF_BIT_MASK;
-}
-
-/**
- *	llc_pdu_init_as_test_rsp - build TEST response PDU
- *	@skb: Address of the skb to build
- *	@ev_skb: The received TEST command PDU frame
- *
- *	Builds a pdu frame as a TEST response.
- */
-static inline void llc_pdu_init_as_test_rsp(struct sk_buff *skb,
-					    struct sk_buff *ev_skb)
-{
-	struct llc_pdu_un *pdu = llc_pdu_un_hdr(skb);
-
-	pdu->ctrl_1  = LLC_PDU_TYPE_U;
-	pdu->ctrl_1 |= LLC_1_PDU_CMD_TEST;
-	pdu->ctrl_1 |= LLC_U_PF_BIT_MASK;
-	if (ev_skb->protocol == htons(ETH_P_802_2)) {
-		struct llc_pdu_un *ev_pdu = llc_pdu_un_hdr(ev_skb);
-		int dsize;
-
-		dsize = ntohs(eth_hdr(ev_skb)->h_proto) - 3;
-		memcpy(((u8 *)pdu) + 3, ((u8 *)ev_pdu) + 3, dsize);
-		skb_put(skb, dsize);
-	}
-}
-
-/* LLC Type 1 XID command/response information fields format */
-struct llc_xid_info {
-	u8 fmt_id;	/* always 0x81 for LLC */
-	u8 type;	/* different if NULL/non-NULL LSAP */
-	u8 rw;		/* sender receive window */
-} __packed;
-
-/**
- *	llc_pdu_init_as_xid_cmd - sets bytes 3, 4 & 5 of LLC header as XID
- *	@skb: input skb that header must be set into it.
- *	@svcs_supported: The class of the LLC (I or II)
- *	@rx_window: The size of the receive window of the LLC
- *
- *	This function sets third,fourth,fifth and sixth bytes of LLC header as
- *	a XID PDU.
- */
-static inline void llc_pdu_init_as_xid_cmd(struct sk_buff *skb,
-					   u8 svcs_supported, u8 rx_window)
-{
-	struct llc_xid_info *xid_info;
-	struct llc_pdu_un *pdu = llc_pdu_un_hdr(skb);
-
-	pdu->ctrl_1	 = LLC_PDU_TYPE_U;
-	pdu->ctrl_1	|= LLC_1_PDU_CMD_XID;
-	pdu->ctrl_1	|= LLC_U_PF_BIT_MASK;
-	xid_info	 = (struct llc_xid_info *)(((u8 *)&pdu->ctrl_1) + 1);
-	xid_info->fmt_id = LLC_XID_FMT_ID;	/* 0x81 */
-	xid_info->type	 = svcs_supported;
-	xid_info->rw	 = rx_window << 1;	/* size of receive window */
-
-	/* no need to push/put since llc_pdu_header_init() has already
-	 * pushed 3 + 3 bytes
-	 */
-}
-
-/**
- *	llc_pdu_init_as_xid_rsp - builds XID response PDU
- *	@skb: Address of the skb to build
- *	@svcs_supported: The class of the LLC (I or II)
- *	@rx_window: The size of the receive window of the LLC
- *
- *	Builds a pdu frame as an XID response.
- */
-static inline void llc_pdu_init_as_xid_rsp(struct sk_buff *skb,
-					   u8 svcs_supported, u8 rx_window)
-{
-	struct llc_xid_info *xid_info;
-	struct llc_pdu_un *pdu = llc_pdu_un_hdr(skb);
-
-	pdu->ctrl_1	 = LLC_PDU_TYPE_U;
-	pdu->ctrl_1	|= LLC_1_PDU_CMD_XID;
-	pdu->ctrl_1	|= LLC_U_PF_BIT_MASK;
-
-	xid_info	 = (struct llc_xid_info *)(((u8 *)&pdu->ctrl_1) + 1);
-	xid_info->fmt_id = LLC_XID_FMT_ID;
-	xid_info->type	 = svcs_supported;
-	xid_info->rw	 = rx_window << 1;
-	skb_put(skb, sizeof(struct llc_xid_info));
-}
-
-/* LLC Type 2 FRMR response information field format */
-struct llc_frmr_info {
-	u16 rej_pdu_ctrl;	/* bits 1-8 if U-PDU */
-	u8  curr_ssv;		/* current send state variable val */
-	u8  curr_rsv;		/* current receive state variable */
-	u8  ind_bits;		/* indicator bits set with macro */
-} __packed;
-
-void llc_pdu_set_cmd_rsp(struct sk_buff *skb, u8 type);
-void llc_pdu_set_pf_bit(struct sk_buff *skb, u8 bit_value);
-void llc_pdu_decode_pf_bit(struct sk_buff *skb, u8 *pf_bit);
-void llc_pdu_init_as_disc_cmd(struct sk_buff *skb, u8 p_bit);
-void llc_pdu_init_as_i_cmd(struct sk_buff *skb, u8 p_bit, u8 ns, u8 nr);
-void llc_pdu_init_as_rej_cmd(struct sk_buff *skb, u8 p_bit, u8 nr);
-void llc_pdu_init_as_rnr_cmd(struct sk_buff *skb, u8 p_bit, u8 nr);
-void llc_pdu_init_as_rr_cmd(struct sk_buff *skb, u8 p_bit, u8 nr);
-void llc_pdu_init_as_sabme_cmd(struct sk_buff *skb, u8 p_bit);
-void llc_pdu_init_as_dm_rsp(struct sk_buff *skb, u8 f_bit);
-void llc_pdu_init_as_frmr_rsp(struct sk_buff *skb, struct llc_pdu_sn *prev_pdu,
-			      u8 f_bit, u8 vs, u8 vr, u8 vzyxw);
-void llc_pdu_init_as_rr_rsp(struct sk_buff *skb, u8 f_bit, u8 nr);
-void llc_pdu_init_as_rej_rsp(struct sk_buff *skb, u8 f_bit, u8 nr);
-void llc_pdu_init_as_rnr_rsp(struct sk_buff *skb, u8 f_bit, u8 nr);
-void llc_pdu_init_as_ua_rsp(struct sk_buff *skb, u8 f_bit);
 #endif /* LLC_PDU_H */
diff --git a/include/net/llc_s_ac.h b/include/net/llc_s_ac.h
deleted file mode 100644
index 076adc5217fd..000000000000
--- a/include/net/llc_s_ac.h
+++ /dev/null
@@ -1,35 +0,0 @@
-/* SPDX-License-Identifier: GPL-2.0 */
-#ifndef LLC_S_AC_H
-#define LLC_S_AC_H
-/*
- * Copyright (c) 1997 by Procom Technology,Inc.
- * 		 2001 by Arnaldo Carvalho de Melo <acme@conectiva.com.br>
- */
-
-struct llc_sap;
-struct sk_buff;
-
-/* SAP component actions */
-#define SAP_ACT_UNITDATA_IND	1
-#define SAP_ACT_SEND_UI		2
-#define SAP_ACT_SEND_XID_C	3
-#define SAP_ACT_SEND_XID_R	4
-#define SAP_ACT_SEND_TEST_C	5
-#define SAP_ACT_SEND_TEST_R	6
-#define SAP_ACT_REPORT_STATUS	7
-#define SAP_ACT_XID_IND		8
-#define SAP_ACT_TEST_IND	9
-
-/* All action functions must look like this */
-typedef int (*llc_sap_action_t)(struct llc_sap *sap, struct sk_buff *skb);
-
-int llc_sap_action_unitdata_ind(struct llc_sap *sap, struct sk_buff *skb);
-int llc_sap_action_send_ui(struct llc_sap *sap, struct sk_buff *skb);
-int llc_sap_action_send_xid_c(struct llc_sap *sap, struct sk_buff *skb);
-int llc_sap_action_send_xid_r(struct llc_sap *sap, struct sk_buff *skb);
-int llc_sap_action_send_test_c(struct llc_sap *sap, struct sk_buff *skb);
-int llc_sap_action_send_test_r(struct llc_sap *sap, struct sk_buff *skb);
-int llc_sap_action_report_status(struct llc_sap *sap, struct sk_buff *skb);
-int llc_sap_action_xid_ind(struct llc_sap *sap, struct sk_buff *skb);
-int llc_sap_action_test_ind(struct llc_sap *sap, struct sk_buff *skb);
-#endif /* LLC_S_AC_H */
diff --git a/include/net/llc_s_ev.h b/include/net/llc_s_ev.h
deleted file mode 100644
index 7b9c94093336..000000000000
--- a/include/net/llc_s_ev.h
+++ /dev/null
@@ -1,61 +0,0 @@
-/* SPDX-License-Identifier: GPL-2.0 */
-#ifndef LLC_S_EV_H
-#define LLC_S_EV_H
-/*
- * Copyright (c) 1997 by Procom Technology,Inc.
- * 		 2001 by Arnaldo Carvalho de Melo <acme@conectiva.com.br>
- */
-
-#include <linux/skbuff.h>
-#include <net/llc.h>
-
-/* Defines SAP component events */
-/* Types of events (possible values in 'ev->type') */
-#define LLC_SAP_EV_TYPE_SIMPLE		1
-#define LLC_SAP_EV_TYPE_CONDITION	2
-#define LLC_SAP_EV_TYPE_PRIM		3
-#define LLC_SAP_EV_TYPE_PDU		4   /* command/response PDU */
-#define LLC_SAP_EV_TYPE_ACK_TMR		5
-#define LLC_SAP_EV_TYPE_RPT_STATUS	6
-
-#define LLC_SAP_EV_ACTIVATION_REQ	 1
-#define LLC_SAP_EV_RX_UI		 2
-#define LLC_SAP_EV_UNITDATA_REQ		 3
-#define LLC_SAP_EV_XID_REQ		 4
-#define LLC_SAP_EV_RX_XID_C		 5
-#define LLC_SAP_EV_RX_XID_R		 6
-#define LLC_SAP_EV_TEST_REQ		 7
-#define LLC_SAP_EV_RX_TEST_C		 8
-#define LLC_SAP_EV_RX_TEST_R		 9
-#define LLC_SAP_EV_DEACTIVATION_REQ	10
-
-struct llc_sap_state_ev {
-	u8		prim;
-	u8		prim_type;
-	u8		type;
-	u8		reason;
-	u8		ind_cfm_flag;
-	struct llc_addr saddr;
-	struct llc_addr daddr;
-};
-
-static __inline__ struct llc_sap_state_ev *llc_sap_ev(struct sk_buff *skb)
-{
-	return (struct llc_sap_state_ev *)skb->cb;
-}
-
-struct llc_sap;
-
-typedef int (*llc_sap_ev_t)(struct llc_sap *sap, struct sk_buff *skb);
-
-int llc_sap_ev_activation_req(struct llc_sap *sap, struct sk_buff *skb);
-int llc_sap_ev_rx_ui(struct llc_sap *sap, struct sk_buff *skb);
-int llc_sap_ev_unitdata_req(struct llc_sap *sap, struct sk_buff *skb);
-int llc_sap_ev_xid_req(struct llc_sap *sap, struct sk_buff *skb);
-int llc_sap_ev_rx_xid_c(struct llc_sap *sap, struct sk_buff *skb);
-int llc_sap_ev_rx_xid_r(struct llc_sap *sap, struct sk_buff *skb);
-int llc_sap_ev_test_req(struct llc_sap *sap, struct sk_buff *skb);
-int llc_sap_ev_rx_test_c(struct llc_sap *sap, struct sk_buff *skb);
-int llc_sap_ev_rx_test_r(struct llc_sap *sap, struct sk_buff *skb);
-int llc_sap_ev_deactivation_req(struct llc_sap *sap, struct sk_buff *skb);
-#endif /* LLC_S_EV_H */
diff --git a/include/net/llc_s_st.h b/include/net/llc_s_st.h
deleted file mode 100644
index 85ce230fd946..000000000000
--- a/include/net/llc_s_st.h
+++ /dev/null
@@ -1,32 +0,0 @@
-/* SPDX-License-Identifier: GPL-2.0 */
-#ifndef LLC_S_ST_H
-#define LLC_S_ST_H
-/*
- * Copyright (c) 1997 by Procom Technology,Inc.
- * 		 2001 by Arnaldo Carvalho de Melo <acme@conectiva.com.br>
- */
-
-#include <linux/types.h>
-#include <net/llc_s_ac.h>
-#include <net/llc_s_ev.h>
-
-struct llc_sap_state_trans;
-
-#define LLC_NR_SAP_STATES	2       /* size of state table */
-
-/* structures and types */
-/* SAP state table structure */
-struct llc_sap_state_trans {
-	llc_sap_ev_t	  ev;
-	u8		  next_state;
-	const llc_sap_action_t *ev_actions;
-};
-
-struct llc_sap_state {
-	u8				 curr_state;
-	const struct llc_sap_state_trans **transitions;
-};
-
-/* only access to SAP state table */
-extern struct llc_sap_state llc_sap_state_table[LLC_NR_SAP_STATES];
-#endif /* LLC_S_ST_H */
diff --git a/include/net/llc_sap.h b/include/net/llc_sap.h
deleted file mode 100644
index b259f5993c46..000000000000
--- a/include/net/llc_sap.h
+++ /dev/null
@@ -1,26 +0,0 @@
-/* SPDX-License-Identifier: GPL-2.0 */
-#ifndef LLC_SAP_H
-#define LLC_SAP_H
-
-#include <asm/types.h>
-
-/*
- * Copyright (c) 1997 by Procom Technology,Inc.
- * 		 2001-2003 by Arnaldo Carvalho de Melo <acme@conectiva.com.br>
- */
-struct llc_sap;
-struct net_device;
-struct sk_buff;
-struct sock;
-
-void llc_sap_rtn_pdu(struct llc_sap *sap, struct sk_buff *skb);
-void llc_save_primitive(struct sock *sk, struct sk_buff *skb,
-			unsigned char prim);
-struct sk_buff *llc_alloc_frame(struct sock *sk, struct net_device *dev,
-				u8 type, u32 data_size);
-
-void llc_build_and_send_test_pkt(struct llc_sap *sap, struct sk_buff *skb,
-				 unsigned char *dmac, unsigned char dsap);
-void llc_build_and_send_xid_pkt(struct llc_sap *sap, struct sk_buff *skb,
-				unsigned char *dmac, unsigned char dsap);
-#endif /* LLC_SAP_H */
diff --git a/include/net/mac80211.h b/include/net/mac80211.h
index ed6a5874ff96..a24d849b8f9c 100644
--- a/include/net/mac80211.h
+++ b/include/net/mac80211.h
@@ -640,7 +640,6 @@ struct ieee80211_bss_npca_params {
  *	mode only, set if the AP advertises TWT responder role)
  * @twt_responder: does this BSS support TWT requester (relevant for managed
  *	mode only, set if the AP advertises TWT responder role)
- * @twt_protected: does this BSS support protected TWT frames
  * @twt_broadcast: does this BSS support broadcast TWT
  * @use_cts_prot: use CTS protection
  * @use_short_preamble: use 802.11b short preamble
@@ -812,7 +811,6 @@ struct ieee80211_bss_conf {
 	bool he_support;
 	bool twt_requester;
 	bool twt_responder;
-	bool twt_protected;
 	bool twt_broadcast;
 	/* erp related data */
 	bool use_cts_prot;
@@ -923,12 +921,14 @@ struct ieee80211_bss_conf {
  * @channel_entry: the Channel Entry blob as defined in Wi-Fi Aware
  *	(TM) 4.0 specification Table 100 (Channel Entry format for the NAN
  *	Availability attribute).
+ * @no_evacuate: if set, this channel must not be evacuated
  */
 struct ieee80211_nan_channel {
 	struct ieee80211_chan_req chanreq;
 	u8 needed_rx_chains;
 	struct ieee80211_chanctx_conf *chanctx_conf;
 	u8 channel_entry[6];
+	bool no_evacuate;
 };
 
 /**
@@ -1770,10 +1770,9 @@ enum mac80211_rx_encoding {
  * @ampdu_reference: A-MPDU reference number, must be a different value for
  *	each A-MPDU but the same for each subframe within one A-MPDU
  * @zero_length_psdu_type: radiotap type of the 0-length PSDU
- * @link_valid: if the link which is identified by @link_id is valid. This flag
- *	is set only when connection is MLO.
- * @link_id: id of the link used to receive the packet. This is used along with
- *	@link_valid.
+ * @link_id: id of the link used to receive the packet. Set and used by
+ *	mac80211 internally, it uses @freq set by the driver to identify the
+ *	correct link per vif.
  */
 struct ieee80211_rx_status {
 	u64 mactime;
@@ -1813,7 +1812,7 @@ struct ieee80211_rx_status {
 	u8 chains;
 	s8 chain_signal[IEEE80211_MAX_CHAINS];
 	u8 zero_length_psdu_type;
-	u8 link_valid:1, link_id:4;
+	u8 link_id:4;
 };
 
 static_assert(sizeof(struct ieee80211_rx_status) <= sizeof_field(struct sk_buff, cb));
@@ -2396,6 +2395,8 @@ static inline bool lockdep_vif_wiphy_mutex_held(struct ieee80211_vif *vif)
  *	number generation only
  * @IEEE80211_KEY_FLAG_SPP_AMSDU: SPP A-MSDUs can be used with this key
  *	(set by mac80211 from the sta->spp_amsdu flag)
+ * @IEEE80211_KEY_FLAG_CIP: This key is used for the Control Integrity
+ *	Protocol, and is either a pairwise key or a CIGTK.
  */
 enum ieee80211_key_flags {
 	IEEE80211_KEY_FLAG_GENERATE_IV_MGMT	= BIT(0),
@@ -2410,6 +2411,7 @@ enum ieee80211_key_flags {
 	IEEE80211_KEY_FLAG_NO_AUTO_TX		= BIT(9),
 	IEEE80211_KEY_FLAG_GENERATE_MMIE	= BIT(10),
 	IEEE80211_KEY_FLAG_SPP_AMSDU		= BIT(11),
+	IEEE80211_KEY_FLAG_CIP			= BIT(12),
 };
 
 /**
@@ -2630,6 +2632,7 @@ struct ieee80211_sta_aggregates {
  * @eht_cap: EHT capabilities of this STA
  * @uhr_cap: UHR capabilities of this STA
  * @s1g_cap: S1G capabilities of this STA
+ * @cip_cap: the CIP capabilities of this STA (or zero)
  * @agg: per-link data for multi-link aggregation
  * @bandwidth: current bandwidth the station can receive with.
  *	This is the minimum between the peer's capabilities and our own
@@ -2658,6 +2661,7 @@ struct ieee80211_link_sta {
 	struct ieee80211_sta_eht_cap eht_cap;
 	struct ieee80211_sta_uhr_cap uhr_cap;
 	struct ieee80211_sta_s1g_cap s1g_cap;
+	u8 cip_cap;
 
 	struct ieee80211_sta_aggregates agg;
 
@@ -2721,6 +2725,8 @@ struct ieee80211_link_sta {
  * @valid_links: bitmap of valid links, or 0 for non-MLO
  * @spp_amsdu: indicates whether the STA uses SPP A-MSDU or not.
  * @epp_peer: indicates that the peer is an EPP peer.
+ * @cip: indicates whether the STA uses control frame protection or not.
+ * @twt_protected: does this STA support protected TWT frames
  * @nmi: For NDI stations, pointer to the NMI station of the peer.
  * @nan_sched: NAN peer schedule for this station. Valid only for NMI stations.
  * @ext_mld_capa_ops: the MLD's extended MLD capabilities and operations
@@ -2742,6 +2748,9 @@ struct ieee80211_sta {
 	u8 max_amsdu_subframes;
 	u16 eml_cap;
 
+	bool cip;
+	bool twt_protected;
+
 	struct ieee80211_sta_aggregates *cur;
 
 	bool support_p2p_ps;
@@ -2919,8 +2928,8 @@ struct ieee80211_txq {
  *	autonomously manages the PS status of connected stations. When
  *	this flag is set mac80211 will not trigger PS mode for connected
  *	stations based on the PM bit of incoming frames.
- *	Use ieee80211_start_ps()/ieee8021_end_ps() to manually configure
- *	the PS mode of connected stations.
+ *	Use ieee80211_sta_ps_transition() to manually toggle the PS mode
+ *	of connected stations.
  *
  * @IEEE80211_HW_TX_AMPDU_SETUP_IN_HW: The device handles TX A-MPDU session
  *	setup strictly in HW. mac80211 should not attempt to do this in
@@ -5389,14 +5398,18 @@ void ieee80211_restart_hw(struct ieee80211_hw *hw);
  * mixed for a single hardware. Must not run concurrently with
  * ieee80211_tx_status_skb() or ieee80211_tx_status_ni().
  *
+ * For data frames, when hardware has done address translation, a link station
+ * has to be provided and the frequency information may be skipped.
+ *
  * This function must be called with BHs disabled and RCU read lock
  *
  * @hw: the hardware this frame came in on
- * @sta: the station the frame was received from, or %NULL
+ * @link_sta: the link station the data frame was received from, or %NULL
  * @skb: the buffer to receive, owned by mac80211 after this call
  * @list: the destination list
  */
-void ieee80211_rx_list(struct ieee80211_hw *hw, struct ieee80211_sta *sta,
+void ieee80211_rx_list(struct ieee80211_hw *hw,
+		       struct ieee80211_link_sta *link_sta,
 		       struct sk_buff *skb, struct list_head *list);
 
 /**
@@ -5414,14 +5427,18 @@ void ieee80211_rx_list(struct ieee80211_hw *hw, struct ieee80211_sta *sta,
  * mixed for a single hardware. Must not run concurrently with
  * ieee80211_tx_status_skb() or ieee80211_tx_status_ni().
  *
+ * For data frames, when hardware has done address translation, a link station
+ * has to be provided and the frequency information may be skipped.
+ *
  * This function must be called with BHs disabled.
  *
  * @hw: the hardware this frame came in on
- * @sta: the station the frame was received from, or %NULL
+ * @link_sta: the link station the data frame was received from, or %NULL
  * @skb: the buffer to receive, owned by mac80211 after this call
  * @napi: the NAPI context
  */
-void ieee80211_rx_napi(struct ieee80211_hw *hw, struct ieee80211_sta *sta,
+void ieee80211_rx_napi(struct ieee80211_hw *hw,
+		       struct ieee80211_link_sta *link_sta,
 		       struct sk_buff *skb, struct napi_struct *napi);
 
 /**
@@ -5499,10 +5516,8 @@ static inline void ieee80211_rx_ni(struct ieee80211_hw *hw,
  *
  * @sta: currently connected sta
  * @start: start or stop PS
- *
- * Return: 0 on success. -EINVAL when the requested PS mode is already set.
  */
-int ieee80211_sta_ps_transition(struct ieee80211_sta *sta, bool start);
+void ieee80211_sta_ps_transition(struct ieee80211_sta *sta, bool start);
 
 /**
  * ieee80211_sta_ps_transition_ni - PS transition for connected sta
@@ -5514,19 +5529,13 @@ int ieee80211_sta_ps_transition(struct ieee80211_sta *sta, bool start);
  *
  * @sta: currently connected sta
  * @start: start or stop PS
- *
- * Return: Like ieee80211_sta_ps_transition().
  */
-static inline int ieee80211_sta_ps_transition_ni(struct ieee80211_sta *sta,
+static inline void ieee80211_sta_ps_transition_ni(struct ieee80211_sta *sta,
 						  bool start)
 {
-	int ret;
-
 	local_bh_disable();
-	ret = ieee80211_sta_ps_transition(sta, start);
+	ieee80211_sta_ps_transition(sta, start);
 	local_bh_enable();
-
-	return ret;
 }
 
 /**
@@ -6279,6 +6288,7 @@ void ieee80211_set_key_rx_seq(struct ieee80211_key_conf *keyconf,
  * @key_len: the key data. Might be bigger than the actual key length,
  *	but not smaller (for the driver convinence)
  * @link_id: the link id of the key or -1 for non-MLO
+ * @cigtk: whether this is a CIGTK
  *
  * When GTK rekeying was done while the system was suspended, (a) new
  * key(s) will be available. These will be needed by mac80211 for proper
@@ -6305,7 +6315,7 @@ void ieee80211_set_key_rx_seq(struct ieee80211_key_conf *keyconf,
 struct ieee80211_key_conf *
 ieee80211_gtk_rekey_add(struct ieee80211_vif *vif,
 			u8 idx, u8 *key_data, u8 key_len,
-			int link_id);
+			int link_id, bool cigtk);
 
 /**
  * ieee80211_gtk_rekey_notify - notify userspace supplicant of rekeying
@@ -7640,12 +7650,14 @@ bool ieee80211_tx_prepare_skb(struct ieee80211_hw *hw,
  * @dev: the &struct device of this 802.11 device
  * @chandef: the channel definition the frame will be transmitted on, or
  *	%NULL to skip the bandwidth checks
+ * @trim_fcs: trim the FCS trailer when present; validate it otherwise
  *
  * Return: %true if the radiotap header was parsed, %false otherwise
  */
 bool ieee80211_parse_tx_radiotap(struct sk_buff *skb,
 				 struct net_device *dev,
-				 const struct cfg80211_chan_def *chandef);
+				 const struct cfg80211_chan_def *chandef,
+				 bool trim_fcs);
 
 /**
  * struct ieee80211_noa_data - holds temporary data for tracking P2P NoA state
@@ -8062,25 +8074,6 @@ ieee80211_obss_color_collision_notify(struct ieee80211_vif *vif,
 				      u64 color_bitmap, u8 link_id);
 
 /**
- * ieee80211_is_tx_data - check if frame is a data frame
- *
- * The function is used to check if a frame is a data frame. Frames with
- * hardware encapsulation enabled are data frames.
- *
- * @skb: the frame to be transmitted.
- *
- * Return: %true if @skb is a data frame, %false otherwise
- */
-static inline bool ieee80211_is_tx_data(struct sk_buff *skb)
-{
-	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
-	struct ieee80211_hdr *hdr = (void *) skb->data;
-
-	return info->flags & IEEE80211_TX_CTL_HW_80211_ENCAP ||
-	       ieee80211_is_data(hdr->frame_control);
-}
-
-/**
  * ieee80211_set_active_links - set active links in client mode
  * @vif: interface to set active links on
  * @active_links: the new active links bitmap
diff --git a/include/net/mana/gdma.h b/include/net/mana/gdma.h
index 2a28fcaa637d..0b52582118e8 100644
--- a/include/net/mana/gdma.h
+++ b/include/net/mana/gdma.h
@@ -427,14 +427,74 @@ enum gdma_context_flags {
 	GC_IN_SERVICE		= 1,
 };
 
+struct gdma_context;
+
+/**
+ * struct gdma_bus_ops - transport-specific operations
+ *
+ * Lets the bus-agnostic GDMA core drive PCI and CDX devices without
+ * testing configuration symbols. Each bus driver installs its own
+ * instance in gdma_context.bus_ops at probe time.
+ *
+ * @bus_name: Bus token used to build the per-vector IRQ names.
+ * @adev_prefix: Prefix used for auxiliary-device match names.
+ * @msix_can_alloc_dyn: True if the bus can allocate MSI-X vectors after
+ *	probe time. Buses that size their vector pool at probe and cannot
+ *	grow it later leave this NULL.
+ * @msix_virq: Return the Linux IRQ number backing an MSI vector, or
+ *	-EINVAL if the vector has not been allocated yet.
+ * @msix_alloc_at: Allocate an MSI vector on demand and return its IRQ
+ *	number, updating @msi with the index actually assigned. Buses that
+ *	allocate their whole pool up front leave this NULL.
+ * @msix_free: Release a vector obtained from @msix_alloc_at. Only needed
+ *	by buses that implement @msix_alloc_at.
+ * @msix_vec_count: Return the number of entries in the device MSI-X table,
+ *	used to clamp the vector count the core asks for. Buses that cannot
+ *	report a table size leave this NULL and the clamp is skipped.
+ * @setup_hwc_irqs: Set up the interrupts the hardware channel needs before
+ *	it is created.
+ * @setup_remaining_irqs: Set up the remaining interrupts once the device
+ *	resource limits are known.
+ * @remove_irqs: Release the interrupts set up by @setup_hwc_irqs and
+ *	@setup_remaining_irqs.
+ * @dev_reset: Reset the device using the bus-level reset mechanism.
+ * @schedule_serv_work: Queue device servicing or recovery. Buses without
+ *	a servicing path leave this NULL.
+ * @drv_cap_flags1: Extra capability bits this transport can honour, OR'ed
+ *	into GDMA_DRV_CAP_FLAGS1 when the driver version is negotiated.
+ */
+struct gdma_bus_ops {
+	const char *bus_name;
+	const char *adev_prefix;
+	bool (*msix_can_alloc_dyn)(struct gdma_context *gc);
+	int (*msix_virq)(struct gdma_context *gc, int msi);
+	int (*msix_alloc_at)(struct gdma_context *gc, int *msi);
+	void (*msix_free)(struct gdma_context *gc, int msi, int irq);
+	int (*msix_vec_count)(struct gdma_context *gc);
+	int (*setup_hwc_irqs)(struct gdma_context *gc);
+	int (*setup_remaining_irqs)(struct gdma_context *gc);
+	void (*remove_irqs)(struct gdma_context *gc);
+	int (*dev_reset)(struct gdma_context *gc);
+	int (*schedule_serv_work)(struct gdma_context *gc,
+				  enum gdma_eqe_type type);
+	u64 drv_cap_flags1;
+};
+
 struct gdma_context {
 	struct device		*dev;
 	struct dentry		*mana_pci_debugfs;
 
+	/* Transport-specific operations, installed by the bus driver */
+	const struct gdma_bus_ops *bus_ops;
+
 	/* Hardware max number of queues */
 	unsigned int		max_num_queues;
 	/* Per-vPort max number of queues */
 	unsigned int		max_num_queues_vport;
+	/* Number of vPorts reported by the device, capped at
+	 * MAX_PORTS_IN_MANA_DEV
+	 */
+	u16			num_ports;
 	unsigned int		max_num_msix;
 	unsigned int		num_msix_usable;
 	struct xarray		irq_contexts;
@@ -534,6 +594,10 @@ ssize_t mana_gd_read_ring(struct gdma_queue *q, char __user *buf,
 
 int mana_schedule_serv_work(struct gdma_context *gc, enum gdma_eqe_type type);
 
+int mana_gd_alloc_service_wq(struct gdma_context *gc);
+
+void mana_gd_free_service_wq(struct gdma_context *gc);
+
 void mana_gd_ring_dim(struct gdma_queue *cq, u32 mod_usec, bool mod_usec_vld,
 		      u32 mod_comps, bool mod_comps_vld);
 
@@ -628,6 +692,8 @@ struct gdma_eqe {
 #define MANA_PF2_DEVICE_ID 0x00C1
 #define MANA_VF_DEVICE_ID 0x00BA
 
+#define MANA_CDX_DEVICE_ID 0x00C2
+
 struct gdma_posted_wqe_info {
 	u32 wqe_size_in_bu;
 	/* Unmasked WQE start offset in GDMA basic units. */
@@ -694,21 +760,28 @@ enum {
 /* Driver supports non-contiguous queue buffers */
 #define GDMA_DRV_CAP_FLAG_1_NON_CONTIGUOUS_BUFFERS BIT(30)
 
+/* Capabilities in the PCI-only group below rely on dynamic MSI-X allocation
+ * and on the servicing and reset paths reached through
+ * mana_schedule_serv_work(). Transports that provide neither leave
+ * gdma_bus_ops.drv_cap_flags1 unset so the group is not advertised.
+ */
+#define GDMA_DRV_CAP_FLAGS1_PCI \
+	(GDMA_DRV_CAP_FLAG_1_DYNAMIC_IRQ_ALLOC_SUPPORT | \
+	 GDMA_DRV_CAP_FLAG_1_SELF_RESET_ON_EQE | \
+	 GDMA_DRV_CAP_FLAG_1_HANDLE_RECONFIG_EQE | \
+	 GDMA_DRV_CAP_FLAG_1_PROBE_RECOVERY | \
+	 GDMA_DRV_CAP_FLAG_1_HWC_TIMEOUT_RECOVERY)
+
 #define GDMA_DRV_CAP_FLAGS1 \
 	(GDMA_DRV_CAP_FLAG_1_EQ_SHARING_MULTI_VPORT | \
 	 GDMA_DRV_CAP_FLAG_1_NAPI_WKDONE_FIX | \
 	 GDMA_DRV_CAP_FLAG_1_HWC_TIMEOUT_RECONFIG | \
 	 GDMA_DRV_CAP_FLAG_1_VARIABLE_INDIRECTION_TABLE_SUPPORT | \
 	 GDMA_DRV_CAP_FLAG_1_DEV_LIST_HOLES_SUP | \
-	 GDMA_DRV_CAP_FLAG_1_DYNAMIC_IRQ_ALLOC_SUPPORT | \
-	 GDMA_DRV_CAP_FLAG_1_SELF_RESET_ON_EQE | \
-	 GDMA_DRV_CAP_FLAG_1_HANDLE_RECONFIG_EQE | \
 	 GDMA_DRV_CAP_FLAG_1_HW_VPORT_LINK_AWARE | \
 	 GDMA_DRV_CAP_FLAG_1_PERIODIC_STATS_QUERY | \
 	 GDMA_DRV_CAP_FLAG_1_SKB_LINEARIZE | \
-	 GDMA_DRV_CAP_FLAG_1_PROBE_RECOVERY | \
 	 GDMA_DRV_CAP_FLAG_1_HANDLE_STALL_SQ_RECOVERY | \
-	 GDMA_DRV_CAP_FLAG_1_HWC_TIMEOUT_RECOVERY | \
 	 GDMA_DRV_CAP_FLAG_1_EQ_MSI_UNSHARE_MULTI_VPORT | \
 	 GDMA_DRV_CAP_FLAG_1_DYN_INTERRUPT_MODERATION | \
 	 GDMA_DRV_CAP_FLAG_1_NON_CONTIGUOUS_BUFFERS)
@@ -1052,7 +1125,24 @@ struct gdma_destroy_dm_resp {
 	struct gdma_resp_hdr hdr;
 }; /* HW Data */
 
-int mana_gd_verify_vf_version(struct pci_dev *pdev);
+int mana_gd_verify_vf_version(struct gdma_context *gc);
+int mana_gd_query_max_resources(struct gdma_context *gc);
+int mana_gd_setup(struct gdma_context *gc);
+void mana_gd_cleanup(struct gdma_context *gc);
+int mana_gd_detect_devices(struct gdma_context *gc);
+int mana_gd_init_registers(struct gdma_context *gc);
+irqreturn_t mana_gd_intr(int irq, void *arg);
+void mana_gd_process_eq_events(void *arg);
+
+static inline u32 mana_gd_r32(struct gdma_context *g, u64 offset)
+{
+	return readl(g->bar0_va + offset);
+}
+
+static inline u64 mana_gd_r64(struct gdma_context *g, u64 offset)
+{
+	return readq(g->bar0_va + offset);
+}
 
 int mana_gd_register_device(struct gdma_dev *gd);
 int mana_gd_deregister_device(struct gdma_dev *gd);
@@ -1087,8 +1177,6 @@ void mana_unregister_debugfs(void);
 
 int mana_rdma_service_event(struct gdma_context *gc, enum gdma_service_type event);
 
-int mana_gd_suspend(struct pci_dev *pdev, pm_message_t state);
-int mana_gd_resume(struct pci_dev *pdev);
 
 bool mana_need_log(struct gdma_context *gc, int err);
 
@@ -1099,4 +1187,6 @@ void mana_gd_put_gic(struct gdma_context *gc, bool use_msi_bitmap, int msi);
 int mana_gd_query_device_cfg(struct gdma_context *gc, u32 proto_major_ver,
 			     u32 proto_minor_ver, u32 proto_micro_ver,
 			     u16 *max_num_vports, u8 *bm_hostmode);
+int mana_gd_dev_reset(struct gdma_context *gc);
+
 #endif /* _GDMA_H */
diff --git a/include/net/mana/hw_channel.h b/include/net/mana/hw_channel.h
index 16feb39616c1..1ab2d66c891e 100644
--- a/include/net/mana/hw_channel.h
+++ b/include/net/mana/hw_channel.h
@@ -20,8 +20,8 @@
 #define HWC_INIT_DATA_MAX_NUM_CQS	7
 #define HWC_INIT_DATA_PDID		8
 #define HWC_INIT_DATA_GPA_MKEY		9
-#define HWC_INIT_DATA_PF_DEST_RQ_ID	10
-#define HWC_INIT_DATA_PF_DEST_CQ_ID	11
+#define HWC_INIT_DATA_DEST_RQ_ID	10
+#define HWC_INIT_DATA_DEST_CQ_ID	11
 
 #define HWC_DATA_CFG_HWC_TIMEOUT 1
 #define HWC_DATA_HW_LINK_CONNECT 2
@@ -195,8 +195,8 @@ struct hw_channel_context {
 	struct semaphore sema;
 	struct gdma_resource inflight_msg_res;
 
-	u32 pf_dest_vrq_id;
-	u32 pf_dest_vrcq_id;
+	u32 dest_vrq_id;
+	u32 dest_vrcq_id;
 	u32 hwc_timeout;
 
 	struct hwc_caller_ctx *caller_ctx;
diff --git a/include/net/ndisc.h b/include/net/ndisc.h
index 9e5379ad2d8e..91898a2475e7 100644
--- a/include/net/ndisc.h
+++ b/include/net/ndisc.h
@@ -67,6 +67,15 @@ struct prefix_info;
 
 extern struct neigh_table nd_tbl;
 
+static inline struct neigh_table *nd_table(struct net *net)
+{
+#if IS_ENABLED(CONFIG_IPV6)
+	if (disable_ipv6_mod)
+		return &nd_tbl;
+#endif
+	return net->neigh_tables[NEIGH_ND_TABLE];
+}
+
 struct nd_msg {
         struct icmp6hdr	icmph;
         struct in6_addr	target;
@@ -354,7 +363,9 @@ static inline u32 ndisc_hashfn(const void *pkey, const struct net_device *dev, _
 
 static inline struct neighbour *__ipv6_neigh_lookup_noref(struct net_device *dev, const void *pkey)
 {
-	return ___neigh_lookup_noref(&nd_tbl, neigh_key_eq128, ndisc_hashfn, pkey, dev);
+	struct neigh_table *tbl = nd_table(dev_net(dev));
+
+	return ___neigh_lookup_noref(tbl, neigh_key_eq128, ndisc_hashfn, pkey, dev);
 }
 
 static inline struct neighbour *__ipv6_neigh_lookup(struct net_device *dev, const void *pkey)
@@ -370,6 +381,30 @@ static inline struct neighbour *__ipv6_neigh_lookup(struct net_device *dev, cons
 	return n;
 }
 
+static inline struct neighbour *ipv6_neigh_lookup(struct net_device *dev,
+						  const void *pkey)
+{
+	struct neigh_table *tbl = nd_table(dev_net(dev));
+
+	return neigh_lookup(tbl, pkey, dev);
+}
+
+static inline struct neighbour *ipv6_neigh_create(struct net_device *dev,
+						  const void *pkey)
+{
+	struct neigh_table *tbl = nd_table(dev_net(dev));
+
+	return neigh_create(tbl, pkey, dev);
+}
+
+static inline struct neighbour *ipv6_neigh_create_noref(struct net_device *dev,
+							const void *pkey)
+{
+	struct neigh_table *tbl = nd_table(dev_net(dev));
+
+	return __neigh_create(tbl, pkey, dev, false);
+}
+
 static inline void __ipv6_confirm_neigh(struct net_device *dev,
 					const void *pkey)
 {
@@ -389,7 +424,7 @@ static inline struct neighbour *ip_neigh_gw6(struct net_device *dev,
 
 	neigh = __ipv6_neigh_lookup_noref(dev, addr);
 	if (unlikely(!neigh))
-		neigh = __neigh_create(&nd_tbl, addr, dev, false);
+		neigh = ipv6_neigh_create_noref(dev, addr);
 
 	return neigh;
 #else
diff --git a/include/net/neighbour.h b/include/net/neighbour.h
index 8860cc2175fc..79a5a548a129 100644
--- a/include/net/neighbour.h
+++ b/include/net/neighbour.h
@@ -31,6 +31,8 @@
 #include <net/rtnetlink.h>
 #include <net/neighbour_tables.h>
 
+extern int sysctl_neigh_inherit_init_net;
+
 /*
  * NUD stands for "neighbor unreachability detection"
  */
@@ -179,7 +181,6 @@ struct neigh_ops {
 
 struct pneigh_entry {
 	struct pneigh_entry	__rcu *next;
-	possible_net_t		net;
 	struct net_device	*dev;
 	netdevice_tracker	dev_tracker;
 	union {
@@ -234,7 +235,7 @@ struct neigh_table {
 	struct delayed_work	managed_work;
 	struct timer_list 	proxy_timer;
 	struct sk_buff_head	proxy_queue;
-	atomic_t		entries;
+	refcount_t		entries;
 	atomic_t		gc_entries;
 	struct list_head	gc_list;
 	struct list_head	managed_list;
@@ -339,8 +340,8 @@ static inline void neigh_confirm(struct neighbour *n)
 	}
 }
 
-void neigh_table_init(int index, struct neigh_table *tbl);
-int neigh_table_clear(int index, struct neigh_table *tbl);
+int neigh_table_register(struct net *net, struct neigh_table *tbl, int index);
+void neigh_table_unregister(struct net *net, int index);
 struct neighbour *neigh_lookup(struct neigh_table *tbl, const void *pkey,
 			       struct net_device *dev);
 struct neighbour *__neigh_create(struct neigh_table *tbl, const void *pkey,
@@ -389,24 +390,17 @@ static inline void neigh_set_reach_time(struct neigh_parms *p)
 
 void pneigh_enqueue(struct neigh_table *tbl, struct neigh_parms *p,
 		    struct sk_buff *skb);
-struct pneigh_entry *pneigh_lookup(struct neigh_table *tbl, struct net *net,
+struct pneigh_entry *pneigh_lookup(struct neigh_table *tbl,
 				   const void *key, struct net_device *dev);
-int pneigh_create(struct neigh_table *tbl, struct net *net, const void *key,
+int pneigh_create(struct neigh_table *tbl, const void *key,
 		  struct net_device *dev, u32 flags, u8 protocol,
 		  bool permanent);
-int pneigh_delete(struct neigh_table *tbl, struct net *net, const void *key,
+int pneigh_delete(struct neigh_table *tbl, const void *key,
 		  struct net_device *dev);
 
-static inline struct net *pneigh_net(const struct pneigh_entry *pneigh)
-{
-	return read_pnet(&pneigh->net);
-}
-
 void neigh_app_ns(struct neighbour *n);
 void neigh_for_each(struct neigh_table *tbl,
 		    void (*cb)(struct neighbour *, void *), void *cookie);
-void __neigh_for_each_release(struct neigh_table *tbl,
-			      int (*cb)(struct neighbour *));
 int neigh_xmit(int fam, struct net_device *, const void *, struct sk_buff *);
 
 struct neigh_seq_state {
@@ -560,30 +554,6 @@ static inline int neigh_output(struct neighbour *n, struct sk_buff *skb,
 	return READ_ONCE(n->output)(n, skb);
 }
 
-static inline struct neighbour *
-__neigh_lookup(struct neigh_table *tbl, const void *pkey, struct net_device *dev, int creat)
-{
-	struct neighbour *n = neigh_lookup(tbl, pkey, dev);
-
-	if (n || !creat)
-		return n;
-
-	n = neigh_create(tbl, pkey, dev);
-	return IS_ERR(n) ? NULL : n;
-}
-
-static inline struct neighbour *
-__neigh_lookup_errno(struct neigh_table *tbl, const void *pkey,
-  struct net_device *dev)
-{
-	struct neighbour *n = neigh_lookup(tbl, pkey, dev);
-
-	if (n)
-		return n;
-
-	return neigh_create(tbl, pkey, dev);
-}
-
 struct neighbour_cb {
 	unsigned long sched_next;
 	unsigned int flags;
diff --git a/include/net/net_namespace.h b/include/net/net_namespace.h
index e5ee673b9fcf..46b4c67e2966 100644
--- a/include/net/net_namespace.h
+++ b/include/net/net_namespace.h
@@ -39,6 +39,7 @@
 #include <net/netns/mctp.h>
 #include <net/netns/vsock.h>
 #include <net/net_trackers.h>
+#include <net/neighbour_tables.h>
 #include <linux/ns_common.h>
 #include <linux/idr.h>
 #include <linux/skbuff.h>
@@ -47,6 +48,7 @@
 
 struct user_namespace;
 struct proc_dir_entry;
+struct neigh_table;
 struct net_device;
 struct sock;
 struct ctl_table_header;
@@ -103,6 +105,8 @@ struct net {
 	struct proc_dir_entry 	*proc_net;
 	struct proc_dir_entry 	*proc_net_stat;
 
+	struct neigh_table	*neigh_tables[NEIGH_NR_TABLES];
+
 #ifdef CONFIG_SYSCTL
 	struct ctl_table_set	sysctls;
 #endif
diff --git a/include/net/netdev_lock.h b/include/net/netdev_lock.h
index 9fb3e93857c3..edd8cc2e2b36 100644
--- a/include/net/netdev_lock.h
+++ b/include/net/netdev_lock.h
@@ -110,34 +110,20 @@ static inline int netdev_is_locked_ops_compat(const struct net_device *dev)
 	return lockdep_rtnl_is_held();
 }
 
-static inline int netdev_lock_cmp_fn(const struct lockdep_map *a,
-				     const struct lockdep_map *b)
-{
-	if (a == b)
-		return 0;
-
-	/* Allow locking multiple devices only under rtnl_lock,
-	 * the exact order doesn't matter.
-	 * Note that upper devices don't lock their ops, so nesting
-	 * mostly happens in batched device removal for now.
-	 */
-	return lockdep_rtnl_is_held() ? -1 : 1;
-}
+void netdev_set_instance_lock_class(struct net_device *dev);
 
 #define netdev_lockdep_set_classes(dev)				\
 {								\
 	static struct lock_class_key qdisc_tx_busylock_key;	\
 	static struct lock_class_key qdisc_xmit_lock_key;	\
 	static struct lock_class_key dev_addr_list_lock_key;	\
-	static struct lock_class_key dev_instance_lock_key;	\
 	unsigned int i;						\
 								\
 	(dev)->qdisc_tx_busylock = &qdisc_tx_busylock_key;	\
 	lockdep_set_class(&(dev)->addr_list_lock,		\
 			  &dev_addr_list_lock_key);		\
-	lockdep_set_class(&(dev)->lock,				\
-			  &dev_instance_lock_key);		\
-	lock_set_cmp_fn(&dev->lock, netdev_lock_cmp_fn, NULL);	\
+	if (IS_ENABLED(CONFIG_PROVE_LOCKING))			\
+		netdev_set_instance_lock_class(dev);		\
 	for (i = 0; i < (dev)->num_tx_queues; i++)		\
 		lockdep_set_class(&(dev)->_tx[i]._xmit_lock,	\
 				  &qdisc_xmit_lock_key);	\
diff --git a/include/net/netdev_queues.h b/include/net/netdev_queues.h
index 70c9fe9e83cc..c5335e935b7d 100644
--- a/include/net/netdev_queues.h
+++ b/include/net/netdev_queues.h
@@ -5,17 +5,55 @@
 #include <linux/netdevice.h>
 
 /**
+ * struct netdev_ring_config - accepted RX ring depth configuration
+ * @rx_pending:		Size of the regular RX ring.
+ * @rx_mini_pending:	Size of the RX mini ring.
+ * @rx_jumbo_pending:	Size of the RX jumbo ring.
+ *
+ * This stores only persistent configuration values. Capability fields,
+ * such as max ring sizes, are reported by drivers but are not part of the
+ * accepted configuration.
+ *
+ * These values are only used for queue-configuration validation today.
+ * Drivers which normalize ring sizes must update the struct ethtool_ringparam
+ * passed to set_ringparam() with the applied sizes.
+ */
+struct netdev_ring_config {
+	u32	rx_pending;
+	u32	rx_mini_pending;
+	u32	rx_jumbo_pending;
+};
+
+/**
  * struct netdev_config - queue-related configuration for a netdev
  * @hds_thresh:		HDS Threshold value.
  * @hds_config:		HDS value from userspace.
+ * @rings:		Accepted RX ring depths.
+ *
+ * Direct values, such as @hds_thresh and @rings, hold the accepted
+ * configuration and always override callback-provided defaults, including
+ * when zero. Drivers which use @rings for queue rendering must initialize
+ * every RX ring depth before registering the netdev.
  */
 struct netdev_config {
 	u32	hds_thresh;
 	u8	hds_config;
+
+	struct netdev_ring_config rings;
 };
 
+/**
+ * struct netdev_queue_config - rendered configuration for an RX queue
+ * @rx_page_size:	Size of one RX page-pool allocation.
+ * @rx_ring_size:	Configured size of the regular RX ring.
+ * @rx_mini_ring_size:	Configured size of the RX mini ring.
+ * @rx_jumbo_ring_size:	Configured size of the RX jumbo ring.
+ */
 struct netdev_queue_config {
 	u32	rx_page_size;
+	u32	rx_ring_size;
+	u32	rx_mini_ring_size;
+	u32	rx_jumbo_ring_size;
 };
 
 /* See the netdev.yaml spec for definition of each statistic */
@@ -139,16 +177,20 @@ enum {
  * @ndo_queue_get_dma_dev: Get dma device for zero-copy operations to be used
  *			   for this queue. Return NULL on error.
  *
- * @ndo_default_qcfg:	(Optional) Populate queue config struct with defaults.
- *			Queue config structs are passed to this helper before
- *			the user-requested settings are applied.
+ * @ndo_default_qcfg:	(Optional) Populate queue config with defaults. Queue
+ *			config structs are passed to this helper before the
+ *			user-requested settings are applied. Ring depths from
+ *			dev->cfg override these defaults. Drivers which consume
+ *			them must initialize dev->cfg->rings before registering
+ *			the netdev.
  *
  * @ndo_validate_qcfg: (Optional) Check if queue config is supported.
  *			Called when configuration affecting a queue may be
- *			changing, either due to NIC-wide config, or config
- *			scoped to the queue at a specified index.
- *			When NIC-wide config is changed the callback will
- *			be invoked for all queues.
+ *			changing. When NIC-wide config is changed the
+ *			callback will be invoked for the defaults and all
+ *			queue overrides. Drivers which normalize device-wide
+ *			values when applying them must use the same
+ *			normalization during validation.
  *
  * @ndo_queue_create:	Create a new RX queue on a virtual device that will
  *			be paired with a physical device's queue via leasing.
diff --git a/include/net/netfilter/nf_conntrack_seqadj.h b/include/net/netfilter/nf_conntrack_seqadj.h
index 883c414b768e..0f5bbb14a25a 100644
--- a/include/net/netfilter/nf_conntrack_seqadj.h
+++ b/include/net/netfilter/nf_conntrack_seqadj.h
@@ -33,6 +33,7 @@ static inline struct nf_conn_seqadj *nfct_seqadj_ext_add(struct nf_conn *ct)
 
 int nf_ct_seqadj_init(struct nf_conn *ct, enum ip_conntrack_info ctinfo,
 		      s32 off);
+void nf_ct_seqadj_reset(struct nf_conn *ct, enum ip_conntrack_info ctinfo);
 int nf_ct_seqadj_set(struct nf_conn *ct, enum ip_conntrack_info ctinfo,
 		     __be32 seq, s32 off);
 void nf_ct_tcp_seqadj_set(struct sk_buff *skb, struct nf_conn *ct,
diff --git a/include/net/netmem.h b/include/net/netmem.h
index bccacd21b6c3..0cc8572f62ca 100644
--- a/include/net/netmem.h
+++ b/include/net/netmem.h
@@ -102,9 +102,6 @@ struct net_iov_area {
 	/* Array of net_iovs for this area. */
 	struct net_iov *niovs;
 	size_t num_niovs;
-
-	/* Offset into the dma-buf where this chunk starts.  */
-	unsigned long base_virtual;
 };
 
 static inline struct net_iov_area *net_iov_owner(const struct net_iov *niov)
@@ -358,6 +355,33 @@ static inline bool netmem_is_pfmemalloc(netmem_ref netmem)
 	return page_is_pfmemalloc(netmem_to_page(netmem));
 }
 
+#define NETMEM_32BIT_ARCH_WITH_64BIT_DMA	\
+	(sizeof(dma_addr_t) > sizeof(unsigned long))
+
+static inline unsigned long netmem_dma_addr_encode(dma_addr_t addr)
+{
+	if (NETMEM_32BIT_ARCH_WITH_64BIT_DMA)
+		addr >>= PAGE_SHIFT;
+
+	return addr;
+}
+
+static inline dma_addr_t netmem_dma_addr_decode(unsigned long addr)
+{
+	if (NETMEM_32BIT_ARCH_WITH_64BIT_DMA)
+		return (dma_addr_t)addr << PAGE_SHIFT;
+
+	return addr;
+}
+
+static inline bool netmem_dma_addr_fits(dma_addr_t addr)
+{
+	/* We assume page alignment to shave off bottom bits,
+	 * if this "compression" doesn't work we need to drop.
+	 */
+	return addr == netmem_dma_addr_decode(netmem_dma_addr_encode(addr));
+}
+
 static inline unsigned long netmem_get_dma_addr(netmem_ref netmem)
 {
 	return netmem_to_nmdesc(netmem)->dma_addr;
diff --git a/include/net/netns/netfilter.h b/include/net/netns/netfilter.h
index a6a0bf4a247e..7fd78394d1e7 100644
--- a/include/net/netns/netfilter.h
+++ b/include/net/netns/netfilter.h
@@ -33,5 +33,7 @@ struct netns_nf {
 #if IS_ENABLED(CONFIG_NF_DEFRAG_IPV6)
 	unsigned int defrag_ipv6_users;
 #endif
+	unsigned int hook_base_seq;
+	unsigned int nat_hook_base_seq;
 };
 #endif
diff --git a/include/net/page_pool/helpers.h b/include/net/page_pool/helpers.h
index e2730dd273b2..cd021832c3fa 100644
--- a/include/net/page_pool/helpers.h
+++ b/include/net/page_pool/helpers.h
@@ -408,16 +408,13 @@ static inline void page_pool_recycle_direct_netmem(struct page_pool *pool,
 	page_pool_put_full_netmem(pool, netmem, true);
 }
 
-#define PAGE_POOL_32BIT_ARCH_WITH_64BIT_DMA	\
-		(sizeof(dma_addr_t) > sizeof(unsigned long))
-
 /**
  * page_pool_free_va() - free a va into the page_pool
  * @pool: pool from which va was allocated
  * @va: va to be freed
  * @allow_direct: freed by the consumer, allow lockless caching
  *
- * Free a va allocated from page_pool_allo_va().
+ * Free a va allocated from page_pool_alloc_va().
  */
 static inline void page_pool_free_va(struct page_pool *pool, void *va,
 				     bool allow_direct)
@@ -427,12 +424,7 @@ static inline void page_pool_free_va(struct page_pool *pool, void *va,
 
 static inline dma_addr_t page_pool_get_dma_addr_netmem(netmem_ref netmem)
 {
-	dma_addr_t ret = netmem_get_dma_addr(netmem);
-
-	if (PAGE_POOL_32BIT_ARCH_WITH_64BIT_DMA)
-		ret <<= PAGE_SHIFT;
-
-	return ret;
+	return netmem_dma_addr_decode(netmem_get_dma_addr(netmem));
 }
 
 /**
diff --git a/include/net/phy/realtek_phy.h b/include/net/phy/realtek_phy.h
deleted file mode 100644
index d683bc1b0659..000000000000
--- a/include/net/phy/realtek_phy.h
+++ /dev/null
@@ -1,7 +0,0 @@
-/* SPDX-License-Identifier: GPL-2.0 */
-#ifndef _REALTEK_PHY_H
-#define _REALTEK_PHY_H
-
-#define	PHY_ID_RTL_DUMMY_SFP	0x001ccbff
-
-#endif /* _REALTEK_PHY_H */
diff --git a/include/net/psp/functions.h b/include/net/psp/functions.h
index c5c23a54774e..b23c30898389 100644
--- a/include/net/psp/functions.h
+++ b/include/net/psp/functions.h
@@ -24,11 +24,6 @@ int psp_dev_rcv(struct sk_buff *skb, u16 dev_id, u8 generation, bool strip_icv);
 /* Kernel-facing API */
 void psp_assoc_put(struct psp_assoc *pas);
 
-static inline void *psp_assoc_drv_data(struct psp_assoc *pas)
-{
-	return pas->drv_data;
-}
-
 #if IS_ENABLED(CONFIG_INET_PSP)
 unsigned int psp_key_size(u32 version);
 void psp_sk_assoc_free(struct sock *sk);
diff --git a/include/net/psp/types.h b/include/net/psp/types.h
index 87991a1ea02d..b8905efbd604 100644
--- a/include/net/psp/types.h
+++ b/include/net/psp/types.h
@@ -219,12 +219,16 @@ struct psp_dev_ops {
 	 * @tx_key_add: add a Tx key to the device
 	 * Install an association in the device. Core will allocate space
 	 * for the driver to use at drv_data.
+	 * Can be left NULL if device does not store Tx keys and @tx_key_del
+	 * is also NULL.
 	 */
 	int (*tx_key_add)(struct psp_dev *psd, struct psp_assoc *pas,
 			  struct netlink_ext_ack *extack);
 	/**
 	 * @tx_key_del: remove a Tx key from the device
 	 * Remove an association from the device.
+	 * Can be left NULL if device does not store Tx keys and @tx_key_add
+	 * is also NULL.
 	 */
 	void (*tx_key_del)(struct psp_dev *psd, struct psp_assoc *pas);
 
diff --git a/include/net/route.h b/include/net/route.h
index 45290177a33c..3fccd31eb74d 100644
--- a/include/net/route.h
+++ b/include/net/route.h
@@ -129,7 +129,13 @@ struct in_device;
 
 int ip_rt_init(void);
 void rt_cache_flush(struct net *net);
+#ifdef CONFIG_INET
 void rt_flush_dev(struct net_device *dev);
+#else
+static inline void rt_flush_dev(struct net_device *dev)
+{
+}
+#endif
 
 static inline void inet_sk_init_flowi4(const struct inet_sock *inet,
 				       struct flowi4 *fl4)
@@ -405,8 +411,11 @@ static inline struct neighbour *ip_neigh_gw4(struct net_device *dev,
 	struct neighbour *neigh;
 
 	neigh = __ipv4_neigh_lookup_noref(dev, (__force u32)daddr);
-	if (unlikely(!neigh))
-		neigh = __neigh_create(&arp_tbl, &daddr, dev, false);
+	if (unlikely(!neigh)) {
+		struct neigh_table *tbl = arp_table(dev_net(dev));
+
+		neigh = __neigh_create(tbl, &daddr, dev, false);
+	}
 
 	return neigh;
 }
diff --git a/include/net/seg6_hmac.h b/include/net/seg6_hmac.h
index e9f41725933e..3161a8104b89 100644
--- a/include/net/seg6_hmac.h
+++ b/include/net/seg6_hmac.h
@@ -48,7 +48,8 @@ extern int seg6_hmac_info_add(struct net *net, u32 key,
 extern int seg6_hmac_info_del(struct net *net, u32 key);
 extern int seg6_push_hmac(struct net *net, struct in6_addr *saddr,
 			  struct ipv6_sr_hdr *srh);
-extern bool seg6_hmac_validate_skb(struct sk_buff *skb);
+extern bool seg6_hmac_validate_skb(struct sk_buff *skb,
+				   struct ipv6_sr_hdr *srh);
 #ifdef CONFIG_IPV6_SEG6_HMAC
 extern int seg6_hmac_net_init(struct net *net);
 extern void seg6_hmac_net_exit(struct net *net);
diff --git a/include/net/sock.h b/include/net/sock.h
index 77dfb170d3c8..173b37b2b8bb 100644
--- a/include/net/sock.h
+++ b/include/net/sock.h
@@ -1131,6 +1131,8 @@ static inline void sk_forward_alloc_add(struct sock *sk, int val)
 }
 
 void sk_stream_write_space(struct sock *sk);
+void sk_set_nospace(struct sock *sk);
+void sk_clear_nospace(struct sock *sk);
 
 /* OOB backlog add */
 static inline void __sk_add_backlog(struct sock *sk, struct sk_buff *skb)
diff --git a/include/net/strparser.h b/include/net/strparser.h
index 881b7ae34498..c2938eda3e79 100644
--- a/include/net/strparser.h
+++ b/include/net/strparser.h
@@ -32,7 +32,6 @@ struct strp_aggr_stats {
 	unsigned int msg_too_big;
 	unsigned int msg_timeouts;
 	unsigned int bad_hdr_len;
-	unsigned int aborts;
 	unsigned int interrupted;
 	unsigned int unrecov_intr;
 };
@@ -46,9 +45,6 @@ struct strp_callbacks {
 	int (*read_sock)(struct strparser *strp, read_descriptor_t *desc,
 			 sk_read_actor_t recv_actor);
 	int (*read_sock_done)(struct strparser *strp, int err);
-	void (*abort_parser)(struct strparser *strp, int err);
-	void (*lock)(struct strparser *strp);
-	void (*unlock)(struct strparser *strp);
 };
 
 struct strp_msg {
@@ -93,7 +89,6 @@ struct strparser {
 
 	u8 stopped;
 	u8 paused;
-	u8 aborted;
 	u8 interrupted;
 	u8 unrecov_intr;
 
@@ -131,8 +126,6 @@ static inline void save_strp_stats(struct strparser *strp,
 	SAVE_PSOCK_STATS(bad_hdr_len);
 #undef SAVE_PSOCK_STATS
 
-	if (strp->aborted)
-		agg_stats->aborts++;
 	if (strp->interrupted)
 		agg_stats->interrupted++;
 	if (strp->unrecov_intr)
@@ -150,7 +143,6 @@ static inline void aggregate_strp_stats(struct strp_aggr_stats *stats,
 	SAVE_PSOCK_STATS(msg_too_big);
 	SAVE_PSOCK_STATS(msg_timeouts);
 	SAVE_PSOCK_STATS(bad_hdr_len);
-	SAVE_PSOCK_STATS(aborts);
 	SAVE_PSOCK_STATS(interrupted);
 	SAVE_PSOCK_STATS(unrecov_intr);
 #undef SAVE_PSOCK_STATS
@@ -163,8 +155,5 @@ void strp_check_rcv(struct strparser *strp);
 int strp_init(struct strparser *strp, struct sock *sk,
 	      const struct strp_callbacks *cb);
 void strp_data_ready(struct strparser *strp);
-int strp_process(struct strparser *strp, struct sk_buff *orig_skb,
-		 unsigned int orig_offset, size_t orig_len,
-		 size_t max_msg_size, long timeo);
 
 #endif /* __NET_STRPARSER_H_ */
diff --git a/include/net/tcp.h b/include/net/tcp.h
index 4416cdf9bf30..0265c27a5fd7 100644
--- a/include/net/tcp.h
+++ b/include/net/tcp.h
@@ -783,14 +783,42 @@ void tcp_done_with_error(struct sock *sk, int err);
 void tcp_reset(struct sock *sk, struct sk_buff *skb);
 void tcp_fin(struct sock *sk);
 void __tcp_check_space(struct sock *sk);
+
+/* Mirror of SOCK_NOSPACE in tcp_sock, maintained by sk_set_nospace()
+ * and sk_clear_nospace().
+ *
+ * MPTCP subflows share the parent socket, and thus its SOCK_NOSPACE bit.
+ * Keep their mirror always set (see subflow_ulp_init()) so that they
+ * always reach __tcp_check_space() and behave as before.
+ */
+static inline void tcp_set_nospace(struct sock *sk)
+{
+	if (sk_is_tcp(sk)) {
+		/* pairs with smp_mb__before_atomic() in tcp_clear_nospace() */
+		smp_mb__after_atomic();
+		/* pairs with smp_mb() in tcp_check_space() */
+		smp_store_mb(tcp_sk(sk)->tcp_nospace, 1);
+	}
+}
+
+static inline void tcp_clear_nospace(struct sock *sk)
+{
+	if (sk_is_tcp(sk) && !sk_is_mptcp(sk)) {
+		WRITE_ONCE(tcp_sk(sk)->tcp_nospace, 0);
+		/* pairs with smp_mb__after_atomic() in tcp_set_nospace() */
+		smp_mb__before_atomic();
+	}
+}
+
 static inline void tcp_check_space(struct sock *sk)
 {
 	/* pairs with tcp_poll() */
 	smp_mb();
 
-	if (sk->sk_socket && test_bit(SOCK_NOSPACE, &sk->sk_socket->flags))
+	if (unlikely(READ_ONCE(tcp_sk(sk)->tcp_nospace)))
 		__tcp_check_space(sk);
 }
+
 void tcp_sack_compress_send_ack(struct sock *sk);
 
 static inline void tcp_cleanup_skb(struct sk_buff *skb)
@@ -823,6 +851,9 @@ unsigned int tcp_sync_mss(struct sock *sk, u32 pmtu);
 unsigned int tcp_current_mss(struct sock *sk);
 u32 tcp_clamp_probe0_to_user_timeout(const struct sock *sk, u32 when);
 
+u32 tcp_tso_autosize(const struct sock *sk, unsigned int mss_now,
+		     int min_tso_segs);
+
 /* Bound MSS / TSO packet size with the half of the window */
 static inline int tcp_bound_to_half_wnd(struct tcp_sock *tp, int pktsize)
 {
@@ -1360,8 +1391,16 @@ struct tcp_congestion_ops {
 	/* hook for packet ack accounting (optional) */
 	void (*pkts_acked)(struct sock *sk, const struct ack_sample *sample);
 
-	/* override sysctl_tcp_min_tso_segs (optional) */
-	u32 (*min_tso_segs)(struct sock *sk);
+	/* Override tcp_tso_autosize() (optional)
+	 *
+	 * If provided, this callback supplies the TSO segment target count
+	 * instead of using tcp_tso_autosize(). The returned value is
+	 * subsequently clamped to [1, sk->sk_gso_max_segs] by the caller.
+	 *
+	 * For the kernel callback path, mss_now originates from
+	 * tcp_current_mss() and should never be zero.
+	 */
+	u32 (*tso_segs)(struct sock *sk, u32 mss_now);
 
 	/* new value of cwnd after loss (required) */
 	u32  (*undo_cwnd)(struct sock *sk);
@@ -3082,7 +3121,7 @@ enum skb_drop_reason tcp_inbound_hash(struct sock *sk,
 
 static inline int tcp_recv_should_stop(struct sock *sk)
 {
-	return sk->sk_err ||
+	return READ_ONCE(sk->sk_err) ||
 	       sk->sk_state == TCP_CLOSE ||
 	       (sk->sk_shutdown & RCV_SHUTDOWN) ||
 	       signal_pending(current);
diff --git a/include/net/udp.h b/include/net/udp.h
index 1fee17274745..5bc25dcf25fb 100644
--- a/include/net/udp.h
+++ b/include/net/udp.h
@@ -613,7 +613,7 @@ static inline struct sk_buff *udp_rcv_segment(struct sock *sk,
 	/* the GSO CB lays after the UDP one, no need to save and restore any
 	 * CB fragment
 	 */
-	segs = __skb_gso_segment(skb, features, false);
+	segs = __skb_gso_segment(skb, features, false, 0);
 	if (IS_ERR_OR_NULL(segs)) {
 		drop_count = skb_shinfo(skb)->gso_segs;
 		goto drop;
diff --git a/include/net/vxlan.h b/include/net/vxlan.h
index 7b8207505523..c3c9f2ccc3d1 100644
--- a/include/net/vxlan.h
+++ b/include/net/vxlan.h
@@ -204,7 +204,6 @@ struct vxlan_rdst {
 	u8			 offloaded:1;
 	__be32			 remote_vni;
 	u32			 remote_ifindex;
-	struct net_device	 *remote_dev;
 	struct list_head	 list;
 	struct rcu_head		 rcu;
 	struct dst_cache	 dst_cache;
@@ -229,6 +228,7 @@ struct vxlan_config {
 	bool				no_share;
 	enum ifla_vxlan_df		df;
 	struct vxlanhdr			reserved_bits;
+	struct rcu_head			rcu;
 };
 
 enum {
@@ -294,14 +294,15 @@ struct vxlan_dev {
 #endif
 	struct net_device *dev;
 	struct net	  *net;		/* netns for packet i/o */
-	struct vxlan_rdst default_dst;	/* default destination */
+	struct net_device *lowerdev;
 
 	struct timer_list age_timer;
 	spinlock_t	  hash_lock;
 	unsigned int	  addrcnt;
 	struct gro_cells  gro_cells;
+	unsigned long	  flags;
 
-	struct vxlan_config	cfg;
+	struct vxlan_config __rcu	*cfg;
 
 	struct vxlan_vni_group  __rcu *vnigrp;
 
@@ -313,6 +314,10 @@ struct vxlan_dev {
 	unsigned int mdb_seq;
 };
 
+enum vxlan_dev_flags {
+	VXLAN_DEV_F_MDB,
+};
+
 #define VXLAN_F_LEARN			0x01
 #define VXLAN_F_PROXY			0x02
 #define VXLAN_F_RSC			0x04
@@ -331,7 +336,6 @@ struct vxlan_dev {
 #define VXLAN_F_IPV6_LINKLOCAL		0x8000
 #define VXLAN_F_TTL_INHERIT		0x10000
 #define VXLAN_F_VNIFILTER               0x20000
-#define VXLAN_F_MDB			0x40000
 #define VXLAN_F_LOCALBYPASS		0x80000
 #define VXLAN_F_MC_ROUTE		0x100000
 
diff --git a/include/trace/events/bridge.h b/include/trace/events/bridge.h
index 3fe4725c83ff..f676516b33fa 100644
--- a/include/trace/events/bridge.h
+++ b/include/trace/events/bridge.h
@@ -68,13 +68,14 @@ TRACE_EVENT(br_fdb_external_learn_add,
 
 TRACE_EVENT(fdb_delete,
 
-	TP_PROTO(struct net_bridge *br, struct net_bridge_fdb_entry *f),
+	TP_PROTO(struct net_bridge *br, struct net_bridge_fdb_entry *f,
+		 const struct net_bridge_port *dst),
 
-	TP_ARGS(br, f),
+	TP_ARGS(br, f, dst),
 
 	TP_STRUCT__entry(
 		__string(br_dev, br->dev->name)
-		__string(dev, f->dst ? f->dst->dev->name : "null")
+		__string(dev, dst ? dst->dev->name : "null")
 		__array(unsigned char, addr, ETH_ALEN)
 		__field(u16, vid)
 	),
diff --git a/include/trace/events/fib.h b/include/trace/events/fib.h
index feb28b359eff..e0ee14d6ca45 100644
--- a/include/trace/events/fib.h
+++ b/include/trace/events/fib.h
@@ -15,9 +15,10 @@
 TRACE_EVENT(fib_table_lookup,
 
 	TP_PROTO(u32 tb_id, const struct flowi4 *flp,
-		 const struct fib_nh_common *nhc, int err),
+		 const struct fib_nh_common *nhc, int err,
+		 const struct net *net),
 
-	TP_ARGS(tb_id, flp, nhc, err),
+	TP_ARGS(tb_id, flp, nhc, err, net),
 
 	TP_STRUCT__entry(
 		__field(	u32,	tb_id		)
@@ -35,6 +36,7 @@ TRACE_EVENT(fib_table_lookup,
 		__field(	u16,	sport		)
 		__field(	u16,	dport		)
 		__array(char,  name,   IFNAMSIZ )
+		__field(	u64,	net_cookie	)
 	),
 
 	TP_fast_assign(
@@ -90,13 +92,16 @@ TRACE_EVENT(fib_table_lookup,
 			in6 = (struct in6_addr *)__entry->gw6;
 			*in6 = in6addr_any;
 		}
+
+		__entry->net_cookie = net->net_cookie;
 	),
 
-	TP_printk("table %u oif %d iif %d proto %u %pI4/%u -> %pI4/%u tos %d scope %d flags %x ==> dev %s gw %pI4/%pI6c err %d",
+	TP_printk("table %u oif %d iif %d proto %u %pI4/%u -> %pI4/%u tos %d scope %d flags %x ==> dev %s gw %pI4/%pI6c err %d net_cookie %llu",
 		  __entry->tb_id, __entry->oif, __entry->iif, __entry->proto,
 		  __entry->src, __entry->sport, __entry->dst, __entry->dport,
 		  __entry->tos, __entry->scope, __entry->flags,
-		  __entry->name, __entry->gw4, __entry->gw6, __entry->err)
+		  __entry->name, __entry->gw4, __entry->gw6, __entry->err,
+		  __entry->net_cookie)
 );
 #endif /* _TRACE_FIB_H */
 
diff --git a/include/trace/events/fib6.h b/include/trace/events/fib6.h
index 8d22b2e98d48..e58facd2d7d4 100644
--- a/include/trace/events/fib6.h
+++ b/include/trace/events/fib6.h
@@ -34,6 +34,7 @@ TRACE_EVENT(fib6_table_lookup,
 		__field(        u8,	rt_type		)
 		__array(		char,	name,	IFNAMSIZ )
 		__array(		__u8,	gw,	16	 )
+		__field(	u64,	net_cookie	)
 	),
 
 	TP_fast_assign(
@@ -76,13 +77,16 @@ TRACE_EVENT(fib6_table_lookup,
 			in6 = (struct in6_addr *)__entry->gw;
 			*in6 = res->nh->fib_nh_gw6;
 		}
+
+		__entry->net_cookie = net->net_cookie;
 	),
 
-	TP_printk("table %3u oif %d iif %d proto %u %pI6c/%u -> %pI6c/%u flowlabel %#x tos %d scope %d flags %x ==> dev %s gw %pI6c err %d",
+	TP_printk("table %3u oif %d iif %d proto %u %pI6c/%u -> %pI6c/%u flowlabel %#x tos %d scope %d flags %x ==> dev %s gw %pI6c err %d net_cookie %llu",
 		  __entry->tb_id, __entry->oif, __entry->iif, __entry->proto,
 		  __entry->src, __entry->sport, __entry->dst, __entry->dport,
 		  __entry->flowlabel, __entry->tos, __entry->scope,
-		  __entry->flags, __entry->name, __entry->gw, __entry->err)
+		  __entry->flags, __entry->name, __entry->gw, __entry->err,
+		  __entry->net_cookie)
 );
 
 #endif /* _TRACE_FIB6_H */
diff --git a/include/uapi/linux/atm.h b/include/uapi/linux/atm.h
index 95ebdcf4fe88..7a3789f39f52 100644
--- a/include/uapi/linux/atm.h
+++ b/include/uapi/linux/atm.h
@@ -39,7 +39,7 @@
 #define ATM_MAX_VCI		 65535	/* maximum VCI */
 
 
-/* "protcol" values for the socket system call */
+/* "protocol" values for the socket system call */
 #define ATM_NO_AAL	0		/* AAL not specified */
 #define ATM_AAL0	13		/* "raw" ATM cells */
 #define ATM_AAL1	1		/* AAL1 (CBR) */
diff --git a/include/uapi/linux/dpll.h b/include/uapi/linux/dpll.h
index 85b898b1db5e..8c71fc3f9863 100644
--- a/include/uapi/linux/dpll.h
+++ b/include/uapi/linux/dpll.h
@@ -29,8 +29,7 @@ enum dpll_mode {
 /**
  * enum dpll_lock_status - provides information of dpll device lock status,
  *   valid values for DPLL_A_LOCK_STATUS attribute
- * @DPLL_LOCK_STATUS_UNLOCKED: dpll was not yet locked to any valid input (or
- *   forced by setting DPLL_A_MODE to DPLL_MODE_DETACHED)
+ * @DPLL_LOCK_STATUS_UNLOCKED: dpll was not yet locked to any valid input
  * @DPLL_LOCK_STATUS_LOCKED: dpll is locked to a valid signal, but no holdover
  *   available
  * @DPLL_LOCK_STATUS_LOCKED_HO_ACQ: dpll is locked and holdover acquired
diff --git a/include/uapi/linux/handshake.h b/include/uapi/linux/handshake.h
index d7e40f594888..f907aa082520 100644
--- a/include/uapi/linux/handshake.h
+++ b/include/uapi/linux/handshake.h
@@ -13,7 +13,10 @@
 enum handshake_handler_class {
 	HANDSHAKE_HANDLER_CLASS_NONE,
 	HANDSHAKE_HANDLER_CLASS_TLSHD,
-	HANDSHAKE_HANDLER_CLASS_MAX,
+
+	/* private: */
+	__HANDSHAKE_HANDLER_CLASS_MAX,
+	HANDSHAKE_HANDLER_CLASS_MAX = (__HANDSHAKE_HANDLER_CLASS_MAX - 1)
 };
 
 enum handshake_msg_type {
diff --git a/include/uapi/linux/if_link.h b/include/uapi/linux/if_link.h
index 43cecca49f01..245b36204525 100644
--- a/include/uapi/linux/if_link.h
+++ b/include/uapi/linux/if_link.h
@@ -381,6 +381,7 @@ enum {
 	IFLA_NETNS_IMMUTABLE,
 	IFLA_HEADROOM,
 	IFLA_TAILROOM,
+	IFLA_PACING_OFFLOAD,
 	__IFLA_MAX
 };
 
diff --git a/include/uapi/linux/mii.h b/include/uapi/linux/mii.h
index 61d6edad4b94..d662c10ee282 100644
--- a/include/uapi/linux/mii.h
+++ b/include/uapi/linux/mii.h
@@ -81,7 +81,7 @@
 #define ADVERTISE_1000XPSE_ASYM	0x0100	/* Try for 1000BASE-X asym pause */
 #define ADVERTISE_100BASE4	0x0200	/* Try for 100mbps 4k packets  */
 #define ADVERTISE_PAUSE_CAP	0x0400	/* Try for pause               */
-#define ADVERTISE_PAUSE_ASYM	0x0800	/* Try for asymetric pause     */
+#define ADVERTISE_PAUSE_ASYM	0x0800	/* Try for asymmetric pause     */
 #define ADVERTISE_XNP		0x1000  /* Extended Next Page */
 #define ADVERTISE_RESV		ADVERTISE_XNP /* Used to be reserved */
 #define ADVERTISE_RFAULT	0x2000	/* Say we can detect faults    */
diff --git a/include/uapi/linux/netdev.h b/include/uapi/linux/netdev.h
index 35ff083221c7..9026e0414fbe 100644
--- a/include/uapi/linux/netdev.h
+++ b/include/uapi/linux/netdev.h
@@ -58,7 +58,7 @@ enum netdev_xdp_rx_metadata {
  * enum netdev_xsk_flags
  * @NETDEV_XSK_FLAGS_TX_TIMESTAMP: HW timestamping egress packets is supported
  *   by the driver.
- * @NETDEV_XSK_FLAGS_TX_CHECKSUM: L3 checksum HW offload is supported by the
+ * @NETDEV_XSK_FLAGS_TX_CHECKSUM: L4 checksum HW offload is supported by the
  *   driver.
  * @NETDEV_XSK_FLAGS_TX_LAUNCH_TIME_FIFO: Launch time HW offload is supported
  *   by the driver.
diff --git a/include/uapi/linux/netfilter/nfnetlink_conntrack.h b/include/uapi/linux/netfilter/nfnetlink_conntrack.h
index 43233af75b9d..985f9c08d3e9 100644
--- a/include/uapi/linux/netfilter/nfnetlink_conntrack.h
+++ b/include/uapi/linux/netfilter/nfnetlink_conntrack.h
@@ -285,6 +285,7 @@ enum ctattr_filter {
 	CTA_FILTER_UNSPEC,
 	CTA_FILTER_ORIG_FLAGS,
 	CTA_FILTER_REPLY_FLAGS,
+	CTA_FILTER_ZONE,
 	__CTA_FILTER_MAX
 };
 #define CTA_FILTER_MAX (__CTA_FILTER_MAX - 1)
diff --git a/include/uapi/linux/netlink.h b/include/uapi/linux/netlink.h
index f87aaf28a649..82c41aeb4357 100644
--- a/include/uapi/linux/netlink.h
+++ b/include/uapi/linux/netlink.h
@@ -330,6 +330,17 @@ enum netlink_attribute_type {
 };
 
 /**
+ * enum netlink_policy_byte_order - byte order of an integer attribute
+ * @NL_POLICY_BYTE_ORDER_BIG_ENDIAN: big endian (network byte order)
+ *
+ * Zero is left unassigned so that it keeps meaning host byte order,
+ * which is also what a missing byte order means.
+ */
+enum netlink_policy_byte_order {
+	NL_POLICY_BYTE_ORDER_BIG_ENDIAN = 1,
+};
+
+/**
  * enum netlink_policy_type_attr - policy type attributes
  * @NL_POLICY_TYPE_ATTR_UNSPEC: unused
  * @NL_POLICY_TYPE_ATTR_TYPE: type of the attribute,
@@ -356,6 +367,8 @@ enum netlink_attribute_type {
  *	bitfield32 type (U32)
  * @NL_POLICY_TYPE_ATTR_MASK: mask of valid bits for unsigned integers (U64)
  * @NL_POLICY_TYPE_ATTR_PAD: pad attribute for 64-bit alignment
+ * @NL_POLICY_TYPE_ATTR_BYTE_ORDER: byte order of an integer attribute,
+ *	&enum netlink_policy_byte_order, absent if host byte order (U32)
  *
  * @__NL_POLICY_TYPE_ATTR_MAX: number of attributes
  * @NL_POLICY_TYPE_ATTR_MAX: highest attribute number
@@ -374,6 +387,7 @@ enum netlink_policy_type_attr {
 	NL_POLICY_TYPE_ATTR_BITFIELD32_MASK,
 	NL_POLICY_TYPE_ATTR_PAD,
 	NL_POLICY_TYPE_ATTR_MASK,
+	NL_POLICY_TYPE_ATTR_BYTE_ORDER,
 
 	/* keep last */
 	__NL_POLICY_TYPE_ATTR_MAX,
diff --git a/include/uapi/linux/nl80211.h b/include/uapi/linux/nl80211.h
index 020387d76412..341f8395d1af 100644
--- a/include/uapi/linux/nl80211.h
+++ b/include/uapi/linux/nl80211.h
@@ -937,8 +937,8 @@
  *	OLBC handling in hostapd. Beacons are reported in %NL80211_CMD_FRAME
  *	messages. Note that per PHY only one application may register.
  *
- * @NL80211_CMD_SET_NOACK_MAP: sets a bitmap for the individual TIDs whether
- *      No Acknowledgement Policy should be applied.
+ * @NL80211_CMD_SET_NOACK_MAP: sets a bitmap (%NL80211_ATTR_TID_BITMAP)
+ *	indicating for which TIDs No Acknowledgment Policy should be applied.
  *
  * @NL80211_CMD_CH_SWITCH_NOTIFY: An AP or GO may decide to switch channels
  *	independently of the userspace SME, send this event indicating
@@ -1383,6 +1383,13 @@
  *	from the device to perform an announced schedule update. See
  *	%NL80211_ATTR_NAN_SCHED_DEFERRED for more details.
  *	If not set, the schedule should be applied immediately.
+ *	Setting a new schedule is always allowed and is never treated as an
+ *	evacuation, even if it removes channels that were previously marked as
+ *	non-evacuable with %NL80211_CMD_NAN_SET_NON_EVAC_CHANNELS. The
+ *	non-evacuable marking is a per-channel property of the schedule:
+ *	channels that remain in the new schedule keep their marking, channels
+ *	that are removed simply lose it, and newly added channels are
+ *	evacuable by default.
  * @NL80211_CMD_NAN_SCHED_UPDATE_DONE: Event sent to user space to notify that
  *	a deferred local NAN schedule update (requested with
  *	%NL80211_CMD_NAN_SET_LOCAL_SCHED and %NL80211_ATTR_NAN_SCHED_DEFERRED)
@@ -1399,10 +1406,12 @@
  *	be provided.
  *	Each peer channel must be compatible with at least one local channel
  *	set by %NL80211_CMD_SET_LOCAL_NAN_SCHED. Different maps must not
- *	contain compatible channels.
- *	For single-radio devices (n_radio <= 1), different maps must not
- *	schedule the same time slot, as the device cannot operate on multiple
- *	channels simultaneously.
+ *	contain compatible channels. Two maps may schedule the same time slot.
+ *	The device decides at runtime which of the channels to follow.
+ *	For example, the local schedule may place slot S on channel c1 while
+ *	the peer advertises slot S on both c1 and c2. If the device is anyway
+ *	on c2 during slot S (e.g. via the ULW mechanism for non-NAN activity),
+ *	it may use slot S on c2 to communicate with the peer.
  *	When updating an existing peer schedule, the full new schedule must be
  *	provided - partial updates are not supported. The new schedule will
  *	completely replace the previous one.
@@ -1427,6 +1436,28 @@
  * @NL80211_CMD_STOP_PD: Stop the PD operation, identified by
  *	its %NL80211_ATTR_WDEV interface.
  *
+ * @NL80211_CMD_NAN_SET_NON_EVAC_CHANNELS: Set the list of NAN local schedule
+ *	channels that must not be evacuated. NAN must be operational
+ *	(%NL80211_CMD_START_NAN was executed) and a local schedule must have
+ *	been set (%NL80211_CMD_NAN_SET_LOCAL_SCHED). The command carries zero
+ *	or more nested %NL80211_ATTR_NAN_CHANNEL attributes, each identifying a
+ *	channel (by its channel definition) of the current local schedule that
+ *	must not be evacuated for concurrent operations. The provided list
+ *	replaces the previous set of non-evacuable channels; channels of the
+ *	current schedule that are not included become evacuable again. All
+ *	provided channels must exist in the current local schedule, otherwise
+ *	the command fails. This is used to protect channels carrying NDC or
+ *	immutable schedules, whose evacuation would break existing NDP
+ *	connections.
+ *	The non-evacuable marking is a per-channel property of the current
+ *	local schedule and only affects evacuation for concurrent operations;
+ *	it does not prevent the schedule itself from being changed. Removing a
+ *	channel from the schedule with %NL80211_CMD_NAN_SET_LOCAL_SCHED is a
+ *	user-initiated change, not an evacuation, and is allowed even for a
+ *	non-evacuable channel. Across a schedule update, channels that remain
+ *	keep their non-evacuable marking, removed channels lose it, and newly
+ *	added channels are evacuable by default; issue this command again to
+ *	change the non-evacuable set.
  * @NL80211_CMD_MAX: highest used command number
  * @__NL80211_CMD_AFTER_LAST: internal use
  */
@@ -1705,6 +1736,8 @@ enum nl80211_commands {
 	NL80211_CMD_START_PD,
 	NL80211_CMD_STOP_PD,
 
+	NL80211_CMD_NAN_SET_NON_EVAC_CHANNELS,
+
 	/* add new commands above here */
 
 	/* used to define NL80211_CMD_MAX below */
@@ -2288,8 +2321,8 @@ enum nl80211_commands {
  *    abides to when initiating radiation on DFS channels. A country maps
  *    to one DFS region.
  *
- * @NL80211_ATTR_NOACK_MAP: This u16 bitmap contains the No Ack Policy of
- *      up to 16 TIDs.
+ * @NL80211_ATTR_TID_BITMAP: A TID bitmap (u16) whose meaning depends
+ *	on the command.
  *
  * @NL80211_ATTR_INACTIVITY_TIMEOUT: timeout value in seconds, this can be
  *	used by the drivers which has MLME in firmware and does not have support
@@ -3185,6 +3218,19 @@ enum nl80211_commands {
  *	The aggregated message always precedes the per-link messages for the
  *	same station within a dump sequence.
  *
+ * @NL80211_ATTR_FRAME_NO_STA: Valid for @NL80211_CMD_FRAME to denote that
+ *	the kernel had no station for a received frame or should not use a
+ *	known station to transmit a frame. This is relevant to know whether
+ *	MLD address translation happened or to disable it when sending a frame.
+ *
+ * @NL80211_ATTR_ASSOC_CIP: Enable Control Integrity Protocol for the
+ *	association
+ * @NL80211_ATTR_CIP_CAPABILITIES: The Control Integrity Protocol for the
+ *	station.
+ *
+ * @NL80211_ATTR_ASSOC_PROTECTED_TWT: Enable protected TWT for the association,
+ *	requires protected TWT support (flag attribute)
+ *
  * @NUM_NL80211_ATTR: total number of nl80211_attrs available
  * @NL80211_ATTR_MAX: highest attribute number currently defined
  * @__NL80211_ATTR_AFTER_LAST: internal use
@@ -3429,7 +3475,7 @@ enum nl80211_attrs {
 	NL80211_ATTR_DISABLE_HT,
 	NL80211_ATTR_HT_CAPABILITY_MASK,
 
-	NL80211_ATTR_NOACK_MAP,
+	NL80211_ATTR_TID_BITMAP,
 
 	NL80211_ATTR_INACTIVITY_TIMEOUT,
 
@@ -3785,6 +3831,13 @@ enum nl80211_attrs {
 
 	NL80211_ATTR_STA_DUMP_LINK_STATS,
 
+	NL80211_ATTR_FRAME_NO_STA,
+
+	NL80211_ATTR_ASSOC_CIP,
+	NL80211_ATTR_CIP_CAPABILITIES,
+
+	NL80211_ATTR_ASSOC_PROTECTED_TWT,
+
 	/* add attributes here, update the policy in nl80211.c */
 
 	__NL80211_ATTR_AFTER_LAST,
@@ -3800,6 +3853,7 @@ enum nl80211_attrs {
 #define NL80211_ATTR_CSA_C_OFF_BEACON NL80211_ATTR_CNTDWN_OFFS_BEACON
 #define NL80211_ATTR_CSA_C_OFF_PRESP NL80211_ATTR_CNTDWN_OFFS_PRESP
 #define NL80211_ATTR_ASSOC_MLD_EXT_CAPA_OPS NL80211_ATTR_EXT_MLD_CAPA_AND_OPS
+#define NL80211_ATTR_NOACK_MAP NL80211_ATTR_TID_BITMAP
 
 /*
  * Allow user space programs to use #ifdef on new attributes by defining them
@@ -3934,6 +3988,7 @@ enum nl80211_iftype {
  *	that support %NL80211_FEATURE_FULL_AP_CLIENT_STATE to transition a
  *	previously added station into associated state
  * @NL80211_STA_FLAG_SPP_AMSDU: station supports SPP A-MSDUs
+ * @NL80211_STA_FLAG_CIP: station has Control Integrity Protocol (CIP) enabled
  * @NL80211_STA_FLAG_MAX: highest station flag number currently defined
  * @__NL80211_STA_FLAG_AFTER_LAST: internal use
  */
@@ -3947,6 +4002,7 @@ enum nl80211_sta_flags {
 	NL80211_STA_FLAG_TDLS_PEER,
 	NL80211_STA_FLAG_ASSOCIATED,
 	NL80211_STA_FLAG_SPP_AMSDU,
+	NL80211_STA_FLAG_CIP,
 
 	/* keep last */
 	__NL80211_STA_FLAG_AFTER_LAST,
@@ -5778,12 +5834,16 @@ enum nl80211_auth_type {
  * @NL80211_KEYTYPE_GROUP: Group (broadcast/multicast) key
  * @NL80211_KEYTYPE_PAIRWISE: Pairwise (unicast/individual) key
  * @NL80211_KEYTYPE_PEERKEY: PeerKey (DLS)
+ * @NL80211_KEYTYPE_CIGTK: Control Integrity Group Temporal Key
+ *	The cipher is GMAC-256 but passed as GCMP-256,
+ *	same as the pairwise key when used for CIP.
  * @NUM_NL80211_KEYTYPES: number of defined key types
  */
 enum nl80211_key_type {
 	NL80211_KEYTYPE_GROUP,
 	NL80211_KEYTYPE_PAIRWISE,
 	NL80211_KEYTYPE_PEERKEY,
+	NL80211_KEYTYPE_CIGTK,
 
 	NUM_NL80211_KEYTYPES
 };
@@ -5900,6 +5960,9 @@ enum nl80211_key_attributes {
  *	see &struct nl80211_txrate_eht
  * @NL80211_TXRATE_EHT_GI: configure EHT GI, (u8, see &enum nl80211_eht_gi)
  * @NL80211_TXRATE_EHT_LTF: configure EHT LTF, (u8, see &enum nl80211_eht_ltf)
+ * @NL80211_TXRATE_6GHZ_NON_HT_DUP: configure 6 GHz non-HT duplicate Beacon
+ *	transmission. This flag is applicable only in Beacon TX rate setting
+ *	and must be accompanied by a non-HT (legacy) Beacon rate.
  * @__NL80211_TXRATE_AFTER_LAST: internal
  * @NL80211_TXRATE_MAX: highest TX rate attribute
  */
@@ -5915,6 +5978,7 @@ enum nl80211_tx_rate_attributes {
 	NL80211_TXRATE_EHT,
 	NL80211_TXRATE_EHT_GI,
 	NL80211_TXRATE_EHT_LTF,
+	NL80211_TXRATE_6GHZ_NON_HT_DUP,
 
 	/* keep last */
 	__NL80211_TXRATE_AFTER_LAST,
@@ -7110,6 +7174,10 @@ enum nl80211_feature_flags {
  * @NL80211_EXT_FEATURE_PROBE_AP: Driver supports probing the associated AP
  *	in STA mode using @NL80211_CMD_PROBE_PEER.
  *
+ * @NL80211_EXT_FEATURE_FAST_ROAM_OFFLOAD: Driver supports fast roaming
+ *	offload in station mode, including Fast Transition or Opportunistic
+ *	Key Caching.
+ *
  * @NUM_NL80211_EXT_FEATURES: number of extended features.
  * @MAX_NL80211_EXT_FEATURES: highest extended feature index.
  */
@@ -7192,6 +7260,7 @@ enum nl80211_ext_feature_index {
 	NL80211_EXT_FEATURE_ROC_ADDR_FILTER,
 	NL80211_EXT_FEATURE_SET_KEY_LTF_SEED,
 	NL80211_EXT_FEATURE_PROBE_AP,
+	NL80211_EXT_FEATURE_FAST_ROAM_OFFLOAD,
 
 	/* add new features before the definition below */
 	NUM_NL80211_EXT_FEATURES,
@@ -7826,6 +7895,11 @@ enum nl80211_nan_band_conf_attributes {
  *	the upcoming discovery window with
  *	%NL80211_CMD_NAN_NEXT_DW_NOTIFICATION.
  *	This is a flag attribute.
+ * @NL80211_NAN_CONF_INSTANT_COMM: If set, the NAN synchronization logic will
+ *	start Instant Communication (IC) as defined in Chapter 13 of the
+ *	Wi-Fi Aware Specification v4.0.
+ *	%NL80211_NAN_CONF_DISCOVERY_BEACON_INTERVAL must be set as well.
+ *	This is a flag attribute.
  * @NUM_NL80211_NAN_CONF_ATTR: Internal.
  * @NL80211_NAN_CONF_ATTR_MAX: Highest NAN configuration attribute.
  *
@@ -7841,6 +7915,7 @@ enum nl80211_nan_conf_attributes {
 	NL80211_NAN_CONF_SCAN_DWELL_TIME,
 	NL80211_NAN_CONF_DISCOVERY_BEACON_INTERVAL,
 	NL80211_NAN_CONF_NOTIFY_DW,
+	NL80211_NAN_CONF_INSTANT_COMM,
 
 	/* keep last */
 	NUM_NL80211_NAN_CONF_ATTR,
@@ -9057,6 +9132,11 @@ enum nl80211_s1g_short_beacon_attrs {
  *	specification Table 79 (Capabilities field).
  * @NL80211_NAN_CAPA_PHY: nested attribute containing band-agnostic
  *	capabilities for NAN data path. See &enum nl80211_nan_phy_cap_attr.
+ * @NL80211_NAN_CAPA_INSTANT_COMM: Flag attribute indicating that the device
+ *	can switch to Instant Communication (IC) mode, as defined in Chapter 13
+ *	of the Wi-Fi Aware Specification v4.0. Can only be set if
+ *	%NL80211_NAN_CAPA_CONFIGURABLE_SYNC is set. When IC is enabled, the IC
+ *	schedule is expected to be configured by user space.
  * @__NL80211_NAN_CAPABILITIES_LAST: Internal
  * @NL80211_NAN_CAPABILITIES_MAX: Highest NAN capability attribute.
  */
@@ -9070,6 +9150,7 @@ enum nl80211_nan_capabilities {
 	NL80211_NAN_CAPA_MAX_CHANNEL_SWITCH_TIME,
 	NL80211_NAN_CAPA_CAPABILITIES,
 	NL80211_NAN_CAPA_PHY,
+	NL80211_NAN_CAPA_INSTANT_COMM,
 	/* keep last */
 	__NL80211_NAN_CAPABILITIES_LAST,
 	NL80211_NAN_CAPABILITIES_MAX = __NL80211_NAN_CAPABILITIES_LAST - 1,