Merge tag 'for-linus-timers-conversion-final-v4.15-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux into timers/urgent

Pull the last batch of manual timer conversions from Kees Cook:

 - final batch of "non trivial" timer conversions (multi-tree dependencies,
   things Coccinelle couldn't handle, etc).

 - treewide conversions via Coccinelle, in 4 steps:
   - DEFINE_TIMER() functions converted to struct timer_list * argument
   - init_timer() -> setup_timer()
   - setup_timer() -> timer_setup()
   - setup_timer() -> timer_setup() (with a single embedded structure)

 - deprecated timer API removals (init_timer(), setup_*timer())

 - finalization of new API (remove global casts)

494 files changed, 18202 insertions, 8639 deletions

diff --git a/net/802/garp.c b/net/802/garp.c
index 2dac647ff420..7f50d47470bd 100644
--- a/net/802/garp.c
+++ b/net/802/garp.c
@@ -401,9 +401,9 @@ static void garp_join_timer_arm(struct garp_applicant *app)
         mod_timer(&app->join_timer, jiffies + delay);
 }
 
-static void garp_join_timer(unsigned long data)
+static void garp_join_timer(struct timer_list *t)
 {
-        struct garp_applicant *app = (struct garp_applicant *)data;
+        struct garp_applicant *app = from_timer(app, t, join_timer);
 
         spin_lock(&app->lock);
         garp_gid_event(app, GARP_EVENT_TRANSMIT_PDU);
@@ -584,7 +584,7 @@ int garp_init_applicant(struct net_device *dev, struct garp_application *appl)
         spin_lock_init(&app->lock);
         skb_queue_head_init(&app->queue);
         rcu_assign_pointer(dev->garp_port->applicants[appl->type], app);
-        setup_timer(&app->join_timer, garp_join_timer, (unsigned long)app);
+        timer_setup(&app->join_timer, garp_join_timer, 0);
         garp_join_timer_arm(app);
         return 0;
 
diff --git a/net/802/mrp.c b/net/802/mrp.c
index be4dd3165347..a808dd5bbb27 100644
--- a/net/802/mrp.c
+++ b/net/802/mrp.c
@@ -586,9 +586,9 @@ static void mrp_join_timer_arm(struct mrp_applicant *app)
         mod_timer(&app->join_timer, jiffies + delay);
 }
 
-static void mrp_join_timer(unsigned long data)
+static void mrp_join_timer(struct timer_list *t)
 {
-        struct mrp_applicant *app = (struct mrp_applicant *)data;
+        struct mrp_applicant *app = from_timer(app, t, join_timer);
 
         spin_lock(&app->lock);
         mrp_mad_event(app, MRP_EVENT_TX);
@@ -605,9 +605,9 @@ static void mrp_periodic_timer_arm(struct mrp_applicant *app)
                   jiffies + msecs_to_jiffies(mrp_periodic_time));
 }
 
-static void mrp_periodic_timer(unsigned long data)
+static void mrp_periodic_timer(struct timer_list *t)
 {
-        struct mrp_applicant *app = (struct mrp_applicant *)data;
+        struct mrp_applicant *app = from_timer(app, t, periodic_timer);
 
         spin_lock(&app->lock);
         mrp_mad_event(app, MRP_EVENT_PERIODIC);
@@ -865,10 +865,9 @@ int mrp_init_applicant(struct net_device *dev, struct mrp_application *appl)
         spin_lock_init(&app->lock);
         skb_queue_head_init(&app->queue);
         rcu_assign_pointer(dev->mrp_port->applicants[appl->type], app);
-        setup_timer(&app->join_timer, mrp_join_timer, (unsigned long)app);
+        timer_setup(&app->join_timer, mrp_join_timer, 0);
         mrp_join_timer_arm(app);
-        setup_timer(&app->periodic_timer, mrp_periodic_timer,
-                    (unsigned long)app);
+        timer_setup(&app->periodic_timer, mrp_periodic_timer, 0);
         mrp_periodic_timer_arm(app);
         return 0;
 
diff --git a/net/8021q/vlan.c b/net/8021q/vlan.c
index 4a72ee4e2ae9..8dfdd94e430f 100644
--- a/net/8021q/vlan.c
+++ b/net/8021q/vlan.c
@@ -138,7 +138,7 @@ int vlan_check_real_dev(struct net_device *real_dev,
         return 0;
 }
 
-int register_vlan_dev(struct net_device *dev)
+int register_vlan_dev(struct net_device *dev, struct netlink_ext_ack *extack)
 {
         struct vlan_dev_priv *vlan = vlan_dev_priv(dev);
         struct net_device *real_dev = vlan->real_dev;
@@ -174,7 +174,7 @@ int register_vlan_dev(struct net_device *dev)
         if (err < 0)
                 goto out_uninit_mvrp;
 
-        err = netdev_upper_dev_link(real_dev, dev);
+        err = netdev_upper_dev_link(real_dev, dev, extack);
         if (err)
                 goto out_unregister_netdev;
 
@@ -270,7 +270,7 @@ static int register_vlan_device(struct net_device *real_dev, u16 vlan_id)
         vlan->flags = VLAN_FLAG_REORDER_HDR;
 
         new_dev->rtnl_link_ops = &vlan_link_ops;
-        err = register_vlan_dev(new_dev);
+        err = register_vlan_dev(new_dev, NULL);
         if (err < 0)
                 goto out_free_newdev;
 
@@ -328,6 +328,9 @@ static void vlan_transfer_features(struct net_device *dev,
         vlandev->fcoe_ddp_xid = dev->fcoe_ddp_xid;
 #endif
 
+        vlandev->priv_flags &= ~IFF_XMIT_DST_RELEASE;
+        vlandev->priv_flags |= (vlan->real_dev->priv_flags & IFF_XMIT_DST_RELEASE);
+
         netdev_update_features(vlandev);
 }
 
diff --git a/net/8021q/vlan.h b/net/8021q/vlan.h
index 0e7afdf86127..a8ba51030b75 100644
--- a/net/8021q/vlan.h
+++ b/net/8021q/vlan.h
@@ -108,7 +108,7 @@ void vlan_dev_get_realdev_name(const struct net_device *dev, char *result);
 int vlan_check_real_dev(struct net_device *real_dev,
                         __be16 protocol, u16 vlan_id);
 void vlan_setup(struct net_device *dev);
-int register_vlan_dev(struct net_device *dev);
+int register_vlan_dev(struct net_device *dev, struct netlink_ext_ack *extack);
 void unregister_vlan_dev(struct net_device *dev, struct list_head *head);
 bool vlan_dev_inherit_address(struct net_device *dev,
                               struct net_device *real_dev);
diff --git a/net/8021q/vlan_netlink.c b/net/8021q/vlan_netlink.c
index 5e831de3103e..6689c0b272a7 100644
--- a/net/8021q/vlan_netlink.c
+++ b/net/8021q/vlan_netlink.c
@@ -143,6 +143,7 @@ static int vlan_newlink(struct net *src_net, struct net_device *dev,
         vlan->vlan_proto = proto;
         vlan->vlan_id    = nla_get_u16(data[IFLA_VLAN_ID]);
         vlan->real_dev   = real_dev;
+        dev->priv_flags |= (real_dev->priv_flags & IFF_XMIT_DST_RELEASE);
         vlan->flags      = VLAN_FLAG_REORDER_HDR;
 
         err = vlan_check_real_dev(real_dev, vlan->vlan_proto, vlan->vlan_id);
@@ -160,7 +161,7 @@ static int vlan_newlink(struct net *src_net, struct net_device *dev,
         if (err < 0)
                 return err;
 
-        return register_vlan_dev(dev);
+        return register_vlan_dev(dev, extack);
 }
 
 static inline size_t vlan_qos_map_size(unsigned int n)
diff --git a/net/appletalk/aarp.c b/net/appletalk/aarp.c
index 8ad3ec2610b6..309d7dbb36e8 100644
--- a/net/appletalk/aarp.c
+++ b/net/appletalk/aarp.c
@@ -310,7 +310,7 @@ static void __aarp_expire_device(struct aarp_entry **n, struct net_device *dev)
 }
 
 /* Handle the timer event */
-static void aarp_expire_timeout(unsigned long unused)
+static void aarp_expire_timeout(struct timer_list *unused)
 {
         int ct;
 
@@ -884,7 +884,7 @@ void __init aarp_proto_init(void)
         aarp_dl = register_snap_client(aarp_snap_id, aarp_rcv);
         if (!aarp_dl)
                 printk(KERN_CRIT "Unable to register AARP with SNAP.\n");
-        setup_timer(&aarp_timer, aarp_expire_timeout, 0);
+        timer_setup(&aarp_timer, aarp_expire_timeout, 0);
         aarp_timer.expires  = jiffies + sysctl_aarp_expiry_time;
         add_timer(&aarp_timer);
         register_netdevice_notifier(&aarp_notifier);
diff --git a/net/appletalk/ddp.c b/net/appletalk/ddp.c
index 5d035c1f1156..03a9fc0771c0 100644
--- a/net/appletalk/ddp.c
+++ b/net/appletalk/ddp.c
@@ -158,9 +158,9 @@ found:
         return s;
 }
 
-static void atalk_destroy_timer(unsigned long data)
+static void atalk_destroy_timer(struct timer_list *t)
 {
-        struct sock *sk = (struct sock *)data;
+        struct sock *sk = from_timer(sk, t, sk_timer);
 
         if (sk_has_allocations(sk)) {
                 sk->sk_timer.expires = jiffies + SOCK_DESTROY_TIME;
@@ -175,8 +175,7 @@ static inline void atalk_destroy_socket(struct sock *sk)
         skb_queue_purge(&sk->sk_receive_queue);
 
         if (sk_has_allocations(sk)) {
-                setup_timer(&sk->sk_timer, atalk_destroy_timer,
-                                (unsigned long)sk);
+                timer_setup(&sk->sk_timer, atalk_destroy_timer, 0);
                 sk->sk_timer.expires    = jiffies + SOCK_DESTROY_TIME;
                 add_timer(&sk->sk_timer);
         } else
diff --git a/net/atm/clip.c b/net/atm/clip.c
index 65f706e4344c..d4f6029d5109 100644
--- a/net/atm/clip.c
+++ b/net/atm/clip.c
@@ -153,7 +153,7 @@ static int neigh_check_cb(struct neighbour *n)
         return 1;
 }
 
-static void idle_timer_check(unsigned long dummy)
+static void idle_timer_check(struct timer_list *unused)
 {
         write_lock(&arp_tbl.lock);
         __neigh_for_each_release(&arp_tbl, neigh_check_cb);
@@ -887,7 +887,7 @@ static int __init atm_clip_init(void)
         register_netdevice_notifier(&clip_dev_notifier);
         register_inetaddr_notifier(&clip_inet_notifier);
 
-        setup_timer(&idle_timer, idle_timer_check, 0);
+        timer_setup(&idle_timer, idle_timer_check, 0);
 
 #ifdef CONFIG_PROC_FS
         {
diff --git a/net/atm/lec.c b/net/atm/lec.c
index a3d93a1bb133..6676e3433261 100644
--- a/net/atm/lec.c
+++ b/net/atm/lec.c
@@ -1232,7 +1232,7 @@ static void lane2_associate_ind(struct net_device *dev, const u8 *mac_addr,
 #define LEC_ARP_REFRESH_INTERVAL (3*HZ)
 
 static void lec_arp_check_expire(struct work_struct *work);
-static void lec_arp_expire_arp(unsigned long data);
+static void lec_arp_expire_arp(struct timer_list *t);
 
 /*
  * Arp table funcs
@@ -1559,8 +1559,7 @@ static struct lec_arp_table *make_entry(struct lec_priv *priv,
         }
         ether_addr_copy(to_return->mac_addr, mac_addr);
         INIT_HLIST_NODE(&to_return->next);
-        setup_timer(&to_return->timer, lec_arp_expire_arp,
-                        (unsigned long)to_return);
+        timer_setup(&to_return->timer, lec_arp_expire_arp, 0);
         to_return->last_used = jiffies;
         to_return->priv = priv;
         skb_queue_head_init(&to_return->tx_wait);
@@ -1569,11 +1568,11 @@ static struct lec_arp_table *make_entry(struct lec_priv *priv,
 }
 
 /* Arp sent timer expired */
-static void lec_arp_expire_arp(unsigned long data)
+static void lec_arp_expire_arp(struct timer_list *t)
 {
         struct lec_arp_table *entry;
 
-        entry = (struct lec_arp_table *)data;
+        entry = from_timer(entry, t, timer);
 
         pr_debug("\n");
         if (entry->status == ESI_ARP_PENDING) {
@@ -1591,10 +1590,10 @@ static void lec_arp_expire_arp(unsigned long data)
 }
 
 /* Unknown/unused vcc expire, remove associated entry */
-static void lec_arp_expire_vcc(unsigned long data)
+static void lec_arp_expire_vcc(struct timer_list *t)
 {
         unsigned long flags;
-        struct lec_arp_table *to_remove = (struct lec_arp_table *)data;
+        struct lec_arp_table *to_remove = from_timer(to_remove, t, timer);
         struct lec_priv *priv = to_remove->priv;
 
         del_timer(&to_remove->timer);
diff --git a/net/atm/mpc.c b/net/atm/mpc.c
index 63138c8c2269..7c6a1cc760a2 100644
--- a/net/atm/mpc.c
+++ b/net/atm/mpc.c
@@ -95,7 +95,7 @@ static netdev_tx_t mpc_send_packet(struct sk_buff *skb,
 static int mpoa_event_listener(struct notifier_block *mpoa_notifier,
                                unsigned long event, void *dev);
 static void mpc_timer_refresh(void);
-static void mpc_cache_check(unsigned long checking_time);
+static void mpc_cache_check(struct timer_list *unused);
 
 static struct llc_snap_hdr llc_snap_mpoa_ctrl = {
         0xaa, 0xaa, 0x03,
@@ -121,7 +121,7 @@ static struct notifier_block mpoa_notifier = {
 
 struct mpoa_client *mpcs = NULL; /* FIXME */
 static struct atm_mpoa_qos *qos_head = NULL;
-static DEFINE_TIMER(mpc_timer, NULL);
+static DEFINE_TIMER(mpc_timer, mpc_cache_check);
 
 
 static struct mpoa_client *find_mpc_by_itfnum(int itf)
@@ -799,7 +799,6 @@ static int atm_mpoa_mpoad_attach(struct atm_vcc *vcc, int arg)
         int err;
 
         if (mpcs == NULL) {
-                init_timer(&mpc_timer);
                 mpc_timer_refresh();
 
                 /* This lets us now how our LECs are doing */
@@ -1408,15 +1407,16 @@ static void clean_up(struct k_message *msg, struct mpoa_client *mpc, int action)
         msg_to_mpoad(msg, mpc);
 }
 
+static unsigned long checking_time;
+
 static void mpc_timer_refresh(void)
 {
         mpc_timer.expires = jiffies + (MPC_P2 * HZ);
-        mpc_timer.data = mpc_timer.expires;
-        mpc_timer.function = mpc_cache_check;
+        checking_time = mpc_timer.expires;
         add_timer(&mpc_timer);
 }
 
-static void mpc_cache_check(unsigned long checking_time)
+static void mpc_cache_check(struct timer_list *unused)
 {
         struct mpoa_client *mpc = mpcs;
         static unsigned long previous_resolving_check_time;
diff --git a/net/ax25/af_ax25.c b/net/ax25/af_ax25.c
index f3f9d18891de..06eac1f50c5e 100644
--- a/net/ax25/af_ax25.c
+++ b/net/ax25/af_ax25.c
@@ -268,9 +268,9 @@ void ax25_destroy_socket(ax25_cb *);
 /*
  *      Handler for deferred kills.
  */
-static void ax25_destroy_timer(unsigned long data)
+static void ax25_destroy_timer(struct timer_list *t)
 {
-        ax25_cb *ax25=(ax25_cb *)data;
+        ax25_cb *ax25 = from_timer(ax25, t, dtimer);
         struct sock *sk;
 
         sk=ax25->sk;
@@ -326,8 +326,7 @@ void ax25_destroy_socket(ax25_cb *ax25)
         if (ax25->sk != NULL) {
                 if (sk_has_allocations(ax25->sk)) {
                         /* Defer: outstanding buffers */
-                        setup_timer(&ax25->dtimer, ax25_destroy_timer,
-                                        (unsigned long)ax25);
+                        timer_setup(&ax25->dtimer, ax25_destroy_timer, 0);
                         ax25->dtimer.expires  = jiffies + 2 * HZ;
                         add_timer(&ax25->dtimer);
                 } else {
diff --git a/net/ax25/ax25_ds_timer.c b/net/ax25/ax25_ds_timer.c
index 5fb2104b7304..e9d11313d45b 100644
--- a/net/ax25/ax25_ds_timer.c
+++ b/net/ax25/ax25_ds_timer.c
@@ -29,7 +29,7 @@
 #include <linux/mm.h>
 #include <linux/interrupt.h>
 
-static void ax25_ds_timeout(unsigned long);
+static void ax25_ds_timeout(struct timer_list *);
 
 /*
  *      Add DAMA slave timeout timer to timer list.
@@ -41,8 +41,7 @@ static void ax25_ds_timeout(unsigned long);
 
 void ax25_ds_setup_timer(ax25_dev *ax25_dev)
 {
-        setup_timer(&ax25_dev->dama.slave_timer, ax25_ds_timeout,
-                    (unsigned long)ax25_dev);
+        timer_setup(&ax25_dev->dama.slave_timer, ax25_ds_timeout, 0);
 }
 
 void ax25_ds_del_timer(ax25_dev *ax25_dev)
@@ -66,9 +65,9 @@ void ax25_ds_set_timer(ax25_dev *ax25_dev)
  *      Silently discard all (slave) connections in case our master forgot us...
  */
 
-static void ax25_ds_timeout(unsigned long arg)
+static void ax25_ds_timeout(struct timer_list *t)
 {
-        ax25_dev *ax25_dev = (struct ax25_dev *) arg;
+        ax25_dev *ax25_dev = from_timer(ax25_dev, t, dama.slave_timer);
         ax25_cb *ax25;
 
         if (ax25_dev == NULL || !ax25_dev->dama.slave)
diff --git a/net/ax25/ax25_timer.c b/net/ax25/ax25_timer.c
index 23a6f38a80bf..c47b7ee1e4da 100644
--- a/net/ax25/ax25_timer.c
+++ b/net/ax25/ax25_timer.c
@@ -33,20 +33,19 @@
 #include <linux/mm.h>
 #include <linux/interrupt.h>
 
-static void ax25_heartbeat_expiry(unsigned long);
-static void ax25_t1timer_expiry(unsigned long);
-static void ax25_t2timer_expiry(unsigned long);
-static void ax25_t3timer_expiry(unsigned long);
-static void ax25_idletimer_expiry(unsigned long);
+static void ax25_heartbeat_expiry(struct timer_list *);
+static void ax25_t1timer_expiry(struct timer_list *);
+static void ax25_t2timer_expiry(struct timer_list *);
+static void ax25_t3timer_expiry(struct timer_list *);
+static void ax25_idletimer_expiry(struct timer_list *);
 
 void ax25_setup_timers(ax25_cb *ax25)
 {
-        setup_timer(&ax25->timer, ax25_heartbeat_expiry, (unsigned long)ax25);
-        setup_timer(&ax25->t1timer, ax25_t1timer_expiry, (unsigned long)ax25);
-        setup_timer(&ax25->t2timer, ax25_t2timer_expiry, (unsigned long)ax25);
-        setup_timer(&ax25->t3timer, ax25_t3timer_expiry, (unsigned long)ax25);
-        setup_timer(&ax25->idletimer, ax25_idletimer_expiry,
-                    (unsigned long)ax25);
+        timer_setup(&ax25->timer, ax25_heartbeat_expiry, 0);
+        timer_setup(&ax25->t1timer, ax25_t1timer_expiry, 0);
+        timer_setup(&ax25->t2timer, ax25_t2timer_expiry, 0);
+        timer_setup(&ax25->t3timer, ax25_t3timer_expiry, 0);
+        timer_setup(&ax25->idletimer, ax25_idletimer_expiry, 0);
 }
 
 void ax25_start_heartbeat(ax25_cb *ax25)
@@ -120,10 +119,10 @@ unsigned long ax25_display_timer(struct timer_list *timer)
 
 EXPORT_SYMBOL(ax25_display_timer);
 
-static void ax25_heartbeat_expiry(unsigned long param)
+static void ax25_heartbeat_expiry(struct timer_list *t)
 {
         int proto = AX25_PROTO_STD_SIMPLEX;
-        ax25_cb *ax25 = (ax25_cb *)param;
+        ax25_cb *ax25 = from_timer(ax25, t, timer);
 
         if (ax25->ax25_dev)
                 proto = ax25->ax25_dev->values[AX25_VALUES_PROTOCOL];
@@ -145,9 +144,9 @@ static void ax25_heartbeat_expiry(unsigned long param)
         }
 }
 
-static void ax25_t1timer_expiry(unsigned long param)
+static void ax25_t1timer_expiry(struct timer_list *t)
 {
-        ax25_cb *ax25 = (ax25_cb *)param;
+        ax25_cb *ax25 = from_timer(ax25, t, t1timer);
 
         switch (ax25->ax25_dev->values[AX25_VALUES_PROTOCOL]) {
         case AX25_PROTO_STD_SIMPLEX:
@@ -164,9 +163,9 @@ static void ax25_t1timer_expiry(unsigned long param)
         }
 }
 
-static void ax25_t2timer_expiry(unsigned long param)
+static void ax25_t2timer_expiry(struct timer_list *t)
 {
-        ax25_cb *ax25 = (ax25_cb *)param;
+        ax25_cb *ax25 = from_timer(ax25, t, t2timer);
 
         switch (ax25->ax25_dev->values[AX25_VALUES_PROTOCOL]) {
         case AX25_PROTO_STD_SIMPLEX:
@@ -183,9 +182,9 @@ static void ax25_t2timer_expiry(unsigned long param)
         }
 }
 
-static void ax25_t3timer_expiry(unsigned long param)
+static void ax25_t3timer_expiry(struct timer_list *t)
 {
-        ax25_cb *ax25 = (ax25_cb *)param;
+        ax25_cb *ax25 = from_timer(ax25, t, t3timer);
 
         switch (ax25->ax25_dev->values[AX25_VALUES_PROTOCOL]) {
         case AX25_PROTO_STD_SIMPLEX:
@@ -204,9 +203,9 @@ static void ax25_t3timer_expiry(unsigned long param)
         }
 }
 
-static void ax25_idletimer_expiry(unsigned long param)
+static void ax25_idletimer_expiry(struct timer_list *t)
 {
-        ax25_cb *ax25 = (ax25_cb *)param;
+        ax25_cb *ax25 = from_timer(ax25, t, idletimer);
 
         switch (ax25->ax25_dev->values[AX25_VALUES_PROTOCOL]) {
         case AX25_PROTO_STD_SIMPLEX:
diff --git a/net/batman-adv/bat_iv_ogm.c b/net/batman-adv/bat_iv_ogm.c
index 83ba5483455a..1b659ab652fb 100644
--- a/net/batman-adv/bat_iv_ogm.c
+++ b/net/batman-adv/bat_iv_ogm.c
@@ -916,8 +916,8 @@ static void batadv_iv_ogm_schedule(struct batadv_hard_iface *hard_iface)
         u16 tvlv_len = 0;
         unsigned long send_time;
 
-        if ((hard_iface->if_status == BATADV_IF_NOT_IN_USE) ||
-            (hard_iface->if_status == BATADV_IF_TO_BE_REMOVED))
+        if (hard_iface->if_status == BATADV_IF_NOT_IN_USE ||
+            hard_iface->if_status == BATADV_IF_TO_BE_REMOVED)
                 return;
 
         /* the interface gets activated here to avoid race conditions between
@@ -1264,7 +1264,7 @@ static bool batadv_iv_ogm_calc_tq(struct batadv_orig_node *orig_node,
          * drops as they can't send and receive at the same time.
          */
         tq_iface_penalty = BATADV_TQ_MAX_VALUE;
-        if (if_outgoing && (if_incoming == if_outgoing) &&
+        if (if_outgoing && if_incoming == if_outgoing &&
             batadv_is_wifi_hardif(if_outgoing))
                 tq_iface_penalty = batadv_hop_penalty(BATADV_TQ_MAX_VALUE,
                                                       bat_priv);
@@ -1369,7 +1369,7 @@ batadv_iv_ogm_update_seqnos(const struct ethhdr *ethhdr,
                                 ret = BATADV_NEIGH_DUP;
                 } else {
                         set_mark = 0;
-                        if (is_dup && (ret != BATADV_NEIGH_DUP))
+                        if (is_dup && ret != BATADV_NEIGH_DUP)
                                 ret = BATADV_ORIG_DUP;
                 }
 
@@ -1515,7 +1515,7 @@ batadv_iv_ogm_process_per_outif(const struct sk_buff *skb, int ogm_offset,
         /* drop packet if sender is not a direct neighbor and if we
          * don't route towards it
          */
-        if (!is_single_hop_neigh && (!orig_neigh_router)) {
+        if (!is_single_hop_neigh && !orig_neigh_router) {
                 batadv_dbg(BATADV_DBG_BATMAN, bat_priv,
                            "Drop packet: OGM via unknown neighbor!\n");
                 goto out_neigh;
@@ -1535,7 +1535,7 @@ batadv_iv_ogm_process_per_outif(const struct sk_buff *skb, int ogm_offset,
         sameseq = orig_ifinfo->last_real_seqno == ntohl(ogm_packet->seqno);
         similar_ttl = (orig_ifinfo->last_ttl - 3) <= ogm_packet->ttl;
 
-        if (is_bidirect && ((dup_status == BATADV_NO_DUP) ||
+        if (is_bidirect && (dup_status == BATADV_NO_DUP ||
                             (sameseq && similar_ttl))) {
                 batadv_iv_ogm_orig_update(bat_priv, orig_node,
                                           orig_ifinfo, ethhdr,
@@ -1553,8 +1553,8 @@ batadv_iv_ogm_process_per_outif(const struct sk_buff *skb, int ogm_offset,
                 /* OGMs from secondary interfaces should only scheduled once
                  * per interface where it has been received, not multiple times
                  */
-                if ((ogm_packet->ttl <= 2) &&
-                    (if_incoming != if_outgoing)) {
+                if (ogm_packet->ttl <= 2 &&
+                    if_incoming != if_outgoing) {
                         batadv_dbg(BATADV_DBG_BATMAN, bat_priv,
                                    "Drop packet: OGM from secondary interface and wrong outgoing interface\n");
                         goto out_neigh;
@@ -1590,7 +1590,7 @@ batadv_iv_ogm_process_per_outif(const struct sk_buff *skb, int ogm_offset,
                               if_incoming, if_outgoing);
 
 out_neigh:
-        if ((orig_neigh_node) && (!is_single_hop_neigh))
+        if (orig_neigh_node && !is_single_hop_neigh)
                 batadv_orig_node_put(orig_neigh_node);
 out:
         if (router_ifinfo)
@@ -2523,9 +2523,9 @@ batadv_iv_gw_get_best_gw_node(struct batadv_priv *bat_priv)
                         tmp_gw_factor *= 100 * 100;
                         tmp_gw_factor >>= 18;
 
-                        if ((tmp_gw_factor > max_gw_factor) ||
-                            ((tmp_gw_factor == max_gw_factor) &&
-                             (tq_avg > max_tq))) {
+                        if (tmp_gw_factor > max_gw_factor ||
+                            (tmp_gw_factor == max_gw_factor &&
+                             tq_avg > max_tq)) {
                                 if (curr_gw)
                                         batadv_gw_node_put(curr_gw);
                                 curr_gw = gw_node;
diff --git a/net/batman-adv/bat_v.c b/net/batman-adv/bat_v.c
index 4e2724c5b33d..341ceab8338d 100644
--- a/net/batman-adv/bat_v.c
+++ b/net/batman-adv/bat_v.c
@@ -19,7 +19,6 @@
 #include "main.h"
 
 #include <linux/atomic.h>
-#include <linux/bug.h>
 #include <linux/cache.h>
 #include <linux/errno.h>
 #include <linux/if_ether.h>
@@ -623,11 +622,11 @@ static int batadv_v_neigh_cmp(struct batadv_neigh_node *neigh1,
         int ret = 0;
 
         ifinfo1 = batadv_neigh_ifinfo_get(neigh1, if_outgoing1);
-        if (WARN_ON(!ifinfo1))
+        if (!ifinfo1)
                 goto err_ifinfo1;
 
         ifinfo2 = batadv_neigh_ifinfo_get(neigh2, if_outgoing2);
-        if (WARN_ON(!ifinfo2))
+        if (!ifinfo2)
                 goto err_ifinfo2;
 
         ret = ifinfo1->bat_v.throughput - ifinfo2->bat_v.throughput;
@@ -649,11 +648,11 @@ static bool batadv_v_neigh_is_sob(struct batadv_neigh_node *neigh1,
         bool ret = false;
 
         ifinfo1 = batadv_neigh_ifinfo_get(neigh1, if_outgoing1);
-        if (WARN_ON(!ifinfo1))
+        if (!ifinfo1)
                 goto err_ifinfo1;
 
         ifinfo2 = batadv_neigh_ifinfo_get(neigh2, if_outgoing2);
-        if (WARN_ON(!ifinfo2))
+        if (!ifinfo2)
                 goto err_ifinfo2;
 
         threshold = ifinfo1->bat_v.throughput / 4;
@@ -767,7 +766,7 @@ batadv_v_gw_get_best_gw_node(struct batadv_priv *bat_priv)
                 if (batadv_v_gw_throughput_get(gw_node, &bw) < 0)
                         goto next;
 
-                if (curr_gw && (bw <= max_bw))
+                if (curr_gw && bw <= max_bw)
                         goto next;
 
                 if (curr_gw)
diff --git a/net/batman-adv/bat_v_elp.c b/net/batman-adv/bat_v_elp.c
index bd1064d98e16..1de992c58b35 100644
--- a/net/batman-adv/bat_v_elp.c
+++ b/net/batman-adv/bat_v_elp.c
@@ -134,7 +134,7 @@ static u32 batadv_v_elp_get_throughput(struct batadv_hardif_neigh_node *neigh)
                         hard_iface->bat_v.flags &= ~BATADV_FULL_DUPLEX;
 
                 throughput = link_settings.base.speed;
-                if (throughput && (throughput != SPEED_UNKNOWN))
+                if (throughput && throughput != SPEED_UNKNOWN)
                         return throughput * 10;
         }
 
@@ -263,8 +263,8 @@ static void batadv_v_elp_periodic_work(struct work_struct *work)
                 goto out;
 
         /* we are in the process of shutting this interface down */
-        if ((hard_iface->if_status == BATADV_IF_NOT_IN_USE) ||
-            (hard_iface->if_status == BATADV_IF_TO_BE_REMOVED))
+        if (hard_iface->if_status == BATADV_IF_NOT_IN_USE ||
+            hard_iface->if_status == BATADV_IF_TO_BE_REMOVED)
                 goto out;
 
         /* the interface was enabled but may not be ready yet */
diff --git a/net/batman-adv/bat_v_ogm.c b/net/batman-adv/bat_v_ogm.c
index 8be61734fc43..c251445a42a0 100644
--- a/net/batman-adv/bat_v_ogm.c
+++ b/net/batman-adv/bat_v_ogm.c
@@ -304,8 +304,8 @@ static u32 batadv_v_forward_penalty(struct batadv_priv *bat_priv,
          * due to the store & forward characteristics of WIFI.
          * Very low throughput values are the exception.
          */
-        if ((throughput > 10) &&
-            (if_incoming == if_outgoing) &&
+        if (throughput > 10 &&
+            if_incoming == if_outgoing &&
             !(if_incoming->bat_v.flags & BATADV_FULL_DUPLEX))
                 return throughput / 2;
 
@@ -455,7 +455,7 @@ static int batadv_v_ogm_metric_update(struct batadv_priv *bat_priv,
         /* drop packets with old seqnos, however accept the first packet after
          * a host has been rebooted.
          */
-        if ((seq_diff < 0) && !protection_started)
+        if (seq_diff < 0 && !protection_started)
                 goto out;
 
         neigh_node->last_seen = jiffies;
@@ -568,8 +568,8 @@ static bool batadv_v_ogm_route_update(struct batadv_priv *bat_priv,
                 router_throughput = router_ifinfo->bat_v.throughput;
                 neigh_throughput = neigh_ifinfo->bat_v.throughput;
 
-                if ((neigh_seq_diff < BATADV_OGM_MAX_ORIGDIFF) &&
-                    (router_throughput >= neigh_throughput))
+                if (neigh_seq_diff < BATADV_OGM_MAX_ORIGDIFF &&
+                    router_throughput >= neigh_throughput)
                         goto out;
         }
 
@@ -621,7 +621,7 @@ batadv_v_ogm_process_per_outif(struct batadv_priv *bat_priv,
                 return;
 
         /* only unknown & newer OGMs contain TVLVs we are interested in */
-        if ((seqno_age > 0) && (if_outgoing == BATADV_IF_DEFAULT))
+        if (seqno_age > 0 && if_outgoing == BATADV_IF_DEFAULT)
                 batadv_tvlv_containers_process(bat_priv, true, orig_node,
                                                NULL, NULL,
                                                (unsigned char *)(ogm2 + 1),
diff --git a/net/batman-adv/distributed-arp-table.c b/net/batman-adv/distributed-arp-table.c
index b6cfa78e9381..760c0de72582 100644
--- a/net/batman-adv/distributed-arp-table.c
+++ b/net/batman-adv/distributed-arp-table.c
@@ -492,8 +492,8 @@ static bool batadv_is_orig_node_eligible(struct batadv_dat_candidate *res,
         /* this is an hash collision with the temporary selected node. Choose
          * the one with the lowest address
          */
-        if ((tmp_max == max) && max_orig_node &&
-            (batadv_compare_eth(candidate->orig, max_orig_node->orig) > 0))
+        if (tmp_max == max && max_orig_node &&
+            batadv_compare_eth(candidate->orig, max_orig_node->orig) > 0)
                 goto out;
 
         ret = true;
diff --git a/net/batman-adv/gateway_client.c b/net/batman-adv/gateway_client.c
index de9955d5224d..10d521f0b17f 100644
--- a/net/batman-adv/gateway_client.c
+++ b/net/batman-adv/gateway_client.c
@@ -248,12 +248,12 @@ void batadv_gw_election(struct batadv_priv *bat_priv)
                 }
         }
 
-        if ((curr_gw) && (!next_gw)) {
+        if (curr_gw && !next_gw) {
                 batadv_dbg(BATADV_DBG_BATMAN, bat_priv,
                            "Removing selected gateway - no gateway in range\n");
                 batadv_throw_uevent(bat_priv, BATADV_UEV_GW, BATADV_UEV_DEL,
                                     NULL);
-        } else if ((!curr_gw) && (next_gw)) {
+        } else if (!curr_gw && next_gw) {
                 batadv_dbg(BATADV_DBG_BATMAN, bat_priv,
                            "Adding route to gateway %pM (bandwidth: %u.%u/%u.%u MBit, tq: %i)\n",
                            next_gw->orig_node->orig,
@@ -411,8 +411,8 @@ void batadv_gw_node_update(struct batadv_priv *bat_priv,
                 goto out;
         }
 
-        if ((gw_node->bandwidth_down == ntohl(gateway->bandwidth_down)) &&
-            (gw_node->bandwidth_up == ntohl(gateway->bandwidth_up)))
+        if (gw_node->bandwidth_down == ntohl(gateway->bandwidth_down) &&
+            gw_node->bandwidth_up == ntohl(gateway->bandwidth_up))
                 goto out;
 
         batadv_dbg(BATADV_DBG_BATMAN, bat_priv,
diff --git a/net/batman-adv/gateway_common.c b/net/batman-adv/gateway_common.c
index 33940c5c74a8..2c26039c23fc 100644
--- a/net/batman-adv/gateway_common.c
+++ b/net/batman-adv/gateway_common.c
@@ -56,8 +56,8 @@ bool batadv_parse_throughput(struct net_device *net_dev, char *buff,
                 if (strncasecmp(tmp_ptr, "mbit", 4) == 0)
                         bw_unit_type = BATADV_BW_UNIT_MBIT;
 
-                if ((strncasecmp(tmp_ptr, "kbit", 4) == 0) ||
-                    (bw_unit_type == BATADV_BW_UNIT_MBIT))
+                if (strncasecmp(tmp_ptr, "kbit", 4) == 0 ||
+                    bw_unit_type == BATADV_BW_UNIT_MBIT)
                         *tmp_ptr = '\0';
         }
 
@@ -190,7 +190,7 @@ ssize_t batadv_gw_bandwidth_set(struct net_device *net_dev, char *buff,
         if (!up_new)
                 up_new = 1;
 
-        if ((down_curr == down_new) && (up_curr == up_new))
+        if (down_curr == down_new && up_curr == up_new)
                 return count;
 
         batadv_gw_reselect(bat_priv);
@@ -224,16 +224,16 @@ static void batadv_gw_tvlv_ogm_handler_v1(struct batadv_priv *bat_priv,
         /* only fetch the tvlv value if the handler wasn't called via the
          * CIFNOTFND flag and if there is data to fetch
          */
-        if ((flags & BATADV_TVLV_HANDLER_OGM_CIFNOTFND) ||
-            (tvlv_value_len < sizeof(gateway))) {
+        if (flags & BATADV_TVLV_HANDLER_OGM_CIFNOTFND ||
+            tvlv_value_len < sizeof(gateway)) {
                 gateway.bandwidth_down = 0;
                 gateway.bandwidth_up = 0;
         } else {
                 gateway_ptr = tvlv_value;
                 gateway.bandwidth_down = gateway_ptr->bandwidth_down;
                 gateway.bandwidth_up = gateway_ptr->bandwidth_up;
-                if ((gateway.bandwidth_down == 0) ||
-                    (gateway.bandwidth_up == 0)) {
+                if (gateway.bandwidth_down == 0 ||
+                    gateway.bandwidth_up == 0) {
                         gateway.bandwidth_down = 0;
                         gateway.bandwidth_up = 0;
                 }
@@ -242,8 +242,8 @@ static void batadv_gw_tvlv_ogm_handler_v1(struct batadv_priv *bat_priv,
         batadv_gw_node_update(bat_priv, orig, &gateway);
 
         /* restart gateway selection */
-        if ((gateway.bandwidth_down != 0) &&
-            (atomic_read(&bat_priv->gw.mode) == BATADV_GW_MODE_CLIENT))
+        if (gateway.bandwidth_down != 0 &&
+            atomic_read(&bat_priv->gw.mode) == BATADV_GW_MODE_CLIENT)
                 batadv_gw_check_election(bat_priv, orig);
 }
 
diff --git a/net/batman-adv/hard-interface.c b/net/batman-adv/hard-interface.c
index e348f76ea8c1..4e3d5340ad96 100644
--- a/net/batman-adv/hard-interface.c
+++ b/net/batman-adv/hard-interface.c
@@ -504,8 +504,8 @@ static void batadv_check_known_mac_addr(const struct net_device *net_dev)
 
         rcu_read_lock();
         list_for_each_entry_rcu(hard_iface, &batadv_hardif_list, list) {
-                if ((hard_iface->if_status != BATADV_IF_ACTIVE) &&
-                    (hard_iface->if_status != BATADV_IF_TO_BE_ACTIVATED))
+                if (hard_iface->if_status != BATADV_IF_ACTIVE &&
+                    hard_iface->if_status != BATADV_IF_TO_BE_ACTIVATED)
                         continue;
 
                 if (hard_iface->net_dev == net_dev)
@@ -568,8 +568,8 @@ int batadv_hardif_min_mtu(struct net_device *soft_iface)
 
         rcu_read_lock();
         list_for_each_entry_rcu(hard_iface, &batadv_hardif_list, list) {
-                if ((hard_iface->if_status != BATADV_IF_ACTIVE) &&
-                    (hard_iface->if_status != BATADV_IF_TO_BE_ACTIVATED))
+                if (hard_iface->if_status != BATADV_IF_ACTIVE &&
+                    hard_iface->if_status != BATADV_IF_TO_BE_ACTIVATED)
                         continue;
 
                 if (hard_iface->soft_iface != soft_iface)
@@ -654,8 +654,8 @@ out:
 static void
 batadv_hardif_deactivate_interface(struct batadv_hard_iface *hard_iface)
 {
-        if ((hard_iface->if_status != BATADV_IF_ACTIVE) &&
-            (hard_iface->if_status != BATADV_IF_TO_BE_ACTIVATED))
+        if (hard_iface->if_status != BATADV_IF_ACTIVE &&
+            hard_iface->if_status != BATADV_IF_TO_BE_ACTIVATED)
                 return;
 
         hard_iface->if_status = BATADV_IF_INACTIVE;
@@ -738,7 +738,7 @@ int batadv_hardif_enable_interface(struct batadv_hard_iface *hard_iface,
         bat_priv = netdev_priv(hard_iface->soft_iface);
 
         ret = netdev_master_upper_dev_link(hard_iface->net_dev,
-                                           soft_iface, NULL, NULL);
+                                           soft_iface, NULL, NULL, NULL);
         if (ret)
                 goto err_dev;
 
diff --git a/net/batman-adv/icmp_socket.c b/net/batman-adv/icmp_socket.c
index 8ead292886d1..bded31121d12 100644
--- a/net/batman-adv/icmp_socket.c
+++ b/net/batman-adv/icmp_socket.c
@@ -132,10 +132,10 @@ static ssize_t batadv_socket_read(struct file *file, char __user *buf,
         size_t packet_len;
         int error;
 
-        if ((file->f_flags & O_NONBLOCK) && (socket_client->queue_len == 0))
+        if ((file->f_flags & O_NONBLOCK) && socket_client->queue_len == 0)
                 return -EAGAIN;
 
-        if ((!buf) || (count < sizeof(struct batadv_icmp_packet)))
+        if (!buf || count < sizeof(struct batadv_icmp_packet))
                 return -EINVAL;
 
         if (!access_ok(VERIFY_WRITE, buf, count))
diff --git a/net/batman-adv/main.c b/net/batman-adv/main.c
index fb381fb26a66..4daed7ad46f2 100644
--- a/net/batman-adv/main.c
+++ b/net/batman-adv/main.c
@@ -73,8 +73,8 @@
  * list traversals just rcu-locked
  */
 struct list_head batadv_hardif_list;
-static int (*batadv_rx_handler[256])(struct sk_buff *,
-                                     struct batadv_hard_iface *);
+static int (*batadv_rx_handler[256])(struct sk_buff *skb,
+                                     struct batadv_hard_iface *recv_if);
 
 unsigned char batadv_broadcast_addr[] = {0xff, 0xff, 0xff, 0xff, 0xff, 0xff};
 
@@ -540,12 +540,12 @@ batadv_recv_handler_register(u8 packet_type,
                              int (*recv_handler)(struct sk_buff *,
                                                  struct batadv_hard_iface *))
 {
-        int (*curr)(struct sk_buff *,
-                    struct batadv_hard_iface *);
+        int (*curr)(struct sk_buff *skb,
+                    struct batadv_hard_iface *recv_if);
         curr = batadv_rx_handler[packet_type];
 
-        if ((curr != batadv_recv_unhandled_packet) &&
-            (curr != batadv_recv_unhandled_unicast_packet))
+        if (curr != batadv_recv_unhandled_packet &&
+            curr != batadv_recv_unhandled_unicast_packet)
                 return -EBUSY;
 
         batadv_rx_handler[packet_type] = recv_handler;
diff --git a/net/batman-adv/main.h b/net/batman-adv/main.h
index 05cc7637c064..edb2f239d04d 100644
--- a/net/batman-adv/main.h
+++ b/net/batman-adv/main.h
@@ -24,7 +24,7 @@
 #define BATADV_DRIVER_DEVICE "batman-adv"
 
 #ifndef BATADV_SOURCE_VERSION
-#define BATADV_SOURCE_VERSION "2017.3"
+#define BATADV_SOURCE_VERSION "2017.4"
 #endif
 
 /* B.A.T.M.A.N. parameters */
diff --git a/net/batman-adv/multicast.c b/net/batman-adv/multicast.c
index d327670641ac..e553a8770a89 100644
--- a/net/batman-adv/multicast.c
+++ b/net/batman-adv/multicast.c
@@ -1126,7 +1126,7 @@ static void batadv_mcast_tvlv_ogm_handler(struct batadv_priv *bat_priv,
         bool orig_initialized;
 
         if (orig_mcast_enabled && tvlv_value &&
-            (tvlv_value_len >= sizeof(mcast_flags)))
+            tvlv_value_len >= sizeof(mcast_flags))
                 mcast_flags = *(u8 *)tvlv_value;
 
         spin_lock_bh(&orig->mcast_handler_lock);
diff --git a/net/batman-adv/originator.c b/net/batman-adv/originator.c
index 8e2a4b205257..2967b86c13da 100644
--- a/net/batman-adv/originator.c
+++ b/net/batman-adv/originator.c
@@ -1062,9 +1062,9 @@ batadv_purge_neigh_ifinfo(struct batadv_priv *bat_priv,
                         continue;
 
                 /* don't purge if the interface is not (going) down */
-                if ((if_outgoing->if_status != BATADV_IF_INACTIVE) &&
-                    (if_outgoing->if_status != BATADV_IF_NOT_IN_USE) &&
-                    (if_outgoing->if_status != BATADV_IF_TO_BE_REMOVED))
+                if (if_outgoing->if_status != BATADV_IF_INACTIVE &&
+                    if_outgoing->if_status != BATADV_IF_NOT_IN_USE &&
+                    if_outgoing->if_status != BATADV_IF_TO_BE_REMOVED)
                         continue;
 
                 batadv_dbg(BATADV_DBG_BATMAN, bat_priv,
@@ -1106,9 +1106,9 @@ batadv_purge_orig_ifinfo(struct batadv_priv *bat_priv,
                         continue;
 
                 /* don't purge if the interface is not (going) down */
-                if ((if_outgoing->if_status != BATADV_IF_INACTIVE) &&
-                    (if_outgoing->if_status != BATADV_IF_NOT_IN_USE) &&
-                    (if_outgoing->if_status != BATADV_IF_TO_BE_REMOVED))
+                if (if_outgoing->if_status != BATADV_IF_INACTIVE &&
+                    if_outgoing->if_status != BATADV_IF_NOT_IN_USE &&
+                    if_outgoing->if_status != BATADV_IF_TO_BE_REMOVED)
                         continue;
 
                 batadv_dbg(BATADV_DBG_BATMAN, bat_priv,
@@ -1155,13 +1155,13 @@ batadv_purge_orig_neighbors(struct batadv_priv *bat_priv,
                 last_seen = neigh_node->last_seen;
                 if_incoming = neigh_node->if_incoming;
 
-                if ((batadv_has_timed_out(last_seen, BATADV_PURGE_TIMEOUT)) ||
-                    (if_incoming->if_status == BATADV_IF_INACTIVE) ||
-                    (if_incoming->if_status == BATADV_IF_NOT_IN_USE) ||
-                    (if_incoming->if_status == BATADV_IF_TO_BE_REMOVED)) {
-                        if ((if_incoming->if_status == BATADV_IF_INACTIVE) ||
-                            (if_incoming->if_status == BATADV_IF_NOT_IN_USE) ||
-                            (if_incoming->if_status == BATADV_IF_TO_BE_REMOVED))
+                if (batadv_has_timed_out(last_seen, BATADV_PURGE_TIMEOUT) ||
+                    if_incoming->if_status == BATADV_IF_INACTIVE ||
+                    if_incoming->if_status == BATADV_IF_NOT_IN_USE ||
+                    if_incoming->if_status == BATADV_IF_TO_BE_REMOVED) {
+                        if (if_incoming->if_status == BATADV_IF_INACTIVE ||
+                            if_incoming->if_status == BATADV_IF_NOT_IN_USE ||
+                            if_incoming->if_status == BATADV_IF_TO_BE_REMOVED)
                                 batadv_dbg(BATADV_DBG_BATMAN, bat_priv,
                                            "neighbor purge: originator %pM, neighbor: %pM, iface: %s\n",
                                            orig_node->orig, neigh_node->addr,
diff --git a/net/batman-adv/routing.c b/net/batman-adv/routing.c
index f10e3ff26f9d..40d9bf3e5bfe 100644
--- a/net/batman-adv/routing.c
+++ b/net/batman-adv/routing.c
@@ -93,14 +93,14 @@ static void _batadv_update_route(struct batadv_priv *bat_priv,
         batadv_orig_ifinfo_put(orig_ifinfo);
 
         /* route deleted */
-        if ((curr_router) && (!neigh_node)) {
+        if (curr_router && !neigh_node) {
                 batadv_dbg(BATADV_DBG_ROUTES, bat_priv,
                            "Deleting route towards: %pM\n", orig_node->orig);
                 batadv_tt_global_del_orig(bat_priv, orig_node, -1,
                                           "Deleted route towards originator");
 
         /* route added */
-        } else if ((!curr_router) && (neigh_node)) {
+        } else if (!curr_router && neigh_node) {
                 batadv_dbg(BATADV_DBG_ROUTES, bat_priv,
                            "Adding route towards: %pM (via %pM)\n",
                            orig_node->orig, neigh_node->addr);
@@ -381,7 +381,7 @@ int batadv_recv_icmp_packet(struct sk_buff *skb,
         /* add record route information if not full */
         if ((icmph->msg_type == BATADV_ECHO_REPLY ||
              icmph->msg_type == BATADV_ECHO_REQUEST) &&
-            (skb->len >= sizeof(struct batadv_icmp_packet_rr))) {
+            skb->len >= sizeof(struct batadv_icmp_packet_rr)) {
                 if (skb_linearize(skb) < 0)
                         goto free_skb;
 
diff --git a/net/batman-adv/send.c b/net/batman-adv/send.c
index 054a65e6eb68..7895323fd2a7 100644
--- a/net/batman-adv/send.c
+++ b/net/batman-adv/send.c
@@ -142,7 +142,7 @@ int batadv_send_unicast_skb(struct sk_buff *skb,
 #ifdef CONFIG_BATMAN_ADV_BATMAN_V
         hardif_neigh = batadv_hardif_neigh_get(neigh->if_incoming, neigh->addr);
 
-        if ((hardif_neigh) && (ret != NET_XMIT_DROP))
+        if (hardif_neigh && ret != NET_XMIT_DROP)
                 hardif_neigh->bat_v.last_unicast_tx = jiffies;
 
         if (hardif_neigh)
@@ -615,8 +615,8 @@ batadv_forw_packet_list_steal(struct hlist_head *forw_list,
                  * we delete only packets belonging to the given interface
                  */
                 if (hard_iface &&
-                    (forw_packet->if_incoming != hard_iface) &&
-                    (forw_packet->if_outgoing != hard_iface))
+                    forw_packet->if_incoming != hard_iface &&
+                    forw_packet->if_outgoing != hard_iface)
                         continue;
 
                 hlist_del(&forw_packet->list);
diff --git a/net/batman-adv/soft-interface.c b/net/batman-adv/soft-interface.c
index 10f7edfb176e..9f673cdfecf8 100644
--- a/net/batman-adv/soft-interface.c
+++ b/net/batman-adv/soft-interface.c
@@ -69,8 +69,8 @@ int batadv_skb_head_push(struct sk_buff *skb, unsigned int len)
         int result;
 
         /* TODO: We must check if we can release all references to non-payload
-         * data using skb_header_release in our skbs to allow skb_cow_header to
-         * work optimally. This means that those skbs are not allowed to read
+         * data using __skb_header_release in our skbs to allow skb_cow_header
+         * to work optimally. This means that those skbs are not allowed to read
          * or write any data which is before the current position of skb->data
          * after that call and thus allow other skbs with the same data buffer
          * to write freely in that area.
@@ -160,7 +160,7 @@ static int batadv_interface_set_mac_addr(struct net_device *dev, void *p)
 static int batadv_interface_change_mtu(struct net_device *dev, int new_mtu)
 {
         /* check ranges */
-        if ((new_mtu < 68) || (new_mtu > batadv_hardif_min_mtu(dev)))
+        if (new_mtu < 68 || new_mtu > batadv_hardif_min_mtu(dev))
                 return -EINVAL;
 
         dev->mtu = new_mtu;
@@ -863,11 +863,13 @@ free_bat_counters:
  * batadv_softif_slave_add - Add a slave interface to a batadv_soft_interface
  * @dev: batadv_soft_interface used as master interface
  * @slave_dev: net_device which should become the slave interface
+ * @extack: extended ACK report struct
  *
  * Return: 0 if successful or error otherwise.
  */
 static int batadv_softif_slave_add(struct net_device *dev,
-                                   struct net_device *slave_dev)
+                                   struct net_device *slave_dev,
+                                   struct netlink_ext_ack *extack)
 {
         struct batadv_hard_iface *hard_iface;
         struct net *net = dev_net(dev);
diff --git a/net/batman-adv/sysfs.c b/net/batman-adv/sysfs.c
index 0ae8b30e4eaa..aa187fd42475 100644
--- a/net/batman-adv/sysfs.c
+++ b/net/batman-adv/sysfs.c
@@ -925,8 +925,8 @@ static int batadv_store_mesh_iface_finish(struct net_device *net_dev,
         if (hard_iface->if_status == status_tmp)
                 goto out;
 
-        if ((hard_iface->soft_iface) &&
-            (strncmp(hard_iface->soft_iface->name, ifname, IFNAMSIZ) == 0))
+        if (hard_iface->soft_iface &&
+            strncmp(hard_iface->soft_iface->name, ifname, IFNAMSIZ) == 0)
                 goto out;
 
         if (status_tmp == BATADV_IF_NOT_IN_USE) {
diff --git a/net/batman-adv/tp_meter.c b/net/batman-adv/tp_meter.c
index bfe8effe9238..15cd2139381e 100644
--- a/net/batman-adv/tp_meter.c
+++ b/net/batman-adv/tp_meter.c
@@ -488,9 +488,9 @@ static void batadv_tp_reset_sender_timer(struct batadv_tp_vars *tp_vars)
  * Switch to Slow Start, set the ss_threshold to half of the current cwnd and
  * reset the cwnd to 3*MSS
  */
-static void batadv_tp_sender_timeout(unsigned long arg)
+static void batadv_tp_sender_timeout(struct timer_list *t)
 {
-        struct batadv_tp_vars *tp_vars = (struct batadv_tp_vars *)arg;
+        struct batadv_tp_vars *tp_vars = from_timer(tp_vars, t, timer);
         struct batadv_priv *bat_priv = tp_vars->bat_priv;
 
         if (atomic_read(&tp_vars->sending) == 0)
@@ -1020,8 +1020,7 @@ void batadv_tp_start(struct batadv_priv *bat_priv, const u8 *dst,
         atomic64_set(&tp_vars->tot_sent, 0);
 
         kref_get(&tp_vars->refcount);
-        setup_timer(&tp_vars->timer, batadv_tp_sender_timeout,
-                    (unsigned long)tp_vars);
+        timer_setup(&tp_vars->timer, batadv_tp_sender_timeout, 0);
 
         tp_vars->bat_priv = bat_priv;
         tp_vars->start_time = jiffies;
@@ -1109,9 +1108,9 @@ static void batadv_tp_reset_receiver_timer(struct batadv_tp_vars *tp_vars)
  *  reached without received ack
  * @arg: address of the related tp_vars
  */
-static void batadv_tp_receiver_shutdown(unsigned long arg)
+static void batadv_tp_receiver_shutdown(struct timer_list *t)
 {
-        struct batadv_tp_vars *tp_vars = (struct batadv_tp_vars *)arg;
+        struct batadv_tp_vars *tp_vars = from_timer(tp_vars, t, timer);
         struct batadv_tp_unacked *un, *safe;
         struct batadv_priv *bat_priv;
 
@@ -1206,7 +1205,7 @@ static int batadv_tp_send_ack(struct batadv_priv *bat_priv, const u8 *dst,
 
         /* send the ack */
         r = batadv_send_skb_to_orig(skb, orig_node, NULL);
-        if (unlikely(r < 0) || (r == NET_XMIT_DROP)) {
+        if (unlikely(r < 0) || r == NET_XMIT_DROP) {
                 ret = BATADV_TP_REASON_DST_UNREACHABLE;
                 goto out;
         }
@@ -1373,8 +1372,7 @@ batadv_tp_init_recv(struct batadv_priv *bat_priv,
         hlist_add_head_rcu(&tp_vars->list, &bat_priv->tp_list);
 
         kref_get(&tp_vars->refcount);
-        setup_timer(&tp_vars->timer, batadv_tp_receiver_shutdown,
-                    (unsigned long)tp_vars);
+        timer_setup(&tp_vars->timer, batadv_tp_receiver_shutdown, 0);
 
         batadv_tp_reset_receiver_timer(tp_vars);
 
diff --git a/net/bluetooth/a2mp.c b/net/bluetooth/a2mp.c
index aad994edd3bb..51c2cf2d8923 100644
--- a/net/bluetooth/a2mp.c
+++ b/net/bluetooth/a2mp.c
@@ -573,7 +573,7 @@ static int a2mp_discphyslink_req(struct amp_mgr *mgr, struct sk_buff *skb,
         hcon = hci_conn_hash_lookup_ba(hdev, AMP_LINK,
                                        &mgr->l2cap_conn->hcon->dst);
         if (!hcon) {
-                BT_ERR("No phys link exist");
+                bt_dev_err(hdev, "no phys link exist");
                 rsp.status = A2MP_STATUS_NO_PHYSICAL_LINK_EXISTS;
                 goto clean;
         }
diff --git a/net/bluetooth/amp.c b/net/bluetooth/amp.c
index ebcab5bbadd7..78bec8df8525 100644
--- a/net/bluetooth/amp.c
+++ b/net/bluetooth/amp.c
@@ -187,7 +187,7 @@ int phylink_gen_key(struct hci_conn *conn, u8 *data, u8 *len, u8 *type)
 
         /* Legacy key */
         if (conn->key_type < 3) {
-                BT_ERR("Legacy key type %d", conn->key_type);
+                bt_dev_err(hdev, "legacy key type %d", conn->key_type);
                 return -EACCES;
         }
 
@@ -207,7 +207,7 @@ int phylink_gen_key(struct hci_conn *conn, u8 *data, u8 *len, u8 *type)
         /* Derive Generic AMP Link Key (gamp) */
         err = hmac_sha256(keybuf, HCI_AMP_LINK_KEY_SIZE, "gamp", 4, gamp_key);
         if (err) {
-                BT_ERR("Could not derive Generic AMP Key: err %d", err);
+                bt_dev_err(hdev, "could not derive Generic AMP Key: err %d", err);
                 return err;
         }
 
diff --git a/net/bluetooth/ecdh_helper.c b/net/bluetooth/ecdh_helper.c
index c7b1a9aee579..2155ce802877 100644
--- a/net/bluetooth/ecdh_helper.c
+++ b/net/bluetooth/ecdh_helper.c
@@ -23,7 +23,6 @@
 #include "ecdh_helper.h"
 
 #include <linux/scatterlist.h>
-#include <crypto/kpp.h>
 #include <crypto/ecdh.h>
 
 struct ecdh_completion {
@@ -50,55 +49,35 @@ static inline void swap_digits(u64 *in, u64 *out, unsigned int ndigits)
                 out[i] = __swab64(in[ndigits - 1 - i]);
 }
 
-bool compute_ecdh_secret(const u8 public_key[64], const u8 private_key[32],
-                         u8 secret[32])
+/* compute_ecdh_secret() - function assumes that the private key was
+ *                         already set.
+ * @tfm:          KPP tfm handle allocated with crypto_alloc_kpp().
+ * @public_key:   pair's ecc public key.
+ * secret:        memory where the ecdh computed shared secret will be saved.
+ *
+ * Return: zero on success; error code in case of error.
+ */
+int compute_ecdh_secret(struct crypto_kpp *tfm, const u8 public_key[64],
+                        u8 secret[32])
 {
-        struct crypto_kpp *tfm;
         struct kpp_request *req;
-        struct ecdh p;
+        u8 *tmp;
         struct ecdh_completion result;
         struct scatterlist src, dst;
-        u8 *tmp, *buf;
-        unsigned int buf_len;
-        int err = -ENOMEM;
+        int err;
 
         tmp = kmalloc(64, GFP_KERNEL);
         if (!tmp)
-                return false;
+                return -ENOMEM;
 
-        tfm = crypto_alloc_kpp("ecdh", CRYPTO_ALG_INTERNAL, 0);
-        if (IS_ERR(tfm)) {
-                pr_err("alg: kpp: Failed to load tfm for kpp: %ld\n",
-                       PTR_ERR(tfm));
+        req = kpp_request_alloc(tfm, GFP_KERNEL);
+        if (!req) {
+                err = -ENOMEM;
                 goto free_tmp;
         }
 
-        req = kpp_request_alloc(tfm, GFP_KERNEL);
-        if (!req)
-                goto free_kpp;
-
         init_completion(&result.completion);
 
-        /* Security Manager Protocol holds digits in litte-endian order
-         * while ECC API expect big-endian data
-         */
-        swap_digits((u64 *)private_key, (u64 *)tmp, 4);
-        p.key = (char *)tmp;
-        p.key_size = 32;
-        /* Set curve_id */
-        p.curve_id = ECC_CURVE_NIST_P256;
-        buf_len = crypto_ecdh_key_len(&p);
-        buf = kmalloc(buf_len, GFP_KERNEL);
-        if (!buf)
-                goto free_req;
-
-        crypto_ecdh_encode_key(buf, buf_len, &p);
-
-        /* Set A private Key */
-        err = crypto_kpp_set_secret(tfm, (void *)buf, buf_len);
-        if (err)
-                goto free_all;
-
         swap_digits((u64 *)public_key, (u64 *)tmp, 4); /* x */
         swap_digits((u64 *)&public_key[32], (u64 *)&tmp[32], 4); /* y */
 
@@ -123,104 +102,129 @@ bool compute_ecdh_secret(const u8 public_key[64], const u8 private_key[32],
         memcpy(secret, tmp, 32);
 
 free_all:
-        kzfree(buf);
-free_req:
         kpp_request_free(req);
-free_kpp:
-        crypto_free_kpp(tfm);
 free_tmp:
-        kfree(tmp);
-        return (err == 0);
+        kzfree(tmp);
+        return err;
 }
 
-bool generate_ecdh_keys(u8 public_key[64], u8 private_key[32])
+/* set_ecdh_privkey() - set or generate ecc private key.
+ *
+ * Function generates an ecc private key in the crypto subsystem when receiving
+ * a NULL private key or sets the received key when not NULL.
+ *
+ * @tfm:           KPP tfm handle allocated with crypto_alloc_kpp().
+ * @private_key:   user's ecc private key. When not NULL, the key is expected
+ *                 in little endian format.
+ *
+ * Return: zero on success; error code in case of error.
+ */
+int set_ecdh_privkey(struct crypto_kpp *tfm, const u8 private_key[32])
+{
+        u8 *buf, *tmp = NULL;
+        unsigned int buf_len;
+        int err;
+        struct ecdh p = {0};
+
+        p.curve_id = ECC_CURVE_NIST_P256;
+
+        if (private_key) {
+                tmp = kmalloc(32, GFP_KERNEL);
+                if (!tmp)
+                        return -ENOMEM;
+                swap_digits((u64 *)private_key, (u64 *)tmp, 4);
+                p.key = tmp;
+                p.key_size = 32;
+        }
+
+        buf_len = crypto_ecdh_key_len(&p);
+        buf = kmalloc(buf_len, GFP_KERNEL);
+        if (!buf) {
+                err = -ENOMEM;
+                goto free_tmp;
+        }
+
+        err = crypto_ecdh_encode_key(buf, buf_len, &p);
+        if (err)
+                goto free_all;
+
+        err = crypto_kpp_set_secret(tfm, buf, buf_len);
+        /* fall through */
+free_all:
+        kzfree(buf);
+free_tmp:
+        kzfree(tmp);
+        return err;
+}
+
+/* generate_ecdh_public_key() - function assumes that the private key was
+ *                              already set.
+ *
+ * @tfm:          KPP tfm handle allocated with crypto_alloc_kpp().
+ * @public_key:   memory where the computed ecc public key will be saved.
+ *
+ * Return: zero on success; error code in case of error.
+ */
+int generate_ecdh_public_key(struct crypto_kpp *tfm, u8 public_key[64])
 {
-        struct crypto_kpp *tfm;
         struct kpp_request *req;
-        struct ecdh p;
+        u8 *tmp;
         struct ecdh_completion result;
         struct scatterlist dst;
-        u8 *tmp, *buf;
-        unsigned int buf_len;
-        int err = -ENOMEM;
-        const unsigned short max_tries = 16;
-        unsigned short tries = 0;
+        int err;
 
         tmp = kmalloc(64, GFP_KERNEL);
         if (!tmp)
-                return false;
+                return -ENOMEM;
 
-        tfm = crypto_alloc_kpp("ecdh", CRYPTO_ALG_INTERNAL, 0);
-        if (IS_ERR(tfm)) {
-                pr_err("alg: kpp: Failed to load tfm for kpp: %ld\n",
-                       PTR_ERR(tfm));
+        req = kpp_request_alloc(tfm, GFP_KERNEL);
+        if (!req) {
+                err = -ENOMEM;
                 goto free_tmp;
         }
 
-        req = kpp_request_alloc(tfm, GFP_KERNEL);
-        if (!req)
-                goto free_kpp;
-
         init_completion(&result.completion);
+        sg_init_one(&dst, tmp, 64);
+        kpp_request_set_input(req, NULL, 0);
+        kpp_request_set_output(req, &dst, 64);
+        kpp_request_set_callback(req, CRYPTO_TFM_REQ_MAY_BACKLOG,
+                                 ecdh_complete, &result);
 
-        /* Set curve_id */
-        p.curve_id = ECC_CURVE_NIST_P256;
-        p.key_size = 32;
-        buf_len = crypto_ecdh_key_len(&p);
-        buf = kmalloc(buf_len, GFP_KERNEL);
-        if (!buf)
-                goto free_req;
-
-        do {
-                if (tries++ >= max_tries)
-                        goto free_all;
-
-                /* Set private Key */
-                p.key = (char *)private_key;
-                crypto_ecdh_encode_key(buf, buf_len, &p);
-                err = crypto_kpp_set_secret(tfm, buf, buf_len);
-                if (err)
-                        goto free_all;
-
-                sg_init_one(&dst, tmp, 64);
-                kpp_request_set_input(req, NULL, 0);
-                kpp_request_set_output(req, &dst, 64);
-                kpp_request_set_callback(req, CRYPTO_TFM_REQ_MAY_BACKLOG,
-                                         ecdh_complete, &result);
-
-                err = crypto_kpp_generate_public_key(req);
-
-                if (err == -EINPROGRESS) {
-                        wait_for_completion(&result.completion);
-                        err = result.err;
-                }
-
-                /* Private key is not valid. Regenerate */
-                if (err == -EINVAL)
-                        continue;
-
-                if (err < 0)
-                        goto free_all;
-                else
-                        break;
-
-        } while (true);
-
-        /* Keys are handed back in little endian as expected by Security
-         * Manager Protocol
+        err = crypto_kpp_generate_public_key(req);
+        if (err == -EINPROGRESS) {
+                wait_for_completion(&result.completion);
+                err = result.err;
+        }
+        if (err < 0)
+                goto free_all;
+
+        /* The public key is handed back in little endian as expected by
+         * the Security Manager Protocol.
          */
         swap_digits((u64 *)tmp, (u64 *)public_key, 4); /* x */
         swap_digits((u64 *)&tmp[32], (u64 *)&public_key[32], 4); /* y */
-        swap_digits((u64 *)private_key, (u64 *)tmp, 4);
-        memcpy(private_key, tmp, 32);
 
 free_all:
-        kzfree(buf);
-free_req:
         kpp_request_free(req);
-free_kpp:
-        crypto_free_kpp(tfm);
 free_tmp:
         kfree(tmp);
-        return (err == 0);
+        return err;
+}
+
+/* generate_ecdh_keys() - generate ecc key pair.
+ *
+ * @tfm:          KPP tfm handle allocated with crypto_alloc_kpp().
+ * @public_key:   memory where the computed ecc public key will be saved.
+ *
+ * Return: zero on success; error code in case of error.
+ */
+int generate_ecdh_keys(struct crypto_kpp *tfm, u8 public_key[64])
+{
+        int err;
+
+        err = set_ecdh_privkey(tfm, NULL);
+        if (err)
+                return err;
+
+        return generate_ecdh_public_key(tfm, public_key);
 }
diff --git a/net/bluetooth/ecdh_helper.h b/net/bluetooth/ecdh_helper.h
index 7a423faf76e5..a6f8d03d4aaf 100644
--- a/net/bluetooth/ecdh_helper.h
+++ b/net/bluetooth/ecdh_helper.h
@@ -20,8 +20,11 @@
  * COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  * SOFTWARE IS DISCLAIMED.
  */
+#include <crypto/kpp.h>
 #include <linux/types.h>
 
-bool compute_ecdh_secret(const u8 pub_a[64], const u8 priv_b[32],
-                         u8 secret[32]);
-bool generate_ecdh_keys(u8 public_key[64], u8 private_key[32]);
+int compute_ecdh_secret(struct crypto_kpp *tfm, const u8 pair_public_key[64],
+                        u8 secret[32]);
+int set_ecdh_privkey(struct crypto_kpp *tfm, const u8 *private_key);
+int generate_ecdh_public_key(struct crypto_kpp *tfm, u8 public_key[64]);
+int generate_ecdh_keys(struct crypto_kpp *tfm, u8 public_key[64]);
diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c
index dc59eae54717..a9682534c377 100644
--- a/net/bluetooth/hci_conn.c
+++ b/net/bluetooth/hci_conn.c
@@ -729,8 +729,8 @@ static void create_le_conn_complete(struct hci_dev *hdev, u8 status, u16 opcode)
                 goto done;
         }
 
-        BT_ERR("HCI request failed to create LE connection: status 0x%2.2x",
-               status);
+        bt_dev_err(hdev, "request failed to create LE connection: "
+                   "status 0x%2.2x", status);
 
         if (!conn)
                 goto done;
@@ -907,7 +907,7 @@ struct hci_conn *hci_connect_le(struct hci_dev *hdev, bdaddr_t *dst,
                  */
                 if (hci_dev_test_flag(hdev, HCI_LE_SCAN) &&
                     hdev->le_scan_type == LE_SCAN_ACTIVE) {
-                        skb_queue_purge(&req.cmd_q);
+                        hci_req_purge(&req);
                         hci_conn_del(conn);
                         return ERR_PTR(-EBUSY);
                 }
diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c
index 6bc679cd3481..40d260f2bea5 100644
--- a/net/bluetooth/hci_core.c
+++ b/net/bluetooth/hci_core.c
@@ -267,7 +267,7 @@ static int hci_init1_req(struct hci_request *req, unsigned long opt)
                 amp_init1(req);
                 break;
         default:
-                BT_ERR("Unknown device type %d", hdev->dev_type);
+                bt_dev_err(hdev, "Unknown device type %d", hdev->dev_type);
                 break;
         }
 
@@ -2150,8 +2150,7 @@ static void hci_error_reset(struct work_struct *work)
         if (hdev->hw_error)
                 hdev->hw_error(hdev, hdev->hw_error_code);
         else
-                BT_ERR("%s hardware error 0x%2.2x", hdev->name,
-                       hdev->hw_error_code);
+                bt_dev_err(hdev, "hardware error 0x%2.2x", hdev->hw_error_code);
 
         if (hci_dev_do_close(hdev))
                 return;
@@ -2524,9 +2523,9 @@ static void hci_cmd_timeout(struct work_struct *work)
                 struct hci_command_hdr *sent = (void *) hdev->sent_cmd->data;
                 u16 opcode = __le16_to_cpu(sent->opcode);
 
-                BT_ERR("%s command 0x%4.4x tx timeout", hdev->name, opcode);
+                bt_dev_err(hdev, "command 0x%4.4x tx timeout", opcode);
         } else {
-                BT_ERR("%s command tx timeout", hdev->name);
+                bt_dev_err(hdev, "command tx timeout");
         }
 
         atomic_set(&hdev->cmd_cnt, 1);
@@ -2858,7 +2857,7 @@ struct hci_conn_params *hci_conn_params_add(struct hci_dev *hdev,
 
         params = kzalloc(sizeof(*params), GFP_KERNEL);
         if (!params) {
-                BT_ERR("Out of memory");
+                bt_dev_err(hdev, "out of memory");
                 return NULL;
         }
 
@@ -3393,7 +3392,7 @@ static void hci_send_frame(struct hci_dev *hdev, struct sk_buff *skb)
 
         err = hdev->send(hdev, skb);
         if (err < 0) {
-                BT_ERR("%s sending frame failed (%d)", hdev->name, err);
+                bt_dev_err(hdev, "sending frame failed (%d)", err);
                 kfree_skb(skb);
         }
 }
@@ -3408,7 +3407,7 @@ int hci_send_cmd(struct hci_dev *hdev, __u16 opcode, __u32 plen,
 
         skb = hci_prepare_cmd(hdev, opcode, plen, param);
         if (!skb) {
-                BT_ERR("%s no memory for command", hdev->name);
+                bt_dev_err(hdev, "no memory for command");
                 return -ENOMEM;
         }
 
@@ -3493,7 +3492,7 @@ static void hci_queue_acl(struct hci_chan *chan, struct sk_buff_head *queue,
                 hci_add_acl_hdr(skb, chan->handle, flags);
                 break;
         default:
-                BT_ERR("%s unknown dev_type %d", hdev->name, hdev->dev_type);
+                bt_dev_err(hdev, "unknown dev_type %d", hdev->dev_type);
                 return;
         }
 
@@ -3618,7 +3617,7 @@ static struct hci_conn *hci_low_sent(struct hci_dev *hdev, __u8 type,
                         break;
                 default:
                         cnt = 0;
-                        BT_ERR("Unknown link type");
+                        bt_dev_err(hdev, "unknown link type %d", conn->type);
                 }
 
                 q = cnt / num;
@@ -3635,15 +3634,15 @@ static void hci_link_tx_to(struct hci_dev *hdev, __u8 type)
         struct hci_conn_hash *h = &hdev->conn_hash;
         struct hci_conn *c;
 
-        BT_ERR("%s link tx timeout", hdev->name);
+        bt_dev_err(hdev, "link tx timeout");
 
         rcu_read_lock();
 
         /* Kill stalled connections */
         list_for_each_entry_rcu(c, &h->list, list) {
                 if (c->type == type && c->sent) {
-                        BT_ERR("%s killing stalled connection %pMR",
-                               hdev->name, &c->dst);
+                        bt_dev_err(hdev, "killing stalled connection %pMR",
+                                   &c->dst);
                         hci_disconnect(c, HCI_ERROR_REMOTE_USER_TERM);
                 }
         }
@@ -3724,7 +3723,7 @@ static struct hci_chan *hci_chan_sent(struct hci_dev *hdev, __u8 type,
                 break;
         default:
                 cnt = 0;
-                BT_ERR("Unknown link type");
+                bt_dev_err(hdev, "unknown link type %d", chan->conn->type);
         }
 
         q = cnt / num;
@@ -4066,8 +4065,8 @@ static void hci_acldata_packet(struct hci_dev *hdev, struct sk_buff *skb)
                 l2cap_recv_acldata(conn, skb, flags);
                 return;
         } else {
-                BT_ERR("%s ACL packet for unknown connection handle %d",
-                       hdev->name, handle);
+                bt_dev_err(hdev, "ACL packet for unknown connection handle %d",
+                           handle);
         }
 
         kfree_skb(skb);
@@ -4097,8 +4096,8 @@ static void hci_scodata_packet(struct hci_dev *hdev, struct sk_buff *skb)
                 sco_recv_scodata(conn, skb);
                 return;
         } else {
-                BT_ERR("%s SCO packet for unknown connection handle %d",
-                       hdev->name, handle);
+                bt_dev_err(hdev, "SCO packet for unknown connection handle %d",
+                           handle);
         }
 
         kfree_skb(skb);
diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c
index 0b4dba08a14e..cd3bbb766c24 100644
--- a/net/bluetooth/hci_event.c
+++ b/net/bluetooth/hci_event.c
@@ -1188,7 +1188,8 @@ static void hci_cc_le_set_scan_enable(struct hci_dev *hdev,
                 break;
 
         default:
-                BT_ERR("Used reserved LE_Scan_Enable param %d", cp->enable);
+                bt_dev_err(hdev, "use of reserved LE_Scan_Enable param %d",
+                           cp->enable);
                 break;
         }
 
@@ -1485,7 +1486,7 @@ static void hci_cs_create_conn(struct hci_dev *hdev, __u8 status)
                         conn = hci_conn_add(hdev, ACL_LINK, &cp->bdaddr,
                                             HCI_ROLE_MASTER);
                         if (!conn)
-                                BT_ERR("No memory for new connection");
+                                bt_dev_err(hdev, "no memory for new connection");
                 }
         }
 
@@ -2269,7 +2270,7 @@ static void hci_conn_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
                 conn = hci_conn_add(hdev, ev->link_type, &ev->bdaddr,
                                     HCI_ROLE_SLAVE);
                 if (!conn) {
-                        BT_ERR("No memory for new connection");
+                        bt_dev_err(hdev, "no memory for new connection");
                         hci_dev_unlock(hdev);
                         return;
                 }
@@ -2431,7 +2432,7 @@ static void hci_auth_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
 
                 if (!hci_conn_ssp_enabled(conn) &&
                     test_bit(HCI_CONN_REAUTH_PEND, &conn->flags)) {
-                        BT_INFO("re-auth of legacy device is not possible.");
+                        bt_dev_info(hdev, "re-auth of legacy device is not possible.");
                 } else {
                         set_bit(HCI_CONN_AUTH, &conn->flags);
                         conn->sec_level = conn->pending_sec_level;
@@ -2535,8 +2536,7 @@ static void read_enc_key_size_complete(struct hci_dev *hdev, u8 status,
         BT_DBG("%s status 0x%02x", hdev->name, status);
 
         if (!skb || skb->len < sizeof(*rp)) {
-                BT_ERR("%s invalid HCI Read Encryption Key Size response",
-                       hdev->name);
+                bt_dev_err(hdev, "invalid read key size response");
                 return;
         }
 
@@ -2554,8 +2554,8 @@ static void read_enc_key_size_complete(struct hci_dev *hdev, u8 status,
          * supported.
          */
         if (rp->status) {
-                BT_ERR("%s failed to read key size for handle %u", hdev->name,
-                       handle);
+                bt_dev_err(hdev, "failed to read key size for handle %u",
+                           handle);
                 conn->enc_key_size = HCI_LINK_KEY_SIZE;
         } else {
                 conn->enc_key_size = rp->key_size;
@@ -2664,7 +2664,7 @@ static void hci_encrypt_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
                 hci_req_add(&req, HCI_OP_READ_ENC_KEY_SIZE, sizeof(cp), &cp);
 
                 if (hci_req_run_skb(&req, read_enc_key_size_complete)) {
-                        BT_ERR("Sending HCI Read Encryption Key Size failed");
+                        bt_dev_err(hdev, "sending read key size failed");
                         conn->enc_key_size = HCI_LINK_KEY_SIZE;
                         goto notify;
                 }
@@ -3197,7 +3197,7 @@ static void hci_num_comp_pkts_evt(struct hci_dev *hdev, struct sk_buff *skb)
         int i;
 
         if (hdev->flow_ctl_mode != HCI_FLOW_CTL_MODE_PACKET_BASED) {
-                BT_ERR("Wrong event for mode %d", hdev->flow_ctl_mode);
+                bt_dev_err(hdev, "wrong event for mode %d", hdev->flow_ctl_mode);
                 return;
         }
 
@@ -3249,7 +3249,8 @@ static void hci_num_comp_pkts_evt(struct hci_dev *hdev, struct sk_buff *skb)
                         break;
 
                 default:
-                        BT_ERR("Unknown type %d conn %p", conn->type, conn);
+                        bt_dev_err(hdev, "unknown type %d conn %p",
+                                   conn->type, conn);
                         break;
                 }
         }
@@ -3271,7 +3272,7 @@ static struct hci_conn *__hci_conn_lookup_handle(struct hci_dev *hdev,
                         return chan->conn;
                 break;
         default:
-                BT_ERR("%s unknown dev_type %d", hdev->name, hdev->dev_type);
+                bt_dev_err(hdev, "unknown dev_type %d", hdev->dev_type);
                 break;
         }
 
@@ -3284,7 +3285,7 @@ static void hci_num_comp_blocks_evt(struct hci_dev *hdev, struct sk_buff *skb)
         int i;
 
         if (hdev->flow_ctl_mode != HCI_FLOW_CTL_MODE_BLOCK_BASED) {
-                BT_ERR("Wrong event for mode %d", hdev->flow_ctl_mode);
+                bt_dev_err(hdev, "wrong event for mode %d", hdev->flow_ctl_mode);
                 return;
         }
 
@@ -3320,7 +3321,8 @@ static void hci_num_comp_blocks_evt(struct hci_dev *hdev, struct sk_buff *skb)
                         break;
 
                 default:
-                        BT_ERR("Unknown type %d conn %p", conn->type, conn);
+                        bt_dev_err(hdev, "unknown type %d conn %p",
+                                   conn->type, conn);
                         break;
                 }
         }
@@ -4479,7 +4481,7 @@ static void hci_le_conn_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
         if (!conn) {
                 conn = hci_conn_add(hdev, LE_LINK, &ev->bdaddr, ev->role);
                 if (!conn) {
-                        BT_ERR("No memory for new connection");
+                        bt_dev_err(hdev, "no memory for new connection");
                         goto unlock;
                 }
 
@@ -4749,8 +4751,8 @@ static void process_adv_report(struct hci_dev *hdev, u8 type, bdaddr_t *bdaddr,
         case LE_ADV_SCAN_RSP:
                 break;
         default:
-                BT_ERR_RATELIMITED("Unknown advertising packet type: 0x%02x",
-                                   type);
+                bt_dev_err_ratelimited(hdev, "unknown advertising packet "
+                                       "type: 0x%02x", type);
                 return;
         }
 
@@ -4769,8 +4771,7 @@ static void process_adv_report(struct hci_dev *hdev, u8 type, bdaddr_t *bdaddr,
 
         /* Adjust for actual length */
         if (len != real_len) {
-                BT_ERR_RATELIMITED("%s advertising data length corrected",
-                                   hdev->name);
+                bt_dev_err_ratelimited(hdev, "advertising data len corrected");
                 len = real_len;
         }
 
@@ -5192,7 +5193,7 @@ static bool hci_get_cmd_complete(struct hci_dev *hdev, u16 opcode,
                 return false;
 
         if (skb->len < sizeof(*hdr)) {
-                BT_ERR("Too short HCI event");
+                bt_dev_err(hdev, "too short HCI event");
                 return false;
         }
 
@@ -5206,12 +5207,13 @@ static bool hci_get_cmd_complete(struct hci_dev *hdev, u16 opcode,
         }
 
         if (hdr->evt != HCI_EV_CMD_COMPLETE) {
-                BT_DBG("Last event is not cmd complete (0x%2.2x)", hdr->evt);
+                bt_dev_err(hdev, "last event is not cmd complete (0x%2.2x)",
+                           hdr->evt);
                 return false;
         }
 
         if (skb->len < sizeof(*ev)) {
-                BT_ERR("Too short cmd_complete event");
+                bt_dev_err(hdev, "too short cmd_complete event");
                 return false;
         }
 
diff --git a/net/bluetooth/hci_request.c b/net/bluetooth/hci_request.c
index b73ac149de34..abc0f3224dd1 100644
--- a/net/bluetooth/hci_request.c
+++ b/net/bluetooth/hci_request.c
@@ -41,6 +41,11 @@ void hci_req_init(struct hci_request *req, struct hci_dev *hdev)
         req->err = 0;
 }
 
+void hci_req_purge(struct hci_request *req)
+{
+        skb_queue_purge(&req->cmd_q);
+}
+
 static int req_run(struct hci_request *req, hci_req_complete_t complete,
                    hci_req_complete_skb_t complete_skb)
 {
@@ -331,8 +336,8 @@ void hci_req_add_ev(struct hci_request *req, u16 opcode, u32 plen,
 
         skb = hci_prepare_cmd(hdev, opcode, plen, param);
         if (!skb) {
-                BT_ERR("%s no memory for command (opcode 0x%4.4x)",
-                       hdev->name, opcode);
+                bt_dev_err(hdev, "no memory for command (opcode 0x%4.4x)",
+                           opcode);
                 req->err = -ENOMEM;
                 return;
         }
@@ -1421,7 +1426,7 @@ int hci_update_random_address(struct hci_request *req, bool require_privacy,
 
                 err = smp_generate_rpa(hdev, hdev->irk, &hdev->rpa);
                 if (err < 0) {
-                        BT_ERR("%s failed to generate new RPA", hdev->name);
+                        bt_dev_err(hdev, "failed to generate new RPA");
                         return err;
                 }
 
@@ -1783,7 +1788,7 @@ int hci_abort_conn(struct hci_conn *conn, u8 reason)
 
         err = hci_req_run(&req, abort_conn_complete);
         if (err && err != -ENODATA) {
-                BT_ERR("Failed to run HCI request: err %d", err);
+                bt_dev_err(conn->hdev, "failed to run HCI request: err %d", err);
                 return err;
         }
 
@@ -1867,7 +1872,8 @@ static void le_scan_disable_work(struct work_struct *work)
 
         hci_req_sync(hdev, le_scan_disable, 0, HCI_CMD_TIMEOUT, &status);
         if (status) {
-                BT_ERR("Failed to disable LE scan: status 0x%02x", status);
+                bt_dev_err(hdev, "failed to disable LE scan: status 0x%02x",
+                           status);
                 return;
         }
 
@@ -1898,7 +1904,7 @@ static void le_scan_disable_work(struct work_struct *work)
         hci_req_sync(hdev, bredr_inquiry, DISCOV_INTERLEAVED_INQUIRY_LEN,
                      HCI_CMD_TIMEOUT, &status);
         if (status) {
-                BT_ERR("Inquiry failed: status 0x%02x", status);
+                bt_dev_err(hdev, "inquiry failed: status 0x%02x", status);
                 goto discov_stopped;
         }
 
@@ -1940,7 +1946,8 @@ static void le_scan_restart_work(struct work_struct *work)
 
         hci_req_sync(hdev, le_scan_restart, 0, HCI_CMD_TIMEOUT, &status);
         if (status) {
-                BT_ERR("Failed to restart LE scan: status %d", status);
+                bt_dev_err(hdev, "failed to restart LE scan: status %d",
+                           status);
                 return;
         }
 
diff --git a/net/bluetooth/hci_request.h b/net/bluetooth/hci_request.h
index dde77bd59f91..702beb140d9f 100644
--- a/net/bluetooth/hci_request.h
+++ b/net/bluetooth/hci_request.h
@@ -36,6 +36,7 @@ struct hci_request {
 };
 
 void hci_req_init(struct hci_request *req, struct hci_dev *hdev);
+void hci_req_purge(struct hci_request *req);
 int hci_req_run(struct hci_request *req, hci_req_complete_t complete);
 int hci_req_run_skb(struct hci_request *req, hci_req_complete_skb_t complete);
 void hci_req_add(struct hci_request *req, u16 opcode, u32 plen,
diff --git a/net/bluetooth/hci_sock.c b/net/bluetooth/hci_sock.c
index 65d734c165bd..923e9a271872 100644
--- a/net/bluetooth/hci_sock.c
+++ b/net/bluetooth/hci_sock.c
@@ -251,15 +251,13 @@ void hci_send_to_sock(struct hci_dev *hdev, struct sk_buff *skb)
 }
 
 /* Send frame to sockets with specific channel */
-void hci_send_to_channel(unsigned short channel, struct sk_buff *skb,
-                         int flag, struct sock *skip_sk)
+static void __hci_send_to_channel(unsigned short channel, struct sk_buff *skb,
+                                  int flag, struct sock *skip_sk)
 {
         struct sock *sk;
 
         BT_DBG("channel %u len %d", channel, skb->len);
 
-        read_lock(&hci_sk_list.lock);
-
         sk_for_each(sk, &hci_sk_list.head) {
                 struct sk_buff *nskb;
 
@@ -285,6 +283,13 @@ void hci_send_to_channel(unsigned short channel, struct sk_buff *skb,
                         kfree_skb(nskb);
         }
 
+}
+
+void hci_send_to_channel(unsigned short channel, struct sk_buff *skb,
+                         int flag, struct sock *skip_sk)
+{
+        read_lock(&hci_sk_list.lock);
+        __hci_send_to_channel(channel, skb, flag, skip_sk);
         read_unlock(&hci_sk_list.lock);
 }
 
@@ -388,8 +393,8 @@ void hci_send_monitor_ctrl_event(struct hci_dev *hdev, u16 event,
                 hdr->index = index;
                 hdr->len = cpu_to_le16(skb->len - HCI_MON_HDR_SIZE);
 
-                hci_send_to_channel(HCI_CHANNEL_MONITOR, skb,
-                                    HCI_SOCK_TRUSTED, NULL);
+                __hci_send_to_channel(HCI_CHANNEL_MONITOR, skb,
+                                      HCI_SOCK_TRUSTED, NULL);
                 kfree_skb(skb);
         }
 
diff --git a/net/bluetooth/hci_sysfs.c b/net/bluetooth/hci_sysfs.c
index d5c7c89ec4d6..9874844a95a9 100644
--- a/net/bluetooth/hci_sysfs.c
+++ b/net/bluetooth/hci_sysfs.c
@@ -51,7 +51,7 @@ void hci_conn_add_sysfs(struct hci_conn *conn)
         dev_set_name(&conn->dev, "%s:%d", hdev->name, conn->handle);
 
         if (device_add(&conn->dev) < 0) {
-                BT_ERR("Failed to register connection device");
+                bt_dev_err(hdev, "failed to register connection device");
                 return;
         }
 
diff --git a/net/bluetooth/hidp/core.c b/net/bluetooth/hidp/core.c
index 8112893037bd..f2cec70d520c 100644
--- a/net/bluetooth/hidp/core.c
+++ b/net/bluetooth/hidp/core.c
@@ -398,9 +398,9 @@ static int hidp_raw_request(struct hid_device *hid, unsigned char reportnum,
         }
 }
 
-static void hidp_idle_timeout(unsigned long arg)
+static void hidp_idle_timeout(struct timer_list *t)
 {
-        struct hidp_session *session = (struct hidp_session *) arg;
+        struct hidp_session *session = from_timer(session, t, timer);
 
         /* The HIDP user-space API only contains calls to add and remove
          * devices. There is no way to forward events of any kind. Therefore,
@@ -944,8 +944,7 @@ static int hidp_session_new(struct hidp_session **out, const bdaddr_t *bdaddr,
 
         /* device management */
         INIT_WORK(&session->dev_init, hidp_session_dev_work);
-        setup_timer(&session->timer, hidp_idle_timeout,
-                    (unsigned long)session);
+        timer_setup(&session->timer, hidp_idle_timeout, 0);
 
         /* session data */
         mutex_init(&session->report_mutex);
diff --git a/net/bluetooth/mgmt.c b/net/bluetooth/mgmt.c
index 1fba2a03f8ae..6e9fc86d8daf 100644
--- a/net/bluetooth/mgmt.c
+++ b/net/bluetooth/mgmt.c
@@ -2159,8 +2159,8 @@ static int load_link_keys(struct sock *sk, struct hci_dev *hdev, void *data,
 
         key_count = __le16_to_cpu(cp->key_count);
         if (key_count > max_key_count) {
-                BT_ERR("load_link_keys: too big key_count value %u",
-                       key_count);
+                bt_dev_err(hdev, "load_link_keys: too big key_count value %u",
+                           key_count);
                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
                                        MGMT_STATUS_INVALID_PARAMS);
         }
@@ -2168,8 +2168,8 @@ static int load_link_keys(struct sock *sk, struct hci_dev *hdev, void *data,
         expected_len = sizeof(*cp) + key_count *
                                         sizeof(struct mgmt_link_key_info);
         if (expected_len != len) {
-                BT_ERR("load_link_keys: expected %u bytes, got %u bytes",
-                       expected_len, len);
+                bt_dev_err(hdev, "load_link_keys: expected %u bytes, got %u bytes",
+                           expected_len, len);
                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
                                        MGMT_STATUS_INVALID_PARAMS);
         }
@@ -2561,7 +2561,7 @@ static int pin_code_reply(struct sock *sk, struct hci_dev *hdev, void *data,
 
                 memcpy(&ncp.addr, &cp->addr, sizeof(ncp.addr));
 
-                BT_ERR("PIN code is not 16 bytes long");
+                bt_dev_err(hdev, "PIN code is not 16 bytes long");
 
                 err = send_pin_code_neg_reply(sk, hdev, &ncp);
                 if (err >= 0)
@@ -3391,7 +3391,8 @@ static int add_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
                                         MGMT_OP_ADD_REMOTE_OOB_DATA,
                                         status, &cp->addr, sizeof(cp->addr));
         } else {
-                BT_ERR("add_remote_oob_data: invalid length of %u bytes", len);
+                bt_dev_err(hdev, "add_remote_oob_data: invalid len of %u bytes",
+                           len);
                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_REMOTE_OOB_DATA,
                                       MGMT_STATUS_INVALID_PARAMS);
         }
@@ -3604,8 +3605,8 @@ static int start_service_discovery(struct sock *sk, struct hci_dev *hdev,
 
         uuid_count = __le16_to_cpu(cp->uuid_count);
         if (uuid_count > max_uuid_count) {
-                BT_ERR("service_discovery: too big uuid_count value %u",
-                       uuid_count);
+                bt_dev_err(hdev, "service_discovery: too big uuid_count value %u",
+                           uuid_count);
                 err = mgmt_cmd_complete(sk, hdev->id,
                                         MGMT_OP_START_SERVICE_DISCOVERY,
                                         MGMT_STATUS_INVALID_PARAMS, &cp->type,
@@ -3615,8 +3616,8 @@ static int start_service_discovery(struct sock *sk, struct hci_dev *hdev,
 
         expected_len = sizeof(*cp) + uuid_count * 16;
         if (expected_len != len) {
-                BT_ERR("service_discovery: expected %u bytes, got %u bytes",
-                       expected_len, len);
+                bt_dev_err(hdev, "service_discovery: expected %u bytes, got %u bytes",
+                           expected_len, len);
                 err = mgmt_cmd_complete(sk, hdev->id,
                                         MGMT_OP_START_SERVICE_DISCOVERY,
                                         MGMT_STATUS_INVALID_PARAMS, &cp->type,
@@ -3943,7 +3944,7 @@ static void set_advertising_complete(struct hci_dev *hdev, u8 status,
                 err = hci_req_run(&req, enable_advertising_instance);
 
         if (err)
-                BT_ERR("Failed to re-configure advertising");
+                bt_dev_err(hdev, "failed to re-configure advertising");
 
 unlock:
         hci_dev_unlock(hdev);
@@ -4664,15 +4665,16 @@ static int load_irks(struct sock *sk, struct hci_dev *hdev, void *cp_data,
 
         irk_count = __le16_to_cpu(cp->irk_count);
         if (irk_count > max_irk_count) {
-                BT_ERR("load_irks: too big irk_count value %u", irk_count);
+                bt_dev_err(hdev, "load_irks: too big irk_count value %u",
+                           irk_count);
                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
                                        MGMT_STATUS_INVALID_PARAMS);
         }
 
         expected_len = sizeof(*cp) + irk_count * sizeof(struct mgmt_irk_info);
         if (expected_len != len) {
-                BT_ERR("load_irks: expected %u bytes, got %u bytes",
-                       expected_len, len);
+                bt_dev_err(hdev, "load_irks: expected %u bytes, got %u bytes",
+                           expected_len, len);
                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
                                        MGMT_STATUS_INVALID_PARAMS);
         }
@@ -4745,7 +4747,8 @@ static int load_long_term_keys(struct sock *sk, struct hci_dev *hdev,
 
         key_count = __le16_to_cpu(cp->key_count);
         if (key_count > max_key_count) {
-                BT_ERR("load_ltks: too big key_count value %u", key_count);
+                bt_dev_err(hdev, "load_ltks: too big key_count value %u",
+                           key_count);
                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
                                        MGMT_STATUS_INVALID_PARAMS);
         }
@@ -4753,8 +4756,8 @@ static int load_long_term_keys(struct sock *sk, struct hci_dev *hdev,
         expected_len = sizeof(*cp) + key_count *
                                         sizeof(struct mgmt_ltk_info);
         if (expected_len != len) {
-                BT_ERR("load_keys: expected %u bytes, got %u bytes",
-                       expected_len, len);
+                bt_dev_err(hdev, "load_keys: expected %u bytes, got %u bytes",
+                           expected_len, len);
                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
                                        MGMT_STATUS_INVALID_PARAMS);
         }
@@ -4873,14 +4876,15 @@ static void conn_info_refresh_complete(struct hci_dev *hdev, u8 hci_status,
         }
 
         if (!cp) {
-                BT_ERR("invalid sent_cmd in conn_info response");
+                bt_dev_err(hdev, "invalid sent_cmd in conn_info response");
                 goto unlock;
         }
 
         handle = __le16_to_cpu(cp->handle);
         conn = hci_conn_hash_lookup_handle(hdev, handle);
         if (!conn) {
-                BT_ERR("unknown handle (%d) in conn_info response", handle);
+                bt_dev_err(hdev, "unknown handle (%d) in conn_info response",
+                           handle);
                 goto unlock;
         }
 
@@ -5477,8 +5481,8 @@ static int load_conn_param(struct sock *sk, struct hci_dev *hdev, void *data,
 
         param_count = __le16_to_cpu(cp->param_count);
         if (param_count > max_param_count) {
-                BT_ERR("load_conn_param: too big param_count value %u",
-                       param_count);
+                bt_dev_err(hdev, "load_conn_param: too big param_count value %u",
+                           param_count);
                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM,
                                        MGMT_STATUS_INVALID_PARAMS);
         }
@@ -5486,8 +5490,8 @@ static int load_conn_param(struct sock *sk, struct hci_dev *hdev, void *data,
         expected_len = sizeof(*cp) + param_count *
                                         sizeof(struct mgmt_conn_param);
         if (expected_len != len) {
-                BT_ERR("load_conn_param: expected %u bytes, got %u bytes",
-                       expected_len, len);
+                bt_dev_err(hdev, "load_conn_param: expected %u bytes, got %u bytes",
+                           expected_len, len);
                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM,
                                        MGMT_STATUS_INVALID_PARAMS);
         }
@@ -5512,7 +5516,7 @@ static int load_conn_param(struct sock *sk, struct hci_dev *hdev, void *data,
                 } else if (param->addr.type == BDADDR_LE_RANDOM) {
                         addr_type = ADDR_LE_DEV_RANDOM;
                 } else {
-                        BT_ERR("Ignoring invalid connection parameters");
+                        bt_dev_err(hdev, "ignoring invalid connection parameters");
                         continue;
                 }
 
@@ -5525,14 +5529,14 @@ static int load_conn_param(struct sock *sk, struct hci_dev *hdev, void *data,
                        min, max, latency, timeout);
 
                 if (hci_check_conn_params(min, max, latency, timeout) < 0) {
-                        BT_ERR("Ignoring invalid connection parameters");
+                        bt_dev_err(hdev, "ignoring invalid connection parameters");
                         continue;
                 }
 
                 hci_param = hci_conn_params_add(hdev, &param->addr.bdaddr,
                                                 addr_type);
                 if (!hci_param) {
-                        BT_ERR("Failed to add connection parameters");
+                        bt_dev_err(hdev, "failed to add connection parameters");
                         continue;
                 }
 
@@ -6383,6 +6387,7 @@ static int remove_advertising(struct sock *sk, struct hci_dev *hdev,
         if (skb_queue_empty(&req.cmd_q) ||
             !hdev_is_powered(hdev) ||
             hci_dev_test_flag(hdev, HCI_ADVERTISING)) {
+                hci_req_purge(&req);
                 rp.instance = cp->instance;
                 err = mgmt_cmd_complete(sk, hdev->id,
                                         MGMT_OP_REMOVE_ADVERTISING,
diff --git a/net/bluetooth/rfcomm/core.c b/net/bluetooth/rfcomm/core.c
index 4a0b41d75c84..b98225d65e87 100644
--- a/net/bluetooth/rfcomm/core.c
+++ b/net/bluetooth/rfcomm/core.c
@@ -233,9 +233,9 @@ static int rfcomm_check_security(struct rfcomm_dlc *d)
                                  d->out);
 }
 
-static void rfcomm_session_timeout(unsigned long arg)
+static void rfcomm_session_timeout(struct timer_list *t)
 {
-        struct rfcomm_session *s = (void *) arg;
+        struct rfcomm_session *s = from_timer(s, t, timer);
 
         BT_DBG("session %p state %ld", s, s->state);
 
@@ -258,9 +258,9 @@ static void rfcomm_session_clear_timer(struct rfcomm_session *s)
 }
 
 /* ---- RFCOMM DLCs ---- */
-static void rfcomm_dlc_timeout(unsigned long arg)
+static void rfcomm_dlc_timeout(struct timer_list *t)
 {
-        struct rfcomm_dlc *d = (void *) arg;
+        struct rfcomm_dlc *d = from_timer(d, t, timer);
 
         BT_DBG("dlc %p state %ld", d, d->state);
 
@@ -307,7 +307,7 @@ struct rfcomm_dlc *rfcomm_dlc_alloc(gfp_t prio)
         if (!d)
                 return NULL;
 
-        setup_timer(&d->timer, rfcomm_dlc_timeout, (unsigned long)d);
+        timer_setup(&d->timer, rfcomm_dlc_timeout, 0);
 
         skb_queue_head_init(&d->tx_queue);
         mutex_init(&d->lock);
@@ -650,7 +650,7 @@ static struct rfcomm_session *rfcomm_session_add(struct socket *sock, int state)
 
         BT_DBG("session %p sock %p", s, sock);
 
-        setup_timer(&s->timer, rfcomm_session_timeout, (unsigned long) s);
+        timer_setup(&s->timer, rfcomm_session_timeout, 0);
 
         INIT_LIST_HEAD(&s->dlcs);
         s->state = state;
diff --git a/net/bluetooth/sco.c b/net/bluetooth/sco.c
index 795e920a3281..08df57665e1f 100644
--- a/net/bluetooth/sco.c
+++ b/net/bluetooth/sco.c
@@ -73,9 +73,9 @@ struct sco_pinfo {
 #define SCO_CONN_TIMEOUT        (HZ * 40)
 #define SCO_DISCONN_TIMEOUT     (HZ * 2)
 
-static void sco_sock_timeout(unsigned long arg)
+static void sco_sock_timeout(struct timer_list *t)
 {
-        struct sock *sk = (struct sock *)arg;
+        struct sock *sk = from_timer(sk, t, sk_timer);
 
         BT_DBG("sock %p state %d", sk, sk->sk_state);
 
@@ -487,7 +487,7 @@ static struct sock *sco_sock_alloc(struct net *net, struct socket *sock,
 
         sco_pi(sk)->setting = BT_VOICE_CVSD_16BIT;
 
-        setup_timer(&sk->sk_timer, sco_sock_timeout, (unsigned long)sk);
+        timer_setup(&sk->sk_timer, sco_sock_timeout, 0);
 
         bt_sock_link(&sco_sk_list, sk);
         return sk;
diff --git a/net/bluetooth/selftest.c b/net/bluetooth/selftest.c
index 34a1227f4391..03e3c89c3046 100644
--- a/net/bluetooth/selftest.c
+++ b/net/bluetooth/selftest.c
@@ -138,12 +138,12 @@ static const u8 dhkey_3[32] __initconst = {
         0x7c, 0x1c, 0xf9, 0x49, 0xe6, 0xd7, 0xaa, 0x70,
 };
 
-static int __init test_ecdh_sample(const u8 priv_a[32], const u8 priv_b[32],
-                                   const u8 pub_a[64], const u8 pub_b[64],
-                                   const u8 dhkey[32])
+static int __init test_ecdh_sample(struct crypto_kpp *tfm, const u8 priv_a[32],
+                                   const u8 priv_b[32], const u8 pub_a[64],
+                                   const u8 pub_b[64], const u8 dhkey[32])
 {
         u8 *tmp, *dhkey_a, *dhkey_b;
-        int ret = 0;
+        int ret;
 
         tmp = kmalloc(64, GFP_KERNEL);
         if (!tmp)
@@ -152,17 +152,30 @@ static int __init test_ecdh_sample(const u8 priv_a[32], const u8 priv_b[32],
         dhkey_a = &tmp[0];
         dhkey_b = &tmp[32];
 
-        compute_ecdh_secret(pub_b, priv_a, dhkey_a);
-        compute_ecdh_secret(pub_a, priv_b, dhkey_b);
+        ret = set_ecdh_privkey(tfm, priv_a);
+        if (ret)
+                goto out;
+
+        ret = compute_ecdh_secret(tfm, pub_b, dhkey_a);
+        if (ret)
+                goto out;
 
         if (memcmp(dhkey_a, dhkey, 32)) {
                 ret = -EINVAL;
                 goto out;
         }
 
+        ret = set_ecdh_privkey(tfm, priv_b);
+        if (ret)
+                goto out;
+
+        ret = compute_ecdh_secret(tfm, pub_a, dhkey_b);
+        if (ret)
+                goto out;
+
         if (memcmp(dhkey_b, dhkey, 32))
                 ret = -EINVAL;
-
+        /* fall through*/
 out:
         kfree(tmp);
         return ret;
@@ -185,30 +198,43 @@ static const struct file_operations test_ecdh_fops = {
 
 static int __init test_ecdh(void)
 {
+        struct crypto_kpp *tfm;
         ktime_t calltime, delta, rettime;
-        unsigned long long duration;
+        unsigned long long duration = 0;
         int err;
 
         calltime = ktime_get();
 
-        err = test_ecdh_sample(priv_a_1, priv_b_1, pub_a_1, pub_b_1, dhkey_1);
+        tfm = crypto_alloc_kpp("ecdh", CRYPTO_ALG_INTERNAL, 0);
+        if (IS_ERR(tfm)) {
+                BT_ERR("Unable to create ECDH crypto context");
+                err = PTR_ERR(tfm);
+                goto done;
+        }
+
+        err = test_ecdh_sample(tfm, priv_a_1, priv_b_1, pub_a_1, pub_b_1,
+                               dhkey_1);
         if (err) {
                 BT_ERR("ECDH sample 1 failed");
                 goto done;
         }
 
-        err = test_ecdh_sample(priv_a_2, priv_b_2, pub_a_2, pub_b_2, dhkey_2);
+        err = test_ecdh_sample(tfm, priv_a_2, priv_b_2, pub_a_2, pub_b_2,
+                               dhkey_2);
         if (err) {
                 BT_ERR("ECDH sample 2 failed");
                 goto done;
         }
 
-        err = test_ecdh_sample(priv_a_3, priv_a_3, pub_a_3, pub_a_3, dhkey_3);
+        err = test_ecdh_sample(tfm, priv_a_3, priv_a_3, pub_a_3, pub_a_3,
+                               dhkey_3);
         if (err) {
                 BT_ERR("ECDH sample 3 failed");
                 goto done;
         }
 
+        crypto_free_kpp(tfm);
+
         rettime = ktime_get();
         delta = ktime_sub(rettime, calltime);
         duration = (unsigned long long) ktime_to_ns(delta) >> 10;
diff --git a/net/bluetooth/smp.c b/net/bluetooth/smp.c
index a0ef89772c36..01117ae84f1d 100644
--- a/net/bluetooth/smp.c
+++ b/net/bluetooth/smp.c
@@ -26,6 +26,7 @@
 #include <crypto/algapi.h>
 #include <crypto/b128ops.h>
 #include <crypto/hash.h>
+#include <crypto/kpp.h>
 
 #include <net/bluetooth/bluetooth.h>
 #include <net/bluetooth/hci_core.h>
@@ -83,7 +84,6 @@ enum {
 struct smp_dev {
         /* Secure Connections OOB data */
         u8                      local_pk[64];
-        u8                      local_sk[32];
         u8                      local_rand[16];
         bool                    debug_key;
 
@@ -92,6 +92,7 @@ struct smp_dev {
 
         struct crypto_cipher    *tfm_aes;
         struct crypto_shash     *tfm_cmac;
+        struct crypto_kpp       *tfm_ecdh;
 };
 
 struct smp_chan {
@@ -124,13 +125,13 @@ struct smp_chan {
 
         /* Secure Connections variables */
         u8                      local_pk[64];
-        u8                      local_sk[32];
         u8                      remote_pk[64];
         u8                      dhkey[32];
         u8                      mackey[16];
 
         struct crypto_cipher    *tfm_aes;
         struct crypto_shash     *tfm_cmac;
+        struct crypto_kpp       *tfm_ecdh;
 };
 
 /* These debug key values are defined in the SMP section of the core
@@ -565,22 +566,22 @@ int smp_generate_oob(struct hci_dev *hdev, u8 hash[16], u8 rand[16])
 
         if (hci_dev_test_flag(hdev, HCI_USE_DEBUG_KEYS)) {
                 BT_DBG("Using debug keys");
+                err = set_ecdh_privkey(smp->tfm_ecdh, debug_sk);
+                if (err)
+                        return err;
                 memcpy(smp->local_pk, debug_pk, 64);
-                memcpy(smp->local_sk, debug_sk, 32);
                 smp->debug_key = true;
         } else {
                 while (true) {
-                        /* Seed private key with random number */
-                        get_random_bytes(smp->local_sk, 32);
-
-                        /* Generate local key pair for Secure Connections */
-                        if (!generate_ecdh_keys(smp->local_pk, smp->local_sk))
-                                return -EIO;
+                        /* Generate key pair for Secure Connections */
+                        err = generate_ecdh_keys(smp->tfm_ecdh, smp->local_pk);
+                        if (err)
+                                return err;
 
                         /* This is unlikely, but we need to check that
                          * we didn't accidentially generate a debug key.
                          */
-                        if (crypto_memneq(smp->local_sk, debug_sk, 32))
+                        if (crypto_memneq(smp->local_pk, debug_pk, 64))
                                 break;
                 }
                 smp->debug_key = false;
@@ -588,7 +589,6 @@ int smp_generate_oob(struct hci_dev *hdev, u8 hash[16], u8 rand[16])
 
         SMP_DBG("OOB Public Key X: %32phN", smp->local_pk);
         SMP_DBG("OOB Public Key Y: %32phN", smp->local_pk + 32);
-        SMP_DBG("OOB Private Key:  %32phN", smp->local_sk);
 
         get_random_bytes(smp->local_rand, 16);
 
@@ -771,6 +771,7 @@ static void smp_chan_destroy(struct l2cap_conn *conn)
 
         crypto_free_cipher(smp->tfm_aes);
         crypto_free_shash(smp->tfm_cmac);
+        crypto_free_kpp(smp->tfm_ecdh);
 
         /* Ensure that we don't leave any debug key around if debug key
          * support hasn't been explicitly enabled.
@@ -995,7 +996,8 @@ static u8 smp_random(struct smp_chan *smp)
                 return SMP_UNSPECIFIED;
 
         if (crypto_memneq(smp->pcnf, confirm, sizeof(smp->pcnf))) {
-                BT_ERR("Pairing failed (confirmation values mismatch)");
+                bt_dev_err(hcon->hdev, "pairing failed "
+                           "(confirmation values mismatch)");
                 return SMP_CONFIRM_FAILED;
         }
 
@@ -1209,7 +1211,7 @@ static void sc_generate_ltk(struct smp_chan *smp)
 
         key = hci_find_link_key(hdev, &hcon->dst);
         if (!key) {
-                BT_ERR("%s No Link Key found to generate LTK", hdev->name);
+                bt_dev_err(hdev, "no Link Key found to generate LTK");
                 return;
         }
 
@@ -1391,16 +1393,19 @@ static struct smp_chan *smp_chan_create(struct l2cap_conn *conn)
         smp->tfm_aes = crypto_alloc_cipher("aes", 0, CRYPTO_ALG_ASYNC);
         if (IS_ERR(smp->tfm_aes)) {
                 BT_ERR("Unable to create AES crypto context");
-                kzfree(smp);
-                return NULL;
+                goto zfree_smp;
         }
 
         smp->tfm_cmac = crypto_alloc_shash("cmac(aes)", 0, 0);
         if (IS_ERR(smp->tfm_cmac)) {
                 BT_ERR("Unable to create CMAC crypto context");
-                crypto_free_cipher(smp->tfm_aes);
-                kzfree(smp);
-                return NULL;
+                goto free_cipher;
+        }
+
+        smp->tfm_ecdh = crypto_alloc_kpp("ecdh", CRYPTO_ALG_INTERNAL, 0);
+        if (IS_ERR(smp->tfm_ecdh)) {
+                BT_ERR("Unable to create ECDH crypto context");
+                goto free_shash;
         }
 
         smp->conn = conn;
@@ -1413,6 +1418,14 @@ static struct smp_chan *smp_chan_create(struct l2cap_conn *conn)
         hci_conn_hold(conn->hcon);
 
         return smp;
+
+free_shash:
+        crypto_free_shash(smp->tfm_cmac);
+free_cipher:
+        crypto_free_cipher(smp->tfm_aes);
+zfree_smp:
+        kzfree(smp);
+        return NULL;
 }
 
 static int sc_mackey_and_ltk(struct smp_chan *smp, u8 mackey[16], u8 ltk[16])
@@ -1883,7 +1896,6 @@ static u8 sc_send_public_key(struct smp_chan *smp)
                 smp_dev = chan->data;
 
                 memcpy(smp->local_pk, smp_dev->local_pk, 64);
-                memcpy(smp->local_sk, smp_dev->local_sk, 32);
                 memcpy(smp->lr, smp_dev->local_rand, 16);
 
                 if (smp_dev->debug_key)
@@ -1894,22 +1906,20 @@ static u8 sc_send_public_key(struct smp_chan *smp)
 
         if (hci_dev_test_flag(hdev, HCI_USE_DEBUG_KEYS)) {
                 BT_DBG("Using debug keys");
+                if (set_ecdh_privkey(smp->tfm_ecdh, debug_sk))
+                        return SMP_UNSPECIFIED;
                 memcpy(smp->local_pk, debug_pk, 64);
-                memcpy(smp->local_sk, debug_sk, 32);
                 set_bit(SMP_FLAG_DEBUG_KEY, &smp->flags);
         } else {
                 while (true) {
-                        /* Seed private key with random number */
-                        get_random_bytes(smp->local_sk, 32);
-
-                        /* Generate local key pair for Secure Connections */
-                        if (!generate_ecdh_keys(smp->local_pk, smp->local_sk))
+                        /* Generate key pair for Secure Connections */
+                        if (generate_ecdh_keys(smp->tfm_ecdh, smp->local_pk))
                                 return SMP_UNSPECIFIED;
 
                         /* This is unlikely, but we need to check that
                          * we didn't accidentially generate a debug key.
                          */
-                        if (crypto_memneq(smp->local_sk, debug_sk, 32))
+                        if (crypto_memneq(smp->local_pk, debug_pk, 64))
                                 break;
                 }
         }
@@ -1917,7 +1927,6 @@ static u8 sc_send_public_key(struct smp_chan *smp)
 done:
         SMP_DBG("Local Public Key X: %32phN", smp->local_pk);
         SMP_DBG("Local Public Key Y: %32phN", smp->local_pk + 32);
-        SMP_DBG("Local Private Key:  %32phN", smp->local_sk);
 
         smp_send_cmd(smp->conn, SMP_CMD_PUBLIC_KEY, 64, smp->local_pk);
 
@@ -2059,11 +2068,11 @@ static int fixup_sc_false_positive(struct smp_chan *smp)
                 return SMP_UNSPECIFIED;
 
         if (hci_dev_test_flag(hdev, HCI_SC_ONLY)) {
-                BT_ERR("Refusing SMP SC -> legacy fallback in SC-only mode");
+                bt_dev_err(hdev, "refusing legacy fallback in SC-only mode");
                 return SMP_UNSPECIFIED;
         }
 
-        BT_ERR("Trying to fall back to legacy SMP");
+        bt_dev_err(hdev, "trying to fall back to legacy SMP");
 
         req = (void *) &smp->preq[1];
         rsp = (void *) &smp->prsp[1];
@@ -2074,7 +2083,7 @@ static int fixup_sc_false_positive(struct smp_chan *smp)
         auth = req->auth_req & AUTH_REQ_MASK(hdev);
 
         if (tk_request(conn, 0, auth, rsp->io_capability, req->io_capability)) {
-                BT_ERR("Failed to fall back to legacy SMP");
+                bt_dev_err(hdev, "failed to fall back to legacy SMP");
                 return SMP_UNSPECIFIED;
         }
 
@@ -2347,7 +2356,7 @@ int smp_conn_security(struct hci_conn *hcon, __u8 sec_level)
 
         chan = conn->smp;
         if (!chan) {
-                BT_ERR("SMP security requested but not available");
+                bt_dev_err(hcon->hdev, "security requested but not available");
                 return 1;
         }
 
@@ -2540,7 +2549,7 @@ static int smp_cmd_ident_addr_info(struct l2cap_conn *conn,
          */
         if (!bacmp(&info->bdaddr, BDADDR_ANY) ||
             !hci_is_identity_address(&info->bdaddr, info->addr_type)) {
-                BT_ERR("Ignoring IRK with no identity address");
+                bt_dev_err(hcon->hdev, "ignoring IRK with no identity address");
                 goto distribute;
         }
 
@@ -2645,6 +2654,7 @@ static int smp_cmd_public_key(struct l2cap_conn *conn, struct sk_buff *skb)
         struct l2cap_chan *chan = conn->smp;
         struct smp_chan *smp = chan->data;
         struct hci_dev *hdev = hcon->hdev;
+        struct crypto_kpp *tfm_ecdh;
         struct smp_cmd_pairing_confirm cfm;
         int err;
 
@@ -2677,7 +2687,18 @@ static int smp_cmd_public_key(struct l2cap_conn *conn, struct sk_buff *skb)
         SMP_DBG("Remote Public Key X: %32phN", smp->remote_pk);
         SMP_DBG("Remote Public Key Y: %32phN", smp->remote_pk + 32);
 
-        if (!compute_ecdh_secret(smp->remote_pk, smp->local_sk, smp->dhkey))
+        /* Compute the shared secret on the same crypto tfm on which the private
+         * key was set/generated.
+         */
+        if (test_bit(SMP_FLAG_LOCAL_OOB, &smp->flags)) {
+                struct smp_dev *smp_dev = chan->data;
+
+                tfm_ecdh = smp_dev->tfm_ecdh;
+        } else {
+                tfm_ecdh = smp->tfm_ecdh;
+        }
+
+        if (compute_ecdh_secret(tfm_ecdh, smp->remote_pk, smp->dhkey))
                 return SMP_UNSPECIFIED;
 
         SMP_DBG("DHKey %32phN", smp->dhkey);
@@ -2933,8 +2954,8 @@ done:
         return err;
 
 drop:
-        BT_ERR("%s unexpected SMP command 0x%02x from %pMR", hcon->hdev->name,
-               code, &hcon->dst);
+        bt_dev_err(hcon->hdev, "unexpected SMP command 0x%02x from %pMR",
+                   code, &hcon->dst);
         kfree_skb(skb);
         return 0;
 }
@@ -3001,8 +3022,7 @@ static void bredr_pairing(struct l2cap_chan *chan)
 
         smp = smp_chan_create(conn);
         if (!smp) {
-                BT_ERR("%s unable to create SMP context for BR/EDR",
-                       hdev->name);
+                bt_dev_err(hdev, "unable to create SMP context for BR/EDR");
                 return;
         }
 
@@ -3169,6 +3189,7 @@ static struct l2cap_chan *smp_add_cid(struct hci_dev *hdev, u16 cid)
         struct smp_dev *smp;
         struct crypto_cipher *tfm_aes;
         struct crypto_shash *tfm_cmac;
+        struct crypto_kpp *tfm_ecdh;
 
         if (cid == L2CAP_CID_SMP_BREDR) {
                 smp = NULL;
@@ -3194,8 +3215,18 @@ static struct l2cap_chan *smp_add_cid(struct hci_dev *hdev, u16 cid)
                 return ERR_CAST(tfm_cmac);
         }
 
+        tfm_ecdh = crypto_alloc_kpp("ecdh", CRYPTO_ALG_INTERNAL, 0);
+        if (IS_ERR(tfm_ecdh)) {
+                BT_ERR("Unable to create ECDH crypto context");
+                crypto_free_shash(tfm_cmac);
+                crypto_free_cipher(tfm_aes);
+                kzfree(smp);
+                return ERR_CAST(tfm_ecdh);
+        }
+
         smp->tfm_aes = tfm_aes;
         smp->tfm_cmac = tfm_cmac;
+        smp->tfm_ecdh = tfm_ecdh;
         smp->min_key_size = SMP_MIN_ENC_KEY_SIZE;
         smp->max_key_size = SMP_MAX_ENC_KEY_SIZE;
 
@@ -3205,6 +3236,7 @@ create_chan:
                 if (smp) {
                         crypto_free_cipher(smp->tfm_aes);
                         crypto_free_shash(smp->tfm_cmac);
+                        crypto_free_kpp(smp->tfm_ecdh);
                         kzfree(smp);
                 }
                 return ERR_PTR(-ENOMEM);
@@ -3252,6 +3284,7 @@ static void smp_del_chan(struct l2cap_chan *chan)
                 chan->data = NULL;
                 crypto_free_cipher(smp->tfm_aes);
                 crypto_free_shash(smp->tfm_cmac);
+                crypto_free_kpp(smp->tfm_ecdh);
                 kzfree(smp);
         }
 
@@ -3490,25 +3523,18 @@ void smp_unregister(struct hci_dev *hdev)
 
 #if IS_ENABLED(CONFIG_BT_SELFTEST_SMP)
 
-static inline void swap_digits(u64 *in, u64 *out, unsigned int ndigits)
+static int __init test_debug_key(struct crypto_kpp *tfm_ecdh)
 {
-        int i;
-
-        for (i = 0; i < ndigits; i++)
-                out[i] = __swab64(in[ndigits - 1 - i]);
-}
-
-static int __init test_debug_key(void)
-{
-        u8 pk[64], sk[32];
-
-        swap_digits((u64 *)debug_sk, (u64 *)sk, 4);
+        u8 pk[64];
+        int err;
 
-        if (!generate_ecdh_keys(pk, sk))
-                return -EINVAL;
+        err = set_ecdh_privkey(tfm_ecdh, debug_sk);
+        if (err)
+                return err;
 
-        if (crypto_memneq(sk, debug_sk, 32))
-                return -EINVAL;
+        err = generate_ecdh_public_key(tfm_ecdh, pk);
+        if (err)
+                return err;
 
         if (crypto_memneq(pk, debug_pk, 64))
                 return -EINVAL;
@@ -3763,7 +3789,8 @@ static const struct file_operations test_smp_fops = {
 };
 
 static int __init run_selftests(struct crypto_cipher *tfm_aes,
-                                struct crypto_shash *tfm_cmac)
+                                struct crypto_shash *tfm_cmac,
+                                struct crypto_kpp *tfm_ecdh)
 {
         ktime_t calltime, delta, rettime;
         unsigned long long duration;
@@ -3771,7 +3798,7 @@ static int __init run_selftests(struct crypto_cipher *tfm_aes,
 
         calltime = ktime_get();
 
-        err = test_debug_key();
+        err = test_debug_key(tfm_ecdh);
         if (err) {
                 BT_ERR("debug_key test failed");
                 goto done;
@@ -3848,6 +3875,7 @@ int __init bt_selftest_smp(void)
 {
         struct crypto_cipher *tfm_aes;
         struct crypto_shash *tfm_cmac;
+        struct crypto_kpp *tfm_ecdh;
         int err;
 
         tfm_aes = crypto_alloc_cipher("aes", 0, CRYPTO_ALG_ASYNC);
@@ -3863,10 +3891,19 @@ int __init bt_selftest_smp(void)
                 return PTR_ERR(tfm_cmac);
         }
 
-        err = run_selftests(tfm_aes, tfm_cmac);
+        tfm_ecdh = crypto_alloc_kpp("ecdh", CRYPTO_ALG_INTERNAL, 0);
+        if (IS_ERR(tfm_ecdh)) {
+                BT_ERR("Unable to create ECDH crypto context");
+                crypto_free_shash(tfm_cmac);
+                crypto_free_cipher(tfm_aes);
+                return PTR_ERR(tfm_ecdh);
+        }
+
+        err = run_selftests(tfm_aes, tfm_cmac, tfm_ecdh);
 
         crypto_free_shash(tfm_cmac);
         crypto_free_cipher(tfm_aes);
+        crypto_free_kpp(tfm_ecdh);
 
         return err;
 }
diff --git a/net/bpf/test_run.c b/net/bpf/test_run.c
index 6be41a44d688..a86e6687026e 100644
--- a/net/bpf/test_run.c
+++ b/net/bpf/test_run.c
@@ -133,7 +133,7 @@ int bpf_prog_test_run_skb(struct bpf_prog *prog, const union bpf_attr *kattr,
         if (is_l2)
                 __skb_push(skb, ETH_HLEN);
         if (is_direct_pkt_access)
-                bpf_compute_data_end(skb);
+                bpf_compute_data_pointers(skb);
         retval = bpf_test_run(prog, skb, repeat, &duration);
         if (!is_l2)
                 __skb_push(skb, ETH_HLEN);
@@ -162,6 +162,7 @@ int bpf_prog_test_run_xdp(struct bpf_prog *prog, const union bpf_attr *kattr,
 
         xdp.data_hard_start = data;
         xdp.data = data + XDP_PACKET_HEADROOM + NET_IP_ALIGN;
+        xdp.data_meta = xdp.data;
         xdp.data_end = xdp.data + size;
 
         retval = bpf_test_run(prog, &xdp, repeat, &duration);
diff --git a/net/bridge/Makefile b/net/bridge/Makefile
index f760e62a672a..ac9ef337f0fa 100644
--- a/net/bridge/Makefile
+++ b/net/bridge/Makefile
@@ -8,7 +8,7 @@ obj-$(CONFIG_BRIDGE) += bridge.o
 bridge-y        := br.o br_device.o br_fdb.o br_forward.o br_if.o br_input.o \
                         br_ioctl.o br_stp.o br_stp_bpdu.o \
                         br_stp_if.o br_stp_timer.o br_netlink.o \
-                        br_netlink_tunnel.o
+                        br_netlink_tunnel.o br_arp_nd_proxy.o
 
 bridge-$(CONFIG_SYSFS) += br_sysfs_if.o br_sysfs_br.o
 
diff --git a/net/bridge/br.c b/net/bridge/br.c
index 1407d1ba7577..6bf06e756df2 100644
--- a/net/bridge/br.c
+++ b/net/bridge/br.c
@@ -112,7 +112,7 @@ static int br_device_event(struct notifier_block *unused, unsigned long event, v
         /* Events that may cause spanning tree to refresh */
         if (event == NETDEV_CHANGEADDR || event == NETDEV_UP ||
             event == NETDEV_CHANGE || event == NETDEV_DOWN)
-                br_ifinfo_notify(RTM_NEWLINK, p);
+                br_ifinfo_notify(RTM_NEWLINK, NULL, p);
 
         return NOTIFY_DONE;
 }
diff --git a/net/bridge/br_arp_nd_proxy.c b/net/bridge/br_arp_nd_proxy.c
new file mode 100644
index 000000000000..2cf7716254be
--- /dev/null
+++ b/net/bridge/br_arp_nd_proxy.c
@@ -0,0 +1,469 @@
+/*
+ *  Handle bridge arp/nd proxy/suppress
+ *
+ *  Copyright (C) 2017 Cumulus Networks
+ *  Copyright (c) 2017 Roopa Prabhu <roopa@cumulusnetworks.com>
+ *
+ *  Authors:
+ *      Roopa Prabhu <roopa@cumulusnetworks.com>
+ *
+ *  This program is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU General Public License
+ *  as published by the Free Software Foundation; either version
+ *  2 of the License, or (at your option) any later version.
+ */
+
+#include <linux/kernel.h>
+#include <linux/netdevice.h>
+#include <linux/etherdevice.h>
+#include <linux/neighbour.h>
+#include <net/arp.h>
+#include <linux/if_vlan.h>
+#include <linux/inetdevice.h>
+#include <net/addrconf.h>
+#if IS_ENABLED(CONFIG_IPV6)
+#include <net/ip6_checksum.h>
+#endif
+
+#include "br_private.h"
+
+void br_recalculate_neigh_suppress_enabled(struct net_bridge *br)
+{
+        struct net_bridge_port *p;
+        bool neigh_suppress = false;
+
+        list_for_each_entry(p, &br->port_list, list) {
+                if (p->flags & BR_NEIGH_SUPPRESS) {
+                        neigh_suppress = true;
+                        break;
+                }
+        }
+
+        br->neigh_suppress_enabled = neigh_suppress;
+}
+
+#if IS_ENABLED(CONFIG_INET)
+static void br_arp_send(struct net_bridge *br, struct net_bridge_port *p,
+                        struct net_device *dev, __be32 dest_ip, __be32 src_ip,
+                        const unsigned char *dest_hw,
+                        const unsigned char *src_hw,
+                        const unsigned char *target_hw,
+                        __be16 vlan_proto, u16 vlan_tci)
+{
+        struct net_bridge_vlan_group *vg;
+        struct sk_buff *skb;
+        u16 pvid;
+
+        netdev_dbg(dev, "arp send dev %s dst %pI4 dst_hw %pM src %pI4 src_hw %pM\n",
+                   dev->name, &dest_ip, dest_hw, &src_ip, src_hw);
+
+        if (!vlan_tci) {
+                arp_send(ARPOP_REPLY, ETH_P_ARP, dest_ip, dev, src_ip,
+                         dest_hw, src_hw, target_hw);
+                return;
+        }
+
+        skb = arp_create(ARPOP_REPLY, ETH_P_ARP, dest_ip, dev, src_ip,
+                         dest_hw, src_hw, target_hw);
+        if (!skb)
+                return;
+
+        if (p)
+                vg = nbp_vlan_group_rcu(p);
+        else
+                vg = br_vlan_group_rcu(br);
+        pvid = br_get_pvid(vg);
+        if (pvid == (vlan_tci & VLAN_VID_MASK))
+                vlan_tci = 0;
+
+        if (vlan_tci)
+                __vlan_hwaccel_put_tag(skb, vlan_proto, vlan_tci);
+
+        if (p) {
+                arp_xmit(skb);
+        } else {
+                skb_reset_mac_header(skb);
+                __skb_pull(skb, skb_network_offset(skb));
+                skb->ip_summed = CHECKSUM_UNNECESSARY;
+                skb->pkt_type = PACKET_HOST;
+
+                netif_rx_ni(skb);
+        }
+}
+
+static int br_chk_addr_ip(struct net_device *dev, void *data)
+{
+        __be32 ip = *(__be32 *)data;
+        struct in_device *in_dev;
+        __be32 addr = 0;
+
+        in_dev = __in_dev_get_rcu(dev);
+        if (in_dev)
+                addr = inet_confirm_addr(dev_net(dev), in_dev, 0, ip,
+                                         RT_SCOPE_HOST);
+
+        if (addr == ip)
+                return 1;
+
+        return 0;
+}
+
+static bool br_is_local_ip(struct net_device *dev, __be32 ip)
+{
+        if (br_chk_addr_ip(dev, &ip))
+                return true;
+
+        /* check if ip is configured on upper dev */
+        if (netdev_walk_all_upper_dev_rcu(dev, br_chk_addr_ip, &ip))
+                return true;
+
+        return false;
+}
+
+void br_do_proxy_suppress_arp(struct sk_buff *skb, struct net_bridge *br,
+                              u16 vid, struct net_bridge_port *p)
+{
+        struct net_device *dev = br->dev;
+        struct net_device *vlandev = dev;
+        struct neighbour *n;
+        struct arphdr *parp;
+        u8 *arpptr, *sha;
+        __be32 sip, tip;
+
+        BR_INPUT_SKB_CB(skb)->proxyarp_replied = false;
+
+        if ((dev->flags & IFF_NOARP) ||
+            !pskb_may_pull(skb, arp_hdr_len(dev)))
+                return;
+
+        parp = arp_hdr(skb);
+
+        if (parp->ar_pro != htons(ETH_P_IP) ||
+            parp->ar_hln != dev->addr_len ||
+            parp->ar_pln != 4)
+                return;
+
+        arpptr = (u8 *)parp + sizeof(struct arphdr);
+        sha = arpptr;
+        arpptr += dev->addr_len;        /* sha */
+        memcpy(&sip, arpptr, sizeof(sip));
+        arpptr += sizeof(sip);
+        arpptr += dev->addr_len;        /* tha */
+        memcpy(&tip, arpptr, sizeof(tip));
+
+        if (ipv4_is_loopback(tip) ||
+            ipv4_is_multicast(tip))
+                return;
+
+        if (br->neigh_suppress_enabled) {
+                if (p && (p->flags & BR_NEIGH_SUPPRESS))
+                        return;
+                if (ipv4_is_zeronet(sip) || sip == tip) {
+                        /* prevent flooding to neigh suppress ports */
+                        BR_INPUT_SKB_CB(skb)->proxyarp_replied = true;
+                        return;
+                }
+        }
+
+        if (parp->ar_op != htons(ARPOP_REQUEST))
+                return;
+
+        if (vid != 0) {
+                vlandev = __vlan_find_dev_deep_rcu(br->dev, skb->vlan_proto,
+                                                   vid);
+                if (!vlandev)
+                        return;
+        }
+
+        if (br->neigh_suppress_enabled && br_is_local_ip(vlandev, tip)) {
+                /* its our local ip, so don't proxy reply
+                 * and don't forward to neigh suppress ports
+                 */
+                BR_INPUT_SKB_CB(skb)->proxyarp_replied = true;
+                return;
+        }
+
+        n = neigh_lookup(&arp_tbl, &tip, vlandev);
+        if (n) {
+                struct net_bridge_fdb_entry *f;
+
+                if (!(n->nud_state & NUD_VALID)) {
+                        neigh_release(n);
+                        return;
+                }
+
+                f = br_fdb_find_rcu(br, n->ha, vid);
+                if (f) {
+                        bool replied = false;
+
+                        if ((p && (p->flags & BR_PROXYARP)) ||
+                            (f->dst && (f->dst->flags & (BR_PROXYARP_WIFI |
+                                                         BR_NEIGH_SUPPRESS)))) {
+                                if (!vid)
+                                        br_arp_send(br, p, skb->dev, sip, tip,
+                                                    sha, n->ha, sha, 0, 0);
+                                else
+                                        br_arp_send(br, p, skb->dev, sip, tip,
+                                                    sha, n->ha, sha,
+                                                    skb->vlan_proto,
+                                                    skb_vlan_tag_get(skb));
+                                replied = true;
+                        }
+
+                        /* If we have replied or as long as we know the
+                         * mac, indicate to arp replied
+                         */
+                        if (replied || br->neigh_suppress_enabled)
+                                BR_INPUT_SKB_CB(skb)->proxyarp_replied = true;
+                }
+
+                neigh_release(n);
+        }
+}
+#endif
+
+#if IS_ENABLED(CONFIG_IPV6)
+struct nd_msg *br_is_nd_neigh_msg(struct sk_buff *skb, struct nd_msg *msg)
+{
+        struct nd_msg *m;
+
+        m = skb_header_pointer(skb, skb_network_offset(skb) +
+                               sizeof(struct ipv6hdr), sizeof(*msg), msg);
+        if (!m)
+                return NULL;
+
+        if (m->icmph.icmp6_code != 0 ||
+            (m->icmph.icmp6_type != NDISC_NEIGHBOUR_SOLICITATION &&
+             m->icmph.icmp6_type != NDISC_NEIGHBOUR_ADVERTISEMENT))
+                return NULL;
+
+        return m;
+}
+
+static void br_nd_send(struct net_bridge *br, struct net_bridge_port *p,
+                       struct sk_buff *request, struct neighbour *n,
+                       __be16 vlan_proto, u16 vlan_tci, struct nd_msg *ns)
+{
+        struct net_device *dev = request->dev;
+        struct net_bridge_vlan_group *vg;
+        struct sk_buff *reply;
+        struct nd_msg *na;
+        struct ipv6hdr *pip6;
+        int na_olen = 8; /* opt hdr + ETH_ALEN for target */
+        int ns_olen;
+        int i, len;
+        u8 *daddr;
+        u16 pvid;
+
+        if (!dev)
+                return;
+
+        len = LL_RESERVED_SPACE(dev) + sizeof(struct ipv6hdr) +
+                sizeof(*na) + na_olen + dev->needed_tailroom;
+
+        reply = alloc_skb(len, GFP_ATOMIC);
+        if (!reply)
+                return;
+
+        reply->protocol = htons(ETH_P_IPV6);
+        reply->dev = dev;
+        skb_reserve(reply, LL_RESERVED_SPACE(dev));
+        skb_push(reply, sizeof(struct ethhdr));
+        skb_set_mac_header(reply, 0);
+
+        daddr = eth_hdr(request)->h_source;
+
+        /* Do we need option processing ? */
+        ns_olen = request->len - (skb_network_offset(request) +
+                                  sizeof(struct ipv6hdr)) - sizeof(*ns);
+        for (i = 0; i < ns_olen - 1; i += (ns->opt[i + 1] << 3)) {
+                if (ns->opt[i] == ND_OPT_SOURCE_LL_ADDR) {
+                        daddr = ns->opt + i + sizeof(struct nd_opt_hdr);
+                        break;
+                }
+        }
+
+        /* Ethernet header */
+        ether_addr_copy(eth_hdr(reply)->h_dest, daddr);
+        ether_addr_copy(eth_hdr(reply)->h_source, n->ha);
+        eth_hdr(reply)->h_proto = htons(ETH_P_IPV6);
+        reply->protocol = htons(ETH_P_IPV6);
+
+        skb_pull(reply, sizeof(struct ethhdr));
+        skb_set_network_header(reply, 0);
+        skb_put(reply, sizeof(struct ipv6hdr));
+
+        /* IPv6 header */
+        pip6 = ipv6_hdr(reply);
+        memset(pip6, 0, sizeof(struct ipv6hdr));
+        pip6->version = 6;
+        pip6->priority = ipv6_hdr(request)->priority;
+        pip6->nexthdr = IPPROTO_ICMPV6;
+        pip6->hop_limit = 255;
+        pip6->daddr = ipv6_hdr(request)->saddr;
+        pip6->saddr = *(struct in6_addr *)n->primary_key;
+
+        skb_pull(reply, sizeof(struct ipv6hdr));
+        skb_set_transport_header(reply, 0);
+
+        na = (struct nd_msg *)skb_put(reply, sizeof(*na) + na_olen);
+
+        /* Neighbor Advertisement */
+        memset(na, 0, sizeof(*na) + na_olen);
+        na->icmph.icmp6_type = NDISC_NEIGHBOUR_ADVERTISEMENT;
+        na->icmph.icmp6_router = 0; /* XXX: should be 1 ? */
+        na->icmph.icmp6_override = 1;
+        na->icmph.icmp6_solicited = 1;
+        na->target = ns->target;
+        ether_addr_copy(&na->opt[2], n->ha);
+        na->opt[0] = ND_OPT_TARGET_LL_ADDR;
+        na->opt[1] = na_olen >> 3;
+
+        na->icmph.icmp6_cksum = csum_ipv6_magic(&pip6->saddr,
+                                                &pip6->daddr,
+                                                sizeof(*na) + na_olen,
+                                                IPPROTO_ICMPV6,
+                                                csum_partial(na, sizeof(*na) + na_olen, 0));
+
+        pip6->payload_len = htons(sizeof(*na) + na_olen);
+
+        skb_push(reply, sizeof(struct ipv6hdr));
+        skb_push(reply, sizeof(struct ethhdr));
+
+        reply->ip_summed = CHECKSUM_UNNECESSARY;
+
+        if (p)
+                vg = nbp_vlan_group_rcu(p);
+        else
+                vg = br_vlan_group_rcu(br);
+        pvid = br_get_pvid(vg);
+        if (pvid == (vlan_tci & VLAN_VID_MASK))
+                vlan_tci = 0;
+
+        if (vlan_tci)
+                __vlan_hwaccel_put_tag(reply, vlan_proto, vlan_tci);
+
+        netdev_dbg(dev, "nd send dev %s dst %pI6 dst_hw %pM src %pI6 src_hw %pM\n",
+                   dev->name, &pip6->daddr, daddr, &pip6->saddr, n->ha);
+
+        if (p) {
+                dev_queue_xmit(reply);
+        } else {
+                skb_reset_mac_header(reply);
+                __skb_pull(reply, skb_network_offset(reply));
+                reply->ip_summed = CHECKSUM_UNNECESSARY;
+                reply->pkt_type = PACKET_HOST;
+
+                netif_rx_ni(reply);
+        }
+}
+
+static int br_chk_addr_ip6(struct net_device *dev, void *data)
+{
+        struct in6_addr *addr = (struct in6_addr *)data;
+
+        if (ipv6_chk_addr(dev_net(dev), addr, dev, 0))
+                return 1;
+
+        return 0;
+}
+
+static bool br_is_local_ip6(struct net_device *dev, struct in6_addr *addr)
+
+{
+        if (br_chk_addr_ip6(dev, addr))
+                return true;
+
+        /* check if ip is configured on upper dev */
+        if (netdev_walk_all_upper_dev_rcu(dev, br_chk_addr_ip6, addr))
+                return true;
+
+        return false;
+}
+
+void br_do_suppress_nd(struct sk_buff *skb, struct net_bridge *br,
+                       u16 vid, struct net_bridge_port *p, struct nd_msg *msg)
+{
+        struct net_device *dev = br->dev;
+        struct net_device *vlandev = NULL;
+        struct in6_addr *saddr, *daddr;
+        struct ipv6hdr *iphdr;
+        struct neighbour *n;
+
+        BR_INPUT_SKB_CB(skb)->proxyarp_replied = false;
+
+        if (p && (p->flags & BR_NEIGH_SUPPRESS))
+                return;
+
+        if (msg->icmph.icmp6_type == NDISC_NEIGHBOUR_ADVERTISEMENT &&
+            !msg->icmph.icmp6_solicited) {
+                /* prevent flooding to neigh suppress ports */
+                BR_INPUT_SKB_CB(skb)->proxyarp_replied = true;
+                return;
+        }
+
+        if (msg->icmph.icmp6_type != NDISC_NEIGHBOUR_SOLICITATION)
+                return;
+
+        iphdr = ipv6_hdr(skb);
+        saddr = &iphdr->saddr;
+        daddr = &iphdr->daddr;
+
+        if (ipv6_addr_any(saddr) || !ipv6_addr_cmp(saddr, daddr)) {
+                /* prevent flooding to neigh suppress ports */
+                BR_INPUT_SKB_CB(skb)->proxyarp_replied = true;
+                return;
+        }
+
+        if (vid != 0) {
+                /* build neigh table lookup on the vlan device */
+                vlandev = __vlan_find_dev_deep_rcu(br->dev, skb->vlan_proto,
+                                                   vid);
+                if (!vlandev)
+                        return;
+        } else {
+                vlandev = dev;
+        }
+
+        if (br_is_local_ip6(vlandev, &msg->target)) {
+                /* its our own ip, so don't proxy reply
+                 * and don't forward to arp suppress ports
+                 */
+                BR_INPUT_SKB_CB(skb)->proxyarp_replied = true;
+                return;
+        }
+
+        n = neigh_lookup(ipv6_stub->nd_tbl, &msg->target, vlandev);
+        if (n) {
+                struct net_bridge_fdb_entry *f;
+
+                if (!(n->nud_state & NUD_VALID)) {
+                        neigh_release(n);
+                        return;
+                }
+
+                f = br_fdb_find_rcu(br, n->ha, vid);
+                if (f) {
+                        bool replied = false;
+
+                        if (f->dst && (f->dst->flags & BR_NEIGH_SUPPRESS)) {
+                                if (vid != 0)
+                                        br_nd_send(br, p, skb, n,
+                                                   skb->vlan_proto,
+                                                   skb_vlan_tag_get(skb), msg);
+                                else
+                                        br_nd_send(br, p, skb, n, 0, 0, msg);
+                                replied = true;
+                        }
+
+                        /* If we have replied or as long as we know the
+                         * mac, indicate to NEIGH_SUPPRESS ports that we
+                         * have replied
+                         */
+                        if (replied || br->neigh_suppress_enabled)
+                                BR_INPUT_SKB_CB(skb)->proxyarp_replied = true;
+                }
+                neigh_release(n);
+        }
+}
+#endif
diff --git a/net/bridge/br_device.c b/net/bridge/br_device.c
index f6b6a92f1c48..af5b8c87f590 100644
--- a/net/bridge/br_device.c
+++ b/net/bridge/br_device.c
@@ -39,6 +39,7 @@ netdev_tx_t br_dev_xmit(struct sk_buff *skb, struct net_device *dev)
         struct pcpu_sw_netstats *brstats = this_cpu_ptr(br->stats);
         const struct nf_br_ops *nf_ops;
         const unsigned char *dest;
+        struct ethhdr *eth;
         u16 vid = 0;
 
         rcu_read_lock();
@@ -57,11 +58,30 @@ netdev_tx_t br_dev_xmit(struct sk_buff *skb, struct net_device *dev)
         BR_INPUT_SKB_CB(skb)->brdev = dev;
 
         skb_reset_mac_header(skb);
+        eth = eth_hdr(skb);
         skb_pull(skb, ETH_HLEN);
 
         if (!br_allowed_ingress(br, br_vlan_group_rcu(br), skb, &vid))
                 goto out;
 
+        if (IS_ENABLED(CONFIG_INET) &&
+            (eth->h_proto == htons(ETH_P_ARP) ||
+             eth->h_proto == htons(ETH_P_RARP)) &&
+            br->neigh_suppress_enabled) {
+                br_do_proxy_suppress_arp(skb, br, vid, NULL);
+        } else if (IS_ENABLED(CONFIG_IPV6) &&
+                   skb->protocol == htons(ETH_P_IPV6) &&
+                   br->neigh_suppress_enabled &&
+                   pskb_may_pull(skb, sizeof(struct ipv6hdr) +
+                                 sizeof(struct nd_msg)) &&
+                   ipv6_hdr(skb)->nexthdr == IPPROTO_ICMPV6) {
+                        struct nd_msg *msg, _msg;
+
+                        msg = br_is_nd_neigh_msg(skb, &_msg);
+                        if (msg)
+                                br_do_suppress_nd(skb, br, vid, NULL, msg);
+        }
+
         dest = eth_hdr(skb)->h_dest;
         if (is_broadcast_ether_addr(dest)) {
                 br_flood(br, skb, BR_PKT_BROADCAST, false, true);
@@ -320,12 +340,13 @@ void br_netpoll_disable(struct net_bridge_port *p)
 
 #endif
 
-static int br_add_slave(struct net_device *dev, struct net_device *slave_dev)
+static int br_add_slave(struct net_device *dev, struct net_device *slave_dev,
+                        struct netlink_ext_ack *extack)
 
 {
         struct net_bridge *br = netdev_priv(dev);
 
-        return br_add_if(br, slave_dev);
+        return br_add_if(br, slave_dev, extack);
 }
 
 static int br_del_slave(struct net_device *dev, struct net_device *slave_dev)
@@ -400,7 +421,7 @@ void br_dev_setup(struct net_device *dev)
         br->bridge_id.prio[0] = 0x80;
         br->bridge_id.prio[1] = 0x00;
 
-        ether_addr_copy(br->group_addr, eth_reserved_addr_base);
+        ether_addr_copy(br->group_addr, eth_stp_addr);
 
         br->stp_enabled = BR_NO_STP;
         br->group_fwd_mask = BR_GROUPFWD_DEFAULT;
diff --git a/net/bridge/br_forward.c b/net/bridge/br_forward.c
index 48fb17417fac..b4eed113d2ec 100644
--- a/net/bridge/br_forward.c
+++ b/net/bridge/br_forward.c
@@ -204,7 +204,7 @@ void br_flood(struct net_bridge *br, struct sk_buff *skb,
                 /* Do not flood to ports that enable proxy ARP */
                 if (p->flags & BR_PROXYARP)
                         continue;
-                if ((p->flags & BR_PROXYARP_WIFI) &&
+                if ((p->flags & (BR_PROXYARP_WIFI | BR_NEIGH_SUPPRESS)) &&
                     BR_INPUT_SKB_CB(skb)->proxyarp_replied)
                         continue;
 
diff --git a/net/bridge/br_if.c b/net/bridge/br_if.c
index f3aef22931ab..9ba4ed65c52b 100644
--- a/net/bridge/br_if.c
+++ b/net/bridge/br_if.c
@@ -271,7 +271,7 @@ static void del_nbp(struct net_bridge_port *p)
         br_stp_disable_port(p);
         spin_unlock_bh(&br->lock);
 
-        br_ifinfo_notify(RTM_DELLINK, p);
+        br_ifinfo_notify(RTM_DELLINK, NULL, p);
 
         list_del_rcu(&p->list);
         if (netdev_get_fwd_headroom(dev) == br->dev->needed_headroom)
@@ -310,6 +310,8 @@ void br_dev_delete(struct net_device *dev, struct list_head *head)
                 del_nbp(p);
         }
 
+        br_recalculate_neigh_suppress_enabled(br);
+
         br_fdb_delete_by_port(br, NULL, 0, 1);
 
         cancel_delayed_work_sync(&br->gc_work);
@@ -480,7 +482,8 @@ netdev_features_t br_features_recompute(struct net_bridge *br,
 }
 
 /* called with RTNL */
-int br_add_if(struct net_bridge *br, struct net_device *dev)
+int br_add_if(struct net_bridge *br, struct net_device *dev,
+              struct netlink_ext_ack *extack)
 {
         struct net_bridge_port *p;
         int err = 0;
@@ -500,16 +503,22 @@ int br_add_if(struct net_bridge *br, struct net_device *dev)
                 return -EINVAL;
 
         /* No bridging of bridges */
-        if (dev->netdev_ops->ndo_start_xmit == br_dev_xmit)
+        if (dev->netdev_ops->ndo_start_xmit == br_dev_xmit) {
+                NL_SET_ERR_MSG(extack,
+                               "Can not enslave a bridge to a bridge");
                 return -ELOOP;
+        }
 
         /* Device is already being bridged */
         if (br_port_exists(dev))
                 return -EBUSY;
 
         /* No bridging devices that dislike that (e.g. wireless) */
-        if (dev->priv_flags & IFF_DONT_BRIDGE)
+        if (dev->priv_flags & IFF_DONT_BRIDGE) {
+                NL_SET_ERR_MSG(extack,
+                               "Device does not allow enslaving to a bridge");
                 return -EOPNOTSUPP;
+        }
 
         p = new_nbp(br, dev);
         if (IS_ERR(p))
@@ -540,7 +549,7 @@ int br_add_if(struct net_bridge *br, struct net_device *dev)
 
         dev->priv_flags |= IFF_BRIDGE_PORT;
 
-        err = netdev_master_upper_dev_link(dev, br->dev, NULL, NULL);
+        err = netdev_master_upper_dev_link(dev, br->dev, NULL, NULL, extack);
         if (err)
                 goto err5;
 
@@ -580,7 +589,7 @@ int br_add_if(struct net_bridge *br, struct net_device *dev)
                 br_stp_enable_port(p);
         spin_unlock_bh(&br->lock);
 
-        br_ifinfo_notify(RTM_NEWLINK, p);
+        br_ifinfo_notify(RTM_NEWLINK, NULL, p);
 
         if (changed_addr)
                 call_netdevice_notifiers(NETDEV_CHANGEADDR, br->dev);
@@ -653,4 +662,7 @@ void br_port_flags_change(struct net_bridge_port *p, unsigned long mask)
 
         if (mask & BR_AUTO_MASK)
                 nbp_update_port_count(br);
+
+        if (mask & BR_NEIGH_SUPPRESS)
+                br_recalculate_neigh_suppress_enabled(br);
 }
diff --git a/net/bridge/br_input.c b/net/bridge/br_input.c
index 7637f58c1226..7f98a7d25866 100644
--- a/net/bridge/br_input.c
+++ b/net/bridge/br_input.c
@@ -71,62 +71,6 @@ static int br_pass_frame_up(struct sk_buff *skb)
                        br_netif_receive_skb);
 }
 
-static void br_do_proxy_arp(struct sk_buff *skb, struct net_bridge *br,
-                            u16 vid, struct net_bridge_port *p)
-{
-        struct net_device *dev = br->dev;
-        struct neighbour *n;
-        struct arphdr *parp;
-        u8 *arpptr, *sha;
-        __be32 sip, tip;
-
-        BR_INPUT_SKB_CB(skb)->proxyarp_replied = false;
-
-        if ((dev->flags & IFF_NOARP) ||
-            !pskb_may_pull(skb, arp_hdr_len(dev)))
-                return;
-
-        parp = arp_hdr(skb);
-
-        if (parp->ar_pro != htons(ETH_P_IP) ||
-            parp->ar_op != htons(ARPOP_REQUEST) ||
-            parp->ar_hln != dev->addr_len ||
-            parp->ar_pln != 4)
-                return;
-
-        arpptr = (u8 *)parp + sizeof(struct arphdr);
-        sha = arpptr;
-        arpptr += dev->addr_len;        /* sha */
-        memcpy(&sip, arpptr, sizeof(sip));
-        arpptr += sizeof(sip);
-        arpptr += dev->addr_len;        /* tha */
-        memcpy(&tip, arpptr, sizeof(tip));
-
-        if (ipv4_is_loopback(tip) ||
-            ipv4_is_multicast(tip))
-                return;
-
-        n = neigh_lookup(&arp_tbl, &tip, dev);
-        if (n) {
-                struct net_bridge_fdb_entry *f;
-
-                if (!(n->nud_state & NUD_VALID)) {
-                        neigh_release(n);
-                        return;
-                }
-
-                f = br_fdb_find_rcu(br, n->ha, vid);
-                if (f && ((p->flags & BR_PROXYARP) ||
-                          (f->dst && (f->dst->flags & BR_PROXYARP_WIFI)))) {
-                        arp_send(ARPOP_REPLY, ETH_P_ARP, sip, skb->dev, tip,
-                                 sha, n->ha, sha);
-                        BR_INPUT_SKB_CB(skb)->proxyarp_replied = true;
-                }
-
-                neigh_release(n);
-        }
-}
-
 /* note: already called with rcu_read_lock */
 int br_handle_frame_finish(struct net *net, struct sock *sk, struct sk_buff *skb)
 {
@@ -171,15 +115,29 @@ int br_handle_frame_finish(struct net *net, struct sock *sk, struct sk_buff *skb
 
         BR_INPUT_SKB_CB(skb)->brdev = br->dev;
 
-        if (IS_ENABLED(CONFIG_INET) && skb->protocol == htons(ETH_P_ARP))
-                br_do_proxy_arp(skb, br, vid, p);
+        if (IS_ENABLED(CONFIG_INET) &&
+            (skb->protocol == htons(ETH_P_ARP) ||
+             skb->protocol == htons(ETH_P_RARP))) {
+                br_do_proxy_suppress_arp(skb, br, vid, p);
+        } else if (IS_ENABLED(CONFIG_IPV6) &&
+                   skb->protocol == htons(ETH_P_IPV6) &&
+                   br->neigh_suppress_enabled &&
+                   pskb_may_pull(skb, sizeof(struct ipv6hdr) +
+                                 sizeof(struct nd_msg)) &&
+                   ipv6_hdr(skb)->nexthdr == IPPROTO_ICMPV6) {
+                        struct nd_msg *msg, _msg;
+
+                        msg = br_is_nd_neigh_msg(skb, &_msg);
+                        if (msg)
+                                br_do_suppress_nd(skb, br, vid, p, msg);
+        }
 
         switch (pkt_type) {
         case BR_PKT_MULTICAST:
                 mdst = br_mdb_get(br, skb, vid);
                 if ((mdst || BR_INPUT_SKB_CB_MROUTERS_ONLY(skb)) &&
                     br_multicast_querier_exists(br, eth_hdr(skb))) {
-                        if ((mdst && mdst->mglist) ||
+                        if ((mdst && mdst->host_joined) ||
                             br_multicast_is_router(br)) {
                                 local_rcv = true;
                                 br->dev->stats.multicast++;
@@ -289,6 +247,7 @@ rx_handler_result_t br_handle_frame(struct sk_buff **pskb)
                  *
                  * Others reserved for future standardization
                  */
+                fwd_mask |= p->group_fwd_mask;
                 switch (dest[5]) {
                 case 0x00:      /* Bridge Group Address */
                         /* If STP is turned off,
diff --git a/net/bridge/br_ioctl.c b/net/bridge/br_ioctl.c
index 7970f8540cbb..73b957fd639d 100644
--- a/net/bridge/br_ioctl.c
+++ b/net/bridge/br_ioctl.c
@@ -98,7 +98,7 @@ static int add_del_if(struct net_bridge *br, int ifindex, int isadd)
                 return -EINVAL;
 
         if (isadd)
-                ret = br_add_if(br, dev);
+                ret = br_add_if(br, dev, NULL);
         else
                 ret = br_del_if(br, dev);
 
@@ -293,7 +293,7 @@ static int old_dev_ioctl(struct net_device *dev, struct ifreq *rq, int cmd)
 
         if (!ret) {
                 if (p)
-                        br_ifinfo_notify(RTM_NEWLINK, p);
+                        br_ifinfo_notify(RTM_NEWLINK, NULL, p);
                 else
                         netdev_state_change(br->dev);
         }
diff --git a/net/bridge/br_mdb.c b/net/bridge/br_mdb.c
index 31ddff22563e..b0f4c734900b 100644
--- a/net/bridge/br_mdb.c
+++ b/net/bridge/br_mdb.c
@@ -292,6 +292,46 @@ err:
         kfree(priv);
 }
 
+static void br_mdb_switchdev_host_port(struct net_device *dev,
+                                       struct net_device *lower_dev,
+                                       struct br_mdb_entry *entry, int type)
+{
+        struct switchdev_obj_port_mdb mdb = {
+                .obj = {
+                        .id = SWITCHDEV_OBJ_ID_HOST_MDB,
+                        .flags = SWITCHDEV_F_DEFER,
+                },
+                .vid = entry->vid,
+        };
+
+        if (entry->addr.proto == htons(ETH_P_IP))
+                ip_eth_mc_map(entry->addr.u.ip4, mdb.addr);
+#if IS_ENABLED(CONFIG_IPV6)
+        else
+                ipv6_eth_mc_map(&entry->addr.u.ip6, mdb.addr);
+#endif
+
+        mdb.obj.orig_dev = dev;
+        switch (type) {
+        case RTM_NEWMDB:
+                switchdev_port_obj_add(lower_dev, &mdb.obj);
+                break;
+        case RTM_DELMDB:
+                switchdev_port_obj_del(lower_dev, &mdb.obj);
+                break;
+        }
+}
+
+static void br_mdb_switchdev_host(struct net_device *dev,
+                                  struct br_mdb_entry *entry, int type)
+{
+        struct net_device *lower_dev;
+        struct list_head *iter;
+
+        netdev_for_each_lower_dev(dev, lower_dev, iter)
+                br_mdb_switchdev_host_port(dev, lower_dev, entry, type);
+}
+
 static void __br_mdb_notify(struct net_device *dev, struct net_bridge_port *p,
                             struct br_mdb_entry *entry, int type)
 {
@@ -317,7 +357,7 @@ static void __br_mdb_notify(struct net_device *dev, struct net_bridge_port *p,
 #endif
 
         mdb.obj.orig_dev = port_dev;
-        if (port_dev && type == RTM_NEWMDB) {
+        if (p && port_dev && type == RTM_NEWMDB) {
                 complete_info = kmalloc(sizeof(*complete_info), GFP_ATOMIC);
                 if (complete_info) {
                         complete_info->port = p;
@@ -327,10 +367,13 @@ static void __br_mdb_notify(struct net_device *dev, struct net_bridge_port *p,
                         if (switchdev_port_obj_add(port_dev, &mdb.obj))
                                 kfree(complete_info);
                 }
-        } else if (port_dev && type == RTM_DELMDB) {
+        } else if (p && port_dev && type == RTM_DELMDB) {
                 switchdev_port_obj_del(port_dev, &mdb.obj);
         }
 
+        if (!p)
+                br_mdb_switchdev_host(dev, entry, type);
+
         skb = nlmsg_new(rtnl_mdb_nlmsg_size(), GFP_ATOMIC);
         if (!skb)
                 goto errout;
@@ -353,7 +396,10 @@ void br_mdb_notify(struct net_device *dev, struct net_bridge_port *port,
         struct br_mdb_entry entry;
 
         memset(&entry, 0, sizeof(entry));
-        entry.ifindex = port->dev->ifindex;
+        if (port)
+                entry.ifindex = port->dev->ifindex;
+        else
+                entry.ifindex = dev->ifindex;
         entry.addr.proto = group->proto;
         entry.addr.u.ip4 = group->u.ip4;
 #if IS_ENABLED(CONFIG_IPV6)
@@ -655,7 +701,7 @@ static int __br_mdb_del(struct net_bridge *br, struct br_mdb_entry *entry)
                 call_rcu_bh(&p->rcu, br_multicast_free_pg);
                 err = 0;
 
-                if (!mp->ports && !mp->mglist &&
+                if (!mp->ports && !mp->host_joined &&
                     netif_running(br->dev))
                         mod_timer(&mp->timer, jiffies);
                 break;
diff --git a/net/bridge/br_multicast.c b/net/bridge/br_multicast.c
index 8dc5c8d69bcd..cb4729539b82 100644
--- a/net/bridge/br_multicast.c
+++ b/net/bridge/br_multicast.c
@@ -239,9 +239,9 @@ static void br_multicast_free_group(struct rcu_head *head)
         kfree(mp);
 }
 
-static void br_multicast_group_expired(unsigned long data)
+static void br_multicast_group_expired(struct timer_list *t)
 {
-        struct net_bridge_mdb_entry *mp = (void *)data;
+        struct net_bridge_mdb_entry *mp = from_timer(mp, t, timer);
         struct net_bridge *br = mp->br;
         struct net_bridge_mdb_htable *mdb;
 
@@ -249,7 +249,8 @@ static void br_multicast_group_expired(unsigned long data)
         if (!netif_running(br->dev) || timer_pending(&mp->timer))
                 goto out;
 
-        mp->mglist = false;
+        mp->host_joined = false;
+        br_mdb_notify(br->dev, NULL, &mp->addr, RTM_DELMDB, 0);
 
         if (mp->ports)
                 goto out;
@@ -292,7 +293,7 @@ static void br_multicast_del_pg(struct net_bridge *br,
                               p->flags);
                 call_rcu_bh(&p->rcu, br_multicast_free_pg);
 
-                if (!mp->ports && !mp->mglist &&
+                if (!mp->ports && !mp->host_joined &&
                     netif_running(br->dev))
                         mod_timer(&mp->timer, jiffies);
 
@@ -302,9 +303,9 @@ static void br_multicast_del_pg(struct net_bridge *br,
         WARN_ON(1);
 }
 
-static void br_multicast_port_group_expired(unsigned long data)
+static void br_multicast_port_group_expired(struct timer_list *t)
 {
-        struct net_bridge_port_group *pg = (void *)data;
+        struct net_bridge_port_group *pg = from_timer(pg, t, timer);
         struct net_bridge *br = pg->port->br;
 
         spin_lock(&br->multicast_lock);
@@ -701,8 +702,7 @@ rehash:
 
         mp->br = br;
         mp->addr = *group;
-        setup_timer(&mp->timer, br_multicast_group_expired,
-                    (unsigned long)mp);
+        timer_setup(&mp->timer, br_multicast_group_expired, 0);
 
         hlist_add_head_rcu(&mp->hlist[mdb->ver], &mdb->mhash[hash]);
         mdb->size++;
@@ -729,8 +729,7 @@ struct net_bridge_port_group *br_multicast_new_port_group(
         p->flags = flags;
         rcu_assign_pointer(p->next, next);
         hlist_add_head(&p->mglist, &port->mglist);
-        setup_timer(&p->timer, br_multicast_port_group_expired,
-                    (unsigned long)p);
+        timer_setup(&p->timer, br_multicast_port_group_expired, 0);
 
         if (src)
                 memcpy(p->eth_addr, src, ETH_ALEN);
@@ -775,7 +774,10 @@ static int br_multicast_add_group(struct net_bridge *br,
                 goto err;
 
         if (!port) {
-                mp->mglist = true;
+                if (!mp->host_joined) {
+                        mp->host_joined = true;
+                        br_mdb_notify(br->dev, NULL, &mp->addr, RTM_NEWMDB, 0);
+                }
                 mod_timer(&mp->timer, now + br->multicast_membership_interval);
                 goto out;
         }
@@ -843,9 +845,10 @@ static int br_ip6_multicast_add_group(struct net_bridge *br,
 }
 #endif
 
-static void br_multicast_router_expired(unsigned long data)
+static void br_multicast_router_expired(struct timer_list *t)
 {
-        struct net_bridge_port *port = (void *)data;
+        struct net_bridge_port *port =
+                        from_timer(port, t, multicast_router_timer);
         struct net_bridge *br = port->br;
 
         spin_lock(&br->multicast_lock);
@@ -859,8 +862,32 @@ out:
         spin_unlock(&br->multicast_lock);
 }
 
-static void br_multicast_local_router_expired(unsigned long data)
+static void br_mc_router_state_change(struct net_bridge *p,
+                                      bool is_mc_router)
+{
+        struct switchdev_attr attr = {
+                .orig_dev = p->dev,
+                .id = SWITCHDEV_ATTR_ID_BRIDGE_MROUTER,
+                .flags = SWITCHDEV_F_DEFER,
+                .u.mrouter = is_mc_router,
+        };
+
+        switchdev_port_attr_set(p->dev, &attr);
+}
+
+static void br_multicast_local_router_expired(struct timer_list *t)
 {
+        struct net_bridge *br = from_timer(br, t, multicast_router_timer);
+
+        spin_lock(&br->multicast_lock);
+        if (br->multicast_router == MDB_RTR_TYPE_DISABLED ||
+            br->multicast_router == MDB_RTR_TYPE_PERM ||
+            timer_pending(&br->multicast_router_timer))
+                goto out;
+
+        br_mc_router_state_change(br, false);
+out:
+        spin_unlock(&br->multicast_lock);
 }
 
 static void br_multicast_querier_expired(struct net_bridge *br,
@@ -876,17 +903,17 @@ out:
         spin_unlock(&br->multicast_lock);
 }
 
-static void br_ip4_multicast_querier_expired(unsigned long data)
+static void br_ip4_multicast_querier_expired(struct timer_list *t)
 {
-        struct net_bridge *br = (void *)data;
+        struct net_bridge *br = from_timer(br, t, ip4_other_query.timer);
 
         br_multicast_querier_expired(br, &br->ip4_own_query);
 }
 
 #if IS_ENABLED(CONFIG_IPV6)
-static void br_ip6_multicast_querier_expired(unsigned long data)
+static void br_ip6_multicast_querier_expired(struct timer_list *t)
 {
-        struct net_bridge *br = (void *)data;
+        struct net_bridge *br = from_timer(br, t, ip6_other_query.timer);
 
         br_multicast_querier_expired(br, &br->ip6_own_query);
 }
@@ -987,17 +1014,17 @@ out:
         spin_unlock(&br->multicast_lock);
 }
 
-static void br_ip4_multicast_port_query_expired(unsigned long data)
+static void br_ip4_multicast_port_query_expired(struct timer_list *t)
 {
-        struct net_bridge_port *port = (void *)data;
+        struct net_bridge_port *port = from_timer(port, t, ip4_own_query.timer);
 
         br_multicast_port_query_expired(port, &port->ip4_own_query);
 }
 
 #if IS_ENABLED(CONFIG_IPV6)
-static void br_ip6_multicast_port_query_expired(unsigned long data)
+static void br_ip6_multicast_port_query_expired(struct timer_list *t)
 {
-        struct net_bridge_port *port = (void *)data;
+        struct net_bridge_port *port = from_timer(port, t, ip6_own_query.timer);
 
         br_multicast_port_query_expired(port, &port->ip6_own_query);
 }
@@ -1019,13 +1046,13 @@ int br_multicast_add_port(struct net_bridge_port *port)
 {
         port->multicast_router = MDB_RTR_TYPE_TEMP_QUERY;
 
-        setup_timer(&port->multicast_router_timer, br_multicast_router_expired,
-                    (unsigned long)port);
-        setup_timer(&port->ip4_own_query.timer,
-                    br_ip4_multicast_port_query_expired, (unsigned long)port);
+        timer_setup(&port->multicast_router_timer,
+                    br_multicast_router_expired, 0);
+        timer_setup(&port->ip4_own_query.timer,
+                    br_ip4_multicast_port_query_expired, 0);
 #if IS_ENABLED(CONFIG_IPV6)
-        setup_timer(&port->ip6_own_query.timer,
-                    br_ip6_multicast_port_query_expired, (unsigned long)port);
+        timer_setup(&port->ip6_own_query.timer,
+                    br_ip6_multicast_port_query_expired, 0);
 #endif
         br_mc_disabled_update(port->dev, port->br->multicast_disabled);
 
@@ -1364,9 +1391,12 @@ static void br_multicast_mark_router(struct net_bridge *br,
         unsigned long now = jiffies;
 
         if (!port) {
-                if (br->multicast_router == MDB_RTR_TYPE_TEMP_QUERY)
+                if (br->multicast_router == MDB_RTR_TYPE_TEMP_QUERY) {
+                        if (!timer_pending(&br->multicast_router_timer))
+                                br_mc_router_state_change(br, true);
                         mod_timer(&br->multicast_router_timer,
                                   now + br->multicast_querier_interval);
+                }
                 return;
         }
 
@@ -1451,7 +1481,7 @@ static int br_ip4_multicast_query(struct net_bridge *br,
 
         max_delay *= br->multicast_last_member_count;
 
-        if (mp->mglist &&
+        if (mp->host_joined &&
             (timer_pending(&mp->timer) ?
              time_after(mp->timer.expires, now + max_delay) :
              try_to_del_timer_sync(&mp->timer) >= 0))
@@ -1535,7 +1565,7 @@ static int br_ip6_multicast_query(struct net_bridge *br,
                 goto out;
 
         max_delay *= br->multicast_last_member_count;
-        if (mp->mglist &&
+        if (mp->host_joined &&
             (timer_pending(&mp->timer) ?
              time_after(mp->timer.expires, now + max_delay) :
              try_to_del_timer_sync(&mp->timer) >= 0))
@@ -1596,7 +1626,7 @@ br_multicast_leave_group(struct net_bridge *br,
                         br_mdb_notify(br->dev, port, group, RTM_DELMDB,
                                       p->flags);
 
-                        if (!mp->ports && !mp->mglist &&
+                        if (!mp->ports && !mp->host_joined &&
                             netif_running(br->dev))
                                 mod_timer(&mp->timer, jiffies);
                 }
@@ -1636,7 +1666,7 @@ br_multicast_leave_group(struct net_bridge *br,
                      br->multicast_last_member_interval;
 
         if (!port) {
-                if (mp->mglist &&
+                if (mp->host_joined &&
                     (timer_pending(&mp->timer) ?
                      time_after(mp->timer.expires, time) :
                      try_to_del_timer_sync(&mp->timer) >= 0)) {
@@ -1906,17 +1936,17 @@ static void br_multicast_query_expired(struct net_bridge *br,
         spin_unlock(&br->multicast_lock);
 }
 
-static void br_ip4_multicast_query_expired(unsigned long data)
+static void br_ip4_multicast_query_expired(struct timer_list *t)
 {
-        struct net_bridge *br = (void *)data;
+        struct net_bridge *br = from_timer(br, t, ip4_own_query.timer);
 
         br_multicast_query_expired(br, &br->ip4_own_query, &br->ip4_querier);
 }
 
 #if IS_ENABLED(CONFIG_IPV6)
-static void br_ip6_multicast_query_expired(unsigned long data)
+static void br_ip6_multicast_query_expired(struct timer_list *t)
 {
-        struct net_bridge *br = (void *)data;
+        struct net_bridge *br = from_timer(br, t, ip6_own_query.timer);
 
         br_multicast_query_expired(br, &br->ip6_own_query, &br->ip6_querier);
 }
@@ -1951,17 +1981,17 @@ void br_multicast_init(struct net_bridge *br)
         br->has_ipv6_addr = 1;
 
         spin_lock_init(&br->multicast_lock);
-        setup_timer(&br->multicast_router_timer,
+        timer_setup(&br->multicast_router_timer,
                     br_multicast_local_router_expired, 0);
-        setup_timer(&br->ip4_other_query.timer,
-                    br_ip4_multicast_querier_expired, (unsigned long)br);
-        setup_timer(&br->ip4_own_query.timer, br_ip4_multicast_query_expired,
-                    (unsigned long)br);
+        timer_setup(&br->ip4_other_query.timer,
+                    br_ip4_multicast_querier_expired, 0);
+        timer_setup(&br->ip4_own_query.timer,
+                    br_ip4_multicast_query_expired, 0);
 #if IS_ENABLED(CONFIG_IPV6)
-        setup_timer(&br->ip6_other_query.timer,
-                    br_ip6_multicast_querier_expired, (unsigned long)br);
-        setup_timer(&br->ip6_own_query.timer, br_ip6_multicast_query_expired,
-                    (unsigned long)br);
+        timer_setup(&br->ip6_other_query.timer,
+                    br_ip6_multicast_querier_expired, 0);
+        timer_setup(&br->ip6_own_query.timer,
+                    br_ip6_multicast_query_expired, 0);
 #endif
 }
 
@@ -2042,9 +2072,14 @@ int br_multicast_set_router(struct net_bridge *br, unsigned long val)
         switch (val) {
         case MDB_RTR_TYPE_DISABLED:
         case MDB_RTR_TYPE_PERM:
+                br_mc_router_state_change(br, val == MDB_RTR_TYPE_PERM);
                 del_timer(&br->multicast_router_timer);
-                /* fall through */
+                br->multicast_router = val;
+                err = 0;
+                break;
         case MDB_RTR_TYPE_TEMP_QUERY:
+                if (br->multicast_router != MDB_RTR_TYPE_TEMP_QUERY)
+                        br_mc_router_state_change(br, false);
                 br->multicast_router = val;
                 err = 0;
                 break;
@@ -2184,6 +2219,18 @@ bool br_multicast_enabled(const struct net_device *dev)
 }
 EXPORT_SYMBOL_GPL(br_multicast_enabled);
 
+bool br_multicast_router(const struct net_device *dev)
+{
+        struct net_bridge *br = netdev_priv(dev);
+        bool is_router;
+
+        spin_lock_bh(&br->multicast_lock);
+        is_router = br_multicast_is_router(br);
+        spin_unlock_bh(&br->multicast_lock);
+        return is_router;
+}
+EXPORT_SYMBOL_GPL(br_multicast_router);
+
 int br_multicast_set_querier(struct net_bridge *br, unsigned long val)
 {
         unsigned long max_delay;
diff --git a/net/bridge/br_netlink.c b/net/bridge/br_netlink.c
index de2152730809..d0ef0a8e8831 100644
--- a/net/bridge/br_netlink.c
+++ b/net/bridge/br_netlink.c
@@ -138,6 +138,7 @@ static inline size_t br_port_info_size(void)
                 + nla_total_size(1)     /* IFLA_BRPORT_PROXYARP */
                 + nla_total_size(1)     /* IFLA_BRPORT_PROXYARP_WIFI */
                 + nla_total_size(1)     /* IFLA_BRPORT_VLAN_TUNNEL */
+                + nla_total_size(1)     /* IFLA_BRPORT_NEIGH_SUPPRESS */
                 + nla_total_size(sizeof(struct ifla_bridge_id)) /* IFLA_BRPORT_ROOT_ID */
                 + nla_total_size(sizeof(struct ifla_bridge_id)) /* IFLA_BRPORT_BRIDGE_ID */
                 + nla_total_size(sizeof(u16))   /* IFLA_BRPORT_DESIGNATED_PORT */
@@ -152,6 +153,7 @@ static inline size_t br_port_info_size(void)
 #ifdef CONFIG_BRIDGE_IGMP_SNOOPING
                 + nla_total_size(sizeof(u8))    /* IFLA_BRPORT_MULTICAST_ROUTER */
 #endif
+                + nla_total_size(sizeof(u16))   /* IFLA_BRPORT_GROUP_FWD_MASK */
                 + 0;
 }
 
@@ -208,7 +210,10 @@ static int br_port_fill_attrs(struct sk_buff *skb,
                        p->topology_change_ack) ||
             nla_put_u8(skb, IFLA_BRPORT_CONFIG_PENDING, p->config_pending) ||
             nla_put_u8(skb, IFLA_BRPORT_VLAN_TUNNEL, !!(p->flags &
-                                                        BR_VLAN_TUNNEL)))
+                                                        BR_VLAN_TUNNEL)) ||
+            nla_put_u16(skb, IFLA_BRPORT_GROUP_FWD_MASK, p->group_fwd_mask) ||
+            nla_put_u8(skb, IFLA_BRPORT_NEIGH_SUPPRESS,
+                       !!(p->flags & BR_NEIGH_SUPPRESS)))
                 return -EMSGSIZE;
 
         timerval = br_timer_value(&p->message_age_timer);
@@ -356,14 +361,14 @@ nla_put_failure:
  * Contains port and master info as well as carrier and bridge state.
  */
 static int br_fill_ifinfo(struct sk_buff *skb,
-                          struct net_bridge_port *port,
+                          const struct net_bridge_port *port,
                           u32 pid, u32 seq, int event, unsigned int flags,
                           u32 filter_mask, const struct net_device *dev)
 {
+        u8 operstate = netif_running(dev) ? dev->operstate : IF_OPER_DOWN;
         struct net_bridge *br;
         struct ifinfomsg *hdr;
         struct nlmsghdr *nlh;
-        u8 operstate = netif_running(dev) ? dev->operstate : IF_OPER_DOWN;
 
         if (port)
                 br = port->br;
@@ -449,28 +454,36 @@ nla_put_failure:
         return -EMSGSIZE;
 }
 
-/*
- * Notify listeners of a change in port information
- */
-void br_ifinfo_notify(int event, struct net_bridge_port *port)
+/* Notify listeners of a change in bridge or port information */
+void br_ifinfo_notify(int event, const struct net_bridge *br,
+                      const struct net_bridge_port *port)
 {
-        struct net *net;
+        u32 filter = RTEXT_FILTER_BRVLAN_COMPRESSED;
+        struct net_device *dev;
         struct sk_buff *skb;
         int err = -ENOBUFS;
-        u32 filter = RTEXT_FILTER_BRVLAN_COMPRESSED;
+        struct net *net;
+        u16 port_no = 0;
 
-        if (!port)
+        if (WARN_ON(!port && !br))
                 return;
 
-        net = dev_net(port->dev);
-        br_debug(port->br, "port %u(%s) event %d\n",
-                 (unsigned int)port->port_no, port->dev->name, event);
+        if (port) {
+                dev = port->dev;
+                br = port->br;
+                port_no = port->port_no;
+        } else {
+                dev = br->dev;
+        }
+
+        net = dev_net(dev);
+        br_debug(br, "port %u(%s) event %d\n", port_no, dev->name, event);
 
-        skb = nlmsg_new(br_nlmsg_size(port->dev, filter), GFP_ATOMIC);
+        skb = nlmsg_new(br_nlmsg_size(dev, filter), GFP_ATOMIC);
         if (skb == NULL)
                 goto errout;
 
-        err = br_fill_ifinfo(skb, port, 0, 0, event, 0, filter, port->dev);
+        err = br_fill_ifinfo(skb, port, 0, 0, event, 0, filter, dev);
         if (err < 0) {
                 /* -EMSGSIZE implies BUG in br_nlmsg_size() */
                 WARN_ON(err == -EMSGSIZE);
@@ -483,7 +496,6 @@ errout:
         rtnl_set_sk_err(net, RTNLGRP_LINK, err);
 }
 
-
 /*
  * Dump information about all ports, in response to GETLINK
  */
@@ -501,8 +513,9 @@ int br_getlink(struct sk_buff *skb, u32 pid, u32 seq,
 }
 
 static int br_vlan_info(struct net_bridge *br, struct net_bridge_port *p,
-                        int cmd, struct bridge_vlan_info *vinfo)
+                        int cmd, struct bridge_vlan_info *vinfo, bool *changed)
 {
+        bool curr_change;
         int err = 0;
 
         switch (cmd) {
@@ -511,22 +524,27 @@ static int br_vlan_info(struct net_bridge *br, struct net_bridge_port *p,
                         /* if the MASTER flag is set this will act on the global
                          * per-VLAN entry as well
                          */
-                        err = nbp_vlan_add(p, vinfo->vid, vinfo->flags);
-                        if (err)
-                                break;
+                        err = nbp_vlan_add(p, vinfo->vid, vinfo->flags,
+                                           &curr_change);
                 } else {
                         vinfo->flags |= BRIDGE_VLAN_INFO_BRENTRY;
-                        err = br_vlan_add(br, vinfo->vid, vinfo->flags);
+                        err = br_vlan_add(br, vinfo->vid, vinfo->flags,
+                                          &curr_change);
                 }
+                if (curr_change)
+                        *changed = true;
                 break;
 
         case RTM_DELLINK:
                 if (p) {
-                        nbp_vlan_delete(p, vinfo->vid);
-                        if (vinfo->flags & BRIDGE_VLAN_INFO_MASTER)
-                                br_vlan_delete(p->br, vinfo->vid);
-                } else {
-                        br_vlan_delete(br, vinfo->vid);
+                        if (!nbp_vlan_delete(p, vinfo->vid))
+                                *changed = true;
+
+                        if ((vinfo->flags & BRIDGE_VLAN_INFO_MASTER) &&
+                            !br_vlan_delete(p->br, vinfo->vid))
+                                *changed = true;
+                } else if (!br_vlan_delete(br, vinfo->vid)) {
+                        *changed = true;
                 }
                 break;
         }
@@ -537,7 +555,8 @@ static int br_vlan_info(struct net_bridge *br, struct net_bridge_port *p,
 static int br_process_vlan_info(struct net_bridge *br,
                                 struct net_bridge_port *p, int cmd,
                                 struct bridge_vlan_info *vinfo_curr,
-                                struct bridge_vlan_info **vinfo_last)
+                                struct bridge_vlan_info **vinfo_last,
+                                bool *changed)
 {
         if (!vinfo_curr->vid || vinfo_curr->vid >= VLAN_VID_MASK)
                 return -EINVAL;
@@ -567,7 +586,7 @@ static int br_process_vlan_info(struct net_bridge *br,
                        sizeof(struct bridge_vlan_info));
                 for (v = (*vinfo_last)->vid; v <= vinfo_curr->vid; v++) {
                         tmp_vinfo.vid = v;
-                        err = br_vlan_info(br, p, cmd, &tmp_vinfo);
+                        err = br_vlan_info(br, p, cmd, &tmp_vinfo, changed);
                         if (err)
                                 break;
                 }
@@ -576,13 +595,13 @@ static int br_process_vlan_info(struct net_bridge *br,
                 return err;
         }
 
-        return br_vlan_info(br, p, cmd, vinfo_curr);
+        return br_vlan_info(br, p, cmd, vinfo_curr, changed);
 }
 
 static int br_afspec(struct net_bridge *br,
                      struct net_bridge_port *p,
                      struct nlattr *af_spec,
-                     int cmd)
+                     int cmd, bool *changed)
 {
         struct bridge_vlan_info *vinfo_curr = NULL;
         struct bridge_vlan_info *vinfo_last = NULL;
@@ -602,7 +621,8 @@ static int br_afspec(struct net_bridge *br,
                                 return err;
                         err = br_process_vlan_tunnel_info(br, p, cmd,
                                                           &tinfo_curr,
-                                                          &tinfo_last);
+                                                          &tinfo_last,
+                                                          changed);
                         if (err)
                                 return err;
                         break;
@@ -611,7 +631,7 @@ static int br_afspec(struct net_bridge *br,
                                 return -EINVAL;
                         vinfo_curr = nla_data(attr);
                         err = br_process_vlan_info(br, p, cmd, vinfo_curr,
-                                                   &vinfo_last);
+                                                   &vinfo_last, changed);
                         if (err)
                                 return err;
                         break;
@@ -637,6 +657,9 @@ static const struct nla_policy br_port_policy[IFLA_BRPORT_MAX + 1] = {
         [IFLA_BRPORT_MCAST_TO_UCAST] = { .type = NLA_U8 },
         [IFLA_BRPORT_MCAST_FLOOD] = { .type = NLA_U8 },
         [IFLA_BRPORT_BCAST_FLOOD] = { .type = NLA_U8 },
+        [IFLA_BRPORT_VLAN_TUNNEL] = { .type = NLA_U8 },
+        [IFLA_BRPORT_GROUP_FWD_MASK] = { .type = NLA_U16 },
+        [IFLA_BRPORT_NEIGH_SUPPRESS] = { .type = NLA_U8 },
 };
 
 /* Change the state of the port and notify spanning tree */
@@ -773,6 +796,20 @@ static int br_setport(struct net_bridge_port *p, struct nlattr *tb[])
                         return err;
         }
 #endif
+
+        if (tb[IFLA_BRPORT_GROUP_FWD_MASK]) {
+                u16 fwd_mask = nla_get_u16(tb[IFLA_BRPORT_GROUP_FWD_MASK]);
+
+                if (fwd_mask & BR_GROUPFWD_MACPAUSE)
+                        return -EINVAL;
+                p->group_fwd_mask = fwd_mask;
+        }
+
+        err = br_set_port_flag(p, tb, IFLA_BRPORT_NEIGH_SUPPRESS,
+                               BR_NEIGH_SUPPRESS);
+        if (err)
+                return err;
+
         br_port_flags_change(p, old_flags ^ p->flags);
         return 0;
 }
@@ -780,10 +817,12 @@ static int br_setport(struct net_bridge_port *p, struct nlattr *tb[])
 /* Change state and parameters on port. */
 int br_setlink(struct net_device *dev, struct nlmsghdr *nlh, u16 flags)
 {
+        struct net_bridge *br = (struct net_bridge *)netdev_priv(dev);
+        struct nlattr *tb[IFLA_BRPORT_MAX + 1];
+        struct net_bridge_port *p;
         struct nlattr *protinfo;
         struct nlattr *afspec;
-        struct net_bridge_port *p;
-        struct nlattr *tb[IFLA_BRPORT_MAX + 1];
+        bool changed = false;
         int err = 0;
 
         protinfo = nlmsg_find_attr(nlh, sizeof(struct ifinfomsg), IFLA_PROTINFO);
@@ -819,15 +858,14 @@ int br_setlink(struct net_device *dev, struct nlmsghdr *nlh, u16 flags)
                 }
                 if (err)
                         goto out;
+                changed = true;
         }
 
-        if (afspec) {
-                err = br_afspec((struct net_bridge *)netdev_priv(dev), p,
-                                afspec, RTM_SETLINK);
-        }
+        if (afspec)
+                err = br_afspec(br, p, afspec, RTM_SETLINK, &changed);
 
-        if (err == 0)
-                br_ifinfo_notify(RTM_NEWLINK, p);
+        if (changed)
+                br_ifinfo_notify(RTM_NEWLINK, br, p);
 out:
         return err;
 }
@@ -835,8 +873,10 @@ out:
 /* Delete port information */
 int br_dellink(struct net_device *dev, struct nlmsghdr *nlh, u16 flags)
 {
-        struct nlattr *afspec;
+        struct net_bridge *br = (struct net_bridge *)netdev_priv(dev);
         struct net_bridge_port *p;
+        struct nlattr *afspec;
+        bool changed = false;
         int err = 0;
 
         afspec = nlmsg_find_attr(nlh, sizeof(struct ifinfomsg), IFLA_AF_SPEC);
@@ -848,13 +888,12 @@ int br_dellink(struct net_device *dev, struct nlmsghdr *nlh, u16 flags)
         if (!p && !(dev->priv_flags & IFF_EBRIDGE))
                 return -EINVAL;
 
-        err = br_afspec((struct net_bridge *)netdev_priv(dev), p,
-                        afspec, RTM_DELLINK);
-        if (err == 0)
+        err = br_afspec(br, p, afspec, RTM_DELLINK, &changed);
+        if (changed)
                 /* Send RTM_NEWLINK because userspace
                  * expects RTM_NEWLINK for vlan dels
                  */
-                br_ifinfo_notify(RTM_NEWLINK, p);
+                br_ifinfo_notify(RTM_NEWLINK, br, p);
 
         return err;
 }
diff --git a/net/bridge/br_netlink_tunnel.c b/net/bridge/br_netlink_tunnel.c
index 3712c7f0e00c..da8cb99fd259 100644
--- a/net/bridge/br_netlink_tunnel.c
+++ b/net/bridge/br_netlink_tunnel.c
@@ -198,7 +198,7 @@ static const struct nla_policy vlan_tunnel_policy[IFLA_BRIDGE_VLAN_TUNNEL_MAX +
 };
 
 static int br_vlan_tunnel_info(struct net_bridge_port *p, int cmd,
-                               u16 vid, u32 tun_id)
+                               u16 vid, u32 tun_id, bool *changed)
 {
         int err = 0;
 
@@ -208,9 +208,12 @@ static int br_vlan_tunnel_info(struct net_bridge_port *p, int cmd,
         switch (cmd) {
         case RTM_SETLINK:
                 err = nbp_vlan_tunnel_info_add(p, vid, tun_id);
+                if (!err)
+                        *changed = true;
                 break;
         case RTM_DELLINK:
-                nbp_vlan_tunnel_info_delete(p, vid);
+                if (!nbp_vlan_tunnel_info_delete(p, vid))
+                        *changed = true;
                 break;
         }
 
@@ -254,7 +257,8 @@ int br_parse_vlan_tunnel_info(struct nlattr *attr,
 int br_process_vlan_tunnel_info(struct net_bridge *br,
                                 struct net_bridge_port *p, int cmd,
                                 struct vtunnel_info *tinfo_curr,
-                                struct vtunnel_info *tinfo_last)
+                                struct vtunnel_info *tinfo_last,
+                                bool *changed)
 {
         int err;
 
@@ -272,7 +276,7 @@ int br_process_vlan_tunnel_info(struct net_bridge *br,
                         return -EINVAL;
                 t = tinfo_last->tunid;
                 for (v = tinfo_last->vid; v <= tinfo_curr->vid; v++) {
-                        err = br_vlan_tunnel_info(p, cmd, v, t);
+                        err = br_vlan_tunnel_info(p, cmd, v, t, changed);
                         if (err)
                                 return err;
                         t++;
@@ -283,7 +287,7 @@ int br_process_vlan_tunnel_info(struct net_bridge *br,
                 if (tinfo_last->flags)
                         return -EINVAL;
                 err = br_vlan_tunnel_info(p, cmd, tinfo_curr->vid,
-                                          tinfo_curr->tunid);
+                                          tinfo_curr->tunid, changed);
                 if (err)
                         return err;
                 memset(tinfo_last, 0, sizeof(struct vtunnel_info));
diff --git a/net/bridge/br_private.h b/net/bridge/br_private.h
index e870cfc85b14..1312b8d20ec3 100644
--- a/net/bridge/br_private.h
+++ b/net/bridge/br_private.h
@@ -36,7 +36,14 @@
 /* Control of forwarding link local multicast */
 #define BR_GROUPFWD_DEFAULT     0
 /* Don't allow forwarding of control protocols like STP, MAC PAUSE and LACP */
-#define BR_GROUPFWD_RESTRICTED  0x0007u
+enum {
+        BR_GROUPFWD_STP         = BIT(0),
+        BR_GROUPFWD_MACPAUSE    = BIT(1),
+        BR_GROUPFWD_LACP        = BIT(2),
+};
+
+#define BR_GROUPFWD_RESTRICTED (BR_GROUPFWD_STP | BR_GROUPFWD_MACPAUSE | \
+                                BR_GROUPFWD_LACP)
 /* The Nearest Customer Bridge Group Address, 01-80-C2-00-00-[00,0B,0C,0D,0F] */
 #define BR_GROUPFWD_8021AD      0xB801u
 
@@ -202,7 +209,7 @@ struct net_bridge_mdb_entry
         struct rcu_head                 rcu;
         struct timer_list               timer;
         struct br_ip                    addr;
-        bool                            mglist;
+        bool                            host_joined;
 };
 
 struct net_bridge_mdb_htable
@@ -268,6 +275,7 @@ struct net_bridge_port {
 #ifdef CONFIG_NET_SWITCHDEV
         int                             offload_fwd_mark;
 #endif
+        u16                             group_fwd_mask;
 };
 
 #define br_auto_port(p) ((p)->flags & BR_AUTO_MASK)
@@ -396,6 +404,7 @@ struct net_bridge {
 #ifdef CONFIG_NET_SWITCHDEV
         int offload_fwd_mark;
 #endif
+        bool                            neigh_suppress_enabled;
 };
 
 struct br_input_skb_cb {
@@ -558,7 +567,8 @@ void br_flood(struct net_bridge *br, struct sk_buff *skb,
 void br_port_carrier_check(struct net_bridge_port *p);
 int br_add_bridge(struct net *net, const char *name);
 int br_del_bridge(struct net *net, const char *name);
-int br_add_if(struct net_bridge *br, struct net_device *dev);
+int br_add_if(struct net_bridge *br, struct net_device *dev,
+              struct netlink_ext_ack *extack);
 int br_del_if(struct net_bridge *br, struct net_device *dev);
 int br_min_mtu(const struct net_bridge *br);
 netdev_features_t br_features_recompute(struct net_bridge *br,
@@ -793,7 +803,8 @@ struct sk_buff *br_handle_vlan(struct net_bridge *br,
                                const struct net_bridge_port *port,
                                struct net_bridge_vlan_group *vg,
                                struct sk_buff *skb);
-int br_vlan_add(struct net_bridge *br, u16 vid, u16 flags);
+int br_vlan_add(struct net_bridge *br, u16 vid, u16 flags,
+                bool *changed);
 int br_vlan_delete(struct net_bridge *br, u16 vid);
 void br_vlan_flush(struct net_bridge *br);
 struct net_bridge_vlan *br_vlan_find(struct net_bridge_vlan_group *vg, u16 vid);
@@ -806,7 +817,8 @@ int br_vlan_set_stats(struct net_bridge *br, unsigned long val);
 int br_vlan_init(struct net_bridge *br);
 int br_vlan_set_default_pvid(struct net_bridge *br, unsigned long val);
 int __br_vlan_set_default_pvid(struct net_bridge *br, u16 pvid);
-int nbp_vlan_add(struct net_bridge_port *port, u16 vid, u16 flags);
+int nbp_vlan_add(struct net_bridge_port *port, u16 vid, u16 flags,
+                 bool *changed);
 int nbp_vlan_delete(struct net_bridge_port *port, u16 vid);
 void nbp_vlan_flush(struct net_bridge_port *port);
 int nbp_vlan_init(struct net_bridge_port *port);
@@ -893,8 +905,10 @@ static inline struct sk_buff *br_handle_vlan(struct net_bridge *br,
         return skb;
 }
 
-static inline int br_vlan_add(struct net_bridge *br, u16 vid, u16 flags)
+static inline int br_vlan_add(struct net_bridge *br, u16 vid, u16 flags,
+                              bool *changed)
 {
+        *changed = false;
         return -EOPNOTSUPP;
 }
 
@@ -916,8 +930,10 @@ static inline int br_vlan_init(struct net_bridge *br)
         return 0;
 }
 
-static inline int nbp_vlan_add(struct net_bridge_port *port, u16 vid, u16 flags)
+static inline int nbp_vlan_add(struct net_bridge_port *port, u16 vid, u16 flags,
+                               bool *changed)
 {
+        *changed = false;
         return -EOPNOTSUPP;
 }
 
@@ -1055,7 +1071,8 @@ extern int (*br_fdb_test_addr_hook)(struct net_device *dev, unsigned char *addr)
 extern struct rtnl_link_ops br_link_ops;
 int br_netlink_init(void);
 void br_netlink_fini(void);
-void br_ifinfo_notify(int event, struct net_bridge_port *port);
+void br_ifinfo_notify(int event, const struct net_bridge *br,
+                      const struct net_bridge_port *port);
 int br_setlink(struct net_device *dev, struct nlmsghdr *nlmsg, u16 flags);
 int br_dellink(struct net_device *dev, struct nlmsghdr *nlmsg, u16 flags);
 int br_getlink(struct sk_buff *skb, u32 pid, u32 seq, struct net_device *dev,
@@ -1130,4 +1147,11 @@ static inline void br_switchdev_frame_unmark(struct sk_buff *skb)
 }
 #endif /* CONFIG_NET_SWITCHDEV */
 
+/* br_arp_nd_proxy.c */
+void br_recalculate_neigh_suppress_enabled(struct net_bridge *br);
+void br_do_proxy_suppress_arp(struct sk_buff *skb, struct net_bridge *br,
+                              u16 vid, struct net_bridge_port *p);
+void br_do_suppress_nd(struct sk_buff *skb, struct net_bridge *br,
+                       u16 vid, struct net_bridge_port *p, struct nd_msg *msg);
+struct nd_msg *br_is_nd_neigh_msg(struct sk_buff *skb, struct nd_msg *m);
 #endif
diff --git a/net/bridge/br_private_tunnel.h b/net/bridge/br_private_tunnel.h
index 4a447a378ab3..a259471bfd78 100644
--- a/net/bridge/br_private_tunnel.h
+++ b/net/bridge/br_private_tunnel.h
@@ -26,7 +26,8 @@ int br_process_vlan_tunnel_info(struct net_bridge *br,
                                 struct net_bridge_port *p,
                                 int cmd,
                                 struct vtunnel_info *tinfo_curr,
-                                struct vtunnel_info *tinfo_last);
+                                struct vtunnel_info *tinfo_last,
+                                bool *changed);
 int br_get_vlan_tunnel_info_size(struct net_bridge_vlan_group *vg);
 int br_fill_vlan_tunnel_info(struct sk_buff *skb,
                              struct net_bridge_vlan_group *vg);
diff --git a/net/bridge/br_stp.c b/net/bridge/br_stp.c
index 8f56c2d1f1a7..b6941961a876 100644
--- a/net/bridge/br_stp.c
+++ b/net/bridge/br_stp.c
@@ -123,7 +123,7 @@ static void br_root_port_block(const struct net_bridge *br,
                   (unsigned int) p->port_no, p->dev->name);
 
         br_set_state(p, BR_STATE_LISTENING);
-        br_ifinfo_notify(RTM_NEWLINK, p);
+        br_ifinfo_notify(RTM_NEWLINK, NULL, p);
 
         if (br->forward_delay > 0)
                 mod_timer(&p->forward_delay_timer, jiffies + br->forward_delay);
@@ -403,7 +403,7 @@ static void br_make_blocking(struct net_bridge_port *p)
                         br_topology_change_detection(p->br);
 
                 br_set_state(p, BR_STATE_BLOCKING);
-                br_ifinfo_notify(RTM_NEWLINK, p);
+                br_ifinfo_notify(RTM_NEWLINK, NULL, p);
 
                 del_timer(&p->forward_delay_timer);
         }
@@ -426,7 +426,7 @@ static void br_make_forwarding(struct net_bridge_port *p)
         else
                 br_set_state(p, BR_STATE_LEARNING);
 
-        br_ifinfo_notify(RTM_NEWLINK, p);
+        br_ifinfo_notify(RTM_NEWLINK, NULL, p);
 
         if (br->forward_delay != 0)
                 mod_timer(&p->forward_delay_timer, jiffies + br->forward_delay);
diff --git a/net/bridge/br_stp_if.c b/net/bridge/br_stp_if.c
index 89110319ef0f..808e2b914015 100644
--- a/net/bridge/br_stp_if.c
+++ b/net/bridge/br_stp_if.c
@@ -96,7 +96,7 @@ void br_stp_enable_port(struct net_bridge_port *p)
 {
         br_init_port(p);
         br_port_state_selection(p->br);
-        br_ifinfo_notify(RTM_NEWLINK, p);
+        br_ifinfo_notify(RTM_NEWLINK, NULL, p);
 }
 
 /* called under bridge lock */
@@ -111,7 +111,7 @@ void br_stp_disable_port(struct net_bridge_port *p)
         p->topology_change_ack = 0;
         p->config_pending = 0;
 
-        br_ifinfo_notify(RTM_NEWLINK, p);
+        br_ifinfo_notify(RTM_NEWLINK, NULL, p);
 
         del_timer(&p->message_age_timer);
         del_timer(&p->forward_delay_timer);
diff --git a/net/bridge/br_stp_timer.c b/net/bridge/br_stp_timer.c
index 60b6fe277a8b..e7739de5f0e1 100644
--- a/net/bridge/br_stp_timer.c
+++ b/net/bridge/br_stp_timer.c
@@ -31,9 +31,9 @@ static int br_is_designated_for_some_port(const struct net_bridge *br)
         return 0;
 }
 
-static void br_hello_timer_expired(unsigned long arg)
+static void br_hello_timer_expired(struct timer_list *t)
 {
-        struct net_bridge *br = (struct net_bridge *)arg;
+        struct net_bridge *br = from_timer(br, t, hello_timer);
 
         br_debug(br, "hello timer expired\n");
         spin_lock(&br->lock);
@@ -47,9 +47,9 @@ static void br_hello_timer_expired(unsigned long arg)
         spin_unlock(&br->lock);
 }
 
-static void br_message_age_timer_expired(unsigned long arg)
+static void br_message_age_timer_expired(struct timer_list *t)
 {
-        struct net_bridge_port *p = (struct net_bridge_port *) arg;
+        struct net_bridge_port *p = from_timer(p, t, message_age_timer);
         struct net_bridge *br = p->br;
         const bridge_id *id = &p->designated_bridge;
         int was_root;
@@ -80,9 +80,9 @@ static void br_message_age_timer_expired(unsigned long arg)
         spin_unlock(&br->lock);
 }
 
-static void br_forward_delay_timer_expired(unsigned long arg)
+static void br_forward_delay_timer_expired(struct timer_list *t)
 {
-        struct net_bridge_port *p = (struct net_bridge_port *) arg;
+        struct net_bridge_port *p = from_timer(p, t, forward_delay_timer);
         struct net_bridge *br = p->br;
 
         br_debug(br, "port %u(%s) forward delay timer\n",
@@ -99,14 +99,14 @@ static void br_forward_delay_timer_expired(unsigned long arg)
                 netif_carrier_on(br->dev);
         }
         rcu_read_lock();
-        br_ifinfo_notify(RTM_NEWLINK, p);
+        br_ifinfo_notify(RTM_NEWLINK, NULL, p);
         rcu_read_unlock();
         spin_unlock(&br->lock);
 }
 
-static void br_tcn_timer_expired(unsigned long arg)
+static void br_tcn_timer_expired(struct timer_list *t)
 {
-        struct net_bridge *br = (struct net_bridge *) arg;
+        struct net_bridge *br = from_timer(br, t, tcn_timer);
 
         br_debug(br, "tcn timer expired\n");
         spin_lock(&br->lock);
@@ -118,9 +118,9 @@ static void br_tcn_timer_expired(unsigned long arg)
         spin_unlock(&br->lock);
 }
 
-static void br_topology_change_timer_expired(unsigned long arg)
+static void br_topology_change_timer_expired(struct timer_list *t)
 {
-        struct net_bridge *br = (struct net_bridge *) arg;
+        struct net_bridge *br = from_timer(br, t, topology_change_timer);
 
         br_debug(br, "topo change timer expired\n");
         spin_lock(&br->lock);
@@ -129,9 +129,9 @@ static void br_topology_change_timer_expired(unsigned long arg)
         spin_unlock(&br->lock);
 }
 
-static void br_hold_timer_expired(unsigned long arg)
+static void br_hold_timer_expired(struct timer_list *t)
 {
-        struct net_bridge_port *p = (struct net_bridge_port *) arg;
+        struct net_bridge_port *p = from_timer(p, t, hold_timer);
 
         br_debug(p->br, "port %u(%s) hold timer expired\n",
                  (unsigned int) p->port_no, p->dev->name);
@@ -144,27 +144,17 @@ static void br_hold_timer_expired(unsigned long arg)
 
 void br_stp_timer_init(struct net_bridge *br)
 {
-        setup_timer(&br->hello_timer, br_hello_timer_expired,
-                      (unsigned long) br);
-
-        setup_timer(&br->tcn_timer, br_tcn_timer_expired,
-                      (unsigned long) br);
-
-        setup_timer(&br->topology_change_timer,
-                      br_topology_change_timer_expired,
-                      (unsigned long) br);
+        timer_setup(&br->hello_timer, br_hello_timer_expired, 0);
+        timer_setup(&br->tcn_timer, br_tcn_timer_expired, 0);
+        timer_setup(&br->topology_change_timer,
+                    br_topology_change_timer_expired, 0);
 }
 
 void br_stp_port_timer_init(struct net_bridge_port *p)
 {
-        setup_timer(&p->message_age_timer, br_message_age_timer_expired,
-                      (unsigned long) p);
-
-        setup_timer(&p->forward_delay_timer, br_forward_delay_timer_expired,
-                      (unsigned long) p);
-
-        setup_timer(&p->hold_timer, br_hold_timer_expired,
-                      (unsigned long) p);
+        timer_setup(&p->message_age_timer, br_message_age_timer_expired, 0);
+        timer_setup(&p->forward_delay_timer, br_forward_delay_timer_expired, 0);
+        timer_setup(&p->hold_timer, br_hold_timer_expired, 0);
 }
 
 /* Report ticks left (in USER_HZ) used for API */
diff --git a/net/bridge/br_sysfs_if.c b/net/bridge/br_sysfs_if.c
index 5d5d413a6cf8..0254c35b2bf0 100644
--- a/net/bridge/br_sysfs_if.c
+++ b/net/bridge/br_sysfs_if.c
@@ -165,6 +165,23 @@ static int store_flush(struct net_bridge_port *p, unsigned long v)
 }
 static BRPORT_ATTR(flush, S_IWUSR, NULL, store_flush);
 
+static ssize_t show_group_fwd_mask(struct net_bridge_port *p, char *buf)
+{
+        return sprintf(buf, "%#x\n", p->group_fwd_mask);
+}
+
+static int store_group_fwd_mask(struct net_bridge_port *p,
+                                unsigned long v)
+{
+        if (v & BR_GROUPFWD_MACPAUSE)
+                return -EINVAL;
+        p->group_fwd_mask = v;
+
+        return 0;
+}
+static BRPORT_ATTR(group_fwd_mask, S_IRUGO | S_IWUSR, show_group_fwd_mask,
+                   store_group_fwd_mask);
+
 BRPORT_ATTR_FLAG(hairpin_mode, BR_HAIRPIN_MODE);
 BRPORT_ATTR_FLAG(bpdu_guard, BR_BPDU_GUARD);
 BRPORT_ATTR_FLAG(root_block, BR_ROOT_BLOCK);
@@ -174,6 +191,7 @@ BRPORT_ATTR_FLAG(proxyarp, BR_PROXYARP);
 BRPORT_ATTR_FLAG(proxyarp_wifi, BR_PROXYARP_WIFI);
 BRPORT_ATTR_FLAG(multicast_flood, BR_MCAST_FLOOD);
 BRPORT_ATTR_FLAG(broadcast_flood, BR_BCAST_FLOOD);
+BRPORT_ATTR_FLAG(neigh_suppress, BR_NEIGH_SUPPRESS);
 
 #ifdef CONFIG_BRIDGE_IGMP_SNOOPING
 static ssize_t show_multicast_router(struct net_bridge_port *p, char *buf)
@@ -223,6 +241,8 @@ static const struct brport_attribute *brport_attrs[] = {
         &brport_attr_proxyarp_wifi,
         &brport_attr_multicast_flood,
         &brport_attr_broadcast_flood,
+        &brport_attr_group_fwd_mask,
+        &brport_attr_neigh_suppress,
         NULL
 };
 
@@ -260,7 +280,7 @@ static ssize_t brport_store(struct kobject *kobj,
                         ret = brport_attr->store(p, val);
                         spin_unlock_bh(&p->br->lock);
                         if (!ret) {
-                                br_ifinfo_notify(RTM_NEWLINK, p);
+                                br_ifinfo_notify(RTM_NEWLINK, NULL, p);
                                 ret = count;
                         }
                 }
diff --git a/net/bridge/br_vlan.c b/net/bridge/br_vlan.c
index 233a30040c91..51935270c651 100644
--- a/net/bridge/br_vlan.c
+++ b/net/bridge/br_vlan.c
@@ -32,27 +32,34 @@ static struct net_bridge_vlan *br_vlan_lookup(struct rhashtable *tbl, u16 vid)
         return rhashtable_lookup_fast(tbl, &vid, br_vlan_rht_params);
 }
 
-static void __vlan_add_pvid(struct net_bridge_vlan_group *vg, u16 vid)
+static bool __vlan_add_pvid(struct net_bridge_vlan_group *vg, u16 vid)
 {
         if (vg->pvid == vid)
-                return;
+                return false;
 
         smp_wmb();
         vg->pvid = vid;
+
+        return true;
 }
 
-static void __vlan_delete_pvid(struct net_bridge_vlan_group *vg, u16 vid)
+static bool __vlan_delete_pvid(struct net_bridge_vlan_group *vg, u16 vid)
 {
         if (vg->pvid != vid)
-                return;
+                return false;
 
         smp_wmb();
         vg->pvid = 0;
+
+        return true;
 }
 
-static void __vlan_add_flags(struct net_bridge_vlan *v, u16 flags)
+/* return true if anything changed, false otherwise */
+static bool __vlan_add_flags(struct net_bridge_vlan *v, u16 flags)
 {
         struct net_bridge_vlan_group *vg;
+        u16 old_flags = v->flags;
+        bool ret;
 
         if (br_vlan_is_master(v))
                 vg = br_vlan_group(v->br);
@@ -60,14 +67,16 @@ static void __vlan_add_flags(struct net_bridge_vlan *v, u16 flags)
                 vg = nbp_vlan_group(v->port);
 
         if (flags & BRIDGE_VLAN_INFO_PVID)
-                __vlan_add_pvid(vg, v->vid);
+                ret = __vlan_add_pvid(vg, v->vid);
         else
-                __vlan_delete_pvid(vg, v->vid);
+                ret = __vlan_delete_pvid(vg, v->vid);
 
         if (flags & BRIDGE_VLAN_INFO_UNTAGGED)
                 v->flags |= BRIDGE_VLAN_INFO_UNTAGGED;
         else
                 v->flags &= ~BRIDGE_VLAN_INFO_UNTAGGED;
+
+        return ret || !!(old_flags ^ v->flags);
 }
 
 static int __vlan_vid_add(struct net_device *dev, struct net_bridge *br,
@@ -151,8 +160,10 @@ static struct net_bridge_vlan *br_vlan_get_master(struct net_bridge *br, u16 vid
         vg = br_vlan_group(br);
         masterv = br_vlan_find(vg, vid);
         if (!masterv) {
+                bool changed;
+
                 /* missing global ctx, create it now */
-                if (br_vlan_add(br, vid, 0))
+                if (br_vlan_add(br, vid, 0, &changed))
                         return NULL;
                 masterv = br_vlan_find(vg, vid);
                 if (WARN_ON(!masterv))
@@ -232,8 +243,11 @@ static int __vlan_add(struct net_bridge_vlan *v, u16 flags)
 
                 /* need to work on the master vlan too */
                 if (flags & BRIDGE_VLAN_INFO_MASTER) {
-                        err = br_vlan_add(br, v->vid, flags |
-                                                      BRIDGE_VLAN_INFO_BRENTRY);
+                        bool changed;
+
+                        err = br_vlan_add(br, v->vid,
+                                          flags | BRIDGE_VLAN_INFO_BRENTRY,
+                                          &changed);
                         if (err)
                                 goto out_filt;
                 }
@@ -550,8 +564,9 @@ bool br_should_learn(struct net_bridge_port *p, struct sk_buff *skb, u16 *vid)
 
 /* Must be protected by RTNL.
  * Must be called with vid in range from 1 to 4094 inclusive.
+ * changed must be true only if the vlan was created or updated
  */
-int br_vlan_add(struct net_bridge *br, u16 vid, u16 flags)
+int br_vlan_add(struct net_bridge *br, u16 vid, u16 flags, bool *changed)
 {
         struct net_bridge_vlan_group *vg;
         struct net_bridge_vlan *vlan;
@@ -559,6 +574,7 @@ int br_vlan_add(struct net_bridge *br, u16 vid, u16 flags)
 
         ASSERT_RTNL();
 
+        *changed = false;
         vg = br_vlan_group(br);
         vlan = br_vlan_find(vg, vid);
         if (vlan) {
@@ -576,8 +592,11 @@ int br_vlan_add(struct net_bridge *br, u16 vid, u16 flags)
                         refcount_inc(&vlan->refcnt);
                         vlan->flags |= BRIDGE_VLAN_INFO_BRENTRY;
                         vg->num_vlans++;
+                        *changed = true;
                 }
-                __vlan_add_flags(vlan, flags);
+                if (__vlan_add_flags(vlan, flags))
+                        *changed = true;
+
                 return 0;
         }
 
@@ -600,6 +619,8 @@ int br_vlan_add(struct net_bridge *br, u16 vid, u16 flags)
         if (ret) {
                 free_percpu(vlan->stats);
                 kfree(vlan);
+        } else {
+                *changed = true;
         }
 
         return ret;
@@ -824,9 +845,10 @@ int __br_vlan_set_default_pvid(struct net_bridge *br, u16 pvid)
         const struct net_bridge_vlan *pvent;
         struct net_bridge_vlan_group *vg;
         struct net_bridge_port *p;
+        unsigned long *changed;
+        bool vlchange;
         u16 old_pvid;
         int err = 0;
-        unsigned long *changed;
 
         if (!pvid) {
                 br_vlan_disable_default_pvid(br);
@@ -850,7 +872,8 @@ int __br_vlan_set_default_pvid(struct net_bridge *br, u16 pvid)
                 err = br_vlan_add(br, pvid,
                                   BRIDGE_VLAN_INFO_PVID |
                                   BRIDGE_VLAN_INFO_UNTAGGED |
-                                  BRIDGE_VLAN_INFO_BRENTRY);
+                                  BRIDGE_VLAN_INFO_BRENTRY,
+                                  &vlchange);
                 if (err)
                         goto out;
                 br_vlan_delete(br, old_pvid);
@@ -869,7 +892,8 @@ int __br_vlan_set_default_pvid(struct net_bridge *br, u16 pvid)
 
                 err = nbp_vlan_add(p, pvid,
                                    BRIDGE_VLAN_INFO_PVID |
-                                   BRIDGE_VLAN_INFO_UNTAGGED);
+                                   BRIDGE_VLAN_INFO_UNTAGGED,
+                                   &vlchange);
                 if (err)
                         goto err_port;
                 nbp_vlan_delete(p, old_pvid);
@@ -890,7 +914,8 @@ err_port:
                 if (old_pvid)
                         nbp_vlan_add(p, old_pvid,
                                      BRIDGE_VLAN_INFO_PVID |
-                                     BRIDGE_VLAN_INFO_UNTAGGED);
+                                     BRIDGE_VLAN_INFO_UNTAGGED,
+                                     &vlchange);
                 nbp_vlan_delete(p, pvid);
         }
 
@@ -899,7 +924,8 @@ err_port:
                         br_vlan_add(br, old_pvid,
                                     BRIDGE_VLAN_INFO_PVID |
                                     BRIDGE_VLAN_INFO_UNTAGGED |
-                                    BRIDGE_VLAN_INFO_BRENTRY);
+                                    BRIDGE_VLAN_INFO_BRENTRY,
+                                    &vlchange);
                 br_vlan_delete(br, pvid);
         }
         goto out;
@@ -931,6 +957,7 @@ int br_vlan_init(struct net_bridge *br)
 {
         struct net_bridge_vlan_group *vg;
         int ret = -ENOMEM;
+        bool changed;
 
         vg = kzalloc(sizeof(*vg), GFP_KERNEL);
         if (!vg)
@@ -947,7 +974,7 @@ int br_vlan_init(struct net_bridge *br)
         rcu_assign_pointer(br->vlgrp, vg);
         ret = br_vlan_add(br, 1,
                           BRIDGE_VLAN_INFO_PVID | BRIDGE_VLAN_INFO_UNTAGGED |
-                          BRIDGE_VLAN_INFO_BRENTRY);
+                          BRIDGE_VLAN_INFO_BRENTRY, &changed);
         if (ret)
                 goto err_vlan_add;
 
@@ -992,9 +1019,12 @@ int nbp_vlan_init(struct net_bridge_port *p)
         INIT_LIST_HEAD(&vg->vlan_list);
         rcu_assign_pointer(p->vlgrp, vg);
         if (p->br->default_pvid) {
+                bool changed;
+
                 ret = nbp_vlan_add(p, p->br->default_pvid,
                                    BRIDGE_VLAN_INFO_PVID |
-                                   BRIDGE_VLAN_INFO_UNTAGGED);
+                                   BRIDGE_VLAN_INFO_UNTAGGED,
+                                   &changed);
                 if (ret)
                         goto err_vlan_add;
         }
@@ -1016,8 +1046,10 @@ err_vlan_enabled:
 
 /* Must be protected by RTNL.
  * Must be called with vid in range from 1 to 4094 inclusive.
+ * changed must be true only if the vlan was created or updated
  */
-int nbp_vlan_add(struct net_bridge_port *port, u16 vid, u16 flags)
+int nbp_vlan_add(struct net_bridge_port *port, u16 vid, u16 flags,
+                 bool *changed)
 {
         struct switchdev_obj_port_vlan v = {
                 .obj.orig_dev = port->dev,
@@ -1031,13 +1063,15 @@ int nbp_vlan_add(struct net_bridge_port *port, u16 vid, u16 flags)
 
         ASSERT_RTNL();
 
+        *changed = false;
         vlan = br_vlan_find(nbp_vlan_group(port), vid);
         if (vlan) {
                 /* Pass the flags to the hardware bridge */
                 ret = switchdev_port_obj_add(port->dev, &v.obj);
                 if (ret && ret != -EOPNOTSUPP)
                         return ret;
-                __vlan_add_flags(vlan, flags);
+                *changed = __vlan_add_flags(vlan, flags);
+
                 return 0;
         }
 
@@ -1050,6 +1084,8 @@ int nbp_vlan_add(struct net_bridge_port *port, u16 vid, u16 flags)
         ret = __vlan_add(vlan, flags);
         if (ret)
                 kfree(vlan);
+        else
+                *changed = true;
 
         return ret;
 }
diff --git a/net/bridge/netfilter/ebtables.c b/net/bridge/netfilter/ebtables.c
index 3b3dcf719e07..37817d25b63d 100644
--- a/net/bridge/netfilter/ebtables.c
+++ b/net/bridge/netfilter/ebtables.c
@@ -2112,9 +2112,8 @@ static int size_entry_mwt(struct ebt_entry *entry, const unsigned char *base,
         for (i = 0, j = 1 ; j < 4 ; j++, i++) {
                 struct compat_ebt_entry_mwt *match32;
                 unsigned int size;
-                char *buf = buf_start;
+                char *buf = buf_start + offsets[i];
 
-                buf = buf_start + offsets[i];
                 if (offsets[i] > offsets[j])
                         return -EINVAL;
 
diff --git a/net/can/af_can.c b/net/can/af_can.c
index ecd5c703d11e..003b2d6d655f 100644
--- a/net/can/af_can.c
+++ b/net/can/af_can.c
@@ -887,8 +887,8 @@ static int can_pernet_init(struct net *net)
         if (IS_ENABLED(CONFIG_PROC_FS)) {
                 /* the statistics are updated every second (timer triggered) */
                 if (stats_timer) {
-                        setup_timer(&net->can.can_stattimer, can_stat_update,
-                                    (unsigned long)net);
+                        timer_setup(&net->can.can_stattimer, can_stat_update,
+                                    0);
                         mod_timer(&net->can.can_stattimer,
                                   round_jiffies(jiffies + HZ));
                 }
diff --git a/net/can/af_can.h b/net/can/af_can.h
index d0ef45bb2a72..eca6463c6213 100644
--- a/net/can/af_can.h
+++ b/net/can/af_can.h
@@ -113,6 +113,6 @@ struct s_pstats {
 /* function prototypes for the CAN networklayer procfs (proc.c) */
 void can_init_proc(struct net *net);
 void can_remove_proc(struct net *net);
-void can_stat_update(unsigned long data);
+void can_stat_update(struct timer_list *t);
 
 #endif /* AF_CAN_H */
diff --git a/net/can/proc.c b/net/can/proc.c
index 83045f00c63c..0c59f876fe6f 100644
--- a/net/can/proc.c
+++ b/net/can/proc.c
@@ -115,9 +115,9 @@ static unsigned long calc_rate(unsigned long oldjif, unsigned long newjif,
         return rate;
 }
 
-void can_stat_update(unsigned long data)
+void can_stat_update(struct timer_list *t)
 {
-        struct net *net = (struct net *)data;
+        struct net *net = from_timer(net, t, can.can_stattimer);
         struct s_stats *can_stats = net->can.can_stats;
         unsigned long j = jiffies; /* snapshot */
 
diff --git a/net/ceph/ceph_hash.c b/net/ceph/ceph_hash.c
index 67bb1f11e613..9a5850f264ed 100644
--- a/net/ceph/ceph_hash.c
+++ b/net/ceph/ceph_hash.c
@@ -47,28 +47,38 @@ unsigned int ceph_str_hash_rjenkins(const char *str, unsigned int length)
 
         /* handle the last 11 bytes */
         c = c + length;
-        switch (len) {            /* all the case statements fall through */
+        switch (len) {
         case 11:
                 c = c + ((__u32)k[10] << 24);
+                /* fall through */
         case 10:
                 c = c + ((__u32)k[9] << 16);
+                /* fall through */
         case 9:
                 c = c + ((__u32)k[8] << 8);
                 /* the first byte of c is reserved for the length */
+                /* fall through */
         case 8:
                 b = b + ((__u32)k[7] << 24);
+                /* fall through */
         case 7:
                 b = b + ((__u32)k[6] << 16);
+                /* fall through */
         case 6:
                 b = b + ((__u32)k[5] << 8);
+                /* fall through */
         case 5:
                 b = b + k[4];
+                /* fall through */
         case 4:
                 a = a + ((__u32)k[3] << 24);
+                /* fall through */
         case 3:
                 a = a + ((__u32)k[2] << 16);
+                /* fall through */
         case 2:
                 a = a + ((__u32)k[1] << 8);
+                /* fall through */
         case 1:
                 a = a + k[0];
                 /* case 0: nothing left to add */
diff --git a/net/ceph/crypto.c b/net/ceph/crypto.c
index 489610ac1cdd..bf9d079cbafd 100644
--- a/net/ceph/crypto.c
+++ b/net/ceph/crypto.c
@@ -37,7 +37,9 @@ static int set_secret(struct ceph_crypto_key *key, void *buf)
                 return -ENOTSUPP;
         }
 
-        WARN_ON(!key->len);
+        if (!key->len)
+                return -EINVAL;
+
         key->key = kmemdup(buf, key->len, GFP_NOIO);
         if (!key->key) {
                 ret = -ENOMEM;
diff --git a/net/ceph/messenger.c b/net/ceph/messenger.c
index ad93342c90d7..8a4d3758030b 100644
--- a/net/ceph/messenger.c
+++ b/net/ceph/messenger.c
@@ -430,6 +430,7 @@ static void ceph_sock_state_change(struct sock *sk)
         switch (sk->sk_state) {
         case TCP_CLOSE:
                 dout("%s TCP_CLOSE\n", __func__);
+                /* fall through */
         case TCP_CLOSE_WAIT:
                 dout("%s TCP_CLOSE_WAIT\n", __func__);
                 con_sock_state_closing(con);
diff --git a/net/ceph/mon_client.c b/net/ceph/mon_client.c
index 9ae1bab8c05d..1547107f4854 100644
--- a/net/ceph/mon_client.c
+++ b/net/ceph/mon_client.c
@@ -1279,9 +1279,10 @@ static struct ceph_msg *mon_alloc_msg(struct ceph_connection *con,
 
                 /*
                  * Older OSDs don't set reply tid even if the orignal
-                 * request had a non-zero tid.  Workaround this weirdness
-                 * by falling through to the allocate case.
+                 * request had a non-zero tid.  Work around this weirdness
+                 * by allocating a new message.
                  */
+                /* fall through */
         case CEPH_MSG_MON_MAP:
         case CEPH_MSG_MDS_MAP:
         case CEPH_MSG_OSD_MAP:
diff --git a/net/ceph/pagevec.c b/net/ceph/pagevec.c
index ee43bc13221c..a3d0adc828e6 100644
--- a/net/ceph/pagevec.c
+++ b/net/ceph/pagevec.c
@@ -25,9 +25,9 @@ struct page **ceph_get_direct_page_vector(const void __user *data,
                 return ERR_PTR(-ENOMEM);
 
         while (got < num_pages) {
-                rc = get_user_pages_unlocked(
+                rc = get_user_pages_fast(
                     (unsigned long)data + ((unsigned long)got * PAGE_SIZE),
-                    num_pages - got, pages + got, write_page ? FOLL_WRITE : 0);
+                    num_pages - got, write_page, pages + got);
                 if (rc < 0)
                         break;
                 BUG_ON(rc == 0);
diff --git a/net/core/datagram.c b/net/core/datagram.c
index 3964c108b169..522873ed120b 100644
--- a/net/core/datagram.c
+++ b/net/core/datagram.c
@@ -189,7 +189,7 @@ struct sk_buff *__skb_try_recv_from_queue(struct sock *sk,
                         }
                         if (!skb->len) {
                                 skb = skb_set_peeked(skb);
-                                if (unlikely(IS_ERR(skb))) {
+                                if (IS_ERR(skb)) {
                                         *err = PTR_ERR(skb);
                                         return NULL;
                                 }
diff --git a/net/core/dev.c b/net/core/dev.c
index 61559ca3980b..8ee29f4f5fa9 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -145,6 +145,7 @@
 #include <linux/crash_dump.h>
 #include <linux/sctp.h>
 #include <net/udp_tunnel.h>
+#include <linux/net_namespace.h>
 
 #include "net-sysfs.h"
 
@@ -162,7 +163,6 @@ static struct list_head offload_base __read_mostly;
 
 static int netif_rx_internal(struct sk_buff *skb);
 static int call_netdevice_notifiers_info(unsigned long val,
-                                         struct net_device *dev,
                                          struct netdev_notifier_info *info);
 static struct napi_struct *napi_by_id(unsigned int napi_id);
 
@@ -188,6 +188,8 @@ static struct napi_struct *napi_by_id(unsigned int napi_id);
 DEFINE_RWLOCK(dev_base_lock);
 EXPORT_SYMBOL(dev_base_lock);
 
+static DEFINE_MUTEX(ifalias_mutex);
+
 /* protects napi_hash addition/deletion and napi_gen_id */
 static DEFINE_SPINLOCK(napi_hash_lock);
 
@@ -1062,7 +1064,10 @@ static int __dev_alloc_name(struct net *net, const char *name, char *buf)
         unsigned long *inuse;
         struct net_device *d;
 
-        p = strnchr(name, IFNAMSIZ-1, '%');
+        if (!dev_valid_name(name))
+                return -EINVAL;
+
+        p = strchr(name, '%');
         if (p) {
                 /*
                  * Verify the string as this thing may have come from
@@ -1093,8 +1098,7 @@ static int __dev_alloc_name(struct net *net, const char *name, char *buf)
                 free_page((unsigned long) inuse);
         }
 
-        if (buf != name)
-                snprintf(buf, IFNAMSIZ, name, i);
+        snprintf(buf, IFNAMSIZ, name, i);
         if (!__dev_get_by_name(net, buf))
                 return i;
 
@@ -1102,7 +1106,21 @@ static int __dev_alloc_name(struct net *net, const char *name, char *buf)
          * when the name is long and there isn't enough space left
          * for the digits, or if all bits are used.
          */
-        return -ENFILE;
+        return p ? -ENFILE : -EEXIST;
+}
+
+static int dev_alloc_name_ns(struct net *net,
+                             struct net_device *dev,
+                             const char *name)
+{
+        char buf[IFNAMSIZ];
+        int ret;
+
+        BUG_ON(!net);
+        ret = __dev_alloc_name(net, name, buf);
+        if (ret >= 0)
+                strlcpy(dev->name, buf, IFNAMSIZ);
+        return ret;
 }
 
 /**
@@ -1121,48 +1139,14 @@ static int __dev_alloc_name(struct net *net, const char *name, char *buf)
 
 int dev_alloc_name(struct net_device *dev, const char *name)
 {
-        char buf[IFNAMSIZ];
-        struct net *net;
-        int ret;
-
-        BUG_ON(!dev_net(dev));
-        net = dev_net(dev);
-        ret = __dev_alloc_name(net, name, buf);
-        if (ret >= 0)
-                strlcpy(dev->name, buf, IFNAMSIZ);
-        return ret;
+        return dev_alloc_name_ns(dev_net(dev), dev, name);
 }
 EXPORT_SYMBOL(dev_alloc_name);
 
-static int dev_alloc_name_ns(struct net *net,
-                             struct net_device *dev,
-                             const char *name)
-{
-        char buf[IFNAMSIZ];
-        int ret;
-
-        ret = __dev_alloc_name(net, name, buf);
-        if (ret >= 0)
-                strlcpy(dev->name, buf, IFNAMSIZ);
-        return ret;
-}
-
 int dev_get_valid_name(struct net *net, struct net_device *dev,
                        const char *name)
 {
-        BUG_ON(!net);
-
-        if (!dev_valid_name(name))
-                return -EINVAL;
-
-        if (strchr(name, '%'))
-                return dev_alloc_name_ns(net, dev, name);
-        else if (__dev_get_by_name(net, name))
-                return -EEXIST;
-        else if (dev->name != name)
-                strlcpy(dev->name, name, IFNAMSIZ);
-
-        return 0;
+        return dev_alloc_name_ns(net, dev, name);
 }
 EXPORT_SYMBOL(dev_get_valid_name);
 
@@ -1265,29 +1249,53 @@ rollback:
  */
 int dev_set_alias(struct net_device *dev, const char *alias, size_t len)
 {
-        char *new_ifalias;
-
-        ASSERT_RTNL();
+        struct dev_ifalias *new_alias = NULL;
 
         if (len >= IFALIASZ)
                 return -EINVAL;
 
-        if (!len) {
-                kfree(dev->ifalias);
-                dev->ifalias = NULL;
-                return 0;
+        if (len) {
+                new_alias = kmalloc(sizeof(*new_alias) + len + 1, GFP_KERNEL);
+                if (!new_alias)
+                        return -ENOMEM;
+
+                memcpy(new_alias->ifalias, alias, len);
+                new_alias->ifalias[len] = 0;
         }
 
-        new_ifalias = krealloc(dev->ifalias, len + 1, GFP_KERNEL);
-        if (!new_ifalias)
-                return -ENOMEM;
-        dev->ifalias = new_ifalias;
-        memcpy(dev->ifalias, alias, len);
-        dev->ifalias[len] = 0;
+        mutex_lock(&ifalias_mutex);
+        rcu_swap_protected(dev->ifalias, new_alias,
+                           mutex_is_locked(&ifalias_mutex));
+        mutex_unlock(&ifalias_mutex);
+
+        if (new_alias)
+                kfree_rcu(new_alias, rcuhead);
 
         return len;
 }
 
+/**
+ *      dev_get_alias - get ifalias of a device
+ *      @dev: device
+ *      @name: buffer to store name of ifalias
+ *      @len: size of buffer
+ *
+ *      get ifalias for a device.  Caller must make sure dev cannot go
+ *      away,  e.g. rcu read lock or own a reference count to device.
+ */
+int dev_get_alias(const struct net_device *dev, char *name, size_t len)
+{
+        const struct dev_ifalias *alias;
+        int ret = 0;
+
+        rcu_read_lock();
+        alias = rcu_dereference(dev->ifalias);
+        if (alias)
+                ret = snprintf(name, len, "%s", alias->ifalias);
+        rcu_read_unlock();
+
+        return ret;
+}
 
 /**
  *      netdev_features_change - device changes features
@@ -1312,10 +1320,11 @@ EXPORT_SYMBOL(netdev_features_change);
 void netdev_state_change(struct net_device *dev)
 {
         if (dev->flags & IFF_UP) {
-                struct netdev_notifier_change_info change_info;
+                struct netdev_notifier_change_info change_info = {
+                        .info.dev = dev,
+                };
 
-                change_info.flags_changed = 0;
-                call_netdevice_notifiers_info(NETDEV_CHANGE, dev,
+                call_netdevice_notifiers_info(NETDEV_CHANGE,
                                               &change_info.info);
                 rtmsg_ifinfo(RTM_NEWLINK, dev, 0, GFP_KERNEL);
         }
@@ -1536,9 +1545,10 @@ EXPORT_SYMBOL(dev_disable_lro);
 static int call_netdevice_notifier(struct notifier_block *nb, unsigned long val,
                                    struct net_device *dev)
 {
-        struct netdev_notifier_info info;
+        struct netdev_notifier_info info = {
+                .dev = dev,
+        };
 
-        netdev_notifier_info_init(&info, dev);
         return nb->notifier_call(nb, val, &info);
 }
 
@@ -1663,11 +1673,9 @@ EXPORT_SYMBOL(unregister_netdevice_notifier);
  */
 
 static int call_netdevice_notifiers_info(unsigned long val,
-                                         struct net_device *dev,
                                          struct netdev_notifier_info *info)
 {
         ASSERT_RTNL();
-        netdev_notifier_info_init(info, dev);
         return raw_notifier_call_chain(&netdev_chain, val, info);
 }
 
@@ -1682,9 +1690,11 @@ static int call_netdevice_notifiers_info(unsigned long val,
 
 int call_netdevice_notifiers(unsigned long val, struct net_device *dev)
 {
-        struct netdev_notifier_info info;
+        struct netdev_notifier_info info = {
+                .dev = dev,
+        };
 
-        return call_netdevice_notifiers_info(val, dev, &info);
+        return call_netdevice_notifiers_info(val, &info);
 }
 EXPORT_SYMBOL(call_netdevice_notifiers);
 
@@ -2012,6 +2022,7 @@ int netdev_txq_to_tc(struct net_device *dev, unsigned int txq)
 
         return 0;
 }
+EXPORT_SYMBOL(netdev_txq_to_tc);
 
 #ifdef CONFIG_XPS
 static DEFINE_MUTEX(xps_map_mutex);
@@ -3245,22 +3256,22 @@ EXPORT_SYMBOL(dev_loopback_xmit);
 static struct sk_buff *
 sch_handle_egress(struct sk_buff *skb, int *ret, struct net_device *dev)
 {
-        struct tcf_proto *cl = rcu_dereference_bh(dev->egress_cl_list);
+        struct mini_Qdisc *miniq = rcu_dereference_bh(dev->miniq_egress);
         struct tcf_result cl_res;
 
-        if (!cl)
+        if (!miniq)
                 return skb;
 
         /* qdisc_skb_cb(skb)->pkt_len was already set by the caller. */
-        qdisc_bstats_cpu_update(cl->q, skb);
+        mini_qdisc_bstats_cpu_update(miniq, skb);
 
-        switch (tcf_classify(skb, cl, &cl_res, false)) {
+        switch (tcf_classify(skb, miniq->filter_list, &cl_res, false)) {
         case TC_ACT_OK:
         case TC_ACT_RECLASSIFY:
                 skb->tc_index = TC_H_MIN(cl_res.classid);
                 break;
         case TC_ACT_SHOT:
-                qdisc_qstats_cpu_drop(cl->q);
+                mini_qdisc_qstats_cpu_drop(miniq);
                 *ret = NET_XMIT_DROP;
                 kfree_skb(skb);
                 return NULL;
@@ -3864,8 +3875,8 @@ drop:
 static u32 netif_receive_generic_xdp(struct sk_buff *skb,
                                      struct bpf_prog *xdp_prog)
 {
+        u32 metalen, act = XDP_DROP;
         struct xdp_buff xdp;
-        u32 act = XDP_DROP;
         void *orig_data;
         int hlen, off;
         u32 mac_len;
@@ -3876,8 +3887,25 @@ static u32 netif_receive_generic_xdp(struct sk_buff *skb,
         if (skb_cloned(skb))
                 return XDP_PASS;
 
-        if (skb_linearize(skb))
-                goto do_drop;
+        /* XDP packets must be linear and must have sufficient headroom
+         * of XDP_PACKET_HEADROOM bytes. This is the guarantee that also
+         * native XDP provides, thus we need to do it here as well.
+         */
+        if (skb_is_nonlinear(skb) ||
+            skb_headroom(skb) < XDP_PACKET_HEADROOM) {
+                int hroom = XDP_PACKET_HEADROOM - skb_headroom(skb);
+                int troom = skb->tail + skb->data_len - skb->end;
+
+                /* In case we have to go down the path and also linearize,
+                 * then lets do the pskb_expand_head() work just once here.
+                 */
+                if (pskb_expand_head(skb,
+                                     hroom > 0 ? ALIGN(hroom, NET_SKB_PAD) : 0,
+                                     troom > 0 ? troom + 128 : 0, GFP_ATOMIC))
+                        goto do_drop;
+                if (troom > 0 && __skb_linearize(skb))
+                        goto do_drop;
+        }
 
         /* The XDP program wants to see the packet starting at the MAC
          * header.
@@ -3885,6 +3913,7 @@ static u32 netif_receive_generic_xdp(struct sk_buff *skb,
         mac_len = skb->data - skb_mac_header(skb);
         hlen = skb_headlen(skb) + mac_len;
         xdp.data = skb->data - mac_len;
+        xdp.data_meta = xdp.data;
         xdp.data_end = xdp.data + hlen;
         xdp.data_hard_start = skb->data - skb_headroom(skb);
         orig_data = xdp.data;
@@ -3902,10 +3931,12 @@ static u32 netif_receive_generic_xdp(struct sk_buff *skb,
         case XDP_REDIRECT:
         case XDP_TX:
                 __skb_push(skb, mac_len);
-                /* fall through */
+                break;
         case XDP_PASS:
+                metalen = xdp.data - xdp.data_meta;
+                if (metalen)
+                        skb_metadata_set(skb, metalen);
                 break;
-
         default:
                 bpf_warn_invalid_xdp_action(act);
                 /* fall through */
@@ -4140,7 +4171,7 @@ sch_handle_ingress(struct sk_buff *skb, struct packet_type **pt_prev, int *ret,
                    struct net_device *orig_dev)
 {
 #ifdef CONFIG_NET_CLS_ACT
-        struct tcf_proto *cl = rcu_dereference_bh(skb->dev->ingress_cl_list);
+        struct mini_Qdisc *miniq = rcu_dereference_bh(skb->dev->miniq_ingress);
         struct tcf_result cl_res;
 
         /* If there's at least one ingress present somewhere (so
@@ -4148,8 +4179,9 @@ sch_handle_ingress(struct sk_buff *skb, struct packet_type **pt_prev, int *ret,
          * that are not configured with an ingress qdisc will bail
          * out here.
          */
-        if (!cl)
+        if (!miniq)
                 return skb;
+
         if (*pt_prev) {
                 *ret = deliver_skb(skb, *pt_prev, orig_dev);
                 *pt_prev = NULL;
@@ -4157,15 +4189,15 @@ sch_handle_ingress(struct sk_buff *skb, struct packet_type **pt_prev, int *ret,
 
         qdisc_skb_cb(skb)->pkt_len = skb->len;
         skb->tc_at_ingress = 1;
-        qdisc_bstats_cpu_update(cl->q, skb);
+        mini_qdisc_bstats_cpu_update(miniq, skb);
 
-        switch (tcf_classify(skb, cl, &cl_res, false)) {
+        switch (tcf_classify(skb, miniq->filter_list, &cl_res, false)) {
         case TC_ACT_OK:
         case TC_ACT_RECLASSIFY:
                 skb->tc_index = TC_H_MIN(cl_res.classid);
                 break;
         case TC_ACT_SHOT:
-                qdisc_qstats_cpu_drop(cl->q);
+                mini_qdisc_qstats_cpu_drop(miniq);
                 kfree_skb(skb);
                 return NULL;
         case TC_ACT_STOLEN:
@@ -4443,6 +4475,33 @@ out:
         return ret;
 }
 
+/**
+ *      netif_receive_skb_core - special purpose version of netif_receive_skb
+ *      @skb: buffer to process
+ *
+ *      More direct receive version of netif_receive_skb().  It should
+ *      only be used by callers that have a need to skip RPS and Generic XDP.
+ *      Caller must also take care of handling if (page_is_)pfmemalloc.
+ *
+ *      This function may only be called from softirq context and interrupts
+ *      should be enabled.
+ *
+ *      Return values (usually ignored):
+ *      NET_RX_SUCCESS: no congestion
+ *      NET_RX_DROP: packet was dropped
+ */
+int netif_receive_skb_core(struct sk_buff *skb)
+{
+        int ret;
+
+        rcu_read_lock();
+        ret = __netif_receive_skb_core(skb, false);
+        rcu_read_unlock();
+
+        return ret;
+}
+EXPORT_SYMBOL(netif_receive_skb_core);
+
 static int __netif_receive_skb(struct sk_buff *skb)
 {
         int ret;
@@ -4468,7 +4527,7 @@ static int __netif_receive_skb(struct sk_buff *skb)
         return ret;
 }
 
-static int generic_xdp_install(struct net_device *dev, struct netdev_xdp *xdp)
+static int generic_xdp_install(struct net_device *dev, struct netdev_bpf *xdp)
 {
         struct bpf_prog *old = rtnl_dereference(dev->xdp_prog);
         struct bpf_prog *new = xdp->prog;
@@ -4695,6 +4754,7 @@ static void gro_list_prepare(struct napi_struct *napi, struct sk_buff *skb)
                 diffs = (unsigned long)p->dev ^ (unsigned long)skb->dev;
                 diffs |= p->vlan_tci ^ skb->vlan_tci;
                 diffs |= skb_metadata_dst_cmp(p, skb);
+                diffs |= skb_metadata_differs(p, skb);
                 if (maclen == ETH_HLEN)
                         diffs |= compare_ether_header(skb_mac_header(p),
                                                       skb_mac_header(skb));
@@ -6228,9 +6288,19 @@ static void __netdev_adjacent_dev_unlink_neighbour(struct net_device *dev,
 
 static int __netdev_upper_dev_link(struct net_device *dev,
                                    struct net_device *upper_dev, bool master,
-                                   void *upper_priv, void *upper_info)
-{
-        struct netdev_notifier_changeupper_info changeupper_info;
+                                   void *upper_priv, void *upper_info,
+                                   struct netlink_ext_ack *extack)
+{
+        struct netdev_notifier_changeupper_info changeupper_info = {
+                .info = {
+                        .dev = dev,
+                        .extack = extack,
+                },
+                .upper_dev = upper_dev,
+                .master = master,
+                .linking = true,
+                .upper_info = upper_info,
+        };
         int ret = 0;
 
         ASSERT_RTNL();
@@ -6248,12 +6318,7 @@ static int __netdev_upper_dev_link(struct net_device *dev,
         if (master && netdev_master_upper_dev_get(dev))
                 return -EBUSY;
 
-        changeupper_info.upper_dev = upper_dev;
-        changeupper_info.master = master;
-        changeupper_info.linking = true;
-        changeupper_info.upper_info = upper_info;
-
-        ret = call_netdevice_notifiers_info(NETDEV_PRECHANGEUPPER, dev,
+        ret = call_netdevice_notifiers_info(NETDEV_PRECHANGEUPPER,
                                             &changeupper_info.info);
         ret = notifier_to_errno(ret);
         if (ret)
@@ -6264,7 +6329,7 @@ static int __netdev_upper_dev_link(struct net_device *dev,
         if (ret)
                 return ret;
 
-        ret = call_netdevice_notifiers_info(NETDEV_CHANGEUPPER, dev,
+        ret = call_netdevice_notifiers_info(NETDEV_CHANGEUPPER,
                                             &changeupper_info.info);
         ret = notifier_to_errno(ret);
         if (ret)
@@ -6289,9 +6354,11 @@ rollback:
  * returns zero.
  */
 int netdev_upper_dev_link(struct net_device *dev,
-                          struct net_device *upper_dev)
+                          struct net_device *upper_dev,
+                          struct netlink_ext_ack *extack)
 {
-        return __netdev_upper_dev_link(dev, upper_dev, false, NULL, NULL);
+        return __netdev_upper_dev_link(dev, upper_dev, false,
+                                       NULL, NULL, extack);
 }
 EXPORT_SYMBOL(netdev_upper_dev_link);
 
@@ -6310,10 +6377,11 @@ EXPORT_SYMBOL(netdev_upper_dev_link);
  */
 int netdev_master_upper_dev_link(struct net_device *dev,
                                  struct net_device *upper_dev,
-                                 void *upper_priv, void *upper_info)
+                                 void *upper_priv, void *upper_info,
+                                 struct netlink_ext_ack *extack)
 {
         return __netdev_upper_dev_link(dev, upper_dev, true,
-                                       upper_priv, upper_info);
+                                       upper_priv, upper_info, extack);
 }
 EXPORT_SYMBOL(netdev_master_upper_dev_link);
 
@@ -6328,20 +6396,24 @@ EXPORT_SYMBOL(netdev_master_upper_dev_link);
 void netdev_upper_dev_unlink(struct net_device *dev,
                              struct net_device *upper_dev)
 {
-        struct netdev_notifier_changeupper_info changeupper_info;
+        struct netdev_notifier_changeupper_info changeupper_info = {
+                .info = {
+                        .dev = dev,
+                },
+                .upper_dev = upper_dev,
+                .linking = false,
+        };
 
         ASSERT_RTNL();
 
-        changeupper_info.upper_dev = upper_dev;
         changeupper_info.master = netdev_master_upper_dev_get(dev) == upper_dev;
-        changeupper_info.linking = false;
 
-        call_netdevice_notifiers_info(NETDEV_PRECHANGEUPPER, dev,
+        call_netdevice_notifiers_info(NETDEV_PRECHANGEUPPER,
                                       &changeupper_info.info);
 
         __netdev_adjacent_dev_unlink_neighbour(dev, upper_dev);
 
-        call_netdevice_notifiers_info(NETDEV_CHANGEUPPER, dev,
+        call_netdevice_notifiers_info(NETDEV_CHANGEUPPER,
                                       &changeupper_info.info);
 }
 EXPORT_SYMBOL(netdev_upper_dev_unlink);
@@ -6357,11 +6429,13 @@ EXPORT_SYMBOL(netdev_upper_dev_unlink);
 void netdev_bonding_info_change(struct net_device *dev,
                                 struct netdev_bonding_info *bonding_info)
 {
-        struct netdev_notifier_bonding_info     info;
+        struct netdev_notifier_bonding_info info = {
+                .info.dev = dev,
+        };
 
         memcpy(&info.bonding_info, bonding_info,
                sizeof(struct netdev_bonding_info));
-        call_netdevice_notifiers_info(NETDEV_BONDING_INFO, dev,
+        call_netdevice_notifiers_info(NETDEV_BONDING_INFO,
                                       &info.info);
 }
 EXPORT_SYMBOL(netdev_bonding_info_change);
@@ -6487,11 +6561,13 @@ EXPORT_SYMBOL(dev_get_nest_level);
 void netdev_lower_state_changed(struct net_device *lower_dev,
                                 void *lower_state_info)
 {
-        struct netdev_notifier_changelowerstate_info changelowerstate_info;
+        struct netdev_notifier_changelowerstate_info changelowerstate_info = {
+                .info.dev = lower_dev,
+        };
 
         ASSERT_RTNL();
         changelowerstate_info.lower_state_info = lower_state_info;
-        call_netdevice_notifiers_info(NETDEV_CHANGELOWERSTATE, lower_dev,
+        call_netdevice_notifiers_info(NETDEV_CHANGELOWERSTATE,
                                       &changelowerstate_info.info);
 }
 EXPORT_SYMBOL(netdev_lower_state_changed);
@@ -6782,11 +6858,14 @@ void __dev_notify_flags(struct net_device *dev, unsigned int old_flags,
 
         if (dev->flags & IFF_UP &&
             (changes & ~(IFF_UP | IFF_PROMISC | IFF_ALLMULTI | IFF_VOLATILE))) {
-                struct netdev_notifier_change_info change_info;
+                struct netdev_notifier_change_info change_info = {
+                        .info = {
+                                .dev = dev,
+                        },
+                        .flags_changed = changes,
+                };
 
-                change_info.flags_changed = changes;
-                call_netdevice_notifiers_info(NETDEV_CHANGE, dev,
-                                              &change_info.info);
+                call_netdevice_notifiers_info(NETDEV_CHANGE, &change_info.info);
         }
 }
 
@@ -6993,26 +7072,26 @@ int dev_change_proto_down(struct net_device *dev, bool proto_down)
 }
 EXPORT_SYMBOL(dev_change_proto_down);
 
-u8 __dev_xdp_attached(struct net_device *dev, xdp_op_t xdp_op, u32 *prog_id)
+u8 __dev_xdp_attached(struct net_device *dev, bpf_op_t bpf_op, u32 *prog_id)
 {
-        struct netdev_xdp xdp;
+        struct netdev_bpf xdp;
 
         memset(&xdp, 0, sizeof(xdp));
         xdp.command = XDP_QUERY_PROG;
 
         /* Query must always succeed. */
-        WARN_ON(xdp_op(dev, &xdp) < 0);
+        WARN_ON(bpf_op(dev, &xdp) < 0);
         if (prog_id)
                 *prog_id = xdp.prog_id;
 
         return xdp.prog_attached;
 }
 
-static int dev_xdp_install(struct net_device *dev, xdp_op_t xdp_op,
+static int dev_xdp_install(struct net_device *dev, bpf_op_t bpf_op,
                            struct netlink_ext_ack *extack, u32 flags,
                            struct bpf_prog *prog)
 {
-        struct netdev_xdp xdp;
+        struct netdev_bpf xdp;
 
         memset(&xdp, 0, sizeof(xdp));
         if (flags & XDP_FLAGS_HW_MODE)
@@ -7023,7 +7102,7 @@ static int dev_xdp_install(struct net_device *dev, xdp_op_t xdp_op,
         xdp.flags = flags;
         xdp.prog = prog;
 
-        return xdp_op(dev, &xdp);
+        return bpf_op(dev, &xdp);
 }
 
 /**
@@ -7040,32 +7119,36 @@ int dev_change_xdp_fd(struct net_device *dev, struct netlink_ext_ack *extack,
 {
         const struct net_device_ops *ops = dev->netdev_ops;
         struct bpf_prog *prog = NULL;
-        xdp_op_t xdp_op, xdp_chk;
+        bpf_op_t bpf_op, bpf_chk;
         int err;
 
         ASSERT_RTNL();
 
-        xdp_op = xdp_chk = ops->ndo_xdp;
-        if (!xdp_op && (flags & (XDP_FLAGS_DRV_MODE | XDP_FLAGS_HW_MODE)))
+        bpf_op = bpf_chk = ops->ndo_bpf;
+        if (!bpf_op && (flags & (XDP_FLAGS_DRV_MODE | XDP_FLAGS_HW_MODE)))
                 return -EOPNOTSUPP;
-        if (!xdp_op || (flags & XDP_FLAGS_SKB_MODE))
-                xdp_op = generic_xdp_install;
-        if (xdp_op == xdp_chk)
-                xdp_chk = generic_xdp_install;
+        if (!bpf_op || (flags & XDP_FLAGS_SKB_MODE))
+                bpf_op = generic_xdp_install;
+        if (bpf_op == bpf_chk)
+                bpf_chk = generic_xdp_install;
 
         if (fd >= 0) {
-                if (xdp_chk && __dev_xdp_attached(dev, xdp_chk, NULL))
+                if (bpf_chk && __dev_xdp_attached(dev, bpf_chk, NULL))
                         return -EEXIST;
                 if ((flags & XDP_FLAGS_UPDATE_IF_NOEXIST) &&
-                    __dev_xdp_attached(dev, xdp_op, NULL))
+                    __dev_xdp_attached(dev, bpf_op, NULL))
                         return -EBUSY;
 
-                prog = bpf_prog_get_type(fd, BPF_PROG_TYPE_XDP);
+                if (bpf_op == ops->ndo_bpf)
+                        prog = bpf_prog_get_type_dev(fd, BPF_PROG_TYPE_XDP,
+                                                     dev);
+                else
+                        prog = bpf_prog_get_type(fd, BPF_PROG_TYPE_XDP);
                 if (IS_ERR(prog))
                         return PTR_ERR(prog);
         }
 
-        err = dev_xdp_install(dev, xdp_op, extack, flags, prog);
+        err = dev_xdp_install(dev, bpf_op, extack, flags, prog);
         if (err < 0 && prog)
                 bpf_prog_put(prog);
 
@@ -7157,7 +7240,7 @@ static void rollback_registered_many(struct list_head *head)
                 if (!dev->rtnl_link_ops ||
                     dev->rtnl_link_state == RTNL_LINK_INITIALIZED)
                         skb = rtmsg_ifinfo_build_skb(RTM_DELLINK, dev, ~0U, 0,
-                                                     GFP_KERNEL);
+                                                     GFP_KERNEL, NULL);
 
                 /*
                  *      Flush the unicast and multicast chains
@@ -7994,7 +8077,7 @@ struct net_device *alloc_netdev_mqs(int sizeof_priv, const char *name,
                 unsigned int txqs, unsigned int rxqs)
 {
         struct net_device *dev;
-        size_t alloc_size;
+        unsigned int alloc_size;
         struct net_device *p;
 
         BUG_ON(strlen(name) >= sizeof(dev->name));
@@ -8244,7 +8327,7 @@ EXPORT_SYMBOL(unregister_netdev);
 
 int dev_change_net_namespace(struct net_device *dev, struct net *net, const char *pat)
 {
-        int err;
+        int err, new_nsid;
 
         ASSERT_RTNL();
 
@@ -8300,7 +8383,11 @@ int dev_change_net_namespace(struct net_device *dev, struct net *net, const char
         call_netdevice_notifiers(NETDEV_UNREGISTER, dev);
         rcu_barrier();
         call_netdevice_notifiers(NETDEV_UNREGISTER_FINAL, dev);
-        rtmsg_ifinfo(RTM_DELLINK, dev, ~0U, GFP_KERNEL);
+        if (dev->rtnl_link_ops && dev->rtnl_link_ops->get_link_net)
+                new_nsid = peernet2id_alloc(dev_net(dev), net);
+        else
+                new_nsid = peernet2id(dev_net(dev), net);
+        rtmsg_ifinfo_newnet(RTM_DELLINK, dev, ~0U, GFP_KERNEL, &new_nsid);
 
         /*
          *      Flush the unicast and multicast chains
@@ -8562,6 +8649,8 @@ static void __net_exit netdev_exit(struct net *net)
 {
         kfree(net->dev_name_head);
         kfree(net->dev_index_head);
+        if (net != &init_net)
+                WARN_ON_ONCE(!list_empty(&net->dev_base_head));
 }
 
 static struct pernet_operations __net_initdata netdev_net_ops = {
diff --git a/net/core/drop_monitor.c b/net/core/drop_monitor.c
index 70ccda233bd1..c7785efeea57 100644
--- a/net/core/drop_monitor.c
+++ b/net/core/drop_monitor.c
@@ -144,9 +144,9 @@ static void send_dm_alert(struct work_struct *work)
  * in the event that more drops will arrive during the
  * hysteresis period.
  */
-static void sched_send_work(unsigned long _data)
+static void sched_send_work(struct timer_list *t)
 {
-        struct per_cpu_dm_data *data = (struct per_cpu_dm_data *)_data;
+        struct per_cpu_dm_data *data = from_timer(data, t, send_timer);
 
         schedule_work(&data->dm_alert_work);
 }
@@ -412,8 +412,7 @@ static int __init init_net_drop_monitor(void)
         for_each_possible_cpu(cpu) {
                 data = &per_cpu(dm_cpu_data, cpu);
                 INIT_WORK(&data->dm_alert_work, send_dm_alert);
-                setup_timer(&data->send_timer, sched_send_work,
-                            (unsigned long)data);
+                timer_setup(&data->send_timer, sched_send_work, 0);
                 spin_lock_init(&data->lock);
                 reset_per_cpu_data(data);
         }
diff --git a/net/core/dst.c b/net/core/dst.c
index a6c47da7d0f8..662a2d4a3d19 100644
--- a/net/core/dst.c
+++ b/net/core/dst.c
@@ -322,3 +322,19 @@ metadata_dst_alloc_percpu(u8 optslen, enum metadata_type type, gfp_t flags)
         return md_dst;
 }
 EXPORT_SYMBOL_GPL(metadata_dst_alloc_percpu);
+
+void metadata_dst_free_percpu(struct metadata_dst __percpu *md_dst)
+{
+#ifdef CONFIG_DST_CACHE
+        int cpu;
+
+        for_each_possible_cpu(cpu) {
+                struct metadata_dst *one_md_dst = per_cpu_ptr(md_dst, cpu);
+
+                if (one_md_dst->type == METADATA_IP_TUNNEL)
+                        dst_cache_destroy(&one_md_dst->u.tun_info.dst_cache);
+        }
+#endif
+        free_percpu(md_dst);
+}
+EXPORT_SYMBOL_GPL(metadata_dst_free_percpu);
diff --git a/net/core/ethtool.c b/net/core/ethtool.c
index 9a9a3d77e327..f8fcf450a36e 100644
--- a/net/core/ethtool.c
+++ b/net/core/ethtool.c
@@ -403,6 +403,22 @@ static int __ethtool_set_flags(struct net_device *dev, u32 data)
         return 0;
 }
 
+/* Given two link masks, AND them together and save the result in dst. */
+void ethtool_intersect_link_masks(struct ethtool_link_ksettings *dst,
+                                  struct ethtool_link_ksettings *src)
+{
+        unsigned int size = BITS_TO_LONGS(__ETHTOOL_LINK_MODE_MASK_NBITS);
+        unsigned int idx = 0;
+
+        for (; idx < size; idx++) {
+                dst->link_modes.supported[idx] &=
+                        src->link_modes.supported[idx];
+                dst->link_modes.advertising[idx] &=
+                        src->link_modes.advertising[idx];
+        }
+}
+EXPORT_SYMBOL(ethtool_intersect_link_masks);
+
 void ethtool_convert_legacy_u32_to_link_mode(unsigned long *dst,
                                              u32 legacy_u32)
 {
diff --git a/net/core/fib_notifier.c b/net/core/fib_notifier.c
index 4fc202dbdfb6..0c048bdeb016 100644
--- a/net/core/fib_notifier.c
+++ b/net/core/fib_notifier.c
@@ -34,12 +34,14 @@ static unsigned int fib_seq_sum(void)
 
         rtnl_lock();
         for_each_net(net) {
-                list_for_each_entry(ops, &net->fib_notifier_ops, list) {
+                rcu_read_lock();
+                list_for_each_entry_rcu(ops, &net->fib_notifier_ops, list) {
                         if (!try_module_get(ops->owner))
                                 continue;
                         fib_seq += ops->fib_seq_read(net);
                         module_put(ops->owner);
                 }
+                rcu_read_unlock();
         }
         rtnl_unlock();
 
@@ -161,8 +163,14 @@ static int __net_init fib_notifier_net_init(struct net *net)
         return 0;
 }
 
+static void __net_exit fib_notifier_net_exit(struct net *net)
+{
+        WARN_ON_ONCE(!list_empty(&net->fib_notifier_ops));
+}
+
 static struct pernet_operations fib_notifier_net_ops = {
         .init = fib_notifier_net_init,
+        .exit = fib_notifier_net_exit,
 };
 
 static int __init fib_notifier_init(void)
diff --git a/net/core/fib_rules.c b/net/core/fib_rules.c
index 9a6d97c1d810..98e1066c3d55 100644
--- a/net/core/fib_rules.c
+++ b/net/core/fib_rules.c
@@ -314,10 +314,12 @@ static int call_fib_rule_notifier(struct notifier_block *nb, struct net *net,
 static int call_fib_rule_notifiers(struct net *net,
                                    enum fib_event_type event_type,
                                    struct fib_rule *rule,
-                                   struct fib_rules_ops *ops)
+                                   struct fib_rules_ops *ops,
+                                   struct netlink_ext_ack *extack)
 {
         struct fib_rule_notifier_info info = {
                 .info.family = ops->family,
+                .info.extack = extack,
                 .rule = rule,
         };
 
@@ -609,7 +611,7 @@ int fib_nl_newrule(struct sk_buff *skb, struct nlmsghdr *nlh,
         if (rule->tun_id)
                 ip_tunnel_need_metadata();
 
-        call_fib_rule_notifiers(net, FIB_EVENT_RULE_ADD, rule, ops);
+        call_fib_rule_notifiers(net, FIB_EVENT_RULE_ADD, rule, ops, extack);
         notify_rule_change(RTM_NEWRULE, rule, ops, nlh, NETLINK_CB(skb).portid);
         flush_route_cache(ops);
         rules_ops_put(ops);
@@ -749,7 +751,8 @@ int fib_nl_delrule(struct sk_buff *skb, struct nlmsghdr *nlh,
                         }
                 }
 
-                call_fib_rule_notifiers(net, FIB_EVENT_RULE_DEL, rule, ops);
+                call_fib_rule_notifiers(net, FIB_EVENT_RULE_DEL, rule, ops,
+                                        NULL);
                 notify_rule_change(RTM_DELRULE, rule, ops, nlh,
                                    NETLINK_CB(skb).portid);
                 fib_rule_put(rule);
@@ -1019,8 +1022,14 @@ static int __net_init fib_rules_net_init(struct net *net)
         return 0;
 }
 
+static void __net_exit fib_rules_net_exit(struct net *net)
+{
+        WARN_ON_ONCE(!list_empty(&net->rules_ops));
+}
+
 static struct pernet_operations fib_rules_net_ops = {
         .init = fib_rules_net_init,
+        .exit = fib_rules_net_exit,
 };
 
 static int __init fib_rules_init(void)
diff --git a/net/core/filter.c b/net/core/filter.c
index 6ae94f825f72..1afa17935954 100644
--- a/net/core/filter.c
+++ b/net/core/filter.c
@@ -43,6 +43,7 @@
 #include <linux/timer.h>
 #include <linux/uaccess.h>
 #include <asm/unaligned.h>
+#include <asm/cmpxchg.h>
 #include <linux/filter.h>
 #include <linux/ratelimit.h>
 #include <linux/seccomp.h>
@@ -1406,7 +1407,7 @@ static inline int bpf_try_make_writable(struct sk_buff *skb,
 {
         int err = __bpf_try_make_writable(skb, write_len);
 
-        bpf_compute_data_end(skb);
+        bpf_compute_data_pointers(skb);
         return err;
 }
 
@@ -1968,7 +1969,7 @@ BPF_CALL_3(bpf_skb_vlan_push, struct sk_buff *, skb, __be16, vlan_proto,
         ret = skb_vlan_push(skb, vlan_proto, vlan_tci);
         bpf_pull_mac_rcsum(skb);
 
-        bpf_compute_data_end(skb);
+        bpf_compute_data_pointers(skb);
         return ret;
 }
 
@@ -1990,7 +1991,7 @@ BPF_CALL_1(bpf_skb_vlan_pop, struct sk_buff *, skb)
         ret = skb_vlan_pop(skb);
         bpf_pull_mac_rcsum(skb);
 
-        bpf_compute_data_end(skb);
+        bpf_compute_data_pointers(skb);
         return ret;
 }
 
@@ -2184,7 +2185,7 @@ BPF_CALL_3(bpf_skb_change_proto, struct sk_buff *, skb, __be16, proto,
          * need to be verified first.
          */
         ret = bpf_skb_proto_xlat(skb, proto);
-        bpf_compute_data_end(skb);
+        bpf_compute_data_pointers(skb);
         return ret;
 }
 
@@ -2309,7 +2310,7 @@ static int bpf_skb_adjust_net(struct sk_buff *skb, s32 len_diff)
         ret = shrink ? bpf_skb_net_shrink(skb, len_diff_abs) :
                        bpf_skb_net_grow(skb, len_diff_abs);
 
-        bpf_compute_data_end(skb);
+        bpf_compute_data_pointers(skb);
         return ret;
 }
 
@@ -2400,7 +2401,7 @@ BPF_CALL_3(bpf_skb_change_tail, struct sk_buff *, skb, u32, new_len,
                         skb_gso_reset(skb);
         }
 
-        bpf_compute_data_end(skb);
+        bpf_compute_data_pointers(skb);
         return ret;
 }
 
@@ -2440,7 +2441,7 @@ BPF_CALL_3(bpf_skb_change_head, struct sk_buff *, skb, u32, head_room,
                 skb_reset_mac_header(skb);
         }
 
-        bpf_compute_data_end(skb);
+        bpf_compute_data_pointers(skb);
         return 0;
 }
 
@@ -2453,14 +2454,26 @@ static const struct bpf_func_proto bpf_skb_change_head_proto = {
         .arg3_type      = ARG_ANYTHING,
 };
 
+static unsigned long xdp_get_metalen(const struct xdp_buff *xdp)
+{
+        return xdp_data_meta_unsupported(xdp) ? 0 :
+               xdp->data - xdp->data_meta;
+}
+
 BPF_CALL_2(bpf_xdp_adjust_head, struct xdp_buff *, xdp, int, offset)
 {
+        unsigned long metalen = xdp_get_metalen(xdp);
+        void *data_start = xdp->data_hard_start + metalen;
         void *data = xdp->data + offset;
 
-        if (unlikely(data < xdp->data_hard_start ||
+        if (unlikely(data < data_start ||
                      data > xdp->data_end - ETH_HLEN))
                 return -EINVAL;
 
+        if (metalen)
+                memmove(xdp->data_meta + offset,
+                        xdp->data_meta, metalen);
+        xdp->data_meta += offset;
         xdp->data = data;
 
         return 0;
@@ -2474,6 +2487,33 @@ static const struct bpf_func_proto bpf_xdp_adjust_head_proto = {
         .arg2_type      = ARG_ANYTHING,
 };
 
+BPF_CALL_2(bpf_xdp_adjust_meta, struct xdp_buff *, xdp, int, offset)
+{
+        void *meta = xdp->data_meta + offset;
+        unsigned long metalen = xdp->data - meta;
+
+        if (xdp_data_meta_unsupported(xdp))
+                return -ENOTSUPP;
+        if (unlikely(meta < xdp->data_hard_start ||
+                     meta > xdp->data))
+                return -EINVAL;
+        if (unlikely((metalen & (sizeof(__u32) - 1)) ||
+                     (metalen > 32)))
+                return -EACCES;
+
+        xdp->data_meta = meta;
+
+        return 0;
+}
+
+static const struct bpf_func_proto bpf_xdp_adjust_meta_proto = {
+        .func           = bpf_xdp_adjust_meta,
+        .gpl_only       = false,
+        .ret_type       = RET_INTEGER,
+        .arg1_type      = ARG_PTR_TO_CTX,
+        .arg2_type      = ARG_ANYTHING,
+};
+
 static int __bpf_tx_xdp(struct net_device *dev,
                         struct bpf_map *map,
                         struct xdp_buff *xdp,
@@ -2488,10 +2528,36 @@ static int __bpf_tx_xdp(struct net_device *dev,
         err = dev->netdev_ops->ndo_xdp_xmit(dev, xdp);
         if (err)
                 return err;
-        if (map)
+        dev->netdev_ops->ndo_xdp_flush(dev);
+        return 0;
+}
+
+static int __bpf_tx_xdp_map(struct net_device *dev_rx, void *fwd,
+                            struct bpf_map *map,
+                            struct xdp_buff *xdp,
+                            u32 index)
+{
+        int err;
+
+        if (map->map_type == BPF_MAP_TYPE_DEVMAP) {
+                struct net_device *dev = fwd;
+
+                if (!dev->netdev_ops->ndo_xdp_xmit)
+                        return -EOPNOTSUPP;
+
+                err = dev->netdev_ops->ndo_xdp_xmit(dev, xdp);
+                if (err)
+                        return err;
                 __dev_map_insert_ctx(map, index);
-        else
-                dev->netdev_ops->ndo_xdp_flush(dev);
+
+        } else if (map->map_type == BPF_MAP_TYPE_CPUMAP) {
+                struct bpf_cpu_map_entry *rcpu = fwd;
+
+                err = cpu_map_enqueue(rcpu, xdp, dev_rx);
+                if (err)
+                        return err;
+                __cpu_map_insert_ctx(map, index);
+        }
         return 0;
 }
 
@@ -2501,11 +2567,33 @@ void xdp_do_flush_map(void)
         struct bpf_map *map = ri->map_to_flush;
 
         ri->map_to_flush = NULL;
-        if (map)
-                __dev_map_flush(map);
+        if (map) {
+                switch (map->map_type) {
+                case BPF_MAP_TYPE_DEVMAP:
+                        __dev_map_flush(map);
+                        break;
+                case BPF_MAP_TYPE_CPUMAP:
+                        __cpu_map_flush(map);
+                        break;
+                default:
+                        break;
+                }
+        }
 }
 EXPORT_SYMBOL_GPL(xdp_do_flush_map);
 
+static void *__xdp_map_lookup_elem(struct bpf_map *map, u32 index)
+{
+        switch (map->map_type) {
+        case BPF_MAP_TYPE_DEVMAP:
+                return __dev_map_lookup_elem(map, index);
+        case BPF_MAP_TYPE_CPUMAP:
+                return __cpu_map_lookup_elem(map, index);
+        default:
+                return NULL;
+        }
+}
+
 static inline bool xdp_map_invalid(const struct bpf_prog *xdp_prog,
                                    unsigned long aux)
 {
@@ -2518,8 +2606,8 @@ static int xdp_do_redirect_map(struct net_device *dev, struct xdp_buff *xdp,
         struct redirect_info *ri = this_cpu_ptr(&redirect_info);
         unsigned long map_owner = ri->map_owner;
         struct bpf_map *map = ri->map;
-        struct net_device *fwd = NULL;
         u32 index = ri->ifindex;
+        void *fwd = NULL;
         int err;
 
         ri->ifindex = 0;
@@ -2532,7 +2620,7 @@ static int xdp_do_redirect_map(struct net_device *dev, struct xdp_buff *xdp,
                 goto err;
         }
 
-        fwd = __dev_map_lookup_elem(map, index);
+        fwd = __xdp_map_lookup_elem(map, index);
         if (!fwd) {
                 err = -EINVAL;
                 goto err;
@@ -2540,7 +2628,7 @@ static int xdp_do_redirect_map(struct net_device *dev, struct xdp_buff *xdp,
         if (ri->map_to_flush && ri->map_to_flush != map)
                 xdp_do_flush_map();
 
-        err = __bpf_tx_xdp(fwd, map, xdp, index);
+        err = __bpf_tx_xdp_map(dev, fwd, map, xdp, index);
         if (unlikely(err))
                 goto err;
 
@@ -2582,54 +2670,88 @@ err:
 }
 EXPORT_SYMBOL_GPL(xdp_do_redirect);
 
-int xdp_do_generic_redirect(struct net_device *dev, struct sk_buff *skb,
-                            struct bpf_prog *xdp_prog)
+static int __xdp_generic_ok_fwd_dev(struct sk_buff *skb, struct net_device *fwd)
+{
+        unsigned int len;
+
+        if (unlikely(!(fwd->flags & IFF_UP)))
+                return -ENETDOWN;
+
+        len = fwd->mtu + fwd->hard_header_len + VLAN_HLEN;
+        if (skb->len > len)
+                return -EMSGSIZE;
+
+        return 0;
+}
+
+int xdp_do_generic_redirect_map(struct net_device *dev, struct sk_buff *skb,
+                                struct bpf_prog *xdp_prog)
 {
         struct redirect_info *ri = this_cpu_ptr(&redirect_info);
         unsigned long map_owner = ri->map_owner;
         struct bpf_map *map = ri->map;
         struct net_device *fwd = NULL;
         u32 index = ri->ifindex;
-        unsigned int len;
         int err = 0;
 
         ri->ifindex = 0;
         ri->map = NULL;
         ri->map_owner = 0;
 
-        if (map) {
-                if (unlikely(xdp_map_invalid(xdp_prog, map_owner))) {
-                        err = -EFAULT;
-                        map = NULL;
-                        goto err;
-                }
-                fwd = __dev_map_lookup_elem(map, index);
-        } else {
-                fwd = dev_get_by_index_rcu(dev_net(dev), index);
+        if (unlikely(xdp_map_invalid(xdp_prog, map_owner))) {
+                err = -EFAULT;
+                map = NULL;
+                goto err;
         }
+        fwd = __xdp_map_lookup_elem(map, index);
         if (unlikely(!fwd)) {
                 err = -EINVAL;
                 goto err;
         }
 
-        if (unlikely(!(fwd->flags & IFF_UP))) {
-                err = -ENETDOWN;
+        if (map->map_type == BPF_MAP_TYPE_DEVMAP) {
+                if (unlikely((err = __xdp_generic_ok_fwd_dev(skb, fwd))))
+                        goto err;
+                skb->dev = fwd;
+        } else {
+                /* TODO: Handle BPF_MAP_TYPE_CPUMAP */
+                err = -EBADRQC;
                 goto err;
         }
 
-        len = fwd->mtu + fwd->hard_header_len + VLAN_HLEN;
-        if (skb->len > len) {
-                err = -EMSGSIZE;
+        _trace_xdp_redirect_map(dev, xdp_prog, fwd, map, index);
+        return 0;
+err:
+        _trace_xdp_redirect_map_err(dev, xdp_prog, fwd, map, index, err);
+        return err;
+}
+
+int xdp_do_generic_redirect(struct net_device *dev, struct sk_buff *skb,
+                            struct bpf_prog *xdp_prog)
+{
+        struct redirect_info *ri = this_cpu_ptr(&redirect_info);
+        u32 index = ri->ifindex;
+        struct net_device *fwd;
+        int err = 0;
+
+        if (ri->map)
+                return xdp_do_generic_redirect_map(dev, skb, xdp_prog);
+
+        ri->ifindex = 0;
+        fwd = dev_get_by_index_rcu(dev_net(dev), index);
+        if (unlikely(!fwd)) {
+                err = -EINVAL;
                 goto err;
         }
 
+        if (unlikely((err = __xdp_generic_ok_fwd_dev(skb, fwd))))
+                goto err;
+
         skb->dev = fwd;
-        map ? _trace_xdp_redirect_map(dev, xdp_prog, fwd, map, index)
-                : _trace_xdp_redirect(dev, xdp_prog, index);
+        _trace_xdp_redirect(dev, xdp_prog, index);
         return 0;
 err:
-        map ? _trace_xdp_redirect_map_err(dev, xdp_prog, fwd, map, index, err)
-                : _trace_xdp_redirect_err(dev, xdp_prog, index, err);
+        _trace_xdp_redirect_err(dev, xdp_prog, index, err);
         return err;
 }
 EXPORT_SYMBOL_GPL(xdp_do_generic_redirect);
@@ -2698,7 +2820,8 @@ bool bpf_helper_changes_pkt_data(void *func)
             func == bpf_clone_redirect ||
             func == bpf_l3_csum_replace ||
             func == bpf_l4_csum_replace ||
-            func == bpf_xdp_adjust_head)
+            func == bpf_xdp_adjust_head ||
+            func == bpf_xdp_adjust_meta)
                 return true;
 
         return false;
@@ -2949,14 +3072,15 @@ static const struct bpf_func_proto *
 bpf_get_skb_set_tunnel_proto(enum bpf_func_id which)
 {
         if (!md_dst) {
-                /* Race is not possible, since it's called from verifier
-                 * that is holding verifier mutex.
-                 */
-                md_dst = metadata_dst_alloc_percpu(IP_TUNNEL_OPTS_MAX,
-                                                   METADATA_IP_TUNNEL,
-                                                   GFP_KERNEL);
-                if (!md_dst)
+                struct metadata_dst __percpu *tmp;
+
+                tmp = metadata_dst_alloc_percpu(IP_TUNNEL_OPTS_MAX,
+                                                METADATA_IP_TUNNEL,
+                                                GFP_KERNEL);
+                if (!tmp)
                         return NULL;
+                if (cmpxchg(&md_dst, NULL, tmp))
+                        metadata_dst_free_percpu(tmp);
         }
 
         switch (which) {
@@ -3151,7 +3275,7 @@ BPF_CALL_5(bpf_setsockopt, struct bpf_sock_ops_kern *, bpf_sock,
 
 static const struct bpf_func_proto bpf_setsockopt_proto = {
         .func           = bpf_setsockopt,
-        .gpl_only       = true,
+        .gpl_only       = false,
         .ret_type       = RET_INTEGER,
         .arg1_type      = ARG_PTR_TO_CTX,
         .arg2_type      = ARG_ANYTHING,
@@ -3160,6 +3284,47 @@ static const struct bpf_func_proto bpf_setsockopt_proto = {
         .arg5_type      = ARG_CONST_SIZE,
 };
 
+BPF_CALL_5(bpf_getsockopt, struct bpf_sock_ops_kern *, bpf_sock,
+           int, level, int, optname, char *, optval, int, optlen)
+{
+        struct sock *sk = bpf_sock->sk;
+
+        if (!sk_fullsock(sk))
+                goto err_clear;
+
+#ifdef CONFIG_INET
+        if (level == SOL_TCP && sk->sk_prot->getsockopt == tcp_getsockopt) {
+                if (optname == TCP_CONGESTION) {
+                        struct inet_connection_sock *icsk = inet_csk(sk);
+
+                        if (!icsk->icsk_ca_ops || optlen <= 1)
+                                goto err_clear;
+                        strncpy(optval, icsk->icsk_ca_ops->name, optlen);
+                        optval[optlen - 1] = 0;
+                } else {
+                        goto err_clear;
+                }
+        } else {
+                goto err_clear;
+        }
+        return 0;
+#endif
+err_clear:
+        memset(optval, 0, optlen);
+        return -EINVAL;
+}
+
+static const struct bpf_func_proto bpf_getsockopt_proto = {
+        .func           = bpf_getsockopt,
+        .gpl_only       = false,
+        .ret_type       = RET_INTEGER,
+        .arg1_type      = ARG_PTR_TO_CTX,
+        .arg2_type      = ARG_ANYTHING,
+        .arg3_type      = ARG_ANYTHING,
+        .arg4_type      = ARG_PTR_TO_UNINIT_MEM,
+        .arg5_type      = ARG_CONST_SIZE,
+};
+
 static const struct bpf_func_proto *
 bpf_base_func_proto(enum bpf_func_id func_id)
 {
@@ -3294,6 +3459,8 @@ xdp_func_proto(enum bpf_func_id func_id)
                 return &bpf_get_smp_processor_id_proto;
         case BPF_FUNC_xdp_adjust_head:
                 return &bpf_xdp_adjust_head_proto;
+        case BPF_FUNC_xdp_adjust_meta:
+                return &bpf_xdp_adjust_meta_proto;
         case BPF_FUNC_redirect:
                 return &bpf_xdp_redirect_proto;
         case BPF_FUNC_redirect_map:
@@ -3336,6 +3503,8 @@ static const struct bpf_func_proto *
         switch (func_id) {
         case BPF_FUNC_setsockopt:
                 return &bpf_setsockopt_proto;
+        case BPF_FUNC_getsockopt:
+                return &bpf_getsockopt_proto;
         case BPF_FUNC_sock_map_update:
                 return &bpf_sock_map_update_proto;
         default:
@@ -3424,6 +3593,7 @@ static bool bpf_skb_is_valid_access(int off, int size, enum bpf_access_type type
         case bpf_ctx_range_till(struct __sk_buff, remote_ip4, remote_ip4):
         case bpf_ctx_range_till(struct __sk_buff, local_ip4, local_ip4):
         case bpf_ctx_range(struct __sk_buff, data):
+        case bpf_ctx_range(struct __sk_buff, data_meta):
         case bpf_ctx_range(struct __sk_buff, data_end):
                 if (size != size_default)
                         return false;
@@ -3450,6 +3620,7 @@ static bool sk_filter_is_valid_access(int off, int size,
         switch (off) {
         case bpf_ctx_range(struct __sk_buff, tc_classid):
         case bpf_ctx_range(struct __sk_buff, data):
+        case bpf_ctx_range(struct __sk_buff, data_meta):
         case bpf_ctx_range(struct __sk_buff, data_end):
         case bpf_ctx_range_till(struct __sk_buff, family, local_port):
                 return false;
@@ -3474,6 +3645,7 @@ static bool lwt_is_valid_access(int off, int size,
         switch (off) {
         case bpf_ctx_range(struct __sk_buff, tc_classid):
         case bpf_ctx_range_till(struct __sk_buff, family, local_port):
+        case bpf_ctx_range(struct __sk_buff, data_meta):
                 return false;
         }
 
@@ -3592,6 +3764,9 @@ static bool tc_cls_act_is_valid_access(int off, int size,
         case bpf_ctx_range(struct __sk_buff, data):
                 info->reg_type = PTR_TO_PACKET;
                 break;
+        case bpf_ctx_range(struct __sk_buff, data_meta):
+                info->reg_type = PTR_TO_PACKET_META;
+                break;
         case bpf_ctx_range(struct __sk_buff, data_end):
                 info->reg_type = PTR_TO_PACKET_END;
                 break;
@@ -3625,6 +3800,9 @@ static bool xdp_is_valid_access(int off, int size,
         case offsetof(struct xdp_md, data):
                 info->reg_type = PTR_TO_PACKET;
                 break;
+        case offsetof(struct xdp_md, data_meta):
+                info->reg_type = PTR_TO_PACKET_META;
+                break;
         case offsetof(struct xdp_md, data_end):
                 info->reg_type = PTR_TO_PACKET_END;
                 break;
@@ -3683,6 +3861,12 @@ static bool sk_skb_is_valid_access(int off, int size,
                                    enum bpf_access_type type,
                                    struct bpf_insn_access_aux *info)
 {
+        switch (off) {
+        case bpf_ctx_range(struct __sk_buff, tc_classid):
+        case bpf_ctx_range(struct __sk_buff, data_meta):
+                return false;
+        }
+
         if (type == BPF_WRITE) {
                 switch (off) {
                 case bpf_ctx_range(struct __sk_buff, tc_index):
@@ -3695,7 +3879,6 @@ static bool sk_skb_is_valid_access(int off, int size,
 
         switch (off) {
         case bpf_ctx_range(struct __sk_buff, mark):
-        case bpf_ctx_range(struct __sk_buff, tc_classid):
                 return false;
         case bpf_ctx_range(struct __sk_buff, data):
                 info->reg_type = PTR_TO_PACKET;
@@ -3853,6 +4036,15 @@ static u32 bpf_convert_ctx_access(enum bpf_access_type type,
                                       offsetof(struct sk_buff, data));
                 break;
 
+        case offsetof(struct __sk_buff, data_meta):
+                off  = si->off;
+                off -= offsetof(struct __sk_buff, data_meta);
+                off += offsetof(struct sk_buff, cb);
+                off += offsetof(struct bpf_skb_data_end, data_meta);
+                *insn++ = BPF_LDX_MEM(BPF_SIZEOF(void *), si->dst_reg,
+                                      si->src_reg, off);
+                break;
+
         case offsetof(struct __sk_buff, data_end):
                 off  = si->off;
                 off -= offsetof(struct __sk_buff, data_end);
@@ -4101,6 +4293,11 @@ static u32 xdp_convert_ctx_access(enum bpf_access_type type,
                                       si->dst_reg, si->src_reg,
                                       offsetof(struct xdp_buff, data));
                 break;
+        case offsetof(struct xdp_md, data_meta):
+                *insn++ = BPF_LDX_MEM(BPF_FIELD_SIZEOF(struct xdp_buff, data_meta),
+                                      si->dst_reg, si->src_reg,
+                                      offsetof(struct xdp_buff, data_meta));
+                break;
         case offsetof(struct xdp_md, data_end):
                 *insn++ = BPF_LDX_MEM(BPF_FIELD_SIZEOF(struct xdp_buff, data_end),
                                       si->dst_reg, si->src_reg,
@@ -4269,68 +4466,95 @@ static u32 sk_skb_convert_ctx_access(enum bpf_access_type type,
         return insn - insn_buf;
 }
 
-const struct bpf_verifier_ops sk_filter_prog_ops = {
+const struct bpf_verifier_ops sk_filter_verifier_ops = {
         .get_func_proto         = sk_filter_func_proto,
         .is_valid_access        = sk_filter_is_valid_access,
         .convert_ctx_access     = bpf_convert_ctx_access,
 };
 
-const struct bpf_verifier_ops tc_cls_act_prog_ops = {
+const struct bpf_prog_ops sk_filter_prog_ops = {
+};
+
+const struct bpf_verifier_ops tc_cls_act_verifier_ops = {
         .get_func_proto         = tc_cls_act_func_proto,
         .is_valid_access        = tc_cls_act_is_valid_access,
         .convert_ctx_access     = tc_cls_act_convert_ctx_access,
         .gen_prologue           = tc_cls_act_prologue,
+};
+
+const struct bpf_prog_ops tc_cls_act_prog_ops = {
         .test_run               = bpf_prog_test_run_skb,
 };
 
-const struct bpf_verifier_ops xdp_prog_ops = {
+const struct bpf_verifier_ops xdp_verifier_ops = {
         .get_func_proto         = xdp_func_proto,
         .is_valid_access        = xdp_is_valid_access,
         .convert_ctx_access     = xdp_convert_ctx_access,
+};
+
+const struct bpf_prog_ops xdp_prog_ops = {
         .test_run               = bpf_prog_test_run_xdp,
 };
 
-const struct bpf_verifier_ops cg_skb_prog_ops = {
+const struct bpf_verifier_ops cg_skb_verifier_ops = {
         .get_func_proto         = sk_filter_func_proto,
         .is_valid_access        = sk_filter_is_valid_access,
         .convert_ctx_access     = bpf_convert_ctx_access,
+};
+
+const struct bpf_prog_ops cg_skb_prog_ops = {
         .test_run               = bpf_prog_test_run_skb,
 };
 
-const struct bpf_verifier_ops lwt_inout_prog_ops = {
+const struct bpf_verifier_ops lwt_inout_verifier_ops = {
         .get_func_proto         = lwt_inout_func_proto,
         .is_valid_access        = lwt_is_valid_access,
         .convert_ctx_access     = bpf_convert_ctx_access,
+};
+
+const struct bpf_prog_ops lwt_inout_prog_ops = {
         .test_run               = bpf_prog_test_run_skb,
 };
 
-const struct bpf_verifier_ops lwt_xmit_prog_ops = {
+const struct bpf_verifier_ops lwt_xmit_verifier_ops = {
         .get_func_proto         = lwt_xmit_func_proto,
         .is_valid_access        = lwt_is_valid_access,
         .convert_ctx_access     = bpf_convert_ctx_access,
         .gen_prologue           = tc_cls_act_prologue,
+};
+
+const struct bpf_prog_ops lwt_xmit_prog_ops = {
         .test_run               = bpf_prog_test_run_skb,
 };
 
-const struct bpf_verifier_ops cg_sock_prog_ops = {
+const struct bpf_verifier_ops cg_sock_verifier_ops = {
         .get_func_proto         = sock_filter_func_proto,
         .is_valid_access        = sock_filter_is_valid_access,
         .convert_ctx_access     = sock_filter_convert_ctx_access,
 };
 
-const struct bpf_verifier_ops sock_ops_prog_ops = {
+const struct bpf_prog_ops cg_sock_prog_ops = {
+};
+
+const struct bpf_verifier_ops sock_ops_verifier_ops = {
         .get_func_proto         = sock_ops_func_proto,
         .is_valid_access        = sock_ops_is_valid_access,
         .convert_ctx_access     = sock_ops_convert_ctx_access,
 };
 
-const struct bpf_verifier_ops sk_skb_prog_ops = {
+const struct bpf_prog_ops sock_ops_prog_ops = {
+};
+
+const struct bpf_verifier_ops sk_skb_verifier_ops = {
         .get_func_proto         = sk_skb_func_proto,
         .is_valid_access        = sk_skb_is_valid_access,
         .convert_ctx_access     = sk_skb_convert_ctx_access,
         .gen_prologue           = sk_skb_prologue,
 };
 
+const struct bpf_prog_ops sk_skb_prog_ops = {
+};
+
 int sk_detach_filter(struct sock *sk)
 {
         int ret = -ENOENT;
diff --git a/net/core/flow_dissector.c b/net/core/flow_dissector.c
index 0a977373d003..15ce30063765 100644
--- a/net/core/flow_dissector.c
+++ b/net/core/flow_dissector.c
@@ -5,10 +5,12 @@
 #include <linux/ipv6.h>
 #include <linux/if_vlan.h>
 #include <net/dsa.h>
+#include <net/dst_metadata.h>
 #include <net/ip.h>
 #include <net/ipv6.h>
 #include <net/gre.h>
 #include <net/pptp.h>
+#include <net/tipc.h>
 #include <linux/igmp.h>
 #include <linux/icmp.h>
 #include <linux/sctp.h>
@@ -115,6 +117,102 @@ __be32 __skb_flow_get_ports(const struct sk_buff *skb, int thoff, u8 ip_proto,
 }
 EXPORT_SYMBOL(__skb_flow_get_ports);
 
+static void
+skb_flow_dissect_set_enc_addr_type(enum flow_dissector_key_id type,
+                                   struct flow_dissector *flow_dissector,
+                                   void *target_container)
+{
+        struct flow_dissector_key_control *ctrl;
+
+        if (!dissector_uses_key(flow_dissector, FLOW_DISSECTOR_KEY_ENC_CONTROL))
+                return;
+
+        ctrl = skb_flow_dissector_target(flow_dissector,
+                                         FLOW_DISSECTOR_KEY_ENC_CONTROL,
+                                         target_container);
+        ctrl->addr_type = type;
+}
+
+static void
+__skb_flow_dissect_tunnel_info(const struct sk_buff *skb,
+                               struct flow_dissector *flow_dissector,
+                               void *target_container)
+{
+        struct ip_tunnel_info *info;
+        struct ip_tunnel_key *key;
+
+        /* A quick check to see if there might be something to do. */
+        if (!dissector_uses_key(flow_dissector,
+                                FLOW_DISSECTOR_KEY_ENC_KEYID) &&
+            !dissector_uses_key(flow_dissector,
+                                FLOW_DISSECTOR_KEY_ENC_IPV4_ADDRS) &&
+            !dissector_uses_key(flow_dissector,
+                                FLOW_DISSECTOR_KEY_ENC_IPV6_ADDRS) &&
+            !dissector_uses_key(flow_dissector,
+                                FLOW_DISSECTOR_KEY_ENC_CONTROL) &&
+            !dissector_uses_key(flow_dissector,
+                                FLOW_DISSECTOR_KEY_ENC_PORTS))
+                return;
+
+        info = skb_tunnel_info(skb);
+        if (!info)
+                return;
+
+        key = &info->key;
+
+        switch (ip_tunnel_info_af(info)) {
+        case AF_INET:
+                skb_flow_dissect_set_enc_addr_type(FLOW_DISSECTOR_KEY_IPV4_ADDRS,
+                                                   flow_dissector,
+                                                   target_container);
+                if (dissector_uses_key(flow_dissector,
+                                       FLOW_DISSECTOR_KEY_ENC_IPV4_ADDRS)) {
+                        struct flow_dissector_key_ipv4_addrs *ipv4;
+
+                        ipv4 = skb_flow_dissector_target(flow_dissector,
+                                                         FLOW_DISSECTOR_KEY_ENC_IPV4_ADDRS,
+                                                         target_container);
+                        ipv4->src = key->u.ipv4.src;
+                        ipv4->dst = key->u.ipv4.dst;
+                }
+                break;
+        case AF_INET6:
+                skb_flow_dissect_set_enc_addr_type(FLOW_DISSECTOR_KEY_IPV6_ADDRS,
+                                                   flow_dissector,
+                                                   target_container);
+                if (dissector_uses_key(flow_dissector,
+                                       FLOW_DISSECTOR_KEY_ENC_IPV6_ADDRS)) {
+                        struct flow_dissector_key_ipv6_addrs *ipv6;
+
+                        ipv6 = skb_flow_dissector_target(flow_dissector,
+                                                         FLOW_DISSECTOR_KEY_ENC_IPV6_ADDRS,
+                                                         target_container);
+                        ipv6->src = key->u.ipv6.src;
+                        ipv6->dst = key->u.ipv6.dst;
+                }
+                break;
+        }
+
+        if (dissector_uses_key(flow_dissector, FLOW_DISSECTOR_KEY_ENC_KEYID)) {
+                struct flow_dissector_key_keyid *keyid;
+
+                keyid = skb_flow_dissector_target(flow_dissector,
+                                                  FLOW_DISSECTOR_KEY_ENC_KEYID,
+                                                  target_container);
+                keyid->keyid = tunnel_id_to_key32(key->tun_id);
+        }
+
+        if (dissector_uses_key(flow_dissector, FLOW_DISSECTOR_KEY_ENC_PORTS)) {
+                struct flow_dissector_key_ports *tp;
+
+                tp = skb_flow_dissector_target(flow_dissector,
+                                               FLOW_DISSECTOR_KEY_ENC_PORTS,
+                                               target_container);
+                tp->src = key->tp_src;
+                tp->dst = key->tp_dst;
+        }
+}
+
 static enum flow_dissect_ret
 __skb_flow_dissect_mpls(const struct sk_buff *skb,
                         struct flow_dissector *flow_dissector,
@@ -478,6 +576,9 @@ bool __skb_flow_dissect(const struct sk_buff *skb,
                                               FLOW_DISSECTOR_KEY_BASIC,
                                               target_container);
 
+        __skb_flow_dissect_tunnel_info(skb, flow_dissector,
+                                       target_container);
+
         if (dissector_uses_key(flow_dissector,
                                FLOW_DISSECTOR_KEY_ETH_ADDRS)) {
                 struct ethhdr *eth = eth_hdr(skb);
@@ -672,23 +773,22 @@ proto_again:
                 break;
         }
         case htons(ETH_P_TIPC): {
-                struct {
-                        __be32 pre[3];
-                        __be32 srcnode;
-                } *hdr, _hdr;
-                hdr = __skb_header_pointer(skb, nhoff, sizeof(_hdr), data, hlen, &_hdr);
+                struct tipc_basic_hdr *hdr, _hdr;
+
+                hdr = __skb_header_pointer(skb, nhoff, sizeof(_hdr),
+                                           data, hlen, &_hdr);
                 if (!hdr) {
                         fdret = FLOW_DISSECT_RET_OUT_BAD;
                         break;
                 }
 
                 if (dissector_uses_key(flow_dissector,
-                                       FLOW_DISSECTOR_KEY_TIPC_ADDRS)) {
+                                       FLOW_DISSECTOR_KEY_TIPC)) {
                         key_addrs = skb_flow_dissector_target(flow_dissector,
-                                                              FLOW_DISSECTOR_KEY_TIPC_ADDRS,
+                                                              FLOW_DISSECTOR_KEY_TIPC,
                                                               target_container);
-                        key_addrs->tipcaddrs.srcnode = hdr->srcnode;
-                        key_control->addr_type = FLOW_DISSECTOR_KEY_TIPC_ADDRS;
+                        key_addrs->tipckey.key = tipc_hdr_rps_key(hdr);
+                        key_control->addr_type = FLOW_DISSECTOR_KEY_TIPC;
                 }
                 fdret = FLOW_DISSECT_RET_OUT_GOOD;
                 break;
@@ -924,8 +1024,8 @@ static inline size_t flow_keys_hash_length(const struct flow_keys *flow)
         case FLOW_DISSECTOR_KEY_IPV6_ADDRS:
                 diff -= sizeof(flow->addrs.v6addrs);
                 break;
-        case FLOW_DISSECTOR_KEY_TIPC_ADDRS:
-                diff -= sizeof(flow->addrs.tipcaddrs);
+        case FLOW_DISSECTOR_KEY_TIPC:
+                diff -= sizeof(flow->addrs.tipckey);
                 break;
         }
         return (sizeof(*flow) - diff) / sizeof(u32);
@@ -939,8 +1039,8 @@ __be32 flow_get_u32_src(const struct flow_keys *flow)
         case FLOW_DISSECTOR_KEY_IPV6_ADDRS:
                 return (__force __be32)ipv6_addr_hash(
                         &flow->addrs.v6addrs.src);
-        case FLOW_DISSECTOR_KEY_TIPC_ADDRS:
-                return flow->addrs.tipcaddrs.srcnode;
+        case FLOW_DISSECTOR_KEY_TIPC:
+                return flow->addrs.tipckey.key;
         default:
                 return 0;
         }
@@ -1221,8 +1321,8 @@ static const struct flow_dissector_key flow_keys_dissector_keys[] = {
                 .offset = offsetof(struct flow_keys, addrs.v6addrs),
         },
         {
-                .key_id = FLOW_DISSECTOR_KEY_TIPC_ADDRS,
-                .offset = offsetof(struct flow_keys, addrs.tipcaddrs),
+                .key_id = FLOW_DISSECTOR_KEY_TIPC,
+                .offset = offsetof(struct flow_keys, addrs.tipckey),
         },
         {
                 .key_id = FLOW_DISSECTOR_KEY_PORTS,
diff --git a/net/core/gen_estimator.c b/net/core/gen_estimator.c
index 7c1ffd6f9501..9834cfa21b21 100644
--- a/net/core/gen_estimator.c
+++ b/net/core/gen_estimator.c
@@ -76,9 +76,9 @@ static void est_fetch_counters(struct net_rate_estimator *e,
 
 }
 
-static void est_timer(unsigned long arg)
+static void est_timer(struct timer_list *t)
 {
-        struct net_rate_estimator *est = (struct net_rate_estimator *)arg;
+        struct net_rate_estimator *est = from_timer(est, t, timer);
         struct gnet_stats_basic_packed b;
         u64 rate, brate;
 
@@ -170,7 +170,7 @@ int gen_new_estimator(struct gnet_stats_basic_packed *bstats,
         }
 
         est->next_jiffies = jiffies + ((HZ/4) << intvl_log);
-        setup_timer(&est->timer, est_timer, (unsigned long)est);
+        timer_setup(&est->timer, est_timer, 0);
         mod_timer(&est->timer, est->next_jiffies);
 
         rcu_assign_pointer(*rate_est, est);
diff --git a/net/core/lwt_bpf.c b/net/core/lwt_bpf.c
index 1307731ddfe4..e7e626fb87bb 100644
--- a/net/core/lwt_bpf.c
+++ b/net/core/lwt_bpf.c
@@ -51,7 +51,7 @@ static int run_lwt_bpf(struct sk_buff *skb, struct bpf_lwt_prog *lwt,
          */
         preempt_disable();
         rcu_read_lock();
-        bpf_compute_data_end(skb);
+        bpf_compute_data_pointers(skb);
         ret = bpf_prog_run_save_cb(lwt->prog, skb);
         rcu_read_unlock();
 
diff --git a/net/core/neighbour.c b/net/core/neighbour.c
index 16a1a4c4eb57..d1f5fe986edd 100644
--- a/net/core/neighbour.c
+++ b/net/core/neighbour.c
@@ -51,7 +51,7 @@ do {						\
 
 #define PNEIGH_HASHMASK         0xF
 
-static void neigh_timer_handler(unsigned long arg);
+static void neigh_timer_handler(struct timer_list *t);
 static void __neigh_notify(struct neighbour *n, int type, int flags,
                            u32 pid);
 static void neigh_update_notify(struct neighbour *neigh, u32 nlmsg_pid);
@@ -331,7 +331,7 @@ static struct neighbour *neigh_alloc(struct neigh_table *tbl, struct net_device
         n->output         = neigh_blackhole;
         seqlock_init(&n->hh.hh_lock);
         n->parms          = neigh_parms_clone(&tbl->parms);
-        setup_timer(&n->timer, neigh_timer_handler, (unsigned long)n);
+        timer_setup(&n->timer, neigh_timer_handler, 0);
 
         NEIGH_CACHE_STAT_INC(tbl, allocs);
         n->tbl            = tbl;
@@ -457,7 +457,7 @@ struct neighbour *neigh_lookup_nodev(struct neigh_table *tbl, struct net *net,
                                      const void *pkey)
 {
         struct neighbour *n;
-        int key_len = tbl->key_len;
+        unsigned int key_len = tbl->key_len;
         u32 hash_val;
         struct neigh_hash_table *nht;
 
@@ -488,7 +488,7 @@ struct neighbour *__neigh_create(struct neigh_table *tbl, const void *pkey,
                                  struct net_device *dev, bool want_ref)
 {
         u32 hash_val;
-        int key_len = tbl->key_len;
+        unsigned int key_len = tbl->key_len;
         int error;
         struct neighbour *n1, *rc, *n = neigh_alloc(tbl, dev);
         struct neigh_hash_table *nht;
@@ -572,7 +572,7 @@ out_neigh_release:
 }
 EXPORT_SYMBOL(__neigh_create);
 
-static u32 pneigh_hash(const void *pkey, int key_len)
+static u32 pneigh_hash(const void *pkey, unsigned int key_len)
 {
         u32 hash_val = *(u32 *)(pkey + key_len - 4);
         hash_val ^= (hash_val >> 16);
@@ -585,7 +585,7 @@ static u32 pneigh_hash(const void *pkey, int key_len)
 static struct pneigh_entry *__pneigh_lookup_1(struct pneigh_entry *n,
                                               struct net *net,
                                               const void *pkey,
-                                              int key_len,
+                                              unsigned int key_len,
                                               struct net_device *dev)
 {
         while (n) {
@@ -601,7 +601,7 @@ static struct pneigh_entry *__pneigh_lookup_1(struct pneigh_entry *n,
 struct pneigh_entry *__pneigh_lookup(struct neigh_table *tbl,
                 struct net *net, const void *pkey, struct net_device *dev)
 {
-        int key_len = tbl->key_len;
+        unsigned int key_len = tbl->key_len;
         u32 hash_val = pneigh_hash(pkey, key_len);
 
         return __pneigh_lookup_1(tbl->phash_buckets[hash_val],
@@ -614,7 +614,7 @@ struct pneigh_entry * pneigh_lookup(struct neigh_table *tbl,
                                     struct net_device *dev, int creat)
 {
         struct pneigh_entry *n;
-        int key_len = tbl->key_len;
+        unsigned int key_len = tbl->key_len;
         u32 hash_val = pneigh_hash(pkey, key_len);
 
         read_lock_bh(&tbl->lock);
@@ -659,7 +659,7 @@ int pneigh_delete(struct neigh_table *tbl, struct net *net, const void *pkey,
                   struct net_device *dev)
 {
         struct pneigh_entry *n, **np;
-        int key_len = tbl->key_len;
+        unsigned int key_len = tbl->key_len;
         u32 hash_val = pneigh_hash(pkey, key_len);
 
         write_lock_bh(&tbl->lock);
@@ -903,10 +903,10 @@ static void neigh_probe(struct neighbour *neigh)
 
 /* Called when a timer expires for a neighbour entry. */
 
-static void neigh_timer_handler(unsigned long arg)
+static void neigh_timer_handler(struct timer_list *t)
 {
         unsigned long now, next;
-        struct neighbour *neigh = (struct neighbour *)arg;
+        struct neighbour *neigh = from_timer(neigh, t, timer);
         unsigned int state;
         int notify = 0;
 
@@ -1391,9 +1391,9 @@ int neigh_direct_output(struct neighbour *neigh, struct sk_buff *skb)
 }
 EXPORT_SYMBOL(neigh_direct_output);
 
-static void neigh_proxy_process(unsigned long arg)
+static void neigh_proxy_process(struct timer_list *t)
 {
-        struct neigh_table *tbl = (struct neigh_table *)arg;
+        struct neigh_table *tbl = from_timer(tbl, t, proxy_timer);
         long sched_next = 0;
         unsigned long now = jiffies;
         struct sk_buff *skb, *n;
@@ -1573,7 +1573,7 @@ void neigh_table_init(int index, struct neigh_table *tbl)
         INIT_DEFERRABLE_WORK(&tbl->gc_work, neigh_periodic_work);
         queue_delayed_work(system_power_efficient_wq, &tbl->gc_work,
                         tbl->parms.reachable_time);
-        setup_timer(&tbl->proxy_timer, neigh_proxy_process, (unsigned long)tbl);
+        timer_setup(&tbl->proxy_timer, neigh_proxy_process, 0);
         skb_queue_head_init_class(&tbl->proxy_queue,
                         &neigh_table_proxy_queue_class);
 
@@ -1662,7 +1662,7 @@ static int neigh_delete(struct sk_buff *skb, struct nlmsghdr *nlh,
         if (tbl == NULL)
                 return -EAFNOSUPPORT;
 
-        if (nla_len(dst_attr) < tbl->key_len)
+        if (nla_len(dst_attr) < (int)tbl->key_len)
                 goto out;
 
         if (ndm->ndm_flags & NTF_PROXY) {
@@ -1730,7 +1730,7 @@ static int neigh_add(struct sk_buff *skb, struct nlmsghdr *nlh,
         if (tbl == NULL)
                 return -EAFNOSUPPORT;
 
-        if (nla_len(tb[NDA_DST]) < tbl->key_len)
+        if (nla_len(tb[NDA_DST]) < (int)tbl->key_len)
                 goto out;
         dst = nla_data(tb[NDA_DST]);
         lladdr = tb[NDA_LLADDR] ? nla_data(tb[NDA_LLADDR]) : NULL;
diff --git a/net/core/net-sysfs.c b/net/core/net-sysfs.c
index 927a6dcbad96..799b75268291 100644
--- a/net/core/net-sysfs.c
+++ b/net/core/net-sysfs.c
@@ -382,7 +382,7 @@ static ssize_t ifalias_store(struct device *dev, struct device_attribute *attr,
         struct net_device *netdev = to_net_dev(dev);
         struct net *net = dev_net(netdev);
         size_t count = len;
-        ssize_t ret;
+        ssize_t ret = 0;
 
         if (!ns_capable(net->user_ns, CAP_NET_ADMIN))
                 return -EPERM;
@@ -393,23 +393,30 @@ static ssize_t ifalias_store(struct device *dev, struct device_attribute *attr,
 
         if (!rtnl_trylock())
                 return restart_syscall();
-        ret = dev_set_alias(netdev, buf, count);
+
+        if (dev_isalive(netdev)) {
+                ret = dev_set_alias(netdev, buf, count);
+                if (ret < 0)
+                        goto err;
+                ret = len;
+                netdev_state_change(netdev);
+        }
+err:
         rtnl_unlock();
 
-        return ret < 0 ? ret : len;
+        return ret;
 }
 
 static ssize_t ifalias_show(struct device *dev,
                             struct device_attribute *attr, char *buf)
 {
         const struct net_device *netdev = to_net_dev(dev);
+        char tmp[IFALIASZ];
         ssize_t ret = 0;
 
-        if (!rtnl_trylock())
-                return restart_syscall();
-        if (netdev->ifalias)
-                ret = sprintf(buf, "%s\n", netdev->ifalias);
-        rtnl_unlock();
+        ret = dev_get_alias(netdev, tmp, sizeof(tmp));
+        if (ret > 0)
+                ret = sprintf(buf, "%s\n", tmp);
         return ret;
 }
 static DEVICE_ATTR_RW(ifalias);
@@ -1488,7 +1495,10 @@ static void netdev_release(struct device *d)
 
         BUG_ON(dev->reg_state != NETREG_RELEASED);
 
-        kfree(dev->ifalias);
+        /* no need to wait for rcu grace period:
+         * device is dead and about to be freed.
+         */
+        kfree(rcu_access_pointer(dev->ifalias));
         netdev_freemem(dev);
 }
 
diff --git a/net/core/net-traces.c b/net/core/net-traces.c
index 71f209542364..380934580fa1 100644
--- a/net/core/net-traces.c
+++ b/net/core/net-traces.c
@@ -32,6 +32,7 @@
 #include <trace/events/napi.h>
 #include <trace/events/sock.h>
 #include <trace/events/udp.h>
+#include <trace/events/tcp.h>
 #include <trace/events/fib.h>
 #include <trace/events/qdisc.h>
 #if IS_ENABLED(CONFIG_IPV6)
@@ -49,3 +50,5 @@ EXPORT_TRACEPOINT_SYMBOL_GPL(br_fdb_update);
 EXPORT_TRACEPOINT_SYMBOL_GPL(kfree_skb);
 
 EXPORT_TRACEPOINT_SYMBOL_GPL(napi_poll);
+
+EXPORT_TRACEPOINT_SYMBOL_GPL(tcp_send_reset);
diff --git a/net/core/net_namespace.c b/net/core/net_namespace.c
index 6cfdc7c84c48..b797832565d3 100644
--- a/net/core/net_namespace.c
+++ b/net/core/net_namespace.c
@@ -234,6 +234,7 @@ int peernet2id_alloc(struct net *net, struct net *peer)
                 rtnl_net_notifyid(net, RTM_NEWNSID, id);
         return id;
 }
+EXPORT_SYMBOL_GPL(peernet2id_alloc);
 
 /* This function returns, if assigned, the id of a peer netns. */
 int peernet2id(struct net *net, struct net *peer)
diff --git a/net/core/pktgen.c b/net/core/pktgen.c
index 3b2034f6d49d..f95a15086225 100644
--- a/net/core/pktgen.c
+++ b/net/core/pktgen.c
@@ -2165,7 +2165,7 @@ static void pktgen_setup_inject(struct pktgen_dev *pkt_dev)
                                                 + pkt_dev->pkt_overhead;
                 }
 
-                for (i = 0; i < IN6_ADDR_HSIZE; i++)
+                for (i = 0; i < sizeof(struct in6_addr); i++)
                         if (pkt_dev->cur_in6_saddr.s6_addr[i]) {
                                 set = 1;
                                 break;
@@ -2711,7 +2711,7 @@ static inline __be16 build_tci(unsigned int id, unsigned int cfi,
 static void pktgen_finalize_skb(struct pktgen_dev *pkt_dev, struct sk_buff *skb,
                                 int datalen)
 {
-        struct timeval timestamp;
+        struct timespec64 timestamp;
         struct pktgen_hdr *pgh;
 
         pgh = skb_put(skb, sizeof(*pgh));
@@ -2773,9 +2773,17 @@ static void pktgen_finalize_skb(struct pktgen_dev *pkt_dev, struct sk_buff *skb,
                 pgh->tv_sec = 0;
                 pgh->tv_usec = 0;
         } else {
-                do_gettimeofday(&timestamp);
+                /*
+                 * pgh->tv_sec wraps in y2106 when interpreted as unsigned
+                 * as done by wireshark, or y2038 when interpreted as signed.
+                 * This is probably harmless, but if anyone wants to improve
+                 * it, we could introduce a variant that puts 64-bit nanoseconds
+                 * into the respective header bytes.
+                 * This would also be slightly faster to read.
+                 */
+                ktime_get_real_ts64(&timestamp);
                 pgh->tv_sec = htonl(timestamp.tv_sec);
-                pgh->tv_usec = htonl(timestamp.tv_usec);
+                pgh->tv_usec = htonl(timestamp.tv_nsec / NSEC_PER_USEC);
         }
 }
 
diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
index 5ace48926b19..dabba2a91fc8 100644
--- a/net/core/rtnetlink.c
+++ b/net/core/rtnetlink.c
@@ -453,7 +453,7 @@ static const struct rtnl_af_ops *rtnl_af_lookup(const int family)
 {
         const struct rtnl_af_ops *ops;
 
-        list_for_each_entry(ops, &rtnl_af_ops, list) {
+        list_for_each_entry_rcu(ops, &rtnl_af_ops, list) {
                 if (ops->family == family)
                         return ops;
         }
@@ -470,32 +470,22 @@ static const struct rtnl_af_ops *rtnl_af_lookup(const int family)
 void rtnl_af_register(struct rtnl_af_ops *ops)
 {
         rtnl_lock();
-        list_add_tail(&ops->list, &rtnl_af_ops);
+        list_add_tail_rcu(&ops->list, &rtnl_af_ops);
         rtnl_unlock();
 }
 EXPORT_SYMBOL_GPL(rtnl_af_register);
 
 /**
- * __rtnl_af_unregister - Unregister rtnl_af_ops from rtnetlink.
- * @ops: struct rtnl_af_ops * to unregister
- *
- * The caller must hold the rtnl_mutex.
- */
-void __rtnl_af_unregister(struct rtnl_af_ops *ops)
-{
-        list_del(&ops->list);
-}
-EXPORT_SYMBOL_GPL(__rtnl_af_unregister);
-
-/**
  * rtnl_af_unregister - Unregister rtnl_af_ops from rtnetlink.
  * @ops: struct rtnl_af_ops * to unregister
  */
 void rtnl_af_unregister(struct rtnl_af_ops *ops)
 {
         rtnl_lock();
-        __rtnl_af_unregister(ops);
+        list_del_rcu(&ops->list);
         rtnl_unlock();
+
+        synchronize_rcu();
 }
 EXPORT_SYMBOL_GPL(rtnl_af_unregister);
 
@@ -508,13 +498,15 @@ static size_t rtnl_link_get_af_size(const struct net_device *dev,
         /* IFLA_AF_SPEC */
         size = nla_total_size(sizeof(struct nlattr));
 
-        list_for_each_entry(af_ops, &rtnl_af_ops, list) {
+        rcu_read_lock();
+        list_for_each_entry_rcu(af_ops, &rtnl_af_ops, list) {
                 if (af_ops->get_link_af_size) {
                         /* AF_* + nested data */
                         size += nla_total_size(sizeof(struct nlattr)) +
                                 af_ops->get_link_af_size(dev, ext_filter_mask);
                 }
         }
+        rcu_read_unlock();
 
         return size;
 }
@@ -522,11 +514,15 @@ static size_t rtnl_link_get_af_size(const struct net_device *dev,
 static bool rtnl_have_link_slave_info(const struct net_device *dev)
 {
         struct net_device *master_dev;
+        bool ret = false;
 
-        master_dev = netdev_master_upper_dev_get((struct net_device *) dev);
+        rcu_read_lock();
+
+        master_dev = netdev_master_upper_dev_get_rcu((struct net_device *)dev);
         if (master_dev && master_dev->rtnl_link_ops)
-                return true;
-        return false;
+                ret = true;
+        rcu_read_unlock();
+        return ret;
 }
 
 static int rtnl_link_slave_info_fill(struct sk_buff *skb,
@@ -923,8 +919,10 @@ static noinline size_t if_nlmsg_size(const struct net_device *dev,
                + nla_total_size(IFNAMSIZ) /* IFLA_PHYS_PORT_NAME */
                + rtnl_xdp_size() /* IFLA_XDP */
                + nla_total_size(4)  /* IFLA_EVENT */
-               + nla_total_size(1); /* IFLA_PROTO_DOWN */
-
+               + nla_total_size(4)  /* IFLA_NEW_NETNSID */
+               + nla_total_size(1)  /* IFLA_PROTO_DOWN */
+               + nla_total_size(4)  /* IFLA_IF_NETNSID */
+               + 0;
 }
 
 static int rtnl_vf_ports_fill(struct sk_buff *skb, struct net_device *dev)
@@ -1211,6 +1209,36 @@ nla_put_vfinfo_failure:
         return -EMSGSIZE;
 }
 
+static noinline_for_stack int rtnl_fill_vf(struct sk_buff *skb,
+                                           struct net_device *dev,
+                                           u32 ext_filter_mask)
+{
+        struct nlattr *vfinfo;
+        int i, num_vfs;
+
+        if (!dev->dev.parent || ((ext_filter_mask & RTEXT_FILTER_VF) == 0))
+                return 0;
+
+        num_vfs = dev_num_vf(dev->dev.parent);
+        if (nla_put_u32(skb, IFLA_NUM_VF, num_vfs))
+                return -EMSGSIZE;
+
+        if (!dev->netdev_ops->ndo_get_vf_config)
+                return 0;
+
+        vfinfo = nla_nest_start(skb, IFLA_VFINFO_LIST);
+        if (!vfinfo)
+                return -EMSGSIZE;
+
+        for (i = 0; i < num_vfs; i++) {
+                if (rtnl_fill_vfinfo(skb, dev, i, vfinfo))
+                        return -EMSGSIZE;
+        }
+
+        nla_nest_end(skb, vfinfo);
+        return 0;
+}
+
 static int rtnl_fill_link_ifmap(struct sk_buff *skb, struct net_device *dev)
 {
         struct rtnl_link_ifmap map;
@@ -1242,10 +1270,10 @@ static u8 rtnl_xdp_attached_mode(struct net_device *dev, u32 *prog_id)
                 *prog_id = generic_xdp_prog->aux->id;
                 return XDP_ATTACHED_SKB;
         }
-        if (!ops->ndo_xdp)
+        if (!ops->ndo_bpf)
                 return XDP_ATTACHED_NONE;
 
-        return __dev_xdp_attached(dev, ops->ndo_xdp, prog_id);
+        return __dev_xdp_attached(dev, ops->ndo_bpf, prog_id);
 }
 
 static int rtnl_xdp_fill(struct sk_buff *skb, struct net_device *dev)
@@ -1307,16 +1335,108 @@ static u32 rtnl_get_event(unsigned long event)
         return rtnl_event_type;
 }
 
-static int rtnl_fill_ifinfo(struct sk_buff *skb, struct net_device *dev,
+static int put_master_ifindex(struct sk_buff *skb, struct net_device *dev)
+{
+        const struct net_device *upper_dev;
+        int ret = 0;
+
+        rcu_read_lock();
+
+        upper_dev = netdev_master_upper_dev_get_rcu(dev);
+        if (upper_dev)
+                ret = nla_put_u32(skb, IFLA_MASTER, upper_dev->ifindex);
+
+        rcu_read_unlock();
+        return ret;
+}
+
+static int nla_put_iflink(struct sk_buff *skb, const struct net_device *dev)
+{
+        int ifindex = dev_get_iflink(dev);
+
+        if (dev->ifindex == ifindex)
+                return 0;
+
+        return nla_put_u32(skb, IFLA_LINK, ifindex);
+}
+
+static noinline_for_stack int nla_put_ifalias(struct sk_buff *skb,
+                                              struct net_device *dev)
+{
+        char buf[IFALIASZ];
+        int ret;
+
+        ret = dev_get_alias(dev, buf, sizeof(buf));
+        return ret > 0 ? nla_put_string(skb, IFLA_IFALIAS, buf) : 0;
+}
+
+static int rtnl_fill_link_netnsid(struct sk_buff *skb,
+                                  const struct net_device *dev,
+                                  struct net *src_net)
+{
+        if (dev->rtnl_link_ops && dev->rtnl_link_ops->get_link_net) {
+                struct net *link_net = dev->rtnl_link_ops->get_link_net(dev);
+
+                if (!net_eq(dev_net(dev), link_net)) {
+                        int id = peernet2id_alloc(src_net, link_net);
+
+                        if (nla_put_s32(skb, IFLA_LINK_NETNSID, id))
+                                return -EMSGSIZE;
+                }
+        }
+
+        return 0;
+}
+
+static int rtnl_fill_link_af(struct sk_buff *skb,
+                             const struct net_device *dev,
+                             u32 ext_filter_mask)
+{
+        const struct rtnl_af_ops *af_ops;
+        struct nlattr *af_spec;
+
+        af_spec = nla_nest_start(skb, IFLA_AF_SPEC);
+        if (!af_spec)
+                return -EMSGSIZE;
+
+        list_for_each_entry_rcu(af_ops, &rtnl_af_ops, list) {
+                struct nlattr *af;
+                int err;
+
+                if (!af_ops->fill_link_af)
+                        continue;
+
+                af = nla_nest_start(skb, af_ops->family);
+                if (!af)
+                        return -EMSGSIZE;
+
+                err = af_ops->fill_link_af(skb, dev, ext_filter_mask);
+                /*
+                 * Caller may return ENODATA to indicate that there
+                 * was no data to be dumped. This is not an error, it
+                 * means we should trim the attribute header and
+                 * continue.
+                 */
+                if (err == -ENODATA)
+                        nla_nest_cancel(skb, af);
+                else if (err < 0)
+                        return -EMSGSIZE;
+
+                nla_nest_end(skb, af);
+        }
+
+        nla_nest_end(skb, af_spec);
+        return 0;
+}
+
+static int rtnl_fill_ifinfo(struct sk_buff *skb,
+                            struct net_device *dev, struct net *src_net,
                             int type, u32 pid, u32 seq, u32 change,
                             unsigned int flags, u32 ext_filter_mask,
-                            u32 event)
+                            u32 event, int *new_nsid, int tgt_netnsid)
 {
         struct ifinfomsg *ifm;
         struct nlmsghdr *nlh;
-        struct nlattr *af_spec;
-        struct rtnl_af_ops *af_ops;
-        struct net_device *upper_dev = netdev_master_upper_dev_get(dev);
 
         ASSERT_RTNL();
         nlh = nlmsg_put(skb, pid, seq, type, sizeof(*ifm), flags);
@@ -1331,6 +1451,9 @@ static int rtnl_fill_ifinfo(struct sk_buff *skb, struct net_device *dev,
         ifm->ifi_flags = dev_get_flags(dev);
         ifm->ifi_change = change;
 
+        if (tgt_netnsid >= 0 && nla_put_s32(skb, IFLA_IF_NETNSID, tgt_netnsid))
+                goto nla_put_failure;
+
         if (nla_put_string(skb, IFLA_IFNAME, dev->name) ||
             nla_put_u32(skb, IFLA_TXQLEN, dev->tx_queue_len) ||
             nla_put_u8(skb, IFLA_OPERSTATE,
@@ -1345,15 +1468,12 @@ static int rtnl_fill_ifinfo(struct sk_buff *skb, struct net_device *dev,
 #ifdef CONFIG_RPS
             nla_put_u32(skb, IFLA_NUM_RX_QUEUES, dev->num_rx_queues) ||
 #endif
-            (dev->ifindex != dev_get_iflink(dev) &&
-             nla_put_u32(skb, IFLA_LINK, dev_get_iflink(dev))) ||
-            (upper_dev &&
-             nla_put_u32(skb, IFLA_MASTER, upper_dev->ifindex)) ||
+            nla_put_iflink(skb, dev) ||
+            put_master_ifindex(skb, dev) ||
             nla_put_u8(skb, IFLA_CARRIER, netif_carrier_ok(dev)) ||
             (dev->qdisc &&
              nla_put_string(skb, IFLA_QDISC, dev->qdisc->ops->id)) ||
-            (dev->ifalias &&
-             nla_put_string(skb, IFLA_IFALIAS, dev->ifalias)) ||
+            nla_put_ifalias(skb, dev) ||
             nla_put_u32(skb, IFLA_CARRIER_CHANGES,
                         atomic_read(&dev->carrier_changes)) ||
             nla_put_u8(skb, IFLA_PROTO_DOWN, dev->proto_down))
@@ -1385,27 +1505,9 @@ static int rtnl_fill_ifinfo(struct sk_buff *skb, struct net_device *dev,
         if (rtnl_fill_stats(skb, dev))
                 goto nla_put_failure;
 
-        if (dev->dev.parent && (ext_filter_mask & RTEXT_FILTER_VF) &&
-            nla_put_u32(skb, IFLA_NUM_VF, dev_num_vf(dev->dev.parent)))
+        if (rtnl_fill_vf(skb, dev, ext_filter_mask))
                 goto nla_put_failure;
 
-        if (dev->netdev_ops->ndo_get_vf_config && dev->dev.parent &&
-            ext_filter_mask & RTEXT_FILTER_VF) {
-                int i;
-                struct nlattr *vfinfo;
-                int num_vfs = dev_num_vf(dev->dev.parent);
-
-                vfinfo = nla_nest_start(skb, IFLA_VFINFO_LIST);
-                if (!vfinfo)
-                        goto nla_put_failure;
-                for (i = 0; i < num_vfs; i++) {
-                        if (rtnl_fill_vfinfo(skb, dev, i, vfinfo))
-                                goto nla_put_failure;
-                }
-
-                nla_nest_end(skb, vfinfo);
-        }
-
         if (rtnl_port_fill(skb, dev, ext_filter_mask))
                 goto nla_put_failure;
 
@@ -1417,51 +1519,23 @@ static int rtnl_fill_ifinfo(struct sk_buff *skb, struct net_device *dev,
                         goto nla_put_failure;
         }
 
-        if (dev->rtnl_link_ops &&
-            dev->rtnl_link_ops->get_link_net) {
-                struct net *link_net = dev->rtnl_link_ops->get_link_net(dev);
-
-                if (!net_eq(dev_net(dev), link_net)) {
-                        int id = peernet2id_alloc(dev_net(dev), link_net);
-
-                        if (nla_put_s32(skb, IFLA_LINK_NETNSID, id))
-                                goto nla_put_failure;
-                }
-        }
-
-        if (!(af_spec = nla_nest_start(skb, IFLA_AF_SPEC)))
+        if (rtnl_fill_link_netnsid(skb, dev, src_net))
                 goto nla_put_failure;
 
-        list_for_each_entry(af_ops, &rtnl_af_ops, list) {
-                if (af_ops->fill_link_af) {
-                        struct nlattr *af;
-                        int err;
-
-                        if (!(af = nla_nest_start(skb, af_ops->family)))
-                                goto nla_put_failure;
-
-                        err = af_ops->fill_link_af(skb, dev, ext_filter_mask);
-
-                        /*
-                         * Caller may return ENODATA to indicate that there
-                         * was no data to be dumped. This is not an error, it
-                         * means we should trim the attribute header and
-                         * continue.
-                         */
-                        if (err == -ENODATA)
-                                nla_nest_cancel(skb, af);
-                        else if (err < 0)
-                                goto nla_put_failure;
-
-                        nla_nest_end(skb, af);
-                }
-        }
+        if (new_nsid &&
+            nla_put_s32(skb, IFLA_NEW_NETNSID, *new_nsid) < 0)
+                goto nla_put_failure;
 
-        nla_nest_end(skb, af_spec);
+        rcu_read_lock();
+        if (rtnl_fill_link_af(skb, dev, ext_filter_mask))
+                goto nla_put_failure_rcu;
+        rcu_read_unlock();
 
         nlmsg_end(skb, nlh);
         return 0;
 
+nla_put_failure_rcu:
+        rcu_read_unlock();
 nla_put_failure:
         nlmsg_cancel(skb, nlh);
         return -EMSGSIZE;
@@ -1503,6 +1577,7 @@ static const struct nla_policy ifla_policy[IFLA_MAX+1] = {
         [IFLA_XDP]              = { .type = NLA_NESTED },
         [IFLA_EVENT]            = { .type = NLA_U32 },
         [IFLA_GROUP]            = { .type = NLA_U32 },
+        [IFLA_IF_NETNSID]       = { .type = NLA_S32 },
 };
 
 static const struct nla_policy ifla_info_policy[IFLA_INFO_MAX+1] = {
@@ -1606,9 +1681,28 @@ static bool link_dump_filtered(struct net_device *dev,
         return false;
 }
 
+static struct net *get_target_net(struct sk_buff *skb, int netnsid)
+{
+        struct net *net;
+
+        net = get_net_ns_by_id(sock_net(skb->sk), netnsid);
+        if (!net)
+                return ERR_PTR(-EINVAL);
+
+        /* For now, the caller is required to have CAP_NET_ADMIN in
+         * the user namespace owning the target net ns.
+         */
+        if (!netlink_ns_capable(skb, net->user_ns, CAP_NET_ADMIN)) {
+                put_net(net);
+                return ERR_PTR(-EACCES);
+        }
+        return net;
+}
+
 static int rtnl_dump_ifinfo(struct sk_buff *skb, struct netlink_callback *cb)
 {
         struct net *net = sock_net(skb->sk);
+        struct net *tgt_net = net;
         int h, s_h;
         int idx = 0, s_idx;
         struct net_device *dev;
@@ -1618,6 +1712,7 @@ static int rtnl_dump_ifinfo(struct sk_buff *skb, struct netlink_callback *cb)
         const struct rtnl_link_ops *kind_ops = NULL;
         unsigned int flags = NLM_F_MULTI;
         int master_idx = 0;
+        int netnsid = -1;
         int err;
         int hdrlen;
 
@@ -1636,6 +1731,15 @@ static int rtnl_dump_ifinfo(struct sk_buff *skb, struct netlink_callback *cb)
 
         if (nlmsg_parse(cb->nlh, hdrlen, tb, IFLA_MAX,
                         ifla_policy, NULL) >= 0) {
+                if (tb[IFLA_IF_NETNSID]) {
+                        netnsid = nla_get_s32(tb[IFLA_IF_NETNSID]);
+                        tgt_net = get_target_net(skb, netnsid);
+                        if (IS_ERR(tgt_net)) {
+                                tgt_net = net;
+                                netnsid = -1;
+                        }
+                }
+
                 if (tb[IFLA_EXT_MASK])
                         ext_filter_mask = nla_get_u32(tb[IFLA_EXT_MASK]);
 
@@ -1651,17 +1755,19 @@ static int rtnl_dump_ifinfo(struct sk_buff *skb, struct netlink_callback *cb)
 
         for (h = s_h; h < NETDEV_HASHENTRIES; h++, s_idx = 0) {
                 idx = 0;
-                head = &net->dev_index_head[h];
+                head = &tgt_net->dev_index_head[h];
                 hlist_for_each_entry(dev, head, index_hlist) {
                         if (link_dump_filtered(dev, master_idx, kind_ops))
                                 goto cont;
                         if (idx < s_idx)
                                 goto cont;
-                        err = rtnl_fill_ifinfo(skb, dev, RTM_NEWLINK,
+                        err = rtnl_fill_ifinfo(skb, dev, net,
+                                               RTM_NEWLINK,
                                                NETLINK_CB(cb->skb).portid,
                                                cb->nlh->nlmsg_seq, 0,
                                                flags,
-                                               ext_filter_mask, 0);
+                                               ext_filter_mask, 0, NULL,
+                                               netnsid);
 
                         if (err < 0) {
                                 if (likely(skb->len))
@@ -1680,6 +1786,8 @@ out_err:
         cb->args[0] = h;
         cb->seq = net->dev_base_seq;
         nl_dump_check_consistent(cb, nlmsg_hdr(skb));
+        if (netnsid >= 0)
+                put_net(tgt_net);
 
         return err;
 }
@@ -1726,17 +1834,27 @@ static int validate_linkmsg(struct net_device *dev, struct nlattr *tb[])
                 nla_for_each_nested(af, tb[IFLA_AF_SPEC], rem) {
                         const struct rtnl_af_ops *af_ops;
 
-                        if (!(af_ops = rtnl_af_lookup(nla_type(af))))
+                        rcu_read_lock();
+                        af_ops = rtnl_af_lookup(nla_type(af));
+                        if (!af_ops) {
+                                rcu_read_unlock();
                                 return -EAFNOSUPPORT;
+                        }
 
-                        if (!af_ops->set_link_af)
+                        if (!af_ops->set_link_af) {
+                                rcu_read_unlock();
                                 return -EOPNOTSUPP;
+                        }
 
                         if (af_ops->validate_link_af) {
                                 err = af_ops->validate_link_af(dev, af);
-                                if (err < 0)
+                                if (err < 0) {
+                                        rcu_read_unlock();
                                         return err;
+                                }
                         }
+
+                        rcu_read_unlock();
                 }
         }
 
@@ -1912,7 +2030,8 @@ static int do_setvfinfo(struct net_device *dev, struct nlattr **tb)
         return err;
 }
 
-static int do_set_master(struct net_device *dev, int ifindex)
+static int do_set_master(struct net_device *dev, int ifindex,
+                         struct netlink_ext_ack *extack)
 {
         struct net_device *upper_dev = netdev_master_upper_dev_get(dev);
         const struct net_device_ops *ops;
@@ -1937,7 +2056,7 @@ static int do_set_master(struct net_device *dev, int ifindex)
                         return -EINVAL;
                 ops = upper_dev->netdev_ops;
                 if (ops->ndo_add_slave) {
-                        err = ops->ndo_add_slave(upper_dev, dev);
+                        err = ops->ndo_add_slave(upper_dev, dev, extack);
                         if (err)
                                 return err;
                 } else {
@@ -2070,7 +2189,7 @@ static int do_setlink(const struct sk_buff *skb,
         }
 
         if (tb[IFLA_MASTER]) {
-                err = do_set_master(dev, nla_get_u32(tb[IFLA_MASTER]));
+                err = do_set_master(dev, nla_get_u32(tb[IFLA_MASTER]), extack);
                 if (err)
                         goto errout;
                 status |= DO_SETLINK_MODIFIED;
@@ -2193,13 +2312,17 @@ static int do_setlink(const struct sk_buff *skb,
                 nla_for_each_nested(af, tb[IFLA_AF_SPEC], rem) {
                         const struct rtnl_af_ops *af_ops;
 
-                        if (!(af_ops = rtnl_af_lookup(nla_type(af))))
-                                BUG();
+                        rcu_read_lock();
+
+                        BUG_ON(!(af_ops = rtnl_af_lookup(nla_type(af))));
 
                         err = af_ops->set_link_af(dev, af);
-                        if (err < 0)
+                        if (err < 0) {
+                                rcu_read_unlock();
                                 goto errout;
+                        }
 
+                        rcu_read_unlock();
                         status |= DO_SETLINK_NOTIFY;
                 }
         }
@@ -2277,6 +2400,9 @@ static int rtnl_setlink(struct sk_buff *skb, struct nlmsghdr *nlh,
         if (err < 0)
                 goto errout;
 
+        if (tb[IFLA_IF_NETNSID])
+                return -EOPNOTSUPP;
+
         if (tb[IFLA_IFNAME])
                 nla_strlcpy(ifname, tb[IFLA_IFNAME], IFNAMSIZ);
         else
@@ -2371,6 +2497,9 @@ static int rtnl_dellink(struct sk_buff *skb, struct nlmsghdr *nlh,
         if (err < 0)
                 return err;
 
+        if (tb[IFLA_IF_NETNSID])
+                return -EOPNOTSUPP;
+
         if (tb[IFLA_IFNAME])
                 nla_strlcpy(ifname, tb[IFLA_IFNAME], IFNAMSIZ);
 
@@ -2502,6 +2631,9 @@ replay:
         if (err < 0)
                 return err;
 
+        if (tb[IFLA_IF_NETNSID])
+                return -EOPNOTSUPP;
+
         if (tb[IFLA_IFNAME])
                 nla_strlcpy(ifname, tb[IFLA_IFNAME], IFNAMSIZ);
         else
@@ -2579,12 +2711,6 @@ replay:
                                         return err;
                                 slave_data = slave_attr;
                         }
-                        if (m_ops->slave_validate) {
-                                err = m_ops->slave_validate(tb, slave_data,
-                                                            extack);
-                                if (err < 0)
-                                        return err;
-                        }
                 }
 
                 if (dev) {
@@ -2714,7 +2840,8 @@ replay:
                                 goto out_unregister;
                 }
                 if (tb[IFLA_MASTER]) {
-                        err = do_set_master(dev, nla_get_u32(tb[IFLA_MASTER]));
+                        err = do_set_master(dev, nla_get_u32(tb[IFLA_MASTER]),
+                                            extack);
                         if (err)
                                 goto out_unregister;
                 }
@@ -2740,11 +2867,13 @@ static int rtnl_getlink(struct sk_buff *skb, struct nlmsghdr *nlh,
                         struct netlink_ext_ack *extack)
 {
         struct net *net = sock_net(skb->sk);
+        struct net *tgt_net = net;
         struct ifinfomsg *ifm;
         char ifname[IFNAMSIZ];
         struct nlattr *tb[IFLA_MAX+1];
         struct net_device *dev = NULL;
         struct sk_buff *nskb;
+        int netnsid = -1;
         int err;
         u32 ext_filter_mask = 0;
 
@@ -2752,35 +2881,50 @@ static int rtnl_getlink(struct sk_buff *skb, struct nlmsghdr *nlh,
         if (err < 0)
                 return err;
 
+        if (tb[IFLA_IF_NETNSID]) {
+                netnsid = nla_get_s32(tb[IFLA_IF_NETNSID]);
+                tgt_net = get_target_net(skb, netnsid);
+                if (IS_ERR(tgt_net))
+                        return PTR_ERR(tgt_net);
+        }
+
         if (tb[IFLA_IFNAME])
                 nla_strlcpy(ifname, tb[IFLA_IFNAME], IFNAMSIZ);
 
         if (tb[IFLA_EXT_MASK])
                 ext_filter_mask = nla_get_u32(tb[IFLA_EXT_MASK]);
 
+        err = -EINVAL;
         ifm = nlmsg_data(nlh);
         if (ifm->ifi_index > 0)
-                dev = __dev_get_by_index(net, ifm->ifi_index);
+                dev = __dev_get_by_index(tgt_net, ifm->ifi_index);
         else if (tb[IFLA_IFNAME])
-                dev = __dev_get_by_name(net, ifname);
+                dev = __dev_get_by_name(tgt_net, ifname);
         else
-                return -EINVAL;
+                goto out;
 
+        err = -ENODEV;
         if (dev == NULL)
-                return -ENODEV;
+                goto out;
 
+        err = -ENOBUFS;
         nskb = nlmsg_new(if_nlmsg_size(dev, ext_filter_mask), GFP_KERNEL);
         if (nskb == NULL)
-                return -ENOBUFS;
+                goto out;
 
-        err = rtnl_fill_ifinfo(nskb, dev, RTM_NEWLINK, NETLINK_CB(skb).portid,
-                               nlh->nlmsg_seq, 0, 0, ext_filter_mask, 0);
+        err = rtnl_fill_ifinfo(nskb, dev, net,
+                               RTM_NEWLINK, NETLINK_CB(skb).portid,
+                               nlh->nlmsg_seq, 0, 0, ext_filter_mask,
+                               0, NULL, netnsid);
         if (err < 0) {
                 /* -EMSGSIZE implies BUG in if_nlmsg_size */
                 WARN_ON(err == -EMSGSIZE);
                 kfree_skb(nskb);
         } else
                 err = rtnl_unicast(nskb, net, NETLINK_CB(skb).portid);
+out:
+        if (netnsid >= 0)
+                put_net(tgt_net);
 
         return err;
 }
@@ -2859,7 +3003,7 @@ static int rtnl_dump_all(struct sk_buff *skb, struct netlink_callback *cb)
 
 struct sk_buff *rtmsg_ifinfo_build_skb(int type, struct net_device *dev,
                                        unsigned int change,
-                                       u32 event, gfp_t flags)
+                                       u32 event, gfp_t flags, int *new_nsid)
 {
         struct net *net = dev_net(dev);
         struct sk_buff *skb;
@@ -2870,7 +3014,9 @@ struct sk_buff *rtmsg_ifinfo_build_skb(int type, struct net_device *dev,
         if (skb == NULL)
                 goto errout;
 
-        err = rtnl_fill_ifinfo(skb, dev, type, 0, 0, change, 0, 0, event);
+        err = rtnl_fill_ifinfo(skb, dev, dev_net(dev),
+                               type, 0, 0, change, 0, 0, event,
+                               new_nsid, -1);
         if (err < 0) {
                 /* -EMSGSIZE implies BUG in if_nlmsg_size() */
                 WARN_ON(err == -EMSGSIZE);
@@ -2893,14 +3039,14 @@ void rtmsg_ifinfo_send(struct sk_buff *skb, struct net_device *dev, gfp_t flags)
 
 static void rtmsg_ifinfo_event(int type, struct net_device *dev,
                                unsigned int change, u32 event,
-                               gfp_t flags)
+                               gfp_t flags, int *new_nsid)
 {
         struct sk_buff *skb;
 
         if (dev->reg_state != NETREG_REGISTERED)
                 return;
 
-        skb = rtmsg_ifinfo_build_skb(type, dev, change, event, flags);
+        skb = rtmsg_ifinfo_build_skb(type, dev, change, event, flags, new_nsid);
         if (skb)
                 rtmsg_ifinfo_send(skb, dev, flags);
 }
@@ -2908,9 +3054,15 @@ static void rtmsg_ifinfo_event(int type, struct net_device *dev,
 void rtmsg_ifinfo(int type, struct net_device *dev, unsigned int change,
                   gfp_t flags)
 {
-        rtmsg_ifinfo_event(type, dev, change, rtnl_get_event(0), flags);
+        rtmsg_ifinfo_event(type, dev, change, rtnl_get_event(0), flags, NULL);
+}
+
+void rtmsg_ifinfo_newnet(int type, struct net_device *dev, unsigned int change,
+                         gfp_t flags, int *new_nsid)
+{
+        rtmsg_ifinfo_event(type, dev, change, rtnl_get_event(0), flags,
+                           new_nsid);
 }
-EXPORT_SYMBOL(rtmsg_ifinfo);
 
 static int nlmsg_populate_fdb_fill(struct sk_buff *skb,
                                    struct net_device *dev,
@@ -3017,21 +3169,21 @@ int ndo_dflt_fdb_add(struct ndmsg *ndm,
 }
 EXPORT_SYMBOL(ndo_dflt_fdb_add);
 
-static int fdb_vid_parse(struct nlattr *vlan_attr, u16 *p_vid)
+static int fdb_vid_parse(struct nlattr *vlan_attr, u16 *p_vid,
+                         struct netlink_ext_ack *extack)
 {
         u16 vid = 0;
 
         if (vlan_attr) {
                 if (nla_len(vlan_attr) != sizeof(u16)) {
-                        pr_info("PF_BRIDGE: RTM_NEWNEIGH with invalid vlan\n");
+                        NL_SET_ERR_MSG(extack, "invalid vlan attribute size");
                         return -EINVAL;
                 }
 
                 vid = nla_get_u16(vlan_attr);
 
                 if (!vid || vid >= VLAN_VID_MASK) {
-                        pr_info("PF_BRIDGE: RTM_NEWNEIGH with invalid vlan id %d\n",
-                                vid);
+                        NL_SET_ERR_MSG(extack, "invalid vlan id");
                         return -EINVAL;
                 }
         }
@@ -3056,24 +3208,24 @@ static int rtnl_fdb_add(struct sk_buff *skb, struct nlmsghdr *nlh,
 
         ndm = nlmsg_data(nlh);
         if (ndm->ndm_ifindex == 0) {
-                pr_info("PF_BRIDGE: RTM_NEWNEIGH with invalid ifindex\n");
+                NL_SET_ERR_MSG(extack, "invalid ifindex");
                 return -EINVAL;
         }
 
         dev = __dev_get_by_index(net, ndm->ndm_ifindex);
         if (dev == NULL) {
-                pr_info("PF_BRIDGE: RTM_NEWNEIGH with unknown ifindex\n");
+                NL_SET_ERR_MSG(extack, "unknown ifindex");
                 return -ENODEV;
         }
 
         if (!tb[NDA_LLADDR] || nla_len(tb[NDA_LLADDR]) != ETH_ALEN) {
-                pr_info("PF_BRIDGE: RTM_NEWNEIGH with invalid address\n");
+                NL_SET_ERR_MSG(extack, "invalid address");
                 return -EINVAL;
         }
 
         addr = nla_data(tb[NDA_LLADDR]);
 
-        err = fdb_vid_parse(tb[NDA_VLAN], &vid);
+        err = fdb_vid_parse(tb[NDA_VLAN], &vid, extack);
         if (err)
                 return err;
 
@@ -3160,24 +3312,24 @@ static int rtnl_fdb_del(struct sk_buff *skb, struct nlmsghdr *nlh,
 
         ndm = nlmsg_data(nlh);
         if (ndm->ndm_ifindex == 0) {
-                pr_info("PF_BRIDGE: RTM_DELNEIGH with invalid ifindex\n");
+                NL_SET_ERR_MSG(extack, "invalid ifindex");
                 return -EINVAL;
         }
 
         dev = __dev_get_by_index(net, ndm->ndm_ifindex);
         if (dev == NULL) {
-                pr_info("PF_BRIDGE: RTM_DELNEIGH with unknown ifindex\n");
+                NL_SET_ERR_MSG(extack, "unknown ifindex");
                 return -ENODEV;
         }
 
         if (!tb[NDA_LLADDR] || nla_len(tb[NDA_LLADDR]) != ETH_ALEN) {
-                pr_info("PF_BRIDGE: RTM_DELNEIGH with invalid address\n");
+                NL_SET_ERR_MSG(extack, "invalid address");
                 return -EINVAL;
         }
 
         addr = nla_data(tb[NDA_LLADDR]);
 
-        err = fdb_vid_parse(tb[NDA_VLAN], &vid);
+        err = fdb_vid_parse(tb[NDA_VLAN], &vid, extack);
         if (err)
                 return err;
 
@@ -3617,7 +3769,7 @@ static int rtnl_bridge_setlink(struct sk_buff *skb, struct nlmsghdr *nlh,
 
         dev = __dev_get_by_index(net, ifm->ifi_index);
         if (!dev) {
-                pr_info("PF_BRIDGE: RTM_SETLINK with unknown ifindex\n");
+                NL_SET_ERR_MSG(extack, "unknown ifindex");
                 return -ENODEV;
         }
 
@@ -3692,7 +3844,7 @@ static int rtnl_bridge_dellink(struct sk_buff *skb, struct nlmsghdr *nlh,
 
         dev = __dev_get_by_index(net, ifm->ifi_index);
         if (!dev) {
-                pr_info("PF_BRIDGE: RTM_SETLINK with unknown ifindex\n");
+                NL_SET_ERR_MSG(extack, "unknown ifindex");
                 return -ENODEV;
         }
 
@@ -3943,25 +4095,30 @@ static int rtnl_fill_statsinfo(struct sk_buff *skb, struct net_device *dev,
                 if (!attr)
                         goto nla_put_failure;
 
-                list_for_each_entry(af_ops, &rtnl_af_ops, list) {
+                rcu_read_lock();
+                list_for_each_entry_rcu(af_ops, &rtnl_af_ops, list) {
                         if (af_ops->fill_stats_af) {
                                 struct nlattr *af;
                                 int err;
 
                                 af = nla_nest_start(skb, af_ops->family);
-                                if (!af)
+                                if (!af) {
+                                        rcu_read_unlock();
                                         goto nla_put_failure;
-
+                                }
                                 err = af_ops->fill_stats_af(skb, dev);
 
-                                if (err == -ENODATA)
+                                if (err == -ENODATA) {
                                         nla_nest_cancel(skb, af);
-                                else if (err < 0)
+                                } else if (err < 0) {
+                                        rcu_read_unlock();
                                         goto nla_put_failure;
+                                }
 
                                 nla_nest_end(skb, af);
                         }
                 }
+                rcu_read_unlock();
 
                 nla_nest_end(skb, attr);
 
@@ -4030,7 +4187,8 @@ static size_t if_nlmsg_stats_size(const struct net_device *dev,
                 /* for IFLA_STATS_AF_SPEC */
                 size += nla_total_size(0);
 
-                list_for_each_entry(af_ops, &rtnl_af_ops, list) {
+                rcu_read_lock();
+                list_for_each_entry_rcu(af_ops, &rtnl_af_ops, list) {
                         if (af_ops->get_stats_af_size) {
                                 size += nla_total_size(
                                         af_ops->get_stats_af_size(dev));
@@ -4039,6 +4197,7 @@ static size_t if_nlmsg_stats_size(const struct net_device *dev,
                                 size += nla_total_size(0);
                         }
                 }
+                rcu_read_unlock();
         }
 
         return size;
@@ -4292,9 +4451,10 @@ static int rtnetlink_event(struct notifier_block *this, unsigned long event, voi
         case NETDEV_CHANGEUPPER:
         case NETDEV_RESEND_IGMP:
         case NETDEV_CHANGEINFODATA:
+        case NETDEV_CHANGELOWERSTATE:
         case NETDEV_CHANGE_TX_QUEUE_LEN:
                 rtmsg_ifinfo_event(RTM_NEWLINK, dev, 0, rtnl_get_event(event),
-                                   GFP_KERNEL);
+                                   GFP_KERNEL, NULL);
                 break;
         default:
                 break;
diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index e140ba49b30a..6b0ff396fa9d 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -41,7 +41,6 @@
 #include <linux/module.h>
 #include <linux/types.h>
 #include <linux/kernel.h>
-#include <linux/kmemcheck.h>
 #include <linux/mm.h>
 #include <linux/interrupt.h>
 #include <linux/in.h>
@@ -234,14 +233,12 @@ struct sk_buff *__alloc_skb(unsigned int size, gfp_t gfp_mask,
         shinfo = skb_shinfo(skb);
         memset(shinfo, 0, offsetof(struct skb_shared_info, dataref));
         atomic_set(&shinfo->dataref, 1);
-        kmemcheck_annotate_variable(shinfo->destructor_arg);
 
         if (flags & SKB_ALLOC_FCLONE) {
                 struct sk_buff_fclones *fclones;
 
                 fclones = container_of(skb, struct sk_buff_fclones, skb1);
 
-                kmemcheck_annotate_bitfield(&fclones->skb2, flags1);
                 skb->fclone = SKB_FCLONE_ORIG;
                 refcount_set(&fclones->fclone_ref, 1);
 
@@ -301,7 +298,6 @@ struct sk_buff *__build_skb(void *data, unsigned int frag_size)
         shinfo = skb_shinfo(skb);
         memset(shinfo, 0, offsetof(struct skb_shared_info, dataref));
         atomic_set(&shinfo->dataref, 1);
-        kmemcheck_annotate_variable(shinfo->destructor_arg);
 
         return skb;
 }
@@ -357,7 +353,7 @@ static void *__netdev_alloc_frag(unsigned int fragsz, gfp_t gfp_mask)
  */
 void *netdev_alloc_frag(unsigned int fragsz)
 {
-        return __netdev_alloc_frag(fragsz, GFP_ATOMIC | __GFP_COLD);
+        return __netdev_alloc_frag(fragsz, GFP_ATOMIC);
 }
 EXPORT_SYMBOL(netdev_alloc_frag);
 
@@ -370,7 +366,7 @@ static void *__napi_alloc_frag(unsigned int fragsz, gfp_t gfp_mask)
 
 void *napi_alloc_frag(unsigned int fragsz)
 {
-        return __napi_alloc_frag(fragsz, GFP_ATOMIC | __GFP_COLD);
+        return __napi_alloc_frag(fragsz, GFP_ATOMIC);
 }
 EXPORT_SYMBOL(napi_alloc_frag);
 
@@ -1283,7 +1279,6 @@ struct sk_buff *skb_clone(struct sk_buff *skb, gfp_t gfp_mask)
                 if (!n)
                         return NULL;
 
-                kmemcheck_annotate_bitfield(n, flags1);
                 n->fclone = SKB_FCLONE_UNAVAILABLE;
         }
 
@@ -1354,8 +1349,7 @@ struct sk_buff *skb_copy(const struct sk_buff *skb, gfp_t gfp_mask)
         /* Set the tail pointer and length */
         skb_put(n, skb->len);
 
-        if (skb_copy_bits(skb, -headerlen, n->head, headerlen + skb->len))
-                BUG();
+        BUG_ON(skb_copy_bits(skb, -headerlen, n->head, headerlen + skb->len));
 
         copy_skb_header(n, skb);
         return n;
@@ -1453,8 +1447,7 @@ int pskb_expand_head(struct sk_buff *skb, int nhead, int ntail,
 
         BUG_ON(nhead < 0);
 
-        if (skb_shared(skb))
-                BUG();
+        BUG_ON(skb_shared(skb));
 
         size = SKB_DATA_ALIGN(size);
 
@@ -1513,6 +1506,8 @@ int pskb_expand_head(struct sk_buff *skb, int nhead, int ntail,
         skb->nohdr    = 0;
         atomic_set(&skb_shinfo(skb)->dataref, 1);
 
+        skb_metadata_clear(skb);
+
         /* It is not generally safe to change skb->truesize.
          * For the moment, we really care of rx path, or
          * when skb is orphaned (not attached to a socket).
@@ -1597,9 +1592,8 @@ struct sk_buff *skb_copy_expand(const struct sk_buff *skb,
                 head_copy_off = newheadroom - head_copy_len;
 
         /* Copy the linear header and data. */
-        if (skb_copy_bits(skb, -head_copy_len, n->head + head_copy_off,
-                          skb->len + head_copy_len))
-                BUG();
+        BUG_ON(skb_copy_bits(skb, -head_copy_len, n->head + head_copy_off,
+                             skb->len + head_copy_len));
 
         copy_skb_header(n, skb);
 
@@ -1880,8 +1874,8 @@ void *__pskb_pull_tail(struct sk_buff *skb, int delta)
                         return NULL;
         }
 
-        if (skb_copy_bits(skb, skb_headlen(skb), skb_tail_pointer(skb), delta))
-                BUG();
+        BUG_ON(skb_copy_bits(skb, skb_headlen(skb),
+                             skb_tail_pointer(skb), delta));
 
         /* Optimization: no fragments, no reasons to preestimate
          * size of pulled pages. Superb.
@@ -2852,12 +2846,15 @@ EXPORT_SYMBOL(skb_queue_purge);
  */
 void skb_rbtree_purge(struct rb_root *root)
 {
-        struct sk_buff *skb, *next;
+        struct rb_node *p = rb_first(root);
 
-        rbtree_postorder_for_each_entry_safe(skb, next, root, rbnode)
-                kfree_skb(skb);
+        while (p) {
+                struct sk_buff *skb = rb_entry(p, struct sk_buff, rbnode);
 
-        *root = RB_ROOT;
+                p = rb_next(p);
+                rb_erase(&skb->rbnode, root);
+                kfree_skb(skb);
+        }
 }
 
 /**
@@ -4766,6 +4763,7 @@ EXPORT_SYMBOL(kfree_skb_partial);
 bool skb_try_coalesce(struct sk_buff *to, struct sk_buff *from,
                       bool *fragstolen, int *delta_truesize)
 {
+        struct skb_shared_info *to_shinfo, *from_shinfo;
         int i, delta, len = from->len;
 
         *fragstolen = false;
@@ -4780,7 +4778,9 @@ bool skb_try_coalesce(struct sk_buff *to, struct sk_buff *from,
                 return true;
         }
 
-        if (skb_has_frag_list(to) || skb_has_frag_list(from))
+        to_shinfo = skb_shinfo(to);
+        from_shinfo = skb_shinfo(from);
+        if (to_shinfo->frag_list || from_shinfo->frag_list)
                 return false;
         if (skb_zcopy(to) || skb_zcopy(from))
                 return false;
@@ -4789,8 +4789,8 @@ bool skb_try_coalesce(struct sk_buff *to, struct sk_buff *from,
                 struct page *page;
                 unsigned int offset;
 
-                if (skb_shinfo(to)->nr_frags +
-                    skb_shinfo(from)->nr_frags >= MAX_SKB_FRAGS)
+                if (to_shinfo->nr_frags +
+                    from_shinfo->nr_frags >= MAX_SKB_FRAGS)
                         return false;
 
                 if (skb_head_is_locked(from))
@@ -4801,12 +4801,12 @@ bool skb_try_coalesce(struct sk_buff *to, struct sk_buff *from,
                 page = virt_to_head_page(from->head);
                 offset = from->data - (unsigned char *)page_address(page);
 
-                skb_fill_page_desc(to, skb_shinfo(to)->nr_frags,
+                skb_fill_page_desc(to, to_shinfo->nr_frags,
                                    page, offset, skb_headlen(from));
                 *fragstolen = true;
         } else {
-                if (skb_shinfo(to)->nr_frags +
-                    skb_shinfo(from)->nr_frags > MAX_SKB_FRAGS)
+                if (to_shinfo->nr_frags +
+                    from_shinfo->nr_frags > MAX_SKB_FRAGS)
                         return false;
 
                 delta = from->truesize - SKB_TRUESIZE(skb_end_offset(from));
@@ -4814,19 +4814,19 @@ bool skb_try_coalesce(struct sk_buff *to, struct sk_buff *from,
 
         WARN_ON_ONCE(delta < len);
 
-        memcpy(skb_shinfo(to)->frags + skb_shinfo(to)->nr_frags,
-               skb_shinfo(from)->frags,
-               skb_shinfo(from)->nr_frags * sizeof(skb_frag_t));
-        skb_shinfo(to)->nr_frags += skb_shinfo(from)->nr_frags;
+        memcpy(to_shinfo->frags + to_shinfo->nr_frags,
+               from_shinfo->frags,
+               from_shinfo->nr_frags * sizeof(skb_frag_t));
+        to_shinfo->nr_frags += from_shinfo->nr_frags;
 
         if (!skb_cloned(from))
-                skb_shinfo(from)->nr_frags = 0;
+                from_shinfo->nr_frags = 0;
 
         /* if the skb is not cloned this does nothing
          * since we set nr_frags to 0.
          */
-        for (i = 0; i < skb_shinfo(from)->nr_frags; i++)
-                skb_frag_ref(from, i);
+        for (i = 0; i < from_shinfo->nr_frags; i++)
+                __skb_frag_ref(&from_shinfo->frags[i]);
 
         to->truesize += delta;
         to->len += len;
diff --git a/net/core/sock.c b/net/core/sock.c
index 415f441c63b9..c0b5b2f17412 100644
--- a/net/core/sock.c
+++ b/net/core/sock.c
@@ -1469,8 +1469,6 @@ static struct sock *sk_prot_alloc(struct proto *prot, gfp_t priority,
                 sk = kmalloc(prot->obj_size, priority);
 
         if (sk != NULL) {
-                kmemcheck_annotate_bitfield(sk, flags);
-
                 if (security_sk_alloc(sk, family, priority))
                         goto out_free;
 
@@ -2346,16 +2344,18 @@ int __sk_mem_raise_allocated(struct sock *sk, int size, int amt, int kind)
 
         /* guarantee minimum buffer size under pressure */
         if (kind == SK_MEM_RECV) {
-                if (atomic_read(&sk->sk_rmem_alloc) < prot->sysctl_rmem[0])
+                if (atomic_read(&sk->sk_rmem_alloc) < sk_get_rmem0(sk, prot))
                         return 1;
 
         } else { /* SK_MEM_SEND */
+                int wmem0 = sk_get_wmem0(sk, prot);
+
                 if (sk->sk_type == SOCK_STREAM) {
-                        if (sk->sk_wmem_queued < prot->sysctl_wmem[0])
+                        if (sk->sk_wmem_queued < wmem0)
                                 return 1;
-                } else if (refcount_read(&sk->sk_wmem_alloc) <
-                           prot->sysctl_wmem[0])
+                } else if (refcount_read(&sk->sk_wmem_alloc) < wmem0) {
                                 return 1;
+                }
         }
 
         if (sk_has_memory_pressure(sk)) {
@@ -2685,7 +2685,7 @@ void sock_init_data(struct socket *sock, struct sock *sk)
         sk_init_common(sk);
         sk->sk_send_head        =       NULL;
 
-        init_timer(&sk->sk_timer);
+        timer_setup(&sk->sk_timer, NULL, 0);
 
         sk->sk_allocation       =       GFP_KERNEL;
         sk->sk_rcvbuf           =       sysctl_rmem_default;
@@ -2744,6 +2744,7 @@ void sock_init_data(struct socket *sock, struct sock *sk)
 
         sk->sk_max_pacing_rate = ~0U;
         sk->sk_pacing_rate = ~0U;
+        sk->sk_pacing_shift = 10;
         sk->sk_incoming_cpu = -1;
         /*
          * Before updating sk_refcnt, we must commit prior changes to memory
@@ -3042,7 +3043,6 @@ struct prot_inuse {
 
 static DECLARE_BITMAP(proto_inuse_idx, PROTO_INUSE_NR);
 
-#ifdef CONFIG_NET_NS
 void sock_prot_inuse_add(struct net *net, struct proto *prot, int val)
 {
         __this_cpu_add(net->core.inuse->val[prot->inuse_idx], val);
@@ -3086,27 +3086,6 @@ static __init int net_inuse_init(void)
 }
 
 core_initcall(net_inuse_init);
-#else
-static DEFINE_PER_CPU(struct prot_inuse, prot_inuse);
-
-void sock_prot_inuse_add(struct net *net, struct proto *prot, int val)
-{
-        __this_cpu_add(prot_inuse.val[prot->inuse_idx], val);
-}
-EXPORT_SYMBOL_GPL(sock_prot_inuse_add);
-
-int sock_prot_inuse_get(struct net *net, struct proto *prot)
-{
-        int cpu, idx = prot->inuse_idx;
-        int res = 0;
-
-        for_each_possible_cpu(cpu)
-                res += per_cpu(prot_inuse, cpu).val[idx];
-
-        return res >= 0 ? res : 0;
-}
-EXPORT_SYMBOL_GPL(sock_prot_inuse_get);
-#endif
 
 static void assign_proto_idx(struct proto *prot)
 {
diff --git a/net/dccp/ccids/ccid2.c b/net/dccp/ccids/ccid2.c
index e1295d5f2c56..1c75cd1255f6 100644
--- a/net/dccp/ccids/ccid2.c
+++ b/net/dccp/ccids/ccid2.c
@@ -126,10 +126,10 @@ static void ccid2_change_l_seq_window(struct sock *sk, u64 val)
                                                   DCCPF_SEQ_WMAX));
 }
 
-static void ccid2_hc_tx_rto_expire(unsigned long data)
+static void ccid2_hc_tx_rto_expire(struct timer_list *t)
 {
-        struct sock *sk = (struct sock *)data;
-        struct ccid2_hc_tx_sock *hc = ccid2_hc_tx_sk(sk);
+        struct ccid2_hc_tx_sock *hc = from_timer(hc, t, tx_rtotimer);
+        struct sock *sk = hc->sk;
         const bool sender_was_blocked = ccid2_cwnd_network_limited(hc);
 
         bh_lock_sock(sk);
@@ -733,8 +733,8 @@ static int ccid2_hc_tx_init(struct ccid *ccid, struct sock *sk)
         hc->tx_rpdupack  = -1;
         hc->tx_last_cong = hc->tx_lsndtime = hc->tx_cwnd_stamp = ccid2_jiffies32;
         hc->tx_cwnd_used = 0;
-        setup_timer(&hc->tx_rtotimer, ccid2_hc_tx_rto_expire,
-                        (unsigned long)sk);
+        hc->sk           = sk;
+        timer_setup(&hc->tx_rtotimer, ccid2_hc_tx_rto_expire, 0);
         INIT_LIST_HEAD(&hc->tx_av_chunks);
         return 0;
 }
diff --git a/net/dccp/ccids/ccid2.h b/net/dccp/ccids/ccid2.h
index 6e50ef2898fb..1af0116dc6ce 100644
--- a/net/dccp/ccids/ccid2.h
+++ b/net/dccp/ccids/ccid2.h
@@ -85,6 +85,7 @@ struct ccid2_hc_tx_sock {
                                 tx_rto;
         u64                     tx_rtt_seq:48;
         struct timer_list       tx_rtotimer;
+        struct sock             *sk;
 
         /* Congestion Window validation (optional, RFC 2861) */
         u32                     tx_cwnd_used,
diff --git a/net/dccp/ccids/ccid3.c b/net/dccp/ccids/ccid3.c
index 119c04317d48..8b5ba6dffac7 100644
--- a/net/dccp/ccids/ccid3.c
+++ b/net/dccp/ccids/ccid3.c
@@ -195,10 +195,10 @@ static inline void ccid3_hc_tx_update_win_count(struct ccid3_hc_tx_sock *hc,
         }
 }
 
-static void ccid3_hc_tx_no_feedback_timer(unsigned long data)
+static void ccid3_hc_tx_no_feedback_timer(struct timer_list *t)
 {
-        struct sock *sk = (struct sock *)data;
-        struct ccid3_hc_tx_sock *hc = ccid3_hc_tx_sk(sk);
+        struct ccid3_hc_tx_sock *hc = from_timer(hc, t, tx_no_feedback_timer);
+        struct sock *sk = hc->sk;
         unsigned long t_nfb = USEC_PER_SEC / 5;
 
         bh_lock_sock(sk);
@@ -505,8 +505,9 @@ static int ccid3_hc_tx_init(struct ccid *ccid, struct sock *sk)
 
         hc->tx_state = TFRC_SSTATE_NO_SENT;
         hc->tx_hist  = NULL;
-        setup_timer(&hc->tx_no_feedback_timer,
-                        ccid3_hc_tx_no_feedback_timer, (unsigned long)sk);
+        hc->sk       = sk;
+        timer_setup(&hc->tx_no_feedback_timer,
+                    ccid3_hc_tx_no_feedback_timer, 0);
         return 0;
 }
 
diff --git a/net/dccp/ccids/ccid3.h b/net/dccp/ccids/ccid3.h
index 1a9933c29672..813d91c6e1e2 100644
--- a/net/dccp/ccids/ccid3.h
+++ b/net/dccp/ccids/ccid3.h
@@ -106,6 +106,7 @@ struct ccid3_hc_tx_sock {
         u8                              tx_last_win_count;
         ktime_t                         tx_t_last_win_count;
         struct timer_list               tx_no_feedback_timer;
+        struct sock                     *sk;
         ktime_t                         tx_t_ld;
         ktime_t                         tx_t_nom;
         struct tfrc_tx_hist_entry       *tx_hist;
diff --git a/net/dccp/ccids/lib/packet_history.c b/net/dccp/ccids/lib/packet_history.c
index 08df7a3acb3d..876e18592d71 100644
--- a/net/dccp/ccids/lib/packet_history.c
+++ b/net/dccp/ccids/lib/packet_history.c
@@ -149,10 +149,8 @@ static void tfrc_rx_hist_swap(struct tfrc_rx_hist *h, const u8 a, const u8 b)
 {
         const u8 idx_a = tfrc_rx_hist_index(h, a),
                  idx_b = tfrc_rx_hist_index(h, b);
-        struct tfrc_rx_hist_entry *tmp = h->ring[idx_a];
 
-        h->ring[idx_a] = h->ring[idx_b];
-        h->ring[idx_b] = tmp;
+        swap(h->ring[idx_a], h->ring[idx_b]);
 }
 
 /*
diff --git a/net/dccp/input.c b/net/dccp/input.c
index fa6be9750bb4..d28d46bff6ab 100644
--- a/net/dccp/input.c
+++ b/net/dccp/input.c
@@ -534,6 +534,7 @@ static int dccp_rcv_respond_partopen_state_process(struct sock *sk,
         case DCCP_PKT_DATA:
                 if (sk->sk_state == DCCP_RESPOND)
                         break;
+                /* fall through */
         case DCCP_PKT_DATAACK:
         case DCCP_PKT_ACK:
                 /*
diff --git a/net/dccp/options.c b/net/dccp/options.c
index 51cdfc3bd8ca..4e40db017e19 100644
--- a/net/dccp/options.c
+++ b/net/dccp/options.c
@@ -227,8 +227,8 @@ int dccp_parse_options(struct sock *sk, struct dccp_request_sock *dreq,
                          * Ack vectors are processed by the TX CCID if it is
                          * interested. The RX CCID need not parse Ack Vectors,
                          * since it is only interested in clearing old state.
-                         * Fall through.
                          */
+                        /* fall through */
                 case DCCPO_MIN_TX_CCID_SPECIFIC ... DCCPO_MAX_TX_CCID_SPECIFIC:
                         if (ccid_hc_tx_parse_options(dp->dccps_hc_tx_ccid, sk,
                                                      pkt_type, opt, value, len))
diff --git a/net/dccp/timer.c b/net/dccp/timer.c
index 3a2c34027758..b50a8732ff43 100644
--- a/net/dccp/timer.c
+++ b/net/dccp/timer.c
@@ -125,10 +125,11 @@ static void dccp_retransmit_timer(struct sock *sk)
                 __sk_dst_reset(sk);
 }
 
-static void dccp_write_timer(unsigned long data)
+static void dccp_write_timer(struct timer_list *t)
 {
-        struct sock *sk = (struct sock *)data;
-        struct inet_connection_sock *icsk = inet_csk(sk);
+        struct inet_connection_sock *icsk =
+                        from_timer(icsk, t, icsk_retransmit_timer);
+        struct sock *sk = &icsk->icsk_inet.sk;
         int event = 0;
 
         bh_lock_sock(sk);
@@ -161,19 +162,20 @@ out:
         sock_put(sk);
 }
 
-static void dccp_keepalive_timer(unsigned long data)
+static void dccp_keepalive_timer(struct timer_list *t)
 {
-        struct sock *sk = (struct sock *)data;
+        struct sock *sk = from_timer(sk, t, sk_timer);
 
         pr_err("dccp should not use a keepalive timer !\n");
         sock_put(sk);
 }
 
 /* This is the same as tcp_delack_timer, sans prequeue & mem_reclaim stuff */
-static void dccp_delack_timer(unsigned long data)
+static void dccp_delack_timer(struct timer_list *t)
 {
-        struct sock *sk = (struct sock *)data;
-        struct inet_connection_sock *icsk = inet_csk(sk);
+        struct inet_connection_sock *icsk =
+                        from_timer(icsk, t, icsk_delack_timer);
+        struct sock *sk = &icsk->icsk_inet.sk;
 
         bh_lock_sock(sk);
         if (sock_owned_by_user(sk)) {
@@ -232,10 +234,13 @@ static void dccp_write_xmitlet(unsigned long data)
         bh_unlock_sock(sk);
 }
 
-static void dccp_write_xmit_timer(unsigned long data)
+static void dccp_write_xmit_timer(struct timer_list *t)
 {
-        dccp_write_xmitlet(data);
-        sock_put((struct sock *)data);
+        struct dccp_sock *dp = from_timer(dp, t, dccps_xmit_timer);
+        struct sock *sk = &dp->dccps_inet_connection.icsk_inet.sk;
+
+        dccp_write_xmitlet((unsigned long)sk);
+        sock_put(sk);
 }
 
 void dccp_init_xmit_timers(struct sock *sk)
@@ -243,8 +248,7 @@ void dccp_init_xmit_timers(struct sock *sk)
         struct dccp_sock *dp = dccp_sk(sk);
 
         tasklet_init(&dp->dccps_xmitlet, dccp_write_xmitlet, (unsigned long)sk);
-        setup_timer(&dp->dccps_xmit_timer, dccp_write_xmit_timer,
-                                                             (unsigned long)sk);
+        timer_setup(&dp->dccps_xmit_timer, dccp_write_xmit_timer, 0);
         inet_csk_init_xmit_timers(sk, &dccp_write_timer, &dccp_delack_timer,
                                   &dccp_keepalive_timer);
 }
diff --git a/net/decnet/af_decnet.c b/net/decnet/af_decnet.c
index 73a0399dc7a2..518cea17b811 100644
--- a/net/decnet/af_decnet.c
+++ b/net/decnet/af_decnet.c
@@ -533,10 +533,6 @@ static struct sock *dn_alloc_sock(struct net *net, struct socket *sock, gfp_t gf
         scp->keepalive = 10 * HZ;
         scp->keepalive_fxn = dn_keepalive;
 
-        init_timer(&scp->delack_timer);
-        scp->delack_pending = 0;
-        scp->delack_fxn = dn_nsp_delayed_ack;
-
         dn_start_slow_timer(sk);
 out:
         return sk;
@@ -634,10 +630,12 @@ static void dn_destroy_sock(struct sock *sk)
                 goto disc_reject;
         case DN_RUN:
                 scp->state = DN_DI;
+                /* fall through */
         case DN_DI:
         case DN_DR:
 disc_reject:
                 dn_nsp_send_disc(sk, NSP_DISCINIT, 0, sk->sk_allocation);
+                /* fall through */
         case DN_NC:
         case DN_NR:
         case DN_RJ:
@@ -651,6 +649,7 @@ disc_reject:
                 break;
         default:
                 printk(KERN_DEBUG "DECnet: dn_destroy_sock passed socket in invalid state\n");
+                /* fall through */
         case DN_O:
                 dn_stop_slow_timer(sk);
 
diff --git a/net/decnet/dn_dev.c b/net/decnet/dn_dev.c
index df042b6d80b8..9153247dad28 100644
--- a/net/decnet/dn_dev.c
+++ b/net/decnet/dn_dev.c
@@ -1039,14 +1039,14 @@ static void dn_eth_down(struct net_device *dev)
 
 static void dn_dev_set_timer(struct net_device *dev);
 
-static void dn_dev_timer_func(unsigned long arg)
+static void dn_dev_timer_func(struct timer_list *t)
 {
-        struct net_device *dev = (struct net_device *)arg;
-        struct dn_dev *dn_db;
+        struct dn_dev *dn_db = from_timer(dn_db, t, timer);
+        struct net_device *dev;
         struct dn_ifaddr *ifa;
 
         rcu_read_lock();
-        dn_db = rcu_dereference(dev->dn_ptr);
+        dev = dn_db->dev;
         if (dn_db->t3 <= dn_db->parms.t2) {
                 if (dn_db->parms.timer3) {
                         for (ifa = rcu_dereference(dn_db->ifa_list);
@@ -1071,8 +1071,6 @@ static void dn_dev_set_timer(struct net_device *dev)
         if (dn_db->parms.t2 > dn_db->parms.t3)
                 dn_db->parms.t2 = dn_db->parms.t3;
 
-        dn_db->timer.data = (unsigned long)dev;
-        dn_db->timer.function = dn_dev_timer_func;
         dn_db->timer.expires = jiffies + (dn_db->parms.t2 * HZ);
 
         add_timer(&dn_db->timer);
@@ -1101,7 +1099,7 @@ static struct dn_dev *dn_dev_create(struct net_device *dev, int *err)
 
         rcu_assign_pointer(dev->dn_ptr, dn_db);
         dn_db->dev = dev;
-        init_timer(&dn_db->timer);
+        timer_setup(&dn_db->timer, dn_dev_timer_func, 0);
 
         dn_db->uptime = jiffies;
 
diff --git a/net/decnet/dn_nsp_in.c b/net/decnet/dn_nsp_in.c
index 7ac086d5c0c0..1b2120645730 100644
--- a/net/decnet/dn_nsp_in.c
+++ b/net/decnet/dn_nsp_in.c
@@ -776,12 +776,8 @@ static int dn_nsp_rx_packet(struct net *net, struct sock *sk2,
          * Swap src & dst and look up in the normal way.
          */
         if (unlikely(cb->rt_flags & DN_RT_F_RTS)) {
-                __le16 tmp = cb->dst_port;
-                cb->dst_port = cb->src_port;
-                cb->src_port = tmp;
-                tmp = cb->dst;
-                cb->dst = cb->src;
-                cb->src = tmp;
+                swap(cb->dst_port, cb->src_port);
+                swap(cb->dst, cb->src);
         }
 
         /*
diff --git a/net/decnet/dn_nsp_out.c b/net/decnet/dn_nsp_out.c
index 66f035e476ea..56a52a004c56 100644
--- a/net/decnet/dn_nsp_out.c
+++ b/net/decnet/dn_nsp_out.c
@@ -313,11 +313,8 @@ static __le16 *dn_mk_ack_header(struct sock *sk, struct sk_buff *skb, unsigned c
         ackcrs |= 0x8000;
 
         /* If this is an "other data/ack" message, swap acknum and ackcrs */
-        if (other) {
-                unsigned short tmp = acknum;
-                acknum = ackcrs;
-                ackcrs = tmp;
-        }
+        if (other)
+                swap(acknum, ackcrs);
 
         /* Set "cross subchannel" bit in ackcrs */
         ackcrs |= 0x2000;
@@ -491,17 +488,6 @@ void dn_send_conn_ack (struct sock *sk)
         dn_nsp_send(skb);
 }
 
-void dn_nsp_delayed_ack(struct sock *sk)
-{
-        struct dn_scp *scp = DN_SK(sk);
-
-        if (scp->ackxmt_oth != scp->numoth_rcv)
-                dn_nsp_send_oth_ack(sk);
-
-        if (scp->ackxmt_dat != scp->numdat_rcv)
-                dn_nsp_send_data_ack(sk);
-}
-
 static int dn_nsp_retrans_conn_conf(struct sock *sk)
 {
         struct dn_scp *scp = DN_SK(sk);
diff --git a/net/decnet/dn_route.c b/net/decnet/dn_route.c
index 6538632fbd03..324cb9f2f551 100644
--- a/net/decnet/dn_route.c
+++ b/net/decnet/dn_route.c
@@ -125,7 +125,7 @@ static struct neighbour *dn_dst_neigh_lookup(const struct dst_entry *dst,
                                              struct sk_buff *skb,
                                              const void *daddr);
 static int dn_route_input(struct sk_buff *);
-static void dn_run_flush(unsigned long dummy);
+static void dn_run_flush(struct timer_list *unused);
 
 static struct dn_rt_hash_bucket *dn_rt_hash_table;
 static unsigned int dn_rt_hash_mask;
@@ -183,7 +183,7 @@ static __inline__ unsigned int dn_hash(__le16 src, __le16 dst)
         return dn_rt_hash_mask & (unsigned int)tmp;
 }
 
-static void dn_dst_check_expire(unsigned long dummy)
+static void dn_dst_check_expire(struct timer_list *unused)
 {
         int i;
         struct dn_route *rt;
@@ -338,7 +338,7 @@ static int dn_insert_route(struct dn_route *rt, unsigned int hash, struct dn_rou
                                            dn_rt_hash_table[hash].chain);
                         rcu_assign_pointer(dn_rt_hash_table[hash].chain, rth);
 
-                        dst_use(&rth->dst, now);
+                        dst_hold_and_use(&rth->dst, now);
                         spin_unlock_bh(&dn_rt_hash_table[hash].lock);
 
                         dst_release_immediate(&rt->dst);
@@ -351,13 +351,13 @@ static int dn_insert_route(struct dn_route *rt, unsigned int hash, struct dn_rou
         rcu_assign_pointer(rt->dst.dn_next, dn_rt_hash_table[hash].chain);
         rcu_assign_pointer(dn_rt_hash_table[hash].chain, rt);
 
-        dst_use(&rt->dst, now);
+        dst_hold_and_use(&rt->dst, now);
         spin_unlock_bh(&dn_rt_hash_table[hash].lock);
         *rp = rt;
         return 0;
 }
 
-static void dn_run_flush(unsigned long dummy)
+static void dn_run_flush(struct timer_list *unused)
 {
         int i;
         struct dn_route *rt, *next;
@@ -1258,7 +1258,7 @@ static int __dn_route_output_key(struct dst_entry **pprt, const struct flowidn *
                             (flp->flowidn_mark == rt->fld.flowidn_mark) &&
                             dn_is_output_route(rt) &&
                             (rt->fld.flowidn_oif == flp->flowidn_oif)) {
-                                dst_use(&rt->dst, jiffies);
+                                dst_hold_and_use(&rt->dst, jiffies);
                                 rcu_read_unlock_bh();
                                 *pprt = &rt->dst;
                                 return 0;
@@ -1535,7 +1535,7 @@ static int dn_route_input(struct sk_buff *skb)
                     (rt->fld.flowidn_oif == 0) &&
                     (rt->fld.flowidn_mark == skb->mark) &&
                     (rt->fld.flowidn_iif == cb->iif)) {
-                        dst_use(&rt->dst, jiffies);
+                        dst_hold_and_use(&rt->dst, jiffies);
                         rcu_read_unlock();
                         skb_dst_set(skb, (struct dst_entry *)rt);
                         return 0;
@@ -1875,7 +1875,7 @@ void __init dn_route_init(void)
                 kmem_cache_create("dn_dst_cache", sizeof(struct dn_route), 0,
                                   SLAB_HWCACHE_ALIGN|SLAB_PANIC, NULL);
         dst_entries_init(&dn_dst_ops);
-        setup_timer(&dn_route_timer, dn_dst_check_expire, 0);
+        timer_setup(&dn_route_timer, dn_dst_check_expire, 0);
         dn_route_timer.expires = jiffies + decnet_dst_gc_interval * HZ;
         add_timer(&dn_route_timer);
 
diff --git a/net/decnet/dn_table.c b/net/decnet/dn_table.c
index 08667f68e601..f0710b5d037d 100644
--- a/net/decnet/dn_table.c
+++ b/net/decnet/dn_table.c
@@ -156,6 +156,7 @@ static void dn_rehash_zone(struct dn_zone *dz)
         default:
                 printk(KERN_DEBUG "DECnet: dn_rehash_zone: BUG! %d\n",
                        old_divisor);
+                /* fall through */
         case 256:
                 new_divisor = 1024;
                 new_hashmask = 0x3FF;
diff --git a/net/decnet/dn_timer.c b/net/decnet/dn_timer.c
index f430daed24a0..aa4155875ca8 100644
--- a/net/decnet/dn_timer.c
+++ b/net/decnet/dn_timer.c
@@ -34,11 +34,11 @@
 
 #define SLOW_INTERVAL (HZ/2)
 
-static void dn_slow_timer(unsigned long arg);
+static void dn_slow_timer(struct timer_list *t);
 
 void dn_start_slow_timer(struct sock *sk)
 {
-        setup_timer(&sk->sk_timer, dn_slow_timer, (unsigned long)sk);
+        timer_setup(&sk->sk_timer, dn_slow_timer, 0);
         sk_reset_timer(sk, &sk->sk_timer, jiffies + SLOW_INTERVAL);
 }
 
@@ -47,9 +47,9 @@ void dn_stop_slow_timer(struct sock *sk)
         sk_stop_timer(sk, &sk->sk_timer);
 }
 
-static void dn_slow_timer(unsigned long arg)
+static void dn_slow_timer(struct timer_list *t)
 {
-        struct sock *sk = (struct sock *)arg;
+        struct sock *sk = from_timer(sk, t, sk_timer);
         struct dn_scp *scp = DN_SK(sk);
 
         bh_lock_sock(sk);
diff --git a/net/dsa/Kconfig b/net/dsa/Kconfig
index cc5f8f971689..03c3bdf25468 100644
--- a/net/dsa/Kconfig
+++ b/net/dsa/Kconfig
@@ -7,6 +7,7 @@ config HAVE_NET_DSA
 config NET_DSA
         tristate "Distributed Switch Architecture"
         depends on HAVE_NET_DSA && MAY_USE_DEVLINK
+        depends on BRIDGE || BRIDGE=n
         select NET_SWITCHDEV
         select PHYLIB
         ---help---
@@ -19,6 +20,9 @@ if NET_DSA
 config NET_DSA_TAG_BRCM
         bool
 
+config NET_DSA_TAG_BRCM_PREPEND
+        bool
+
 config NET_DSA_TAG_DSA
         bool
 
diff --git a/net/dsa/Makefile b/net/dsa/Makefile
index 3d3c74193d06..0e13c1f95d13 100644
--- a/net/dsa/Makefile
+++ b/net/dsa/Makefile
@@ -1,10 +1,11 @@
 # SPDX-License-Identifier: GPL-2.0
 # the core
 obj-$(CONFIG_NET_DSA) += dsa_core.o
-dsa_core-y += dsa.o dsa2.o legacy.o port.o slave.o switch.o
+dsa_core-y += dsa.o dsa2.o legacy.o master.o port.o slave.o switch.o
 
 # tagging formats
 dsa_core-$(CONFIG_NET_DSA_TAG_BRCM) += tag_brcm.o
+dsa_core-$(CONFIG_NET_DSA_TAG_BRCM_PREPEND) += tag_brcm.o
 dsa_core-$(CONFIG_NET_DSA_TAG_DSA) += tag_dsa.o
 dsa_core-$(CONFIG_NET_DSA_TAG_EDSA) += tag_edsa.o
 dsa_core-$(CONFIG_NET_DSA_TAG_KSZ) += tag_ksz.o
diff --git a/net/dsa/dsa.c b/net/dsa/dsa.c
index 03c58b0eb082..6a9d0f50fbee 100644
--- a/net/dsa/dsa.c
+++ b/net/dsa/dsa.c
@@ -14,6 +14,7 @@
 #include <linux/platform_device.h>
 #include <linux/slab.h>
 #include <linux/module.h>
+#include <linux/notifier.h>
 #include <linux/of.h>
 #include <linux/of_mdio.h>
 #include <linux/of_platform.h>
@@ -43,6 +44,9 @@ const struct dsa_device_ops *dsa_device_ops[DSA_TAG_LAST] = {
 #ifdef CONFIG_NET_DSA_TAG_BRCM
         [DSA_TAG_PROTO_BRCM] = &brcm_netdev_ops,
 #endif
+#ifdef CONFIG_NET_DSA_TAG_BRCM_PREPEND
+        [DSA_TAG_PROTO_BRCM_PREPEND] = &brcm_prepend_netdev_ops,
+#endif
 #ifdef CONFIG_NET_DSA_TAG_DSA
         [DSA_TAG_PROTO_DSA] = &dsa_netdev_ops,
 #endif
@@ -67,37 +71,6 @@ const struct dsa_device_ops *dsa_device_ops[DSA_TAG_LAST] = {
         [DSA_TAG_PROTO_NONE] = &none_ops,
 };
 
-int dsa_cpu_dsa_setup(struct dsa_port *port)
-{
-        struct device_node *port_dn = port->dn;
-        struct dsa_switch *ds = port->ds;
-        struct phy_device *phydev;
-        int ret, mode;
-
-        if (of_phy_is_fixed_link(port_dn)) {
-                ret = of_phy_register_fixed_link(port_dn);
-                if (ret) {
-                        dev_err(ds->dev, "failed to register fixed PHY\n");
-                        return ret;
-                }
-                phydev = of_phy_find_device(port_dn);
-
-                mode = of_get_phy_mode(port_dn);
-                if (mode < 0)
-                        mode = PHY_INTERFACE_MODE_NA;
-                phydev->interface = mode;
-
-                genphy_config_init(phydev);
-                genphy_read_status(phydev);
-                if (ds->ops->adjust_link)
-                        ds->ops->adjust_link(ds, port->index, phydev);
-
-                put_device(&phydev->mdio.dev);
-        }
-
-        return 0;
-}
-
 const struct dsa_device_ops *dsa_resolve_tag_protocol(int tag_protocol)
 {
         const struct dsa_device_ops *ops;
@@ -112,42 +85,6 @@ const struct dsa_device_ops *dsa_resolve_tag_protocol(int tag_protocol)
         return ops;
 }
 
-int dsa_cpu_port_ethtool_setup(struct dsa_port *cpu_dp)
-{
-        struct dsa_switch *ds = cpu_dp->ds;
-        struct net_device *master;
-        struct ethtool_ops *cpu_ops;
-
-        master = cpu_dp->netdev;
-
-        cpu_ops = devm_kzalloc(ds->dev, sizeof(*cpu_ops), GFP_KERNEL);
-        if (!cpu_ops)
-                return -ENOMEM;
-
-        memcpy(&cpu_dp->ethtool_ops, master->ethtool_ops,
-               sizeof(struct ethtool_ops));
-        cpu_dp->orig_ethtool_ops = master->ethtool_ops;
-        memcpy(cpu_ops, &cpu_dp->ethtool_ops,
-               sizeof(struct ethtool_ops));
-        dsa_cpu_port_ethtool_init(cpu_ops);
-        master->ethtool_ops = cpu_ops;
-
-        return 0;
-}
-
-void dsa_cpu_port_ethtool_restore(struct dsa_port *cpu_dp)
-{
-        cpu_dp->netdev->ethtool_ops = cpu_dp->orig_ethtool_ops;
-}
-
-void dsa_cpu_dsa_destroy(struct dsa_port *port)
-{
-        struct device_node *port_dn = port->dn;
-
-        if (of_phy_is_fixed_link(port_dn))
-                of_phy_deregister_fixed_link(port_dn);
-}
-
 static int dev_is_class(struct device *dev, void *class)
 {
         if (dev->class != NULL && !strcmp(dev->class->name, class))
@@ -188,12 +125,12 @@ EXPORT_SYMBOL_GPL(dsa_dev_to_net_device);
 static int dsa_switch_rcv(struct sk_buff *skb, struct net_device *dev,
                           struct packet_type *pt, struct net_device *unused)
 {
-        struct dsa_switch_tree *dst = dev->dsa_ptr;
+        struct dsa_port *cpu_dp = dev->dsa_ptr;
         struct sk_buff *nskb = NULL;
         struct pcpu_sw_netstats *s;
         struct dsa_slave_priv *p;
 
-        if (unlikely(dst == NULL)) {
+        if (unlikely(!cpu_dp)) {
                 kfree_skb(skb);
                 return 0;
         }
@@ -202,7 +139,7 @@ static int dsa_switch_rcv(struct sk_buff *skb, struct net_device *dev,
         if (!skb)
                 return 0;
 
-        nskb = dst->rcv(skb, dev, pt);
+        nskb = cpu_dp->rcv(skb, dev, pt);
         if (!nskb) {
                 kfree_skb(skb);
                 return 0;
@@ -228,7 +165,7 @@ static int dsa_switch_rcv(struct sk_buff *skb, struct net_device *dev,
 #ifdef CONFIG_PM_SLEEP
 static bool dsa_is_port_initialized(struct dsa_switch *ds, int p)
 {
-        return ds->enabled_port_mask & (1 << p) && ds->ports[p].netdev;
+        return dsa_is_user_port(ds, p) && ds->ports[p].slave;
 }
 
 int dsa_switch_suspend(struct dsa_switch *ds)
@@ -240,7 +177,7 @@ int dsa_switch_suspend(struct dsa_switch *ds)
                 if (!dsa_is_port_initialized(ds, i))
                         continue;
 
-                ret = dsa_slave_suspend(ds->ports[i].netdev);
+                ret = dsa_slave_suspend(ds->ports[i].slave);
                 if (ret)
                         return ret;
         }
@@ -267,7 +204,7 @@ int dsa_switch_resume(struct dsa_switch *ds)
                 if (!dsa_is_port_initialized(ds, i))
                         continue;
 
-                ret = dsa_slave_resume(ds->ports[i].netdev);
+                ret = dsa_slave_resume(ds->ports[i].slave);
                 if (ret)
                         return ret;
         }
@@ -289,6 +226,28 @@ bool dsa_schedule_work(struct work_struct *work)
         return queue_work(dsa_owq, work);
 }
 
+static ATOMIC_NOTIFIER_HEAD(dsa_notif_chain);
+
+int register_dsa_notifier(struct notifier_block *nb)
+{
+        return atomic_notifier_chain_register(&dsa_notif_chain, nb);
+}
+EXPORT_SYMBOL_GPL(register_dsa_notifier);
+
+int unregister_dsa_notifier(struct notifier_block *nb)
+{
+        return atomic_notifier_chain_unregister(&dsa_notif_chain, nb);
+}
+EXPORT_SYMBOL_GPL(unregister_dsa_notifier);
+
+int call_dsa_notifiers(unsigned long val, struct net_device *dev,
+                       struct dsa_notifier_info *info)
+{
+        info->dev = dev;
+        return atomic_notifier_call_chain(&dsa_notif_chain, val, info);
+}
+EXPORT_SYMBOL_GPL(call_dsa_notifiers);
+
 static int __init dsa_init_module(void)
 {
         int rc;
diff --git a/net/dsa/dsa2.c b/net/dsa/dsa2.c
index 045d8a176279..44e3fb7dec8c 100644
--- a/net/dsa/dsa2.c
+++ b/net/dsa/dsa2.c
@@ -21,293 +21,297 @@
 
 #include "dsa_priv.h"
 
-static LIST_HEAD(dsa_switch_trees);
+static LIST_HEAD(dsa_tree_list);
 static DEFINE_MUTEX(dsa2_mutex);
 
 static const struct devlink_ops dsa_devlink_ops = {
 };
 
-static struct dsa_switch_tree *dsa_get_dst(u32 tree)
+static struct dsa_switch_tree *dsa_tree_find(int index)
 {
         struct dsa_switch_tree *dst;
 
-        list_for_each_entry(dst, &dsa_switch_trees, list)
-                if (dst->tree == tree) {
-                        kref_get(&dst->refcount);
+        list_for_each_entry(dst, &dsa_tree_list, list)
+                if (dst->index == index)
                         return dst;
-                }
+
         return NULL;
 }
 
-static void dsa_free_dst(struct kref *ref)
+static struct dsa_switch_tree *dsa_tree_alloc(int index)
 {
-        struct dsa_switch_tree *dst = container_of(ref, struct dsa_switch_tree,
-                                                   refcount);
+        struct dsa_switch_tree *dst;
 
-        list_del(&dst->list);
-        kfree(dst);
+        dst = kzalloc(sizeof(*dst), GFP_KERNEL);
+        if (!dst)
+                return NULL;
+
+        dst->index = index;
+
+        INIT_LIST_HEAD(&dst->list);
+        list_add_tail(&dsa_tree_list, &dst->list);
+
+        /* Initialize the reference counter to the number of switches, not 1 */
+        kref_init(&dst->refcount);
+        refcount_set(&dst->refcount.refcount, 0);
+
+        return dst;
 }
 
-static void dsa_put_dst(struct dsa_switch_tree *dst)
+static void dsa_tree_free(struct dsa_switch_tree *dst)
 {
-        kref_put(&dst->refcount, dsa_free_dst);
+        list_del(&dst->list);
+        kfree(dst);
 }
 
-static struct dsa_switch_tree *dsa_add_dst(u32 tree)
+static struct dsa_switch_tree *dsa_tree_touch(int index)
 {
         struct dsa_switch_tree *dst;
 
-        dst = kzalloc(sizeof(*dst), GFP_KERNEL);
+        dst = dsa_tree_find(index);
         if (!dst)
-                return NULL;
-        dst->tree = tree;
-        INIT_LIST_HEAD(&dst->list);
-        list_add_tail(&dsa_switch_trees, &dst->list);
-        kref_init(&dst->refcount);
+                dst = dsa_tree_alloc(index);
 
         return dst;
 }
 
-static void dsa_dst_add_ds(struct dsa_switch_tree *dst,
-                           struct dsa_switch *ds, u32 index)
+static void dsa_tree_get(struct dsa_switch_tree *dst)
 {
         kref_get(&dst->refcount);
-        dst->ds[index] = ds;
 }
 
-static void dsa_dst_del_ds(struct dsa_switch_tree *dst,
-                           struct dsa_switch *ds, u32 index)
+static void dsa_tree_release(struct kref *ref)
 {
-        dst->ds[index] = NULL;
-        kref_put(&dst->refcount, dsa_free_dst);
+        struct dsa_switch_tree *dst;
+
+        dst = container_of(ref, struct dsa_switch_tree, refcount);
+
+        dsa_tree_free(dst);
 }
 
-/* For platform data configurations, we need to have a valid name argument to
- * differentiate a disabled port from an enabled one
- */
-static bool dsa_port_is_valid(struct dsa_port *port)
+static void dsa_tree_put(struct dsa_switch_tree *dst)
 {
-        return !!(port->dn || port->name);
+        kref_put(&dst->refcount, dsa_tree_release);
 }
 
 static bool dsa_port_is_dsa(struct dsa_port *port)
 {
-        if (port->name && !strcmp(port->name, "dsa"))
-                return true;
-        else
-                return !!of_parse_phandle(port->dn, "link", 0);
+        return port->type == DSA_PORT_TYPE_DSA;
 }
 
 static bool dsa_port_is_cpu(struct dsa_port *port)
 {
-        if (port->name && !strcmp(port->name, "cpu"))
-                return true;
-        else
-                return !!of_parse_phandle(port->dn, "ethernet", 0);
+        return port->type == DSA_PORT_TYPE_CPU;
 }
 
-static bool dsa_ds_find_port_dn(struct dsa_switch *ds,
-                                struct device_node *port)
+static bool dsa_port_is_user(struct dsa_port *dp)
 {
-        u32 index;
-
-        for (index = 0; index < ds->num_ports; index++)
-                if (ds->ports[index].dn == port)
-                        return true;
-        return false;
+        return dp->type == DSA_PORT_TYPE_USER;
 }
 
-static struct dsa_switch *dsa_dst_find_port_dn(struct dsa_switch_tree *dst,
-                                               struct device_node *port)
+static struct dsa_port *dsa_tree_find_port_by_node(struct dsa_switch_tree *dst,
+                                                   struct device_node *dn)
 {
         struct dsa_switch *ds;
-        u32 index;
+        struct dsa_port *dp;
+        int device, port;
 
-        for (index = 0; index < DSA_MAX_SWITCHES; index++) {
-                ds = dst->ds[index];
+        for (device = 0; device < DSA_MAX_SWITCHES; device++) {
+                ds = dst->ds[device];
                 if (!ds)
                         continue;
 
-                if (dsa_ds_find_port_dn(ds, port))
-                        return ds;
+                for (port = 0; port < ds->num_ports; port++) {
+                        dp = &ds->ports[port];
+
+                        if (dp->dn == dn)
+                                return dp;
+                }
         }
 
         return NULL;
 }
 
-static int dsa_port_complete(struct dsa_switch_tree *dst,
-                             struct dsa_switch *src_ds,
-                             struct dsa_port *port,
-                             u32 src_port)
+static bool dsa_port_setup_routing_table(struct dsa_port *dp)
 {
-        struct device_node *link;
-        int index;
-        struct dsa_switch *dst_ds;
-
-        for (index = 0;; index++) {
-                link = of_parse_phandle(port->dn, "link", index);
-                if (!link)
-                        break;
-
-                dst_ds = dsa_dst_find_port_dn(dst, link);
-                of_node_put(link);
+        struct dsa_switch *ds = dp->ds;
+        struct dsa_switch_tree *dst = ds->dst;
+        struct device_node *dn = dp->dn;
+        struct of_phandle_iterator it;
+        struct dsa_port *link_dp;
+        int err;
 
-                if (!dst_ds)
-                        return 1;
+        of_for_each_phandle(&it, err, dn, "link", NULL, 0) {
+                link_dp = dsa_tree_find_port_by_node(dst, it.node);
+                if (!link_dp) {
+                        of_node_put(it.node);
+                        return false;
+                }
 
-                src_ds->rtable[dst_ds->index] = src_port;
+                ds->rtable[link_dp->ds->index] = dp->index;
         }
 
-        return 0;
+        return true;
 }
 
-/* A switch is complete if all the DSA ports phandles point to ports
- * known in the tree. A return value of 1 means the tree is not
- * complete. This is not an error condition. A value of 0 is
- * success.
- */
-static int dsa_ds_complete(struct dsa_switch_tree *dst, struct dsa_switch *ds)
+static bool dsa_switch_setup_routing_table(struct dsa_switch *ds)
 {
-        struct dsa_port *port;
-        u32 index;
-        int err;
-
-        for (index = 0; index < ds->num_ports; index++) {
-                port = &ds->ports[index];
-                if (!dsa_port_is_valid(port))
-                        continue;
+        bool complete = true;
+        struct dsa_port *dp;
+        int i;
 
-                if (!dsa_port_is_dsa(port))
-                        continue;
+        for (i = 0; i < DSA_MAX_SWITCHES; i++)
+                ds->rtable[i] = DSA_RTABLE_NONE;
 
-                err = dsa_port_complete(dst, ds, port, index);
-                if (err != 0)
-                        return err;
+        for (i = 0; i < ds->num_ports; i++) {
+                dp = &ds->ports[i];
 
-                ds->dsa_port_mask |= BIT(index);
+                if (dsa_port_is_dsa(dp)) {
+                        complete = dsa_port_setup_routing_table(dp);
+                        if (!complete)
+                                break;
+                }
         }
 
-        return 0;
+        return complete;
 }
 
-/* A tree is complete if all the DSA ports phandles point to ports
- * known in the tree. A return value of 1 means the tree is not
- * complete. This is not an error condition. A value of 0 is
- * success.
- */
-static int dsa_dst_complete(struct dsa_switch_tree *dst)
+static bool dsa_tree_setup_routing_table(struct dsa_switch_tree *dst)
 {
         struct dsa_switch *ds;
-        u32 index;
-        int err;
+        bool complete = true;
+        int device;
 
-        for (index = 0; index < DSA_MAX_SWITCHES; index++) {
-                ds = dst->ds[index];
+        for (device = 0; device < DSA_MAX_SWITCHES; device++) {
+                ds = dst->ds[device];
                 if (!ds)
                         continue;
 
-                err = dsa_ds_complete(dst, ds);
-                if (err != 0)
-                        return err;
+                complete = dsa_switch_setup_routing_table(ds);
+                if (!complete)
+                        break;
         }
 
-        return 0;
+        return complete;
 }
 
-static int dsa_dsa_port_apply(struct dsa_port *port)
+static struct dsa_port *dsa_tree_find_first_cpu(struct dsa_switch_tree *dst)
 {
-        struct dsa_switch *ds = port->ds;
-        int err;
+        struct dsa_switch *ds;
+        struct dsa_port *dp;
+        int device, port;
 
-        err = dsa_cpu_dsa_setup(port);
-        if (err) {
-                dev_warn(ds->dev, "Failed to setup dsa port %d: %d\n",
-                         port->index, err);
-                return err;
-        }
+        for (device = 0; device < DSA_MAX_SWITCHES; device++) {
+                ds = dst->ds[device];
+                if (!ds)
+                        continue;
 
-        memset(&port->devlink_port, 0, sizeof(port->devlink_port));
+                for (port = 0; port < ds->num_ports; port++) {
+                        dp = &ds->ports[port];
 
-        return devlink_port_register(ds->devlink, &port->devlink_port,
-                                     port->index);
-}
+                        if (dsa_port_is_cpu(dp))
+                                return dp;
+                }
+        }
 
-static void dsa_dsa_port_unapply(struct dsa_port *port)
-{
-        devlink_port_unregister(&port->devlink_port);
-        dsa_cpu_dsa_destroy(port);
+        return NULL;
 }
 
-static int dsa_cpu_port_apply(struct dsa_port *port)
+static int dsa_tree_setup_default_cpu(struct dsa_switch_tree *dst)
 {
-        struct dsa_switch *ds = port->ds;
-        int err;
+        struct dsa_switch *ds;
+        struct dsa_port *dp;
+        int device, port;
 
-        err = dsa_cpu_dsa_setup(port);
-        if (err) {
-                dev_warn(ds->dev, "Failed to setup cpu port %d: %d\n",
-                         port->index, err);
-                return err;
+        /* DSA currently only supports a single CPU port */
+        dst->cpu_dp = dsa_tree_find_first_cpu(dst);
+        if (!dst->cpu_dp) {
+                pr_warn("Tree has no master device\n");
+                return -EINVAL;
         }
 
-        memset(&port->devlink_port, 0, sizeof(port->devlink_port));
-        err = devlink_port_register(ds->devlink, &port->devlink_port,
-                                    port->index);
-        return err;
+        /* Assign the default CPU port to all ports of the fabric */
+        for (device = 0; device < DSA_MAX_SWITCHES; device++) {
+                ds = dst->ds[device];
+                if (!ds)
+                        continue;
+
+                for (port = 0; port < ds->num_ports; port++) {
+                        dp = &ds->ports[port];
+
+                        if (dsa_port_is_user(dp))
+                                dp->cpu_dp = dst->cpu_dp;
+                }
+        }
+
+        return 0;
 }
 
-static void dsa_cpu_port_unapply(struct dsa_port *port)
+static void dsa_tree_teardown_default_cpu(struct dsa_switch_tree *dst)
 {
-        devlink_port_unregister(&port->devlink_port);
-        dsa_cpu_dsa_destroy(port);
-        port->ds->cpu_port_mask &= ~BIT(port->index);
-
+        /* DSA currently only supports a single CPU port */
+        dst->cpu_dp = NULL;
 }
 
-static int dsa_user_port_apply(struct dsa_port *port)
+static int dsa_port_setup(struct dsa_port *dp)
 {
-        struct dsa_switch *ds = port->ds;
-        const char *name = port->name;
+        struct dsa_switch *ds = dp->ds;
         int err;
 
-        if (port->dn)
-                name = of_get_property(port->dn, "label", NULL);
-        if (!name)
-                name = "eth%d";
+        memset(&dp->devlink_port, 0, sizeof(dp->devlink_port));
 
-        err = dsa_slave_create(port, name);
-        if (err) {
-                dev_warn(ds->dev, "Failed to create slave %d: %d\n",
-                         port->index, err);
-                port->netdev = NULL;
-                return err;
-        }
-
-        memset(&port->devlink_port, 0, sizeof(port->devlink_port));
-        err = devlink_port_register(ds->devlink, &port->devlink_port,
-                                    port->index);
+        err = devlink_port_register(ds->devlink, &dp->devlink_port, dp->index);
         if (err)
                 return err;
 
-        devlink_port_type_eth_set(&port->devlink_port, port->netdev);
+        switch (dp->type) {
+        case DSA_PORT_TYPE_UNUSED:
+                break;
+        case DSA_PORT_TYPE_CPU:
+        case DSA_PORT_TYPE_DSA:
+                err = dsa_port_fixed_link_register_of(dp);
+                if (err) {
+                        dev_err(ds->dev, "failed to register fixed link for port %d.%d\n",
+                                ds->index, dp->index);
+                        return err;
+                }
+
+                break;
+        case DSA_PORT_TYPE_USER:
+                err = dsa_slave_create(dp);
+                if (err)
+                        dev_err(ds->dev, "failed to create slave for port %d.%d\n",
+                                ds->index, dp->index);
+                else
+                        devlink_port_type_eth_set(&dp->devlink_port, dp->slave);
+                break;
+        }
 
         return 0;
 }
 
-static void dsa_user_port_unapply(struct dsa_port *port)
+static void dsa_port_teardown(struct dsa_port *dp)
 {
-        devlink_port_unregister(&port->devlink_port);
-        if (port->netdev) {
-                dsa_slave_destroy(port->netdev);
-                port->netdev = NULL;
-                port->ds->enabled_port_mask &= ~(1 << port->index);
+        devlink_port_unregister(&dp->devlink_port);
+
+        switch (dp->type) {
+        case DSA_PORT_TYPE_UNUSED:
+                break;
+        case DSA_PORT_TYPE_CPU:
+        case DSA_PORT_TYPE_DSA:
+                dsa_port_fixed_link_unregister_of(dp);
+                break;
+        case DSA_PORT_TYPE_USER:
+                if (dp->slave) {
+                        dsa_slave_destroy(dp->slave);
+                        dp->slave = NULL;
+                }
+                break;
         }
 }
 
-static int dsa_ds_apply(struct dsa_switch_tree *dst, struct dsa_switch *ds)
+static int dsa_switch_setup(struct dsa_switch *ds)
 {
-        struct dsa_port *port;
-        u32 index;
         int err;
 
         /* Initialize ds->phys_mii_mask before registering the slave MDIO bus
@@ -315,7 +319,7 @@ static int dsa_ds_apply(struct dsa_switch_tree *dst, struct dsa_switch *ds)
          * the slave MDIO bus driver rely on these values for probing PHY
          * devices or not
          */
-        ds->phys_mii_mask = ds->enabled_port_mask;
+        ds->phys_mii_mask |= dsa_user_ports(ds);
 
         /* Add the switch to devlink before calling setup, so that setup can
          * add dpipe tables
@@ -336,12 +340,6 @@ static int dsa_ds_apply(struct dsa_switch_tree *dst, struct dsa_switch *ds)
         if (err)
                 return err;
 
-        if (ds->ops->set_addr) {
-                err = ds->ops->set_addr(ds, dst->cpu_dp->netdev->dev_addr);
-                if (err < 0)
-                        return err;
-        }
-
         if (!ds->slave_mii_bus && ds->ops->phy_read) {
                 ds->slave_mii_bus = devm_mdiobus_alloc(ds->dev);
                 if (!ds->slave_mii_bus)
@@ -354,56 +352,11 @@ static int dsa_ds_apply(struct dsa_switch_tree *dst, struct dsa_switch *ds)
                         return err;
         }
 
-        for (index = 0; index < ds->num_ports; index++) {
-                port = &ds->ports[index];
-                if (!dsa_port_is_valid(port))
-                        continue;
-
-                if (dsa_port_is_dsa(port)) {
-                        err = dsa_dsa_port_apply(port);
-                        if (err)
-                                return err;
-                        continue;
-                }
-
-                if (dsa_port_is_cpu(port)) {
-                        err = dsa_cpu_port_apply(port);
-                        if (err)
-                                return err;
-                        continue;
-                }
-
-                err = dsa_user_port_apply(port);
-                if (err)
-                        continue;
-        }
-
         return 0;
 }
 
-static void dsa_ds_unapply(struct dsa_switch_tree *dst, struct dsa_switch *ds)
+static void dsa_switch_teardown(struct dsa_switch *ds)
 {
-        struct dsa_port *port;
-        u32 index;
-
-        for (index = 0; index < ds->num_ports; index++) {
-                port = &ds->ports[index];
-                if (!dsa_port_is_valid(port))
-                        continue;
-
-                if (dsa_port_is_dsa(port)) {
-                        dsa_dsa_port_unapply(port);
-                        continue;
-                }
-
-                if (dsa_port_is_cpu(port)) {
-                        dsa_cpu_port_unapply(port);
-                        continue;
-                }
-
-                dsa_user_port_unapply(port);
-        }
-
         if (ds->slave_mii_bus && ds->ops->phy_read)
                 mdiobus_unregister(ds->slave_mii_bus);
 
@@ -417,199 +370,228 @@ static void dsa_ds_unapply(struct dsa_switch_tree *dst, struct dsa_switch *ds)
 
 }
 
-static int dsa_dst_apply(struct dsa_switch_tree *dst)
+static int dsa_tree_setup_switches(struct dsa_switch_tree *dst)
 {
         struct dsa_switch *ds;
-        u32 index;
+        struct dsa_port *dp;
+        int device, port;
         int err;
 
-        for (index = 0; index < DSA_MAX_SWITCHES; index++) {
-                ds = dst->ds[index];
+        for (device = 0; device < DSA_MAX_SWITCHES; device++) {
+                ds = dst->ds[device];
                 if (!ds)
                         continue;
 
-                err = dsa_ds_apply(dst, ds);
+                err = dsa_switch_setup(ds);
                 if (err)
                         return err;
-        }
 
-        if (dst->cpu_dp) {
-                err = dsa_cpu_port_ethtool_setup(dst->cpu_dp);
-                if (err)
-                        return err;
-        }
+                for (port = 0; port < ds->num_ports; port++) {
+                        dp = &ds->ports[port];
 
-        /* If we use a tagging format that doesn't have an ethertype
-         * field, make sure that all packets from this point on get
-         * sent to the tag format's receive function.
-         */
-        wmb();
-        dst->cpu_dp->netdev->dsa_ptr = dst;
-        dst->applied = true;
+                        err = dsa_port_setup(dp);
+                        if (err)
+                                return err;
+                }
+        }
 
         return 0;
 }
 
-static void dsa_dst_unapply(struct dsa_switch_tree *dst)
+static void dsa_tree_teardown_switches(struct dsa_switch_tree *dst)
 {
         struct dsa_switch *ds;
-        u32 index;
-
-        if (!dst->applied)
-                return;
-
-        dst->cpu_dp->netdev->dsa_ptr = NULL;
-
-        /* If we used a tagging format that doesn't have an ethertype
-         * field, make sure that all packets from this point get sent
-         * without the tag and go through the regular receive path.
-         */
-        wmb();
+        struct dsa_port *dp;
+        int device, port;
 
-        for (index = 0; index < DSA_MAX_SWITCHES; index++) {
-                ds = dst->ds[index];
+        for (device = 0; device < DSA_MAX_SWITCHES; device++) {
+                ds = dst->ds[device];
                 if (!ds)
                         continue;
 
-                dsa_ds_unapply(dst, ds);
-        }
+                for (port = 0; port < ds->num_ports; port++) {
+                        dp = &ds->ports[port];
 
-        if (dst->cpu_dp) {
-                dsa_cpu_port_ethtool_restore(dst->cpu_dp);
-                dst->cpu_dp = NULL;
+                        dsa_port_teardown(dp);
+                }
+
+                dsa_switch_teardown(ds);
         }
+}
+
+static int dsa_tree_setup_master(struct dsa_switch_tree *dst)
+{
+        struct dsa_port *cpu_dp = dst->cpu_dp;
+        struct net_device *master = cpu_dp->master;
 
-        pr_info("DSA: tree %d unapplied\n", dst->tree);
-        dst->applied = false;
+        /* DSA currently supports a single pair of CPU port and master device */
+        return dsa_master_setup(master, cpu_dp);
 }
 
-static int dsa_cpu_parse(struct dsa_port *port, u32 index,
-                         struct dsa_switch_tree *dst,
-                         struct dsa_switch *ds)
+static void dsa_tree_teardown_master(struct dsa_switch_tree *dst)
 {
-        enum dsa_tag_protocol tag_protocol;
-        struct net_device *ethernet_dev;
-        struct device_node *ethernet;
+        struct dsa_port *cpu_dp = dst->cpu_dp;
+        struct net_device *master = cpu_dp->master;
 
-        if (port->dn) {
-                ethernet = of_parse_phandle(port->dn, "ethernet", 0);
-                if (!ethernet)
-                        return -EINVAL;
-                ethernet_dev = of_find_net_device_by_node(ethernet);
-                if (!ethernet_dev)
-                        return -EPROBE_DEFER;
-        } else {
-                ethernet_dev = dsa_dev_to_net_device(ds->cd->netdev[index]);
-                if (!ethernet_dev)
-                        return -EPROBE_DEFER;
-                dev_put(ethernet_dev);
-        }
+        return dsa_master_teardown(master);
+}
 
-        if (!dst->cpu_dp) {
-                dst->cpu_dp = port;
-                dst->cpu_dp->netdev = ethernet_dev;
+static int dsa_tree_setup(struct dsa_switch_tree *dst)
+{
+        bool complete;
+        int err;
+
+        if (dst->setup) {
+                pr_err("DSA: tree %d already setup! Disjoint trees?\n",
+                       dst->index);
+                return -EEXIST;
         }
 
-        /* Initialize cpu_port_mask now for drv->setup()
-         * to have access to a correct value, just like what
-         * net/dsa/dsa.c::dsa_switch_setup_one does.
-         */
-        ds->cpu_port_mask |= BIT(index);
+        complete = dsa_tree_setup_routing_table(dst);
+        if (!complete)
+                return 0;
 
-        tag_protocol = ds->ops->get_tag_protocol(ds);
-        dst->tag_ops = dsa_resolve_tag_protocol(tag_protocol);
-        if (IS_ERR(dst->tag_ops)) {
-                dev_warn(ds->dev, "No tagger for this switch\n");
-                ds->cpu_port_mask &= ~BIT(index);
-                return PTR_ERR(dst->tag_ops);
-        }
+        err = dsa_tree_setup_default_cpu(dst);
+        if (err)
+                return err;
 
-        dst->rcv = dst->tag_ops->rcv;
+        err = dsa_tree_setup_switches(dst);
+        if (err)
+                return err;
+
+        err = dsa_tree_setup_master(dst);
+        if (err)
+                return err;
+
+        dst->setup = true;
+
+        pr_info("DSA: tree %d setup\n", dst->index);
 
         return 0;
 }
 
-static int dsa_ds_parse(struct dsa_switch_tree *dst, struct dsa_switch *ds)
+static void dsa_tree_teardown(struct dsa_switch_tree *dst)
+{
+        if (!dst->setup)
+                return;
+
+        dsa_tree_teardown_master(dst);
+
+        dsa_tree_teardown_switches(dst);
+
+        dsa_tree_teardown_default_cpu(dst);
+
+        pr_info("DSA: tree %d torn down\n", dst->index);
+
+        dst->setup = false;
+}
+
+static void dsa_tree_remove_switch(struct dsa_switch_tree *dst,
+                                   unsigned int index)
 {
-        struct dsa_port *port;
-        u32 index;
+        dsa_tree_teardown(dst);
+
+        dst->ds[index] = NULL;
+        dsa_tree_put(dst);
+}
+
+static int dsa_tree_add_switch(struct dsa_switch_tree *dst,
+                               struct dsa_switch *ds)
+{
+        unsigned int index = ds->index;
         int err;
 
-        for (index = 0; index < ds->num_ports; index++) {
-                port = &ds->ports[index];
-                if (!dsa_port_is_valid(port) ||
-                    dsa_port_is_dsa(port))
-                        continue;
+        if (dst->ds[index])
+                return -EBUSY;
 
-                if (dsa_port_is_cpu(port)) {
-                        err = dsa_cpu_parse(port, index, dst, ds);
-                        if (err)
-                                return err;
-                } else {
-                        /* Initialize enabled_port_mask now for drv->setup()
-                         * to have access to a correct value, just like what
-                         * net/dsa/dsa.c::dsa_switch_setup_one does.
-                         */
-                        ds->enabled_port_mask |= BIT(index);
-                }
+        dsa_tree_get(dst);
+        dst->ds[index] = ds;
 
-        }
+        err = dsa_tree_setup(dst);
+        if (err)
+                dsa_tree_remove_switch(dst, index);
 
-        pr_info("DSA: switch %d %d parsed\n", dst->tree, ds->index);
+        return err;
+}
+
+static int dsa_port_parse_user(struct dsa_port *dp, const char *name)
+{
+        if (!name)
+                name = "eth%d";
+
+        dp->type = DSA_PORT_TYPE_USER;
+        dp->name = name;
 
         return 0;
 }
 
-static int dsa_dst_parse(struct dsa_switch_tree *dst)
+static int dsa_port_parse_dsa(struct dsa_port *dp)
 {
-        struct dsa_switch *ds;
-        struct dsa_port *dp;
-        u32 index;
-        int port;
-        int err;
+        dp->type = DSA_PORT_TYPE_DSA;
 
-        for (index = 0; index < DSA_MAX_SWITCHES; index++) {
-                ds = dst->ds[index];
-                if (!ds)
-                        continue;
+        return 0;
+}
 
-                err = dsa_ds_parse(dst, ds);
-                if (err)
-                        return err;
-        }
+static int dsa_port_parse_cpu(struct dsa_port *dp, struct net_device *master)
+{
+        struct dsa_switch *ds = dp->ds;
+        struct dsa_switch_tree *dst = ds->dst;
+        const struct dsa_device_ops *tag_ops;
+        enum dsa_tag_protocol tag_protocol;
 
-        if (!dst->cpu_dp) {
-                pr_warn("Tree has no master device\n");
-                return -EINVAL;
+        tag_protocol = ds->ops->get_tag_protocol(ds, dp->index);
+        tag_ops = dsa_resolve_tag_protocol(tag_protocol);
+        if (IS_ERR(tag_ops)) {
+                dev_warn(ds->dev, "No tagger for this switch\n");
+                return PTR_ERR(tag_ops);
         }
 
-        /* Assign the default CPU port to all ports of the fabric */
-        for (index = 0; index < DSA_MAX_SWITCHES; index++) {
-                ds = dst->ds[index];
-                if (!ds)
-                        continue;
+        dp->type = DSA_PORT_TYPE_CPU;
+        dp->rcv = tag_ops->rcv;
+        dp->tag_ops = tag_ops;
+        dp->master = master;
+        dp->dst = dst;
 
-                for (port = 0; port < ds->num_ports; port++) {
-                        dp = &ds->ports[port];
-                        if (!dsa_port_is_valid(dp) ||
-                            dsa_port_is_dsa(dp) ||
-                            dsa_port_is_cpu(dp))
-                                continue;
+        return 0;
+}
 
-                        dp->cpu_dp = dst->cpu_dp;
-                }
+static int dsa_port_parse_of(struct dsa_port *dp, struct device_node *dn)
+{
+        struct device_node *ethernet = of_parse_phandle(dn, "ethernet", 0);
+        const char *name = of_get_property(dn, "label", NULL);
+        bool link = of_property_read_bool(dn, "link");
+
+        dp->dn = dn;
+
+        if (ethernet) {
+                struct net_device *master;
+
+                master = of_find_net_device_by_node(ethernet);
+                if (!master)
+                        return -EPROBE_DEFER;
+
+                return dsa_port_parse_cpu(dp, master);
         }
 
-        pr_info("DSA: tree %d parsed\n", dst->tree);
+        if (link)
+                return dsa_port_parse_dsa(dp);
 
-        return 0;
+        return dsa_port_parse_user(dp, name);
 }
 
-static int dsa_parse_ports_dn(struct device_node *ports, struct dsa_switch *ds)
+static int dsa_switch_parse_ports_of(struct dsa_switch *ds,
+                                     struct device_node *dn)
 {
-        struct device_node *port;
-        int err;
+        struct device_node *ports, *port;
+        struct dsa_port *dp;
         u32 reg;
+        int err;
+
+        ports = of_get_child_by_name(dn, "ports");
+        if (!ports) {
+                dev_err(ds->dev, "no ports child node found\n");
+                return -EINVAL;
+        }
 
         for_each_available_child_of_node(ports, port) {
                 err = of_property_read_u32(port, "reg", &reg);
@@ -619,174 +601,140 @@ static int dsa_parse_ports_dn(struct device_node *ports, struct dsa_switch *ds)
                 if (reg >= ds->num_ports)
                         return -EINVAL;
 
-                ds->ports[reg].dn = port;
+                dp = &ds->ports[reg];
+
+                err = dsa_port_parse_of(dp, port);
+                if (err)
+                        return err;
         }
 
         return 0;
 }
 
-static int dsa_parse_ports(struct dsa_chip_data *cd, struct dsa_switch *ds)
+static int dsa_switch_parse_member_of(struct dsa_switch *ds,
+                                      struct device_node *dn)
 {
-        bool valid_name_found = false;
-        unsigned int i;
+        u32 m[2] = { 0, 0 };
+        int sz;
 
-        for (i = 0; i < DSA_MAX_PORTS; i++) {
-                if (!cd->port_names[i])
-                        continue;
+        /* Don't error out if this optional property isn't found */
+        sz = of_property_read_variable_u32_array(dn, "dsa,member", m, 2, 2);
+        if (sz < 0 && sz != -EINVAL)
+                return sz;
 
-                ds->ports[i].name = cd->port_names[i];
-                valid_name_found = true;
-        }
-
-        if (!valid_name_found && i == DSA_MAX_PORTS)
+        ds->index = m[1];
+        if (ds->index >= DSA_MAX_SWITCHES)
                 return -EINVAL;
 
+        ds->dst = dsa_tree_touch(m[0]);
+        if (!ds->dst)
+                return -ENOMEM;
+
         return 0;
 }
 
-static int dsa_parse_member_dn(struct device_node *np, u32 *tree, u32 *index)
+static int dsa_switch_parse_of(struct dsa_switch *ds, struct device_node *dn)
 {
         int err;
 
-        *tree = *index = 0;
-
-        err = of_property_read_u32_index(np, "dsa,member", 0, tree);
-        if (err) {
-                /* Does not exist, but it is optional */
-                if (err == -EINVAL)
-                        return 0;
-                return err;
-        }
-
-        err = of_property_read_u32_index(np, "dsa,member", 1, index);
+        err = dsa_switch_parse_member_of(ds, dn);
         if (err)
                 return err;
 
-        if (*index >= DSA_MAX_SWITCHES)
-                return -EINVAL;
-
-        return 0;
+        return dsa_switch_parse_ports_of(ds, dn);
 }
 
-static int dsa_parse_member(struct dsa_chip_data *pd, u32 *tree, u32 *index)
+static int dsa_port_parse(struct dsa_port *dp, const char *name,
+                          struct device *dev)
 {
-        if (!pd)
-                return -ENODEV;
-
-        /* We do not support complex trees with dsa_chip_data */
-        *tree = 0;
-        *index = 0;
+        if (!strcmp(name, "cpu")) {
+                struct net_device *master;
 
-        return 0;
-}
+                master = dsa_dev_to_net_device(dev);
+                if (!master)
+                        return -EPROBE_DEFER;
 
-static struct device_node *dsa_get_ports(struct dsa_switch *ds,
-                                         struct device_node *np)
-{
-        struct device_node *ports;
+                dev_put(master);
 
-        ports = of_get_child_by_name(np, "ports");
-        if (!ports) {
-                dev_err(ds->dev, "no ports child node found\n");
-                return ERR_PTR(-EINVAL);
+                return dsa_port_parse_cpu(dp, master);
         }
 
-        return ports;
+        if (!strcmp(name, "dsa"))
+                return dsa_port_parse_dsa(dp);
+
+        return dsa_port_parse_user(dp, name);
 }
 
-static int _dsa_register_switch(struct dsa_switch *ds)
+static int dsa_switch_parse_ports(struct dsa_switch *ds,
+                                  struct dsa_chip_data *cd)
 {
-        struct dsa_chip_data *pdata = ds->dev->platform_data;
-        struct device_node *np = ds->dev->of_node;
-        struct dsa_switch_tree *dst;
-        struct device_node *ports;
-        u32 tree, index;
-        int i, err;
-
-        if (np) {
-                err = dsa_parse_member_dn(np, &tree, &index);
-                if (err)
-                        return err;
+        bool valid_name_found = false;
+        struct dsa_port *dp;
+        struct device *dev;
+        const char *name;
+        unsigned int i;
+        int err;
 
-                ports = dsa_get_ports(ds, np);
-                if (IS_ERR(ports))
-                        return PTR_ERR(ports);
+        for (i = 0; i < DSA_MAX_PORTS; i++) {
+                name = cd->port_names[i];
+                dev = cd->netdev[i];
+                dp = &ds->ports[i];
 
-                err = dsa_parse_ports_dn(ports, ds);
-                if (err)
-                        return err;
-        } else {
-                err = dsa_parse_member(pdata, &tree, &index);
-                if (err)
-                        return err;
+                if (!name)
+                        continue;
 
-                err = dsa_parse_ports(pdata, ds);
+                err = dsa_port_parse(dp, name, dev);
                 if (err)
                         return err;
-        }
 
-        dst = dsa_get_dst(tree);
-        if (!dst) {
-                dst = dsa_add_dst(tree);
-                if (!dst)
-                        return -ENOMEM;
-        }
-
-        if (dst->ds[index]) {
-                err = -EBUSY;
-                goto out;
+                valid_name_found = true;
         }
 
-        ds->dst = dst;
-        ds->index = index;
-        ds->cd = pdata;
-
-        /* Initialize the routing table */
-        for (i = 0; i < DSA_MAX_SWITCHES; ++i)
-                ds->rtable[i] = DSA_RTABLE_NONE;
+        if (!valid_name_found && i == DSA_MAX_PORTS)
+                return -EINVAL;
 
-        dsa_dst_add_ds(dst, ds, index);
+        return 0;
+}
 
-        err = dsa_dst_complete(dst);
-        if (err < 0)
-                goto out_del_dst;
+static int dsa_switch_parse(struct dsa_switch *ds, struct dsa_chip_data *cd)
+{
+        ds->cd = cd;
 
-        if (err == 1) {
-                /* Not all switches registered yet */
-                err = 0;
-                goto out;
-        }
+        /* We don't support interconnected switches nor multiple trees via
+         * platform data, so this is the unique switch of the tree.
+         */
+        ds->index = 0;
+        ds->dst = dsa_tree_touch(0);
+        if (!ds->dst)
+                return -ENOMEM;
 
-        if (dst->applied) {
-                pr_info("DSA: Disjoint trees?\n");
-                return -EINVAL;
-        }
+        return dsa_switch_parse_ports(ds, cd);
+}
 
-        err = dsa_dst_parse(dst);
-        if (err) {
-                if (err == -EPROBE_DEFER) {
-                        dsa_dst_del_ds(dst, ds, ds->index);
-                        return err;
-                }
+static int dsa_switch_add(struct dsa_switch *ds)
+{
+        struct dsa_switch_tree *dst = ds->dst;
 
-                goto out_del_dst;
-        }
+        return dsa_tree_add_switch(dst, ds);
+}
 
-        err = dsa_dst_apply(dst);
-        if (err) {
-                dsa_dst_unapply(dst);
-                goto out_del_dst;
-        }
+static int dsa_switch_probe(struct dsa_switch *ds)
+{
+        struct dsa_chip_data *pdata = ds->dev->platform_data;
+        struct device_node *np = ds->dev->of_node;
+        int err;
 
-        dsa_put_dst(dst);
-        return 0;
+        if (np)
+                err = dsa_switch_parse_of(ds, np);
+        else if (pdata)
+                err = dsa_switch_parse(ds, pdata);
+        else
+                err = -ENODEV;
 
-out_del_dst:
-        dsa_dst_del_ds(dst, ds, ds->index);
-out:
-        dsa_put_dst(dst);
+        if (err)
+                return err;
 
-        return err;
+        return dsa_switch_add(ds);
 }
 
 struct dsa_switch *dsa_switch_alloc(struct device *dev, size_t n)
@@ -816,26 +764,25 @@ int dsa_register_switch(struct dsa_switch *ds)
         int err;
 
         mutex_lock(&dsa2_mutex);
-        err = _dsa_register_switch(ds);
+        err = dsa_switch_probe(ds);
         mutex_unlock(&dsa2_mutex);
 
         return err;
 }
 EXPORT_SYMBOL_GPL(dsa_register_switch);
 
-static void _dsa_unregister_switch(struct dsa_switch *ds)
+static void dsa_switch_remove(struct dsa_switch *ds)
 {
         struct dsa_switch_tree *dst = ds->dst;
+        unsigned int index = ds->index;
 
-        dsa_dst_unapply(dst);
-
-        dsa_dst_del_ds(dst, ds, ds->index);
+        dsa_tree_remove_switch(dst, index);
 }
 
 void dsa_unregister_switch(struct dsa_switch *ds)
 {
         mutex_lock(&dsa2_mutex);
-        _dsa_unregister_switch(ds);
+        dsa_switch_remove(ds);
         mutex_unlock(&dsa2_mutex);
 }
 EXPORT_SYMBOL_GPL(dsa_unregister_switch);
diff --git a/net/dsa/dsa_priv.h b/net/dsa/dsa_priv.h
index 9c3eeb72462d..7d036696e8c4 100644
--- a/net/dsa/dsa_priv.h
+++ b/net/dsa/dsa_priv.h
@@ -66,7 +66,7 @@ struct dsa_notifier_vlan_info {
 };
 
 struct dsa_slave_priv {
-        /* Copy of dp->ds->dst->tag_ops->xmit for faster access in hot path */
+        /* Copy of CPU port xmit for faster access in slave transmit hot path */
         struct sk_buff *        (*xmit)(struct sk_buff *skb,
                                         struct net_device *dev);
 
@@ -79,7 +79,6 @@ struct dsa_slave_priv {
          * The phylib phy_device pointer for the PHY connected
          * to this port.
          */
-        struct phy_device       *phy;
         phy_interface_t         phy_interface;
         int                     old_link;
         int                     old_pause;
@@ -94,11 +93,7 @@ struct dsa_slave_priv {
 };
 
 /* dsa.c */
-int dsa_cpu_dsa_setup(struct dsa_port *port);
-void dsa_cpu_dsa_destroy(struct dsa_port *dport);
 const struct dsa_device_ops *dsa_resolve_tag_protocol(int tag_protocol);
-int dsa_cpu_port_ethtool_setup(struct dsa_port *cpu_dp);
-void dsa_cpu_port_ethtool_restore(struct dsa_port *cpu_dp);
 bool dsa_schedule_work(struct work_struct *work);
 
 /* legacy.c */
@@ -112,10 +107,35 @@ int dsa_legacy_fdb_del(struct ndmsg *ndm, struct nlattr *tb[],
                        struct net_device *dev,
                        const unsigned char *addr, u16 vid);
 
+/* master.c */
+int dsa_master_setup(struct net_device *dev, struct dsa_port *cpu_dp);
+void dsa_master_teardown(struct net_device *dev);
+
+static inline struct net_device *dsa_master_find_slave(struct net_device *dev,
+                                                       int device, int port)
+{
+        struct dsa_port *cpu_dp = dev->dsa_ptr;
+        struct dsa_switch_tree *dst = cpu_dp->dst;
+        struct dsa_switch *ds;
+
+        if (device < 0 || device >= DSA_MAX_SWITCHES)
+                return NULL;
+
+        ds = dst->ds[device];
+        if (!ds)
+                return NULL;
+
+        if (port < 0 || port >= ds->num_ports)
+                return NULL;
+
+        return ds->ports[port].slave;
+}
+
 /* port.c */
 int dsa_port_set_state(struct dsa_port *dp, u8 state,
                        struct switchdev_trans *trans);
-void dsa_port_set_state_now(struct dsa_port *dp, u8 state);
+int dsa_port_enable(struct dsa_port *dp, struct phy_device *phy);
+void dsa_port_disable(struct dsa_port *dp, struct phy_device *phy);
 int dsa_port_bridge_join(struct dsa_port *dp, struct net_device *br);
 void dsa_port_bridge_leave(struct dsa_port *dp, struct net_device *br);
 int dsa_port_vlan_filtering(struct dsa_port *dp, bool vlan_filtering,
@@ -126,33 +146,52 @@ int dsa_port_fdb_add(struct dsa_port *dp, const unsigned char *addr,
                      u16 vid);
 int dsa_port_fdb_del(struct dsa_port *dp, const unsigned char *addr,
                      u16 vid);
-int dsa_port_mdb_add(struct dsa_port *dp,
+int dsa_port_fdb_dump(struct dsa_port *dp, dsa_fdb_dump_cb_t *cb, void *data);
+int dsa_port_mdb_add(const struct dsa_port *dp,
                      const struct switchdev_obj_port_mdb *mdb,
                      struct switchdev_trans *trans);
-int dsa_port_mdb_del(struct dsa_port *dp,
+int dsa_port_mdb_del(const struct dsa_port *dp,
                      const struct switchdev_obj_port_mdb *mdb);
 int dsa_port_vlan_add(struct dsa_port *dp,
                       const struct switchdev_obj_port_vlan *vlan,
                       struct switchdev_trans *trans);
 int dsa_port_vlan_del(struct dsa_port *dp,
                       const struct switchdev_obj_port_vlan *vlan);
+int dsa_port_fixed_link_register_of(struct dsa_port *dp);
+void dsa_port_fixed_link_unregister_of(struct dsa_port *dp);
+
 /* slave.c */
 extern const struct dsa_device_ops notag_netdev_ops;
 void dsa_slave_mii_bus_init(struct dsa_switch *ds);
-void dsa_cpu_port_ethtool_init(struct ethtool_ops *ops);
-int dsa_slave_create(struct dsa_port *port, const char *name);
+int dsa_slave_create(struct dsa_port *dp);
 void dsa_slave_destroy(struct net_device *slave_dev);
 int dsa_slave_suspend(struct net_device *slave_dev);
 int dsa_slave_resume(struct net_device *slave_dev);
 int dsa_slave_register_notifier(void);
 void dsa_slave_unregister_notifier(void);
 
+static inline struct dsa_port *dsa_slave_to_port(const struct net_device *dev)
+{
+        struct dsa_slave_priv *p = netdev_priv(dev);
+
+        return p->dp;
+}
+
+static inline struct net_device *
+dsa_slave_to_master(const struct net_device *dev)
+{
+        struct dsa_port *dp = dsa_slave_to_port(dev);
+
+        return dp->cpu_dp->master;
+}
+
 /* switch.c */
 int dsa_switch_register_notifier(struct dsa_switch *ds);
 void dsa_switch_unregister_notifier(struct dsa_switch *ds);
 
 /* tag_brcm.c */
 extern const struct dsa_device_ops brcm_netdev_ops;
+extern const struct dsa_device_ops brcm_prepend_netdev_ops;
 
 /* tag_dsa.c */
 extern const struct dsa_device_ops dsa_netdev_ops;
@@ -175,14 +214,4 @@ extern const struct dsa_device_ops qca_netdev_ops;
 /* tag_trailer.c */
 extern const struct dsa_device_ops trailer_netdev_ops;
 
-static inline struct net_device *dsa_master_netdev(struct dsa_slave_priv *p)
-{
-        return p->dp->cpu_dp->netdev;
-}
-
-static inline struct dsa_port *dsa_get_cpu_port(struct dsa_switch_tree *dst)
-{
-        return dst->cpu_dp;
-}
-
 #endif
diff --git a/net/dsa/legacy.c b/net/dsa/legacy.c
index 91e6f7981d39..84611d7fcfa2 100644
--- a/net/dsa/legacy.c
+++ b/net/dsa/legacy.c
@@ -86,7 +86,7 @@ static int dsa_cpu_dsa_setups(struct dsa_switch *ds)
                 if (!(dsa_is_cpu_port(ds, port) || dsa_is_dsa_port(ds, port)))
                         continue;
 
-                ret = dsa_cpu_dsa_setup(&ds->ports[port]);
+                ret = dsa_port_fixed_link_register_of(&ds->ports[port]);
                 if (ret)
                         return ret;
         }
@@ -101,6 +101,7 @@ static int dsa_switch_setup_one(struct dsa_switch *ds,
         struct dsa_chip_data *cd = ds->cd;
         bool valid_name_found = false;
         int index = ds->index;
+        struct dsa_port *dp;
         int i, ret;
 
         /*
@@ -109,9 +110,12 @@ static int dsa_switch_setup_one(struct dsa_switch *ds,
         for (i = 0; i < ds->num_ports; i++) {
                 char *name;
 
+                dp = &ds->ports[i];
+
                 name = cd->port_names[i];
                 if (name == NULL)
                         continue;
+                dp->name = name;
 
                 if (!strcmp(name, "cpu")) {
                         if (dst->cpu_dp) {
@@ -120,12 +124,12 @@ static int dsa_switch_setup_one(struct dsa_switch *ds,
                                 return -EINVAL;
                         }
                         dst->cpu_dp = &ds->ports[i];
-                        dst->cpu_dp->netdev = master;
-                        ds->cpu_port_mask |= 1 << i;
+                        dst->cpu_dp->master = master;
+                        dp->type = DSA_PORT_TYPE_CPU;
                 } else if (!strcmp(name, "dsa")) {
-                        ds->dsa_port_mask |= 1 << i;
+                        dp->type = DSA_PORT_TYPE_DSA;
                 } else {
-                        ds->enabled_port_mask |= 1 << i;
+                        dp->type = DSA_PORT_TYPE_USER;
                 }
                 valid_name_found = true;
         }
@@ -136,7 +140,7 @@ static int dsa_switch_setup_one(struct dsa_switch *ds,
         /* Make the built-in MII bus mask match the number of ports,
          * switch drivers can override this later
          */
-        ds->phys_mii_mask = ds->enabled_port_mask;
+        ds->phys_mii_mask |= dsa_user_ports(ds);
 
         /*
          * If the CPU connects to this switch, set the switch tree
@@ -144,14 +148,19 @@ static int dsa_switch_setup_one(struct dsa_switch *ds,
          * switch.
          */
         if (dst->cpu_dp->ds == ds) {
+                const struct dsa_device_ops *tag_ops;
                 enum dsa_tag_protocol tag_protocol;
 
-                tag_protocol = ops->get_tag_protocol(ds);
-                dst->tag_ops = dsa_resolve_tag_protocol(tag_protocol);
-                if (IS_ERR(dst->tag_ops))
-                        return PTR_ERR(dst->tag_ops);
+                tag_protocol = ops->get_tag_protocol(ds, dst->cpu_dp->index);
+                tag_ops = dsa_resolve_tag_protocol(tag_protocol);
+                if (IS_ERR(tag_ops))
+                        return PTR_ERR(tag_ops);
+
+                dst->cpu_dp->tag_ops = tag_ops;
 
-                dst->rcv = dst->tag_ops->rcv;
+                /* Few copies for faster access in master receive hot path */
+                dst->cpu_dp->rcv = dst->cpu_dp->tag_ops->rcv;
+                dst->cpu_dp->dst = dst;
         }
 
         memcpy(ds->rtable, cd->rtable, sizeof(ds->rtable));
@@ -167,12 +176,6 @@ static int dsa_switch_setup_one(struct dsa_switch *ds,
         if (ret)
                 return ret;
 
-        if (ops->set_addr) {
-                ret = ops->set_addr(ds, master->dev_addr);
-                if (ret < 0)
-                        return ret;
-        }
-
         if (!ds->slave_mii_bus && ops->phy_read) {
                 ds->slave_mii_bus = devm_mdiobus_alloc(ds->dev);
                 if (!ds->slave_mii_bus)
@@ -191,10 +194,10 @@ static int dsa_switch_setup_one(struct dsa_switch *ds,
                 ds->ports[i].dn = cd->port_dn[i];
                 ds->ports[i].cpu_dp = dst->cpu_dp;
 
-                if (!(ds->enabled_port_mask & (1 << i)))
+                if (dsa_is_user_port(ds, i))
                         continue;
 
-                ret = dsa_slave_create(&ds->ports[i], cd->port_names[i]);
+                ret = dsa_slave_create(&ds->ports[i]);
                 if (ret < 0)
                         netdev_err(master, "[%d]: can't create dsa slave device for port %d(%s): %d\n",
                                    index, i, cd->port_names[i], ret);
@@ -206,10 +209,6 @@ static int dsa_switch_setup_one(struct dsa_switch *ds,
                 netdev_err(master, "[%d] : can't configure CPU and DSA ports\n",
                            index);
 
-        ret = dsa_cpu_port_ethtool_setup(ds->dst->cpu_dp);
-        if (ret)
-                return ret;
-
         return 0;
 }
 
@@ -263,24 +262,20 @@ static void dsa_switch_destroy(struct dsa_switch *ds)
 
         /* Destroy network devices for physical switch ports. */
         for (port = 0; port < ds->num_ports; port++) {
-                if (!(ds->enabled_port_mask & (1 << port)))
+                if (!dsa_is_user_port(ds, port))
                         continue;
 
-                if (!ds->ports[port].netdev)
+                if (!ds->ports[port].slave)
                         continue;
 
-                dsa_slave_destroy(ds->ports[port].netdev);
+                dsa_slave_destroy(ds->ports[port].slave);
         }
 
         /* Disable configuration of the CPU and DSA ports */
         for (port = 0; port < ds->num_ports; port++) {
                 if (!(dsa_is_cpu_port(ds, port) || dsa_is_dsa_port(ds, port)))
                         continue;
-                dsa_cpu_dsa_destroy(&ds->ports[port]);
-
-                /* Clearing a bit which is not set does no harm */
-                ds->cpu_port_mask |= ~(1 << port);
-                ds->dsa_port_mask |= ~(1 << port);
+                dsa_port_fixed_link_unregister_of(&ds->ports[port]);
         }
 
         if (ds->slave_mii_bus && ds->ops->phy_read)
@@ -598,15 +593,7 @@ static int dsa_setup_dst(struct dsa_switch_tree *dst, struct net_device *dev,
         if (!configured)
                 return -EPROBE_DEFER;
 
-        /*
-         * If we use a tagging format that doesn't have an ethertype
-         * field, make sure that all packets from this point on get
-         * sent to the tag format's receive function.
-         */
-        wmb();
-        dev->dsa_ptr = dst;
-
-        return 0;
+        return dsa_master_setup(dst->cpu_dp->master, dst->cpu_dp);
 }
 
 static int dsa_probe(struct platform_device *pdev)
@@ -671,13 +658,7 @@ static void dsa_remove_dst(struct dsa_switch_tree *dst)
 {
         int i;
 
-        dst->cpu_dp->netdev->dsa_ptr = NULL;
-
-        /* If we used a tagging format that doesn't have an ethertype
-         * field, make sure that all packets from this point get sent
-         * without the tag and go through the regular receive path.
-         */
-        wmb();
+        dsa_master_teardown(dst->cpu_dp->master);
 
         for (i = 0; i < dst->pd->nr_chips; i++) {
                 struct dsa_switch *ds = dst->ds[i];
@@ -686,9 +667,7 @@ static void dsa_remove_dst(struct dsa_switch_tree *dst)
                         dsa_switch_destroy(ds);
         }
 
-        dsa_cpu_port_ethtool_restore(dst->cpu_dp);
-
-        dev_put(dst->cpu_dp->netdev);
+        dev_put(dst->cpu_dp->master);
 }
 
 static int dsa_remove(struct platform_device *pdev)
@@ -745,8 +724,7 @@ int dsa_legacy_fdb_add(struct ndmsg *ndm, struct nlattr *tb[],
                        const unsigned char *addr, u16 vid,
                        u16 flags)
 {
-        struct dsa_slave_priv *p = netdev_priv(dev);
-        struct dsa_port *dp = p->dp;
+        struct dsa_port *dp = dsa_slave_to_port(dev);
 
         return dsa_port_fdb_add(dp, addr, vid);
 }
@@ -755,8 +733,7 @@ int dsa_legacy_fdb_del(struct ndmsg *ndm, struct nlattr *tb[],
                        struct net_device *dev,
                        const unsigned char *addr, u16 vid)
 {
-        struct dsa_slave_priv *p = netdev_priv(dev);
-        struct dsa_port *dp = p->dp;
+        struct dsa_port *dp = dsa_slave_to_port(dev);
 
         return dsa_port_fdb_del(dp, addr, vid);
 }
diff --git a/net/dsa/master.c b/net/dsa/master.c
new file mode 100644
index 000000000000..00589147f042
--- /dev/null
+++ b/net/dsa/master.c
@@ -0,0 +1,143 @@
+/*
+ * Handling of a master device, switching frames via its switch fabric CPU port
+ *
+ * Copyright (c) 2017 Savoir-faire Linux Inc.
+ *      Vivien Didelot <vivien.didelot@savoirfairelinux.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ */
+
+#include "dsa_priv.h"
+
+static void dsa_master_get_ethtool_stats(struct net_device *dev,
+                                         struct ethtool_stats *stats,
+                                         uint64_t *data)
+{
+        struct dsa_port *cpu_dp = dev->dsa_ptr;
+        const struct ethtool_ops *ops = cpu_dp->orig_ethtool_ops;
+        struct dsa_switch *ds = cpu_dp->ds;
+        int port = cpu_dp->index;
+        int count = 0;
+
+        if (ops && ops->get_sset_count && ops->get_ethtool_stats) {
+                count = ops->get_sset_count(dev, ETH_SS_STATS);
+                ops->get_ethtool_stats(dev, stats, data);
+        }
+
+        if (ds->ops->get_ethtool_stats)
+                ds->ops->get_ethtool_stats(ds, port, data + count);
+}
+
+static int dsa_master_get_sset_count(struct net_device *dev, int sset)
+{
+        struct dsa_port *cpu_dp = dev->dsa_ptr;
+        const struct ethtool_ops *ops = cpu_dp->orig_ethtool_ops;
+        struct dsa_switch *ds = cpu_dp->ds;
+        int count = 0;
+
+        if (ops && ops->get_sset_count)
+                count += ops->get_sset_count(dev, sset);
+
+        if (sset == ETH_SS_STATS && ds->ops->get_sset_count)
+                count += ds->ops->get_sset_count(ds);
+
+        return count;
+}
+
+static void dsa_master_get_strings(struct net_device *dev, uint32_t stringset,
+                                   uint8_t *data)
+{
+        struct dsa_port *cpu_dp = dev->dsa_ptr;
+        const struct ethtool_ops *ops = cpu_dp->orig_ethtool_ops;
+        struct dsa_switch *ds = cpu_dp->ds;
+        int port = cpu_dp->index;
+        int len = ETH_GSTRING_LEN;
+        int mcount = 0, count;
+        unsigned int i;
+        uint8_t pfx[4];
+        uint8_t *ndata;
+
+        snprintf(pfx, sizeof(pfx), "p%.2d", port);
+        /* We do not want to be NULL-terminated, since this is a prefix */
+        pfx[sizeof(pfx) - 1] = '_';
+
+        if (ops && ops->get_sset_count && ops->get_strings) {
+                mcount = ops->get_sset_count(dev, ETH_SS_STATS);
+                ops->get_strings(dev, stringset, data);
+        }
+
+        if (stringset == ETH_SS_STATS && ds->ops->get_strings) {
+                ndata = data + mcount * len;
+                /* This function copies ETH_GSTRINGS_LEN bytes, we will mangle
+                 * the output after to prepend our CPU port prefix we
+                 * constructed earlier
+                 */
+                ds->ops->get_strings(ds, port, ndata);
+                count = ds->ops->get_sset_count(ds);
+                for (i = 0; i < count; i++) {
+                        memmove(ndata + (i * len + sizeof(pfx)),
+                                ndata + i * len, len - sizeof(pfx));
+                        memcpy(ndata + i * len, pfx, sizeof(pfx));
+                }
+        }
+}
+
+static int dsa_master_ethtool_setup(struct net_device *dev)
+{
+        struct dsa_port *cpu_dp = dev->dsa_ptr;
+        struct dsa_switch *ds = cpu_dp->ds;
+        struct ethtool_ops *ops;
+
+        ops = devm_kzalloc(ds->dev, sizeof(*ops), GFP_KERNEL);
+        if (!ops)
+                return -ENOMEM;
+
+        cpu_dp->orig_ethtool_ops = dev->ethtool_ops;
+        if (cpu_dp->orig_ethtool_ops)
+                memcpy(ops, cpu_dp->orig_ethtool_ops, sizeof(*ops));
+
+        ops->get_sset_count = dsa_master_get_sset_count;
+        ops->get_ethtool_stats = dsa_master_get_ethtool_stats;
+        ops->get_strings = dsa_master_get_strings;
+
+        dev->ethtool_ops = ops;
+
+        return 0;
+}
+
+static void dsa_master_ethtool_teardown(struct net_device *dev)
+{
+        struct dsa_port *cpu_dp = dev->dsa_ptr;
+
+        dev->ethtool_ops = cpu_dp->orig_ethtool_ops;
+        cpu_dp->orig_ethtool_ops = NULL;
+}
+
+int dsa_master_setup(struct net_device *dev, struct dsa_port *cpu_dp)
+{
+        /* If we use a tagging format that doesn't have an ethertype
+         * field, make sure that all packets from this point on get
+         * sent to the tag format's receive function.
+         */
+        wmb();
+
+        dev->dsa_ptr = cpu_dp;
+
+        return dsa_master_ethtool_setup(dev);
+}
+
+void dsa_master_teardown(struct net_device *dev)
+{
+        dsa_master_ethtool_teardown(dev);
+
+        dev->dsa_ptr = NULL;
+
+        /* If we used a tagging format that doesn't have an ethertype
+         * field, make sure that all packets from this point get sent
+         * without the tag and go through the regular receive path.
+         */
+        wmb();
+}
diff --git a/net/dsa/port.c b/net/dsa/port.c
index 659676ba3f8b..bb4be2679904 100644
--- a/net/dsa/port.c
+++ b/net/dsa/port.c
@@ -12,10 +12,12 @@
 
 #include <linux/if_bridge.h>
 #include <linux/notifier.h>
+#include <linux/of_mdio.h>
+#include <linux/of_net.h>
 
 #include "dsa_priv.h"
 
-static int dsa_port_notify(struct dsa_port *dp, unsigned long e, void *v)
+static int dsa_port_notify(const struct dsa_port *dp, unsigned long e, void *v)
 {
         struct raw_notifier_head *nh = &dp->ds->dst->nh;
         int err;
@@ -56,7 +58,7 @@ int dsa_port_set_state(struct dsa_port *dp, u8 state,
         return 0;
 }
 
-void dsa_port_set_state_now(struct dsa_port *dp, u8 state)
+static void dsa_port_set_state_now(struct dsa_port *dp, u8 state)
 {
         int err;
 
@@ -65,6 +67,35 @@ void dsa_port_set_state_now(struct dsa_port *dp, u8 state)
                 pr_err("DSA: failed to set STP state %u (%d)\n", state, err);
 }
 
+int dsa_port_enable(struct dsa_port *dp, struct phy_device *phy)
+{
+        u8 stp_state = dp->bridge_dev ? BR_STATE_BLOCKING : BR_STATE_FORWARDING;
+        struct dsa_switch *ds = dp->ds;
+        int port = dp->index;
+        int err;
+
+        if (ds->ops->port_enable) {
+                err = ds->ops->port_enable(ds, port, phy);
+                if (err)
+                        return err;
+        }
+
+        dsa_port_set_state_now(dp, stp_state);
+
+        return 0;
+}
+
+void dsa_port_disable(struct dsa_port *dp, struct phy_device *phy)
+{
+        struct dsa_switch *ds = dp->ds;
+        int port = dp->index;
+
+        dsa_port_set_state_now(dp, BR_STATE_DISABLED);
+
+        if (ds->ops->port_disable)
+                ds->ops->port_disable(ds, port, phy);
+}
+
 int dsa_port_bridge_join(struct dsa_port *dp, struct net_device *br)
 {
         struct dsa_notifier_bridge_info info = {
@@ -173,7 +204,18 @@ int dsa_port_fdb_del(struct dsa_port *dp, const unsigned char *addr,
         return dsa_port_notify(dp, DSA_NOTIFIER_FDB_DEL, &info);
 }
 
-int dsa_port_mdb_add(struct dsa_port *dp,
+int dsa_port_fdb_dump(struct dsa_port *dp, dsa_fdb_dump_cb_t *cb, void *data)
+{
+        struct dsa_switch *ds = dp->ds;
+        int port = dp->index;
+
+        if (!ds->ops->port_fdb_dump)
+                return -EOPNOTSUPP;
+
+        return ds->ops->port_fdb_dump(ds, port, cb, data);
+}
+
+int dsa_port_mdb_add(const struct dsa_port *dp,
                      const struct switchdev_obj_port_mdb *mdb,
                      struct switchdev_trans *trans)
 {
@@ -187,7 +229,7 @@ int dsa_port_mdb_add(struct dsa_port *dp,
         return dsa_port_notify(dp, DSA_NOTIFIER_MDB_ADD, &info);
 }
 
-int dsa_port_mdb_del(struct dsa_port *dp,
+int dsa_port_mdb_del(const struct dsa_port *dp,
                      const struct switchdev_obj_port_mdb *mdb)
 {
         struct dsa_notifier_mdb_info info = {
@@ -210,7 +252,10 @@ int dsa_port_vlan_add(struct dsa_port *dp,
                 .vlan = vlan,
         };
 
-        return dsa_port_notify(dp, DSA_NOTIFIER_VLAN_ADD, &info);
+        if (br_vlan_enabled(dp->bridge_dev))
+                return dsa_port_notify(dp, DSA_NOTIFIER_VLAN_ADD, &info);
+
+        return 0;
 }
 
 int dsa_port_vlan_del(struct dsa_port *dp,
@@ -222,5 +267,53 @@ int dsa_port_vlan_del(struct dsa_port *dp,
                 .vlan = vlan,
         };
 
-        return dsa_port_notify(dp, DSA_NOTIFIER_VLAN_DEL, &info);
+        if (br_vlan_enabled(dp->bridge_dev))
+                return dsa_port_notify(dp, DSA_NOTIFIER_VLAN_DEL, &info);
+
+        return 0;
+}
+
+int dsa_port_fixed_link_register_of(struct dsa_port *dp)
+{
+        struct device_node *dn = dp->dn;
+        struct dsa_switch *ds = dp->ds;
+        struct phy_device *phydev;
+        int port = dp->index;
+        int mode;
+        int err;
+
+        if (of_phy_is_fixed_link(dn)) {
+                err = of_phy_register_fixed_link(dn);
+                if (err) {
+                        dev_err(ds->dev,
+                                "failed to register the fixed PHY of port %d\n",
+                                port);
+                        return err;
+                }
+
+                phydev = of_phy_find_device(dn);
+
+                mode = of_get_phy_mode(dn);
+                if (mode < 0)
+                        mode = PHY_INTERFACE_MODE_NA;
+                phydev->interface = mode;
+
+                genphy_config_init(phydev);
+                genphy_read_status(phydev);
+
+                if (ds->ops->adjust_link)
+                        ds->ops->adjust_link(ds, port, phydev);
+
+                put_device(&phydev->mdio.dev);
+        }
+
+        return 0;
+}
+
+void dsa_port_fixed_link_unregister_of(struct dsa_port *dp)
+{
+        struct device_node *dn = dp->dn;
+
+        if (of_phy_is_fixed_link(dn))
+                of_phy_deregister_fixed_link(dn);
 }
diff --git a/net/dsa/slave.c b/net/dsa/slave.c
index 865e29e62bad..d6e7a642493b 100644
--- a/net/dsa/slave.c
+++ b/net/dsa/slave.c
@@ -55,7 +55,7 @@ void dsa_slave_mii_bus_init(struct dsa_switch *ds)
         ds->slave_mii_bus->read = dsa_slave_phy_read;
         ds->slave_mii_bus->write = dsa_slave_phy_write;
         snprintf(ds->slave_mii_bus->id, MII_BUS_ID_SIZE, "dsa-%d.%d",
-                 ds->dst->tree, ds->index);
+                 ds->dst->index, ds->index);
         ds->slave_mii_bus->parent = ds->dev;
         ds->slave_mii_bus->phy_mask = ~ds->phys_mii_mask;
 }
@@ -64,18 +64,13 @@ void dsa_slave_mii_bus_init(struct dsa_switch *ds)
 /* slave device handling ****************************************************/
 static int dsa_slave_get_iflink(const struct net_device *dev)
 {
-        struct dsa_slave_priv *p = netdev_priv(dev);
-
-        return dsa_master_netdev(p)->ifindex;
+        return dsa_slave_to_master(dev)->ifindex;
 }
 
 static int dsa_slave_open(struct net_device *dev)
 {
-        struct dsa_slave_priv *p = netdev_priv(dev);
-        struct dsa_port *dp = p->dp;
-        struct dsa_switch *ds = dp->ds;
-        struct net_device *master = dsa_master_netdev(p);
-        u8 stp_state = dp->bridge_dev ? BR_STATE_BLOCKING : BR_STATE_FORWARDING;
+        struct net_device *master = dsa_slave_to_master(dev);
+        struct dsa_port *dp = dsa_slave_to_port(dev);
         int err;
 
         if (!(master->flags & IFF_UP))
@@ -98,16 +93,12 @@ static int dsa_slave_open(struct net_device *dev)
                         goto clear_allmulti;
         }
 
-        if (ds->ops->port_enable) {
-                err = ds->ops->port_enable(ds, p->dp->index, p->phy);
-                if (err)
-                        goto clear_promisc;
-        }
-
-        dsa_port_set_state_now(p->dp, stp_state);
+        err = dsa_port_enable(dp, dev->phydev);
+        if (err)
+                goto clear_promisc;
 
-        if (p->phy)
-                phy_start(p->phy);
+        if (dev->phydev)
+                phy_start(dev->phydev);
 
         return 0;
 
@@ -126,12 +117,13 @@ out:
 
 static int dsa_slave_close(struct net_device *dev)
 {
-        struct dsa_slave_priv *p = netdev_priv(dev);
-        struct net_device *master = dsa_master_netdev(p);
-        struct dsa_switch *ds = p->dp->ds;
+        struct net_device *master = dsa_slave_to_master(dev);
+        struct dsa_port *dp = dsa_slave_to_port(dev);
+
+        if (dev->phydev)
+                phy_stop(dev->phydev);
 
-        if (p->phy)
-                phy_stop(p->phy);
+        dsa_port_disable(dp, dev->phydev);
 
         dev_mc_unsync(master, dev);
         dev_uc_unsync(master, dev);
@@ -143,18 +135,12 @@ static int dsa_slave_close(struct net_device *dev)
         if (!ether_addr_equal(dev->dev_addr, master->dev_addr))
                 dev_uc_del(master, dev->dev_addr);
 
-        if (ds->ops->port_disable)
-                ds->ops->port_disable(ds, p->dp->index, p->phy);
-
-        dsa_port_set_state_now(p->dp, BR_STATE_DISABLED);
-
         return 0;
 }
 
 static void dsa_slave_change_rx_flags(struct net_device *dev, int change)
 {
-        struct dsa_slave_priv *p = netdev_priv(dev);
-        struct net_device *master = dsa_master_netdev(p);
+        struct net_device *master = dsa_slave_to_master(dev);
 
         if (change & IFF_ALLMULTI)
                 dev_set_allmulti(master, dev->flags & IFF_ALLMULTI ? 1 : -1);
@@ -164,8 +150,7 @@ static void dsa_slave_change_rx_flags(struct net_device *dev, int change)
 
 static void dsa_slave_set_rx_mode(struct net_device *dev)
 {
-        struct dsa_slave_priv *p = netdev_priv(dev);
-        struct net_device *master = dsa_master_netdev(p);
+        struct net_device *master = dsa_slave_to_master(dev);
 
         dev_mc_sync(master, dev);
         dev_uc_sync(master, dev);
@@ -173,8 +158,7 @@ static void dsa_slave_set_rx_mode(struct net_device *dev)
 
 static int dsa_slave_set_mac_address(struct net_device *dev, void *a)
 {
-        struct dsa_slave_priv *p = netdev_priv(dev);
-        struct net_device *master = dsa_master_netdev(p);
+        struct net_device *master = dsa_slave_to_master(dev);
         struct sockaddr *addr = a;
         int err;
 
@@ -255,43 +239,34 @@ dsa_slave_fdb_dump(struct sk_buff *skb, struct netlink_callback *cb,
                    struct net_device *dev, struct net_device *filter_dev,
                    int *idx)
 {
+        struct dsa_port *dp = dsa_slave_to_port(dev);
         struct dsa_slave_dump_ctx dump = {
                 .dev = dev,
                 .skb = skb,
                 .cb = cb,
                 .idx = *idx,
         };
-        struct dsa_slave_priv *p = netdev_priv(dev);
-        struct dsa_port *dp = p->dp;
-        struct dsa_switch *ds = dp->ds;
         int err;
 
-        if (!ds->ops->port_fdb_dump)
-                return -EOPNOTSUPP;
-
-        err = ds->ops->port_fdb_dump(ds, dp->index,
-                                     dsa_slave_port_fdb_do_dump,
-                                     &dump);
+        err = dsa_port_fdb_dump(dp, dsa_slave_port_fdb_do_dump, &dump);
         *idx = dump.idx;
+
         return err;
 }
 
 static int dsa_slave_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
 {
-        struct dsa_slave_priv *p = netdev_priv(dev);
-
-        if (p->phy != NULL)
-                return phy_mii_ioctl(p->phy, ifr, cmd);
+        if (!dev->phydev)
+                return -ENODEV;
 
-        return -EOPNOTSUPP;
+        return phy_mii_ioctl(dev->phydev, ifr, cmd);
 }
 
 static int dsa_slave_port_attr_set(struct net_device *dev,
                                    const struct switchdev_attr *attr,
                                    struct switchdev_trans *trans)
 {
-        struct dsa_slave_priv *p = netdev_priv(dev);
-        struct dsa_port *dp = p->dp;
+        struct dsa_port *dp = dsa_slave_to_port(dev);
         int ret;
 
         switch (attr->id) {
@@ -317,8 +292,7 @@ static int dsa_slave_port_obj_add(struct net_device *dev,
                                   const struct switchdev_obj *obj,
                                   struct switchdev_trans *trans)
 {
-        struct dsa_slave_priv *p = netdev_priv(dev);
-        struct dsa_port *dp = p->dp;
+        struct dsa_port *dp = dsa_slave_to_port(dev);
         int err;
 
         /* For the prepare phase, ensure the full set of changes is feasable in
@@ -330,6 +304,13 @@ static int dsa_slave_port_obj_add(struct net_device *dev,
         case SWITCHDEV_OBJ_ID_PORT_MDB:
                 err = dsa_port_mdb_add(dp, SWITCHDEV_OBJ_PORT_MDB(obj), trans);
                 break;
+        case SWITCHDEV_OBJ_ID_HOST_MDB:
+                /* DSA can directly translate this to a normal MDB add,
+                 * but on the CPU port.
+                 */
+                err = dsa_port_mdb_add(dp->cpu_dp, SWITCHDEV_OBJ_PORT_MDB(obj),
+                                       trans);
+                break;
         case SWITCHDEV_OBJ_ID_PORT_VLAN:
                 err = dsa_port_vlan_add(dp, SWITCHDEV_OBJ_PORT_VLAN(obj),
                                         trans);
@@ -345,14 +326,19 @@ static int dsa_slave_port_obj_add(struct net_device *dev,
 static int dsa_slave_port_obj_del(struct net_device *dev,
                                   const struct switchdev_obj *obj)
 {
-        struct dsa_slave_priv *p = netdev_priv(dev);
-        struct dsa_port *dp = p->dp;
+        struct dsa_port *dp = dsa_slave_to_port(dev);
         int err;
 
         switch (obj->id) {
         case SWITCHDEV_OBJ_ID_PORT_MDB:
                 err = dsa_port_mdb_del(dp, SWITCHDEV_OBJ_PORT_MDB(obj));
                 break;
+        case SWITCHDEV_OBJ_ID_HOST_MDB:
+                /* DSA can directly translate this to a normal MDB add,
+                 * but on the CPU port.
+                 */
+                err = dsa_port_mdb_del(dp->cpu_dp, SWITCHDEV_OBJ_PORT_MDB(obj));
+                break;
         case SWITCHDEV_OBJ_ID_PORT_VLAN:
                 err = dsa_port_vlan_del(dp, SWITCHDEV_OBJ_PORT_VLAN(obj));
                 break;
@@ -367,13 +353,14 @@ static int dsa_slave_port_obj_del(struct net_device *dev,
 static int dsa_slave_port_attr_get(struct net_device *dev,
                                    struct switchdev_attr *attr)
 {
-        struct dsa_slave_priv *p = netdev_priv(dev);
-        struct dsa_switch *ds = p->dp->ds;
+        struct dsa_port *dp = dsa_slave_to_port(dev);
+        struct dsa_switch *ds = dp->ds;
+        struct dsa_switch_tree *dst = ds->dst;
 
         switch (attr->id) {
         case SWITCHDEV_ATTR_ID_PORT_PARENT_ID:
-                attr->u.ppid.id_len = sizeof(ds->index);
-                memcpy(&attr->u.ppid.id, &ds->index, attr->u.ppid.id_len);
+                attr->u.ppid.id_len = sizeof(dst->index);
+                memcpy(&attr->u.ppid.id, &dst->index, attr->u.ppid.id_len);
                 break;
         case SWITCHDEV_ATTR_ID_PORT_BRIDGE_FLAGS_SUPPORT:
                 attr->u.brport_flags_support = 0;
@@ -385,10 +372,12 @@ static int dsa_slave_port_attr_get(struct net_device *dev,
         return 0;
 }
 
-static inline netdev_tx_t dsa_netpoll_send_skb(struct dsa_slave_priv *p,
-                                               struct sk_buff *skb)
+static inline netdev_tx_t dsa_slave_netpoll_send_skb(struct net_device *dev,
+                                                     struct sk_buff *skb)
 {
 #ifdef CONFIG_NET_POLL_CONTROLLER
+        struct dsa_slave_priv *p = netdev_priv(dev);
+
         if (p->netpoll)
                 netpoll_send_skb(p->netpoll, skb);
 #else
@@ -422,43 +411,18 @@ static netdev_tx_t dsa_slave_xmit(struct sk_buff *skb, struct net_device *dev)
          * tag to be successfully transmitted
          */
         if (unlikely(netpoll_tx_running(dev)))
-                return dsa_netpoll_send_skb(p, nskb);
+                return dsa_slave_netpoll_send_skb(dev, nskb);
 
         /* Queue the SKB for transmission on the parent interface, but
          * do not modify its EtherType
          */
-        nskb->dev = dsa_master_netdev(p);
+        nskb->dev = dsa_slave_to_master(dev);
         dev_queue_xmit(nskb);
 
         return NETDEV_TX_OK;
 }
 
 /* ethtool operations *******************************************************/
-static int
-dsa_slave_get_link_ksettings(struct net_device *dev,
-                             struct ethtool_link_ksettings *cmd)
-{
-        struct dsa_slave_priv *p = netdev_priv(dev);
-
-        if (!p->phy)
-                return -EOPNOTSUPP;
-
-        phy_ethtool_ksettings_get(p->phy, cmd);
-
-        return 0;
-}
-
-static int
-dsa_slave_set_link_ksettings(struct net_device *dev,
-                             const struct ethtool_link_ksettings *cmd)
-{
-        struct dsa_slave_priv *p = netdev_priv(dev);
-
-        if (p->phy != NULL)
-                return phy_ethtool_ksettings_set(p->phy, cmd);
-
-        return -EOPNOTSUPP;
-}
 
 static void dsa_slave_get_drvinfo(struct net_device *dev,
                                   struct ethtool_drvinfo *drvinfo)
@@ -470,11 +434,11 @@ static void dsa_slave_get_drvinfo(struct net_device *dev,
 
 static int dsa_slave_get_regs_len(struct net_device *dev)
 {
-        struct dsa_slave_priv *p = netdev_priv(dev);
-        struct dsa_switch *ds = p->dp->ds;
+        struct dsa_port *dp = dsa_slave_to_port(dev);
+        struct dsa_switch *ds = dp->ds;
 
         if (ds->ops->get_regs_len)
-                return ds->ops->get_regs_len(ds, p->dp->index);
+                return ds->ops->get_regs_len(ds, dp->index);
 
         return -EOPNOTSUPP;
 }
@@ -482,39 +446,27 @@ static int dsa_slave_get_regs_len(struct net_device *dev)
 static void
 dsa_slave_get_regs(struct net_device *dev, struct ethtool_regs *regs, void *_p)
 {
-        struct dsa_slave_priv *p = netdev_priv(dev);
-        struct dsa_switch *ds = p->dp->ds;
+        struct dsa_port *dp = dsa_slave_to_port(dev);
+        struct dsa_switch *ds = dp->ds;
 
         if (ds->ops->get_regs)
-                ds->ops->get_regs(ds, p->dp->index, regs, _p);
-}
-
-static int dsa_slave_nway_reset(struct net_device *dev)
-{
-        struct dsa_slave_priv *p = netdev_priv(dev);
-
-        if (p->phy != NULL)
-                return genphy_restart_aneg(p->phy);
-
-        return -EOPNOTSUPP;
+                ds->ops->get_regs(ds, dp->index, regs, _p);
 }
 
 static u32 dsa_slave_get_link(struct net_device *dev)
 {
-        struct dsa_slave_priv *p = netdev_priv(dev);
+        if (!dev->phydev)
+                return -ENODEV;
 
-        if (p->phy != NULL) {
-                genphy_update_link(p->phy);
-                return p->phy->link;
-        }
+        genphy_update_link(dev->phydev);
 
-        return -EOPNOTSUPP;
+        return dev->phydev->link;
 }
 
 static int dsa_slave_get_eeprom_len(struct net_device *dev)
 {
-        struct dsa_slave_priv *p = netdev_priv(dev);
-        struct dsa_switch *ds = p->dp->ds;
+        struct dsa_port *dp = dsa_slave_to_port(dev);
+        struct dsa_switch *ds = dp->ds;
 
         if (ds->cd && ds->cd->eeprom_len)
                 return ds->cd->eeprom_len;
@@ -528,8 +480,8 @@ static int dsa_slave_get_eeprom_len(struct net_device *dev)
 static int dsa_slave_get_eeprom(struct net_device *dev,
                                 struct ethtool_eeprom *eeprom, u8 *data)
 {
-        struct dsa_slave_priv *p = netdev_priv(dev);
-        struct dsa_switch *ds = p->dp->ds;
+        struct dsa_port *dp = dsa_slave_to_port(dev);
+        struct dsa_switch *ds = dp->ds;
 
         if (ds->ops->get_eeprom)
                 return ds->ops->get_eeprom(ds, eeprom, data);
@@ -540,8 +492,8 @@ static int dsa_slave_get_eeprom(struct net_device *dev,
 static int dsa_slave_set_eeprom(struct net_device *dev,
                                 struct ethtool_eeprom *eeprom, u8 *data)
 {
-        struct dsa_slave_priv *p = netdev_priv(dev);
-        struct dsa_switch *ds = p->dp->ds;
+        struct dsa_port *dp = dsa_slave_to_port(dev);
+        struct dsa_switch *ds = dp->ds;
 
         if (ds->ops->set_eeprom)
                 return ds->ops->set_eeprom(ds, eeprom, data);
@@ -552,8 +504,8 @@ static int dsa_slave_set_eeprom(struct net_device *dev,
 static void dsa_slave_get_strings(struct net_device *dev,
                                   uint32_t stringset, uint8_t *data)
 {
-        struct dsa_slave_priv *p = netdev_priv(dev);
-        struct dsa_switch *ds = p->dp->ds;
+        struct dsa_port *dp = dsa_slave_to_port(dev);
+        struct dsa_switch *ds = dp->ds;
 
         if (stringset == ETH_SS_STATS) {
                 int len = ETH_GSTRING_LEN;
@@ -563,80 +515,7 @@ static void dsa_slave_get_strings(struct net_device *dev,
                 strncpy(data + 2 * len, "rx_packets", len);
                 strncpy(data + 3 * len, "rx_bytes", len);
                 if (ds->ops->get_strings)
-                        ds->ops->get_strings(ds, p->dp->index, data + 4 * len);
-        }
-}
-
-static void dsa_cpu_port_get_ethtool_stats(struct net_device *dev,
-                                           struct ethtool_stats *stats,
-                                           uint64_t *data)
-{
-        struct dsa_switch_tree *dst = dev->dsa_ptr;
-        struct dsa_port *cpu_dp = dsa_get_cpu_port(dst);
-        struct dsa_switch *ds = cpu_dp->ds;
-        s8 cpu_port = cpu_dp->index;
-        int count = 0;
-
-        if (cpu_dp->ethtool_ops.get_sset_count) {
-                count = cpu_dp->ethtool_ops.get_sset_count(dev, ETH_SS_STATS);
-                cpu_dp->ethtool_ops.get_ethtool_stats(dev, stats, data);
-        }
-
-        if (ds->ops->get_ethtool_stats)
-                ds->ops->get_ethtool_stats(ds, cpu_port, data + count);
-}
-
-static int dsa_cpu_port_get_sset_count(struct net_device *dev, int sset)
-{
-        struct dsa_switch_tree *dst = dev->dsa_ptr;
-        struct dsa_port *cpu_dp = dsa_get_cpu_port(dst);
-        struct dsa_switch *ds = cpu_dp->ds;
-        int count = 0;
-
-        if (cpu_dp->ethtool_ops.get_sset_count)
-                count += cpu_dp->ethtool_ops.get_sset_count(dev, sset);
-
-        if (sset == ETH_SS_STATS && ds->ops->get_sset_count)
-                count += ds->ops->get_sset_count(ds);
-
-        return count;
-}
-
-static void dsa_cpu_port_get_strings(struct net_device *dev,
-                                     uint32_t stringset, uint8_t *data)
-{
-        struct dsa_switch_tree *dst = dev->dsa_ptr;
-        struct dsa_port *cpu_dp = dsa_get_cpu_port(dst);
-        struct dsa_switch *ds = cpu_dp->ds;
-        s8 cpu_port = cpu_dp->index;
-        int len = ETH_GSTRING_LEN;
-        int mcount = 0, count;
-        unsigned int i;
-        uint8_t pfx[4];
-        uint8_t *ndata;
-
-        snprintf(pfx, sizeof(pfx), "p%.2d", cpu_port);
-        /* We do not want to be NULL-terminated, since this is a prefix */
-        pfx[sizeof(pfx) - 1] = '_';
-
-        if (cpu_dp->ethtool_ops.get_sset_count) {
-                mcount = cpu_dp->ethtool_ops.get_sset_count(dev, ETH_SS_STATS);
-                cpu_dp->ethtool_ops.get_strings(dev, stringset, data);
-        }
-
-        if (stringset == ETH_SS_STATS && ds->ops->get_strings) {
-                ndata = data + mcount * len;
-                /* This function copies ETH_GSTRINGS_LEN bytes, we will mangle
-                 * the output after to prepend our CPU port prefix we
-                 * constructed earlier
-                 */
-                ds->ops->get_strings(ds, cpu_port, ndata);
-                count = ds->ops->get_sset_count(ds);
-                for (i = 0; i < count; i++) {
-                        memmove(ndata + (i * len + sizeof(pfx)),
-                                ndata + i * len, len - sizeof(pfx));
-                        memcpy(ndata + i * len, pfx, sizeof(pfx));
-                }
+                        ds->ops->get_strings(ds, dp->index, data + 4 * len);
         }
 }
 
@@ -644,8 +523,9 @@ static void dsa_slave_get_ethtool_stats(struct net_device *dev,
                                         struct ethtool_stats *stats,
                                         uint64_t *data)
 {
+        struct dsa_port *dp = dsa_slave_to_port(dev);
         struct dsa_slave_priv *p = netdev_priv(dev);
-        struct dsa_switch *ds = p->dp->ds;
+        struct dsa_switch *ds = dp->ds;
         struct pcpu_sw_netstats *s;
         unsigned int start;
         int i;
@@ -667,13 +547,13 @@ static void dsa_slave_get_ethtool_stats(struct net_device *dev,
                 data[3] += rx_bytes;
         }
         if (ds->ops->get_ethtool_stats)
-                ds->ops->get_ethtool_stats(ds, p->dp->index, data + 4);
+                ds->ops->get_ethtool_stats(ds, dp->index, data + 4);
 }
 
 static int dsa_slave_get_sset_count(struct net_device *dev, int sset)
 {
-        struct dsa_slave_priv *p = netdev_priv(dev);
-        struct dsa_switch *ds = p->dp->ds;
+        struct dsa_port *dp = dsa_slave_to_port(dev);
+        struct dsa_switch *ds = dp->ds;
 
         if (sset == ETH_SS_STATS) {
                 int count;
@@ -690,77 +570,77 @@ static int dsa_slave_get_sset_count(struct net_device *dev, int sset)
 
 static void dsa_slave_get_wol(struct net_device *dev, struct ethtool_wolinfo *w)
 {
-        struct dsa_slave_priv *p = netdev_priv(dev);
-        struct dsa_switch *ds = p->dp->ds;
+        struct dsa_port *dp = dsa_slave_to_port(dev);
+        struct dsa_switch *ds = dp->ds;
 
         if (ds->ops->get_wol)
-                ds->ops->get_wol(ds, p->dp->index, w);
+                ds->ops->get_wol(ds, dp->index, w);
 }
 
 static int dsa_slave_set_wol(struct net_device *dev, struct ethtool_wolinfo *w)
 {
-        struct dsa_slave_priv *p = netdev_priv(dev);
-        struct dsa_switch *ds = p->dp->ds;
+        struct dsa_port *dp = dsa_slave_to_port(dev);
+        struct dsa_switch *ds = dp->ds;
         int ret = -EOPNOTSUPP;
 
         if (ds->ops->set_wol)
-                ret = ds->ops->set_wol(ds, p->dp->index, w);
+                ret = ds->ops->set_wol(ds, dp->index, w);
 
         return ret;
 }
 
 static int dsa_slave_set_eee(struct net_device *dev, struct ethtool_eee *e)
 {
-        struct dsa_slave_priv *p = netdev_priv(dev);
-        struct dsa_switch *ds = p->dp->ds;
+        struct dsa_port *dp = dsa_slave_to_port(dev);
+        struct dsa_switch *ds = dp->ds;
         int ret;
 
         /* Port's PHY and MAC both need to be EEE capable */
-        if (!p->phy)
+        if (!dev->phydev)
                 return -ENODEV;
 
         if (!ds->ops->set_mac_eee)
                 return -EOPNOTSUPP;
 
-        ret = ds->ops->set_mac_eee(ds, p->dp->index, e);
+        ret = ds->ops->set_mac_eee(ds, dp->index, e);
         if (ret)
                 return ret;
 
         if (e->eee_enabled) {
-                ret = phy_init_eee(p->phy, 0);
+                ret = phy_init_eee(dev->phydev, 0);
                 if (ret)
                         return ret;
         }
 
-        return phy_ethtool_set_eee(p->phy, e);
+        return phy_ethtool_set_eee(dev->phydev, e);
 }
 
 static int dsa_slave_get_eee(struct net_device *dev, struct ethtool_eee *e)
 {
-        struct dsa_slave_priv *p = netdev_priv(dev);
-        struct dsa_switch *ds = p->dp->ds;
+        struct dsa_port *dp = dsa_slave_to_port(dev);
+        struct dsa_switch *ds = dp->ds;
         int ret;
 
         /* Port's PHY and MAC both need to be EEE capable */
-        if (!p->phy)
+        if (!dev->phydev)
                 return -ENODEV;
 
         if (!ds->ops->get_mac_eee)
                 return -EOPNOTSUPP;
 
-        ret = ds->ops->get_mac_eee(ds, p->dp->index, e);
+        ret = ds->ops->get_mac_eee(ds, dp->index, e);
         if (ret)
                 return ret;
 
-        return phy_ethtool_get_eee(p->phy, e);
+        return phy_ethtool_get_eee(dev->phydev, e);
 }
 
 #ifdef CONFIG_NET_POLL_CONTROLLER
 static int dsa_slave_netpoll_setup(struct net_device *dev,
                                    struct netpoll_info *ni)
 {
+        struct net_device *master = dsa_slave_to_master(dev);
         struct dsa_slave_priv *p = netdev_priv(dev);
-        struct net_device *master = dsa_master_netdev(p);
         struct netpoll *netpoll;
         int err = 0;
 
@@ -800,18 +680,18 @@ static void dsa_slave_poll_controller(struct net_device *dev)
 static int dsa_slave_get_phys_port_name(struct net_device *dev,
                                         char *name, size_t len)
 {
-        struct dsa_slave_priv *p = netdev_priv(dev);
+        struct dsa_port *dp = dsa_slave_to_port(dev);
 
-        if (snprintf(name, len, "p%d", p->dp->index) >= len)
+        if (snprintf(name, len, "p%d", dp->index) >= len)
                 return -EINVAL;
 
         return 0;
 }
 
 static struct dsa_mall_tc_entry *
-dsa_slave_mall_tc_entry_find(struct dsa_slave_priv *p,
-                             unsigned long cookie)
+dsa_slave_mall_tc_entry_find(struct net_device *dev, unsigned long cookie)
 {
+        struct dsa_slave_priv *p = netdev_priv(dev);
         struct dsa_mall_tc_entry *mall_tc_entry;
 
         list_for_each_entry(mall_tc_entry, &p->mall_tc_list, list)
@@ -825,14 +705,15 @@ static int dsa_slave_add_cls_matchall(struct net_device *dev,
                                       struct tc_cls_matchall_offload *cls,
                                       bool ingress)
 {
+        struct dsa_port *dp = dsa_slave_to_port(dev);
         struct dsa_slave_priv *p = netdev_priv(dev);
         struct dsa_mall_tc_entry *mall_tc_entry;
         __be16 protocol = cls->common.protocol;
-        struct dsa_switch *ds = p->dp->ds;
         struct net *net = dev_net(dev);
-        struct dsa_slave_priv *to_p;
+        struct dsa_switch *ds = dp->ds;
         struct net_device *to_dev;
         const struct tc_action *a;
+        struct dsa_port *to_dp;
         int err = -EOPNOTSUPP;
         LIST_HEAD(actions);
         int ifindex;
@@ -865,13 +746,12 @@ static int dsa_slave_add_cls_matchall(struct net_device *dev,
                 mall_tc_entry->type = DSA_PORT_MALL_MIRROR;
                 mirror = &mall_tc_entry->mirror;
 
-                to_p = netdev_priv(to_dev);
+                to_dp = dsa_slave_to_port(to_dev);
 
-                mirror->to_local_port = to_p->dp->index;
+                mirror->to_local_port = to_dp->index;
                 mirror->ingress = ingress;
 
-                err = ds->ops->port_mirror_add(ds, p->dp->index, mirror,
-                                               ingress);
+                err = ds->ops->port_mirror_add(ds, dp->index, mirror, ingress);
                 if (err) {
                         kfree(mall_tc_entry);
                         return err;
@@ -886,14 +766,14 @@ static int dsa_slave_add_cls_matchall(struct net_device *dev,
 static void dsa_slave_del_cls_matchall(struct net_device *dev,
                                        struct tc_cls_matchall_offload *cls)
 {
-        struct dsa_slave_priv *p = netdev_priv(dev);
+        struct dsa_port *dp = dsa_slave_to_port(dev);
         struct dsa_mall_tc_entry *mall_tc_entry;
-        struct dsa_switch *ds = p->dp->ds;
+        struct dsa_switch *ds = dp->ds;
 
         if (!ds->ops->port_mirror_del)
                 return;
 
-        mall_tc_entry = dsa_slave_mall_tc_entry_find(p, cls->cookie);
+        mall_tc_entry = dsa_slave_mall_tc_entry_find(dev, cls->cookie);
         if (!mall_tc_entry)
                 return;
 
@@ -901,8 +781,7 @@ static void dsa_slave_del_cls_matchall(struct net_device *dev,
 
         switch (mall_tc_entry->type) {
         case DSA_PORT_MALL_MIRROR:
-                ds->ops->port_mirror_del(ds, p->dp->index,
-                                         &mall_tc_entry->mirror);
+                ds->ops->port_mirror_del(ds, dp->index, &mall_tc_entry->mirror);
                 break;
         default:
                 WARN_ON(1);
@@ -912,17 +791,9 @@ static void dsa_slave_del_cls_matchall(struct net_device *dev,
 }
 
 static int dsa_slave_setup_tc_cls_matchall(struct net_device *dev,
-                                           struct tc_cls_matchall_offload *cls)
+                                           struct tc_cls_matchall_offload *cls,
+                                           bool ingress)
 {
-        bool ingress;
-
-        if (is_classid_clsact_ingress(cls->common.classid))
-                ingress = true;
-        else if (is_classid_clsact_egress(cls->common.classid))
-                ingress = false;
-        else
-                return -EOPNOTSUPP;
-
         if (cls->common.chain_index)
                 return -EOPNOTSUPP;
 
@@ -937,12 +808,63 @@ static int dsa_slave_setup_tc_cls_matchall(struct net_device *dev,
         }
 }
 
+static int dsa_slave_setup_tc_block_cb(enum tc_setup_type type, void *type_data,
+                                       void *cb_priv, bool ingress)
+{
+        struct net_device *dev = cb_priv;
+
+        if (!tc_can_offload(dev))
+                return -EOPNOTSUPP;
+
+        switch (type) {
+        case TC_SETUP_CLSMATCHALL:
+                return dsa_slave_setup_tc_cls_matchall(dev, type_data, ingress);
+        default:
+                return -EOPNOTSUPP;
+        }
+}
+
+static int dsa_slave_setup_tc_block_cb_ig(enum tc_setup_type type,
+                                          void *type_data, void *cb_priv)
+{
+        return dsa_slave_setup_tc_block_cb(type, type_data, cb_priv, true);
+}
+
+static int dsa_slave_setup_tc_block_cb_eg(enum tc_setup_type type,
+                                          void *type_data, void *cb_priv)
+{
+        return dsa_slave_setup_tc_block_cb(type, type_data, cb_priv, false);
+}
+
+static int dsa_slave_setup_tc_block(struct net_device *dev,
+                                    struct tc_block_offload *f)
+{
+        tc_setup_cb_t *cb;
+
+        if (f->binder_type == TCF_BLOCK_BINDER_TYPE_CLSACT_INGRESS)
+                cb = dsa_slave_setup_tc_block_cb_ig;
+        else if (f->binder_type == TCF_BLOCK_BINDER_TYPE_CLSACT_EGRESS)
+                cb = dsa_slave_setup_tc_block_cb_eg;
+        else
+                return -EOPNOTSUPP;
+
+        switch (f->command) {
+        case TC_BLOCK_BIND:
+                return tcf_block_cb_register(f->block, cb, dev, dev);
+        case TC_BLOCK_UNBIND:
+                tcf_block_cb_unregister(f->block, cb, dev);
+                return 0;
+        default:
+                return -EOPNOTSUPP;
+        }
+}
+
 static int dsa_slave_setup_tc(struct net_device *dev, enum tc_setup_type type,
                               void *type_data)
 {
         switch (type) {
-        case TC_SETUP_CLSMATCHALL:
-                return dsa_slave_setup_tc_cls_matchall(dev, type_data);
+        case TC_SETUP_BLOCK:
+                return dsa_slave_setup_tc_block(dev, type_data);
         default:
                 return -EOPNOTSUPP;
         }
@@ -976,42 +898,35 @@ static void dsa_slave_get_stats64(struct net_device *dev,
         }
 }
 
-void dsa_cpu_port_ethtool_init(struct ethtool_ops *ops)
-{
-        ops->get_sset_count = dsa_cpu_port_get_sset_count;
-        ops->get_ethtool_stats = dsa_cpu_port_get_ethtool_stats;
-        ops->get_strings = dsa_cpu_port_get_strings;
-}
-
 static int dsa_slave_get_rxnfc(struct net_device *dev,
                                struct ethtool_rxnfc *nfc, u32 *rule_locs)
 {
-        struct dsa_slave_priv *p = netdev_priv(dev);
-        struct dsa_switch *ds = p->dp->ds;
+        struct dsa_port *dp = dsa_slave_to_port(dev);
+        struct dsa_switch *ds = dp->ds;
 
         if (!ds->ops->get_rxnfc)
                 return -EOPNOTSUPP;
 
-        return ds->ops->get_rxnfc(ds, p->dp->index, nfc, rule_locs);
+        return ds->ops->get_rxnfc(ds, dp->index, nfc, rule_locs);
 }
 
 static int dsa_slave_set_rxnfc(struct net_device *dev,
                                struct ethtool_rxnfc *nfc)
 {
-        struct dsa_slave_priv *p = netdev_priv(dev);
-        struct dsa_switch *ds = p->dp->ds;
+        struct dsa_port *dp = dsa_slave_to_port(dev);
+        struct dsa_switch *ds = dp->ds;
 
         if (!ds->ops->set_rxnfc)
                 return -EOPNOTSUPP;
 
-        return ds->ops->set_rxnfc(ds, p->dp->index, nfc);
+        return ds->ops->set_rxnfc(ds, dp->index, nfc);
 }
 
 static const struct ethtool_ops dsa_slave_ethtool_ops = {
         .get_drvinfo            = dsa_slave_get_drvinfo,
         .get_regs_len           = dsa_slave_get_regs_len,
         .get_regs               = dsa_slave_get_regs,
-        .nway_reset             = dsa_slave_nway_reset,
+        .nway_reset             = phy_ethtool_nway_reset,
         .get_link               = dsa_slave_get_link,
         .get_eeprom_len         = dsa_slave_get_eeprom_len,
         .get_eeprom             = dsa_slave_get_eeprom,
@@ -1023,8 +938,8 @@ static const struct ethtool_ops dsa_slave_ethtool_ops = {
         .get_wol                = dsa_slave_get_wol,
         .set_eee                = dsa_slave_set_eee,
         .get_eee                = dsa_slave_get_eee,
-        .get_link_ksettings     = dsa_slave_get_link_ksettings,
-        .set_link_ksettings     = dsa_slave_set_link_ksettings,
+        .get_link_ksettings     = phy_ethtool_get_link_ksettings,
+        .set_link_ksettings     = phy_ethtool_set_link_ksettings,
         .get_rxnfc              = dsa_slave_get_rxnfc,
         .set_rxnfc              = dsa_slave_set_rxnfc,
 };
@@ -1064,78 +979,81 @@ static struct device_type dsa_type = {
 
 static void dsa_slave_adjust_link(struct net_device *dev)
 {
+        struct dsa_port *dp = dsa_slave_to_port(dev);
         struct dsa_slave_priv *p = netdev_priv(dev);
-        struct dsa_switch *ds = p->dp->ds;
+        struct dsa_switch *ds = dp->ds;
         unsigned int status_changed = 0;
 
-        if (p->old_link != p->phy->link) {
+        if (p->old_link != dev->phydev->link) {
                 status_changed = 1;
-                p->old_link = p->phy->link;
+                p->old_link = dev->phydev->link;
         }
 
-        if (p->old_duplex != p->phy->duplex) {
+        if (p->old_duplex != dev->phydev->duplex) {
                 status_changed = 1;
-                p->old_duplex = p->phy->duplex;
+                p->old_duplex = dev->phydev->duplex;
         }
 
-        if (p->old_pause != p->phy->pause) {
+        if (p->old_pause != dev->phydev->pause) {
                 status_changed = 1;
-                p->old_pause = p->phy->pause;
+                p->old_pause = dev->phydev->pause;
         }
 
         if (ds->ops->adjust_link && status_changed)
-                ds->ops->adjust_link(ds, p->dp->index, p->phy);
+                ds->ops->adjust_link(ds, dp->index, dev->phydev);
 
         if (status_changed)
-                phy_print_status(p->phy);
+                phy_print_status(dev->phydev);
 }
 
 static int dsa_slave_fixed_link_update(struct net_device *dev,
                                        struct fixed_phy_status *status)
 {
-        struct dsa_slave_priv *p;
         struct dsa_switch *ds;
+        struct dsa_port *dp;
 
         if (dev) {
-                p = netdev_priv(dev);
-                ds = p->dp->ds;
+                dp = dsa_slave_to_port(dev);
+                ds = dp->ds;
                 if (ds->ops->fixed_link_update)
-                        ds->ops->fixed_link_update(ds, p->dp->index, status);
+                        ds->ops->fixed_link_update(ds, dp->index, status);
         }
 
         return 0;
 }
 
 /* slave device setup *******************************************************/
-static int dsa_slave_phy_connect(struct dsa_slave_priv *p,
-                                 struct net_device *slave_dev,
-                                 int addr)
+static int dsa_slave_phy_connect(struct net_device *slave_dev, int addr)
 {
-        struct dsa_switch *ds = p->dp->ds;
+        struct dsa_port *dp = dsa_slave_to_port(slave_dev);
+        struct dsa_slave_priv *p = netdev_priv(slave_dev);
+        struct dsa_switch *ds = dp->ds;
 
-        p->phy = mdiobus_get_phy(ds->slave_mii_bus, addr);
-        if (!p->phy) {
+        slave_dev->phydev = mdiobus_get_phy(ds->slave_mii_bus, addr);
+        if (!slave_dev->phydev) {
                 netdev_err(slave_dev, "no phy at %d\n", addr);
                 return -ENODEV;
         }
 
         /* Use already configured phy mode */
         if (p->phy_interface == PHY_INTERFACE_MODE_NA)
-                p->phy_interface = p->phy->interface;
-        return phy_connect_direct(slave_dev, p->phy, dsa_slave_adjust_link,
-                                  p->phy_interface);
+                p->phy_interface = slave_dev->phydev->interface;
+
+        return phy_connect_direct(slave_dev, slave_dev->phydev,
+                                  dsa_slave_adjust_link, p->phy_interface);
 }
 
-static int dsa_slave_phy_setup(struct dsa_slave_priv *p,
-                                struct net_device *slave_dev)
+static int dsa_slave_phy_setup(struct net_device *slave_dev)
 {
-        struct dsa_switch *ds = p->dp->ds;
-        struct device_node *phy_dn, *port_dn;
+        struct dsa_port *dp = dsa_slave_to_port(slave_dev);
+        struct dsa_slave_priv *p = netdev_priv(slave_dev);
+        struct device_node *port_dn = dp->dn;
+        struct dsa_switch *ds = dp->ds;
+        struct device_node *phy_dn;
         bool phy_is_fixed = false;
         u32 phy_flags = 0;
         int mode, ret;
 
-        port_dn = p->dp->dn;
         mode = of_get_phy_mode(port_dn);
         if (mode < 0)
                 mode = PHY_INTERFACE_MODE_NA;
@@ -1156,52 +1074,35 @@ static int dsa_slave_phy_setup(struct dsa_slave_priv *p,
         }
 
         if (ds->ops->get_phy_flags)
-                phy_flags = ds->ops->get_phy_flags(ds, p->dp->index);
+                phy_flags = ds->ops->get_phy_flags(ds, dp->index);
 
         if (phy_dn) {
-                int phy_id = of_mdio_parse_addr(&slave_dev->dev, phy_dn);
-
-                /* If this PHY address is part of phys_mii_mask, which means
-                 * that we need to divert reads and writes to/from it, then we
-                 * want to bind this device using the slave MII bus created by
-                 * DSA to make that happen.
-                 */
-                if (!phy_is_fixed && phy_id >= 0 &&
-                    (ds->phys_mii_mask & (1 << phy_id))) {
-                        ret = dsa_slave_phy_connect(p, slave_dev, phy_id);
-                        if (ret) {
-                                netdev_err(slave_dev, "failed to connect to phy%d: %d\n", phy_id, ret);
-                                of_node_put(phy_dn);
-                                return ret;
-                        }
-                } else {
-                        p->phy = of_phy_connect(slave_dev, phy_dn,
-                                                dsa_slave_adjust_link,
-                                                phy_flags,
-                                                p->phy_interface);
-                }
-
+                slave_dev->phydev = of_phy_connect(slave_dev, phy_dn,
+                                                   dsa_slave_adjust_link,
+                                                   phy_flags,
+                                                   p->phy_interface);
                 of_node_put(phy_dn);
         }
 
-        if (p->phy && phy_is_fixed)
-                fixed_phy_set_link_update(p->phy, dsa_slave_fixed_link_update);
+        if (slave_dev->phydev && phy_is_fixed)
+                fixed_phy_set_link_update(slave_dev->phydev,
+                                          dsa_slave_fixed_link_update);
 
         /* We could not connect to a designated PHY, so use the switch internal
          * MDIO bus instead
          */
-        if (!p->phy) {
-                ret = dsa_slave_phy_connect(p, slave_dev, p->dp->index);
+        if (!slave_dev->phydev) {
+                ret = dsa_slave_phy_connect(slave_dev, dp->index);
                 if (ret) {
                         netdev_err(slave_dev, "failed to connect to port %d: %d\n",
-                                   p->dp->index, ret);
+                                   dp->index, ret);
                         if (phy_is_fixed)
                                 of_phy_deregister_fixed_link(port_dn);
                         return ret;
                 }
         }
 
-        phy_attached_info(p->phy);
+        phy_attached_info(slave_dev->phydev);
 
         return 0;
 }
@@ -1221,12 +1122,12 @@ int dsa_slave_suspend(struct net_device *slave_dev)
 
         netif_device_detach(slave_dev);
 
-        if (p->phy) {
-                phy_stop(p->phy);
+        if (slave_dev->phydev) {
+                phy_stop(slave_dev->phydev);
                 p->old_pause = -1;
                 p->old_link = -1;
                 p->old_duplex = -1;
-                phy_suspend(p->phy);
+                phy_suspend(slave_dev->phydev);
         }
 
         return 0;
@@ -1234,31 +1135,40 @@ int dsa_slave_suspend(struct net_device *slave_dev)
 
 int dsa_slave_resume(struct net_device *slave_dev)
 {
-        struct dsa_slave_priv *p = netdev_priv(slave_dev);
-
         netif_device_attach(slave_dev);
 
-        if (p->phy) {
-                phy_resume(p->phy);
-                phy_start(p->phy);
+        if (slave_dev->phydev) {
+                phy_resume(slave_dev->phydev);
+                phy_start(slave_dev->phydev);
         }
 
         return 0;
 }
 
-int dsa_slave_create(struct dsa_port *port, const char *name)
+static void dsa_slave_notify(struct net_device *dev, unsigned long val)
+{
+        struct net_device *master = dsa_slave_to_master(dev);
+        struct dsa_port *dp = dsa_slave_to_port(dev);
+        struct dsa_notifier_register_info rinfo = {
+                .switch_number = dp->ds->index,
+                .port_number = dp->index,
+                .master = master,
+                .info.dev = dev,
+        };
+
+        call_dsa_notifiers(val, dev, &rinfo.info);
+}
+
+int dsa_slave_create(struct dsa_port *port)
 {
+        const struct dsa_port *cpu_dp = port->cpu_dp;
+        struct net_device *master = cpu_dp->master;
         struct dsa_switch *ds = port->ds;
-        struct dsa_switch_tree *dst = ds->dst;
-        struct net_device *master;
+        const char *name = port->name;
         struct net_device *slave_dev;
         struct dsa_slave_priv *p;
-        struct dsa_port *cpu_dp;
         int ret;
 
-        cpu_dp = ds->dst->cpu_dp;
-        master = cpu_dp->netdev;
-
         if (!ds->num_tx_queues)
                 ds->num_tx_queues = 1;
 
@@ -1294,22 +1204,24 @@ int dsa_slave_create(struct dsa_port *port, const char *name)
         }
         p->dp = port;
         INIT_LIST_HEAD(&p->mall_tc_list);
-        p->xmit = dst->tag_ops->xmit;
+        p->xmit = cpu_dp->tag_ops->xmit;
 
         p->old_pause = -1;
         p->old_link = -1;
         p->old_duplex = -1;
 
-        port->netdev = slave_dev;
+        port->slave = slave_dev;
 
         netif_carrier_off(slave_dev);
 
-        ret = dsa_slave_phy_setup(p, slave_dev);
+        ret = dsa_slave_phy_setup(slave_dev);
         if (ret) {
                 netdev_err(master, "error %d setting up slave phy\n", ret);
                 goto out_free;
         }
 
+        dsa_slave_notify(slave_dev, DSA_PORT_REGISTER);
+
         ret = register_netdev(slave_dev);
         if (ret) {
                 netdev_err(master, "error %d registering interface %s\n",
@@ -1320,30 +1232,30 @@ int dsa_slave_create(struct dsa_port *port, const char *name)
         return 0;
 
 out_phy:
-        phy_disconnect(p->phy);
-        if (of_phy_is_fixed_link(p->dp->dn))
-                of_phy_deregister_fixed_link(p->dp->dn);
+        phy_disconnect(slave_dev->phydev);
+        if (of_phy_is_fixed_link(port->dn))
+                of_phy_deregister_fixed_link(port->dn);
 out_free:
         free_percpu(p->stats64);
         free_netdev(slave_dev);
-        port->netdev = NULL;
+        port->slave = NULL;
         return ret;
 }
 
 void dsa_slave_destroy(struct net_device *slave_dev)
 {
+        struct dsa_port *dp = dsa_slave_to_port(slave_dev);
         struct dsa_slave_priv *p = netdev_priv(slave_dev);
-        struct device_node *port_dn;
-
-        port_dn = p->dp->dn;
+        struct device_node *port_dn = dp->dn;
 
         netif_carrier_off(slave_dev);
-        if (p->phy) {
-                phy_disconnect(p->phy);
+        if (slave_dev->phydev) {
+                phy_disconnect(slave_dev->phydev);
 
                 if (of_phy_is_fixed_link(port_dn))
                         of_phy_deregister_fixed_link(port_dn);
         }
+        dsa_slave_notify(slave_dev, DSA_PORT_UNREGISTER);
         unregister_netdev(slave_dev);
         free_percpu(p->stats64);
         free_netdev(slave_dev);
@@ -1357,8 +1269,7 @@ static bool dsa_slave_dev_check(struct net_device *dev)
 static int dsa_slave_changeupper(struct net_device *dev,
                                  struct netdev_notifier_changeupper_info *info)
 {
-        struct dsa_slave_priv *p = netdev_priv(dev);
-        struct dsa_port *dp = p->dp;
+        struct dsa_port *dp = dsa_slave_to_port(dev);
         int err = NOTIFY_DONE;
 
         if (netif_is_bridge_master(info->upper_dev)) {
@@ -1379,7 +1290,7 @@ static int dsa_slave_netdevice_event(struct notifier_block *nb,
 {
         struct net_device *dev = netdev_notifier_info_to_dev(ptr);
 
-        if (dev->netdev_ops != &dsa_slave_netdev_ops)
+        if (!dsa_slave_dev_check(dev))
                 return NOTIFY_DONE;
 
         if (event == NETDEV_CHANGEUPPER)
@@ -1401,14 +1312,14 @@ static void dsa_slave_switchdev_event_work(struct work_struct *work)
                 container_of(work, struct dsa_switchdev_event_work, work);
         struct net_device *dev = switchdev_work->dev;
         struct switchdev_notifier_fdb_info *fdb_info;
-        struct dsa_slave_priv *p = netdev_priv(dev);
+        struct dsa_port *dp = dsa_slave_to_port(dev);
         int err;
 
         rtnl_lock();
         switch (switchdev_work->event) {
         case SWITCHDEV_FDB_ADD_TO_DEVICE:
                 fdb_info = &switchdev_work->fdb_info;
-                err = dsa_port_fdb_add(p->dp, fdb_info->addr, fdb_info->vid);
+                err = dsa_port_fdb_add(dp, fdb_info->addr, fdb_info->vid);
                 if (err) {
                         netdev_dbg(dev, "fdb add failed err=%d\n", err);
                         break;
@@ -1419,7 +1330,7 @@ static void dsa_slave_switchdev_event_work(struct work_struct *work)
 
         case SWITCHDEV_FDB_DEL_TO_DEVICE:
                 fdb_info = &switchdev_work->fdb_info;
-                err = dsa_port_fdb_del(p->dp, fdb_info->addr, fdb_info->vid);
+                err = dsa_port_fdb_del(dp, fdb_info->addr, fdb_info->vid);
                 if (err) {
                         netdev_dbg(dev, "fdb del failed err=%d\n", err);
                         dev_close(dev);
diff --git a/net/dsa/switch.c b/net/dsa/switch.c
index 1e2929f4290a..29608d087a7c 100644
--- a/net/dsa/switch.c
+++ b/net/dsa/switch.c
@@ -121,7 +121,7 @@ static int dsa_switch_mdb_add(struct dsa_switch *ds,
         if (ds->index == info->sw_index)
                 set_bit(info->port, group);
         for (port = 0; port < ds->num_ports; port++)
-                if (dsa_is_cpu_port(ds, port) || dsa_is_dsa_port(ds, port))
+                if (dsa_is_dsa_port(ds, port))
                         set_bit(port, group);
 
         if (switchdev_trans_ph_prepare(trans)) {
diff --git a/net/dsa/tag_brcm.c b/net/dsa/tag_brcm.c
index dbb016434ace..e6e0b7b6025c 100644
--- a/net/dsa/tag_brcm.c
+++ b/net/dsa/tag_brcm.c
@@ -59,9 +59,11 @@
 #define BRCM_EG_TC_MASK         0x7
 #define BRCM_EG_PID_MASK        0x1f
 
-static struct sk_buff *brcm_tag_xmit(struct sk_buff *skb, struct net_device *dev)
+static struct sk_buff *brcm_tag_xmit_ll(struct sk_buff *skb,
+                                        struct net_device *dev,
+                                        unsigned int offset)
 {
-        struct dsa_slave_priv *p = netdev_priv(dev);
+        struct dsa_port *dp = dsa_slave_to_port(dev);
         u16 queue = skb_get_queue_mapping(skb);
         u8 *brcm_tag;
 
@@ -70,10 +72,10 @@ static struct sk_buff *brcm_tag_xmit(struct sk_buff *skb, struct net_device *dev
 
         skb_push(skb, BRCM_TAG_LEN);
 
-        memmove(skb->data, skb->data + BRCM_TAG_LEN, 2 * ETH_ALEN);
+        if (offset)
+                memmove(skb->data, skb->data + BRCM_TAG_LEN, offset);
 
-        /* Build the tag after the MAC Source Address */
-        brcm_tag = skb->data + 2 * ETH_ALEN;
+        brcm_tag = skb->data + offset;
 
         /* Set the ingress opcode, traffic class, tag enforcment is
          * deprecated
@@ -82,27 +84,30 @@ static struct sk_buff *brcm_tag_xmit(struct sk_buff *skb, struct net_device *dev
                        ((queue & BRCM_IG_TC_MASK) << BRCM_IG_TC_SHIFT);
         brcm_tag[1] = 0;
         brcm_tag[2] = 0;
-        if (p->dp->index == 8)
+        if (dp->index == 8)
                 brcm_tag[2] = BRCM_IG_DSTMAP2_MASK;
-        brcm_tag[3] = (1 << p->dp->index) & BRCM_IG_DSTMAP1_MASK;
+        brcm_tag[3] = (1 << dp->index) & BRCM_IG_DSTMAP1_MASK;
+
+        /* Now tell the master network device about the desired output queue
+         * as well
+         */
+        skb_set_queue_mapping(skb, BRCM_TAG_SET_PORT_QUEUE(dp->index, queue));
 
         return skb;
 }
 
-static struct sk_buff *brcm_tag_rcv(struct sk_buff *skb, struct net_device *dev,
-                                    struct packet_type *pt)
+static struct sk_buff *brcm_tag_rcv_ll(struct sk_buff *skb,
+                                       struct net_device *dev,
+                                       struct packet_type *pt,
+                                       unsigned int offset)
 {
-        struct dsa_switch_tree *dst = dev->dsa_ptr;
-        struct dsa_port *cpu_dp = dsa_get_cpu_port(dst);
-        struct dsa_switch *ds = cpu_dp->ds;
         int source_port;
         u8 *brcm_tag;
 
         if (unlikely(!pskb_may_pull(skb, BRCM_TAG_LEN)))
                 return NULL;
 
-        /* skb->data points to the EtherType, the tag is right before it */
-        brcm_tag = skb->data - 2;
+        brcm_tag = skb->data - offset;
 
         /* The opcode should never be different than 0b000 */
         if (unlikely((brcm_tag[0] >> BRCM_OPCODE_SHIFT) & BRCM_OPCODE_MASK))
@@ -117,24 +122,67 @@ static struct sk_buff *brcm_tag_rcv(struct sk_buff *skb, struct net_device *dev,
         /* Locate which port this is coming from */
         source_port = brcm_tag[3] & BRCM_EG_PID_MASK;
 
-        /* Validate port against switch setup, either the port is totally */
-        if (source_port >= ds->num_ports || !ds->ports[source_port].netdev)
+        skb->dev = dsa_master_find_slave(dev, 0, source_port);
+        if (!skb->dev)
                 return NULL;
 
         /* Remove Broadcom tag and update checksum */
         skb_pull_rcsum(skb, BRCM_TAG_LEN);
 
+        return skb;
+}
+
+#ifdef CONFIG_NET_DSA_TAG_BRCM
+static struct sk_buff *brcm_tag_xmit(struct sk_buff *skb,
+                                     struct net_device *dev)
+{
+        /* Build the tag after the MAC Source Address */
+        return brcm_tag_xmit_ll(skb, dev, 2 * ETH_ALEN);
+}
+
+
+static struct sk_buff *brcm_tag_rcv(struct sk_buff *skb, struct net_device *dev,
+                                    struct packet_type *pt)
+{
+        struct sk_buff *nskb;
+
+        /* skb->data points to the EtherType, the tag is right before it */
+        nskb = brcm_tag_rcv_ll(skb, dev, pt, 2);
+        if (!nskb)
+                return nskb;
+
         /* Move the Ethernet DA and SA */
-        memmove(skb->data - ETH_HLEN,
-                skb->data - ETH_HLEN - BRCM_TAG_LEN,
+        memmove(nskb->data - ETH_HLEN,
+                nskb->data - ETH_HLEN - BRCM_TAG_LEN,
                 2 * ETH_ALEN);
 
-        skb->dev = ds->ports[source_port].netdev;
-
-        return skb;
+        return nskb;
 }
 
 const struct dsa_device_ops brcm_netdev_ops = {
         .xmit   = brcm_tag_xmit,
         .rcv    = brcm_tag_rcv,
 };
+#endif
+
+#ifdef CONFIG_NET_DSA_TAG_BRCM_PREPEND
+static struct sk_buff *brcm_tag_xmit_prepend(struct sk_buff *skb,
+                                             struct net_device *dev)
+{
+        /* tag is prepended to the packet */
+        return brcm_tag_xmit_ll(skb, dev, 0);
+}
+
+static struct sk_buff *brcm_tag_rcv_prepend(struct sk_buff *skb,
+                                            struct net_device *dev,
+                                            struct packet_type *pt)
+{
+        /* tag is prepended to the packet */
+        return brcm_tag_rcv_ll(skb, dev, pt, ETH_HLEN);
+}
+
+const struct dsa_device_ops brcm_prepend_netdev_ops = {
+        .xmit   = brcm_tag_xmit_prepend,
+        .rcv    = brcm_tag_rcv_prepend,
+};
+#endif
diff --git a/net/dsa/tag_dsa.c b/net/dsa/tag_dsa.c
index fbf9ca954773..cd13cfc542ce 100644
--- a/net/dsa/tag_dsa.c
+++ b/net/dsa/tag_dsa.c
@@ -18,7 +18,7 @@
 
 static struct sk_buff *dsa_xmit(struct sk_buff *skb, struct net_device *dev)
 {
-        struct dsa_slave_priv *p = netdev_priv(dev);
+        struct dsa_port *dp = dsa_slave_to_port(dev);
         u8 *dsa_header;
 
         /*
@@ -34,8 +34,8 @@ static struct sk_buff *dsa_xmit(struct sk_buff *skb, struct net_device *dev)
                  * Construct tagged FROM_CPU DSA tag from 802.1q tag.
                  */
                 dsa_header = skb->data + 2 * ETH_ALEN;
-                dsa_header[0] = 0x60 | p->dp->ds->index;
-                dsa_header[1] = p->dp->index << 3;
+                dsa_header[0] = 0x60 | dp->ds->index;
+                dsa_header[1] = dp->index << 3;
 
                 /*
                  * Move CFI field from byte 2 to byte 1.
@@ -55,8 +55,8 @@ static struct sk_buff *dsa_xmit(struct sk_buff *skb, struct net_device *dev)
                  * Construct untagged FROM_CPU DSA tag.
                  */
                 dsa_header = skb->data + 2 * ETH_ALEN;
-                dsa_header[0] = 0x40 | p->dp->ds->index;
-                dsa_header[1] = p->dp->index << 3;
+                dsa_header[0] = 0x40 | dp->ds->index;
+                dsa_header[1] = dp->index << 3;
                 dsa_header[2] = 0x00;
                 dsa_header[3] = 0x00;
         }
@@ -67,8 +67,6 @@ static struct sk_buff *dsa_xmit(struct sk_buff *skb, struct net_device *dev)
 static struct sk_buff *dsa_rcv(struct sk_buff *skb, struct net_device *dev,
                                struct packet_type *pt)
 {
-        struct dsa_switch_tree *dst = dev->dsa_ptr;
-        struct dsa_switch *ds;
         u8 *dsa_header;
         int source_device;
         int source_port;
@@ -93,18 +91,8 @@ static struct sk_buff *dsa_rcv(struct sk_buff *skb, struct net_device *dev,
         source_device = dsa_header[0] & 0x1f;
         source_port = (dsa_header[1] >> 3) & 0x1f;
 
-        /*
-         * Check that the source device exists and that the source
-         * port is a registered DSA port.
-         */
-        if (source_device >= DSA_MAX_SWITCHES)
-                return NULL;
-
-        ds = dst->ds[source_device];
-        if (!ds)
-                return NULL;
-
-        if (source_port >= ds->num_ports || !ds->ports[source_port].netdev)
+        skb->dev = dsa_master_find_slave(dev, source_device, source_port);
+        if (!skb->dev)
                 return NULL;
 
         /*
@@ -153,7 +141,7 @@ static struct sk_buff *dsa_rcv(struct sk_buff *skb, struct net_device *dev,
                         2 * ETH_ALEN);
         }
 
-        skb->dev = ds->ports[source_port].netdev;
+        skb->offload_fwd_mark = 1;
 
         return skb;
 }
diff --git a/net/dsa/tag_edsa.c b/net/dsa/tag_edsa.c
index 76367ba1b2e2..4083326b806e 100644
--- a/net/dsa/tag_edsa.c
+++ b/net/dsa/tag_edsa.c
@@ -19,7 +19,7 @@
 
 static struct sk_buff *edsa_xmit(struct sk_buff *skb, struct net_device *dev)
 {
-        struct dsa_slave_priv *p = netdev_priv(dev);
+        struct dsa_port *dp = dsa_slave_to_port(dev);
         u8 *edsa_header;
 
         /*
@@ -43,8 +43,8 @@ static struct sk_buff *edsa_xmit(struct sk_buff *skb, struct net_device *dev)
                 edsa_header[1] = ETH_P_EDSA & 0xff;
                 edsa_header[2] = 0x00;
                 edsa_header[3] = 0x00;
-                edsa_header[4] = 0x60 | p->dp->ds->index;
-                edsa_header[5] = p->dp->index << 3;
+                edsa_header[4] = 0x60 | dp->ds->index;
+                edsa_header[5] = dp->index << 3;
 
                 /*
                  * Move CFI field from byte 6 to byte 5.
@@ -68,8 +68,8 @@ static struct sk_buff *edsa_xmit(struct sk_buff *skb, struct net_device *dev)
                 edsa_header[1] = ETH_P_EDSA & 0xff;
                 edsa_header[2] = 0x00;
                 edsa_header[3] = 0x00;
-                edsa_header[4] = 0x40 | p->dp->ds->index;
-                edsa_header[5] = p->dp->index << 3;
+                edsa_header[4] = 0x40 | dp->ds->index;
+                edsa_header[5] = dp->index << 3;
                 edsa_header[6] = 0x00;
                 edsa_header[7] = 0x00;
         }
@@ -80,8 +80,6 @@ static struct sk_buff *edsa_xmit(struct sk_buff *skb, struct net_device *dev)
 static struct sk_buff *edsa_rcv(struct sk_buff *skb, struct net_device *dev,
                                 struct packet_type *pt)
 {
-        struct dsa_switch_tree *dst = dev->dsa_ptr;
-        struct dsa_switch *ds;
         u8 *edsa_header;
         int source_device;
         int source_port;
@@ -106,18 +104,8 @@ static struct sk_buff *edsa_rcv(struct sk_buff *skb, struct net_device *dev,
         source_device = edsa_header[0] & 0x1f;
         source_port = (edsa_header[1] >> 3) & 0x1f;
 
-        /*
-         * Check that the source device exists and that the source
-         * port is a registered DSA port.
-         */
-        if (source_device >= DSA_MAX_SWITCHES)
-                return NULL;
-
-        ds = dst->ds[source_device];
-        if (!ds)
-                return NULL;
-
-        if (source_port >= ds->num_ports || !ds->ports[source_port].netdev)
+        skb->dev = dsa_master_find_slave(dev, source_device, source_port);
+        if (!skb->dev)
                 return NULL;
 
         /*
@@ -172,7 +160,7 @@ static struct sk_buff *edsa_rcv(struct sk_buff *skb, struct net_device *dev,
                         2 * ETH_ALEN);
         }
 
-        skb->dev = ds->ports[source_port].netdev;
+        skb->offload_fwd_mark = 1;
 
         return skb;
 }
diff --git a/net/dsa/tag_ksz.c b/net/dsa/tag_ksz.c
index 010ca0a336c4..0f62effad88f 100644
--- a/net/dsa/tag_ksz.c
+++ b/net/dsa/tag_ksz.c
@@ -34,7 +34,7 @@
 
 static struct sk_buff *ksz_xmit(struct sk_buff *skb, struct net_device *dev)
 {
-        struct dsa_slave_priv *p = netdev_priv(dev);
+        struct dsa_port *dp = dsa_slave_to_port(dev);
         struct sk_buff *nskb;
         int padlen;
         u8 *tag;
@@ -72,7 +72,7 @@ static struct sk_buff *ksz_xmit(struct sk_buff *skb, struct net_device *dev)
 
         tag = skb_put(nskb, KSZ_INGRESS_TAG_LEN);
         tag[0] = 0;
-        tag[1] = 1 << p->dp->index; /* destination port */
+        tag[1] = 1 << dp->index; /* destination port */
 
         return nskb;
 }
@@ -80,22 +80,19 @@ static struct sk_buff *ksz_xmit(struct sk_buff *skb, struct net_device *dev)
 static struct sk_buff *ksz_rcv(struct sk_buff *skb, struct net_device *dev,
                                struct packet_type *pt)
 {
-        struct dsa_switch_tree *dst = dev->dsa_ptr;
-        struct dsa_port *cpu_dp = dsa_get_cpu_port(dst);
-        struct dsa_switch *ds = cpu_dp->ds;
         u8 *tag;
         int source_port;
 
         tag = skb_tail_pointer(skb) - KSZ_EGRESS_TAG_LEN;
 
         source_port = tag[0] & 7;
-        if (source_port >= ds->num_ports || !ds->ports[source_port].netdev)
+
+        skb->dev = dsa_master_find_slave(dev, 0, source_port);
+        if (!skb->dev)
                 return NULL;
 
         pskb_trim_rcsum(skb, skb->len - KSZ_EGRESS_TAG_LEN);
 
-        skb->dev = ds->ports[source_port].netdev;
-
         return skb;
 }
 
diff --git a/net/dsa/tag_lan9303.c b/net/dsa/tag_lan9303.c
index 0b9826105e42..548c00254c07 100644
--- a/net/dsa/tag_lan9303.c
+++ b/net/dsa/tag_lan9303.c
@@ -11,6 +11,7 @@
  * GNU General Public License for more details.
  *
  */
+#include <linux/dsa/lan9303.h>
 #include <linux/etherdevice.h>
 #include <linux/list.h>
 #include <linux/slab.h>
@@ -39,10 +40,30 @@
  */
 
 #define LAN9303_TAG_LEN 4
+# define LAN9303_TAG_TX_USE_ALR BIT(3)
+# define LAN9303_TAG_TX_STP_OVERRIDE BIT(4)
+# define LAN9303_TAG_RX_IGMP BIT(3)
+# define LAN9303_TAG_RX_STP BIT(4)
+# define LAN9303_TAG_RX_TRAPPED_TO_CPU (LAN9303_TAG_RX_IGMP | \
+                                        LAN9303_TAG_RX_STP)
+
+/* Decide whether to transmit using ALR lookup, or transmit directly to
+ * port using tag. ALR learning is performed only when using ALR lookup.
+ * If the two external ports are bridged and the frame is unicast,
+ * then use ALR lookup to allow ALR learning on CPU port.
+ * Otherwise transmit directly to port with STP state override.
+ * See also: lan9303_separate_ports() and lan9303.pdf 6.4.10.1
+ */
+static int lan9303_xmit_use_arl(struct dsa_port *dp, u8 *dest_addr)
+{
+        struct lan9303 *chip = dp->ds->priv;
+
+        return chip->is_bridged && !is_multicast_ether_addr(dest_addr);
+}
 
 static struct sk_buff *lan9303_xmit(struct sk_buff *skb, struct net_device *dev)
 {
-        struct dsa_slave_priv *p = netdev_priv(dev);
+        struct dsa_port *dp = dsa_slave_to_port(dev);
         u16 *lan9303_tag;
 
         /* insert a special VLAN tag between the MAC addresses
@@ -62,26 +83,21 @@ static struct sk_buff *lan9303_xmit(struct sk_buff *skb, struct net_device *dev)
 
         lan9303_tag = (u16 *)(skb->data + 2 * ETH_ALEN);
         lan9303_tag[0] = htons(ETH_P_8021Q);
-        lan9303_tag[1] = htons(p->dp->index | BIT(4));
+        lan9303_tag[1] = lan9303_xmit_use_arl(dp, skb->data) ?
+                                LAN9303_TAG_TX_USE_ALR :
+                                dp->index | LAN9303_TAG_TX_STP_OVERRIDE;
+        lan9303_tag[1] = htons(lan9303_tag[1]);
 
         return skb;
 }
 
 static struct sk_buff *lan9303_rcv(struct sk_buff *skb, struct net_device *dev,
-                        struct packet_type *pt)
+                                   struct packet_type *pt)
 {
         u16 *lan9303_tag;
-        struct dsa_switch_tree *dst = dev->dsa_ptr;
-        struct dsa_switch *ds;
+        u16 lan9303_tag1;
         unsigned int source_port;
 
-        ds = dst->ds[0];
-
-        if (unlikely(!ds)) {
-                dev_warn_ratelimited(&dev->dev, "Dropping packet, due to missing DSA switch device\n");
-                return NULL;
-        }
-
         if (unlikely(!pskb_may_pull(skb, LAN9303_TAG_LEN))) {
                 dev_warn_ratelimited(&dev->dev,
                                      "Dropping packet, cannot pull\n");
@@ -101,27 +117,22 @@ static struct sk_buff *lan9303_rcv(struct sk_buff *skb, struct net_device *dev,
                 return NULL;
         }
 
-        source_port = ntohs(lan9303_tag[1]) & 0x3;
+        lan9303_tag1 = ntohs(lan9303_tag[1]);
+        source_port = lan9303_tag1 & 0x3;
 
-        if (source_port >= ds->num_ports) {
+        skb->dev = dsa_master_find_slave(dev, 0, source_port);
+        if (!skb->dev) {
                 dev_warn_ratelimited(&dev->dev, "Dropping packet due to invalid source port\n");
                 return NULL;
         }
 
-        if (!ds->ports[source_port].netdev) {
-                dev_warn_ratelimited(&dev->dev, "Dropping packet due to invalid netdev or device\n");
-                return NULL;
-        }
-
         /* remove the special VLAN tag between the MAC addresses
          * and the current ethertype field.
          */
         skb_pull_rcsum(skb, 2 + 2);
         memmove(skb->data - ETH_HLEN, skb->data - (ETH_HLEN + LAN9303_TAG_LEN),
                 2 * ETH_ALEN);
-
-        /* forward the packet to the dedicated interface */
-        skb->dev = ds->ports[source_port].netdev;
+        skb->offload_fwd_mark = !(lan9303_tag1 & LAN9303_TAG_RX_TRAPPED_TO_CPU);
 
         return skb;
 }
diff --git a/net/dsa/tag_mtk.c b/net/dsa/tag_mtk.c
index ec8ee5f43255..8475434af7d5 100644
--- a/net/dsa/tag_mtk.c
+++ b/net/dsa/tag_mtk.c
@@ -23,7 +23,7 @@
 static struct sk_buff *mtk_tag_xmit(struct sk_buff *skb,
                                     struct net_device *dev)
 {
-        struct dsa_slave_priv *p = netdev_priv(dev);
+        struct dsa_port *dp = dsa_slave_to_port(dev);
         u8 *mtk_tag;
 
         if (skb_cow_head(skb, MTK_HDR_LEN) < 0)
@@ -36,7 +36,7 @@ static struct sk_buff *mtk_tag_xmit(struct sk_buff *skb,
         /* Build the tag after the MAC Source Address */
         mtk_tag = skb->data + 2 * ETH_ALEN;
         mtk_tag[0] = 0;
-        mtk_tag[1] = (1 << p->dp->index) & MTK_HDR_XMIT_DP_BIT_MASK;
+        mtk_tag[1] = (1 << dp->index) & MTK_HDR_XMIT_DP_BIT_MASK;
         mtk_tag[2] = 0;
         mtk_tag[3] = 0;
 
@@ -46,8 +46,6 @@ static struct sk_buff *mtk_tag_xmit(struct sk_buff *skb,
 static struct sk_buff *mtk_tag_rcv(struct sk_buff *skb, struct net_device *dev,
                                    struct packet_type *pt)
 {
-        struct dsa_switch_tree *dst = dev->dsa_ptr;
-        struct dsa_switch *ds;
         int port;
         __be16 *phdr, hdr;
 
@@ -68,20 +66,12 @@ static struct sk_buff *mtk_tag_rcv(struct sk_buff *skb, struct net_device *dev,
                 skb->data - ETH_HLEN - MTK_HDR_LEN,
                 2 * ETH_ALEN);
 
-        /* This protocol doesn't support cascading multiple
-         * switches so it's safe to assume the switch is first
-         * in the tree.
-         */
-        ds = dst->ds[0];
-        if (!ds)
-                return NULL;
-
         /* Get source port information */
         port = (hdr & MTK_HDR_RECV_SOURCE_PORT_MASK);
-        if (!ds->ports[port].netdev)
-                return NULL;
 
-        skb->dev = ds->ports[port].netdev;
+        skb->dev = dsa_master_find_slave(dev, 0, port);
+        if (!skb->dev)
+                return NULL;
 
         return skb;
 }
diff --git a/net/dsa/tag_qca.c b/net/dsa/tag_qca.c
index 1d4c70711c0f..613f4ee97771 100644
--- a/net/dsa/tag_qca.c
+++ b/net/dsa/tag_qca.c
@@ -38,7 +38,7 @@
 
 static struct sk_buff *qca_tag_xmit(struct sk_buff *skb, struct net_device *dev)
 {
-        struct dsa_slave_priv *p = netdev_priv(dev);
+        struct dsa_port *dp = dsa_slave_to_port(dev);
         u16 *phdr, hdr;
 
         dev->stats.tx_packets++;
@@ -54,8 +54,7 @@ static struct sk_buff *qca_tag_xmit(struct sk_buff *skb, struct net_device *dev)
 
         /* Set the version field, and set destination port information */
         hdr = QCA_HDR_VERSION << QCA_HDR_XMIT_VERSION_S |
-                QCA_HDR_XMIT_FROM_CPU |
-                BIT(p->dp->index);
+                QCA_HDR_XMIT_FROM_CPU | BIT(dp->index);
 
         *phdr = htons(hdr);
 
@@ -65,9 +64,6 @@ static struct sk_buff *qca_tag_xmit(struct sk_buff *skb, struct net_device *dev)
 static struct sk_buff *qca_tag_rcv(struct sk_buff *skb, struct net_device *dev,
                                    struct packet_type *pt)
 {
-        struct dsa_switch_tree *dst = dev->dsa_ptr;
-        struct dsa_port *cpu_dp = dsa_get_cpu_port(dst);
-        struct dsa_switch *ds;
         u8 ver;
         int port;
         __be16 *phdr, hdr;
@@ -92,20 +88,12 @@ static struct sk_buff *qca_tag_rcv(struct sk_buff *skb, struct net_device *dev,
         memmove(skb->data - ETH_HLEN, skb->data - ETH_HLEN - QCA_HDR_LEN,
                 ETH_HLEN - QCA_HDR_LEN);
 
-        /* This protocol doesn't support cascading multiple switches so it's
-         * safe to assume the switch is first in the tree
-         */
-        ds = cpu_dp->ds;
-        if (!ds)
-                return NULL;
-
         /* Get source port information */
         port = (hdr & QCA_HDR_RECV_SOURCE_PORT_MASK);
-        if (!ds->ports[port].netdev)
-                return NULL;
 
-        /* Update skb & forward the frame accordingly */
-        skb->dev = ds->ports[port].netdev;
+        skb->dev = dsa_master_find_slave(dev, 0, port);
+        if (!skb->dev)
+                return NULL;
 
         return skb;
 }
diff --git a/net/dsa/tag_trailer.c b/net/dsa/tag_trailer.c
index d2fd4923aa3e..7d20e1f3de28 100644
--- a/net/dsa/tag_trailer.c
+++ b/net/dsa/tag_trailer.c
@@ -16,7 +16,7 @@
 
 static struct sk_buff *trailer_xmit(struct sk_buff *skb, struct net_device *dev)
 {
-        struct dsa_slave_priv *p = netdev_priv(dev);
+        struct dsa_port *dp = dsa_slave_to_port(dev);
         struct sk_buff *nskb;
         int padlen;
         u8 *trailer;
@@ -48,7 +48,7 @@ static struct sk_buff *trailer_xmit(struct sk_buff *skb, struct net_device *dev)
 
         trailer = skb_put(nskb, 4);
         trailer[0] = 0x80;
-        trailer[1] = 1 << p->dp->index;
+        trailer[1] = 1 << dp->index;
         trailer[2] = 0x10;
         trailer[3] = 0x00;
 
@@ -58,9 +58,6 @@ static struct sk_buff *trailer_xmit(struct sk_buff *skb, struct net_device *dev)
 static struct sk_buff *trailer_rcv(struct sk_buff *skb, struct net_device *dev,
                                    struct packet_type *pt)
 {
-        struct dsa_switch_tree *dst = dev->dsa_ptr;
-        struct dsa_port *cpu_dp = dsa_get_cpu_port(dst);
-        struct dsa_switch *ds = cpu_dp->ds;
         u8 *trailer;
         int source_port;
 
@@ -73,13 +70,13 @@ static struct sk_buff *trailer_rcv(struct sk_buff *skb, struct net_device *dev,
                 return NULL;
 
         source_port = trailer[1] & 7;
-        if (source_port >= ds->num_ports || !ds->ports[source_port].netdev)
+
+        skb->dev = dsa_master_find_slave(dev, 0, source_port);
+        if (!skb->dev)
                 return NULL;
 
         pskb_trim_rcsum(skb, skb->len - 4);
 
-        skb->dev = ds->ports[source_port].netdev;
-
         return skb;
 }
 
diff --git a/net/hsr/hsr_device.c b/net/hsr/hsr_device.c
index 172d8309f89e..b8cd43c9ed5b 100644
--- a/net/hsr/hsr_device.c
+++ b/net/hsr/hsr_device.c
@@ -328,12 +328,12 @@ out:
 
 /* Announce (supervision frame) timer function
  */
-static void hsr_announce(unsigned long data)
+static void hsr_announce(struct timer_list *t)
 {
         struct hsr_priv *hsr;
         struct hsr_port *master;
 
-        hsr = (struct hsr_priv *) data;
+        hsr = from_timer(hsr, t, announce_timer);
 
         rcu_read_lock();
         master = hsr_port_get_hsr(hsr, HSR_PT_MASTER);
@@ -463,9 +463,8 @@ int hsr_dev_finalize(struct net_device *hsr_dev, struct net_device *slave[2],
         hsr->sequence_nr = HSR_SEQNR_START;
         hsr->sup_sequence_nr = HSR_SUP_SEQNR_START;
 
-        setup_timer(&hsr->announce_timer, hsr_announce, (unsigned long)hsr);
-
-        setup_timer(&hsr->prune_timer, hsr_prune_nodes, (unsigned long)hsr);
+        timer_setup(&hsr->announce_timer, hsr_announce, 0);
+        timer_setup(&hsr->prune_timer, hsr_prune_nodes, 0);
 
         ether_addr_copy(hsr->sup_multicast_addr, def_multicast_addr);
         hsr->sup_multicast_addr[ETH_ALEN - 1] = multicast_spec;
diff --git a/net/hsr/hsr_framereg.c b/net/hsr/hsr_framereg.c
index 284a9b820df8..286ceb41ac0c 100644
--- a/net/hsr/hsr_framereg.c
+++ b/net/hsr/hsr_framereg.c
@@ -365,16 +365,14 @@ static struct hsr_port *get_late_port(struct hsr_priv *hsr,
 /* Remove stale sequence_nr records. Called by timer every
  * HSR_LIFE_CHECK_INTERVAL (two seconds or so).
  */
-void hsr_prune_nodes(unsigned long data)
+void hsr_prune_nodes(struct timer_list *t)
 {
-        struct hsr_priv *hsr;
+        struct hsr_priv *hsr = from_timer(hsr, t, prune_timer);
         struct hsr_node *node;
         struct hsr_port *port;
         unsigned long timestamp;
         unsigned long time_a, time_b;
 
-        hsr = (struct hsr_priv *) data;
-
         rcu_read_lock();
         list_for_each_entry_rcu(node, &hsr->node_db, mac_list) {
                 /* Shorthand */
diff --git a/net/hsr/hsr_framereg.h b/net/hsr/hsr_framereg.h
index 4e04f0e868e9..370b45998121 100644
--- a/net/hsr/hsr_framereg.h
+++ b/net/hsr/hsr_framereg.h
@@ -33,7 +33,7 @@ void hsr_register_frame_in(struct hsr_node *node, struct hsr_port *port,
 int hsr_register_frame_out(struct hsr_port *port, struct hsr_node *node,
                            u16 sequence_nr);
 
-void hsr_prune_nodes(unsigned long data);
+void hsr_prune_nodes(struct timer_list *t);
 
 int hsr_create_self_node(struct list_head *self_node_db,
                          unsigned char addr_a[ETH_ALEN],
diff --git a/net/ieee802154/6lowpan/reassembly.c b/net/ieee802154/6lowpan/reassembly.c
index f85b08baff16..85bf86ad6b18 100644
--- a/net/ieee802154/6lowpan/reassembly.c
+++ b/net/ieee802154/6lowpan/reassembly.c
@@ -80,12 +80,13 @@ static void lowpan_frag_init(struct inet_frag_queue *q, const void *a)
         fq->daddr = *arg->dst;
 }
 
-static void lowpan_frag_expire(unsigned long data)
+static void lowpan_frag_expire(struct timer_list *t)
 {
+        struct inet_frag_queue *frag = from_timer(frag, t, timer);
         struct frag_queue *fq;
         struct net *net;
 
-        fq = container_of((struct inet_frag_queue *)data, struct frag_queue, q);
+        fq = container_of(frag, struct frag_queue, q);
         net = container_of(fq->q.net, struct net, ieee802154_lowpan.frags);
 
         spin_lock(&fq->q.lock);
diff --git a/net/ieee802154/netlink.c b/net/ieee802154/netlink.c
index 6bde9e5a5503..96636e3b7aa9 100644
--- a/net/ieee802154/netlink.c
+++ b/net/ieee802154/netlink.c
@@ -89,7 +89,7 @@ int ieee802154_nl_reply(struct sk_buff *msg, struct genl_info *info)
         return genlmsg_reply(msg, info);
 }
 
-static const struct genl_ops ieee8021154_ops[] = {
+static const struct genl_ops ieee802154_ops[] = {
         /* see nl-phy.c */
         IEEE802154_DUMP(IEEE802154_LIST_PHY, ieee802154_list_phy,
                         ieee802154_dump_phy),
@@ -137,8 +137,8 @@ struct genl_family nl802154_family __ro_after_init = {
         .version        = 1,
         .maxattr        = IEEE802154_ATTR_MAX,
         .module         = THIS_MODULE,
-        .ops            = ieee8021154_ops,
-        .n_ops          = ARRAY_SIZE(ieee8021154_ops),
+        .ops            = ieee802154_ops,
+        .n_ops          = ARRAY_SIZE(ieee802154_ops),
         .mcgrps         = ieee802154_mcgrps,
         .n_mcgrps       = ARRAY_SIZE(ieee802154_mcgrps),
 };
diff --git a/net/ipv4/af_inet.c b/net/ipv4/af_inet.c
index e31108e5ef79..ce4aa827be05 100644
--- a/net/ipv4/af_inet.c
+++ b/net/ipv4/af_inet.c
@@ -195,7 +195,7 @@ int inet_listen(struct socket *sock, int backlog)
 {
         struct sock *sk = sock->sk;
         unsigned char old_state;
-        int err;
+        int err, tcp_fastopen;
 
         lock_sock(sk);
 
@@ -217,11 +217,12 @@ int inet_listen(struct socket *sock, int backlog)
                  * because the socket was in TCP_LISTEN state previously but
                  * was shutdown() rather than close().
                  */
-                if ((sysctl_tcp_fastopen & TFO_SERVER_WO_SOCKOPT1) &&
-                    (sysctl_tcp_fastopen & TFO_SERVER_ENABLE) &&
+                tcp_fastopen = sock_net(sk)->ipv4.sysctl_tcp_fastopen;
+                if ((tcp_fastopen & TFO_SERVER_WO_SOCKOPT1) &&
+                    (tcp_fastopen & TFO_SERVER_ENABLE) &&
                     !inet_csk(sk)->icsk_accept_queue.fastopenq.max_qlen) {
                         fastopen_queue_tune(sk, backlog);
-                        tcp_fastopen_init_key_once(true);
+                        tcp_fastopen_init_key_once(sock_net(sk));
                 }
 
                 err = inet_csk_listen_start(sk, backlog);
@@ -826,6 +827,7 @@ int inet_shutdown(struct socket *sock, int how)
                 err = -ENOTCONN;
                 /* Hack to wake up other listeners, who can poll for
                    POLLHUP, even on eg. unconnected UDP sockets -- RR */
+                /* fall through */
         default:
                 sk->sk_shutdown |= how;
                 if (sk->sk_prot->shutdown)
@@ -839,7 +841,7 @@ int inet_shutdown(struct socket *sock, int how)
         case TCP_LISTEN:
                 if (!(how & RCV_SHUTDOWN))
                         break;
-                /* Fall through */
+                /* fall through */
         case TCP_SYN_SENT:
                 err = sk->sk_prot->disconnect(sk, O_NONBLOCK);
                 sock->state = err ? SS_DISCONNECTING : SS_UNCONNECTED;
diff --git a/net/ipv4/ah4.c b/net/ipv4/ah4.c
index 37db44f60718..4dd95cdd8070 100644
--- a/net/ipv4/ah4.c
+++ b/net/ipv4/ah4.c
@@ -240,7 +240,7 @@ static int ah_output(struct xfrm_state *x, struct sk_buff *skb)
                 if (err == -EINPROGRESS)
                         goto out;
 
-                if (err == -EBUSY)
+                if (err == -ENOSPC)
                         err = NET_XMIT_DROP;
                 goto out_free;
         }
diff --git a/net/ipv4/arp.c b/net/ipv4/arp.c
index 7c45b8896709..a8d7c5a9fb05 100644
--- a/net/ipv4/arp.c
+++ b/net/ipv4/arp.c
@@ -1180,6 +1180,7 @@ int arp_ioctl(struct net *net, unsigned int cmd, void __user *arg)
         case SIOCSARP:
                 if (!ns_capable(net->user_ns, CAP_NET_ADMIN))
                         return -EPERM;
+                /* fall through */
         case SIOCGARP:
                 err = copy_from_user(&r, arg, sizeof(struct arpreq));
                 if (err)
diff --git a/net/ipv4/devinet.c b/net/ipv4/devinet.c
index d7adc0616599..a4573bccd6da 100644
--- a/net/ipv4/devinet.c
+++ b/net/ipv4/devinet.c
@@ -137,22 +137,12 @@ static void inet_hash_remove(struct in_ifaddr *ifa)
  */
 struct net_device *__ip_dev_find(struct net *net, __be32 addr, bool devref)
 {
-        u32 hash = inet_addr_hash(net, addr);
         struct net_device *result = NULL;
         struct in_ifaddr *ifa;
 
         rcu_read_lock();
-        hlist_for_each_entry_rcu(ifa, &inet_addr_lst[hash], hash) {
-                if (ifa->ifa_local == addr) {
-                        struct net_device *dev = ifa->ifa_dev->dev;
-
-                        if (!net_eq(dev_net(dev), net))
-                                continue;
-                        result = dev;
-                        break;
-                }
-        }
-        if (!result) {
+        ifa = inet_lookup_ifaddr_rcu(net, addr);
+        if (!ifa) {
                 struct flowi4 fl4 = { .daddr = addr };
                 struct fib_result res = { 0 };
                 struct fib_table *local;
@@ -165,6 +155,8 @@ struct net_device *__ip_dev_find(struct net *net, __be32 addr, bool devref)
                     !fib_table_lookup(local, &fl4, &res, FIB_LOOKUP_NOREF) &&
                     res.type == RTN_LOCAL)
                         result = FIB_RES_DEV(res);
+        } else {
+                result = ifa->ifa_dev->dev;
         }
         if (result && devref)
                 dev_hold(result);
@@ -173,6 +165,20 @@ struct net_device *__ip_dev_find(struct net *net, __be32 addr, bool devref)
 }
 EXPORT_SYMBOL(__ip_dev_find);
 
+/* called under RCU lock */
+struct in_ifaddr *inet_lookup_ifaddr_rcu(struct net *net, __be32 addr)
+{
+        u32 hash = inet_addr_hash(net, addr);
+        struct in_ifaddr *ifa;
+
+        hlist_for_each_entry_rcu(ifa, &inet_addr_lst[hash], hash)
+                if (ifa->ifa_local == addr &&
+                    net_eq(dev_net(ifa->ifa_dev->dev), net))
+                        return ifa;
+
+        return NULL;
+}
+
 static void rtmsg_ifa(int event, struct in_ifaddr *, struct nlmsghdr *, u32);
 
 static BLOCKING_NOTIFIER_HEAD(inetaddr_chain);
@@ -438,7 +444,7 @@ static void check_lifetime(struct work_struct *work);
 static DECLARE_DELAYED_WORK(check_lifetime_work, check_lifetime);
 
 static int __inet_insert_ifa(struct in_ifaddr *ifa, struct nlmsghdr *nlh,
-                             u32 portid)
+                             u32 portid, struct netlink_ext_ack *extack)
 {
         struct in_device *in_dev = ifa->ifa_dev;
         struct in_ifaddr *ifa1, **ifap, **last_primary;
@@ -483,6 +489,7 @@ static int __inet_insert_ifa(struct in_ifaddr *ifa, struct nlmsghdr *nlh,
          */
         ivi.ivi_addr = ifa->ifa_address;
         ivi.ivi_dev = ifa->ifa_dev;
+        ivi.extack = extack;
         ret = blocking_notifier_call_chain(&inetaddr_validator_chain,
                                            NETDEV_UP, &ivi);
         ret = notifier_to_errno(ret);
@@ -515,7 +522,7 @@ static int __inet_insert_ifa(struct in_ifaddr *ifa, struct nlmsghdr *nlh,
 
 static int inet_insert_ifa(struct in_ifaddr *ifa)
 {
-        return __inet_insert_ifa(ifa, NULL, 0);
+        return __inet_insert_ifa(ifa, NULL, 0, NULL);
 }
 
 static int inet_set_ifa(struct net_device *dev, struct in_ifaddr *ifa)
@@ -896,7 +903,8 @@ static int inet_rtm_newaddr(struct sk_buff *skb, struct nlmsghdr *nlh,
                                 return ret;
                         }
                 }
-                return __inet_insert_ifa(ifa, nlh, NETLINK_CB(skb).portid);
+                return __inet_insert_ifa(ifa, nlh, NETLINK_CB(skb).portid,
+                                         extack);
         } else {
                 inet_free_ifa(ifa);
 
@@ -1516,6 +1524,7 @@ static int inetdev_event(struct notifier_block *this, unsigned long event,
                 if (inetdev_valid_mtu(dev->mtu))
                         break;
                 /* disable IP when MTU is not enough */
+                /* fall through */
         case NETDEV_UNREGISTER:
                 inetdev_destroy(in_dev);
                 break;
@@ -1751,7 +1760,7 @@ static int inet_validate_link_af(const struct net_device *dev,
         struct nlattr *a, *tb[IFLA_INET_MAX+1];
         int err, rem;
 
-        if (dev && !__in_dev_get_rtnl(dev))
+        if (dev && !__in_dev_get_rcu(dev))
                 return -EAFNOSUPPORT;
 
         err = nla_parse_nested(tb, IFLA_INET_MAX, nla, inet_af_policy, NULL);
@@ -1775,7 +1784,7 @@ static int inet_validate_link_af(const struct net_device *dev,
 
 static int inet_set_link_af(struct net_device *dev, const struct nlattr *nla)
 {
-        struct in_device *in_dev = __in_dev_get_rtnl(dev);
+        struct in_device *in_dev = __in_dev_get_rcu(dev);
         struct nlattr *a, *tb[IFLA_INET_MAX+1];
         int rem;
 
diff --git a/net/ipv4/esp4.c b/net/ipv4/esp4.c
index b00e4a43b4dc..d57aa64fa7c7 100644
--- a/net/ipv4/esp4.c
+++ b/net/ipv4/esp4.c
@@ -432,7 +432,7 @@ int esp_output_tail(struct xfrm_state *x, struct sk_buff *skb, struct esp_info *
         case -EINPROGRESS:
                 goto error;
 
-        case -EBUSY:
+        case -ENOSPC:
                 err = NET_XMIT_DROP;
                 break;
 
diff --git a/net/ipv4/fib_frontend.c b/net/ipv4/fib_frontend.c
index 37819ab4cc74..f52d27a422c3 100644
--- a/net/ipv4/fib_frontend.c
+++ b/net/ipv4/fib_frontend.c
@@ -73,6 +73,11 @@ fail:
         fib_free_table(main_table);
         return -ENOMEM;
 }
+
+static bool fib4_has_custom_rules(struct net *net)
+{
+        return false;
+}
 #else
 
 struct fib_table *fib_new_table(struct net *net, u32 id)
@@ -128,6 +133,11 @@ struct fib_table *fib_get_table(struct net *net, u32 id)
         }
         return NULL;
 }
+
+static bool fib4_has_custom_rules(struct net *net)
+{
+        return net->ipv4.fib_has_custom_rules;
+}
 #endif /* CONFIG_IP_MULTIPLE_TABLES */
 
 static void fib_replace_table(struct net *net, struct fib_table *old,
@@ -345,9 +355,6 @@ static int __fib_validate_source(struct sk_buff *skb, __be32 src, __be32 dst,
         if (res.type != RTN_UNICAST &&
             (res.type != RTN_LOCAL || !IN_DEV_ACCEPT_LOCAL(idev)))
                 goto e_inval;
-        if (!rpf && !fib_num_tclassid_users(net) &&
-            (dev->ifindex != oif || !IN_DEV_TX_REDIRECTS(idev)))
-                goto last_resort;
         fib_combine_itag(itag, &res);
         dev_match = false;
 
@@ -402,13 +409,28 @@ int fib_validate_source(struct sk_buff *skb, __be32 src, __be32 dst,
                         struct in_device *idev, u32 *itag)
 {
         int r = secpath_exists(skb) ? 0 : IN_DEV_RPFILTER(idev);
+        struct net *net = dev_net(dev);
 
-        if (!r && !fib_num_tclassid_users(dev_net(dev)) &&
-            IN_DEV_ACCEPT_LOCAL(idev) &&
+        if (!r && !fib_num_tclassid_users(net) &&
             (dev->ifindex != oif || !IN_DEV_TX_REDIRECTS(idev))) {
+                if (IN_DEV_ACCEPT_LOCAL(idev))
+                        goto ok;
+                /* with custom local routes in place, checking local addresses
+                 * only will be too optimistic, with custom rules, checking
+                 * local addresses only can be too strict, e.g. due to vrf
+                 */
+                if (net->ipv4.fib_has_custom_local_routes ||
+                    fib4_has_custom_rules(net))
+                        goto full_check;
+                if (inet_lookup_ifaddr_rcu(net, src))
+                        return -EINVAL;
+
+ok:
                 *itag = 0;
                 return 0;
         }
+
+full_check:
         return __fib_validate_source(skb, src, dst, tos, oif, dev, r, idev, itag);
 }
 
@@ -759,6 +781,8 @@ static int inet_rtm_newroute(struct sk_buff *skb, struct nlmsghdr *nlh,
         }
 
         err = fib_table_insert(net, tb, &cfg, extack);
+        if (!err && cfg.fc_type == RTN_LOCAL)
+                net->ipv4.fib_has_custom_local_routes = true;
 errout:
         return err;
 }
diff --git a/net/ipv4/fib_semantics.c b/net/ipv4/fib_semantics.c
index 01ed22139ac2..f04d944f8abe 100644
--- a/net/ipv4/fib_semantics.c
+++ b/net/ipv4/fib_semantics.c
@@ -601,17 +601,9 @@ static void fib_rebalance(struct fib_info *fi)
                 atomic_set(&nexthop_nh->nh_upper_bound, upper_bound);
         } endfor_nexthops(fi);
 }
-
-static inline void fib_add_weight(struct fib_info *fi,
-                                  const struct fib_nh *nh)
-{
-        fi->fib_weight += nh->nh_weight;
-}
-
 #else /* CONFIG_IP_ROUTE_MULTIPATH */
 
 #define fib_rebalance(fi) do { } while (0)
-#define fib_add_weight(fi, nh) do { } while (0)
 
 #endif /* CONFIG_IP_ROUTE_MULTIPATH */
 
@@ -718,7 +710,7 @@ bool fib_metrics_match(struct fib_config *cfg, struct fib_info *fi)
                         bool ecn_ca = false;
 
                         nla_strlcpy(tmp, nla, sizeof(tmp));
-                        val = tcp_ca_get_key_by_name(tmp, &ecn_ca);
+                        val = tcp_ca_get_key_by_name(fi->fib_net, tmp, &ecn_ca);
                 } else {
                         val = nla_get_u32(nla);
                 }
@@ -774,8 +766,8 @@ bool fib_metrics_match(struct fib_config *cfg, struct fib_info *fi)
  *                                      |
  *                                      |-> {local prefix} (terminal node)
  */
-static int fib_check_nh(struct fib_config *cfg, struct fib_info *fi,
-                        struct fib_nh *nh, struct netlink_ext_ack *extack)
+static int fib_check_nh(struct fib_config *cfg, struct fib_nh *nh,
+                        struct netlink_ext_ack *extack)
 {
         int err = 0;
         struct net *net;
@@ -1038,7 +1030,7 @@ fib_convert_metrics(struct fib_info *fi, const struct fib_config *cfg)
                         char tmp[TCP_CA_NAME_MAX];
 
                         nla_strlcpy(tmp, nla, sizeof(tmp));
-                        val = tcp_ca_get_key_by_name(tmp, &ecn_ca);
+                        val = tcp_ca_get_key_by_name(fi->fib_net, tmp, &ecn_ca);
                         if (val == TCP_CA_UNSPEC)
                                 return -EINVAL;
                 } else {
@@ -1258,7 +1250,7 @@ struct fib_info *fib_create_info(struct fib_config *cfg,
                 int linkdown = 0;
 
                 change_nexthops(fi) {
-                        err = fib_check_nh(cfg, fi, nexthop_nh, extack);
+                        err = fib_check_nh(cfg, nexthop_nh, extack);
                         if (err != 0)
                                 goto failure;
                         if (nexthop_nh->nh_flags & RTNH_F_LINKDOWN)
@@ -1275,7 +1267,6 @@ struct fib_info *fib_create_info(struct fib_config *cfg,
 
         change_nexthops(fi) {
                 fib_info_update_nh_saddr(net, nexthop_nh);
-                fib_add_weight(fi, nexthop_nh);
         } endfor_nexthops(fi)
 
         fib_rebalance(fi);
diff --git a/net/ipv4/fib_trie.c b/net/ipv4/fib_trie.c
index c636650a6a70..5ddc4aefff12 100644
--- a/net/ipv4/fib_trie.c
+++ b/net/ipv4/fib_trie.c
@@ -87,32 +87,32 @@
 
 static int call_fib_entry_notifier(struct notifier_block *nb, struct net *net,
                                    enum fib_event_type event_type, u32 dst,
-                                   int dst_len, struct fib_info *fi,
-                                   u8 tos, u8 type, u32 tb_id)
+                                   int dst_len, struct fib_alias *fa)
 {
         struct fib_entry_notifier_info info = {
                 .dst = dst,
                 .dst_len = dst_len,
-                .fi = fi,
-                .tos = tos,
-                .type = type,
-                .tb_id = tb_id,
+                .fi = fa->fa_info,
+                .tos = fa->fa_tos,
+                .type = fa->fa_type,
+                .tb_id = fa->tb_id,
         };
         return call_fib4_notifier(nb, net, event_type, &info.info);
 }
 
 static int call_fib_entry_notifiers(struct net *net,
                                     enum fib_event_type event_type, u32 dst,
-                                    int dst_len, struct fib_info *fi,
-                                    u8 tos, u8 type, u32 tb_id)
+                                    int dst_len, struct fib_alias *fa,
+                                    struct netlink_ext_ack *extack)
 {
         struct fib_entry_notifier_info info = {
+                .info.extack = extack,
                 .dst = dst,
                 .dst_len = dst_len,
-                .fi = fi,
-                .tos = tos,
-                .type = type,
-                .tb_id = tb_id,
+                .fi = fa->fa_info,
+                .tos = fa->fa_tos,
+                .type = fa->fa_type,
+                .tb_id = fa->tb_id,
         };
         return call_fib4_notifiers(net, event_type, &info.info);
 }
@@ -1216,9 +1216,7 @@ int fib_table_insert(struct net *net, struct fib_table *tb,
                         new_fa->fa_default = -1;
 
                         call_fib_entry_notifiers(net, FIB_EVENT_ENTRY_REPLACE,
-                                                 key, plen, fi,
-                                                 new_fa->fa_tos, cfg->fc_type,
-                                                 tb->tb_id);
+                                                 key, plen, new_fa, extack);
                         rtmsg_fib(RTM_NEWROUTE, htonl(key), new_fa, plen,
                                   tb->tb_id, &cfg->fc_nlinfo, nlflags);
 
@@ -1273,8 +1271,7 @@ int fib_table_insert(struct net *net, struct fib_table *tb,
                 tb->tb_num_default++;
 
         rt_cache_flush(cfg->fc_nlinfo.nl_net);
-        call_fib_entry_notifiers(net, event, key, plen, fi, tos, cfg->fc_type,
-                                 tb->tb_id);
+        call_fib_entry_notifiers(net, event, key, plen, new_fa, extack);
         rtmsg_fib(RTM_NEWROUTE, htonl(key), new_fa, plen, new_fa->tb_id,
                   &cfg->fc_nlinfo, nlflags);
 succeeded:
@@ -1574,8 +1571,7 @@ int fib_table_delete(struct net *net, struct fib_table *tb,
                 return -ESRCH;
 
         call_fib_entry_notifiers(net, FIB_EVENT_ENTRY_DEL, key, plen,
-                                 fa_to_delete->fa_info, tos,
-                                 fa_to_delete->fa_type, tb->tb_id);
+                                 fa_to_delete, extack);
         rtmsg_fib(RTM_DELROUTE, htonl(key), fa_to_delete, plen, tb->tb_id,
                   &cfg->fc_nlinfo, 0);
 
@@ -1892,9 +1888,8 @@ int fib_table_flush(struct net *net, struct fib_table *tb)
 
                         call_fib_entry_notifiers(net, FIB_EVENT_ENTRY_DEL,
                                                  n->key,
-                                                 KEYLENGTH - fa->fa_slen,
-                                                 fi, fa->fa_tos, fa->fa_type,
-                                                 tb->tb_id);
+                                                 KEYLENGTH - fa->fa_slen, fa,
+                                                 NULL);
                         hlist_del_rcu(&fa->fa_list);
                         fib_release_info(fa->fa_info);
                         alias_free_mem_rcu(fa);
@@ -1932,8 +1927,7 @@ static void fib_leaf_notify(struct net *net, struct key_vector *l,
                         continue;
 
                 call_fib_entry_notifier(nb, net, FIB_EVENT_ENTRY_ADD, l->key,
-                                        KEYLENGTH - fa->fa_slen, fi, fa->fa_tos,
-                                        fa->fa_type, fa->tb_id);
+                                        KEYLENGTH - fa->fa_slen, fa);
         }
 }
 
diff --git a/net/ipv4/icmp.c b/net/ipv4/icmp.c
index 681e33998e03..1617604c9284 100644
--- a/net/ipv4/icmp.c
+++ b/net/ipv4/icmp.c
@@ -782,7 +782,7 @@ static bool icmp_tag_validation(int proto)
 }
 
 /*
- *      Handle ICMP_DEST_UNREACH, ICMP_TIME_EXCEED, ICMP_QUENCH, and
+ *      Handle ICMP_DEST_UNREACH, ICMP_TIME_EXCEEDED, ICMP_QUENCH, and
  *      ICMP_PARAMETERPROB.
  */
 
@@ -810,7 +810,8 @@ static bool icmp_unreach(struct sk_buff *skb)
         if (iph->ihl < 5) /* Mangled header, drop. */
                 goto out_err;
 
-        if (icmph->type == ICMP_DEST_UNREACH) {
+        switch (icmph->type) {
+        case ICMP_DEST_UNREACH:
                 switch (icmph->code & 15) {
                 case ICMP_NET_UNREACH:
                 case ICMP_HOST_UNREACH:
@@ -846,8 +847,16 @@ static bool icmp_unreach(struct sk_buff *skb)
                 }
                 if (icmph->code > NR_ICMP_UNREACH)
                         goto out;
-        } else if (icmph->type == ICMP_PARAMETERPROB)
+                break;
+        case ICMP_PARAMETERPROB:
                 info = ntohl(icmph->un.gateway) >> 24;
+                break;
+        case ICMP_TIME_EXCEEDED:
+                __ICMP_INC_STATS(net, ICMP_MIB_INTIMEEXCDS);
+                if (icmph->code == ICMP_EXC_FRAGTIME)
+                        goto out;
+                break;
+        }
 
         /*
          *      Throw it at our lower layers
@@ -959,8 +968,9 @@ static bool icmp_timestamp(struct sk_buff *skb)
          */
         icmp_param.data.times[1] = inet_current_timestamp();
         icmp_param.data.times[2] = icmp_param.data.times[1];
-        if (skb_copy_bits(skb, 0, &icmp_param.data.times[0], 4))
-                BUG();
+
+        BUG_ON(skb_copy_bits(skb, 0, &icmp_param.data.times[0], 4));
+
         icmp_param.data.icmph      = *icmp_hdr(skb);
         icmp_param.data.icmph.type = ICMP_TIMESTAMPREPLY;
         icmp_param.data.icmph.code = 0;
diff --git a/net/ipv4/igmp.c b/net/ipv4/igmp.c
index ab183af0b5b6..d1f8f302dbf3 100644
--- a/net/ipv4/igmp.c
+++ b/net/ipv4/igmp.c
@@ -752,18 +752,18 @@ static int igmp_send_report(struct in_device *in_dev, struct ip_mc_list *pmc,
         return ip_local_out(net, skb->sk, skb);
 }
 
-static void igmp_gq_timer_expire(unsigned long data)
+static void igmp_gq_timer_expire(struct timer_list *t)
 {
-        struct in_device *in_dev = (struct in_device *)data;
+        struct in_device *in_dev = from_timer(in_dev, t, mr_gq_timer);
 
         in_dev->mr_gq_running = 0;
         igmpv3_send_report(in_dev, NULL);
         in_dev_put(in_dev);
 }
 
-static void igmp_ifc_timer_expire(unsigned long data)
+static void igmp_ifc_timer_expire(struct timer_list *t)
 {
-        struct in_device *in_dev = (struct in_device *)data;
+        struct in_device *in_dev = from_timer(in_dev, t, mr_ifc_timer);
 
         igmpv3_send_cr(in_dev);
         if (in_dev->mr_ifc_count) {
@@ -784,9 +784,9 @@ static void igmp_ifc_event(struct in_device *in_dev)
 }
 
 
-static void igmp_timer_expire(unsigned long data)
+static void igmp_timer_expire(struct timer_list *t)
 {
-        struct ip_mc_list *im = (struct ip_mc_list *)data;
+        struct ip_mc_list *im = from_timer(im, t, timer);
         struct in_device *in_dev = im->interface;
 
         spin_lock(&im->lock);
@@ -1385,7 +1385,7 @@ void ip_mc_inc_group(struct in_device *in_dev, __be32 addr)
         refcount_set(&im->refcnt, 1);
         spin_lock_init(&im->lock);
 #ifdef CONFIG_IP_MULTICAST
-        setup_timer(&im->timer, igmp_timer_expire, (unsigned long)im);
+        timer_setup(&im->timer, igmp_timer_expire, 0);
         im->unsolicit_count = net->ipv4.sysctl_igmp_qrv;
 #endif
 
@@ -1695,10 +1695,8 @@ void ip_mc_init_dev(struct in_device *in_dev)
         ASSERT_RTNL();
 
 #ifdef CONFIG_IP_MULTICAST
-        setup_timer(&in_dev->mr_gq_timer, igmp_gq_timer_expire,
-                        (unsigned long)in_dev);
-        setup_timer(&in_dev->mr_ifc_timer, igmp_ifc_timer_expire,
-                        (unsigned long)in_dev);
+        timer_setup(&in_dev->mr_gq_timer, igmp_gq_timer_expire, 0);
+        timer_setup(&in_dev->mr_ifc_timer, igmp_ifc_timer_expire, 0);
         in_dev->mr_qrv = net->ipv4.sysctl_igmp_qrv;
 #endif
 
diff --git a/net/ipv4/inet_connection_sock.c b/net/ipv4/inet_connection_sock.c
index b47a59cb3573..4ca46dc08e63 100644
--- a/net/ipv4/inet_connection_sock.c
+++ b/net/ipv4/inet_connection_sock.c
@@ -39,11 +39,11 @@ EXPORT_SYMBOL(inet_csk_timer_bug_msg);
  *                          IPV6_ADDR_ANY only equals to IPV6_ADDR_ANY,
  *                          and 0.0.0.0 equals to 0.0.0.0 only
  */
-static int ipv6_rcv_saddr_equal(const struct in6_addr *sk1_rcv_saddr6,
-                                const struct in6_addr *sk2_rcv_saddr6,
-                                __be32 sk1_rcv_saddr, __be32 sk2_rcv_saddr,
-                                bool sk1_ipv6only, bool sk2_ipv6only,
-                                bool match_wildcard)
+static bool ipv6_rcv_saddr_equal(const struct in6_addr *sk1_rcv_saddr6,
+                                 const struct in6_addr *sk2_rcv_saddr6,
+                                 __be32 sk1_rcv_saddr, __be32 sk2_rcv_saddr,
+                                 bool sk1_ipv6only, bool sk2_ipv6only,
+                                 bool match_wildcard)
 {
         int addr_type = ipv6_addr_type(sk1_rcv_saddr6);
         int addr_type2 = sk2_rcv_saddr6 ? ipv6_addr_type(sk2_rcv_saddr6) : IPV6_ADDR_MAPPED;
@@ -52,29 +52,29 @@ static int ipv6_rcv_saddr_equal(const struct in6_addr *sk1_rcv_saddr6,
         if (addr_type == IPV6_ADDR_MAPPED && addr_type2 == IPV6_ADDR_MAPPED) {
                 if (!sk2_ipv6only) {
                         if (sk1_rcv_saddr == sk2_rcv_saddr)
-                                return 1;
+                                return true;
                         if (!sk1_rcv_saddr || !sk2_rcv_saddr)
                                 return match_wildcard;
                 }
-                return 0;
+                return false;
         }
 
         if (addr_type == IPV6_ADDR_ANY && addr_type2 == IPV6_ADDR_ANY)
-                return 1;
+                return true;
 
         if (addr_type2 == IPV6_ADDR_ANY && match_wildcard &&
             !(sk2_ipv6only && addr_type == IPV6_ADDR_MAPPED))
-                return 1;
+                return true;
 
         if (addr_type == IPV6_ADDR_ANY && match_wildcard &&
             !(sk1_ipv6only && addr_type2 == IPV6_ADDR_MAPPED))
-                return 1;
+                return true;
 
         if (sk2_rcv_saddr6 &&
             ipv6_addr_equal(sk1_rcv_saddr6, sk2_rcv_saddr6))
-                return 1;
+                return true;
 
-        return 0;
+        return false;
 }
 #endif
 
@@ -82,20 +82,20 @@ static int ipv6_rcv_saddr_equal(const struct in6_addr *sk1_rcv_saddr6,
  * match_wildcard == false: addresses must be exactly the same, i.e.
  *                          0.0.0.0 only equals to 0.0.0.0
  */
-static int ipv4_rcv_saddr_equal(__be32 sk1_rcv_saddr, __be32 sk2_rcv_saddr,
-                                bool sk2_ipv6only, bool match_wildcard)
+static bool ipv4_rcv_saddr_equal(__be32 sk1_rcv_saddr, __be32 sk2_rcv_saddr,
+                                 bool sk2_ipv6only, bool match_wildcard)
 {
         if (!sk2_ipv6only) {
                 if (sk1_rcv_saddr == sk2_rcv_saddr)
-                        return 1;
+                        return true;
                 if (!sk1_rcv_saddr || !sk2_rcv_saddr)
                         return match_wildcard;
         }
-        return 0;
+        return false;
 }
 
-int inet_rcv_saddr_equal(const struct sock *sk, const struct sock *sk2,
-                         bool match_wildcard)
+bool inet_rcv_saddr_equal(const struct sock *sk, const struct sock *sk2,
+                          bool match_wildcard)
 {
 #if IS_ENABLED(CONFIG_IPV6)
         if (sk->sk_family == AF_INET6)
@@ -495,17 +495,15 @@ EXPORT_SYMBOL(inet_csk_accept);
  * to optimize.
  */
 void inet_csk_init_xmit_timers(struct sock *sk,
-                               void (*retransmit_handler)(unsigned long),
-                               void (*delack_handler)(unsigned long),
-                               void (*keepalive_handler)(unsigned long))
+                               void (*retransmit_handler)(struct timer_list *t),
+                               void (*delack_handler)(struct timer_list *t),
+                               void (*keepalive_handler)(struct timer_list *t))
 {
         struct inet_connection_sock *icsk = inet_csk(sk);
 
-        setup_timer(&icsk->icsk_retransmit_timer, retransmit_handler,
-                        (unsigned long)sk);
-        setup_timer(&icsk->icsk_delack_timer, delack_handler,
-                        (unsigned long)sk);
-        setup_timer(&sk->sk_timer, keepalive_handler, (unsigned long)sk);
+        timer_setup(&icsk->icsk_retransmit_timer, retransmit_handler, 0);
+        timer_setup(&icsk->icsk_delack_timer, delack_handler, 0);
+        timer_setup(&sk->sk_timer, keepalive_handler, 0);
         icsk->icsk_pending = icsk->icsk_ack.pending = 0;
 }
 EXPORT_SYMBOL(inet_csk_init_xmit_timers);
@@ -676,9 +674,9 @@ void inet_csk_reqsk_queue_drop_and_put(struct sock *sk, struct request_sock *req
 }
 EXPORT_SYMBOL(inet_csk_reqsk_queue_drop_and_put);
 
-static void reqsk_timer_handler(unsigned long data)
+static void reqsk_timer_handler(struct timer_list *t)
 {
-        struct request_sock *req = (struct request_sock *)data;
+        struct request_sock *req = from_timer(req, t, rsk_timer);
         struct sock *sk_listener = req->rsk_listener;
         struct net *net = sock_net(sk_listener);
         struct inet_connection_sock *icsk = inet_csk(sk_listener);
@@ -749,8 +747,7 @@ static void reqsk_queue_hash_req(struct request_sock *req,
         req->num_timeout = 0;
         req->sk = NULL;
 
-        setup_pinned_timer(&req->rsk_timer, reqsk_timer_handler,
-                            (unsigned long)req);
+        timer_setup(&req->rsk_timer, reqsk_timer_handler, TIMER_PINNED);
         mod_timer(&req->rsk_timer, jiffies + timeout);
 
         inet_ehash_insert(req_to_sk(req), NULL);
diff --git a/net/ipv4/inet_fragment.c b/net/ipv4/inet_fragment.c
index f9597ba26599..26a3d0315728 100644
--- a/net/ipv4/inet_fragment.c
+++ b/net/ipv4/inet_fragment.c
@@ -147,7 +147,7 @@ inet_evict_bucket(struct inet_frags *f, struct inet_frag_bucket *hb)
         spin_unlock(&hb->chain_lock);
 
         hlist_for_each_entry_safe(fq, n, &expired, list_evictor)
-                f->frag_expire((unsigned long) fq);
+                f->frag_expire(&fq->timer);
 
         return evicted;
 }
@@ -366,7 +366,7 @@ static struct inet_frag_queue *inet_frag_alloc(struct netns_frags *nf,
         f->constructor(q, arg);
         add_frag_mem_limit(nf, f->qsize);
 
-        setup_timer(&q->timer, f->frag_expire, (unsigned long)q);
+        timer_setup(&q->timer, f->frag_expire, 0);
         spin_lock_init(&q->lock);
         refcount_set(&q->refcnt, 1);
 
diff --git a/net/ipv4/inet_timewait_sock.c b/net/ipv4/inet_timewait_sock.c
index 5b039159e67a..c690cd0d9b3f 100644
--- a/net/ipv4/inet_timewait_sock.c
+++ b/net/ipv4/inet_timewait_sock.c
@@ -9,7 +9,6 @@
  */
 
 #include <linux/kernel.h>
-#include <linux/kmemcheck.h>
 #include <linux/slab.h>
 #include <linux/module.h>
 #include <net/inet_hashtables.h>
@@ -142,9 +141,9 @@ void __inet_twsk_hashdance(struct inet_timewait_sock *tw, struct sock *sk,
 }
 EXPORT_SYMBOL_GPL(__inet_twsk_hashdance);
 
-static void tw_timer_handler(unsigned long data)
+static void tw_timer_handler(struct timer_list *t)
 {
-        struct inet_timewait_sock *tw = (struct inet_timewait_sock *)data;
+        struct inet_timewait_sock *tw = from_timer(tw, t, tw_timer);
 
         if (tw->tw_kill)
                 __NET_INC_STATS(twsk_net(tw), LINUX_MIB_TIMEWAITKILLED);
@@ -167,8 +166,6 @@ struct inet_timewait_sock *inet_twsk_alloc(const struct sock *sk,
         if (tw) {
                 const struct inet_sock *inet = inet_sk(sk);
 
-                kmemcheck_annotate_bitfield(tw, flags);
-
                 tw->tw_dr           = dr;
                 /* Give us an identity. */
                 tw->tw_daddr        = inet->inet_daddr;
@@ -188,8 +185,7 @@ struct inet_timewait_sock *inet_twsk_alloc(const struct sock *sk,
                 tw->tw_prot         = sk->sk_prot_creator;
                 atomic64_set(&tw->tw_cookie, atomic64_read(&sk->sk_cookie));
                 twsk_net_set(tw, sock_net(sk));
-                setup_pinned_timer(&tw->tw_timer, tw_timer_handler,
-                                   (unsigned long)tw);
+                timer_setup(&tw->tw_timer, tw_timer_handler, TIMER_PINNED);
                 /*
                  * Because we use RCU lookups, we should not set tw_refcnt
                  * to a non null value before everything is setup for this
diff --git a/net/ipv4/inetpeer.c b/net/ipv4/inetpeer.c
index b20c8ac64081..914d56928578 100644
--- a/net/ipv4/inetpeer.c
+++ b/net/ipv4/inetpeer.c
@@ -284,14 +284,17 @@ EXPORT_SYMBOL(inet_peer_xrlim_allow);
 
 void inetpeer_invalidate_tree(struct inet_peer_base *base)
 {
-        struct inet_peer *p, *n;
+        struct rb_node *p = rb_first(&base->rb_root);
 
-        rbtree_postorder_for_each_entry_safe(p, n, &base->rb_root, rb_node) {
-                inet_putpeer(p);
+        while (p) {
+                struct inet_peer *peer = rb_entry(p, struct inet_peer, rb_node);
+
+                p = rb_next(p);
+                rb_erase(&peer->rb_node, &base->rb_root);
+                inet_putpeer(peer);
                 cond_resched();
         }
 
-        base->rb_root = RB_ROOT;
         base->total = 0;
 }
 EXPORT_SYMBOL(inetpeer_invalidate_tree);
diff --git a/net/ipv4/ip_fragment.c b/net/ipv4/ip_fragment.c
index df8fe0503de0..bbf1b94942c0 100644
--- a/net/ipv4/ip_fragment.c
+++ b/net/ipv4/ip_fragment.c
@@ -191,12 +191,13 @@ static bool frag_expire_skip_icmp(u32 user)
 /*
  * Oops, a fragment queue timed out.  Kill it and send an ICMP reply.
  */
-static void ip_expire(unsigned long arg)
+static void ip_expire(struct timer_list *t)
 {
+        struct inet_frag_queue *frag = from_timer(frag, t, timer);
         struct ipq *qp;
         struct net *net;
 
-        qp = container_of((struct inet_frag_queue *) arg, struct ipq, q);
+        qp = container_of(frag, struct ipq, q);
         net = container_of(qp->q.net, struct net, ipv4.frags);
 
         rcu_read_lock();
diff --git a/net/ipv4/ip_gre.c b/net/ipv4/ip_gre.c
index 467e44d7587d..bb6239169b1a 100644
--- a/net/ipv4/ip_gre.c
+++ b/net/ipv4/ip_gre.c
@@ -579,8 +579,8 @@ static void erspan_fb_xmit(struct sk_buff *skb, struct net_device *dev,
         if (gre_handle_offloads(skb, false))
                 goto err_free_rt;
 
-        if (skb->len > dev->mtu) {
-                pskb_trim(skb, dev->mtu);
+        if (skb->len > dev->mtu + dev->hard_header_len) {
+                pskb_trim(skb, dev->mtu + dev->hard_header_len);
                 truncate = true;
         }
 
@@ -731,8 +731,8 @@ static netdev_tx_t erspan_xmit(struct sk_buff *skb,
         if (skb_cow_head(skb, dev->needed_headroom))
                 goto free_skb;
 
-        if (skb->len - dev->hard_header_len > dev->mtu) {
-                pskb_trim(skb, dev->mtu);
+        if (skb->len > dev->mtu + dev->hard_header_len) {
+                pskb_trim(skb, dev->mtu + dev->hard_header_len);
                 truncate = true;
         }
 
@@ -773,20 +773,46 @@ free_skb:
         return NETDEV_TX_OK;
 }
 
+static void ipgre_link_update(struct net_device *dev, bool set_mtu)
+{
+        struct ip_tunnel *tunnel = netdev_priv(dev);
+        int len;
+
+        len = tunnel->tun_hlen;
+        tunnel->tun_hlen = gre_calc_hlen(tunnel->parms.o_flags);
+        len = tunnel->tun_hlen - len;
+        tunnel->hlen = tunnel->hlen + len;
+
+        dev->needed_headroom = dev->needed_headroom + len;
+        if (set_mtu)
+                dev->mtu = max_t(int, dev->mtu - len, 68);
+
+        if (!(tunnel->parms.o_flags & TUNNEL_SEQ)) {
+                if (!(tunnel->parms.o_flags & TUNNEL_CSUM) ||
+                    tunnel->encap.type == TUNNEL_ENCAP_NONE) {
+                        dev->features |= NETIF_F_GSO_SOFTWARE;
+                        dev->hw_features |= NETIF_F_GSO_SOFTWARE;
+                }
+                dev->features |= NETIF_F_LLTX;
+        }
+}
+
 static int ipgre_tunnel_ioctl(struct net_device *dev,
                               struct ifreq *ifr, int cmd)
 {
-        int err;
         struct ip_tunnel_parm p;
+        int err;
 
         if (copy_from_user(&p, ifr->ifr_ifru.ifru_data, sizeof(p)))
                 return -EFAULT;
+
         if (cmd == SIOCADDTUNNEL || cmd == SIOCCHGTUNNEL) {
                 if (p.iph.version != 4 || p.iph.protocol != IPPROTO_GRE ||
-                    p.iph.ihl != 5 || (p.iph.frag_off&htons(~IP_DF)) ||
-                    ((p.i_flags|p.o_flags)&(GRE_VERSION|GRE_ROUTING)))
+                    p.iph.ihl != 5 || (p.iph.frag_off & htons(~IP_DF)) ||
+                    ((p.i_flags | p.o_flags) & (GRE_VERSION | GRE_ROUTING)))
                         return -EINVAL;
         }
+
         p.i_flags = gre_flags_to_tnl_flags(p.i_flags);
         p.o_flags = gre_flags_to_tnl_flags(p.o_flags);
 
@@ -794,11 +820,22 @@ static int ipgre_tunnel_ioctl(struct net_device *dev,
         if (err)
                 return err;
 
+        if (cmd == SIOCCHGTUNNEL) {
+                struct ip_tunnel *t = netdev_priv(dev);
+
+                t->parms.i_flags = p.i_flags;
+                t->parms.o_flags = p.o_flags;
+
+                if (strcmp(dev->rtnl_link_ops->kind, "erspan"))
+                        ipgre_link_update(dev, true);
+        }
+
         p.i_flags = gre_tnl_flags_to_gre_flags(p.i_flags);
         p.o_flags = gre_tnl_flags_to_gre_flags(p.o_flags);
 
         if (copy_to_user(ifr->ifr_ifru.ifru_data, &p, sizeof(p)))
                 return -EFAULT;
+
         return 0;
 }
 
@@ -1011,15 +1048,14 @@ static int __net_init ipgre_init_net(struct net *net)
         return ip_tunnel_init_net(net, ipgre_net_id, &ipgre_link_ops, NULL);
 }
 
-static void __net_exit ipgre_exit_net(struct net *net)
+static void __net_exit ipgre_exit_batch_net(struct list_head *list_net)
 {
-        struct ip_tunnel_net *itn = net_generic(net, ipgre_net_id);
-        ip_tunnel_delete_net(itn, &ipgre_link_ops);
+        ip_tunnel_delete_nets(list_net, ipgre_net_id, &ipgre_link_ops);
 }
 
 static struct pernet_operations ipgre_net_ops = {
         .init = ipgre_init_net,
-        .exit = ipgre_exit_net,
+        .exit_batch = ipgre_exit_batch_net,
         .id   = &ipgre_net_id,
         .size = sizeof(struct ip_tunnel_net),
 };
@@ -1308,9 +1344,9 @@ static int ipgre_changelink(struct net_device *dev, struct nlattr *tb[],
                             struct netlink_ext_ack *extack)
 {
         struct ip_tunnel *t = netdev_priv(dev);
-        struct ip_tunnel_parm p;
         struct ip_tunnel_encap ipencap;
         __u32 fwmark = t->fwmark;
+        struct ip_tunnel_parm p;
         int err;
 
         if (ipgre_netlink_encap_parms(data, &ipencap)) {
@@ -1323,7 +1359,18 @@ static int ipgre_changelink(struct net_device *dev, struct nlattr *tb[],
         err = ipgre_netlink_parms(dev, data, tb, &p, &fwmark);
         if (err < 0)
                 return err;
-        return ip_tunnel_changelink(dev, tb, &p, fwmark);
+
+        err = ip_tunnel_changelink(dev, tb, &p, fwmark);
+        if (err < 0)
+                return err;
+
+        t->parms.i_flags = p.i_flags;
+        t->parms.o_flags = p.o_flags;
+
+        if (strcmp(dev->rtnl_link_ops->kind, "erspan"))
+                ipgre_link_update(dev, !tb[IFLA_MTU]);
+
+        return 0;
 }
 
 static size_t ipgre_get_size(const struct net_device *dev)
@@ -1542,15 +1589,14 @@ static int __net_init ipgre_tap_init_net(struct net *net)
         return ip_tunnel_init_net(net, gre_tap_net_id, &ipgre_tap_ops, "gretap0");
 }
 
-static void __net_exit ipgre_tap_exit_net(struct net *net)
+static void __net_exit ipgre_tap_exit_batch_net(struct list_head *list_net)
 {
-        struct ip_tunnel_net *itn = net_generic(net, gre_tap_net_id);
-        ip_tunnel_delete_net(itn, &ipgre_tap_ops);
+        ip_tunnel_delete_nets(list_net, gre_tap_net_id, &ipgre_tap_ops);
 }
 
 static struct pernet_operations ipgre_tap_net_ops = {
         .init = ipgre_tap_init_net,
-        .exit = ipgre_tap_exit_net,
+        .exit_batch = ipgre_tap_exit_batch_net,
         .id   = &gre_tap_net_id,
         .size = sizeof(struct ip_tunnel_net),
 };
@@ -1561,16 +1607,14 @@ static int __net_init erspan_init_net(struct net *net)
                                   &erspan_link_ops, "erspan0");
 }
 
-static void __net_exit erspan_exit_net(struct net *net)
+static void __net_exit erspan_exit_batch_net(struct list_head *net_list)
 {
-        struct ip_tunnel_net *itn = net_generic(net, erspan_net_id);
-
-        ip_tunnel_delete_net(itn, &erspan_link_ops);
+        ip_tunnel_delete_nets(net_list, erspan_net_id, &erspan_link_ops);
 }
 
 static struct pernet_operations erspan_net_ops = {
         .init = erspan_init_net,
-        .exit = erspan_exit_net,
+        .exit_batch = erspan_exit_batch_net,
         .id   = &erspan_net_id,
         .size = sizeof(struct ip_tunnel_net),
 };
diff --git a/net/ipv4/ip_tunnel.c b/net/ipv4/ip_tunnel.c
index e9805ad664ac..fe6fee728ce4 100644
--- a/net/ipv4/ip_tunnel.c
+++ b/net/ipv4/ip_tunnel.c
@@ -1061,16 +1061,22 @@ static void ip_tunnel_destroy(struct ip_tunnel_net *itn, struct list_head *head,
         }
 }
 
-void ip_tunnel_delete_net(struct ip_tunnel_net *itn, struct rtnl_link_ops *ops)
+void ip_tunnel_delete_nets(struct list_head *net_list, unsigned int id,
+                           struct rtnl_link_ops *ops)
 {
+        struct ip_tunnel_net *itn;
+        struct net *net;
         LIST_HEAD(list);
 
         rtnl_lock();
-        ip_tunnel_destroy(itn, &list, ops);
+        list_for_each_entry(net, net_list, exit_list) {
+                itn = net_generic(net, id);
+                ip_tunnel_destroy(itn, &list, ops);
+        }
         unregister_netdevice_many(&list);
         rtnl_unlock();
 }
-EXPORT_SYMBOL_GPL(ip_tunnel_delete_net);
+EXPORT_SYMBOL_GPL(ip_tunnel_delete_nets);
 
 int ip_tunnel_newlink(struct net_device *dev, struct nlattr *tb[],
                       struct ip_tunnel_parm *p, __u32 fwmark)
diff --git a/net/ipv4/ip_vti.c b/net/ipv4/ip_vti.c
index 89453cf62158..949f432a5f04 100644
--- a/net/ipv4/ip_vti.c
+++ b/net/ipv4/ip_vti.c
@@ -198,15 +198,6 @@ static netdev_tx_t vti_xmit(struct sk_buff *skb, struct net_device *dev,
                 goto tx_error;
         }
 
-        if (tunnel->err_count > 0) {
-                if (time_before(jiffies,
-                                tunnel->err_time + IPTUNNEL_ERR_TIMEO)) {
-                        tunnel->err_count--;
-                        dst_link_failure(skb);
-                } else
-                        tunnel->err_count = 0;
-        }
-
         mtu = dst_mtu(dst);
         if (skb->len > mtu) {
                 skb_dst(skb)->ops->update_pmtu(skb_dst(skb), NULL, skb, mtu);
@@ -453,15 +444,14 @@ static int __net_init vti_init_net(struct net *net)
         return 0;
 }
 
-static void __net_exit vti_exit_net(struct net *net)
+static void __net_exit vti_exit_batch_net(struct list_head *list_net)
 {
-        struct ip_tunnel_net *itn = net_generic(net, vti_net_id);
-        ip_tunnel_delete_net(itn, &vti_link_ops);
+        ip_tunnel_delete_nets(list_net, vti_net_id, &vti_link_ops);
 }
 
 static struct pernet_operations vti_net_ops = {
         .init = vti_init_net,
-        .exit = vti_exit_net,
+        .exit_batch = vti_exit_batch_net,
         .id   = &vti_net_id,
         .size = sizeof(struct ip_tunnel_net),
 };
diff --git a/net/ipv4/ipip.c b/net/ipv4/ipip.c
index cdd627355ed1..c891235b4966 100644
--- a/net/ipv4/ipip.c
+++ b/net/ipv4/ipip.c
@@ -659,15 +659,14 @@ static int __net_init ipip_init_net(struct net *net)
         return ip_tunnel_init_net(net, ipip_net_id, &ipip_link_ops, "tunl0");
 }
 
-static void __net_exit ipip_exit_net(struct net *net)
+static void __net_exit ipip_exit_batch_net(struct list_head *list_net)
 {
-        struct ip_tunnel_net *itn = net_generic(net, ipip_net_id);
-        ip_tunnel_delete_net(itn, &ipip_link_ops);
+        ip_tunnel_delete_nets(list_net, ipip_net_id, &ipip_link_ops);
 }
 
 static struct pernet_operations ipip_net_ops = {
         .init = ipip_init_net,
-        .exit = ipip_exit_net,
+        .exit_batch = ipip_exit_batch_net,
         .id   = &ipip_net_id,
         .size = sizeof(struct ip_tunnel_net),
 };
diff --git a/net/ipv4/ipmr.c b/net/ipv4/ipmr.c
index c9b3e6e069ae..fd5f19c988e4 100644
--- a/net/ipv4/ipmr.c
+++ b/net/ipv4/ipmr.c
@@ -67,6 +67,7 @@
 #include <net/fib_rules.h>
 #include <linux/netconf.h>
 #include <net/nexthop.h>
+#include <net/switchdev.h>
 
 struct ipmr_rule {
         struct fib_rule         common;
@@ -111,7 +112,7 @@ static void mroute_netlink_event(struct mr_table *mrt, struct mfc_cache *mfc,
                                  int cmd);
 static void igmpmsg_netlink_event(struct mr_table *mrt, struct sk_buff *pkt);
 static void mroute_clean_tables(struct mr_table *mrt, bool all);
-static void ipmr_expire_process(unsigned long arg);
+static void ipmr_expire_process(struct timer_list *t);
 
 #ifdef CONFIG_IP_MROUTE_MULTIPLE_TABLES
 #define ipmr_for_each_table(mrt, net) \
@@ -264,6 +265,22 @@ static void __net_exit ipmr_rules_exit(struct net *net)
         fib_rules_unregister(net->ipv4.mr_rules_ops);
         rtnl_unlock();
 }
+
+static int ipmr_rules_dump(struct net *net, struct notifier_block *nb)
+{
+        return fib_rules_dump(net, nb, RTNL_FAMILY_IPMR);
+}
+
+static unsigned int ipmr_rules_seq_read(struct net *net)
+{
+        return fib_rules_seq_read(net, RTNL_FAMILY_IPMR);
+}
+
+bool ipmr_rule_default(const struct fib_rule *rule)
+{
+        return fib_rule_matchall(rule) && rule->table == RT_TABLE_DEFAULT;
+}
+EXPORT_SYMBOL(ipmr_rule_default);
 #else
 #define ipmr_for_each_table(mrt, net) \
         for (mrt = net->ipv4.mrt; mrt; mrt = NULL)
@@ -298,6 +315,22 @@ static void __net_exit ipmr_rules_exit(struct net *net)
         net->ipv4.mrt = NULL;
         rtnl_unlock();
 }
+
+static int ipmr_rules_dump(struct net *net, struct notifier_block *nb)
+{
+        return 0;
+}
+
+static unsigned int ipmr_rules_seq_read(struct net *net)
+{
+        return 0;
+}
+
+bool ipmr_rule_default(const struct fib_rule *rule)
+{
+        return true;
+}
+EXPORT_SYMBOL(ipmr_rule_default);
 #endif
 
 static inline int ipmr_hash_cmp(struct rhashtable_compare_arg *arg,
@@ -342,8 +375,7 @@ static struct mr_table *ipmr_new_table(struct net *net, u32 id)
         INIT_LIST_HEAD(&mrt->mfc_cache_list);
         INIT_LIST_HEAD(&mrt->mfc_unres_queue);
 
-        setup_timer(&mrt->ipmr_expire_timer, ipmr_expire_process,
-                    (unsigned long)mrt);
+        timer_setup(&mrt->ipmr_expire_timer, ipmr_expire_process, 0);
 
         mrt->mroute_reg_vif_num = -1;
 #ifdef CONFIG_IP_MROUTE_MULTIPLE_TABLES
@@ -587,6 +619,82 @@ static struct net_device *ipmr_reg_vif(struct net *net, struct mr_table *mrt)
 }
 #endif
 
+static int call_ipmr_vif_entry_notifier(struct notifier_block *nb,
+                                        struct net *net,
+                                        enum fib_event_type event_type,
+                                        struct vif_device *vif,
+                                        vifi_t vif_index, u32 tb_id)
+{
+        struct vif_entry_notifier_info info = {
+                .info = {
+                        .family = RTNL_FAMILY_IPMR,
+                        .net = net,
+                },
+                .dev = vif->dev,
+                .vif_index = vif_index,
+                .vif_flags = vif->flags,
+                .tb_id = tb_id,
+        };
+
+        return call_fib_notifier(nb, net, event_type, &info.info);
+}
+
+static int call_ipmr_vif_entry_notifiers(struct net *net,
+                                         enum fib_event_type event_type,
+                                         struct vif_device *vif,
+                                         vifi_t vif_index, u32 tb_id)
+{
+        struct vif_entry_notifier_info info = {
+                .info = {
+                        .family = RTNL_FAMILY_IPMR,
+                        .net = net,
+                },
+                .dev = vif->dev,
+                .vif_index = vif_index,
+                .vif_flags = vif->flags,
+                .tb_id = tb_id,
+        };
+
+        ASSERT_RTNL();
+        net->ipv4.ipmr_seq++;
+        return call_fib_notifiers(net, event_type, &info.info);
+}
+
+static int call_ipmr_mfc_entry_notifier(struct notifier_block *nb,
+                                        struct net *net,
+                                        enum fib_event_type event_type,
+                                        struct mfc_cache *mfc, u32 tb_id)
+{
+        struct mfc_entry_notifier_info info = {
+                .info = {
+                        .family = RTNL_FAMILY_IPMR,
+                        .net = net,
+                },
+                .mfc = mfc,
+                .tb_id = tb_id
+        };
+
+        return call_fib_notifier(nb, net, event_type, &info.info);
+}
+
+static int call_ipmr_mfc_entry_notifiers(struct net *net,
+                                         enum fib_event_type event_type,
+                                         struct mfc_cache *mfc, u32 tb_id)
+{
+        struct mfc_entry_notifier_info info = {
+                .info = {
+                        .family = RTNL_FAMILY_IPMR,
+                        .net = net,
+                },
+                .mfc = mfc,
+                .tb_id = tb_id
+        };
+
+        ASSERT_RTNL();
+        net->ipv4.ipmr_seq++;
+        return call_fib_notifiers(net, event_type, &info.info);
+}
+
 /**
  *      vif_delete - Delete a VIF entry
  *      @notify: Set to 1, if the caller is a notifier_call
@@ -594,6 +702,7 @@ static struct net_device *ipmr_reg_vif(struct net *net, struct mr_table *mrt)
 static int vif_delete(struct mr_table *mrt, int vifi, int notify,
                       struct list_head *head)
 {
+        struct net *net = read_pnet(&mrt->net);
         struct vif_device *v;
         struct net_device *dev;
         struct in_device *in_dev;
@@ -603,6 +712,10 @@ static int vif_delete(struct mr_table *mrt, int vifi, int notify,
 
         v = &mrt->vif_table[vifi];
 
+        if (VIF_EXISTS(mrt, vifi))
+                call_ipmr_vif_entry_notifiers(net, FIB_EVENT_VIF_DEL, v, vifi,
+                                              mrt->id);
+
         write_lock_bh(&mrt_lock);
         dev = v->dev;
         v->dev = NULL;
@@ -652,10 +765,11 @@ static void ipmr_cache_free_rcu(struct rcu_head *head)
         kmem_cache_free(mrt_cachep, c);
 }
 
-static inline void ipmr_cache_free(struct mfc_cache *c)
+void ipmr_cache_free(struct mfc_cache *c)
 {
         call_rcu(&c->rcu, ipmr_cache_free_rcu);
 }
+EXPORT_SYMBOL(ipmr_cache_free);
 
 /* Destroy an unresolved cache entry, killing queued skbs
  * and reporting error to netlink readers.
@@ -689,9 +803,9 @@ static void ipmr_destroy_unres(struct mr_table *mrt, struct mfc_cache *c)
 }
 
 /* Timer process for the unresolved queue. */
-static void ipmr_expire_process(unsigned long arg)
+static void ipmr_expire_process(struct timer_list *t)
 {
-        struct mr_table *mrt = (struct mr_table *)arg;
+        struct mr_table *mrt = from_timer(mrt, t, ipmr_expire_timer);
         unsigned long now;
         unsigned long expires;
         struct mfc_cache *c, *next;
@@ -754,6 +868,9 @@ static int vif_add(struct net *net, struct mr_table *mrt,
                    struct vifctl *vifc, int mrtsock)
 {
         int vifi = vifc->vifc_vifi;
+        struct switchdev_attr attr = {
+                .id = SWITCHDEV_ATTR_ID_PORT_PARENT_ID,
+        };
         struct vif_device *v = &mrt->vif_table[vifi];
         struct net_device *dev;
         struct in_device *in_dev;
@@ -828,6 +945,13 @@ static int vif_add(struct net *net, struct mr_table *mrt,
 
         /* Fill in the VIF structures */
 
+        attr.orig_dev = dev;
+        if (!switchdev_port_attr_get(dev, &attr)) {
+                memcpy(v->dev_parent_id.id, attr.u.ppid.id, attr.u.ppid.id_len);
+                v->dev_parent_id.id_len = attr.u.ppid.id_len;
+        } else {
+                v->dev_parent_id.id_len = 0;
+        }
         v->rate_limit = vifc->vifc_rate_limit;
         v->local = vifc->vifc_lcl_addr.s_addr;
         v->remote = vifc->vifc_rmt_addr.s_addr;
@@ -851,6 +975,7 @@ static int vif_add(struct net *net, struct mr_table *mrt,
         if (vifi+1 > mrt->maxvif)
                 mrt->maxvif = vifi+1;
         write_unlock_bh(&mrt_lock);
+        call_ipmr_vif_entry_notifiers(net, FIB_EVENT_VIF_ADD, v, vifi, mrt->id);
         return 0;
 }
 
@@ -949,6 +1074,7 @@ static struct mfc_cache *ipmr_cache_alloc(void)
         if (c) {
                 c->mfc_un.res.last_assert = jiffies - MFC_ASSERT_THRESH - 1;
                 c->mfc_un.res.minvif = MAXVIFS;
+                refcount_set(&c->mfc_un.res.refcount, 1);
         }
         return c;
 }
@@ -1150,6 +1276,7 @@ static int ipmr_cache_unresolved(struct mr_table *mrt, vifi_t vifi,
 
 static int ipmr_mfc_delete(struct mr_table *mrt, struct mfcctl *mfc, int parent)
 {
+        struct net *net = read_pnet(&mrt->net);
         struct mfc_cache *c;
 
         /* The entries are added/deleted only under RTNL */
@@ -1161,8 +1288,9 @@ static int ipmr_mfc_delete(struct mr_table *mrt, struct mfcctl *mfc, int parent)
                 return -ENOENT;
         rhltable_remove(&mrt->mfc_hash, &c->mnode, ipmr_rht_params);
         list_del_rcu(&c->list);
+        call_ipmr_mfc_entry_notifiers(net, FIB_EVENT_ENTRY_DEL, c, mrt->id);
         mroute_netlink_event(mrt, c, RTM_DELROUTE);
-        ipmr_cache_free(c);
+        ipmr_cache_put(c);
 
         return 0;
 }
@@ -1189,6 +1317,8 @@ static int ipmr_mfc_add(struct net *net, struct mr_table *mrt,
                 if (!mrtsock)
                         c->mfc_flags |= MFC_STATIC;
                 write_unlock_bh(&mrt_lock);
+                call_ipmr_mfc_entry_notifiers(net, FIB_EVENT_ENTRY_REPLACE, c,
+                                              mrt->id);
                 mroute_netlink_event(mrt, c, RTM_NEWROUTE);
                 return 0;
         }
@@ -1238,6 +1368,7 @@ static int ipmr_mfc_add(struct net *net, struct mr_table *mrt,
                 ipmr_cache_resolve(net, mrt, uc, c);
                 ipmr_cache_free(uc);
         }
+        call_ipmr_mfc_entry_notifiers(net, FIB_EVENT_ENTRY_ADD, c, mrt->id);
         mroute_netlink_event(mrt, c, RTM_NEWROUTE);
         return 0;
 }
@@ -1245,6 +1376,7 @@ static int ipmr_mfc_add(struct net *net, struct mr_table *mrt,
 /* Close the multicast socket, and clear the vif tables etc */
 static void mroute_clean_tables(struct mr_table *mrt, bool all)
 {
+        struct net *net = read_pnet(&mrt->net);
         struct mfc_cache *c, *tmp;
         LIST_HEAD(list);
         int i;
@@ -1263,8 +1395,10 @@ static void mroute_clean_tables(struct mr_table *mrt, bool all)
                         continue;
                 rhltable_remove(&mrt->mfc_hash, &c->mnode, ipmr_rht_params);
                 list_del_rcu(&c->list);
+                call_ipmr_mfc_entry_notifiers(net, FIB_EVENT_ENTRY_DEL, c,
+                                              mrt->id);
                 mroute_netlink_event(mrt, c, RTM_DELROUTE);
-                ipmr_cache_free(c);
+                ipmr_cache_put(c);
         }
 
         if (atomic_read(&mrt->cache_resolve_queue_len) != 0) {
@@ -1393,6 +1527,7 @@ int ip_mroute_setsockopt(struct sock *sk, int optname, char __user *optval,
         case MRT_ADD_MFC:
         case MRT_DEL_MFC:
                 parent = -1;
+                /* fall through */
         case MRT_ADD_MFC_PROXY:
         case MRT_DEL_MFC_PROXY:
                 if (optlen != sizeof(mfc)) {
@@ -1724,10 +1859,33 @@ static inline int ipmr_forward_finish(struct net *net, struct sock *sk,
         return dst_output(net, sk, skb);
 }
 
+#ifdef CONFIG_NET_SWITCHDEV
+static bool ipmr_forward_offloaded(struct sk_buff *skb, struct mr_table *mrt,
+                                   int in_vifi, int out_vifi)
+{
+        struct vif_device *out_vif = &mrt->vif_table[out_vifi];
+        struct vif_device *in_vif = &mrt->vif_table[in_vifi];
+
+        if (!skb->offload_mr_fwd_mark)
+                return false;
+        if (!out_vif->dev_parent_id.id_len || !in_vif->dev_parent_id.id_len)
+                return false;
+        return netdev_phys_item_id_same(&out_vif->dev_parent_id,
+                                        &in_vif->dev_parent_id);
+}
+#else
+static bool ipmr_forward_offloaded(struct sk_buff *skb, struct mr_table *mrt,
+                                   int in_vifi, int out_vifi)
+{
+        return false;
+}
+#endif
+
 /* Processing handlers for ipmr_forward */
 
 static void ipmr_queue_xmit(struct net *net, struct mr_table *mrt,
-                            struct sk_buff *skb, struct mfc_cache *c, int vifi)
+                            int in_vifi, struct sk_buff *skb,
+                            struct mfc_cache *c, int vifi)
 {
         const struct iphdr *iph = ip_hdr(skb);
         struct vif_device *vif = &mrt->vif_table[vifi];
@@ -1748,6 +1906,9 @@ static void ipmr_queue_xmit(struct net *net, struct mr_table *mrt,
                 goto out_free;
         }
 
+        if (ipmr_forward_offloaded(skb, mrt, in_vifi, vifi))
+                goto out_free;
+
         if (vif->flags & VIFF_TUNNEL) {
                 rt = ip_route_output_ports(net, &fl4, NULL,
                                            vif->remote, vif->local,
@@ -1925,8 +2086,8 @@ forward:
                                 struct sk_buff *skb2 = skb_clone(skb, GFP_ATOMIC);
 
                                 if (skb2)
-                                        ipmr_queue_xmit(net, mrt, skb2, cache,
-                                                        psend);
+                                        ipmr_queue_xmit(net, mrt, true_vifi,
+                                                        skb2, cache, psend);
                         }
                         psend = ct;
                 }
@@ -1937,9 +2098,10 @@ last_forward:
                         struct sk_buff *skb2 = skb_clone(skb, GFP_ATOMIC);
 
                         if (skb2)
-                                ipmr_queue_xmit(net, mrt, skb2, cache, psend);
+                                ipmr_queue_xmit(net, mrt, true_vifi, skb2,
+                                                cache, psend);
                 } else {
-                        ipmr_queue_xmit(net, mrt, skb, cache, psend);
+                        ipmr_queue_xmit(net, mrt, true_vifi, skb, cache, psend);
                         return;
                 }
         }
@@ -2156,6 +2318,9 @@ static int __ipmr_fill_mroute(struct mr_table *mrt, struct sk_buff *skb,
             nla_put_u32(skb, RTA_IIF, mrt->vif_table[c->mfc_parent].dev->ifindex) < 0)
                 return -EMSGSIZE;
 
+        if (c->mfc_flags & MFC_OFFLOAD)
+                rtm->rtm_flags |= RTNH_F_OFFLOAD;
+
         if (!(mp_attr = nla_nest_start(skb, RTA_MULTIPATH)))
                 return -EMSGSIZE;
 
@@ -3048,14 +3213,87 @@ static const struct net_protocol pim_protocol = {
 };
 #endif
 
+static unsigned int ipmr_seq_read(struct net *net)
+{
+        ASSERT_RTNL();
+
+        return net->ipv4.ipmr_seq + ipmr_rules_seq_read(net);
+}
+
+static int ipmr_dump(struct net *net, struct notifier_block *nb)
+{
+        struct mr_table *mrt;
+        int err;
+
+        err = ipmr_rules_dump(net, nb);
+        if (err)
+                return err;
+
+        ipmr_for_each_table(mrt, net) {
+                struct vif_device *v = &mrt->vif_table[0];
+                struct mfc_cache *mfc;
+                int vifi;
+
+                /* Notifiy on table VIF entries */
+                read_lock(&mrt_lock);
+                for (vifi = 0; vifi < mrt->maxvif; vifi++, v++) {
+                        if (!v->dev)
+                                continue;
+
+                        call_ipmr_vif_entry_notifier(nb, net, FIB_EVENT_VIF_ADD,
+                                                     v, vifi, mrt->id);
+                }
+                read_unlock(&mrt_lock);
+
+                /* Notify on table MFC entries */
+                list_for_each_entry_rcu(mfc, &mrt->mfc_cache_list, list)
+                        call_ipmr_mfc_entry_notifier(nb, net,
+                                                     FIB_EVENT_ENTRY_ADD, mfc,
+                                                     mrt->id);
+        }
+
+        return 0;
+}
+
+static const struct fib_notifier_ops ipmr_notifier_ops_template = {
+        .family         = RTNL_FAMILY_IPMR,
+        .fib_seq_read   = ipmr_seq_read,
+        .fib_dump       = ipmr_dump,
+        .owner          = THIS_MODULE,
+};
+
+static int __net_init ipmr_notifier_init(struct net *net)
+{
+        struct fib_notifier_ops *ops;
+
+        net->ipv4.ipmr_seq = 0;
+
+        ops = fib_notifier_ops_register(&ipmr_notifier_ops_template, net);
+        if (IS_ERR(ops))
+                return PTR_ERR(ops);
+        net->ipv4.ipmr_notifier_ops = ops;
+
+        return 0;
+}
+
+static void __net_exit ipmr_notifier_exit(struct net *net)
+{
+        fib_notifier_ops_unregister(net->ipv4.ipmr_notifier_ops);
+        net->ipv4.ipmr_notifier_ops = NULL;
+}
+
 /* Setup for IP multicast routing */
 static int __net_init ipmr_net_init(struct net *net)
 {
         int err;
 
+        err = ipmr_notifier_init(net);
+        if (err)
+                goto ipmr_notifier_fail;
+
         err = ipmr_rules_init(net);
         if (err < 0)
-                goto fail;
+                goto ipmr_rules_fail;
 
 #ifdef CONFIG_PROC_FS
         err = -ENOMEM;
@@ -3072,7 +3310,9 @@ proc_cache_fail:
 proc_vif_fail:
         ipmr_rules_exit(net);
 #endif
-fail:
+ipmr_rules_fail:
+        ipmr_notifier_exit(net);
+ipmr_notifier_fail:
         return err;
 }
 
@@ -3082,6 +3322,7 @@ static void __net_exit ipmr_net_exit(struct net *net)
         remove_proc_entry("ip_mr_cache", net->proc_net);
         remove_proc_entry("ip_mr_vif", net->proc_net);
 #endif
+        ipmr_notifier_exit(net);
         ipmr_rules_exit(net);
 }
 
diff --git a/net/ipv4/netfilter/arp_tables.c b/net/ipv4/netfilter/arp_tables.c
index 9e2770fd00be..f88221aebc9d 100644
--- a/net/ipv4/netfilter/arp_tables.c
+++ b/net/ipv4/netfilter/arp_tables.c
@@ -634,6 +634,25 @@ static void get_counters(const struct xt_table_info *t,
         }
 }
 
+static void get_old_counters(const struct xt_table_info *t,
+                             struct xt_counters counters[])
+{
+        struct arpt_entry *iter;
+        unsigned int cpu, i;
+
+        for_each_possible_cpu(cpu) {
+                i = 0;
+                xt_entry_foreach(iter, t->entries, t->size) {
+                        struct xt_counters *tmp;
+
+                        tmp = xt_get_per_cpu_counter(&iter->counters, cpu);
+                        ADD_COUNTER(counters[i], tmp->bcnt, tmp->pcnt);
+                        ++i;
+                }
+                cond_resched();
+        }
+}
+
 static struct xt_counters *alloc_counters(const struct xt_table *table)
 {
         unsigned int countersize;
@@ -910,8 +929,7 @@ static int __do_replace(struct net *net, const char *name,
             (newinfo->number <= oldinfo->initial_entries))
                 module_put(t->me);
 
-        /* Get the old counters, and synchronize with replace */
-        get_counters(oldinfo, counters);
+        get_old_counters(oldinfo, counters);
 
         /* Decrease module usage counts and free resource */
         loc_cpu_old_entry = oldinfo->entries;
diff --git a/net/ipv4/netfilter/ip_tables.c b/net/ipv4/netfilter/ip_tables.c
index 39286e543ee6..4cbe5e80f3bf 100644
--- a/net/ipv4/netfilter/ip_tables.c
+++ b/net/ipv4/netfilter/ip_tables.c
@@ -781,6 +781,26 @@ get_counters(const struct xt_table_info *t,
         }
 }
 
+static void get_old_counters(const struct xt_table_info *t,
+                             struct xt_counters counters[])
+{
+        struct ipt_entry *iter;
+        unsigned int cpu, i;
+
+        for_each_possible_cpu(cpu) {
+                i = 0;
+                xt_entry_foreach(iter, t->entries, t->size) {
+                        const struct xt_counters *tmp;
+
+                        tmp = xt_get_per_cpu_counter(&iter->counters, cpu);
+                        ADD_COUNTER(counters[i], tmp->bcnt, tmp->pcnt);
+                        ++i; /* macro does multi eval of i */
+                }
+
+                cond_resched();
+        }
+}
+
 static struct xt_counters *alloc_counters(const struct xt_table *table)
 {
         unsigned int countersize;
@@ -1070,8 +1090,7 @@ __do_replace(struct net *net, const char *name, unsigned int valid_hooks,
             (newinfo->number <= oldinfo->initial_entries))
                 module_put(t->me);
 
-        /* Get the old counters, and synchronize with replace */
-        get_counters(oldinfo, counters);
+        get_old_counters(oldinfo, counters);
 
         /* Decrease module usage counts and free resource */
         xt_entry_foreach(iter, oldinfo->entries, oldinfo->size)
diff --git a/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c b/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c
index fe374da4bc13..89af9d88ca21 100644
--- a/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c
+++ b/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c
@@ -344,7 +344,7 @@ static void ipv4_hooks_unregister(struct net *net)
         mutex_unlock(&register_ipv4_hooks);
 }
 
-struct nf_conntrack_l3proto nf_conntrack_l3proto_ipv4 __read_mostly = {
+const struct nf_conntrack_l3proto nf_conntrack_l3proto_ipv4 = {
         .l3proto         = PF_INET,
         .pkt_to_tuple    = ipv4_pkt_to_tuple,
         .invert_tuple    = ipv4_invert_tuple,
diff --git a/net/ipv4/netfilter/nf_conntrack_proto_icmp.c b/net/ipv4/netfilter/nf_conntrack_proto_icmp.c
index a046c298413a..1849fedd9b81 100644
--- a/net/ipv4/netfilter/nf_conntrack_proto_icmp.c
+++ b/net/ipv4/netfilter/nf_conntrack_proto_icmp.c
@@ -81,7 +81,6 @@ static int icmp_packet(struct nf_conn *ct,
                        const struct sk_buff *skb,
                        unsigned int dataoff,
                        enum ip_conntrack_info ctinfo,
-                       u_int8_t pf,
                        unsigned int *timeout)
 {
         /* Do not immediately delete the connection after the first
@@ -165,6 +164,12 @@ icmp_error_message(struct net *net, struct nf_conn *tmpl, struct sk_buff *skb,
         return NF_ACCEPT;
 }
 
+static void icmp_error_log(const struct sk_buff *skb, struct net *net,
+                           u8 pf, const char *msg)
+{
+        nf_l4proto_log_invalid(skb, net, pf, IPPROTO_ICMP, "%s", msg);
+}
+
 /* Small and modified version of icmp_rcv */
 static int
 icmp_error(struct net *net, struct nf_conn *tmpl,
@@ -177,18 +182,14 @@ icmp_error(struct net *net, struct nf_conn *tmpl,
         /* Not enough header? */
         icmph = skb_header_pointer(skb, ip_hdrlen(skb), sizeof(_ih), &_ih);
         if (icmph == NULL) {
-                if (LOG_INVALID(net, IPPROTO_ICMP))
-                        nf_log_packet(net, PF_INET, 0, skb, NULL, NULL,
-                                      NULL, "nf_ct_icmp: short packet ");
+                icmp_error_log(skb, net, pf, "short packet");
                 return -NF_ACCEPT;
         }
 
         /* See ip_conntrack_proto_tcp.c */
         if (net->ct.sysctl_checksum && hooknum == NF_INET_PRE_ROUTING &&
             nf_ip_checksum(skb, hooknum, dataoff, 0)) {
-                if (LOG_INVALID(net, IPPROTO_ICMP))
-                        nf_log_packet(net, PF_INET, 0, skb, NULL, NULL, NULL,
-                                      "nf_ct_icmp: bad HW ICMP checksum ");
+                icmp_error_log(skb, net, pf, "bad hw icmp checksum");
                 return -NF_ACCEPT;
         }
 
@@ -199,9 +200,7 @@ icmp_error(struct net *net, struct nf_conn *tmpl,
          *                discarded.
          */
         if (icmph->type > NR_ICMP_TYPES) {
-                if (LOG_INVALID(net, IPPROTO_ICMP))
-                        nf_log_packet(net, PF_INET, 0, skb, NULL, NULL, NULL,
-                                      "nf_ct_icmp: invalid ICMP type ");
+                icmp_error_log(skb, net, pf, "invalid icmp type");
                 return -NF_ACCEPT;
         }
 
@@ -259,9 +258,14 @@ static int icmp_nlattr_to_tuple(struct nlattr *tb[],
         return 0;
 }
 
-static int icmp_nlattr_tuple_size(void)
+static unsigned int icmp_nlattr_tuple_size(void)
 {
-        return nla_policy_len(icmp_nla_policy, CTA_PROTO_MAX + 1);
+        static unsigned int size __read_mostly;
+
+        if (!size)
+                size = nla_policy_len(icmp_nla_policy, CTA_PROTO_MAX + 1);
+
+        return size;
 }
 #endif
 
diff --git a/net/ipv4/netfilter/nf_nat_l3proto_ipv4.c b/net/ipv4/netfilter/nf_nat_l3proto_ipv4.c
index a0f37b208268..0443ca4120b0 100644
--- a/net/ipv4/netfilter/nf_nat_l3proto_ipv4.c
+++ b/net/ipv4/netfilter/nf_nat_l3proto_ipv4.c
@@ -276,7 +276,8 @@ nf_nat_ipv4_fn(void *priv, struct sk_buff *skb,
                         else
                                 return NF_ACCEPT;
                 }
-                /* Fall thru... (Only ICMPs can be IP_CT_IS_REPLY) */
+                /* Only ICMPs can be IP_CT_IS_REPLY: */
+                /* fall through */
         case IP_CT_NEW:
                 /* Seen it before?  This can happen for loopback, retrans,
                  * or local packets.
diff --git a/net/ipv4/proc.c b/net/ipv4/proc.c
index 127153f1ed8a..9f37c4727861 100644
--- a/net/ipv4/proc.c
+++ b/net/ipv4/proc.c
@@ -212,7 +212,6 @@ static const struct snmp_mib snmp4_net_list[] = {
         SNMP_MIB_ITEM("TCPRenoRecovery", LINUX_MIB_TCPRENORECOVERY),
         SNMP_MIB_ITEM("TCPSackRecovery", LINUX_MIB_TCPSACKRECOVERY),
         SNMP_MIB_ITEM("TCPSACKReneging", LINUX_MIB_TCPSACKRENEGING),
-        SNMP_MIB_ITEM("TCPFACKReorder", LINUX_MIB_TCPFACKREORDER),
         SNMP_MIB_ITEM("TCPSACKReorder", LINUX_MIB_TCPSACKREORDER),
         SNMP_MIB_ITEM("TCPRenoReorder", LINUX_MIB_TCPRENOREORDER),
         SNMP_MIB_ITEM("TCPTSReorder", LINUX_MIB_TCPTSREORDER),
diff --git a/net/ipv4/route.c b/net/ipv4/route.c
index c0864562083b..43b69af242e1 100644
--- a/net/ipv4/route.c
+++ b/net/ipv4/route.c
@@ -651,9 +651,12 @@ static void update_or_create_fnhe(struct fib_nh *nh, __be32 daddr, __be32 gw,
         struct fnhe_hash_bucket *hash;
         struct fib_nh_exception *fnhe;
         struct rtable *rt;
+        u32 genid, hval;
         unsigned int i;
         int depth;
-        u32 hval = fnhe_hashfun(daddr);
+
+        genid = fnhe_genid(dev_net(nh->nh_dev));
+        hval = fnhe_hashfun(daddr);
 
         spin_lock_bh(&fnhe_lock);
 
@@ -676,12 +679,13 @@ static void update_or_create_fnhe(struct fib_nh *nh, __be32 daddr, __be32 gw,
         }
 
         if (fnhe) {
+                if (fnhe->fnhe_genid != genid)
+                        fnhe->fnhe_genid = genid;
                 if (gw)
                         fnhe->fnhe_gw = gw;
-                if (pmtu) {
+                if (pmtu)
                         fnhe->fnhe_pmtu = pmtu;
-                        fnhe->fnhe_expires = max(1UL, expires);
-                }
+                fnhe->fnhe_expires = max(1UL, expires);
                 /* Update all cached dsts too */
                 rt = rcu_dereference(fnhe->fnhe_rth_input);
                 if (rt)
@@ -700,7 +704,7 @@ static void update_or_create_fnhe(struct fib_nh *nh, __be32 daddr, __be32 gw,
                         fnhe->fnhe_next = hash->chain;
                         rcu_assign_pointer(hash->chain, fnhe);
                 }
-                fnhe->fnhe_genid = fnhe_genid(dev_net(nh->nh_dev));
+                fnhe->fnhe_genid = genid;
                 fnhe->fnhe_daddr = daddr;
                 fnhe->fnhe_gw = gw;
                 fnhe->fnhe_pmtu = pmtu;
@@ -1250,7 +1254,7 @@ static void set_class_tag(struct rtable *rt, u32 tag)
 static unsigned int ipv4_default_advmss(const struct dst_entry *dst)
 {
         unsigned int header_size = sizeof(struct tcphdr) + sizeof(struct iphdr);
-        unsigned int advmss = max_t(unsigned int, dst->dev->mtu - header_size,
+        unsigned int advmss = max_t(unsigned int, ipv4_mtu(dst) - header_size,
                                     ip_rt_min_advmss);
 
         return min(advmss, IPV4_MAX_PMTU - header_size);
@@ -3038,7 +3042,6 @@ struct ip_rt_acct __percpu *ip_rt_acct __read_mostly;
 
 int __init ip_rt_init(void)
 {
-        int rc = 0;
         int cpu;
 
         ip_idents = kmalloc(IP_IDENTS_SZ * sizeof(*ip_idents), GFP_KERNEL);
@@ -3095,7 +3098,7 @@ int __init ip_rt_init(void)
 #endif
         register_pernet_subsys(&rt_genid_ops);
         register_pernet_subsys(&ipv4_inetpeer_ops);
-        return rc;
+        return 0;
 }
 
 #ifdef CONFIG_SYSCTL
diff --git a/net/ipv4/syncookies.c b/net/ipv4/syncookies.c
index 77cf32a80952..fda37f2862c9 100644
--- a/net/ipv4/syncookies.c
+++ b/net/ipv4/syncookies.c
@@ -385,7 +385,7 @@ struct sock *cookie_v4_check(struct sock *sk, struct sk_buff *skb)
         /* Try to redo what tcp_v4_send_synack did. */
         req->rsk_window_clamp = tp->window_clamp ? :dst_metric(&rt->dst, RTAX_WINDOW);
 
-        tcp_select_initial_window(tcp_full_space(sk), req->mss,
+        tcp_select_initial_window(sk, tcp_full_space(sk), req->mss,
                                   &req->rsk_rcv_wnd, &req->rsk_window_clamp,
                                   ireq->wscale_ok, &rcv_wscale,
                                   dst_metric(&rt->dst, RTAX_INITRWND));
diff --git a/net/ipv4/sysctl_net_ipv4.c b/net/ipv4/sysctl_net_ipv4.c
index 0989e739d098..93e172118a94 100644
--- a/net/ipv4/sysctl_net_ipv4.c
+++ b/net/ipv4/sysctl_net_ipv4.c
@@ -26,6 +26,7 @@
 #include <net/inet_frag.h>
 #include <net/ping.h>
 #include <net/protocol.h>
+#include <net/netevent.h>
 
 static int zero;
 static int one = 1;
@@ -200,6 +201,8 @@ static int ipv4_ping_group_range(struct ctl_table *table, int write,
 static int proc_tcp_congestion_control(struct ctl_table *ctl, int write,
                                        void __user *buffer, size_t *lenp, loff_t *ppos)
 {
+        struct net *net = container_of(ctl->data, struct net,
+                                       ipv4.tcp_congestion_control);
         char val[TCP_CA_NAME_MAX];
         struct ctl_table tbl = {
                 .data = val,
@@ -207,11 +210,11 @@ static int proc_tcp_congestion_control(struct ctl_table *ctl, int write,
         };
         int ret;
 
-        tcp_get_default_congestion_control(val);
+        tcp_get_default_congestion_control(net, val);
 
         ret = proc_dostring(&tbl, write, buffer, lenp, ppos);
         if (write && ret == 0)
-                ret = tcp_set_default_congestion_control(val);
+                ret = tcp_set_default_congestion_control(net, val);
         return ret;
 }
 
@@ -252,10 +255,12 @@ static int proc_allowed_congestion_control(struct ctl_table *ctl,
         return ret;
 }
 
-static int proc_tcp_fastopen_key(struct ctl_table *ctl, int write,
+static int proc_tcp_fastopen_key(struct ctl_table *table, int write,
                                  void __user *buffer, size_t *lenp,
                                  loff_t *ppos)
 {
+        struct net *net = container_of(table->data, struct net,
+            ipv4.sysctl_tcp_fastopen);
         struct ctl_table tbl = { .maxlen = (TCP_FASTOPEN_KEY_LENGTH * 2 + 10) };
         struct tcp_fastopen_context *ctxt;
         int ret;
@@ -266,7 +271,7 @@ static int proc_tcp_fastopen_key(struct ctl_table *ctl, int write,
                 return -ENOMEM;
 
         rcu_read_lock();
-        ctxt = rcu_dereference(tcp_fastopen_ctx);
+        ctxt = rcu_dereference(net->ipv4.tcp_fastopen_ctx);
         if (ctxt)
                 memcpy(user_key, ctxt->key, TCP_FASTOPEN_KEY_LENGTH);
         else
@@ -283,12 +288,8 @@ static int proc_tcp_fastopen_key(struct ctl_table *ctl, int write,
                         ret = -EINVAL;
                         goto bad_key;
                 }
-                /* Generate a dummy secret but don't publish it. This
-                 * is needed so we don't regenerate a new key on the
-                 * first invocation of tcp_fastopen_cookie_gen
-                 */
-                tcp_fastopen_init_key_once(false);
-                tcp_fastopen_reset_cipher(user_key, TCP_FASTOPEN_KEY_LENGTH);
+                tcp_fastopen_reset_cipher(net, NULL, user_key,
+                                          TCP_FASTOPEN_KEY_LENGTH);
         }
 
 bad_key:
@@ -359,11 +360,13 @@ static int proc_tfo_blackhole_detect_timeout(struct ctl_table *table,
                                              void __user *buffer,
                                              size_t *lenp, loff_t *ppos)
 {
+        struct net *net = container_of(table->data, struct net,
+            ipv4.sysctl_tcp_fastopen_blackhole_timeout);
         int ret;
 
         ret = proc_dointvec_minmax(table, write, buffer, lenp, ppos);
         if (write && ret == 0)
-                tcp_fastopen_active_timeout_reset();
+                atomic_set(&net->ipv4.tfo_active_disable_times, 0);
 
         return ret;
 }
@@ -386,15 +389,25 @@ static int proc_tcp_available_ulp(struct ctl_table *ctl,
         return ret;
 }
 
+#ifdef CONFIG_IP_ROUTE_MULTIPATH
+static int proc_fib_multipath_hash_policy(struct ctl_table *table, int write,
+                                          void __user *buffer, size_t *lenp,
+                                          loff_t *ppos)
+{
+        struct net *net = container_of(table->data, struct net,
+            ipv4.sysctl_fib_multipath_hash_policy);
+        int ret;
+
+        ret = proc_dointvec_minmax(table, write, buffer, lenp, ppos);
+        if (write && ret == 0)
+                call_netevent_notifiers(NETEVENT_MULTIPATH_HASH_UPDATE, net);
+
+        return ret;
+}
+#endif
+
 static struct ctl_table ipv4_table[] = {
         {
-                .procname       = "tcp_retrans_collapse",
-                .data           = &sysctl_tcp_retrans_collapse,
-                .maxlen         = sizeof(int),
-                .mode           = 0644,
-                .proc_handler   = proc_dointvec
-        },
-        {
                 .procname       = "tcp_max_orphans",
                 .data           = &sysctl_tcp_max_orphans,
                 .maxlen         = sizeof(int),
@@ -402,48 +415,6 @@ static struct ctl_table ipv4_table[] = {
                 .proc_handler   = proc_dointvec
         },
         {
-                .procname       = "tcp_fastopen",
-                .data           = &sysctl_tcp_fastopen,
-                .maxlen         = sizeof(int),
-                .mode           = 0644,
-                .proc_handler   = proc_dointvec,
-        },
-        {
-                .procname       = "tcp_fastopen_key",
-                .mode           = 0600,
-                .maxlen         = ((TCP_FASTOPEN_KEY_LENGTH * 2) + 10),
-                .proc_handler   = proc_tcp_fastopen_key,
-        },
-        {
-                .procname       = "tcp_fastopen_blackhole_timeout_sec",
-                .data           = &sysctl_tcp_fastopen_blackhole_timeout,
-                .maxlen         = sizeof(int),
-                .mode           = 0644,
-                .proc_handler   = proc_tfo_blackhole_detect_timeout,
-                .extra1         = &zero,
-        },
-        {
-                .procname       = "tcp_abort_on_overflow",
-                .data           = &sysctl_tcp_abort_on_overflow,
-                .maxlen         = sizeof(int),
-                .mode           = 0644,
-                .proc_handler   = proc_dointvec
-        },
-        {
-                .procname       = "tcp_stdurg",
-                .data           = &sysctl_tcp_stdurg,
-                .maxlen         = sizeof(int),
-                .mode           = 0644,
-                .proc_handler   = proc_dointvec
-        },
-        {
-                .procname       = "tcp_rfc1337",
-                .data           = &sysctl_tcp_rfc1337,
-                .maxlen         = sizeof(int),
-                .mode           = 0644,
-                .proc_handler   = proc_dointvec
-        },
-        {
                 .procname       = "inet_peer_threshold",
                 .data           = &inet_peer_threshold,
                 .maxlen         = sizeof(int),
@@ -465,34 +436,6 @@ static struct ctl_table ipv4_table[] = {
                 .proc_handler   = proc_dointvec_jiffies,
         },
         {
-                .procname       = "tcp_fack",
-                .data           = &sysctl_tcp_fack,
-                .maxlen         = sizeof(int),
-                .mode           = 0644,
-                .proc_handler   = proc_dointvec
-        },
-        {
-                .procname       = "tcp_recovery",
-                .data           = &sysctl_tcp_recovery,
-                .maxlen         = sizeof(int),
-                .mode           = 0644,
-                .proc_handler   = proc_dointvec,
-        },
-        {
-                .procname       = "tcp_max_reordering",
-                .data           = &sysctl_tcp_max_reordering,
-                .maxlen         = sizeof(int),
-                .mode           = 0644,
-                .proc_handler   = proc_dointvec
-        },
-        {
-                .procname       = "tcp_dsack",
-                .data           = &sysctl_tcp_dsack,
-                .maxlen         = sizeof(int),
-                .mode           = 0644,
-                .proc_handler   = proc_dointvec
-        },
-        {
                 .procname       = "tcp_mem",
                 .maxlen         = sizeof(sysctl_tcp_mem),
                 .data           = &sysctl_tcp_mem,
@@ -500,113 +443,12 @@ static struct ctl_table ipv4_table[] = {
                 .proc_handler   = proc_doulongvec_minmax,
         },
         {
-                .procname       = "tcp_wmem",
-                .data           = &sysctl_tcp_wmem,
-                .maxlen         = sizeof(sysctl_tcp_wmem),
-                .mode           = 0644,
-                .proc_handler   = proc_dointvec_minmax,
-                .extra1         = &one,
-        },
-        {
-                .procname       = "tcp_rmem",
-                .data           = &sysctl_tcp_rmem,
-                .maxlen         = sizeof(sysctl_tcp_rmem),
-                .mode           = 0644,
-                .proc_handler   = proc_dointvec_minmax,
-                .extra1         = &one,
-        },
-        {
-                .procname       = "tcp_app_win",
-                .data           = &sysctl_tcp_app_win,
-                .maxlen         = sizeof(int),
-                .mode           = 0644,
-                .proc_handler   = proc_dointvec
-        },
-        {
-                .procname       = "tcp_adv_win_scale",
-                .data           = &sysctl_tcp_adv_win_scale,
-                .maxlen         = sizeof(int),
-                .mode           = 0644,
-                .proc_handler   = proc_dointvec_minmax,
-                .extra1         = &tcp_adv_win_scale_min,
-                .extra2         = &tcp_adv_win_scale_max,
-        },
-        {
-                .procname       = "tcp_frto",
-                .data           = &sysctl_tcp_frto,
-                .maxlen         = sizeof(int),
-                .mode           = 0644,
-                .proc_handler   = proc_dointvec
-        },
-        {
-                .procname       = "tcp_min_rtt_wlen",
-                .data           = &sysctl_tcp_min_rtt_wlen,
-                .maxlen         = sizeof(int),
-                .mode           = 0644,
-                .proc_handler   = proc_dointvec
-        },
-        {
                 .procname       = "tcp_low_latency",
                 .data           = &sysctl_tcp_low_latency,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
                 .proc_handler   = proc_dointvec
         },
-        {
-                .procname       = "tcp_no_metrics_save",
-                .data           = &sysctl_tcp_nometrics_save,
-                .maxlen         = sizeof(int),
-                .mode           = 0644,
-                .proc_handler   = proc_dointvec,
-        },
-        {
-                .procname       = "tcp_moderate_rcvbuf",
-                .data           = &sysctl_tcp_moderate_rcvbuf,
-                .maxlen         = sizeof(int),
-                .mode           = 0644,
-                .proc_handler   = proc_dointvec,
-        },
-        {
-                .procname       = "tcp_tso_win_divisor",
-                .data           = &sysctl_tcp_tso_win_divisor,
-                .maxlen         = sizeof(int),
-                .mode           = 0644,
-                .proc_handler   = proc_dointvec,
-        },
-        {
-                .procname       = "tcp_congestion_control",
-                .mode           = 0644,
-                .maxlen         = TCP_CA_NAME_MAX,
-                .proc_handler   = proc_tcp_congestion_control,
-        },
-        {
-                .procname       = "tcp_workaround_signed_windows",
-                .data           = &sysctl_tcp_workaround_signed_windows,
-                .maxlen         = sizeof(int),
-                .mode           = 0644,
-                .proc_handler   = proc_dointvec
-        },
-        {
-                .procname       = "tcp_limit_output_bytes",
-                .data           = &sysctl_tcp_limit_output_bytes,
-                .maxlen         = sizeof(int),
-                .mode           = 0644,
-                .proc_handler   = proc_dointvec
-        },
-        {
-                .procname       = "tcp_challenge_ack_limit",
-                .data           = &sysctl_tcp_challenge_ack_limit,
-                .maxlen         = sizeof(int),
-                .mode           = 0644,
-                .proc_handler   = proc_dointvec
-        },
-        {
-                .procname       = "tcp_slow_start_after_idle",
-                .data           = &sysctl_tcp_slow_start_after_idle,
-                .maxlen         = sizeof(int),
-                .mode           = 0644,
-                .proc_handler   = proc_dointvec
-        },
 #ifdef CONFIG_NETLABEL
         {
                 .procname       = "cipso_cache_enable",
@@ -650,65 +492,6 @@ static struct ctl_table ipv4_table[] = {
                 .proc_handler   = proc_allowed_congestion_control,
         },
         {
-                .procname       = "tcp_thin_linear_timeouts",
-                .data           = &sysctl_tcp_thin_linear_timeouts,
-                .maxlen         = sizeof(int),
-                .mode           = 0644,
-                .proc_handler   = proc_dointvec
-        },
-        {
-                .procname       = "tcp_early_retrans",
-                .data           = &sysctl_tcp_early_retrans,
-                .maxlen         = sizeof(int),
-                .mode           = 0644,
-                .proc_handler   = proc_dointvec_minmax,
-                .extra1         = &zero,
-                .extra2         = &four,
-        },
-        {
-                .procname       = "tcp_min_tso_segs",
-                .data           = &sysctl_tcp_min_tso_segs,
-                .maxlen         = sizeof(int),
-                .mode           = 0644,
-                .proc_handler   = proc_dointvec_minmax,
-                .extra1         = &one,
-                .extra2         = &gso_max_segs,
-        },
-        {
-                .procname       = "tcp_pacing_ss_ratio",
-                .data           = &sysctl_tcp_pacing_ss_ratio,
-                .maxlen         = sizeof(int),
-                .mode           = 0644,
-                .proc_handler   = proc_dointvec_minmax,
-                .extra1         = &zero,
-                .extra2         = &thousand,
-        },
-        {
-                .procname       = "tcp_pacing_ca_ratio",
-                .data           = &sysctl_tcp_pacing_ca_ratio,
-                .maxlen         = sizeof(int),
-                .mode           = 0644,
-                .proc_handler   = proc_dointvec_minmax,
-                .extra1         = &zero,
-                .extra2         = &thousand,
-        },
-        {
-                .procname       = "tcp_autocorking",
-                .data           = &sysctl_tcp_autocorking,
-                .maxlen         = sizeof(int),
-                .mode           = 0644,
-                .proc_handler   = proc_dointvec_minmax,
-                .extra1         = &zero,
-                .extra2         = &one,
-        },
-        {
-                .procname       = "tcp_invalid_ratelimit",
-                .data           = &sysctl_tcp_invalid_ratelimit,
-                .maxlen         = sizeof(int),
-                .mode           = 0644,
-                .proc_handler   = proc_dointvec_ms_jiffies,
-        },
-        {
                 .procname       = "tcp_available_ulp",
                 .maxlen         = TCP_ULP_BUF_MAX,
                 .mode           = 0444,
@@ -977,6 +760,13 @@ static struct ctl_table ipv4_net_table[] = {
         },
 #endif
         {
+                .procname       = "tcp_congestion_control",
+                .data           = &init_net.ipv4.tcp_congestion_control,
+                .mode           = 0644,
+                .maxlen         = TCP_CA_NAME_MAX,
+                .proc_handler   = proc_tcp_congestion_control,
+        },
+        {
                 .procname       = "tcp_keepalive_time",
                 .data           = &init_net.ipv4.sysctl_tcp_keepalive_time,
                 .maxlen         = sizeof(int),
@@ -1086,6 +876,28 @@ static struct ctl_table ipv4_net_table[] = {
                 .mode           = 0644,
                 .proc_handler   = proc_dointvec
         },
+        {
+                .procname       = "tcp_fastopen",
+                .data           = &init_net.ipv4.sysctl_tcp_fastopen,
+                .maxlen         = sizeof(int),
+                .mode           = 0644,
+                .proc_handler   = proc_dointvec,
+        },
+        {
+                .procname       = "tcp_fastopen_key",
+                .mode           = 0600,
+                .data           = &init_net.ipv4.sysctl_tcp_fastopen,
+                .maxlen         = ((TCP_FASTOPEN_KEY_LENGTH * 2) + 10),
+                .proc_handler   = proc_tcp_fastopen_key,
+        },
+        {
+                .procname       = "tcp_fastopen_blackhole_timeout_sec",
+                .data           = &init_net.ipv4.sysctl_tcp_fastopen_blackhole_timeout,
+                .maxlen         = sizeof(int),
+                .mode           = 0644,
+                .proc_handler   = proc_tfo_blackhole_detect_timeout,
+                .extra1         = &zero,
+        },
 #ifdef CONFIG_IP_ROUTE_MULTIPATH
         {
                 .procname       = "fib_multipath_use_neigh",
@@ -1101,7 +913,7 @@ static struct ctl_table ipv4_net_table[] = {
                 .data           = &init_net.ipv4.sysctl_fib_multipath_hash_policy,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
-                .proc_handler   = proc_dointvec_minmax,
+                .proc_handler   = proc_fib_multipath_hash_policy,
                 .extra1         = &zero,
                 .extra2         = &one,
         },
@@ -1145,6 +957,216 @@ static struct ctl_table ipv4_net_table[] = {
                 .mode           = 0644,
                 .proc_handler   = proc_dointvec
         },
+        {
+                .procname       = "tcp_early_retrans",
+                .data           = &init_net.ipv4.sysctl_tcp_early_retrans,
+                .maxlen         = sizeof(int),
+                .mode           = 0644,
+                .proc_handler   = proc_dointvec_minmax,
+                .extra1         = &zero,
+                .extra2         = &four,
+        },
+        {
+                .procname       = "tcp_recovery",
+                .data           = &init_net.ipv4.sysctl_tcp_recovery,
+                .maxlen         = sizeof(int),
+                .mode           = 0644,
+                .proc_handler   = proc_dointvec,
+        },
+        {
+                .procname       = "tcp_thin_linear_timeouts",
+                .data           = &init_net.ipv4.sysctl_tcp_thin_linear_timeouts,
+                .maxlen         = sizeof(int),
+                .mode           = 0644,
+                .proc_handler   = proc_dointvec
+        },
+        {
+                .procname       = "tcp_slow_start_after_idle",
+                .data           = &init_net.ipv4.sysctl_tcp_slow_start_after_idle,
+                .maxlen         = sizeof(int),
+                .mode           = 0644,
+                .proc_handler   = proc_dointvec
+        },
+        {
+                .procname       = "tcp_retrans_collapse",
+                .data           = &init_net.ipv4.sysctl_tcp_retrans_collapse,
+                .maxlen         = sizeof(int),
+                .mode           = 0644,
+                .proc_handler   = proc_dointvec
+        },
+        {
+                .procname       = "tcp_stdurg",
+                .data           = &init_net.ipv4.sysctl_tcp_stdurg,
+                .maxlen         = sizeof(int),
+                .mode           = 0644,
+                .proc_handler   = proc_dointvec
+        },
+        {
+                .procname       = "tcp_rfc1337",
+                .data           = &init_net.ipv4.sysctl_tcp_rfc1337,
+                .maxlen         = sizeof(int),
+                .mode           = 0644,
+                .proc_handler   = proc_dointvec
+        },
+        {
+                .procname       = "tcp_abort_on_overflow",
+                .data           = &init_net.ipv4.sysctl_tcp_abort_on_overflow,
+                .maxlen         = sizeof(int),
+                .mode           = 0644,
+                .proc_handler   = proc_dointvec
+        },
+        {
+                .procname       = "tcp_fack",
+                .data           = &init_net.ipv4.sysctl_tcp_fack,
+                .maxlen         = sizeof(int),
+                .mode           = 0644,
+                .proc_handler   = proc_dointvec
+        },
+        {
+                .procname       = "tcp_max_reordering",
+                .data           = &init_net.ipv4.sysctl_tcp_max_reordering,
+                .maxlen         = sizeof(int),
+                .mode           = 0644,
+                .proc_handler   = proc_dointvec
+        },
+        {
+                .procname       = "tcp_dsack",
+                .data           = &init_net.ipv4.sysctl_tcp_dsack,
+                .maxlen         = sizeof(int),
+                .mode           = 0644,
+                .proc_handler   = proc_dointvec
+        },
+        {
+                .procname       = "tcp_app_win",
+                .data           = &init_net.ipv4.sysctl_tcp_app_win,
+                .maxlen         = sizeof(int),
+                .mode           = 0644,
+                .proc_handler   = proc_dointvec
+        },
+        {
+                .procname       = "tcp_adv_win_scale",
+                .data           = &init_net.ipv4.sysctl_tcp_adv_win_scale,
+                .maxlen         = sizeof(int),
+                .mode           = 0644,
+                .proc_handler   = proc_dointvec_minmax,
+                .extra1         = &tcp_adv_win_scale_min,
+                .extra2         = &tcp_adv_win_scale_max,
+        },
+        {
+                .procname       = "tcp_frto",
+                .data           = &init_net.ipv4.sysctl_tcp_frto,
+                .maxlen         = sizeof(int),
+                .mode           = 0644,
+                .proc_handler   = proc_dointvec
+        },
+        {
+                .procname       = "tcp_no_metrics_save",
+                .data           = &init_net.ipv4.sysctl_tcp_nometrics_save,
+                .maxlen         = sizeof(int),
+                .mode           = 0644,
+                .proc_handler   = proc_dointvec,
+        },
+        {
+                .procname       = "tcp_moderate_rcvbuf",
+                .data           = &init_net.ipv4.sysctl_tcp_moderate_rcvbuf,
+                .maxlen         = sizeof(int),
+                .mode           = 0644,
+                .proc_handler   = proc_dointvec,
+        },
+        {
+                .procname       = "tcp_tso_win_divisor",
+                .data           = &init_net.ipv4.sysctl_tcp_tso_win_divisor,
+                .maxlen         = sizeof(int),
+                .mode           = 0644,
+                .proc_handler   = proc_dointvec,
+        },
+        {
+                .procname       = "tcp_workaround_signed_windows",
+                .data           = &init_net.ipv4.sysctl_tcp_workaround_signed_windows,
+                .maxlen         = sizeof(int),
+                .mode           = 0644,
+                .proc_handler   = proc_dointvec
+        },
+        {
+                .procname       = "tcp_limit_output_bytes",
+                .data           = &init_net.ipv4.sysctl_tcp_limit_output_bytes,
+                .maxlen         = sizeof(int),
+                .mode           = 0644,
+                .proc_handler   = proc_dointvec
+        },
+        {
+                .procname       = "tcp_challenge_ack_limit",
+                .data           = &init_net.ipv4.sysctl_tcp_challenge_ack_limit,
+                .maxlen         = sizeof(int),
+                .mode           = 0644,
+                .proc_handler   = proc_dointvec
+        },
+        {
+                .procname       = "tcp_min_tso_segs",
+                .data           = &init_net.ipv4.sysctl_tcp_min_tso_segs,
+                .maxlen         = sizeof(int),
+                .mode           = 0644,
+                .proc_handler   = proc_dointvec_minmax,
+                .extra1         = &one,
+                .extra2         = &gso_max_segs,
+        },
+        {
+                .procname       = "tcp_min_rtt_wlen",
+                .data           = &init_net.ipv4.sysctl_tcp_min_rtt_wlen,
+                .maxlen         = sizeof(int),
+                .mode           = 0644,
+                .proc_handler   = proc_dointvec
+        },
+        {
+                .procname       = "tcp_autocorking",
+                .data           = &init_net.ipv4.sysctl_tcp_autocorking,
+                .maxlen         = sizeof(int),
+                .mode           = 0644,
+                .proc_handler   = proc_dointvec_minmax,
+                .extra1         = &zero,
+                .extra2         = &one,
+        },
+        {
+                .procname       = "tcp_invalid_ratelimit",
+                .data           = &init_net.ipv4.sysctl_tcp_invalid_ratelimit,
+                .maxlen         = sizeof(int),
+                .mode           = 0644,
+                .proc_handler   = proc_dointvec_ms_jiffies,
+        },
+        {
+                .procname       = "tcp_pacing_ss_ratio",
+                .data           = &init_net.ipv4.sysctl_tcp_pacing_ss_ratio,
+                .maxlen         = sizeof(int),
+                .mode           = 0644,
+                .proc_handler   = proc_dointvec_minmax,
+                .extra1         = &zero,
+                .extra2         = &thousand,
+        },
+        {
+                .procname       = "tcp_pacing_ca_ratio",
+                .data           = &init_net.ipv4.sysctl_tcp_pacing_ca_ratio,
+                .maxlen         = sizeof(int),
+                .mode           = 0644,
+                .proc_handler   = proc_dointvec_minmax,
+                .extra1         = &zero,
+                .extra2         = &thousand,
+        },
+        {
+                .procname       = "tcp_wmem",
+                .data           = &init_net.ipv4.sysctl_tcp_wmem,
+                .maxlen         = sizeof(init_net.ipv4.sysctl_tcp_wmem),
+                .mode           = 0644,
+                .proc_handler   = proc_dointvec_minmax,
+                .extra1         = &one,
+        },
+        {
+                .procname       = "tcp_rmem",
+                .data           = &init_net.ipv4.sysctl_tcp_rmem,
+                .maxlen         = sizeof(init_net.ipv4.sysctl_tcp_rmem),
+                .mode           = 0644,
+                .proc_handler   = proc_dointvec_minmax,
+                .extra1         = &one,
+        },
         { }
 };
 
diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
index 5091402720ab..bf97317e6c97 100644
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -270,6 +270,7 @@
 #include <linux/time.h>
 #include <linux/slab.h>
 #include <linux/errqueue.h>
+#include <linux/static_key.h>
 
 #include <net/icmp.h>
 #include <net/inet_common.h>
@@ -282,24 +283,22 @@
 #include <asm/ioctls.h>
 #include <net/busy_poll.h>
 
-int sysctl_tcp_min_tso_segs __read_mostly = 2;
-
-int sysctl_tcp_autocorking __read_mostly = 1;
+#include <trace/events/tcp.h>
 
 struct percpu_counter tcp_orphan_count;
 EXPORT_SYMBOL_GPL(tcp_orphan_count);
 
 long sysctl_tcp_mem[3] __read_mostly;
-int sysctl_tcp_wmem[3] __read_mostly;
-int sysctl_tcp_rmem[3] __read_mostly;
-
 EXPORT_SYMBOL(sysctl_tcp_mem);
-EXPORT_SYMBOL(sysctl_tcp_rmem);
-EXPORT_SYMBOL(sysctl_tcp_wmem);
 
 atomic_long_t tcp_memory_allocated;     /* Current allocated memory. */
 EXPORT_SYMBOL(tcp_memory_allocated);
 
+#if IS_ENABLED(CONFIG_SMC)
+DEFINE_STATIC_KEY_FALSE(tcp_have_smc);
+EXPORT_SYMBOL(tcp_have_smc);
+#endif
+
 /*
  * Current number of TCP sockets.
  */
@@ -413,8 +412,10 @@ void tcp_init_sock(struct sock *sk)
         struct tcp_sock *tp = tcp_sk(sk);
 
         tp->out_of_order_queue = RB_ROOT;
+        sk->tcp_rtx_queue = RB_ROOT;
         tcp_init_xmit_timers(sk);
         INIT_LIST_HEAD(&tp->tsq_node);
+        INIT_LIST_HEAD(&tp->tsorted_sent_queue);
 
         icsk->icsk_rto = TCP_TIMEOUT_INIT;
         tp->mdev_us = jiffies_to_usecs(TCP_TIMEOUT_INIT);
@@ -441,6 +442,7 @@ void tcp_init_sock(struct sock *sk)
         tcp_assign_congestion_control(sk);
 
         tp->tsoffset = 0;
+        tp->rack.reo_wnd_steps = 1;
 
         sk->sk_state = TCP_CLOSE;
 
@@ -449,15 +451,29 @@ void tcp_init_sock(struct sock *sk)
 
         icsk->icsk_sync_mss = tcp_sync_mss;
 
-        sk->sk_sndbuf = sysctl_tcp_wmem[1];
-        sk->sk_rcvbuf = sysctl_tcp_rmem[1];
+        sk->sk_sndbuf = sock_net(sk)->ipv4.sysctl_tcp_wmem[1];
+        sk->sk_rcvbuf = sock_net(sk)->ipv4.sysctl_tcp_rmem[1];
 
         sk_sockets_allocated_inc(sk);
 }
 EXPORT_SYMBOL(tcp_init_sock);
 
-static void tcp_tx_timestamp(struct sock *sk, u16 tsflags, struct sk_buff *skb)
+void tcp_init_transfer(struct sock *sk, int bpf_op)
 {
+        struct inet_connection_sock *icsk = inet_csk(sk);
+
+        tcp_mtup_init(sk);
+        icsk->icsk_af_ops->rebuild_header(sk);
+        tcp_init_metrics(sk);
+        tcp_call_bpf(sk, bpf_op);
+        tcp_init_congestion_control(sk);
+        tcp_init_buffer_space(sk);
+}
+
+static void tcp_tx_timestamp(struct sock *sk, u16 tsflags)
+{
+        struct sk_buff *skb = tcp_write_queue_tail(sk);
+
         if (tsflags && skb) {
                 struct skb_shared_info *shinfo = skb_shinfo(skb);
                 struct tcp_skb_cb *tcb = TCP_SKB_CB(skb);
@@ -675,7 +691,7 @@ static bool tcp_should_autocork(struct sock *sk, struct sk_buff *skb,
                                 int size_goal)
 {
         return skb->len < size_goal &&
-               sysctl_tcp_autocorking &&
+               sock_net(sk)->ipv4.sysctl_tcp_autocorking &&
                skb != tcp_write_queue_head(sk) &&
                refcount_read(&sk->sk_wmem_alloc) > skb->truesize;
 }
@@ -686,10 +702,9 @@ static void tcp_push(struct sock *sk, int flags, int mss_now,
         struct tcp_sock *tp = tcp_sk(sk);
         struct sk_buff *skb;
 
-        if (!tcp_send_head(sk))
-                return;
-
         skb = tcp_write_queue_tail(sk);
+        if (!skb)
+                return;
         if (!(flags & MSG_MORE) || forced_push(tp))
                 tcp_mark_push(tp, skb);
 
@@ -869,6 +884,7 @@ struct sk_buff *sk_stream_alloc_skb(struct sock *sk, int size, gfp_t gfp,
                          * available to the caller, no more, no less.
                          */
                         skb->reserved_tailroom = skb->end - skb->tail - size;
+                        INIT_LIST_HEAD(&skb->tcp_tsorted_anchor);
                         return skb;
                 }
                 __kfree_skb(skb);
@@ -948,14 +964,14 @@ ssize_t do_tcp_sendpages(struct sock *sk, struct page *page, int offset,
                 int copy, i;
                 bool can_coalesce;
 
-                if (!tcp_send_head(sk) || (copy = size_goal - skb->len) <= 0 ||
+                if (!skb || (copy = size_goal - skb->len) <= 0 ||
                     !tcp_skb_can_collapse_to(skb)) {
 new_segment:
                         if (!sk_stream_memory_free(sk))
                                 goto wait_for_sndbuf;
 
                         skb = sk_stream_alloc_skb(sk, 0, sk->sk_allocation,
-                                                  skb_queue_empty(&sk->sk_write_queue));
+                                        tcp_rtx_and_write_queues_empty(sk));
                         if (!skb)
                                 goto wait_for_memory;
 
@@ -1027,7 +1043,7 @@ wait_for_memory:
 
 out:
         if (copied) {
-                tcp_tx_timestamp(sk, sk->sk_tsflags, tcp_write_queue_tail(sk));
+                tcp_tx_timestamp(sk, sk->sk_tsflags);
                 if (!(flags & MSG_SENDPAGE_NOTLAST))
                         tcp_push(sk, flags, mss_now, tp->nonagle, size_goal);
         }
@@ -1126,7 +1142,7 @@ static int tcp_sendmsg_fastopen(struct sock *sk, struct msghdr *msg,
         struct sockaddr *uaddr = msg->msg_name;
         int err, flags;
 
-        if (!(sysctl_tcp_fastopen & TFO_CLIENT_ENABLE) ||
+        if (!(sock_net(sk)->ipv4.sysctl_tcp_fastopen & TFO_CLIENT_ENABLE) ||
             (uaddr && msg->msg_namelen >= sizeof(uaddr->sa_family) &&
              uaddr->sa_family == AF_UNSPEC))
                 return -EOPNOTSUPP;
@@ -1183,7 +1199,7 @@ int tcp_sendmsg_locked(struct sock *sk, struct msghdr *msg, size_t size)
                         goto out_err;
                 }
 
-                skb = tcp_send_head(sk) ? tcp_write_queue_tail(sk) : NULL;
+                skb = tcp_write_queue_tail(sk);
                 uarg = sock_zerocopy_realloc(sk, size, skb_zcopy(skb));
                 if (!uarg) {
                         err = -ENOBUFS;
@@ -1259,7 +1275,7 @@ restart:
                 int max = size_goal;
 
                 skb = tcp_write_queue_tail(sk);
-                if (tcp_send_head(sk)) {
+                if (skb) {
                         if (skb->ip_summed == CHECKSUM_NONE)
                                 max = mss_now;
                         copy = max - skb->len;
@@ -1279,7 +1295,7 @@ new_segment:
                                 process_backlog = false;
                                 goto restart;
                         }
-                        first_skb = skb_queue_empty(&sk->sk_write_queue);
+                        first_skb = tcp_rtx_and_write_queues_empty(sk);
                         skb = sk_stream_alloc_skb(sk,
                                                   select_size(sk, sg, first_skb),
                                                   sk->sk_allocation,
@@ -1404,7 +1420,7 @@ wait_for_memory:
 
 out:
         if (copied) {
-                tcp_tx_timestamp(sk, sockc.tsflags, tcp_write_queue_tail(sk));
+                tcp_tx_timestamp(sk, sockc.tsflags);
                 tcp_push(sk, flags, mss_now, tp->nonagle, size_goal);
         }
 out_nopush:
@@ -1505,6 +1521,13 @@ static int tcp_peek_sndq(struct sock *sk, struct msghdr *msg, int len)
 
         /* XXX -- need to support SO_PEEK_OFF */
 
+        skb_rbtree_walk(skb, &sk->tcp_rtx_queue) {
+                err = skb_copy_datagram_msg(skb, 0, msg, skb->len);
+                if (err)
+                        return err;
+                copied += skb->len;
+        }
+
         skb_queue_walk(&sk->sk_write_queue, skb) {
                 err = skb_copy_datagram_msg(skb, 0, msg, skb->len);
                 if (err)
@@ -2017,6 +2040,8 @@ void tcp_set_state(struct sock *sk, int state)
 {
         int oldstate = sk->sk_state;
 
+        trace_tcp_set_state(sk, oldstate, state);
+
         switch (state) {
         case TCP_ESTABLISHED:
                 if (oldstate != TCP_ESTABLISHED)
@@ -2304,6 +2329,37 @@ static inline bool tcp_need_reset(int state)
                 TCPF_FIN_WAIT2 | TCPF_SYN_RECV);
 }
 
+static void tcp_rtx_queue_purge(struct sock *sk)
+{
+        struct rb_node *p = rb_first(&sk->tcp_rtx_queue);
+
+        while (p) {
+                struct sk_buff *skb = rb_to_skb(p);
+
+                p = rb_next(p);
+                /* Since we are deleting whole queue, no need to
+                 * list_del(&skb->tcp_tsorted_anchor)
+                 */
+                tcp_rtx_queue_unlink(skb, sk);
+                sk_wmem_free_skb(sk, skb);
+        }
+}
+
+void tcp_write_queue_purge(struct sock *sk)
+{
+        struct sk_buff *skb;
+
+        tcp_chrono_stop(sk, TCP_CHRONO_BUSY);
+        while ((skb = __skb_dequeue(&sk->sk_write_queue)) != NULL) {
+                tcp_skb_tsorted_anchor_cleanup(skb);
+                sk_wmem_free_skb(sk, skb);
+        }
+        tcp_rtx_queue_purge(sk);
+        INIT_LIST_HEAD(&tcp_sk(sk)->tsorted_sent_queue);
+        sk_mem_reclaim(sk);
+        tcp_clear_all_retrans_hints(tcp_sk(sk));
+}
+
 int tcp_disconnect(struct sock *sk, int flags)
 {
         struct inet_sock *inet = inet_sk(sk);
@@ -2362,7 +2418,6 @@ int tcp_disconnect(struct sock *sk, int flags)
          * issue in __tcp_select_window()
          */
         icsk->icsk_ack.rcv_mss = TCP_MIN_MSS;
-        tcp_init_send_head(sk);
         memset(&tp->rx_opt, 0, sizeof(tp->rx_opt));
         __sk_dst_reset(sk);
         dst_release(sk->sk_rx_dst);
@@ -2454,8 +2509,6 @@ static int tcp_repair_options_est(struct sock *sk,
                                 return -EINVAL;
 
                         tp->rx_opt.sack_ok |= TCP_SACK_SEEN;
-                        if (sysctl_tcp_fack)
-                                tcp_enable_fack(tp);
                         break;
                 case TCPOPT_TIMESTAMP:
                         if (opt.opt_val != 0)
@@ -2518,6 +2571,17 @@ static int do_tcp_setsockopt(struct sock *sk, int level,
                 release_sock(sk);
                 return err;
         }
+        case TCP_FASTOPEN_KEY: {
+                __u8 key[TCP_FASTOPEN_KEY_LENGTH];
+
+                if (optlen != sizeof(key))
+                        return -EINVAL;
+
+                if (copy_from_user(key, optval, optlen))
+                        return -EFAULT;
+
+                return tcp_fastopen_reset_cipher(net, sk, key, sizeof(key));
+        }
         default:
                 /* fallthru */
                 break;
@@ -2749,7 +2813,7 @@ static int do_tcp_setsockopt(struct sock *sk, int level,
         case TCP_FASTOPEN:
                 if (val >= 0 && ((1 << sk->sk_state) & (TCPF_CLOSE |
                     TCPF_LISTEN))) {
-                        tcp_fastopen_init_key_once(true);
+                        tcp_fastopen_init_key_once(net);
 
                         fastopen_queue_tune(sk, val);
                 } else {
@@ -2759,7 +2823,7 @@ static int do_tcp_setsockopt(struct sock *sk, int level,
         case TCP_FASTOPEN_CONNECT:
                 if (val > 1 || val < 0) {
                         err = -EINVAL;
-                } else if (sysctl_tcp_fastopen & TFO_CLIENT_ENABLE) {
+                } else if (net->ipv4.sysctl_tcp_fastopen & TFO_CLIENT_ENABLE) {
                         if (sk->sk_state == TCP_CLOSE)
                                 tp->fastopen_connect = val;
                         else
@@ -2768,6 +2832,14 @@ static int do_tcp_setsockopt(struct sock *sk, int level,
                         err = -EOPNOTSUPP;
                 }
                 break;
+        case TCP_FASTOPEN_NO_COOKIE:
+                if (val > 1 || val < 0)
+                        err = -EINVAL;
+                else if (!((1 << sk->sk_state) & (TCPF_CLOSE | TCPF_LISTEN)))
+                        err = -EINVAL;
+                else
+                        tp->fastopen_no_cookie = val;
+                break;
         case TCP_TIMESTAMP:
                 if (!tp->repair)
                         err = -EPERM;
@@ -2905,7 +2977,6 @@ void tcp_get_info(struct sock *sk, struct tcp_info *info)
 
         info->tcpi_lost = tp->lost_out;
         info->tcpi_retrans = tp->retrans_out;
-        info->tcpi_fackets = tp->fackets_out;
 
         now = tcp_jiffies32;
         info->tcpi_last_data_sent = jiffies_to_msecs(now - tp->lsndtime);
@@ -3104,6 +3175,28 @@ static int do_tcp_getsockopt(struct sock *sk, int level,
                         return -EFAULT;
                 return 0;
 
+        case TCP_FASTOPEN_KEY: {
+                __u8 key[TCP_FASTOPEN_KEY_LENGTH];
+                struct tcp_fastopen_context *ctx;
+
+                if (get_user(len, optlen))
+                        return -EFAULT;
+
+                rcu_read_lock();
+                ctx = rcu_dereference(icsk->icsk_accept_queue.fastopenq.ctx);
+                if (ctx)
+                        memcpy(key, ctx->key, sizeof(key));
+                else
+                        len = 0;
+                rcu_read_unlock();
+
+                len = min_t(unsigned int, len, sizeof(key));
+                if (put_user(len, optlen))
+                        return -EFAULT;
+                if (copy_to_user(optval, key, len))
+                        return -EFAULT;
+                return 0;
+        }
         case TCP_THIN_LINEAR_TIMEOUTS:
                 val = tp->thin_lto;
                 break;
@@ -3166,6 +3259,10 @@ static int do_tcp_getsockopt(struct sock *sk, int level,
                 val = tp->fastopen_connect;
                 break;
 
+        case TCP_FASTOPEN_NO_COOKIE:
+                val = tp->fastopen_no_cookie;
+                break;
+
         case TCP_TIMESTAMP:
                 val = tcp_time_stamp_raw() + tp->tsoffset;
                 break;
@@ -3531,13 +3628,13 @@ void __init tcp_init(void)
         max_wshare = min(4UL*1024*1024, limit);
         max_rshare = min(6UL*1024*1024, limit);
 
-        sysctl_tcp_wmem[0] = SK_MEM_QUANTUM;
-        sysctl_tcp_wmem[1] = 16*1024;
-        sysctl_tcp_wmem[2] = max(64*1024, max_wshare);
+        init_net.ipv4.sysctl_tcp_wmem[0] = SK_MEM_QUANTUM;
+        init_net.ipv4.sysctl_tcp_wmem[1] = 16*1024;
+        init_net.ipv4.sysctl_tcp_wmem[2] = max(64*1024, max_wshare);
 
-        sysctl_tcp_rmem[0] = SK_MEM_QUANTUM;
-        sysctl_tcp_rmem[1] = 87380;
-        sysctl_tcp_rmem[2] = max(87380, max_rshare);
+        init_net.ipv4.sysctl_tcp_rmem[0] = SK_MEM_QUANTUM;
+        init_net.ipv4.sysctl_tcp_rmem[1] = 87380;
+        init_net.ipv4.sysctl_tcp_rmem[2] = max(87380, max_rshare);
 
         pr_info("Hash tables configured (established %u bind %u)\n",
                 tcp_hashinfo.ehash_mask + 1, tcp_hashinfo.bhash_size);
diff --git a/net/ipv4/tcp_cdg.c b/net/ipv4/tcp_cdg.c
index 66ac69f7bd19..06fbe102a425 100644
--- a/net/ipv4/tcp_cdg.c
+++ b/net/ipv4/tcp_cdg.c
@@ -389,7 +389,7 @@ static void tcp_cdg_release(struct sock *sk)
         kfree(ca->gradients);
 }
 
-struct tcp_congestion_ops tcp_cdg __read_mostly = {
+static struct tcp_congestion_ops tcp_cdg __read_mostly = {
         .cong_avoid = tcp_cdg_cong_avoid,
         .cwnd_event = tcp_cdg_cwnd_event,
         .pkts_acked = tcp_cdg_acked,
diff --git a/net/ipv4/tcp_cong.c b/net/ipv4/tcp_cong.c
index 2f26124fd160..bc6c02f16243 100644
--- a/net/ipv4/tcp_cong.c
+++ b/net/ipv4/tcp_cong.c
@@ -33,9 +33,11 @@ static struct tcp_congestion_ops *tcp_ca_find(const char *name)
 }
 
 /* Must be called with rcu lock held */
-static const struct tcp_congestion_ops *__tcp_ca_find_autoload(const char *name)
+static struct tcp_congestion_ops *tcp_ca_find_autoload(struct net *net,
+                                                       const char *name)
 {
-        const struct tcp_congestion_ops *ca = tcp_ca_find(name);
+        struct tcp_congestion_ops *ca = tcp_ca_find(name);
+
 #ifdef CONFIG_MODULES
         if (!ca && capable(CAP_NET_ADMIN)) {
                 rcu_read_unlock();
@@ -115,7 +117,7 @@ void tcp_unregister_congestion_control(struct tcp_congestion_ops *ca)
 }
 EXPORT_SYMBOL_GPL(tcp_unregister_congestion_control);
 
-u32 tcp_ca_get_key_by_name(const char *name, bool *ecn_ca)
+u32 tcp_ca_get_key_by_name(struct net *net, const char *name, bool *ecn_ca)
 {
         const struct tcp_congestion_ops *ca;
         u32 key = TCP_CA_UNSPEC;
@@ -123,7 +125,7 @@ u32 tcp_ca_get_key_by_name(const char *name, bool *ecn_ca)
         might_sleep();
 
         rcu_read_lock();
-        ca = __tcp_ca_find_autoload(name);
+        ca = tcp_ca_find_autoload(net, name);
         if (ca) {
                 key = ca->key;
                 *ecn_ca = ca->flags & TCP_CONG_NEEDS_ECN;
@@ -153,23 +155,18 @@ EXPORT_SYMBOL_GPL(tcp_ca_get_name_by_key);
 /* Assign choice of congestion control. */
 void tcp_assign_congestion_control(struct sock *sk)
 {
+        struct net *net = sock_net(sk);
         struct inet_connection_sock *icsk = inet_csk(sk);
-        struct tcp_congestion_ops *ca;
+        const struct tcp_congestion_ops *ca;
 
         rcu_read_lock();
-        list_for_each_entry_rcu(ca, &tcp_cong_list, list) {
-                if (likely(try_module_get(ca->owner))) {
-                        icsk->icsk_ca_ops = ca;
-                        goto out;
-                }
-                /* Fallback to next available. The last really
-                 * guaranteed fallback is Reno from this list.
-                 */
-        }
-out:
+        ca = rcu_dereference(net->ipv4.tcp_congestion_control);
+        if (unlikely(!try_module_get(ca->owner)))
+                ca = &tcp_reno;
+        icsk->icsk_ca_ops = ca;
         rcu_read_unlock();
-        memset(icsk->icsk_ca_priv, 0, sizeof(icsk->icsk_ca_priv));
 
+        memset(icsk->icsk_ca_priv, 0, sizeof(icsk->icsk_ca_priv));
         if (ca->flags & TCP_CONG_NEEDS_ECN)
                 INET_ECN_xmit(sk);
         else
@@ -214,29 +211,27 @@ void tcp_cleanup_congestion_control(struct sock *sk)
 }
 
 /* Used by sysctl to change default congestion control */
-int tcp_set_default_congestion_control(const char *name)
+int tcp_set_default_congestion_control(struct net *net, const char *name)
 {
         struct tcp_congestion_ops *ca;
-        int ret = -ENOENT;
-
-        spin_lock(&tcp_cong_list_lock);
-        ca = tcp_ca_find(name);
-#ifdef CONFIG_MODULES
-        if (!ca && capable(CAP_NET_ADMIN)) {
-                spin_unlock(&tcp_cong_list_lock);
+        const struct tcp_congestion_ops *prev;
+        int ret;
 
-                request_module("tcp_%s", name);
-                spin_lock(&tcp_cong_list_lock);
-                ca = tcp_ca_find(name);
-        }
-#endif
+        rcu_read_lock();
+        ca = tcp_ca_find_autoload(net, name);
+        if (!ca) {
+                ret = -ENOENT;
+        } else if (!try_module_get(ca->owner)) {
+                ret = -EBUSY;
+        } else {
+                prev = xchg(&net->ipv4.tcp_congestion_control, ca);
+                if (prev)
+                        module_put(prev->owner);
 
-        if (ca) {
-                ca->flags |= TCP_CONG_NON_RESTRICTED;   /* default is always allowed */
-                list_move(&ca->list, &tcp_cong_list);
+                ca->flags |= TCP_CONG_NON_RESTRICTED;
                 ret = 0;
         }
-        spin_unlock(&tcp_cong_list_lock);
+        rcu_read_unlock();
 
         return ret;
 }
@@ -244,7 +239,8 @@ int tcp_set_default_congestion_control(const char *name)
 /* Set default value from kernel configuration at bootup */
 static int __init tcp_congestion_default(void)
 {
-        return tcp_set_default_congestion_control(CONFIG_DEFAULT_TCP_CONG);
+        return tcp_set_default_congestion_control(&init_net,
+                                                  CONFIG_DEFAULT_TCP_CONG);
 }
 late_initcall(tcp_congestion_default);
 
@@ -264,14 +260,12 @@ void tcp_get_available_congestion_control(char *buf, size_t maxlen)
 }
 
 /* Get current default congestion control */
-void tcp_get_default_congestion_control(char *name)
+void tcp_get_default_congestion_control(struct net *net, char *name)
 {
-        struct tcp_congestion_ops *ca;
-        /* We will always have reno... */
-        BUG_ON(list_empty(&tcp_cong_list));
+        const struct tcp_congestion_ops *ca;
 
         rcu_read_lock();
-        ca = list_entry(tcp_cong_list.next, struct tcp_congestion_ops, list);
+        ca = rcu_dereference(net->ipv4.tcp_congestion_control);
         strncpy(name, ca->name, TCP_CA_NAME_MAX);
         rcu_read_unlock();
 }
@@ -351,12 +345,14 @@ int tcp_set_congestion_control(struct sock *sk, const char *name, bool load, boo
         if (!load)
                 ca = tcp_ca_find(name);
         else
-                ca = __tcp_ca_find_autoload(name);
+                ca = tcp_ca_find_autoload(sock_net(sk), name);
+
         /* No change asking for existing value */
         if (ca == icsk->icsk_ca_ops) {
                 icsk->icsk_ca_setsockopt = 1;
                 goto out;
         }
+
         if (!ca) {
                 err = -ENOENT;
         } else if (!load) {
diff --git a/net/ipv4/tcp_fastopen.c b/net/ipv4/tcp_fastopen.c
index fbbeda647774..78c192ee03a4 100644
--- a/net/ipv4/tcp_fastopen.c
+++ b/net/ipv4/tcp_fastopen.c
@@ -10,15 +10,18 @@
 #include <net/inetpeer.h>
 #include <net/tcp.h>
 
-int sysctl_tcp_fastopen __read_mostly = TFO_CLIENT_ENABLE;
-
-struct tcp_fastopen_context __rcu *tcp_fastopen_ctx;
-
-static DEFINE_SPINLOCK(tcp_fastopen_ctx_lock);
-
-void tcp_fastopen_init_key_once(bool publish)
+void tcp_fastopen_init_key_once(struct net *net)
 {
-        static u8 key[TCP_FASTOPEN_KEY_LENGTH];
+        u8 key[TCP_FASTOPEN_KEY_LENGTH];
+        struct tcp_fastopen_context *ctxt;
+
+        rcu_read_lock();
+        ctxt = rcu_dereference(net->ipv4.tcp_fastopen_ctx);
+        if (ctxt) {
+                rcu_read_unlock();
+                return;
+        }
+        rcu_read_unlock();
 
         /* tcp_fastopen_reset_cipher publishes the new context
          * atomically, so we allow this race happening here.
@@ -26,8 +29,8 @@ void tcp_fastopen_init_key_once(bool publish)
          * All call sites of tcp_fastopen_cookie_gen also check
          * for a valid cookie, so this is an acceptable risk.
          */
-        if (net_get_random_once(key, sizeof(key)) && publish)
-                tcp_fastopen_reset_cipher(key, sizeof(key));
+        get_random_bytes(key, sizeof(key));
+        tcp_fastopen_reset_cipher(net, NULL, key, sizeof(key));
 }
 
 static void tcp_fastopen_ctx_free(struct rcu_head *head)
@@ -38,10 +41,37 @@ static void tcp_fastopen_ctx_free(struct rcu_head *head)
         kfree(ctx);
 }
 
-int tcp_fastopen_reset_cipher(void *key, unsigned int len)
+void tcp_fastopen_destroy_cipher(struct sock *sk)
+{
+        struct tcp_fastopen_context *ctx;
+
+        ctx = rcu_dereference_protected(
+                        inet_csk(sk)->icsk_accept_queue.fastopenq.ctx, 1);
+        if (ctx)
+                call_rcu(&ctx->rcu, tcp_fastopen_ctx_free);
+}
+
+void tcp_fastopen_ctx_destroy(struct net *net)
+{
+        struct tcp_fastopen_context *ctxt;
+
+        spin_lock(&net->ipv4.tcp_fastopen_ctx_lock);
+
+        ctxt = rcu_dereference_protected(net->ipv4.tcp_fastopen_ctx,
+                                lockdep_is_held(&net->ipv4.tcp_fastopen_ctx_lock));
+        rcu_assign_pointer(net->ipv4.tcp_fastopen_ctx, NULL);
+        spin_unlock(&net->ipv4.tcp_fastopen_ctx_lock);
+
+        if (ctxt)
+                call_rcu(&ctxt->rcu, tcp_fastopen_ctx_free);
+}
+
+int tcp_fastopen_reset_cipher(struct net *net, struct sock *sk,
+                              void *key, unsigned int len)
 {
-        int err;
         struct tcp_fastopen_context *ctx, *octx;
+        struct fastopen_queue *q;
+        int err;
 
         ctx = kmalloc(sizeof(*ctx), GFP_KERNEL);
         if (!ctx)
@@ -62,26 +92,37 @@ error:		kfree(ctx);
         }
         memcpy(ctx->key, key, len);
 
-        spin_lock(&tcp_fastopen_ctx_lock);
 
-        octx = rcu_dereference_protected(tcp_fastopen_ctx,
-                                lockdep_is_held(&tcp_fastopen_ctx_lock));
-        rcu_assign_pointer(tcp_fastopen_ctx, ctx);
-        spin_unlock(&tcp_fastopen_ctx_lock);
+        spin_lock(&net->ipv4.tcp_fastopen_ctx_lock);
+        if (sk) {
+                q = &inet_csk(sk)->icsk_accept_queue.fastopenq;
+                octx = rcu_dereference_protected(q->ctx,
+                        lockdep_is_held(&net->ipv4.tcp_fastopen_ctx_lock));
+                rcu_assign_pointer(q->ctx, ctx);
+        } else {
+                octx = rcu_dereference_protected(net->ipv4.tcp_fastopen_ctx,
+                        lockdep_is_held(&net->ipv4.tcp_fastopen_ctx_lock));
+                rcu_assign_pointer(net->ipv4.tcp_fastopen_ctx, ctx);
+        }
+        spin_unlock(&net->ipv4.tcp_fastopen_ctx_lock);
 
         if (octx)
                 call_rcu(&octx->rcu, tcp_fastopen_ctx_free);
         return err;
 }
 
-static bool __tcp_fastopen_cookie_gen(const void *path,
+static bool __tcp_fastopen_cookie_gen(struct sock *sk, const void *path,
                                       struct tcp_fastopen_cookie *foc)
 {
         struct tcp_fastopen_context *ctx;
         bool ok = false;
 
         rcu_read_lock();
-        ctx = rcu_dereference(tcp_fastopen_ctx);
+
+        ctx = rcu_dereference(inet_csk(sk)->icsk_accept_queue.fastopenq.ctx);
+        if (!ctx)
+                ctx = rcu_dereference(sock_net(sk)->ipv4.tcp_fastopen_ctx);
+
         if (ctx) {
                 crypto_cipher_encrypt_one(ctx->tfm, foc->val, path);
                 foc->len = TCP_FASTOPEN_COOKIE_SIZE;
@@ -97,7 +138,8 @@ static bool __tcp_fastopen_cookie_gen(const void *path,
  *
  * XXX (TFO) - refactor when TCP_FASTOPEN_COOKIE_SIZE != AES_BLOCK_SIZE.
  */
-static bool tcp_fastopen_cookie_gen(struct request_sock *req,
+static bool tcp_fastopen_cookie_gen(struct sock *sk,
+                                    struct request_sock *req,
                                     struct sk_buff *syn,
                                     struct tcp_fastopen_cookie *foc)
 {
@@ -105,7 +147,7 @@ static bool tcp_fastopen_cookie_gen(struct request_sock *req,
                 const struct iphdr *iph = ip_hdr(syn);
 
                 __be32 path[4] = { iph->saddr, iph->daddr, 0, 0 };
-                return __tcp_fastopen_cookie_gen(path, foc);
+                return __tcp_fastopen_cookie_gen(sk, path, foc);
         }
 
 #if IS_ENABLED(CONFIG_IPV6)
@@ -113,13 +155,13 @@ static bool tcp_fastopen_cookie_gen(struct request_sock *req,
                 const struct ipv6hdr *ip6h = ipv6_hdr(syn);
                 struct tcp_fastopen_cookie tmp;
 
-                if (__tcp_fastopen_cookie_gen(&ip6h->saddr, &tmp)) {
+                if (__tcp_fastopen_cookie_gen(sk, &ip6h->saddr, &tmp)) {
                         struct in6_addr *buf = &tmp.addr;
                         int i;
 
                         for (i = 0; i < 4; i++)
                                 buf->s6_addr32[i] ^= ip6h->daddr.s6_addr32[i];
-                        return __tcp_fastopen_cookie_gen(buf, foc);
+                        return __tcp_fastopen_cookie_gen(sk, buf, foc);
                 }
         }
 #endif
@@ -217,12 +259,7 @@ static struct sock *tcp_fastopen_create_child(struct sock *sk,
         refcount_set(&req->rsk_refcnt, 2);
 
         /* Now finish processing the fastopen child socket. */
-        inet_csk(child)->icsk_af_ops->rebuild_header(child);
-        tcp_init_congestion_control(child);
-        tcp_mtup_init(child);
-        tcp_init_metrics(child);
-        tcp_call_bpf(child, BPF_SOCK_OPS_PASSIVE_ESTABLISHED_CB);
-        tcp_init_buffer_space(child);
+        tcp_init_transfer(child, BPF_SOCK_OPS_PASSIVE_ESTABLISHED_CB);
 
         tp->rcv_nxt = TCP_SKB_CB(skb)->seq + 1;
 
@@ -272,33 +309,45 @@ static bool tcp_fastopen_queue_check(struct sock *sk)
         return true;
 }
 
+static bool tcp_fastopen_no_cookie(const struct sock *sk,
+                                   const struct dst_entry *dst,
+                                   int flag)
+{
+        return (sock_net(sk)->ipv4.sysctl_tcp_fastopen & flag) ||
+               tcp_sk(sk)->fastopen_no_cookie ||
+               (dst && dst_metric(dst, RTAX_FASTOPEN_NO_COOKIE));
+}
+
 /* Returns true if we should perform Fast Open on the SYN. The cookie (foc)
  * may be updated and return the client in the SYN-ACK later. E.g., Fast Open
  * cookie request (foc->len == 0).
  */
 struct sock *tcp_try_fastopen(struct sock *sk, struct sk_buff *skb,
                               struct request_sock *req,
-                              struct tcp_fastopen_cookie *foc)
+                              struct tcp_fastopen_cookie *foc,
+                              const struct dst_entry *dst)
 {
-        struct tcp_fastopen_cookie valid_foc = { .len = -1 };
         bool syn_data = TCP_SKB_CB(skb)->end_seq != TCP_SKB_CB(skb)->seq + 1;
+        int tcp_fastopen = sock_net(sk)->ipv4.sysctl_tcp_fastopen;
+        struct tcp_fastopen_cookie valid_foc = { .len = -1 };
         struct sock *child;
 
         if (foc->len == 0) /* Client requests a cookie */
                 NET_INC_STATS(sock_net(sk), LINUX_MIB_TCPFASTOPENCOOKIEREQD);
 
-        if (!((sysctl_tcp_fastopen & TFO_SERVER_ENABLE) &&
+        if (!((tcp_fastopen & TFO_SERVER_ENABLE) &&
               (syn_data || foc->len >= 0) &&
               tcp_fastopen_queue_check(sk))) {
                 foc->len = -1;
                 return NULL;
         }
 
-        if (syn_data && (sysctl_tcp_fastopen & TFO_SERVER_COOKIE_NOT_REQD))
+        if (syn_data &&
+            tcp_fastopen_no_cookie(sk, dst, TFO_SERVER_COOKIE_NOT_REQD))
                 goto fastopen;
 
         if (foc->len >= 0 &&  /* Client presents or requests a cookie */
-            tcp_fastopen_cookie_gen(req, skb, &valid_foc) &&
+            tcp_fastopen_cookie_gen(sk, req, skb, &valid_foc) &&
             foc->len == TCP_FASTOPEN_COOKIE_SIZE &&
             foc->len == valid_foc.len &&
             !memcmp(foc->val, valid_foc.val, foc->len)) {
@@ -331,6 +380,7 @@ bool tcp_fastopen_cookie_check(struct sock *sk, u16 *mss,
                                struct tcp_fastopen_cookie *cookie)
 {
         unsigned long last_syn_loss = 0;
+        const struct dst_entry *dst;
         int syn_loss = 0;
 
         tcp_fastopen_cache_get(sk, mss, cookie, &syn_loss, &last_syn_loss);
@@ -348,7 +398,9 @@ bool tcp_fastopen_cookie_check(struct sock *sk, u16 *mss,
                 return false;
         }
 
-        if (sysctl_tcp_fastopen & TFO_CLIENT_NO_COOKIE) {
+        dst = __sk_dst_get(sk);
+
+        if (tcp_fastopen_no_cookie(sk, dst, TFO_CLIENT_NO_COOKIE)) {
                 cookie->len = -1;
                 return true;
         }
@@ -402,25 +454,16 @@ EXPORT_SYMBOL(tcp_fastopen_defer_connect);
  * TFO connection with data exchanges.
  */
 
-/* Default to 1hr */
-unsigned int sysctl_tcp_fastopen_blackhole_timeout __read_mostly = 60 * 60;
-static atomic_t tfo_active_disable_times __read_mostly = ATOMIC_INIT(0);
-static unsigned long tfo_active_disable_stamp __read_mostly;
-
 /* Disable active TFO and record current jiffies and
  * tfo_active_disable_times
  */
 void tcp_fastopen_active_disable(struct sock *sk)
 {
-        atomic_inc(&tfo_active_disable_times);
-        tfo_active_disable_stamp = jiffies;
-        NET_INC_STATS(sock_net(sk), LINUX_MIB_TCPFASTOPENBLACKHOLE);
-}
+        struct net *net = sock_net(sk);
 
-/* Reset tfo_active_disable_times to 0 */
-void tcp_fastopen_active_timeout_reset(void)
-{
-        atomic_set(&tfo_active_disable_times, 0);
+        atomic_inc(&net->ipv4.tfo_active_disable_times);
+        net->ipv4.tfo_active_disable_stamp = jiffies;
+        NET_INC_STATS(net, LINUX_MIB_TCPFASTOPENBLACKHOLE);
 }
 
 /* Calculate timeout for tfo active disable
@@ -429,17 +472,18 @@ void tcp_fastopen_active_timeout_reset(void)
  */
 bool tcp_fastopen_active_should_disable(struct sock *sk)
 {
-        int tfo_da_times = atomic_read(&tfo_active_disable_times);
-        int multiplier;
+        unsigned int tfo_bh_timeout = sock_net(sk)->ipv4.sysctl_tcp_fastopen_blackhole_timeout;
+        int tfo_da_times = atomic_read(&sock_net(sk)->ipv4.tfo_active_disable_times);
         unsigned long timeout;
+        int multiplier;
 
         if (!tfo_da_times)
                 return false;
 
         /* Limit timout to max: 2^6 * initial timeout */
         multiplier = 1 << min(tfo_da_times - 1, 6);
-        timeout = multiplier * sysctl_tcp_fastopen_blackhole_timeout * HZ;
-        if (time_before(jiffies, tfo_active_disable_stamp + timeout))
+        timeout = multiplier * tfo_bh_timeout * HZ;
+        if (time_before(jiffies, sock_net(sk)->ipv4.tfo_active_disable_stamp + timeout))
                 return true;
 
         /* Mark check bit so we can check for successful active TFO
@@ -458,27 +502,25 @@ bool tcp_fastopen_active_should_disable(struct sock *sk)
 void tcp_fastopen_active_disable_ofo_check(struct sock *sk)
 {
         struct tcp_sock *tp = tcp_sk(sk);
-        struct rb_node *p;
-        struct sk_buff *skb;
         struct dst_entry *dst;
+        struct sk_buff *skb;
 
         if (!tp->syn_fastopen)
                 return;
 
         if (!tp->data_segs_in) {
-                p = rb_first(&tp->out_of_order_queue);
-                if (p && !rb_next(p)) {
-                        skb = rb_entry(p, struct sk_buff, rbnode);
+                skb = skb_rb_first(&tp->out_of_order_queue);
+                if (skb && !skb_rb_next(skb)) {
                         if (TCP_SKB_CB(skb)->tcp_flags & TCPHDR_FIN) {
                                 tcp_fastopen_active_disable(sk);
                                 return;
                         }
                 }
         } else if (tp->syn_fastopen_ch &&
-                   atomic_read(&tfo_active_disable_times)) {
+                   atomic_read(&sock_net(sk)->ipv4.tfo_active_disable_times)) {
                 dst = sk_dst_get(sk);
                 if (!(dst && dst->dev && (dst->dev->flags & IFF_LOOPBACK)))
-                        tcp_fastopen_active_timeout_reset();
+                        atomic_set(&sock_net(sk)->ipv4.tfo_active_disable_times, 0);
                 dst_release(dst);
         }
 }
diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index 887585045b27..734cfc8ff76e 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -76,25 +76,10 @@
 #include <linux/ipsec.h>
 #include <asm/unaligned.h>
 #include <linux/errqueue.h>
+#include <trace/events/tcp.h>
+#include <linux/static_key.h>
 
-int sysctl_tcp_fack __read_mostly;
-int sysctl_tcp_max_reordering __read_mostly = 300;
-int sysctl_tcp_dsack __read_mostly = 1;
-int sysctl_tcp_app_win __read_mostly = 31;
-int sysctl_tcp_adv_win_scale __read_mostly = 1;
-EXPORT_SYMBOL(sysctl_tcp_adv_win_scale);
-
-/* rfc5961 challenge ack rate limiting */
-int sysctl_tcp_challenge_ack_limit = 1000;
-
-int sysctl_tcp_stdurg __read_mostly;
-int sysctl_tcp_rfc1337 __read_mostly;
 int sysctl_tcp_max_orphans __read_mostly = NR_FILE;
-int sysctl_tcp_frto __read_mostly = 2;
-int sysctl_tcp_min_rtt_wlen __read_mostly = 300;
-int sysctl_tcp_moderate_rcvbuf __read_mostly = 1;
-int sysctl_tcp_early_retrans __read_mostly = 3;
-int sysctl_tcp_invalid_ratelimit __read_mostly = HZ/2;
 
 #define FLAG_DATA               0x01 /* Incoming frame contained data.          */
 #define FLAG_WIN_UPDATE         0x02 /* Incoming ACK was a window update.       */
@@ -335,7 +320,7 @@ static void tcp_sndbuf_expand(struct sock *sk)
         sndmem *= nr_segs * per_mss;
 
         if (sk->sk_sndbuf < sndmem)
-                sk->sk_sndbuf = min(sndmem, sysctl_tcp_wmem[2]);
+                sk->sk_sndbuf = min(sndmem, sock_net(sk)->ipv4.sysctl_tcp_wmem[2]);
 }
 
 /* 2. Tuning advertised window (window_clamp, rcv_ssthresh)
@@ -368,8 +353,8 @@ static int __tcp_grow_window(const struct sock *sk, const struct sk_buff *skb)
 {
         struct tcp_sock *tp = tcp_sk(sk);
         /* Optimize this! */
-        int truesize = tcp_win_from_space(skb->truesize) >> 1;
-        int window = tcp_win_from_space(sysctl_tcp_rmem[2]) >> 1;
+        int truesize = tcp_win_from_space(sk, skb->truesize) >> 1;
+        int window = tcp_win_from_space(sk, sock_net(sk)->ipv4.sysctl_tcp_rmem[2]) >> 1;
 
         while (tp->rcv_ssthresh <= window) {
                 if (truesize <= skb->len)
@@ -394,7 +379,7 @@ static void tcp_grow_window(struct sock *sk, const struct sk_buff *skb)
                 /* Check #2. Increase window, if skb with such overhead
                  * will fit to rcvbuf in future.
                  */
-                if (tcp_win_from_space(skb->truesize) <= skb->len)
+                if (tcp_win_from_space(sk, skb->truesize) <= skb->len)
                         incr = 2 * tp->advmss;
                 else
                         incr = __tcp_grow_window(sk, skb);
@@ -420,11 +405,11 @@ static void tcp_fixup_rcvbuf(struct sock *sk)
         /* Dynamic Right Sizing (DRS) has 2 to 3 RTT latency
          * Allow enough cushion so that sender is not limited by our window
          */
-        if (sysctl_tcp_moderate_rcvbuf)
+        if (sock_net(sk)->ipv4.sysctl_tcp_moderate_rcvbuf)
                 rcvmem <<= 2;
 
         if (sk->sk_rcvbuf < rcvmem)
-                sk->sk_rcvbuf = min(rcvmem, sysctl_tcp_rmem[2]);
+                sk->sk_rcvbuf = min(rcvmem, sock_net(sk)->ipv4.sysctl_tcp_rmem[2]);
 }
 
 /* 4. Try to fixup all. It is made immediately after connection enters
@@ -432,6 +417,7 @@ static void tcp_fixup_rcvbuf(struct sock *sk)
  */
 void tcp_init_buffer_space(struct sock *sk)
 {
+        int tcp_app_win = sock_net(sk)->ipv4.sysctl_tcp_app_win;
         struct tcp_sock *tp = tcp_sk(sk);
         int maxwin;
 
@@ -450,14 +436,14 @@ void tcp_init_buffer_space(struct sock *sk)
         if (tp->window_clamp >= maxwin) {
                 tp->window_clamp = maxwin;
 
-                if (sysctl_tcp_app_win && maxwin > 4 * tp->advmss)
+                if (tcp_app_win && maxwin > 4 * tp->advmss)
                         tp->window_clamp = max(maxwin -
-                                               (maxwin >> sysctl_tcp_app_win),
+                                               (maxwin >> tcp_app_win),
                                                4 * tp->advmss);
         }
 
         /* Force reservation of one segment. */
-        if (sysctl_tcp_app_win &&
+        if (tcp_app_win &&
             tp->window_clamp > 2 * tp->advmss &&
             tp->window_clamp + tp->advmss > maxwin)
                 tp->window_clamp = max(2 * tp->advmss, maxwin - tp->advmss);
@@ -471,15 +457,16 @@ static void tcp_clamp_window(struct sock *sk)
 {
         struct tcp_sock *tp = tcp_sk(sk);
         struct inet_connection_sock *icsk = inet_csk(sk);
+        struct net *net = sock_net(sk);
 
         icsk->icsk_ack.quick = 0;
 
-        if (sk->sk_rcvbuf < sysctl_tcp_rmem[2] &&
+        if (sk->sk_rcvbuf < net->ipv4.sysctl_tcp_rmem[2] &&
             !(sk->sk_userlocks & SOCK_RCVBUF_LOCK) &&
             !tcp_under_memory_pressure(sk) &&
             sk_memory_allocated(sk) < sk_prot_mem_limits(sk, 0)) {
                 sk->sk_rcvbuf = min(atomic_read(&sk->sk_rmem_alloc),
-                                    sysctl_tcp_rmem[2]);
+                                    net->ipv4.sysctl_tcp_rmem[2]);
         }
         if (atomic_read(&sk->sk_rmem_alloc) > sk->sk_rcvbuf)
                 tp->rcv_ssthresh = min(tp->window_clamp, 2U * tp->advmss);
@@ -610,7 +597,7 @@ void tcp_rcv_space_adjust(struct sock *sk)
          * <prev RTT . ><current RTT .. ><next RTT .... >
          */
 
-        if (sysctl_tcp_moderate_rcvbuf &&
+        if (sock_net(sk)->ipv4.sysctl_tcp_moderate_rcvbuf &&
             !(sk->sk_userlocks & SOCK_RCVBUF_LOCK)) {
                 int rcvwin, rcvmem, rcvbuf;
 
@@ -634,10 +621,11 @@ void tcp_rcv_space_adjust(struct sock *sk)
                 }
 
                 rcvmem = SKB_TRUESIZE(tp->advmss + MAX_TCP_HEADER);
-                while (tcp_win_from_space(rcvmem) < tp->advmss)
+                while (tcp_win_from_space(sk, rcvmem) < tp->advmss)
                         rcvmem += 128;
 
-                rcvbuf = min(rcvwin / tp->advmss * rcvmem, sysctl_tcp_rmem[2]);
+                rcvbuf = min(rcvwin / tp->advmss * rcvmem,
+                             sock_net(sk)->ipv4.sysctl_tcp_rmem[2]);
                 if (rcvbuf > sk->sk_rcvbuf) {
                         sk->sk_rcvbuf = rcvbuf;
 
@@ -781,15 +769,6 @@ static void tcp_rtt_estimator(struct sock *sk, long mrtt_us)
         tp->srtt_us = max(1U, srtt);
 }
 
-/* Set the sk_pacing_rate to allow proper sizing of TSO packets.
- * Note: TCP stack does not yet implement pacing.
- * FQ packet scheduler can be used to implement cheap but effective
- * TCP pacing, to smooth the burst on large writes when packets
- * in flight is significantly lower than cwnd (or rwin)
- */
-int sysctl_tcp_pacing_ss_ratio __read_mostly = 200;
-int sysctl_tcp_pacing_ca_ratio __read_mostly = 120;
-
 static void tcp_update_pacing_rate(struct sock *sk)
 {
         const struct tcp_sock *tp = tcp_sk(sk);
@@ -807,9 +786,9 @@ static void tcp_update_pacing_rate(struct sock *sk)
          *       end of slow start and should slow down.
          */
         if (tp->snd_cwnd < tp->snd_ssthresh / 2)
-                rate *= sysctl_tcp_pacing_ss_ratio;
+                rate *= sock_net(sk)->ipv4.sysctl_tcp_pacing_ss_ratio;
         else
-                rate *= sysctl_tcp_pacing_ca_ratio;
+                rate *= sock_net(sk)->ipv4.sysctl_tcp_pacing_ca_ratio;
 
         rate *= max(tp->snd_cwnd, tp->packets_out);
 
@@ -863,60 +842,46 @@ __u32 tcp_init_cwnd(const struct tcp_sock *tp, const struct dst_entry *dst)
         return min_t(__u32, cwnd, tp->snd_cwnd_clamp);
 }
 
-/*
- * Packet counting of FACK is based on in-order assumptions, therefore TCP
- * disables it when reordering is detected
- */
-void tcp_disable_fack(struct tcp_sock *tp)
-{
-        /* RFC3517 uses different metric in lost marker => reset on change */
-        if (tcp_is_fack(tp))
-                tp->lost_skb_hint = NULL;
-        tp->rx_opt.sack_ok &= ~TCP_FACK_ENABLED;
-}
-
 /* Take a notice that peer is sending D-SACKs */
 static void tcp_dsack_seen(struct tcp_sock *tp)
 {
         tp->rx_opt.sack_ok |= TCP_DSACK_SEEN;
+        tp->rack.dsack_seen = 1;
 }
 
-static void tcp_update_reordering(struct sock *sk, const int metric,
-                                  const int ts)
+/* It's reordering when higher sequence was delivered (i.e. sacked) before
+ * some lower never-retransmitted sequence ("low_seq"). The maximum reordering
+ * distance is approximated in full-mss packet distance ("reordering").
+ */
+static void tcp_check_sack_reordering(struct sock *sk, const u32 low_seq,
+                                      const int ts)
 {
         struct tcp_sock *tp = tcp_sk(sk);
-        int mib_idx;
+        const u32 mss = tp->mss_cache;
+        u32 fack, metric;
 
-        if (WARN_ON_ONCE(metric < 0))
+        fack = tcp_highest_sack_seq(tp);
+        if (!before(low_seq, fack))
                 return;
 
-        if (metric > tp->reordering) {
-                tp->reordering = min(sysctl_tcp_max_reordering, metric);
-
+        metric = fack - low_seq;
+        if ((metric > tp->reordering * mss) && mss) {
 #if FASTRETRANS_DEBUG > 1
                 pr_debug("Disorder%d %d %u f%u s%u rr%d\n",
                          tp->rx_opt.sack_ok, inet_csk(sk)->icsk_ca_state,
                          tp->reordering,
-                         tp->fackets_out,
+                         0,
                          tp->sacked_out,
                          tp->undo_marker ? tp->undo_retrans : 0);
 #endif
-                tcp_disable_fack(tp);
+                tp->reordering = min_t(u32, (metric + mss - 1) / mss,
+                                       sock_net(sk)->ipv4.sysctl_tcp_max_reordering);
         }
 
         tp->rack.reord = 1;
-
         /* This exciting event is worth to be remembered. 8) */
-        if (ts)
-                mib_idx = LINUX_MIB_TCPTSREORDER;
-        else if (tcp_is_reno(tp))
-                mib_idx = LINUX_MIB_TCPRENOREORDER;
-        else if (tcp_is_fack(tp))
-                mib_idx = LINUX_MIB_TCPFACKREORDER;
-        else
-                mib_idx = LINUX_MIB_TCPSACKREORDER;
-
-        NET_INC_STATS(sock_net(sk), mib_idx);
+        NET_INC_STATS(sock_net(sk),
+                      ts ? LINUX_MIB_TCPTSREORDER : LINUX_MIB_TCPSACKREORDER);
 }
 
 /* This must be called before lost_out is incremented */
@@ -990,7 +955,6 @@ void tcp_skb_mark_lost_uncond_verify(struct tcp_sock *tp, struct sk_buff *skb)
  * 3. Loss detection event of two flavors:
  *      A. Scoreboard estimator decided the packet is lost.
  *         A'. Reno "three dupacks" marks head of queue lost.
- *         A''. Its FACK modification, head until snd.fack is lost.
  *      B. SACK arrives sacking SND.NXT at the moment, when the
  *         segment was retransmitted.
  * 4. D-SACK added new rule: D-SACK changes any tag to S.
@@ -1133,8 +1097,7 @@ static bool tcp_check_dsack(struct sock *sk, const struct sk_buff *ack_skb,
 }
 
 struct tcp_sacktag_state {
-        int     reord;
-        int     fack_count;
+        u32     reord;
         /* Timestamps for earliest and latest never-retransmitted segment
          * that was SACKed. RTO needs the earliest RTT to stay conservative,
          * but congestion control should still get an accurate delay signal.
@@ -1143,6 +1106,7 @@ struct tcp_sacktag_state {
         u64     last_sackt;
         struct rate_sample *rate;
         int     flag;
+        unsigned int mss_now;
 };
 
 /* Check if skb is fully within the SACK block. In presence of GSO skbs,
@@ -1192,7 +1156,8 @@ static int tcp_match_skb_to_sack(struct sock *sk, struct sk_buff *skb,
                 if (pkt_len >= skb->len && !in_sack)
                         return 0;
 
-                err = tcp_fragment(sk, skb, pkt_len, mss, GFP_ATOMIC);
+                err = tcp_fragment(sk, TCP_FRAG_IN_RTX_QUEUE, skb,
+                                   pkt_len, mss, GFP_ATOMIC);
                 if (err < 0)
                         return err;
         }
@@ -1208,15 +1173,15 @@ static u8 tcp_sacktag_one(struct sock *sk,
                           u64 xmit_time)
 {
         struct tcp_sock *tp = tcp_sk(sk);
-        int fack_count = state->fack_count;
 
         /* Account D-SACK for retransmitted packet. */
         if (dup_sack && (sacked & TCPCB_RETRANS)) {
                 if (tp->undo_marker && tp->undo_retrans > 0 &&
                     after(end_seq, tp->undo_marker))
                         tp->undo_retrans--;
-                if (sacked & TCPCB_SACKED_ACKED)
-                        state->reord = min(fack_count, state->reord);
+                if ((sacked & TCPCB_SACKED_ACKED) &&
+                    before(start_seq, state->reord))
+                                state->reord = start_seq;
         }
 
         /* Nothing to do; acked frame is about to be dropped (was ACKed). */
@@ -1242,9 +1207,10 @@ static u8 tcp_sacktag_one(struct sock *sk,
                                  * which was in hole. It is reordering.
                                  */
                                 if (before(start_seq,
-                                           tcp_highest_sack_seq(tp)))
-                                        state->reord = min(fack_count,
-                                                           state->reord);
+                                           tcp_highest_sack_seq(tp)) &&
+                                    before(start_seq, state->reord))
+                                        state->reord = start_seq;
+
                                 if (!after(end_seq, tp->high_seq))
                                         state->flag |= FLAG_ORIG_SACK_ACKED;
                                 if (state->first_sackt == 0)
@@ -1263,15 +1229,10 @@ static u8 tcp_sacktag_one(struct sock *sk,
                 tp->sacked_out += pcount;
                 tp->delivered += pcount;  /* Out-of-order packets delivered */
 
-                fack_count += pcount;
-
                 /* Lost marker hint past SACKed? Tweak RFC3517 cnt */
-                if (!tcp_is_fack(tp) && tp->lost_skb_hint &&
+                if (tp->lost_skb_hint &&
                     before(start_seq, TCP_SKB_CB(tp->lost_skb_hint)->seq))
                         tp->lost_cnt_hint += pcount;
-
-                if (fack_count > tp->fackets_out)
-                        tp->fackets_out = fack_count;
         }
 
         /* D-SACK. We can detect redundant retransmission in S|R and plain R
@@ -1289,13 +1250,13 @@ static u8 tcp_sacktag_one(struct sock *sk,
 /* Shift newly-SACKed bytes from this skb to the immediately previous
  * already-SACKed sk_buff. Mark the newly-SACKed bytes as such.
  */
-static bool tcp_shifted_skb(struct sock *sk, struct sk_buff *skb,
+static bool tcp_shifted_skb(struct sock *sk, struct sk_buff *prev,
+                            struct sk_buff *skb,
                             struct tcp_sacktag_state *state,
                             unsigned int pcount, int shifted, int mss,
                             bool dup_sack)
 {
         struct tcp_sock *tp = tcp_sk(sk);
-        struct sk_buff *prev = tcp_write_queue_prev(sk, skb);
         u32 start_seq = TCP_SKB_CB(skb)->seq;   /* start of newly-SACKed */
         u32 end_seq = start_seq + shifted;      /* end of newly-SACKed */
 
@@ -1364,8 +1325,7 @@ static bool tcp_shifted_skb(struct sock *sk, struct sk_buff *skb,
         if (unlikely(TCP_SKB_CB(prev)->tx.delivered_mstamp))
                 TCP_SKB_CB(prev)->tx.delivered_mstamp = 0;
 
-        tcp_unlink_write_queue(skb, sk);
-        sk_wmem_free_skb(sk, skb);
+        tcp_rtx_queue_unlink_and_free(skb, sk);
 
         NET_INC_STATS(sock_net(sk), LINUX_MIB_SACKMERGED);
 
@@ -1415,9 +1375,9 @@ static struct sk_buff *tcp_shift_skb_data(struct sock *sk, struct sk_buff *skb,
                 goto fallback;
 
         /* Can only happen with delayed DSACK + discard craziness */
-        if (unlikely(skb == tcp_write_queue_head(sk)))
+        prev = skb_rb_prev(skb);
+        if (!prev)
                 goto fallback;
-        prev = tcp_write_queue_prev(sk, skb);
 
         if ((TCP_SKB_CB(prev)->sacked & TCPCB_TAGBITS) != TCPCB_SACKED_ACKED)
                 goto fallback;
@@ -1496,18 +1456,17 @@ static struct sk_buff *tcp_shift_skb_data(struct sock *sk, struct sk_buff *skb,
 
         if (!skb_shift(prev, skb, len))
                 goto fallback;
-        if (!tcp_shifted_skb(sk, skb, state, pcount, len, mss, dup_sack))
+        if (!tcp_shifted_skb(sk, prev, skb, state, pcount, len, mss, dup_sack))
                 goto out;
 
         /* Hole filled allows collapsing with the next as well, this is very
          * useful when hole on every nth skb pattern happens
          */
-        if (prev == tcp_write_queue_tail(sk))
+        skb = skb_rb_next(prev);
+        if (!skb)
                 goto out;
-        skb = tcp_write_queue_next(sk, prev);
 
         if (!skb_can_shift(skb) ||
-            (skb == tcp_send_head(sk)) ||
             ((TCP_SKB_CB(skb)->sacked & TCPCB_TAGBITS) != TCPCB_SACKED_ACKED) ||
             (mss != tcp_skb_seglen(skb)))
                 goto out;
@@ -1515,11 +1474,11 @@ static struct sk_buff *tcp_shift_skb_data(struct sock *sk, struct sk_buff *skb,
         len = skb->len;
         if (skb_shift(prev, skb, len)) {
                 pcount += tcp_skb_pcount(skb);
-                tcp_shifted_skb(sk, skb, state, tcp_skb_pcount(skb), len, mss, 0);
+                tcp_shifted_skb(sk, prev, skb, state, tcp_skb_pcount(skb),
+                                len, mss, 0);
         }
 
 out:
-        state->fack_count += pcount;
         return prev;
 
 noop:
@@ -1539,13 +1498,10 @@ static struct sk_buff *tcp_sacktag_walk(struct sk_buff *skb, struct sock *sk,
         struct tcp_sock *tp = tcp_sk(sk);
         struct sk_buff *tmp;
 
-        tcp_for_write_queue_from(skb, sk) {
+        skb_rbtree_walk_from(skb) {
                 int in_sack = 0;
                 bool dup_sack = dup_sack_in;
 
-                if (skb == tcp_send_head(sk))
-                        break;
-
                 /* queue is in-order => we can short-circuit the walk early */
                 if (!before(TCP_SKB_CB(skb)->seq, end_seq))
                         break;
@@ -1594,34 +1550,48 @@ static struct sk_buff *tcp_sacktag_walk(struct sk_buff *skb, struct sock *sk,
                                                 tcp_skb_pcount(skb),
                                                 skb->skb_mstamp);
                         tcp_rate_skb_delivered(sk, skb, state->rate);
+                        if (TCP_SKB_CB(skb)->sacked & TCPCB_SACKED_ACKED)
+                                list_del_init(&skb->tcp_tsorted_anchor);
 
                         if (!before(TCP_SKB_CB(skb)->seq,
                                     tcp_highest_sack_seq(tp)))
                                 tcp_advance_highest_sack(sk, skb);
                 }
-
-                state->fack_count += tcp_skb_pcount(skb);
         }
         return skb;
 }
 
-/* Avoid all extra work that is being done by sacktag while walking in
- * a normal way
- */
+static struct sk_buff *tcp_sacktag_bsearch(struct sock *sk,
+                                           struct tcp_sacktag_state *state,
+                                           u32 seq)
+{
+        struct rb_node *parent, **p = &sk->tcp_rtx_queue.rb_node;
+        struct sk_buff *skb;
+
+        while (*p) {
+                parent = *p;
+                skb = rb_to_skb(parent);
+                if (before(seq, TCP_SKB_CB(skb)->seq)) {
+                        p = &parent->rb_left;
+                        continue;
+                }
+                if (!before(seq, TCP_SKB_CB(skb)->end_seq)) {
+                        p = &parent->rb_right;
+                        continue;
+                }
+                return skb;
+        }
+        return NULL;
+}
+
 static struct sk_buff *tcp_sacktag_skip(struct sk_buff *skb, struct sock *sk,
                                         struct tcp_sacktag_state *state,
                                         u32 skip_to_seq)
 {
-        tcp_for_write_queue_from(skb, sk) {
-                if (skb == tcp_send_head(sk))
-                        break;
-
-                if (after(TCP_SKB_CB(skb)->end_seq, skip_to_seq))
-                        break;
+        if (skb && after(TCP_SKB_CB(skb)->seq, skip_to_seq))
+                return skb;
 
-                state->fack_count += tcp_skb_pcount(skb);
-        }
-        return skb;
+        return tcp_sacktag_bsearch(sk, state, skip_to_seq);
 }
 
 static struct sk_buff *tcp_maybe_skipping_dsack(struct sk_buff *skb,
@@ -1666,13 +1636,10 @@ tcp_sacktag_write_queue(struct sock *sk, const struct sk_buff *ack_skb,
         int first_sack_index;
 
         state->flag = 0;
-        state->reord = tp->packets_out;
+        state->reord = tp->snd_nxt;
 
-        if (!tp->sacked_out) {
-                if (WARN_ON(tp->fackets_out))
-                        tp->fackets_out = 0;
+        if (!tp->sacked_out)
                 tcp_highest_sack_reset(sk);
-        }
 
         found_dup_sack = tcp_check_dsack(sk, ack_skb, sp_wire,
                                          num_sacks, prior_snd_una);
@@ -1743,8 +1710,8 @@ tcp_sacktag_write_queue(struct sock *sk, const struct sk_buff *ack_skb,
                 }
         }
 
-        skb = tcp_write_queue_head(sk);
-        state->fack_count = 0;
+        state->mss_now = tcp_current_mss(sk);
+        skb = NULL;
         i = 0;
 
         if (!tp->sacked_out) {
@@ -1801,7 +1768,6 @@ tcp_sacktag_write_queue(struct sock *sk, const struct sk_buff *ack_skb,
                                 skb = tcp_highest_sack(sk);
                                 if (!skb)
                                         break;
-                                state->fack_count = tp->fackets_out;
                                 cache++;
                                 goto walk;
                         }
@@ -1816,7 +1782,6 @@ tcp_sacktag_write_queue(struct sock *sk, const struct sk_buff *ack_skb,
                         skb = tcp_highest_sack(sk);
                         if (!skb)
                                 break;
-                        state->fack_count = tp->fackets_out;
                 }
                 skb = tcp_sacktag_skip(skb, sk, state, start_seq);
 
@@ -1836,9 +1801,8 @@ advance_sp:
         for (j = 0; j < used_sacks; j++)
                 tp->recv_sack_cache[i++] = sp[j];
 
-        if ((state->reord < tp->fackets_out) &&
-            ((inet_csk(sk)->icsk_ca_state != TCP_CA_Loss) || tp->undo_marker))
-                tcp_update_reordering(sk, tp->fackets_out - state->reord, 0);
+        if (inet_csk(sk)->icsk_ca_state != TCP_CA_Loss || tp->undo_marker)
+                tcp_check_sack_reordering(sk, state->reord, 0);
 
         tcp_verify_left_out(tp);
 out:
@@ -1876,8 +1840,13 @@ static bool tcp_limit_reno_sacked(struct tcp_sock *tp)
 static void tcp_check_reno_reordering(struct sock *sk, const int addend)
 {
         struct tcp_sock *tp = tcp_sk(sk);
-        if (tcp_limit_reno_sacked(tp))
-                tcp_update_reordering(sk, tp->packets_out + addend, 0);
+
+        if (!tcp_limit_reno_sacked(tp))
+                return;
+
+        tp->reordering = min_t(u32, tp->packets_out + addend,
+                               sock_net(sk)->ipv4.sysctl_tcp_max_reordering);
+        NET_INC_STATS(sock_net(sk), LINUX_MIB_TCPRENOREORDER);
 }
 
 /* Emulate SACKs for SACKless connection: account for a new dupack. */
@@ -1923,7 +1892,6 @@ void tcp_clear_retrans(struct tcp_sock *tp)
         tp->lost_out = 0;
         tp->undo_marker = 0;
         tp->undo_retrans = -1;
-        tp->fackets_out = 0;
         tp->sacked_out = 0;
 }
 
@@ -1968,19 +1936,15 @@ void tcp_enter_loss(struct sock *sk)
         if (tcp_is_reno(tp))
                 tcp_reset_reno_sack(tp);
 
-        skb = tcp_write_queue_head(sk);
+        skb = tcp_rtx_queue_head(sk);
         is_reneg = skb && (TCP_SKB_CB(skb)->sacked & TCPCB_SACKED_ACKED);
         if (is_reneg) {
                 NET_INC_STATS(sock_net(sk), LINUX_MIB_TCPSACKRENEGING);
                 tp->sacked_out = 0;
-                tp->fackets_out = 0;
         }
         tcp_clear_all_retrans_hints(tp);
 
-        tcp_for_write_queue(skb, sk) {
-                if (skb == tcp_send_head(sk))
-                        break;
-
+        skb_rbtree_walk_from(skb) {
                 mark_lost = (!(TCP_SKB_CB(skb)->sacked & TCPCB_SACKED_ACKED) ||
                              is_reneg);
                 if (mark_lost)
@@ -2014,7 +1978,7 @@ void tcp_enter_loss(struct sock *sk)
          * falsely raise the receive window, which results in repeated
          * timeouts and stop-and-go behavior.
          */
-        tp->frto = sysctl_tcp_frto &&
+        tp->frto = net->ipv4.sysctl_tcp_frto &&
                    (new_recovery || icsk->icsk_retransmits) &&
                    !inet_csk(sk)->icsk_mtup.probe_size;
 }
@@ -2043,19 +2007,10 @@ static bool tcp_check_sack_reneging(struct sock *sk, int flag)
         return false;
 }
 
-static inline int tcp_fackets_out(const struct tcp_sock *tp)
-{
-        return tcp_is_reno(tp) ? tp->sacked_out + 1 : tp->fackets_out;
-}
-
 /* Heurestics to calculate number of duplicate ACKs. There's no dupACKs
  * counter when SACK is enabled (without SACK, sacked_out is used for
  * that purpose).
  *
- * Instead, with FACK TCP uses fackets_out that includes both SACKed
- * segments up to the highest received SACK block so far and holes in
- * between them.
- *
  * With reordering, holes may still be in flight, so RFC3517 recovery
  * uses pure sacked_out (total number of SACKed segments) even though
  * it violates the RFC that uses duplicate ACKs, often these are equal
@@ -2065,10 +2020,10 @@ static inline int tcp_fackets_out(const struct tcp_sock *tp)
  */
 static inline int tcp_dupack_heuristics(const struct tcp_sock *tp)
 {
-        return tcp_is_fack(tp) ? tp->fackets_out : tp->sacked_out + 1;
+        return tp->sacked_out + 1;
 }
 
-/* Linux NewReno/SACK/FACK/ECN state machine.
+/* Linux NewReno/SACK/ECN state machine.
  * --------------------------------------
  *
  * "Open"       Normal state, no dubious events, fast path.
@@ -2133,16 +2088,6 @@ static inline int tcp_dupack_heuristics(const struct tcp_sock *tp)
  *              dynamically measured and adjusted. This is implemented in
  *              tcp_rack_mark_lost.
  *
- *              FACK (Disabled by default. Subsumbed by RACK):
- *              It is the simplest heuristics. As soon as we decided
- *              that something is lost, we decide that _all_ not SACKed
- *              packets until the most forward SACK are lost. I.e.
- *              lost_out = fackets_out - sacked_out and left_out = fackets_out.
- *              It is absolutely correct estimate, if network does not reorder
- *              packets. And it loses any connection to reality when reordering
- *              takes place. We use FACK by default until reordering
- *              is suspected on the path to this destination.
- *
  *              If the receiver does not support SACK:
  *
  *              NewReno (RFC6582): in Recovery we assume that one segment
@@ -2191,7 +2136,7 @@ static bool tcp_time_to_recover(struct sock *sk, int flag)
 }
 
 /* Detect loss in event "A" above by marking head of queue up as lost.
- * For FACK or non-SACK(Reno) senders, the first "packets" number of segments
+ * For non-SACK(Reno) senders, the first "packets" number of segments
  * are considered lost. For RFC3517 SACK, a segment is considered lost if it
  * has at least tp->reordering SACKed seqments above it; "packets" refers to
  * the maximum SACKed segments to pass before reaching this limit.
@@ -2206,20 +2151,18 @@ static void tcp_mark_head_lost(struct sock *sk, int packets, int mark_head)
         const u32 loss_high = tcp_is_sack(tp) ?  tp->snd_nxt : tp->high_seq;
 
         WARN_ON(packets > tp->packets_out);
-        if (tp->lost_skb_hint) {
-                skb = tp->lost_skb_hint;
-                cnt = tp->lost_cnt_hint;
+        skb = tp->lost_skb_hint;
+        if (skb) {
                 /* Head already handled? */
-                if (mark_head && skb != tcp_write_queue_head(sk))
+                if (mark_head && after(TCP_SKB_CB(skb)->seq, tp->snd_una))
                         return;
+                cnt = tp->lost_cnt_hint;
         } else {
-                skb = tcp_write_queue_head(sk);
+                skb = tcp_rtx_queue_head(sk);
                 cnt = 0;
         }
 
-        tcp_for_write_queue_from(skb, sk) {
-                if (skb == tcp_send_head(sk))
-                        break;
+        skb_rbtree_walk_from(skb) {
                 /* TODO: do this better */
                 /* this is not the most efficient way to do this... */
                 tp->lost_skb_hint = skb;
@@ -2229,12 +2172,12 @@ static void tcp_mark_head_lost(struct sock *sk, int packets, int mark_head)
                         break;
 
                 oldcnt = cnt;
-                if (tcp_is_fack(tp) || tcp_is_reno(tp) ||
+                if (tcp_is_reno(tp) ||
                     (TCP_SKB_CB(skb)->sacked & TCPCB_SACKED_ACKED))
                         cnt += tcp_skb_pcount(skb);
 
                 if (cnt > packets) {
-                        if ((tcp_is_sack(tp) && !tcp_is_fack(tp)) ||
+                        if (tcp_is_sack(tp) ||
                             (TCP_SKB_CB(skb)->sacked & TCPCB_SACKED_ACKED) ||
                             (oldcnt >= packets))
                                 break;
@@ -2243,7 +2186,8 @@ static void tcp_mark_head_lost(struct sock *sk, int packets, int mark_head)
                         /* If needed, chop off the prefix to mark as lost. */
                         lost = (packets - oldcnt) * mss;
                         if (lost < skb->len &&
-                            tcp_fragment(sk, skb, lost, mss, GFP_ATOMIC) < 0)
+                            tcp_fragment(sk, TCP_FRAG_IN_RTX_QUEUE, skb,
+                                         lost, mss, GFP_ATOMIC) < 0)
                                 break;
                         cnt = packets;
                 }
@@ -2264,11 +2208,6 @@ static void tcp_update_scoreboard(struct sock *sk, int fast_rexmit)
 
         if (tcp_is_reno(tp)) {
                 tcp_mark_head_lost(sk, 1, 1);
-        } else if (tcp_is_fack(tp)) {
-                int lost = tp->fackets_out - tp->reordering;
-                if (lost <= 0)
-                        lost = 1;
-                tcp_mark_head_lost(sk, lost, 0);
         } else {
                 int sacked_upto = tp->sacked_out - tp->reordering;
                 if (sacked_upto >= 0)
@@ -2327,16 +2266,16 @@ static bool tcp_any_retrans_done(const struct sock *sk)
         if (tp->retrans_out)
                 return true;
 
-        skb = tcp_write_queue_head(sk);
+        skb = tcp_rtx_queue_head(sk);
         if (unlikely(skb && TCP_SKB_CB(skb)->sacked & TCPCB_EVER_RETRANS))
                 return true;
 
         return false;
 }
 
-#if FASTRETRANS_DEBUG > 1
 static void DBGUNDO(struct sock *sk, const char *msg)
 {
+#if FASTRETRANS_DEBUG > 1
         struct tcp_sock *tp = tcp_sk(sk);
         struct inet_sock *inet = inet_sk(sk);
 
@@ -2358,10 +2297,8 @@ static void DBGUNDO(struct sock *sk, const char *msg)
                          tp->packets_out);
         }
 #endif
-}
-#else
-#define DBGUNDO(x...) do { } while (0)
 #endif
+}
 
 static void tcp_undo_cwnd_reduction(struct sock *sk, bool unmark_loss)
 {
@@ -2370,9 +2307,7 @@ static void tcp_undo_cwnd_reduction(struct sock *sk, bool unmark_loss)
         if (unmark_loss) {
                 struct sk_buff *skb;
 
-                tcp_for_write_queue(skb, sk) {
-                        if (skb == tcp_send_head(sk))
-                                break;
+                skb_rbtree_walk(skb, &sk->tcp_rtx_queue) {
                         TCP_SKB_CB(skb)->sacked &= ~TCPCB_LOST;
                 }
                 tp->lost_out = 0;
@@ -2417,6 +2352,8 @@ static bool tcp_try_undo_recovery(struct sock *sk)
                         mib_idx = LINUX_MIB_TCPFULLUNDO;
 
                 NET_INC_STATS(sock_net(sk), mib_idx);
+        } else if (tp->rack.reo_wnd_persist) {
+                tp->rack.reo_wnd_persist--;
         }
         if (tp->snd_una == tp->high_seq && tcp_is_reno(tp)) {
                 /* Hold old state until something *above* high_seq
@@ -2436,6 +2373,8 @@ static bool tcp_try_undo_dsack(struct sock *sk)
         struct tcp_sock *tp = tcp_sk(sk);
 
         if (tp->undo_marker && !tp->undo_retrans) {
+                tp->rack.reo_wnd_persist = min(TCP_RACK_RECOVERY_THRESH,
+                                               tp->rack.reo_wnd_persist + 1);
                 DBGUNDO(sk, "D-SACK");
                 tcp_undo_cwnd_reduction(sk, false);
                 NET_INC_STATS(sock_net(sk), LINUX_MIB_TCPDSACKUNDO);
@@ -2616,9 +2555,7 @@ void tcp_simple_retransmit(struct sock *sk)
         struct sk_buff *skb;
         unsigned int mss = tcp_current_mss(sk);
 
-        tcp_for_write_queue(skb, sk) {
-                if (skb == tcp_send_head(sk))
-                        break;
+        skb_rbtree_walk(skb, &sk->tcp_rtx_queue) {
                 if (tcp_skb_seglen(skb) > mss &&
                     !(TCP_SKB_CB(skb)->sacked & TCPCB_SACKED_ACKED)) {
                         if (TCP_SKB_CB(skb)->sacked & TCPCB_SACKED_RETRANS) {
@@ -2712,7 +2649,7 @@ static void tcp_process_loss(struct sock *sk, int flag, bool is_dupack,
                          * is updated in tcp_ack()). Otherwise fall back to
                          * the conventional recovery.
                          */
-                        if (tcp_send_head(sk) &&
+                        if (!tcp_write_queue_empty(sk) &&
                             after(tcp_wnd_end(tp), tp->snd_nxt)) {
                                 *rexmit = REXMIT_NEW;
                                 return;
@@ -2739,15 +2676,15 @@ static void tcp_process_loss(struct sock *sk, int flag, bool is_dupack,
 }
 
 /* Undo during fast recovery after partial ACK. */
-static bool tcp_try_undo_partial(struct sock *sk, const int acked)
+static bool tcp_try_undo_partial(struct sock *sk, u32 prior_snd_una)
 {
         struct tcp_sock *tp = tcp_sk(sk);
 
         if (tp->undo_marker && tcp_packet_delayed(tp)) {
                 /* Plain luck! Hole if filled with delayed
-                 * packet, rather than with a retransmit.
+                 * packet, rather than with a retransmit. Check reordering.
                  */
-                tcp_update_reordering(sk, tcp_fackets_out(tp) + acked, 1);
+                tcp_check_sack_reordering(sk, prior_snd_una, 1);
 
                 /* We are getting evidence that the reordering degree is higher
                  * than we realized. If there are no retransmits out then we
@@ -2774,7 +2711,7 @@ static void tcp_rack_identify_loss(struct sock *sk, int *ack_flag)
         struct tcp_sock *tp = tcp_sk(sk);
 
         /* Use RACK to detect loss */
-        if (sysctl_tcp_recovery & TCP_RACK_LOSS_DETECTION) {
+        if (sock_net(sk)->ipv4.sysctl_tcp_recovery & TCP_RACK_LOSS_DETECTION) {
                 u32 prior_retrans = tp->retrans_out;
 
                 tcp_rack_mark_lost(sk);
@@ -2783,6 +2720,14 @@ static void tcp_rack_identify_loss(struct sock *sk, int *ack_flag)
         }
 }
 
+static bool tcp_force_fast_retransmit(struct sock *sk)
+{
+        struct tcp_sock *tp = tcp_sk(sk);
+
+        return after(tcp_highest_sack_seq(tp),
+                     tp->snd_una + tp->reordering * tp->mss_cache);
+}
+
 /* Process an event, which can update packets-in-flight not trivially.
  * Main goal of this function is to calculate new estimate for left_out,
  * taking into account both packets sitting in receiver's buffer and
@@ -2795,19 +2740,17 @@ static void tcp_rack_identify_loss(struct sock *sk, int *ack_flag)
  * It does _not_ decide what to send, it is made in function
  * tcp_xmit_retransmit_queue().
  */
-static void tcp_fastretrans_alert(struct sock *sk, const int acked,
+static void tcp_fastretrans_alert(struct sock *sk, const u32 prior_snd_una,
                                   bool is_dupack, int *ack_flag, int *rexmit)
 {
         struct inet_connection_sock *icsk = inet_csk(sk);
         struct tcp_sock *tp = tcp_sk(sk);
         int fast_rexmit = 0, flag = *ack_flag;
         bool do_lost = is_dupack || ((flag & FLAG_DATA_SACKED) &&
-                                    (tcp_fackets_out(tp) > tp->reordering));
+                                     tcp_force_fast_retransmit(sk));
 
-        if (WARN_ON(!tp->packets_out && tp->sacked_out))
+        if (!tp->packets_out && tp->sacked_out)
                 tp->sacked_out = 0;
-        if (WARN_ON(!tp->sacked_out && tp->fackets_out))
-                tp->fackets_out = 0;
 
         /* Now state machine starts.
          * A. ECE, hence prohibit cwnd undoing, the reduction is required. */
@@ -2854,11 +2797,11 @@ static void tcp_fastretrans_alert(struct sock *sk, const int acked,
                         if (tcp_is_reno(tp) && is_dupack)
                                 tcp_add_reno_sack(sk);
                 } else {
-                        if (tcp_try_undo_partial(sk, acked))
+                        if (tcp_try_undo_partial(sk, prior_snd_una))
                                 return;
                         /* Partial ACK arrived. Force fast retransmit. */
                         do_lost = tcp_is_reno(tp) ||
-                                  tcp_fackets_out(tp) > tp->reordering;
+                                  tcp_force_fast_retransmit(sk);
                 }
                 if (tcp_try_undo_dsack(sk)) {
                         tcp_try_keep_open(sk);
@@ -2873,6 +2816,7 @@ static void tcp_fastretrans_alert(struct sock *sk, const int acked,
                       (*ack_flag & FLAG_LOST_RETRANS)))
                         return;
                 /* Change state if cwnd is undone or retransmits are lost */
+                /* fall through */
         default:
                 if (tcp_is_reno(tp)) {
                         if (flag & FLAG_SND_UNA_ADVANCED)
@@ -2913,8 +2857,8 @@ static void tcp_fastretrans_alert(struct sock *sk, const int acked,
 
 static void tcp_update_rtt_min(struct sock *sk, u32 rtt_us)
 {
+        u32 wlen = sock_net(sk)->ipv4.sysctl_tcp_min_rtt_wlen * HZ;
         struct tcp_sock *tp = tcp_sk(sk);
-        u32 wlen = sysctl_tcp_min_rtt_wlen * HZ;
 
         minmax_running_min(&tp->rtt_min, wlen, tcp_jiffies32,
                            rtt_us ? : jiffies_to_usecs(1));
@@ -3020,7 +2964,7 @@ void tcp_rearm_rto(struct sock *sk)
 /* Try to schedule a loss probe; if that doesn't work, then schedule an RTO. */
 static void tcp_set_xmit_timer(struct sock *sk)
 {
-        if (!tcp_schedule_loss_probe(sk))
+        if (!tcp_schedule_loss_probe(sk, true))
                 tcp_rearm_rto(sk);
 }
 
@@ -3056,28 +3000,31 @@ static void tcp_ack_tstamp(struct sock *sk, struct sk_buff *skb,
 
         shinfo = skb_shinfo(skb);
         if (!before(shinfo->tskey, prior_snd_una) &&
-            before(shinfo->tskey, tcp_sk(sk)->snd_una))
-                __skb_tstamp_tx(skb, NULL, sk, SCM_TSTAMP_ACK);
+            before(shinfo->tskey, tcp_sk(sk)->snd_una)) {
+                tcp_skb_tsorted_save(skb) {
+                        __skb_tstamp_tx(skb, NULL, sk, SCM_TSTAMP_ACK);
+                } tcp_skb_tsorted_restore(skb);
+        }
 }
 
 /* Remove acknowledged frames from the retransmission queue. If our packet
  * is before the ack sequence we can discard it as it's confirmed to have
  * arrived at the other end.
  */
-static int tcp_clean_rtx_queue(struct sock *sk, int prior_fackets,
-                               u32 prior_snd_una, int *acked,
+static int tcp_clean_rtx_queue(struct sock *sk, u32 prior_fack,
+                               u32 prior_snd_una,
                                struct tcp_sacktag_state *sack)
 {
         const struct inet_connection_sock *icsk = inet_csk(sk);
         u64 first_ackt, last_ackt;
         struct tcp_sock *tp = tcp_sk(sk);
         u32 prior_sacked = tp->sacked_out;
-        u32 reord = tp->packets_out;
+        u32 reord = tp->snd_nxt; /* lowest acked un-retx un-sacked seq */
+        struct sk_buff *skb, *next;
         bool fully_acked = true;
         long sack_rtt_us = -1L;
         long seq_rtt_us = -1L;
         long ca_rtt_us = -1L;
-        struct sk_buff *skb;
         u32 pkts_acked = 0;
         u32 last_in_flight = 0;
         bool rtt_update;
@@ -3085,8 +3032,9 @@ static int tcp_clean_rtx_queue(struct sock *sk, int prior_fackets,
 
         first_ackt = 0;
 
-        while ((skb = tcp_write_queue_head(sk)) && skb != tcp_send_head(sk)) {
+        for (skb = skb_rb_first(&sk->tcp_rtx_queue); skb; skb = next) {
                 struct tcp_skb_cb *scb = TCP_SKB_CB(skb);
+                const u32 start_seq = scb->seq;
                 u8 sacked = scb->sacked;
                 u32 acked_pcount;
 
@@ -3103,8 +3051,6 @@ static int tcp_clean_rtx_queue(struct sock *sk, int prior_fackets,
                                 break;
                         fully_acked = false;
                 } else {
-                        /* Speedup tcp_unlink_write_queue() and next loop */
-                        prefetchw(skb->next);
                         acked_pcount = tcp_skb_pcount(skb);
                 }
 
@@ -3119,7 +3065,8 @@ static int tcp_clean_rtx_queue(struct sock *sk, int prior_fackets,
                                 first_ackt = last_ackt;
 
                         last_in_flight = TCP_SKB_CB(skb)->tx.in_flight;
-                        reord = min(pkts_acked, reord);
+                        if (before(start_seq, reord))
+                                reord = start_seq;
                         if (!after(scb->end_seq, tp->high_seq))
                                 flag |= FLAG_ORIG_SACK_ACKED;
                 }
@@ -3156,12 +3103,12 @@ static int tcp_clean_rtx_queue(struct sock *sk, int prior_fackets,
                 if (!fully_acked)
                         break;
 
-                tcp_unlink_write_queue(skb, sk);
-                sk_wmem_free_skb(sk, skb);
+                next = skb_rb_next(skb);
                 if (unlikely(skb == tp->retransmit_skb_hint))
                         tp->retransmit_skb_hint = NULL;
                 if (unlikely(skb == tp->lost_skb_hint))
                         tp->lost_skb_hint = NULL;
+                tcp_rtx_queue_unlink_and_free(skb, sk);
         }
 
         if (!skb)
@@ -3197,16 +3144,12 @@ static int tcp_clean_rtx_queue(struct sock *sk, int prior_fackets,
                         int delta;
 
                         /* Non-retransmitted hole got filled? That's reordering */
-                        if (reord < prior_fackets && reord <= tp->fackets_out)
-                                tcp_update_reordering(sk, tp->fackets_out - reord, 0);
+                        if (before(reord, prior_fack))
+                                tcp_check_sack_reordering(sk, reord, 0);
 
-                        delta = tcp_is_fack(tp) ? pkts_acked :
-                                                  prior_sacked - tp->sacked_out;
+                        delta = prior_sacked - tp->sacked_out;
                         tp->lost_cnt_hint -= min(tp->lost_cnt_hint, delta);
                 }
-
-                tp->fackets_out -= min(pkts_acked, tp->fackets_out);
-
         } else if (skb && rtt_update && sack_rtt_us >= 0 &&
                    sack_rtt_us > tcp_stamp_us_delta(tp->tcp_mstamp, skb->skb_mstamp)) {
                 /* Do not re-arm RTO if the sack RTT is measured from data sent
@@ -3247,18 +3190,19 @@ static int tcp_clean_rtx_queue(struct sock *sk, int prior_fackets,
                 }
         }
 #endif
-        *acked = pkts_acked;
         return flag;
 }
 
 static void tcp_ack_probe(struct sock *sk)
 {
-        const struct tcp_sock *tp = tcp_sk(sk);
         struct inet_connection_sock *icsk = inet_csk(sk);
+        struct sk_buff *head = tcp_send_head(sk);
+        const struct tcp_sock *tp = tcp_sk(sk);
 
         /* Was it a usable window open? */
-
-        if (!after(TCP_SKB_CB(tcp_send_head(sk))->end_seq, tcp_wnd_end(tp))) {
+        if (!head)
+                return;
+        if (!after(TCP_SKB_CB(head)->end_seq, tcp_wnd_end(tp))) {
                 icsk->icsk_backoff = 0;
                 inet_csk_clear_xmit_timer(sk, ICSK_TIME_PROBE0);
                 /* Socket must be waked up by subsequent tcp_data_snd_check().
@@ -3378,7 +3322,7 @@ static int tcp_ack_update_window(struct sock *sk, const struct sk_buff *skb, u32
                         tp->pred_flags = 0;
                         tcp_fast_path_check(sk);
 
-                        if (tcp_send_head(sk))
+                        if (!tcp_write_queue_empty(sk))
                                 tcp_slow_start_after_idle_check(sk);
 
                         if (nwin > tp->max_window) {
@@ -3399,7 +3343,7 @@ static bool __tcp_oow_rate_limited(struct net *net, int mib_idx,
         if (*last_oow_ack_time) {
                 s32 elapsed = (s32)(tcp_jiffies32 - *last_oow_ack_time);
 
-                if (0 <= elapsed && elapsed < sysctl_tcp_invalid_ratelimit) {
+                if (0 <= elapsed && elapsed < net->ipv4.sysctl_tcp_invalid_ratelimit) {
                         NET_INC_STATS(net, mib_idx);
                         return true;    /* rate-limited: don't send yet! */
                 }
@@ -3435,10 +3379,11 @@ static void tcp_send_challenge_ack(struct sock *sk, const struct sk_buff *skb)
         static u32 challenge_timestamp;
         static unsigned int challenge_count;
         struct tcp_sock *tp = tcp_sk(sk);
+        struct net *net = sock_net(sk);
         u32 count, now;
 
         /* First check our per-socket dupack rate limit. */
-        if (__tcp_oow_rate_limited(sock_net(sk),
+        if (__tcp_oow_rate_limited(net,
                                    LINUX_MIB_TCPACKSKIPPEDCHALLENGE,
                                    &tp->last_oow_ack_time))
                 return;
@@ -3446,16 +3391,16 @@ static void tcp_send_challenge_ack(struct sock *sk, const struct sk_buff *skb)
         /* Then check host-wide RFC 5961 rate limit. */
         now = jiffies / HZ;
         if (now != challenge_timestamp) {
-                u32 half = (sysctl_tcp_challenge_ack_limit + 1) >> 1;
+                u32 ack_limit = net->ipv4.sysctl_tcp_challenge_ack_limit;
+                u32 half = (ack_limit + 1) >> 1;
 
                 challenge_timestamp = now;
-                WRITE_ONCE(challenge_count, half +
-                           prandom_u32_max(sysctl_tcp_challenge_ack_limit));
+                WRITE_ONCE(challenge_count, half + prandom_u32_max(ack_limit));
         }
         count = READ_ONCE(challenge_count);
         if (count > 0) {
                 WRITE_ONCE(challenge_count, count - 1);
-                NET_INC_STATS(sock_net(sk), LINUX_MIB_TCPCHALLENGEACK);
+                NET_INC_STATS(net, LINUX_MIB_TCPCHALLENGEACK);
                 tcp_send_ack(sk);
         }
 }
@@ -3553,18 +3498,17 @@ static int tcp_ack(struct sock *sk, const struct sk_buff *skb, int flag)
         u32 ack_seq = TCP_SKB_CB(skb)->seq;
         u32 ack = TCP_SKB_CB(skb)->ack_seq;
         bool is_dupack = false;
-        u32 prior_fackets;
         int prior_packets = tp->packets_out;
         u32 delivered = tp->delivered;
         u32 lost = tp->lost;
-        int acked = 0; /* Number of packets newly acked */
         int rexmit = REXMIT_NONE; /* Flag to (re)transmit to recover losses */
+        u32 prior_fack;
 
         sack_state.first_sackt = 0;
         sack_state.rate = &rs;
 
-        /* We very likely will need to access write queue head. */
-        prefetchw(sk->sk_write_queue.next);
+        /* We very likely will need to access rtx queue. */
+        prefetch(sk->tcp_rtx_queue.rb_node);
 
         /* If the ack is older than previous acks
          * then we can probably ignore it.
@@ -3590,7 +3534,7 @@ static int tcp_ack(struct sock *sk, const struct sk_buff *skb, int flag)
                 icsk->icsk_retransmits = 0;
         }
 
-        prior_fackets = tp->fackets_out;
+        prior_fack = tcp_is_sack(tp) ? tcp_highest_sack_seq(tp) : tp->snd_una;
         rs.prior_in_flight = tcp_packets_in_flight(tp);
 
         /* ts_recent update must be made after we are sure that the packet
@@ -3646,8 +3590,9 @@ static int tcp_ack(struct sock *sk, const struct sk_buff *skb, int flag)
                 goto no_queue;
 
         /* See if we can take anything off of the retransmit queue. */
-        flag |= tcp_clean_rtx_queue(sk, prior_fackets, prior_snd_una, &acked,
-                                    &sack_state);
+        flag |= tcp_clean_rtx_queue(sk, prior_fack, prior_snd_una, &sack_state);
+
+        tcp_rack_update_reo_wnd(sk, &rs);
 
         if (tp->tlp_high_seq)
                 tcp_process_tlp_ack(sk, ack, flag);
@@ -3657,7 +3602,8 @@ static int tcp_ack(struct sock *sk, const struct sk_buff *skb, int flag)
 
         if (tcp_ack_is_dubious(sk, flag)) {
                 is_dupack = !(flag & (FLAG_SND_UNA_ADVANCED | FLAG_NOT_DUP));
-                tcp_fastretrans_alert(sk, acked, is_dupack, &flag, &rexmit);
+                tcp_fastretrans_alert(sk, prior_snd_una, is_dupack, &flag,
+                                      &rexmit);
         }
 
         if ((flag & FLAG_FORWARD_PROGRESS) || !(flag & FLAG_NOT_DUP))
@@ -3673,13 +3619,13 @@ static int tcp_ack(struct sock *sk, const struct sk_buff *skb, int flag)
 no_queue:
         /* If data was DSACKed, see if we can undo a cwnd reduction. */
         if (flag & FLAG_DSACKING_ACK)
-                tcp_fastretrans_alert(sk, acked, is_dupack, &flag, &rexmit);
+                tcp_fastretrans_alert(sk, prior_snd_una, is_dupack, &flag,
+                                      &rexmit);
         /* If this ack opens up a zero window, clear backoff.  It was
          * being used to time the probes, and is probably far higher than
          * it needs to be for normal retransmission.
          */
-        if (tcp_send_head(sk))
-                tcp_ack_probe(sk);
+        tcp_ack_probe(sk);
 
         if (tp->tlp_high_seq)
                 tcp_process_tlp_ack(sk, ack, flag);
@@ -3696,7 +3642,8 @@ old_ack:
         if (TCP_SKB_CB(skb)->sacked) {
                 flag |= tcp_sacktag_write_queue(sk, skb, prior_snd_una,
                                                 &sack_state);
-                tcp_fastretrans_alert(sk, acked, is_dupack, &flag, &rexmit);
+                tcp_fastretrans_alert(sk, prior_snd_una, is_dupack, &flag,
+                                      &rexmit);
                 tcp_xmit_recovery(sk, rexmit);
         }
 
@@ -3721,6 +3668,21 @@ static void tcp_parse_fastopen_option(int len, const unsigned char *cookie,
         foc->exp = exp_opt;
 }
 
+static void smc_parse_options(const struct tcphdr *th,
+                              struct tcp_options_received *opt_rx,
+                              const unsigned char *ptr,
+                              int opsize)
+{
+#if IS_ENABLED(CONFIG_SMC)
+        if (static_branch_unlikely(&tcp_have_smc)) {
+                if (th->syn && !(opsize & 1) &&
+                    opsize >= TCPOLEN_EXP_SMC_BASE &&
+                    get_unaligned_be32(ptr) == TCPOPT_SMC_MAGIC)
+                        opt_rx->smc_ok = 1;
+        }
+#endif
+}
+
 /* Look for tcp options. Normally only called on SYN and SYNACK packets.
  * But, this can also be called on packets in the established flow when
  * the fast version below fails.
@@ -3828,6 +3790,9 @@ void tcp_parse_options(const struct net *net,
                                         tcp_parse_fastopen_option(opsize -
                                                 TCPOLEN_EXP_FASTOPEN_BASE,
                                                 ptr + 2, th->syn, foc, true);
+                                else
+                                        smc_parse_options(th, opt_rx, ptr,
+                                                          opsize);
                                 break;
 
                         }
@@ -3995,6 +3960,8 @@ static inline bool tcp_sequence(const struct tcp_sock *tp, u32 seq, u32 end_seq)
 /* When we get a reset we do this. */
 void tcp_reset(struct sock *sk)
 {
+        trace_tcp_receive_reset(sk);
+
         /* We want the right error as BSD sees it (and indeed as we do). */
         switch (sk->sk_state) {
         case TCP_SYN_SENT:
@@ -4117,7 +4084,7 @@ static void tcp_dsack_set(struct sock *sk, u32 seq, u32 end_seq)
 {
         struct tcp_sock *tp = tcp_sk(sk);
 
-        if (tcp_is_sack(tp) && sysctl_tcp_dsack) {
+        if (tcp_is_sack(tp) && sock_net(sk)->ipv4.sysctl_tcp_dsack) {
                 int mib_idx;
 
                 if (before(seq, tp->rcv_nxt))
@@ -4152,7 +4119,7 @@ static void tcp_send_dupack(struct sock *sk, const struct sk_buff *skb)
                 NET_INC_STATS(sock_net(sk), LINUX_MIB_DELAYEDACKLOST);
                 tcp_enter_quickack_mode(sk);
 
-                if (tcp_is_sack(tp) && sysctl_tcp_dsack) {
+                if (tcp_is_sack(tp) && sock_net(sk)->ipv4.sysctl_tcp_dsack) {
                         u32 end_seq = TCP_SKB_CB(skb)->end_seq;
 
                         if (after(TCP_SKB_CB(skb)->end_seq, tp->rcv_nxt))
@@ -4268,11 +4235,6 @@ static void tcp_sack_remove(struct tcp_sock *tp)
         tp->rx_opt.num_sacks = num_sacks;
 }
 
-enum tcp_queue {
-        OOO_QUEUE,
-        RCV_QUEUE,
-};
-
 /**
  * tcp_try_coalesce - try to merge skb to prior one
  * @sk: socket
@@ -4288,7 +4250,6 @@ enum tcp_queue {
  * Returns true if caller should free @from instead of queueing it
  */
 static bool tcp_try_coalesce(struct sock *sk,
-                             enum tcp_queue dest,
                              struct sk_buff *to,
                              struct sk_buff *from,
                              bool *fragstolen)
@@ -4313,10 +4274,7 @@ static bool tcp_try_coalesce(struct sock *sk,
 
         if (TCP_SKB_CB(from)->has_rxtstamp) {
                 TCP_SKB_CB(to)->has_rxtstamp = true;
-                if (dest == OOO_QUEUE)
-                        TCP_SKB_CB(to)->swtstamp = TCP_SKB_CB(from)->swtstamp;
-                else
-                        to->tstamp = from->tstamp;
+                to->tstamp = from->tstamp;
         }
 
         return true;
@@ -4341,7 +4299,7 @@ static void tcp_ofo_queue(struct sock *sk)
 
         p = rb_first(&tp->out_of_order_queue);
         while (p) {
-                skb = rb_entry(p, struct sk_buff, rbnode);
+                skb = rb_to_skb(p);
                 if (after(TCP_SKB_CB(skb)->seq, tp->rcv_nxt))
                         break;
 
@@ -4353,9 +4311,6 @@ static void tcp_ofo_queue(struct sock *sk)
                 }
                 p = rb_next(p);
                 rb_erase(&skb->rbnode, &tp->out_of_order_queue);
-                /* Replace tstamp which was stomped by rbnode */
-                if (TCP_SKB_CB(skb)->has_rxtstamp)
-                        skb->tstamp = TCP_SKB_CB(skb)->swtstamp;
 
                 if (unlikely(!after(TCP_SKB_CB(skb)->end_seq, tp->rcv_nxt))) {
                         SOCK_DEBUG(sk, "ofo packet was already received\n");
@@ -4367,8 +4322,7 @@ static void tcp_ofo_queue(struct sock *sk)
                            TCP_SKB_CB(skb)->end_seq);
 
                 tail = skb_peek_tail(&sk->sk_receive_queue);
-                eaten = tail && tcp_try_coalesce(sk, RCV_QUEUE,
-                                                 tail, skb, &fragstolen);
+                eaten = tail && tcp_try_coalesce(sk, tail, skb, &fragstolen);
                 tcp_rcv_nxt_update(tp, TCP_SKB_CB(skb)->end_seq);
                 fin = TCP_SKB_CB(skb)->tcp_flags & TCPHDR_FIN;
                 if (!eaten)
@@ -4409,7 +4363,7 @@ static int tcp_try_rmem_schedule(struct sock *sk, struct sk_buff *skb,
 static void tcp_data_queue_ofo(struct sock *sk, struct sk_buff *skb)
 {
         struct tcp_sock *tp = tcp_sk(sk);
-        struct rb_node **p, *q, *parent;
+        struct rb_node **p, *parent;
         struct sk_buff *skb1;
         u32 seq, end_seq;
         bool fragstolen;
@@ -4422,10 +4376,6 @@ static void tcp_data_queue_ofo(struct sock *sk, struct sk_buff *skb)
                 return;
         }
 
-        /* Stash tstamp to avoid being stomped on by rbnode */
-        if (TCP_SKB_CB(skb)->has_rxtstamp)
-                TCP_SKB_CB(skb)->swtstamp = skb->tstamp;
-
         /* Disable header prediction. */
         tp->pred_flags = 0;
         inet_csk_schedule_ack(sk);
@@ -4453,7 +4403,7 @@ static void tcp_data_queue_ofo(struct sock *sk, struct sk_buff *skb)
         /* In the typical case, we are adding an skb to the end of the list.
          * Use of ooo_last_skb avoids the O(Log(N)) rbtree lookup.
          */
-        if (tcp_try_coalesce(sk, OOO_QUEUE, tp->ooo_last_skb,
+        if (tcp_try_coalesce(sk, tp->ooo_last_skb,
                              skb, &fragstolen)) {
 coalesce_done:
                 tcp_grow_window(sk, skb);
@@ -4472,7 +4422,7 @@ coalesce_done:
         parent = NULL;
         while (*p) {
                 parent = *p;
-                skb1 = rb_entry(parent, struct sk_buff, rbnode);
+                skb1 = rb_to_skb(parent);
                 if (before(seq, TCP_SKB_CB(skb1)->seq)) {
                         p = &parent->rb_left;
                         continue;
@@ -4504,7 +4454,7 @@ coalesce_done:
                                 __kfree_skb(skb1);
                                 goto merge_right;
                         }
-                } else if (tcp_try_coalesce(sk, OOO_QUEUE, skb1,
+                } else if (tcp_try_coalesce(sk, skb1,
                                             skb, &fragstolen)) {
                         goto coalesce_done;
                 }
@@ -4517,9 +4467,7 @@ insert:
 
 merge_right:
         /* Remove other segments covered by skb. */
-        while ((q = rb_next(&skb->rbnode)) != NULL) {
-                skb1 = rb_entry(q, struct sk_buff, rbnode);
-
+        while ((skb1 = skb_rb_next(skb)) != NULL) {
                 if (!after(end_seq, TCP_SKB_CB(skb1)->seq))
                         break;
                 if (before(end_seq, TCP_SKB_CB(skb1)->end_seq)) {
@@ -4534,7 +4482,7 @@ merge_right:
                 tcp_drop(sk, skb1);
         }
         /* If there is no skb after us, we are the last_skb ! */
-        if (!q)
+        if (!skb1)
                 tp->ooo_last_skb = skb;
 
 add_sack:
@@ -4556,7 +4504,7 @@ static int __must_check tcp_queue_rcv(struct sock *sk, struct sk_buff *skb, int
 
         __skb_pull(skb, hdrlen);
         eaten = (tail &&
-                 tcp_try_coalesce(sk, RCV_QUEUE, tail,
+                 tcp_try_coalesce(sk, tail,
                                   skb, fragstolen)) ? 1 : 0;
         tcp_rcv_nxt_update(tcp_sk(sk), TCP_SKB_CB(skb)->end_seq);
         if (!eaten) {
@@ -4720,7 +4668,7 @@ static struct sk_buff *tcp_skb_next(struct sk_buff *skb, struct sk_buff_head *li
         if (list)
                 return !skb_queue_is_last(list, skb) ? skb->next : NULL;
 
-        return rb_entry_safe(rb_next(&skb->rbnode), struct sk_buff, rbnode);
+        return skb_rb_next(skb);
 }
 
 static struct sk_buff *tcp_collapse_one(struct sock *sk, struct sk_buff *skb,
@@ -4741,7 +4689,7 @@ static struct sk_buff *tcp_collapse_one(struct sock *sk, struct sk_buff *skb,
 }
 
 /* Insert skb into rb tree, ordered by TCP_SKB_CB(skb)->seq */
-static void tcp_rbtree_insert(struct rb_root *root, struct sk_buff *skb)
+void tcp_rbtree_insert(struct rb_root *root, struct sk_buff *skb)
 {
         struct rb_node **p = &root->rb_node;
         struct rb_node *parent = NULL;
@@ -4749,7 +4697,7 @@ static void tcp_rbtree_insert(struct rb_root *root, struct sk_buff *skb)
 
         while (*p) {
                 parent = *p;
-                skb1 = rb_entry(parent, struct sk_buff, rbnode);
+                skb1 = rb_to_skb(parent);
                 if (before(TCP_SKB_CB(skb)->seq, TCP_SKB_CB(skb1)->seq))
                         p = &parent->rb_left;
                 else
@@ -4796,7 +4744,7 @@ restart:
                  *   overlaps to the next one.
                  */
                 if (!(TCP_SKB_CB(skb)->tcp_flags & (TCPHDR_SYN | TCPHDR_FIN)) &&
-                    (tcp_win_from_space(skb->truesize) > skb->len ||
+                    (tcp_win_from_space(sk, skb->truesize) > skb->len ||
                      before(TCP_SKB_CB(skb)->seq, start))) {
                         end_of_skbs = false;
                         break;
@@ -4868,26 +4816,19 @@ static void tcp_collapse_ofo_queue(struct sock *sk)
 {
         struct tcp_sock *tp = tcp_sk(sk);
         struct sk_buff *skb, *head;
-        struct rb_node *p;
         u32 start, end;
 
-        p = rb_first(&tp->out_of_order_queue);
-        skb = rb_entry_safe(p, struct sk_buff, rbnode);
+        skb = skb_rb_first(&tp->out_of_order_queue);
 new_range:
         if (!skb) {
-                p = rb_last(&tp->out_of_order_queue);
-                /* Note: This is possible p is NULL here. We do not
-                 * use rb_entry_safe(), as ooo_last_skb is valid only
-                 * if rbtree is not empty.
-                 */
-                tp->ooo_last_skb = rb_entry(p, struct sk_buff, rbnode);
+                tp->ooo_last_skb = skb_rb_last(&tp->out_of_order_queue);
                 return;
         }
         start = TCP_SKB_CB(skb)->seq;
         end = TCP_SKB_CB(skb)->end_seq;
 
         for (head = skb;;) {
-                skb = tcp_skb_next(skb, NULL);
+                skb = skb_rb_next(skb);
 
                 /* Range is terminated when we see a gap or when
                  * we are at the queue end.
@@ -4930,14 +4871,14 @@ static bool tcp_prune_ofo_queue(struct sock *sk)
         do {
                 prev = rb_prev(node);
                 rb_erase(node, &tp->out_of_order_queue);
-                tcp_drop(sk, rb_entry(node, struct sk_buff, rbnode));
+                tcp_drop(sk, rb_to_skb(node));
                 sk_mem_reclaim(sk);
                 if (atomic_read(&sk->sk_rmem_alloc) <= sk->sk_rcvbuf &&
                     !tcp_under_memory_pressure(sk))
                         break;
                 node = prev;
         } while (node);
-        tp->ooo_last_skb = rb_entry(prev, struct sk_buff, rbnode);
+        tp->ooo_last_skb = rb_to_skb(prev);
 
         /* Reset SACK state.  A conforming SACK implementation will
          * do the same at a timeout based retransmit.  When a connection
@@ -5112,7 +5053,7 @@ static void tcp_check_urg(struct sock *sk, const struct tcphdr *th)
         struct tcp_sock *tp = tcp_sk(sk);
         u32 ptr = ntohs(th->urg_ptr);
 
-        if (ptr && !sysctl_tcp_stdurg)
+        if (ptr && !sock_net(sk)->ipv4.sysctl_tcp_stdurg)
                 ptr--;
         ptr += ntohl(th->seq);
 
@@ -5532,20 +5473,13 @@ void tcp_finish_connect(struct sock *sk, struct sk_buff *skb)
                 security_inet_conn_established(sk, skb);
         }
 
-        /* Make sure socket is routed, for correct metrics.  */
-        icsk->icsk_af_ops->rebuild_header(sk);
-
-        tcp_init_metrics(sk);
-        tcp_call_bpf(sk, BPF_SOCK_OPS_ACTIVE_ESTABLISHED_CB);
-        tcp_init_congestion_control(sk);
+        tcp_init_transfer(sk, BPF_SOCK_OPS_ACTIVE_ESTABLISHED_CB);
 
         /* Prevent spurious tcp_cwnd_restart() on first data
          * packet.
          */
         tp->lsndtime = tcp_jiffies32;
 
-        tcp_init_buffer_space(sk);
-
         if (sock_flag(sk, SOCK_KEEPOPEN))
                 inet_csk_reset_keepalive_timer(sk, keepalive_time_when(tp));
 
@@ -5559,7 +5493,7 @@ static bool tcp_rcv_fastopen_synack(struct sock *sk, struct sk_buff *synack,
                                     struct tcp_fastopen_cookie *cookie)
 {
         struct tcp_sock *tp = tcp_sk(sk);
-        struct sk_buff *data = tp->syn_data ? tcp_write_queue_head(sk) : NULL;
+        struct sk_buff *data = tp->syn_data ? tcp_rtx_queue_head(sk) : NULL;
         u16 mss = tp->rx_opt.mss_clamp, try_exp = 0;
         bool syn_drop = false;
 
@@ -5594,9 +5528,8 @@ static bool tcp_rcv_fastopen_synack(struct sock *sk, struct sk_buff *synack,
         tcp_fastopen_cache_set(sk, mss, cookie, syn_drop, try_exp);
 
         if (data) { /* Retransmit unacked data in SYN */
-                tcp_for_write_queue_from(data, sk) {
-                        if (data == tcp_send_head(sk) ||
-                            __tcp_retransmit_skb(sk, data, 1))
+                skb_rbtree_walk_from(data) {
+                        if (__tcp_retransmit_skb(sk, data, 1))
                                 break;
                 }
                 tcp_rearm_rto(sk);
@@ -5614,6 +5547,16 @@ static bool tcp_rcv_fastopen_synack(struct sock *sk, struct sk_buff *synack,
         return false;
 }
 
+static void smc_check_reset_syn(struct tcp_sock *tp)
+{
+#if IS_ENABLED(CONFIG_SMC)
+        if (static_branch_unlikely(&tcp_have_smc)) {
+                if (tp->syn_smc && !tp->rx_opt.smc_ok)
+                        tp->syn_smc = 0;
+        }
+#endif
+}
+
 static int tcp_rcv_synsent_state_process(struct sock *sk, struct sk_buff *skb,
                                          const struct tcphdr *th)
 {
@@ -5709,10 +5652,6 @@ static int tcp_rcv_synsent_state_process(struct sock *sk, struct sk_buff *skb,
                         tp->tcp_header_len = sizeof(struct tcphdr);
                 }
 
-                if (tcp_is_sack(tp) && sysctl_tcp_fack)
-                        tcp_enable_fack(tp);
-
-                tcp_mtup_init(sk);
                 tcp_sync_mss(sk, icsk->icsk_pmtu_cookie);
                 tcp_initialize_rcv_mss(sk);
 
@@ -5721,6 +5660,8 @@ static int tcp_rcv_synsent_state_process(struct sock *sk, struct sk_buff *skb,
                  * is initialized. */
                 tp->copied_seq = tp->rcv_nxt;
 
+                smc_check_reset_syn(tp);
+
                 smp_mb();
 
                 tcp_finish_connect(sk, skb);
@@ -5938,15 +5879,18 @@ int tcp_rcv_state_process(struct sock *sk, struct sk_buff *skb)
                 if (req) {
                         inet_csk(sk)->icsk_retransmits = 0;
                         reqsk_fastopen_remove(sk, req, false);
+                        /* Re-arm the timer because data may have been sent out.
+                         * This is similar to the regular data transmission case
+                         * when new data has just been ack'ed.
+                         *
+                         * (TFO) - we could try to be more aggressive and
+                         * retransmitting any data sooner based on when they
+                         * are sent out.
+                         */
+                        tcp_rearm_rto(sk);
                 } else {
-                        /* Make sure socket is routed, for correct metrics. */
-                        icsk->icsk_af_ops->rebuild_header(sk);
-                        tcp_call_bpf(sk, BPF_SOCK_OPS_PASSIVE_ESTABLISHED_CB);
-                        tcp_init_congestion_control(sk);
-
-                        tcp_mtup_init(sk);
+                        tcp_init_transfer(sk, BPF_SOCK_OPS_PASSIVE_ESTABLISHED_CB);
                         tp->copied_seq = tp->rcv_nxt;
-                        tcp_init_buffer_space(sk);
                 }
                 smp_mb();
                 tcp_set_state(sk, TCP_ESTABLISHED);
@@ -5966,19 +5910,6 @@ int tcp_rcv_state_process(struct sock *sk, struct sk_buff *skb)
                 if (tp->rx_opt.tstamp_ok)
                         tp->advmss -= TCPOLEN_TSTAMP_ALIGNED;
 
-                if (req) {
-                        /* Re-arm the timer because data may have been sent out.
-                         * This is similar to the regular data transmission case
-                         * when new data has just been ack'ed.
-                         *
-                         * (TFO) - we could try to be more aggressive and
-                         * retransmitting any data sooner based on when they
-                         * are sent out.
-                         */
-                        tcp_rearm_rto(sk);
-                } else
-                        tcp_init_metrics(sk);
-
                 if (!inet_csk(sk)->icsk_ca_ops->cong_control)
                         tcp_update_pacing_rate(sk);
 
@@ -6075,6 +6006,7 @@ int tcp_rcv_state_process(struct sock *sk, struct sk_buff *skb)
         case TCP_LAST_ACK:
                 if (!before(TCP_SKB_CB(skb)->seq, tp->rcv_nxt))
                         break;
+                /* fall through */
         case TCP_FIN_WAIT1:
         case TCP_FIN_WAIT2:
                 /* RFC 793 says to queue data in these states,
@@ -6183,6 +6115,9 @@ static void tcp_openreq_init(struct request_sock *req,
         ireq->ir_rmt_port = tcp_hdr(skb)->source;
         ireq->ir_num = ntohs(tcp_hdr(skb)->dest);
         ireq->ir_mark = inet_request_mark(sk, skb);
+#if IS_ENABLED(CONFIG_SMC)
+        ireq->smc_ok = rx_opt->smc_ok;
+#endif
 }
 
 struct request_sock *inet_reqsk_alloc(const struct request_sock_ops *ops,
@@ -6195,7 +6130,6 @@ struct request_sock *inet_reqsk_alloc(const struct request_sock_ops *ops,
         if (req) {
                 struct inet_request_sock *ireq = inet_rsk(req);
 
-                kmemcheck_annotate_bitfield(ireq, flags);
                 ireq->ireq_opt = NULL;
 #if IS_ENABLED(CONFIG_IPV6)
                 ireq->pktopts = NULL;
@@ -6358,7 +6292,7 @@ int tcp_conn_request(struct request_sock_ops *rsk_ops,
         tcp_openreq_init_rwin(req, sk, dst);
         if (!want_cookie) {
                 tcp_reqsk_record_syn(sk, req, skb);
-                fastopen_sk = tcp_try_fastopen(sk, skb, req, &foc);
+                fastopen_sk = tcp_try_fastopen(sk, skb, req, &foc, dst);
         }
         if (fastopen_sk) {
                 af_ops->send_synack(fastopen_sk, dst, &fl, req,
diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
index 5b027c69cbc5..c6bc0c4d19c6 100644
--- a/net/ipv4/tcp_ipv4.c
+++ b/net/ipv4/tcp_ipv4.c
@@ -85,6 +85,8 @@
 #include <crypto/hash.h>
 #include <linux/scatterlist.h>
 
+#include <trace/events/tcp.h>
+
 #ifdef CONFIG_TCP_MD5SIG
 static int tcp_v4_md5_hash_hdr(char *md5_hash, const struct tcp_md5sig_key *key,
                                __be32 daddr, __be32 saddr, const struct tcphdr *th);
@@ -480,7 +482,7 @@ void tcp_v4_err(struct sk_buff *icmp_skb, u32 info)
                                                TCP_TIMEOUT_INIT;
                 icsk->icsk_rto = inet_csk_rto_backoff(icsk, TCP_RTO_MAX);
 
-                skb = tcp_write_queue_head(sk);
+                skb = tcp_rtx_queue_head(sk);
                 BUG_ON(!skb);
 
                 tcp_mstamp_refresh(tp);
@@ -701,8 +703,10 @@ static void tcp_v4_send_reset(const struct sock *sk, struct sk_buff *skb)
          * routing might fail in this case. No choice here, if we choose to force
          * input interface, we will misroute in case of asymmetric route.
          */
-        if (sk)
+        if (sk) {
                 arg.bound_dev_if = sk->sk_bound_dev_if;
+                trace_tcp_send_reset(sk, skb);
+        }
 
         BUILD_BUG_ON(offsetof(struct sock, sk_bound_dev_if) !=
                      offsetof(struct inet_timewait_sock, tw_bound_dev_if));
@@ -1783,8 +1787,9 @@ do_time_wait:
                         refcounted = false;
                         goto process;
                 }
-                /* Fall through to ACK */
         }
+                /* to ACK */
+                /* fall through */
         case TCP_TW_ACK:
                 tcp_v4_timewait_ack(sk, skb);
                 break;
@@ -1864,6 +1869,8 @@ void tcp_v4_destroy_sock(struct sock *sk)
 {
         struct tcp_sock *tp = tcp_sk(sk);
 
+        trace_tcp_destroy_sock(sk);
+
         tcp_clear_xmit_timers(sk);
 
         tcp_cleanup_congestion_control(sk);
@@ -1896,6 +1903,7 @@ void tcp_v4_destroy_sock(struct sock *sk)
 
         /* If socket is aborted during connect operation */
         tcp_free_fastopen_req(tp);
+        tcp_fastopen_destroy_cipher(sk);
         tcp_saved_syn_free(tp);
 
         sk_sockets_allocated_dec(sk);
@@ -2401,8 +2409,8 @@ struct proto tcp_prot = {
         .memory_allocated       = &tcp_memory_allocated,
         .memory_pressure        = &tcp_memory_pressure,
         .sysctl_mem             = sysctl_tcp_mem,
-        .sysctl_wmem            = sysctl_tcp_wmem,
-        .sysctl_rmem            = sysctl_tcp_rmem,
+        .sysctl_wmem_offset     = offsetof(struct net, ipv4.sysctl_tcp_wmem),
+        .sysctl_rmem_offset     = offsetof(struct net, ipv4.sysctl_tcp_rmem),
         .max_header             = MAX_TCP_HEADER,
         .obj_size               = sizeof(struct tcp_sock),
         .slab_flags             = SLAB_TYPESAFE_BY_RCU,
@@ -2422,6 +2430,8 @@ static void __net_exit tcp_sk_exit(struct net *net)
 {
         int cpu;
 
+        module_put(net->ipv4.tcp_congestion_control->owner);
+
         for_each_possible_cpu(cpu)
                 inet_ctl_sock_destroy(*per_cpu_ptr(net->ipv4.tcp_sk, cpu));
         free_percpu(net->ipv4.tcp_sk);
@@ -2476,6 +2486,50 @@ static int __net_init tcp_sk_init(struct net *net)
         net->ipv4.sysctl_tcp_sack = 1;
         net->ipv4.sysctl_tcp_window_scaling = 1;
         net->ipv4.sysctl_tcp_timestamps = 1;
+        net->ipv4.sysctl_tcp_early_retrans = 3;
+        net->ipv4.sysctl_tcp_recovery = TCP_RACK_LOSS_DETECTION;
+        net->ipv4.sysctl_tcp_slow_start_after_idle = 1; /* By default, RFC2861 behavior.  */
+        net->ipv4.sysctl_tcp_retrans_collapse = 1;
+        net->ipv4.sysctl_tcp_max_reordering = 300;
+        net->ipv4.sysctl_tcp_dsack = 1;
+        net->ipv4.sysctl_tcp_app_win = 31;
+        net->ipv4.sysctl_tcp_adv_win_scale = 1;
+        net->ipv4.sysctl_tcp_frto = 2;
+        net->ipv4.sysctl_tcp_moderate_rcvbuf = 1;
+        /* This limits the percentage of the congestion window which we
+         * will allow a single TSO frame to consume.  Building TSO frames
+         * which are too large can cause TCP streams to be bursty.
+         */
+        net->ipv4.sysctl_tcp_tso_win_divisor = 3;
+        /* Default TSQ limit of four TSO segments */
+        net->ipv4.sysctl_tcp_limit_output_bytes = 262144;
+        /* rfc5961 challenge ack rate limiting */
+        net->ipv4.sysctl_tcp_challenge_ack_limit = 1000;
+        net->ipv4.sysctl_tcp_min_tso_segs = 2;
+        net->ipv4.sysctl_tcp_min_rtt_wlen = 300;
+        net->ipv4.sysctl_tcp_autocorking = 1;
+        net->ipv4.sysctl_tcp_invalid_ratelimit = HZ/2;
+        net->ipv4.sysctl_tcp_pacing_ss_ratio = 200;
+        net->ipv4.sysctl_tcp_pacing_ca_ratio = 120;
+        if (net != &init_net) {
+                memcpy(net->ipv4.sysctl_tcp_rmem,
+                       init_net.ipv4.sysctl_tcp_rmem,
+                       sizeof(init_net.ipv4.sysctl_tcp_rmem));
+                memcpy(net->ipv4.sysctl_tcp_wmem,
+                       init_net.ipv4.sysctl_tcp_wmem,
+                       sizeof(init_net.ipv4.sysctl_tcp_wmem));
+        }
+        net->ipv4.sysctl_tcp_fastopen = TFO_CLIENT_ENABLE;
+        spin_lock_init(&net->ipv4.tcp_fastopen_ctx_lock);
+        net->ipv4.sysctl_tcp_fastopen_blackhole_timeout = 60 * 60;
+        atomic_set(&net->ipv4.tfo_active_disable_times, 0);
+
+        /* Reno is always built in */
+        if (!net_eq(net, &init_net) &&
+            try_module_get(init_net.ipv4.tcp_congestion_control->owner))
+                net->ipv4.tcp_congestion_control = init_net.ipv4.tcp_congestion_control;
+        else
+                net->ipv4.tcp_congestion_control = &tcp_reno;
 
         return 0;
 fail:
@@ -2486,7 +2540,12 @@ fail:
 
 static void __net_exit tcp_sk_exit_batch(struct list_head *net_exit_list)
 {
+        struct net *net;
+
         inet_twsk_purge(&tcp_hashinfo, AF_INET);
+
+        list_for_each_entry(net, net_exit_list, exit_list)
+                tcp_fastopen_ctx_destroy(net);
 }
 
 static struct pernet_operations __net_initdata tcp_sk_ops = {
diff --git a/net/ipv4/tcp_metrics.c b/net/ipv4/tcp_metrics.c
index 0f0d740f6c8b..7097f92d16e5 100644
--- a/net/ipv4/tcp_metrics.c
+++ b/net/ipv4/tcp_metrics.c
@@ -21,8 +21,6 @@
 #include <net/tcp.h>
 #include <net/genetlink.h>
 
-int sysctl_tcp_nometrics_save __read_mostly;
-
 static struct tcp_metrics_block *__tcp_get_metrics(const struct inetpeer_addr *saddr,
                                                    const struct inetpeer_addr *daddr,
                                                    struct net *net, unsigned int hash);
@@ -331,7 +329,7 @@ void tcp_update_metrics(struct sock *sk)
         int m;
 
         sk_dst_confirm(sk);
-        if (sysctl_tcp_nometrics_save || !dst)
+        if (net->ipv4.sysctl_tcp_nometrics_save || !dst)
                 return;
 
         rcu_read_lock();
@@ -472,10 +470,8 @@ void tcp_init_metrics(struct sock *sk)
                 tp->snd_ssthresh = TCP_INFINITE_SSTHRESH;
         }
         val = tcp_metric_get(tm, TCP_METRIC_REORDERING);
-        if (val && tp->reordering != val) {
-                tcp_disable_fack(tp);
+        if (val && tp->reordering != val)
                 tp->reordering = val;
-        }
 
         crtt = tcp_metric_get(tm, TCP_METRIC_RTT);
         rcu_read_unlock();
@@ -893,10 +889,14 @@ static void tcp_metrics_flush_all(struct net *net)
 
         for (row = 0; row < max_rows; row++, hb++) {
                 struct tcp_metrics_block __rcu **pp;
+                bool match;
+
                 spin_lock_bh(&tcp_metrics_lock);
                 pp = &hb->chain;
                 for (tm = deref_locked(*pp); tm; tm = deref_locked(*pp)) {
-                        if (net_eq(tm_net(tm), net)) {
+                        match = net ? net_eq(tm_net(tm), net) :
+                                !atomic_read(&tm_net(tm)->count);
+                        if (match) {
                                 *pp = tm->tcpm_next;
                                 kfree_rcu(tm, rcu_head);
                         } else {
@@ -1019,14 +1019,14 @@ static int __net_init tcp_net_metrics_init(struct net *net)
         return 0;
 }
 
-static void __net_exit tcp_net_metrics_exit(struct net *net)
+static void __net_exit tcp_net_metrics_exit_batch(struct list_head *net_exit_list)
 {
-        tcp_metrics_flush_all(net);
+        tcp_metrics_flush_all(NULL);
 }
 
 static __net_initdata struct pernet_operations tcp_net_metrics_ops = {
-        .init   =       tcp_net_metrics_init,
-        .exit   =       tcp_net_metrics_exit,
+        .init           =       tcp_net_metrics_init,
+        .exit_batch     =       tcp_net_metrics_exit_batch,
 };
 
 void __init tcp_metrics_init(void)
diff --git a/net/ipv4/tcp_minisocks.c b/net/ipv4/tcp_minisocks.c
index 188a6f31356d..e36eff0403f4 100644
--- a/net/ipv4/tcp_minisocks.c
+++ b/net/ipv4/tcp_minisocks.c
@@ -23,13 +23,12 @@
 #include <linux/slab.h>
 #include <linux/sysctl.h>
 #include <linux/workqueue.h>
+#include <linux/static_key.h>
 #include <net/tcp.h>
 #include <net/inet_common.h>
 #include <net/xfrm.h>
 #include <net/busy_poll.h>
 
-int sysctl_tcp_abort_on_overflow __read_mostly;
-
 static bool tcp_in_window(u32 seq, u32 end_seq, u32 s_win, u32 e_win)
 {
         if (seq == s_win)
@@ -180,7 +179,7 @@ tcp_timewait_state_process(struct inet_timewait_sock *tw, struct sk_buff *skb,
                          * Oh well... nobody has a sufficient solution to this
                          * protocol bug yet.
                          */
-                        if (sysctl_tcp_rfc1337 == 0) {
+                        if (twsk_net(tw)->ipv4.sysctl_tcp_rfc1337 == 0) {
 kill:
                                 inet_twsk_deschedule_put(tw);
                                 return TCP_TW_SUCCESS;
@@ -298,8 +297,7 @@ void tcp_time_wait(struct sock *sk, int state, int timeo)
                         key = tp->af_specific->md5_lookup(sk, sk);
                         if (key) {
                                 tcptw->tw_md5_key = kmemdup(key, sizeof(*key), GFP_ATOMIC);
-                                if (tcptw->tw_md5_key && !tcp_alloc_md5sig_pool())
-                                        BUG();
+                                BUG_ON(tcptw->tw_md5_key && !tcp_alloc_md5sig_pool());
                         }
                 } while (0);
 #endif
@@ -371,7 +369,7 @@ void tcp_openreq_init_rwin(struct request_sock *req,
                 full_space = rcv_wnd * mss;
 
         /* tcp_full_space because it is guaranteed to be the first packet */
-        tcp_select_initial_window(full_space,
+        tcp_select_initial_window(sk_listener, full_space,
                 mss - (ireq->tstamp_ok ? TCPOLEN_TSTAMP_ALIGNED : 0),
                 &req->rsk_rcv_wnd,
                 &req->rsk_window_clamp,
@@ -417,6 +415,21 @@ void tcp_ca_openreq_child(struct sock *sk, const struct dst_entry *dst)
 }
 EXPORT_SYMBOL_GPL(tcp_ca_openreq_child);
 
+static void smc_check_reset_syn_req(struct tcp_sock *oldtp,
+                                    struct request_sock *req,
+                                    struct tcp_sock *newtp)
+{
+#if IS_ENABLED(CONFIG_SMC)
+        struct inet_request_sock *ireq;
+
+        if (static_branch_unlikely(&tcp_have_smc)) {
+                ireq = inet_rsk(req);
+                if (oldtp->syn_smc && !ireq->smc_ok)
+                        newtp->syn_smc = 0;
+        }
+#endif
+}
+
 /* This is not only more efficient than what we used to do, it eliminates
  * a lot of code duplication between IPv4/IPv6 SYN recv processing. -DaveM
  *
@@ -434,6 +447,9 @@ struct sock *tcp_create_openreq_child(const struct sock *sk,
                 struct tcp_request_sock *treq = tcp_rsk(req);
                 struct inet_connection_sock *newicsk = inet_csk(newsk);
                 struct tcp_sock *newtp = tcp_sk(newsk);
+                struct tcp_sock *oldtp = tcp_sk(sk);
+
+                smc_check_reset_syn_req(oldtp, req, newtp);
 
                 /* Now setup tcp_sock */
                 newtp->pred_flags = 0;
@@ -446,6 +462,7 @@ struct sock *tcp_create_openreq_child(const struct sock *sk,
                 newtp->snd_nxt = newtp->snd_up = treq->snt_isn + 1;
 
                 INIT_LIST_HEAD(&newtp->tsq_node);
+                INIT_LIST_HEAD(&newtp->tsorted_sent_queue);
 
                 tcp_init_wl(newtp, treq->rcv_isn);
 
@@ -458,7 +475,6 @@ struct sock *tcp_create_openreq_child(const struct sock *sk,
                 newtp->packets_out = 0;
                 newtp->retrans_out = 0;
                 newtp->sacked_out = 0;
-                newtp->fackets_out = 0;
                 newtp->snd_ssthresh = TCP_INFINITE_SSTHRESH;
                 newtp->tlp_high_seq = 0;
                 newtp->lsndtime = tcp_jiffies32;
@@ -492,10 +508,7 @@ struct sock *tcp_create_openreq_child(const struct sock *sk,
                                                        keepalive_time_when(newtp));
 
                 newtp->rx_opt.tstamp_ok = ireq->tstamp_ok;
-                if ((newtp->rx_opt.sack_ok = ireq->sack_ok) != 0) {
-                        if (sysctl_tcp_fack)
-                                tcp_enable_fack(newtp);
-                }
+                newtp->rx_opt.sack_ok = ireq->sack_ok;
                 newtp->window_clamp = req->rsk_window_clamp;
                 newtp->rcv_ssthresh = req->rsk_rcv_wnd;
                 newtp->rcv_wnd = req->rsk_rcv_wnd;
@@ -534,6 +547,10 @@ struct sock *tcp_create_openreq_child(const struct sock *sk,
                 newtp->syn_data_acked = 0;
                 newtp->rack.mstamp = 0;
                 newtp->rack.advanced = 0;
+                newtp->rack.reo_wnd_steps = 1;
+                newtp->rack.last_delivered = 0;
+                newtp->rack.reo_wnd_persist = 0;
+                newtp->rack.dsack_seen = 0;
 
                 __TCP_INC_STATS(sock_net(sk), TCP_MIB_PASSIVEOPENS);
         }
@@ -764,7 +781,7 @@ struct sock *tcp_check_req(struct sock *sk, struct sk_buff *skb,
         return inet_csk_complete_hashdance(sk, child, req, own_req);
 
 listen_overflow:
-        if (!sysctl_tcp_abort_on_overflow) {
+        if (!sock_net(sk)->ipv4.sysctl_tcp_abort_on_overflow) {
                 inet_rsk(req)->acked = 1;
                 return NULL;
         }
diff --git a/net/ipv4/tcp_nv.c b/net/ipv4/tcp_nv.c
index 125fc1450b01..0b5a05bd82e3 100644
--- a/net/ipv4/tcp_nv.c
+++ b/net/ipv4/tcp_nv.c
@@ -39,7 +39,7 @@
  * nv_cong_dec_mult     Decrease cwnd by X% (30%) of congestion when detected
  * nv_ssthresh_factor   On congestion set ssthresh to this * <desired cwnd> / 8
  * nv_rtt_factor        RTT averaging factor
- * nv_loss_dec_factor   Decrease cwnd by this (50%) when losses occur
+ * nv_loss_dec_factor   Decrease cwnd to this (80%) when losses occur
  * nv_dec_eval_min_calls        Wait this many RTT measurements before dec cwnd
  * nv_inc_eval_min_calls        Wait this many RTT measurements before inc cwnd
  * nv_ssthresh_eval_min_calls   Wait this many RTT measurements before stopping
@@ -61,7 +61,7 @@ static int nv_min_cwnd __read_mostly = 2;
 static int nv_cong_dec_mult __read_mostly = 30 * 128 / 100; /* = 30% */
 static int nv_ssthresh_factor __read_mostly = 8; /* = 1 */
 static int nv_rtt_factor __read_mostly = 128; /* = 1/2*old + 1/2*new */
-static int nv_loss_dec_factor __read_mostly = 512; /* => 50% */
+static int nv_loss_dec_factor __read_mostly = 819; /* => 80% */
 static int nv_cwnd_growth_rate_neg __read_mostly = 8;
 static int nv_cwnd_growth_rate_pos __read_mostly; /* 0 => fixed like Reno */
 static int nv_dec_eval_min_calls __read_mostly = 60;
@@ -101,6 +101,11 @@ struct tcpnv {
         u32 nv_last_rtt;        /* last rtt */
         u32 nv_min_rtt;         /* active min rtt. Used to determine slope */
         u32 nv_min_rtt_new;     /* min rtt for future use */
+        u32 nv_base_rtt;        /* If non-zero it represents the threshold for
+                                 * congestion */
+        u32 nv_lower_bound_rtt; /* Used in conjunction with nv_base_rtt. It is
+                                 * set to 80% of nv_base_rtt. It helps reduce
+                                 * unfairness between flows */
         u32 nv_rtt_max_rate;    /* max rate seen during current RTT */
         u32 nv_rtt_start_seq;   /* current RTT ends when packet arrives
                                  * acking beyond nv_rtt_start_seq */
@@ -132,9 +137,24 @@ static inline void tcpnv_reset(struct tcpnv *ca, struct sock *sk)
 static void tcpnv_init(struct sock *sk)
 {
         struct tcpnv *ca = inet_csk_ca(sk);
+        int base_rtt;
 
         tcpnv_reset(ca, sk);
 
+        /* See if base_rtt is available from socket_ops bpf program.
+         * It is meant to be used in environments, such as communication
+         * within a datacenter, where we have reasonable estimates of
+         * RTTs
+         */
+        base_rtt = tcp_call_bpf(sk, BPF_SOCK_OPS_BASE_RTT);
+        if (base_rtt > 0) {
+                ca->nv_base_rtt = base_rtt;
+                ca->nv_lower_bound_rtt = (base_rtt * 205) >> 8; /* 80% */
+        } else {
+                ca->nv_base_rtt = 0;
+                ca->nv_lower_bound_rtt = 0;
+        }
+
         ca->nv_allow_cwnd_growth = 1;
         ca->nv_min_rtt_reset_jiffies = jiffies + 2 * HZ;
         ca->nv_min_rtt = NV_INIT_RTT;
@@ -144,6 +164,19 @@ static void tcpnv_init(struct sock *sk)
         ca->cwnd_growth_factor = 0;
 }
 
+/* If provided, apply upper (base_rtt) and lower (lower_bound_rtt)
+ * bounds to RTT.
+ */
+inline u32 nv_get_bounded_rtt(struct tcpnv *ca, u32 val)
+{
+        if (ca->nv_lower_bound_rtt > 0 && val < ca->nv_lower_bound_rtt)
+                return ca->nv_lower_bound_rtt;
+        else if (ca->nv_base_rtt > 0 && val > ca->nv_base_rtt)
+                return ca->nv_base_rtt;
+        else
+                return val;
+}
+
 static void tcpnv_cong_avoid(struct sock *sk, u32 ack, u32 acked)
 {
         struct tcp_sock *tp = tcp_sk(sk);
@@ -209,7 +242,7 @@ static void tcpnv_acked(struct sock *sk, const struct ack_sample *sample)
         struct tcp_sock *tp = tcp_sk(sk);
         struct tcpnv *ca = inet_csk_ca(sk);
         unsigned long now = jiffies;
-        s64 rate64 = 0;
+        u64 rate64;
         u32 rate, max_win, cwnd_by_slope;
         u32 avg_rtt;
         u32 bytes_acked = 0;
@@ -251,8 +284,9 @@ static void tcpnv_acked(struct sock *sk, const struct ack_sample *sample)
         }
 
         /* rate in 100's bits per second */
-        rate64 = ((u64)sample->in_flight) * 8000000;
-        rate = (u32)div64_u64(rate64, (u64)(avg_rtt ?: 1) * 100);
+        rate64 = ((u64)sample->in_flight) * 80000;
+        do_div(rate64, avg_rtt ?: 1);
+        rate = (u32)rate64;
 
         /* Remember the maximum rate seen during this RTT
          * Note: It may be more than one RTT. This function should be
@@ -265,6 +299,9 @@ static void tcpnv_acked(struct sock *sk, const struct ack_sample *sample)
         if (ca->nv_eval_call_cnt < 255)
                 ca->nv_eval_call_cnt++;
 
+        /* Apply bounds to rtt. Only used to update min_rtt */
+        avg_rtt = nv_get_bounded_rtt(ca, avg_rtt);
+
         /* update min rtt if necessary */
         if (avg_rtt < ca->nv_min_rtt)
                 ca->nv_min_rtt = avg_rtt;
diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
index 5a42e873d44a..a4d214c7b506 100644
--- a/net/ipv4/tcp_output.c
+++ b/net/ipv4/tcp_output.c
@@ -41,40 +41,25 @@
 #include <linux/compiler.h>
 #include <linux/gfp.h>
 #include <linux/module.h>
+#include <linux/static_key.h>
 
-/* People can turn this off for buggy TCP's found in printers etc. */
-int sysctl_tcp_retrans_collapse __read_mostly = 1;
-
-/* People can turn this on to work with those rare, broken TCPs that
- * interpret the window field as a signed quantity.
- */
-int sysctl_tcp_workaround_signed_windows __read_mostly = 0;
-
-/* Default TSQ limit of four TSO segments */
-int sysctl_tcp_limit_output_bytes __read_mostly = 262144;
-
-/* This limits the percentage of the congestion window which we
- * will allow a single TSO frame to consume.  Building TSO frames
- * which are too large can cause TCP streams to be bursty.
- */
-int sysctl_tcp_tso_win_divisor __read_mostly = 3;
-
-/* By default, RFC2861 behavior.  */
-int sysctl_tcp_slow_start_after_idle __read_mostly = 1;
+#include <trace/events/tcp.h>
 
 static bool tcp_write_xmit(struct sock *sk, unsigned int mss_now, int nonagle,
                            int push_one, gfp_t gfp);
 
 /* Account for new data that has been sent to the network. */
-static void tcp_event_new_data_sent(struct sock *sk, const struct sk_buff *skb)
+static void tcp_event_new_data_sent(struct sock *sk, struct sk_buff *skb)
 {
         struct inet_connection_sock *icsk = inet_csk(sk);
         struct tcp_sock *tp = tcp_sk(sk);
         unsigned int prior_packets = tp->packets_out;
 
-        tcp_advance_send_head(sk, skb);
         tp->snd_nxt = TCP_SKB_CB(skb)->end_seq;
 
+        __skb_unlink(skb, &sk->sk_write_queue);
+        tcp_rbtree_insert(&sk->tcp_rtx_queue, skb);
+
         tp->packets_out += tcp_skb_pcount(skb);
         if (!prior_packets || icsk->icsk_pending == ICSK_TIME_LOSS_PROBE)
                 tcp_rearm_rto(sk);
@@ -203,7 +188,7 @@ u32 tcp_default_init_rwnd(u32 mss)
  * be a multiple of mss if possible. We assume here that mss >= 1.
  * This MUST be enforced by all callers.
  */
-void tcp_select_initial_window(int __space, __u32 mss,
+void tcp_select_initial_window(const struct sock *sk, int __space, __u32 mss,
                                __u32 *rcv_wnd, __u32 *window_clamp,
                                int wscale_ok, __u8 *rcv_wscale,
                                __u32 init_rcv_wnd)
@@ -227,7 +212,7 @@ void tcp_select_initial_window(int __space, __u32 mss,
          * which we interpret as a sign the remote TCP is not
          * misinterpreting the window field as a signed quantity.
          */
-        if (sysctl_tcp_workaround_signed_windows)
+        if (sock_net(sk)->ipv4.sysctl_tcp_workaround_signed_windows)
                 (*rcv_wnd) = min(space, MAX_TCP_WINDOW);
         else
                 (*rcv_wnd) = space;
@@ -235,7 +220,7 @@ void tcp_select_initial_window(int __space, __u32 mss,
         (*rcv_wscale) = 0;
         if (wscale_ok) {
                 /* Set window scaling on max possible window */
-                space = max_t(u32, space, sysctl_tcp_rmem[2]);
+                space = max_t(u32, space, sock_net(sk)->ipv4.sysctl_tcp_rmem[2]);
                 space = max_t(u32, space, sysctl_rmem_max);
                 space = min_t(u32, space, *window_clamp);
                 while (space > U16_MAX && (*rcv_wscale) < TCP_MAX_WSCALE) {
@@ -287,7 +272,8 @@ static u16 tcp_select_window(struct sock *sk)
         /* Make sure we do not exceed the maximum possible
          * scaled window.
          */
-        if (!tp->rx_opt.rcv_wscale && sysctl_tcp_workaround_signed_windows)
+        if (!tp->rx_opt.rcv_wscale &&
+            sock_net(sk)->ipv4.sysctl_tcp_workaround_signed_windows)
                 new_win = min(new_win, MAX_TCP_WINDOW);
         else
                 new_win = min(new_win, (65535U << tp->rx_opt.rcv_wscale));
@@ -395,7 +381,6 @@ static void tcp_ecn_send(struct sock *sk, struct sk_buff *skb,
 static void tcp_init_nondata_skb(struct sk_buff *skb, u32 seq, u8 flags)
 {
         skb->ip_summed = CHECKSUM_PARTIAL;
-        skb->csum = 0;
 
         TCP_SKB_CB(skb)->tcp_flags = flags;
         TCP_SKB_CB(skb)->sacked = 0;
@@ -418,6 +403,22 @@ static inline bool tcp_urg_mode(const struct tcp_sock *tp)
 #define OPTION_MD5              (1 << 2)
 #define OPTION_WSCALE           (1 << 3)
 #define OPTION_FAST_OPEN_COOKIE (1 << 8)
+#define OPTION_SMC              (1 << 9)
+
+static void smc_options_write(__be32 *ptr, u16 *options)
+{
+#if IS_ENABLED(CONFIG_SMC)
+        if (static_branch_unlikely(&tcp_have_smc)) {
+                if (unlikely(OPTION_SMC & *options)) {
+                        *ptr++ = htonl((TCPOPT_NOP  << 24) |
+                                       (TCPOPT_NOP  << 16) |
+                                       (TCPOPT_EXP <<  8) |
+                                       (TCPOLEN_EXP_SMC_BASE));
+                        *ptr++ = htonl(TCPOPT_SMC_MAGIC);
+                }
+        }
+#endif
+}
 
 struct tcp_out_options {
         u16 options;            /* bit field of OPTION_* */
@@ -536,6 +537,41 @@ static void tcp_options_write(__be32 *ptr, struct tcp_sock *tp,
                 }
                 ptr += (len + 3) >> 2;
         }
+
+        smc_options_write(ptr, &options);
+}
+
+static void smc_set_option(const struct tcp_sock *tp,
+                           struct tcp_out_options *opts,
+                           unsigned int *remaining)
+{
+#if IS_ENABLED(CONFIG_SMC)
+        if (static_branch_unlikely(&tcp_have_smc)) {
+                if (tp->syn_smc) {
+                        if (*remaining >= TCPOLEN_EXP_SMC_BASE_ALIGNED) {
+                                opts->options |= OPTION_SMC;
+                                *remaining -= TCPOLEN_EXP_SMC_BASE_ALIGNED;
+                        }
+                }
+        }
+#endif
+}
+
+static void smc_set_option_cond(const struct tcp_sock *tp,
+                                const struct inet_request_sock *ireq,
+                                struct tcp_out_options *opts,
+                                unsigned int *remaining)
+{
+#if IS_ENABLED(CONFIG_SMC)
+        if (static_branch_unlikely(&tcp_have_smc)) {
+                if (tp->syn_smc && ireq->smc_ok) {
+                        if (*remaining >= TCPOLEN_EXP_SMC_BASE_ALIGNED) {
+                                opts->options |= OPTION_SMC;
+                                *remaining -= TCPOLEN_EXP_SMC_BASE_ALIGNED;
+                        }
+                }
+        }
+#endif
 }
 
 /* Compute TCP options for SYN packets. This is not the final
@@ -603,11 +639,14 @@ static unsigned int tcp_syn_options(struct sock *sk, struct sk_buff *skb,
                 }
         }
 
+        smc_set_option(tp, opts, &remaining);
+
         return MAX_TCP_OPTION_SPACE - remaining;
 }
 
 /* Set up TCP options for SYN-ACKs. */
-static unsigned int tcp_synack_options(struct request_sock *req,
+static unsigned int tcp_synack_options(const struct sock *sk,
+                                       struct request_sock *req,
                                        unsigned int mss, struct sk_buff *skb,
                                        struct tcp_out_options *opts,
                                        const struct tcp_md5sig_key *md5,
@@ -663,6 +702,8 @@ static unsigned int tcp_synack_options(struct request_sock *req,
                 }
         }
 
+        smc_set_option_cond(tcp_sk(sk), ireq, opts, &remaining);
+
         return MAX_TCP_OPTION_SPACE - remaining;
 }
 
@@ -973,6 +1014,12 @@ static void tcp_internal_pacing(struct sock *sk, const struct sk_buff *skb)
                       HRTIMER_MODE_ABS_PINNED);
 }
 
+static void tcp_update_skb_after_send(struct tcp_sock *tp, struct sk_buff *skb)
+{
+        skb->skb_mstamp = tp->tcp_mstamp;
+        list_move_tail(&skb->tcp_tsorted_anchor, &tp->tsorted_sent_queue);
+}
+
 /* This routine actually transmits TCP packets queued in by
  * tcp_do_sendmsg().  This is used by both the initial
  * transmission and possible later retransmissions.
@@ -1005,10 +1052,14 @@ static int tcp_transmit_skb(struct sock *sk, struct sk_buff *skb, int clone_it,
                 TCP_SKB_CB(skb)->tx.in_flight = TCP_SKB_CB(skb)->end_seq
                         - tp->snd_una;
                 oskb = skb;
-                if (unlikely(skb_cloned(skb)))
-                        skb = pskb_copy(skb, gfp_mask);
-                else
-                        skb = skb_clone(skb, gfp_mask);
+
+                tcp_skb_tsorted_save(oskb) {
+                        if (unlikely(skb_cloned(oskb)))
+                                skb = pskb_copy(oskb, gfp_mask);
+                        else
+                                skb = skb_clone(oskb, gfp_mask);
+                } tcp_skb_tsorted_restore(oskb);
+
                 if (unlikely(!skb))
                         return -ENOBUFS;
         }
@@ -1129,7 +1180,7 @@ static int tcp_transmit_skb(struct sock *sk, struct sk_buff *skb, int clone_it,
                 err = net_xmit_eval(err);
         }
         if (!err && oskb) {
-                oskb->skb_mstamp = tp->tcp_mstamp;
+                tcp_update_skb_after_send(tp, oskb);
                 tcp_rate_skb_sent(sk, oskb);
         }
         return err;
@@ -1167,21 +1218,6 @@ static void tcp_set_skb_tso_segs(struct sk_buff *skb, unsigned int mss_now)
         }
 }
 
-/* When a modification to fackets out becomes necessary, we need to check
- * skb is counted to fackets_out or not.
- */
-static void tcp_adjust_fackets_out(struct sock *sk, const struct sk_buff *skb,
-                                   int decr)
-{
-        struct tcp_sock *tp = tcp_sk(sk);
-
-        if (!tp->sacked_out || tcp_is_reno(tp))
-                return;
-
-        if (after(tcp_highest_sack_seq(tp), TCP_SKB_CB(skb)->seq))
-                tp->fackets_out -= decr;
-}
-
 /* Pcount in the middle of the write queue got changed, we need to do various
  * tweaks to fix counters
  */
@@ -1202,11 +1238,9 @@ static void tcp_adjust_pcount(struct sock *sk, const struct sk_buff *skb, int de
         if (tcp_is_reno(tp) && decr > 0)
                 tp->sacked_out -= min_t(u32, tp->sacked_out, decr);
 
-        tcp_adjust_fackets_out(sk, skb, decr);
-
         if (tp->lost_skb_hint &&
             before(TCP_SKB_CB(skb)->seq, TCP_SKB_CB(tp->lost_skb_hint)->seq) &&
-            (tcp_is_fack(tp) || (TCP_SKB_CB(skb)->sacked & TCPCB_SACKED_ACKED)))
+            (TCP_SKB_CB(skb)->sacked & TCPCB_SACKED_ACKED))
                 tp->lost_cnt_hint -= decr;
 
         tcp_verify_left_out(tp);
@@ -1241,12 +1275,25 @@ static void tcp_skb_fragment_eor(struct sk_buff *skb, struct sk_buff *skb2)
         TCP_SKB_CB(skb)->eor = 0;
 }
 
+/* Insert buff after skb on the write or rtx queue of sk.  */
+static void tcp_insert_write_queue_after(struct sk_buff *skb,
+                                         struct sk_buff *buff,
+                                         struct sock *sk,
+                                         enum tcp_queue tcp_queue)
+{
+        if (tcp_queue == TCP_FRAG_IN_WRITE_QUEUE)
+                __skb_queue_after(&sk->sk_write_queue, skb, buff);
+        else
+                tcp_rbtree_insert(&sk->tcp_rtx_queue, buff);
+}
+
 /* Function to create two new TCP segments.  Shrinks the given segment
  * to the specified size and appends a new segment with the rest of the
  * packet to the list.  This won't be called frequently, I hope.
  * Remember, these are still headerless SKBs at this point.
  */
-int tcp_fragment(struct sock *sk, struct sk_buff *skb, u32 len,
+int tcp_fragment(struct sock *sk, enum tcp_queue tcp_queue,
+                 struct sk_buff *skb, u32 len,
                  unsigned int mss_now, gfp_t gfp)
 {
         struct tcp_sock *tp = tcp_sk(sk);
@@ -1329,7 +1376,9 @@ int tcp_fragment(struct sock *sk, struct sk_buff *skb, u32 len,
 
         /* Link BUFF into the send queue. */
         __skb_header_release(buff);
-        tcp_insert_write_queue_after(skb, buff, sk);
+        tcp_insert_write_queue_after(skb, buff, sk, tcp_queue);
+        if (tcp_queue == TCP_FRAG_IN_RTX_QUEUE)
+                list_add(&buff->tcp_tsorted_anchor, &skb->tcp_tsorted_anchor);
 
         return 0;
 }
@@ -1607,7 +1656,7 @@ static void tcp_cwnd_validate(struct sock *sk, bool is_cwnd_limited)
                 if (tp->packets_out > tp->snd_cwnd_used)
                         tp->snd_cwnd_used = tp->packets_out;
 
-                if (sysctl_tcp_slow_start_after_idle &&
+                if (sock_net(sk)->ipv4.sysctl_tcp_slow_start_after_idle &&
                     (s32)(tcp_jiffies32 - tp->snd_cwnd_stamp) >= inet_csk(sk)->icsk_rto &&
                     !ca_ops->cong_control)
                         tcp_cwnd_application_limited(sk);
@@ -1616,10 +1665,10 @@ static void tcp_cwnd_validate(struct sock *sk, bool is_cwnd_limited)
                  * is caused by insufficient sender buffer:
                  * 1) just sent some data (see tcp_write_xmit)
                  * 2) not cwnd limited (this else condition)
-                 * 3) no more data to send (null tcp_send_head )
+                 * 3) no more data to send (tcp_write_queue_empty())
                  * 4) application is hitting buffer limit (SOCK_NOSPACE)
                  */
-                if (!tcp_send_head(sk) && sk->sk_socket &&
+                if (tcp_write_queue_empty(sk) && sk->sk_socket &&
                     test_bit(SOCK_NOSPACE, &sk->sk_socket->flags) &&
                     (1 << sk->sk_state) & (TCPF_ESTABLISHED | TCPF_CLOSE_WAIT))
                         tcp_chrono_start(sk, TCP_CHRONO_SNDBUF_LIMITED);
@@ -1671,7 +1720,7 @@ u32 tcp_tso_autosize(const struct sock *sk, unsigned int mss_now,
 {
         u32 bytes, segs;
 
-        bytes = min(sk->sk_pacing_rate >> 10,
+        bytes = min(sk->sk_pacing_rate >> sk->sk_pacing_shift,
                     sk->sk_gso_max_size - 1 - MAX_TCP_HEADER);
 
         /* Goal is to send at least one packet per ms,
@@ -1694,7 +1743,8 @@ static u32 tcp_tso_segs(struct sock *sk, unsigned int mss_now)
         u32 tso_segs = ca_ops->tso_segs_goal ? ca_ops->tso_segs_goal(sk) : 0;
 
         return tso_segs ? :
-                tcp_tso_autosize(sk, mss_now, sysctl_tcp_min_tso_segs);
+                tcp_tso_autosize(sk, mss_now,
+                                 sock_net(sk)->ipv4.sysctl_tcp_min_tso_segs);
 }
 
 /* Returns the portion of skb which can be sent right away */
@@ -1815,7 +1865,8 @@ static bool tcp_snd_wnd_test(const struct tcp_sock *tp,
  * know that all the data is in scatter-gather pages, and that the
  * packet has never been sent out before (and thus is not cloned).
  */
-static int tso_fragment(struct sock *sk, struct sk_buff *skb, unsigned int len,
+static int tso_fragment(struct sock *sk, enum tcp_queue tcp_queue,
+                        struct sk_buff *skb, unsigned int len,
                         unsigned int mss_now, gfp_t gfp)
 {
         struct sk_buff *buff;
@@ -1824,7 +1875,7 @@ static int tso_fragment(struct sock *sk, struct sk_buff *skb, unsigned int len,
 
         /* All of a TSO frame must be composed of paged data.  */
         if (skb->len != skb->data_len)
-                return tcp_fragment(sk, skb, len, mss_now, gfp);
+                return tcp_fragment(sk, tcp_queue, skb, len, mss_now, gfp);
 
         buff = sk_stream_alloc_skb(sk, 0, gfp, true);
         if (unlikely(!buff))
@@ -1860,7 +1911,7 @@ static int tso_fragment(struct sock *sk, struct sk_buff *skb, unsigned int len,
 
         /* Link BUFF into the send queue. */
         __skb_header_release(buff);
-        tcp_insert_write_queue_after(skb, buff, sk);
+        tcp_insert_write_queue_after(skb, buff, sk, tcp_queue);
 
         return 0;
 }
@@ -1910,7 +1961,7 @@ static bool tcp_tso_should_defer(struct sock *sk, struct sk_buff *skb,
         if ((skb != tcp_write_queue_tail(sk)) && (limit >= skb->len))
                 goto send_now;
 
-        win_divisor = READ_ONCE(sysctl_tcp_tso_win_divisor);
+        win_divisor = READ_ONCE(sock_net(sk)->ipv4.sysctl_tcp_tso_win_divisor);
         if (win_divisor) {
                 u32 chunk = min(tp->snd_wnd, tp->snd_cwnd * tp->mss_cache);
 
@@ -1930,8 +1981,10 @@ static bool tcp_tso_should_defer(struct sock *sk, struct sk_buff *skb,
                         goto send_now;
         }
 
-        head = tcp_write_queue_head(sk);
-
+        /* TODO : use tsorted_sent_queue ? */
+        head = tcp_rtx_queue_head(sk);
+        if (!head)
+                goto send_now;
         age = tcp_stamp_us_delta(tp->tcp_mstamp, head->skb_mstamp);
         /* If next ACK is likely to come too late (half srtt), do not defer */
         if (age < (tp->srtt_us >> 4))
@@ -2145,18 +2198,18 @@ static bool tcp_small_queue_check(struct sock *sk, const struct sk_buff *skb,
 {
         unsigned int limit;
 
-        limit = max(2 * skb->truesize, sk->sk_pacing_rate >> 10);
-        limit = min_t(u32, limit, sysctl_tcp_limit_output_bytes);
+        limit = max(2 * skb->truesize, sk->sk_pacing_rate >> sk->sk_pacing_shift);
+        limit = min_t(u32, limit,
+                      sock_net(sk)->ipv4.sysctl_tcp_limit_output_bytes);
         limit <<= factor;
 
         if (refcount_read(&sk->sk_wmem_alloc) > limit) {
-                /* Always send the 1st or 2nd skb in write queue.
+                /* Always send skb if rtx queue is empty.
                  * No need to wait for TX completion to call us back,
                  * after softirq/tasklet schedule.
                  * This helps when TX completions are delayed too much.
                  */
-                if (skb == sk->sk_write_queue.next ||
-                    skb->prev == sk->sk_write_queue.next)
+                if (tcp_rtx_queue_empty(sk))
                         return false;
 
                 set_bit(TSQ_THROTTLED, &sk->sk_tsq_flags);
@@ -2207,7 +2260,7 @@ void tcp_chrono_stop(struct sock *sk, const enum tcp_chrono type)
          * it's the "most interesting" or current chrono we are
          * tracking and starts busy chrono if we have pending data.
          */
-        if (tcp_write_queue_empty(sk))
+        if (tcp_rtx_and_write_queues_empty(sk))
                 tcp_chrono_set(tp, TCP_CHRONO_UNSPEC);
         else if (type == tp->chrono_type)
                 tcp_chrono_set(tp, TCP_CHRONO_BUSY);
@@ -2263,7 +2316,7 @@ static bool tcp_write_xmit(struct sock *sk, unsigned int mss_now, int nonagle,
 
                 if (unlikely(tp->repair) && tp->repair_queue == TCP_SEND_QUEUE) {
                         /* "skb_mstamp" is used as a start point for the retransmit timer */
-                        skb->skb_mstamp = tp->tcp_mstamp;
+                        tcp_update_skb_after_send(tp, skb);
                         goto repair; /* Skip network transmission */
                 }
 
@@ -2302,7 +2355,8 @@ static bool tcp_write_xmit(struct sock *sk, unsigned int mss_now, int nonagle,
                                                     nonagle);
 
                 if (skb->len > limit &&
-                    unlikely(tso_fragment(sk, skb, limit, mss_now, gfp)))
+                    unlikely(tso_fragment(sk, TCP_FRAG_IN_WRITE_QUEUE,
+                                          skb, limit, mss_now, gfp)))
                         break;
 
                 if (test_bit(TCP_TSQ_DEFERRED, &sk->sk_tsq_flags))
@@ -2337,19 +2391,20 @@ repair:
 
                 /* Send one loss probe per tail loss episode. */
                 if (push_one != 2)
-                        tcp_schedule_loss_probe(sk);
+                        tcp_schedule_loss_probe(sk, false);
                 is_cwnd_limited |= (tcp_packets_in_flight(tp) >= tp->snd_cwnd);
                 tcp_cwnd_validate(sk, is_cwnd_limited);
                 return false;
         }
-        return !tp->packets_out && tcp_send_head(sk);
+        return !tp->packets_out && !tcp_write_queue_empty(sk);
 }
 
-bool tcp_schedule_loss_probe(struct sock *sk)
+bool tcp_schedule_loss_probe(struct sock *sk, bool advancing_rto)
 {
         struct inet_connection_sock *icsk = inet_csk(sk);
         struct tcp_sock *tp = tcp_sk(sk);
         u32 timeout, rto_delta_us;
+        int early_retrans;
 
         /* Don't do any loss probe on a Fast Open connection before 3WHS
          * finishes.
@@ -2357,16 +2412,17 @@ bool tcp_schedule_loss_probe(struct sock *sk)
         if (tp->fastopen_rsk)
                 return false;
 
+        early_retrans = sock_net(sk)->ipv4.sysctl_tcp_early_retrans;
         /* Schedule a loss probe in 2*RTT for SACK capable connections
          * in Open state, that are either limited by cwnd or application.
          */
-        if ((sysctl_tcp_early_retrans != 3 && sysctl_tcp_early_retrans != 4) ||
+        if ((early_retrans != 3 && early_retrans != 4) ||
             !tp->packets_out || !tcp_is_sack(tp) ||
             icsk->icsk_ca_state != TCP_CA_Open)
                 return false;
 
         if ((tp->snd_cwnd > tcp_packets_in_flight(tp)) &&
-             tcp_send_head(sk))
+             !tcp_write_queue_empty(sk))
                 return false;
 
         /* Probe timeout is 2*rtt. Add minimum RTO to account
@@ -2384,7 +2440,9 @@ bool tcp_schedule_loss_probe(struct sock *sk)
         }
 
         /* If the RTO formula yields an earlier time, then use that time. */
-        rto_delta_us = tcp_rto_delta_us(sk);  /* How far in future is RTO? */
+        rto_delta_us = advancing_rto ?
+                        jiffies_to_usecs(inet_csk(sk)->icsk_rto) :
+                        tcp_rto_delta_us(sk);  /* How far in future is RTO? */
         if (rto_delta_us > 0)
                 timeout = min_t(u32, timeout, usecs_to_jiffies(rto_delta_us));
 
@@ -2419,18 +2477,14 @@ void tcp_send_loss_probe(struct sock *sk)
         int mss = tcp_current_mss(sk);
 
         skb = tcp_send_head(sk);
-        if (skb) {
-                if (tcp_snd_wnd_test(tp, skb, mss)) {
-                        pcount = tp->packets_out;
-                        tcp_write_xmit(sk, mss, TCP_NAGLE_OFF, 2, GFP_ATOMIC);
-                        if (tp->packets_out > pcount)
-                                goto probe_sent;
-                        goto rearm_timer;
-                }
-                skb = tcp_write_queue_prev(sk, skb);
-        } else {
-                skb = tcp_write_queue_tail(sk);
+        if (skb && tcp_snd_wnd_test(tp, skb, mss)) {
+                pcount = tp->packets_out;
+                tcp_write_xmit(sk, mss, TCP_NAGLE_OFF, 2, GFP_ATOMIC);
+                if (tp->packets_out > pcount)
+                        goto probe_sent;
+                goto rearm_timer;
         }
+        skb = skb_rb_last(&sk->tcp_rtx_queue);
 
         /* At most one outstanding TLP retransmission. */
         if (tp->tlp_high_seq)
@@ -2448,10 +2502,11 @@ void tcp_send_loss_probe(struct sock *sk)
                 goto rearm_timer;
 
         if ((pcount > 1) && (skb->len > (pcount - 1) * mss)) {
-                if (unlikely(tcp_fragment(sk, skb, (pcount - 1) * mss, mss,
+                if (unlikely(tcp_fragment(sk, TCP_FRAG_IN_RTX_QUEUE, skb,
+                                          (pcount - 1) * mss, mss,
                                           GFP_ATOMIC)))
                         goto rearm_timer;
-                skb = tcp_write_queue_next(sk, skb);
+                skb = skb_rb_next(skb);
         }
 
         if (WARN_ON(!skb || !tcp_skb_pcount(skb)))
@@ -2651,7 +2706,7 @@ void tcp_skb_collapse_tstamp(struct sk_buff *skb,
 static bool tcp_collapse_retrans(struct sock *sk, struct sk_buff *skb)
 {
         struct tcp_sock *tp = tcp_sk(sk);
-        struct sk_buff *next_skb = tcp_write_queue_next(sk, skb);
+        struct sk_buff *next_skb = skb_rb_next(skb);
         int skb_size, next_skb_size;
 
         skb_size = skb->len;
@@ -2668,8 +2723,6 @@ static bool tcp_collapse_retrans(struct sock *sk, struct sk_buff *skb)
         }
         tcp_highest_sack_replace(sk, next_skb, skb);
 
-        tcp_unlink_write_queue(next_skb, sk);
-
         if (next_skb->ip_summed == CHECKSUM_PARTIAL)
                 skb->ip_summed = CHECKSUM_PARTIAL;
 
@@ -2697,7 +2750,7 @@ static bool tcp_collapse_retrans(struct sock *sk, struct sk_buff *skb)
 
         tcp_skb_collapse_tstamp(skb, next_skb);
 
-        sk_wmem_free_skb(sk, next_skb);
+        tcp_rtx_queue_unlink_and_free(next_skb, sk);
         return true;
 }
 
@@ -2708,8 +2761,6 @@ static bool tcp_can_collapse(const struct sock *sk, const struct sk_buff *skb)
                 return false;
         if (skb_cloned(skb))
                 return false;
-        if (skb == tcp_send_head(sk))
-                return false;
         /* Some heuristics for collapsing over SACK'd could be invented */
         if (TCP_SKB_CB(skb)->sacked & TCPCB_SACKED_ACKED)
                 return false;
@@ -2727,12 +2778,12 @@ static void tcp_retrans_try_collapse(struct sock *sk, struct sk_buff *to,
         struct sk_buff *skb = to, *tmp;
         bool first = true;
 
-        if (!sysctl_tcp_retrans_collapse)
+        if (!sock_net(sk)->ipv4.sysctl_tcp_retrans_collapse)
                 return;
         if (TCP_SKB_CB(skb)->tcp_flags & TCPHDR_SYN)
                 return;
 
-        tcp_for_write_queue_from_safe(skb, tmp, sk) {
+        skb_rbtree_walk_from_safe(skb, tmp) {
                 if (!tcp_can_collapse(sk, skb))
                         break;
 
@@ -2807,7 +2858,8 @@ int __tcp_retransmit_skb(struct sock *sk, struct sk_buff *skb, int segs)
 
         len = cur_mss * segs;
         if (skb->len > len) {
-                if (tcp_fragment(sk, skb, len, cur_mss, GFP_ATOMIC))
+                if (tcp_fragment(sk, TCP_FRAG_IN_RTX_QUEUE, skb, len,
+                                 cur_mss, GFP_ATOMIC))
                         return -ENOMEM; /* We'll try again later. */
         } else {
                 if (skb_unclone(skb, GFP_ATOMIC))
@@ -2841,11 +2893,14 @@ int __tcp_retransmit_skb(struct sock *sk, struct sk_buff *skb, int segs)
                      skb_headroom(skb) >= 0xFFFF)) {
                 struct sk_buff *nskb;
 
-                nskb = __pskb_copy(skb, MAX_TCP_HEADER, GFP_ATOMIC);
-                err = nskb ? tcp_transmit_skb(sk, nskb, 0, GFP_ATOMIC) :
-                             -ENOBUFS;
+                tcp_skb_tsorted_save(skb) {
+                        nskb = __pskb_copy(skb, MAX_TCP_HEADER, GFP_ATOMIC);
+                        err = nskb ? tcp_transmit_skb(sk, nskb, 0, GFP_ATOMIC) :
+                                     -ENOBUFS;
+                } tcp_skb_tsorted_restore(skb);
+
                 if (!err) {
-                        skb->skb_mstamp = tp->tcp_mstamp;
+                        tcp_update_skb_after_send(tp, skb);
                         tcp_rate_skb_sent(sk, skb);
                 }
         } else {
@@ -2854,6 +2909,7 @@ int __tcp_retransmit_skb(struct sock *sk, struct sk_buff *skb, int segs)
 
         if (likely(!err)) {
                 TCP_SKB_CB(skb)->sacked |= TCPCB_EVER_RETRANS;
+                trace_tcp_retransmit_skb(sk, skb);
         } else if (err != -EBUSY) {
                 NET_INC_STATS(sock_net(sk), LINUX_MIB_TCPRETRANSFAIL);
         }
@@ -2890,36 +2946,25 @@ int tcp_retransmit_skb(struct sock *sk, struct sk_buff *skb, int segs)
  * retransmitted data is acknowledged.  It tries to continue
  * resending the rest of the retransmit queue, until either
  * we've sent it all or the congestion window limit is reached.
- * If doing SACK, the first ACK which comes back for a timeout
- * based retransmit packet might feed us FACK information again.
- * If so, we use it to avoid unnecessarily retransmissions.
  */
 void tcp_xmit_retransmit_queue(struct sock *sk)
 {
         const struct inet_connection_sock *icsk = inet_csk(sk);
+        struct sk_buff *skb, *rtx_head, *hole = NULL;
         struct tcp_sock *tp = tcp_sk(sk);
-        struct sk_buff *skb;
-        struct sk_buff *hole = NULL;
         u32 max_segs;
         int mib_idx;
 
         if (!tp->packets_out)
                 return;
 
-        if (tp->retransmit_skb_hint) {
-                skb = tp->retransmit_skb_hint;
-        } else {
-                skb = tcp_write_queue_head(sk);
-        }
-
+        rtx_head = tcp_rtx_queue_head(sk);
+        skb = tp->retransmit_skb_hint ?: rtx_head;
         max_segs = tcp_tso_segs(sk, tcp_current_mss(sk));
-        tcp_for_write_queue_from(skb, sk) {
+        skb_rbtree_walk_from(skb) {
                 __u8 sacked;
                 int segs;
 
-                if (skb == tcp_send_head(sk))
-                        break;
-
                 if (tcp_pacing_check(sk))
                         break;
 
@@ -2964,7 +3009,7 @@ void tcp_xmit_retransmit_queue(struct sock *sk)
                 if (tcp_in_cwnd_reduction(sk))
                         tp->prr_out += tcp_skb_pcount(skb);
 
-                if (skb == tcp_write_queue_head(sk) &&
+                if (skb == rtx_head &&
                     icsk->icsk_pending != ICSK_TIME_REO_TIMEOUT)
                         inet_csk_reset_xmit_timer(sk, ICSK_TIME_RETRANS,
                                                   inet_csk(sk)->icsk_rto,
@@ -3006,12 +3051,15 @@ void tcp_send_fin(struct sock *sk)
          * Note: in the latter case, FIN packet will be sent after a timeout,
          * as TCP stack thinks it has already been transmitted.
          */
-        if (tskb && (tcp_send_head(sk) || tcp_under_memory_pressure(sk))) {
+        if (!tskb && tcp_under_memory_pressure(sk))
+                tskb = skb_rb_last(&sk->tcp_rtx_queue);
+
+        if (tskb) {
 coalesce:
                 TCP_SKB_CB(tskb)->tcp_flags |= TCPHDR_FIN;
                 TCP_SKB_CB(tskb)->end_seq++;
                 tp->write_seq++;
-                if (!tcp_send_head(sk)) {
+                if (tcp_write_queue_empty(sk)) {
                         /* This means tskb was already sent.
                          * Pretend we included the FIN on previous transmit.
                          * We need to set tp->snd_nxt to the value it would have
@@ -3028,6 +3076,7 @@ coalesce:
                                 goto coalesce;
                         return;
                 }
+                INIT_LIST_HEAD(&skb->tcp_tsorted_anchor);
                 skb_reserve(skb, MAX_TCP_HEADER);
                 sk_forced_mem_schedule(sk, skb->truesize);
                 /* FIN eats a sequence byte, write_seq advanced by tcp_queue_skb(). */
@@ -3064,6 +3113,11 @@ void tcp_send_active_reset(struct sock *sk, gfp_t priority)
         /* Send it off. */
         if (tcp_transmit_skb(sk, skb, 0, priority))
                 NET_INC_STATS(sock_net(sk), LINUX_MIB_TCPABORTFAILED);
+
+        /* skb of trace_tcp_send_reset() keeps the skb that caused RST,
+         * skb here is different to the troublesome skb, so use NULL
+         */
+        trace_tcp_send_reset(sk, NULL);
 }
 
 /* Send a crossed SYN-ACK during socket establishment.
@@ -3076,20 +3130,24 @@ int tcp_send_synack(struct sock *sk)
 {
         struct sk_buff *skb;
 
-        skb = tcp_write_queue_head(sk);
+        skb = tcp_rtx_queue_head(sk);
         if (!skb || !(TCP_SKB_CB(skb)->tcp_flags & TCPHDR_SYN)) {
-                pr_debug("%s: wrong queue state\n", __func__);
+                pr_err("%s: wrong queue state\n", __func__);
                 return -EFAULT;
         }
         if (!(TCP_SKB_CB(skb)->tcp_flags & TCPHDR_ACK)) {
                 if (skb_cloned(skb)) {
-                        struct sk_buff *nskb = skb_copy(skb, GFP_ATOMIC);
+                        struct sk_buff *nskb;
+
+                        tcp_skb_tsorted_save(skb) {
+                                nskb = skb_copy(skb, GFP_ATOMIC);
+                        } tcp_skb_tsorted_restore(skb);
                         if (!nskb)
                                 return -ENOMEM;
-                        tcp_unlink_write_queue(skb, sk);
+                        INIT_LIST_HEAD(&nskb->tcp_tsorted_anchor);
+                        tcp_rtx_queue_unlink_and_free(skb, sk);
                         __skb_header_release(nskb);
-                        __tcp_add_write_queue_head(sk, nskb);
-                        sk_wmem_free_skb(sk, skb);
+                        tcp_rbtree_insert(&sk->tcp_rtx_queue, nskb);
                         sk->sk_wmem_queued += nskb->truesize;
                         sk_mem_charge(sk, nskb->truesize);
                         skb = nskb;
@@ -3166,8 +3224,8 @@ struct sk_buff *tcp_make_synack(const struct sock *sk, struct dst_entry *dst,
         md5 = tcp_rsk(req)->af_specific->req_md5_lookup(sk, req_to_sk(req));
 #endif
         skb_set_hash(skb, tcp_rsk(req)->txhash, PKT_HASH_TYPE_L4);
-        tcp_header_size = tcp_synack_options(req, mss, skb, &opts, md5, foc) +
-                          sizeof(*th);
+        tcp_header_size = tcp_synack_options(sk, req, mss, skb, &opts, md5,
+                                             foc) + sizeof(*th);
 
         skb_push(skb, tcp_header_size);
         skb_reset_transport_header(skb);
@@ -3268,7 +3326,7 @@ static void tcp_connect_init(struct sock *sk)
         if (rcv_wnd == 0)
                 rcv_wnd = dst_metric(dst, RTAX_INITRWND);
 
-        tcp_select_initial_window(tcp_full_space(sk),
+        tcp_select_initial_window(sk, tcp_full_space(sk),
                                   tp->advmss - (tp->rx_opt.ts_recent_stamp ? tp->tcp_header_len - sizeof(struct tcphdr) : 0),
                                   &tp->rcv_wnd,
                                   &tp->window_clamp,
@@ -3307,7 +3365,6 @@ static void tcp_connect_queue_skb(struct sock *sk, struct sk_buff *skb)
 
         tcb->end_seq += skb->len;
         __skb_header_release(skb);
-        __tcp_add_write_queue_tail(sk, skb);
         sk->sk_wmem_queued += skb->truesize;
         sk_mem_charge(sk, skb->truesize);
         tp->write_seq = tcb->end_seq;
@@ -3355,6 +3412,7 @@ static int tcp_send_syn_data(struct sock *sk, struct sk_buff *syn)
                 int copied = copy_from_iter(skb_put(syn_data, space), space,
                                             &fo->data->msg_iter);
                 if (unlikely(!copied)) {
+                        tcp_skb_tsorted_anchor_cleanup(syn_data);
                         kfree_skb(syn_data);
                         goto fallback;
                 }
@@ -3385,12 +3443,13 @@ static int tcp_send_syn_data(struct sock *sk, struct sk_buff *syn)
         TCP_SKB_CB(syn_data)->tcp_flags = TCPHDR_ACK | TCPHDR_PSH;
         if (!err) {
                 tp->syn_data = (fo->copied > 0);
+                tcp_rbtree_insert(&sk->tcp_rtx_queue, syn_data);
                 NET_INC_STATS(sock_net(sk), LINUX_MIB_TCPORIGDATASENT);
                 goto done;
         }
 
-        /* data was not sent, this is our new send_head */
-        sk->sk_send_head = syn_data;
+        /* data was not sent, put it in write_queue */
+        __skb_queue_tail(&sk->sk_write_queue, syn_data);
         tp->packets_out -= tcp_skb_pcount(syn_data);
 
 fallback:
@@ -3433,6 +3492,7 @@ int tcp_connect(struct sock *sk)
         tp->retrans_stamp = tcp_time_stamp(tp);
         tcp_connect_queue_skb(sk, buff);
         tcp_ecn_send_syn(sk, buff);
+        tcp_rbtree_insert(&sk->tcp_rtx_queue, buff);
 
         /* Send off SYN; include data in Fast Open. */
         err = tp->fastopen_req ? tcp_send_syn_data(sk, buff) :
@@ -3627,7 +3687,8 @@ int tcp_write_wakeup(struct sock *sk, int mib)
                     skb->len > mss) {
                         seg_size = min(seg_size, mss);
                         TCP_SKB_CB(skb)->tcp_flags |= TCPHDR_PSH;
-                        if (tcp_fragment(sk, skb, seg_size, mss, GFP_ATOMIC))
+                        if (tcp_fragment(sk, TCP_FRAG_IN_WRITE_QUEUE,
+                                         skb, seg_size, mss, GFP_ATOMIC))
                                 return -1;
                 } else if (!tcp_skb_pcount(skb))
                         tcp_set_skb_tso_segs(skb, mss);
@@ -3657,7 +3718,7 @@ void tcp_send_probe0(struct sock *sk)
 
         err = tcp_write_wakeup(sk, LINUX_MIB_TCPWINPROBE);
 
-        if (tp->packets_out || !tcp_send_head(sk)) {
+        if (tp->packets_out || tcp_write_queue_empty(sk)) {
                 /* Cancel probe timer, if it is not required. */
                 icsk->icsk_probes_out = 0;
                 icsk->icsk_backoff = 0;
@@ -3698,6 +3759,7 @@ int tcp_rtx_synack(const struct sock *sk, struct request_sock *req)
                 __NET_INC_STATS(sock_net(sk), LINUX_MIB_TCPSYNRETRANS);
                 if (unlikely(tcp_passive_fastopen(sk)))
                         tcp_sk(sk)->total_retrans++;
+                trace_tcp_retransmit_synack(sk, req);
         }
         return res;
 }
diff --git a/net/ipv4/tcp_recovery.c b/net/ipv4/tcp_recovery.c
index be8ef1e5dfef..d3ea89020c69 100644
--- a/net/ipv4/tcp_recovery.c
+++ b/net/ipv4/tcp_recovery.c
@@ -2,8 +2,6 @@
 #include <linux/tcp.h>
 #include <net/tcp.h>
 
-int sysctl_tcp_recovery __read_mostly = TCP_RACK_LOSS_DETECTION;
-
 static void tcp_rack_mark_skb_lost(struct sock *sk, struct sk_buff *skb)
 {
         struct tcp_sock *tp = tcp_sk(sk);
@@ -46,7 +44,8 @@ static bool tcp_rack_sent_after(u64 t1, u64 t2, u32 seq1, u32 seq2)
 static void tcp_rack_detect_loss(struct sock *sk, u32 *reo_timeout)
 {
         struct tcp_sock *tp = tcp_sk(sk);
-        struct sk_buff *skb;
+        u32 min_rtt = tcp_min_rtt(tp);
+        struct sk_buff *skb, *n;
         u32 reo_wnd;
 
         *reo_timeout = 0;
@@ -56,48 +55,36 @@ static void tcp_rack_detect_loss(struct sock *sk, u32 *reo_timeout)
          * to queuing or delayed ACKs.
          */
         reo_wnd = 1000;
-        if ((tp->rack.reord || !tp->lost_out) && tcp_min_rtt(tp) != ~0U)
-                reo_wnd = max(tcp_min_rtt(tp) >> 2, reo_wnd);
+        if ((tp->rack.reord || !tp->lost_out) && min_rtt != ~0U) {
+                reo_wnd = max((min_rtt >> 2) * tp->rack.reo_wnd_steps, reo_wnd);
+                reo_wnd = min(reo_wnd, tp->srtt_us >> 3);
+        }
 
-        tcp_for_write_queue(skb, sk) {
+        list_for_each_entry_safe(skb, n, &tp->tsorted_sent_queue,
+                                 tcp_tsorted_anchor) {
                 struct tcp_skb_cb *scb = TCP_SKB_CB(skb);
+                s32 remaining;
 
-                if (skb == tcp_send_head(sk))
-                        break;
-
-                /* Skip ones already (s)acked */
-                if (!after(scb->end_seq, tp->snd_una) ||
-                    scb->sacked & TCPCB_SACKED_ACKED)
+                /* Skip ones marked lost but not yet retransmitted */
+                if ((scb->sacked & TCPCB_LOST) &&
+                    !(scb->sacked & TCPCB_SACKED_RETRANS))
                         continue;
 
-                if (tcp_rack_sent_after(tp->rack.mstamp, skb->skb_mstamp,
-                                        tp->rack.end_seq, scb->end_seq)) {
-                        /* Step 3 in draft-cheng-tcpm-rack-00.txt:
-                         * A packet is lost if its elapsed time is beyond
-                         * the recent RTT plus the reordering window.
-                         */
-                        u32 elapsed = tcp_stamp_us_delta(tp->tcp_mstamp,
-                                                         skb->skb_mstamp);
-                        s32 remaining = tp->rack.rtt_us + reo_wnd - elapsed;
-
-                        if (remaining < 0) {
-                                tcp_rack_mark_skb_lost(sk, skb);
-                                continue;
-                        }
-
-                        /* Skip ones marked lost but not yet retransmitted */
-                        if ((scb->sacked & TCPCB_LOST) &&
-                            !(scb->sacked & TCPCB_SACKED_RETRANS))
-                                continue;
+                if (!tcp_rack_sent_after(tp->rack.mstamp, skb->skb_mstamp,
+                                         tp->rack.end_seq, scb->end_seq))
+                        break;
 
+                /* A packet is lost if it has not been s/acked beyond
+                 * the recent RTT plus the reordering window.
+                 */
+                remaining = tp->rack.rtt_us + reo_wnd -
+                            tcp_stamp_us_delta(tp->tcp_mstamp, skb->skb_mstamp);
+                if (remaining < 0) {
+                        tcp_rack_mark_skb_lost(sk, skb);
+                        list_del_init(&skb->tcp_tsorted_anchor);
+                } else {
                         /* Record maximum wait time (+1 to avoid 0) */
                         *reo_timeout = max_t(u32, *reo_timeout, 1 + remaining);
-
-                } else if (!(scb->sacked & TCPCB_RETRANS)) {
-                        /* Original data are sent sequentially so stop early
-                         * b/c the rest are all sent after rack_sent
-                         */
-                        break;
                 }
         }
 }
@@ -176,3 +163,44 @@ void tcp_rack_reo_timeout(struct sock *sk)
         if (inet_csk(sk)->icsk_pending != ICSK_TIME_RETRANS)
                 tcp_rearm_rto(sk);
 }
+
+/* Updates the RACK's reo_wnd based on DSACK and no. of recoveries.
+ *
+ * If DSACK is received, increment reo_wnd by min_rtt/4 (upper bounded
+ * by srtt), since there is possibility that spurious retransmission was
+ * due to reordering delay longer than reo_wnd.
+ *
+ * Persist the current reo_wnd value for TCP_RACK_RECOVERY_THRESH (16)
+ * no. of successful recoveries (accounts for full DSACK-based loss
+ * recovery undo). After that, reset it to default (min_rtt/4).
+ *
+ * At max, reo_wnd is incremented only once per rtt. So that the new
+ * DSACK on which we are reacting, is due to the spurious retx (approx)
+ * after the reo_wnd has been updated last time.
+ *
+ * reo_wnd is tracked in terms of steps (of min_rtt/4), rather than
+ * absolute value to account for change in rtt.
+ */
+void tcp_rack_update_reo_wnd(struct sock *sk, struct rate_sample *rs)
+{
+        struct tcp_sock *tp = tcp_sk(sk);
+
+        if (sock_net(sk)->ipv4.sysctl_tcp_recovery & TCP_RACK_STATIC_REO_WND ||
+            !rs->prior_delivered)
+                return;
+
+        /* Disregard DSACK if a rtt has not passed since we adjusted reo_wnd */
+        if (before(rs->prior_delivered, tp->rack.last_delivered))
+                tp->rack.dsack_seen = 0;
+
+        /* Adjust the reo_wnd if update is pending */
+        if (tp->rack.dsack_seen) {
+                tp->rack.reo_wnd_steps = min_t(u32, 0xFF,
+                                               tp->rack.reo_wnd_steps + 1);
+                tp->rack.dsack_seen = 0;
+                tp->rack.last_delivered = tp->delivered;
+                tp->rack.reo_wnd_persist = TCP_RACK_RECOVERY_THRESH;
+        } else if (!tp->rack.reo_wnd_persist) {
+                tp->rack.reo_wnd_steps = 1;
+        }
+}
diff --git a/net/ipv4/tcp_timer.c b/net/ipv4/tcp_timer.c
index 655dd8d7f064..16df6dd44b98 100644
--- a/net/ipv4/tcp_timer.c
+++ b/net/ipv4/tcp_timer.c
@@ -22,8 +22,6 @@
 #include <linux/gfp.h>
 #include <net/tcp.h>
 
-int sysctl_tcp_thin_linear_timeouts __read_mostly;
-
 /**
  *  tcp_write_err() - close socket and save error info
  *  @sk:  The socket the error has appeared on.
@@ -109,26 +107,23 @@ static int tcp_orphan_retries(struct sock *sk, bool alive)
 
 static void tcp_mtu_probing(struct inet_connection_sock *icsk, struct sock *sk)
 {
-        struct net *net = sock_net(sk);
+        const struct net *net = sock_net(sk);
+        int mss;
 
         /* Black hole detection */
-        if (net->ipv4.sysctl_tcp_mtu_probing) {
-                if (!icsk->icsk_mtup.enabled) {
-                        icsk->icsk_mtup.enabled = 1;
-                        icsk->icsk_mtup.probe_timestamp = tcp_jiffies32;
-                        tcp_sync_mss(sk, icsk->icsk_pmtu_cookie);
-                } else {
-                        struct net *net = sock_net(sk);
-                        struct tcp_sock *tp = tcp_sk(sk);
-                        int mss;
-
-                        mss = tcp_mtu_to_mss(sk, icsk->icsk_mtup.search_low) >> 1;
-                        mss = min(net->ipv4.sysctl_tcp_base_mss, mss);
-                        mss = max(mss, 68 - tp->tcp_header_len);
-                        icsk->icsk_mtup.search_low = tcp_mss_to_mtu(sk, mss);
-                        tcp_sync_mss(sk, icsk->icsk_pmtu_cookie);
-                }
+        if (!net->ipv4.sysctl_tcp_mtu_probing)
+                return;
+
+        if (!icsk->icsk_mtup.enabled) {
+                icsk->icsk_mtup.enabled = 1;
+                icsk->icsk_mtup.probe_timestamp = tcp_jiffies32;
+        } else {
+                mss = tcp_mtu_to_mss(sk, icsk->icsk_mtup.search_low) >> 1;
+                mss = min(net->ipv4.sysctl_tcp_base_mss, mss);
+                mss = max(mss, 68 - tcp_sk(sk)->tcp_header_len);
+                icsk->icsk_mtup.search_low = tcp_mss_to_mtu(sk, mss);
         }
+        tcp_sync_mss(sk, icsk->icsk_pmtu_cookie);
 }
 
 
@@ -156,8 +151,13 @@ static bool retransmits_timed_out(struct sock *sk,
                 return false;
 
         start_ts = tcp_sk(sk)->retrans_stamp;
-        if (unlikely(!start_ts))
-                start_ts = tcp_skb_timestamp(tcp_write_queue_head(sk));
+        if (unlikely(!start_ts)) {
+                struct sk_buff *head = tcp_rtx_queue_head(sk);
+
+                if (!head)
+                        return false;
+                start_ts = tcp_skb_timestamp(head);
+        }
 
         if (likely(timeout == 0)) {
                 linear_backoff_thresh = ilog2(TCP_RTO_MAX/rto_base);
@@ -283,15 +283,17 @@ out:
  *
  *  Returns: Nothing (void)
  */
-static void tcp_delack_timer(unsigned long data)
+static void tcp_delack_timer(struct timer_list *t)
 {
-        struct sock *sk = (struct sock *)data;
+        struct inet_connection_sock *icsk =
+                        from_timer(icsk, t, icsk_delack_timer);
+        struct sock *sk = &icsk->icsk_inet.sk;
 
         bh_lock_sock(sk);
         if (!sock_owned_by_user(sk)) {
                 tcp_delack_timer_handler(sk);
         } else {
-                inet_csk(sk)->icsk_ack.blocked = 1;
+                icsk->icsk_ack.blocked = 1;
                 __NET_INC_STATS(sock_net(sk), LINUX_MIB_DELAYEDACKLOCKED);
                 /* deleguate our work to tcp_release_cb() */
                 if (!test_and_set_bit(TCP_DELACK_TIMER_DEFERRED, &sk->sk_tsq_flags))
@@ -304,11 +306,12 @@ static void tcp_delack_timer(unsigned long data)
 static void tcp_probe_timer(struct sock *sk)
 {
         struct inet_connection_sock *icsk = inet_csk(sk);
+        struct sk_buff *skb = tcp_send_head(sk);
         struct tcp_sock *tp = tcp_sk(sk);
         int max_probes;
         u32 start_ts;
 
-        if (tp->packets_out || !tcp_send_head(sk)) {
+        if (tp->packets_out || !skb) {
                 icsk->icsk_probes_out = 0;
                 return;
         }
@@ -321,9 +324,9 @@ static void tcp_probe_timer(struct sock *sk)
          * corresponding system limit. We also implement similar policy when
          * we use RTO to probe window in tcp_retransmit_timer().
          */
-        start_ts = tcp_skb_timestamp(tcp_send_head(sk));
+        start_ts = tcp_skb_timestamp(skb);
         if (!start_ts)
-                tcp_send_head(sk)->skb_mstamp = tp->tcp_mstamp;
+                skb->skb_mstamp = tp->tcp_mstamp;
         else if (icsk->icsk_user_timeout &&
                  (s32)(tcp_time_stamp(tp) - start_ts) >
                  jiffies_to_msecs(icsk->icsk_user_timeout))
@@ -408,7 +411,7 @@ void tcp_retransmit_timer(struct sock *sk)
         if (!tp->packets_out)
                 goto out;
 
-        WARN_ON(tcp_write_queue_empty(sk));
+        WARN_ON(tcp_rtx_queue_empty(sk));
 
         tp->tlp_high_seq = 0;
 
@@ -441,7 +444,7 @@ void tcp_retransmit_timer(struct sock *sk)
                         goto out;
                 }
                 tcp_enter_loss(sk);
-                tcp_retransmit_skb(sk, tcp_write_queue_head(sk), 1);
+                tcp_retransmit_skb(sk, tcp_rtx_queue_head(sk), 1);
                 __sk_dst_reset(sk);
                 goto out_reset_timer;
         }
@@ -473,7 +476,7 @@ void tcp_retransmit_timer(struct sock *sk)
 
         tcp_enter_loss(sk);
 
-        if (tcp_retransmit_skb(sk, tcp_write_queue_head(sk), 1) > 0) {
+        if (tcp_retransmit_skb(sk, tcp_rtx_queue_head(sk), 1) > 0) {
                 /* Retransmission failed because of local congestion,
                  * do not backoff.
                  */
@@ -514,7 +517,7 @@ out_reset_timer:
          * linear-timeout retransmissions into a black hole
          */
         if (sk->sk_state == TCP_ESTABLISHED &&
-            (tp->thin_lto || sysctl_tcp_thin_linear_timeouts) &&
+            (tp->thin_lto || net->ipv4.sysctl_tcp_thin_linear_timeouts) &&
             tcp_stream_is_thin(tp) &&
             icsk->icsk_retransmits <= TCP_THIN_LINEAR_RETRIES) {
                 icsk->icsk_backoff = 0;
@@ -570,9 +573,11 @@ out:
         sk_mem_reclaim(sk);
 }
 
-static void tcp_write_timer(unsigned long data)
+static void tcp_write_timer(struct timer_list *t)
 {
-        struct sock *sk = (struct sock *)data;
+        struct inet_connection_sock *icsk =
+                        from_timer(icsk, t, icsk_retransmit_timer);
+        struct sock *sk = &icsk->icsk_inet.sk;
 
         bh_lock_sock(sk);
         if (!sock_owned_by_user(sk)) {
@@ -607,9 +612,9 @@ void tcp_set_keepalive(struct sock *sk, int val)
 EXPORT_SYMBOL_GPL(tcp_set_keepalive);
 
 
-static void tcp_keepalive_timer (unsigned long data)
+static void tcp_keepalive_timer (struct timer_list *t)
 {
-        struct sock *sk = (struct sock *) data;
+        struct sock *sk = from_timer(sk, t, sk_timer);
         struct inet_connection_sock *icsk = inet_csk(sk);
         struct tcp_sock *tp = tcp_sk(sk);
         u32 elapsed;
@@ -647,7 +652,7 @@ static void tcp_keepalive_timer (unsigned long data)
         elapsed = keepalive_time_when(tp);
 
         /* It is alive without keepalive 8) */
-        if (tp->packets_out || tcp_send_head(sk))
+        if (tp->packets_out || !tcp_write_queue_empty(sk))
                 goto resched;
 
         elapsed = keepalive_time_elapsed(tp);
diff --git a/net/ipv4/tcp_vegas.c b/net/ipv4/tcp_vegas.c
index 218cfcc77650..ee113ff15fd0 100644
--- a/net/ipv4/tcp_vegas.c
+++ b/net/ipv4/tcp_vegas.c
@@ -158,7 +158,7 @@ EXPORT_SYMBOL_GPL(tcp_vegas_cwnd_event);
 
 static inline u32 tcp_vegas_ssthresh(struct tcp_sock *tp)
 {
-        return  min(tp->snd_ssthresh, tp->snd_cwnd-1);
+        return  min(tp->snd_ssthresh, tp->snd_cwnd);
 }
 
 static void tcp_vegas_cong_avoid(struct sock *sk, u32 ack, u32 acked)
diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
index 02ec9a349303..e4ff25c947c5 100644
--- a/net/ipv4/udp.c
+++ b/net/ipv4/udp.c
@@ -1209,8 +1209,7 @@ static void udp_rmem_release(struct sock *sk, int size, int partial,
         if (likely(partial)) {
                 up->forward_deficit += size;
                 size = up->forward_deficit;
-                if (size < (sk->sk_rcvbuf >> 2) &&
-                    !skb_queue_empty(&up->reader_queue))
+                if (size < (sk->sk_rcvbuf >> 2))
                         return;
         } else {
                 size += up->forward_deficit;
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index 8a1c846d3df9..f49bd7897e95 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -152,11 +152,13 @@ static void ipv6_regen_rndid(struct inet6_dev *idev);
 static void ipv6_try_regen_rndid(struct inet6_dev *idev, struct in6_addr *tmpaddr);
 
 static int ipv6_generate_eui64(u8 *eui, struct net_device *dev);
-static int ipv6_count_addresses(struct inet6_dev *idev);
+static int ipv6_count_addresses(const struct inet6_dev *idev);
 static int ipv6_generate_stable_address(struct in6_addr *addr,
                                         u8 dad_count,
                                         const struct inet6_dev *idev);
 
+#define IN6_ADDR_HSIZE_SHIFT    8
+#define IN6_ADDR_HSIZE          (1 << IN6_ADDR_HSIZE_SHIFT)
 /*
  *      Configured unicast address hash table
  */
@@ -186,14 +188,12 @@ static void addrconf_dad_start(struct inet6_ifaddr *ifp);
 static void addrconf_dad_work(struct work_struct *w);
 static void addrconf_dad_completed(struct inet6_ifaddr *ifp, bool bump_id);
 static void addrconf_dad_run(struct inet6_dev *idev);
-static void addrconf_rs_timer(unsigned long data);
+static void addrconf_rs_timer(struct timer_list *t);
 static void __ipv6_ifa_notify(int event, struct inet6_ifaddr *ifa);
 static void ipv6_ifa_notify(int event, struct inet6_ifaddr *ifa);
 
 static void inet6_prefix_notify(int event, struct inet6_dev *idev,
                                 struct prefix_info *pinfo);
-static bool ipv6_chk_same_addr(struct net *net, const struct in6_addr *addr,
-                               struct net_device *dev);
 
 static struct ipv6_devconf ipv6_devconf __read_mostly = {
         .forwarding             = 0,
@@ -231,7 +231,7 @@ static struct ipv6_devconf ipv6_devconf __read_mostly = {
         .proxy_ndp              = 0,
         .accept_source_route    = 0,    /* we do not accept RH0 by default. */
         .disable_ipv6           = 0,
-        .accept_dad             = 1,
+        .accept_dad             = 0,
         .suppress_frag_ndisc    = 1,
         .accept_ra_mtu          = 1,
         .stable_secret          = {
@@ -303,10 +303,10 @@ static struct ipv6_devconf ipv6_devconf_dflt __read_mostly = {
         .disable_policy         = 0,
 };
 
-/* Check if a valid qdisc is available */
-static inline bool addrconf_qdisc_ok(const struct net_device *dev)
+/* Check if link is ready: is it up and is a valid qdisc available */
+static inline bool addrconf_link_ready(const struct net_device *dev)
 {
-        return !qdisc_tx_is_noop(dev);
+        return netif_oper_up(dev) && !qdisc_tx_is_noop(dev);
 }
 
 static void addrconf_del_rs_timer(struct inet6_dev *idev)
@@ -388,8 +388,7 @@ static struct inet6_dev *ipv6_add_dev(struct net_device *dev)
         rwlock_init(&ndev->lock);
         ndev->dev = dev;
         INIT_LIST_HEAD(&ndev->addr_list);
-        setup_timer(&ndev->rs_timer, addrconf_rs_timer,
-                    (unsigned long)ndev);
+        timer_setup(&ndev->rs_timer, addrconf_rs_timer, 0);
         memcpy(&ndev->cnf, dev_net(dev)->ipv6.devconf_dflt, sizeof(ndev->cnf));
 
         if (ndev->cnf.stable_secret.initialized)
@@ -451,7 +450,7 @@ static struct inet6_dev *ipv6_add_dev(struct net_device *dev)
 
         ndev->token = in6addr_any;
 
-        if (netif_running(dev) && addrconf_qdisc_ok(dev))
+        if (netif_running(dev) && addrconf_link_ready(dev))
                 ndev->if_flags |= IF_READY;
 
         ipv6_mc_init_dev(ndev);
@@ -616,23 +615,23 @@ static int inet6_netconf_get_devconf(struct sk_buff *in_skb,
 {
         struct net *net = sock_net(in_skb->sk);
         struct nlattr *tb[NETCONFA_MAX+1];
+        struct inet6_dev *in6_dev = NULL;
+        struct net_device *dev = NULL;
         struct netconfmsg *ncm;
         struct sk_buff *skb;
         struct ipv6_devconf *devconf;
-        struct inet6_dev *in6_dev;
-        struct net_device *dev;
         int ifindex;
         int err;
 
         err = nlmsg_parse(nlh, sizeof(*ncm), tb, NETCONFA_MAX,
                           devconf_ipv6_policy, extack);
         if (err < 0)
-                goto errout;
+                return err;
 
-        err = -EINVAL;
         if (!tb[NETCONFA_IFINDEX])
-                goto errout;
+                return -EINVAL;
 
+        err = -EINVAL;
         ifindex = nla_get_s32(tb[NETCONFA_IFINDEX]);
         switch (ifindex) {
         case NETCONFA_IFINDEX_ALL:
@@ -642,10 +641,10 @@ static int inet6_netconf_get_devconf(struct sk_buff *in_skb,
                 devconf = net->ipv6.devconf_dflt;
                 break;
         default:
-                dev = __dev_get_by_index(net, ifindex);
+                dev = dev_get_by_index(net, ifindex);
                 if (!dev)
-                        goto errout;
-                in6_dev = __in6_dev_get(dev);
+                        return -EINVAL;
+                in6_dev = in6_dev_get(dev);
                 if (!in6_dev)
                         goto errout;
                 devconf = &in6_dev->cnf;
@@ -653,7 +652,7 @@ static int inet6_netconf_get_devconf(struct sk_buff *in_skb,
         }
 
         err = -ENOBUFS;
-        skb = nlmsg_new(inet6_netconf_msgsize_devconf(NETCONFA_ALL), GFP_ATOMIC);
+        skb = nlmsg_new(inet6_netconf_msgsize_devconf(NETCONFA_ALL), GFP_KERNEL);
         if (!skb)
                 goto errout;
 
@@ -669,6 +668,10 @@ static int inet6_netconf_get_devconf(struct sk_buff *in_skb,
         }
         err = rtnl_unicast(skb, net, NETLINK_CB(in_skb).portid);
 errout:
+        if (in6_dev)
+                in6_dev_put(in6_dev);
+        if (dev)
+                dev_put(dev);
         return err;
 }
 
@@ -945,12 +948,50 @@ ipv6_link_dev_addr(struct inet6_dev *idev, struct inet6_ifaddr *ifp)
                         break;
         }
 
-        list_add_tail(&ifp->if_list, p);
+        list_add_tail_rcu(&ifp->if_list, p);
 }
 
-static u32 inet6_addr_hash(const struct in6_addr *addr)
+static u32 inet6_addr_hash(const struct net *net, const struct in6_addr *addr)
 {
-        return hash_32(ipv6_addr_hash(addr), IN6_ADDR_HSIZE_SHIFT);
+        u32 val = ipv6_addr_hash(addr) ^ net_hash_mix(net);
+
+        return hash_32(val, IN6_ADDR_HSIZE_SHIFT);
+}
+
+static bool ipv6_chk_same_addr(struct net *net, const struct in6_addr *addr,
+                               struct net_device *dev, unsigned int hash)
+{
+        struct inet6_ifaddr *ifp;
+
+        hlist_for_each_entry(ifp, &inet6_addr_lst[hash], addr_lst) {
+                if (!net_eq(dev_net(ifp->idev->dev), net))
+                        continue;
+                if (ipv6_addr_equal(&ifp->addr, addr)) {
+                        if (!dev || ifp->idev->dev == dev)
+                                return true;
+                }
+        }
+        return false;
+}
+
+static int ipv6_add_addr_hash(struct net_device *dev, struct inet6_ifaddr *ifa)
+{
+        unsigned int hash = inet6_addr_hash(dev_net(dev), &ifa->addr);
+        int err = 0;
+
+        spin_lock(&addrconf_hash_lock);
+
+        /* Ignore adding duplicate addresses on an interface */
+        if (ipv6_chk_same_addr(dev_net(dev), &ifa->addr, dev, hash)) {
+                ADBG("ipv6_add_addr: already assigned\n");
+                err = -EEXIST;
+        } else {
+                hlist_add_head_rcu(&ifa->addr_lst, &inet6_addr_lst[hash]);
+        }
+
+        spin_unlock(&addrconf_hash_lock);
+
+        return err;
 }
 
 /* On success it returns ifp with increased reference count */
@@ -958,13 +999,13 @@ static u32 inet6_addr_hash(const struct in6_addr *addr)
 static struct inet6_ifaddr *
 ipv6_add_addr(struct inet6_dev *idev, const struct in6_addr *addr,
               const struct in6_addr *peer_addr, int pfxlen,
-              int scope, u32 flags, u32 valid_lft, u32 prefered_lft)
+              int scope, u32 flags, u32 valid_lft, u32 prefered_lft,
+              bool can_block, struct netlink_ext_ack *extack)
 {
+        gfp_t gfp_flags = can_block ? GFP_KERNEL : GFP_ATOMIC;
         struct net *net = dev_net(idev->dev);
         struct inet6_ifaddr *ifa = NULL;
-        struct rt6_info *rt;
-        struct in6_validator_info i6vi;
-        unsigned int hash;
+        struct rt6_info *rt = NULL;
         int err = 0;
         int addr_type = ipv6_addr_type(addr);
 
@@ -974,42 +1015,33 @@ ipv6_add_addr(struct inet6_dev *idev, const struct in6_addr *addr,
              addr_type & IPV6_ADDR_LOOPBACK))
                 return ERR_PTR(-EADDRNOTAVAIL);
 
-        rcu_read_lock_bh();
-
-        in6_dev_hold(idev);
-
         if (idev->dead) {
                 err = -ENODEV;                  /*XXX*/
-                goto out2;
+                goto out;
         }
 
         if (idev->cnf.disable_ipv6) {
                 err = -EACCES;
-                goto out2;
-        }
-
-        i6vi.i6vi_addr = *addr;
-        i6vi.i6vi_dev = idev;
-        rcu_read_unlock_bh();
-
-        err = inet6addr_validator_notifier_call_chain(NETDEV_UP, &i6vi);
-
-        rcu_read_lock_bh();
-        err = notifier_to_errno(err);
-        if (err)
-                goto out2;
-
-        spin_lock(&addrconf_hash_lock);
-
-        /* Ignore adding duplicate addresses on an interface */
-        if (ipv6_chk_same_addr(dev_net(idev->dev), addr, idev->dev)) {
-                ADBG("ipv6_add_addr: already assigned\n");
-                err = -EEXIST;
                 goto out;
         }
 
-        ifa = kzalloc(sizeof(struct inet6_ifaddr), GFP_ATOMIC);
+        /* validator notifier needs to be blocking;
+         * do not call in atomic context
+         */
+        if (can_block) {
+                struct in6_validator_info i6vi = {
+                        .i6vi_addr = *addr,
+                        .i6vi_dev = idev,
+                        .extack = extack,
+                };
+
+                err = inet6addr_validator_notifier_call_chain(NETDEV_UP, &i6vi);
+                err = notifier_to_errno(err);
+                if (err < 0)
+                        goto out;
+        }
 
+        ifa = kzalloc(sizeof(*ifa), gfp_flags);
         if (!ifa) {
                 ADBG("ipv6_add_addr: malloc failed\n");
                 err = -ENOBUFS;
@@ -1019,6 +1051,7 @@ ipv6_add_addr(struct inet6_dev *idev, const struct in6_addr *addr,
         rt = addrconf_dst_alloc(idev, addr, false);
         if (IS_ERR(rt)) {
                 err = PTR_ERR(rt);
+                rt = NULL;
                 goto out;
         }
 
@@ -1049,16 +1082,21 @@ ipv6_add_addr(struct inet6_dev *idev, const struct in6_addr *addr,
         ifa->rt = rt;
 
         ifa->idev = idev;
+        in6_dev_hold(idev);
+
         /* For caller */
         refcount_set(&ifa->refcnt, 1);
 
-        /* Add to big hash table */
-        hash = inet6_addr_hash(addr);
+        rcu_read_lock_bh();
 
-        hlist_add_head_rcu(&ifa->addr_lst, &inet6_addr_lst[hash]);
-        spin_unlock(&addrconf_hash_lock);
+        err = ipv6_add_addr_hash(idev->dev, ifa);
+        if (err < 0) {
+                rcu_read_unlock_bh();
+                goto out;
+        }
 
         write_lock(&idev->lock);
+
         /* Add to inet6_dev unicast addr list. */
         ipv6_link_dev_addr(idev, ifa);
 
@@ -1069,21 +1107,23 @@ ipv6_add_addr(struct inet6_dev *idev, const struct in6_addr *addr,
 
         in6_ifa_hold(ifa);
         write_unlock(&idev->lock);
-out2:
+
         rcu_read_unlock_bh();
 
-        if (likely(err == 0))
-                inet6addr_notifier_call_chain(NETDEV_UP, ifa);
-        else {
-                kfree(ifa);
-                in6_dev_put(idev);
+        inet6addr_notifier_call_chain(NETDEV_UP, ifa);
+out:
+        if (unlikely(err < 0)) {
+                if (rt)
+                        ip6_rt_put(rt);
+                if (ifa) {
+                        if (ifa->idev)
+                                in6_dev_put(ifa->idev);
+                        kfree(ifa);
+                }
                 ifa = ERR_PTR(err);
         }
 
         return ifa;
-out:
-        spin_unlock(&addrconf_hash_lock);
-        goto out2;
 }
 
 enum cleanup_prefix_rt_t {
@@ -1204,7 +1244,7 @@ static void ipv6_del_addr(struct inet6_ifaddr *ifp)
         if (ifp->flags & IFA_F_PERMANENT && !(ifp->flags & IFA_F_NOPREFIXROUTE))
                 action = check_cleanup_prefix_route(ifp, &expires);
 
-        list_del_init(&ifp->if_list);
+        list_del_rcu(&ifp->if_list);
         __in6_ifa_put(ifp);
 
         write_unlock_bh(&ifp->idev->lock);
@@ -1226,7 +1266,9 @@ out:
         in6_ifa_put(ifp);
 }
 
-static int ipv6_create_tempaddr(struct inet6_ifaddr *ifp, struct inet6_ifaddr *ift)
+static int ipv6_create_tempaddr(struct inet6_ifaddr *ifp,
+                                struct inet6_ifaddr *ift,
+                                bool block)
 {
         struct inet6_dev *idev = ifp->idev;
         struct in6_addr addr, *tmpaddr;
@@ -1330,7 +1372,7 @@ retry:
 
         ift = ipv6_add_addr(idev, &addr, NULL, tmp_plen,
                             ipv6_addr_scope(&addr), addr_flags,
-                            tmp_valid_lft, tmp_prefered_lft);
+                            tmp_valid_lft, tmp_prefered_lft, block, NULL);
         if (IS_ERR(ift)) {
                 in6_ifa_put(ifp);
                 in6_dev_put(idev);
@@ -1558,8 +1600,7 @@ static int __ipv6_dev_get_saddr(struct net *net,
 {
         struct ipv6_saddr_score *score = &scores[1 - hiscore_idx], *hiscore = &scores[hiscore_idx];
 
-        read_lock_bh(&idev->lock);
-        list_for_each_entry(score->ifa, &idev->addr_list, if_list) {
+        list_for_each_entry_rcu(score->ifa, &idev->addr_list, if_list) {
                 int i;
 
                 /*
@@ -1609,11 +1650,6 @@ static int __ipv6_dev_get_saddr(struct net *net,
                                 }
                                 break;
                         } else if (minihiscore < miniscore) {
-                                if (hiscore->ifa)
-                                        in6_ifa_put(hiscore->ifa);
-
-                                in6_ifa_hold(score->ifa);
-
                                 swap(hiscore, score);
                                 hiscore_idx = 1 - hiscore_idx;
 
@@ -1625,7 +1661,6 @@ static int __ipv6_dev_get_saddr(struct net *net,
                 }
         }
 out:
-        read_unlock_bh(&idev->lock);
         return hiscore_idx;
 }
 
@@ -1662,6 +1697,7 @@ int ipv6_dev_get_saddr(struct net *net, const struct net_device *dst_dev,
         int dst_type;
         bool use_oif_addr = false;
         int hiscore_idx = 0;
+        int ret = 0;
 
         dst_type = __ipv6_addr_type(daddr);
         dst.addr = daddr;
@@ -1737,15 +1773,14 @@ int ipv6_dev_get_saddr(struct net *net, const struct net_device *dst_dev,
         }
 
 out:
-        rcu_read_unlock();
-
         hiscore = &scores[hiscore_idx];
         if (!hiscore->ifa)
-                return -EADDRNOTAVAIL;
+                ret = -EADDRNOTAVAIL;
+        else
+                *saddr = hiscore->ifa->addr;
 
-        *saddr = hiscore->ifa->addr;
-        in6_ifa_put(hiscore->ifa);
-        return 0;
+        rcu_read_unlock();
+        return ret;
 }
 EXPORT_SYMBOL(ipv6_dev_get_saddr);
 
@@ -1785,15 +1820,15 @@ int ipv6_get_lladdr(struct net_device *dev, struct in6_addr *addr,
         return err;
 }
 
-static int ipv6_count_addresses(struct inet6_dev *idev)
+static int ipv6_count_addresses(const struct inet6_dev *idev)
 {
+        const struct inet6_ifaddr *ifp;
         int cnt = 0;
-        struct inet6_ifaddr *ifp;
 
-        read_lock_bh(&idev->lock);
-        list_for_each_entry(ifp, &idev->addr_list, if_list)
+        rcu_read_lock();
+        list_for_each_entry_rcu(ifp, &idev->addr_list, if_list)
                 cnt++;
-        read_unlock_bh(&idev->lock);
+        rcu_read_unlock();
         return cnt;
 }
 
@@ -1808,11 +1843,11 @@ int ipv6_chk_addr_and_flags(struct net *net, const struct in6_addr *addr,
                             const struct net_device *dev, int strict,
                             u32 banned_flags)
 {
+        unsigned int hash = inet6_addr_hash(net, addr);
         struct inet6_ifaddr *ifp;
-        unsigned int hash = inet6_addr_hash(addr);
         u32 ifp_flags;
 
-        rcu_read_lock_bh();
+        rcu_read_lock();
         hlist_for_each_entry_rcu(ifp, &inet6_addr_lst[hash], addr_lst) {
                 if (!net_eq(dev_net(ifp->idev->dev), net))
                         continue;
@@ -1826,32 +1861,16 @@ int ipv6_chk_addr_and_flags(struct net *net, const struct in6_addr *addr,
                     !(ifp_flags&banned_flags) &&
                     (!dev || ifp->idev->dev == dev ||
                      !(ifp->scope&(IFA_LINK|IFA_HOST) || strict))) {
-                        rcu_read_unlock_bh();
+                        rcu_read_unlock();
                         return 1;
                 }
         }
 
-        rcu_read_unlock_bh();
+        rcu_read_unlock();
         return 0;
 }
 EXPORT_SYMBOL(ipv6_chk_addr_and_flags);
 
-static bool ipv6_chk_same_addr(struct net *net, const struct in6_addr *addr,
-                               struct net_device *dev)
-{
-        unsigned int hash = inet6_addr_hash(addr);
-        struct inet6_ifaddr *ifp;
-
-        hlist_for_each_entry(ifp, &inet6_addr_lst[hash], addr_lst) {
-                if (!net_eq(dev_net(ifp->idev->dev), net))
-                        continue;
-                if (ipv6_addr_equal(&ifp->addr, addr)) {
-                        if (!dev || ifp->idev->dev == dev)
-                                return true;
-                }
-        }
-        return false;
-}
 
 /* Compares an address/prefix_len with addresses on device @dev.
  * If one is found it returns true.
@@ -1859,20 +1878,18 @@ static bool ipv6_chk_same_addr(struct net *net, const struct in6_addr *addr,
 bool ipv6_chk_custom_prefix(const struct in6_addr *addr,
         const unsigned int prefix_len, struct net_device *dev)
 {
-        struct inet6_dev *idev;
-        struct inet6_ifaddr *ifa;
+        const struct inet6_ifaddr *ifa;
+        const struct inet6_dev *idev;
         bool ret = false;
 
         rcu_read_lock();
         idev = __in6_dev_get(dev);
         if (idev) {
-                read_lock_bh(&idev->lock);
-                list_for_each_entry(ifa, &idev->addr_list, if_list) {
+                list_for_each_entry_rcu(ifa, &idev->addr_list, if_list) {
                         ret = ipv6_prefix_equal(addr, &ifa->addr, prefix_len);
                         if (ret)
                                 break;
                 }
-                read_unlock_bh(&idev->lock);
         }
         rcu_read_unlock();
 
@@ -1882,22 +1899,20 @@ EXPORT_SYMBOL(ipv6_chk_custom_prefix);
 
 int ipv6_chk_prefix(const struct in6_addr *addr, struct net_device *dev)
 {
-        struct inet6_dev *idev;
-        struct inet6_ifaddr *ifa;
+        const struct inet6_ifaddr *ifa;
+        const struct inet6_dev *idev;
         int     onlink;
 
         onlink = 0;
         rcu_read_lock();
         idev = __in6_dev_get(dev);
         if (idev) {
-                read_lock_bh(&idev->lock);
-                list_for_each_entry(ifa, &idev->addr_list, if_list) {
+                list_for_each_entry_rcu(ifa, &idev->addr_list, if_list) {
                         onlink = ipv6_prefix_equal(addr, &ifa->addr,
                                                    ifa->prefix_len);
                         if (onlink)
                                 break;
                 }
-                read_unlock_bh(&idev->lock);
         }
         rcu_read_unlock();
         return onlink;
@@ -1907,11 +1922,11 @@ EXPORT_SYMBOL(ipv6_chk_prefix);
 struct inet6_ifaddr *ipv6_get_ifaddr(struct net *net, const struct in6_addr *addr,
                                      struct net_device *dev, int strict)
 {
+        unsigned int hash = inet6_addr_hash(net, addr);
         struct inet6_ifaddr *ifp, *result = NULL;
-        unsigned int hash = inet6_addr_hash(addr);
 
-        rcu_read_lock_bh();
-        hlist_for_each_entry_rcu_bh(ifp, &inet6_addr_lst[hash], addr_lst) {
+        rcu_read_lock();
+        hlist_for_each_entry_rcu(ifp, &inet6_addr_lst[hash], addr_lst) {
                 if (!net_eq(dev_net(ifp->idev->dev), net))
                         continue;
                 if (ipv6_addr_equal(&ifp->addr, addr)) {
@@ -1923,7 +1938,7 @@ struct inet6_ifaddr *ipv6_get_ifaddr(struct net *net, const struct in6_addr *add
                         }
                 }
         }
-        rcu_read_unlock_bh();
+        rcu_read_unlock();
 
         return result;
 }
@@ -1942,7 +1957,7 @@ static void addrconf_dad_stop(struct inet6_ifaddr *ifp, int dad_failed)
                 if (ifpub) {
                         in6_ifa_hold(ifpub);
                         spin_unlock_bh(&ifp->lock);
-                        ipv6_create_tempaddr(ifpub, ifp);
+                        ipv6_create_tempaddr(ifpub, ifp, true);
                         in6_ifa_put(ifpub);
                 } else {
                         spin_unlock_bh(&ifp->lock);
@@ -1975,7 +1990,7 @@ static int addrconf_dad_end(struct inet6_ifaddr *ifp)
         return err;
 }
 
-void addrconf_dad_failure(struct inet6_ifaddr *ifp)
+void addrconf_dad_failure(struct sk_buff *skb, struct inet6_ifaddr *ifp)
 {
         struct inet6_dev *idev = ifp->idev;
         struct net *net = dev_net(ifp->idev->dev);
@@ -1985,8 +2000,8 @@ void addrconf_dad_failure(struct inet6_ifaddr *ifp)
                 return;
         }
 
-        net_info_ratelimited("%s: IPv6 duplicate address %pI6c detected!\n",
-                             ifp->idev->dev->name, &ifp->addr);
+        net_info_ratelimited("%s: IPv6 duplicate address %pI6c used by %pM detected!\n",
+                             ifp->idev->dev->name, &ifp->addr, eth_hdr(skb)->h_source);
 
         spin_lock_bh(&ifp->lock);
 
@@ -2025,7 +2040,7 @@ void addrconf_dad_failure(struct inet6_ifaddr *ifp)
 
                 ifp2 = ipv6_add_addr(idev, &new_addr, NULL, pfxlen,
                                      scope, flags, valid_lft,
-                                     preferred_lft);
+                                     preferred_lft, false, NULL);
                 if (IS_ERR(ifp2))
                         goto lock_errdad;
 
@@ -2321,24 +2336,24 @@ static struct rt6_info *addrconf_get_prefix_route(const struct in6_addr *pfx,
         if (!table)
                 return NULL;
 
-        read_lock_bh(&table->tb6_lock);
-        fn = fib6_locate(&table->tb6_root, pfx, plen, NULL, 0);
+        rcu_read_lock();
+        fn = fib6_locate(&table->tb6_root, pfx, plen, NULL, 0, true);
         if (!fn)
                 goto out;
 
-        noflags |= RTF_CACHE;
-        for (rt = fn->leaf; rt; rt = rt->dst.rt6_next) {
+        for_each_fib6_node_rt_rcu(fn) {
                 if (rt->dst.dev->ifindex != dev->ifindex)
                         continue;
                 if ((rt->rt6i_flags & flags) != flags)
                         continue;
                 if ((rt->rt6i_flags & noflags) != 0)
                         continue;
-                dst_hold(&rt->dst);
+                if (!dst_hold_safe(&rt->dst))
+                        rt = NULL;
                 break;
         }
 out:
-        read_unlock_bh(&table->tb6_lock);
+        rcu_read_unlock();
         return rt;
 }
 
@@ -2442,7 +2457,7 @@ static void manage_tempaddrs(struct inet6_dev *idev,
                  * no temporary address currently exists.
                  */
                 read_unlock_bh(&idev->lock);
-                ipv6_create_tempaddr(ifp, NULL);
+                ipv6_create_tempaddr(ifp, NULL, false);
         } else {
                 read_unlock_bh(&idev->lock);
         }
@@ -2483,7 +2498,7 @@ int addrconf_prefix_rcv_add_addr(struct net *net, struct net_device *dev,
                                             pinfo->prefix_len,
                                             addr_type&IPV6_ADDR_SCOPE_MASK,
                                             addr_flags, valid_lft,
-                                            prefered_lft);
+                                            prefered_lft, false, NULL);
 
                 if (IS_ERR_OR_NULL(ifp))
                         return -1;
@@ -2793,7 +2808,8 @@ static int inet6_addr_add(struct net *net, int ifindex,
                           const struct in6_addr *pfx,
                           const struct in6_addr *peer_pfx,
                           unsigned int plen, __u32 ifa_flags,
-                          __u32 prefered_lft, __u32 valid_lft)
+                          __u32 prefered_lft, __u32 valid_lft,
+                          struct netlink_ext_ack *extack)
 {
         struct inet6_ifaddr *ifp;
         struct inet6_dev *idev;
@@ -2852,7 +2868,7 @@ static int inet6_addr_add(struct net *net, int ifindex,
         }
 
         ifp = ipv6_add_addr(idev, pfx, peer_pfx, plen, scope, ifa_flags,
-                            valid_lft, prefered_lft);
+                            valid_lft, prefered_lft, true, extack);
 
         if (!IS_ERR(ifp)) {
                 if (!(ifa_flags & IFA_F_NOPREFIXROUTE)) {
@@ -2937,7 +2953,7 @@ int addrconf_add_ifaddr(struct net *net, void __user *arg)
         rtnl_lock();
         err = inet6_addr_add(net, ireq.ifr6_ifindex, &ireq.ifr6_addr, NULL,
                              ireq.ifr6_prefixlen, IFA_F_PERMANENT,
-                             INFINITY_LIFE_TIME, INFINITY_LIFE_TIME);
+                             INFINITY_LIFE_TIME, INFINITY_LIFE_TIME, NULL);
         rtnl_unlock();
         return err;
 }
@@ -2967,7 +2983,8 @@ static void add_addr(struct inet6_dev *idev, const struct in6_addr *addr,
 
         ifp = ipv6_add_addr(idev, addr, NULL, plen,
                             scope, IFA_F_PERMANENT,
-                            INFINITY_LIFE_TIME, INFINITY_LIFE_TIME);
+                            INFINITY_LIFE_TIME, INFINITY_LIFE_TIME,
+                            true, NULL);
         if (!IS_ERR(ifp)) {
                 spin_lock_bh(&ifp->lock);
                 ifp->flags &= ~IFA_F_TENTATIVE;
@@ -3067,7 +3084,7 @@ void addrconf_add_linklocal(struct inet6_dev *idev,
 #endif
 
         ifp = ipv6_add_addr(idev, addr, NULL, 64, IFA_LINK, addr_flags,
-                            INFINITY_LIFE_TIME, INFINITY_LIFE_TIME);
+                            INFINITY_LIFE_TIME, INFINITY_LIFE_TIME, true, NULL);
         if (!IS_ERR(ifp)) {
                 addrconf_prefix_route(&ifp->addr, ifp->prefix_len, idev->dev, 0, 0);
                 addrconf_dad_start(ifp);
@@ -3297,7 +3314,7 @@ static int fixup_permanent_addr(struct inet6_dev *idev,
                 struct rt6_info *rt, *prev;
 
                 rt = addrconf_dst_alloc(idev, &ifp->addr, false);
-                if (unlikely(IS_ERR(rt)))
+                if (IS_ERR(rt))
                         return PTR_ERR(rt);
 
                 /* ifp->rt can be accessed outside of rtnl */
@@ -3404,7 +3421,7 @@ static int addrconf_notify(struct notifier_block *this, unsigned long event,
                         /* restore routes for permanent addresses */
                         addrconf_permanent_addr(dev);
 
-                        if (!addrconf_qdisc_ok(dev)) {
+                        if (!addrconf_link_ready(dev)) {
                                 /* device is not ready yet. */
                                 pr_info("ADDRCONF(NETDEV_UP): %s: link is not ready\n",
                                         dev->name);
@@ -3419,7 +3436,7 @@ static int addrconf_notify(struct notifier_block *this, unsigned long event,
                                 run_pending = 1;
                         }
                 } else if (event == NETDEV_CHANGE) {
-                        if (!addrconf_qdisc_ok(dev)) {
+                        if (!addrconf_link_ready(dev)) {
                                 /* device is still not ready. */
                                 break;
                         }
@@ -3563,7 +3580,6 @@ static int addrconf_ifdown(struct net_device *dev, int how)
         struct net *net = dev_net(dev);
         struct inet6_dev *idev;
         struct inet6_ifaddr *ifa, *tmp;
-        struct list_head del_list;
         int _keep_addr;
         bool keep_addr;
         int state, i;
@@ -3655,7 +3671,6 @@ restart:
          */
         keep_addr = (!how && _keep_addr > 0 && !idev->cnf.disable_ipv6);
 
-        INIT_LIST_HEAD(&del_list);
         list_for_each_entry_safe(ifa, tmp, &idev->addr_list, if_list) {
                 struct rt6_info *rt = NULL;
                 bool keep;
@@ -3664,8 +3679,6 @@ restart:
 
                 keep = keep_addr && (ifa->flags & IFA_F_PERMANENT) &&
                         !addr_is_local(&ifa->addr);
-                if (!keep)
-                        list_move(&ifa->if_list, &del_list);
 
                 write_unlock_bh(&idev->lock);
                 spin_lock_bh(&ifa->lock);
@@ -3699,19 +3712,14 @@ restart:
                 }
 
                 write_lock_bh(&idev->lock);
+                if (!keep) {
+                        list_del_rcu(&ifa->if_list);
+                        in6_ifa_put(ifa);
+                }
         }
 
         write_unlock_bh(&idev->lock);
 
-        /* now clean up addresses to be removed */
-        while (!list_empty(&del_list)) {
-                ifa = list_first_entry(&del_list,
-                                       struct inet6_ifaddr, if_list);
-                list_del(&ifa->if_list);
-
-                in6_ifa_put(ifa);
-        }
-
         /* Step 5: Discard anycast and multicast list */
         if (how) {
                 ipv6_ac_destroy_dev(idev);
@@ -3732,9 +3740,9 @@ restart:
         return 0;
 }
 
-static void addrconf_rs_timer(unsigned long data)
+static void addrconf_rs_timer(struct timer_list *t)
 {
-        struct inet6_dev *idev = (struct inet6_dev *)data;
+        struct inet6_dev *idev = from_timer(idev, t, rs_timer);
         struct net_device *dev = idev->dev;
         struct in6_addr lladdr;
 
@@ -4093,9 +4101,9 @@ struct if6_iter_state {
 
 static struct inet6_ifaddr *if6_get_first(struct seq_file *seq, loff_t pos)
 {
-        struct inet6_ifaddr *ifa = NULL;
         struct if6_iter_state *state = seq->private;
         struct net *net = seq_file_net(seq);
+        struct inet6_ifaddr *ifa = NULL;
         int p = 0;
 
         /* initial bucket if pos is 0 */
@@ -4105,7 +4113,7 @@ static struct inet6_ifaddr *if6_get_first(struct seq_file *seq, loff_t pos)
         }
 
         for (; state->bucket < IN6_ADDR_HSIZE; ++state->bucket) {
-                hlist_for_each_entry_rcu_bh(ifa, &inet6_addr_lst[state->bucket],
+                hlist_for_each_entry_rcu(ifa, &inet6_addr_lst[state->bucket],
                                          addr_lst) {
                         if (!net_eq(dev_net(ifa->idev->dev), net))
                                 continue;
@@ -4131,7 +4139,7 @@ static struct inet6_ifaddr *if6_get_next(struct seq_file *seq,
         struct if6_iter_state *state = seq->private;
         struct net *net = seq_file_net(seq);
 
-        hlist_for_each_entry_continue_rcu_bh(ifa, addr_lst) {
+        hlist_for_each_entry_continue_rcu(ifa, addr_lst) {
                 if (!net_eq(dev_net(ifa->idev->dev), net))
                         continue;
                 state->offset++;
@@ -4140,7 +4148,7 @@ static struct inet6_ifaddr *if6_get_next(struct seq_file *seq,
 
         while (++state->bucket < IN6_ADDR_HSIZE) {
                 state->offset = 0;
-                hlist_for_each_entry_rcu_bh(ifa,
+                hlist_for_each_entry_rcu(ifa,
                                      &inet6_addr_lst[state->bucket], addr_lst) {
                         if (!net_eq(dev_net(ifa->idev->dev), net))
                                 continue;
@@ -4153,9 +4161,9 @@ static struct inet6_ifaddr *if6_get_next(struct seq_file *seq,
 }
 
 static void *if6_seq_start(struct seq_file *seq, loff_t *pos)
-        __acquires(rcu_bh)
+        __acquires(rcu)
 {
-        rcu_read_lock_bh();
+        rcu_read_lock();
         return if6_get_first(seq, *pos);
 }
 
@@ -4169,9 +4177,9 @@ static void *if6_seq_next(struct seq_file *seq, void *v, loff_t *pos)
 }
 
 static void if6_seq_stop(struct seq_file *seq, void *v)
-        __releases(rcu_bh)
+        __releases(rcu)
 {
-        rcu_read_unlock_bh();
+        rcu_read_unlock();
 }
 
 static int if6_seq_show(struct seq_file *seq, void *v)
@@ -4240,12 +4248,12 @@ void if6_proc_exit(void)
 /* Check if address is a home address configured on any interface. */
 int ipv6_chk_home_addr(struct net *net, const struct in6_addr *addr)
 {
-        int ret = 0;
+        unsigned int hash = inet6_addr_hash(net, addr);
         struct inet6_ifaddr *ifp = NULL;
-        unsigned int hash = inet6_addr_hash(addr);
+        int ret = 0;
 
-        rcu_read_lock_bh();
-        hlist_for_each_entry_rcu_bh(ifp, &inet6_addr_lst[hash], addr_lst) {
+        rcu_read_lock();
+        hlist_for_each_entry_rcu(ifp, &inet6_addr_lst[hash], addr_lst) {
                 if (!net_eq(dev_net(ifp->idev->dev), net))
                         continue;
                 if (ipv6_addr_equal(&ifp->addr, addr) &&
@@ -4254,7 +4262,7 @@ int ipv6_chk_home_addr(struct net *net, const struct in6_addr *addr)
                         break;
                 }
         }
-        rcu_read_unlock_bh();
+        rcu_read_unlock();
         return ret;
 }
 #endif
@@ -4344,7 +4352,7 @@ restart:
                                                 spin_lock(&ifpub->lock);
                                                 ifpub->regen_count = 0;
                                                 spin_unlock(&ifpub->lock);
-                                                ipv6_create_tempaddr(ifpub, ifp);
+                                                ipv6_create_tempaddr(ifpub, ifp, true);
                                                 in6_ifa_put(ifpub);
                                                 in6_ifa_put(ifp);
                                                 goto restart;
@@ -4580,7 +4588,7 @@ inet6_rtm_newaddr(struct sk_buff *skb, struct nlmsghdr *nlh,
                  */
                 return inet6_addr_add(net, ifm->ifa_index, pfx, peer_pfx,
                                       ifm->ifa_prefixlen, ifa_flags,
-                                      preferred_lft, valid_lft);
+                                      preferred_lft, valid_lft, extack);
         }
 
         if (nlh->nlmsg_flags & NLM_F_EXCL ||
@@ -4907,17 +4915,15 @@ static int inet6_rtm_getaddr(struct sk_buff *in_skb, struct nlmsghdr *nlh,
         err = nlmsg_parse(nlh, sizeof(*ifm), tb, IFA_MAX, ifa_ipv6_policy,
                           extack);
         if (err < 0)
-                goto errout;
+                return err;
 
         addr = extract_addr(tb[IFA_ADDRESS], tb[IFA_LOCAL], &peer);
-        if (!addr) {
-                err = -EINVAL;
-                goto errout;
-        }
+        if (!addr)
+                return -EINVAL;
 
         ifm = nlmsg_data(nlh);
         if (ifm->ifa_index)
-                dev = __dev_get_by_index(net, ifm->ifa_index);
+                dev = dev_get_by_index(net, ifm->ifa_index);
 
         ifa = ipv6_get_ifaddr(net, addr, dev, 1);
         if (!ifa) {
@@ -4943,6 +4949,8 @@ static int inet6_rtm_getaddr(struct sk_buff *in_skb, struct nlmsghdr *nlh,
 errout_ifa:
         in6_ifa_put(ifa);
 errout:
+        if (dev)
+                dev_put(dev);
         return err;
 }
 
@@ -5050,6 +5058,7 @@ static inline void ipv6_store_devconf(struct ipv6_devconf *cnf,
         array[DEVCONF_ENHANCED_DAD] = cnf->enhanced_dad;
         array[DEVCONF_ADDR_GEN_MODE] = cnf->addr_gen_mode;
         array[DEVCONF_DISABLE_POLICY] = cnf->disable_policy;
+        array[DEVCONF_NDISC_TCLASS] = cnf->ndisc_tclass;
 }
 
 static inline size_t inet6_ifla6_size(void)
@@ -5899,10 +5908,9 @@ void addrconf_disable_policy_idev(struct inet6_dev *idev, int val)
                 spin_lock(&ifa->lock);
                 if (ifa->rt) {
                         struct rt6_info *rt = ifa->rt;
-                        struct fib6_table *table = rt->rt6i_table;
                         int cpu;
 
-                        read_lock(&table->tb6_lock);
+                        rcu_read_lock();
                         addrconf_set_nopolicy(ifa->rt, val);
                         if (rt->rt6i_pcpu) {
                                 for_each_possible_cpu(cpu) {
@@ -5912,7 +5920,7 @@ void addrconf_disable_policy_idev(struct inet6_dev *idev, int val)
                                         addrconf_set_nopolicy(*rtp, val);
                                 }
                         }
-                        read_unlock(&table->tb6_lock);
+                        rcu_read_unlock();
                 }
                 spin_unlock(&ifa->lock);
         }
@@ -5978,6 +5986,7 @@ int addrconf_sysctl_disable_policy(struct ctl_table *ctl, int write,
 }
 
 static int minus_one = -1;
+static const int zero = 0;
 static const int one = 1;
 static const int two_five_five = 255;
 
@@ -6349,6 +6358,15 @@ static const struct ctl_table addrconf_sysctl[] = {
                 .proc_handler   = addrconf_sysctl_disable_policy,
         },
         {
+                .procname       = "ndisc_tclass",
+                .data           = &ipv6_devconf.ndisc_tclass,
+                .maxlen         = sizeof(int),
+                .mode           = 0644,
+                .proc_handler   = proc_dointvec_minmax,
+                .extra1         = (void *)&zero,
+                .extra2         = (void *)&two_five_five,
+        },
+        {
                 /* sentinel */
         }
 };
@@ -6586,13 +6604,13 @@ int __init addrconf_init(void)
         __rtnl_register(PF_INET6, RTM_NEWADDR, inet6_rtm_newaddr, NULL, 0);
         __rtnl_register(PF_INET6, RTM_DELADDR, inet6_rtm_deladdr, NULL, 0);
         __rtnl_register(PF_INET6, RTM_GETADDR, inet6_rtm_getaddr,
-                        inet6_dump_ifaddr, 0);
+                        inet6_dump_ifaddr, RTNL_FLAG_DOIT_UNLOCKED);
         __rtnl_register(PF_INET6, RTM_GETMULTICAST, NULL,
                         inet6_dump_ifmcaddr, 0);
         __rtnl_register(PF_INET6, RTM_GETANYCAST, NULL,
                         inet6_dump_ifacaddr, 0);
         __rtnl_register(PF_INET6, RTM_GETNETCONF, inet6_netconf_get_devconf,
-                        inet6_netconf_dump_devconf, 0);
+                        inet6_netconf_dump_devconf, RTNL_FLAG_DOIT_UNLOCKED);
 
         ipv6_addr_label_rtnl_register();
 
@@ -6619,9 +6637,9 @@ void addrconf_cleanup(void)
         unregister_pernet_subsys(&addrconf_ops);
         ipv6_addr_label_cleanup();
 
-        rtnl_lock();
+        rtnl_af_unregister(&inet6_ops);
 
-        __rtnl_af_unregister(&inet6_ops);
+        rtnl_lock();
 
         /* clean dev list */
         for_each_netdev(&init_net, dev) {
diff --git a/net/ipv6/addrconf_core.c b/net/ipv6/addrconf_core.c
index 9e3488d50b15..32b564dfd02a 100644
--- a/net/ipv6/addrconf_core.c
+++ b/net/ipv6/addrconf_core.c
@@ -88,7 +88,7 @@ int __ipv6_addr_type(const struct in6_addr *addr)
 EXPORT_SYMBOL(__ipv6_addr_type);
 
 static ATOMIC_NOTIFIER_HEAD(inet6addr_chain);
-static ATOMIC_NOTIFIER_HEAD(inet6addr_validator_chain);
+static BLOCKING_NOTIFIER_HEAD(inet6addr_validator_chain);
 
 int register_inet6addr_notifier(struct notifier_block *nb)
 {
@@ -110,19 +110,20 @@ EXPORT_SYMBOL(inet6addr_notifier_call_chain);
 
 int register_inet6addr_validator_notifier(struct notifier_block *nb)
 {
-        return atomic_notifier_chain_register(&inet6addr_validator_chain, nb);
+        return blocking_notifier_chain_register(&inet6addr_validator_chain, nb);
 }
 EXPORT_SYMBOL(register_inet6addr_validator_notifier);
 
 int unregister_inet6addr_validator_notifier(struct notifier_block *nb)
 {
-        return atomic_notifier_chain_unregister(&inet6addr_validator_chain, nb);
+        return blocking_notifier_chain_unregister(&inet6addr_validator_chain,
+                                                  nb);
 }
 EXPORT_SYMBOL(unregister_inet6addr_validator_notifier);
 
 int inet6addr_validator_notifier_call_chain(unsigned long val, void *v)
 {
-        return atomic_notifier_call_chain(&inet6addr_validator_chain, val, v);
+        return blocking_notifier_call_chain(&inet6addr_validator_chain, val, v);
 }
 EXPORT_SYMBOL(inet6addr_validator_notifier_call_chain);
 
diff --git a/net/ipv6/addrlabel.c b/net/ipv6/addrlabel.c
index f664871feca6..00e1f8ee08f8 100644
--- a/net/ipv6/addrlabel.c
+++ b/net/ipv6/addrlabel.c
@@ -19,7 +19,6 @@
 #include <linux/if_addrlabel.h>
 #include <linux/netlink.h>
 #include <linux/rtnetlink.h>
-#include <linux/refcount.h>
 
 #if 0
 #define ADDRLABEL(x...) printk(x)
@@ -31,30 +30,15 @@
  * Policy Table
  */
 struct ip6addrlbl_entry {
-        possible_net_t lbl_net;
         struct in6_addr prefix;
         int prefixlen;
         int ifindex;
         int addrtype;
         u32 label;
         struct hlist_node list;
-        refcount_t refcnt;
         struct rcu_head rcu;
 };
 
-static struct ip6addrlbl_table
-{
-        struct hlist_head head;
-        spinlock_t lock;
-        u32 seq;
-} ip6addrlbl_table;
-
-static inline
-struct net *ip6addrlbl_net(const struct ip6addrlbl_entry *lbl)
-{
-        return read_pnet(&lbl->lbl_net);
-}
-
 /*
  * Default policy table (RFC6724 + extensions)
  *
@@ -126,36 +110,11 @@ static const __net_initconst struct ip6addrlbl_init_table
         }
 };
 
-/* Object management */
-static inline void ip6addrlbl_free(struct ip6addrlbl_entry *p)
-{
-        kfree(p);
-}
-
-static void ip6addrlbl_free_rcu(struct rcu_head *h)
-{
-        ip6addrlbl_free(container_of(h, struct ip6addrlbl_entry, rcu));
-}
-
-static bool ip6addrlbl_hold(struct ip6addrlbl_entry *p)
-{
-        return refcount_inc_not_zero(&p->refcnt);
-}
-
-static inline void ip6addrlbl_put(struct ip6addrlbl_entry *p)
-{
-        if (refcount_dec_and_test(&p->refcnt))
-                call_rcu(&p->rcu, ip6addrlbl_free_rcu);
-}
-
 /* Find label */
-static bool __ip6addrlbl_match(struct net *net,
-                               const struct ip6addrlbl_entry *p,
+static bool __ip6addrlbl_match(const struct ip6addrlbl_entry *p,
                                const struct in6_addr *addr,
                                int addrtype, int ifindex)
 {
-        if (!net_eq(ip6addrlbl_net(p), net))
-                return false;
         if (p->ifindex && p->ifindex != ifindex)
                 return false;
         if (p->addrtype && p->addrtype != addrtype)
@@ -170,8 +129,9 @@ static struct ip6addrlbl_entry *__ipv6_addr_label(struct net *net,
                                                   int type, int ifindex)
 {
         struct ip6addrlbl_entry *p;
-        hlist_for_each_entry_rcu(p, &ip6addrlbl_table.head, list) {
-                if (__ip6addrlbl_match(net, p, addr, type, ifindex))
+
+        hlist_for_each_entry_rcu(p, &net->ipv6.ip6addrlbl_table.head, list) {
+                if (__ip6addrlbl_match(p, addr, type, ifindex))
                         return p;
         }
         return NULL;
@@ -197,8 +157,7 @@ u32 ipv6_addr_label(struct net *net,
 }
 
 /* allocate one entry */
-static struct ip6addrlbl_entry *ip6addrlbl_alloc(struct net *net,
-                                                 const struct in6_addr *prefix,
+static struct ip6addrlbl_entry *ip6addrlbl_alloc(const struct in6_addr *prefix,
                                                  int prefixlen, int ifindex,
                                                  u32 label)
 {
@@ -237,24 +196,22 @@ static struct ip6addrlbl_entry *ip6addrlbl_alloc(struct net *net,
         newp->addrtype = addrtype;
         newp->label = label;
         INIT_HLIST_NODE(&newp->list);
-        write_pnet(&newp->lbl_net, net);
-        refcount_set(&newp->refcnt, 1);
         return newp;
 }
 
 /* add a label */
-static int __ip6addrlbl_add(struct ip6addrlbl_entry *newp, int replace)
+static int __ip6addrlbl_add(struct net *net, struct ip6addrlbl_entry *newp,
+                            int replace)
 {
-        struct hlist_node *n;
         struct ip6addrlbl_entry *last = NULL, *p = NULL;
+        struct hlist_node *n;
         int ret = 0;
 
         ADDRLABEL(KERN_DEBUG "%s(newp=%p, replace=%d)\n", __func__, newp,
                   replace);
 
-        hlist_for_each_entry_safe(p, n, &ip6addrlbl_table.head, list) {
+        hlist_for_each_entry_safe(p, n, &net->ipv6.ip6addrlbl_table.head, list) {
                 if (p->prefixlen == newp->prefixlen &&
-                    net_eq(ip6addrlbl_net(p), ip6addrlbl_net(newp)) &&
                     p->ifindex == newp->ifindex &&
                     ipv6_addr_equal(&p->prefix, &newp->prefix)) {
                         if (!replace) {
@@ -262,7 +219,7 @@ static int __ip6addrlbl_add(struct ip6addrlbl_entry *newp, int replace)
                                 goto out;
                         }
                         hlist_replace_rcu(&p->list, &newp->list);
-                        ip6addrlbl_put(p);
+                        kfree_rcu(p, rcu);
                         goto out;
                 } else if ((p->prefixlen == newp->prefixlen && !p->ifindex) ||
                            (p->prefixlen < newp->prefixlen)) {
@@ -274,10 +231,10 @@ static int __ip6addrlbl_add(struct ip6addrlbl_entry *newp, int replace)
         if (last)
                 hlist_add_behind_rcu(&newp->list, &last->list);
         else
-                hlist_add_head_rcu(&newp->list, &ip6addrlbl_table.head);
+                hlist_add_head_rcu(&newp->list, &net->ipv6.ip6addrlbl_table.head);
 out:
         if (!ret)
-                ip6addrlbl_table.seq++;
+                net->ipv6.ip6addrlbl_table.seq++;
         return ret;
 }
 
@@ -293,14 +250,14 @@ static int ip6addrlbl_add(struct net *net,
                   __func__, prefix, prefixlen, ifindex, (unsigned int)label,
                   replace);
 
-        newp = ip6addrlbl_alloc(net, prefix, prefixlen, ifindex, label);
+        newp = ip6addrlbl_alloc(prefix, prefixlen, ifindex, label);
         if (IS_ERR(newp))
                 return PTR_ERR(newp);
-        spin_lock(&ip6addrlbl_table.lock);
-        ret = __ip6addrlbl_add(newp, replace);
-        spin_unlock(&ip6addrlbl_table.lock);
+        spin_lock(&net->ipv6.ip6addrlbl_table.lock);
+        ret = __ip6addrlbl_add(net, newp, replace);
+        spin_unlock(&net->ipv6.ip6addrlbl_table.lock);
         if (ret)
-                ip6addrlbl_free(newp);
+                kfree(newp);
         return ret;
 }
 
@@ -316,13 +273,12 @@ static int __ip6addrlbl_del(struct net *net,
         ADDRLABEL(KERN_DEBUG "%s(prefix=%pI6, prefixlen=%d, ifindex=%d)\n",
                   __func__, prefix, prefixlen, ifindex);
 
-        hlist_for_each_entry_safe(p, n, &ip6addrlbl_table.head, list) {
+        hlist_for_each_entry_safe(p, n, &net->ipv6.ip6addrlbl_table.head, list) {
                 if (p->prefixlen == prefixlen &&
-                    net_eq(ip6addrlbl_net(p), net) &&
                     p->ifindex == ifindex &&
                     ipv6_addr_equal(&p->prefix, prefix)) {
                         hlist_del_rcu(&p->list);
-                        ip6addrlbl_put(p);
+                        kfree_rcu(p, rcu);
                         ret = 0;
                         break;
                 }
@@ -341,9 +297,9 @@ static int ip6addrlbl_del(struct net *net,
                   __func__, prefix, prefixlen, ifindex);
 
         ipv6_addr_prefix(&prefix_buf, prefix, prefixlen);
-        spin_lock(&ip6addrlbl_table.lock);
+        spin_lock(&net->ipv6.ip6addrlbl_table.lock);
         ret = __ip6addrlbl_del(net, &prefix_buf, prefixlen, ifindex);
-        spin_unlock(&ip6addrlbl_table.lock);
+        spin_unlock(&net->ipv6.ip6addrlbl_table.lock);
         return ret;
 }
 
@@ -355,6 +311,9 @@ static int __net_init ip6addrlbl_net_init(struct net *net)
 
         ADDRLABEL(KERN_DEBUG "%s\n", __func__);
 
+        spin_lock_init(&net->ipv6.ip6addrlbl_table.lock);
+        INIT_HLIST_HEAD(&net->ipv6.ip6addrlbl_table.head);
+
         for (i = 0; i < ARRAY_SIZE(ip6addrlbl_init_table); i++) {
                 int ret = ip6addrlbl_add(net,
                                          ip6addrlbl_init_table[i].prefix,
@@ -374,14 +333,12 @@ static void __net_exit ip6addrlbl_net_exit(struct net *net)
         struct hlist_node *n;
 
         /* Remove all labels belonging to the exiting net */
-        spin_lock(&ip6addrlbl_table.lock);
-        hlist_for_each_entry_safe(p, n, &ip6addrlbl_table.head, list) {
-                if (net_eq(ip6addrlbl_net(p), net)) {
-                        hlist_del_rcu(&p->list);
-                        ip6addrlbl_put(p);
-                }
+        spin_lock(&net->ipv6.ip6addrlbl_table.lock);
+        hlist_for_each_entry_safe(p, n, &net->ipv6.ip6addrlbl_table.head, list) {
+                hlist_del_rcu(&p->list);
+                kfree_rcu(p, rcu);
         }
-        spin_unlock(&ip6addrlbl_table.lock);
+        spin_unlock(&net->ipv6.ip6addrlbl_table.lock);
 }
 
 static struct pernet_operations ipv6_addr_label_ops = {
@@ -391,8 +348,6 @@ static struct pernet_operations ipv6_addr_label_ops = {
 
 int __init ipv6_addr_label_init(void)
 {
-        spin_lock_init(&ip6addrlbl_table.lock);
-
         return register_pernet_subsys(&ipv6_addr_label_ops);
 }
 
@@ -511,11 +466,10 @@ static int ip6addrlbl_dump(struct sk_buff *skb, struct netlink_callback *cb)
         int err;
 
         rcu_read_lock();
-        hlist_for_each_entry_rcu(p, &ip6addrlbl_table.head, list) {
-                if (idx >= s_idx &&
-                    net_eq(ip6addrlbl_net(p), net)) {
+        hlist_for_each_entry_rcu(p, &net->ipv6.ip6addrlbl_table.head, list) {
+                if (idx >= s_idx) {
                         err = ip6addrlbl_fill(skb, p,
-                                              ip6addrlbl_table.seq,
+                                              net->ipv6.ip6addrlbl_table.seq,
                                               NETLINK_CB(cb->skb).portid,
                                               cb->nlh->nlmsg_seq,
                                               RTM_NEWADDRLABEL,
@@ -568,38 +522,28 @@ static int ip6addrlbl_get(struct sk_buff *in_skb, struct nlmsghdr *nlh,
                 return -EINVAL;
         addr = nla_data(tb[IFAL_ADDRESS]);
 
-        rcu_read_lock();
-        p = __ipv6_addr_label(net, addr, ipv6_addr_type(addr), ifal->ifal_index);
-        if (p && !ip6addrlbl_hold(p))
-                p = NULL;
-        lseq = ip6addrlbl_table.seq;
-        rcu_read_unlock();
-
-        if (!p) {
-                err = -ESRCH;
-                goto out;
-        }
-
         skb = nlmsg_new(ip6addrlbl_msgsize(), GFP_KERNEL);
-        if (!skb) {
-                ip6addrlbl_put(p);
+        if (!skb)
                 return -ENOBUFS;
-        }
 
-        err = ip6addrlbl_fill(skb, p, lseq,
-                              NETLINK_CB(in_skb).portid, nlh->nlmsg_seq,
-                              RTM_NEWADDRLABEL, 0);
+        err = -ESRCH;
 
-        ip6addrlbl_put(p);
+        rcu_read_lock();
+        p = __ipv6_addr_label(net, addr, ipv6_addr_type(addr), ifal->ifal_index);
+        lseq = net->ipv6.ip6addrlbl_table.seq;
+        if (p)
+                err = ip6addrlbl_fill(skb, p, lseq,
+                                      NETLINK_CB(in_skb).portid,
+                                      nlh->nlmsg_seq,
+                                      RTM_NEWADDRLABEL, 0);
+        rcu_read_unlock();
 
         if (err < 0) {
                 WARN_ON(err == -EMSGSIZE);
                 kfree_skb(skb);
-                goto out;
+        } else {
+                err = rtnl_unicast(skb, net, NETLINK_CB(in_skb).portid);
         }
-
-        err = rtnl_unicast(skb, net, NETLINK_CB(in_skb).portid);
-out:
         return err;
 }
 
diff --git a/net/ipv6/af_inet6.c b/net/ipv6/af_inet6.c
index fe5262fd6aa5..c26f71234b9c 100644
--- a/net/ipv6/af_inet6.c
+++ b/net/ipv6/af_inet6.c
@@ -810,6 +810,10 @@ static int __net_init inet6_net_init(struct net *net)
         net->ipv6.sysctl.idgen_retries = 3;
         net->ipv6.sysctl.idgen_delay = 1 * HZ;
         net->ipv6.sysctl.flowlabel_state_ranges = 0;
+        net->ipv6.sysctl.max_dst_opts_cnt = IP6_DEFAULT_MAX_DST_OPTS_CNT;
+        net->ipv6.sysctl.max_hbh_opts_cnt = IP6_DEFAULT_MAX_HBH_OPTS_CNT;
+        net->ipv6.sysctl.max_dst_opts_len = IP6_DEFAULT_MAX_DST_OPTS_LEN;
+        net->ipv6.sysctl.max_hbh_opts_len = IP6_DEFAULT_MAX_HBH_OPTS_LEN;
         atomic_set(&net->ipv6.fib6_sernum, 1);
 
         err = ipv6_init_mibs(net);
diff --git a/net/ipv6/ah6.c b/net/ipv6/ah6.c
index 7802b72196f3..78c974391567 100644
--- a/net/ipv6/ah6.c
+++ b/net/ipv6/ah6.c
@@ -271,6 +271,7 @@ static int ipv6_clear_mutable_options(struct ipv6hdr *iph, int len, int dir)
                 case NEXTHDR_DEST:
                         if (dir == XFRM_POLICY_OUT)
                                 ipv6_rearrange_destopt(iph, exthdr.opth);
+                        /* fall through */
                 case NEXTHDR_HOP:
                         if (!zero_out_mutable_opts(exthdr.opth)) {
                                 net_dbg_ratelimited("overrun %sopts\n",
@@ -443,7 +444,7 @@ static int ah6_output(struct xfrm_state *x, struct sk_buff *skb)
                 if (err == -EINPROGRESS)
                         goto out;
 
-                if (err == -EBUSY)
+                if (err == -ENOSPC)
                         err = NET_XMIT_DROP;
                 goto out_free;
         }
diff --git a/net/ipv6/esp6.c b/net/ipv6/esp6.c
index 89910e2c10f4..a902ff8f59be 100644
--- a/net/ipv6/esp6.c
+++ b/net/ipv6/esp6.c
@@ -396,7 +396,7 @@ int esp6_output_tail(struct xfrm_state *x, struct sk_buff *skb, struct esp_info
         case -EINPROGRESS:
                 goto error;
 
-        case -EBUSY:
+        case -ENOSPC:
                 err = NET_XMIT_DROP;
                 break;
 
@@ -483,8 +483,8 @@ static inline int esp_remove_trailer(struct sk_buff *skb)
                 goto out;
         }
 
-        if (skb_copy_bits(skb, skb->len - alen - 2, nexthdr, 2))
-                BUG();
+        ret = skb_copy_bits(skb, skb->len - alen - 2, nexthdr, 2);
+        BUG_ON(ret);
 
         ret = -EINVAL;
         padlen = nexthdr[0];
@@ -559,14 +559,14 @@ static void esp_input_restore_header(struct sk_buff *skb)
 static void esp_input_set_header(struct sk_buff *skb, __be32 *seqhi)
 {
         struct xfrm_state *x = xfrm_input_state(skb);
-        struct ip_esp_hdr *esph = (struct ip_esp_hdr *)skb->data;
 
         /* For ESN we move the header forward by 4 bytes to
          * accomodate the high bits.  We will move it back after
          * decryption.
          */
         if ((x->props.flags & XFRM_STATE_ESN)) {
-                esph = skb_push(skb, 4);
+                struct ip_esp_hdr *esph = skb_push(skb, 4);
+
                 *seqhi = esph->spi;
                 esph->spi = esph->seq_no;
                 esph->seq_no = XFRM_SKB_CB(skb)->seq.input.hi;
diff --git a/net/ipv6/exthdrs.c b/net/ipv6/exthdrs.c
index 95516138e861..83bd75713535 100644
--- a/net/ipv6/exthdrs.c
+++ b/net/ipv6/exthdrs.c
@@ -74,8 +74,20 @@ struct tlvtype_proc {
 
 /* An unknown option is detected, decide what to do */
 
-static bool ip6_tlvopt_unknown(struct sk_buff *skb, int optoff)
+static bool ip6_tlvopt_unknown(struct sk_buff *skb, int optoff,
+                               bool disallow_unknowns)
 {
+        if (disallow_unknowns) {
+                /* If unknown TLVs are disallowed by configuration
+                 * then always silently drop packet. Note this also
+                 * means no ICMP parameter problem is sent which
+                 * could be a good property to mitigate a reflection DOS
+                 * attack.
+                 */
+
+                goto drop;
+        }
+
         switch ((skb_network_header(skb)[optoff] & 0xC0) >> 6) {
         case 0: /* ignore */
                 return true;
@@ -89,25 +101,36 @@ static bool ip6_tlvopt_unknown(struct sk_buff *skb, int optoff)
                  */
                 if (ipv6_addr_is_multicast(&ipv6_hdr(skb)->daddr))
                         break;
+                /* fall through */
         case 2: /* send ICMP PARM PROB regardless and drop packet */
                 icmpv6_param_prob(skb, ICMPV6_UNK_OPTION, optoff);
                 return false;
         }
 
+drop:
         kfree_skb(skb);
         return false;
 }
 
 /* Parse tlv encoded option header (hop-by-hop or destination) */
 
-static bool ip6_parse_tlv(const struct tlvtype_proc *procs, struct sk_buff *skb)
+static bool ip6_parse_tlv(const struct tlvtype_proc *procs,
+                          struct sk_buff *skb,
+                          int max_count)
 {
-        const struct tlvtype_proc *curr;
+        int len = (skb_transport_header(skb)[1] + 1) << 3;
         const unsigned char *nh = skb_network_header(skb);
         int off = skb_network_header_len(skb);
-        int len = (skb_transport_header(skb)[1] + 1) << 3;
+        const struct tlvtype_proc *curr;
+        bool disallow_unknowns = false;
+        int tlv_count = 0;
         int padlen = 0;
 
+        if (unlikely(max_count < 0)) {
+                disallow_unknowns = true;
+                max_count = -max_count;
+        }
+
         if (skb_transport_offset(skb) + len > skb_headlen(skb))
                 goto bad;
 
@@ -148,6 +171,11 @@ static bool ip6_parse_tlv(const struct tlvtype_proc *procs, struct sk_buff *skb)
                 default: /* Other TLV code so scan list */
                         if (optlen > len)
                                 goto bad;
+
+                        tlv_count++;
+                        if (tlv_count > max_count)
+                                goto bad;
+
                         for (curr = procs; curr->type >= 0; curr++) {
                                 if (curr->type == nh[off]) {
                                         /* type specific length/alignment
@@ -158,10 +186,10 @@ static bool ip6_parse_tlv(const struct tlvtype_proc *procs, struct sk_buff *skb)
                                         break;
                                 }
                         }
-                        if (curr->type < 0) {
-                                if (ip6_tlvopt_unknown(skb, off) == 0)
-                                        return false;
-                        }
+                        if (curr->type < 0 &&
+                            !ip6_tlvopt_unknown(skb, off, disallow_unknowns))
+                                return false;
+
                         padlen = 0;
                         break;
                 }
@@ -186,7 +214,6 @@ static bool ipv6_dest_hao(struct sk_buff *skb, int optoff)
         struct ipv6_destopt_hao *hao;
         struct inet6_skb_parm *opt = IP6CB(skb);
         struct ipv6hdr *ipv6h = ipv6_hdr(skb);
-        struct in6_addr tmp_addr;
         int ret;
 
         if (opt->dsthao) {
@@ -228,9 +255,7 @@ static bool ipv6_dest_hao(struct sk_buff *skb, int optoff)
         if (skb->ip_summed == CHECKSUM_COMPLETE)
                 skb->ip_summed = CHECKSUM_NONE;
 
-        tmp_addr = ipv6h->saddr;
-        ipv6h->saddr = hao->addr;
-        hao->addr = tmp_addr;
+        swap(ipv6h->saddr, hao->addr);
 
         if (skb->tstamp == 0)
                 __net_timestamp(skb);
@@ -260,23 +285,31 @@ static int ipv6_destopt_rcv(struct sk_buff *skb)
         __u16 dstbuf;
 #endif
         struct dst_entry *dst = skb_dst(skb);
+        struct net *net = dev_net(skb->dev);
+        int extlen;
 
         if (!pskb_may_pull(skb, skb_transport_offset(skb) + 8) ||
             !pskb_may_pull(skb, (skb_transport_offset(skb) +
                                  ((skb_transport_header(skb)[1] + 1) << 3)))) {
                 __IP6_INC_STATS(dev_net(dst->dev), ip6_dst_idev(dst),
                                 IPSTATS_MIB_INHDRERRORS);
+fail_and_free:
                 kfree_skb(skb);
                 return -1;
         }
 
+        extlen = (skb_transport_header(skb)[1] + 1) << 3;
+        if (extlen > net->ipv6.sysctl.max_dst_opts_len)
+                goto fail_and_free;
+
         opt->lastopt = opt->dst1 = skb_network_header_len(skb);
 #if IS_ENABLED(CONFIG_IPV6_MIP6)
         dstbuf = opt->dst1;
 #endif
 
-        if (ip6_parse_tlv(tlvprocdestopt_lst, skb)) {
-                skb->transport_header += (skb_transport_header(skb)[1] + 1) << 3;
+        if (ip6_parse_tlv(tlvprocdestopt_lst, skb,
+                          init_net.ipv6.sysctl.max_dst_opts_cnt)) {
+                skb->transport_header += extlen;
                 opt = IP6CB(skb);
 #if IS_ENABLED(CONFIG_IPV6_MIP6)
                 opt->nhoff = dstbuf;
@@ -805,6 +838,8 @@ static const struct tlvtype_proc tlvprochopopt_lst[] = {
 int ipv6_parse_hopopts(struct sk_buff *skb)
 {
         struct inet6_skb_parm *opt = IP6CB(skb);
+        struct net *net = dev_net(skb->dev);
+        int extlen;
 
         /*
          * skb_network_header(skb) is equal to skb->data, and
@@ -815,13 +850,19 @@ int ipv6_parse_hopopts(struct sk_buff *skb)
         if (!pskb_may_pull(skb, sizeof(struct ipv6hdr) + 8) ||
             !pskb_may_pull(skb, (sizeof(struct ipv6hdr) +
                                  ((skb_transport_header(skb)[1] + 1) << 3)))) {
+fail_and_free:
                 kfree_skb(skb);
                 return -1;
         }
 
+        extlen = (skb_transport_header(skb)[1] + 1) << 3;
+        if (extlen > net->ipv6.sysctl.max_hbh_opts_len)
+                goto fail_and_free;
+
         opt->flags |= IP6SKB_HOPBYHOP;
-        if (ip6_parse_tlv(tlvprochopopt_lst, skb)) {
-                skb->transport_header += (skb_transport_header(skb)[1] + 1) << 3;
+        if (ip6_parse_tlv(tlvprochopopt_lst, skb,
+                          init_net.ipv6.sysctl.max_hbh_opts_cnt)) {
+                skb->transport_header += extlen;
                 opt = IP6CB(skb);
                 opt->nhoff = sizeof(struct ipv6hdr);
                 return 1;
diff --git a/net/ipv6/exthdrs_core.c b/net/ipv6/exthdrs_core.c
index 305e2ed730bf..11025f8d124b 100644
--- a/net/ipv6/exthdrs_core.c
+++ b/net/ipv6/exthdrs_core.c
@@ -99,7 +99,7 @@ int ipv6_skip_exthdr(const struct sk_buff *skb, int start, u8 *nexthdrp,
                                 break;
                         hdrlen = 8;
                 } else if (nexthdr == NEXTHDR_AUTH)
-                        hdrlen = (hp->hdrlen+2)<<2;
+                        hdrlen = ipv6_authlen(hp);
                 else
                         hdrlen = ipv6_optlen(hp);
 
@@ -187,7 +187,6 @@ int ipv6_find_hdr(const struct sk_buff *skb, unsigned int *offset,
 {
         unsigned int start = skb_network_offset(skb) + sizeof(struct ipv6hdr);
         u8 nexthdr = ipv6_hdr(skb)->nexthdr;
-        unsigned int len;
         bool found;
 
         if (fragoff)
@@ -204,7 +203,6 @@ int ipv6_find_hdr(const struct sk_buff *skb, unsigned int *offset,
                 start = *offset + sizeof(struct ipv6hdr);
                 nexthdr = ip6->nexthdr;
         }
-        len = skb->len - start;
 
         do {
                 struct ipv6_opt_hdr _hdr, *hp;
@@ -273,7 +271,6 @@ int ipv6_find_hdr(const struct sk_buff *skb, unsigned int *offset,
 
                 if (!found) {
                         nexthdr = hp->nexthdr;
-                        len -= hdrlen;
                         start += hdrlen;
                 }
         } while (!found);
diff --git a/net/ipv6/icmp.c b/net/ipv6/icmp.c
index 5acb54405b10..6ae5dd3f4d0d 100644
--- a/net/ipv6/icmp.c
+++ b/net/ipv6/icmp.c
@@ -250,16 +250,15 @@ static bool opt_unrec(struct sk_buff *skb, __u32 offset)
         return (*op & 0xC0) == 0x80;
 }
 
-int icmpv6_push_pending_frames(struct sock *sk, struct flowi6 *fl6,
-                               struct icmp6hdr *thdr, int len)
+void icmpv6_push_pending_frames(struct sock *sk, struct flowi6 *fl6,
+                                struct icmp6hdr *thdr, int len)
 {
         struct sk_buff *skb;
         struct icmp6hdr *icmp6h;
-        int err = 0;
 
         skb = skb_peek(&sk->sk_write_queue);
         if (!skb)
-                goto out;
+                return;
 
         icmp6h = icmp6_hdr(skb);
         memcpy(icmp6h, thdr, sizeof(struct icmp6hdr));
@@ -287,8 +286,6 @@ int icmpv6_push_pending_frames(struct sock *sk, struct flowi6 *fl6,
                                                       tmp_csum);
         }
         ip6_push_pending_frames(sk);
-out:
-        return err;
 }
 
 struct icmpv6_msg {
@@ -438,7 +435,6 @@ static void icmp6_send(struct sk_buff *skb, u8 type, u8 code, __u32 info,
         int iif = 0;
         int addr_type = 0;
         int len;
-        int err = 0;
         u32 mark = IP6_REPLY_MARK(net, skb->mark);
 
         if ((u8 *)hdr < skb->head ||
@@ -575,17 +571,16 @@ static void icmp6_send(struct sk_buff *skb, u8 type, u8 code, __u32 info,
         rcu_read_lock();
         idev = __in6_dev_get(skb->dev);
 
-        err = ip6_append_data(sk, icmpv6_getfrag, &msg,
-                              len + sizeof(struct icmp6hdr),
-                              sizeof(struct icmp6hdr),
-                              &ipc6, &fl6, (struct rt6_info *)dst,
-                              MSG_DONTWAIT, &sockc_unused);
-        if (err) {
+        if (ip6_append_data(sk, icmpv6_getfrag, &msg,
+                            len + sizeof(struct icmp6hdr),
+                            sizeof(struct icmp6hdr),
+                            &ipc6, &fl6, (struct rt6_info *)dst,
+                            MSG_DONTWAIT, &sockc_unused)) {
                 ICMP6_INC_STATS(net, idev, ICMP6_MIB_OUTERRORS);
                 ip6_flush_pending_frames(sk);
         } else {
-                err = icmpv6_push_pending_frames(sk, &fl6, &tmp_hdr,
-                                                 len + sizeof(struct icmp6hdr));
+                icmpv6_push_pending_frames(sk, &fl6, &tmp_hdr,
+                                           len + sizeof(struct icmp6hdr));
         }
         rcu_read_unlock();
 out_dst_release:
@@ -682,7 +677,6 @@ static void icmpv6_echo_reply(struct sk_buff *skb)
         struct icmpv6_msg msg;
         struct dst_entry *dst;
         struct ipcm6_cookie ipc6;
-        int err = 0;
         u32 mark = IP6_REPLY_MARK(net, skb->mark);
         struct sockcm_cookie sockc_unused = {0};
 
@@ -719,8 +713,7 @@ static void icmpv6_echo_reply(struct sk_buff *skb)
         else if (!fl6.flowi6_oif)
                 fl6.flowi6_oif = np->ucast_oif;
 
-        err = ip6_dst_lookup(net, sk, &dst, &fl6);
-        if (err)
+        if (ip6_dst_lookup(net, sk, &dst, &fl6))
                 goto out;
         dst = xfrm_lookup(net, dst, flowi6_to_flowi(&fl6), sk, 0);
         if (IS_ERR(dst))
@@ -737,17 +730,16 @@ static void icmpv6_echo_reply(struct sk_buff *skb)
         ipc6.dontfrag = np->dontfrag;
         ipc6.opt = NULL;
 
-        err = ip6_append_data(sk, icmpv6_getfrag, &msg, skb->len + sizeof(struct icmp6hdr),
-                                sizeof(struct icmp6hdr), &ipc6, &fl6,
-                                (struct rt6_info *)dst, MSG_DONTWAIT,
-                                &sockc_unused);
-
-        if (err) {
+        if (ip6_append_data(sk, icmpv6_getfrag, &msg,
+                            skb->len + sizeof(struct icmp6hdr),
+                            sizeof(struct icmp6hdr), &ipc6, &fl6,
+                            (struct rt6_info *)dst, MSG_DONTWAIT,
+                            &sockc_unused)) {
                 __ICMP6_INC_STATS(net, idev, ICMP6_MIB_OUTERRORS);
                 ip6_flush_pending_frames(sk);
         } else {
-                err = icmpv6_push_pending_frames(sk, &fl6, &tmp_hdr,
-                                                 skb->len + sizeof(struct icmp6hdr));
+                icmpv6_push_pending_frames(sk, &fl6, &tmp_hdr,
+                                           skb->len + sizeof(struct icmp6hdr));
         }
         dst_release(dst);
 out:
@@ -872,10 +864,8 @@ static int icmpv6_rcv(struct sk_buff *skb)
                         goto discard_it;
                 hdr = icmp6_hdr(skb);
 
-                /*
-                 *      Drop through to notify
-                 */
-
+                /* to notify */
+                /* fall through */
         case ICMPV6_DEST_UNREACH:
         case ICMPV6_TIME_EXCEED:
         case ICMPV6_PARAMPROB:
diff --git a/net/ipv6/ila/ila.h b/net/ipv6/ila/ila.h
index e0170f62bc39..3c7a11b62334 100644
--- a/net/ipv6/ila/ila.h
+++ b/net/ipv6/ila/ila.h
@@ -55,17 +55,6 @@ struct ila_identifier {
         };
 };
 
-enum {
-        ILA_ATYPE_IID = 0,
-        ILA_ATYPE_LUID,
-        ILA_ATYPE_VIRT_V4,
-        ILA_ATYPE_VIRT_UNI_V6,
-        ILA_ATYPE_VIRT_MULTI_V6,
-        ILA_ATYPE_RSVD_1,
-        ILA_ATYPE_RSVD_2,
-        ILA_ATYPE_RSVD_3,
-};
-
 #define CSUM_NEUTRAL_FLAG       htonl(0x10000000)
 
 struct ila_addr {
@@ -93,6 +82,7 @@ struct ila_params {
         struct ila_locator locator_match;
         __wsum csum_diff;
         u8 csum_mode;
+        u8 ident_type;
 };
 
 static inline __wsum compute_csum_diff8(const __be32 *from, const __be32 *to)
diff --git a/net/ipv6/ila/ila_common.c b/net/ipv6/ila/ila_common.c
index aba0998ddbfb..8c88ecf29b93 100644
--- a/net/ipv6/ila/ila_common.c
+++ b/net/ipv6/ila/ila_common.c
@@ -13,30 +13,37 @@
 #include <uapi/linux/ila.h>
 #include "ila.h"
 
-static __wsum get_csum_diff(struct ipv6hdr *ip6h, struct ila_params *p)
+void ila_init_saved_csum(struct ila_params *p)
 {
-        struct ila_addr *iaddr = ila_a2i(&ip6h->daddr);
+        if (!p->locator_match.v64)
+                return;
 
+        p->csum_diff = compute_csum_diff8(
+                                (__be32 *)&p->locator,
+                                (__be32 *)&p->locator_match);
+}
+
+static __wsum get_csum_diff_iaddr(struct ila_addr *iaddr, struct ila_params *p)
+{
         if (p->locator_match.v64)
                 return p->csum_diff;
         else
-                return compute_csum_diff8((__be32 *)&iaddr->loc,
-                                          (__be32 *)&p->locator);
+                return compute_csum_diff8((__be32 *)&p->locator,
+                                          (__be32 *)&iaddr->loc);
 }
 
-static void ila_csum_do_neutral(struct ila_addr *iaddr,
-                                struct ila_params *p)
+static __wsum get_csum_diff(struct ipv6hdr *ip6h, struct ila_params *p)
+{
+        return get_csum_diff_iaddr(ila_a2i(&ip6h->daddr), p);
+}
+
+static void ila_csum_do_neutral_fmt(struct ila_addr *iaddr,
+                                    struct ila_params *p)
 {
         __sum16 *adjust = (__force __sum16 *)&iaddr->ident.v16[3];
         __wsum diff, fval;
 
-        /* Check if checksum adjust value has been cached */
-        if (p->locator_match.v64) {
-                diff = p->csum_diff;
-        } else {
-                diff = compute_csum_diff8((__be32 *)&p->locator,
-                                          (__be32 *)iaddr);
-        }
+        diff = get_csum_diff_iaddr(iaddr, p);
 
         fval = (__force __wsum)(ila_csum_neutral_set(iaddr->ident) ?
                         CSUM_NEUTRAL_FLAG : ~CSUM_NEUTRAL_FLAG);
@@ -53,13 +60,23 @@ static void ila_csum_do_neutral(struct ila_addr *iaddr,
         iaddr->ident.csum_neutral ^= 1;
 }
 
-static void ila_csum_adjust_transport(struct sk_buff *skb,
+static void ila_csum_do_neutral_nofmt(struct ila_addr *iaddr,
                                       struct ila_params *p)
 {
+        __sum16 *adjust = (__force __sum16 *)&iaddr->ident.v16[3];
         __wsum diff;
-        struct ipv6hdr *ip6h = ipv6_hdr(skb);
-        struct ila_addr *iaddr = ila_a2i(&ip6h->daddr);
+
+        diff = get_csum_diff_iaddr(iaddr, p);
+
+        *adjust = ~csum_fold(csum_add(diff, csum_unfold(*adjust)));
+}
+
+static void ila_csum_adjust_transport(struct sk_buff *skb,
+                                      struct ila_params *p)
+{
         size_t nhoff = sizeof(struct ipv6hdr);
+        struct ipv6hdr *ip6h = ipv6_hdr(skb);
+        __wsum diff;
 
         switch (ip6h->nexthdr) {
         case NEXTHDR_TCP:
@@ -98,52 +115,45 @@ static void ila_csum_adjust_transport(struct sk_buff *skb,
                 }
                 break;
         }
-
-        /* Now change destination address */
-        iaddr->loc = p->locator;
 }
 
 void ila_update_ipv6_locator(struct sk_buff *skb, struct ila_params *p,
-                             bool set_csum_neutral)
+                             bool sir2ila)
 {
         struct ipv6hdr *ip6h = ipv6_hdr(skb);
         struct ila_addr *iaddr = ila_a2i(&ip6h->daddr);
 
-        /* First deal with the transport checksum */
-        if (ila_csum_neutral_set(iaddr->ident)) {
-                /* C-bit is set in the locator indicating that this
-                 * is a locator being translated to a SIR address.
-                 * Perform (receiver) checksum-neutral translation.
-                 */
-                if (!set_csum_neutral)
-                        ila_csum_do_neutral(iaddr, p);
-        } else {
-                switch (p->csum_mode) {
-                case ILA_CSUM_ADJUST_TRANSPORT:
-                        ila_csum_adjust_transport(skb, p);
-                        break;
-                case ILA_CSUM_NEUTRAL_MAP:
-                        ila_csum_do_neutral(iaddr, p);
-                        break;
-                case ILA_CSUM_NO_ACTION:
+        switch (p->csum_mode) {
+        case ILA_CSUM_ADJUST_TRANSPORT:
+                ila_csum_adjust_transport(skb, p);
+                break;
+        case ILA_CSUM_NEUTRAL_MAP:
+                if (sir2ila) {
+                        if (WARN_ON(ila_csum_neutral_set(iaddr->ident))) {
+                                /* Checksum flag should never be
+                                 * set in a formatted SIR address.
+                                 */
+                                break;
+                        }
+                } else if (!ila_csum_neutral_set(iaddr->ident)) {
+                        /* ILA to SIR translation and C-bit isn't
+                         * set so we're good.
+                         */
                         break;
                 }
+                ila_csum_do_neutral_fmt(iaddr, p);
+                break;
+        case ILA_CSUM_NEUTRAL_MAP_AUTO:
+                ila_csum_do_neutral_nofmt(iaddr, p);
+                break;
+        case ILA_CSUM_NO_ACTION:
+                break;
         }
 
         /* Now change destination address */
         iaddr->loc = p->locator;
 }
 
-void ila_init_saved_csum(struct ila_params *p)
-{
-        if (!p->locator_match.v64)
-                return;
-
-        p->csum_diff = compute_csum_diff8(
-                                (__be32 *)&p->locator,
-                                (__be32 *)&p->locator_match);
-}
-
 static int __init ila_init(void)
 {
         int ret;
diff --git a/net/ipv6/ila/ila_lwt.c b/net/ipv6/ila/ila_lwt.c
index 696281b4bca2..3d56a2fb6f86 100644
--- a/net/ipv6/ila/ila_lwt.c
+++ b/net/ipv6/ila/ila_lwt.c
@@ -20,6 +20,7 @@ struct ila_lwt {
         struct ila_params p;
         struct dst_cache dst_cache;
         u32 connected : 1;
+        u32 lwt_output : 1;
 };
 
 static inline struct ila_lwt *ila_lwt_lwtunnel(
@@ -45,8 +46,10 @@ static int ila_output(struct net *net, struct sock *sk, struct sk_buff *skb)
         if (skb->protocol != htons(ETH_P_IPV6))
                 goto drop;
 
-        ila_update_ipv6_locator(skb, ila_params_lwtunnel(orig_dst->lwtstate),
-                                true);
+        if (ilwt->lwt_output)
+                ila_update_ipv6_locator(skb,
+                                        ila_params_lwtunnel(orig_dst->lwtstate),
+                                        true);
 
         if (rt->rt6i_flags & (RTF_GATEWAY | RTF_CACHE)) {
                 /* Already have a next hop address in route, no need for
@@ -98,11 +101,15 @@ drop:
 static int ila_input(struct sk_buff *skb)
 {
         struct dst_entry *dst = skb_dst(skb);
+        struct ila_lwt *ilwt = ila_lwt_lwtunnel(dst->lwtstate);
 
         if (skb->protocol != htons(ETH_P_IPV6))
                 goto drop;
 
-        ila_update_ipv6_locator(skb, ila_params_lwtunnel(dst->lwtstate), false);
+        if (!ilwt->lwt_output)
+                ila_update_ipv6_locator(skb,
+                                        ila_params_lwtunnel(dst->lwtstate),
+                                        false);
 
         return dst->lwtstate->orig_input(skb);
 
@@ -114,6 +121,8 @@ drop:
 static const struct nla_policy ila_nl_policy[ILA_ATTR_MAX + 1] = {
         [ILA_ATTR_LOCATOR] = { .type = NLA_U64, },
         [ILA_ATTR_CSUM_MODE] = { .type = NLA_U8, },
+        [ILA_ATTR_IDENT_TYPE] = { .type = NLA_U8, },
+        [ILA_ATTR_HOOK_TYPE] = { .type = NLA_U8, },
 };
 
 static int ila_build_state(struct nlattr *nla,
@@ -127,33 +136,84 @@ static int ila_build_state(struct nlattr *nla,
         struct lwtunnel_state *newts;
         const struct fib6_config *cfg6 = cfg;
         struct ila_addr *iaddr;
+        u8 ident_type = ILA_ATYPE_USE_FORMAT;
+        u8 hook_type = ILA_HOOK_ROUTE_OUTPUT;
+        u8 csum_mode = ILA_CSUM_NO_ACTION;
+        bool lwt_output = true;
+        u8 eff_ident_type;
         int ret;
 
         if (family != AF_INET6)
                 return -EINVAL;
 
-        if (cfg6->fc_dst_len < 8 * sizeof(struct ila_locator) + 3) {
-                /* Need to have full locator and at least type field
-                 * included in destination
-                 */
+        ret = nla_parse_nested(tb, ILA_ATTR_MAX, nla, ila_nl_policy, extack);
+        if (ret < 0)
+                return ret;
+
+        if (!tb[ILA_ATTR_LOCATOR])
                 return -EINVAL;
-        }
 
         iaddr = (struct ila_addr *)&cfg6->fc_dst;
 
-        if (!ila_addr_is_ila(iaddr) || ila_csum_neutral_set(iaddr->ident)) {
-                /* Don't allow translation for a non-ILA address or checksum
-                 * neutral flag to be set.
+        if (tb[ILA_ATTR_IDENT_TYPE])
+                ident_type = nla_get_u8(tb[ILA_ATTR_IDENT_TYPE]);
+
+        if (ident_type == ILA_ATYPE_USE_FORMAT) {
+                /* Infer identifier type from type field in formatted
+                 * identifier.
                  */
+
+                if (cfg6->fc_dst_len < 8 * sizeof(struct ila_locator) + 3) {
+                        /* Need to have full locator and at least type field
+                         * included in destination
+                         */
+                        return -EINVAL;
+                }
+
+                eff_ident_type = iaddr->ident.type;
+        } else {
+                eff_ident_type = ident_type;
+        }
+
+        switch (eff_ident_type) {
+        case ILA_ATYPE_IID:
+                /* Don't allow ILA for IID type */
+                return -EINVAL;
+        case ILA_ATYPE_LUID:
+                break;
+        case ILA_ATYPE_VIRT_V4:
+        case ILA_ATYPE_VIRT_UNI_V6:
+        case ILA_ATYPE_VIRT_MULTI_V6:
+        case ILA_ATYPE_NONLOCAL_ADDR:
+                /* These ILA formats are not supported yet. */
+        default:
                 return -EINVAL;
         }
 
-        ret = nla_parse_nested(tb, ILA_ATTR_MAX, nla, ila_nl_policy, extack);
-        if (ret < 0)
-                return ret;
+        if (tb[ILA_ATTR_HOOK_TYPE])
+                hook_type = nla_get_u8(tb[ILA_ATTR_HOOK_TYPE]);
+
+        switch (hook_type) {
+        case ILA_HOOK_ROUTE_OUTPUT:
+                lwt_output = true;
+                break;
+        case ILA_HOOK_ROUTE_INPUT:
+                lwt_output = false;
+                break;
+        default:
+                return -EINVAL;
+        }
 
-        if (!tb[ILA_ATTR_LOCATOR])
+        if (tb[ILA_ATTR_CSUM_MODE])
+                csum_mode = nla_get_u8(tb[ILA_ATTR_CSUM_MODE]);
+
+        if (csum_mode == ILA_CSUM_NEUTRAL_MAP &&
+            ila_csum_neutral_set(iaddr->ident)) {
+                /* Don't allow translation if checksum neutral bit is
+                 * configured and it's set in the SIR address.
+                 */
                 return -EINVAL;
+        }
 
         newts = lwtunnel_state_alloc(sizeof(*ilwt));
         if (!newts)
@@ -166,19 +226,18 @@ static int ila_build_state(struct nlattr *nla,
                 return ret;
         }
 
+        ilwt->lwt_output = !!lwt_output;
+
         p = ila_params_lwtunnel(newts);
 
+        p->csum_mode = csum_mode;
+        p->ident_type = ident_type;
         p->locator.v64 = (__force __be64)nla_get_u64(tb[ILA_ATTR_LOCATOR]);
 
         /* Precompute checksum difference for translation since we
          * know both the old locator and the new one.
          */
         p->locator_match = iaddr->loc;
-        p->csum_diff = compute_csum_diff8(
-                (__be32 *)&p->locator_match, (__be32 *)&p->locator);
-
-        if (tb[ILA_ATTR_CSUM_MODE])
-                p->csum_mode = nla_get_u8(tb[ILA_ATTR_CSUM_MODE]);
 
         ila_init_saved_csum(p);
 
@@ -203,13 +262,23 @@ static int ila_fill_encap_info(struct sk_buff *skb,
                                struct lwtunnel_state *lwtstate)
 {
         struct ila_params *p = ila_params_lwtunnel(lwtstate);
+        struct ila_lwt *ilwt = ila_lwt_lwtunnel(lwtstate);
 
         if (nla_put_u64_64bit(skb, ILA_ATTR_LOCATOR, (__force u64)p->locator.v64,
                               ILA_ATTR_PAD))
                 goto nla_put_failure;
+
         if (nla_put_u8(skb, ILA_ATTR_CSUM_MODE, (__force u8)p->csum_mode))
                 goto nla_put_failure;
 
+        if (nla_put_u8(skb, ILA_ATTR_IDENT_TYPE, (__force u8)p->ident_type))
+                goto nla_put_failure;
+
+        if (nla_put_u8(skb, ILA_ATTR_HOOK_TYPE,
+                       ilwt->lwt_output ? ILA_HOOK_ROUTE_OUTPUT :
+                                          ILA_HOOK_ROUTE_INPUT))
+                goto nla_put_failure;
+
         return 0;
 
 nla_put_failure:
@@ -220,6 +289,8 @@ static int ila_encap_nlsize(struct lwtunnel_state *lwtstate)
 {
         return nla_total_size_64bit(sizeof(u64)) + /* ILA_ATTR_LOCATOR */
                nla_total_size(sizeof(u8)) +        /* ILA_ATTR_CSUM_MODE */
+               nla_total_size(sizeof(u8)) +        /* ILA_ATTR_IDENT_TYPE */
+               nla_total_size(sizeof(u8)) +        /* ILA_ATTR_HOOK_TYPE */
                0;
 }
 
diff --git a/net/ipv6/ila/ila_xlat.c b/net/ipv6/ila/ila_xlat.c
index 3123b9de91b5..6eb5e68f112a 100644
--- a/net/ipv6/ila/ila_xlat.c
+++ b/net/ipv6/ila/ila_xlat.c
@@ -121,6 +121,7 @@ static const struct nla_policy ila_nl_policy[ILA_ATTR_MAX + 1] = {
         [ILA_ATTR_LOCATOR_MATCH] = { .type = NLA_U64, },
         [ILA_ATTR_IFINDEX] = { .type = NLA_U32, },
         [ILA_ATTR_CSUM_MODE] = { .type = NLA_U8, },
+        [ILA_ATTR_IDENT_TYPE] = { .type = NLA_U8, },
 };
 
 static int parse_nl_config(struct genl_info *info,
@@ -138,6 +139,14 @@ static int parse_nl_config(struct genl_info *info,
 
         if (info->attrs[ILA_ATTR_CSUM_MODE])
                 xp->ip.csum_mode = nla_get_u8(info->attrs[ILA_ATTR_CSUM_MODE]);
+        else
+                xp->ip.csum_mode = ILA_CSUM_NO_ACTION;
+
+        if (info->attrs[ILA_ATTR_IDENT_TYPE])
+                xp->ip.ident_type = nla_get_u8(
+                                info->attrs[ILA_ATTR_IDENT_TYPE]);
+        else
+                xp->ip.ident_type = ILA_ATYPE_USE_FORMAT;
 
         if (info->attrs[ILA_ATTR_IFINDEX])
                 xp->ifindex = nla_get_s32(info->attrs[ILA_ATTR_IFINDEX]);
@@ -198,7 +207,7 @@ static void ila_free_cb(void *ptr, void *arg)
         }
 }
 
-static int ila_xlat_addr(struct sk_buff *skb, bool set_csum_neutral);
+static int ila_xlat_addr(struct sk_buff *skb, bool sir2ila);
 
 static unsigned int
 ila_nf_input(void *priv,
@@ -396,7 +405,8 @@ static int ila_fill_info(struct ila_map *ila, struct sk_buff *msg)
                               (__force u64)ila->xp.ip.locator_match.v64,
                               ILA_ATTR_PAD) ||
             nla_put_s32(msg, ILA_ATTR_IFINDEX, ila->xp.ifindex) ||
-            nla_put_u32(msg, ILA_ATTR_CSUM_MODE, ila->xp.ip.csum_mode))
+            nla_put_u8(msg, ILA_ATTR_CSUM_MODE, ila->xp.ip.csum_mode) ||
+            nla_put_u8(msg, ILA_ATTR_IDENT_TYPE, ila->xp.ip.ident_type))
                 return -1;
 
         return 0;
@@ -607,7 +617,7 @@ static struct pernet_operations ila_net_ops = {
         .size = sizeof(struct ila_net),
 };
 
-static int ila_xlat_addr(struct sk_buff *skb, bool set_csum_neutral)
+static int ila_xlat_addr(struct sk_buff *skb, bool sir2ila)
 {
         struct ila_map *ila;
         struct ipv6hdr *ip6h = ipv6_hdr(skb);
@@ -617,16 +627,16 @@ static int ila_xlat_addr(struct sk_buff *skb, bool set_csum_neutral)
 
         /* Assumes skb contains a valid IPv6 header that is pulled */
 
-        if (!ila_addr_is_ila(iaddr)) {
-                /* Type indicates this is not an ILA address */
-                return 0;
-        }
+        /* No check here that ILA type in the mapping matches what is in the
+         * address. We assume that whatever sender gaves us can be translated.
+         * The checksum mode however is relevant.
+         */
 
         rcu_read_lock();
 
         ila = ila_lookup_wildcards(iaddr, skb->dev->ifindex, ilan);
         if (ila)
-                ila_update_ipv6_locator(skb, &ila->xp.ip, set_csum_neutral);
+                ila_update_ipv6_locator(skb, &ila->xp.ip, sir2ila);
 
         rcu_read_unlock();
 
diff --git a/net/ipv6/ip6_fib.c b/net/ipv6/ip6_fib.c
index e5308d7cbd75..f5285f4e1d08 100644
--- a/net/ipv6/ip6_fib.c
+++ b/net/ipv6/ip6_fib.c
@@ -38,14 +38,6 @@
 #include <net/ip6_fib.h>
 #include <net/ip6_route.h>
 
-#define RT6_DEBUG 2
-
-#if RT6_DEBUG >= 3
-#define RT6_TRACE(x...) pr_debug(x)
-#else
-#define RT6_TRACE(x...) do { ; } while (0)
-#endif
-
 static struct kmem_cache *fib6_node_kmem __read_mostly;
 
 struct fib6_cleaner {
@@ -62,9 +54,12 @@ struct fib6_cleaner {
 #define FWS_INIT FWS_L
 #endif
 
-static void fib6_prune_clones(struct net *net, struct fib6_node *fn);
-static struct rt6_info *fib6_find_prefix(struct net *net, struct fib6_node *fn);
-static struct fib6_node *fib6_repair_tree(struct net *net, struct fib6_node *fn);
+static struct rt6_info *fib6_find_prefix(struct net *net,
+                                         struct fib6_table *table,
+                                         struct fib6_node *fn);
+static struct fib6_node *fib6_repair_tree(struct net *net,
+                                          struct fib6_table *table,
+                                          struct fib6_node *fn);
 static int fib6_walk(struct net *net, struct fib6_walker *w);
 static int fib6_walk_continue(struct fib6_walker *w);
 
@@ -75,7 +70,7 @@ static int fib6_walk_continue(struct fib6_walker *w);
  *      result of redirects, path MTU changes, etc.
  */
 
-static void fib6_gc_timer_cb(unsigned long arg);
+static void fib6_gc_timer_cb(struct timer_list *t);
 
 #define FOR_WALKERS(net, w) \
         list_for_each_entry(w, &(net)->ipv6.fib6_walkers, lh)
@@ -110,6 +105,20 @@ enum {
         FIB6_NO_SERNUM_CHANGE = 0,
 };
 
+void fib6_update_sernum(struct rt6_info *rt)
+{
+        struct fib6_table *table = rt->rt6i_table;
+        struct net *net = dev_net(rt->dst.dev);
+        struct fib6_node *fn;
+
+        spin_lock_bh(&table->tb6_lock);
+        fn = rcu_dereference_protected(rt->rt6i_node,
+                        lockdep_is_held(&table->tb6_lock));
+        if (fn)
+                fn->fn_sernum = fib6_new_sernum(net);
+        spin_unlock_bh(&table->tb6_lock);
+}
+
 /*
  *      Auxiliary address test functions for the radix tree.
  *
@@ -140,18 +149,21 @@ static __be32 addr_bit_set(const void *token, int fn_bit)
                addr[fn_bit >> 5];
 }
 
-static struct fib6_node *node_alloc(void)
+static struct fib6_node *node_alloc(struct net *net)
 {
         struct fib6_node *fn;
 
         fn = kmem_cache_zalloc(fib6_node_kmem, GFP_ATOMIC);
+        if (fn)
+                net->ipv6.rt6_stats->fib_nodes++;
 
         return fn;
 }
 
-static void node_free_immediate(struct fib6_node *fn)
+static void node_free_immediate(struct net *net, struct fib6_node *fn)
 {
         kmem_cache_free(fib6_node_kmem, fn);
+        net->ipv6.rt6_stats->fib_nodes--;
 }
 
 static void node_free_rcu(struct rcu_head *head)
@@ -161,9 +173,10 @@ static void node_free_rcu(struct rcu_head *head)
         kmem_cache_free(fib6_node_kmem, fn);
 }
 
-static void node_free(struct fib6_node *fn)
+static void node_free(struct net *net, struct fib6_node *fn)
 {
         call_rcu(&fn->rcu, node_free_rcu);
+        net->ipv6.rt6_stats->fib_nodes--;
 }
 
 void rt6_free_pcpu(struct rt6_info *non_pcpu_rt)
@@ -185,9 +198,6 @@ void rt6_free_pcpu(struct rt6_info *non_pcpu_rt)
                         *ppcpu_rt = NULL;
                 }
         }
-
-        free_percpu(non_pcpu_rt->rt6i_pcpu);
-        non_pcpu_rt->rt6i_pcpu = NULL;
 }
 EXPORT_SYMBOL_GPL(rt6_free_pcpu);
 
@@ -205,8 +215,7 @@ static void fib6_link_table(struct net *net, struct fib6_table *tb)
          * Initialize table lock at a single place to give lockdep a key,
          * tables aren't visible prior to being linked to the list.
          */
-        rwlock_init(&tb->tb6_lock);
-
+        spin_lock_init(&tb->tb6_lock);
         h = tb->tb6_id & (FIB6_TABLE_HASHSZ - 1);
 
         /*
@@ -225,7 +234,8 @@ static struct fib6_table *fib6_alloc_table(struct net *net, u32 id)
         table = kzalloc(sizeof(*table), GFP_ATOMIC);
         if (table) {
                 table->tb6_id = id;
-                table->tb6_root.leaf = net->ipv6.ip6_null_entry;
+                rcu_assign_pointer(table->tb6_root.leaf,
+                                   net->ipv6.ip6_null_entry);
                 table->tb6_root.fn_flags = RTN_ROOT | RTN_TL_ROOT | RTN_RTINFO;
                 inet_peer_base_init(&table->tb6_peers);
         }
@@ -322,11 +332,8 @@ unsigned int fib6_tables_seq_read(struct net *net)
                 struct hlist_head *head = &net->ipv6.fib_table_hash[h];
                 struct fib6_table *tb;
 
-                hlist_for_each_entry_rcu(tb, head, tb6_hlist) {
-                        read_lock_bh(&tb->tb6_lock);
+                hlist_for_each_entry_rcu(tb, head, tb6_hlist)
                         fib_seq += tb->fib_seq;
-                        read_unlock_bh(&tb->tb6_lock);
-                }
         }
         rcu_read_unlock();
 
@@ -346,9 +353,11 @@ static int call_fib6_entry_notifier(struct notifier_block *nb, struct net *net,
 
 static int call_fib6_entry_notifiers(struct net *net,
                                      enum fib_event_type event_type,
-                                     struct rt6_info *rt)
+                                     struct rt6_info *rt,
+                                     struct netlink_ext_ack *extack)
 {
         struct fib6_entry_notifier_info info = {
+                .info.extack = extack,
                 .rt = rt,
         };
 
@@ -372,7 +381,7 @@ static int fib6_node_dump(struct fib6_walker *w)
 {
         struct rt6_info *rt;
 
-        for (rt = w->leaf; rt; rt = rt->dst.rt6_next)
+        for_each_fib6_walker_rt(w)
                 fib6_rt_dump(rt, w->args);
         w->leaf = NULL;
         return 0;
@@ -382,9 +391,9 @@ static void fib6_table_dump(struct net *net, struct fib6_table *tb,
                             struct fib6_walker *w)
 {
         w->root = &tb->tb6_root;
-        read_lock_bh(&tb->tb6_lock);
+        spin_lock_bh(&tb->tb6_lock);
         fib6_walk(net, w);
-        read_unlock_bh(&tb->tb6_lock);
+        spin_unlock_bh(&tb->tb6_lock);
 }
 
 /* Called with rcu_read_lock() */
@@ -421,7 +430,7 @@ static int fib6_dump_node(struct fib6_walker *w)
         int res;
         struct rt6_info *rt;
 
-        for (rt = w->leaf; rt; rt = rt->dst.rt6_next) {
+        for_each_fib6_walker_rt(w) {
                 res = rt6_dump_route(rt, w->args);
                 if (res < 0) {
                         /* Frame is full, suspend walking */
@@ -480,9 +489,9 @@ static int fib6_dump_table(struct fib6_table *table, struct sk_buff *skb,
                 w->count = 0;
                 w->skip = 0;
 
-                read_lock_bh(&table->tb6_lock);
+                spin_lock_bh(&table->tb6_lock);
                 res = fib6_walk(net, w);
-                read_unlock_bh(&table->tb6_lock);
+                spin_unlock_bh(&table->tb6_lock);
                 if (res > 0) {
                         cb->args[4] = 1;
                         cb->args[5] = w->root->fn_sernum;
@@ -497,9 +506,9 @@ static int fib6_dump_table(struct fib6_table *table, struct sk_buff *skb,
                 } else
                         w->skip = 0;
 
-                read_lock_bh(&table->tb6_lock);
+                spin_lock_bh(&table->tb6_lock);
                 res = fib6_walk_continue(w);
-                read_unlock_bh(&table->tb6_lock);
+                spin_unlock_bh(&table->tb6_lock);
                 if (res <= 0) {
                         fib6_walker_unlink(net, w);
                         cb->args[4] = 0;
@@ -580,11 +589,13 @@ out:
  *      node.
  */
 
-static struct fib6_node *fib6_add_1(struct fib6_node *root,
-                                     struct in6_addr *addr, int plen,
-                                     int offset, int allow_create,
-                                     int replace_required, int sernum,
-                                     struct netlink_ext_ack *extack)
+static struct fib6_node *fib6_add_1(struct net *net,
+                                    struct fib6_table *table,
+                                    struct fib6_node *root,
+                                    struct in6_addr *addr, int plen,
+                                    int offset, int allow_create,
+                                    int replace_required,
+                                    struct netlink_ext_ack *extack)
 {
         struct fib6_node *fn, *in, *ln;
         struct fib6_node *pn = NULL;
@@ -599,7 +610,9 @@ static struct fib6_node *fib6_add_1(struct fib6_node *root,
         fn = root;
 
         do {
-                key = (struct rt6key *)((u8 *)fn->leaf + offset);
+                struct rt6_info *leaf = rcu_dereference_protected(fn->leaf,
+                                            lockdep_is_held(&table->tb6_lock));
+                key = (struct rt6key *)((u8 *)leaf + offset);
 
                 /*
                  *      Prefix match
@@ -625,12 +638,10 @@ static struct fib6_node *fib6_add_1(struct fib6_node *root,
                 if (plen == fn->fn_bit) {
                         /* clean up an intermediate node */
                         if (!(fn->fn_flags & RTN_RTINFO)) {
-                                rt6_release(fn->leaf);
-                                fn->leaf = NULL;
+                                RCU_INIT_POINTER(fn->leaf, NULL);
+                                rt6_release(leaf);
                         }
 
-                        fn->fn_sernum = sernum;
-
                         return fn;
                 }
 
@@ -639,10 +650,13 @@ static struct fib6_node *fib6_add_1(struct fib6_node *root,
                  */
 
                 /* Try to walk down on tree. */
-                fn->fn_sernum = sernum;
                 dir = addr_bit_set(addr, fn->fn_bit);
                 pn = fn;
-                fn = dir ? fn->right : fn->left;
+                fn = dir ?
+                     rcu_dereference_protected(fn->right,
+                                        lockdep_is_held(&table->tb6_lock)) :
+                     rcu_dereference_protected(fn->left,
+                                        lockdep_is_held(&table->tb6_lock));
         } while (fn);
 
         if (!allow_create) {
@@ -668,19 +682,17 @@ static struct fib6_node *fib6_add_1(struct fib6_node *root,
          *      Create new leaf node without children.
          */
 
-        ln = node_alloc();
+        ln = node_alloc(net);
 
         if (!ln)
                 return ERR_PTR(-ENOMEM);
         ln->fn_bit = plen;
-
-        ln->parent = pn;
-        ln->fn_sernum = sernum;
+        RCU_INIT_POINTER(ln->parent, pn);
 
         if (dir)
-                pn->right = ln;
+                rcu_assign_pointer(pn->right, ln);
         else
-                pn->left  = ln;
+                rcu_assign_pointer(pn->left, ln);
 
         return ln;
 
@@ -694,7 +706,8 @@ insert_above:
          * and the current
          */
 
-        pn = fn->parent;
+        pn = rcu_dereference_protected(fn->parent,
+                                       lockdep_is_held(&table->tb6_lock));
 
         /* find 1st bit in difference between the 2 addrs.
 
@@ -710,14 +723,14 @@ insert_above:
          *      (new leaf node)[ln] (old node)[fn]
          */
         if (plen > bit) {
-                in = node_alloc();
-                ln = node_alloc();
+                in = node_alloc(net);
+                ln = node_alloc(net);
 
                 if (!in || !ln) {
                         if (in)
-                                node_free_immediate(in);
+                                node_free_immediate(net, in);
                         if (ln)
-                                node_free_immediate(ln);
+                                node_free_immediate(net, ln);
                         return ERR_PTR(-ENOMEM);
                 }
 
@@ -731,31 +744,28 @@ insert_above:
 
                 in->fn_bit = bit;
 
-                in->parent = pn;
+                RCU_INIT_POINTER(in->parent, pn);
                 in->leaf = fn->leaf;
-                atomic_inc(&in->leaf->rt6i_ref);
-
-                in->fn_sernum = sernum;
+                atomic_inc(&rcu_dereference_protected(in->leaf,
+                                lockdep_is_held(&table->tb6_lock))->rt6i_ref);
 
                 /* update parent pointer */
                 if (dir)
-                        pn->right = in;
+                        rcu_assign_pointer(pn->right, in);
                 else
-                        pn->left  = in;
+                        rcu_assign_pointer(pn->left, in);
 
                 ln->fn_bit = plen;
 
-                ln->parent = in;
-                fn->parent = in;
-
-                ln->fn_sernum = sernum;
+                RCU_INIT_POINTER(ln->parent, in);
+                rcu_assign_pointer(fn->parent, in);
 
                 if (addr_bit_set(addr, bit)) {
-                        in->right = ln;
-                        in->left  = fn;
+                        rcu_assign_pointer(in->right, ln);
+                        rcu_assign_pointer(in->left, fn);
                 } else {
-                        in->left  = ln;
-                        in->right = fn;
+                        rcu_assign_pointer(in->left, ln);
+                        rcu_assign_pointer(in->right, fn);
                 }
         } else { /* plen <= bit */
 
@@ -765,28 +775,26 @@ insert_above:
                  *           (old node)[fn] NULL
                  */
 
-                ln = node_alloc();
+                ln = node_alloc(net);
 
                 if (!ln)
                         return ERR_PTR(-ENOMEM);
 
                 ln->fn_bit = plen;
 
-                ln->parent = pn;
-
-                ln->fn_sernum = sernum;
-
-                if (dir)
-                        pn->right = ln;
-                else
-                        pn->left  = ln;
+                RCU_INIT_POINTER(ln->parent, pn);
 
                 if (addr_bit_set(&key->addr, plen))
-                        ln->right = fn;
+                        RCU_INIT_POINTER(ln->right, fn);
                 else
-                        ln->left  = fn;
+                        RCU_INIT_POINTER(ln->left, fn);
+
+                rcu_assign_pointer(fn->parent, ln);
 
-                fn->parent = ln;
+                if (dir)
+                        rcu_assign_pointer(pn->right, ln);
+                else
+                        rcu_assign_pointer(pn->left, ln);
         }
         return ln;
 }
@@ -832,6 +840,8 @@ static int fib6_commit_metrics(struct dst_entry *dst, struct mx6_config *mxc)
 static void fib6_purge_rt(struct rt6_info *rt, struct fib6_node *fn,
                           struct net *net)
 {
+        struct fib6_table *table = rt->rt6i_table;
+
         if (atomic_read(&rt->rt6i_ref) != 1) {
                 /* This route is used as dummy address holder in some split
                  * nodes. It is not leaked, but it still holds other resources,
@@ -840,12 +850,17 @@ static void fib6_purge_rt(struct rt6_info *rt, struct fib6_node *fn,
                  * to still alive ones.
                  */
                 while (fn) {
-                        if (!(fn->fn_flags & RTN_RTINFO) && fn->leaf == rt) {
-                                fn->leaf = fib6_find_prefix(net, fn);
-                                atomic_inc(&fn->leaf->rt6i_ref);
+                        struct rt6_info *leaf = rcu_dereference_protected(fn->leaf,
+                                            lockdep_is_held(&table->tb6_lock));
+                        struct rt6_info *new_leaf;
+                        if (!(fn->fn_flags & RTN_RTINFO) && leaf == rt) {
+                                new_leaf = fib6_find_prefix(net, table, fn);
+                                atomic_inc(&new_leaf->rt6i_ref);
+                                rcu_assign_pointer(fn->leaf, new_leaf);
                                 rt6_release(rt);
                         }
-                        fn = fn->parent;
+                        fn = rcu_dereference_protected(fn->parent,
+                                    lockdep_is_held(&table->tb6_lock));
                 }
         }
 }
@@ -855,11 +870,14 @@ static void fib6_purge_rt(struct rt6_info *rt, struct fib6_node *fn,
  */
 
 static int fib6_add_rt2node(struct fib6_node *fn, struct rt6_info *rt,
-                            struct nl_info *info, struct mx6_config *mxc)
+                            struct nl_info *info, struct mx6_config *mxc,
+                            struct netlink_ext_ack *extack)
 {
+        struct rt6_info *leaf = rcu_dereference_protected(fn->leaf,
+                                    lockdep_is_held(&rt->rt6i_table->tb6_lock));
         struct rt6_info *iter = NULL;
-        struct rt6_info **ins;
-        struct rt6_info **fallback_ins = NULL;
+        struct rt6_info __rcu **ins;
+        struct rt6_info __rcu **fallback_ins = NULL;
         int replace = (info->nlh &&
                        (info->nlh->nlmsg_flags & NLM_F_REPLACE));
         int add = (!info->nlh ||
@@ -874,7 +892,9 @@ static int fib6_add_rt2node(struct fib6_node *fn, struct rt6_info *rt,
 
         ins = &fn->leaf;
 
-        for (iter = fn->leaf; iter; iter = iter->dst.rt6_next) {
+        for (iter = leaf; iter;
+             iter = rcu_dereference_protected(iter->dst.rt6_next,
+                                lockdep_is_held(&rt->rt6i_table->tb6_lock))) {
                 /*
                  *      Search for duplicates
                  */
@@ -936,7 +956,8 @@ next_iter:
         if (fallback_ins && !found) {
                 /* No ECMP-able route found, replace first non-ECMP one */
                 ins = fallback_ins;
-                iter = *ins;
+                iter = rcu_dereference_protected(*ins,
+                                    lockdep_is_held(&rt->rt6i_table->tb6_lock));
                 found++;
         }
 
@@ -950,7 +971,7 @@ next_iter:
                 struct rt6_info *sibling, *temp_sibling;
 
                 /* Find the first route that have the same metric */
-                sibling = fn->leaf;
+                sibling = leaf;
                 while (sibling) {
                         if (sibling->rt6i_metric == rt->rt6i_metric &&
                             rt6_qualify_for_ecmp(sibling)) {
@@ -958,7 +979,8 @@ next_iter:
                                               &sibling->rt6i_siblings);
                                 break;
                         }
-                        sibling = sibling->dst.rt6_next;
+                        sibling = rcu_dereference_protected(sibling->dst.rt6_next,
+                                    lockdep_is_held(&rt->rt6i_table->tb6_lock));
                 }
                 /* For each sibling in the list, increment the counter of
                  * siblings. BUG() if counters does not match, list of siblings
@@ -987,12 +1009,12 @@ add:
                 if (err)
                         return err;
 
-                rt->dst.rt6_next = iter;
-                *ins = rt;
-                rcu_assign_pointer(rt->rt6i_node, fn);
+                rcu_assign_pointer(rt->dst.rt6_next, iter);
                 atomic_inc(&rt->rt6i_ref);
+                rcu_assign_pointer(rt->rt6i_node, fn);
+                rcu_assign_pointer(*ins, rt);
                 call_fib6_entry_notifiers(info->nl_net, FIB_EVENT_ENTRY_ADD,
-                                          rt);
+                                          rt, extack);
                 if (!info->skip_notify)
                         inet6_rt_notify(RTM_NEWROUTE, rt, info, nlflags);
                 info->nl_net->ipv6.rt6_stats->fib_rt_entries++;
@@ -1016,12 +1038,12 @@ add:
                 if (err)
                         return err;
 
-                *ins = rt;
+                atomic_inc(&rt->rt6i_ref);
                 rcu_assign_pointer(rt->rt6i_node, fn);
                 rt->dst.rt6_next = iter->dst.rt6_next;
-                atomic_inc(&rt->rt6i_ref);
+                rcu_assign_pointer(*ins, rt);
                 call_fib6_entry_notifiers(info->nl_net, FIB_EVENT_ENTRY_REPLACE,
-                                          rt);
+                                          rt, extack);
                 if (!info->skip_notify)
                         inet6_rt_notify(RTM_NEWROUTE, rt, info, NLM_F_REPLACE);
                 if (!(fn->fn_flags & RTN_RTINFO)) {
@@ -1031,14 +1053,15 @@ add:
                 nsiblings = iter->rt6i_nsiblings;
                 iter->rt6i_node = NULL;
                 fib6_purge_rt(iter, fn, info->nl_net);
-                if (fn->rr_ptr == iter)
+                if (rcu_access_pointer(fn->rr_ptr) == iter)
                         fn->rr_ptr = NULL;
                 rt6_release(iter);
 
                 if (nsiblings) {
                         /* Replacing an ECMP route, remove all siblings */
                         ins = &rt->dst.rt6_next;
-                        iter = *ins;
+                        iter = rcu_dereference_protected(*ins,
+                                    lockdep_is_held(&rt->rt6i_table->tb6_lock));
                         while (iter) {
                                 if (iter->rt6i_metric > rt->rt6i_metric)
                                         break;
@@ -1046,14 +1069,16 @@ add:
                                         *ins = iter->dst.rt6_next;
                                         iter->rt6i_node = NULL;
                                         fib6_purge_rt(iter, fn, info->nl_net);
-                                        if (fn->rr_ptr == iter)
+                                        if (rcu_access_pointer(fn->rr_ptr) == iter)
                                                 fn->rr_ptr = NULL;
                                         rt6_release(iter);
                                         nsiblings--;
+                                        info->nl_net->ipv6.rt6_stats->fib_rt_entries--;
                                 } else {
                                         ins = &iter->dst.rt6_next;
                                 }
-                                iter = *ins;
+                                iter = rcu_dereference_protected(*ins,
+                                        lockdep_is_held(&rt->rt6i_table->tb6_lock));
                         }
                         WARN_ON(nsiblings != 0);
                 }
@@ -1077,16 +1102,33 @@ void fib6_force_start_gc(struct net *net)
                           jiffies + net->ipv6.sysctl.ip6_rt_gc_interval);
 }
 
+static void fib6_update_sernum_upto_root(struct rt6_info *rt,
+                                         int sernum)
+{
+        struct fib6_node *fn = rcu_dereference_protected(rt->rt6i_node,
+                                lockdep_is_held(&rt->rt6i_table->tb6_lock));
+
+        /* paired with smp_rmb() in rt6_get_cookie_safe() */
+        smp_wmb();
+        while (fn) {
+                fn->fn_sernum = sernum;
+                fn = rcu_dereference_protected(fn->parent,
+                                lockdep_is_held(&rt->rt6i_table->tb6_lock));
+        }
+}
+
 /*
  *      Add routing information to the routing tree.
  *      <destination addr>/<source addr>
  *      with source addr info in sub-trees
+ *      Need to own table->tb6_lock
  */
 
 int fib6_add(struct fib6_node *root, struct rt6_info *rt,
              struct nl_info *info, struct mx6_config *mxc,
              struct netlink_ext_ack *extack)
 {
+        struct fib6_table *table = rt->rt6i_table;
         struct fib6_node *fn, *pn = NULL;
         int err = -ENOMEM;
         int allow_create = 1;
@@ -1095,6 +1137,8 @@ int fib6_add(struct fib6_node *root, struct rt6_info *rt,
 
         if (WARN_ON_ONCE(!atomic_read(&rt->dst.__refcnt)))
                 return -EINVAL;
+        if (WARN_ON_ONCE(rt->rt6i_flags & RTF_CACHE))
+                return -EINVAL;
 
         if (info->nlh) {
                 if (!(info->nlh->nlmsg_flags & NLM_F_CREATE))
@@ -1105,9 +1149,10 @@ int fib6_add(struct fib6_node *root, struct rt6_info *rt,
         if (!allow_create && !replace_required)
                 pr_warn("RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE\n");
 
-        fn = fib6_add_1(root, &rt->rt6i_dst.addr, rt->rt6i_dst.plen,
+        fn = fib6_add_1(info->nl_net, table, root,
+                        &rt->rt6i_dst.addr, rt->rt6i_dst.plen,
                         offsetof(struct rt6_info, rt6i_dst), allow_create,
-                        replace_required, sernum, extack);
+                        replace_required, extack);
         if (IS_ERR(fn)) {
                 err = PTR_ERR(fn);
                 fn = NULL;
@@ -1120,7 +1165,7 @@ int fib6_add(struct fib6_node *root, struct rt6_info *rt,
         if (rt->rt6i_src.plen) {
                 struct fib6_node *sn;
 
-                if (!fn->subtree) {
+                if (!rcu_access_pointer(fn->subtree)) {
                         struct fib6_node *sfn;
 
                         /*
@@ -1134,42 +1179,40 @@ int fib6_add(struct fib6_node *root, struct rt6_info *rt,
                          */
 
                         /* Create subtree root node */
-                        sfn = node_alloc();
+                        sfn = node_alloc(info->nl_net);
                         if (!sfn)
                                 goto failure;
 
-                        sfn->leaf = info->nl_net->ipv6.ip6_null_entry;
                         atomic_inc(&info->nl_net->ipv6.ip6_null_entry->rt6i_ref);
+                        rcu_assign_pointer(sfn->leaf,
+                                           info->nl_net->ipv6.ip6_null_entry);
                         sfn->fn_flags = RTN_ROOT;
-                        sfn->fn_sernum = sernum;
 
                         /* Now add the first leaf node to new subtree */
 
-                        sn = fib6_add_1(sfn, &rt->rt6i_src.addr,
-                                        rt->rt6i_src.plen,
+                        sn = fib6_add_1(info->nl_net, table, sfn,
+                                        &rt->rt6i_src.addr, rt->rt6i_src.plen,
                                         offsetof(struct rt6_info, rt6i_src),
-                                        allow_create, replace_required, sernum,
-                                        extack);
+                                        allow_create, replace_required, extack);
 
                         if (IS_ERR(sn)) {
                                 /* If it is failed, discard just allocated
                                    root, and then (in failure) stale node
                                    in main tree.
                                  */
-                                node_free_immediate(sfn);
+                                node_free_immediate(info->nl_net, sfn);
                                 err = PTR_ERR(sn);
                                 goto failure;
                         }
 
                         /* Now link new subtree to main tree */
-                        sfn->parent = fn;
-                        fn->subtree = sfn;
+                        rcu_assign_pointer(sfn->parent, fn);
+                        rcu_assign_pointer(fn->subtree, sfn);
                 } else {
-                        sn = fib6_add_1(fn->subtree, &rt->rt6i_src.addr,
-                                        rt->rt6i_src.plen,
+                        sn = fib6_add_1(info->nl_net, table, FIB6_SUBTREE(fn),
+                                        &rt->rt6i_src.addr, rt->rt6i_src.plen,
                                         offsetof(struct rt6_info, rt6i_src),
-                                        allow_create, replace_required, sernum,
-                                        extack);
+                                        allow_create, replace_required, extack);
 
                         if (IS_ERR(sn)) {
                                 err = PTR_ERR(sn);
@@ -1177,19 +1220,18 @@ int fib6_add(struct fib6_node *root, struct rt6_info *rt,
                         }
                 }
 
-                if (!fn->leaf) {
-                        fn->leaf = rt;
+                if (!rcu_access_pointer(fn->leaf)) {
                         atomic_inc(&rt->rt6i_ref);
+                        rcu_assign_pointer(fn->leaf, rt);
                 }
                 fn = sn;
         }
 #endif
 
-        err = fib6_add_rt2node(fn, rt, info, mxc);
+        err = fib6_add_rt2node(fn, rt, info, mxc, extack);
         if (!err) {
+                fib6_update_sernum_upto_root(rt, sernum);
                 fib6_start_gc(info->nl_net, rt);
-                if (!(rt->rt6i_flags & RTF_CACHE))
-                        fib6_prune_clones(info->nl_net, pn);
         }
 
 out:
@@ -1199,19 +1241,23 @@ out:
                  * If fib6_add_1 has cleared the old leaf pointer in the
                  * super-tree leaf node we have to find a new one for it.
                  */
-                if (pn != fn && pn->leaf == rt) {
-                        pn->leaf = NULL;
+                struct rt6_info *pn_leaf = rcu_dereference_protected(pn->leaf,
+                                            lockdep_is_held(&table->tb6_lock));
+                if (pn != fn && pn_leaf == rt) {
+                        pn_leaf = NULL;
+                        RCU_INIT_POINTER(pn->leaf, NULL);
                         atomic_dec(&rt->rt6i_ref);
                 }
-                if (pn != fn && !pn->leaf && !(pn->fn_flags & RTN_RTINFO)) {
-                        pn->leaf = fib6_find_prefix(info->nl_net, pn);
+                if (pn != fn && !pn_leaf && !(pn->fn_flags & RTN_RTINFO)) {
+                        pn_leaf = fib6_find_prefix(info->nl_net, table, pn);
 #if RT6_DEBUG >= 2
-                        if (!pn->leaf) {
-                                WARN_ON(pn->leaf == NULL);
-                                pn->leaf = info->nl_net->ipv6.ip6_null_entry;
+                        if (!pn_leaf) {
+                                WARN_ON(!pn_leaf);
+                                pn_leaf = info->nl_net->ipv6.ip6_null_entry;
                         }
 #endif
-                        atomic_inc(&pn->leaf->rt6i_ref);
+                        atomic_inc(&pn_leaf->rt6i_ref);
+                        rcu_assign_pointer(pn->leaf, pn_leaf);
                 }
 #endif
                 goto failure;
@@ -1226,7 +1272,7 @@ failure:
          * fn->leaf.
          */
         if (fn && !(fn->fn_flags & (RTN_RTINFO|RTN_ROOT)))
-                fib6_repair_tree(info->nl_net, fn);
+                fib6_repair_tree(info->nl_net, table, fn);
         /* Always release dst as dst->__refcnt is guaranteed
          * to be taken before entering this function
          */
@@ -1264,7 +1310,8 @@ static struct fib6_node *fib6_lookup_1(struct fib6_node *root,
 
                 dir = addr_bit_set(args->addr, fn->fn_bit);
 
-                next = dir ? fn->right : fn->left;
+                next = dir ? rcu_dereference(fn->right) :
+                             rcu_dereference(fn->left);
 
                 if (next) {
                         fn = next;
@@ -1274,18 +1321,22 @@ static struct fib6_node *fib6_lookup_1(struct fib6_node *root,
         }
 
         while (fn) {
-                if (FIB6_SUBTREE(fn) || fn->fn_flags & RTN_RTINFO) {
+                struct fib6_node *subtree = FIB6_SUBTREE(fn);
+
+                if (subtree || fn->fn_flags & RTN_RTINFO) {
+                        struct rt6_info *leaf = rcu_dereference(fn->leaf);
                         struct rt6key *key;
 
-                        key = (struct rt6key *) ((u8 *) fn->leaf +
-                                                 args->offset);
+                        if (!leaf)
+                                goto backtrack;
+
+                        key = (struct rt6key *) ((u8 *)leaf + args->offset);
 
                         if (ipv6_prefix_equal(&key->addr, args->addr, key->plen)) {
 #ifdef CONFIG_IPV6_SUBTREES
-                                if (fn->subtree) {
+                                if (subtree) {
                                         struct fib6_node *sfn;
-                                        sfn = fib6_lookup_1(fn->subtree,
-                                                            args + 1);
+                                        sfn = fib6_lookup_1(subtree, args + 1);
                                         if (!sfn)
                                                 goto backtrack;
                                         fn = sfn;
@@ -1295,18 +1346,18 @@ static struct fib6_node *fib6_lookup_1(struct fib6_node *root,
                                         return fn;
                         }
                 }
-#ifdef CONFIG_IPV6_SUBTREES
 backtrack:
-#endif
                 if (fn->fn_flags & RTN_ROOT)
                         break;
 
-                fn = fn->parent;
+                fn = rcu_dereference(fn->parent);
         }
 
         return NULL;
 }
 
+/* called with rcu_read_lock() held
+ */
 struct fib6_node *fib6_lookup(struct fib6_node *root, const struct in6_addr *daddr,
                               const struct in6_addr *saddr)
 {
@@ -1337,54 +1388,87 @@ struct fib6_node *fib6_lookup(struct fib6_node *root, const struct in6_addr *dad
 /*
  *      Get node with specified destination prefix (and source prefix,
  *      if subtrees are used)
+ *      exact_match == true means we try to find fn with exact match of
+ *      the passed in prefix addr
+ *      exact_match == false means we try to find fn with longest prefix
+ *      match of the passed in prefix addr. This is useful for finding fn
+ *      for cached route as it will be stored in the exception table under
+ *      the node with longest prefix length.
  */
 
 
 static struct fib6_node *fib6_locate_1(struct fib6_node *root,
                                        const struct in6_addr *addr,
-                                       int plen, int offset)
+                                       int plen, int offset,
+                                       bool exact_match)
 {
-        struct fib6_node *fn;
+        struct fib6_node *fn, *prev = NULL;
 
         for (fn = root; fn ; ) {
-                struct rt6key *key = (struct rt6key *)((u8 *)fn->leaf + offset);
+                struct rt6_info *leaf = rcu_dereference(fn->leaf);
+                struct rt6key *key;
+
+                /* This node is being deleted */
+                if (!leaf) {
+                        if (plen <= fn->fn_bit)
+                                goto out;
+                        else
+                                goto next;
+                }
+
+                key = (struct rt6key *)((u8 *)leaf + offset);
 
                 /*
                  *      Prefix match
                  */
                 if (plen < fn->fn_bit ||
                     !ipv6_prefix_equal(&key->addr, addr, fn->fn_bit))
-                        return NULL;
+                        goto out;
 
                 if (plen == fn->fn_bit)
                         return fn;
 
+                prev = fn;
+
+next:
                 /*
                  *      We have more bits to go
                  */
                 if (addr_bit_set(addr, fn->fn_bit))
-                        fn = fn->right;
+                        fn = rcu_dereference(fn->right);
                 else
-                        fn = fn->left;
+                        fn = rcu_dereference(fn->left);
         }
-        return NULL;
+out:
+        if (exact_match)
+                return NULL;
+        else
+                return prev;
 }
 
 struct fib6_node *fib6_locate(struct fib6_node *root,
                               const struct in6_addr *daddr, int dst_len,
-                              const struct in6_addr *saddr, int src_len)
+                              const struct in6_addr *saddr, int src_len,
+                              bool exact_match)
 {
         struct fib6_node *fn;
 
         fn = fib6_locate_1(root, daddr, dst_len,
-                           offsetof(struct rt6_info, rt6i_dst));
+                           offsetof(struct rt6_info, rt6i_dst),
+                           exact_match);
 
 #ifdef CONFIG_IPV6_SUBTREES
         if (src_len) {
                 WARN_ON(saddr == NULL);
-                if (fn && fn->subtree)
-                        fn = fib6_locate_1(fn->subtree, saddr, src_len,
-                                           offsetof(struct rt6_info, rt6i_src));
+                if (fn) {
+                        struct fib6_node *subtree = FIB6_SUBTREE(fn);
+
+                        if (subtree) {
+                                fn = fib6_locate_1(subtree, saddr, src_len,
+                                           offsetof(struct rt6_info, rt6i_src),
+                                           exact_match);
+                        }
+                }
         }
 #endif
 
@@ -1400,16 +1484,26 @@ struct fib6_node *fib6_locate(struct fib6_node *root,
  *
  */
 
-static struct rt6_info *fib6_find_prefix(struct net *net, struct fib6_node *fn)
+static struct rt6_info *fib6_find_prefix(struct net *net,
+                                         struct fib6_table *table,
+                                         struct fib6_node *fn)
 {
+        struct fib6_node *child_left, *child_right;
+
         if (fn->fn_flags & RTN_ROOT)
                 return net->ipv6.ip6_null_entry;
 
         while (fn) {
-                if (fn->left)
-                        return fn->left->leaf;
-                if (fn->right)
-                        return fn->right->leaf;
+                child_left = rcu_dereference_protected(fn->left,
+                                    lockdep_is_held(&table->tb6_lock));
+                child_right = rcu_dereference_protected(fn->right,
+                                    lockdep_is_held(&table->tb6_lock));
+                if (child_left)
+                        return rcu_dereference_protected(child_left->leaf,
+                                        lockdep_is_held(&table->tb6_lock));
+                if (child_right)
+                        return rcu_dereference_protected(child_right->leaf,
+                                        lockdep_is_held(&table->tb6_lock));
 
                 fn = FIB6_SUBTREE(fn);
         }
@@ -1419,31 +1513,49 @@ static struct rt6_info *fib6_find_prefix(struct net *net, struct fib6_node *fn)
 /*
  *      Called to trim the tree of intermediate nodes when possible. "fn"
  *      is the node we want to try and remove.
+ *      Need to own table->tb6_lock
  */
 
 static struct fib6_node *fib6_repair_tree(struct net *net,
-                                           struct fib6_node *fn)
+                                          struct fib6_table *table,
+                                          struct fib6_node *fn)
 {
         int children;
         int nstate;
-        struct fib6_node *child, *pn;
+        struct fib6_node *child;
         struct fib6_walker *w;
         int iter = 0;
 
         for (;;) {
+                struct fib6_node *fn_r = rcu_dereference_protected(fn->right,
+                                            lockdep_is_held(&table->tb6_lock));
+                struct fib6_node *fn_l = rcu_dereference_protected(fn->left,
+                                            lockdep_is_held(&table->tb6_lock));
+                struct fib6_node *pn = rcu_dereference_protected(fn->parent,
+                                            lockdep_is_held(&table->tb6_lock));
+                struct fib6_node *pn_r = rcu_dereference_protected(pn->right,
+                                            lockdep_is_held(&table->tb6_lock));
+                struct fib6_node *pn_l = rcu_dereference_protected(pn->left,
+                                            lockdep_is_held(&table->tb6_lock));
+                struct rt6_info *fn_leaf = rcu_dereference_protected(fn->leaf,
+                                            lockdep_is_held(&table->tb6_lock));
+                struct rt6_info *pn_leaf = rcu_dereference_protected(pn->leaf,
+                                            lockdep_is_held(&table->tb6_lock));
+                struct rt6_info *new_fn_leaf;
+
                 RT6_TRACE("fixing tree: plen=%d iter=%d\n", fn->fn_bit, iter);
                 iter++;
 
                 WARN_ON(fn->fn_flags & RTN_RTINFO);
                 WARN_ON(fn->fn_flags & RTN_TL_ROOT);
-                WARN_ON(fn->leaf);
+                WARN_ON(fn_leaf);
 
                 children = 0;
                 child = NULL;
-                if (fn->right)
-                        child = fn->right, children |= 1;
-                if (fn->left)
-                        child = fn->left, children |= 2;
+                if (fn_r)
+                        child = fn_r, children |= 1;
+                if (fn_l)
+                        child = fn_l, children |= 2;
 
                 if (children == 3 || FIB6_SUBTREE(fn)
 #ifdef CONFIG_IPV6_SUBTREES
@@ -1451,36 +1563,36 @@ static struct fib6_node *fib6_repair_tree(struct net *net,
                     || (children && fn->fn_flags & RTN_ROOT)
 #endif
                     ) {
-                        fn->leaf = fib6_find_prefix(net, fn);
+                        new_fn_leaf = fib6_find_prefix(net, table, fn);
 #if RT6_DEBUG >= 2
-                        if (!fn->leaf) {
-                                WARN_ON(!fn->leaf);
-                                fn->leaf = net->ipv6.ip6_null_entry;
+                        if (!new_fn_leaf) {
+                                WARN_ON(!new_fn_leaf);
+                                new_fn_leaf = net->ipv6.ip6_null_entry;
                         }
 #endif
-                        atomic_inc(&fn->leaf->rt6i_ref);
-                        return fn->parent;
+                        atomic_inc(&new_fn_leaf->rt6i_ref);
+                        rcu_assign_pointer(fn->leaf, new_fn_leaf);
+                        return pn;
                 }
 
-                pn = fn->parent;
 #ifdef CONFIG_IPV6_SUBTREES
                 if (FIB6_SUBTREE(pn) == fn) {
                         WARN_ON(!(fn->fn_flags & RTN_ROOT));
-                        FIB6_SUBTREE(pn) = NULL;
+                        RCU_INIT_POINTER(pn->subtree, NULL);
                         nstate = FWS_L;
                 } else {
                         WARN_ON(fn->fn_flags & RTN_ROOT);
 #endif
-                        if (pn->right == fn)
-                                pn->right = child;
-                        else if (pn->left == fn)
-                                pn->left = child;
+                        if (pn_r == fn)
+                                rcu_assign_pointer(pn->right, child);
+                        else if (pn_l == fn)
+                                rcu_assign_pointer(pn->left, child);
 #if RT6_DEBUG >= 2
                         else
                                 WARN_ON(1);
 #endif
                         if (child)
-                                child->parent = pn;
+                                rcu_assign_pointer(child->parent, pn);
                         nstate = FWS_R;
 #ifdef CONFIG_IPV6_SUBTREES
                 }
@@ -1489,19 +1601,12 @@ static struct fib6_node *fib6_repair_tree(struct net *net,
                 read_lock(&net->ipv6.fib6_walker_lock);
                 FOR_WALKERS(net, w) {
                         if (!child) {
-                                if (w->root == fn) {
-                                        w->root = w->node = NULL;
-                                        RT6_TRACE("W %p adjusted by delroot 1\n", w);
-                                } else if (w->node == fn) {
+                                if (w->node == fn) {
                                         RT6_TRACE("W %p adjusted by delnode 1, s=%d/%d\n", w, w->state, nstate);
                                         w->node = pn;
                                         w->state = nstate;
                                 }
                         } else {
-                                if (w->root == fn) {
-                                        w->root = child;
-                                        RT6_TRACE("W %p adjusted by delroot 2\n", w);
-                                }
                                 if (w->node == fn) {
                                         w->node = child;
                                         if (children&2) {
@@ -1516,33 +1621,39 @@ static struct fib6_node *fib6_repair_tree(struct net *net,
                 }
                 read_unlock(&net->ipv6.fib6_walker_lock);
 
-                node_free(fn);
+                node_free(net, fn);
                 if (pn->fn_flags & RTN_RTINFO || FIB6_SUBTREE(pn))
                         return pn;
 
-                rt6_release(pn->leaf);
-                pn->leaf = NULL;
+                RCU_INIT_POINTER(pn->leaf, NULL);
+                rt6_release(pn_leaf);
                 fn = pn;
         }
 }
 
-static void fib6_del_route(struct fib6_node *fn, struct rt6_info **rtp,
-                           struct nl_info *info)
+static void fib6_del_route(struct fib6_table *table, struct fib6_node *fn,
+                           struct rt6_info __rcu **rtp, struct nl_info *info)
 {
         struct fib6_walker *w;
-        struct rt6_info *rt = *rtp;
+        struct rt6_info *rt = rcu_dereference_protected(*rtp,
+                                    lockdep_is_held(&table->tb6_lock));
         struct net *net = info->nl_net;
 
         RT6_TRACE("fib6_del_route\n");
 
+        WARN_ON_ONCE(rt->rt6i_flags & RTF_CACHE);
+
         /* Unlink it */
         *rtp = rt->dst.rt6_next;
         rt->rt6i_node = NULL;
         net->ipv6.rt6_stats->fib_rt_entries--;
         net->ipv6.rt6_stats->fib_discarded_routes++;
 
+        /* Flush all cached dst in exception table */
+        rt6_flush_exceptions(rt);
+
         /* Reset round-robin state, if necessary */
-        if (fn->rr_ptr == rt)
+        if (rcu_access_pointer(fn->rr_ptr) == rt)
                 fn->rr_ptr = NULL;
 
         /* Remove this entry from other siblings */
@@ -1561,36 +1672,38 @@ static void fib6_del_route(struct fib6_node *fn, struct rt6_info **rtp,
         FOR_WALKERS(net, w) {
                 if (w->state == FWS_C && w->leaf == rt) {
                         RT6_TRACE("walker %p adjusted by delroute\n", w);
-                        w->leaf = rt->dst.rt6_next;
+                        w->leaf = rcu_dereference_protected(rt->dst.rt6_next,
+                                            lockdep_is_held(&table->tb6_lock));
                         if (!w->leaf)
                                 w->state = FWS_U;
                 }
         }
         read_unlock(&net->ipv6.fib6_walker_lock);
 
-        rt->dst.rt6_next = NULL;
-
         /* If it was last route, expunge its radix tree node */
-        if (!fn->leaf) {
+        if (!rcu_access_pointer(fn->leaf)) {
                 fn->fn_flags &= ~RTN_RTINFO;
                 net->ipv6.rt6_stats->fib_route_nodes--;
-                fn = fib6_repair_tree(net, fn);
+                fn = fib6_repair_tree(net, table, fn);
         }
 
         fib6_purge_rt(rt, fn, net);
 
-        call_fib6_entry_notifiers(net, FIB_EVENT_ENTRY_DEL, rt);
+        call_fib6_entry_notifiers(net, FIB_EVENT_ENTRY_DEL, rt, NULL);
         if (!info->skip_notify)
                 inet6_rt_notify(RTM_DELROUTE, rt, info, 0);
         rt6_release(rt);
 }
 
+/* Need to own table->tb6_lock */
 int fib6_del(struct rt6_info *rt, struct nl_info *info)
 {
         struct fib6_node *fn = rcu_dereference_protected(rt->rt6i_node,
                                     lockdep_is_held(&rt->rt6i_table->tb6_lock));
+        struct fib6_table *table = rt->rt6i_table;
         struct net *net = info->nl_net;
-        struct rt6_info **rtp;
+        struct rt6_info __rcu **rtp;
+        struct rt6_info __rcu **rtp_next;
 
 #if RT6_DEBUG >= 2
         if (rt->dst.obsolete > 0) {
@@ -1603,28 +1716,22 @@ int fib6_del(struct rt6_info *rt, struct nl_info *info)
 
         WARN_ON(!(fn->fn_flags & RTN_RTINFO));
 
-        if (!(rt->rt6i_flags & RTF_CACHE)) {
-                struct fib6_node *pn = fn;
-#ifdef CONFIG_IPV6_SUBTREES
-                /* clones of this route might be in another subtree */
-                if (rt->rt6i_src.plen) {
-                        while (!(pn->fn_flags & RTN_ROOT))
-                                pn = pn->parent;
-                        pn = pn->parent;
-                }
-#endif
-                fib6_prune_clones(info->nl_net, pn);
-        }
+        /* remove cached dst from exception table */
+        if (rt->rt6i_flags & RTF_CACHE)
+                return rt6_remove_exception_rt(rt);
 
         /*
          *      Walk the leaf entries looking for ourself
          */
 
-        for (rtp = &fn->leaf; *rtp; rtp = &(*rtp)->dst.rt6_next) {
-                if (*rtp == rt) {
-                        fib6_del_route(fn, rtp, info);
+        for (rtp = &fn->leaf; *rtp; rtp = rtp_next) {
+                struct rt6_info *cur = rcu_dereference_protected(*rtp,
+                                        lockdep_is_held(&table->tb6_lock));
+                if (rt == cur) {
+                        fib6_del_route(table, fn, rtp, info);
                         return 0;
                 }
+                rtp_next = &cur->dst.rt6_next;
         }
         return -ENOENT;
 }
@@ -1651,22 +1758,22 @@ int fib6_del(struct rt6_info *rt, struct nl_info *info)
  *      0   -> walk is complete.
  *      >0  -> walk is incomplete (i.e. suspended)
  *      <0  -> walk is terminated by an error.
+ *
+ *      This function is called with tb6_lock held.
  */
 
 static int fib6_walk_continue(struct fib6_walker *w)
 {
-        struct fib6_node *fn, *pn;
+        struct fib6_node *fn, *pn, *left, *right;
+
+        /* w->root should always be table->tb6_root */
+        WARN_ON_ONCE(!(w->root->fn_flags & RTN_TL_ROOT));
 
         for (;;) {
                 fn = w->node;
                 if (!fn)
                         return 0;
 
-                if (w->prune && fn != w->root &&
-                    fn->fn_flags & RTN_RTINFO && w->state < FWS_C) {
-                        w->state = FWS_C;
-                        w->leaf = fn->leaf;
-                }
                 switch (w->state) {
 #ifdef CONFIG_IPV6_SUBTREES
                 case FWS_S:
@@ -1676,21 +1783,26 @@ static int fib6_walk_continue(struct fib6_walker *w)
                         }
                         w->state = FWS_L;
 #endif
+                        /* fall through */
                 case FWS_L:
-                        if (fn->left) {
-                                w->node = fn->left;
+                        left = rcu_dereference_protected(fn->left, 1);
+                        if (left) {
+                                w->node = left;
                                 w->state = FWS_INIT;
                                 continue;
                         }
                         w->state = FWS_R;
+                        /* fall through */
                 case FWS_R:
-                        if (fn->right) {
-                                w->node = fn->right;
+                        right = rcu_dereference_protected(fn->right, 1);
+                        if (right) {
+                                w->node = right;
                                 w->state = FWS_INIT;
                                 continue;
                         }
                         w->state = FWS_C;
-                        w->leaf = fn->leaf;
+                        w->leaf = rcu_dereference_protected(fn->leaf, 1);
+                        /* fall through */
                 case FWS_C:
                         if (w->leaf && fn->fn_flags & RTN_RTINFO) {
                                 int err;
@@ -1709,10 +1821,13 @@ static int fib6_walk_continue(struct fib6_walker *w)
                         }
 skip:
                         w->state = FWS_U;
+                        /* fall through */
                 case FWS_U:
                         if (fn == w->root)
                                 return 0;
-                        pn = fn->parent;
+                        pn = rcu_dereference_protected(fn->parent, 1);
+                        left = rcu_dereference_protected(pn->left, 1);
+                        right = rcu_dereference_protected(pn->right, 1);
                         w->node = pn;
 #ifdef CONFIG_IPV6_SUBTREES
                         if (FIB6_SUBTREE(pn) == fn) {
@@ -1721,13 +1836,13 @@ skip:
                                 continue;
                         }
 #endif
-                        if (pn->left == fn) {
+                        if (left == fn) {
                                 w->state = FWS_R;
                                 continue;
                         }
-                        if (pn->right == fn) {
+                        if (right == fn) {
                                 w->state = FWS_C;
-                                w->leaf = w->node->leaf;
+                                w->leaf = rcu_dereference_protected(w->node->leaf, 1);
                                 continue;
                         }
 #if RT6_DEBUG >= 2
@@ -1770,7 +1885,7 @@ static int fib6_clean_node(struct fib6_walker *w)
                 return 0;
         }
 
-        for (rt = w->leaf; rt; rt = rt->dst.rt6_next) {
+        for_each_fib6_walker_rt(w) {
                 res = c->func(rt, c->arg);
                 if (res < 0) {
                         w->leaf = rt;
@@ -1798,20 +1913,16 @@ static int fib6_clean_node(struct fib6_walker *w)
  *      func is called on each route.
  *              It may return -1 -> delete this route.
  *                            0  -> continue walking
- *
- *      prune==1 -> only immediate children of node (certainly,
- *      ignoring pure split nodes) will be scanned.
  */
 
 static void fib6_clean_tree(struct net *net, struct fib6_node *root,
                             int (*func)(struct rt6_info *, void *arg),
-                            bool prune, int sernum, void *arg)
+                            int sernum, void *arg)
 {
         struct fib6_cleaner c;
 
         c.w.root = root;
         c.w.func = fib6_clean_node;
-        c.w.prune = prune;
         c.w.count = 0;
         c.w.skip = 0;
         c.func = func;
@@ -1834,10 +1945,10 @@ static void __fib6_clean_all(struct net *net,
         for (h = 0; h < FIB6_TABLE_HASHSZ; h++) {
                 head = &net->ipv6.fib_table_hash[h];
                 hlist_for_each_entry_rcu(table, head, tb6_hlist) {
-                        write_lock_bh(&table->tb6_lock);
+                        spin_lock_bh(&table->tb6_lock);
                         fib6_clean_tree(net, &table->tb6_root,
-                                        func, false, sernum, arg);
-                        write_unlock_bh(&table->tb6_lock);
+                                        func, sernum, arg);
+                        spin_unlock_bh(&table->tb6_lock);
                 }
         }
         rcu_read_unlock();
@@ -1849,22 +1960,6 @@ void fib6_clean_all(struct net *net, int (*func)(struct rt6_info *, void *),
         __fib6_clean_all(net, func, FIB6_NO_SERNUM_CHANGE, arg);
 }
 
-static int fib6_prune_clone(struct rt6_info *rt, void *arg)
-{
-        if (rt->rt6i_flags & RTF_CACHE) {
-                RT6_TRACE("pruning clone %p\n", rt);
-                return -1;
-        }
-
-        return 0;
-}
-
-static void fib6_prune_clones(struct net *net, struct fib6_node *fn)
-{
-        fib6_clean_tree(net, fn, fib6_prune_clone, true,
-                        FIB6_NO_SERNUM_CHANGE, NULL);
-}
-
 static void fib6_flush_trees(struct net *net)
 {
         int new_sernum = fib6_new_sernum(net);
@@ -1876,12 +1971,6 @@ static void fib6_flush_trees(struct net *net)
  *      Garbage collection
  */
 
-struct fib6_gc_args
-{
-        int                     timeout;
-        int                     more;
-};
-
 static int fib6_age(struct rt6_info *rt, void *arg)
 {
         struct fib6_gc_args *gc_args = arg;
@@ -1890,9 +1979,6 @@ static int fib6_age(struct rt6_info *rt, void *arg)
         /*
          *      check addrconf expiration here.
          *      Routes are expired even if they are in use.
-         *
-         *      Also age clones. Note, that clones are aged out
-         *      only if they are not in use now.
          */
 
         if (rt->rt6i_flags & RTF_EXPIRES && rt->dst.expires) {
@@ -1901,31 +1987,14 @@ static int fib6_age(struct rt6_info *rt, void *arg)
                         return -1;
                 }
                 gc_args->more++;
-        } else if (rt->rt6i_flags & RTF_CACHE) {
-                if (time_after_eq(now, rt->dst.lastuse + gc_args->timeout))
-                        rt->dst.obsolete = DST_OBSOLETE_KILL;
-                if (atomic_read(&rt->dst.__refcnt) == 1 &&
-                    rt->dst.obsolete == DST_OBSOLETE_KILL) {
-                        RT6_TRACE("aging clone %p\n", rt);
-                        return -1;
-                } else if (rt->rt6i_flags & RTF_GATEWAY) {
-                        struct neighbour *neigh;
-                        __u8 neigh_flags = 0;
-
-                        neigh = dst_neigh_lookup(&rt->dst, &rt->rt6i_gateway);
-                        if (neigh) {
-                                neigh_flags = neigh->flags;
-                                neigh_release(neigh);
-                        }
-                        if (!(neigh_flags & NTF_ROUTER)) {
-                                RT6_TRACE("purging route %p via non-router but gateway\n",
-                                          rt);
-                                return -1;
-                        }
-                }
-                gc_args->more++;
         }
 
+        /*      Also age clones in the exception table.
+         *      Note, that clones are aged out
+         *      only if they are not in use now.
+         */
+        rt6_age_exceptions(rt, gc_args, now);
+
         return 0;
 }
 
@@ -1957,9 +2026,11 @@ void fib6_run_gc(unsigned long expires, struct net *net, bool force)
         spin_unlock_bh(&net->ipv6.fib6_gc_lock);
 }
 
-static void fib6_gc_timer_cb(unsigned long arg)
+static void fib6_gc_timer_cb(struct timer_list *t)
 {
-        fib6_run_gc(0, (struct net *)arg, true);
+        struct net *arg = from_timer(arg, t, ipv6.ip6_fib_timer);
+
+        fib6_run_gc(0, arg, true);
 }
 
 static int __net_init fib6_net_init(struct net *net)
@@ -1974,7 +2045,7 @@ static int __net_init fib6_net_init(struct net *net)
         spin_lock_init(&net->ipv6.fib6_gc_lock);
         rwlock_init(&net->ipv6.fib6_walker_lock);
         INIT_LIST_HEAD(&net->ipv6.fib6_walkers);
-        setup_timer(&net->ipv6.ip6_fib_timer, fib6_gc_timer_cb, (unsigned long)net);
+        timer_setup(&net->ipv6.ip6_fib_timer, fib6_gc_timer_cb, 0);
 
         net->ipv6.rt6_stats = kzalloc(sizeof(*net->ipv6.rt6_stats), GFP_KERNEL);
         if (!net->ipv6.rt6_stats)
@@ -1993,7 +2064,8 @@ static int __net_init fib6_net_init(struct net *net)
                 goto out_fib_table_hash;
 
         net->ipv6.fib6_main_tbl->tb6_id = RT6_TABLE_MAIN;
-        net->ipv6.fib6_main_tbl->tb6_root.leaf = net->ipv6.ip6_null_entry;
+        rcu_assign_pointer(net->ipv6.fib6_main_tbl->tb6_root.leaf,
+                           net->ipv6.ip6_null_entry);
         net->ipv6.fib6_main_tbl->tb6_root.fn_flags =
                 RTN_ROOT | RTN_TL_ROOT | RTN_RTINFO;
         inet_peer_base_init(&net->ipv6.fib6_main_tbl->tb6_peers);
@@ -2004,7 +2076,8 @@ static int __net_init fib6_net_init(struct net *net)
         if (!net->ipv6.fib6_local_tbl)
                 goto out_fib6_main_tbl;
         net->ipv6.fib6_local_tbl->tb6_id = RT6_TABLE_LOCAL;
-        net->ipv6.fib6_local_tbl->tb6_root.leaf = net->ipv6.ip6_null_entry;
+        rcu_assign_pointer(net->ipv6.fib6_local_tbl->tb6_root.leaf,
+                           net->ipv6.ip6_null_entry);
         net->ipv6.fib6_local_tbl->tb6_root.fn_flags =
                 RTN_ROOT | RTN_TL_ROOT | RTN_RTINFO;
         inet_peer_base_init(&net->ipv6.fib6_local_tbl->tb6_peers);
@@ -2134,7 +2207,9 @@ static int ipv6_route_yield(struct fib6_walker *w)
                 return 1;
 
         do {
-                iter->w.leaf = iter->w.leaf->dst.rt6_next;
+                iter->w.leaf = rcu_dereference_protected(
+                                iter->w.leaf->dst.rt6_next,
+                                lockdep_is_held(&iter->tbl->tb6_lock));
                 iter->skip--;
                 if (!iter->skip && iter->w.leaf)
                         return 1;
@@ -2199,7 +2274,7 @@ static void *ipv6_route_seq_next(struct seq_file *seq, void *v, loff_t *pos)
         if (!v)
                 goto iter_table;
 
-        n = ((struct rt6_info *)v)->dst.rt6_next;
+        n = rcu_dereference_bh(((struct rt6_info *)v)->dst.rt6_next);
         if (n) {
                 ++*pos;
                 return n;
@@ -2207,9 +2282,9 @@ static void *ipv6_route_seq_next(struct seq_file *seq, void *v, loff_t *pos)
 
 iter_table:
         ipv6_route_check_sernum(iter);
-        read_lock(&iter->tbl->tb6_lock);
+        spin_lock_bh(&iter->tbl->tb6_lock);
         r = fib6_walk_continue(&iter->w);
-        read_unlock(&iter->tbl->tb6_lock);
+        spin_unlock_bh(&iter->tbl->tb6_lock);
         if (r > 0) {
                 if (v)
                         ++*pos;
diff --git a/net/ipv6/ip6_flowlabel.c b/net/ipv6/ip6_flowlabel.c
index 9f2e73c71768..7f59c8fabeeb 100644
--- a/net/ipv6/ip6_flowlabel.c
+++ b/net/ipv6/ip6_flowlabel.c
@@ -46,7 +46,7 @@
 static atomic_t fl_size = ATOMIC_INIT(0);
 static struct ip6_flowlabel __rcu *fl_ht[FL_HASH_MASK+1];
 
-static void ip6_fl_gc(unsigned long dummy);
+static void ip6_fl_gc(struct timer_list *unused);
 static DEFINE_TIMER(ip6_fl_gc_timer, ip6_fl_gc);
 
 /* FL hash table lock: it protects only of GC */
@@ -127,7 +127,7 @@ static void fl_release(struct ip6_flowlabel *fl)
         spin_unlock_bh(&ip6_fl_lock);
 }
 
-static void ip6_fl_gc(unsigned long dummy)
+static void ip6_fl_gc(struct timer_list *unused)
 {
         int i;
         unsigned long now = jiffies;
diff --git a/net/ipv6/ip6_gre.c b/net/ipv6/ip6_gre.c
index 59c121b932ac..4cfd8e0696fe 100644
--- a/net/ipv6/ip6_gre.c
+++ b/net/ipv6/ip6_gre.c
@@ -369,6 +369,7 @@ static void ip6gre_tunnel_uninit(struct net_device *dev)
 static void ip6gre_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
                        u8 type, u8 code, int offset, __be32 info)
 {
+        struct net *net = dev_net(skb->dev);
         const struct gre_base_hdr *greh;
         const struct ipv6hdr *ipv6h;
         int grehlen = sizeof(*greh);
@@ -402,9 +403,8 @@ static void ip6gre_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
                 return;
 
         switch (type) {
-                __u32 teli;
                 struct ipv6_tlv_tnl_enc_lim *tel;
-                __u32 mtu;
+                __u32 teli;
         case ICMPV6_DEST_UNREACH:
                 net_dbg_ratelimited("%s: Path to destination invalid or inactive!\n",
                                     t->parms.name);
@@ -435,12 +435,11 @@ static void ip6gre_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
                 }
                 return;
         case ICMPV6_PKT_TOOBIG:
-                mtu = be32_to_cpu(info) - offset - t->tun_hlen;
-                if (t->dev->type == ARPHRD_ETHER)
-                        mtu -= ETH_HLEN;
-                if (mtu < IPV6_MIN_MTU)
-                        mtu = IPV6_MIN_MTU;
-                t->dev->mtu = mtu;
+                ip6_update_pmtu(skb, net, info, 0, 0, sock_net_uid(net, NULL));
+                return;
+        case NDISC_REDIRECT:
+                ip6_redirect(skb, net, skb->dev->ifindex, 0,
+                             sock_net_uid(net, NULL));
                 return;
         }
 
@@ -461,7 +460,7 @@ static int ip6gre_rcv(struct sk_buff *skb, const struct tnl_ptk_info *tpi)
                                       &ipv6h->saddr, &ipv6h->daddr, tpi->key,
                                       tpi->proto);
         if (tunnel) {
-                ip6_tnl_rcv(tunnel, skb, tpi, NULL, false);
+                ip6_tnl_rcv(tunnel, skb, tpi, NULL, log_ecn_error);
 
                 return PACKET_RCVD;
         }
@@ -503,7 +502,6 @@ static netdev_tx_t __gre6_xmit(struct sk_buff *skb,
                                __u32 *pmtu, __be16 proto)
 {
         struct ip6_tnl *tunnel = netdev_priv(dev);
-        struct dst_entry *dst = skb_dst(skb);
         __be16 protocol;
 
         if (dev->type == ARPHRD_ETHER)
@@ -522,10 +520,6 @@ static netdev_tx_t __gre6_xmit(struct sk_buff *skb,
         gre_build_header(skb, tunnel->tun_hlen, tunnel->parms.o_flags,
                          protocol, tunnel->parms.o_key, htonl(tunnel->o_seqno));
 
-        /* TooBig packet may have updated dst->dev's mtu */
-        if (dst && dst_mtu(dst) > dst->dev->mtu)
-                dst->ops->update_pmtu(dst, NULL, skb, dst->dev->mtu);
-
         return ip6_tnl_xmit(skb, dev, dsfield, fl6, encap_limit, pmtu,
                             NEXTHDR_GRE);
 }
@@ -1164,19 +1158,21 @@ err_alloc_dev:
         return err;
 }
 
-static void __net_exit ip6gre_exit_net(struct net *net)
+static void __net_exit ip6gre_exit_batch_net(struct list_head *net_list)
 {
+        struct net *net;
         LIST_HEAD(list);
 
         rtnl_lock();
-        ip6gre_destroy_tunnels(net, &list);
+        list_for_each_entry(net, net_list, exit_list)
+                ip6gre_destroy_tunnels(net, &list);
         unregister_netdevice_many(&list);
         rtnl_unlock();
 }
 
 static struct pernet_operations ip6gre_net_ops = {
         .init = ip6gre_init_net,
-        .exit = ip6gre_exit_net,
+        .exit_batch = ip6gre_exit_batch_net,
         .id   = &ip6gre_net_id,
         .size = sizeof(struct ip6gre_net),
 };
diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c
index dab946554157..3d3092adf1d2 100644
--- a/net/ipv6/ip6_tunnel.c
+++ b/net/ipv6/ip6_tunnel.c
@@ -471,15 +471,16 @@ static int
 ip6_tnl_err(struct sk_buff *skb, __u8 ipproto, struct inet6_skb_parm *opt,
             u8 *type, u8 *code, int *msg, __u32 *info, int offset)
 {
-        const struct ipv6hdr *ipv6h = (const struct ipv6hdr *) skb->data;
-        struct ip6_tnl *t;
-        int rel_msg = 0;
+        const struct ipv6hdr *ipv6h = (const struct ipv6hdr *)skb->data;
+        struct net *net = dev_net(skb->dev);
         u8 rel_type = ICMPV6_DEST_UNREACH;
         u8 rel_code = ICMPV6_ADDR_UNREACH;
-        u8 tproto;
         __u32 rel_info = 0;
-        __u16 len;
+        struct ip6_tnl *t;
         int err = -ENOENT;
+        int rel_msg = 0;
+        u8 tproto;
+        __u16 len;
 
         /* If the packet doesn't contain the original IPv6 header we are
            in trouble since we might need the source address for further
@@ -497,9 +498,8 @@ ip6_tnl_err(struct sk_buff *skb, __u8 ipproto, struct inet6_skb_parm *opt,
         err = 0;
 
         switch (*type) {
-                __u32 teli;
                 struct ipv6_tlv_tnl_enc_lim *tel;
-                __u32 mtu;
+                __u32 mtu, teli;
         case ICMPV6_DEST_UNREACH:
                 net_dbg_ratelimited("%s: Path to destination invalid or inactive!\n",
                                     t->parms.name);
@@ -530,11 +530,11 @@ ip6_tnl_err(struct sk_buff *skb, __u8 ipproto, struct inet6_skb_parm *opt,
                 }
                 break;
         case ICMPV6_PKT_TOOBIG:
+                ip6_update_pmtu(skb, net, htonl(*info), 0, 0,
+                                sock_net_uid(net, NULL));
                 mtu = *info - offset;
                 if (mtu < IPV6_MIN_MTU)
                         mtu = IPV6_MIN_MTU;
-                t->dev->mtu = mtu;
-
                 len = sizeof(*ipv6h) + ntohs(ipv6h->payload_len);
                 if (len > mtu) {
                         rel_type = ICMPV6_PKT_TOOBIG;
@@ -543,6 +543,10 @@ ip6_tnl_err(struct sk_buff *skb, __u8 ipproto, struct inet6_skb_parm *opt,
                         rel_msg = 1;
                 }
                 break;
+        case NDISC_REDIRECT:
+                ip6_redirect(skb, net, skb->dev->ifindex, 0,
+                             sock_net_uid(net, NULL));
+                break;
         }
 
         *type = rel_type;
@@ -559,13 +563,12 @@ static int
 ip4ip6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
            u8 type, u8 code, int offset, __be32 info)
 {
-        int rel_msg = 0;
-        u8 rel_type = type;
-        u8 rel_code = code;
         __u32 rel_info = ntohl(info);
-        int err;
-        struct sk_buff *skb2;
         const struct iphdr *eiph;
+        struct sk_buff *skb2;
+        int err, rel_msg = 0;
+        u8 rel_type = type;
+        u8 rel_code = code;
         struct rtable *rt;
         struct flowi4 fl4;
 
@@ -590,9 +593,6 @@ ip4ip6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
                 rel_type = ICMP_DEST_UNREACH;
                 rel_code = ICMP_FRAG_NEEDED;
                 break;
-        case NDISC_REDIRECT:
-                rel_type = ICMP_REDIRECT;
-                rel_code = ICMP_REDIR_HOST;
         default:
                 return 0;
         }
@@ -611,33 +611,26 @@ ip4ip6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
         eiph = ip_hdr(skb2);
 
         /* Try to guess incoming interface */
-        rt = ip_route_output_ports(dev_net(skb->dev), &fl4, NULL,
-                                   eiph->saddr, 0,
-                                   0, 0,
-                                   IPPROTO_IPIP, RT_TOS(eiph->tos), 0);
+        rt = ip_route_output_ports(dev_net(skb->dev), &fl4, NULL, eiph->saddr,
+                                   0, 0, 0, IPPROTO_IPIP, RT_TOS(eiph->tos), 0);
         if (IS_ERR(rt))
                 goto out;
 
         skb2->dev = rt->dst.dev;
+        ip_rt_put(rt);
 
         /* route "incoming" packet */
         if (rt->rt_flags & RTCF_LOCAL) {
-                ip_rt_put(rt);
-                rt = NULL;
                 rt = ip_route_output_ports(dev_net(skb->dev), &fl4, NULL,
-                                           eiph->daddr, eiph->saddr,
-                                           0, 0,
-                                           IPPROTO_IPIP,
-                                           RT_TOS(eiph->tos), 0);
-                if (IS_ERR(rt) ||
-                    rt->dst.dev->type != ARPHRD_TUNNEL) {
+                                           eiph->daddr, eiph->saddr, 0, 0,
+                                           IPPROTO_IPIP, RT_TOS(eiph->tos), 0);
+                if (IS_ERR(rt) || rt->dst.dev->type != ARPHRD_TUNNEL) {
                         if (!IS_ERR(rt))
                                 ip_rt_put(rt);
                         goto out;
                 }
                 skb_dst_set(skb2, &rt->dst);
         } else {
-                ip_rt_put(rt);
                 if (ip_route_input(skb2, eiph->daddr, eiph->saddr, eiph->tos,
                                    skb2->dev) ||
                     skb_dst(skb2)->dev->type != ARPHRD_TUNNEL)
@@ -649,10 +642,9 @@ ip4ip6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
                 if (rel_info > dst_mtu(skb_dst(skb2)))
                         goto out;
 
-                skb_dst(skb2)->ops->update_pmtu(skb_dst(skb2), NULL, skb2, rel_info);
+                skb_dst(skb2)->ops->update_pmtu(skb_dst(skb2), NULL, skb2,
+                                                rel_info);
         }
-        if (rel_type == ICMP_REDIRECT)
-                skb_dst(skb2)->ops->redirect(skb_dst(skb2), NULL, skb2);
 
         icmp_send(skb2, rel_type, rel_code, htonl(rel_info));
 
@@ -665,11 +657,10 @@ static int
 ip6ip6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
            u8 type, u8 code, int offset, __be32 info)
 {
-        int rel_msg = 0;
+        __u32 rel_info = ntohl(info);
+        int err, rel_msg = 0;
         u8 rel_type = type;
         u8 rel_code = code;
-        __u32 rel_info = ntohl(info);
-        int err;
 
         err = ip6_tnl_err(skb, IPPROTO_IPV6, opt, &rel_type, &rel_code,
                           &rel_msg, &rel_info, offset);
@@ -769,7 +760,8 @@ int ip6_tnl_rcv_ctl(struct ip6_tnl *t,
 
                 if ((ipv6_addr_is_multicast(laddr) ||
                      likely(ipv6_chk_addr(net, laddr, ldev, 0))) &&
-                    likely(!ipv6_chk_addr(net, raddr, NULL, 0)))
+                    ((p->flags & IP6_TNL_F_ALLOW_LOCAL_REMOTE) ||
+                     likely(!ipv6_chk_addr(net, raddr, NULL, 0))))
                         ret = 1;
         }
         return ret;
@@ -999,7 +991,8 @@ int ip6_tnl_xmit_ctl(struct ip6_tnl *t,
                 if (unlikely(!ipv6_chk_addr(net, laddr, ldev, 0)))
                         pr_warn("%s xmit: Local address not yet configured!\n",
                                 p->name);
-                else if (!ipv6_addr_is_multicast(raddr) &&
+                else if (!(p->flags & IP6_TNL_F_ALLOW_LOCAL_REMOTE) &&
+                         !ipv6_addr_is_multicast(raddr) &&
                          unlikely(ipv6_chk_addr(net, raddr, NULL, 0)))
                         pr_warn("%s xmit: Routing loop! Remote address found on this node!\n",
                                 p->name);
@@ -2168,17 +2161,16 @@ static struct xfrm6_tunnel ip6ip6_handler __read_mostly = {
         .priority       =       1,
 };
 
-static void __net_exit ip6_tnl_destroy_tunnels(struct net *net)
+static void __net_exit ip6_tnl_destroy_tunnels(struct net *net, struct list_head *list)
 {
         struct ip6_tnl_net *ip6n = net_generic(net, ip6_tnl_net_id);
         struct net_device *dev, *aux;
         int h;
         struct ip6_tnl *t;
-        LIST_HEAD(list);
 
         for_each_netdev_safe(net, dev, aux)
                 if (dev->rtnl_link_ops == &ip6_link_ops)
-                        unregister_netdevice_queue(dev, &list);
+                        unregister_netdevice_queue(dev, list);
 
         for (h = 0; h < IP6_TUNNEL_HASH_SIZE; h++) {
                 t = rtnl_dereference(ip6n->tnls_r_l[h]);
@@ -2187,12 +2179,10 @@ static void __net_exit ip6_tnl_destroy_tunnels(struct net *net)
                          * been added to the list by the previous loop.
                          */
                         if (!net_eq(dev_net(t->dev), net))
-                                unregister_netdevice_queue(t->dev, &list);
+                                unregister_netdevice_queue(t->dev, list);
                         t = rtnl_dereference(t->next);
                 }
         }
-
-        unregister_netdevice_many(&list);
 }
 
 static int __net_init ip6_tnl_init_net(struct net *net)
@@ -2236,16 +2226,21 @@ err_alloc_dev:
         return err;
 }
 
-static void __net_exit ip6_tnl_exit_net(struct net *net)
+static void __net_exit ip6_tnl_exit_batch_net(struct list_head *net_list)
 {
+        struct net *net;
+        LIST_HEAD(list);
+
         rtnl_lock();
-        ip6_tnl_destroy_tunnels(net);
+        list_for_each_entry(net, net_list, exit_list)
+                ip6_tnl_destroy_tunnels(net, &list);
+        unregister_netdevice_many(&list);
         rtnl_unlock();
 }
 
 static struct pernet_operations ip6_tnl_net_ops = {
         .init = ip6_tnl_init_net,
-        .exit = ip6_tnl_exit_net,
+        .exit_batch = ip6_tnl_exit_batch_net,
         .id   = &ip6_tnl_net_id,
         .size = sizeof(struct ip6_tnl_net),
 };
diff --git a/net/ipv6/ip6_vti.c b/net/ipv6/ip6_vti.c
index bcdc2d557de1..dbb74f3c57a7 100644
--- a/net/ipv6/ip6_vti.c
+++ b/net/ipv6/ip6_vti.c
@@ -1053,23 +1053,22 @@ static struct rtnl_link_ops vti6_link_ops __read_mostly = {
         .get_link_net   = ip6_tnl_get_link_net,
 };
 
-static void __net_exit vti6_destroy_tunnels(struct vti6_net *ip6n)
+static void __net_exit vti6_destroy_tunnels(struct vti6_net *ip6n,
+                                            struct list_head *list)
 {
         int h;
         struct ip6_tnl *t;
-        LIST_HEAD(list);
 
         for (h = 0; h < IP6_VTI_HASH_SIZE; h++) {
                 t = rtnl_dereference(ip6n->tnls_r_l[h]);
                 while (t) {
-                        unregister_netdevice_queue(t->dev, &list);
+                        unregister_netdevice_queue(t->dev, list);
                         t = rtnl_dereference(t->next);
                 }
         }
 
         t = rtnl_dereference(ip6n->tnls_wc[0]);
-        unregister_netdevice_queue(t->dev, &list);
-        unregister_netdevice_many(&list);
+        unregister_netdevice_queue(t->dev, list);
 }
 
 static int __net_init vti6_init_net(struct net *net)
@@ -1109,18 +1108,24 @@ err_alloc_dev:
         return err;
 }
 
-static void __net_exit vti6_exit_net(struct net *net)
+static void __net_exit vti6_exit_batch_net(struct list_head *net_list)
 {
-        struct vti6_net *ip6n = net_generic(net, vti6_net_id);
+        struct vti6_net *ip6n;
+        struct net *net;
+        LIST_HEAD(list);
 
         rtnl_lock();
-        vti6_destroy_tunnels(ip6n);
+        list_for_each_entry(net, net_list, exit_list) {
+                ip6n = net_generic(net, vti6_net_id);
+                vti6_destroy_tunnels(ip6n, &list);
+        }
+        unregister_netdevice_many(&list);
         rtnl_unlock();
 }
 
 static struct pernet_operations vti6_net_ops = {
         .init = vti6_init_net,
-        .exit = vti6_exit_net,
+        .exit_batch = vti6_exit_batch_net,
         .id   = &vti6_net_id,
         .size = sizeof(struct vti6_net),
 };
diff --git a/net/ipv6/ip6mr.c b/net/ipv6/ip6mr.c
index f5500f5444e9..a2e1a864eb46 100644
--- a/net/ipv6/ip6mr.c
+++ b/net/ipv6/ip6mr.c
@@ -120,7 +120,7 @@ static void mrt6msg_netlink_event(struct mr6_table *mrt, struct sk_buff *pkt);
 static int ip6mr_rtm_dumproute(struct sk_buff *skb,
                                struct netlink_callback *cb);
 static void mroute_clean_tables(struct mr6_table *mrt, bool all);
-static void ipmr_expire_process(unsigned long arg);
+static void ipmr_expire_process(struct timer_list *t);
 
 #ifdef CONFIG_IPV6_MROUTE_MULTIPLE_TABLES
 #define ip6mr_for_each_table(mrt, net) \
@@ -320,8 +320,7 @@ static struct mr6_table *ip6mr_new_table(struct net *net, u32 id)
 
         INIT_LIST_HEAD(&mrt->mfc6_unres_queue);
 
-        setup_timer(&mrt->ipmr_expire_timer, ipmr_expire_process,
-                    (unsigned long)mrt);
+        timer_setup(&mrt->ipmr_expire_timer, ipmr_expire_process, 0);
 
 #ifdef CONFIG_IPV6_PIMSM_V2
         mrt->mroute_reg_vif_num = -1;
@@ -888,9 +887,9 @@ static void ipmr_do_expire_process(struct mr6_table *mrt)
                 mod_timer(&mrt->ipmr_expire_timer, jiffies + expires);
 }
 
-static void ipmr_expire_process(unsigned long arg)
+static void ipmr_expire_process(struct timer_list *t)
 {
-        struct mr6_table *mrt = (struct mr6_table *)arg;
+        struct mr6_table *mrt = from_timer(mrt, t, ipmr_expire_timer);
 
         if (!spin_trylock(&mfc_unres_lock)) {
                 mod_timer(&mrt->ipmr_expire_timer, jiffies + 1);
@@ -1617,6 +1616,10 @@ int ip6mr_sk_done(struct sock *sk)
         struct net *net = sock_net(sk);
         struct mr6_table *mrt;
 
+        if (sk->sk_type != SOCK_RAW ||
+            inet_sk(sk)->inet_num != IPPROTO_ICMPV6)
+                return err;
+
         rtnl_lock();
         ip6mr_for_each_table(mrt, net) {
                 if (sk == mrt->mroute6_sk) {
@@ -1722,6 +1725,7 @@ int ip6_mroute_setsockopt(struct sock *sk, int optname, char __user *optval, uns
         case MRT6_ADD_MFC:
         case MRT6_DEL_MFC:
                 parent = -1;
+                /* fall through */
         case MRT6_ADD_MFC_PROXY:
         case MRT6_DEL_MFC_PROXY:
                 if (optlen < sizeof(mfc))
diff --git a/net/ipv6/ipv6_sockglue.c b/net/ipv6/ipv6_sockglue.c
index a5e466d4e093..b9404feabd78 100644
--- a/net/ipv6/ipv6_sockglue.c
+++ b/net/ipv6/ipv6_sockglue.c
@@ -377,6 +377,14 @@ static int do_ipv6_setsockopt(struct sock *sk, int level, int optname,
                 retv = 0;
                 break;
 
+        case IPV6_FREEBIND:
+                if (optlen < sizeof(int))
+                        goto e_inval;
+                /* we also don't have a separate freebind bit for IPV6 */
+                inet_sk(sk)->freebind = valbool;
+                retv = 0;
+                break;
+
         case IPV6_RECVORIGDSTADDR:
                 if (optlen < sizeof(int))
                         goto e_inval;
@@ -1214,6 +1222,10 @@ static int do_ipv6_getsockopt(struct sock *sk, int level, int optname,
                 val = inet_sk(sk)->transparent;
                 break;
 
+        case IPV6_FREEBIND:
+                val = inet_sk(sk)->freebind;
+                break;
+
         case IPV6_RECVORIGDSTADDR:
                 val = np->rxopt.bits.rxorigdstaddr;
                 break;
diff --git a/net/ipv6/mcast.c b/net/ipv6/mcast.c
index 12b7c27ce5ce..fc6d7d143f2c 100644
--- a/net/ipv6/mcast.c
+++ b/net/ipv6/mcast.c
@@ -75,10 +75,10 @@ static struct in6_addr mld2_all_mcr = MLD2_ALL_MCR_INIT;
 
 static void igmp6_join_group(struct ifmcaddr6 *ma);
 static void igmp6_leave_group(struct ifmcaddr6 *ma);
-static void igmp6_timer_handler(unsigned long data);
+static void igmp6_timer_handler(struct timer_list *t);
 
-static void mld_gq_timer_expire(unsigned long data);
-static void mld_ifc_timer_expire(unsigned long data);
+static void mld_gq_timer_expire(struct timer_list *t);
+static void mld_ifc_timer_expire(struct timer_list *t);
 static void mld_ifc_event(struct inet6_dev *idev);
 static void mld_add_delrec(struct inet6_dev *idev, struct ifmcaddr6 *pmc);
 static void mld_del_delrec(struct inet6_dev *idev, struct ifmcaddr6 *pmc);
@@ -839,7 +839,7 @@ static struct ifmcaddr6 *mca_alloc(struct inet6_dev *idev,
         if (!mc)
                 return NULL;
 
-        setup_timer(&mc->mca_timer, igmp6_timer_handler, (unsigned long)mc);
+        timer_setup(&mc->mca_timer, igmp6_timer_handler, 0);
 
         mc->mca_addr = *addr;
         mc->idev = idev; /* reference taken by caller */
@@ -2083,9 +2083,9 @@ void ipv6_mc_dad_complete(struct inet6_dev *idev)
         }
 }
 
-static void mld_dad_timer_expire(unsigned long data)
+static void mld_dad_timer_expire(struct timer_list *t)
 {
-        struct inet6_dev *idev = (struct inet6_dev *)data;
+        struct inet6_dev *idev = from_timer(idev, t, mc_dad_timer);
 
         mld_send_initial_cr(idev);
         if (idev->mc_dad_count) {
@@ -2432,18 +2432,18 @@ static void igmp6_leave_group(struct ifmcaddr6 *ma)
         }
 }
 
-static void mld_gq_timer_expire(unsigned long data)
+static void mld_gq_timer_expire(struct timer_list *t)
 {
-        struct inet6_dev *idev = (struct inet6_dev *)data;
+        struct inet6_dev *idev = from_timer(idev, t, mc_gq_timer);
 
         idev->mc_gq_running = 0;
         mld_send_report(idev, NULL);
         in6_dev_put(idev);
 }
 
-static void mld_ifc_timer_expire(unsigned long data)
+static void mld_ifc_timer_expire(struct timer_list *t)
 {
-        struct inet6_dev *idev = (struct inet6_dev *)data;
+        struct inet6_dev *idev = from_timer(idev, t, mc_ifc_timer);
 
         mld_send_cr(idev);
         if (idev->mc_ifc_count) {
@@ -2462,9 +2462,9 @@ static void mld_ifc_event(struct inet6_dev *idev)
         mld_ifc_start_timer(idev, 1);
 }
 
-static void igmp6_timer_handler(unsigned long data)
+static void igmp6_timer_handler(struct timer_list *t)
 {
-        struct ifmcaddr6 *ma = (struct ifmcaddr6 *) data;
+        struct ifmcaddr6 *ma = from_timer(ma, t, mca_timer);
 
         if (mld_in_v1_mode(ma->idev))
                 igmp6_send(&ma->mca_addr, ma->idev->dev, ICMPV6_MGM_REPORT);
@@ -2552,14 +2552,11 @@ void ipv6_mc_init_dev(struct inet6_dev *idev)
         write_lock_bh(&idev->lock);
         spin_lock_init(&idev->mc_lock);
         idev->mc_gq_running = 0;
-        setup_timer(&idev->mc_gq_timer, mld_gq_timer_expire,
-                        (unsigned long)idev);
+        timer_setup(&idev->mc_gq_timer, mld_gq_timer_expire, 0);
         idev->mc_tomb = NULL;
         idev->mc_ifc_count = 0;
-        setup_timer(&idev->mc_ifc_timer, mld_ifc_timer_expire,
-                        (unsigned long)idev);
-        setup_timer(&idev->mc_dad_timer, mld_dad_timer_expire,
-                    (unsigned long)idev);
+        timer_setup(&idev->mc_ifc_timer, mld_ifc_timer_expire, 0);
+        timer_setup(&idev->mc_dad_timer, mld_dad_timer_expire, 0);
         ipv6_mc_reset(idev);
         write_unlock_bh(&idev->lock);
 }
diff --git a/net/ipv6/ndisc.c b/net/ipv6/ndisc.c
index 266a530414d7..b3cea200c85e 100644
--- a/net/ipv6/ndisc.c
+++ b/net/ipv6/ndisc.c
@@ -46,6 +46,7 @@
 #endif
 
 #include <linux/if_addr.h>
+#include <linux/if_ether.h>
 #include <linux/if_arp.h>
 #include <linux/ipv6.h>
 #include <linux/icmpv6.h>
@@ -426,12 +427,19 @@ static void ip6_nd_hdr(struct sk_buff *skb,
                        int hop_limit, int len)
 {
         struct ipv6hdr *hdr;
+        struct inet6_dev *idev;
+        unsigned tclass;
+
+        rcu_read_lock();
+        idev = __in6_dev_get(skb->dev);
+        tclass = idev ? idev->cnf.ndisc_tclass : 0;
+        rcu_read_unlock();
 
         skb_push(skb, sizeof(*hdr));
         skb_reset_network_header(skb);
         hdr = ipv6_hdr(skb);
 
-        ip6_flow_hdr(hdr, 0, 0);
+        ip6_flow_hdr(hdr, tclass, 0);
 
         hdr->payload_len = htons(len);
         hdr->nexthdr = IPPROTO_ICMPV6;
@@ -822,7 +830,7 @@ have_ifp:
                                  * who is doing DAD
                                  * so fail our DAD process
                                  */
-                                addrconf_dad_failure(ifp);
+                                addrconf_dad_failure(skb, ifp);
                                 return;
                         } else {
                                 /*
@@ -975,7 +983,7 @@ static void ndisc_recv_na(struct sk_buff *skb)
         if (ifp) {
                 if (skb->pkt_type != PACKET_LOOPBACK
                     && (ifp->flags & IFA_F_TENTATIVE)) {
-                                addrconf_dad_failure(ifp);
+                                addrconf_dad_failure(skb, ifp);
                                 return;
                 }
                 /* What should we make now? The advertisement
@@ -989,8 +997,8 @@ static void ndisc_recv_na(struct sk_buff *skb)
                  */
                 if (skb->pkt_type != PACKET_LOOPBACK)
                         ND_PRINTK(1, warn,
-                                  "NA: someone advertises our address %pI6 on %s!\n",
-                                  &ifp->addr, ifp->idev->dev->name);
+                                  "NA: %pM advertised our address %pI6c on %s!\n",
+                                  eth_hdr(skb)->h_source, &ifp->addr, ifp->idev->dev->name);
                 in6_ifa_put(ifp);
                 return;
         }
diff --git a/net/ipv6/netfilter/ip6_tables.c b/net/ipv6/netfilter/ip6_tables.c
index 01bd3ee5ebc6..f06e25065a34 100644
--- a/net/ipv6/netfilter/ip6_tables.c
+++ b/net/ipv6/netfilter/ip6_tables.c
@@ -800,6 +800,25 @@ get_counters(const struct xt_table_info *t,
         }
 }
 
+static void get_old_counters(const struct xt_table_info *t,
+                             struct xt_counters counters[])
+{
+        struct ip6t_entry *iter;
+        unsigned int cpu, i;
+
+        for_each_possible_cpu(cpu) {
+                i = 0;
+                xt_entry_foreach(iter, t->entries, t->size) {
+                        const struct xt_counters *tmp;
+
+                        tmp = xt_get_per_cpu_counter(&iter->counters, cpu);
+                        ADD_COUNTER(counters[i], tmp->bcnt, tmp->pcnt);
+                        ++i;
+                }
+                cond_resched();
+        }
+}
+
 static struct xt_counters *alloc_counters(const struct xt_table *table)
 {
         unsigned int countersize;
@@ -1090,8 +1109,7 @@ __do_replace(struct net *net, const char *name, unsigned int valid_hooks,
             (newinfo->number <= oldinfo->initial_entries))
                 module_put(t->me);
 
-        /* Get the old counters, and synchronize with replace */
-        get_counters(oldinfo, counters);
+        get_old_counters(oldinfo, counters);
 
         /* Decrease module usage counts and free resource */
         xt_entry_foreach(iter, oldinfo->entries, oldinfo->size)
diff --git a/net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c b/net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c
index fe01dc953c56..3b80a38f62b8 100644
--- a/net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c
+++ b/net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c
@@ -339,7 +339,7 @@ static void ipv6_hooks_unregister(struct net *net)
         mutex_unlock(&register_ipv6_hooks);
 }
 
-struct nf_conntrack_l3proto nf_conntrack_l3proto_ipv6 __read_mostly = {
+const struct nf_conntrack_l3proto nf_conntrack_l3proto_ipv6 = {
         .l3proto                = PF_INET6,
         .pkt_to_tuple           = ipv6_pkt_to_tuple,
         .invert_tuple           = ipv6_invert_tuple,
diff --git a/net/ipv6/netfilter/nf_conntrack_proto_icmpv6.c b/net/ipv6/netfilter/nf_conntrack_proto_icmpv6.c
index a9e1fd1a8536..3ac0d826afc4 100644
--- a/net/ipv6/netfilter/nf_conntrack_proto_icmpv6.c
+++ b/net/ipv6/netfilter/nf_conntrack_proto_icmpv6.c
@@ -94,7 +94,6 @@ static int icmpv6_packet(struct nf_conn *ct,
                        const struct sk_buff *skb,
                        unsigned int dataoff,
                        enum ip_conntrack_info ctinfo,
-                       u_int8_t pf,
                        unsigned int *timeout)
 {
         /* Do not immediately delete the connection after the first
@@ -176,6 +175,12 @@ icmpv6_error_message(struct net *net, struct nf_conn *tmpl,
         return NF_ACCEPT;
 }
 
+static void icmpv6_error_log(const struct sk_buff *skb, struct net *net,
+                             u8 pf, const char *msg)
+{
+        nf_l4proto_log_invalid(skb, net, pf, IPPROTO_ICMPV6, "%s", msg);
+}
+
 static int
 icmpv6_error(struct net *net, struct nf_conn *tmpl,
              struct sk_buff *skb, unsigned int dataoff,
@@ -187,17 +192,13 @@ icmpv6_error(struct net *net, struct nf_conn *tmpl,
 
         icmp6h = skb_header_pointer(skb, dataoff, sizeof(_ih), &_ih);
         if (icmp6h == NULL) {
-                if (LOG_INVALID(net, IPPROTO_ICMPV6))
-                        nf_log_packet(net, PF_INET6, 0, skb, NULL, NULL, NULL,
-                              "nf_ct_icmpv6: short packet ");
+                icmpv6_error_log(skb, net, pf, "short packet");
                 return -NF_ACCEPT;
         }
 
         if (net->ct.sysctl_checksum && hooknum == NF_INET_PRE_ROUTING &&
             nf_ip6_checksum(skb, hooknum, dataoff, IPPROTO_ICMPV6)) {
-                if (LOG_INVALID(net, IPPROTO_ICMPV6))
-                        nf_log_packet(net, PF_INET6, 0, skb, NULL, NULL, NULL,
-                                      "nf_ct_icmpv6: ICMPv6 checksum failed ");
+                icmpv6_error_log(skb, net, pf, "ICMPv6 checksum failed");
                 return -NF_ACCEPT;
         }
 
@@ -258,9 +259,14 @@ static int icmpv6_nlattr_to_tuple(struct nlattr *tb[],
         return 0;
 }
 
-static int icmpv6_nlattr_tuple_size(void)
+static unsigned int icmpv6_nlattr_tuple_size(void)
 {
-        return nla_policy_len(icmpv6_nla_policy, CTA_PROTO_MAX + 1);
+        static unsigned int size __read_mostly;
+
+        if (!size)
+                size = nla_policy_len(icmpv6_nla_policy, CTA_PROTO_MAX + 1);
+
+        return size;
 }
 #endif
 
diff --git a/net/ipv6/netfilter/nf_conntrack_reasm.c b/net/ipv6/netfilter/nf_conntrack_reasm.c
index b263bf3a19f7..977d8900cfd1 100644
--- a/net/ipv6/netfilter/nf_conntrack_reasm.c
+++ b/net/ipv6/netfilter/nf_conntrack_reasm.c
@@ -169,12 +169,13 @@ static unsigned int nf_hashfn(const struct inet_frag_queue *q)
         return nf_hash_frag(nq->id, &nq->saddr, &nq->daddr);
 }
 
-static void nf_ct_frag6_expire(unsigned long data)
+static void nf_ct_frag6_expire(struct timer_list *t)
 {
+        struct inet_frag_queue *frag = from_timer(frag, t, timer);
         struct frag_queue *fq;
         struct net *net;
 
-        fq = container_of((struct inet_frag_queue *)data, struct frag_queue, q);
+        fq = container_of(frag, struct frag_queue, q);
         net = container_of(fq->q.net, struct net, nf_frag.frags);
 
         ip6_expire_frag_queue(net, fq, &nf_frags);
diff --git a/net/ipv6/netfilter/nf_nat_l3proto_ipv6.c b/net/ipv6/netfilter/nf_nat_l3proto_ipv6.c
index 46d6dba50698..1d2fb9267d6f 100644
--- a/net/ipv6/netfilter/nf_nat_l3proto_ipv6.c
+++ b/net/ipv6/netfilter/nf_nat_l3proto_ipv6.c
@@ -290,7 +290,8 @@ nf_nat_ipv6_fn(void *priv, struct sk_buff *skb,
                         else
                                 return NF_ACCEPT;
                 }
-                /* Fall thru... (Only ICMPs can be IP_CT_IS_REPLY) */
+                /* Only ICMPs can be IP_CT_IS_REPLY: */
+                /* fall through */
         case IP_CT_NEW:
                 /* Seen it before?  This can happen for loopback, retrans,
                  * or local packets.
diff --git a/net/ipv6/output_core.c b/net/ipv6/output_core.c
index a338bbc33cf3..4a7e5ffa5108 100644
--- a/net/ipv6/output_core.c
+++ b/net/ipv6/output_core.c
@@ -31,37 +31,6 @@ static u32 __ipv6_select_ident(struct net *net, u32 hashrnd,
         return id;
 }
 
-/* This function exists only for tap drivers that must support broken
- * clients requesting UFO without specifying an IPv6 fragment ID.
- *
- * This is similar to ipv6_select_ident() but we use an independent hash
- * seed to limit information leakage.
- *
- * The network header must be set before calling this.
- */
-void ipv6_proxy_select_ident(struct net *net, struct sk_buff *skb)
-{
-        static u32 ip6_proxy_idents_hashrnd __read_mostly;
-        struct in6_addr buf[2];
-        struct in6_addr *addrs;
-        u32 id;
-
-        addrs = skb_header_pointer(skb,
-                                   skb_network_offset(skb) +
-                                   offsetof(struct ipv6hdr, saddr),
-                                   sizeof(buf), buf);
-        if (!addrs)
-                return;
-
-        net_get_random_once(&ip6_proxy_idents_hashrnd,
-                            sizeof(ip6_proxy_idents_hashrnd));
-
-        id = __ipv6_select_ident(net, ip6_proxy_idents_hashrnd,
-                                 &addrs[1], &addrs[0]);
-        skb_shinfo(skb)->ip6_frag_id = htonl(id);
-}
-EXPORT_SYMBOL_GPL(ipv6_proxy_select_ident);
-
 __be32 ipv6_select_ident(struct net *net,
                          const struct in6_addr *daddr,
                          const struct in6_addr *saddr)
diff --git a/net/ipv6/ping.c b/net/ipv6/ping.c
index ac826dd338ff..d12c55dad7d1 100644
--- a/net/ipv6/ping.c
+++ b/net/ipv6/ping.c
@@ -154,9 +154,8 @@ static int ping_v6_sendmsg(struct sock *sk, struct msghdr *msg, size_t len)
                                 ICMP6_MIB_OUTERRORS);
                 ip6_flush_pending_frames(sk);
         } else {
-                err = icmpv6_push_pending_frames(sk, &fl6,
-                                                 (struct icmp6hdr *) &pfh.icmph,
-                                                 len);
+                icmpv6_push_pending_frames(sk, &fl6,
+                                           (struct icmp6hdr *)&pfh.icmph, len);
         }
         release_sock(sk);
 
diff --git a/net/ipv6/raw.c b/net/ipv6/raw.c
index e4462b0ff801..761a473a07c5 100644
--- a/net/ipv6/raw.c
+++ b/net/ipv6/raw.c
@@ -1055,6 +1055,7 @@ static int rawv6_setsockopt(struct sock *sk, int level, int optname,
                 if (optname == IPV6_CHECKSUM ||
                     optname == IPV6_HDRINCL)
                         break;
+                /* fall through */
         default:
                 return ipv6_setsockopt(sk, level, optname, optval, optlen);
         }
@@ -1077,6 +1078,7 @@ static int compat_rawv6_setsockopt(struct sock *sk, int level, int optname,
                 if (optname == IPV6_CHECKSUM ||
                     optname == IPV6_HDRINCL)
                         break;
+                /* fall through */
         default:
                 return compat_ipv6_setsockopt(sk, level, optname,
                                               optval, optlen);
@@ -1138,6 +1140,7 @@ static int rawv6_getsockopt(struct sock *sk, int level, int optname,
                 if (optname == IPV6_CHECKSUM ||
                     optname == IPV6_HDRINCL)
                         break;
+                /* fall through */
         default:
                 return ipv6_getsockopt(sk, level, optname, optval, optlen);
         }
@@ -1160,6 +1163,7 @@ static int compat_rawv6_getsockopt(struct sock *sk, int level, int optname,
                 if (optname == IPV6_CHECKSUM ||
                     optname == IPV6_HDRINCL)
                         break;
+                /* fall through */
         default:
                 return compat_ipv6_getsockopt(sk, level, optname,
                                               optval, optlen);
diff --git a/net/ipv6/reassembly.c b/net/ipv6/reassembly.c
index 846012eae526..afbc000ad4f2 100644
--- a/net/ipv6/reassembly.c
+++ b/net/ipv6/reassembly.c
@@ -170,12 +170,13 @@ out:
 }
 EXPORT_SYMBOL(ip6_expire_frag_queue);
 
-static void ip6_frag_expire(unsigned long data)
+static void ip6_frag_expire(struct timer_list *t)
 {
+        struct inet_frag_queue *frag = from_timer(frag, t, timer);
         struct frag_queue *fq;
         struct net *net;
 
-        fq = container_of((struct inet_frag_queue *)data, struct frag_queue, q);
+        fq = container_of(frag, struct frag_queue, q);
         net = container_of(fq->q.net, struct net, ipv6.frags);
 
         ip6_expire_frag_queue(net, fq, &ip6_frags);
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index a96d5b385d8f..05eb7bc36156 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -44,6 +44,7 @@
 #include <linux/seq_file.h>
 #include <linux/nsproxy.h>
 #include <linux/slab.h>
+#include <linux/jhash.h>
 #include <net/net_namespace.h>
 #include <net/snmp.h>
 #include <net/ipv6.h>
@@ -104,6 +105,9 @@ static int rt6_fill_node(struct net *net,
                          struct in6_addr *dst, struct in6_addr *src,
                          int iif, int type, u32 portid, u32 seq,
                          unsigned int flags);
+static struct rt6_info *rt6_find_cached_rt(struct rt6_info *rt,
+                                           struct in6_addr *daddr,
+                                           struct in6_addr *saddr);
 
 #ifdef CONFIG_IPV6_ROUTE_INFO
 static struct rt6_info *rt6_add_route_info(struct net *net,
@@ -139,9 +143,11 @@ static void rt6_uncached_list_del(struct rt6_info *rt)
 {
         if (!list_empty(&rt->rt6i_uncached)) {
                 struct uncached_list *ul = rt->rt6i_uncached_list;
+                struct net *net = dev_net(rt->dst.dev);
 
                 spin_lock_bh(&ul->lock);
                 list_del(&rt->rt6i_uncached);
+                atomic_dec(&net->ipv6.rt6_stats->fib_rt_uncache);
                 spin_unlock_bh(&ul->lock);
         }
 }
@@ -355,8 +361,10 @@ static struct rt6_info *__ip6_dst_alloc(struct net *net,
         struct rt6_info *rt = dst_alloc(&net->ipv6.ip6_dst_ops, dev,
                                         1, DST_OBSOLETE_FORCE_CHK, flags);
 
-        if (rt)
+        if (rt) {
                 rt6_info_init(rt);
+                atomic_inc(&net->ipv6.rt6_stats->fib_rt_alloc);
+        }
 
         return rt;
 }
@@ -369,17 +377,7 @@ struct rt6_info *ip6_dst_alloc(struct net *net,
 
         if (rt) {
                 rt->rt6i_pcpu = alloc_percpu_gfp(struct rt6_info *, GFP_ATOMIC);
-                if (rt->rt6i_pcpu) {
-                        int cpu;
-
-                        for_each_possible_cpu(cpu) {
-                                struct rt6_info **p;
-
-                                p = per_cpu_ptr(rt->rt6i_pcpu, cpu);
-                                /* no one shares rt */
-                                *p =  NULL;
-                        }
-                } else {
+                if (!rt->rt6i_pcpu) {
                         dst_release_immediate(&rt->dst);
                         return NULL;
                 }
@@ -392,6 +390,7 @@ EXPORT_SYMBOL(ip6_dst_alloc);
 static void ip6_dst_destroy(struct dst_entry *dst)
 {
         struct rt6_info *rt = (struct rt6_info *)dst;
+        struct rt6_exception_bucket *bucket;
         struct dst_entry *from = dst->from;
         struct inet6_dev *idev;
 
@@ -404,6 +403,11 @@ static void ip6_dst_destroy(struct dst_entry *dst)
                 rt->rt6i_idev = NULL;
                 in6_dev_put(idev);
         }
+        bucket = rcu_dereference_protected(rt->rt6i_exception_bucket, 1);
+        if (bucket) {
+                rt->rt6i_exception_bucket = NULL;
+                kfree(bucket);
+        }
 
         dst->from = NULL;
         dst_release(from);
@@ -478,7 +482,7 @@ static struct rt6_info *rt6_multipath_select(struct rt6_info *match,
 }
 
 /*
- *      Route lookup. Any table->tb6_lock is implied.
+ *      Route lookup. rcu_read_lock() should be held.
  */
 
 static inline struct rt6_info *rt6_device_match(struct net *net,
@@ -493,7 +497,7 @@ static inline struct rt6_info *rt6_device_match(struct net *net,
         if (!oif && ipv6_addr_any(saddr))
                 goto out;
 
-        for (sprt = rt; sprt; sprt = sprt->dst.rt6_next) {
+        for (sprt = rt; sprt; sprt = rcu_dereference(sprt->dst.rt6_next)) {
                 struct net_device *dev = sprt->dst.dev;
 
                 if (oif) {
@@ -702,6 +706,7 @@ out:
 }
 
 static struct rt6_info *find_rr_leaf(struct fib6_node *fn,
+                                     struct rt6_info *leaf,
                                      struct rt6_info *rr_head,
                                      u32 metric, int oif, int strict,
                                      bool *do_rr)
@@ -711,7 +716,7 @@ static struct rt6_info *find_rr_leaf(struct fib6_node *fn,
 
         match = NULL;
         cont = NULL;
-        for (rt = rr_head; rt; rt = rt->dst.rt6_next) {
+        for (rt = rr_head; rt; rt = rcu_dereference(rt->dst.rt6_next)) {
                 if (rt->rt6i_metric != metric) {
                         cont = rt;
                         break;
@@ -720,7 +725,8 @@ static struct rt6_info *find_rr_leaf(struct fib6_node *fn,
                 match = find_match(rt, oif, strict, &mpri, match, do_rr);
         }
 
-        for (rt = fn->leaf; rt && rt != rr_head; rt = rt->dst.rt6_next) {
+        for (rt = leaf; rt && rt != rr_head;
+             rt = rcu_dereference(rt->dst.rt6_next)) {
                 if (rt->rt6i_metric != metric) {
                         cont = rt;
                         break;
@@ -732,37 +738,59 @@ static struct rt6_info *find_rr_leaf(struct fib6_node *fn,
         if (match || !cont)
                 return match;
 
-        for (rt = cont; rt; rt = rt->dst.rt6_next)
+        for (rt = cont; rt; rt = rcu_dereference(rt->dst.rt6_next))
                 match = find_match(rt, oif, strict, &mpri, match, do_rr);
 
         return match;
 }
 
-static struct rt6_info *rt6_select(struct fib6_node *fn, int oif, int strict)
+static struct rt6_info *rt6_select(struct net *net, struct fib6_node *fn,
+                                   int oif, int strict)
 {
+        struct rt6_info *leaf = rcu_dereference(fn->leaf);
         struct rt6_info *match, *rt0;
-        struct net *net;
         bool do_rr = false;
+        int key_plen;
 
-        rt0 = fn->rr_ptr;
+        if (!leaf || leaf == net->ipv6.ip6_null_entry)
+                return net->ipv6.ip6_null_entry;
+
+        rt0 = rcu_dereference(fn->rr_ptr);
         if (!rt0)
-                fn->rr_ptr = rt0 = fn->leaf;
+                rt0 = leaf;
 
-        match = find_rr_leaf(fn, rt0, rt0->rt6i_metric, oif, strict,
+        /* Double check to make sure fn is not an intermediate node
+         * and fn->leaf does not points to its child's leaf
+         * (This might happen if all routes under fn are deleted from
+         * the tree and fib6_repair_tree() is called on the node.)
+         */
+        key_plen = rt0->rt6i_dst.plen;
+#ifdef CONFIG_IPV6_SUBTREES
+        if (rt0->rt6i_src.plen)
+                key_plen = rt0->rt6i_src.plen;
+#endif
+        if (fn->fn_bit != key_plen)
+                return net->ipv6.ip6_null_entry;
+
+        match = find_rr_leaf(fn, leaf, rt0, rt0->rt6i_metric, oif, strict,
                              &do_rr);
 
         if (do_rr) {
-                struct rt6_info *next = rt0->dst.rt6_next;
+                struct rt6_info *next = rcu_dereference(rt0->dst.rt6_next);
 
                 /* no entries matched; do round-robin */
                 if (!next || next->rt6i_metric != rt0->rt6i_metric)
-                        next = fn->leaf;
-
-                if (next != rt0)
-                        fn->rr_ptr = next;
+                        next = leaf;
+
+                if (next != rt0) {
+                        spin_lock_bh(&leaf->rt6i_table->tb6_lock);
+                        /* make sure next is not being deleted from the tree */
+                        if (next->rt6i_node)
+                                rcu_assign_pointer(fn->rr_ptr, next);
+                        spin_unlock_bh(&leaf->rt6i_table->tb6_lock);
+                }
         }
 
-        net = dev_net(rt0->dst.dev);
         return match ? match : net->ipv6.ip6_null_entry;
 }
 
@@ -850,13 +878,14 @@ int rt6_route_rcv(struct net_device *dev, u8 *opt, int len,
 static struct fib6_node* fib6_backtrack(struct fib6_node *fn,
                                         struct in6_addr *saddr)
 {
-        struct fib6_node *pn;
+        struct fib6_node *pn, *sn;
         while (1) {
                 if (fn->fn_flags & RTN_TL_ROOT)
                         return NULL;
-                pn = fn->parent;
-                if (FIB6_SUBTREE(pn) && FIB6_SUBTREE(pn) != fn)
-                        fn = fib6_lookup(FIB6_SUBTREE(pn), NULL, saddr);
+                pn = rcu_dereference(fn->parent);
+                sn = FIB6_SUBTREE(pn);
+                if (sn && sn != fn)
+                        fn = fib6_lookup(sn, NULL, saddr);
                 else
                         fn = pn;
                 if (fn->fn_flags & RTN_RTINFO)
@@ -864,29 +893,59 @@ static struct fib6_node* fib6_backtrack(struct fib6_node *fn,
         }
 }
 
+static bool ip6_hold_safe(struct net *net, struct rt6_info **prt,
+                          bool null_fallback)
+{
+        struct rt6_info *rt = *prt;
+
+        if (dst_hold_safe(&rt->dst))
+                return true;
+        if (null_fallback) {
+                rt = net->ipv6.ip6_null_entry;
+                dst_hold(&rt->dst);
+        } else {
+                rt = NULL;
+        }
+        *prt = rt;
+        return false;
+}
+
 static struct rt6_info *ip6_pol_route_lookup(struct net *net,
                                              struct fib6_table *table,
                                              struct flowi6 *fl6, int flags)
 {
+        struct rt6_info *rt, *rt_cache;
         struct fib6_node *fn;
-        struct rt6_info *rt;
 
-        read_lock_bh(&table->tb6_lock);
+        rcu_read_lock();
         fn = fib6_lookup(&table->tb6_root, &fl6->daddr, &fl6->saddr);
 restart:
-        rt = fn->leaf;
-        rt = rt6_device_match(net, rt, &fl6->saddr, fl6->flowi6_oif, flags);
-        if (rt->rt6i_nsiblings && fl6->flowi6_oif == 0)
-                rt = rt6_multipath_select(rt, fl6, fl6->flowi6_oif, flags);
+        rt = rcu_dereference(fn->leaf);
+        if (!rt) {
+                rt = net->ipv6.ip6_null_entry;
+        } else {
+                rt = rt6_device_match(net, rt, &fl6->saddr,
+                                      fl6->flowi6_oif, flags);
+                if (rt->rt6i_nsiblings && fl6->flowi6_oif == 0)
+                        rt = rt6_multipath_select(rt, fl6,
+                                                  fl6->flowi6_oif, flags);
+        }
         if (rt == net->ipv6.ip6_null_entry) {
                 fn = fib6_backtrack(fn, &fl6->saddr);
                 if (fn)
                         goto restart;
         }
-        dst_use(&rt->dst, jiffies);
-        read_unlock_bh(&table->tb6_lock);
+        /* Search through exception table */
+        rt_cache = rt6_find_cached_rt(rt, &fl6->daddr, &fl6->saddr);
+        if (rt_cache)
+                rt = rt_cache;
+
+        if (ip6_hold_safe(net, &rt, true))
+                dst_use_noref(&rt->dst, jiffies);
+
+        rcu_read_unlock();
 
-        trace_fib6_table_lookup(net, rt, table->tb6_id, fl6);
+        trace_fib6_table_lookup(net, rt, table, fl6);
 
         return rt;
 
@@ -938,9 +997,9 @@ static int __ip6_ins_rt(struct rt6_info *rt, struct nl_info *info,
         struct fib6_table *table;
 
         table = rt->rt6i_table;
-        write_lock_bh(&table->tb6_lock);
+        spin_lock_bh(&table->tb6_lock);
         err = fib6_add(&table->tb6_root, rt, info, mxc, extack);
-        write_unlock_bh(&table->tb6_lock);
+        spin_unlock_bh(&table->tb6_lock);
 
         return err;
 }
@@ -1038,7 +1097,7 @@ static struct rt6_info *ip6_rt_pcpu_alloc(struct rt6_info *rt)
         return pcpu_rt;
 }
 
-/* It should be called with read_lock_bh(&tb6_lock) acquired */
+/* It should be called with rcu_read_lock() acquired */
 static struct rt6_info *rt6_get_pcpu_route(struct rt6_info *rt)
 {
         struct rt6_info *pcpu_rt, **p;
@@ -1046,16 +1105,14 @@ static struct rt6_info *rt6_get_pcpu_route(struct rt6_info *rt)
         p = this_cpu_ptr(rt->rt6i_pcpu);
         pcpu_rt = *p;
 
-        if (pcpu_rt) {
-                dst_hold(&pcpu_rt->dst);
+        if (pcpu_rt && ip6_hold_safe(NULL, &pcpu_rt, false))
                 rt6_dst_from_metrics_check(pcpu_rt);
-        }
+
         return pcpu_rt;
 }
 
 static struct rt6_info *rt6_make_pcpu_route(struct rt6_info *rt)
 {
-        struct fib6_table *table = rt->rt6i_table;
         struct rt6_info *pcpu_rt, *prev, **p;
 
         pcpu_rt = ip6_rt_pcpu_alloc(rt);
@@ -1066,36 +1123,526 @@ static struct rt6_info *rt6_make_pcpu_route(struct rt6_info *rt)
                 return net->ipv6.ip6_null_entry;
         }
 
-        read_lock_bh(&table->tb6_lock);
-        if (rt->rt6i_pcpu) {
-                p = this_cpu_ptr(rt->rt6i_pcpu);
-                prev = cmpxchg(p, NULL, pcpu_rt);
-                if (prev) {
-                        /* If someone did it before us, return prev instead */
-                        dst_release_immediate(&pcpu_rt->dst);
-                        pcpu_rt = prev;
-                }
-        } else {
-                /* rt has been removed from the fib6 tree
-                 * before we have a chance to acquire the read_lock.
-                 * In this case, don't brother to create a pcpu rt
-                 * since rt is going away anyway.  The next
-                 * dst_check() will trigger a re-lookup.
-                 */
-                dst_release_immediate(&pcpu_rt->dst);
-                pcpu_rt = rt;
-        }
         dst_hold(&pcpu_rt->dst);
+        p = this_cpu_ptr(rt->rt6i_pcpu);
+        prev = cmpxchg(p, NULL, pcpu_rt);
+        BUG_ON(prev);
+
         rt6_dst_from_metrics_check(pcpu_rt);
-        read_unlock_bh(&table->tb6_lock);
         return pcpu_rt;
 }
 
+/* exception hash table implementation
+ */
+static DEFINE_SPINLOCK(rt6_exception_lock);
+
+/* Remove rt6_ex from hash table and free the memory
+ * Caller must hold rt6_exception_lock
+ */
+static void rt6_remove_exception(struct rt6_exception_bucket *bucket,
+                                 struct rt6_exception *rt6_ex)
+{
+        struct net *net;
+
+        if (!bucket || !rt6_ex)
+                return;
+
+        net = dev_net(rt6_ex->rt6i->dst.dev);
+        rt6_ex->rt6i->rt6i_node = NULL;
+        hlist_del_rcu(&rt6_ex->hlist);
+        rt6_release(rt6_ex->rt6i);
+        kfree_rcu(rt6_ex, rcu);
+        WARN_ON_ONCE(!bucket->depth);
+        bucket->depth--;
+        net->ipv6.rt6_stats->fib_rt_cache--;
+}
+
+/* Remove oldest rt6_ex in bucket and free the memory
+ * Caller must hold rt6_exception_lock
+ */
+static void rt6_exception_remove_oldest(struct rt6_exception_bucket *bucket)
+{
+        struct rt6_exception *rt6_ex, *oldest = NULL;
+
+        if (!bucket)
+                return;
+
+        hlist_for_each_entry(rt6_ex, &bucket->chain, hlist) {
+                if (!oldest || time_before(rt6_ex->stamp, oldest->stamp))
+                        oldest = rt6_ex;
+        }
+        rt6_remove_exception(bucket, oldest);
+}
+
+static u32 rt6_exception_hash(const struct in6_addr *dst,
+                              const struct in6_addr *src)
+{
+        static u32 seed __read_mostly;
+        u32 val;
+
+        net_get_random_once(&seed, sizeof(seed));
+        val = jhash(dst, sizeof(*dst), seed);
+
+#ifdef CONFIG_IPV6_SUBTREES
+        if (src)
+                val = jhash(src, sizeof(*src), val);
+#endif
+        return hash_32(val, FIB6_EXCEPTION_BUCKET_SIZE_SHIFT);
+}
+
+/* Helper function to find the cached rt in the hash table
+ * and update bucket pointer to point to the bucket for this
+ * (daddr, saddr) pair
+ * Caller must hold rt6_exception_lock
+ */
+static struct rt6_exception *
+__rt6_find_exception_spinlock(struct rt6_exception_bucket **bucket,
+                              const struct in6_addr *daddr,
+                              const struct in6_addr *saddr)
+{
+        struct rt6_exception *rt6_ex;
+        u32 hval;
+
+        if (!(*bucket) || !daddr)
+                return NULL;
+
+        hval = rt6_exception_hash(daddr, saddr);
+        *bucket += hval;
+
+        hlist_for_each_entry(rt6_ex, &(*bucket)->chain, hlist) {
+                struct rt6_info *rt6 = rt6_ex->rt6i;
+                bool matched = ipv6_addr_equal(daddr, &rt6->rt6i_dst.addr);
+
+#ifdef CONFIG_IPV6_SUBTREES
+                if (matched && saddr)
+                        matched = ipv6_addr_equal(saddr, &rt6->rt6i_src.addr);
+#endif
+                if (matched)
+                        return rt6_ex;
+        }
+        return NULL;
+}
+
+/* Helper function to find the cached rt in the hash table
+ * and update bucket pointer to point to the bucket for this
+ * (daddr, saddr) pair
+ * Caller must hold rcu_read_lock()
+ */
+static struct rt6_exception *
+__rt6_find_exception_rcu(struct rt6_exception_bucket **bucket,
+                         const struct in6_addr *daddr,
+                         const struct in6_addr *saddr)
+{
+        struct rt6_exception *rt6_ex;
+        u32 hval;
+
+        WARN_ON_ONCE(!rcu_read_lock_held());
+
+        if (!(*bucket) || !daddr)
+                return NULL;
+
+        hval = rt6_exception_hash(daddr, saddr);
+        *bucket += hval;
+
+        hlist_for_each_entry_rcu(rt6_ex, &(*bucket)->chain, hlist) {
+                struct rt6_info *rt6 = rt6_ex->rt6i;
+                bool matched = ipv6_addr_equal(daddr, &rt6->rt6i_dst.addr);
+
+#ifdef CONFIG_IPV6_SUBTREES
+                if (matched && saddr)
+                        matched = ipv6_addr_equal(saddr, &rt6->rt6i_src.addr);
+#endif
+                if (matched)
+                        return rt6_ex;
+        }
+        return NULL;
+}
+
+static int rt6_insert_exception(struct rt6_info *nrt,
+                                struct rt6_info *ort)
+{
+        struct net *net = dev_net(ort->dst.dev);
+        struct rt6_exception_bucket *bucket;
+        struct in6_addr *src_key = NULL;
+        struct rt6_exception *rt6_ex;
+        int err = 0;
+
+        /* ort can't be a cache or pcpu route */
+        if (ort->rt6i_flags & (RTF_CACHE | RTF_PCPU))
+                ort = (struct rt6_info *)ort->dst.from;
+        WARN_ON_ONCE(ort->rt6i_flags & (RTF_CACHE | RTF_PCPU));
+
+        spin_lock_bh(&rt6_exception_lock);
+
+        if (ort->exception_bucket_flushed) {
+                err = -EINVAL;
+                goto out;
+        }
+
+        bucket = rcu_dereference_protected(ort->rt6i_exception_bucket,
+                                        lockdep_is_held(&rt6_exception_lock));
+        if (!bucket) {
+                bucket = kcalloc(FIB6_EXCEPTION_BUCKET_SIZE, sizeof(*bucket),
+                                 GFP_ATOMIC);
+                if (!bucket) {
+                        err = -ENOMEM;
+                        goto out;
+                }
+                rcu_assign_pointer(ort->rt6i_exception_bucket, bucket);
+        }
+
+#ifdef CONFIG_IPV6_SUBTREES
+        /* rt6i_src.plen != 0 indicates ort is in subtree
+         * and exception table is indexed by a hash of
+         * both rt6i_dst and rt6i_src.
+         * Otherwise, the exception table is indexed by
+         * a hash of only rt6i_dst.
+         */
+        if (ort->rt6i_src.plen)
+                src_key = &nrt->rt6i_src.addr;
+#endif
+
+        /* Update rt6i_prefsrc as it could be changed
+         * in rt6_remove_prefsrc()
+         */
+        nrt->rt6i_prefsrc = ort->rt6i_prefsrc;
+        /* rt6_mtu_change() might lower mtu on ort.
+         * Only insert this exception route if its mtu
+         * is less than ort's mtu value.
+         */
+        if (nrt->rt6i_pmtu >= dst_mtu(&ort->dst)) {
+                err = -EINVAL;
+                goto out;
+        }
+
+        rt6_ex = __rt6_find_exception_spinlock(&bucket, &nrt->rt6i_dst.addr,
+                                               src_key);
+        if (rt6_ex)
+                rt6_remove_exception(bucket, rt6_ex);
+
+        rt6_ex = kzalloc(sizeof(*rt6_ex), GFP_ATOMIC);
+        if (!rt6_ex) {
+                err = -ENOMEM;
+                goto out;
+        }
+        rt6_ex->rt6i = nrt;
+        rt6_ex->stamp = jiffies;
+        atomic_inc(&nrt->rt6i_ref);
+        nrt->rt6i_node = ort->rt6i_node;
+        hlist_add_head_rcu(&rt6_ex->hlist, &bucket->chain);
+        bucket->depth++;
+        net->ipv6.rt6_stats->fib_rt_cache++;
+
+        if (bucket->depth > FIB6_MAX_DEPTH)
+                rt6_exception_remove_oldest(bucket);
+
+out:
+        spin_unlock_bh(&rt6_exception_lock);
+
+        /* Update fn->fn_sernum to invalidate all cached dst */
+        if (!err) {
+                fib6_update_sernum(ort);
+                fib6_force_start_gc(net);
+        }
+
+        return err;
+}
+
+void rt6_flush_exceptions(struct rt6_info *rt)
+{
+        struct rt6_exception_bucket *bucket;
+        struct rt6_exception *rt6_ex;
+        struct hlist_node *tmp;
+        int i;
+
+        spin_lock_bh(&rt6_exception_lock);
+        /* Prevent rt6_insert_exception() to recreate the bucket list */
+        rt->exception_bucket_flushed = 1;
+
+        bucket = rcu_dereference_protected(rt->rt6i_exception_bucket,
+                                    lockdep_is_held(&rt6_exception_lock));
+        if (!bucket)
+                goto out;
+
+        for (i = 0; i < FIB6_EXCEPTION_BUCKET_SIZE; i++) {
+                hlist_for_each_entry_safe(rt6_ex, tmp, &bucket->chain, hlist)
+                        rt6_remove_exception(bucket, rt6_ex);
+                WARN_ON_ONCE(bucket->depth);
+                bucket++;
+        }
+
+out:
+        spin_unlock_bh(&rt6_exception_lock);
+}
+
+/* Find cached rt in the hash table inside passed in rt
+ * Caller has to hold rcu_read_lock()
+ */
+static struct rt6_info *rt6_find_cached_rt(struct rt6_info *rt,
+                                           struct in6_addr *daddr,
+                                           struct in6_addr *saddr)
+{
+        struct rt6_exception_bucket *bucket;
+        struct in6_addr *src_key = NULL;
+        struct rt6_exception *rt6_ex;
+        struct rt6_info *res = NULL;
+
+        bucket = rcu_dereference(rt->rt6i_exception_bucket);
+
+#ifdef CONFIG_IPV6_SUBTREES
+        /* rt6i_src.plen != 0 indicates rt is in subtree
+         * and exception table is indexed by a hash of
+         * both rt6i_dst and rt6i_src.
+         * Otherwise, the exception table is indexed by
+         * a hash of only rt6i_dst.
+         */
+        if (rt->rt6i_src.plen)
+                src_key = saddr;
+#endif
+        rt6_ex = __rt6_find_exception_rcu(&bucket, daddr, src_key);
+
+        if (rt6_ex && !rt6_check_expired(rt6_ex->rt6i))
+                res = rt6_ex->rt6i;
+
+        return res;
+}
+
+/* Remove the passed in cached rt from the hash table that contains it */
+int rt6_remove_exception_rt(struct rt6_info *rt)
+{
+        struct rt6_info *from = (struct rt6_info *)rt->dst.from;
+        struct rt6_exception_bucket *bucket;
+        struct in6_addr *src_key = NULL;
+        struct rt6_exception *rt6_ex;
+        int err;
+
+        if (!from ||
+            !(rt->rt6i_flags & RTF_CACHE))
+                return -EINVAL;
+
+        if (!rcu_access_pointer(from->rt6i_exception_bucket))
+                return -ENOENT;
+
+        spin_lock_bh(&rt6_exception_lock);
+        bucket = rcu_dereference_protected(from->rt6i_exception_bucket,
+                                    lockdep_is_held(&rt6_exception_lock));
+#ifdef CONFIG_IPV6_SUBTREES
+        /* rt6i_src.plen != 0 indicates 'from' is in subtree
+         * and exception table is indexed by a hash of
+         * both rt6i_dst and rt6i_src.
+         * Otherwise, the exception table is indexed by
+         * a hash of only rt6i_dst.
+         */
+        if (from->rt6i_src.plen)
+                src_key = &rt->rt6i_src.addr;
+#endif
+        rt6_ex = __rt6_find_exception_spinlock(&bucket,
+                                               &rt->rt6i_dst.addr,
+                                               src_key);
+        if (rt6_ex) {
+                rt6_remove_exception(bucket, rt6_ex);
+                err = 0;
+        } else {
+                err = -ENOENT;
+        }
+
+        spin_unlock_bh(&rt6_exception_lock);
+        return err;
+}
+
+/* Find rt6_ex which contains the passed in rt cache and
+ * refresh its stamp
+ */
+static void rt6_update_exception_stamp_rt(struct rt6_info *rt)
+{
+        struct rt6_info *from = (struct rt6_info *)rt->dst.from;
+        struct rt6_exception_bucket *bucket;
+        struct in6_addr *src_key = NULL;
+        struct rt6_exception *rt6_ex;
+
+        if (!from ||
+            !(rt->rt6i_flags & RTF_CACHE))
+                return;
+
+        rcu_read_lock();
+        bucket = rcu_dereference(from->rt6i_exception_bucket);
+
+#ifdef CONFIG_IPV6_SUBTREES
+        /* rt6i_src.plen != 0 indicates 'from' is in subtree
+         * and exception table is indexed by a hash of
+         * both rt6i_dst and rt6i_src.
+         * Otherwise, the exception table is indexed by
+         * a hash of only rt6i_dst.
+         */
+        if (from->rt6i_src.plen)
+                src_key = &rt->rt6i_src.addr;
+#endif
+        rt6_ex = __rt6_find_exception_rcu(&bucket,
+                                          &rt->rt6i_dst.addr,
+                                          src_key);
+        if (rt6_ex)
+                rt6_ex->stamp = jiffies;
+
+        rcu_read_unlock();
+}
+
+static void rt6_exceptions_remove_prefsrc(struct rt6_info *rt)
+{
+        struct rt6_exception_bucket *bucket;
+        struct rt6_exception *rt6_ex;
+        int i;
+
+        bucket = rcu_dereference_protected(rt->rt6i_exception_bucket,
+                                        lockdep_is_held(&rt6_exception_lock));
+
+        if (bucket) {
+                for (i = 0; i < FIB6_EXCEPTION_BUCKET_SIZE; i++) {
+                        hlist_for_each_entry(rt6_ex, &bucket->chain, hlist) {
+                                rt6_ex->rt6i->rt6i_prefsrc.plen = 0;
+                        }
+                        bucket++;
+                }
+        }
+}
+
+static void rt6_exceptions_update_pmtu(struct rt6_info *rt, int mtu)
+{
+        struct rt6_exception_bucket *bucket;
+        struct rt6_exception *rt6_ex;
+        int i;
+
+        bucket = rcu_dereference_protected(rt->rt6i_exception_bucket,
+                                        lockdep_is_held(&rt6_exception_lock));
+
+        if (bucket) {
+                for (i = 0; i < FIB6_EXCEPTION_BUCKET_SIZE; i++) {
+                        hlist_for_each_entry(rt6_ex, &bucket->chain, hlist) {
+                                struct rt6_info *entry = rt6_ex->rt6i;
+                                /* For RTF_CACHE with rt6i_pmtu == 0
+                                 * (i.e. a redirected route),
+                                 * the metrics of its rt->dst.from has already
+                                 * been updated.
+                                 */
+                                if (entry->rt6i_pmtu && entry->rt6i_pmtu > mtu)
+                                        entry->rt6i_pmtu = mtu;
+                        }
+                        bucket++;
+                }
+        }
+}
+
+#define RTF_CACHE_GATEWAY       (RTF_GATEWAY | RTF_CACHE)
+
+static void rt6_exceptions_clean_tohost(struct rt6_info *rt,
+                                        struct in6_addr *gateway)
+{
+        struct rt6_exception_bucket *bucket;
+        struct rt6_exception *rt6_ex;
+        struct hlist_node *tmp;
+        int i;
+
+        if (!rcu_access_pointer(rt->rt6i_exception_bucket))
+                return;
+
+        spin_lock_bh(&rt6_exception_lock);
+        bucket = rcu_dereference_protected(rt->rt6i_exception_bucket,
+                                     lockdep_is_held(&rt6_exception_lock));
+
+        if (bucket) {
+                for (i = 0; i < FIB6_EXCEPTION_BUCKET_SIZE; i++) {
+                        hlist_for_each_entry_safe(rt6_ex, tmp,
+                                                  &bucket->chain, hlist) {
+                                struct rt6_info *entry = rt6_ex->rt6i;
+
+                                if ((entry->rt6i_flags & RTF_CACHE_GATEWAY) ==
+                                    RTF_CACHE_GATEWAY &&
+                                    ipv6_addr_equal(gateway,
+                                                    &entry->rt6i_gateway)) {
+                                        rt6_remove_exception(bucket, rt6_ex);
+                                }
+                        }
+                        bucket++;
+                }
+        }
+
+        spin_unlock_bh(&rt6_exception_lock);
+}
+
+static void rt6_age_examine_exception(struct rt6_exception_bucket *bucket,
+                                      struct rt6_exception *rt6_ex,
+                                      struct fib6_gc_args *gc_args,
+                                      unsigned long now)
+{
+        struct rt6_info *rt = rt6_ex->rt6i;
+
+        /* we are pruning and obsoleting aged-out and non gateway exceptions
+         * even if others have still references to them, so that on next
+         * dst_check() such references can be dropped.
+         * EXPIRES exceptions - e.g. pmtu-generated ones are pruned when
+         * expired, independently from their aging, as per RFC 8201 section 4
+         */
+        if (!(rt->rt6i_flags & RTF_EXPIRES) &&
+            time_after_eq(now, rt->dst.lastuse + gc_args->timeout)) {
+                RT6_TRACE("aging clone %p\n", rt);
+                rt6_remove_exception(bucket, rt6_ex);
+                return;
+        } else if (rt->rt6i_flags & RTF_GATEWAY) {
+                struct neighbour *neigh;
+                __u8 neigh_flags = 0;
+
+                neigh = dst_neigh_lookup(&rt->dst, &rt->rt6i_gateway);
+                if (neigh) {
+                        neigh_flags = neigh->flags;
+                        neigh_release(neigh);
+                }
+                if (!(neigh_flags & NTF_ROUTER)) {
+                        RT6_TRACE("purging route %p via non-router but gateway\n",
+                                  rt);
+                        rt6_remove_exception(bucket, rt6_ex);
+                        return;
+                }
+        } else if (__rt6_check_expired(rt)) {
+                RT6_TRACE("purging expired route %p\n", rt);
+                rt6_remove_exception(bucket, rt6_ex);
+                return;
+        }
+        gc_args->more++;
+}
+
+void rt6_age_exceptions(struct rt6_info *rt,
+                        struct fib6_gc_args *gc_args,
+                        unsigned long now)
+{
+        struct rt6_exception_bucket *bucket;
+        struct rt6_exception *rt6_ex;
+        struct hlist_node *tmp;
+        int i;
+
+        if (!rcu_access_pointer(rt->rt6i_exception_bucket))
+                return;
+
+        spin_lock_bh(&rt6_exception_lock);
+        bucket = rcu_dereference_protected(rt->rt6i_exception_bucket,
+                                    lockdep_is_held(&rt6_exception_lock));
+
+        if (bucket) {
+                for (i = 0; i < FIB6_EXCEPTION_BUCKET_SIZE; i++) {
+                        hlist_for_each_entry_safe(rt6_ex, tmp,
+                                                  &bucket->chain, hlist) {
+                                rt6_age_examine_exception(bucket, rt6_ex,
+                                                          gc_args, now);
+                        }
+                        bucket++;
+                }
+        }
+        spin_unlock_bh(&rt6_exception_lock);
+}
+
 struct rt6_info *ip6_pol_route(struct net *net, struct fib6_table *table,
                                int oif, struct flowi6 *fl6, int flags)
 {
         struct fib6_node *fn, *saved_fn;
-        struct rt6_info *rt;
+        struct rt6_info *rt, *rt_cache;
         int strict = 0;
 
         strict |= flags & RT6_LOOKUP_F_IFACE;
@@ -1103,7 +1650,7 @@ struct rt6_info *ip6_pol_route(struct net *net, struct fib6_table *table,
         if (net->ipv6.devconf_all->forwarding == 0)
                 strict |= RT6_LOOKUP_F_REACHABLE;
 
-        read_lock_bh(&table->tb6_lock);
+        rcu_read_lock();
 
         fn = fib6_lookup(&table->tb6_root, &fl6->daddr, &fl6->saddr);
         saved_fn = fn;
@@ -1112,7 +1659,7 @@ struct rt6_info *ip6_pol_route(struct net *net, struct fib6_table *table,
                 oif = 0;
 
 redo_rt6_select:
-        rt = rt6_select(fn, oif, strict);
+        rt = rt6_select(net, fn, oif, strict);
         if (rt->rt6i_nsiblings)
                 rt = rt6_multipath_select(rt, fl6, oif, strict);
         if (rt == net->ipv6.ip6_null_entry) {
@@ -1127,14 +1674,23 @@ redo_rt6_select:
                 }
         }
 
+        /*Search through exception table */
+        rt_cache = rt6_find_cached_rt(rt, &fl6->daddr, &fl6->saddr);
+        if (rt_cache)
+                rt = rt_cache;
 
-        if (rt == net->ipv6.ip6_null_entry || (rt->rt6i_flags & RTF_CACHE)) {
-                dst_use(&rt->dst, jiffies);
-                read_unlock_bh(&table->tb6_lock);
-
-                rt6_dst_from_metrics_check(rt);
-
-                trace_fib6_table_lookup(net, rt, table->tb6_id, fl6);
+        if (rt == net->ipv6.ip6_null_entry) {
+                rcu_read_unlock();
+                dst_hold(&rt->dst);
+                trace_fib6_table_lookup(net, rt, table, fl6);
+                return rt;
+        } else if (rt->rt6i_flags & RTF_CACHE) {
+                if (ip6_hold_safe(net, &rt, true)) {
+                        dst_use_noref(&rt->dst, jiffies);
+                        rt6_dst_from_metrics_check(rt);
+                }
+                rcu_read_unlock();
+                trace_fib6_table_lookup(net, rt, table, fl6);
                 return rt;
         } else if (unlikely((fl6->flowi6_flags & FLOWI_FLAG_KNOWN_NH) &&
                             !(rt->rt6i_flags & RTF_GATEWAY))) {
@@ -1146,8 +1702,14 @@ redo_rt6_select:
 
                 struct rt6_info *uncached_rt;
 
-                dst_use(&rt->dst, jiffies);
-                read_unlock_bh(&table->tb6_lock);
+                if (ip6_hold_safe(net, &rt, true)) {
+                        dst_use_noref(&rt->dst, jiffies);
+                } else {
+                        rcu_read_unlock();
+                        uncached_rt = rt;
+                        goto uncached_rt_out;
+                }
+                rcu_read_unlock();
 
                 uncached_rt = ip6_rt_cache_alloc(rt, &fl6->daddr, NULL);
                 dst_release(&rt->dst);
@@ -1157,12 +1719,14 @@ redo_rt6_select:
                          * No need for another dst_hold()
                          */
                         rt6_uncached_list_add(uncached_rt);
+                        atomic_inc(&net->ipv6.rt6_stats->fib_rt_uncache);
                 } else {
                         uncached_rt = net->ipv6.ip6_null_entry;
                         dst_hold(&uncached_rt->dst);
                 }
 
-                trace_fib6_table_lookup(net, uncached_rt, table->tb6_id, fl6);
+uncached_rt_out:
+                trace_fib6_table_lookup(net, uncached_rt, table, fl6);
                 return uncached_rt;
 
         } else {
@@ -1170,26 +1734,28 @@ redo_rt6_select:
 
                 struct rt6_info *pcpu_rt;
 
-                rt->dst.lastuse = jiffies;
-                rt->dst.__use++;
+                dst_use_noref(&rt->dst, jiffies);
+                local_bh_disable();
                 pcpu_rt = rt6_get_pcpu_route(rt);
 
-                if (pcpu_rt) {
-                        read_unlock_bh(&table->tb6_lock);
-                } else {
-                        /* We have to do the read_unlock first
-                         * because rt6_make_pcpu_route() may trigger
-                         * ip6_dst_gc() which will take the write_lock.
-                         */
-                        dst_hold(&rt->dst);
-                        read_unlock_bh(&table->tb6_lock);
-                        pcpu_rt = rt6_make_pcpu_route(rt);
-                        dst_release(&rt->dst);
+                if (!pcpu_rt) {
+                        /* atomic_inc_not_zero() is needed when using rcu */
+                        if (atomic_inc_not_zero(&rt->rt6i_ref)) {
+                                /* No dst_hold() on rt is needed because grabbing
+                                 * rt->rt6i_ref makes sure rt can't be released.
+                                 */
+                                pcpu_rt = rt6_make_pcpu_route(rt);
+                                rt6_release(rt);
+                        } else {
+                                /* rt is already removed from tree */
+                                pcpu_rt = net->ipv6.ip6_null_entry;
+                                dst_hold(&pcpu_rt->dst);
+                        }
                 }
-
-                trace_fib6_table_lookup(net, pcpu_rt, table->tb6_id, fl6);
+                local_bh_enable();
+                rcu_read_unlock();
+                trace_fib6_table_lookup(net, pcpu_rt, table, fl6);
                 return pcpu_rt;
-
         }
 }
 EXPORT_SYMBOL_GPL(ip6_pol_route);
@@ -1328,6 +1894,7 @@ struct dst_entry *ip6_blackhole_route(struct net *net, struct dst_entry *dst_ori
                        DST_OBSOLETE_DEAD, 0);
         if (rt) {
                 rt6_info_init(rt);
+                atomic_inc(&net->ipv6.rt6_stats->fib_rt_alloc);
 
                 new = &rt->dst;
                 new->__use = 1;
@@ -1491,23 +2058,17 @@ static void __ip6_rt_update_pmtu(struct dst_entry *dst, const struct sock *sk,
 
         if (!rt6_cache_allowed_for_pmtu(rt6)) {
                 rt6_do_update_pmtu(rt6, mtu);
+                /* update rt6_ex->stamp for cache */
+                if (rt6->rt6i_flags & RTF_CACHE)
+                        rt6_update_exception_stamp_rt(rt6);
         } else if (daddr) {
                 struct rt6_info *nrt6;
 
                 nrt6 = ip6_rt_cache_alloc(rt6, daddr, saddr);
                 if (nrt6) {
                         rt6_do_update_pmtu(nrt6, mtu);
-
-                        /* ip6_ins_rt(nrt6) will bump the
-                         * rt6->rt6i_node->fn_sernum
-                         * which will fail the next rt6_check() and
-                         * invalidate the sk->sk_dst_cache.
-                         */
-                        ip6_ins_rt(nrt6);
-                        /* Release the reference taken in
-                         * ip6_rt_cache_alloc()
-                         */
-                        dst_release(&nrt6->dst);
+                        if (rt6_insert_exception(nrt6, rt6))
+                                dst_release_immediate(&nrt6->dst);
                 }
         }
 }
@@ -1571,7 +2132,7 @@ static struct rt6_info *__ip6_route_redirect(struct net *net,
                                              int flags)
 {
         struct ip6rd_flowi *rdfl = (struct ip6rd_flowi *)fl6;
-        struct rt6_info *rt;
+        struct rt6_info *rt, *rt_cache;
         struct fib6_node *fn;
 
         /* Get the "current" route for this destination and
@@ -1584,10 +2145,10 @@ static struct rt6_info *__ip6_route_redirect(struct net *net,
          * routes.
          */
 
-        read_lock_bh(&table->tb6_lock);
+        rcu_read_lock();
         fn = fib6_lookup(&table->tb6_root, &fl6->daddr, &fl6->saddr);
 restart:
-        for (rt = fn->leaf; rt; rt = rt->dst.rt6_next) {
+        for_each_fib6_node_rt_rcu(fn) {
                 if (rt6_check_expired(rt))
                         continue;
                 if (rt->dst.error)
@@ -1596,8 +2157,23 @@ restart:
                         continue;
                 if (fl6->flowi6_oif != rt->dst.dev->ifindex)
                         continue;
-                if (!ipv6_addr_equal(&rdfl->gateway, &rt->rt6i_gateway))
+                /* rt_cache's gateway might be different from its 'parent'
+                 * in the case of an ip redirect.
+                 * So we keep searching in the exception table if the gateway
+                 * is different.
+                 */
+                if (!ipv6_addr_equal(&rdfl->gateway, &rt->rt6i_gateway)) {
+                        rt_cache = rt6_find_cached_rt(rt,
+                                                      &fl6->daddr,
+                                                      &fl6->saddr);
+                        if (rt_cache &&
+                            ipv6_addr_equal(&rdfl->gateway,
+                                            &rt_cache->rt6i_gateway)) {
+                                rt = rt_cache;
+                                break;
+                        }
                         continue;
+                }
                 break;
         }
 
@@ -1615,11 +2191,11 @@ restart:
         }
 
 out:
-        dst_hold(&rt->dst);
+        ip6_hold_safe(net, &rt, true);
 
-        read_unlock_bh(&table->tb6_lock);
+        rcu_read_unlock();
 
-        trace_fib6_table_lookup(net, rt, table->tb6_id, fl6);
+        trace_fib6_table_lookup(net, rt, table, fl6);
         return rt;
 };
 
@@ -1766,6 +2342,7 @@ struct dst_entry *icmp6_dst_alloc(struct net_device *dev,
          * do proper release of the net_device
          */
         rt6_uncached_list_add(rt);
+        atomic_inc(&net->ipv6.rt6_stats->fib_rt_uncache);
 
         dst = xfrm_lookup(net, &rt->dst, flowi6_to_flowi(fl6), NULL, 0);
 
@@ -1801,6 +2378,7 @@ out:
 static int ip6_convert_metrics(struct mx6_config *mxc,
                                const struct fib6_config *cfg)
 {
+        struct net *net = cfg->fc_nlinfo.nl_net;
         bool ecn_ca = false;
         struct nlattr *nla;
         int remaining;
@@ -1826,7 +2404,7 @@ static int ip6_convert_metrics(struct mx6_config *mxc,
                         char tmp[TCP_CA_NAME_MAX];
 
                         nla_strlcpy(tmp, nla, sizeof(tmp));
-                        val = tcp_ca_get_key_by_name(tmp, &ecn_ca);
+                        val = tcp_ca_get_key_by_name(net, tmp, &ecn_ca);
                         if (val == TCP_CA_UNSPEC)
                                 goto err;
                 } else {
@@ -1901,6 +2479,12 @@ static struct rt6_info *ip6_route_info_create(struct fib6_config *cfg,
                 goto out;
         }
 
+        /* RTF_CACHE is an internal flag; can not be set by userspace */
+        if (cfg->fc_flags & RTF_CACHE) {
+                NL_SET_ERR_MSG(extack, "Userspace can not set RTF_CACHE");
+                goto out;
+        }
+
         if (cfg->fc_dst_len > 128) {
                 NL_SET_ERR_MSG(extack, "Invalid prefix length");
                 goto out;
@@ -2216,9 +2800,9 @@ static int __ip6_del_rt(struct rt6_info *rt, struct nl_info *info)
         }
 
         table = rt->rt6i_table;
-        write_lock_bh(&table->tb6_lock);
+        spin_lock_bh(&table->tb6_lock);
         err = fib6_del(rt, info);
-        write_unlock_bh(&table->tb6_lock);
+        spin_unlock_bh(&table->tb6_lock);
 
 out:
         ip6_rt_put(rt);
@@ -2244,7 +2828,7 @@ static int __ip6_del_rt_siblings(struct rt6_info *rt, struct fib6_config *cfg)
         if (rt == net->ipv6.ip6_null_entry)
                 goto out_put;
         table = rt->rt6i_table;
-        write_lock_bh(&table->tb6_lock);
+        spin_lock_bh(&table->tb6_lock);
 
         if (rt->rt6i_nsiblings && cfg->fc_delete_all_nh) {
                 struct rt6_info *sibling, *next_sibling;
@@ -2274,7 +2858,7 @@ static int __ip6_del_rt_siblings(struct rt6_info *rt, struct fib6_config *cfg)
 
         err = fib6_del(rt, info);
 out_unlock:
-        write_unlock_bh(&table->tb6_lock);
+        spin_unlock_bh(&table->tb6_lock);
 out_put:
         ip6_rt_put(rt);
 
@@ -2288,9 +2872,9 @@ out_put:
 static int ip6_route_del(struct fib6_config *cfg,
                          struct netlink_ext_ack *extack)
 {
+        struct rt6_info *rt, *rt_cache;
         struct fib6_table *table;
         struct fib6_node *fn;
-        struct rt6_info *rt;
         int err = -ESRCH;
 
         table = fib6_get_table(cfg->fc_nlinfo.nl_net, cfg->fc_table);
@@ -2299,17 +2883,22 @@ static int ip6_route_del(struct fib6_config *cfg,
                 return err;
         }
 
-        read_lock_bh(&table->tb6_lock);
+        rcu_read_lock();
 
         fn = fib6_locate(&table->tb6_root,
                          &cfg->fc_dst, cfg->fc_dst_len,
-                         &cfg->fc_src, cfg->fc_src_len);
+                         &cfg->fc_src, cfg->fc_src_len,
+                         !(cfg->fc_flags & RTF_CACHE));
 
         if (fn) {
-                for (rt = fn->leaf; rt; rt = rt->dst.rt6_next) {
-                        if ((rt->rt6i_flags & RTF_CACHE) &&
-                            !(cfg->fc_flags & RTF_CACHE))
-                                continue;
+                for_each_fib6_node_rt_rcu(fn) {
+                        if (cfg->fc_flags & RTF_CACHE) {
+                                rt_cache = rt6_find_cached_rt(rt, &cfg->fc_dst,
+                                                              &cfg->fc_src);
+                                if (!rt_cache)
+                                        continue;
+                                rt = rt_cache;
+                        }
                         if (cfg->fc_ifindex &&
                             (!rt->dst.dev ||
                              rt->dst.dev->ifindex != cfg->fc_ifindex))
@@ -2321,8 +2910,9 @@ static int ip6_route_del(struct fib6_config *cfg,
                                 continue;
                         if (cfg->fc_protocol && cfg->fc_protocol != rt->rt6i_protocol)
                                 continue;
-                        dst_hold(&rt->dst);
-                        read_unlock_bh(&table->tb6_lock);
+                        if (!dst_hold_safe(&rt->dst))
+                                break;
+                        rcu_read_unlock();
 
                         /* if gateway was specified only delete the one hop */
                         if (cfg->fc_flags & RTF_GATEWAY)
@@ -2331,7 +2921,7 @@ static int ip6_route_del(struct fib6_config *cfg,
                         return __ip6_del_rt_siblings(rt, cfg);
                 }
         }
-        read_unlock_bh(&table->tb6_lock);
+        rcu_read_unlock();
 
         return err;
 }
@@ -2435,8 +3025,14 @@ static void rt6_do_redirect(struct dst_entry *dst, struct sock *sk, struct sk_bu
         nrt->rt6i_protocol = RTPROT_REDIRECT;
         nrt->rt6i_gateway = *(struct in6_addr *)neigh->primary_key;
 
-        if (ip6_ins_rt(nrt))
-                goto out_release;
+        /* No need to remove rt from the exception table if rt is
+         * a cached route because rt6_insert_exception() will
+         * takes care of it
+         */
+        if (rt6_insert_exception(nrt, rt)) {
+                dst_release_immediate(&nrt->dst);
+                goto out;
+        }
 
         netevent.old = &rt->dst;
         netevent.new = &nrt->dst;
@@ -2444,17 +3040,6 @@ static void rt6_do_redirect(struct dst_entry *dst, struct sock *sk, struct sk_bu
         netevent.neigh = neigh;
         call_netevent_notifiers(NETEVENT_REDIRECT, &netevent);
 
-        if (rt->rt6i_flags & RTF_CACHE) {
-                rt = (struct rt6_info *) dst_clone(&rt->dst);
-                ip6_del_rt(rt);
-        }
-
-out_release:
-        /* Release the reference taken in
-         * ip6_rt_cache_alloc()
-         */
-        dst_release(&nrt->dst);
-
 out:
         neigh_release(neigh);
 }
@@ -2511,23 +3096,23 @@ static struct rt6_info *rt6_get_route_info(struct net *net,
         if (!table)
                 return NULL;
 
-        read_lock_bh(&table->tb6_lock);
-        fn = fib6_locate(&table->tb6_root, prefix, prefixlen, NULL, 0);
+        rcu_read_lock();
+        fn = fib6_locate(&table->tb6_root, prefix, prefixlen, NULL, 0, true);
         if (!fn)
                 goto out;
 
-        for (rt = fn->leaf; rt; rt = rt->dst.rt6_next) {
+        for_each_fib6_node_rt_rcu(fn) {
                 if (rt->dst.dev->ifindex != ifindex)
                         continue;
                 if ((rt->rt6i_flags & (RTF_ROUTEINFO|RTF_GATEWAY)) != (RTF_ROUTEINFO|RTF_GATEWAY))
                         continue;
                 if (!ipv6_addr_equal(&rt->rt6i_gateway, gwaddr))
                         continue;
-                dst_hold(&rt->dst);
+                ip6_hold_safe(NULL, &rt, false);
                 break;
         }
 out:
-        read_unlock_bh(&table->tb6_lock);
+        rcu_read_unlock();
         return rt;
 }
 
@@ -2573,16 +3158,16 @@ struct rt6_info *rt6_get_dflt_router(const struct in6_addr *addr, struct net_dev
         if (!table)
                 return NULL;
 
-        read_lock_bh(&table->tb6_lock);
-        for (rt = table->tb6_root.leaf; rt; rt = rt->dst.rt6_next) {
+        rcu_read_lock();
+        for_each_fib6_node_rt_rcu(&table->tb6_root) {
                 if (dev == rt->dst.dev &&
                     ((rt->rt6i_flags & (RTF_ADDRCONF | RTF_DEFAULT)) == (RTF_ADDRCONF | RTF_DEFAULT)) &&
                     ipv6_addr_equal(&rt->rt6i_gateway, addr))
                         break;
         }
         if (rt)
-                dst_hold(&rt->dst);
-        read_unlock_bh(&table->tb6_lock);
+                ip6_hold_safe(NULL, &rt, false);
+        rcu_read_unlock();
         return rt;
 }
 
@@ -2620,17 +3205,20 @@ static void __rt6_purge_dflt_routers(struct fib6_table *table)
         struct rt6_info *rt;
 
 restart:
-        read_lock_bh(&table->tb6_lock);
-        for (rt = table->tb6_root.leaf; rt; rt = rt->dst.rt6_next) {
+        rcu_read_lock();
+        for_each_fib6_node_rt_rcu(&table->tb6_root) {
                 if (rt->rt6i_flags & (RTF_DEFAULT | RTF_ADDRCONF) &&
                     (!rt->rt6i_idev || rt->rt6i_idev->cnf.accept_ra != 2)) {
-                        dst_hold(&rt->dst);
-                        read_unlock_bh(&table->tb6_lock);
-                        ip6_del_rt(rt);
+                        if (dst_hold_safe(&rt->dst)) {
+                                rcu_read_unlock();
+                                ip6_del_rt(rt);
+                        } else {
+                                rcu_read_unlock();
+                        }
                         goto restart;
                 }
         }
-        read_unlock_bh(&table->tb6_lock);
+        rcu_read_unlock();
 
         table->flags &= ~RT6_TABLE_HAS_DFLT_ROUTER;
 }
@@ -2818,8 +3406,12 @@ static int fib6_remove_prefsrc(struct rt6_info *rt, void *arg)
         if (((void *)rt->dst.dev == dev || !dev) &&
             rt != net->ipv6.ip6_null_entry &&
             ipv6_addr_equal(addr, &rt->rt6i_prefsrc.addr)) {
+                spin_lock_bh(&rt6_exception_lock);
                 /* remove prefsrc entry */
                 rt->rt6i_prefsrc.plen = 0;
+                /* need to update cache as well */
+                rt6_exceptions_remove_prefsrc(rt);
+                spin_unlock_bh(&rt6_exception_lock);
         }
         return 0;
 }
@@ -2836,18 +3428,23 @@ void rt6_remove_prefsrc(struct inet6_ifaddr *ifp)
 }
 
 #define RTF_RA_ROUTER           (RTF_ADDRCONF | RTF_DEFAULT | RTF_GATEWAY)
-#define RTF_CACHE_GATEWAY       (RTF_GATEWAY | RTF_CACHE)
 
 /* Remove routers and update dst entries when gateway turn into host. */
 static int fib6_clean_tohost(struct rt6_info *rt, void *arg)
 {
         struct in6_addr *gateway = (struct in6_addr *)arg;
 
-        if ((((rt->rt6i_flags & RTF_RA_ROUTER) == RTF_RA_ROUTER) ||
-             ((rt->rt6i_flags & RTF_CACHE_GATEWAY) == RTF_CACHE_GATEWAY)) &&
-             ipv6_addr_equal(gateway, &rt->rt6i_gateway)) {
+        if (((rt->rt6i_flags & RTF_RA_ROUTER) == RTF_RA_ROUTER) &&
+            ipv6_addr_equal(gateway, &rt->rt6i_gateway)) {
                 return -1;
         }
+
+        /* Further clean up cached routes in exception table.
+         * This is needed because cached route may have a different
+         * gateway than its 'parent' in the case of an ip redirect.
+         */
+        rt6_exceptions_clean_tohost(rt, gateway);
+
         return 0;
 }
 
@@ -2926,19 +3523,14 @@ static int rt6_mtu_change_route(struct rt6_info *rt, void *p_arg)
         if (rt->dst.dev == arg->dev &&
             dst_metric_raw(&rt->dst, RTAX_MTU) &&
             !dst_metric_locked(&rt->dst, RTAX_MTU)) {
-                if (rt->rt6i_flags & RTF_CACHE) {
-                        /* For RTF_CACHE with rt6i_pmtu == 0
-                         * (i.e. a redirected route),
-                         * the metrics of its rt->dst.from has already
-                         * been updated.
-                         */
-                        if (rt->rt6i_pmtu && rt->rt6i_pmtu > arg->mtu)
-                                rt->rt6i_pmtu = arg->mtu;
-                } else if (dst_mtu(&rt->dst) >= arg->mtu ||
-                           (dst_mtu(&rt->dst) < arg->mtu &&
-                            dst_mtu(&rt->dst) == idev->cnf.mtu6)) {
+                spin_lock_bh(&rt6_exception_lock);
+                if (dst_mtu(&rt->dst) >= arg->mtu ||
+                    (dst_mtu(&rt->dst) < arg->mtu &&
+                     dst_mtu(&rt->dst) == idev->cnf.mtu6)) {
                         dst_metric_set(&rt->dst, RTAX_MTU, arg->mtu);
                 }
+                rt6_exceptions_update_pmtu(rt, arg->mtu);
+                spin_unlock_bh(&rt6_exception_lock);
         }
         return 0;
 }
@@ -3839,7 +4431,7 @@ static int rt6_stats_seq_show(struct seq_file *seq, void *v)
         seq_printf(seq, "%04x %04x %04x %04x %04x %04x %04x\n",
                    net->ipv6.rt6_stats->fib_nodes,
                    net->ipv6.rt6_stats->fib_route_nodes,
-                   net->ipv6.rt6_stats->fib_rt_alloc,
+                   atomic_read(&net->ipv6.rt6_stats->fib_rt_alloc),
                    net->ipv6.rt6_stats->fib_rt_entries,
                    net->ipv6.rt6_stats->fib_rt_cache,
                    dst_entries_get_slow(&net->ipv6.ip6_dst_ops),
diff --git a/net/ipv6/sit.c b/net/ipv6/sit.c
index ac912bb21747..d60ddcb0bfe2 100644
--- a/net/ipv6/sit.c
+++ b/net/ipv6/sit.c
@@ -91,29 +91,35 @@ struct sit_net {
  * Must be invoked with rcu_read_lock
  */
 static struct ip_tunnel *ipip6_tunnel_lookup(struct net *net,
-                struct net_device *dev, __be32 remote, __be32 local)
+                                             struct net_device *dev,
+                                             __be32 remote, __be32 local,
+                                             int sifindex)
 {
         unsigned int h0 = HASH(remote);
         unsigned int h1 = HASH(local);
         struct ip_tunnel *t;
         struct sit_net *sitn = net_generic(net, sit_net_id);
+        int ifindex = dev ? dev->ifindex : 0;
 
         for_each_ip_tunnel_rcu(t, sitn->tunnels_r_l[h0 ^ h1]) {
                 if (local == t->parms.iph.saddr &&
                     remote == t->parms.iph.daddr &&
-                    (!dev || !t->parms.link || dev->ifindex == t->parms.link) &&
+                    (!dev || !t->parms.link || ifindex == t->parms.link ||
+                     sifindex == t->parms.link) &&
                     (t->dev->flags & IFF_UP))
                         return t;
         }
         for_each_ip_tunnel_rcu(t, sitn->tunnels_r[h0]) {
                 if (remote == t->parms.iph.daddr &&
-                    (!dev || !t->parms.link || dev->ifindex == t->parms.link) &&
+                    (!dev || !t->parms.link || ifindex == t->parms.link ||
+                     sifindex == t->parms.link) &&
                     (t->dev->flags & IFF_UP))
                         return t;
         }
         for_each_ip_tunnel_rcu(t, sitn->tunnels_l[h1]) {
                 if (local == t->parms.iph.saddr &&
-                    (!dev || !t->parms.link || dev->ifindex == t->parms.link) &&
+                    (!dev || !t->parms.link || ifindex == t->parms.link ||
+                     sifindex == t->parms.link) &&
                     (t->dev->flags & IFF_UP))
                         return t;
         }
@@ -486,6 +492,7 @@ static int ipip6_err(struct sk_buff *skb, u32 info)
         const int code = icmp_hdr(skb)->code;
         unsigned int data_len = 0;
         struct ip_tunnel *t;
+        int sifindex;
         int err;
 
         switch (type) {
@@ -517,10 +524,9 @@ static int ipip6_err(struct sk_buff *skb, u32 info)
 
         err = -ENOENT;
 
-        t = ipip6_tunnel_lookup(dev_net(skb->dev),
-                                skb->dev,
-                                iph->daddr,
-                                iph->saddr);
+        sifindex = netif_is_l3_master(skb->dev) ? IPCB(skb)->iif : 0;
+        t = ipip6_tunnel_lookup(dev_net(skb->dev), skb->dev,
+                                iph->daddr, iph->saddr, sifindex);
         if (!t)
                 goto out;
 
@@ -633,10 +639,12 @@ static int ipip6_rcv(struct sk_buff *skb)
 {
         const struct iphdr *iph = ip_hdr(skb);
         struct ip_tunnel *tunnel;
+        int sifindex;
         int err;
 
+        sifindex = netif_is_l3_master(skb->dev) ? IPCB(skb)->iif : 0;
         tunnel = ipip6_tunnel_lookup(dev_net(skb->dev), skb->dev,
-                                     iph->saddr, iph->daddr);
+                                     iph->saddr, iph->daddr, sifindex);
         if (tunnel) {
                 struct pcpu_sw_netstats *tstats;
 
@@ -704,10 +712,13 @@ static int sit_tunnel_rcv(struct sk_buff *skb, u8 ipproto)
 {
         const struct iphdr *iph;
         struct ip_tunnel *tunnel;
+        int sifindex;
+
+        sifindex = netif_is_l3_master(skb->dev) ? IPCB(skb)->iif : 0;
 
         iph = ip_hdr(skb);
         tunnel = ipip6_tunnel_lookup(dev_net(skb->dev), skb->dev,
-                                     iph->saddr, iph->daddr);
+                                     iph->saddr, iph->daddr, sifindex);
         if (tunnel) {
                 const struct tnl_ptk_info *tpi;
 
@@ -1848,19 +1859,22 @@ err_alloc_dev:
         return err;
 }
 
-static void __net_exit sit_exit_net(struct net *net)
+static void __net_exit sit_exit_batch_net(struct list_head *net_list)
 {
         LIST_HEAD(list);
+        struct net *net;
 
         rtnl_lock();
-        sit_destroy_tunnels(net, &list);
+        list_for_each_entry(net, net_list, exit_list)
+                sit_destroy_tunnels(net, &list);
+
         unregister_netdevice_many(&list);
         rtnl_unlock();
 }
 
 static struct pernet_operations sit_net_ops = {
         .init = sit_init_net,
-        .exit = sit_exit_net,
+        .exit_batch = sit_exit_batch_net,
         .id   = &sit_net_id,
         .size = sizeof(struct sit_net),
 };
diff --git a/net/ipv6/syncookies.c b/net/ipv6/syncookies.c
index 4e7817abc0b9..e7a3a6b6cf56 100644
--- a/net/ipv6/syncookies.c
+++ b/net/ipv6/syncookies.c
@@ -244,7 +244,7 @@ struct sock *cookie_v6_check(struct sock *sk, struct sk_buff *skb)
         }
 
         req->rsk_window_clamp = tp->window_clamp ? :dst_metric(dst, RTAX_WINDOW);
-        tcp_select_initial_window(tcp_full_space(sk), req->mss,
+        tcp_select_initial_window(sk, tcp_full_space(sk), req->mss,
                                   &req->rsk_rcv_wnd, &req->rsk_window_clamp,
                                   ireq->wscale_ok, &rcv_wscale,
                                   dst_metric(dst, RTAX_INITRWND));
diff --git a/net/ipv6/sysctl_net_ipv6.c b/net/ipv6/sysctl_net_ipv6.c
index f7051ba5b8af..a789a8ac6a64 100644
--- a/net/ipv6/sysctl_net_ipv6.c
+++ b/net/ipv6/sysctl_net_ipv6.c
@@ -98,6 +98,34 @@ static struct ctl_table ipv6_table_template[] = {
                 .mode           = 0644,
                 .proc_handler   = proc_dointvec,
         },
+        {
+                .procname       = "max_dst_opts_number",
+                .data           = &init_net.ipv6.sysctl.max_dst_opts_cnt,
+                .maxlen         = sizeof(int),
+                .mode           = 0644,
+                .proc_handler   = proc_dointvec
+        },
+        {
+                .procname       = "max_hbh_opts_number",
+                .data           = &init_net.ipv6.sysctl.max_hbh_opts_cnt,
+                .maxlen         = sizeof(int),
+                .mode           = 0644,
+                .proc_handler   = proc_dointvec
+        },
+        {
+                .procname       = "max_dst_opts_length",
+                .data           = &init_net.ipv6.sysctl.max_dst_opts_len,
+                .maxlen         = sizeof(int),
+                .mode           = 0644,
+                .proc_handler   = proc_dointvec
+        },
+        {
+                .procname       = "max_hbh_length",
+                .data           = &init_net.ipv6.sysctl.max_hbh_opts_len,
+                .maxlen         = sizeof(int),
+                .mode           = 0644,
+                .proc_handler   = proc_dointvec
+        },
         { }
 };
 
@@ -158,6 +186,10 @@ static int __net_init ipv6_sysctl_net_init(struct net *net)
         ipv6_table[7].data = &net->ipv6.sysctl.flowlabel_state_ranges;
         ipv6_table[8].data = &net->ipv6.sysctl.ip_nonlocal_bind;
         ipv6_table[9].data = &net->ipv6.sysctl.flowlabel_reflect;
+        ipv6_table[10].data = &net->ipv6.sysctl.max_dst_opts_cnt;
+        ipv6_table[11].data = &net->ipv6.sysctl.max_hbh_opts_cnt;
+        ipv6_table[12].data = &net->ipv6.sysctl.max_dst_opts_len;
+        ipv6_table[13].data = &net->ipv6.sysctl.max_hbh_opts_len;
 
         ipv6_route_table = ipv6_route_sysctl_init(net);
         if (!ipv6_route_table)
diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
index 64d94afa427f..6bb98c93edfe 100644
--- a/net/ipv6/tcp_ipv6.c
+++ b/net/ipv6/tcp_ipv6.c
@@ -69,6 +69,8 @@
 #include <crypto/hash.h>
 #include <linux/scatterlist.h>
 
+#include <trace/events/tcp.h>
+
 static void     tcp_v6_send_reset(const struct sock *sk, struct sk_buff *skb);
 static void     tcp_v6_reqsk_send_ack(const struct sock *sk, struct sk_buff *skb,
                                       struct request_sock *req);
@@ -890,7 +892,7 @@ static void tcp_v6_send_reset(const struct sock *sk, struct sk_buff *skb)
         int genhash;
         struct sock *sk1 = NULL;
 #endif
-        int oif;
+        int oif = 0;
 
         if (th->rst)
                 return;
@@ -939,7 +941,11 @@ static void tcp_v6_send_reset(const struct sock *sk, struct sk_buff *skb)
                 ack_seq = ntohl(th->seq) + th->syn + th->fin + skb->len -
                           (th->doff << 2);
 
-        oif = sk ? sk->sk_bound_dev_if : 0;
+        if (sk) {
+                oif = sk->sk_bound_dev_if;
+                trace_tcp_send_reset(sk, skb);
+        }
+
         tcp_v6_send_response(sk, skb, seq, ack_seq, 0, 0, 0, oif, key, 1, 0, 0);
 
 #ifdef CONFIG_TCP_MD5SIG
@@ -1577,8 +1583,9 @@ do_time_wait:
                         refcounted = false;
                         goto process;
                 }
-                /* Fall through to ACK */
         }
+                /* to ACK */
+                /* fall through */
         case TCP_TW_ACK:
                 tcp_v6_timewait_ack(sk, skb);
                 break;
@@ -1933,8 +1940,8 @@ struct proto tcpv6_prot = {
         .memory_pressure        = &tcp_memory_pressure,
         .orphan_count           = &tcp_orphan_count,
         .sysctl_mem             = sysctl_tcp_mem,
-        .sysctl_wmem            = sysctl_tcp_wmem,
-        .sysctl_rmem            = sysctl_tcp_rmem,
+        .sysctl_wmem_offset     = offsetof(struct net, ipv4.sysctl_tcp_wmem),
+        .sysctl_rmem_offset     = offsetof(struct net, ipv4.sysctl_tcp_rmem),
         .max_header             = MAX_TCP_HEADER,
         .obj_size               = sizeof(struct tcp6_sock),
         .slab_flags             = SLAB_TYPESAFE_BY_RCU,
diff --git a/net/ipv6/xfrm6_policy.c b/net/ipv6/xfrm6_policy.c
index 17e95a0386b3..885ade234a49 100644
--- a/net/ipv6/xfrm6_policy.c
+++ b/net/ipv6/xfrm6_policy.c
@@ -153,6 +153,7 @@ _decode_session6(struct sk_buff *skb, struct flowi *fl, int reverse)
                 switch (nexthdr) {
                 case NEXTHDR_FRAGMENT:
                         onlyproto = 1;
+                        /* fall through */
                 case NEXTHDR_ROUTING:
                 case NEXTHDR_HOP:
                 case NEXTHDR_DEST:
diff --git a/net/ipv6/xfrm6_tunnel.c b/net/ipv6/xfrm6_tunnel.c
index 4e438bc7ee87..f85f0d7480ac 100644
--- a/net/ipv6/xfrm6_tunnel.c
+++ b/net/ipv6/xfrm6_tunnel.c
@@ -338,6 +338,14 @@ static int __net_init xfrm6_tunnel_net_init(struct net *net)
 
 static void __net_exit xfrm6_tunnel_net_exit(struct net *net)
 {
+        struct xfrm6_tunnel_net *xfrm6_tn = xfrm6_tunnel_pernet(net);
+        unsigned int i;
+
+        for (i = 0; i < XFRM6_TUNNEL_SPI_BYADDR_HSIZE; i++)
+                WARN_ON_ONCE(!hlist_empty(&xfrm6_tn->spi_byaddr[i]));
+
+        for (i = 0; i < XFRM6_TUNNEL_SPI_BYSPI_HSIZE; i++)
+                WARN_ON_ONCE(!hlist_empty(&xfrm6_tn->spi_byspi[i]));
 }
 
 static struct pernet_operations xfrm6_tunnel_net_ops = {
diff --git a/net/ipx/af_ipx.c b/net/ipx/af_ipx.c
index ac598ec90589..d21a9d128d3e 100644
--- a/net/ipx/af_ipx.c
+++ b/net/ipx/af_ipx.c
@@ -1867,6 +1867,7 @@ static int ipx_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
                 rc = -EPERM;
                 if (!capable(CAP_NET_ADMIN))
                         break;
+                /* fall through */
         case SIOCGIFADDR:
                 rc = ipxitf_ioctl(cmd, argp);
                 break;
diff --git a/net/kcm/kcmsock.c b/net/kcm/kcmsock.c
index af4e76ac88ff..0b750a22c4b9 100644
--- a/net/kcm/kcmsock.c
+++ b/net/kcm/kcmsock.c
@@ -1650,7 +1650,7 @@ static int kcm_clone(struct socket *osock, struct kcm_clone *info,
         }
 
         newfile = sock_alloc_file(newsock, 0, osock->sk->sk_prot_creator->name);
-        if (unlikely(IS_ERR(newfile))) {
+        if (IS_ERR(newfile)) {
                 err = PTR_ERR(newfile);
                 goto out_sock_alloc_fail;
         }
diff --git a/net/key/af_key.c b/net/key/af_key.c
index a00d607e7224..3dffb892d52c 100644
--- a/net/key/af_key.c
+++ b/net/key/af_key.c
@@ -3845,7 +3845,7 @@ static void __net_exit pfkey_net_exit(struct net *net)
         struct netns_pfkey *net_pfkey = net_generic(net, pfkey_net_id);
 
         pfkey_exit_proc(net);
-        BUG_ON(!hlist_empty(&net_pfkey->table));
+        WARN_ON(!hlist_empty(&net_pfkey->table));
 }
 
 static struct pernet_operations pfkey_net_ops = {
diff --git a/net/l2tp/l2tp_core.c b/net/l2tp/l2tp_core.c
index 02d61101b108..115918ad8eca 100644
--- a/net/l2tp/l2tp_core.c
+++ b/net/l2tp/l2tp_core.c
@@ -100,8 +100,6 @@ struct l2tp_skb_cb {
 
 #define L2TP_SKB_CB(skb)        ((struct l2tp_skb_cb *) &skb->cb[sizeof(struct inet_skb_parm)])
 
-static atomic_t l2tp_tunnel_count;
-static atomic_t l2tp_session_count;
 static struct workqueue_struct *l2tp_wq;
 
 /* per-net private data for this module */
@@ -216,12 +214,10 @@ struct l2tp_tunnel *l2tp_tunnel_get(const struct net *net, u32 tunnel_id)
 }
 EXPORT_SYMBOL_GPL(l2tp_tunnel_get);
 
-/* Lookup a session. A new reference is held on the returned session.
- * Optionally calls session->ref() too if do_ref is true.
- */
+/* Lookup a session. A new reference is held on the returned session. */
 struct l2tp_session *l2tp_session_get(const struct net *net,
                                       struct l2tp_tunnel *tunnel,
-                                      u32 session_id, bool do_ref)
+                                      u32 session_id)
 {
         struct hlist_head *session_list;
         struct l2tp_session *session;
@@ -235,8 +231,6 @@ struct l2tp_session *l2tp_session_get(const struct net *net,
                 hlist_for_each_entry_rcu(session, session_list, global_hlist) {
                         if (session->session_id == session_id) {
                                 l2tp_session_inc_refcount(session);
-                                if (do_ref && session->ref)
-                                        session->ref(session);
                                 rcu_read_unlock_bh();
 
                                 return session;
@@ -252,8 +246,6 @@ struct l2tp_session *l2tp_session_get(const struct net *net,
         hlist_for_each_entry(session, session_list, hlist) {
                 if (session->session_id == session_id) {
                         l2tp_session_inc_refcount(session);
-                        if (do_ref && session->ref)
-                                session->ref(session);
                         read_unlock_bh(&tunnel->hlist_lock);
 
                         return session;
@@ -265,8 +257,7 @@ struct l2tp_session *l2tp_session_get(const struct net *net,
 }
 EXPORT_SYMBOL_GPL(l2tp_session_get);
 
-struct l2tp_session *l2tp_session_get_nth(struct l2tp_tunnel *tunnel, int nth,
-                                          bool do_ref)
+struct l2tp_session *l2tp_session_get_nth(struct l2tp_tunnel *tunnel, int nth)
 {
         int hash;
         struct l2tp_session *session;
@@ -277,8 +268,6 @@ struct l2tp_session *l2tp_session_get_nth(struct l2tp_tunnel *tunnel, int nth,
                 hlist_for_each_entry(session, &tunnel->session_hlist[hash], hlist) {
                         if (++count > nth) {
                                 l2tp_session_inc_refcount(session);
-                                if (do_ref && session->ref)
-                                        session->ref(session);
                                 read_unlock_bh(&tunnel->hlist_lock);
                                 return session;
                         }
@@ -295,8 +284,7 @@ EXPORT_SYMBOL_GPL(l2tp_session_get_nth);
  * This is very inefficient but is only used by management interfaces.
  */
 struct l2tp_session *l2tp_session_get_by_ifname(const struct net *net,
-                                                const char *ifname,
-                                                bool do_ref)
+                                                const char *ifname)
 {
         struct l2tp_net *pn = l2tp_pernet(net);
         int hash;
@@ -307,8 +295,6 @@ struct l2tp_session *l2tp_session_get_by_ifname(const struct net *net,
                 hlist_for_each_entry_rcu(session, &pn->l2tp_session_hlist[hash], global_hlist) {
                         if (!strcmp(session->ifname, ifname)) {
                                 l2tp_session_inc_refcount(session);
-                                if (do_ref && session->ref)
-                                        session->ref(session);
                                 rcu_read_unlock_bh();
 
                                 return session;
@@ -322,8 +308,8 @@ struct l2tp_session *l2tp_session_get_by_ifname(const struct net *net,
 }
 EXPORT_SYMBOL_GPL(l2tp_session_get_by_ifname);
 
-static int l2tp_session_add_to_tunnel(struct l2tp_tunnel *tunnel,
-                                      struct l2tp_session *session)
+int l2tp_session_register(struct l2tp_session *session,
+                          struct l2tp_tunnel *tunnel)
 {
         struct l2tp_session *session_walk;
         struct hlist_head *g_head;
@@ -380,6 +366,7 @@ err_tlock:
 
         return err;
 }
+EXPORT_SYMBOL_GPL(l2tp_session_register);
 
 /* Lookup a tunnel by id
  */
@@ -484,9 +471,6 @@ static void l2tp_recv_dequeue_skb(struct l2tp_session *session, struct sk_buff *
                 (*session->recv_skb)(session, skb, L2TP_SKB_CB(skb)->length);
         else
                 kfree_skb(skb);
-
-        if (session->deref)
-                (*session->deref)(session);
 }
 
 /* Dequeue skbs from the session's reorder_q, subject to packet order.
@@ -515,8 +499,6 @@ start:
                         session->reorder_skip = 1;
                         __skb_unlink(skb, &session->reorder_q);
                         kfree_skb(skb);
-                        if (session->deref)
-                                (*session->deref)(session);
                         continue;
                 }
 
@@ -689,9 +671,6 @@ discard:
  * a data (not control) frame before coming here. Fields up to the
  * session-id have already been parsed and ptr points to the data
  * after the session-id.
- *
- * session->ref() must have been called prior to l2tp_recv_common().
- * session->deref() will be called automatically after skb is processed.
  */
 void l2tp_recv_common(struct l2tp_session *session, struct sk_buff *skb,
                       unsigned char *ptr, unsigned char *optr, u16 hdrflags,
@@ -858,9 +837,6 @@ void l2tp_recv_common(struct l2tp_session *session, struct sk_buff *skb,
 discard:
         atomic_long_inc(&session->stats.rx_errors);
         kfree_skb(skb);
-
-        if (session->deref)
-                (*session->deref)(session);
 }
 EXPORT_SYMBOL(l2tp_recv_common);
 
@@ -874,8 +850,6 @@ int l2tp_session_queue_purge(struct l2tp_session *session)
         while ((skb = skb_dequeue(&session->reorder_q))) {
                 atomic_long_inc(&session->stats.rx_errors);
                 kfree_skb(skb);
-                if (session->deref)
-                        (*session->deref)(session);
         }
         return 0;
 }
@@ -967,13 +941,10 @@ static int l2tp_udp_recv_core(struct l2tp_tunnel *tunnel, struct sk_buff *skb,
         }
 
         /* Find the session context */
-        session = l2tp_session_get(tunnel->l2tp_net, tunnel, session_id, true);
+        session = l2tp_session_get(tunnel->l2tp_net, tunnel, session_id);
         if (!session || !session->recv_skb) {
-                if (session) {
-                        if (session->deref)
-                                session->deref(session);
+                if (session)
                         l2tp_session_dec_refcount(session);
-                }
 
                 /* Not found? Pass to userspace to deal with */
                 l2tp_info(tunnel, L2TP_MSG_DATA,
@@ -1274,9 +1245,6 @@ static void l2tp_tunnel_destruct(struct sock *sk)
         spin_lock_bh(&pn->l2tp_tunnel_list_lock);
         list_del_rcu(&tunnel->list);
         spin_unlock_bh(&pn->l2tp_tunnel_list_lock);
-        atomic_dec(&l2tp_tunnel_count);
-
-        l2tp_tunnel_closeall(tunnel);
 
         tunnel->sock = NULL;
         l2tp_tunnel_dec_refcount(tunnel);
@@ -1317,9 +1285,6 @@ again:
                         if (test_and_set_bit(0, &session->dead))
                                 goto again;
 
-                        if (session->ref != NULL)
-                                (*session->ref)(session);
-
                         write_unlock_bh(&tunnel->hlist_lock);
 
                         __l2tp_session_unhash(session);
@@ -1328,9 +1293,6 @@ again:
                         if (session->session_close != NULL)
                                 (*session->session_close)(session);
 
-                        if (session->deref != NULL)
-                                (*session->deref)(session);
-
                         l2tp_session_dec_refcount(session);
 
                         write_lock_bh(&tunnel->hlist_lock);
@@ -1661,7 +1623,6 @@ int l2tp_tunnel_create(struct net *net, int fd, int version, u32 tunnel_id, u32
 
         /* Add tunnel to our list */
         INIT_LIST_HEAD(&tunnel->list);
-        atomic_inc(&l2tp_tunnel_count);
 
         /* Bump the reference count. The tunnel context is deleted
          * only when this drops to zero. Must be done before list insertion
@@ -1707,8 +1668,6 @@ void l2tp_session_free(struct l2tp_session *session)
 
         if (tunnel) {
                 BUG_ON(tunnel->magic != L2TP_TUNNEL_MAGIC);
-                if (session->session_id != 0)
-                        atomic_dec(&l2tp_session_count);
                 sock_put(tunnel->sock);
                 session->tunnel = NULL;
                 l2tp_tunnel_dec_refcount(tunnel);
@@ -1754,15 +1713,13 @@ int l2tp_session_delete(struct l2tp_session *session)
         if (test_and_set_bit(0, &session->dead))
                 return 0;
 
-        if (session->ref)
-                (*session->ref)(session);
         __l2tp_session_unhash(session);
         l2tp_session_queue_purge(session);
         if (session->session_close != NULL)
                 (*session->session_close)(session);
-        if (session->deref)
-                (*session->deref)(session);
+
         l2tp_session_dec_refcount(session);
+
         return 0;
 }
 EXPORT_SYMBOL_GPL(l2tp_session_delete);
@@ -1788,7 +1745,6 @@ EXPORT_SYMBOL_GPL(l2tp_session_set_header_len);
 struct l2tp_session *l2tp_session_create(int priv_size, struct l2tp_tunnel *tunnel, u32 session_id, u32 peer_session_id, struct l2tp_session_cfg *cfg)
 {
         struct l2tp_session *session;
-        int err;
 
         session = kzalloc(sizeof(struct l2tp_session) + priv_size, GFP_KERNEL);
         if (session != NULL) {
@@ -1846,17 +1802,6 @@ struct l2tp_session *l2tp_session_create(int priv_size, struct l2tp_tunnel *tunn
 
                 refcount_set(&session->ref_count, 1);
 
-                err = l2tp_session_add_to_tunnel(tunnel, session);
-                if (err) {
-                        kfree(session);
-
-                        return ERR_PTR(err);
-                }
-
-                /* Ignore management session in session count value */
-                if (session->session_id != 0)
-                        atomic_inc(&l2tp_session_count);
-
                 return session;
         }
 
@@ -1888,15 +1833,19 @@ static __net_exit void l2tp_exit_net(struct net *net)
 {
         struct l2tp_net *pn = l2tp_pernet(net);
         struct l2tp_tunnel *tunnel = NULL;
+        int hash;
 
         rcu_read_lock_bh();
         list_for_each_entry_rcu(tunnel, &pn->l2tp_tunnel_list, list) {
-                (void)l2tp_tunnel_delete(tunnel);
+                l2tp_tunnel_delete(tunnel);
         }
         rcu_read_unlock_bh();
 
         flush_workqueue(l2tp_wq);
         rcu_barrier();
+
+        for (hash = 0; hash < L2TP_HASH_SIZE_2; hash++)
+                WARN_ON_ONCE(!hlist_empty(&pn->l2tp_session_hlist[hash]));
 }
 
 static struct pernet_operations l2tp_net_ops = {
diff --git a/net/l2tp/l2tp_core.h b/net/l2tp/l2tp_core.h
index 67c79d9b5c6c..9534e16965cc 100644
--- a/net/l2tp/l2tp_core.h
+++ b/net/l2tp/l2tp_core.h
@@ -129,8 +129,6 @@ struct l2tp_session {
         int (*build_header)(struct l2tp_session *session, void *buf);
         void (*recv_skb)(struct l2tp_session *session, struct sk_buff *skb, int data_len);
         void (*session_close)(struct l2tp_session *session);
-        void (*ref)(struct l2tp_session *session);
-        void (*deref)(struct l2tp_session *session);
 #if IS_ENABLED(CONFIG_L2TP_DEBUGFS)
         void (*show)(struct seq_file *m, void *priv);
 #endif
@@ -245,12 +243,10 @@ struct l2tp_tunnel *l2tp_tunnel_get(const struct net *net, u32 tunnel_id);
 
 struct l2tp_session *l2tp_session_get(const struct net *net,
                                       struct l2tp_tunnel *tunnel,
-                                      u32 session_id, bool do_ref);
-struct l2tp_session *l2tp_session_get_nth(struct l2tp_tunnel *tunnel, int nth,
-                                          bool do_ref);
+                                      u32 session_id);
+struct l2tp_session *l2tp_session_get_nth(struct l2tp_tunnel *tunnel, int nth);
 struct l2tp_session *l2tp_session_get_by_ifname(const struct net *net,
-                                                const char *ifname,
-                                                bool do_ref);
+                                                const char *ifname);
 struct l2tp_tunnel *l2tp_tunnel_find(const struct net *net, u32 tunnel_id);
 struct l2tp_tunnel *l2tp_tunnel_find_nth(const struct net *net, int nth);
 
@@ -263,6 +259,9 @@ struct l2tp_session *l2tp_session_create(int priv_size,
                                          struct l2tp_tunnel *tunnel,
                                          u32 session_id, u32 peer_session_id,
                                          struct l2tp_session_cfg *cfg);
+int l2tp_session_register(struct l2tp_session *session,
+                          struct l2tp_tunnel *tunnel);
+
 void __l2tp_session_unhash(struct l2tp_session *session);
 int l2tp_session_delete(struct l2tp_session *session);
 void l2tp_session_free(struct l2tp_session *session);
@@ -295,37 +294,17 @@ static inline void l2tp_tunnel_dec_refcount(struct l2tp_tunnel *tunnel)
 /* Session reference counts. Incremented when code obtains a reference
  * to a session.
  */
-static inline void l2tp_session_inc_refcount_1(struct l2tp_session *session)
+static inline void l2tp_session_inc_refcount(struct l2tp_session *session)
 {
         refcount_inc(&session->ref_count);
 }
 
-static inline void l2tp_session_dec_refcount_1(struct l2tp_session *session)
+static inline void l2tp_session_dec_refcount(struct l2tp_session *session)
 {
         if (refcount_dec_and_test(&session->ref_count))
                 l2tp_session_free(session);
 }
 
-#ifdef L2TP_REFCNT_DEBUG
-#define l2tp_session_inc_refcount(_s)                                   \
-do {                                                                    \
-        pr_debug("l2tp_session_inc_refcount: %s:%d %s: cnt=%d\n",       \
-                 __func__, __LINE__, (_s)->name,                        \
-                 refcount_read(&_s->ref_count));                        \
-        l2tp_session_inc_refcount_1(_s);                                \
-} while (0)
-#define l2tp_session_dec_refcount(_s)                                   \
-do {                                                                    \
-        pr_debug("l2tp_session_dec_refcount: %s:%d %s: cnt=%d\n",       \
-                 __func__, __LINE__, (_s)->name,                        \
-                 refcount_read(&_s->ref_count));                        \
-        l2tp_session_dec_refcount_1(_s);                                \
-} while (0)
-#else
-#define l2tp_session_inc_refcount(s) l2tp_session_inc_refcount_1(s)
-#define l2tp_session_dec_refcount(s) l2tp_session_dec_refcount_1(s)
-#endif
-
 #define l2tp_printk(ptr, type, func, fmt, ...)                          \
 do {                                                                    \
         if (((ptr)->debug) & (type))                                    \
diff --git a/net/l2tp/l2tp_debugfs.c b/net/l2tp/l2tp_debugfs.c
index 53bae54c4d6e..eb69411bcb47 100644
--- a/net/l2tp/l2tp_debugfs.c
+++ b/net/l2tp/l2tp_debugfs.c
@@ -53,7 +53,7 @@ static void l2tp_dfs_next_tunnel(struct l2tp_dfs_seq_data *pd)
 
 static void l2tp_dfs_next_session(struct l2tp_dfs_seq_data *pd)
 {
-        pd->session = l2tp_session_get_nth(pd->tunnel, pd->session_idx, true);
+        pd->session = l2tp_session_get_nth(pd->tunnel, pd->session_idx);
         pd->session_idx++;
 
         if (pd->session == NULL) {
@@ -241,8 +241,6 @@ static int l2tp_dfs_seq_show(struct seq_file *m, void *v)
                 l2tp_dfs_seq_tunnel_show(m, pd->tunnel);
         } else {
                 l2tp_dfs_seq_session_show(m, pd->session);
-                if (pd->session->deref)
-                        pd->session->deref(pd->session);
                 l2tp_session_dec_refcount(pd->session);
         }
 
diff --git a/net/l2tp/l2tp_eth.c b/net/l2tp/l2tp_eth.c
index 014a7bc2a872..5c366ecfa1cb 100644
--- a/net/l2tp/l2tp_eth.c
+++ b/net/l2tp/l2tp_eth.c
@@ -41,8 +41,6 @@
 
 /* via netdev_priv() */
 struct l2tp_eth {
-        struct net_device       *dev;
-        struct sock             *tunnel_sock;
         struct l2tp_session     *session;
         atomic_long_t           tx_bytes;
         atomic_long_t           tx_packets;
@@ -54,15 +52,12 @@ struct l2tp_eth {
 
 /* via l2tp_session_priv() */
 struct l2tp_eth_sess {
-        struct net_device       *dev;
+        struct net_device __rcu *dev;
 };
 
 
 static int l2tp_eth_dev_init(struct net_device *dev)
 {
-        struct l2tp_eth *priv = netdev_priv(dev);
-
-        priv->dev = dev;
         eth_hw_addr_random(dev);
         eth_broadcast_addr(dev->broadcast);
         netdev_lockdep_set_classes(dev);
@@ -72,7 +67,14 @@ static int l2tp_eth_dev_init(struct net_device *dev)
 
 static void l2tp_eth_dev_uninit(struct net_device *dev)
 {
-        dev_put(dev);
+        struct l2tp_eth *priv = netdev_priv(dev);
+        struct l2tp_eth_sess *spriv;
+
+        spriv = l2tp_session_priv(priv->session);
+        RCU_INIT_POINTER(spriv->dev, NULL);
+        /* No need for synchronize_net() here. We're called by
+         * unregister_netdev*(), which does the synchronisation for us.
+         */
 }
 
 static int l2tp_eth_dev_xmit(struct sk_buff *skb, struct net_device *dev)
@@ -130,8 +132,8 @@ static void l2tp_eth_dev_setup(struct net_device *dev)
 static void l2tp_eth_dev_recv(struct l2tp_session *session, struct sk_buff *skb, int data_len)
 {
         struct l2tp_eth_sess *spriv = l2tp_session_priv(session);
-        struct net_device *dev = spriv->dev;
-        struct l2tp_eth *priv = netdev_priv(dev);
+        struct net_device *dev;
+        struct l2tp_eth *priv;
 
         if (session->debug & L2TP_MSG_DATA) {
                 unsigned int length;
@@ -155,16 +157,25 @@ static void l2tp_eth_dev_recv(struct l2tp_session *session, struct sk_buff *skb,
         skb_dst_drop(skb);
         nf_reset(skb);
 
+        rcu_read_lock();
+        dev = rcu_dereference(spriv->dev);
+        if (!dev)
+                goto error_rcu;
+
+        priv = netdev_priv(dev);
         if (dev_forward_skb(dev, skb) == NET_RX_SUCCESS) {
                 atomic_long_inc(&priv->rx_packets);
                 atomic_long_add(data_len, &priv->rx_bytes);
         } else {
                 atomic_long_inc(&priv->rx_errors);
         }
+        rcu_read_unlock();
+
         return;
 
+error_rcu:
+        rcu_read_unlock();
 error:
-        atomic_long_inc(&priv->rx_errors);
         kfree_skb(skb);
 }
 
@@ -175,11 +186,15 @@ static void l2tp_eth_delete(struct l2tp_session *session)
 
         if (session) {
                 spriv = l2tp_session_priv(session);
-                dev = spriv->dev;
+
+                rtnl_lock();
+                dev = rtnl_dereference(spriv->dev);
                 if (dev) {
-                        unregister_netdev(dev);
-                        spriv->dev = NULL;
+                        unregister_netdevice(dev);
+                        rtnl_unlock();
                         module_put(THIS_MODULE);
+                } else {
+                        rtnl_unlock();
                 }
         }
 }
@@ -189,9 +204,20 @@ static void l2tp_eth_show(struct seq_file *m, void *arg)
 {
         struct l2tp_session *session = arg;
         struct l2tp_eth_sess *spriv = l2tp_session_priv(session);
-        struct net_device *dev = spriv->dev;
+        struct net_device *dev;
+
+        rcu_read_lock();
+        dev = rcu_dereference(spriv->dev);
+        if (!dev) {
+                rcu_read_unlock();
+                return;
+        }
+        dev_hold(dev);
+        rcu_read_unlock();
 
         seq_printf(m, "   interface %s\n", dev->name);
+
+        dev_put(dev);
 }
 #endif
 
@@ -268,14 +294,14 @@ static int l2tp_eth_create(struct net *net, struct l2tp_tunnel *tunnel,
                                       peer_session_id, cfg);
         if (IS_ERR(session)) {
                 rc = PTR_ERR(session);
-                goto out;
+                goto err;
         }
 
         dev = alloc_netdev(sizeof(*priv), name, name_assign_type,
                            l2tp_eth_dev_setup);
         if (!dev) {
                 rc = -ENOMEM;
-                goto out_del_session;
+                goto err_sess;
         }
 
         dev_net_set(dev, net);
@@ -284,10 +310,8 @@ static int l2tp_eth_create(struct net *net, struct l2tp_tunnel *tunnel,
         l2tp_eth_adjust_mtu(tunnel, session, dev);
 
         priv = netdev_priv(dev);
-        priv->dev = dev;
         priv->session = session;
 
-        priv->tunnel_sock = tunnel->sock;
         session->recv_skb = l2tp_eth_dev_recv;
         session->session_close = l2tp_eth_delete;
 #if IS_ENABLED(CONFIG_L2TP_DEBUGFS)
@@ -295,26 +319,48 @@ static int l2tp_eth_create(struct net *net, struct l2tp_tunnel *tunnel,
 #endif
 
         spriv = l2tp_session_priv(session);
-        spriv->dev = dev;
 
-        rc = register_netdev(dev);
-        if (rc < 0)
-                goto out_del_dev;
+        l2tp_session_inc_refcount(session);
+
+        rtnl_lock();
+
+        /* Register both device and session while holding the rtnl lock. This
+         * ensures that l2tp_eth_delete() will see that there's a device to
+         * unregister, even if it happened to run before we assign spriv->dev.
+         */
+        rc = l2tp_session_register(session, tunnel);
+        if (rc < 0) {
+                rtnl_unlock();
+                goto err_sess_dev;
+        }
+
+        rc = register_netdevice(dev);
+        if (rc < 0) {
+                rtnl_unlock();
+                l2tp_session_delete(session);
+                l2tp_session_dec_refcount(session);
+                free_netdev(dev);
+
+                return rc;
+        }
 
-        __module_get(THIS_MODULE);
-        /* Must be done after register_netdev() */
         strlcpy(session->ifname, dev->name, IFNAMSIZ);
+        rcu_assign_pointer(spriv->dev, dev);
 
-        dev_hold(dev);
+        rtnl_unlock();
+
+        l2tp_session_dec_refcount(session);
+
+        __module_get(THIS_MODULE);
 
         return 0;
 
-out_del_dev:
+err_sess_dev:
+        l2tp_session_dec_refcount(session);
         free_netdev(dev);
-        spriv->dev = NULL;
-out_del_session:
-        l2tp_session_delete(session);
-out:
+err_sess:
+        kfree(session);
+err:
         return rc;
 }
 
diff --git a/net/l2tp/l2tp_ip.c b/net/l2tp/l2tp_ip.c
index e4280b6568b4..ff61124fdf59 100644
--- a/net/l2tp/l2tp_ip.c
+++ b/net/l2tp/l2tp_ip.c
@@ -144,7 +144,7 @@ static int l2tp_ip_recv(struct sk_buff *skb)
         }
 
         /* Ok, this is a data packet. Lookup the session. */
-        session = l2tp_session_get(net, NULL, session_id, true);
+        session = l2tp_session_get(net, NULL, session_id);
         if (!session)
                 goto discard;
 
@@ -199,8 +199,6 @@ pass_up:
         return sk_receive_skb(sk, skb, 1);
 
 discard_sess:
-        if (session->deref)
-                session->deref(session);
         l2tp_session_dec_refcount(session);
         goto discard;
 
diff --git a/net/l2tp/l2tp_ip6.c b/net/l2tp/l2tp_ip6.c
index 8bcaa975b432..192344688c06 100644
--- a/net/l2tp/l2tp_ip6.c
+++ b/net/l2tp/l2tp_ip6.c
@@ -157,7 +157,7 @@ static int l2tp_ip6_recv(struct sk_buff *skb)
         }
 
         /* Ok, this is a data packet. Lookup the session. */
-        session = l2tp_session_get(net, NULL, session_id, true);
+        session = l2tp_session_get(net, NULL, session_id);
         if (!session)
                 goto discard;
 
@@ -213,8 +213,6 @@ pass_up:
         return sk_receive_skb(sk, skb, 1);
 
 discard_sess:
-        if (session->deref)
-                session->deref(session);
         l2tp_session_dec_refcount(session);
         goto discard;
 
diff --git a/net/l2tp/l2tp_netlink.c b/net/l2tp/l2tp_netlink.c
index 7135f4645d3a..a1f24fb2be98 100644
--- a/net/l2tp/l2tp_netlink.c
+++ b/net/l2tp/l2tp_netlink.c
@@ -48,8 +48,7 @@ static int l2tp_nl_session_send(struct sk_buff *skb, u32 portid, u32 seq,
 /* Accessed under genl lock */
 static const struct l2tp_nl_cmd_ops *l2tp_nl_cmd_ops[__L2TP_PWTYPE_MAX];
 
-static struct l2tp_session *l2tp_nl_session_get(struct genl_info *info,
-                                                bool do_ref)
+static struct l2tp_session *l2tp_nl_session_get(struct genl_info *info)
 {
         u32 tunnel_id;
         u32 session_id;
@@ -60,15 +59,14 @@ static struct l2tp_session *l2tp_nl_session_get(struct genl_info *info,
 
         if (info->attrs[L2TP_ATTR_IFNAME]) {
                 ifname = nla_data(info->attrs[L2TP_ATTR_IFNAME]);
-                session = l2tp_session_get_by_ifname(net, ifname, do_ref);
+                session = l2tp_session_get_by_ifname(net, ifname);
         } else if ((info->attrs[L2TP_ATTR_SESSION_ID]) &&
                    (info->attrs[L2TP_ATTR_CONN_ID])) {
                 tunnel_id = nla_get_u32(info->attrs[L2TP_ATTR_CONN_ID]);
                 session_id = nla_get_u32(info->attrs[L2TP_ATTR_SESSION_ID]);
                 tunnel = l2tp_tunnel_get(net, tunnel_id);
                 if (tunnel) {
-                        session = l2tp_session_get(net, tunnel, session_id,
-                                                   do_ref);
+                        session = l2tp_session_get(net, tunnel, session_id);
                         l2tp_tunnel_dec_refcount(tunnel);
                 }
         }
@@ -282,7 +280,7 @@ static int l2tp_nl_cmd_tunnel_delete(struct sk_buff *skb, struct genl_info *info
         l2tp_tunnel_notify(&l2tp_nl_family, info,
                            tunnel, L2TP_CMD_TUNNEL_DELETE);
 
-        (void) l2tp_tunnel_delete(tunnel);
+        l2tp_tunnel_delete(tunnel);
 
         l2tp_tunnel_dec_refcount(tunnel);
 
@@ -406,7 +404,7 @@ static int l2tp_nl_tunnel_send(struct sk_buff *skb, u32 portid, u32 seq, int fla
                 if (nla_put_u16(skb, L2TP_ATTR_UDP_SPORT, ntohs(inet->inet_sport)) ||
                     nla_put_u16(skb, L2TP_ATTR_UDP_DPORT, ntohs(inet->inet_dport)))
                         goto nla_put_failure;
-                /* NOBREAK */
+                /* fall through  */
         case L2TP_ENCAPTYPE_IP:
 #if IS_ENABLED(CONFIG_IPV6)
                 if (np) {
@@ -649,7 +647,7 @@ static int l2tp_nl_cmd_session_create(struct sk_buff *skb, struct genl_info *inf
                                                            &cfg);
 
         if (ret >= 0) {
-                session = l2tp_session_get(net, tunnel, session_id, false);
+                session = l2tp_session_get(net, tunnel, session_id);
                 if (session) {
                         ret = l2tp_session_notify(&l2tp_nl_family, info, session,
                                                   L2TP_CMD_SESSION_CREATE);
@@ -669,7 +667,7 @@ static int l2tp_nl_cmd_session_delete(struct sk_buff *skb, struct genl_info *inf
         struct l2tp_session *session;
         u16 pw_type;
 
-        session = l2tp_nl_session_get(info, true);
+        session = l2tp_nl_session_get(info);
         if (session == NULL) {
                 ret = -ENODEV;
                 goto out;
@@ -683,8 +681,6 @@ static int l2tp_nl_cmd_session_delete(struct sk_buff *skb, struct genl_info *inf
                 if (l2tp_nl_cmd_ops[pw_type] && l2tp_nl_cmd_ops[pw_type]->session_delete)
                         ret = (*l2tp_nl_cmd_ops[pw_type]->session_delete)(session);
 
-        if (session->deref)
-                session->deref(session);
         l2tp_session_dec_refcount(session);
 
 out:
@@ -696,7 +692,7 @@ static int l2tp_nl_cmd_session_modify(struct sk_buff *skb, struct genl_info *inf
         int ret = 0;
         struct l2tp_session *session;
 
-        session = l2tp_nl_session_get(info, false);
+        session = l2tp_nl_session_get(info);
         if (session == NULL) {
                 ret = -ENODEV;
                 goto out;
@@ -828,7 +824,7 @@ static int l2tp_nl_cmd_session_get(struct sk_buff *skb, struct genl_info *info)
         struct sk_buff *msg;
         int ret;
 
-        session = l2tp_nl_session_get(info, false);
+        session = l2tp_nl_session_get(info);
         if (session == NULL) {
                 ret = -ENODEV;
                 goto err;
@@ -874,7 +870,7 @@ static int l2tp_nl_cmd_session_dump(struct sk_buff *skb, struct netlink_callback
                                 goto out;
                 }
 
-                session = l2tp_session_get_nth(tunnel, si, false);
+                session = l2tp_session_get_nth(tunnel, si);
                 if (session == NULL) {
                         ti++;
                         tunnel = NULL;
diff --git a/net/l2tp/l2tp_ppp.c b/net/l2tp/l2tp_ppp.c
index 0c2738349442..b412fc3351dc 100644
--- a/net/l2tp/l2tp_ppp.c
+++ b/net/l2tp/l2tp_ppp.c
@@ -122,10 +122,11 @@
 struct pppol2tp_session {
         int                     owner;          /* pid that opened the socket */
 
-        struct sock             *sock;          /* Pointer to the session
+        struct mutex            sk_lock;        /* Protects .sk */
+        struct sock __rcu       *sk;            /* Pointer to the session
                                                  * PPPoX socket */
-        struct sock             *tunnel_sock;   /* Pointer to the tunnel UDP
-                                                 * socket */
+        struct sock             *__sk;          /* Copy of .sk, for cleanup */
+        struct rcu_head         rcu;            /* For asynchronous release */
         int                     flags;          /* accessed by PPPIOCGFLAGS.
                                                  * Unused. */
 };
@@ -138,6 +139,24 @@ static const struct ppp_channel_ops pppol2tp_chan_ops = {
 
 static const struct proto_ops pppol2tp_ops;
 
+/* Retrieves the pppol2tp socket associated to a session.
+ * A reference is held on the returned socket, so this function must be paired
+ * with sock_put().
+ */
+static struct sock *pppol2tp_session_get_sock(struct l2tp_session *session)
+{
+        struct pppol2tp_session *ps = l2tp_session_priv(session);
+        struct sock *sk;
+
+        rcu_read_lock();
+        sk = rcu_dereference(ps->sk);
+        if (sk)
+                sock_hold(sk);
+        rcu_read_unlock();
+
+        return sk;
+}
+
 /* Helpers to obtain tunnel/session contexts from sockets.
  */
 static inline struct l2tp_session *pppol2tp_sock_to_session(struct sock *sk)
@@ -224,7 +243,8 @@ static void pppol2tp_recv(struct l2tp_session *session, struct sk_buff *skb, int
         /* If the socket is bound, send it in to PPP's input queue. Otherwise
          * queue it on the session socket.
          */
-        sk = ps->sock;
+        rcu_read_lock();
+        sk = rcu_dereference(ps->sk);
         if (sk == NULL)
                 goto no_sock;
 
@@ -247,30 +267,16 @@ static void pppol2tp_recv(struct l2tp_session *session, struct sk_buff *skb, int
                         kfree_skb(skb);
                 }
         }
+        rcu_read_unlock();
 
         return;
 
 no_sock:
+        rcu_read_unlock();
         l2tp_info(session, L2TP_MSG_DATA, "%s: no socket\n", session->name);
         kfree_skb(skb);
 }
 
-static void pppol2tp_session_sock_hold(struct l2tp_session *session)
-{
-        struct pppol2tp_session *ps = l2tp_session_priv(session);
-
-        if (ps->sock)
-                sock_hold(ps->sock);
-}
-
-static void pppol2tp_session_sock_put(struct l2tp_session *session)
-{
-        struct pppol2tp_session *ps = l2tp_session_priv(session);
-
-        if (ps->sock)
-                sock_put(ps->sock);
-}
-
 /************************************************************************
  * Transmit handling
  ***********************************************************************/
@@ -287,7 +293,6 @@ static int pppol2tp_sendmsg(struct socket *sock, struct msghdr *m,
         int error;
         struct l2tp_session *session;
         struct l2tp_tunnel *tunnel;
-        struct pppol2tp_session *ps;
         int uhlen;
 
         error = -ENOTCONN;
@@ -300,10 +305,7 @@ static int pppol2tp_sendmsg(struct socket *sock, struct msghdr *m,
         if (session == NULL)
                 goto error;
 
-        ps = l2tp_session_priv(session);
-        tunnel = l2tp_sock_to_tunnel(ps->tunnel_sock);
-        if (tunnel == NULL)
-                goto error_put_sess;
+        tunnel = session->tunnel;
 
         uhlen = (tunnel->encap == L2TP_ENCAPTYPE_UDP) ? sizeof(struct udphdr) : 0;
 
@@ -314,7 +316,7 @@ static int pppol2tp_sendmsg(struct socket *sock, struct msghdr *m,
                            2 + total_len, /* 2 bytes for PPP_ALLSTATIONS & PPP_UI */
                            0, GFP_KERNEL);
         if (!skb)
-                goto error_put_sess_tun;
+                goto error_put_sess;
 
         /* Reserve space for headers. */
         skb_reserve(skb, NET_SKB_PAD);
@@ -332,20 +334,17 @@ static int pppol2tp_sendmsg(struct socket *sock, struct msghdr *m,
         error = memcpy_from_msg(skb_put(skb, total_len), m, total_len);
         if (error < 0) {
                 kfree_skb(skb);
-                goto error_put_sess_tun;
+                goto error_put_sess;
         }
 
         local_bh_disable();
         l2tp_xmit_skb(session, skb, session->hdr_len);
         local_bh_enable();
 
-        sock_put(ps->tunnel_sock);
         sock_put(sk);
 
         return total_len;
 
-error_put_sess_tun:
-        sock_put(ps->tunnel_sock);
 error_put_sess:
         sock_put(sk);
 error:
@@ -369,10 +368,8 @@ error:
 static int pppol2tp_xmit(struct ppp_channel *chan, struct sk_buff *skb)
 {
         struct sock *sk = (struct sock *) chan->private;
-        struct sock *sk_tun;
         struct l2tp_session *session;
         struct l2tp_tunnel *tunnel;
-        struct pppol2tp_session *ps;
         int uhlen, headroom;
 
         if (sock_flag(sk, SOCK_DEAD) || !(sk->sk_state & PPPOX_CONNECTED))
@@ -383,13 +380,7 @@ static int pppol2tp_xmit(struct ppp_channel *chan, struct sk_buff *skb)
         if (session == NULL)
                 goto abort;
 
-        ps = l2tp_session_priv(session);
-        sk_tun = ps->tunnel_sock;
-        if (sk_tun == NULL)
-                goto abort_put_sess;
-        tunnel = l2tp_sock_to_tunnel(sk_tun);
-        if (tunnel == NULL)
-                goto abort_put_sess;
+        tunnel = session->tunnel;
 
         uhlen = (tunnel->encap == L2TP_ENCAPTYPE_UDP) ? sizeof(struct udphdr) : 0;
         headroom = NET_SKB_PAD +
@@ -398,7 +389,7 @@ static int pppol2tp_xmit(struct ppp_channel *chan, struct sk_buff *skb)
                    session->hdr_len +   /* L2TP header */
                    2;                   /* 2 bytes for PPP_ALLSTATIONS & PPP_UI */
         if (skb_cow_head(skb, headroom))
-                goto abort_put_sess_tun;
+                goto abort_put_sess;
 
         /* Setup PPP header */
         __skb_push(skb, 2);
@@ -409,12 +400,10 @@ static int pppol2tp_xmit(struct ppp_channel *chan, struct sk_buff *skb)
         l2tp_xmit_skb(session, skb, session->hdr_len);
         local_bh_enable();
 
-        sock_put(sk_tun);
         sock_put(sk);
+
         return 1;
 
-abort_put_sess_tun:
-        sock_put(sk_tun);
 abort_put_sess:
         sock_put(sk);
 abort:
@@ -431,17 +420,16 @@ abort:
  */
 static void pppol2tp_session_close(struct l2tp_session *session)
 {
-        struct pppol2tp_session *ps = l2tp_session_priv(session);
-        struct sock *sk = ps->sock;
-        struct socket *sock = sk->sk_socket;
+        struct sock *sk;
 
         BUG_ON(session->magic != L2TP_SESSION_MAGIC);
 
-        if (sock)
-                inet_shutdown(sock, SEND_SHUTDOWN);
-
-        /* Don't let the session go away before our socket does */
-        l2tp_session_inc_refcount(session);
+        sk = pppol2tp_session_get_sock(session);
+        if (sk) {
+                if (sk->sk_socket)
+                        inet_shutdown(sk->sk_socket, SEND_SHUTDOWN);
+                sock_put(sk);
+        }
 }
 
 /* Really kill the session socket. (Called from sock_put() if
@@ -461,6 +449,14 @@ static void pppol2tp_session_destruct(struct sock *sk)
         }
 }
 
+static void pppol2tp_put_sk(struct rcu_head *head)
+{
+        struct pppol2tp_session *ps;
+
+        ps = container_of(head, typeof(*ps), rcu);
+        sock_put(ps->__sk);
+}
+
 /* Called when the PPPoX socket (session) is closed.
  */
 static int pppol2tp_release(struct socket *sock)
@@ -486,11 +482,23 @@ static int pppol2tp_release(struct socket *sock)
 
         session = pppol2tp_sock_to_session(sk);
 
-        /* Purge any queued data */
         if (session != NULL) {
-                __l2tp_session_unhash(session);
-                l2tp_session_queue_purge(session);
-                sock_put(sk);
+                struct pppol2tp_session *ps;
+
+                l2tp_session_delete(session);
+
+                ps = l2tp_session_priv(session);
+                mutex_lock(&ps->sk_lock);
+                ps->__sk = rcu_dereference_protected(ps->sk,
+                                                     lockdep_is_held(&ps->sk_lock));
+                RCU_INIT_POINTER(ps->sk, NULL);
+                mutex_unlock(&ps->sk_lock);
+                call_rcu(&ps->rcu, pppol2tp_put_sk);
+
+                /* Rely on the sock_put() call at the end of the function for
+                 * dropping the reference held by pppol2tp_sock_to_session().
+                 * The last reference will be dropped by pppol2tp_put_sk().
+                 */
         }
         release_sock(sk);
 
@@ -557,16 +565,46 @@ out:
 static void pppol2tp_show(struct seq_file *m, void *arg)
 {
         struct l2tp_session *session = arg;
-        struct pppol2tp_session *ps = l2tp_session_priv(session);
+        struct sock *sk;
 
-        if (ps) {
-                struct pppox_sock *po = pppox_sk(ps->sock);
-                if (po)
-                        seq_printf(m, "   interface %s\n", ppp_dev_name(&po->chan));
+        sk = pppol2tp_session_get_sock(session);
+        if (sk) {
+                struct pppox_sock *po = pppox_sk(sk);
+
+                seq_printf(m, "   interface %s\n", ppp_dev_name(&po->chan));
+                sock_put(sk);
         }
 }
 #endif
 
+static void pppol2tp_session_init(struct l2tp_session *session)
+{
+        struct pppol2tp_session *ps;
+        struct dst_entry *dst;
+
+        session->recv_skb = pppol2tp_recv;
+        session->session_close = pppol2tp_session_close;
+#if IS_ENABLED(CONFIG_L2TP_DEBUGFS)
+        session->show = pppol2tp_show;
+#endif
+
+        ps = l2tp_session_priv(session);
+        mutex_init(&ps->sk_lock);
+        ps->owner = current->pid;
+
+        /* If PMTU discovery was enabled, use the MTU that was discovered */
+        dst = sk_dst_get(session->tunnel->sock);
+        if (dst) {
+                u32 pmtu = dst_mtu(dst);
+
+                if (pmtu) {
+                        session->mtu = pmtu - PPPOL2TP_HEADER_OVERHEAD;
+                        session->mru = pmtu - PPPOL2TP_HEADER_OVERHEAD;
+                }
+                dst_release(dst);
+        }
+}
+
 /* connect() handler. Attach a PPPoX socket to a tunnel UDP socket
  */
 static int pppol2tp_connect(struct socket *sock, struct sockaddr *uservaddr,
@@ -578,7 +616,6 @@ static int pppol2tp_connect(struct socket *sock, struct sockaddr *uservaddr,
         struct l2tp_session *session = NULL;
         struct l2tp_tunnel *tunnel;
         struct pppol2tp_session *ps;
-        struct dst_entry *dst;
         struct l2tp_session_cfg cfg = { 0, };
         int error = 0;
         u32 tunnel_id, peer_tunnel_id;
@@ -688,7 +725,7 @@ static int pppol2tp_connect(struct socket *sock, struct sockaddr *uservaddr,
         if (tunnel->peer_tunnel_id == 0)
                 tunnel->peer_tunnel_id = peer_tunnel_id;
 
-        session = l2tp_session_get(sock_net(sk), tunnel, session_id, false);
+        session = l2tp_session_get(sock_net(sk), tunnel, session_id);
         if (session) {
                 drop_refcnt = true;
                 ps = l2tp_session_priv(session);
@@ -696,13 +733,10 @@ static int pppol2tp_connect(struct socket *sock, struct sockaddr *uservaddr,
                 /* Using a pre-existing session is fine as long as it hasn't
                  * been connected yet.
                  */
-                if (ps->sock) {
-                        error = -EEXIST;
-                        goto end;
-                }
-
-                /* consistency checks */
-                if (ps->tunnel_sock != tunnel->sock) {
+                mutex_lock(&ps->sk_lock);
+                if (rcu_dereference_protected(ps->sk,
+                                              lockdep_is_held(&ps->sk_lock))) {
+                        mutex_unlock(&ps->sk_lock);
                         error = -EEXIST;
                         goto end;
                 }
@@ -718,35 +752,19 @@ static int pppol2tp_connect(struct socket *sock, struct sockaddr *uservaddr,
                         error = PTR_ERR(session);
                         goto end;
                 }
-        }
-
-        /* Associate session with its PPPoL2TP socket */
-        ps = l2tp_session_priv(session);
-        ps->owner            = current->pid;
-        ps->sock             = sk;
-        ps->tunnel_sock = tunnel->sock;
 
-        session->recv_skb       = pppol2tp_recv;
-        session->session_close  = pppol2tp_session_close;
-#if IS_ENABLED(CONFIG_L2TP_DEBUGFS)
-        session->show           = pppol2tp_show;
-#endif
-
-        /* We need to know each time a skb is dropped from the reorder
-         * queue.
-         */
-        session->ref = pppol2tp_session_sock_hold;
-        session->deref = pppol2tp_session_sock_put;
-
-        /* If PMTU discovery was enabled, use the MTU that was discovered */
-        dst = sk_dst_get(tunnel->sock);
-        if (dst != NULL) {
-                u32 pmtu = dst_mtu(dst);
+                pppol2tp_session_init(session);
+                ps = l2tp_session_priv(session);
+                l2tp_session_inc_refcount(session);
 
-                if (pmtu != 0)
-                        session->mtu = session->mru = pmtu -
-                                PPPOL2TP_HEADER_OVERHEAD;
-                dst_release(dst);
+                mutex_lock(&ps->sk_lock);
+                error = l2tp_session_register(session, tunnel);
+                if (error < 0) {
+                        mutex_unlock(&ps->sk_lock);
+                        kfree(session);
+                        goto end;
+                }
+                drop_refcnt = true;
         }
 
         /* Special case: if source & dest session_id == 0x0000, this
@@ -771,12 +789,23 @@ static int pppol2tp_connect(struct socket *sock, struct sockaddr *uservaddr,
         po->chan.mtu     = session->mtu;
 
         error = ppp_register_net_channel(sock_net(sk), &po->chan);
-        if (error)
+        if (error) {
+                mutex_unlock(&ps->sk_lock);
                 goto end;
+        }
 
 out_no_ppp:
         /* This is how we get the session context from the socket. */
         sk->sk_user_data = session;
+        rcu_assign_pointer(ps->sk, sk);
+        mutex_unlock(&ps->sk_lock);
+
+        /* Keep the reference we've grabbed on the session: sk doesn't expect
+         * the session to disappear. pppol2tp_session_destruct() is responsible
+         * for dropping it.
+         */
+        drop_refcnt = false;
+
         sk->sk_state = PPPOX_CONNECTED;
         l2tp_info(session, L2TP_MSG_CONTROL, "%s: created\n",
                   session->name);
@@ -800,12 +829,11 @@ static int pppol2tp_session_create(struct net *net, struct l2tp_tunnel *tunnel,
 {
         int error;
         struct l2tp_session *session;
-        struct pppol2tp_session *ps;
 
         /* Error if tunnel socket is not prepped */
         if (!tunnel->sock) {
                 error = -ENOENT;
-                goto out;
+                goto err;
         }
 
         /* Default MTU values. */
@@ -820,18 +848,20 @@ static int pppol2tp_session_create(struct net *net, struct l2tp_tunnel *tunnel,
                                       peer_session_id, cfg);
         if (IS_ERR(session)) {
                 error = PTR_ERR(session);
-                goto out;
+                goto err;
         }
 
-        ps = l2tp_session_priv(session);
-        ps->tunnel_sock = tunnel->sock;
+        pppol2tp_session_init(session);
 
-        l2tp_info(session, L2TP_MSG_CONTROL, "%s: created\n",
-                  session->name);
+        error = l2tp_session_register(session, tunnel);
+        if (error < 0)
+                goto err_sess;
 
-        error = 0;
+        return 0;
 
-out:
+err_sess:
+        kfree(session);
+err:
         return error;
 }
 
@@ -862,9 +892,7 @@ static int pppol2tp_getname(struct socket *sock, struct sockaddr *uaddr,
                 goto end;
 
         pls = l2tp_session_priv(session);
-        tunnel = l2tp_sock_to_tunnel(pls->tunnel_sock);
-        if (tunnel == NULL)
-                goto end_put_sess;
+        tunnel = session->tunnel;
 
         inet = inet_sk(tunnel->sock);
         if ((tunnel->version == 2) && (tunnel->sock->sk_family == AF_INET)) {
@@ -944,8 +972,6 @@ static int pppol2tp_getname(struct socket *sock, struct sockaddr *uaddr,
         *usockaddr_len = len;
         error = 0;
 
-        sock_put(pls->tunnel_sock);
-end_put_sess:
         sock_put(sk);
 end:
         return error;
@@ -992,12 +1018,10 @@ static int pppol2tp_session_ioctl(struct l2tp_session *session,
                  "%s: pppol2tp_session_ioctl(cmd=%#x, arg=%#lx)\n",
                  session->name, cmd, arg);
 
-        sk = ps->sock;
+        sk = pppol2tp_session_get_sock(session);
         if (!sk)
                 return -EBADR;
 
-        sock_hold(sk);
-
         switch (cmd) {
         case SIOCGIFMTU:
                 err = -ENXIO;
@@ -1143,13 +1167,11 @@ static int pppol2tp_tunnel_ioctl(struct l2tp_tunnel *tunnel,
                         /* resend to session ioctl handler */
                         struct l2tp_session *session =
                                 l2tp_session_get(sock_net(sk), tunnel,
-                                                 stats.session_id, true);
+                                                 stats.session_id);
 
                         if (session) {
                                 err = pppol2tp_session_ioctl(session, cmd,
                                                              arg);
-                                if (session->deref)
-                                        session->deref(session);
                                 l2tp_session_dec_refcount(session);
                         } else {
                                 err = -EBADR;
@@ -1188,7 +1210,6 @@ static int pppol2tp_ioctl(struct socket *sock, unsigned int cmd,
         struct sock *sk = sock->sk;
         struct l2tp_session *session;
         struct l2tp_tunnel *tunnel;
-        struct pppol2tp_session *ps;
         int err;
 
         if (!sk)
@@ -1212,16 +1233,10 @@ static int pppol2tp_ioctl(struct socket *sock, unsigned int cmd,
         /* Special case: if session's session_id is zero, treat ioctl as a
          * tunnel ioctl
          */
-        ps = l2tp_session_priv(session);
         if ((session->session_id == 0) &&
             (session->peer_session_id == 0)) {
-                err = -EBADF;
-                tunnel = l2tp_sock_to_tunnel(ps->tunnel_sock);
-                if (tunnel == NULL)
-                        goto end_put_sess;
-
+                tunnel = session->tunnel;
                 err = pppol2tp_tunnel_ioctl(tunnel, cmd, arg);
-                sock_put(ps->tunnel_sock);
                 goto end_put_sess;
         }
 
@@ -1273,7 +1288,6 @@ static int pppol2tp_session_setsockopt(struct sock *sk,
                                        int optname, int val)
 {
         int err = 0;
-        struct pppol2tp_session *ps = l2tp_session_priv(session);
 
         switch (optname) {
         case PPPOL2TP_SO_RECVSEQ:
@@ -1294,8 +1308,8 @@ static int pppol2tp_session_setsockopt(struct sock *sk,
                 }
                 session->send_seq = !!val;
                 {
-                        struct sock *ssk      = ps->sock;
-                        struct pppox_sock *po = pppox_sk(ssk);
+                        struct pppox_sock *po = pppox_sk(sk);
+
                         po->chan.hdrlen = val ? PPPOL2TP_L2TP_HDR_SIZE_SEQ :
                                 PPPOL2TP_L2TP_HDR_SIZE_NOSEQ;
                 }
@@ -1348,7 +1362,6 @@ static int pppol2tp_setsockopt(struct socket *sock, int level, int optname,
         struct sock *sk = sock->sk;
         struct l2tp_session *session;
         struct l2tp_tunnel *tunnel;
-        struct pppol2tp_session *ps;
         int val;
         int err;
 
@@ -1373,20 +1386,14 @@ static int pppol2tp_setsockopt(struct socket *sock, int level, int optname,
 
         /* Special case: if session_id == 0x0000, treat as operation on tunnel
          */
-        ps = l2tp_session_priv(session);
         if ((session->session_id == 0) &&
             (session->peer_session_id == 0)) {
-                err = -EBADF;
-                tunnel = l2tp_sock_to_tunnel(ps->tunnel_sock);
-                if (tunnel == NULL)
-                        goto end_put_sess;
-
+                tunnel = session->tunnel;
                 err = pppol2tp_tunnel_setsockopt(sk, tunnel, optname, val);
-                sock_put(ps->tunnel_sock);
-        } else
+        } else {
                 err = pppol2tp_session_setsockopt(sk, session, optname, val);
+        }
 
-end_put_sess:
         sock_put(sk);
 end:
         return err;
@@ -1474,7 +1481,6 @@ static int pppol2tp_getsockopt(struct socket *sock, int level, int optname,
         struct l2tp_tunnel *tunnel;
         int val, len;
         int err;
-        struct pppol2tp_session *ps;
 
         if (level != SOL_PPPOL2TP)
                 return -EINVAL;
@@ -1498,16 +1504,10 @@ static int pppol2tp_getsockopt(struct socket *sock, int level, int optname,
                 goto end;
 
         /* Special case: if session_id == 0x0000, treat as operation on tunnel */
-        ps = l2tp_session_priv(session);
         if ((session->session_id == 0) &&
             (session->peer_session_id == 0)) {
-                err = -EBADF;
-                tunnel = l2tp_sock_to_tunnel(ps->tunnel_sock);
-                if (tunnel == NULL)
-                        goto end_put_sess;
-
+                tunnel = session->tunnel;
                 err = pppol2tp_tunnel_getsockopt(sk, tunnel, optname, &val);
-                sock_put(ps->tunnel_sock);
                 if (err)
                         goto end_put_sess;
         } else {
@@ -1566,7 +1566,7 @@ static void pppol2tp_next_tunnel(struct net *net, struct pppol2tp_seq_data *pd)
 
 static void pppol2tp_next_session(struct net *net, struct pppol2tp_seq_data *pd)
 {
-        pd->session = l2tp_session_get_nth(pd->tunnel, pd->session_idx, true);
+        pd->session = l2tp_session_get_nth(pd->tunnel, pd->session_idx);
         pd->session_idx++;
 
         if (pd->session == NULL) {
@@ -1634,8 +1634,9 @@ static void pppol2tp_seq_session_show(struct seq_file *m, void *v)
 {
         struct l2tp_session *session = v;
         struct l2tp_tunnel *tunnel = session->tunnel;
-        struct pppol2tp_session *ps = l2tp_session_priv(session);
-        struct pppox_sock *po = pppox_sk(ps->sock);
+        unsigned char state;
+        char user_data_ok;
+        struct sock *sk;
         u32 ip = 0;
         u16 port = 0;
 
@@ -1645,6 +1646,15 @@ static void pppol2tp_seq_session_show(struct seq_file *m, void *v)
                 port = ntohs(inet->inet_sport);
         }
 
+        sk = pppol2tp_session_get_sock(session);
+        if (sk) {
+                state = sk->sk_state;
+                user_data_ok = (session == sk->sk_user_data) ? 'Y' : 'N';
+        } else {
+                state = 0;
+                user_data_ok = 'N';
+        }
+
         seq_printf(m, "  SESSION '%s' %08X/%d %04X/%04X -> "
                    "%04X/%04X %d %c\n",
                    session->name, ip, port,
@@ -1652,9 +1662,7 @@ static void pppol2tp_seq_session_show(struct seq_file *m, void *v)
                    session->session_id,
                    tunnel->peer_tunnel_id,
                    session->peer_session_id,
-                   ps->sock->sk_state,
-                   (session == ps->sock->sk_user_data) ?
-                   'Y' : 'N');
+                   state, user_data_ok);
         seq_printf(m, "   %d/%d/%c/%c/%s %08x %u\n",
                    session->mtu, session->mru,
                    session->recv_seq ? 'R' : '-',
@@ -1671,8 +1679,12 @@ static void pppol2tp_seq_session_show(struct seq_file *m, void *v)
                    atomic_long_read(&session->stats.rx_bytes),
                    atomic_long_read(&session->stats.rx_errors));
 
-        if (po)
+        if (sk) {
+                struct pppox_sock *po = pppox_sk(sk);
+
                 seq_printf(m, "   interface %s\n", ppp_dev_name(&po->chan));
+                sock_put(sk);
+        }
 }
 
 static int pppol2tp_seq_show(struct seq_file *m, void *v)
@@ -1697,8 +1709,6 @@ static int pppol2tp_seq_show(struct seq_file *m, void *v)
                 pppol2tp_seq_tunnel_show(m, pd->tunnel);
         } else {
                 pppol2tp_seq_session_show(m, pd->session);
-                if (pd->session->deref)
-                        pd->session->deref(pd->session);
                 l2tp_session_dec_refcount(pd->session);
         }
 
diff --git a/net/lapb/lapb_iface.c b/net/lapb/lapb_iface.c
index e15314e3b464..db6e0afe3a20 100644
--- a/net/lapb/lapb_iface.c
+++ b/net/lapb/lapb_iface.c
@@ -127,8 +127,8 @@ static struct lapb_cb *lapb_create_cb(void)
         skb_queue_head_init(&lapb->write_queue);
         skb_queue_head_init(&lapb->ack_queue);
 
-        init_timer(&lapb->t1timer);
-        init_timer(&lapb->t2timer);
+        timer_setup(&lapb->t1timer, NULL, 0);
+        timer_setup(&lapb->t2timer, NULL, 0);
 
         lapb->t1      = LAPB_DEFAULT_T1;
         lapb->t2      = LAPB_DEFAULT_T2;
diff --git a/net/lapb/lapb_timer.c b/net/lapb/lapb_timer.c
index 1a5535bc3b8d..5d4ae01951b5 100644
--- a/net/lapb/lapb_timer.c
+++ b/net/lapb/lapb_timer.c
@@ -35,15 +35,14 @@
 #include <linux/interrupt.h>
 #include <net/lapb.h>
 
-static void lapb_t1timer_expiry(unsigned long);
-static void lapb_t2timer_expiry(unsigned long);
+static void lapb_t1timer_expiry(struct timer_list *);
+static void lapb_t2timer_expiry(struct timer_list *);
 
 void lapb_start_t1timer(struct lapb_cb *lapb)
 {
         del_timer(&lapb->t1timer);
 
-        lapb->t1timer.data     = (unsigned long)lapb;
-        lapb->t1timer.function = &lapb_t1timer_expiry;
+        lapb->t1timer.function = lapb_t1timer_expiry;
         lapb->t1timer.expires  = jiffies + lapb->t1;
 
         add_timer(&lapb->t1timer);
@@ -53,8 +52,7 @@ void lapb_start_t2timer(struct lapb_cb *lapb)
 {
         del_timer(&lapb->t2timer);
 
-        lapb->t2timer.data     = (unsigned long)lapb;
-        lapb->t2timer.function = &lapb_t2timer_expiry;
+        lapb->t2timer.function = lapb_t2timer_expiry;
         lapb->t2timer.expires  = jiffies + lapb->t2;
 
         add_timer(&lapb->t2timer);
@@ -75,9 +73,9 @@ int lapb_t1timer_running(struct lapb_cb *lapb)
         return timer_pending(&lapb->t1timer);
 }
 
-static void lapb_t2timer_expiry(unsigned long param)
+static void lapb_t2timer_expiry(struct timer_list *t)
 {
-        struct lapb_cb *lapb = (struct lapb_cb *)param;
+        struct lapb_cb *lapb = from_timer(lapb, t, t2timer);
 
         if (lapb->condition & LAPB_ACK_PENDING_CONDITION) {
                 lapb->condition &= ~LAPB_ACK_PENDING_CONDITION;
@@ -85,9 +83,9 @@ static void lapb_t2timer_expiry(unsigned long param)
         }
 }
 
-static void lapb_t1timer_expiry(unsigned long param)
+static void lapb_t1timer_expiry(struct timer_list *t)
 {
-        struct lapb_cb *lapb = (struct lapb_cb *)param;
+        struct lapb_cb *lapb = from_timer(lapb, t, t1timer);
 
         switch (lapb->state) {
 
diff --git a/net/llc/llc_c_ac.c b/net/llc/llc_c_ac.c
index ea225bd2672c..f59648018060 100644
--- a/net/llc/llc_c_ac.c
+++ b/net/llc/llc_c_ac.c
@@ -1318,9 +1318,8 @@ static int llc_conn_ac_inc_vs_by_1(struct sock *sk, struct sk_buff *skb)
         return 0;
 }
 
-static void llc_conn_tmr_common_cb(unsigned long timeout_data, u8 type)
+static void llc_conn_tmr_common_cb(struct sock *sk, u8 type)
 {
-        struct sock *sk = (struct sock *)timeout_data;
         struct sk_buff *skb = alloc_skb(0, GFP_ATOMIC);
 
         bh_lock_sock(sk);
@@ -1334,24 +1333,32 @@ static void llc_conn_tmr_common_cb(unsigned long timeout_data, u8 type)
         bh_unlock_sock(sk);
 }
 
-void llc_conn_pf_cycle_tmr_cb(unsigned long timeout_data)
+void llc_conn_pf_cycle_tmr_cb(struct timer_list *t)
 {
-        llc_conn_tmr_common_cb(timeout_data, LLC_CONN_EV_TYPE_P_TMR);
+        struct llc_sock *llc = from_timer(llc, t, pf_cycle_timer.timer);
+
+        llc_conn_tmr_common_cb(&llc->sk, LLC_CONN_EV_TYPE_P_TMR);
 }
 
-void llc_conn_busy_tmr_cb(unsigned long timeout_data)
+void llc_conn_busy_tmr_cb(struct timer_list *t)
 {
-        llc_conn_tmr_common_cb(timeout_data, LLC_CONN_EV_TYPE_BUSY_TMR);
+        struct llc_sock *llc = from_timer(llc, t, busy_state_timer.timer);
+
+        llc_conn_tmr_common_cb(&llc->sk, LLC_CONN_EV_TYPE_BUSY_TMR);
 }
 
-void llc_conn_ack_tmr_cb(unsigned long timeout_data)
+void llc_conn_ack_tmr_cb(struct timer_list *t)
 {
-        llc_conn_tmr_common_cb(timeout_data, LLC_CONN_EV_TYPE_ACK_TMR);
+        struct llc_sock *llc = from_timer(llc, t, ack_timer.timer);
+
+        llc_conn_tmr_common_cb(&llc->sk, LLC_CONN_EV_TYPE_ACK_TMR);
 }
 
-void llc_conn_rej_tmr_cb(unsigned long timeout_data)
+void llc_conn_rej_tmr_cb(struct timer_list *t)
 {
-        llc_conn_tmr_common_cb(timeout_data, LLC_CONN_EV_TYPE_REJ_TMR);
+        struct llc_sock *llc = from_timer(llc, t, rej_sent_timer.timer);
+
+        llc_conn_tmr_common_cb(&llc->sk, LLC_CONN_EV_TYPE_REJ_TMR);
 }
 
 int llc_conn_ac_rst_vs(struct sock *sk, struct sk_buff *skb)
diff --git a/net/llc/llc_conn.c b/net/llc/llc_conn.c
index 5e91b47f0d2a..9177dbb16dce 100644
--- a/net/llc/llc_conn.c
+++ b/net/llc/llc_conn.c
@@ -902,20 +902,16 @@ static void llc_sk_init(struct sock *sk)
         llc->inc_cntr = llc->dec_cntr = 2;
         llc->dec_step = llc->connect_step = 1;
 
-        setup_timer(&llc->ack_timer.timer, llc_conn_ack_tmr_cb,
-                        (unsigned long)sk);
+        timer_setup(&llc->ack_timer.timer, llc_conn_ack_tmr_cb, 0);
         llc->ack_timer.expire         = sysctl_llc2_ack_timeout;
 
-        setup_timer(&llc->pf_cycle_timer.timer, llc_conn_pf_cycle_tmr_cb,
-                        (unsigned long)sk);
+        timer_setup(&llc->pf_cycle_timer.timer, llc_conn_pf_cycle_tmr_cb, 0);
         llc->pf_cycle_timer.expire         = sysctl_llc2_p_timeout;
 
-        setup_timer(&llc->rej_sent_timer.timer, llc_conn_rej_tmr_cb,
-                        (unsigned long)sk);
+        timer_setup(&llc->rej_sent_timer.timer, llc_conn_rej_tmr_cb, 0);
         llc->rej_sent_timer.expire         = sysctl_llc2_rej_timeout;
 
-        setup_timer(&llc->busy_state_timer.timer, llc_conn_busy_tmr_cb,
-                        (unsigned long)sk);
+        timer_setup(&llc->busy_state_timer.timer, llc_conn_busy_tmr_cb, 0);
         llc->busy_state_timer.expire         = sysctl_llc2_busy_timeout;
 
         llc->n2 = 2;   /* max retransmit */
diff --git a/net/mac80211/Makefile b/net/mac80211/Makefile
index 80bfe29099f6..e3589ade62e0 100644
--- a/net/mac80211/Makefile
+++ b/net/mac80211/Makefile
@@ -7,6 +7,7 @@ mac80211-y := \
         driver-ops.o \
         sta_info.o \
         wep.o \
+        aead_api.o \
         wpa.o \
         scan.o offchannel.o \
         ht.o agg-tx.o agg-rx.o \
@@ -16,8 +17,6 @@ mac80211-y := \
         rate.o \
         michael.o \
         tkip.o \
-        aes_ccm.o \
-        aes_gcm.o \
         aes_cmac.o \
         aes_gmac.o \
         fils_aead.o \
diff --git a/net/mac80211/aes_ccm.c b/net/mac80211/aead_api.c
index a4e0d59a40dd..160f9df30402 100644
--- a/net/mac80211/aes_ccm.c
+++ b/net/mac80211/aead_api.c
@@ -1,6 +1,7 @@
 /*
  * Copyright 2003-2004, Instant802 Networks, Inc.
  * Copyright 2005-2006, Devicescape Software, Inc.
+ * Copyright 2014-2015, Qualcomm Atheros, Inc.
  *
  * Rewrite: Copyright (C) 2013 Linaro Ltd <ard.biesheuvel@linaro.org>
  *
@@ -12,30 +13,29 @@
 #include <linux/kernel.h>
 #include <linux/types.h>
 #include <linux/err.h>
+#include <linux/scatterlist.h>
 #include <crypto/aead.h>
 
-#include <net/mac80211.h>
-#include "key.h"
-#include "aes_ccm.h"
+#include "aead_api.h"
 
-int ieee80211_aes_ccm_encrypt(struct crypto_aead *tfm, u8 *b_0, u8 *aad,
-                              u8 *data, size_t data_len, u8 *mic,
-                              size_t mic_len)
+int aead_encrypt(struct crypto_aead *tfm, u8 *b_0, u8 *aad, size_t aad_len,
+                 u8 *data, size_t data_len, u8 *mic)
 {
+        size_t mic_len = crypto_aead_authsize(tfm);
         struct scatterlist sg[3];
         struct aead_request *aead_req;
         int reqsize = sizeof(*aead_req) + crypto_aead_reqsize(tfm);
         u8 *__aad;
 
-        aead_req = kzalloc(reqsize + CCM_AAD_LEN, GFP_ATOMIC);
+        aead_req = kzalloc(reqsize + aad_len, GFP_ATOMIC);
         if (!aead_req)
                 return -ENOMEM;
 
         __aad = (u8 *)aead_req + reqsize;
-        memcpy(__aad, aad, CCM_AAD_LEN);
+        memcpy(__aad, aad, aad_len);
 
         sg_init_table(sg, 3);
-        sg_set_buf(&sg[0], &__aad[2], be16_to_cpup((__be16 *)__aad));
+        sg_set_buf(&sg[0], __aad, aad_len);
         sg_set_buf(&sg[1], data, data_len);
         sg_set_buf(&sg[2], mic, mic_len);
 
@@ -49,10 +49,10 @@ int ieee80211_aes_ccm_encrypt(struct crypto_aead *tfm, u8 *b_0, u8 *aad,
         return 0;
 }
 
-int ieee80211_aes_ccm_decrypt(struct crypto_aead *tfm, u8 *b_0, u8 *aad,
-                              u8 *data, size_t data_len, u8 *mic,
-                              size_t mic_len)
+int aead_decrypt(struct crypto_aead *tfm, u8 *b_0, u8 *aad, size_t aad_len,
+                 u8 *data, size_t data_len, u8 *mic)
 {
+        size_t mic_len = crypto_aead_authsize(tfm);
         struct scatterlist sg[3];
         struct aead_request *aead_req;
         int reqsize = sizeof(*aead_req) + crypto_aead_reqsize(tfm);
@@ -62,15 +62,15 @@ int ieee80211_aes_ccm_decrypt(struct crypto_aead *tfm, u8 *b_0, u8 *aad,
         if (data_len == 0)
                 return -EINVAL;
 
-        aead_req = kzalloc(reqsize + CCM_AAD_LEN, GFP_ATOMIC);
+        aead_req = kzalloc(reqsize + aad_len, GFP_ATOMIC);
         if (!aead_req)
                 return -ENOMEM;
 
         __aad = (u8 *)aead_req + reqsize;
-        memcpy(__aad, aad, CCM_AAD_LEN);
+        memcpy(__aad, aad, aad_len);
 
         sg_init_table(sg, 3);
-        sg_set_buf(&sg[0], &__aad[2], be16_to_cpup((__be16 *)__aad));
+        sg_set_buf(&sg[0], __aad, aad_len);
         sg_set_buf(&sg[1], data, data_len);
         sg_set_buf(&sg[2], mic, mic_len);
 
@@ -84,14 +84,14 @@ int ieee80211_aes_ccm_decrypt(struct crypto_aead *tfm, u8 *b_0, u8 *aad,
         return err;
 }
 
-struct crypto_aead *ieee80211_aes_key_setup_encrypt(const u8 key[],
-                                                    size_t key_len,
-                                                    size_t mic_len)
+struct crypto_aead *
+aead_key_setup_encrypt(const char *alg, const u8 key[],
+                       size_t key_len, size_t mic_len)
 {
         struct crypto_aead *tfm;
         int err;
 
-        tfm = crypto_alloc_aead("ccm(aes)", 0, CRYPTO_ALG_ASYNC);
+        tfm = crypto_alloc_aead(alg, 0, CRYPTO_ALG_ASYNC);
         if (IS_ERR(tfm))
                 return tfm;
 
@@ -109,7 +109,7 @@ free_aead:
         return ERR_PTR(err);
 }
 
-void ieee80211_aes_key_free(struct crypto_aead *tfm)
+void aead_key_free(struct crypto_aead *tfm)
 {
         crypto_free_aead(tfm);
 }
diff --git a/net/mac80211/aead_api.h b/net/mac80211/aead_api.h
new file mode 100644
index 000000000000..5e39ea843bbf
--- /dev/null
+++ b/net/mac80211/aead_api.h
@@ -0,0 +1,27 @@
+/*
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+
+#ifndef _AEAD_API_H
+#define _AEAD_API_H
+
+#include <crypto/aead.h>
+#include <linux/crypto.h>
+
+struct crypto_aead *
+aead_key_setup_encrypt(const char *alg, const u8 key[],
+                       size_t key_len, size_t mic_len);
+
+int aead_encrypt(struct crypto_aead *tfm, u8 *b_0, u8 *aad,
+                 size_t aad_len, u8 *data,
+                 size_t data_len, u8 *mic);
+
+int aead_decrypt(struct crypto_aead *tfm, u8 *b_0, u8 *aad,
+                 size_t aad_len, u8 *data,
+                 size_t data_len, u8 *mic);
+
+void aead_key_free(struct crypto_aead *tfm);
+
+#endif /* _AEAD_API_H */
diff --git a/net/mac80211/aes_ccm.h b/net/mac80211/aes_ccm.h
index fcd3254c5cf0..e9b7ca0bde5b 100644
--- a/net/mac80211/aes_ccm.h
+++ b/net/mac80211/aes_ccm.h
@@ -10,19 +10,39 @@
 #ifndef AES_CCM_H
 #define AES_CCM_H
 
-#include <linux/crypto.h>
+#include "aead_api.h"
 
 #define CCM_AAD_LEN     32
 
-struct crypto_aead *ieee80211_aes_key_setup_encrypt(const u8 key[],
-                                                    size_t key_len,
-                                                    size_t mic_len);
-int ieee80211_aes_ccm_encrypt(struct crypto_aead *tfm, u8 *b_0, u8 *aad,
-                              u8 *data, size_t data_len, u8 *mic,
-                              size_t mic_len);
-int ieee80211_aes_ccm_decrypt(struct crypto_aead *tfm, u8 *b_0, u8 *aad,
-                              u8 *data, size_t data_len, u8 *mic,
-                              size_t mic_len);
-void ieee80211_aes_key_free(struct crypto_aead *tfm);
+static inline struct crypto_aead *
+ieee80211_aes_key_setup_encrypt(const u8 key[], size_t key_len, size_t mic_len)
+{
+        return aead_key_setup_encrypt("ccm(aes)", key, key_len, mic_len);
+}
+
+static inline int
+ieee80211_aes_ccm_encrypt(struct crypto_aead *tfm,
+                          u8 *b_0, u8 *aad, u8 *data,
+                          size_t data_len, u8 *mic)
+{
+        return aead_encrypt(tfm, b_0, aad + 2,
+                            be16_to_cpup((__be16 *)aad),
+                            data, data_len, mic);
+}
+
+static inline int
+ieee80211_aes_ccm_decrypt(struct crypto_aead *tfm,
+                          u8 *b_0, u8 *aad, u8 *data,
+                          size_t data_len, u8 *mic)
+{
+        return aead_decrypt(tfm, b_0, aad + 2,
+                            be16_to_cpup((__be16 *)aad),
+                            data, data_len, mic);
+}
+
+static inline void ieee80211_aes_key_free(struct crypto_aead *tfm)
+{
+        return aead_key_free(tfm);
+}
 
 #endif /* AES_CCM_H */
diff --git a/net/mac80211/aes_gcm.c b/net/mac80211/aes_gcm.c
deleted file mode 100644
index 8a4397cc1b08..000000000000
--- a/net/mac80211/aes_gcm.c
+++ /dev/null
@@ -1,109 +0,0 @@
-/*
- * Copyright 2014-2015, Qualcomm Atheros, Inc.
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation.
- */
-
-#include <linux/kernel.h>
-#include <linux/types.h>
-#include <linux/err.h>
-#include <crypto/aead.h>
-
-#include <net/mac80211.h>
-#include "key.h"
-#include "aes_gcm.h"
-
-int ieee80211_aes_gcm_encrypt(struct crypto_aead *tfm, u8 *j_0, u8 *aad,
-                              u8 *data, size_t data_len, u8 *mic)
-{
-        struct scatterlist sg[3];
-        struct aead_request *aead_req;
-        int reqsize = sizeof(*aead_req) + crypto_aead_reqsize(tfm);
-        u8 *__aad;
-
-        aead_req = kzalloc(reqsize + GCM_AAD_LEN, GFP_ATOMIC);
-        if (!aead_req)
-                return -ENOMEM;
-
-        __aad = (u8 *)aead_req + reqsize;
-        memcpy(__aad, aad, GCM_AAD_LEN);
-
-        sg_init_table(sg, 3);
-        sg_set_buf(&sg[0], &__aad[2], be16_to_cpup((__be16 *)__aad));
-        sg_set_buf(&sg[1], data, data_len);
-        sg_set_buf(&sg[2], mic, IEEE80211_GCMP_MIC_LEN);
-
-        aead_request_set_tfm(aead_req, tfm);
-        aead_request_set_crypt(aead_req, sg, sg, data_len, j_0);
-        aead_request_set_ad(aead_req, sg[0].length);
-
-        crypto_aead_encrypt(aead_req);
-        kzfree(aead_req);
-        return 0;
-}
-
-int ieee80211_aes_gcm_decrypt(struct crypto_aead *tfm, u8 *j_0, u8 *aad,
-                              u8 *data, size_t data_len, u8 *mic)
-{
-        struct scatterlist sg[3];
-        struct aead_request *aead_req;
-        int reqsize = sizeof(*aead_req) + crypto_aead_reqsize(tfm);
-        u8 *__aad;
-        int err;
-
-        if (data_len == 0)
-                return -EINVAL;
-
-        aead_req = kzalloc(reqsize + GCM_AAD_LEN, GFP_ATOMIC);
-        if (!aead_req)
-                return -ENOMEM;
-
-        __aad = (u8 *)aead_req + reqsize;
-        memcpy(__aad, aad, GCM_AAD_LEN);
-
-        sg_init_table(sg, 3);
-        sg_set_buf(&sg[0], &__aad[2], be16_to_cpup((__be16 *)__aad));
-        sg_set_buf(&sg[1], data, data_len);
-        sg_set_buf(&sg[2], mic, IEEE80211_GCMP_MIC_LEN);
-
-        aead_request_set_tfm(aead_req, tfm);
-        aead_request_set_crypt(aead_req, sg, sg,
-                               data_len + IEEE80211_GCMP_MIC_LEN, j_0);
-        aead_request_set_ad(aead_req, sg[0].length);
-
-        err = crypto_aead_decrypt(aead_req);
-        kzfree(aead_req);
-
-        return err;
-}
-
-struct crypto_aead *ieee80211_aes_gcm_key_setup_encrypt(const u8 key[],
-                                                        size_t key_len)
-{
-        struct crypto_aead *tfm;
-        int err;
-
-        tfm = crypto_alloc_aead("gcm(aes)", 0, CRYPTO_ALG_ASYNC);
-        if (IS_ERR(tfm))
-                return tfm;
-
-        err = crypto_aead_setkey(tfm, key, key_len);
-        if (err)
-                goto free_aead;
-        err = crypto_aead_setauthsize(tfm, IEEE80211_GCMP_MIC_LEN);
-        if (err)
-                goto free_aead;
-
-        return tfm;
-
-free_aead:
-        crypto_free_aead(tfm);
-        return ERR_PTR(err);
-}
-
-void ieee80211_aes_gcm_key_free(struct crypto_aead *tfm)
-{
-        crypto_free_aead(tfm);
-}
diff --git a/net/mac80211/aes_gcm.h b/net/mac80211/aes_gcm.h
index 55aed5352494..d2b096033009 100644
--- a/net/mac80211/aes_gcm.h
+++ b/net/mac80211/aes_gcm.h
@@ -9,16 +9,38 @@
 #ifndef AES_GCM_H
 #define AES_GCM_H
 
-#include <linux/crypto.h>
+#include "aead_api.h"
 
 #define GCM_AAD_LEN     32
 
-int ieee80211_aes_gcm_encrypt(struct crypto_aead *tfm, u8 *j_0, u8 *aad,
-                              u8 *data, size_t data_len, u8 *mic);
-int ieee80211_aes_gcm_decrypt(struct crypto_aead *tfm, u8 *j_0, u8 *aad,
-                              u8 *data, size_t data_len, u8 *mic);
-struct crypto_aead *ieee80211_aes_gcm_key_setup_encrypt(const u8 key[],
-                                                        size_t key_len);
-void ieee80211_aes_gcm_key_free(struct crypto_aead *tfm);
+static inline int ieee80211_aes_gcm_encrypt(struct crypto_aead *tfm,
+                                            u8 *j_0, u8 *aad,  u8 *data,
+                                            size_t data_len, u8 *mic)
+{
+        return aead_encrypt(tfm, j_0, aad + 2,
+                            be16_to_cpup((__be16 *)aad),
+                            data, data_len, mic);
+}
+
+static inline int ieee80211_aes_gcm_decrypt(struct crypto_aead *tfm,
+                                            u8 *j_0, u8 *aad, u8 *data,
+                                            size_t data_len, u8 *mic)
+{
+        return aead_decrypt(tfm, j_0, aad + 2,
+                            be16_to_cpup((__be16 *)aad),
+                            data, data_len, mic);
+}
+
+static inline struct crypto_aead *
+ieee80211_aes_gcm_key_setup_encrypt(const u8 key[], size_t key_len)
+{
+        return aead_key_setup_encrypt("gcm(aes)", key,
+                                      key_len, IEEE80211_GCMP_MIC_LEN);
+}
+
+static inline void ieee80211_aes_gcm_key_free(struct crypto_aead *tfm)
+{
+        return aead_key_free(tfm);
+}
 
 #endif /* AES_GCM_H */
diff --git a/net/mac80211/agg-rx.c b/net/mac80211/agg-rx.c
index 2849a1fc41c5..d444752dbf40 100644
--- a/net/mac80211/agg-rx.c
+++ b/net/mac80211/agg-rx.c
@@ -151,21 +151,17 @@ EXPORT_SYMBOL(ieee80211_stop_rx_ba_session);
  * After accepting the AddBA Request we activated a timer,
  * resetting it after each frame that arrives from the originator.
  */
-static void sta_rx_agg_session_timer_expired(unsigned long data)
+static void sta_rx_agg_session_timer_expired(struct timer_list *t)
 {
-        /* not an elegant detour, but there is no choice as the timer passes
-         * only one argument, and various sta_info are needed here, so init
-         * flow in sta_info_create gives the TID as data, while the timer_to_id
-         * array gives the sta through container_of */
-        u8 *ptid = (u8 *)data;
-        u8 *timer_to_id = ptid - *ptid;
-        struct sta_info *sta = container_of(timer_to_id, struct sta_info,
-                                         timer_to_tid[0]);
+        struct tid_ampdu_rx *tid_rx_timer =
+                from_timer(tid_rx_timer, t, session_timer);
+        struct sta_info *sta = tid_rx_timer->sta;
+        u8 tid = tid_rx_timer->tid;
         struct tid_ampdu_rx *tid_rx;
         unsigned long timeout;
 
         rcu_read_lock();
-        tid_rx = rcu_dereference(sta->ampdu_mlme.tid_rx[*ptid]);
+        tid_rx = rcu_dereference(sta->ampdu_mlme.tid_rx[tid]);
         if (!tid_rx) {
                 rcu_read_unlock();
                 return;
@@ -180,21 +176,18 @@ static void sta_rx_agg_session_timer_expired(unsigned long data)
         rcu_read_unlock();
 
         ht_dbg(sta->sdata, "RX session timer expired on %pM tid %d\n",
-               sta->sta.addr, (u16)*ptid);
+               sta->sta.addr, tid);
 
-        set_bit(*ptid, sta->ampdu_mlme.tid_rx_timer_expired);
+        set_bit(tid, sta->ampdu_mlme.tid_rx_timer_expired);
         ieee80211_queue_work(&sta->local->hw, &sta->ampdu_mlme.work);
 }
 
-static void sta_rx_agg_reorder_timer_expired(unsigned long data)
+static void sta_rx_agg_reorder_timer_expired(struct timer_list *t)
 {
-        u8 *ptid = (u8 *)data;
-        u8 *timer_to_id = ptid - *ptid;
-        struct sta_info *sta = container_of(timer_to_id, struct sta_info,
-                        timer_to_tid[0]);
+        struct tid_ampdu_rx *tid_rx = from_timer(tid_rx, t, reorder_timer);
 
         rcu_read_lock();
-        ieee80211_release_reorder_timeout(sta, *ptid);
+        ieee80211_release_reorder_timeout(tid_rx->sta, tid_rx->tid);
         rcu_read_unlock();
 }
 
@@ -356,14 +349,12 @@ void ___ieee80211_start_rx_ba_session(struct sta_info *sta,
         spin_lock_init(&tid_agg_rx->reorder_lock);
 
         /* rx timer */
-        setup_deferrable_timer(&tid_agg_rx->session_timer,
-                               sta_rx_agg_session_timer_expired,
-                               (unsigned long)&sta->timer_to_tid[tid]);
+        timer_setup(&tid_agg_rx->session_timer,
+                    sta_rx_agg_session_timer_expired, TIMER_DEFERRABLE);
 
         /* rx reorder timer */
-        setup_timer(&tid_agg_rx->reorder_timer,
-                    sta_rx_agg_reorder_timer_expired,
-                    (unsigned long)&sta->timer_to_tid[tid]);
+        timer_setup(&tid_agg_rx->reorder_timer,
+                    sta_rx_agg_reorder_timer_expired, 0);
 
         /* prepare reordering buffer */
         tid_agg_rx->reorder_buf =
@@ -399,6 +390,8 @@ void ___ieee80211_start_rx_ba_session(struct sta_info *sta,
         tid_agg_rx->auto_seq = auto_seq;
         tid_agg_rx->started = false;
         tid_agg_rx->reorder_buf_filtered = 0;
+        tid_agg_rx->tid = tid;
+        tid_agg_rx->sta = sta;
         status = WLAN_STATUS_SUCCESS;
 
         /* activate it for RX */
@@ -459,7 +452,7 @@ void ieee80211_process_addba_request(struct ieee80211_local *local,
 }
 
 void ieee80211_manage_rx_ba_offl(struct ieee80211_vif *vif,
-                                 const u8 *addr, unsigned int bit)
+                                 const u8 *addr, unsigned int tid)
 {
         struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
         struct ieee80211_local *local = sdata->local;
@@ -470,7 +463,7 @@ void ieee80211_manage_rx_ba_offl(struct ieee80211_vif *vif,
         if (!sta)
                 goto unlock;
 
-        set_bit(bit, sta->ampdu_mlme.tid_rx_manage_offl);
+        set_bit(tid, sta->ampdu_mlme.tid_rx_manage_offl);
         ieee80211_queue_work(&local->hw, &sta->ampdu_mlme.work);
  unlock:
         rcu_read_unlock();
diff --git a/net/mac80211/agg-tx.c b/net/mac80211/agg-tx.c
index bef516ec47f9..5f8ab5be369f 100644
--- a/net/mac80211/agg-tx.c
+++ b/net/mac80211/agg-tx.c
@@ -330,6 +330,11 @@ int ___ieee80211_stop_tx_ba_session(struct sta_info *sta, u16 tid,
 
         spin_lock_bh(&sta->lock);
 
+        /* free struct pending for start, if present */
+        tid_tx = sta->ampdu_mlme.tid_start_tx[tid];
+        kfree(tid_tx);
+        sta->ampdu_mlme.tid_start_tx[tid] = NULL;
+
         tid_tx = rcu_dereference_protected_tid_tx(sta, tid);
         if (!tid_tx) {
                 spin_unlock_bh(&sta->lock);
@@ -422,15 +427,12 @@ int ___ieee80211_stop_tx_ba_session(struct sta_info *sta, u16 tid,
  * add Block Ack response will arrive from the recipient.
  * If this timer expires sta_addba_resp_timer_expired will be executed.
  */
-static void sta_addba_resp_timer_expired(unsigned long data)
+static void sta_addba_resp_timer_expired(struct timer_list *t)
 {
-        /* not an elegant detour, but there is no choice as the timer passes
-         * only one argument, and both sta_info and TID are needed, so init
-         * flow in sta_info_create gives the TID as data, while the timer_to_id
-         * array gives the sta through container_of */
-        u16 tid = *(u8 *)data;
-        struct sta_info *sta = container_of((void *)data,
-                struct sta_info, timer_to_tid[tid]);
+        struct tid_ampdu_tx *tid_tx_timer =
+                from_timer(tid_tx_timer, t, addba_resp_timer);
+        struct sta_info *sta = tid_tx_timer->sta;
+        u8 tid = tid_tx_timer->tid;
         struct tid_ampdu_tx *tid_tx;
 
         /* check if the TID waits for addBA response */
@@ -525,21 +527,17 @@ void ieee80211_tx_ba_session_handle_start(struct sta_info *sta, int tid)
  * After accepting the AddBA Response we activated a timer,
  * resetting it after each frame that we send.
  */
-static void sta_tx_agg_session_timer_expired(unsigned long data)
+static void sta_tx_agg_session_timer_expired(struct timer_list *t)
 {
-        /* not an elegant detour, but there is no choice as the timer passes
-         * only one argument, and various sta_info are needed here, so init
-         * flow in sta_info_create gives the TID as data, while the timer_to_id
-         * array gives the sta through container_of */
-        u8 *ptid = (u8 *)data;
-        u8 *timer_to_id = ptid - *ptid;
-        struct sta_info *sta = container_of(timer_to_id, struct sta_info,
-                                         timer_to_tid[0]);
+        struct tid_ampdu_tx *tid_tx_timer =
+                from_timer(tid_tx_timer, t, session_timer);
+        struct sta_info *sta = tid_tx_timer->sta;
+        u8 tid = tid_tx_timer->tid;
         struct tid_ampdu_tx *tid_tx;
         unsigned long timeout;
 
         rcu_read_lock();
-        tid_tx = rcu_dereference(sta->ampdu_mlme.tid_tx[*ptid]);
+        tid_tx = rcu_dereference(sta->ampdu_mlme.tid_tx[tid]);
         if (!tid_tx || test_bit(HT_AGG_STATE_STOPPING, &tid_tx->state)) {
                 rcu_read_unlock();
                 return;
@@ -555,9 +553,9 @@ static void sta_tx_agg_session_timer_expired(unsigned long data)
         rcu_read_unlock();
 
         ht_dbg(sta->sdata, "tx session timer expired on %pM tid %d\n",
-               sta->sta.addr, (u16)*ptid);
+               sta->sta.addr, tid);
 
-        ieee80211_stop_tx_ba_session(&sta->sta, *ptid);
+        ieee80211_stop_tx_ba_session(&sta->sta, tid);
 }
 
 int ieee80211_start_tx_ba_session(struct ieee80211_sta *pubsta, u16 tid,
@@ -670,16 +668,15 @@ int ieee80211_start_tx_ba_session(struct ieee80211_sta *pubsta, u16 tid,
         __set_bit(HT_AGG_STATE_WANT_START, &tid_tx->state);
 
         tid_tx->timeout = timeout;
+        tid_tx->sta = sta;
+        tid_tx->tid = tid;
 
         /* response timer */
-        setup_timer(&tid_tx->addba_resp_timer,
-                    sta_addba_resp_timer_expired,
-                    (unsigned long)&sta->timer_to_tid[tid]);
+        timer_setup(&tid_tx->addba_resp_timer, sta_addba_resp_timer_expired, 0);
 
         /* tx timer */
-        setup_deferrable_timer(&tid_tx->session_timer,
-                               sta_tx_agg_session_timer_expired,
-                               (unsigned long)&sta->timer_to_tid[tid]);
+        timer_setup(&tid_tx->session_timer,
+                    sta_tx_agg_session_timer_expired, TIMER_DEFERRABLE);
 
         /* assign a dialog token */
         sta->ampdu_mlme.dialog_token_allocator++;
diff --git a/net/mac80211/ht.c b/net/mac80211/ht.c
index d6d0b4201e40..41f5e48f8021 100644
--- a/net/mac80211/ht.c
+++ b/net/mac80211/ht.c
@@ -290,13 +290,15 @@ void ieee80211_sta_tear_down_BA_sessions(struct sta_info *sta,
 {
         int i;
 
+        mutex_lock(&sta->ampdu_mlme.mtx);
         for (i = 0; i <  IEEE80211_NUM_TIDS; i++) {
-                __ieee80211_stop_tx_ba_session(sta, i, reason);
-                __ieee80211_stop_rx_ba_session(sta, i, WLAN_BACK_RECIPIENT,
-                                               WLAN_REASON_QSTA_LEAVE_QBSS,
-                                               reason != AGG_STOP_DESTROY_STA &&
-                                               reason != AGG_STOP_PEER_REQUEST);
+                ___ieee80211_stop_tx_ba_session(sta, i, reason);
+                ___ieee80211_stop_rx_ba_session(sta, i, WLAN_BACK_RECIPIENT,
+                                                WLAN_REASON_QSTA_LEAVE_QBSS,
+                                                reason != AGG_STOP_DESTROY_STA &&
+                                                reason != AGG_STOP_PEER_REQUEST);
         }
+        mutex_unlock(&sta->ampdu_mlme.mtx);
 
         /* stopping might queue the work again - so cancel only afterwards */
         cancel_work_sync(&sta->ampdu_mlme.work);
diff --git a/net/mac80211/ibss.c b/net/mac80211/ibss.c
index e9c6aa3ed05b..db07e0de9a03 100644
--- a/net/mac80211/ibss.c
+++ b/net/mac80211/ibss.c
@@ -1711,10 +1711,10 @@ void ieee80211_ibss_work(struct ieee80211_sub_if_data *sdata)
         sdata_unlock(sdata);
 }
 
-static void ieee80211_ibss_timer(unsigned long data)
+static void ieee80211_ibss_timer(struct timer_list *t)
 {
         struct ieee80211_sub_if_data *sdata =
-                (struct ieee80211_sub_if_data *) data;
+                from_timer(sdata, t, u.ibss.timer);
 
         ieee80211_queue_work(&sdata->local->hw, &sdata->work);
 }
@@ -1723,8 +1723,7 @@ void ieee80211_ibss_setup_sdata(struct ieee80211_sub_if_data *sdata)
 {
         struct ieee80211_if_ibss *ifibss = &sdata->u.ibss;
 
-        setup_timer(&ifibss->timer, ieee80211_ibss_timer,
-                    (unsigned long) sdata);
+        timer_setup(&ifibss->timer, ieee80211_ibss_timer, 0);
         INIT_LIST_HEAD(&ifibss->incomplete_stations);
         spin_lock_init(&ifibss->incomplete_lock);
         INIT_WORK(&ifibss->csa_connection_drop_work,
diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h
index 9675814f64db..885d00b41911 100644
--- a/net/mac80211/ieee80211_i.h
+++ b/net/mac80211/ieee80211_i.h
@@ -1057,6 +1057,7 @@ struct tpt_led_trigger {
         const struct ieee80211_tpt_blink *blink_table;
         unsigned int blink_table_len;
         struct timer_list timer;
+        struct ieee80211_local *local;
         unsigned long prev_traffic;
         unsigned long tx_bytes, rx_bytes;
         unsigned int active, want;
@@ -1932,7 +1933,7 @@ static inline int ieee80211_ac_from_tid(int tid)
 
 void ieee80211_dynamic_ps_enable_work(struct work_struct *work);
 void ieee80211_dynamic_ps_disable_work(struct work_struct *work);
-void ieee80211_dynamic_ps_timer(unsigned long data);
+void ieee80211_dynamic_ps_timer(struct timer_list *t);
 void ieee80211_send_nullfunc(struct ieee80211_local *local,
                              struct ieee80211_sub_if_data *sdata,
                              bool powersave);
@@ -2009,6 +2010,8 @@ void ieee80211_txq_init(struct ieee80211_sub_if_data *sdata,
                         struct txq_info *txq, int tid);
 void ieee80211_txq_purge(struct ieee80211_local *local,
                          struct txq_info *txqi);
+void ieee80211_txq_remove_vlan(struct ieee80211_local *local,
+                               struct ieee80211_sub_if_data *sdata);
 void ieee80211_send_auth(struct ieee80211_sub_if_data *sdata,
                          u16 transaction, u16 auth_alg, u16 status,
                          const u8 *extra, size_t extra_len, const u8 *bssid,
diff --git a/net/mac80211/iface.c b/net/mac80211/iface.c
index f75029abf728..13b16f90e1cf 100644
--- a/net/mac80211/iface.c
+++ b/net/mac80211/iface.c
@@ -793,9 +793,7 @@ static int ieee80211_open(struct net_device *dev)
 static void ieee80211_do_stop(struct ieee80211_sub_if_data *sdata,
                               bool going_down)
 {
-        struct ieee80211_sub_if_data *txq_sdata = sdata;
         struct ieee80211_local *local = sdata->local;
-        struct fq *fq = &local->fq;
         unsigned long flags;
         struct sk_buff *skb, *tmp;
         u32 hw_reconf_flags = 0;
@@ -939,9 +937,6 @@ static void ieee80211_do_stop(struct ieee80211_sub_if_data *sdata,
 
         switch (sdata->vif.type) {
         case NL80211_IFTYPE_AP_VLAN:
-                txq_sdata = container_of(sdata->bss,
-                                         struct ieee80211_sub_if_data, u.ap);
-
                 mutex_lock(&local->mtx);
                 list_del(&sdata->u.vlan.list);
                 mutex_unlock(&local->mtx);
@@ -998,8 +993,6 @@ static void ieee80211_do_stop(struct ieee80211_sub_if_data *sdata,
                 skb_queue_purge(&sdata->skb_queue);
         }
 
-        sdata->bss = NULL;
-
         spin_lock_irqsave(&local->queue_stop_reason_lock, flags);
         for (i = 0; i < IEEE80211_MAX_QUEUES; i++) {
                 skb_queue_walk_safe(&local->pending[i], skb, tmp) {
@@ -1012,22 +1005,10 @@ static void ieee80211_do_stop(struct ieee80211_sub_if_data *sdata,
         }
         spin_unlock_irqrestore(&local->queue_stop_reason_lock, flags);
 
-        if (txq_sdata->vif.txq) {
-                struct txq_info *txqi = to_txq_info(txq_sdata->vif.txq);
-
-                /*
-                 * FIXME FIXME
-                 *
-                 * We really shouldn't purge the *entire* txqi since that
-                 * contains frames for the other AP_VLANs (and possibly
-                 * the AP itself) as well, but there's no API in FQ now
-                 * to be able to filter.
-                 */
+        if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
+                ieee80211_txq_remove_vlan(local, sdata);
 
-                spin_lock_bh(&fq->lock);
-                ieee80211_txq_purge(local, txqi);
-                spin_unlock_bh(&fq->lock);
-        }
+        sdata->bss = NULL;
 
         if (local->open_count == 0)
                 ieee80211_clear_tx_pending(local);
@@ -1772,7 +1753,9 @@ int ieee80211_if_add(struct ieee80211_local *local, const char *name,
                                  sizeof(void *));
                 int txq_size = 0;
 
-                if (local->ops->wake_tx_queue)
+                if (local->ops->wake_tx_queue &&
+                    type != NL80211_IFTYPE_AP_VLAN &&
+                    type != NL80211_IFTYPE_MONITOR)
                         txq_size += sizeof(struct txq_info) +
                                     local->hw.txq_data_size;
 
diff --git a/net/mac80211/led.c b/net/mac80211/led.c
index 0505845b7ab8..ba0b507ea691 100644
--- a/net/mac80211/led.c
+++ b/net/mac80211/led.c
@@ -248,10 +248,10 @@ static unsigned long tpt_trig_traffic(struct ieee80211_local *local,
         return DIV_ROUND_UP(delta, 1024 / 8);
 }
 
-static void tpt_trig_timer(unsigned long data)
+static void tpt_trig_timer(struct timer_list *t)
 {
-        struct ieee80211_local *local = (void *)data;
-        struct tpt_led_trigger *tpt_trig = local->tpt_led_trigger;
+        struct tpt_led_trigger *tpt_trig = from_timer(tpt_trig, t, timer);
+        struct ieee80211_local *local = tpt_trig->local;
         struct led_classdev *led_cdev;
         unsigned long on, off, tpt;
         int i;
@@ -306,8 +306,9 @@ __ieee80211_create_tpt_led_trigger(struct ieee80211_hw *hw,
         tpt_trig->blink_table = blink_table;
         tpt_trig->blink_table_len = blink_table_len;
         tpt_trig->want = flags;
+        tpt_trig->local = local;
 
-        setup_timer(&tpt_trig->timer, tpt_trig_timer, (unsigned long)local);
+        timer_setup(&tpt_trig->timer, tpt_trig_timer, 0);
 
         local->tpt_led_trigger = tpt_trig;
 
@@ -326,7 +327,7 @@ static void ieee80211_start_tpt_led_trig(struct ieee80211_local *local)
         tpt_trig_traffic(local, tpt_trig);
         tpt_trig->running = true;
 
-        tpt_trig_timer((unsigned long)local);
+        tpt_trig_timer(&tpt_trig->timer);
         mod_timer(&tpt_trig->timer, round_jiffies(jiffies + HZ));
 }
 
diff --git a/net/mac80211/main.c b/net/mac80211/main.c
index 8aa1f5b6a051..e054a2fd8d38 100644
--- a/net/mac80211/main.c
+++ b/net/mac80211/main.c
@@ -633,8 +633,7 @@ struct ieee80211_hw *ieee80211_alloc_hw_nm(size_t priv_data_len,
                   ieee80211_dynamic_ps_enable_work);
         INIT_WORK(&local->dynamic_ps_disable_work,
                   ieee80211_dynamic_ps_disable_work);
-        setup_timer(&local->dynamic_ps_timer,
-                    ieee80211_dynamic_ps_timer, (unsigned long) local);
+        timer_setup(&local->dynamic_ps_timer, ieee80211_dynamic_ps_timer, 0);
 
         INIT_WORK(&local->sched_scan_stopped_work,
                   ieee80211_sched_scan_stopped_work);
diff --git a/net/mac80211/mesh.c b/net/mac80211/mesh.c
index a550c707cd8a..5e27364e10ac 100644
--- a/net/mac80211/mesh.c
+++ b/net/mac80211/mesh.c
@@ -37,9 +37,10 @@ void ieee80211s_stop(void)
         kmem_cache_destroy(rm_cache);
 }
 
-static void ieee80211_mesh_housekeeping_timer(unsigned long data)
+static void ieee80211_mesh_housekeeping_timer(struct timer_list *t)
 {
-        struct ieee80211_sub_if_data *sdata = (void *) data;
+        struct ieee80211_sub_if_data *sdata =
+                from_timer(sdata, t, u.mesh.housekeeping_timer);
         struct ieee80211_local *local = sdata->local;
         struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
 
@@ -528,18 +529,18 @@ int mesh_add_vht_oper_ie(struct ieee80211_sub_if_data *sdata,
         return 0;
 }
 
-static void ieee80211_mesh_path_timer(unsigned long data)
+static void ieee80211_mesh_path_timer(struct timer_list *t)
 {
         struct ieee80211_sub_if_data *sdata =
-                (struct ieee80211_sub_if_data *) data;
+                from_timer(sdata, t, u.mesh.mesh_path_timer);
 
         ieee80211_queue_work(&sdata->local->hw, &sdata->work);
 }
 
-static void ieee80211_mesh_path_root_timer(unsigned long data)
+static void ieee80211_mesh_path_root_timer(struct timer_list *t)
 {
         struct ieee80211_sub_if_data *sdata =
-                (struct ieee80211_sub_if_data *) data;
+                from_timer(sdata, t, u.mesh.mesh_path_root_timer);
         struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
 
         set_bit(MESH_WORK_ROOT, &ifmsh->wrkq_flags);
@@ -675,8 +676,7 @@ ieee80211_mesh_build_beacon(struct ieee80211_if_mesh *ifmsh)
         enum nl80211_band band;
         u8 *pos;
         struct ieee80211_sub_if_data *sdata;
-        int hdr_len = offsetof(struct ieee80211_mgmt, u.beacon) +
-                      sizeof(mgmt->u.beacon);
+        int hdr_len = offsetofend(struct ieee80211_mgmt, u.beacon);
 
         sdata = container_of(ifmsh, struct ieee80211_sub_if_data, u.mesh);
         rcu_read_lock();
@@ -1443,9 +1443,8 @@ void ieee80211_mesh_init_sdata(struct ieee80211_sub_if_data *sdata)
         struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
         static u8 zero_addr[ETH_ALEN] = {};
 
-        setup_timer(&ifmsh->housekeeping_timer,
-                    ieee80211_mesh_housekeeping_timer,
-                    (unsigned long) sdata);
+        timer_setup(&ifmsh->housekeeping_timer,
+                    ieee80211_mesh_housekeeping_timer, 0);
 
         ifmsh->accepting_plinks = true;
         atomic_set(&ifmsh->mpaths, 0);
@@ -1459,12 +1458,9 @@ void ieee80211_mesh_init_sdata(struct ieee80211_sub_if_data *sdata)
 
         mesh_pathtbl_init(sdata);
 
-        setup_timer(&ifmsh->mesh_path_timer,
-                    ieee80211_mesh_path_timer,
-                    (unsigned long) sdata);
-        setup_timer(&ifmsh->mesh_path_root_timer,
-                    ieee80211_mesh_path_root_timer,
-                    (unsigned long) sdata);
+        timer_setup(&ifmsh->mesh_path_timer, ieee80211_mesh_path_timer, 0);
+        timer_setup(&ifmsh->mesh_path_root_timer,
+                    ieee80211_mesh_path_root_timer, 0);
         INIT_LIST_HEAD(&ifmsh->preq_queue.list);
         skb_queue_head_init(&ifmsh->ps.bc_buf);
         spin_lock_init(&ifmsh->mesh_preq_queue_lock);
diff --git a/net/mac80211/mesh.h b/net/mac80211/mesh.h
index 7e5f271e3c30..ee56f18cad3f 100644
--- a/net/mac80211/mesh.h
+++ b/net/mac80211/mesh.h
@@ -275,6 +275,7 @@ void mesh_neighbour_update(struct ieee80211_sub_if_data *sdata,
                            u8 *hw_addr, struct ieee802_11_elems *ie);
 bool mesh_peer_accepts_plinks(struct ieee802_11_elems *ie);
 u32 mesh_accept_plinks_update(struct ieee80211_sub_if_data *sdata);
+void mesh_plink_timer(struct timer_list *t);
 void mesh_plink_broken(struct sta_info *sta);
 u32 mesh_plink_deactivate(struct sta_info *sta);
 u32 mesh_plink_open(struct sta_info *sta);
@@ -295,7 +296,7 @@ void mesh_path_tx_pending(struct mesh_path *mpath);
 int mesh_pathtbl_init(struct ieee80211_sub_if_data *sdata);
 void mesh_pathtbl_unregister(struct ieee80211_sub_if_data *sdata);
 int mesh_path_del(struct ieee80211_sub_if_data *sdata, const u8 *addr);
-void mesh_path_timer(unsigned long data);
+void mesh_path_timer(struct timer_list *t);
 void mesh_path_flush_by_nexthop(struct sta_info *sta);
 void mesh_path_discard_frame(struct ieee80211_sub_if_data *sdata,
                              struct sk_buff *skb);
diff --git a/net/mac80211/mesh_hwmp.c b/net/mac80211/mesh_hwmp.c
index d8bbd0d2225a..4f7826d7b47c 100644
--- a/net/mac80211/mesh_hwmp.c
+++ b/net/mac80211/mesh_hwmp.c
@@ -111,8 +111,8 @@ static int mesh_path_sel_frame_tx(enum mpath_frame_type action, u8 flags,
         struct sk_buff *skb;
         struct ieee80211_mgmt *mgmt;
         u8 *pos, ie_len;
-        int hdr_len = offsetof(struct ieee80211_mgmt, u.action.u.mesh_action) +
-                      sizeof(mgmt->u.action.u.mesh_action);
+        int hdr_len = offsetofend(struct ieee80211_mgmt,
+                                  u.action.u.mesh_action);
 
         skb = dev_alloc_skb(local->tx_headroom +
                             hdr_len +
@@ -242,8 +242,8 @@ int mesh_path_error_tx(struct ieee80211_sub_if_data *sdata,
         struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
         struct ieee80211_mgmt *mgmt;
         u8 *pos, ie_len;
-        int hdr_len = offsetof(struct ieee80211_mgmt, u.action.u.mesh_action) +
-                      sizeof(mgmt->u.action.u.mesh_action);
+        int hdr_len = offsetofend(struct ieee80211_mgmt,
+                                  u.action.u.mesh_action);
 
         if (time_before(jiffies, ifmsh->next_perr))
                 return -EAGAIN;
@@ -1194,9 +1194,9 @@ endlookup:
         return err;
 }
 
-void mesh_path_timer(unsigned long data)
+void mesh_path_timer(struct timer_list *t)
 {
-        struct mesh_path *mpath = (void *) data;
+        struct mesh_path *mpath = from_timer(mpath, t, timer);
         struct ieee80211_sub_if_data *sdata = mpath->sdata;
         int ret;
 
diff --git a/net/mac80211/mesh_pathtbl.c b/net/mac80211/mesh_pathtbl.c
index 97269caafecd..86c8dfef56a4 100644
--- a/net/mac80211/mesh_pathtbl.c
+++ b/net/mac80211/mesh_pathtbl.c
@@ -399,8 +399,7 @@ struct mesh_path *mesh_path_new(struct ieee80211_sub_if_data *sdata,
         skb_queue_head_init(&new_mpath->frame_queue);
         new_mpath->exp_time = jiffies;
         spin_lock_init(&new_mpath->state_lock);
-        setup_timer(&new_mpath->timer, mesh_path_timer,
-                    (unsigned long) new_mpath);
+        timer_setup(&new_mpath->timer, mesh_path_timer, 0);
 
         return new_mpath;
 }
diff --git a/net/mac80211/mesh_plink.c b/net/mac80211/mesh_plink.c
index f69c6c38ca43..e2d00cce3c17 100644
--- a/net/mac80211/mesh_plink.c
+++ b/net/mac80211/mesh_plink.c
@@ -220,8 +220,7 @@ static int mesh_plink_frame_tx(struct ieee80211_sub_if_data *sdata,
         bool include_plid = false;
         u16 peering_proto = 0;
         u8 *pos, ie_len = 4;
-        int hdr_len = offsetof(struct ieee80211_mgmt, u.action.u.self_prot) +
-                      sizeof(mgmt->u.action.u.self_prot);
+        int hdr_len = offsetofend(struct ieee80211_mgmt, u.action.u.self_prot);
         int err = -ENOMEM;
 
         skb = dev_alloc_skb(local->tx_headroom +
@@ -604,8 +603,9 @@ out:
         ieee80211_mbss_info_change_notify(sdata, changed);
 }
 
-static void mesh_plink_timer(unsigned long data)
+void mesh_plink_timer(struct timer_list *t)
 {
+        struct mesh_sta *mesh = from_timer(mesh, t, plink_timer);
         struct sta_info *sta;
         u16 reason = 0;
         struct ieee80211_sub_if_data *sdata;
@@ -617,7 +617,7 @@ static void mesh_plink_timer(unsigned long data)
          * del_timer_sync() this timer after having made sure
          * it cannot be readded (by deleting the plink.)
          */
-        sta = (struct sta_info *) data;
+        sta = mesh->plink_sta;
 
         if (sta->sdata->local->quiescing)
                 return;
@@ -697,11 +697,8 @@ static void mesh_plink_timer(unsigned long data)
 
 static inline void mesh_plink_timer_set(struct sta_info *sta, u32 timeout)
 {
-        sta->mesh->plink_timer.expires = jiffies + msecs_to_jiffies(timeout);
-        sta->mesh->plink_timer.data = (unsigned long) sta;
-        sta->mesh->plink_timer.function = mesh_plink_timer;
         sta->mesh->plink_timeout = timeout;
-        add_timer(&sta->mesh->plink_timer);
+        mod_timer(&sta->mesh->plink_timer, jiffies + msecs_to_jiffies(timeout));
 }
 
 static bool llid_in_use(struct ieee80211_sub_if_data *sdata,
diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
index 3b8e2709d8de..04460440d731 100644
--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
@@ -145,7 +145,6 @@ static u32
 ieee80211_determine_chantype(struct ieee80211_sub_if_data *sdata,
                              struct ieee80211_supported_band *sband,
                              struct ieee80211_channel *channel,
-                             const struct ieee80211_ht_cap *ht_cap,
                              const struct ieee80211_ht_operation *ht_oper,
                              const struct ieee80211_vht_operation *vht_oper,
                              struct cfg80211_chan_def *chandef, bool tracking)
@@ -163,20 +162,13 @@ ieee80211_determine_chantype(struct ieee80211_sub_if_data *sdata,
         chandef->center_freq1 = channel->center_freq;
         chandef->center_freq2 = 0;
 
-        if (!ht_cap || !ht_oper || !sta_ht_cap.ht_supported) {
+        if (!ht_oper || !sta_ht_cap.ht_supported) {
                 ret = IEEE80211_STA_DISABLE_HT | IEEE80211_STA_DISABLE_VHT;
                 goto out;
         }
 
         chandef->width = NL80211_CHAN_WIDTH_20;
 
-        if (!(ht_cap->cap_info &
-              cpu_to_le16(IEEE80211_HT_CAP_SUP_WIDTH_20_40))) {
-                ret = IEEE80211_STA_DISABLE_40MHZ;
-                vht_chandef = *chandef;
-                goto out;
-        }
-
         ht_cfreq = ieee80211_channel_to_frequency(ht_oper->primary_chan,
                                                   channel->band);
         /* check that channel matches the right operating channel */
@@ -344,7 +336,7 @@ static int ieee80211_config_bw(struct ieee80211_sub_if_data *sdata,
 
         /* calculate new channel (type) based on HT/VHT operation IEs */
         flags = ieee80211_determine_chantype(sdata, sband, chan,
-                                             ht_cap, ht_oper, vht_oper,
+                                             ht_oper, vht_oper,
                                              &chandef, true);
 
         /*
@@ -780,11 +772,12 @@ static void ieee80211_send_assoc(struct ieee80211_sub_if_data *sdata)
                         WLAN_EID_SUPPORTED_REGULATORY_CLASSES,
                         WLAN_EID_HT_CAPABILITY,
                         WLAN_EID_BSS_COEX_2040,
+                        /* luckily this is almost always there */
                         WLAN_EID_EXT_CAPABILITY,
                         WLAN_EID_QOS_TRAFFIC_CAPA,
                         WLAN_EID_TIM_BCAST_REQ,
                         WLAN_EID_INTERWORKING,
-                        /* 60GHz doesn't happen right now */
+                        /* 60 GHz (Multi-band, DMG, MMS) can't happen */
                         WLAN_EID_VHT_CAPABILITY,
                         WLAN_EID_OPMODE_NOTIF,
                 };
@@ -811,22 +804,16 @@ static void ieee80211_send_assoc(struct ieee80211_sub_if_data *sdata)
         /* if present, add any custom IEs that go before VHT */
         if (assoc_data->ie_len) {
                 static const u8 before_vht[] = {
-                        WLAN_EID_SSID,
-                        WLAN_EID_SUPP_RATES,
-                        WLAN_EID_EXT_SUPP_RATES,
-                        WLAN_EID_PWR_CAPABILITY,
-                        WLAN_EID_SUPPORTED_CHANNELS,
-                        WLAN_EID_RSN,
-                        WLAN_EID_QOS_CAPA,
-                        WLAN_EID_RRM_ENABLED_CAPABILITIES,
-                        WLAN_EID_MOBILITY_DOMAIN,
-                        WLAN_EID_SUPPORTED_REGULATORY_CLASSES,
-                        WLAN_EID_HT_CAPABILITY,
+                        /*
+                         * no need to list the ones split off before HT
+                         * or generated here
+                         */
                         WLAN_EID_BSS_COEX_2040,
                         WLAN_EID_EXT_CAPABILITY,
                         WLAN_EID_QOS_TRAFFIC_CAPA,
                         WLAN_EID_TIM_BCAST_REQ,
                         WLAN_EID_INTERWORKING,
+                        /* 60 GHz (Multi-band, DMG, MMS) can't happen */
                 };
 
                 /* RIC already taken above, so no need to handle here anymore */
@@ -1079,10 +1066,10 @@ void ieee80211_chswitch_done(struct ieee80211_vif *vif, bool success)
 }
 EXPORT_SYMBOL(ieee80211_chswitch_done);
 
-static void ieee80211_chswitch_timer(unsigned long data)
+static void ieee80211_chswitch_timer(struct timer_list *t)
 {
         struct ieee80211_sub_if_data *sdata =
-                (struct ieee80211_sub_if_data *) data;
+                from_timer(sdata, t, u.mgd.chswitch_timer);
 
         ieee80211_queue_work(&sdata->local->hw, &sdata->u.mgd.chswitch_work);
 }
@@ -1590,9 +1577,9 @@ void ieee80211_dynamic_ps_enable_work(struct work_struct *work)
         }
 }
 
-void ieee80211_dynamic_ps_timer(unsigned long data)
+void ieee80211_dynamic_ps_timer(struct timer_list *t)
 {
-        struct ieee80211_local *local = (void *) data;
+        struct ieee80211_local *local = from_timer(local, t, dynamic_ps_timer);
 
         ieee80211_queue_work(&local->hw, &local->dynamic_ps_enable_work);
 }
@@ -3724,10 +3711,10 @@ void ieee80211_sta_rx_queued_mgmt(struct ieee80211_sub_if_data *sdata,
         sdata_unlock(sdata);
 }
 
-static void ieee80211_sta_timer(unsigned long data)
+static void ieee80211_sta_timer(struct timer_list *t)
 {
         struct ieee80211_sub_if_data *sdata =
-                (struct ieee80211_sub_if_data *) data;
+                from_timer(sdata, t, u.mgd.timer);
 
         ieee80211_queue_work(&sdata->local->hw, &sdata->work);
 }
@@ -4004,10 +3991,10 @@ void ieee80211_sta_work(struct ieee80211_sub_if_data *sdata)
         sdata_unlock(sdata);
 }
 
-static void ieee80211_sta_bcn_mon_timer(unsigned long data)
+static void ieee80211_sta_bcn_mon_timer(struct timer_list *t)
 {
         struct ieee80211_sub_if_data *sdata =
-                (struct ieee80211_sub_if_data *) data;
+                from_timer(sdata, t, u.mgd.bcn_mon_timer);
         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
 
         if (sdata->vif.csa_active && !ifmgd->csa_waiting_bcn)
@@ -4018,10 +4005,10 @@ static void ieee80211_sta_bcn_mon_timer(unsigned long data)
                              &sdata->u.mgd.beacon_connection_loss_work);
 }
 
-static void ieee80211_sta_conn_mon_timer(unsigned long data)
+static void ieee80211_sta_conn_mon_timer(struct timer_list *t)
 {
         struct ieee80211_sub_if_data *sdata =
-                (struct ieee80211_sub_if_data *) data;
+                from_timer(sdata, t, u.mgd.conn_mon_timer);
         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
         struct ieee80211_local *local = sdata->local;
 
@@ -4152,14 +4139,10 @@ void ieee80211_sta_setup_sdata(struct ieee80211_sub_if_data *sdata)
         INIT_WORK(&ifmgd->request_smps_work, ieee80211_request_smps_mgd_work);
         INIT_DELAYED_WORK(&ifmgd->tdls_peer_del_work,
                           ieee80211_tdls_peer_del_work);
-        setup_timer(&ifmgd->timer, ieee80211_sta_timer,
-                    (unsigned long) sdata);
-        setup_timer(&ifmgd->bcn_mon_timer, ieee80211_sta_bcn_mon_timer,
-                    (unsigned long) sdata);
-        setup_timer(&ifmgd->conn_mon_timer, ieee80211_sta_conn_mon_timer,
-                    (unsigned long) sdata);
-        setup_timer(&ifmgd->chswitch_timer, ieee80211_chswitch_timer,
-                    (unsigned long) sdata);
+        timer_setup(&ifmgd->timer, ieee80211_sta_timer, 0);
+        timer_setup(&ifmgd->bcn_mon_timer, ieee80211_sta_bcn_mon_timer, 0);
+        timer_setup(&ifmgd->conn_mon_timer, ieee80211_sta_conn_mon_timer, 0);
+        timer_setup(&ifmgd->chswitch_timer, ieee80211_chswitch_timer, 0);
         INIT_DELAYED_WORK(&ifmgd->tx_tspec_wk,
                           ieee80211_sta_handle_tspec_ac_params_wk);
 
@@ -4317,7 +4300,7 @@ static int ieee80211_prep_channel(struct ieee80211_sub_if_data *sdata,
 
         ifmgd->flags |= ieee80211_determine_chantype(sdata, sband,
                                                      cbss->channel,
-                                                     ht_cap, ht_oper, vht_oper,
+                                                     ht_oper, vht_oper,
                                                      &chandef, false);
 
         sdata->needed_rx_chains = min(ieee80211_ht_vht_rx_chains(sdata, cbss),
diff --git a/net/mac80211/ocb.c b/net/mac80211/ocb.c
index 88e6ebbbe24f..d351dc1162be 100644
--- a/net/mac80211/ocb.c
+++ b/net/mac80211/ocb.c
@@ -150,9 +150,10 @@ void ieee80211_ocb_work(struct ieee80211_sub_if_data *sdata)
         sdata_unlock(sdata);
 }
 
-static void ieee80211_ocb_housekeeping_timer(unsigned long data)
+static void ieee80211_ocb_housekeeping_timer(struct timer_list *t)
 {
-        struct ieee80211_sub_if_data *sdata = (void *)data;
+        struct ieee80211_sub_if_data *sdata =
+                from_timer(sdata, t, u.ocb.housekeeping_timer);
         struct ieee80211_local *local = sdata->local;
         struct ieee80211_if_ocb *ifocb = &sdata->u.ocb;
 
@@ -165,9 +166,8 @@ void ieee80211_ocb_setup_sdata(struct ieee80211_sub_if_data *sdata)
 {
         struct ieee80211_if_ocb *ifocb = &sdata->u.ocb;
 
-        setup_timer(&ifocb->housekeeping_timer,
-                    ieee80211_ocb_housekeeping_timer,
-                    (unsigned long)sdata);
+        timer_setup(&ifocb->housekeeping_timer,
+                    ieee80211_ocb_housekeeping_timer, 0);
         INIT_LIST_HEAD(&ifocb->incomplete_stations);
         spin_lock_init(&ifocb->incomplete_lock);
 }
diff --git a/net/mac80211/scan.c b/net/mac80211/scan.c
index 47d2ed570470..ef2becaade50 100644
--- a/net/mac80211/scan.c
+++ b/net/mac80211/scan.c
@@ -7,7 +7,7 @@
  * Copyright 2006-2007  Jiri Benc <jbenc@suse.cz>
  * Copyright 2007, Michael Wu <flamingice@sourmilk.net>
  * Copyright 2013-2015  Intel Mobile Communications GmbH
- * Copyright 2016  Intel Deutschland GmbH
+ * Copyright 2016-2017  Intel Deutschland GmbH
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 2 as
@@ -183,6 +183,20 @@ ieee80211_bss_info_update(struct ieee80211_local *local,
         return bss;
 }
 
+static bool ieee80211_scan_accept_presp(struct ieee80211_sub_if_data *sdata,
+                                        u32 scan_flags, const u8 *da)
+{
+        if (!sdata)
+                return false;
+        /* accept broadcast for OCE */
+        if (scan_flags & NL80211_SCAN_FLAG_ACCEPT_BCAST_PROBE_RESP &&
+            is_broadcast_ether_addr(da))
+                return true;
+        if (scan_flags & NL80211_SCAN_FLAG_RANDOM_ADDR)
+                return true;
+        return ether_addr_equal(da, sdata->vif.addr);
+}
+
 void ieee80211_scan_rx(struct ieee80211_local *local, struct sk_buff *skb)
 {
         struct ieee80211_rx_status *rx_status = IEEE80211_SKB_RXCB(skb);
@@ -208,19 +222,24 @@ void ieee80211_scan_rx(struct ieee80211_local *local, struct sk_buff *skb)
         if (ieee80211_is_probe_resp(mgmt->frame_control)) {
                 struct cfg80211_scan_request *scan_req;
                 struct cfg80211_sched_scan_request *sched_scan_req;
+                u32 scan_req_flags = 0, sched_scan_req_flags = 0;
 
                 scan_req = rcu_dereference(local->scan_req);
                 sched_scan_req = rcu_dereference(local->sched_scan_req);
 
-                /* ignore ProbeResp to foreign address unless scanning
-                 * with randomised address
+                if (scan_req)
+                        scan_req_flags = scan_req->flags;
+
+                if (sched_scan_req)
+                        sched_scan_req_flags = sched_scan_req->flags;
+
+                /* ignore ProbeResp to foreign address or non-bcast (OCE)
+                 * unless scanning with randomised address
                  */
-                if (!(sdata1 &&
-                      (ether_addr_equal(mgmt->da, sdata1->vif.addr) ||
-                       scan_req->flags & NL80211_SCAN_FLAG_RANDOM_ADDR)) &&
-                    !(sdata2 &&
-                      (ether_addr_equal(mgmt->da, sdata2->vif.addr) ||
-                       sched_scan_req->flags & NL80211_SCAN_FLAG_RANDOM_ADDR)))
+                if (!ieee80211_scan_accept_presp(sdata1, scan_req_flags,
+                                                 mgmt->da) &&
+                    !ieee80211_scan_accept_presp(sdata2, sched_scan_req_flags,
+                                                 mgmt->da))
                         return;
 
                 elements = mgmt->u.probe_resp.variable;
diff --git a/net/mac80211/sta_info.c b/net/mac80211/sta_info.c
index 214d2ba02877..0c5627f8a104 100644
--- a/net/mac80211/sta_info.c
+++ b/net/mac80211/sta_info.c
@@ -329,10 +329,12 @@ struct sta_info *sta_info_alloc(struct ieee80211_sub_if_data *sdata,
                 sta->mesh = kzalloc(sizeof(*sta->mesh), gfp);
                 if (!sta->mesh)
                         goto free;
+                sta->mesh->plink_sta = sta;
                 spin_lock_init(&sta->mesh->plink_lock);
                 if (ieee80211_vif_is_mesh(&sdata->vif) &&
                     !sdata->u.mesh.user_mpm)
-                        init_timer(&sta->mesh->plink_timer);
+                        timer_setup(&sta->mesh->plink_timer, mesh_plink_timer,
+                                    0);
                 sta->mesh->nonpeer_pm = NL80211_MESH_POWER_ACTIVE;
         }
 #endif
@@ -377,14 +379,6 @@ struct sta_info *sta_info_alloc(struct ieee80211_sub_if_data *sdata,
         if (sta_prepare_rate_control(local, sta, gfp))
                 goto free_txq;
 
-        for (i = 0; i < IEEE80211_NUM_TIDS; i++) {
-                /*
-                 * timer_to_tid must be initialized with identity mapping
-                 * to enable session_timer's data differentiation. See
-                 * sta_rx_agg_session_timer_expired for usage.
-                 */
-                sta->timer_to_tid[i] = i;
-        }
         for (i = 0; i < IEEE80211_NUM_ACS; i++) {
                 skb_queue_head_init(&sta->ps_tx_buf[i]);
                 skb_queue_head_init(&sta->tx_filtered[i]);
@@ -515,6 +509,31 @@ static int sta_info_insert_drv_state(struct ieee80211_local *local,
         return err;
 }
 
+static void
+ieee80211_recalc_p2p_go_ps_allowed(struct ieee80211_sub_if_data *sdata)
+{
+        struct ieee80211_local *local = sdata->local;
+        bool allow_p2p_go_ps = sdata->vif.p2p;
+        struct sta_info *sta;
+
+        rcu_read_lock();
+        list_for_each_entry_rcu(sta, &local->sta_list, list) {
+                if (sdata != sta->sdata ||
+                    !test_sta_flag(sta, WLAN_STA_ASSOC))
+                        continue;
+                if (!sta->sta.support_p2p_ps) {
+                        allow_p2p_go_ps = false;
+                        break;
+                }
+        }
+        rcu_read_unlock();
+
+        if (allow_p2p_go_ps != sdata->vif.bss_conf.allow_p2p_go_ps) {
+                sdata->vif.bss_conf.allow_p2p_go_ps = allow_p2p_go_ps;
+                ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_P2P_PS);
+        }
+}
+
 /*
  * should be called with sta_mtx locked
  * this function replaces the mutex lock
@@ -561,6 +580,13 @@ static int sta_info_insert_finish(struct sta_info *sta) __acquires(RCU)
                 goto out_remove;
 
         set_sta_flag(sta, WLAN_STA_INSERTED);
+
+        if (sta->sta_state >= IEEE80211_STA_ASSOC) {
+                ieee80211_recalc_min_chandef(sta->sdata);
+                if (!sta->sta.support_p2p_ps)
+                        ieee80211_recalc_p2p_go_ps_allowed(sta->sdata);
+        }
+
         /* accept BA sessions now */
         clear_sta_flag(sta, WLAN_STA_BLOCK_BA);
 
@@ -1030,9 +1056,9 @@ int sta_info_destroy_addr_bss(struct ieee80211_sub_if_data *sdata,
         return ret;
 }
 
-static void sta_info_cleanup(unsigned long data)
+static void sta_info_cleanup(struct timer_list *t)
 {
-        struct ieee80211_local *local = (struct ieee80211_local *) data;
+        struct ieee80211_local *local = from_timer(local, t, sta_cleanup);
         struct sta_info *sta;
         bool timer_needed = false;
 
@@ -1064,8 +1090,7 @@ int sta_info_init(struct ieee80211_local *local)
         mutex_init(&local->sta_mtx);
         INIT_LIST_HEAD(&local->sta_list);
 
-        setup_timer(&local->sta_cleanup, sta_info_cleanup,
-                    (unsigned long)local);
+        timer_setup(&local->sta_cleanup, sta_info_cleanup, 0);
         return 0;
 }
 
@@ -1788,31 +1813,6 @@ void ieee80211_sta_set_buffered(struct ieee80211_sta *pubsta,
 }
 EXPORT_SYMBOL(ieee80211_sta_set_buffered);
 
-static void
-ieee80211_recalc_p2p_go_ps_allowed(struct ieee80211_sub_if_data *sdata)
-{
-        struct ieee80211_local *local = sdata->local;
-        bool allow_p2p_go_ps = sdata->vif.p2p;
-        struct sta_info *sta;
-
-        rcu_read_lock();
-        list_for_each_entry_rcu(sta, &local->sta_list, list) {
-                if (sdata != sta->sdata ||
-                    !test_sta_flag(sta, WLAN_STA_ASSOC))
-                        continue;
-                if (!sta->sta.support_p2p_ps) {
-                        allow_p2p_go_ps = false;
-                        break;
-                }
-        }
-        rcu_read_unlock();
-
-        if (allow_p2p_go_ps != sdata->vif.bss_conf.allow_p2p_go_ps) {
-                sdata->vif.bss_conf.allow_p2p_go_ps = allow_p2p_go_ps;
-                ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_P2P_PS);
-        }
-}
-
 int sta_info_move_state(struct sta_info *sta,
                         enum ieee80211_sta_state new_state)
 {
diff --git a/net/mac80211/sta_info.h b/net/mac80211/sta_info.h
index 3acbdfa9f649..cd53619435b6 100644
--- a/net/mac80211/sta_info.h
+++ b/net/mac80211/sta_info.h
@@ -126,6 +126,8 @@ enum ieee80211_agg_stop_reason {
         AGG_STOP_DESTROY_STA,
 };
 
+struct sta_info;
+
 /**
  * struct tid_ampdu_tx - TID aggregation information (Tx).
  *
@@ -133,8 +135,10 @@ enum ieee80211_agg_stop_reason {
  * @session_timer: check if we keep Tx-ing on the TID (by timeout value)
  * @addba_resp_timer: timer for peer's response to addba request
  * @pending: pending frames queue -- use sta's spinlock to protect
+ * @sta: station we are attached to
  * @dialog_token: dialog token for aggregation session
  * @timeout: session timeout value to be filled in ADDBA requests
+ * @tid: TID number
  * @state: session state (see above)
  * @last_tx: jiffies of last tx activity
  * @stop_initiator: initiator of a session stop
@@ -158,6 +162,7 @@ struct tid_ampdu_tx {
         struct timer_list session_timer;
         struct timer_list addba_resp_timer;
         struct sk_buff_head pending;
+        struct sta_info *sta;
         unsigned long state;
         unsigned long last_tx;
         u16 timeout;
@@ -169,6 +174,7 @@ struct tid_ampdu_tx {
         u16 failed_bar_ssn;
         bool bar_pending;
         bool amsdu;
+        u8 tid;
 };
 
 /**
@@ -181,12 +187,14 @@ struct tid_ampdu_tx {
  * @reorder_time: jiffies when skb was added
  * @session_timer: check if peer keeps Tx-ing on the TID (by timeout value)
  * @reorder_timer: releases expired frames from the reorder buffer.
+ * @sta: station we are attached to
  * @last_rx: jiffies of last rx activity
  * @head_seq_num: head sequence number in reordering buffer.
  * @stored_mpdu_num: number of MPDUs in reordering buffer
  * @ssn: Starting Sequence Number expected to be aggregated.
  * @buf_size: buffer size for incoming A-MPDUs
  * @timeout: reset timer value (in TUs).
+ * @tid: TID number
  * @rcu_head: RCU head used for freeing this struct
  * @reorder_lock: serializes access to reorder buffer, see below.
  * @auto_seq: used for offloaded BA sessions to automatically pick head_seq_and
@@ -208,6 +216,7 @@ struct tid_ampdu_rx {
         u64 reorder_buf_filtered;
         struct sk_buff_head *reorder_buf;
         unsigned long *reorder_time;
+        struct sta_info *sta;
         struct timer_list session_timer;
         struct timer_list reorder_timer;
         unsigned long last_rx;
@@ -216,6 +225,7 @@ struct tid_ampdu_rx {
         u16 ssn;
         u16 buf_size;
         u16 timeout;
+        u8 tid;
         u8 auto_seq:1,
            removed:1,
            started:1;
@@ -344,6 +354,7 @@ DECLARE_EWMA(mesh_fail_avg, 20, 8)
  * @plink_state: peer link state
  * @plink_timeout: timeout of peer link
  * @plink_timer: peer link watch timer
+ * @plink_sta: peer link watch timer's sta_info
  * @t_offset: timing offset relative to this host
  * @t_offset_setpoint: reference timing offset of this sta to be used when
  *      calculating clockdrift
@@ -356,6 +367,7 @@ DECLARE_EWMA(mesh_fail_avg, 20, 8)
  */
 struct mesh_sta {
         struct timer_list plink_timer;
+        struct sta_info *plink_sta;
 
         s64 t_offset;
         s64 t_offset_setpoint;
@@ -398,7 +410,7 @@ struct ieee80211_sta_rx_stats {
         u64 msdu[IEEE80211_NUM_TIDS + 1];
 };
 
-/**
+/*
  * The bandwidth threshold below which the per-station CoDel parameters will be
  * scaled to be more lenient (to prevent starvation of slow stations). This
  * value will be scaled by the number of active stations when it is being
@@ -445,7 +457,6 @@ struct ieee80211_sta_rx_stats {
  *      plus one for non-QoS frames)
  * @tid_seq: per-TID sequence numbers for sending to this STA
  * @ampdu_mlme: A-MPDU state machine state
- * @timer_to_tid: identity mapping to ID timers
  * @mesh: mesh STA information
  * @debugfs_dir: debug filesystem directory dentry
  * @dead: set to true when sta is unlinked
@@ -552,7 +563,6 @@ struct sta_info {
          * Aggregation information, locked with lock.
          */
         struct sta_ampdu_mlme ampdu_mlme;
-        u8 timer_to_tid[IEEE80211_NUM_TIDS];
 
 #ifdef CONFIG_MAC80211_DEBUGFS
         struct dentry *debugfs_dir;
diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
index 94826680cf2b..7b8154474b9e 100644
--- a/net/mac80211/tx.c
+++ b/net/mac80211/tx.c
@@ -1396,6 +1396,40 @@ static void ieee80211_txq_enqueue(struct ieee80211_local *local,
                        fq_flow_get_default_func);
 }
 
+static bool fq_vlan_filter_func(struct fq *fq, struct fq_tin *tin,
+                                struct fq_flow *flow, struct sk_buff *skb,
+                                void *data)
+{
+        struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
+
+        return info->control.vif == data;
+}
+
+void ieee80211_txq_remove_vlan(struct ieee80211_local *local,
+                               struct ieee80211_sub_if_data *sdata)
+{
+        struct fq *fq = &local->fq;
+        struct txq_info *txqi;
+        struct fq_tin *tin;
+        struct ieee80211_sub_if_data *ap;
+
+        if (WARN_ON(sdata->vif.type != NL80211_IFTYPE_AP_VLAN))
+                return;
+
+        ap = container_of(sdata->bss, struct ieee80211_sub_if_data, u.ap);
+
+        if (!ap->vif.txq)
+                return;
+
+        txqi = to_txq_info(ap->vif.txq);
+        tin = &txqi->tin;
+
+        spin_lock_bh(&fq->lock);
+        fq_tin_filter(fq, tin, fq_vlan_filter_func, &sdata->vif,
+                      fq_skb_free_func);
+        spin_unlock_bh(&fq->lock);
+}
+
 void ieee80211_txq_init(struct ieee80211_sub_if_data *sdata,
                         struct sta_info *sta,
                         struct txq_info *txqi, int tid)
diff --git a/net/mac80211/util.c b/net/mac80211/util.c
index 6aef6793d052..d57e5f6bd8b6 100644
--- a/net/mac80211/util.c
+++ b/net/mac80211/util.c
@@ -1392,10 +1392,10 @@ static int ieee80211_build_preq_ies_band(struct ieee80211_local *local,
         /* insert custom IEs that go before HT */
         if (ie && ie_len) {
                 static const u8 before_ht[] = {
-                        WLAN_EID_SSID,
-                        WLAN_EID_SUPP_RATES,
-                        WLAN_EID_REQUEST,
-                        WLAN_EID_EXT_SUPP_RATES,
+                        /*
+                         * no need to list the ones split off already
+                         * (or generated here)
+                         */
                         WLAN_EID_DS_PARAMS,
                         WLAN_EID_SUPPORTED_REGULATORY_CLASSES,
                 };
@@ -1424,20 +1424,17 @@ static int ieee80211_build_preq_ies_band(struct ieee80211_local *local,
         /* insert custom IEs that go before VHT */
         if (ie && ie_len) {
                 static const u8 before_vht[] = {
-                        WLAN_EID_SSID,
-                        WLAN_EID_SUPP_RATES,
-                        WLAN_EID_REQUEST,
-                        WLAN_EID_EXT_SUPP_RATES,
-                        WLAN_EID_DS_PARAMS,
-                        WLAN_EID_SUPPORTED_REGULATORY_CLASSES,
-                        WLAN_EID_HT_CAPABILITY,
+                        /*
+                         * no need to list the ones split off already
+                         * (or generated here)
+                         */
                         WLAN_EID_BSS_COEX_2040,
                         WLAN_EID_EXT_CAPABILITY,
                         WLAN_EID_SSID_LIST,
                         WLAN_EID_CHANNEL_USAGE,
                         WLAN_EID_INTERWORKING,
                         WLAN_EID_MESH_ID,
-                        /* 60 GHz can't happen here right now */
+                        /* 60 GHz (Multi-band, DMG, MMS) can't happen */
                 };
                 noffset = ieee80211_ie_split(ie, ie_len,
                                              before_vht, ARRAY_SIZE(before_vht),
@@ -2980,8 +2977,8 @@ int ieee80211_send_action_csa(struct ieee80211_sub_if_data *sdata,
         struct ieee80211_mgmt *mgmt;
         struct ieee80211_local *local = sdata->local;
         int freq;
-        int hdr_len = offsetof(struct ieee80211_mgmt, u.action.u.chan_switch) +
-                               sizeof(mgmt->u.action.u.chan_switch);
+        int hdr_len = offsetofend(struct ieee80211_mgmt,
+                                  u.action.u.chan_switch);
         u8 *pos;
 
         if (sdata->vif.type != NL80211_IFTYPE_ADHOC &&
diff --git a/net/mac80211/vht.c b/net/mac80211/vht.c
index 19ec2189d3ac..b9276ac849fa 100644
--- a/net/mac80211/vht.c
+++ b/net/mac80211/vht.c
@@ -386,6 +386,16 @@ enum ieee80211_sta_rx_bandwidth ieee80211_sta_cur_vht_bw(struct sta_info *sta)
 
         bw = ieee80211_sta_cap_rx_bw(sta);
         bw = min(bw, sta->cur_max_bandwidth);
+
+        /* Don't consider AP's bandwidth for TDLS peers, section 11.23.1 of
+         * IEEE80211-2016 specification makes higher bandwidth operation
+         * possible on the TDLS link if the peers have wider bandwidth
+         * capability.
+         */
+        if (test_sta_flag(sta, WLAN_STA_TDLS_PEER) &&
+            test_sta_flag(sta, WLAN_STA_TDLS_WIDER_BW))
+                return bw;
+
         bw = min(bw, ieee80211_chan_width_to_rx_bw(bss_width));
 
         return bw;
diff --git a/net/mac80211/wpa.c b/net/mac80211/wpa.c
index 0d722ea98a1b..b58722d9de37 100644
--- a/net/mac80211/wpa.c
+++ b/net/mac80211/wpa.c
@@ -464,7 +464,7 @@ static int ccmp_encrypt_skb(struct ieee80211_tx_data *tx, struct sk_buff *skb,
         pos += IEEE80211_CCMP_HDR_LEN;
         ccmp_special_blocks(skb, pn, b_0, aad);
         return ieee80211_aes_ccm_encrypt(key->u.ccmp.tfm, b_0, aad, pos, len,
-                                         skb_put(skb, mic_len), mic_len);
+                                         skb_put(skb, mic_len));
 }
 
 
@@ -543,7 +543,7 @@ ieee80211_crypto_ccmp_decrypt(struct ieee80211_rx_data *rx,
                                     key->u.ccmp.tfm, b_0, aad,
                                     skb->data + hdrlen + IEEE80211_CCMP_HDR_LEN,
                                     data_len,
-                                    skb->data + skb->len - mic_len, mic_len))
+                                    skb->data + skb->len - mic_len))
                                 return RX_DROP_UNUSABLE;
                 }
 
diff --git a/net/mac802154/llsec.c b/net/mac802154/llsec.c
index 1e1c9b20bab7..2fb703d70803 100644
--- a/net/mac802154/llsec.c
+++ b/net/mac802154/llsec.c
@@ -623,13 +623,18 @@ llsec_do_encrypt_unauth(struct sk_buff *skb, const struct mac802154_llsec *sec,
         u8 iv[16];
         struct scatterlist src;
         SKCIPHER_REQUEST_ON_STACK(req, key->tfm0);
-        int err;
+        int err, datalen;
+        unsigned char *data;
 
         llsec_geniv(iv, sec->params.hwaddr, &hdr->sec);
-        sg_init_one(&src, skb->data, skb->len);
+        /* Compute data payload offset and data length */
+        data = skb_mac_header(skb) + skb->mac_len;
+        datalen = skb_tail_pointer(skb) - data;
+        sg_init_one(&src, data, datalen);
+
         skcipher_request_set_tfm(req, key->tfm0);
         skcipher_request_set_callback(req, 0, NULL, NULL);
-        skcipher_request_set_crypt(req, &src, &src, skb->len, iv);
+        skcipher_request_set_crypt(req, &src, &src, datalen, iv);
         err = crypto_skcipher_encrypt(req);
         skcipher_request_zero(req);
         return err;
@@ -713,7 +718,8 @@ int mac802154_llsec_encrypt(struct mac802154_llsec *sec, struct sk_buff *skb)
         if (hlen < 0 || hdr.fc.type != IEEE802154_FC_TYPE_DATA)
                 return -EINVAL;
 
-        if (!hdr.fc.security_enabled || hdr.sec.level == 0) {
+        if (!hdr.fc.security_enabled ||
+            (hdr.sec.level == IEEE802154_SCF_SECLEVEL_NONE)) {
                 skb_push(skb, hlen);
                 return 0;
         }
diff --git a/net/mpls/Kconfig b/net/mpls/Kconfig
index 5c467ef97311..801ea9098387 100644
--- a/net/mpls/Kconfig
+++ b/net/mpls/Kconfig
@@ -24,6 +24,7 @@ config NET_MPLS_GSO
 
 config MPLS_ROUTING
         tristate "MPLS: routing support"
+        depends on NET_IP_TUNNEL || NET_IP_TUNNEL=n
         ---help---
          Add support for forwarding of mpls packets.
 
diff --git a/net/mpls/af_mpls.c b/net/mpls/af_mpls.c
index c5b9ce41d66f..8ca9915befc8 100644
--- a/net/mpls/af_mpls.c
+++ b/net/mpls/af_mpls.c
@@ -16,6 +16,7 @@
 #include <net/arp.h>
 #include <net/ip_fib.h>
 #include <net/netevent.h>
+#include <net/ip_tunnels.h>
 #include <net/netns/generic.h>
 #if IS_ENABLED(CONFIG_IPV6)
 #include <net/ipv6.h>
@@ -39,6 +40,36 @@ static int one = 1;
 static int label_limit = (1 << 20) - 1;
 static int ttl_max = 255;
 
+#if IS_ENABLED(CONFIG_NET_IP_TUNNEL)
+static size_t ipgre_mpls_encap_hlen(struct ip_tunnel_encap *e)
+{
+        return sizeof(struct mpls_shim_hdr);
+}
+
+static const struct ip_tunnel_encap_ops mpls_iptun_ops = {
+        .encap_hlen     = ipgre_mpls_encap_hlen,
+};
+
+static int ipgre_tunnel_encap_add_mpls_ops(void)
+{
+        return ip_tunnel_encap_add_ops(&mpls_iptun_ops, TUNNEL_ENCAP_MPLS);
+}
+
+static void ipgre_tunnel_encap_del_mpls_ops(void)
+{
+        ip_tunnel_encap_del_ops(&mpls_iptun_ops, TUNNEL_ENCAP_MPLS);
+}
+#else
+static int ipgre_tunnel_encap_add_mpls_ops(void)
+{
+        return 0;
+}
+
+static void ipgre_tunnel_encap_del_mpls_ops(void)
+{
+}
+#endif
+
 static void rtmsg_lfib(int event, u32 label, struct mpls_route *rt,
                        struct nlmsghdr *nlh, struct net *net, u32 portid,
                        unsigned int nlm_flags);
@@ -2485,6 +2516,10 @@ static int __init mpls_init(void)
                       0);
         rtnl_register(PF_MPLS, RTM_GETNETCONF, mpls_netconf_get_devconf,
                       mpls_netconf_dump_devconf, 0);
+        err = ipgre_tunnel_encap_add_mpls_ops();
+        if (err)
+                pr_err("Can't add mpls over gre tunnel ops\n");
+
         err = 0;
 out:
         return err;
@@ -2502,6 +2537,7 @@ static void __exit mpls_exit(void)
         dev_remove_pack(&mpls_packet_type);
         unregister_netdevice_notifier(&mpls_dev_notifier);
         unregister_pernet_subsys(&mpls_net_ops);
+        ipgre_tunnel_encap_del_mpls_ops();
 }
 module_exit(mpls_exit);
 
diff --git a/net/ncsi/ncsi-aen.c b/net/ncsi/ncsi-aen.c
index f135938bf781..67e708e98ccf 100644
--- a/net/ncsi/ncsi-aen.c
+++ b/net/ncsi/ncsi-aen.c
@@ -73,6 +73,9 @@ static int ncsi_aen_handler_lsc(struct ncsi_dev_priv *ndp,
         ncm->data[2] = data;
         ncm->data[4] = ntohl(lsc->oem_status);
 
+        netdev_info(ndp->ndev.dev, "NCSI: LSC AEN - channel %u state %s\n",
+                    nc->id, data & 0x1 ? "up" : "down");
+
         chained = !list_empty(&nc->link);
         state = nc->state;
         spin_unlock_irqrestore(&nc->lock, flags);
@@ -145,6 +148,8 @@ static int ncsi_aen_handler_hncdsc(struct ncsi_dev_priv *ndp,
         ncm = &nc->modes[NCSI_MODE_LINK];
         hncdsc = (struct ncsi_aen_hncdsc_pkt *)h;
         ncm->data[3] = ntohl(hncdsc->status);
+        netdev_info(ndp->ndev.dev, "NCSI: HNCDSC AEN - channel %u state %s\n",
+                    nc->id, ncm->data[3] & 0x3 ? "up" : "down");
         if (!list_empty(&nc->link) ||
             nc->state != NCSI_CHANNEL_ACTIVE) {
                 spin_unlock_irqrestore(&nc->lock, flags);
@@ -212,10 +217,18 @@ int ncsi_aen_handler(struct ncsi_dev_priv *ndp, struct sk_buff *skb)
         }
 
         ret = ncsi_validate_aen_pkt(h, nah->payload);
-        if (ret)
+        if (ret) {
+                netdev_warn(ndp->ndev.dev,
+                            "NCSI: 'bad' packet ignored for AEN type 0x%x\n",
+                            h->type);
                 goto out;
+        }
 
         ret = nah->handler(ndp, h);
+        if (ret)
+                netdev_err(ndp->ndev.dev,
+                           "NCSI: Handler for AEN type 0x%x returned %d\n",
+                           h->type, ret);
 out:
         consume_skb(skb);
         return ret;
diff --git a/net/ncsi/ncsi-manage.c b/net/ncsi/ncsi-manage.c
index 28c42b22b748..c989211bbabc 100644
--- a/net/ncsi/ncsi-manage.c
+++ b/net/ncsi/ncsi-manage.c
@@ -38,7 +38,7 @@ static inline int ncsi_filter_size(int table)
         return sizes[table];
 }
 
-u32 *ncsi_get_filter(struct ncsi_channel *nc, int table, int index)
+static u32 *ncsi_get_filter(struct ncsi_channel *nc, int table, int index)
 {
         struct ncsi_channel_filter *ncf;
         int size;
@@ -184,9 +184,9 @@ report:
         nd->handler(nd);
 }
 
-static void ncsi_channel_monitor(unsigned long data)
+static void ncsi_channel_monitor(struct timer_list *t)
 {
-        struct ncsi_channel *nc = (struct ncsi_channel *)data;
+        struct ncsi_channel *nc = from_timer(nc, t, monitor.timer);
         struct ncsi_package *np = nc->package;
         struct ncsi_dev_priv *ndp = np->ndp;
         struct ncsi_channel_mode *ncm;
@@ -229,6 +229,8 @@ static void ncsi_channel_monitor(unsigned long data)
         case NCSI_CHANNEL_MONITOR_WAIT ... NCSI_CHANNEL_MONITOR_WAIT_MAX:
                 break;
         default:
+                netdev_err(ndp->ndev.dev, "NCSI Channel %d timed out!\n",
+                           nc->id);
                 if (!(ndp->flags & NCSI_DEV_HWA)) {
                         ncsi_report_link(ndp, true);
                         ndp->flags |= NCSI_DEV_RESHUFFLE;
@@ -311,8 +313,7 @@ struct ncsi_channel *ncsi_add_channel(struct ncsi_package *np, unsigned char id)
         nc->package = np;
         nc->state = NCSI_CHANNEL_INACTIVE;
         nc->monitor.enabled = false;
-        setup_timer(&nc->monitor.timer,
-                    ncsi_channel_monitor, (unsigned long)nc);
+        timer_setup(&nc->monitor.timer, ncsi_channel_monitor, 0);
         spin_lock_init(&nc->lock);
         INIT_LIST_HEAD(&nc->link);
         for (index = 0; index < NCSI_CAP_MAX; index++)
@@ -527,9 +528,9 @@ struct ncsi_dev *ncsi_find_dev(struct net_device *dev)
         return NULL;
 }
 
-static void ncsi_request_timeout(unsigned long data)
+static void ncsi_request_timeout(struct timer_list *t)
 {
-        struct ncsi_request *nr = (struct ncsi_request *)data;
+        struct ncsi_request *nr = from_timer(nr, t, timer);
         struct ncsi_dev_priv *ndp = nr->ndp;
         unsigned long flags;
 
@@ -682,7 +683,7 @@ static int clear_one_vid(struct ncsi_dev_priv *ndp, struct ncsi_channel *nc,
         data = ncsi_get_filter(nc, NCSI_FILTER_VLAN, index);
         if (!data) {
                 netdev_err(ndp->ndev.dev,
-                           "ncsi: failed to retrieve filter %d\n", index);
+                           "NCSI: failed to retrieve filter %d\n", index);
                 /* Set the VLAN id to 0 - this will still disable the entry in
                  * the filter table, but we won't know what it was.
                  */
@@ -692,7 +693,7 @@ static int clear_one_vid(struct ncsi_dev_priv *ndp, struct ncsi_channel *nc,
         }
 
         netdev_printk(KERN_DEBUG, ndp->ndev.dev,
-                      "ncsi: removed vlan tag %u at index %d\n",
+                      "NCSI: removed vlan tag %u at index %d\n",
                       vid, index + 1);
         ncsi_remove_filter(nc, NCSI_FILTER_VLAN, index);
 
@@ -718,7 +719,7 @@ static int set_one_vid(struct ncsi_dev_priv *ndp, struct ncsi_channel *nc,
                 if (index < 0) {
                         /* New tag to add */
                         netdev_printk(KERN_DEBUG, ndp->ndev.dev,
-                                      "ncsi: new vlan id to set: %u\n",
+                                      "NCSI: new vlan id to set: %u\n",
                                       vlan->vid);
                         break;
                 }
@@ -745,7 +746,7 @@ static int set_one_vid(struct ncsi_dev_priv *ndp, struct ncsi_channel *nc,
         }
 
         netdev_printk(KERN_DEBUG, ndp->ndev.dev,
-                      "ncsi: set vid %u in packet, index %u\n",
+                      "NCSI: set vid %u in packet, index %u\n",
                       vlan->vid, index + 1);
         nca->type = NCSI_PKT_CMD_SVF;
         nca->words[1] = vlan->vid;
@@ -784,8 +785,11 @@ static void ncsi_configure_channel(struct ncsi_dev_priv *ndp)
                 nca.package = np->id;
                 nca.channel = NCSI_RESERVED_CHANNEL;
                 ret = ncsi_xmit_cmd(&nca);
-                if (ret)
+                if (ret) {
+                        netdev_err(ndp->ndev.dev,
+                                   "NCSI: Failed to transmit CMD_SP\n");
                         goto error;
+                }
 
                 nd->state = ncsi_dev_state_config_cis;
                 break;
@@ -797,8 +801,11 @@ static void ncsi_configure_channel(struct ncsi_dev_priv *ndp)
                 nca.package = np->id;
                 nca.channel = nc->id;
                 ret = ncsi_xmit_cmd(&nca);
-                if (ret)
+                if (ret) {
+                        netdev_err(ndp->ndev.dev,
+                                   "NCSI: Failed to transmit CMD_CIS\n");
                         goto error;
+                }
 
                 nd->state = ncsi_dev_state_config_clear_vids;
                 break;
@@ -895,10 +902,16 @@ static void ncsi_configure_channel(struct ncsi_dev_priv *ndp)
                 }
 
                 ret = ncsi_xmit_cmd(&nca);
-                if (ret)
+                if (ret) {
+                        netdev_err(ndp->ndev.dev,
+                                   "NCSI: Failed to transmit CMD %x\n",
+                                   nca.type);
                         goto error;
+                }
                 break;
         case ncsi_dev_state_config_done:
+                netdev_printk(KERN_DEBUG, ndp->ndev.dev,
+                              "NCSI: channel %u config done\n", nc->id);
                 spin_lock_irqsave(&nc->lock, flags);
                 if (nc->reconfigure_needed) {
                         /* This channel's configuration has been updated
@@ -925,6 +938,9 @@ static void ncsi_configure_channel(struct ncsi_dev_priv *ndp)
                 } else {
                         hot_nc = NULL;
                         nc->state = NCSI_CHANNEL_INACTIVE;
+                        netdev_warn(ndp->ndev.dev,
+                                    "NCSI: channel %u link down after config\n",
+                                    nc->id);
                 }
                 spin_unlock_irqrestore(&nc->lock, flags);
 
@@ -937,8 +953,8 @@ static void ncsi_configure_channel(struct ncsi_dev_priv *ndp)
                 ncsi_process_next_channel(ndp);
                 break;
         default:
-                netdev_warn(dev, "Wrong NCSI state 0x%x in config\n",
-                            nd->state);
+                netdev_alert(dev, "Wrong NCSI state 0x%x in config\n",
+                             nd->state);
         }
 
         return;
@@ -990,10 +1006,17 @@ static int ncsi_choose_active_channel(struct ncsi_dev_priv *ndp)
         }
 
         if (!found) {
+                netdev_warn(ndp->ndev.dev,
+                            "NCSI: No channel found with link\n");
                 ncsi_report_link(ndp, true);
                 return -ENODEV;
         }
 
+        ncm = &found->modes[NCSI_MODE_LINK];
+        netdev_printk(KERN_DEBUG, ndp->ndev.dev,
+                      "NCSI: Channel %u added to queue (link %s)\n",
+                      found->id, ncm->data[2] & 0x1 ? "up" : "down");
+
 out:
         spin_lock_irqsave(&ndp->lock, flags);
         list_add_tail_rcu(&found->link, &ndp->channel_queue);
@@ -1055,6 +1078,8 @@ static int ncsi_enable_hwa(struct ncsi_dev_priv *ndp)
 
         /* We can have no channels in extremely case */
         if (list_empty(&ndp->channel_queue)) {
+                netdev_err(ndp->ndev.dev,
+                           "NCSI: No available channels for HWA\n");
                 ncsi_report_link(ndp, false);
                 return -ENOENT;
         }
@@ -1223,6 +1248,9 @@ static void ncsi_probe_channel(struct ncsi_dev_priv *ndp)
 
         return;
 error:
+        netdev_err(ndp->ndev.dev,
+                   "NCSI: Failed to transmit cmd 0x%x during probe\n",
+                   nca.type);
         ncsi_report_link(ndp, true);
 }
 
@@ -1276,10 +1304,14 @@ int ncsi_process_next_channel(struct ncsi_dev_priv *ndp)
         switch (old_state) {
         case NCSI_CHANNEL_INACTIVE:
                 ndp->ndev.state = ncsi_dev_state_config;
+                netdev_info(ndp->ndev.dev, "NCSI: configuring channel %u\n",
+                            nc->id);
                 ncsi_configure_channel(ndp);
                 break;
         case NCSI_CHANNEL_ACTIVE:
                 ndp->ndev.state = ncsi_dev_state_suspend;
+                netdev_info(ndp->ndev.dev, "NCSI: suspending channel %u\n",
+                            nc->id);
                 ncsi_suspend_channel(ndp);
                 break;
         default:
@@ -1299,6 +1331,8 @@ out:
                 return ncsi_choose_active_channel(ndp);
         }
 
+        netdev_printk(KERN_DEBUG, ndp->ndev.dev,
+                      "NCSI: No more channels to process\n");
         ncsi_report_link(ndp, false);
         return -ENODEV;
 }
@@ -1390,7 +1424,7 @@ static int ncsi_kick_channels(struct ncsi_dev_priv *ndp)
                                                 ncsi_dev_state_config ||
                                                 !list_empty(&nc->link)) {
                                         netdev_printk(KERN_DEBUG, nd->dev,
-                                                      "ncsi: channel %p marked dirty\n",
+                                                      "NCSI: channel %p marked dirty\n",
                                                       nc);
                                         nc->reconfigure_needed = true;
                                 }
@@ -1410,7 +1444,7 @@ static int ncsi_kick_channels(struct ncsi_dev_priv *ndp)
                         spin_unlock_irqrestore(&ndp->lock, flags);
 
                         netdev_printk(KERN_DEBUG, nd->dev,
-                                      "ncsi: kicked channel %p\n", nc);
+                                      "NCSI: kicked channel %p\n", nc);
                         n++;
                 }
         }
@@ -1431,7 +1465,7 @@ int ncsi_vlan_rx_add_vid(struct net_device *dev, __be16 proto, u16 vid)
 
         nd = ncsi_find_dev(dev);
         if (!nd) {
-                netdev_warn(dev, "ncsi: No net_device?\n");
+                netdev_warn(dev, "NCSI: No net_device?\n");
                 return 0;
         }
 
@@ -1442,7 +1476,7 @@ int ncsi_vlan_rx_add_vid(struct net_device *dev, __be16 proto, u16 vid)
                 n_vids++;
                 if (vlan->vid == vid) {
                         netdev_printk(KERN_DEBUG, dev,
-                                      "vid %u already registered\n", vid);
+                                      "NCSI: vid %u already registered\n", vid);
                         return 0;
                 }
         }
@@ -1461,7 +1495,7 @@ int ncsi_vlan_rx_add_vid(struct net_device *dev, __be16 proto, u16 vid)
         vlan->vid = vid;
         list_add_rcu(&vlan->list, &ndp->vlan_vids);
 
-        netdev_printk(KERN_DEBUG, dev, "Added new vid %u\n", vid);
+        netdev_printk(KERN_DEBUG, dev, "NCSI: Added new vid %u\n", vid);
 
         found = ncsi_kick_channels(ndp) != 0;
 
@@ -1481,7 +1515,7 @@ int ncsi_vlan_rx_kill_vid(struct net_device *dev, __be16 proto, u16 vid)
 
         nd = ncsi_find_dev(dev);
         if (!nd) {
-                netdev_warn(dev, "ncsi: no net_device?\n");
+                netdev_warn(dev, "NCSI: no net_device?\n");
                 return 0;
         }
 
@@ -1491,14 +1525,14 @@ int ncsi_vlan_rx_kill_vid(struct net_device *dev, __be16 proto, u16 vid)
         list_for_each_entry_safe(vlan, tmp, &ndp->vlan_vids, list)
                 if (vlan->vid == vid) {
                         netdev_printk(KERN_DEBUG, dev,
-                                      "vid %u found, removing\n", vid);
+                                      "NCSI: vid %u found, removing\n", vid);
                         list_del_rcu(&vlan->list);
                         found = true;
                         kfree(vlan);
                 }
 
         if (!found) {
-                netdev_err(dev, "ncsi: vid %u wasn't registered!\n", vid);
+                netdev_err(dev, "NCSI: vid %u wasn't registered!\n", vid);
                 return -EINVAL;
         }
 
@@ -1542,9 +1576,7 @@ struct ncsi_dev *ncsi_register_dev(struct net_device *dev,
         for (i = 0; i < ARRAY_SIZE(ndp->requests); i++) {
                 ndp->requests[i].id = i;
                 ndp->requests[i].ndp = ndp;
-                setup_timer(&ndp->requests[i].timer,
-                            ncsi_request_timeout,
-                            (unsigned long)&ndp->requests[i]);
+                timer_setup(&ndp->requests[i].timer, ncsi_request_timeout, 0);
         }
 
         spin_lock_irqsave(&ncsi_dev_lock, flags);
@@ -1581,10 +1613,12 @@ int ncsi_start_dev(struct ncsi_dev *nd)
                 return 0;
         }
 
-        if (ndp->flags & NCSI_DEV_HWA)
+        if (ndp->flags & NCSI_DEV_HWA) {
+                netdev_info(ndp->ndev.dev, "NCSI: Enabling HWA mode\n");
                 ret = ncsi_enable_hwa(ndp);
-        else
+        } else {
                 ret = ncsi_choose_active_channel(ndp);
+        }
 
         return ret;
 }
@@ -1615,6 +1649,7 @@ void ncsi_stop_dev(struct ncsi_dev *nd)
                 }
         }
 
+        netdev_printk(KERN_DEBUG, ndp->ndev.dev, "NCSI: Stopping device\n");
         ncsi_report_link(ndp, true);
 }
 EXPORT_SYMBOL_GPL(ncsi_stop_dev);
diff --git a/net/ncsi/ncsi-rsp.c b/net/ncsi/ncsi-rsp.c
index 927dad4759d1..efd933ff5570 100644
--- a/net/ncsi/ncsi-rsp.c
+++ b/net/ncsi/ncsi-rsp.c
@@ -146,7 +146,7 @@ static int ncsi_rsp_handler_ec(struct ncsi_request *nr)
 
         ncm = &nc->modes[NCSI_MODE_ENABLE];
         if (ncm->enable)
-                return -EBUSY;
+                return 0;
 
         ncm->enable = 1;
         return 0;
@@ -173,7 +173,7 @@ static int ncsi_rsp_handler_dc(struct ncsi_request *nr)
 
         ncm = &nc->modes[NCSI_MODE_ENABLE];
         if (!ncm->enable)
-                return -EBUSY;
+                return 0;
 
         ncm->enable = 0;
         return 0;
@@ -217,7 +217,7 @@ static int ncsi_rsp_handler_ecnt(struct ncsi_request *nr)
 
         ncm = &nc->modes[NCSI_MODE_TX_ENABLE];
         if (ncm->enable)
-                return -EBUSY;
+                return 0;
 
         ncm->enable = 1;
         return 0;
@@ -239,7 +239,7 @@ static int ncsi_rsp_handler_dcnt(struct ncsi_request *nr)
 
         ncm = &nc->modes[NCSI_MODE_TX_ENABLE];
         if (!ncm->enable)
-                return -EBUSY;
+                return 0;
 
         ncm->enable = 1;
         return 0;
@@ -263,7 +263,7 @@ static int ncsi_rsp_handler_ae(struct ncsi_request *nr)
         /* Check if the AEN has been enabled */
         ncm = &nc->modes[NCSI_MODE_AEN];
         if (ncm->enable)
-                return -EBUSY;
+                return 0;
 
         /* Update to AEN configuration */
         cmd = (struct ncsi_cmd_ae_pkt *)skb_network_header(nr->cmd);
@@ -382,7 +382,7 @@ static int ncsi_rsp_handler_ev(struct ncsi_request *nr)
         /* Check if VLAN mode has been enabled */
         ncm = &nc->modes[NCSI_MODE_VLAN];
         if (ncm->enable)
-                return -EBUSY;
+                return 0;
 
         /* Update to VLAN mode */
         cmd = (struct ncsi_cmd_ev_pkt *)skb_network_header(nr->cmd);
@@ -409,7 +409,7 @@ static int ncsi_rsp_handler_dv(struct ncsi_request *nr)
         /* Check if VLAN mode has been enabled */
         ncm = &nc->modes[NCSI_MODE_VLAN];
         if (!ncm->enable)
-                return -EBUSY;
+                return 0;
 
         /* Update to VLAN mode */
         ncm->enable = 0;
@@ -455,13 +455,10 @@ static int ncsi_rsp_handler_sma(struct ncsi_request *nr)
 
         bitmap = &ncf->bitmap;
         if (cmd->at_e & 0x1) {
-                if (test_and_set_bit(cmd->index, bitmap))
-                        return -EBUSY;
+                set_bit(cmd->index, bitmap);
                 memcpy(ncf->data + 6 * cmd->index, cmd->mac, 6);
         } else {
-                if (!test_and_clear_bit(cmd->index, bitmap))
-                        return -EBUSY;
-
+                clear_bit(cmd->index, bitmap);
                 memset(ncf->data + 6 * cmd->index, 0, 6);
         }
 
@@ -485,7 +482,7 @@ static int ncsi_rsp_handler_ebf(struct ncsi_request *nr)
         /* Check if broadcast filter has been enabled */
         ncm = &nc->modes[NCSI_MODE_BC];
         if (ncm->enable)
-                return -EBUSY;
+                return 0;
 
         /* Update to broadcast filter mode */
         cmd = (struct ncsi_cmd_ebf_pkt *)skb_network_header(nr->cmd);
@@ -511,7 +508,7 @@ static int ncsi_rsp_handler_dbf(struct ncsi_request *nr)
         /* Check if broadcast filter isn't enabled */
         ncm = &nc->modes[NCSI_MODE_BC];
         if (!ncm->enable)
-                return -EBUSY;
+                return 0;
 
         /* Update to broadcast filter mode */
         ncm->enable = 0;
@@ -538,7 +535,7 @@ static int ncsi_rsp_handler_egmf(struct ncsi_request *nr)
         /* Check if multicast filter has been enabled */
         ncm = &nc->modes[NCSI_MODE_MC];
         if (ncm->enable)
-                return -EBUSY;
+                return 0;
 
         /* Update to multicast filter mode */
         cmd = (struct ncsi_cmd_egmf_pkt *)skb_network_header(nr->cmd);
@@ -564,7 +561,7 @@ static int ncsi_rsp_handler_dgmf(struct ncsi_request *nr)
         /* Check if multicast filter has been enabled */
         ncm = &nc->modes[NCSI_MODE_MC];
         if (!ncm->enable)
-                return -EBUSY;
+                return 0;
 
         /* Update to multicast filter mode */
         ncm->enable = 0;
@@ -591,7 +588,7 @@ static int ncsi_rsp_handler_snfc(struct ncsi_request *nr)
         /* Check if flow control has been enabled */
         ncm = &nc->modes[NCSI_MODE_FC];
         if (ncm->enable)
-                return -EBUSY;
+                return 0;
 
         /* Update to flow control mode */
         cmd = (struct ncsi_cmd_snfc_pkt *)skb_network_header(nr->cmd);
@@ -1032,11 +1029,19 @@ int ncsi_rcv_rsp(struct sk_buff *skb, struct net_device *dev,
         if (payload < 0)
                 payload = ntohs(hdr->length);
         ret = ncsi_validate_rsp_pkt(nr, payload);
-        if (ret)
+        if (ret) {
+                netdev_warn(ndp->ndev.dev,
+                            "NCSI: 'bad' packet ignored for type 0x%x\n",
+                            hdr->type);
                 goto out;
+        }
 
         /* Process the packet */
         ret = nrh->handler(nr);
+        if (ret)
+                netdev_err(ndp->ndev.dev,
+                           "NCSI: Handler for packet type 0x%x returned %d\n",
+                           hdr->type, ret);
 out:
         ncsi_free_request(nr);
         return ret;
diff --git a/net/netfilter/ipset/ip_set_bitmap_gen.h b/net/netfilter/ipset/ip_set_bitmap_gen.h
index 8ad2b52a0b32..5ca18f07683b 100644
--- a/net/netfilter/ipset/ip_set_bitmap_gen.h
+++ b/net/netfilter/ipset/ip_set_bitmap_gen.h
@@ -37,11 +37,11 @@
 #define get_ext(set, map, id)   ((map)->extensions + ((set)->dsize * (id)))
 
 static void
-mtype_gc_init(struct ip_set *set, void (*gc)(unsigned long ul_set))
+mtype_gc_init(struct ip_set *set, void (*gc)(struct timer_list *t))
 {
         struct mtype *map = set->data;
 
-        setup_timer(&map->gc, gc, (unsigned long)set);
+        timer_setup(&map->gc, gc, 0);
         mod_timer(&map->gc, jiffies + IPSET_GC_PERIOD(set->timeout) * HZ);
 }
 
@@ -272,10 +272,10 @@ out:
 }
 
 static void
-mtype_gc(unsigned long ul_set)
+mtype_gc(struct timer_list *t)
 {
-        struct ip_set *set = (struct ip_set *)ul_set;
-        struct mtype *map = set->data;
+        struct mtype *map = from_timer(map, t, gc);
+        struct ip_set *set = map->set;
         void *x;
         u32 id;
 
diff --git a/net/netfilter/ipset/ip_set_bitmap_ip.c b/net/netfilter/ipset/ip_set_bitmap_ip.c
index 4783efff0bde..d8975a0b4282 100644
--- a/net/netfilter/ipset/ip_set_bitmap_ip.c
+++ b/net/netfilter/ipset/ip_set_bitmap_ip.c
@@ -48,6 +48,7 @@ struct bitmap_ip {
         size_t memsize;         /* members size */
         u8 netmask;             /* subnet netmask */
         struct timer_list gc;   /* garbage collection */
+        struct ip_set *set;     /* attached to this ip_set */
         unsigned char extensions[0]     /* data extensions */
                 __aligned(__alignof__(u64));
 };
@@ -232,6 +233,7 @@ init_map_ip(struct ip_set *set, struct bitmap_ip *map,
         map->netmask = netmask;
         set->timeout = IPSET_NO_TIMEOUT;
 
+        map->set = set;
         set->data = map;
         set->family = NFPROTO_IPV4;
 
diff --git a/net/netfilter/ipset/ip_set_bitmap_ipmac.c b/net/netfilter/ipset/ip_set_bitmap_ipmac.c
index 9a065f672d3a..4c279fbd2d5d 100644
--- a/net/netfilter/ipset/ip_set_bitmap_ipmac.c
+++ b/net/netfilter/ipset/ip_set_bitmap_ipmac.c
@@ -52,6 +52,7 @@ struct bitmap_ipmac {
         u32 elements;           /* number of max elements in the set */
         size_t memsize;         /* members size */
         struct timer_list gc;   /* garbage collector */
+        struct ip_set *set;     /* attached to this ip_set */
         unsigned char extensions[0]     /* MAC + data extensions */
                 __aligned(__alignof__(u64));
 };
@@ -307,6 +308,7 @@ init_map_ipmac(struct ip_set *set, struct bitmap_ipmac *map,
         map->elements = elements;
         set->timeout = IPSET_NO_TIMEOUT;
 
+        map->set = set;
         set->data = map;
         set->family = NFPROTO_IPV4;
 
diff --git a/net/netfilter/ipset/ip_set_bitmap_port.c b/net/netfilter/ipset/ip_set_bitmap_port.c
index 7f0c733358a4..7f9bbd7c98b5 100644
--- a/net/netfilter/ipset/ip_set_bitmap_port.c
+++ b/net/netfilter/ipset/ip_set_bitmap_port.c
@@ -40,6 +40,7 @@ struct bitmap_port {
         u32 elements;           /* number of max elements in the set */
         size_t memsize;         /* members size */
         struct timer_list gc;   /* garbage collection */
+        struct ip_set *set;     /* attached to this ip_set */
         unsigned char extensions[0]     /* data extensions */
                 __aligned(__alignof__(u64));
 };
@@ -214,6 +215,7 @@ init_map_port(struct ip_set *set, struct bitmap_port *map,
         map->last_port = last_port;
         set->timeout = IPSET_NO_TIMEOUT;
 
+        map->set = set;
         set->data = map;
         set->family = NFPROTO_UNSPEC;
 
diff --git a/net/netfilter/ipset/ip_set_hash_gen.h b/net/netfilter/ipset/ip_set_hash_gen.h
index 51063d9ed0f7..efffc8eabafe 100644
--- a/net/netfilter/ipset/ip_set_hash_gen.h
+++ b/net/netfilter/ipset/ip_set_hash_gen.h
@@ -280,6 +280,7 @@ htable_bits(u32 hashsize)
 struct htype {
         struct htable __rcu *table; /* the hash table */
         struct timer_list gc;   /* garbage collection when timeout enabled */
+        struct ip_set *set;     /* attached to this ip_set */
         u32 maxelem;            /* max elements in the hash */
         u32 initval;            /* random jhash init value */
 #ifdef IP_SET_HASH_WITH_MARKMASK
@@ -429,11 +430,11 @@ mtype_destroy(struct ip_set *set)
 }
 
 static void
-mtype_gc_init(struct ip_set *set, void (*gc)(unsigned long ul_set))
+mtype_gc_init(struct ip_set *set, void (*gc)(struct timer_list *t))
 {
         struct htype *h = set->data;
 
-        setup_timer(&h->gc, gc, (unsigned long)set);
+        timer_setup(&h->gc, gc, 0);
         mod_timer(&h->gc, jiffies + IPSET_GC_PERIOD(set->timeout) * HZ);
         pr_debug("gc initialized, run in every %u\n",
                  IPSET_GC_PERIOD(set->timeout));
@@ -526,10 +527,10 @@ mtype_expire(struct ip_set *set, struct htype *h)
 }
 
 static void
-mtype_gc(unsigned long ul_set)
+mtype_gc(struct timer_list *t)
 {
-        struct ip_set *set = (struct ip_set *)ul_set;
-        struct htype *h = set->data;
+        struct htype *h = from_timer(h, t, gc);
+        struct ip_set *set = h->set;
 
         pr_debug("called\n");
         spin_lock_bh(&set->lock);
@@ -1314,6 +1315,7 @@ IPSET_TOKEN(HTYPE, _create)(struct net *net, struct ip_set *set,
         t->htable_bits = hbits;
         RCU_INIT_POINTER(h->table, t);
 
+        h->set = set;
         set->data = h;
 #ifndef IP_SET_PROTO_UNDEF
         if (set->family == NFPROTO_IPV4) {
diff --git a/net/netfilter/ipset/ip_set_hash_ipportnet.c b/net/netfilter/ipset/ip_set_hash_ipportnet.c
index a2f19b9906e9..0f164e986bf1 100644
--- a/net/netfilter/ipset/ip_set_hash_ipportnet.c
+++ b/net/netfilter/ipset/ip_set_hash_ipportnet.c
@@ -434,7 +434,7 @@ hash_ipportnet6_uadt(struct ip_set *set, struct nlattr *tb[],
         if (unlikely(tb[IPSET_ATTR_IP_TO]))
                 return -IPSET_ERR_HASH_RANGE_UNSUPPORTED;
         if (unlikely(tb[IPSET_ATTR_CIDR])) {
-                u8 cidr = nla_get_u8(tb[IPSET_ATTR_CIDR]);
+                cidr = nla_get_u8(tb[IPSET_ATTR_CIDR]);
 
                 if (cidr != HOST_MASK)
                         return -IPSET_ERR_INVALID_CIDR;
diff --git a/net/netfilter/ipset/ip_set_list_set.c b/net/netfilter/ipset/ip_set_list_set.c
index 178d4eba013b..e864681b8dc5 100644
--- a/net/netfilter/ipset/ip_set_list_set.c
+++ b/net/netfilter/ipset/ip_set_list_set.c
@@ -44,6 +44,7 @@ struct set_adt_elem {
 struct list_set {
         u32 size;               /* size of set list array */
         struct timer_list gc;   /* garbage collection */
+        struct ip_set *set;     /* attached to this ip_set */
         struct net *net;        /* namespace */
         struct list_head members; /* the set members */
 };
@@ -453,7 +454,6 @@ static size_t
 list_set_memsize(const struct list_set *map, size_t dsize)
 {
         struct set_elem *e;
-        size_t memsize;
         u32 n = 0;
 
         rcu_read_lock();
@@ -461,9 +461,7 @@ list_set_memsize(const struct list_set *map, size_t dsize)
                 n++;
         rcu_read_unlock();
 
-        memsize = sizeof(*map) + n * dsize;
-
-        return memsize;
+        return (sizeof(*map) + n * dsize);
 }
 
 static int
@@ -571,10 +569,10 @@ static const struct ip_set_type_variant set_variant = {
 };
 
 static void
-list_set_gc(unsigned long ul_set)
+list_set_gc(struct timer_list *t)
 {
-        struct ip_set *set = (struct ip_set *)ul_set;
-        struct list_set *map = set->data;
+        struct list_set *map = from_timer(map, t, gc);
+        struct ip_set *set = map->set;
 
         spin_lock_bh(&set->lock);
         set_cleanup_entries(set);
@@ -585,11 +583,11 @@ list_set_gc(unsigned long ul_set)
 }
 
 static void
-list_set_gc_init(struct ip_set *set, void (*gc)(unsigned long ul_set))
+list_set_gc_init(struct ip_set *set, void (*gc)(struct timer_list *t))
 {
         struct list_set *map = set->data;
 
-        setup_timer(&map->gc, gc, (unsigned long)set);
+        timer_setup(&map->gc, gc, 0);
         mod_timer(&map->gc, jiffies + IPSET_GC_PERIOD(set->timeout) * HZ);
 }
 
@@ -606,6 +604,7 @@ init_list_set(struct net *net, struct ip_set *set, u32 size)
 
         map->size = size;
         map->net = net;
+        map->set = set;
         INIT_LIST_HEAD(&map->members);
         set->data = map;
 
diff --git a/net/netfilter/ipset/pfxlen.c b/net/netfilter/ipset/pfxlen.c
index 1c8a42c1056c..d5be9c25fad6 100644
--- a/net/netfilter/ipset/pfxlen.c
+++ b/net/netfilter/ipset/pfxlen.c
@@ -3,6 +3,141 @@
 
 /* Prefixlen maps for fast conversions, by Jan Engelhardt. */
 
+#ifdef E
+#undef E
+#endif
+
+#define PREFIXES_MAP                                            \
+        E(0x00000000, 0x00000000, 0x00000000, 0x00000000),      \
+        E(0x80000000, 0x00000000, 0x00000000, 0x00000000),      \
+        E(0xC0000000, 0x00000000, 0x00000000, 0x00000000),      \
+        E(0xE0000000, 0x00000000, 0x00000000, 0x00000000),      \
+        E(0xF0000000, 0x00000000, 0x00000000, 0x00000000),      \
+        E(0xF8000000, 0x00000000, 0x00000000, 0x00000000),      \
+        E(0xFC000000, 0x00000000, 0x00000000, 0x00000000),      \
+        E(0xFE000000, 0x00000000, 0x00000000, 0x00000000),      \
+        E(0xFF000000, 0x00000000, 0x00000000, 0x00000000),      \
+        E(0xFF800000, 0x00000000, 0x00000000, 0x00000000),      \
+        E(0xFFC00000, 0x00000000, 0x00000000, 0x00000000),      \
+        E(0xFFE00000, 0x00000000, 0x00000000, 0x00000000),      \
+        E(0xFFF00000, 0x00000000, 0x00000000, 0x00000000),      \
+        E(0xFFF80000, 0x00000000, 0x00000000, 0x00000000),      \
+        E(0xFFFC0000, 0x00000000, 0x00000000, 0x00000000),      \
+        E(0xFFFE0000, 0x00000000, 0x00000000, 0x00000000),      \
+        E(0xFFFF0000, 0x00000000, 0x00000000, 0x00000000),      \
+        E(0xFFFF8000, 0x00000000, 0x00000000, 0x00000000),      \
+        E(0xFFFFC000, 0x00000000, 0x00000000, 0x00000000),      \
+        E(0xFFFFE000, 0x00000000, 0x00000000, 0x00000000),      \
+        E(0xFFFFF000, 0x00000000, 0x00000000, 0x00000000),      \
+        E(0xFFFFF800, 0x00000000, 0x00000000, 0x00000000),      \
+        E(0xFFFFFC00, 0x00000000, 0x00000000, 0x00000000),      \
+        E(0xFFFFFE00, 0x00000000, 0x00000000, 0x00000000),      \
+        E(0xFFFFFF00, 0x00000000, 0x00000000, 0x00000000),      \
+        E(0xFFFFFF80, 0x00000000, 0x00000000, 0x00000000),      \
+        E(0xFFFFFFC0, 0x00000000, 0x00000000, 0x00000000),      \
+        E(0xFFFFFFE0, 0x00000000, 0x00000000, 0x00000000),      \
+        E(0xFFFFFFF0, 0x00000000, 0x00000000, 0x00000000),      \
+        E(0xFFFFFFF8, 0x00000000, 0x00000000, 0x00000000),      \
+        E(0xFFFFFFFC, 0x00000000, 0x00000000, 0x00000000),      \
+        E(0xFFFFFFFE, 0x00000000, 0x00000000, 0x00000000),      \
+        E(0xFFFFFFFF, 0x00000000, 0x00000000, 0x00000000),      \
+        E(0xFFFFFFFF, 0x80000000, 0x00000000, 0x00000000),      \
+        E(0xFFFFFFFF, 0xC0000000, 0x00000000, 0x00000000),      \
+        E(0xFFFFFFFF, 0xE0000000, 0x00000000, 0x00000000),      \
+        E(0xFFFFFFFF, 0xF0000000, 0x00000000, 0x00000000),      \
+        E(0xFFFFFFFF, 0xF8000000, 0x00000000, 0x00000000),      \
+        E(0xFFFFFFFF, 0xFC000000, 0x00000000, 0x00000000),      \
+        E(0xFFFFFFFF, 0xFE000000, 0x00000000, 0x00000000),      \
+        E(0xFFFFFFFF, 0xFF000000, 0x00000000, 0x00000000),      \
+        E(0xFFFFFFFF, 0xFF800000, 0x00000000, 0x00000000),      \
+        E(0xFFFFFFFF, 0xFFC00000, 0x00000000, 0x00000000),      \
+        E(0xFFFFFFFF, 0xFFE00000, 0x00000000, 0x00000000),      \
+        E(0xFFFFFFFF, 0xFFF00000, 0x00000000, 0x00000000),      \
+        E(0xFFFFFFFF, 0xFFF80000, 0x00000000, 0x00000000),      \
+        E(0xFFFFFFFF, 0xFFFC0000, 0x00000000, 0x00000000),      \
+        E(0xFFFFFFFF, 0xFFFE0000, 0x00000000, 0x00000000),      \
+        E(0xFFFFFFFF, 0xFFFF0000, 0x00000000, 0x00000000),      \
+        E(0xFFFFFFFF, 0xFFFF8000, 0x00000000, 0x00000000),      \
+        E(0xFFFFFFFF, 0xFFFFC000, 0x00000000, 0x00000000),      \
+        E(0xFFFFFFFF, 0xFFFFE000, 0x00000000, 0x00000000),      \
+        E(0xFFFFFFFF, 0xFFFFF000, 0x00000000, 0x00000000),      \
+        E(0xFFFFFFFF, 0xFFFFF800, 0x00000000, 0x00000000),      \
+        E(0xFFFFFFFF, 0xFFFFFC00, 0x00000000, 0x00000000),      \
+        E(0xFFFFFFFF, 0xFFFFFE00, 0x00000000, 0x00000000),      \
+        E(0xFFFFFFFF, 0xFFFFFF00, 0x00000000, 0x00000000),      \
+        E(0xFFFFFFFF, 0xFFFFFF80, 0x00000000, 0x00000000),      \
+        E(0xFFFFFFFF, 0xFFFFFFC0, 0x00000000, 0x00000000),      \
+        E(0xFFFFFFFF, 0xFFFFFFE0, 0x00000000, 0x00000000),      \
+        E(0xFFFFFFFF, 0xFFFFFFF0, 0x00000000, 0x00000000),      \
+        E(0xFFFFFFFF, 0xFFFFFFF8, 0x00000000, 0x00000000),      \
+        E(0xFFFFFFFF, 0xFFFFFFFC, 0x00000000, 0x00000000),      \
+        E(0xFFFFFFFF, 0xFFFFFFFE, 0x00000000, 0x00000000),      \
+        E(0xFFFFFFFF, 0xFFFFFFFF, 0x00000000, 0x00000000),      \
+        E(0xFFFFFFFF, 0xFFFFFFFF, 0x80000000, 0x00000000),      \
+        E(0xFFFFFFFF, 0xFFFFFFFF, 0xC0000000, 0x00000000),      \
+        E(0xFFFFFFFF, 0xFFFFFFFF, 0xE0000000, 0x00000000),      \
+        E(0xFFFFFFFF, 0xFFFFFFFF, 0xF0000000, 0x00000000),      \
+        E(0xFFFFFFFF, 0xFFFFFFFF, 0xF8000000, 0x00000000),      \
+        E(0xFFFFFFFF, 0xFFFFFFFF, 0xFC000000, 0x00000000),      \
+        E(0xFFFFFFFF, 0xFFFFFFFF, 0xFE000000, 0x00000000),      \
+        E(0xFFFFFFFF, 0xFFFFFFFF, 0xFF000000, 0x00000000),      \
+        E(0xFFFFFFFF, 0xFFFFFFFF, 0xFF800000, 0x00000000),      \
+        E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFC00000, 0x00000000),      \
+        E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFE00000, 0x00000000),      \
+        E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFF00000, 0x00000000),      \
+        E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFF80000, 0x00000000),      \
+        E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFFC0000, 0x00000000),      \
+        E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFFE0000, 0x00000000),      \
+        E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFFF0000, 0x00000000),      \
+        E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFFF8000, 0x00000000),      \
+        E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFC000, 0x00000000),      \
+        E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFE000, 0x00000000),      \
+        E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFF000, 0x00000000),      \
+        E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFF800, 0x00000000),      \
+        E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFC00, 0x00000000),      \
+        E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFE00, 0x00000000),      \
+        E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFF00, 0x00000000),      \
+        E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFF80, 0x00000000),      \
+        E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFC0, 0x00000000),      \
+        E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFE0, 0x00000000),      \
+        E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFF0, 0x00000000),      \
+        E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFF8, 0x00000000),      \
+        E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFC, 0x00000000),      \
+        E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFE, 0x00000000),      \
+        E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF, 0x00000000),      \
+        E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF, 0x80000000),      \
+        E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF, 0xC0000000),      \
+        E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF, 0xE0000000),      \
+        E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF, 0xF0000000),      \
+        E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF, 0xF8000000),      \
+        E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF, 0xFC000000),      \
+        E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF, 0xFE000000),      \
+        E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF, 0xFF000000),      \
+        E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF, 0xFF800000),      \
+        E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF, 0xFFC00000),      \
+        E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF, 0xFFE00000),      \
+        E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF, 0xFFF00000),      \
+        E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF, 0xFFF80000),      \
+        E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF, 0xFFFC0000),      \
+        E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF, 0xFFFE0000),      \
+        E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF, 0xFFFF0000),      \
+        E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF, 0xFFFF8000),      \
+        E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFC000),      \
+        E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFE000),      \
+        E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFF000),      \
+        E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFF800),      \
+        E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFC00),      \
+        E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFE00),      \
+        E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFF00),      \
+        E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFF80),      \
+        E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFC0),      \
+        E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFE0),      \
+        E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFF0),      \
+        E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFF8),      \
+        E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFC),      \
+        E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFE),      \
+        E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF),
+
 #define E(a, b, c, d) \
         {.ip6 = { \
                 htonl(a), htonl(b), \
@@ -13,135 +148,7 @@
  * just use prefixlen_netmask_map[prefixlength].ip.
  */
 const union nf_inet_addr ip_set_netmask_map[] = {
-        E(0x00000000, 0x00000000, 0x00000000, 0x00000000),
-        E(0x80000000, 0x00000000, 0x00000000, 0x00000000),
-        E(0xC0000000, 0x00000000, 0x00000000, 0x00000000),
-        E(0xE0000000, 0x00000000, 0x00000000, 0x00000000),
-        E(0xF0000000, 0x00000000, 0x00000000, 0x00000000),
-        E(0xF8000000, 0x00000000, 0x00000000, 0x00000000),
-        E(0xFC000000, 0x00000000, 0x00000000, 0x00000000),
-        E(0xFE000000, 0x00000000, 0x00000000, 0x00000000),
-        E(0xFF000000, 0x00000000, 0x00000000, 0x00000000),
-        E(0xFF800000, 0x00000000, 0x00000000, 0x00000000),
-        E(0xFFC00000, 0x00000000, 0x00000000, 0x00000000),
-        E(0xFFE00000, 0x00000000, 0x00000000, 0x00000000),
-        E(0xFFF00000, 0x00000000, 0x00000000, 0x00000000),
-        E(0xFFF80000, 0x00000000, 0x00000000, 0x00000000),
-        E(0xFFFC0000, 0x00000000, 0x00000000, 0x00000000),
-        E(0xFFFE0000, 0x00000000, 0x00000000, 0x00000000),
-        E(0xFFFF0000, 0x00000000, 0x00000000, 0x00000000),
-        E(0xFFFF8000, 0x00000000, 0x00000000, 0x00000000),
-        E(0xFFFFC000, 0x00000000, 0x00000000, 0x00000000),
-        E(0xFFFFE000, 0x00000000, 0x00000000, 0x00000000),
-        E(0xFFFFF000, 0x00000000, 0x00000000, 0x00000000),
-        E(0xFFFFF800, 0x00000000, 0x00000000, 0x00000000),
-        E(0xFFFFFC00, 0x00000000, 0x00000000, 0x00000000),
-        E(0xFFFFFE00, 0x00000000, 0x00000000, 0x00000000),
-        E(0xFFFFFF00, 0x00000000, 0x00000000, 0x00000000),
-        E(0xFFFFFF80, 0x00000000, 0x00000000, 0x00000000),
-        E(0xFFFFFFC0, 0x00000000, 0x00000000, 0x00000000),
-        E(0xFFFFFFE0, 0x00000000, 0x00000000, 0x00000000),
-        E(0xFFFFFFF0, 0x00000000, 0x00000000, 0x00000000),
-        E(0xFFFFFFF8, 0x00000000, 0x00000000, 0x00000000),
-        E(0xFFFFFFFC, 0x00000000, 0x00000000, 0x00000000),
-        E(0xFFFFFFFE, 0x00000000, 0x00000000, 0x00000000),
-        E(0xFFFFFFFF, 0x00000000, 0x00000000, 0x00000000),
-        E(0xFFFFFFFF, 0x80000000, 0x00000000, 0x00000000),
-        E(0xFFFFFFFF, 0xC0000000, 0x00000000, 0x00000000),
-        E(0xFFFFFFFF, 0xE0000000, 0x00000000, 0x00000000),
-        E(0xFFFFFFFF, 0xF0000000, 0x00000000, 0x00000000),
-        E(0xFFFFFFFF, 0xF8000000, 0x00000000, 0x00000000),
-        E(0xFFFFFFFF, 0xFC000000, 0x00000000, 0x00000000),
-        E(0xFFFFFFFF, 0xFE000000, 0x00000000, 0x00000000),
-        E(0xFFFFFFFF, 0xFF000000, 0x00000000, 0x00000000),
-        E(0xFFFFFFFF, 0xFF800000, 0x00000000, 0x00000000),
-        E(0xFFFFFFFF, 0xFFC00000, 0x00000000, 0x00000000),
-        E(0xFFFFFFFF, 0xFFE00000, 0x00000000, 0x00000000),
-        E(0xFFFFFFFF, 0xFFF00000, 0x00000000, 0x00000000),
-        E(0xFFFFFFFF, 0xFFF80000, 0x00000000, 0x00000000),
-        E(0xFFFFFFFF, 0xFFFC0000, 0x00000000, 0x00000000),
-        E(0xFFFFFFFF, 0xFFFE0000, 0x00000000, 0x00000000),
-        E(0xFFFFFFFF, 0xFFFF0000, 0x00000000, 0x00000000),
-        E(0xFFFFFFFF, 0xFFFF8000, 0x00000000, 0x00000000),
-        E(0xFFFFFFFF, 0xFFFFC000, 0x00000000, 0x00000000),
-        E(0xFFFFFFFF, 0xFFFFE000, 0x00000000, 0x00000000),
-        E(0xFFFFFFFF, 0xFFFFF000, 0x00000000, 0x00000000),
-        E(0xFFFFFFFF, 0xFFFFF800, 0x00000000, 0x00000000),
-        E(0xFFFFFFFF, 0xFFFFFC00, 0x00000000, 0x00000000),
-        E(0xFFFFFFFF, 0xFFFFFE00, 0x00000000, 0x00000000),
-        E(0xFFFFFFFF, 0xFFFFFF00, 0x00000000, 0x00000000),
-        E(0xFFFFFFFF, 0xFFFFFF80, 0x00000000, 0x00000000),
-        E(0xFFFFFFFF, 0xFFFFFFC0, 0x00000000, 0x00000000),
-        E(0xFFFFFFFF, 0xFFFFFFE0, 0x00000000, 0x00000000),
-        E(0xFFFFFFFF, 0xFFFFFFF0, 0x00000000, 0x00000000),
-        E(0xFFFFFFFF, 0xFFFFFFF8, 0x00000000, 0x00000000),
-        E(0xFFFFFFFF, 0xFFFFFFFC, 0x00000000, 0x00000000),
-        E(0xFFFFFFFF, 0xFFFFFFFE, 0x00000000, 0x00000000),
-        E(0xFFFFFFFF, 0xFFFFFFFF, 0x00000000, 0x00000000),
-        E(0xFFFFFFFF, 0xFFFFFFFF, 0x80000000, 0x00000000),
-        E(0xFFFFFFFF, 0xFFFFFFFF, 0xC0000000, 0x00000000),
-        E(0xFFFFFFFF, 0xFFFFFFFF, 0xE0000000, 0x00000000),
-        E(0xFFFFFFFF, 0xFFFFFFFF, 0xF0000000, 0x00000000),
-        E(0xFFFFFFFF, 0xFFFFFFFF, 0xF8000000, 0x00000000),
-        E(0xFFFFFFFF, 0xFFFFFFFF, 0xFC000000, 0x00000000),
-        E(0xFFFFFFFF, 0xFFFFFFFF, 0xFE000000, 0x00000000),
-        E(0xFFFFFFFF, 0xFFFFFFFF, 0xFF000000, 0x00000000),
-        E(0xFFFFFFFF, 0xFFFFFFFF, 0xFF800000, 0x00000000),
-        E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFC00000, 0x00000000),
-        E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFE00000, 0x00000000),
-        E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFF00000, 0x00000000),
-        E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFF80000, 0x00000000),
-        E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFFC0000, 0x00000000),
-        E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFFE0000, 0x00000000),
-        E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFFF0000, 0x00000000),
-        E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFFF8000, 0x00000000),
-        E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFC000, 0x00000000),
-        E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFE000, 0x00000000),
-        E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFF000, 0x00000000),
-        E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFF800, 0x00000000),
-        E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFC00, 0x00000000),
-        E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFE00, 0x00000000),
-        E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFF00, 0x00000000),
-        E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFF80, 0x00000000),
-        E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFC0, 0x00000000),
-        E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFE0, 0x00000000),
-        E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFF0, 0x00000000),
-        E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFF8, 0x00000000),
-        E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFC, 0x00000000),
-        E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFE, 0x00000000),
-        E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF, 0x00000000),
-        E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF, 0x80000000),
-        E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF, 0xC0000000),
-        E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF, 0xE0000000),
-        E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF, 0xF0000000),
-        E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF, 0xF8000000),
-        E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF, 0xFC000000),
-        E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF, 0xFE000000),
-        E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF, 0xFF000000),
-        E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF, 0xFF800000),
-        E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF, 0xFFC00000),
-        E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF, 0xFFE00000),
-        E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF, 0xFFF00000),
-        E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF, 0xFFF80000),
-        E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF, 0xFFFC0000),
-        E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF, 0xFFFE0000),
-        E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF, 0xFFFF0000),
-        E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF, 0xFFFF8000),
-        E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFC000),
-        E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFE000),
-        E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFF000),
-        E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFF800),
-        E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFC00),
-        E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFE00),
-        E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFF00),
-        E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFF80),
-        E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFC0),
-        E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFE0),
-        E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFF0),
-        E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFF8),
-        E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFC),
-        E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFE),
-        E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF),
+        PREFIXES_MAP
 };
 EXPORT_SYMBOL_GPL(ip_set_netmask_map);
 
@@ -155,135 +162,7 @@ EXPORT_SYMBOL_GPL(ip_set_netmask_map);
  * just use prefixlen_hostmask_map[prefixlength].ip.
  */
 const union nf_inet_addr ip_set_hostmask_map[] = {
-        E(0x00000000, 0x00000000, 0x00000000, 0x00000000),
-        E(0x80000000, 0x00000000, 0x00000000, 0x00000000),
-        E(0xC0000000, 0x00000000, 0x00000000, 0x00000000),
-        E(0xE0000000, 0x00000000, 0x00000000, 0x00000000),
-        E(0xF0000000, 0x00000000, 0x00000000, 0x00000000),
-        E(0xF8000000, 0x00000000, 0x00000000, 0x00000000),
-        E(0xFC000000, 0x00000000, 0x00000000, 0x00000000),
-        E(0xFE000000, 0x00000000, 0x00000000, 0x00000000),
-        E(0xFF000000, 0x00000000, 0x00000000, 0x00000000),
-        E(0xFF800000, 0x00000000, 0x00000000, 0x00000000),
-        E(0xFFC00000, 0x00000000, 0x00000000, 0x00000000),
-        E(0xFFE00000, 0x00000000, 0x00000000, 0x00000000),
-        E(0xFFF00000, 0x00000000, 0x00000000, 0x00000000),
-        E(0xFFF80000, 0x00000000, 0x00000000, 0x00000000),
-        E(0xFFFC0000, 0x00000000, 0x00000000, 0x00000000),
-        E(0xFFFE0000, 0x00000000, 0x00000000, 0x00000000),
-        E(0xFFFF0000, 0x00000000, 0x00000000, 0x00000000),
-        E(0xFFFF8000, 0x00000000, 0x00000000, 0x00000000),
-        E(0xFFFFC000, 0x00000000, 0x00000000, 0x00000000),
-        E(0xFFFFE000, 0x00000000, 0x00000000, 0x00000000),
-        E(0xFFFFF000, 0x00000000, 0x00000000, 0x00000000),
-        E(0xFFFFF800, 0x00000000, 0x00000000, 0x00000000),
-        E(0xFFFFFC00, 0x00000000, 0x00000000, 0x00000000),
-        E(0xFFFFFE00, 0x00000000, 0x00000000, 0x00000000),
-        E(0xFFFFFF00, 0x00000000, 0x00000000, 0x00000000),
-        E(0xFFFFFF80, 0x00000000, 0x00000000, 0x00000000),
-        E(0xFFFFFFC0, 0x00000000, 0x00000000, 0x00000000),
-        E(0xFFFFFFE0, 0x00000000, 0x00000000, 0x00000000),
-        E(0xFFFFFFF0, 0x00000000, 0x00000000, 0x00000000),
-        E(0xFFFFFFF8, 0x00000000, 0x00000000, 0x00000000),
-        E(0xFFFFFFFC, 0x00000000, 0x00000000, 0x00000000),
-        E(0xFFFFFFFE, 0x00000000, 0x00000000, 0x00000000),
-        E(0xFFFFFFFF, 0x00000000, 0x00000000, 0x00000000),
-        E(0xFFFFFFFF, 0x80000000, 0x00000000, 0x00000000),
-        E(0xFFFFFFFF, 0xC0000000, 0x00000000, 0x00000000),
-        E(0xFFFFFFFF, 0xE0000000, 0x00000000, 0x00000000),
-        E(0xFFFFFFFF, 0xF0000000, 0x00000000, 0x00000000),
-        E(0xFFFFFFFF, 0xF8000000, 0x00000000, 0x00000000),
-        E(0xFFFFFFFF, 0xFC000000, 0x00000000, 0x00000000),
-        E(0xFFFFFFFF, 0xFE000000, 0x00000000, 0x00000000),
-        E(0xFFFFFFFF, 0xFF000000, 0x00000000, 0x00000000),
-        E(0xFFFFFFFF, 0xFF800000, 0x00000000, 0x00000000),
-        E(0xFFFFFFFF, 0xFFC00000, 0x00000000, 0x00000000),
-        E(0xFFFFFFFF, 0xFFE00000, 0x00000000, 0x00000000),
-        E(0xFFFFFFFF, 0xFFF00000, 0x00000000, 0x00000000),
-        E(0xFFFFFFFF, 0xFFF80000, 0x00000000, 0x00000000),
-        E(0xFFFFFFFF, 0xFFFC0000, 0x00000000, 0x00000000),
-        E(0xFFFFFFFF, 0xFFFE0000, 0x00000000, 0x00000000),
-        E(0xFFFFFFFF, 0xFFFF0000, 0x00000000, 0x00000000),
-        E(0xFFFFFFFF, 0xFFFF8000, 0x00000000, 0x00000000),
-        E(0xFFFFFFFF, 0xFFFFC000, 0x00000000, 0x00000000),
-        E(0xFFFFFFFF, 0xFFFFE000, 0x00000000, 0x00000000),
-        E(0xFFFFFFFF, 0xFFFFF000, 0x00000000, 0x00000000),
-        E(0xFFFFFFFF, 0xFFFFF800, 0x00000000, 0x00000000),
-        E(0xFFFFFFFF, 0xFFFFFC00, 0x00000000, 0x00000000),
-        E(0xFFFFFFFF, 0xFFFFFE00, 0x00000000, 0x00000000),
-        E(0xFFFFFFFF, 0xFFFFFF00, 0x00000000, 0x00000000),
-        E(0xFFFFFFFF, 0xFFFFFF80, 0x00000000, 0x00000000),
-        E(0xFFFFFFFF, 0xFFFFFFC0, 0x00000000, 0x00000000),
-        E(0xFFFFFFFF, 0xFFFFFFE0, 0x00000000, 0x00000000),
-        E(0xFFFFFFFF, 0xFFFFFFF0, 0x00000000, 0x00000000),
-        E(0xFFFFFFFF, 0xFFFFFFF8, 0x00000000, 0x00000000),
-        E(0xFFFFFFFF, 0xFFFFFFFC, 0x00000000, 0x00000000),
-        E(0xFFFFFFFF, 0xFFFFFFFE, 0x00000000, 0x00000000),
-        E(0xFFFFFFFF, 0xFFFFFFFF, 0x00000000, 0x00000000),
-        E(0xFFFFFFFF, 0xFFFFFFFF, 0x80000000, 0x00000000),
-        E(0xFFFFFFFF, 0xFFFFFFFF, 0xC0000000, 0x00000000),
-        E(0xFFFFFFFF, 0xFFFFFFFF, 0xE0000000, 0x00000000),
-        E(0xFFFFFFFF, 0xFFFFFFFF, 0xF0000000, 0x00000000),
-        E(0xFFFFFFFF, 0xFFFFFFFF, 0xF8000000, 0x00000000),
-        E(0xFFFFFFFF, 0xFFFFFFFF, 0xFC000000, 0x00000000),
-        E(0xFFFFFFFF, 0xFFFFFFFF, 0xFE000000, 0x00000000),
-        E(0xFFFFFFFF, 0xFFFFFFFF, 0xFF000000, 0x00000000),
-        E(0xFFFFFFFF, 0xFFFFFFFF, 0xFF800000, 0x00000000),
-        E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFC00000, 0x00000000),
-        E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFE00000, 0x00000000),
-        E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFF00000, 0x00000000),
-        E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFF80000, 0x00000000),
-        E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFFC0000, 0x00000000),
-        E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFFE0000, 0x00000000),
-        E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFFF0000, 0x00000000),
-        E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFFF8000, 0x00000000),
-        E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFC000, 0x00000000),
-        E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFE000, 0x00000000),
-        E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFF000, 0x00000000),
-        E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFF800, 0x00000000),
-        E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFC00, 0x00000000),
-        E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFE00, 0x00000000),
-        E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFF00, 0x00000000),
-        E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFF80, 0x00000000),
-        E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFC0, 0x00000000),
-        E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFE0, 0x00000000),
-        E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFF0, 0x00000000),
-        E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFF8, 0x00000000),
-        E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFC, 0x00000000),
-        E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFE, 0x00000000),
-        E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF, 0x00000000),
-        E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF, 0x80000000),
-        E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF, 0xC0000000),
-        E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF, 0xE0000000),
-        E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF, 0xF0000000),
-        E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF, 0xF8000000),
-        E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF, 0xFC000000),
-        E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF, 0xFE000000),
-        E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF, 0xFF000000),
-        E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF, 0xFF800000),
-        E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF, 0xFFC00000),
-        E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF, 0xFFE00000),
-        E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF, 0xFFF00000),
-        E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF, 0xFFF80000),
-        E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF, 0xFFFC0000),
-        E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF, 0xFFFE0000),
-        E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF, 0xFFFF0000),
-        E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF, 0xFFFF8000),
-        E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFC000),
-        E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFE000),
-        E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFF000),
-        E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFF800),
-        E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFC00),
-        E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFE00),
-        E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFF00),
-        E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFF80),
-        E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFC0),
-        E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFE0),
-        E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFF0),
-        E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFF8),
-        E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFC),
-        E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFE),
-        E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF),
+        PREFIXES_MAP
 };
 EXPORT_SYMBOL_GPL(ip_set_hostmask_map);
 
diff --git a/net/netfilter/ipvs/ip_vs_conn.c b/net/netfilter/ipvs/ip_vs_conn.c
index 3a43b3470331..3e053cb30070 100644
--- a/net/netfilter/ipvs/ip_vs_conn.c
+++ b/net/netfilter/ipvs/ip_vs_conn.c
@@ -185,7 +185,7 @@ static inline int ip_vs_conn_hash(struct ip_vs_conn *cp)
                 hlist_add_head_rcu(&cp->c_list, &ip_vs_conn_tab[hash]);
                 ret = 1;
         } else {
-                pr_err("%s(): request for already hashed, called from %pF\n",
+                pr_err("%s(): request for already hashed, called from %pS\n",
                        __func__, __builtin_return_address(0));
                 ret = 0;
         }
diff --git a/net/netfilter/ipvs/ip_vs_ctl.c b/net/netfilter/ipvs/ip_vs_ctl.c
index b47e266c6eca..fff213eacf2a 100644
--- a/net/netfilter/ipvs/ip_vs_ctl.c
+++ b/net/netfilter/ipvs/ip_vs_ctl.c
@@ -300,7 +300,7 @@ static int ip_vs_svc_hash(struct ip_vs_service *svc)
         unsigned int hash;
 
         if (svc->flags & IP_VS_SVC_F_HASHED) {
-                pr_err("%s(): request for already hashed, called from %pF\n",
+                pr_err("%s(): request for already hashed, called from %pS\n",
                        __func__, __builtin_return_address(0));
                 return 0;
         }
@@ -334,7 +334,7 @@ static int ip_vs_svc_hash(struct ip_vs_service *svc)
 static int ip_vs_svc_unhash(struct ip_vs_service *svc)
 {
         if (!(svc->flags & IP_VS_SVC_F_HASHED)) {
-                pr_err("%s(): request for unhash flagged, called from %pF\n",
+                pr_err("%s(): request for unhash flagged, called from %pS\n",
                        __func__, __builtin_return_address(0));
                 return 0;
         }
@@ -2034,12 +2034,16 @@ static int ip_vs_info_seq_show(struct seq_file *seq, void *v)
                 seq_puts(seq,
                          "  -> RemoteAddress:Port Forward Weight ActiveConn InActConn\n");
         } else {
+                struct net *net = seq_file_net(seq);
+                struct netns_ipvs *ipvs = net_ipvs(net);
                 const struct ip_vs_service *svc = v;
                 const struct ip_vs_iter *iter = seq->private;
                 const struct ip_vs_dest *dest;
                 struct ip_vs_scheduler *sched = rcu_dereference(svc->scheduler);
                 char *sched_name = sched ? sched->name : "none";
 
+                if (svc->ipvs != ipvs)
+                        return 0;
                 if (iter->table == ip_vs_svc_table) {
 #ifdef CONFIG_IP_VS_IPV6
                         if (svc->af == AF_INET6)
diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c
index 01130392b7c0..85f643c1e227 100644
--- a/net/netfilter/nf_conntrack_core.c
+++ b/net/netfilter/nf_conntrack_core.c
@@ -1083,7 +1083,7 @@ static void gc_worker(struct work_struct *work)
         next_run = gc_work->next_gc_run;
         gc_work->last_bucket = i;
         gc_work->early_drop = false;
-        queue_delayed_work(system_long_wq, &gc_work->dwork, next_run);
+        queue_delayed_work(system_power_efficient_wq, &gc_work->dwork, next_run);
 }
 
 static void conntrack_gc_work_init(struct conntrack_gc_work *gc_work)
@@ -1419,7 +1419,7 @@ repeat:
         /* Decide what timeout policy we want to apply to this flow. */
         timeouts = nf_ct_timeout_lookup(net, ct, l4proto);
 
-        ret = l4proto->packet(ct, skb, dataoff, ctinfo, pf, timeouts);
+        ret = l4proto->packet(ct, skb, dataoff, ctinfo, timeouts);
         if (ret <= 0) {
                 /* Invalid: inverse of the return code tells
                  * the netfilter core what to do */
@@ -1563,9 +1563,14 @@ int nf_ct_port_nlattr_to_tuple(struct nlattr *tb[],
 }
 EXPORT_SYMBOL_GPL(nf_ct_port_nlattr_to_tuple);
 
-int nf_ct_port_nlattr_tuple_size(void)
+unsigned int nf_ct_port_nlattr_tuple_size(void)
 {
-        return nla_policy_len(nf_ct_port_nla_policy, CTA_PROTO_MAX + 1);
+        static unsigned int size __read_mostly;
+
+        if (!size)
+                size = nla_policy_len(nf_ct_port_nla_policy, CTA_PROTO_MAX + 1);
+
+        return size;
 }
 EXPORT_SYMBOL_GPL(nf_ct_port_nlattr_tuple_size);
 #endif
@@ -1940,7 +1945,7 @@ int nf_conntrack_hash_resize(unsigned int hashsize)
         return 0;
 }
 
-int nf_conntrack_set_hashsize(const char *val, struct kernel_param *kp)
+int nf_conntrack_set_hashsize(const char *val, const struct kernel_param *kp)
 {
         unsigned int hashsize;
         int rc;
@@ -2084,7 +2089,7 @@ int nf_conntrack_init_start(void)
                 goto err_proto;
 
         conntrack_gc_work_init(&conntrack_gc_work);
-        queue_delayed_work(system_long_wq, &conntrack_gc_work.dwork, HZ);
+        queue_delayed_work(system_power_efficient_wq, &conntrack_gc_work.dwork, HZ);
 
         return 0;
 
diff --git a/net/netfilter/nf_conntrack_expect.c b/net/netfilter/nf_conntrack_expect.c
index 64778f9a8548..d6748a8a79c5 100644
--- a/net/netfilter/nf_conntrack_expect.c
+++ b/net/netfilter/nf_conntrack_expect.c
@@ -67,9 +67,9 @@ void nf_ct_unlink_expect_report(struct nf_conntrack_expect *exp,
 }
 EXPORT_SYMBOL_GPL(nf_ct_unlink_expect_report);
 
-static void nf_ct_expectation_timed_out(unsigned long ul_expect)
+static void nf_ct_expectation_timed_out(struct timer_list *t)
 {
-        struct nf_conntrack_expect *exp = (void *)ul_expect;
+        struct nf_conntrack_expect *exp = from_timer(exp, t, timeout);
 
         spin_lock_bh(&nf_conntrack_expect_lock);
         nf_ct_unlink_expect(exp);
@@ -368,8 +368,7 @@ static void nf_ct_expect_insert(struct nf_conntrack_expect *exp)
         /* two references : one for hash insert, one for the timer */
         refcount_add(2, &exp->use);
 
-        setup_timer(&exp->timeout, nf_ct_expectation_timed_out,
-                    (unsigned long)exp);
+        timer_setup(&exp->timeout, nf_ct_expectation_timed_out, 0);
         helper = rcu_dereference_protected(master_help->helper,
                                            lockdep_is_held(&nf_conntrack_expect_lock));
         if (helper) {
diff --git a/net/netfilter/nf_conntrack_h323_asn1.c b/net/netfilter/nf_conntrack_h323_asn1.c
index 89b2e46925c4..cf1bf2605c10 100644
--- a/net/netfilter/nf_conntrack_h323_asn1.c
+++ b/net/netfilter/nf_conntrack_h323_asn1.c
@@ -91,41 +91,41 @@ typedef struct field_t {
 } field_t;
 
 /* Bit Stream */
-typedef struct {
+struct bitstr {
         unsigned char *buf;
         unsigned char *beg;
         unsigned char *end;
         unsigned char *cur;
         unsigned int bit;
-} bitstr_t;
+};
 
 /* Tool Functions */
 #define INC_BIT(bs) if((++(bs)->bit)>7){(bs)->cur++;(bs)->bit=0;}
 #define INC_BITS(bs,b) if(((bs)->bit+=(b))>7){(bs)->cur+=(bs)->bit>>3;(bs)->bit&=7;}
 #define BYTE_ALIGN(bs) if((bs)->bit){(bs)->cur++;(bs)->bit=0;}
 #define CHECK_BOUND(bs,n) if((bs)->cur+(n)>(bs)->end)return(H323_ERROR_BOUND)
-static unsigned int get_len(bitstr_t *bs);
-static unsigned int get_bit(bitstr_t *bs);
-static unsigned int get_bits(bitstr_t *bs, unsigned int b);
-static unsigned int get_bitmap(bitstr_t *bs, unsigned int b);
-static unsigned int get_uint(bitstr_t *bs, int b);
+static unsigned int get_len(struct bitstr *bs);
+static unsigned int get_bit(struct bitstr *bs);
+static unsigned int get_bits(struct bitstr *bs, unsigned int b);
+static unsigned int get_bitmap(struct bitstr *bs, unsigned int b);
+static unsigned int get_uint(struct bitstr *bs, int b);
 
 /* Decoder Functions */
-static int decode_nul(bitstr_t *bs, const struct field_t *f, char *base, int level);
-static int decode_bool(bitstr_t *bs, const struct field_t *f, char *base, int level);
-static int decode_oid(bitstr_t *bs, const struct field_t *f, char *base, int level);
-static int decode_int(bitstr_t *bs, const struct field_t *f, char *base, int level);
-static int decode_enum(bitstr_t *bs, const struct field_t *f, char *base, int level);
-static int decode_bitstr(bitstr_t *bs, const struct field_t *f, char *base, int level);
-static int decode_numstr(bitstr_t *bs, const struct field_t *f, char *base, int level);
-static int decode_octstr(bitstr_t *bs, const struct field_t *f, char *base, int level);
-static int decode_bmpstr(bitstr_t *bs, const struct field_t *f, char *base, int level);
-static int decode_seq(bitstr_t *bs, const struct field_t *f, char *base, int level);
-static int decode_seqof(bitstr_t *bs, const struct field_t *f, char *base, int level);
-static int decode_choice(bitstr_t *bs, const struct field_t *f, char *base, int level);
+static int decode_nul(struct bitstr *bs, const struct field_t *f, char *base, int level);
+static int decode_bool(struct bitstr *bs, const struct field_t *f, char *base, int level);
+static int decode_oid(struct bitstr *bs, const struct field_t *f, char *base, int level);
+static int decode_int(struct bitstr *bs, const struct field_t *f, char *base, int level);
+static int decode_enum(struct bitstr *bs, const struct field_t *f, char *base, int level);
+static int decode_bitstr(struct bitstr *bs, const struct field_t *f, char *base, int level);
+static int decode_numstr(struct bitstr *bs, const struct field_t *f, char *base, int level);
+static int decode_octstr(struct bitstr *bs, const struct field_t *f, char *base, int level);
+static int decode_bmpstr(struct bitstr *bs, const struct field_t *f, char *base, int level);
+static int decode_seq(struct bitstr *bs, const struct field_t *f, char *base, int level);
+static int decode_seqof(struct bitstr *bs, const struct field_t *f, char *base, int level);
+static int decode_choice(struct bitstr *bs, const struct field_t *f, char *base, int level);
 
 /* Decoder Functions Vector */
-typedef int (*decoder_t)(bitstr_t *, const struct field_t *, char *, int);
+typedef int (*decoder_t)(struct bitstr *, const struct field_t *, char *, int);
 static const decoder_t Decoders[] = {
         decode_nul,
         decode_bool,
@@ -150,7 +150,7 @@ static const decoder_t Decoders[] = {
  * Functions
  ****************************************************************************/
 /* Assume bs is aligned && v < 16384 */
-static unsigned int get_len(bitstr_t *bs)
+static unsigned int get_len(struct bitstr *bs)
 {
         unsigned int v;
 
@@ -166,7 +166,7 @@ static unsigned int get_len(bitstr_t *bs)
 }
 
 /****************************************************************************/
-static unsigned int get_bit(bitstr_t *bs)
+static unsigned int get_bit(struct bitstr *bs)
 {
         unsigned int b = (*bs->cur) & (0x80 >> bs->bit);
 
@@ -177,7 +177,7 @@ static unsigned int get_bit(bitstr_t *bs)
 
 /****************************************************************************/
 /* Assume b <= 8 */
-static unsigned int get_bits(bitstr_t *bs, unsigned int b)
+static unsigned int get_bits(struct bitstr *bs, unsigned int b)
 {
         unsigned int v, l;
 
@@ -203,7 +203,7 @@ static unsigned int get_bits(bitstr_t *bs, unsigned int b)
 
 /****************************************************************************/
 /* Assume b <= 32 */
-static unsigned int get_bitmap(bitstr_t *bs, unsigned int b)
+static unsigned int get_bitmap(struct bitstr *bs, unsigned int b)
 {
         unsigned int v, l, shift, bytes;
 
@@ -242,7 +242,7 @@ static unsigned int get_bitmap(bitstr_t *bs, unsigned int b)
 /****************************************************************************
  * Assume bs is aligned and sizeof(unsigned int) == 4
  ****************************************************************************/
-static unsigned int get_uint(bitstr_t *bs, int b)
+static unsigned int get_uint(struct bitstr *bs, int b)
 {
         unsigned int v = 0;
 
@@ -264,7 +264,7 @@ static unsigned int get_uint(bitstr_t *bs, int b)
 }
 
 /****************************************************************************/
-static int decode_nul(bitstr_t *bs, const struct field_t *f,
+static int decode_nul(struct bitstr *bs, const struct field_t *f,
                       char *base, int level)
 {
         PRINT("%*.s%s\n", level * TAB_SIZE, " ", f->name);
@@ -273,7 +273,7 @@ static int decode_nul(bitstr_t *bs, const struct field_t *f,
 }
 
 /****************************************************************************/
-static int decode_bool(bitstr_t *bs, const struct field_t *f,
+static int decode_bool(struct bitstr *bs, const struct field_t *f,
                        char *base, int level)
 {
         PRINT("%*.s%s\n", level * TAB_SIZE, " ", f->name);
@@ -285,7 +285,7 @@ static int decode_bool(bitstr_t *bs, const struct field_t *f,
 }
 
 /****************************************************************************/
-static int decode_oid(bitstr_t *bs, const struct field_t *f,
+static int decode_oid(struct bitstr *bs, const struct field_t *f,
                       char *base, int level)
 {
         int len;
@@ -302,7 +302,7 @@ static int decode_oid(bitstr_t *bs, const struct field_t *f,
 }
 
 /****************************************************************************/
-static int decode_int(bitstr_t *bs, const struct field_t *f,
+static int decode_int(struct bitstr *bs, const struct field_t *f,
                       char *base, int level)
 {
         unsigned int len;
@@ -346,7 +346,7 @@ static int decode_int(bitstr_t *bs, const struct field_t *f,
 }
 
 /****************************************************************************/
-static int decode_enum(bitstr_t *bs, const struct field_t *f,
+static int decode_enum(struct bitstr *bs, const struct field_t *f,
                        char *base, int level)
 {
         PRINT("%*.s%s\n", level * TAB_SIZE, " ", f->name);
@@ -362,7 +362,7 @@ static int decode_enum(bitstr_t *bs, const struct field_t *f,
 }
 
 /****************************************************************************/
-static int decode_bitstr(bitstr_t *bs, const struct field_t *f,
+static int decode_bitstr(struct bitstr *bs, const struct field_t *f,
                          char *base, int level)
 {
         unsigned int len;
@@ -396,7 +396,7 @@ static int decode_bitstr(bitstr_t *bs, const struct field_t *f,
 }
 
 /****************************************************************************/
-static int decode_numstr(bitstr_t *bs, const struct field_t *f,
+static int decode_numstr(struct bitstr *bs, const struct field_t *f,
                          char *base, int level)
 {
         unsigned int len;
@@ -414,7 +414,7 @@ static int decode_numstr(bitstr_t *bs, const struct field_t *f,
 }
 
 /****************************************************************************/
-static int decode_octstr(bitstr_t *bs, const struct field_t *f,
+static int decode_octstr(struct bitstr *bs, const struct field_t *f,
                          char *base, int level)
 {
         unsigned int len;
@@ -463,7 +463,7 @@ static int decode_octstr(bitstr_t *bs, const struct field_t *f,
 }
 
 /****************************************************************************/
-static int decode_bmpstr(bitstr_t *bs, const struct field_t *f,
+static int decode_bmpstr(struct bitstr *bs, const struct field_t *f,
                          char *base, int level)
 {
         unsigned int len;
@@ -489,7 +489,7 @@ static int decode_bmpstr(bitstr_t *bs, const struct field_t *f,
 }
 
 /****************************************************************************/
-static int decode_seq(bitstr_t *bs, const struct field_t *f,
+static int decode_seq(struct bitstr *bs, const struct field_t *f,
                       char *base, int level)
 {
         unsigned int ext, bmp, i, opt, len = 0, bmp2, bmp2_len;
@@ -606,7 +606,7 @@ static int decode_seq(bitstr_t *bs, const struct field_t *f,
 }
 
 /****************************************************************************/
-static int decode_seqof(bitstr_t *bs, const struct field_t *f,
+static int decode_seqof(struct bitstr *bs, const struct field_t *f,
                         char *base, int level)
 {
         unsigned int count, effective_count = 0, i, len = 0;
@@ -696,7 +696,7 @@ static int decode_seqof(bitstr_t *bs, const struct field_t *f,
 
 
 /****************************************************************************/
-static int decode_choice(bitstr_t *bs, const struct field_t *f,
+static int decode_choice(struct bitstr *bs, const struct field_t *f,
                          char *base, int level)
 {
         unsigned int type, ext, len = 0;
@@ -772,7 +772,7 @@ int DecodeRasMessage(unsigned char *buf, size_t sz, RasMessage *ras)
                 FNAME("RasMessage") CHOICE, 5, 24, 32, DECODE | EXT,
                 0, _RasMessage
         };
-        bitstr_t bs;
+        struct bitstr bs;
 
         bs.buf = bs.beg = bs.cur = buf;
         bs.end = buf + sz;
@@ -789,7 +789,7 @@ static int DecodeH323_UserInformation(unsigned char *buf, unsigned char *beg,
                 FNAME("H323-UserInformation") SEQ, 1, 2, 2, DECODE | EXT,
                 0, _H323_UserInformation
         };
-        bitstr_t bs;
+        struct bitstr bs;
 
         bs.buf = buf;
         bs.beg = bs.cur = beg;
@@ -808,7 +808,7 @@ int DecodeMultimediaSystemControlMessage(unsigned char *buf, size_t sz,
                 FNAME("MultimediaSystemControlMessage") CHOICE, 2, 4, 4,
                 DECODE | EXT, 0, _MultimediaSystemControlMessage
         };
-        bitstr_t bs;
+        struct bitstr bs;
 
         bs.buf = bs.beg = bs.cur = buf;
         bs.end = buf + sz;
@@ -877,6 +877,7 @@ int DecodeQ931(unsigned char *buf, size_t sz, Q931 *q931)
                 if (sz < 1)
                         break;
                 len = *p++;
+                sz--;
                 if (sz < len)
                         break;
                 p += len;
diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c
index de4053d84364..59c08997bfdf 100644
--- a/net/netfilter/nf_conntrack_netlink.c
+++ b/net/netfilter/nf_conntrack_netlink.c
@@ -533,11 +533,12 @@ nla_put_failure:
         return -1;
 }
 
-static inline size_t ctnetlink_proto_size(const struct nf_conn *ct)
+#if defined(CONFIG_NETFILTER_NETLINK_GLUE_CT) || defined(CONFIG_NF_CONNTRACK_EVENTS)
+static size_t ctnetlink_proto_size(const struct nf_conn *ct)
 {
         const struct nf_conntrack_l3proto *l3proto;
         const struct nf_conntrack_l4proto *l4proto;
-        size_t len;
+        size_t len, len4 = 0;
 
         l3proto = __nf_ct_l3proto_find(nf_ct_l3num(ct));
         len = l3proto->nla_size;
@@ -545,9 +546,14 @@ static inline size_t ctnetlink_proto_size(const struct nf_conn *ct)
 
         l4proto = __nf_ct_l4proto_find(nf_ct_l3num(ct), nf_ct_protonum(ct));
         len += l4proto->nla_size;
+        if (l4proto->nlattr_tuple_size) {
+                len4 = l4proto->nlattr_tuple_size();
+                len4 *= 3u; /* ORIG, REPLY, MASTER */
+        }
 
-        return len;
+        return len + len4;
 }
+#endif
 
 static inline size_t ctnetlink_acct_size(const struct nf_conn *ct)
 {
diff --git a/net/netfilter/nf_conntrack_proto.c b/net/netfilter/nf_conntrack_proto.c
index b3e489c859ec..c8e9c9503a08 100644
--- a/net/netfilter/nf_conntrack_proto.c
+++ b/net/netfilter/nf_conntrack_proto.c
@@ -27,6 +27,7 @@
 #include <net/netfilter/nf_conntrack_l3proto.h>
 #include <net/netfilter/nf_conntrack_l4proto.h>
 #include <net/netfilter/nf_conntrack_core.h>
+#include <net/netfilter/nf_log.h>
 
 static struct nf_conntrack_l4proto __rcu **nf_ct_protos[NFPROTO_NUMPROTO] __read_mostly;
 struct nf_conntrack_l3proto __rcu *nf_ct_l3protos[NFPROTO_NUMPROTO] __read_mostly;
@@ -63,6 +64,52 @@ nf_ct_unregister_sysctl(struct ctl_table_header **header,
         *header = NULL;
         *table = NULL;
 }
+
+__printf(5, 6)
+void nf_l4proto_log_invalid(const struct sk_buff *skb,
+                            struct net *net,
+                            u16 pf, u8 protonum,
+                            const char *fmt, ...)
+{
+        struct va_format vaf;
+        va_list args;
+
+        if (net->ct.sysctl_log_invalid != protonum ||
+            net->ct.sysctl_log_invalid != IPPROTO_RAW)
+                return;
+
+        va_start(args, fmt);
+        vaf.fmt = fmt;
+        vaf.va = &args;
+
+        nf_log_packet(net, pf, 0, skb, NULL, NULL, NULL,
+                      "nf_ct_proto_%d: %pV ", protonum, &vaf);
+        va_end(args);
+}
+EXPORT_SYMBOL_GPL(nf_l4proto_log_invalid);
+
+__printf(3, 4)
+void nf_ct_l4proto_log_invalid(const struct sk_buff *skb,
+                               const struct nf_conn *ct,
+                               const char *fmt, ...)
+{
+        struct va_format vaf;
+        struct net *net;
+        va_list args;
+
+        net = nf_ct_net(ct);
+        if (likely(net->ct.sysctl_log_invalid == 0))
+                return;
+
+        va_start(args, fmt);
+        vaf.fmt = fmt;
+        vaf.va = &args;
+
+        nf_l4proto_log_invalid(skb, net, nf_ct_l3num(ct),
+                               nf_ct_protonum(ct), "%pV", &vaf);
+        va_end(args);
+}
+EXPORT_SYMBOL_GPL(nf_ct_l4proto_log_invalid);
 #endif
 
 const struct nf_conntrack_l4proto *
@@ -125,7 +172,7 @@ void nf_ct_l3proto_module_put(unsigned short l3proto)
 }
 EXPORT_SYMBOL_GPL(nf_ct_l3proto_module_put);
 
-int nf_ct_netns_get(struct net *net, u8 nfproto)
+static int nf_ct_netns_do_get(struct net *net, u8 nfproto)
 {
         const struct nf_conntrack_l3proto *l3proto;
         int ret;
@@ -150,9 +197,33 @@ int nf_ct_netns_get(struct net *net, u8 nfproto)
 
         return ret;
 }
+
+int nf_ct_netns_get(struct net *net, u8 nfproto)
+{
+        int err;
+
+        if (nfproto == NFPROTO_INET) {
+                err = nf_ct_netns_do_get(net, NFPROTO_IPV4);
+                if (err < 0)
+                        goto err1;
+                err = nf_ct_netns_do_get(net, NFPROTO_IPV6);
+                if (err < 0)
+                        goto err2;
+        } else {
+                err = nf_ct_netns_do_get(net, nfproto);
+                if (err < 0)
+                        goto err1;
+        }
+        return 0;
+
+err2:
+        nf_ct_netns_put(net, NFPROTO_IPV4);
+err1:
+        return err;
+}
 EXPORT_SYMBOL_GPL(nf_ct_netns_get);
 
-void nf_ct_netns_put(struct net *net, u8 nfproto)
+static void nf_ct_netns_do_put(struct net *net, u8 nfproto)
 {
         const struct nf_conntrack_l3proto *l3proto;
 
@@ -171,6 +242,15 @@ void nf_ct_netns_put(struct net *net, u8 nfproto)
 
         nf_ct_l3proto_module_put(nfproto);
 }
+
+void nf_ct_netns_put(struct net *net, uint8_t nfproto)
+{
+        if (nfproto == NFPROTO_INET) {
+                nf_ct_netns_do_put(net, NFPROTO_IPV4);
+                nf_ct_netns_do_put(net, NFPROTO_IPV6);
+        } else
+                nf_ct_netns_do_put(net, nfproto);
+}
 EXPORT_SYMBOL_GPL(nf_ct_netns_put);
 
 const struct nf_conntrack_l4proto *
@@ -351,8 +431,6 @@ int nf_ct_l4proto_register_one(struct nf_conntrack_l4proto *l4proto)
         l4proto->nla_size = 0;
         if (l4proto->nlattr_size)
                 l4proto->nla_size += l4proto->nlattr_size();
-        if (l4proto->nlattr_tuple_size)
-                l4proto->nla_size += 3 * l4proto->nlattr_tuple_size();
 
         rcu_assign_pointer(nf_ct_protos[l4proto->l3proto][l4proto->l4proto],
                            l4proto);
diff --git a/net/netfilter/nf_conntrack_proto_dccp.c b/net/netfilter/nf_conntrack_proto_dccp.c
index 0f5a4d79f6b8..2a446f4a554c 100644
--- a/net/netfilter/nf_conntrack_proto_dccp.c
+++ b/net/netfilter/nf_conntrack_proto_dccp.c
@@ -428,13 +428,13 @@ static bool dccp_new(struct nf_conn *ct, const struct sk_buff *skb,
         default:
                 dn = dccp_pernet(net);
                 if (dn->dccp_loose == 0) {
-                        msg = "nf_ct_dccp: not picking up existing connection ";
+                        msg = "not picking up existing connection ";
                         goto out_invalid;
                 }
         case CT_DCCP_REQUEST:
                 break;
         case CT_DCCP_INVALID:
-                msg = "nf_ct_dccp: invalid state transition ";
+                msg = "invalid state transition ";
                 goto out_invalid;
         }
 
@@ -447,9 +447,7 @@ static bool dccp_new(struct nf_conn *ct, const struct sk_buff *skb,
         return true;
 
 out_invalid:
-        if (LOG_INVALID(net, IPPROTO_DCCP))
-                nf_log_packet(net, nf_ct_l3num(ct), 0, skb, NULL, NULL,
-                              NULL, "%s", msg);
+        nf_ct_l4proto_log_invalid(skb, ct, "%s", msg);
         return false;
 }
 
@@ -469,10 +467,8 @@ static unsigned int *dccp_get_timeouts(struct net *net)
 
 static int dccp_packet(struct nf_conn *ct, const struct sk_buff *skb,
                        unsigned int dataoff, enum ip_conntrack_info ctinfo,
-                       u_int8_t pf,
                        unsigned int *timeouts)
 {
-        struct net *net = nf_ct_net(ct);
         enum ip_conntrack_dir dir = CTINFO2DIR(ctinfo);
         struct dccp_hdr _dh, *dh;
         u_int8_t type, old_state, new_state;
@@ -534,15 +530,11 @@ static int dccp_packet(struct nf_conn *ct, const struct sk_buff *skb,
                 ct->proto.dccp.last_pkt = type;
 
                 spin_unlock_bh(&ct->lock);
-                if (LOG_INVALID(net, IPPROTO_DCCP))
-                        nf_log_packet(net, pf, 0, skb, NULL, NULL, NULL,
-                                      "nf_ct_dccp: invalid packet ignored ");
+                nf_ct_l4proto_log_invalid(skb, ct, "%s", "invalid packet");
                 return NF_ACCEPT;
         case CT_DCCP_INVALID:
                 spin_unlock_bh(&ct->lock);
-                if (LOG_INVALID(net, IPPROTO_DCCP))
-                        nf_log_packet(net, pf, 0, skb, NULL, NULL, NULL,
-                                      "nf_ct_dccp: invalid state transition ");
+                nf_ct_l4proto_log_invalid(skb, ct, "%s", "invalid state transition");
                 return -NF_ACCEPT;
         }
 
@@ -604,8 +596,7 @@ static int dccp_error(struct net *net, struct nf_conn *tmpl,
         return NF_ACCEPT;
 
 out_invalid:
-        if (LOG_INVALID(net, IPPROTO_DCCP))
-                nf_log_packet(net, pf, 0, skb, NULL, NULL, NULL, "%s", msg);
+        nf_l4proto_log_invalid(skb, net, pf, IPPROTO_DCCP, "%s", msg);
         return -NF_ACCEPT;
 }
 
diff --git a/net/netfilter/nf_conntrack_proto_generic.c b/net/netfilter/nf_conntrack_proto_generic.c
index 9cd40700842e..1f86ddf6649a 100644
--- a/net/netfilter/nf_conntrack_proto_generic.c
+++ b/net/netfilter/nf_conntrack_proto_generic.c
@@ -60,7 +60,6 @@ static int generic_packet(struct nf_conn *ct,
                           const struct sk_buff *skb,
                           unsigned int dataoff,
                           enum ip_conntrack_info ctinfo,
-                          u_int8_t pf,
                           unsigned int *timeout)
 {
         nf_ct_refresh_acct(ct, ctinfo, skb, *timeout);
diff --git a/net/netfilter/nf_conntrack_proto_gre.c b/net/netfilter/nf_conntrack_proto_gre.c
index 09a90484c27d..a2503005d80b 100644
--- a/net/netfilter/nf_conntrack_proto_gre.c
+++ b/net/netfilter/nf_conntrack_proto_gre.c
@@ -244,7 +244,6 @@ static int gre_packet(struct nf_conn *ct,
                       const struct sk_buff *skb,
                       unsigned int dataoff,
                       enum ip_conntrack_info ctinfo,
-                      u_int8_t pf,
                       unsigned int *timeouts)
 {
         /* If we've seen traffic both ways, this is a GRE connection.
diff --git a/net/netfilter/nf_conntrack_proto_sctp.c b/net/netfilter/nf_conntrack_proto_sctp.c
index 6303a88af12b..80faf04ddf15 100644
--- a/net/netfilter/nf_conntrack_proto_sctp.c
+++ b/net/netfilter/nf_conntrack_proto_sctp.c
@@ -306,7 +306,6 @@ static int sctp_packet(struct nf_conn *ct,
                        const struct sk_buff *skb,
                        unsigned int dataoff,
                        enum ip_conntrack_info ctinfo,
-                       u_int8_t pf,
                        unsigned int *timeouts)
 {
         enum sctp_conntrack new_state, old_state;
@@ -522,8 +521,7 @@ static int sctp_error(struct net *net, struct nf_conn *tpl, struct sk_buff *skb,
         }
         return NF_ACCEPT;
 out_invalid:
-        if (LOG_INVALID(net, IPPROTO_SCTP))
-                nf_log_packet(net, pf, 0, skb, NULL, NULL, NULL, "%s", logmsg);
+        nf_l4proto_log_invalid(skb, net, pf, IPPROTO_SCTP, "%s", logmsg);
         return -NF_ACCEPT;
 }
 
diff --git a/net/netfilter/nf_conntrack_proto_tcp.c b/net/netfilter/nf_conntrack_proto_tcp.c
index cba1c6ffe51a..b12fc07111d0 100644
--- a/net/netfilter/nf_conntrack_proto_tcp.c
+++ b/net/netfilter/nf_conntrack_proto_tcp.c
@@ -493,8 +493,7 @@ static bool tcp_in_window(const struct nf_conn *ct,
                           unsigned int index,
                           const struct sk_buff *skb,
                           unsigned int dataoff,
-                          const struct tcphdr *tcph,
-                          u_int8_t pf)
+                          const struct tcphdr *tcph)
 {
         struct net *net = nf_ct_net(ct);
         struct nf_tcp_net *tn = tcp_pernet(net);
@@ -702,9 +701,9 @@ static bool tcp_in_window(const struct nf_conn *ct,
                 if (sender->flags & IP_CT_TCP_FLAG_BE_LIBERAL ||
                     tn->tcp_be_liberal)
                         res = true;
-                if (!res && LOG_INVALID(net, IPPROTO_TCP))
-                        nf_log_packet(net, pf, 0, skb, NULL, NULL, NULL,
-                        "nf_ct_tcp: %s ",
+                if (!res) {
+                        nf_ct_l4proto_log_invalid(skb, ct,
+                        "%s",
                         before(seq, sender->td_maxend + 1) ?
                         in_recv_win ?
                         before(sack, receiver->td_end + 1) ?
@@ -713,6 +712,7 @@ static bool tcp_in_window(const struct nf_conn *ct,
                         : "ACK is over the upper bound (ACKed data not seen yet)"
                         : "SEQ is under the lower bound (already ACKed data retransmitted)"
                         : "SEQ is over the upper bound (over the window of the receiver)");
+                }
         }
 
         pr_debug("tcp_in_window: res=%u sender end=%u maxend=%u maxwin=%u "
@@ -738,6 +738,12 @@ static const u8 tcp_valid_flags[(TCPHDR_FIN|TCPHDR_SYN|TCPHDR_RST|TCPHDR_ACK|
         [TCPHDR_ACK|TCPHDR_URG]                 = 1,
 };
 
+static void tcp_error_log(const struct sk_buff *skb, struct net *net,
+                          u8 pf, const char *msg)
+{
+        nf_l4proto_log_invalid(skb, net, pf, IPPROTO_TCP, "%s", msg);
+}
+
 /* Protect conntrack agaist broken packets. Code taken from ipt_unclean.c.  */
 static int tcp_error(struct net *net, struct nf_conn *tmpl,
                      struct sk_buff *skb,
@@ -753,17 +759,13 @@ static int tcp_error(struct net *net, struct nf_conn *tmpl,
         /* Smaller that minimal TCP header? */
         th = skb_header_pointer(skb, dataoff, sizeof(_tcph), &_tcph);
         if (th == NULL) {
-                if (LOG_INVALID(net, IPPROTO_TCP))
-                        nf_log_packet(net, pf, 0, skb, NULL, NULL, NULL,
-                                "nf_ct_tcp: short packet ");
+                tcp_error_log(skb, net, pf, "short packet");
                 return -NF_ACCEPT;
         }
 
         /* Not whole TCP header or malformed packet */
         if (th->doff*4 < sizeof(struct tcphdr) || tcplen < th->doff*4) {
-                if (LOG_INVALID(net, IPPROTO_TCP))
-                        nf_log_packet(net, pf, 0, skb, NULL, NULL, NULL,
-                                "nf_ct_tcp: truncated/malformed packet ");
+                tcp_error_log(skb, net, pf, "truncated packet");
                 return -NF_ACCEPT;
         }
 
@@ -774,18 +776,14 @@ static int tcp_error(struct net *net, struct nf_conn *tmpl,
         /* FIXME: Source route IP option packets --RR */
         if (net->ct.sysctl_checksum && hooknum == NF_INET_PRE_ROUTING &&
             nf_checksum(skb, hooknum, dataoff, IPPROTO_TCP, pf)) {
-                if (LOG_INVALID(net, IPPROTO_TCP))
-                        nf_log_packet(net, pf, 0, skb, NULL, NULL, NULL,
-                                  "nf_ct_tcp: bad TCP checksum ");
+                tcp_error_log(skb, net, pf, "bad checksum");
                 return -NF_ACCEPT;
         }
 
         /* Check TCP flags. */
         tcpflags = (tcp_flag_byte(th) & ~(TCPHDR_ECE|TCPHDR_CWR|TCPHDR_PSH));
         if (!tcp_valid_flags[tcpflags]) {
-                if (LOG_INVALID(net, IPPROTO_TCP))
-                        nf_log_packet(net, pf, 0, skb, NULL, NULL, NULL,
-                                  "nf_ct_tcp: invalid TCP flag combination ");
+                tcp_error_log(skb, net, pf, "invalid tcp flag combination");
                 return -NF_ACCEPT;
         }
 
@@ -802,7 +800,6 @@ static int tcp_packet(struct nf_conn *ct,
                       const struct sk_buff *skb,
                       unsigned int dataoff,
                       enum ip_conntrack_info ctinfo,
-                      u_int8_t pf,
                       unsigned int *timeouts)
 {
         struct net *net = nf_ct_net(ct);
@@ -939,10 +936,8 @@ static int tcp_packet(struct nf_conn *ct,
                                         IP_CT_EXP_CHALLENGE_ACK;
                 }
                 spin_unlock_bh(&ct->lock);
-                if (LOG_INVALID(net, IPPROTO_TCP))
-                        nf_log_packet(net, pf, 0, skb, NULL, NULL, NULL,
-                                  "nf_ct_tcp: invalid packet ignored in "
-                                  "state %s ", tcp_conntrack_names[old_state]);
+                nf_ct_l4proto_log_invalid(skb, ct, "invalid packet ignored in "
+                                          "state %s ", tcp_conntrack_names[old_state]);
                 return NF_ACCEPT;
         case TCP_CONNTRACK_MAX:
                 /* Special case for SYN proxy: when the SYN to the server or
@@ -964,9 +959,7 @@ static int tcp_packet(struct nf_conn *ct,
                 pr_debug("nf_ct_tcp: Invalid dir=%i index=%u ostate=%u\n",
                          dir, get_conntrack_index(th), old_state);
                 spin_unlock_bh(&ct->lock);
-                if (LOG_INVALID(net, IPPROTO_TCP))
-                        nf_log_packet(net, pf, 0, skb, NULL, NULL, NULL,
-                                  "nf_ct_tcp: invalid state ");
+                nf_ct_l4proto_log_invalid(skb, ct, "invalid state");
                 return -NF_ACCEPT;
         case TCP_CONNTRACK_TIME_WAIT:
                 /* RFC5961 compliance cause stack to send "challenge-ACK"
@@ -981,9 +974,7 @@ static int tcp_packet(struct nf_conn *ct,
                         /* Detected RFC5961 challenge ACK */
                         ct->proto.tcp.last_flags &= ~IP_CT_EXP_CHALLENGE_ACK;
                         spin_unlock_bh(&ct->lock);
-                        if (LOG_INVALID(net, IPPROTO_TCP))
-                                nf_log_packet(net, pf, 0, skb, NULL, NULL, NULL,
-                                      "nf_ct_tcp: challenge-ACK ignored ");
+                        nf_ct_l4proto_log_invalid(skb, ct, "challenge-ack ignored");
                         return NF_ACCEPT; /* Don't change state */
                 }
                 break;
@@ -993,9 +984,7 @@ static int tcp_packet(struct nf_conn *ct,
                     && before(ntohl(th->seq), ct->proto.tcp.seen[!dir].td_maxack)) {
                         /* Invalid RST  */
                         spin_unlock_bh(&ct->lock);
-                        if (LOG_INVALID(net, IPPROTO_TCP))
-                                nf_log_packet(net, pf, 0, skb, NULL, NULL,
-                                              NULL, "nf_ct_tcp: invalid RST ");
+                        nf_ct_l4proto_log_invalid(skb, ct, "invalid rst");
                         return -NF_ACCEPT;
                 }
                 if (index == TCP_RST_SET
@@ -1022,7 +1011,7 @@ static int tcp_packet(struct nf_conn *ct,
         }
 
         if (!tcp_in_window(ct, &ct->proto.tcp, dir, index,
-                           skb, dataoff, th, pf)) {
+                           skb, dataoff, th)) {
                 spin_unlock_bh(&ct->lock);
                 return -NF_ACCEPT;
         }
@@ -1288,9 +1277,14 @@ static int tcp_nlattr_size(void)
                 + nla_policy_len(tcp_nla_policy, CTA_PROTOINFO_TCP_MAX + 1);
 }
 
-static int tcp_nlattr_tuple_size(void)
+static unsigned int tcp_nlattr_tuple_size(void)
 {
-        return nla_policy_len(nf_ct_port_nla_policy, CTA_PROTO_MAX + 1);
+        static unsigned int size __read_mostly;
+
+        if (!size)
+                size = nla_policy_len(nf_ct_port_nla_policy, CTA_PROTO_MAX + 1);
+
+        return size;
 }
 #endif
 
diff --git a/net/netfilter/nf_conntrack_proto_udp.c b/net/netfilter/nf_conntrack_proto_udp.c
index 8af734cd1a94..3a5f727103af 100644
--- a/net/netfilter/nf_conntrack_proto_udp.c
+++ b/net/netfilter/nf_conntrack_proto_udp.c
@@ -73,7 +73,6 @@ static int udp_packet(struct nf_conn *ct,
                       const struct sk_buff *skb,
                       unsigned int dataoff,
                       enum ip_conntrack_info ctinfo,
-                      u_int8_t pf,
                       unsigned int *timeouts)
 {
         /* If we've seen traffic both ways, this is some kind of UDP
@@ -99,6 +98,12 @@ static bool udp_new(struct nf_conn *ct, const struct sk_buff *skb,
 }
 
 #ifdef CONFIG_NF_CT_PROTO_UDPLITE
+static void udplite_error_log(const struct sk_buff *skb, struct net *net,
+                              u8 pf, const char *msg)
+{
+        nf_l4proto_log_invalid(skb, net, pf, IPPROTO_UDPLITE, "%s", msg);
+}
+
 static int udplite_error(struct net *net, struct nf_conn *tmpl,
                          struct sk_buff *skb,
                          unsigned int dataoff,
@@ -112,9 +117,7 @@ static int udplite_error(struct net *net, struct nf_conn *tmpl,
         /* Header is too small? */
         hdr = skb_header_pointer(skb, dataoff, sizeof(_hdr), &_hdr);
         if (!hdr) {
-                if (LOG_INVALID(net, IPPROTO_UDPLITE))
-                        nf_log_packet(net, pf, 0, skb, NULL, NULL, NULL,
-                                      "nf_ct_udplite: short packet ");
+                udplite_error_log(skb, net, pf, "short packet");
                 return -NF_ACCEPT;
         }
 
@@ -122,17 +125,13 @@ static int udplite_error(struct net *net, struct nf_conn *tmpl,
         if (cscov == 0) {
                 cscov = udplen;
         } else if (cscov < sizeof(*hdr) || cscov > udplen) {
-                if (LOG_INVALID(net, IPPROTO_UDPLITE))
-                        nf_log_packet(net, pf, 0, skb, NULL, NULL, NULL,
-                                      "nf_ct_udplite: invalid checksum coverage ");
+                udplite_error_log(skb, net, pf, "invalid checksum coverage");
                 return -NF_ACCEPT;
         }
 
         /* UDPLITE mandates checksums */
         if (!hdr->check) {
-                if (LOG_INVALID(net, IPPROTO_UDPLITE))
-                        nf_log_packet(net, pf, 0, skb, NULL, NULL, NULL,
-                                      "nf_ct_udplite: checksum missing ");
+                udplite_error_log(skb, net, pf, "checksum missing");
                 return -NF_ACCEPT;
         }
 
@@ -140,9 +139,7 @@ static int udplite_error(struct net *net, struct nf_conn *tmpl,
         if (net->ct.sysctl_checksum && hooknum == NF_INET_PRE_ROUTING &&
             nf_checksum_partial(skb, hooknum, dataoff, cscov, IPPROTO_UDP,
                                 pf)) {
-                if (LOG_INVALID(net, IPPROTO_UDPLITE))
-                        nf_log_packet(net, pf, 0, skb, NULL, NULL, NULL,
-                                      "nf_ct_udplite: bad UDPLite checksum ");
+                udplite_error_log(skb, net, pf, "bad checksum");
                 return -NF_ACCEPT;
         }
 
@@ -150,6 +147,12 @@ static int udplite_error(struct net *net, struct nf_conn *tmpl,
 }
 #endif
 
+static void udp_error_log(const struct sk_buff *skb, struct net *net,
+                          u8 pf, const char *msg)
+{
+        nf_l4proto_log_invalid(skb, net, pf, IPPROTO_UDP, "%s", msg);
+}
+
 static int udp_error(struct net *net, struct nf_conn *tmpl, struct sk_buff *skb,
                      unsigned int dataoff,
                      u_int8_t pf,
@@ -162,17 +165,13 @@ static int udp_error(struct net *net, struct nf_conn *tmpl, struct sk_buff *skb,
         /* Header is too small? */
         hdr = skb_header_pointer(skb, dataoff, sizeof(_hdr), &_hdr);
         if (hdr == NULL) {
-                if (LOG_INVALID(net, IPPROTO_UDP))
-                        nf_log_packet(net, pf, 0, skb, NULL, NULL, NULL,
-                                      "nf_ct_udp: short packet ");
+                udp_error_log(skb, net, pf, "short packet");
                 return -NF_ACCEPT;
         }
 
         /* Truncated/malformed packets */
         if (ntohs(hdr->len) > udplen || ntohs(hdr->len) < sizeof(*hdr)) {
-                if (LOG_INVALID(net, IPPROTO_UDP))
-                        nf_log_packet(net, pf, 0, skb, NULL, NULL, NULL,
-                                "nf_ct_udp: truncated/malformed packet ");
+                udp_error_log(skb, net, pf, "truncated/malformed packet");
                 return -NF_ACCEPT;
         }
 
@@ -186,9 +185,7 @@ static int udp_error(struct net *net, struct nf_conn *tmpl, struct sk_buff *skb,
          * FIXME: Source route IP option packets --RR */
         if (net->ct.sysctl_checksum && hooknum == NF_INET_PRE_ROUTING &&
             nf_checksum(skb, hooknum, dataoff, IPPROTO_UDP, pf)) {
-                if (LOG_INVALID(net, IPPROTO_UDP))
-                        nf_log_packet(net, pf, 0, skb, NULL, NULL, NULL,
-                                "nf_ct_udp: bad UDP checksum ");
+                udp_error_log(skb, net, pf, "bad checksum");
                 return -NF_ACCEPT;
         }
 
diff --git a/net/netfilter/nf_nat_core.c b/net/netfilter/nf_nat_core.c
index af8345fc4fbd..6c38421e31f9 100644
--- a/net/netfilter/nf_nat_core.c
+++ b/net/netfilter/nf_nat_core.c
@@ -542,17 +542,14 @@ static int nf_nat_proto_clean(struct nf_conn *ct, void *data)
         if (nf_nat_proto_remove(ct, data))
                 return 1;
 
-        if ((ct->status & IPS_SRC_NAT_DONE) == 0)
-                return 0;
-
-        /* This netns is being destroyed, and conntrack has nat null binding.
+        /* This module is being removed and conntrack has nat null binding.
          * Remove it from bysource hash, as the table will be freed soon.
          *
          * Else, when the conntrack is destoyed, nf_nat_cleanup_conntrack()
          * will delete entry from already-freed table.
          */
-        clear_bit(IPS_SRC_NAT_DONE_BIT, &ct->status);
-        __nf_nat_cleanup_conntrack(ct);
+        if (test_and_clear_bit(IPS_SRC_NAT_DONE_BIT, &ct->status))
+                __nf_nat_cleanup_conntrack(ct);
 
         /* don't delete conntrack.  Although that would make things a lot
          * simpler, we'd end up flushing all conntracks on nat rmmod.
diff --git a/net/netfilter/nf_nat_ftp.c b/net/netfilter/nf_nat_ftp.c
index e84a578dbe35..d76afafdc699 100644
--- a/net/netfilter/nf_nat_ftp.c
+++ b/net/netfilter/nf_nat_ftp.c
@@ -134,7 +134,7 @@ static int __init nf_nat_ftp_init(void)
 }
 
 /* Prior to 2.6.11, we had a ports param.  No longer, but don't break users. */
-static int warn_set(const char *val, struct kernel_param *kp)
+static int warn_set(const char *val, const struct kernel_param *kp)
 {
         printk(KERN_INFO KBUILD_MODNAME
                ": kernel >= 2.6.10 only uses 'ports' for conntrack modules\n");
diff --git a/net/netfilter/nf_nat_irc.c b/net/netfilter/nf_nat_irc.c
index 0648cb096bd8..dcb5f6375d9d 100644
--- a/net/netfilter/nf_nat_irc.c
+++ b/net/netfilter/nf_nat_irc.c
@@ -106,7 +106,7 @@ static int __init nf_nat_irc_init(void)
 }
 
 /* Prior to 2.6.11, we had a ports param.  No longer, but don't break users. */
-static int warn_set(const char *val, struct kernel_param *kp)
+static int warn_set(const char *val, const struct kernel_param *kp)
 {
         printk(KERN_INFO KBUILD_MODNAME
                ": kernel >= 2.6.10 only uses 'ports' for conntrack modules\n");
diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index 64e1ee091225..d8327b43e4dc 100644
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -2549,14 +2549,9 @@ nft_select_set_ops(const struct nft_ctx *ctx,
                 case NFT_SET_POL_PERFORMANCE:
                         if (est.lookup < best.lookup)
                                 break;
-                        if (est.lookup == best.lookup) {
-                                if (!desc->size) {
-                                        if (est.space < best.space)
-                                                break;
-                                } else if (est.size < best.size) {
-                                        break;
-                                }
-                        }
+                        if (est.lookup == best.lookup &&
+                            est.space < best.space)
+                                break;
                         continue;
                 case NFT_SET_POL_MEMORY:
                         if (!desc->size) {
@@ -3593,45 +3588,6 @@ static int nf_tables_dump_set_done(struct netlink_callback *cb)
         return 0;
 }
 
-static int nf_tables_getsetelem(struct net *net, struct sock *nlsk,
-                                struct sk_buff *skb, const struct nlmsghdr *nlh,
-                                const struct nlattr * const nla[],
-                                struct netlink_ext_ack *extack)
-{
-        u8 genmask = nft_genmask_cur(net);
-        const struct nft_set *set;
-        struct nft_ctx ctx;
-        int err;
-
-        err = nft_ctx_init_from_elemattr(&ctx, net, skb, nlh, nla, genmask);
-        if (err < 0)
-                return err;
-
-        set = nf_tables_set_lookup(ctx.table, nla[NFTA_SET_ELEM_LIST_SET],
-                                   genmask);
-        if (IS_ERR(set))
-                return PTR_ERR(set);
-
-        if (nlh->nlmsg_flags & NLM_F_DUMP) {
-                struct netlink_dump_control c = {
-                        .dump = nf_tables_dump_set,
-                        .done = nf_tables_dump_set_done,
-                };
-                struct nft_set_dump_ctx *dump_ctx;
-
-                dump_ctx = kmalloc(sizeof(*dump_ctx), GFP_KERNEL);
-                if (!dump_ctx)
-                        return -ENOMEM;
-
-                dump_ctx->set = set;
-                dump_ctx->ctx = ctx;
-
-                c.data = dump_ctx;
-                return netlink_dump_start(nlsk, skb, nlh, &c);
-        }
-        return -EOPNOTSUPP;
-}
-
 static int nf_tables_fill_setelem_info(struct sk_buff *skb,
                                        const struct nft_ctx *ctx, u32 seq,
                                        u32 portid, int event, u16 flags,
@@ -3677,6 +3633,135 @@ nla_put_failure:
         return -1;
 }
 
+static int nft_setelem_parse_flags(const struct nft_set *set,
+                                   const struct nlattr *attr, u32 *flags)
+{
+        if (attr == NULL)
+                return 0;
+
+        *flags = ntohl(nla_get_be32(attr));
+        if (*flags & ~NFT_SET_ELEM_INTERVAL_END)
+                return -EINVAL;
+        if (!(set->flags & NFT_SET_INTERVAL) &&
+            *flags & NFT_SET_ELEM_INTERVAL_END)
+                return -EINVAL;
+
+        return 0;
+}
+
+static int nft_get_set_elem(struct nft_ctx *ctx, struct nft_set *set,
+                            const struct nlattr *attr)
+{
+        struct nlattr *nla[NFTA_SET_ELEM_MAX + 1];
+        const struct nft_set_ext *ext;
+        struct nft_data_desc desc;
+        struct nft_set_elem elem;
+        struct sk_buff *skb;
+        uint32_t flags = 0;
+        void *priv;
+        int err;
+
+        err = nla_parse_nested(nla, NFTA_SET_ELEM_MAX, attr,
+                               nft_set_elem_policy, NULL);
+        if (err < 0)
+                return err;
+
+        if (!nla[NFTA_SET_ELEM_KEY])
+                return -EINVAL;
+
+        err = nft_setelem_parse_flags(set, nla[NFTA_SET_ELEM_FLAGS], &flags);
+        if (err < 0)
+                return err;
+
+        err = nft_data_init(ctx, &elem.key.val, sizeof(elem.key), &desc,
+                            nla[NFTA_SET_ELEM_KEY]);
+        if (err < 0)
+                return err;
+
+        err = -EINVAL;
+        if (desc.type != NFT_DATA_VALUE || desc.len != set->klen)
+                return err;
+
+        priv = set->ops->get(ctx->net, set, &elem, flags);
+        if (IS_ERR(priv))
+                return PTR_ERR(priv);
+
+        elem.priv = priv;
+        ext = nft_set_elem_ext(set, &elem);
+
+        err = -ENOMEM;
+        skb = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
+        if (skb == NULL)
+                goto err1;
+
+        err = nf_tables_fill_setelem_info(skb, ctx, ctx->seq, ctx->portid,
+                                          NFT_MSG_NEWSETELEM, 0, set, &elem);
+        if (err < 0)
+                goto err2;
+
+        err = nfnetlink_unicast(skb, ctx->net, ctx->portid, MSG_DONTWAIT);
+        /* This avoids a loop in nfnetlink. */
+        if (err < 0)
+                goto err1;
+
+        return 0;
+err2:
+        kfree_skb(skb);
+err1:
+        /* this avoids a loop in nfnetlink. */
+        return err == -EAGAIN ? -ENOBUFS : err;
+}
+
+static int nf_tables_getsetelem(struct net *net, struct sock *nlsk,
+                                struct sk_buff *skb, const struct nlmsghdr *nlh,
+                                const struct nlattr * const nla[],
+                                struct netlink_ext_ack *extack)
+{
+        u8 genmask = nft_genmask_cur(net);
+        struct nft_set *set;
+        struct nlattr *attr;
+        struct nft_ctx ctx;
+        int rem, err = 0;
+
+        err = nft_ctx_init_from_elemattr(&ctx, net, skb, nlh, nla, genmask);
+        if (err < 0)
+                return err;
+
+        set = nf_tables_set_lookup(ctx.table, nla[NFTA_SET_ELEM_LIST_SET],
+                                   genmask);
+        if (IS_ERR(set))
+                return PTR_ERR(set);
+
+        if (nlh->nlmsg_flags & NLM_F_DUMP) {
+                struct netlink_dump_control c = {
+                        .dump = nf_tables_dump_set,
+                        .done = nf_tables_dump_set_done,
+                };
+                struct nft_set_dump_ctx *dump_ctx;
+
+                dump_ctx = kmalloc(sizeof(*dump_ctx), GFP_KERNEL);
+                if (!dump_ctx)
+                        return -ENOMEM;
+
+                dump_ctx->set = set;
+                dump_ctx->ctx = ctx;
+
+                c.data = dump_ctx;
+                return netlink_dump_start(nlsk, skb, nlh, &c);
+        }
+
+        if (!nla[NFTA_SET_ELEM_LIST_ELEMENTS])
+                return -EINVAL;
+
+        nla_for_each_nested(attr, nla[NFTA_SET_ELEM_LIST_ELEMENTS], rem) {
+                err = nft_get_set_elem(&ctx, set, attr);
+                if (err < 0)
+                        break;
+        }
+
+        return err;
+}
+
 static void nf_tables_setelem_notify(const struct nft_ctx *ctx,
                                      const struct nft_set *set,
                                      const struct nft_set_elem *elem,
@@ -3777,22 +3862,6 @@ static void nf_tables_set_elem_destroy(const struct nft_set *set, void *elem)
         kfree(elem);
 }
 
-static int nft_setelem_parse_flags(const struct nft_set *set,
-                                   const struct nlattr *attr, u32 *flags)
-{
-        if (attr == NULL)
-                return 0;
-
-        *flags = ntohl(nla_get_be32(attr));
-        if (*flags & ~NFT_SET_ELEM_INTERVAL_END)
-                return -EINVAL;
-        if (!(set->flags & NFT_SET_INTERVAL) &&
-            *flags & NFT_SET_ELEM_INTERVAL_END)
-                return -EINVAL;
-
-        return 0;
-}
-
 static int nft_add_set_elem(struct nft_ctx *ctx, struct nft_set *set,
                             const struct nlattr *attr, u32 nlmsg_flags)
 {
diff --git a/net/netfilter/nfnetlink_log.c b/net/netfilter/nfnetlink_log.c
index cad6498f10b0..e5afab86381c 100644
--- a/net/netfilter/nfnetlink_log.c
+++ b/net/netfilter/nfnetlink_log.c
@@ -151,7 +151,7 @@ instance_put(struct nfulnl_instance *inst)
                 call_rcu_bh(&inst->rcu, nfulnl_instance_free_rcu);
 }
 
-static void nfulnl_timer(unsigned long data);
+static void nfulnl_timer(struct timer_list *t);
 
 static struct nfulnl_instance *
 instance_create(struct net *net, u_int16_t group_num,
@@ -184,7 +184,7 @@ instance_create(struct net *net, u_int16_t group_num,
         /* needs to be two, since we _put() after creation */
         refcount_set(&inst->use, 2);
 
-        setup_timer(&inst->timer, nfulnl_timer, (unsigned long)inst);
+        timer_setup(&inst->timer, nfulnl_timer, 0);
 
         inst->net = get_net(net);
         inst->peer_user_ns = user_ns;
@@ -377,9 +377,9 @@ __nfulnl_flush(struct nfulnl_instance *inst)
 }
 
 static void
-nfulnl_timer(unsigned long data)
+nfulnl_timer(struct timer_list *t)
 {
-        struct nfulnl_instance *inst = (struct nfulnl_instance *)data;
+        struct nfulnl_instance *inst = from_timer(inst, t, timer);
 
         spin_lock_bh(&inst->lock);
         if (inst->skb)
diff --git a/net/netfilter/nft_ct.c b/net/netfilter/nft_ct.c
index bd0975d7dd6f..2647b895f4b0 100644
--- a/net/netfilter/nft_ct.c
+++ b/net/netfilter/nft_ct.c
@@ -312,39 +312,6 @@ static const struct nla_policy nft_ct_policy[NFTA_CT_MAX + 1] = {
         [NFTA_CT_SREG]          = { .type = NLA_U32 },
 };
 
-static int nft_ct_netns_get(struct net *net, uint8_t family)
-{
-        int err;
-
-        if (family == NFPROTO_INET) {
-                err = nf_ct_netns_get(net, NFPROTO_IPV4);
-                if (err < 0)
-                        goto err1;
-                err = nf_ct_netns_get(net, NFPROTO_IPV6);
-                if (err < 0)
-                        goto err2;
-        } else {
-                err = nf_ct_netns_get(net, family);
-                if (err < 0)
-                        goto err1;
-        }
-        return 0;
-
-err2:
-        nf_ct_netns_put(net, NFPROTO_IPV4);
-err1:
-        return err;
-}
-
-static void nft_ct_netns_put(struct net *net, uint8_t family)
-{
-        if (family == NFPROTO_INET) {
-                nf_ct_netns_put(net, NFPROTO_IPV4);
-                nf_ct_netns_put(net, NFPROTO_IPV6);
-        } else
-                nf_ct_netns_put(net, family);
-}
-
 #ifdef CONFIG_NF_CONNTRACK_ZONES
 static void nft_ct_tmpl_put_pcpu(void)
 {
@@ -489,7 +456,7 @@ static int nft_ct_get_init(const struct nft_ctx *ctx,
         if (err < 0)
                 return err;
 
-        err = nft_ct_netns_get(ctx->net, ctx->afi->family);
+        err = nf_ct_netns_get(ctx->net, ctx->afi->family);
         if (err < 0)
                 return err;
 
@@ -583,7 +550,7 @@ static int nft_ct_set_init(const struct nft_ctx *ctx,
         if (err < 0)
                 goto err1;
 
-        err = nft_ct_netns_get(ctx->net, ctx->afi->family);
+        err = nf_ct_netns_get(ctx->net, ctx->afi->family);
         if (err < 0)
                 goto err1;
 
@@ -606,7 +573,7 @@ static void nft_ct_set_destroy(const struct nft_ctx *ctx,
         struct nft_ct *priv = nft_expr_priv(expr);
 
         __nft_ct_set_destroy(ctx, priv);
-        nft_ct_netns_put(ctx->net, ctx->afi->family);
+        nf_ct_netns_put(ctx->net, ctx->afi->family);
 }
 
 static int nft_ct_get_dump(struct sk_buff *skb, const struct nft_expr *expr)
diff --git a/net/netfilter/nft_set_bitmap.c b/net/netfilter/nft_set_bitmap.c
index 734989c40579..45fb2752fb63 100644
--- a/net/netfilter/nft_set_bitmap.c
+++ b/net/netfilter/nft_set_bitmap.c
@@ -106,6 +106,23 @@ nft_bitmap_elem_find(const struct nft_set *set, struct nft_bitmap_elem *this,
         return NULL;
 }
 
+static void *nft_bitmap_get(const struct net *net, const struct nft_set *set,
+                            const struct nft_set_elem *elem, unsigned int flags)
+{
+        const struct nft_bitmap *priv = nft_set_priv(set);
+        u8 genmask = nft_genmask_cur(net);
+        struct nft_bitmap_elem *be;
+
+        list_for_each_entry_rcu(be, &priv->list, head) {
+                if (memcmp(nft_set_ext_key(&be->ext), elem->key.val.data, set->klen) ||
+                    !nft_set_elem_active(&be->ext, genmask))
+                        continue;
+
+                return be;
+        }
+        return ERR_PTR(-ENOENT);
+}
+
 static int nft_bitmap_insert(const struct net *net, const struct nft_set *set,
                              const struct nft_set_elem *elem,
                              struct nft_set_ext **ext)
@@ -294,6 +311,7 @@ static struct nft_set_ops nft_bitmap_ops __read_mostly = {
         .activate       = nft_bitmap_activate,
         .lookup         = nft_bitmap_lookup,
         .walk           = nft_bitmap_walk,
+        .get            = nft_bitmap_get,
 };
 
 static struct nft_set_type nft_bitmap_type __read_mostly = {
diff --git a/net/netfilter/nft_set_hash.c b/net/netfilter/nft_set_hash.c
index 9c0d5a7ce5f9..f8166c1d5430 100644
--- a/net/netfilter/nft_set_hash.c
+++ b/net/netfilter/nft_set_hash.c
@@ -95,6 +95,24 @@ static bool nft_rhash_lookup(const struct net *net, const struct nft_set *set,
         return !!he;
 }
 
+static void *nft_rhash_get(const struct net *net, const struct nft_set *set,
+                           const struct nft_set_elem *elem, unsigned int flags)
+{
+        struct nft_rhash *priv = nft_set_priv(set);
+        struct nft_rhash_elem *he;
+        struct nft_rhash_cmp_arg arg = {
+                .genmask = nft_genmask_cur(net),
+                .set     = set,
+                .key     = elem->key.val.data,
+        };
+
+        he = rhashtable_lookup_fast(&priv->ht, &arg, nft_rhash_params);
+        if (he != NULL)
+                return he;
+
+        return ERR_PTR(-ENOENT);
+}
+
 static bool nft_rhash_update(struct nft_set *set, const u32 *key,
                              void *(*new)(struct nft_set *,
                                           const struct nft_expr *,
@@ -409,6 +427,24 @@ static bool nft_hash_lookup(const struct net *net, const struct nft_set *set,
         return false;
 }
 
+static void *nft_hash_get(const struct net *net, const struct nft_set *set,
+                          const struct nft_set_elem *elem, unsigned int flags)
+{
+        struct nft_hash *priv = nft_set_priv(set);
+        u8 genmask = nft_genmask_cur(net);
+        struct nft_hash_elem *he;
+        u32 hash;
+
+        hash = jhash(elem->key.val.data, set->klen, priv->seed);
+        hash = reciprocal_scale(hash, priv->buckets);
+        hlist_for_each_entry_rcu(he, &priv->table[hash], node) {
+                if (!memcmp(nft_set_ext_key(&he->ext), elem->key.val.data, set->klen) &&
+                    nft_set_elem_active(&he->ext, genmask))
+                        return he;
+        }
+        return ERR_PTR(-ENOENT);
+}
+
 /* nft_hash_select_ops() makes sure key size can be either 2 or 4 bytes . */
 static inline u32 nft_hash_key(const u32 *key, u32 klen)
 {
@@ -494,7 +530,7 @@ static void *nft_hash_deactivate(const struct net *net,
         hash = reciprocal_scale(hash, priv->buckets);
         hlist_for_each_entry(he, &priv->table[hash], node) {
                 if (!memcmp(nft_set_ext_key(&this->ext), &elem->key.val,
-                            set->klen) ||
+                            set->klen) &&
                     nft_set_elem_active(&he->ext, genmask)) {
                         nft_set_elem_change_active(net, set, &he->ext);
                         return he;
@@ -600,6 +636,7 @@ static struct nft_set_ops nft_rhash_ops __read_mostly = {
         .lookup         = nft_rhash_lookup,
         .update         = nft_rhash_update,
         .walk           = nft_rhash_walk,
+        .get            = nft_rhash_get,
         .features       = NFT_SET_MAP | NFT_SET_OBJECT | NFT_SET_TIMEOUT,
 };
 
@@ -617,6 +654,7 @@ static struct nft_set_ops nft_hash_ops __read_mostly = {
         .remove         = nft_hash_remove,
         .lookup         = nft_hash_lookup,
         .walk           = nft_hash_walk,
+        .get            = nft_hash_get,
         .features       = NFT_SET_MAP | NFT_SET_OBJECT,
 };
 
@@ -634,6 +672,7 @@ static struct nft_set_ops nft_hash_fast_ops __read_mostly = {
         .remove         = nft_hash_remove,
         .lookup         = nft_hash_lookup_fast,
         .walk           = nft_hash_walk,
+        .get            = nft_hash_get,
         .features       = NFT_SET_MAP | NFT_SET_OBJECT,
 };
 
diff --git a/net/netfilter/nft_set_rbtree.c b/net/netfilter/nft_set_rbtree.c
index d83a4ec5900d..e6f08bc5f359 100644
--- a/net/netfilter/nft_set_rbtree.c
+++ b/net/netfilter/nft_set_rbtree.c
@@ -113,6 +113,78 @@ static bool nft_rbtree_lookup(const struct net *net, const struct nft_set *set,
         return ret;
 }
 
+static bool __nft_rbtree_get(const struct net *net, const struct nft_set *set,
+                             const u32 *key, struct nft_rbtree_elem **elem,
+                             unsigned int seq, unsigned int flags, u8 genmask)
+{
+        struct nft_rbtree_elem *rbe, *interval = NULL;
+        struct nft_rbtree *priv = nft_set_priv(set);
+        const struct rb_node *parent;
+        const void *this;
+        int d;
+
+        parent = rcu_dereference_raw(priv->root.rb_node);
+        while (parent != NULL) {
+                if (read_seqcount_retry(&priv->count, seq))
+                        return false;
+
+                rbe = rb_entry(parent, struct nft_rbtree_elem, node);
+
+                this = nft_set_ext_key(&rbe->ext);
+                d = memcmp(this, key, set->klen);
+                if (d < 0) {
+                        parent = rcu_dereference_raw(parent->rb_left);
+                        interval = rbe;
+                } else if (d > 0) {
+                        parent = rcu_dereference_raw(parent->rb_right);
+                } else {
+                        if (!nft_set_elem_active(&rbe->ext, genmask))
+                                parent = rcu_dereference_raw(parent->rb_left);
+
+                        if (!nft_set_ext_exists(&rbe->ext, NFT_SET_EXT_FLAGS) ||
+                            (*nft_set_ext_flags(&rbe->ext) & NFT_SET_ELEM_INTERVAL_END) ==
+                            (flags & NFT_SET_ELEM_INTERVAL_END)) {
+                                *elem = rbe;
+                                return true;
+                        }
+                        return false;
+                }
+        }
+
+        if (set->flags & NFT_SET_INTERVAL && interval != NULL &&
+            nft_set_elem_active(&interval->ext, genmask) &&
+            !nft_rbtree_interval_end(interval)) {
+                *elem = interval;
+                return true;
+        }
+
+        return false;
+}
+
+static void *nft_rbtree_get(const struct net *net, const struct nft_set *set,
+                            const struct nft_set_elem *elem, unsigned int flags)
+{
+        struct nft_rbtree *priv = nft_set_priv(set);
+        unsigned int seq = read_seqcount_begin(&priv->count);
+        struct nft_rbtree_elem *rbe = ERR_PTR(-ENOENT);
+        const u32 *key = (const u32 *)&elem->key.val;
+        u8 genmask = nft_genmask_cur(net);
+        bool ret;
+
+        ret = __nft_rbtree_get(net, set, key, &rbe, seq, flags, genmask);
+        if (ret || !read_seqcount_retry(&priv->count, seq))
+                return rbe;
+
+        read_lock_bh(&priv->lock);
+        seq = read_seqcount_begin(&priv->count);
+        ret = __nft_rbtree_get(net, set, key, &rbe, seq, flags, genmask);
+        if (!ret)
+                rbe = ERR_PTR(-ENOENT);
+        read_unlock_bh(&priv->lock);
+
+        return rbe;
+}
+
 static int __nft_rbtree_insert(const struct net *net, const struct nft_set *set,
                                struct nft_rbtree_elem *new,
                                struct nft_set_ext **ext)
@@ -336,6 +408,7 @@ static struct nft_set_ops nft_rbtree_ops __read_mostly = {
         .activate       = nft_rbtree_activate,
         .lookup         = nft_rbtree_lookup,
         .walk           = nft_rbtree_walk,
+        .get            = nft_rbtree_get,
         .features       = NFT_SET_INTERVAL | NFT_SET_MAP | NFT_SET_OBJECT,
 };
 
diff --git a/net/netfilter/x_tables.c b/net/netfilter/x_tables.c
index d8571f414208..a77dd514297c 100644
--- a/net/netfilter/x_tables.c
+++ b/net/netfilter/x_tables.c
@@ -1153,6 +1153,7 @@ xt_replace_table(struct xt_table *table,
               int *error)
 {
         struct xt_table_info *private;
+        unsigned int cpu;
         int ret;
 
         ret = xt_jumpstack_alloc(newinfo);
@@ -1182,14 +1183,28 @@ xt_replace_table(struct xt_table *table,
         smp_wmb();
         table->private = newinfo;
 
+        /* make sure all cpus see new ->private value */
+        smp_wmb();
+
         /*
          * Even though table entries have now been swapped, other CPU's
-         * may still be using the old entries. This is okay, because
-         * resynchronization happens because of the locking done
-         * during the get_counters() routine.
+         * may still be using the old entries...
          */
         local_bh_enable();
 
+        /* ... so wait for even xt_recseq on all cpus */
+        for_each_possible_cpu(cpu) {
+                seqcount_t *s = &per_cpu(xt_recseq, cpu);
+                u32 seq = raw_read_seqcount(s);
+
+                if (seq & 1) {
+                        do {
+                                cond_resched();
+                                cpu_relax();
+                        } while (seq == raw_read_seqcount(s));
+                }
+        }
+
 #ifdef CONFIG_AUDIT
         if (audit_enabled) {
                 audit_log(current->audit_context, GFP_KERNEL,
diff --git a/net/netfilter/xt_IDLETIMER.c b/net/netfilter/xt_IDLETIMER.c
index daf45da448fa..ee3421ad108d 100644
--- a/net/netfilter/xt_IDLETIMER.c
+++ b/net/netfilter/xt_IDLETIMER.c
@@ -107,9 +107,9 @@ static void idletimer_tg_work(struct work_struct *work)
         sysfs_notify(idletimer_tg_kobj, NULL, timer->attr.attr.name);
 }
 
-static void idletimer_tg_expired(unsigned long data)
+static void idletimer_tg_expired(struct timer_list *t)
 {
-        struct idletimer_tg *timer = (struct idletimer_tg *) data;
+        struct idletimer_tg *timer = from_timer(timer, t, timer);
 
         pr_debug("timer %s expired\n", timer->attr.attr.name);
 
@@ -143,8 +143,7 @@ static int idletimer_tg_create(struct idletimer_tg_info *info)
 
         list_add(&info->timer->entry, &idletimer_tg_list);
 
-        setup_timer(&info->timer->timer, idletimer_tg_expired,
-                    (unsigned long) info->timer);
+        timer_setup(&info->timer->timer, idletimer_tg_expired, 0);
         info->timer->refcnt = 1;
 
         mod_timer(&info->timer->timer,
diff --git a/net/netfilter/xt_LED.c b/net/netfilter/xt_LED.c
index 3ba31c194cce..0971634e5444 100644
--- a/net/netfilter/xt_LED.c
+++ b/net/netfilter/xt_LED.c
@@ -85,9 +85,10 @@ led_tg(struct sk_buff *skb, const struct xt_action_param *par)
         return XT_CONTINUE;
 }
 
-static void led_timeout_callback(unsigned long data)
+static void led_timeout_callback(struct timer_list *t)
 {
-        struct xt_led_info_internal *ledinternal = (struct xt_led_info_internal *)data;
+        struct xt_led_info_internal *ledinternal = from_timer(ledinternal, t,
+                                                              timer);
 
         led_trigger_event(&ledinternal->netfilter_led_trigger, LED_OFF);
 }
@@ -143,8 +144,7 @@ static int led_tg_check(const struct xt_tgchk_param *par)
 
         /* See if we need to set up a timer */
         if (ledinfo->delay > 0)
-                setup_timer(&ledinternal->timer, led_timeout_callback,
-                            (unsigned long)ledinternal);
+                timer_setup(&ledinternal->timer, led_timeout_callback, 0);
 
         list_add_tail(&ledinternal->list, &xt_led_triggers);
 
diff --git a/net/netfilter/xt_bpf.c b/net/netfilter/xt_bpf.c
index 29123934887b..041da0d9c06f 100644
--- a/net/netfilter/xt_bpf.c
+++ b/net/netfilter/xt_bpf.c
@@ -56,7 +56,7 @@ static int __bpf_mt_check_path(const char *path, struct bpf_prog **ret)
         int retval, fd;
 
         set_fs(KERNEL_DS);
-        fd = bpf_obj_get_user(path);
+        fd = bpf_obj_get_user(path, 0);
         set_fs(oldfs);
         if (fd < 0)
                 return fd;
diff --git a/net/netfilter/xt_connlimit.c b/net/netfilter/xt_connlimit.c
index ffa8eec980e9..a6214f235333 100644
--- a/net/netfilter/xt_connlimit.c
+++ b/net/netfilter/xt_connlimit.c
@@ -46,7 +46,6 @@
 struct xt_connlimit_conn {
         struct hlist_node               node;
         struct nf_conntrack_tuple       tuple;
-        union nf_inet_addr              addr;
 };
 
 struct xt_connlimit_rb {
@@ -72,16 +71,9 @@ static inline unsigned int connlimit_iphash(__be32 addr)
 }
 
 static inline unsigned int
-connlimit_iphash6(const union nf_inet_addr *addr,
-                  const union nf_inet_addr *mask)
+connlimit_iphash6(const union nf_inet_addr *addr)
 {
-        union nf_inet_addr res;
-        unsigned int i;
-
-        for (i = 0; i < ARRAY_SIZE(addr->ip6); ++i)
-                res.ip6[i] = addr->ip6[i] & mask->ip6[i];
-
-        return jhash2((u32 *)res.ip6, ARRAY_SIZE(res.ip6),
+        return jhash2((u32 *)addr->ip6, ARRAY_SIZE(addr->ip6),
                        connlimit_rnd) % CONNLIMIT_SLOTS;
 }
 
@@ -95,24 +87,13 @@ static inline bool already_closed(const struct nf_conn *conn)
 }
 
 static int
-same_source_net(const union nf_inet_addr *addr,
-                const union nf_inet_addr *mask,
-                const union nf_inet_addr *u3, u_int8_t family)
+same_source(const union nf_inet_addr *addr,
+            const union nf_inet_addr *u3, u_int8_t family)
 {
-        if (family == NFPROTO_IPV4) {
-                return ntohl(addr->ip & mask->ip) -
-                       ntohl(u3->ip & mask->ip);
-        } else {
-                union nf_inet_addr lh, rh;
-                unsigned int i;
-
-                for (i = 0; i < ARRAY_SIZE(addr->ip6); ++i) {
-                        lh.ip6[i] = addr->ip6[i] & mask->ip6[i];
-                        rh.ip6[i] = u3->ip6[i] & mask->ip6[i];
-                }
+        if (family == NFPROTO_IPV4)
+                return ntohl(addr->ip) - ntohl(u3->ip);
 
-                return memcmp(&lh.ip6, &rh.ip6, sizeof(lh.ip6));
-        }
+        return memcmp(addr->ip6, u3->ip6, sizeof(addr->ip6));
 }
 
 static bool add_hlist(struct hlist_head *head,
@@ -125,7 +106,6 @@ static bool add_hlist(struct hlist_head *head,
         if (conn == NULL)
                 return false;
         conn->tuple = *tuple;
-        conn->addr = *addr;
         hlist_add_head(&conn->node, head);
         return true;
 }
@@ -196,7 +176,7 @@ static void tree_nodes_free(struct rb_root *root,
 static unsigned int
 count_tree(struct net *net, struct rb_root *root,
            const struct nf_conntrack_tuple *tuple,
-           const union nf_inet_addr *addr, const union nf_inet_addr *mask,
+           const union nf_inet_addr *addr,
            u8 family, const struct nf_conntrack_zone *zone)
 {
         struct xt_connlimit_rb *gc_nodes[CONNLIMIT_GC_MAX_NODES];
@@ -217,7 +197,7 @@ count_tree(struct net *net, struct rb_root *root,
                 rbconn = rb_entry(*rbnode, struct xt_connlimit_rb, node);
 
                 parent = *rbnode;
-                diff = same_source_net(addr, mask, &rbconn->addr, family);
+                diff = same_source(addr, &rbconn->addr, family);
                 if (diff < 0) {
                         rbnode = &((*rbnode)->rb_left);
                 } else if (diff > 0) {
@@ -270,7 +250,6 @@ count_tree(struct net *net, struct rb_root *root,
         }
 
         conn->tuple = *tuple;
-        conn->addr = *addr;
         rbconn->addr = *addr;
 
         INIT_HLIST_HEAD(&rbconn->hhead);
@@ -285,7 +264,6 @@ static int count_them(struct net *net,
                       struct xt_connlimit_data *data,
                       const struct nf_conntrack_tuple *tuple,
                       const union nf_inet_addr *addr,
-                      const union nf_inet_addr *mask,
                       u_int8_t family,
                       const struct nf_conntrack_zone *zone)
 {
@@ -294,14 +272,14 @@ static int count_them(struct net *net,
         u32 hash;
 
         if (family == NFPROTO_IPV6)
-                hash = connlimit_iphash6(addr, mask);
+                hash = connlimit_iphash6(addr);
         else
-                hash = connlimit_iphash(addr->ip & mask->ip);
+                hash = connlimit_iphash(addr->ip);
         root = &data->climit_root[hash];
 
         spin_lock_bh(&xt_connlimit_locks[hash % CONNLIMIT_LOCK_SLOTS]);
 
-        count = count_tree(net, root, tuple, addr, mask, family, zone);
+        count = count_tree(net, root, tuple, addr, family, zone);
 
         spin_unlock_bh(&xt_connlimit_locks[hash % CONNLIMIT_LOCK_SLOTS]);
 
@@ -332,16 +310,23 @@ connlimit_mt(const struct sk_buff *skb, struct xt_action_param *par)
 
         if (xt_family(par) == NFPROTO_IPV6) {
                 const struct ipv6hdr *iph = ipv6_hdr(skb);
+                unsigned int i;
+
                 memcpy(&addr.ip6, (info->flags & XT_CONNLIMIT_DADDR) ?
                        &iph->daddr : &iph->saddr, sizeof(addr.ip6));
+
+                for (i = 0; i < ARRAY_SIZE(addr.ip6); ++i)
+                        addr.ip6[i] &= info->mask.ip6[i];
         } else {
                 const struct iphdr *iph = ip_hdr(skb);
                 addr.ip = (info->flags & XT_CONNLIMIT_DADDR) ?
                           iph->daddr : iph->saddr;
+
+                addr.ip &= info->mask.ip;
         }
 
         connections = count_them(net, info->data, tuple_ptr, &addr,
-                                 &info->mask, xt_family(par), zone);
+                                 xt_family(par), zone);
         if (connections == 0)
                 /* kmalloc failed, drop it entirely */
                 goto hotdrop;
diff --git a/net/netlabel/netlabel_addrlist.h b/net/netlabel/netlabel_addrlist.h
index d0f38bc9af6d..ac709f0f197b 100644
--- a/net/netlabel/netlabel_addrlist.h
+++ b/net/netlabel/netlabel_addrlist.h
@@ -87,7 +87,7 @@ static inline struct netlbl_af4list *__af4list_valid_rcu(struct list_head *s,
         struct list_head *i = s;
         struct netlbl_af4list *n = __af4list_entry(s);
         while (i != h && !n->valid) {
-                i = rcu_dereference(i->next);
+                i = rcu_dereference(list_next_rcu(i));
                 n = __af4list_entry(i);
         }
         return n;
@@ -154,7 +154,7 @@ static inline struct netlbl_af6list *__af6list_valid_rcu(struct list_head *s,
         struct list_head *i = s;
         struct netlbl_af6list *n = __af6list_entry(s);
         while (i != h && !n->valid) {
-                i = rcu_dereference(i->next);
+                i = rcu_dereference(list_next_rcu(i));
                 n = __af6list_entry(i);
         }
         return n;
diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c
index b93148e8e9fb..b9e0ee4e22f5 100644
--- a/net/netlink/af_netlink.c
+++ b/net/netlink/af_netlink.c
@@ -128,7 +128,6 @@ static const char *const nlk_cb_mutex_key_strings[MAX_LINKS + 1] = {
 };
 
 static int netlink_dump(struct sock *sk);
-static void netlink_skb_destructor(struct sk_buff *skb);
 
 /* nl_table locking explained:
  * Lookup and traversal are protected with an RCU read-side lock. Insertion
@@ -2136,7 +2135,7 @@ static int netlink_dump(struct sock *sk)
         struct sk_buff *skb = NULL;
         struct nlmsghdr *nlh;
         struct module *module;
-        int len, err = -ENOBUFS;
+        int err = -ENOBUFS;
         int alloc_min_size;
         int alloc_size;
 
@@ -2183,9 +2182,11 @@ static int netlink_dump(struct sock *sk)
         skb_reserve(skb, skb_tailroom(skb) - alloc_size);
         netlink_skb_set_owner_r(skb, sk);
 
-        len = cb->dump(skb, cb);
+        if (nlk->dump_done_errno > 0)
+                nlk->dump_done_errno = cb->dump(skb, cb);
 
-        if (len > 0) {
+        if (nlk->dump_done_errno > 0 ||
+            skb_tailroom(skb) < nlmsg_total_size(sizeof(nlk->dump_done_errno))) {
                 mutex_unlock(nlk->cb_mutex);
 
                 if (sk_filter(sk, skb))
@@ -2195,13 +2196,15 @@ static int netlink_dump(struct sock *sk)
                 return 0;
         }
 
-        nlh = nlmsg_put_answer(skb, cb, NLMSG_DONE, sizeof(len), NLM_F_MULTI);
-        if (!nlh)
+        nlh = nlmsg_put_answer(skb, cb, NLMSG_DONE,
+                               sizeof(nlk->dump_done_errno), NLM_F_MULTI);
+        if (WARN_ON(!nlh))
                 goto errout_skb;
 
         nl_dump_check_consistent(cb, nlh);
 
-        memcpy(nlmsg_data(nlh), &len, sizeof(len));
+        memcpy(nlmsg_data(nlh), &nlk->dump_done_errno,
+               sizeof(nlk->dump_done_errno));
 
         if (sk_filter(sk, skb))
                 kfree_skb(skb);
@@ -2273,6 +2276,7 @@ int __netlink_dump_start(struct sock *ssk, struct sk_buff *skb,
         }
 
         nlk->cb_running = true;
+        nlk->dump_done_errno = INT_MAX;
 
         mutex_unlock(nlk->cb_mutex);
 
@@ -2313,17 +2317,16 @@ void netlink_ack(struct sk_buff *in_skb, struct nlmsghdr *nlh, int err,
          * requests to cap the error message, and get extra error data if
          * requested.
          */
+        if (nlk_has_extack && extack && extack->_msg)
+                tlvlen += nla_total_size(strlen(extack->_msg) + 1);
+
         if (err) {
                 if (!(nlk->flags & NETLINK_F_CAP_ACK))
                         payload += nlmsg_len(nlh);
                 else
                         flags |= NLM_F_CAPPED;
-                if (nlk_has_extack && extack) {
-                        if (extack->_msg)
-                                tlvlen += nla_total_size(strlen(extack->_msg) + 1);
-                        if (extack->bad_attr)
-                                tlvlen += nla_total_size(sizeof(u32));
-                }
+                if (nlk_has_extack && extack && extack->bad_attr)
+                        tlvlen += nla_total_size(sizeof(u32));
         } else {
                 flags |= NLM_F_CAPPED;
 
@@ -2336,16 +2339,8 @@ void netlink_ack(struct sk_buff *in_skb, struct nlmsghdr *nlh, int err,
 
         skb = nlmsg_new(payload + tlvlen, GFP_KERNEL);
         if (!skb) {
-                struct sock *sk;
-
-                sk = netlink_lookup(sock_net(in_skb->sk),
-                                    in_skb->sk->sk_protocol,
-                                    NETLINK_CB(in_skb).portid);
-                if (sk) {
-                        sk->sk_err = ENOBUFS;
-                        sk->sk_error_report(sk);
-                        sock_put(sk);
-                }
+                NETLINK_CB(in_skb).sk->sk_err = ENOBUFS;
+                NETLINK_CB(in_skb).sk->sk_error_report(NETLINK_CB(in_skb).sk);
                 return;
         }
 
@@ -2356,10 +2351,11 @@ void netlink_ack(struct sk_buff *in_skb, struct nlmsghdr *nlh, int err,
         memcpy(&errmsg->msg, nlh, payload > sizeof(*errmsg) ? nlh->nlmsg_len : sizeof(*nlh));
 
         if (nlk_has_extack && extack) {
+                if (extack->_msg) {
+                        WARN_ON(nla_put_string(skb, NLMSGERR_ATTR_MSG,
+                                               extack->_msg));
+                }
                 if (err) {
-                        if (extack->_msg)
-                                WARN_ON(nla_put_string(skb, NLMSGERR_ATTR_MSG,
-                                                       extack->_msg));
                         if (extack->bad_attr &&
                             !WARN_ON((u8 *)extack->bad_attr < in_skb->data ||
                                      (u8 *)extack->bad_attr >= in_skb->data +
diff --git a/net/netlink/af_netlink.h b/net/netlink/af_netlink.h
index 028188597eaa..962de7b3c023 100644
--- a/net/netlink/af_netlink.h
+++ b/net/netlink/af_netlink.h
@@ -34,6 +34,7 @@ struct netlink_sock {
         wait_queue_head_t       wait;
         bool                    bound;
         bool                    cb_running;
+        int                     dump_done_errno;
         struct netlink_callback cb;
         struct mutex            *cb_mutex;
         struct mutex            cb_def_mutex;
diff --git a/net/netrom/af_netrom.c b/net/netrom/af_netrom.c
index ebf16f7f9089..7ed9d4422a73 100644
--- a/net/netrom/af_netrom.c
+++ b/net/netrom/af_netrom.c
@@ -241,9 +241,9 @@ void nr_destroy_socket(struct sock *);
 /*
  *      Handler for deferred kills.
  */
-static void nr_destroy_timer(unsigned long data)
+static void nr_destroy_timer(struct timer_list *t)
 {
-        struct sock *sk=(struct sock *)data;
+        struct sock *sk = from_timer(sk, t, sk_timer);
         bh_lock_sock(sk);
         sock_hold(sk);
         nr_destroy_socket(sk);
diff --git a/net/netrom/nr_in.c b/net/netrom/nr_in.c
index 80dbd0beb516..fbfdae452ff9 100644
--- a/net/netrom/nr_in.c
+++ b/net/netrom/nr_in.c
@@ -125,7 +125,7 @@ static int nr_state2_machine(struct sock *sk, struct sk_buff *skb,
 
         case NR_DISCREQ:
                 nr_write_internal(sk, NR_DISCACK);
-
+                /* fall through */
         case NR_DISCACK:
                 nr_disconnect(sk, 0);
                 break;
diff --git a/net/netrom/nr_loopback.c b/net/netrom/nr_loopback.c
index 989ae647825e..215ad22a9647 100644
--- a/net/netrom/nr_loopback.c
+++ b/net/netrom/nr_loopback.c
@@ -15,7 +15,7 @@
 #include <net/netrom.h>
 #include <linux/init.h>
 
-static void nr_loopback_timer(unsigned long);
+static void nr_loopback_timer(struct timer_list *);
 
 static struct sk_buff_head loopback_queue;
 static DEFINE_TIMER(loopback_timer, nr_loopback_timer);
@@ -48,7 +48,7 @@ int nr_loopback_queue(struct sk_buff *skb)
         return 1;
 }
 
-static void nr_loopback_timer(unsigned long param)
+static void nr_loopback_timer(struct timer_list *unused)
 {
         struct sk_buff *skb;
         ax25_address *nr_dest;
diff --git a/net/netrom/nr_route.c b/net/netrom/nr_route.c
index 0c59354e280e..75e6ba970fde 100644
--- a/net/netrom/nr_route.c
+++ b/net/netrom/nr_route.c
@@ -80,6 +80,19 @@ static struct nr_neigh *nr_neigh_get_dev(ax25_address *callsign,
 
 static void nr_remove_neigh(struct nr_neigh *);
 
+/*      re-sort the routes in quality order.    */
+static void re_sort_routes(struct nr_node *nr_node, int x, int y)
+{
+        if (nr_node->routes[y].quality > nr_node->routes[x].quality) {
+                if (nr_node->which == x)
+                        nr_node->which = y;
+                else if (nr_node->which == y)
+                        nr_node->which = x;
+
+                swap(nr_node->routes[x], nr_node->routes[y]);
+        }
+}
+
 /*
  *      Add a new route to a node, and in the process add the node and the
  *      neighbour if it is new.
@@ -90,7 +103,6 @@ static int __must_check nr_add_node(ax25_address *nr, const char *mnemonic,
 {
         struct nr_node  *nr_node;
         struct nr_neigh *nr_neigh;
-        struct nr_route nr_route;
         int i, found;
         struct net_device *odev;
 
@@ -251,49 +263,11 @@ static int __must_check nr_add_node(ax25_address *nr, const char *mnemonic,
         /* Now re-sort the routes in quality order */
         switch (nr_node->count) {
         case 3:
-                if (nr_node->routes[1].quality > nr_node->routes[0].quality) {
-                        switch (nr_node->which) {
-                        case 0:
-                                nr_node->which = 1;
-                                break;
-                        case 1:
-                                nr_node->which = 0;
-                                break;
-                        }
-                        nr_route           = nr_node->routes[0];
-                        nr_node->routes[0] = nr_node->routes[1];
-                        nr_node->routes[1] = nr_route;
-                }
-                if (nr_node->routes[2].quality > nr_node->routes[1].quality) {
-                        switch (nr_node->which) {
-                        case 1:  nr_node->which = 2;
-                                break;
-
-                        case 2:  nr_node->which = 1;
-                                break;
-
-                        default:
-                                break;
-                        }
-                        nr_route           = nr_node->routes[1];
-                        nr_node->routes[1] = nr_node->routes[2];
-                        nr_node->routes[2] = nr_route;
-                }
+                re_sort_routes(nr_node, 0, 1);
+                re_sort_routes(nr_node, 1, 2);
+                /* fall through */
         case 2:
-                if (nr_node->routes[1].quality > nr_node->routes[0].quality) {
-                        switch (nr_node->which) {
-                        case 0:  nr_node->which = 1;
-                                break;
-
-                        case 1:  nr_node->which = 0;
-                                break;
-
-                        default: break;
-                        }
-                        nr_route           = nr_node->routes[0];
-                        nr_node->routes[0] = nr_node->routes[1];
-                        nr_node->routes[1] = nr_route;
-                        }
+                re_sort_routes(nr_node, 0, 1);
         case 1:
                 break;
         }
@@ -384,6 +358,7 @@ static int nr_del_node(ax25_address *callsign, ax25_address *neighbour, struct n
                                 switch (i) {
                                 case 0:
                                         nr_node->routes[0] = nr_node->routes[1];
+                                        /* fall through */
                                 case 1:
                                         nr_node->routes[1] = nr_node->routes[2];
                                 case 2:
@@ -553,6 +528,7 @@ void nr_rt_device_down(struct net_device *dev)
                                                 switch (i) {
                                                 case 0:
                                                         t->routes[0] = t->routes[1];
+                                                        /* fall through */
                                                 case 1:
                                                         t->routes[1] = t->routes[2];
                                                 case 2:
diff --git a/net/netrom/nr_timer.c b/net/netrom/nr_timer.c
index 94d05806a9a2..cbd51ed5a2d7 100644
--- a/net/netrom/nr_timer.c
+++ b/net/netrom/nr_timer.c
@@ -29,24 +29,23 @@
 #include <linux/interrupt.h>
 #include <net/netrom.h>
 
-static void nr_heartbeat_expiry(unsigned long);
-static void nr_t1timer_expiry(unsigned long);
-static void nr_t2timer_expiry(unsigned long);
-static void nr_t4timer_expiry(unsigned long);
-static void nr_idletimer_expiry(unsigned long);
+static void nr_heartbeat_expiry(struct timer_list *);
+static void nr_t1timer_expiry(struct timer_list *);
+static void nr_t2timer_expiry(struct timer_list *);
+static void nr_t4timer_expiry(struct timer_list *);
+static void nr_idletimer_expiry(struct timer_list *);
 
 void nr_init_timers(struct sock *sk)
 {
         struct nr_sock *nr = nr_sk(sk);
 
-        setup_timer(&nr->t1timer, nr_t1timer_expiry, (unsigned long)sk);
-        setup_timer(&nr->t2timer, nr_t2timer_expiry, (unsigned long)sk);
-        setup_timer(&nr->t4timer, nr_t4timer_expiry, (unsigned long)sk);
-        setup_timer(&nr->idletimer, nr_idletimer_expiry, (unsigned long)sk);
+        timer_setup(&nr->t1timer, nr_t1timer_expiry, 0);
+        timer_setup(&nr->t2timer, nr_t2timer_expiry, 0);
+        timer_setup(&nr->t4timer, nr_t4timer_expiry, 0);
+        timer_setup(&nr->idletimer, nr_idletimer_expiry, 0);
 
         /* initialized by sock_init_data */
-        sk->sk_timer.data     = (unsigned long)sk;
-        sk->sk_timer.function = &nr_heartbeat_expiry;
+        sk->sk_timer.function = nr_heartbeat_expiry;
 }
 
 void nr_start_t1timer(struct sock *sk)
@@ -113,9 +112,9 @@ int nr_t1timer_running(struct sock *sk)
         return timer_pending(&nr_sk(sk)->t1timer);
 }
 
-static void nr_heartbeat_expiry(unsigned long param)
+static void nr_heartbeat_expiry(struct timer_list *t)
 {
-        struct sock *sk = (struct sock *)param;
+        struct sock *sk = from_timer(sk, t, sk_timer);
         struct nr_sock *nr = nr_sk(sk);
 
         bh_lock_sock(sk);
@@ -152,10 +151,10 @@ static void nr_heartbeat_expiry(unsigned long param)
         bh_unlock_sock(sk);
 }
 
-static void nr_t2timer_expiry(unsigned long param)
+static void nr_t2timer_expiry(struct timer_list *t)
 {
-        struct sock *sk = (struct sock *)param;
-        struct nr_sock *nr = nr_sk(sk);
+        struct nr_sock *nr = from_timer(nr, t, t2timer);
+        struct sock *sk = &nr->sock;
 
         bh_lock_sock(sk);
         if (nr->condition & NR_COND_ACK_PENDING) {
@@ -165,19 +164,20 @@ static void nr_t2timer_expiry(unsigned long param)
         bh_unlock_sock(sk);
 }
 
-static void nr_t4timer_expiry(unsigned long param)
+static void nr_t4timer_expiry(struct timer_list *t)
 {
-        struct sock *sk = (struct sock *)param;
+        struct nr_sock *nr = from_timer(nr, t, t4timer);
+        struct sock *sk = &nr->sock;
 
         bh_lock_sock(sk);
         nr_sk(sk)->condition &= ~NR_COND_PEER_RX_BUSY;
         bh_unlock_sock(sk);
 }
 
-static void nr_idletimer_expiry(unsigned long param)
+static void nr_idletimer_expiry(struct timer_list *t)
 {
-        struct sock *sk = (struct sock *)param;
-        struct nr_sock *nr = nr_sk(sk);
+        struct nr_sock *nr = from_timer(nr, t, idletimer);
+        struct sock *sk = &nr->sock;
 
         bh_lock_sock(sk);
 
@@ -202,10 +202,10 @@ static void nr_idletimer_expiry(unsigned long param)
         bh_unlock_sock(sk);
 }
 
-static void nr_t1timer_expiry(unsigned long param)
+static void nr_t1timer_expiry(struct timer_list *t)
 {
-        struct sock *sk = (struct sock *)param;
-        struct nr_sock *nr = nr_sk(sk);
+        struct nr_sock *nr = from_timer(nr, t, t1timer);
+        struct sock *sk = &nr->sock;
 
         bh_lock_sock(sk);
         switch (nr->state) {
diff --git a/net/nfc/core.c b/net/nfc/core.c
index 5cf33df888c3..947a470f929d 100644
--- a/net/nfc/core.c
+++ b/net/nfc/core.c
@@ -1015,9 +1015,9 @@ exit:
         device_unlock(&dev->dev);
 }
 
-static void nfc_check_pres_timeout(unsigned long data)
+static void nfc_check_pres_timeout(struct timer_list *t)
 {
-        struct nfc_dev *dev = (struct nfc_dev *)data;
+        struct nfc_dev *dev = from_timer(dev, t, check_pres_timer);
 
         schedule_work(&dev->check_pres_work);
 }
@@ -1094,10 +1094,7 @@ struct nfc_dev *nfc_allocate_device(struct nfc_ops *ops,
         dev->targets_generation = 1;
 
         if (ops->check_presence) {
-                init_timer(&dev->check_pres_timer);
-                dev->check_pres_timer.data = (unsigned long)dev;
-                dev->check_pres_timer.function = nfc_check_pres_timeout;
-
+                timer_setup(&dev->check_pres_timer, nfc_check_pres_timeout, 0);
                 INIT_WORK(&dev->check_pres_work, nfc_check_pres_work);
         }
 
@@ -1106,7 +1103,7 @@ struct nfc_dev *nfc_allocate_device(struct nfc_ops *ops,
 err_free_dev:
         kfree(dev);
 
-        return ERR_PTR(rc);
+        return NULL;
 }
 EXPORT_SYMBOL(nfc_allocate_device);
 
diff --git a/net/nfc/digital_core.c b/net/nfc/digital_core.c
index de6dd37d04c7..ec0a8998e52d 100644
--- a/net/nfc/digital_core.c
+++ b/net/nfc/digital_core.c
@@ -650,6 +650,7 @@ static void digital_deactivate_target(struct nfc_dev *nfc_dev,
                 return;
         }
 
+        digital_abort_cmd(ddev);
         ddev->curr_protocol = 0;
 }
 
diff --git a/net/nfc/hci/core.c b/net/nfc/hci/core.c
index b740fef0acc5..ac8030c4bcf8 100644
--- a/net/nfc/hci/core.c
+++ b/net/nfc/hci/core.c
@@ -428,9 +428,9 @@ exit_noskb:
                 nfc_hci_driver_failure(hdev, r);
 }
 
-static void nfc_hci_cmd_timeout(unsigned long data)
+static void nfc_hci_cmd_timeout(struct timer_list *t)
 {
-        struct nfc_hci_dev *hdev = (struct nfc_hci_dev *)data;
+        struct nfc_hci_dev *hdev = from_timer(hdev, t, cmd_timer);
 
         schedule_work(&hdev->msg_tx_work);
 }
@@ -1004,9 +1004,7 @@ int nfc_hci_register_device(struct nfc_hci_dev *hdev)
 
         INIT_WORK(&hdev->msg_tx_work, nfc_hci_msg_tx_work);
 
-        init_timer(&hdev->cmd_timer);
-        hdev->cmd_timer.data = (unsigned long)hdev;
-        hdev->cmd_timer.function = nfc_hci_cmd_timeout;
+        timer_setup(&hdev->cmd_timer, nfc_hci_cmd_timeout, 0);
 
         skb_queue_head_init(&hdev->rx_hcp_frags);
 
diff --git a/net/nfc/hci/llc_shdlc.c b/net/nfc/hci/llc_shdlc.c
index 17e59a009ce6..fe988936ad92 100644
--- a/net/nfc/hci/llc_shdlc.c
+++ b/net/nfc/hci/llc_shdlc.c
@@ -580,27 +580,27 @@ static void llc_shdlc_handle_send_queue(struct llc_shdlc *shdlc)
         }
 }
 
-static void llc_shdlc_connect_timeout(unsigned long data)
+static void llc_shdlc_connect_timeout(struct timer_list *t)
 {
-        struct llc_shdlc *shdlc = (struct llc_shdlc *)data;
+        struct llc_shdlc *shdlc = from_timer(shdlc, t, connect_timer);
 
         pr_debug("\n");
 
         schedule_work(&shdlc->sm_work);
 }
 
-static void llc_shdlc_t1_timeout(unsigned long data)
+static void llc_shdlc_t1_timeout(struct timer_list *t)
 {
-        struct llc_shdlc *shdlc = (struct llc_shdlc *)data;
+        struct llc_shdlc *shdlc = from_timer(shdlc, t, t1_timer);
 
         pr_debug("SoftIRQ: need to send ack\n");
 
         schedule_work(&shdlc->sm_work);
 }
 
-static void llc_shdlc_t2_timeout(unsigned long data)
+static void llc_shdlc_t2_timeout(struct timer_list *t)
 {
-        struct llc_shdlc *shdlc = (struct llc_shdlc *)data;
+        struct llc_shdlc *shdlc = from_timer(shdlc, t, t2_timer);
 
         pr_debug("SoftIRQ: need to retransmit\n");
 
@@ -763,17 +763,9 @@ static void *llc_shdlc_init(struct nfc_hci_dev *hdev, xmit_to_drv_t xmit_to_drv,
         mutex_init(&shdlc->state_mutex);
         shdlc->state = SHDLC_DISCONNECTED;
 
-        init_timer(&shdlc->connect_timer);
-        shdlc->connect_timer.data = (unsigned long)shdlc;
-        shdlc->connect_timer.function = llc_shdlc_connect_timeout;
-
-        init_timer(&shdlc->t1_timer);
-        shdlc->t1_timer.data = (unsigned long)shdlc;
-        shdlc->t1_timer.function = llc_shdlc_t1_timeout;
-
-        init_timer(&shdlc->t2_timer);
-        shdlc->t2_timer.data = (unsigned long)shdlc;
-        shdlc->t2_timer.function = llc_shdlc_t2_timeout;
+        timer_setup(&shdlc->connect_timer, llc_shdlc_connect_timeout, 0);
+        timer_setup(&shdlc->t1_timer, llc_shdlc_t1_timeout, 0);
+        timer_setup(&shdlc->t2_timer, llc_shdlc_t2_timeout, 0);
 
         shdlc->w = SHDLC_MAX_WINDOW;
         shdlc->srej_support = SHDLC_SREJ_SUPPORT;
diff --git a/net/nfc/llcp_core.c b/net/nfc/llcp_core.c
index 02eef5cf3cce..ef4026a23e80 100644
--- a/net/nfc/llcp_core.c
+++ b/net/nfc/llcp_core.c
@@ -242,9 +242,9 @@ static void nfc_llcp_timeout_work(struct work_struct *work)
         nfc_dep_link_down(local->dev);
 }
 
-static void nfc_llcp_symm_timer(unsigned long data)
+static void nfc_llcp_symm_timer(struct timer_list *t)
 {
-        struct nfc_llcp_local *local = (struct nfc_llcp_local *) data;
+        struct nfc_llcp_local *local = from_timer(local, t, link_timer);
 
         pr_err("SYMM timeout\n");
 
@@ -285,9 +285,9 @@ static void nfc_llcp_sdreq_timeout_work(struct work_struct *work)
                 nfc_genl_llc_send_sdres(local->dev, &nl_sdres_list);
 }
 
-static void nfc_llcp_sdreq_timer(unsigned long data)
+static void nfc_llcp_sdreq_timer(struct timer_list *t)
 {
-        struct nfc_llcp_local *local = (struct nfc_llcp_local *) data;
+        struct nfc_llcp_local *local = from_timer(local, t, sdreq_timer);
 
         schedule_work(&local->sdreq_timeout_work);
 }
@@ -1573,9 +1573,7 @@ int nfc_llcp_register_device(struct nfc_dev *ndev)
         INIT_LIST_HEAD(&local->list);
         kref_init(&local->ref);
         mutex_init(&local->sdp_lock);
-        init_timer(&local->link_timer);
-        local->link_timer.data = (unsigned long) local;
-        local->link_timer.function = nfc_llcp_symm_timer;
+        timer_setup(&local->link_timer, nfc_llcp_symm_timer, 0);
 
         skb_queue_head_init(&local->tx_queue);
         INIT_WORK(&local->tx_work, nfc_llcp_tx_work);
@@ -1601,9 +1599,7 @@ int nfc_llcp_register_device(struct nfc_dev *ndev)
 
         mutex_init(&local->sdreq_lock);
         INIT_HLIST_HEAD(&local->pending_sdreqs);
-        init_timer(&local->sdreq_timer);
-        local->sdreq_timer.data = (unsigned long) local;
-        local->sdreq_timer.function = nfc_llcp_sdreq_timer;
+        timer_setup(&local->sdreq_timer, nfc_llcp_sdreq_timer, 0);
         INIT_WORK(&local->sdreq_timeout_work, nfc_llcp_sdreq_timeout_work);
 
         list_add(&local->list, &llcp_devices);
diff --git a/net/nfc/nci/core.c b/net/nfc/nci/core.c
index c25e9b4179c3..074960154993 100644
--- a/net/nfc/nci/core.c
+++ b/net/nfc/nci/core.c
@@ -591,18 +591,18 @@ static int nci_close_device(struct nci_dev *ndev)
 }
 
 /* NCI command timer function */
-static void nci_cmd_timer(unsigned long arg)
+static void nci_cmd_timer(struct timer_list *t)
 {
-        struct nci_dev *ndev = (void *) arg;
+        struct nci_dev *ndev = from_timer(ndev, t, cmd_timer);
 
         atomic_set(&ndev->cmd_cnt, 1);
         queue_work(ndev->cmd_wq, &ndev->cmd_work);
 }
 
 /* NCI data exchange timer function */
-static void nci_data_timer(unsigned long arg)
+static void nci_data_timer(struct timer_list *t)
 {
-        struct nci_dev *ndev = (void *) arg;
+        struct nci_dev *ndev = from_timer(ndev, t, data_timer);
 
         set_bit(NCI_DATA_EXCHANGE_TO, &ndev->flags);
         queue_work(ndev->rx_wq, &ndev->rx_work);
@@ -1232,10 +1232,8 @@ int nci_register_device(struct nci_dev *ndev)
         skb_queue_head_init(&ndev->rx_q);
         skb_queue_head_init(&ndev->tx_q);
 
-        setup_timer(&ndev->cmd_timer, nci_cmd_timer,
-                    (unsigned long) ndev);
-        setup_timer(&ndev->data_timer, nci_data_timer,
-                    (unsigned long) ndev);
+        timer_setup(&ndev->cmd_timer, nci_cmd_timer, 0);
+        timer_setup(&ndev->data_timer, nci_data_timer, 0);
 
         mutex_init(&ndev->req_lock);
         INIT_LIST_HEAD(&ndev->conn_info_list);
diff --git a/net/nfc/netlink.c b/net/nfc/netlink.c
index b251fb936a27..c0b83dc9d993 100644
--- a/net/nfc/netlink.c
+++ b/net/nfc/netlink.c
@@ -75,7 +75,7 @@ static int nfc_genl_send_target(struct sk_buff *msg, struct nfc_target *target,
         if (!hdr)
                 return -EMSGSIZE;
 
-        genl_dump_check_consistent(cb, hdr, &nfc_genl_family);
+        genl_dump_check_consistent(cb, hdr);
 
         if (nla_put_u32(msg, NFC_ATTR_TARGET_INDEX, target->idx) ||
             nla_put_u32(msg, NFC_ATTR_PROTOCOLS, target->supported_protocols) ||
@@ -603,7 +603,7 @@ static int nfc_genl_send_device(struct sk_buff *msg, struct nfc_dev *dev,
                 return -EMSGSIZE;
 
         if (cb)
-                genl_dump_check_consistent(cb, hdr, &nfc_genl_family);
+                genl_dump_check_consistent(cb, hdr);
 
         if (nfc_genl_setup_device_added(dev, msg))
                 goto nla_put_failure;
@@ -928,6 +928,30 @@ static int nfc_genl_activate_target(struct sk_buff *skb, struct genl_info *info)
         return rc;
 }
 
+static int nfc_genl_deactivate_target(struct sk_buff *skb,
+                                      struct genl_info *info)
+{
+        struct nfc_dev *dev;
+        u32 device_idx, target_idx;
+        int rc;
+
+        if (!info->attrs[NFC_ATTR_DEVICE_INDEX])
+                return -EINVAL;
+
+        device_idx = nla_get_u32(info->attrs[NFC_ATTR_DEVICE_INDEX]);
+
+        dev = nfc_get_device(device_idx);
+        if (!dev)
+                return -ENODEV;
+
+        target_idx = nla_get_u32(info->attrs[NFC_ATTR_TARGET_INDEX]);
+
+        rc = nfc_deactivate_target(dev, target_idx, NFC_TARGET_MODE_SLEEP);
+
+        nfc_put_device(dev);
+        return rc;
+}
+
 static int nfc_genl_dep_link_up(struct sk_buff *skb, struct genl_info *info)
 {
         struct nfc_dev *dev;
@@ -1332,7 +1356,7 @@ static int nfc_genl_send_se(struct sk_buff *msg, struct nfc_dev *dev,
                         goto nla_put_failure;
 
                 if (cb)
-                        genl_dump_check_consistent(cb, hdr, &nfc_genl_family);
+                        genl_dump_check_consistent(cb, hdr);
 
                 if (nla_put_u32(msg, NFC_ATTR_DEVICE_INDEX, dev->idx) ||
                     nla_put_u32(msg, NFC_ATTR_SE_INDEX, se->idx) ||
@@ -1751,6 +1775,11 @@ static const struct genl_ops nfc_genl_ops[] = {
                 .doit = nfc_genl_vendor_cmd,
                 .policy = nfc_genl_policy,
         },
+        {
+                .cmd = NFC_CMD_DEACTIVATE_TARGET,
+                .doit = nfc_genl_deactivate_target,
+                .policy = nfc_genl_policy,
+        },
 };
 
 static struct genl_family nfc_genl_family __ro_after_init = {
diff --git a/net/nsh/nsh.c b/net/nsh/nsh.c
index 58fb827439a8..d7da99a0b0b8 100644
--- a/net/nsh/nsh.c
+++ b/net/nsh/nsh.c
@@ -14,6 +14,66 @@
 #include <net/nsh.h>
 #include <net/tun_proto.h>
 
+int nsh_push(struct sk_buff *skb, const struct nshhdr *pushed_nh)
+{
+        struct nshhdr *nh;
+        size_t length = nsh_hdr_len(pushed_nh);
+        u8 next_proto;
+
+        if (skb->mac_len) {
+                next_proto = TUN_P_ETHERNET;
+        } else {
+                next_proto = tun_p_from_eth_p(skb->protocol);
+                if (!next_proto)
+                        return -EAFNOSUPPORT;
+        }
+
+        /* Add the NSH header */
+        if (skb_cow_head(skb, length) < 0)
+                return -ENOMEM;
+
+        skb_push(skb, length);
+        nh = (struct nshhdr *)(skb->data);
+        memcpy(nh, pushed_nh, length);
+        nh->np = next_proto;
+        skb_postpush_rcsum(skb, nh, length);
+
+        skb->protocol = htons(ETH_P_NSH);
+        skb_reset_mac_header(skb);
+        skb_reset_network_header(skb);
+        skb_reset_mac_len(skb);
+
+        return 0;
+}
+EXPORT_SYMBOL_GPL(nsh_push);
+
+int nsh_pop(struct sk_buff *skb)
+{
+        struct nshhdr *nh;
+        size_t length;
+        __be16 inner_proto;
+
+        if (!pskb_may_pull(skb, NSH_BASE_HDR_LEN))
+                return -ENOMEM;
+        nh = (struct nshhdr *)(skb->data);
+        length = nsh_hdr_len(nh);
+        inner_proto = tun_p_to_eth_p(nh->np);
+        if (!pskb_may_pull(skb, length))
+                return -ENOMEM;
+
+        if (!inner_proto)
+                return -EAFNOSUPPORT;
+
+        skb_pull_rcsum(skb, length);
+        skb_reset_mac_header(skb);
+        skb_reset_network_header(skb);
+        skb_reset_mac_len(skb);
+        skb->protocol = inner_proto;
+
+        return 0;
+}
+EXPORT_SYMBOL_GPL(nsh_pop);
+
 static struct sk_buff *nsh_gso_segment(struct sk_buff *skb,
                                        netdev_features_t features)
 {
diff --git a/net/openvswitch/Kconfig b/net/openvswitch/Kconfig
index ce947292ae77..2650205cdaf9 100644
--- a/net/openvswitch/Kconfig
+++ b/net/openvswitch/Kconfig
@@ -14,6 +14,7 @@ config OPENVSWITCH
         select MPLS
         select NET_MPLS_GSO
         select DST_CACHE
+        select NET_NSH
         ---help---
           Open vSwitch is a multilayer Ethernet switch targeted at virtualized
           environments.  In addition to supporting a variety of features
diff --git a/net/openvswitch/Makefile b/net/openvswitch/Makefile
index 299f4476cf44..41109c326f3a 100644
--- a/net/openvswitch/Makefile
+++ b/net/openvswitch/Makefile
@@ -12,6 +12,7 @@ openvswitch-y := \
         flow.o \
         flow_netlink.o \
         flow_table.o \
+        meter.o \
         vport.o \
         vport-internal_dev.o \
         vport-netdev.o
diff --git a/net/openvswitch/actions.c b/net/openvswitch/actions.c
index a54a556fcdb5..30a5df27116e 100644
--- a/net/openvswitch/actions.c
+++ b/net/openvswitch/actions.c
@@ -43,6 +43,7 @@
 #include "flow.h"
 #include "conntrack.h"
 #include "vport.h"
+#include "flow_netlink.h"
 
 struct deferred_action {
         struct sk_buff *skb;
@@ -380,6 +381,38 @@ static int push_eth(struct sk_buff *skb, struct sw_flow_key *key,
         return 0;
 }
 
+static int push_nsh(struct sk_buff *skb, struct sw_flow_key *key,
+                    const struct nshhdr *nh)
+{
+        int err;
+
+        err = nsh_push(skb, nh);
+        if (err)
+                return err;
+
+        /* safe right before invalidate_flow_key */
+        key->mac_proto = MAC_PROTO_NONE;
+        invalidate_flow_key(key);
+        return 0;
+}
+
+static int pop_nsh(struct sk_buff *skb, struct sw_flow_key *key)
+{
+        int err;
+
+        err = nsh_pop(skb);
+        if (err)
+                return err;
+
+        /* safe right before invalidate_flow_key */
+        if (skb->protocol == htons(ETH_P_TEB))
+                key->mac_proto = MAC_PROTO_ETHERNET;
+        else
+                key->mac_proto = MAC_PROTO_NONE;
+        invalidate_flow_key(key);
+        return 0;
+}
+
 static void update_ip_l4_checksum(struct sk_buff *skb, struct iphdr *nh,
                                   __be32 addr, __be32 new_addr)
 {
@@ -602,6 +635,69 @@ static int set_ipv6(struct sk_buff *skb, struct sw_flow_key *flow_key,
         return 0;
 }
 
+static int set_nsh(struct sk_buff *skb, struct sw_flow_key *flow_key,
+                   const struct nlattr *a)
+{
+        struct nshhdr *nh;
+        size_t length;
+        int err;
+        u8 flags;
+        u8 ttl;
+        int i;
+
+        struct ovs_key_nsh key;
+        struct ovs_key_nsh mask;
+
+        err = nsh_key_from_nlattr(a, &key, &mask);
+        if (err)
+                return err;
+
+        /* Make sure the NSH base header is there */
+        if (!pskb_may_pull(skb, skb_network_offset(skb) + NSH_BASE_HDR_LEN))
+                return -ENOMEM;
+
+        nh = nsh_hdr(skb);
+        length = nsh_hdr_len(nh);
+
+        /* Make sure the whole NSH header is there */
+        err = skb_ensure_writable(skb, skb_network_offset(skb) +
+                                       length);
+        if (unlikely(err))
+                return err;
+
+        nh = nsh_hdr(skb);
+        skb_postpull_rcsum(skb, nh, length);
+        flags = nsh_get_flags(nh);
+        flags = OVS_MASKED(flags, key.base.flags, mask.base.flags);
+        flow_key->nsh.base.flags = flags;
+        ttl = nsh_get_ttl(nh);
+        ttl = OVS_MASKED(ttl, key.base.ttl, mask.base.ttl);
+        flow_key->nsh.base.ttl = ttl;
+        nsh_set_flags_and_ttl(nh, flags, ttl);
+        nh->path_hdr = OVS_MASKED(nh->path_hdr, key.base.path_hdr,
+                                  mask.base.path_hdr);
+        flow_key->nsh.base.path_hdr = nh->path_hdr;
+        switch (nh->mdtype) {
+        case NSH_M_TYPE1:
+                for (i = 0; i < NSH_MD1_CONTEXT_SIZE; i++) {
+                        nh->md1.context[i] =
+                            OVS_MASKED(nh->md1.context[i], key.context[i],
+                                       mask.context[i]);
+                }
+                memcpy(flow_key->nsh.context, nh->md1.context,
+                       sizeof(nh->md1.context));
+                break;
+        case NSH_M_TYPE2:
+                memset(flow_key->nsh.context, 0,
+                       sizeof(flow_key->nsh.context));
+                break;
+        default:
+                return -EINVAL;
+        }
+        skb_postpush_rcsum(skb, nh, length);
+        return 0;
+}
+
 /* Must follow skb_ensure_writable() since that can move the skb data. */
 static void set_tp_port(struct sk_buff *skb, __be16 *port,
                         __be16 new_port, __sum16 *check)
@@ -1024,6 +1120,10 @@ static int execute_masked_set_action(struct sk_buff *skb,
                                    get_mask(a, struct ovs_key_ethernet *));
                 break;
 
+        case OVS_KEY_ATTR_NSH:
+                err = set_nsh(skb, flow_key, a);
+                break;
+
         case OVS_KEY_ATTR_IPV4:
                 err = set_ipv4(skb, flow_key, nla_data(a),
                                get_mask(a, struct ovs_key_ipv4 *));
@@ -1203,6 +1303,10 @@ static int do_execute_actions(struct datapath *dp, struct sk_buff *skb,
                                 return err == -EINPROGRESS ? 0 : err;
                         break;
 
+                case OVS_ACTION_ATTR_CT_CLEAR:
+                        err = ovs_ct_clear(skb, key);
+                        break;
+
                 case OVS_ACTION_ATTR_PUSH_ETH:
                         err = push_eth(skb, key, nla_data(a));
                         break;
@@ -1210,6 +1314,28 @@ static int do_execute_actions(struct datapath *dp, struct sk_buff *skb,
                 case OVS_ACTION_ATTR_POP_ETH:
                         err = pop_eth(skb, key);
                         break;
+
+                case OVS_ACTION_ATTR_PUSH_NSH: {
+                        u8 buffer[NSH_HDR_MAX_LEN];
+                        struct nshhdr *nh = (struct nshhdr *)buffer;
+
+                        err = nsh_hdr_from_nlattr(nla_data(a), nh,
+                                                  NSH_HDR_MAX_LEN);
+                        if (unlikely(err))
+                                break;
+                        err = push_nsh(skb, key, nh);
+                        break;
+                }
+
+                case OVS_ACTION_ATTR_POP_NSH:
+                        err = pop_nsh(skb, key);
+                        break;
+
+                case OVS_ACTION_ATTR_METER:
+                        if (ovs_meter_execute(dp, skb, key, nla_get_u32(a))) {
+                                consume_skb(skb);
+                                return 0;
+                        }
                 }
 
                 if (unlikely(err)) {
diff --git a/net/openvswitch/conntrack.c b/net/openvswitch/conntrack.c
index d558e882ca0c..b27c5c6d9cab 100644
--- a/net/openvswitch/conntrack.c
+++ b/net/openvswitch/conntrack.c
@@ -752,6 +752,7 @@ static int ovs_ct_nat_execute(struct sk_buff *skb, struct nf_conn *ct,
                         }
                 }
                 /* Non-ICMP, fall thru to initialize if needed. */
+                /* fall through */
         case IP_CT_NEW:
                 /* Seen it before?  This can happen for loopback, retrans,
                  * or local packets.
@@ -1129,6 +1130,17 @@ int ovs_ct_execute(struct net *net, struct sk_buff *skb,
         return err;
 }
 
+int ovs_ct_clear(struct sk_buff *skb, struct sw_flow_key *key)
+{
+        if (skb_nfct(skb)) {
+                nf_conntrack_put(skb_nfct(skb));
+                nf_ct_set(skb, NULL, IP_CT_UNTRACKED);
+                ovs_ct_fill_key(skb, key);
+        }
+
+        return 0;
+}
+
 static int ovs_ct_add_helper(struct ovs_conntrack_info *info, const char *name,
                              const struct sw_flow_key *key, bool log)
 {
diff --git a/net/openvswitch/conntrack.h b/net/openvswitch/conntrack.h
index bc7efd1867ab..399dfdd2c4f9 100644
--- a/net/openvswitch/conntrack.h
+++ b/net/openvswitch/conntrack.h
@@ -30,6 +30,7 @@ int ovs_ct_action_to_attr(const struct ovs_conntrack_info *, struct sk_buff *);
 
 int ovs_ct_execute(struct net *, struct sk_buff *, struct sw_flow_key *,
                    const struct ovs_conntrack_info *);
+int ovs_ct_clear(struct sk_buff *skb, struct sw_flow_key *key);
 
 void ovs_ct_fill_key(const struct sk_buff *skb, struct sw_flow_key *key);
 int ovs_ct_put_key(const struct sw_flow_key *swkey,
@@ -73,6 +74,12 @@ static inline int ovs_ct_execute(struct net *net, struct sk_buff *skb,
         return -ENOTSUPP;
 }
 
+static inline int ovs_ct_clear(struct sk_buff *skb,
+                               struct sw_flow_key *key)
+{
+        return -ENOTSUPP;
+}
+
 static inline void ovs_ct_fill_key(const struct sk_buff *skb,
                                    struct sw_flow_key *key)
 {
diff --git a/net/openvswitch/datapath.c b/net/openvswitch/datapath.c
index c3aec6227c91..0dab33fb9844 100644
--- a/net/openvswitch/datapath.c
+++ b/net/openvswitch/datapath.c
@@ -55,6 +55,7 @@
 #include "flow.h"
 #include "flow_table.h"
 #include "flow_netlink.h"
+#include "meter.h"
 #include "vport-internal_dev.h"
 #include "vport-netdev.h"
 
@@ -142,35 +143,6 @@ static int queue_userspace_packet(struct datapath *dp, struct sk_buff *,
                                   const struct dp_upcall_info *,
                                   uint32_t cutlen);
 
-/* Must be called with rcu_read_lock. */
-static struct datapath *get_dp_rcu(struct net *net, int dp_ifindex)
-{
-        struct net_device *dev = dev_get_by_index_rcu(net, dp_ifindex);
-
-        if (dev) {
-                struct vport *vport = ovs_internal_dev_get_vport(dev);
-                if (vport)
-                        return vport->dp;
-        }
-
-        return NULL;
-}
-
-/* The caller must hold either ovs_mutex or rcu_read_lock to keep the
- * returned dp pointer valid.
- */
-static inline struct datapath *get_dp(struct net *net, int dp_ifindex)
-{
-        struct datapath *dp;
-
-        WARN_ON_ONCE(!rcu_read_lock_held() && !lockdep_ovsl_is_held());
-        rcu_read_lock();
-        dp = get_dp_rcu(net, dp_ifindex);
-        rcu_read_unlock();
-
-        return dp;
-}
-
 /* Must be called with rcu_read_lock or ovs_mutex. */
 const char *ovs_dp_name(const struct datapath *dp)
 {
@@ -203,6 +175,7 @@ static void destroy_dp_rcu(struct rcu_head *rcu)
         ovs_flow_tbl_destroy(&dp->table);
         free_percpu(dp->stats_percpu);
         kfree(dp->ports);
+        ovs_meters_exit(dp);
         kfree(dp);
 }
 
@@ -1601,6 +1574,10 @@ static int ovs_dp_cmd_new(struct sk_buff *skb, struct genl_info *info)
         for (i = 0; i < DP_VPORT_HASH_BUCKETS; i++)
                 INIT_HLIST_HEAD(&dp->ports[i]);
 
+        err = ovs_meters_init(dp);
+        if (err)
+                goto err_destroy_ports_array;
+
         /* Set up our datapath device. */
         parms.name = nla_data(a[OVS_DP_ATTR_NAME]);
         parms.type = OVS_VPORT_TYPE_INTERNAL;
@@ -1629,7 +1606,7 @@ static int ovs_dp_cmd_new(struct sk_buff *skb, struct genl_info *info)
                                 ovs_dp_reset_user_features(skb, info);
                 }
 
-                goto err_destroy_ports_array;
+                goto err_destroy_meters;
         }
 
         err = ovs_dp_cmd_fill_info(dp, reply, info->snd_portid,
@@ -1644,8 +1621,10 @@ static int ovs_dp_cmd_new(struct sk_buff *skb, struct genl_info *info)
         ovs_notify(&dp_datapath_genl_family, reply, info);
         return 0;
 
-err_destroy_ports_array:
+err_destroy_meters:
         ovs_unlock();
+        ovs_meters_exit(dp);
+err_destroy_ports_array:
         kfree(dp->ports);
 err_destroy_percpu:
         free_percpu(dp->stats_percpu);
@@ -1848,7 +1827,8 @@ static struct genl_family dp_datapath_genl_family __ro_after_init = {
 
 /* Called with ovs_mutex or RCU read lock. */
 static int ovs_vport_cmd_fill_info(struct vport *vport, struct sk_buff *skb,
-                                   u32 portid, u32 seq, u32 flags, u8 cmd)
+                                   struct net *net, u32 portid, u32 seq,
+                                   u32 flags, u8 cmd)
 {
         struct ovs_header *ovs_header;
         struct ovs_vport_stats vport_stats;
@@ -1864,9 +1844,17 @@ static int ovs_vport_cmd_fill_info(struct vport *vport, struct sk_buff *skb,
         if (nla_put_u32(skb, OVS_VPORT_ATTR_PORT_NO, vport->port_no) ||
             nla_put_u32(skb, OVS_VPORT_ATTR_TYPE, vport->ops->type) ||
             nla_put_string(skb, OVS_VPORT_ATTR_NAME,
-                           ovs_vport_name(vport)))
+                           ovs_vport_name(vport)) ||
+            nla_put_u32(skb, OVS_VPORT_ATTR_IFINDEX, vport->dev->ifindex))
                 goto nla_put_failure;
 
+        if (!net_eq(net, dev_net(vport->dev))) {
+                int id = peernet2id_alloc(net, dev_net(vport->dev));
+
+                if (nla_put_s32(skb, OVS_VPORT_ATTR_NETNSID, id))
+                        goto nla_put_failure;
+        }
+
         ovs_vport_get_stats(vport, &vport_stats);
         if (nla_put_64bit(skb, OVS_VPORT_ATTR_STATS,
                           sizeof(struct ovs_vport_stats), &vport_stats,
@@ -1896,8 +1884,8 @@ static struct sk_buff *ovs_vport_cmd_alloc_info(void)
 }
 
 /* Called with ovs_mutex, only via ovs_dp_notify_wq(). */
-struct sk_buff *ovs_vport_cmd_build_info(struct vport *vport, u32 portid,
-                                         u32 seq, u8 cmd)
+struct sk_buff *ovs_vport_cmd_build_info(struct vport *vport, struct net *net,
+                                         u32 portid, u32 seq, u8 cmd)
 {
         struct sk_buff *skb;
         int retval;
@@ -1906,7 +1894,7 @@ struct sk_buff *ovs_vport_cmd_build_info(struct vport *vport, u32 portid,
         if (!skb)
                 return ERR_PTR(-ENOMEM);
 
-        retval = ovs_vport_cmd_fill_info(vport, skb, portid, seq, 0, cmd);
+        retval = ovs_vport_cmd_fill_info(vport, skb, net, portid, seq, 0, cmd);
         BUG_ON(retval < 0);
 
         return skb;
@@ -1920,6 +1908,8 @@ static struct vport *lookup_vport(struct net *net,
         struct datapath *dp;
         struct vport *vport;
 
+        if (a[OVS_VPORT_ATTR_IFINDEX])
+                return ERR_PTR(-EOPNOTSUPP);
         if (a[OVS_VPORT_ATTR_NAME]) {
                 vport = ovs_vport_locate(net, nla_data(a[OVS_VPORT_ATTR_NAME]));
                 if (!vport)
@@ -1944,6 +1934,7 @@ static struct vport *lookup_vport(struct net *net,
                 return vport;
         } else
                 return ERR_PTR(-EINVAL);
+
 }
 
 /* Called with ovs_mutex */
@@ -1983,6 +1974,8 @@ static int ovs_vport_cmd_new(struct sk_buff *skb, struct genl_info *info)
         if (!a[OVS_VPORT_ATTR_NAME] || !a[OVS_VPORT_ATTR_TYPE] ||
             !a[OVS_VPORT_ATTR_UPCALL_PID])
                 return -EINVAL;
+        if (a[OVS_VPORT_ATTR_IFINDEX])
+                return -EOPNOTSUPP;
 
         port_no = a[OVS_VPORT_ATTR_PORT_NO]
                 ? nla_get_u32(a[OVS_VPORT_ATTR_PORT_NO]) : 0;
@@ -2032,8 +2025,9 @@ restart:
                 goto exit_unlock_free;
         }
 
-        err = ovs_vport_cmd_fill_info(vport, reply, info->snd_portid,
-                                      info->snd_seq, 0, OVS_VPORT_CMD_NEW);
+        err = ovs_vport_cmd_fill_info(vport, reply, genl_info_net(info),
+                                      info->snd_portid, info->snd_seq, 0,
+                                      OVS_VPORT_CMD_NEW);
 
         if (netdev_get_fwd_headroom(vport->dev) > dp->max_headroom)
                 update_headroom(dp);
@@ -2090,8 +2084,9 @@ static int ovs_vport_cmd_set(struct sk_buff *skb, struct genl_info *info)
                         goto exit_unlock_free;
         }
 
-        err = ovs_vport_cmd_fill_info(vport, reply, info->snd_portid,
-                                      info->snd_seq, 0, OVS_VPORT_CMD_NEW);
+        err = ovs_vport_cmd_fill_info(vport, reply, genl_info_net(info),
+                                      info->snd_portid, info->snd_seq, 0,
+                                      OVS_VPORT_CMD_NEW);
         BUG_ON(err < 0);
 
         ovs_unlock();
@@ -2128,8 +2123,9 @@ static int ovs_vport_cmd_del(struct sk_buff *skb, struct genl_info *info)
                 goto exit_unlock_free;
         }
 
-        err = ovs_vport_cmd_fill_info(vport, reply, info->snd_portid,
-                                      info->snd_seq, 0, OVS_VPORT_CMD_DEL);
+        err = ovs_vport_cmd_fill_info(vport, reply, genl_info_net(info),
+                                      info->snd_portid, info->snd_seq, 0,
+                                      OVS_VPORT_CMD_DEL);
         BUG_ON(err < 0);
 
         /* the vport deletion may trigger dp headroom update */
@@ -2169,8 +2165,9 @@ static int ovs_vport_cmd_get(struct sk_buff *skb, struct genl_info *info)
         err = PTR_ERR(vport);
         if (IS_ERR(vport))
                 goto exit_unlock_free;
-        err = ovs_vport_cmd_fill_info(vport, reply, info->snd_portid,
-                                      info->snd_seq, 0, OVS_VPORT_CMD_NEW);
+        err = ovs_vport_cmd_fill_info(vport, reply, genl_info_net(info),
+                                      info->snd_portid, info->snd_seq, 0,
+                                      OVS_VPORT_CMD_NEW);
         BUG_ON(err < 0);
         rcu_read_unlock();
 
@@ -2202,6 +2199,7 @@ static int ovs_vport_cmd_dump(struct sk_buff *skb, struct netlink_callback *cb)
                 hlist_for_each_entry_rcu(vport, &dp->ports[i], dp_hash_node) {
                         if (j >= skip &&
                             ovs_vport_cmd_fill_info(vport, skb,
+                                                    sock_net(skb->sk),
                                                     NETLINK_CB(cb->skb).portid,
                                                     cb->nlh->nlmsg_seq,
                                                     NLM_F_MULTI,
@@ -2228,6 +2226,8 @@ static const struct nla_policy vport_policy[OVS_VPORT_ATTR_MAX + 1] = {
         [OVS_VPORT_ATTR_TYPE] = { .type = NLA_U32 },
         [OVS_VPORT_ATTR_UPCALL_PID] = { .type = NLA_U32 },
         [OVS_VPORT_ATTR_OPTIONS] = { .type = NLA_NESTED },
+        [OVS_VPORT_ATTR_IFINDEX] = { .type = NLA_U32 },
+        [OVS_VPORT_ATTR_NETNSID] = { .type = NLA_S32 },
 };
 
 static const struct genl_ops dp_vport_genl_ops[] = {
@@ -2273,6 +2273,7 @@ static struct genl_family * const dp_genl_families[] = {
         &dp_vport_genl_family,
         &dp_flow_genl_family,
         &dp_packet_genl_family,
+        &dp_meter_genl_family,
 };
 
 static void dp_unregister_genl(int n_families)
@@ -2453,3 +2454,4 @@ MODULE_ALIAS_GENL_FAMILY(OVS_DATAPATH_FAMILY);
 MODULE_ALIAS_GENL_FAMILY(OVS_VPORT_FAMILY);
 MODULE_ALIAS_GENL_FAMILY(OVS_FLOW_FAMILY);
 MODULE_ALIAS_GENL_FAMILY(OVS_PACKET_FAMILY);
+MODULE_ALIAS_GENL_FAMILY(OVS_METER_FAMILY);
diff --git a/net/openvswitch/datapath.h b/net/openvswitch/datapath.h
index 480600649d0b..523d65526766 100644
--- a/net/openvswitch/datapath.h
+++ b/net/openvswitch/datapath.h
@@ -30,6 +30,8 @@
 #include "conntrack.h"
 #include "flow.h"
 #include "flow_table.h"
+#include "meter.h"
+#include "vport-internal_dev.h"
 
 #define DP_MAX_PORTS           USHRT_MAX
 #define DP_VPORT_HASH_BUCKETS  1024
@@ -91,6 +93,9 @@ struct datapath {
         u32 user_features;
 
         u32 max_headroom;
+
+        /* Switch meters. */
+        struct hlist_head *meters;
 };
 
 /**
@@ -190,6 +195,36 @@ static inline struct vport *ovs_vport_ovsl(const struct datapath *dp, int port_n
         return ovs_lookup_vport(dp, port_no);
 }
 
+/* Must be called with rcu_read_lock. */
+static inline struct datapath *get_dp_rcu(struct net *net, int dp_ifindex)
+{
+        struct net_device *dev = dev_get_by_index_rcu(net, dp_ifindex);
+
+        if (dev) {
+                struct vport *vport = ovs_internal_dev_get_vport(dev);
+
+                if (vport)
+                        return vport->dp;
+        }
+
+        return NULL;
+}
+
+/* The caller must hold either ovs_mutex or rcu_read_lock to keep the
+ * returned dp pointer valid.
+ */
+static inline struct datapath *get_dp(struct net *net, int dp_ifindex)
+{
+        struct datapath *dp;
+
+        WARN_ON_ONCE(!rcu_read_lock_held() && !lockdep_ovsl_is_held());
+        rcu_read_lock();
+        dp = get_dp_rcu(net, dp_ifindex);
+        rcu_read_unlock();
+
+        return dp;
+}
+
 extern struct notifier_block ovs_dp_device_notifier;
 extern struct genl_family dp_vport_genl_family;
 
@@ -200,8 +235,8 @@ int ovs_dp_upcall(struct datapath *, struct sk_buff *,
                   uint32_t cutlen);
 
 const char *ovs_dp_name(const struct datapath *dp);
-struct sk_buff *ovs_vport_cmd_build_info(struct vport *, u32 pid, u32 seq,
-                                         u8 cmd);
+struct sk_buff *ovs_vport_cmd_build_info(struct vport *vport, struct net *net,
+                                         u32 portid, u32 seq, u8 cmd);
 
 int ovs_execute_actions(struct datapath *dp, struct sk_buff *skb,
                         const struct sw_flow_actions *, struct sw_flow_key *);
diff --git a/net/openvswitch/dp_notify.c b/net/openvswitch/dp_notify.c
index 653d073bae45..f3ee2f2825c0 100644
--- a/net/openvswitch/dp_notify.c
+++ b/net/openvswitch/dp_notify.c
@@ -30,8 +30,8 @@ static void dp_detach_port_notify(struct vport *vport)
         struct datapath *dp;
 
         dp = vport->dp;
-        notify = ovs_vport_cmd_build_info(vport, 0, 0,
-                                          OVS_VPORT_CMD_DEL);
+        notify = ovs_vport_cmd_build_info(vport, ovs_dp_get_net(dp),
+                                          0, 0, OVS_VPORT_CMD_DEL);
         ovs_dp_detach_port(vport);
         if (IS_ERR(notify)) {
                 genl_set_err(&dp_vport_genl_family, ovs_dp_get_net(dp), 0,
diff --git a/net/openvswitch/flow.c b/net/openvswitch/flow.c
index 8c94cef25a72..864ddb1e3642 100644
--- a/net/openvswitch/flow.c
+++ b/net/openvswitch/flow.c
@@ -46,6 +46,7 @@
 #include <net/ipv6.h>
 #include <net/mpls.h>
 #include <net/ndisc.h>
+#include <net/nsh.h>
 
 #include "conntrack.h"
 #include "datapath.h"
@@ -490,6 +491,52 @@ invalid:
         return 0;
 }
 
+static int parse_nsh(struct sk_buff *skb, struct sw_flow_key *key)
+{
+        struct nshhdr *nh;
+        unsigned int nh_ofs = skb_network_offset(skb);
+        u8 version, length;
+        int err;
+
+        err = check_header(skb, nh_ofs + NSH_BASE_HDR_LEN);
+        if (unlikely(err))
+                return err;
+
+        nh = nsh_hdr(skb);
+        version = nsh_get_ver(nh);
+        length = nsh_hdr_len(nh);
+
+        if (version != 0)
+                return -EINVAL;
+
+        err = check_header(skb, nh_ofs + length);
+        if (unlikely(err))
+                return err;
+
+        nh = nsh_hdr(skb);
+        key->nsh.base.flags = nsh_get_flags(nh);
+        key->nsh.base.ttl = nsh_get_ttl(nh);
+        key->nsh.base.mdtype = nh->mdtype;
+        key->nsh.base.np = nh->np;
+        key->nsh.base.path_hdr = nh->path_hdr;
+        switch (key->nsh.base.mdtype) {
+        case NSH_M_TYPE1:
+                if (length != NSH_M_TYPE1_LEN)
+                        return -EINVAL;
+                memcpy(key->nsh.context, nh->md1.context,
+                       sizeof(nh->md1));
+                break;
+        case NSH_M_TYPE2:
+                memset(key->nsh.context, 0,
+                       sizeof(nh->md1));
+                break;
+        default:
+                return -EINVAL;
+        }
+
+        return 0;
+}
+
 /**
  * key_extract - extracts a flow key from an Ethernet frame.
  * @skb: sk_buff that contains the frame, with skb->data pointing to the
@@ -735,6 +782,10 @@ static int key_extract(struct sk_buff *skb, struct sw_flow_key *key)
                                 memset(&key->tp, 0, sizeof(key->tp));
                         }
                 }
+        } else if (key->eth.type == htons(ETH_P_NSH)) {
+                error = parse_nsh(skb, key);
+                if (error)
+                        return error;
         }
         return 0;
 }
diff --git a/net/openvswitch/flow.h b/net/openvswitch/flow.h
index 1875bba4f865..c670dd24b8b7 100644
--- a/net/openvswitch/flow.h
+++ b/net/openvswitch/flow.h
@@ -35,6 +35,7 @@
 #include <net/inet_ecn.h>
 #include <net/ip_tunnels.h>
 #include <net/dst_metadata.h>
+#include <net/nsh.h>
 
 struct sk_buff;
 
@@ -66,6 +67,11 @@ struct vlan_head {
         (offsetof(struct sw_flow_key, recirc_id) +      \
         FIELD_SIZEOF(struct sw_flow_key, recirc_id))
 
+struct ovs_key_nsh {
+        struct ovs_nsh_key_base base;
+        __be32 context[NSH_MD1_CONTEXT_SIZE];
+};
+
 struct sw_flow_key {
         u8 tun_opts[IP_TUNNEL_OPTS_MAX];
         u8 tun_opts_len;
@@ -143,6 +149,7 @@ struct sw_flow_key {
                                 } nd;
                         };
                 } ipv6;
+                struct ovs_key_nsh nsh;         /* network service header */
         };
         struct {
                 /* Connection tracking fields not packed above. */
diff --git a/net/openvswitch/flow_netlink.c b/net/openvswitch/flow_netlink.c
index e8eb427ce6d1..dc424798ba6f 100644
--- a/net/openvswitch/flow_netlink.c
+++ b/net/openvswitch/flow_netlink.c
@@ -48,6 +48,8 @@
 #include <net/ndisc.h>
 #include <net/mpls.h>
 #include <net/vxlan.h>
+#include <net/tun_proto.h>
+#include <net/erspan.h>
 
 #include "flow_netlink.h"
 
@@ -75,16 +77,20 @@ static bool actions_may_change_flow(const struct nlattr *actions)
                         break;
 
                 case OVS_ACTION_ATTR_CT:
+                case OVS_ACTION_ATTR_CT_CLEAR:
                 case OVS_ACTION_ATTR_HASH:
                 case OVS_ACTION_ATTR_POP_ETH:
                 case OVS_ACTION_ATTR_POP_MPLS:
+                case OVS_ACTION_ATTR_POP_NSH:
                 case OVS_ACTION_ATTR_POP_VLAN:
                 case OVS_ACTION_ATTR_PUSH_ETH:
                 case OVS_ACTION_ATTR_PUSH_MPLS:
+                case OVS_ACTION_ATTR_PUSH_NSH:
                 case OVS_ACTION_ATTR_PUSH_VLAN:
                 case OVS_ACTION_ATTR_SAMPLE:
                 case OVS_ACTION_ATTR_SET:
                 case OVS_ACTION_ATTR_SET_MASKED:
+                case OVS_ACTION_ATTR_METER:
                 default:
                         return true;
                 }
@@ -173,7 +179,8 @@ static bool match_validate(const struct sw_flow_match *match,
                         | (1 << OVS_KEY_ATTR_ICMPV6)
                         | (1 << OVS_KEY_ATTR_ARP)
                         | (1 << OVS_KEY_ATTR_ND)
-                        | (1 << OVS_KEY_ATTR_MPLS));
+                        | (1 << OVS_KEY_ATTR_MPLS)
+                        | (1 << OVS_KEY_ATTR_NSH));
 
         /* Always allowed mask fields. */
         mask_allowed |= ((1 << OVS_KEY_ATTR_TUNNEL)
@@ -282,6 +289,14 @@ static bool match_validate(const struct sw_flow_match *match,
                 }
         }
 
+        if (match->key->eth.type == htons(ETH_P_NSH)) {
+                key_expected |= 1 << OVS_KEY_ATTR_NSH;
+                if (match->mask &&
+                    match->mask->key.eth.type == htons(0xffff)) {
+                        mask_allowed |= 1 << OVS_KEY_ATTR_NSH;
+                }
+        }
+
         if ((key_attrs & key_expected) != key_expected) {
                 /* Key attributes check failed. */
                 OVS_NLERR(log, "Missing key (keys=%llx, expected=%llx)",
@@ -319,7 +334,21 @@ size_t ovs_tun_key_attr_size(void)
                  * OVS_TUNNEL_KEY_ATTR_GENEVE_OPTS and covered by it.
                  */
                 + nla_total_size(2)    /* OVS_TUNNEL_KEY_ATTR_TP_SRC */
-                + nla_total_size(2);   /* OVS_TUNNEL_KEY_ATTR_TP_DST */
+                + nla_total_size(2)    /* OVS_TUNNEL_KEY_ATTR_TP_DST */
+                + nla_total_size(4);   /* OVS_TUNNEL_KEY_ATTR_ERSPAN_OPTS */
+}
+
+static size_t ovs_nsh_key_attr_size(void)
+{
+        /* Whenever adding new OVS_NSH_KEY_ FIELDS, we should consider
+         * updating this function.
+         */
+        return  nla_total_size(NSH_BASE_HDR_LEN) /* OVS_NSH_KEY_ATTR_BASE */
+                /* OVS_NSH_KEY_ATTR_MD1 and OVS_NSH_KEY_ATTR_MD2 are
+                 * mutually exclusive, so the bigger one can cover
+                 * the small one.
+                 */
+                + nla_total_size(NSH_CTX_HDRS_MAX_LEN);
 }
 
 size_t ovs_key_attr_size(void)
@@ -327,7 +356,7 @@ size_t ovs_key_attr_size(void)
         /* Whenever adding new OVS_KEY_ FIELDS, we should consider
          * updating this function.
          */
-        BUILD_BUG_ON(OVS_KEY_ATTR_TUNNEL_INFO != 28);
+        BUILD_BUG_ON(OVS_KEY_ATTR_TUNNEL_INFO != 29);
 
         return    nla_total_size(4)   /* OVS_KEY_ATTR_PRIORITY */
                 + nla_total_size(0)   /* OVS_KEY_ATTR_TUNNEL */
@@ -341,6 +370,8 @@ size_t ovs_key_attr_size(void)
                 + nla_total_size(4)   /* OVS_KEY_ATTR_CT_MARK */
                 + nla_total_size(16)  /* OVS_KEY_ATTR_CT_LABELS */
                 + nla_total_size(40)  /* OVS_KEY_ATTR_CT_ORIG_TUPLE_IPV6 */
+                + nla_total_size(0)   /* OVS_KEY_ATTR_NSH */
+                  + ovs_nsh_key_attr_size()
                 + nla_total_size(12)  /* OVS_KEY_ATTR_ETHERNET */
                 + nla_total_size(2)   /* OVS_KEY_ATTR_ETHERTYPE */
                 + nla_total_size(4)   /* OVS_KEY_ATTR_VLAN */
@@ -371,6 +402,14 @@ static const struct ovs_len_tbl ovs_tunnel_key_lens[OVS_TUNNEL_KEY_ATTR_MAX + 1]
                                                 .next = ovs_vxlan_ext_key_lens },
         [OVS_TUNNEL_KEY_ATTR_IPV6_SRC]      = { .len = sizeof(struct in6_addr) },
         [OVS_TUNNEL_KEY_ATTR_IPV6_DST]      = { .len = sizeof(struct in6_addr) },
+        [OVS_TUNNEL_KEY_ATTR_ERSPAN_OPTS]   = { .len = sizeof(u32) },
+};
+
+static const struct ovs_len_tbl
+ovs_nsh_key_attr_lens[OVS_NSH_KEY_ATTR_MAX + 1] = {
+        [OVS_NSH_KEY_ATTR_BASE] = { .len = sizeof(struct ovs_nsh_key_base) },
+        [OVS_NSH_KEY_ATTR_MD1]  = { .len = sizeof(struct ovs_nsh_key_md1) },
+        [OVS_NSH_KEY_ATTR_MD2]  = { .len = OVS_ATTR_VARIABLE },
 };
 
 /* The size of the argument for each %OVS_KEY_ATTR_* Netlink attribute.  */
@@ -405,6 +444,8 @@ static const struct ovs_len_tbl ovs_key_lens[OVS_KEY_ATTR_MAX + 1] = {
                 .len = sizeof(struct ovs_key_ct_tuple_ipv4) },
         [OVS_KEY_ATTR_CT_ORIG_TUPLE_IPV6] = {
                 .len = sizeof(struct ovs_key_ct_tuple_ipv6) },
+        [OVS_KEY_ATTR_NSH]       = { .len = OVS_ATTR_NESTED,
+                                     .next = ovs_nsh_key_attr_lens, },
 };
 
 static bool check_attr_len(unsigned int attr_len, unsigned int expected_len)
@@ -593,6 +634,33 @@ static int vxlan_tun_opt_from_nlattr(const struct nlattr *attr,
         return 0;
 }
 
+static int erspan_tun_opt_from_nlattr(const struct nlattr *attr,
+                                      struct sw_flow_match *match, bool is_mask,
+                                      bool log)
+{
+        unsigned long opt_key_offset;
+        struct erspan_metadata opts;
+
+        BUILD_BUG_ON(sizeof(opts) > sizeof(match->key->tun_opts));
+
+        memset(&opts, 0, sizeof(opts));
+        opts.index = nla_get_be32(attr);
+
+        /* Index has only 20-bit */
+        if (ntohl(opts.index) & ~INDEX_MASK) {
+                OVS_NLERR(log, "ERSPAN index number %x too large.",
+                          ntohl(opts.index));
+                return -EINVAL;
+        }
+
+        SW_FLOW_KEY_PUT(match, tun_opts_len, sizeof(opts), is_mask);
+        opt_key_offset = TUN_METADATA_OFFSET(sizeof(opts));
+        SW_FLOW_KEY_MEMCPY_OFFSET(match, opt_key_offset, &opts, sizeof(opts),
+                                  is_mask);
+
+        return 0;
+}
+
 static int ip_tun_from_nlattr(const struct nlattr *attr,
                               struct sw_flow_match *match, bool is_mask,
                               bool log)
@@ -700,6 +768,19 @@ static int ip_tun_from_nlattr(const struct nlattr *attr,
                         break;
                 case OVS_TUNNEL_KEY_ATTR_PAD:
                         break;
+                case OVS_TUNNEL_KEY_ATTR_ERSPAN_OPTS:
+                        if (opts_type) {
+                                OVS_NLERR(log, "Multiple metadata blocks provided");
+                                return -EINVAL;
+                        }
+
+                        err = erspan_tun_opt_from_nlattr(a, match, is_mask, log);
+                        if (err)
+                                return err;
+
+                        tun_flags |= TUNNEL_ERSPAN_OPT;
+                        opts_type = type;
+                        break;
                 default:
                         OVS_NLERR(log, "Unknown IP tunnel attribute %d",
                                   type);
@@ -824,6 +905,10 @@ static int __ip_tun_to_nlattr(struct sk_buff *skb,
                 else if (output->tun_flags & TUNNEL_VXLAN_OPT &&
                          vxlan_opt_to_nlattr(skb, tun_opts, swkey_tun_opts_len))
                         return -EMSGSIZE;
+                else if (output->tun_flags & TUNNEL_ERSPAN_OPT &&
+                         nla_put_be32(skb, OVS_TUNNEL_KEY_ATTR_ERSPAN_OPTS,
+                                      ((struct erspan_metadata *)tun_opts)->index))
+                        return -EMSGSIZE;
         }
 
         return 0;
@@ -1179,6 +1264,221 @@ static int metadata_from_nlattrs(struct net *net, struct sw_flow_match *match,
         return 0;
 }
 
+int nsh_hdr_from_nlattr(const struct nlattr *attr,
+                        struct nshhdr *nh, size_t size)
+{
+        struct nlattr *a;
+        int rem;
+        u8 flags = 0;
+        u8 ttl = 0;
+        int mdlen = 0;
+
+        /* validate_nsh has check this, so we needn't do duplicate check here
+         */
+        if (size < NSH_BASE_HDR_LEN)
+                return -ENOBUFS;
+
+        nla_for_each_nested(a, attr, rem) {
+                int type = nla_type(a);
+
+                switch (type) {
+                case OVS_NSH_KEY_ATTR_BASE: {
+                        const struct ovs_nsh_key_base *base = nla_data(a);
+
+                        flags = base->flags;
+                        ttl = base->ttl;
+                        nh->np = base->np;
+                        nh->mdtype = base->mdtype;
+                        nh->path_hdr = base->path_hdr;
+                        break;
+                }
+                case OVS_NSH_KEY_ATTR_MD1:
+                        mdlen = nla_len(a);
+                        if (mdlen > size - NSH_BASE_HDR_LEN)
+                                return -ENOBUFS;
+                        memcpy(&nh->md1, nla_data(a), mdlen);
+                        break;
+
+                case OVS_NSH_KEY_ATTR_MD2:
+                        mdlen = nla_len(a);
+                        if (mdlen > size - NSH_BASE_HDR_LEN)
+                                return -ENOBUFS;
+                        memcpy(&nh->md2, nla_data(a), mdlen);
+                        break;
+
+                default:
+                        return -EINVAL;
+                }
+        }
+
+        /* nsh header length  = NSH_BASE_HDR_LEN + mdlen */
+        nh->ver_flags_ttl_len = 0;
+        nsh_set_flags_ttl_len(nh, flags, ttl, NSH_BASE_HDR_LEN + mdlen);
+
+        return 0;
+}
+
+int nsh_key_from_nlattr(const struct nlattr *attr,
+                        struct ovs_key_nsh *nsh, struct ovs_key_nsh *nsh_mask)
+{
+        struct nlattr *a;
+        int rem;
+
+        /* validate_nsh has check this, so we needn't do duplicate check here
+         */
+        nla_for_each_nested(a, attr, rem) {
+                int type = nla_type(a);
+
+                switch (type) {
+                case OVS_NSH_KEY_ATTR_BASE: {
+                        const struct ovs_nsh_key_base *base = nla_data(a);
+                        const struct ovs_nsh_key_base *base_mask = base + 1;
+
+                        nsh->base = *base;
+                        nsh_mask->base = *base_mask;
+                        break;
+                }
+                case OVS_NSH_KEY_ATTR_MD1: {
+                        const struct ovs_nsh_key_md1 *md1 = nla_data(a);
+                        const struct ovs_nsh_key_md1 *md1_mask = md1 + 1;
+
+                        memcpy(nsh->context, md1->context, sizeof(*md1));
+                        memcpy(nsh_mask->context, md1_mask->context,
+                               sizeof(*md1_mask));
+                        break;
+                }
+                case OVS_NSH_KEY_ATTR_MD2:
+                        /* Not supported yet */
+                        return -ENOTSUPP;
+                default:
+                        return -EINVAL;
+                }
+        }
+
+        return 0;
+}
+
+static int nsh_key_put_from_nlattr(const struct nlattr *attr,
+                                   struct sw_flow_match *match, bool is_mask,
+                                   bool is_push_nsh, bool log)
+{
+        struct nlattr *a;
+        int rem;
+        bool has_base = false;
+        bool has_md1 = false;
+        bool has_md2 = false;
+        u8 mdtype = 0;
+        int mdlen = 0;
+
+        if (WARN_ON(is_push_nsh && is_mask))
+                return -EINVAL;
+
+        nla_for_each_nested(a, attr, rem) {
+                int type = nla_type(a);
+                int i;
+
+                if (type > OVS_NSH_KEY_ATTR_MAX) {
+                        OVS_NLERR(log, "nsh attr %d is out of range max %d",
+                                  type, OVS_NSH_KEY_ATTR_MAX);
+                        return -EINVAL;
+                }
+
+                if (!check_attr_len(nla_len(a),
+                                    ovs_nsh_key_attr_lens[type].len)) {
+                        OVS_NLERR(
+                            log,
+                            "nsh attr %d has unexpected len %d expected %d",
+                            type,
+                            nla_len(a),
+                            ovs_nsh_key_attr_lens[type].len
+                        );
+                        return -EINVAL;
+                }
+
+                switch (type) {
+                case OVS_NSH_KEY_ATTR_BASE: {
+                        const struct ovs_nsh_key_base *base = nla_data(a);
+
+                        has_base = true;
+                        mdtype = base->mdtype;
+                        SW_FLOW_KEY_PUT(match, nsh.base.flags,
+                                        base->flags, is_mask);
+                        SW_FLOW_KEY_PUT(match, nsh.base.ttl,
+                                        base->ttl, is_mask);
+                        SW_FLOW_KEY_PUT(match, nsh.base.mdtype,
+                                        base->mdtype, is_mask);
+                        SW_FLOW_KEY_PUT(match, nsh.base.np,
+                                        base->np, is_mask);
+                        SW_FLOW_KEY_PUT(match, nsh.base.path_hdr,
+                                        base->path_hdr, is_mask);
+                        break;
+                }
+                case OVS_NSH_KEY_ATTR_MD1: {
+                        const struct ovs_nsh_key_md1 *md1 = nla_data(a);
+
+                        has_md1 = true;
+                        for (i = 0; i < NSH_MD1_CONTEXT_SIZE; i++)
+                                SW_FLOW_KEY_PUT(match, nsh.context[i],
+                                                md1->context[i], is_mask);
+                        break;
+                }
+                case OVS_NSH_KEY_ATTR_MD2:
+                        if (!is_push_nsh) /* Not supported MD type 2 yet */
+                                return -ENOTSUPP;
+
+                        has_md2 = true;
+                        mdlen = nla_len(a);
+                        if (mdlen > NSH_CTX_HDRS_MAX_LEN || mdlen <= 0) {
+                                OVS_NLERR(
+                                    log,
+                                    "Invalid MD length %d for MD type %d",
+                                    mdlen,
+                                    mdtype
+                                );
+                                return -EINVAL;
+                        }
+                        break;
+                default:
+                        OVS_NLERR(log, "Unknown nsh attribute %d",
+                                  type);
+                        return -EINVAL;
+                }
+        }
+
+        if (rem > 0) {
+                OVS_NLERR(log, "nsh attribute has %d unknown bytes.", rem);
+                return -EINVAL;
+        }
+
+        if (has_md1 && has_md2) {
+                OVS_NLERR(
+                    1,
+                    "invalid nsh attribute: md1 and md2 are exclusive."
+                );
+                return -EINVAL;
+        }
+
+        if (!is_mask) {
+                if ((has_md1 && mdtype != NSH_M_TYPE1) ||
+                    (has_md2 && mdtype != NSH_M_TYPE2)) {
+                        OVS_NLERR(1, "nsh attribute has unmatched MD type %d.",
+                                  mdtype);
+                        return -EINVAL;
+                }
+
+                if (is_push_nsh &&
+                    (!has_base || (!has_md1 && !has_md2))) {
+                        OVS_NLERR(
+                            1,
+                            "push_nsh: missing base or metadata attributes"
+                        );
+                        return -EINVAL;
+                }
+        }
+
+        return 0;
+}
+
 static int ovs_key_from_nlattrs(struct net *net, struct sw_flow_match *match,
                                 u64 attrs, const struct nlattr **a,
                                 bool is_mask, bool log)
@@ -1306,6 +1606,13 @@ static int ovs_key_from_nlattrs(struct net *net, struct sw_flow_match *match,
                 attrs &= ~(1 << OVS_KEY_ATTR_ARP);
         }
 
+        if (attrs & (1 << OVS_KEY_ATTR_NSH)) {
+                if (nsh_key_put_from_nlattr(a[OVS_KEY_ATTR_NSH], match,
+                                            is_mask, false, log) < 0)
+                        return -EINVAL;
+                attrs &= ~(1 << OVS_KEY_ATTR_NSH);
+        }
+
         if (attrs & (1 << OVS_KEY_ATTR_MPLS)) {
                 const struct ovs_key_mpls *mpls_key;
 
@@ -1622,6 +1929,34 @@ static int ovs_nla_put_vlan(struct sk_buff *skb, const struct vlan_head *vh,
         return 0;
 }
 
+static int nsh_key_to_nlattr(const struct ovs_key_nsh *nsh, bool is_mask,
+                             struct sk_buff *skb)
+{
+        struct nlattr *start;
+
+        start = nla_nest_start(skb, OVS_KEY_ATTR_NSH);
+        if (!start)
+                return -EMSGSIZE;
+
+        if (nla_put(skb, OVS_NSH_KEY_ATTR_BASE, sizeof(nsh->base), &nsh->base))
+                goto nla_put_failure;
+
+        if (is_mask || nsh->base.mdtype == NSH_M_TYPE1) {
+                if (nla_put(skb, OVS_NSH_KEY_ATTR_MD1,
+                            sizeof(nsh->context), nsh->context))
+                        goto nla_put_failure;
+        }
+
+        /* Don't support MD type 2 yet */
+
+        nla_nest_end(skb, start);
+
+        return 0;
+
+nla_put_failure:
+        return -EMSGSIZE;
+}
+
 static int __ovs_nla_put_key(const struct sw_flow_key *swkey,
                              const struct sw_flow_key *output, bool is_mask,
                              struct sk_buff *skb)
@@ -1750,6 +2085,9 @@ static int __ovs_nla_put_key(const struct sw_flow_key *swkey,
                 ipv6_key->ipv6_tclass = output->ip.tos;
                 ipv6_key->ipv6_hlimit = output->ip.ttl;
                 ipv6_key->ipv6_frag = output->ip.frag;
+        } else if (swkey->eth.type == htons(ETH_P_NSH)) {
+                if (nsh_key_to_nlattr(&output->nsh, is_mask, skb))
+                        goto nla_put_failure;
         } else if (swkey->eth.type == htons(ETH_P_ARP) ||
                    swkey->eth.type == htons(ETH_P_RARP)) {
                 struct ovs_key_arp *arp_key;
@@ -2195,6 +2533,8 @@ static int validate_and_copy_set_tun(const struct nlattr *attr,
                         break;
                 case OVS_TUNNEL_KEY_ATTR_VXLAN_OPTS:
                         break;
+                case OVS_TUNNEL_KEY_ATTR_ERSPAN_OPTS:
+                        break;
                 }
         };
 
@@ -2242,6 +2582,19 @@ static int validate_and_copy_set_tun(const struct nlattr *attr,
         return err;
 }
 
+static bool validate_nsh(const struct nlattr *attr, bool is_mask,
+                         bool is_push_nsh, bool log)
+{
+        struct sw_flow_match match;
+        struct sw_flow_key key;
+        int ret = 0;
+
+        ovs_match_init(&match, &key, true, NULL);
+        ret = nsh_key_put_from_nlattr(attr, &match, is_mask,
+                                      is_push_nsh, log);
+        return !ret;
+}
+
 /* Return false if there are any non-masked bits set.
  * Mask follows data immediately, before any netlink padding.
  */
@@ -2384,6 +2737,13 @@ static int validate_set(const struct nlattr *a,
 
                 break;
 
+        case OVS_KEY_ATTR_NSH:
+                if (eth_type != htons(ETH_P_NSH))
+                        return -EINVAL;
+                if (!validate_nsh(nla_data(a), masked, false, log))
+                        return -EINVAL;
+                break;
+
         default:
                 return -EINVAL;
         }
@@ -2479,9 +2839,13 @@ static int __ovs_nla_copy_actions(struct net *net, const struct nlattr *attr,
                         [OVS_ACTION_ATTR_SAMPLE] = (u32)-1,
                         [OVS_ACTION_ATTR_HASH] = sizeof(struct ovs_action_hash),
                         [OVS_ACTION_ATTR_CT] = (u32)-1,
+                        [OVS_ACTION_ATTR_CT_CLEAR] = 0,
                         [OVS_ACTION_ATTR_TRUNC] = sizeof(struct ovs_action_trunc),
                         [OVS_ACTION_ATTR_PUSH_ETH] = sizeof(struct ovs_action_push_eth),
                         [OVS_ACTION_ATTR_POP_ETH] = 0,
+                        [OVS_ACTION_ATTR_PUSH_NSH] = (u32)-1,
+                        [OVS_ACTION_ATTR_POP_NSH] = 0,
+                        [OVS_ACTION_ATTR_METER] = sizeof(u32),
                 };
                 const struct ovs_action_push_vlan *vlan;
                 int type = nla_type(a);
@@ -2620,6 +2984,9 @@ static int __ovs_nla_copy_actions(struct net *net, const struct nlattr *attr,
                         skip_copy = true;
                         break;
 
+                case OVS_ACTION_ATTR_CT_CLEAR:
+                        break;
+
                 case OVS_ACTION_ATTR_PUSH_ETH:
                         /* Disallow pushing an Ethernet header if one
                          * is already present */
@@ -2636,6 +3003,38 @@ static int __ovs_nla_copy_actions(struct net *net, const struct nlattr *attr,
                         mac_proto = MAC_PROTO_ETHERNET;
                         break;
 
+                case OVS_ACTION_ATTR_PUSH_NSH:
+                        if (mac_proto != MAC_PROTO_ETHERNET) {
+                                u8 next_proto;
+
+                                next_proto = tun_p_from_eth_p(eth_type);
+                                if (!next_proto)
+                                        return -EINVAL;
+                        }
+                        mac_proto = MAC_PROTO_NONE;
+                        if (!validate_nsh(nla_data(a), false, true, true))
+                                return -EINVAL;
+                        break;
+
+                case OVS_ACTION_ATTR_POP_NSH: {
+                        __be16 inner_proto;
+
+                        if (eth_type != htons(ETH_P_NSH))
+                                return -EINVAL;
+                        inner_proto = tun_p_to_eth_p(key->nsh.base.np);
+                        if (!inner_proto)
+                                return -EINVAL;
+                        if (key->nsh.base.np == TUN_P_ETHERNET)
+                                mac_proto = MAC_PROTO_ETHERNET;
+                        else
+                                mac_proto = MAC_PROTO_NONE;
+                        break;
+                }
+
+                case OVS_ACTION_ATTR_METER:
+                        /* Non-existent meters are simply ignored.  */
+                        break;
+
                 default:
                         OVS_NLERR(log, "Unknown Action type %d", type);
                         return -EINVAL;
diff --git a/net/openvswitch/flow_netlink.h b/net/openvswitch/flow_netlink.h
index 929c665ac3aa..6657606b2b47 100644
--- a/net/openvswitch/flow_netlink.h
+++ b/net/openvswitch/flow_netlink.h
@@ -79,4 +79,9 @@ int ovs_nla_put_actions(const struct nlattr *attr,
 void ovs_nla_free_flow_actions(struct sw_flow_actions *);
 void ovs_nla_free_flow_actions_rcu(struct sw_flow_actions *);
 
+int nsh_key_from_nlattr(const struct nlattr *attr, struct ovs_key_nsh *nsh,
+                        struct ovs_key_nsh *nsh_mask);
+int nsh_hdr_from_nlattr(const struct nlattr *attr, struct nshhdr *nh,
+                        size_t size);
+
 #endif /* flow_netlink.h */
diff --git a/net/openvswitch/meter.c b/net/openvswitch/meter.c
new file mode 100644
index 000000000000..3fbfc78991ac
--- /dev/null
+++ b/net/openvswitch/meter.c
@@ -0,0 +1,597 @@
+/*
+ * Copyright (c) 2017 Nicira, Inc.
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of version 2 of the GNU General Public
+ * License as published by the Free Software Foundation.
+ */
+
+#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
+
+#include <linux/if.h>
+#include <linux/skbuff.h>
+#include <linux/ip.h>
+#include <linux/kernel.h>
+#include <linux/openvswitch.h>
+#include <linux/netlink.h>
+#include <linux/rculist.h>
+
+#include <net/netlink.h>
+#include <net/genetlink.h>
+
+#include "datapath.h"
+#include "meter.h"
+
+#define METER_HASH_BUCKETS 1024
+
+static const struct nla_policy meter_policy[OVS_METER_ATTR_MAX + 1] = {
+        [OVS_METER_ATTR_ID] = { .type = NLA_U32, },
+        [OVS_METER_ATTR_KBPS] = { .type = NLA_FLAG },
+        [OVS_METER_ATTR_STATS] = { .len = sizeof(struct ovs_flow_stats) },
+        [OVS_METER_ATTR_BANDS] = { .type = NLA_NESTED },
+        [OVS_METER_ATTR_USED] = { .type = NLA_U64 },
+        [OVS_METER_ATTR_CLEAR] = { .type = NLA_FLAG },
+        [OVS_METER_ATTR_MAX_METERS] = { .type = NLA_U32 },
+        [OVS_METER_ATTR_MAX_BANDS] = { .type = NLA_U32 },
+};
+
+static const struct nla_policy band_policy[OVS_BAND_ATTR_MAX + 1] = {
+        [OVS_BAND_ATTR_TYPE] = { .type = NLA_U32, },
+        [OVS_BAND_ATTR_RATE] = { .type = NLA_U32, },
+        [OVS_BAND_ATTR_BURST] = { .type = NLA_U32, },
+        [OVS_BAND_ATTR_STATS] = { .len = sizeof(struct ovs_flow_stats) },
+};
+
+static void ovs_meter_free(struct dp_meter *meter)
+{
+        if (!meter)
+                return;
+
+        kfree_rcu(meter, rcu);
+}
+
+static struct hlist_head *meter_hash_bucket(const struct datapath *dp,
+                                            u32 meter_id)
+{
+        return &dp->meters[meter_id & (METER_HASH_BUCKETS - 1)];
+}
+
+/* Call with ovs_mutex or RCU read lock. */
+static struct dp_meter *lookup_meter(const struct datapath *dp,
+                                     u32 meter_id)
+{
+        struct dp_meter *meter;
+        struct hlist_head *head;
+
+        head = meter_hash_bucket(dp, meter_id);
+        hlist_for_each_entry_rcu(meter, head, dp_hash_node) {
+                if (meter->id == meter_id)
+                        return meter;
+        }
+        return NULL;
+}
+
+static void attach_meter(struct datapath *dp, struct dp_meter *meter)
+{
+        struct hlist_head *head = meter_hash_bucket(dp, meter->id);
+
+        hlist_add_head_rcu(&meter->dp_hash_node, head);
+}
+
+static void detach_meter(struct dp_meter *meter)
+{
+        ASSERT_OVSL();
+        if (meter)
+                hlist_del_rcu(&meter->dp_hash_node);
+}
+
+static struct sk_buff *
+ovs_meter_cmd_reply_start(struct genl_info *info, u8 cmd,
+                          struct ovs_header **ovs_reply_header)
+{
+        struct sk_buff *skb;
+        struct ovs_header *ovs_header = info->userhdr;
+
+        skb = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC);
+        if (!skb)
+                return ERR_PTR(-ENOMEM);
+
+        *ovs_reply_header = genlmsg_put(skb, info->snd_portid,
+                                        info->snd_seq,
+                                        &dp_meter_genl_family, 0, cmd);
+        if (!*ovs_reply_header) {
+                nlmsg_free(skb);
+                return ERR_PTR(-EMSGSIZE);
+        }
+        (*ovs_reply_header)->dp_ifindex = ovs_header->dp_ifindex;
+
+        return skb;
+}
+
+static int ovs_meter_cmd_reply_stats(struct sk_buff *reply, u32 meter_id,
+                                     struct dp_meter *meter)
+{
+        struct nlattr *nla;
+        struct dp_meter_band *band;
+        u16 i;
+
+        if (nla_put_u32(reply, OVS_METER_ATTR_ID, meter_id))
+                goto error;
+
+        if (!meter)
+                return 0;
+
+        if (nla_put(reply, OVS_METER_ATTR_STATS,
+                    sizeof(struct ovs_flow_stats), &meter->stats) ||
+            nla_put_u64_64bit(reply, OVS_METER_ATTR_USED, meter->used,
+                              OVS_METER_ATTR_PAD))
+                goto error;
+
+        nla = nla_nest_start(reply, OVS_METER_ATTR_BANDS);
+        if (!nla)
+                goto error;
+
+        band = meter->bands;
+
+        for (i = 0; i < meter->n_bands; ++i, ++band) {
+                struct nlattr *band_nla;
+
+                band_nla = nla_nest_start(reply, OVS_BAND_ATTR_UNSPEC);
+                if (!band_nla || nla_put(reply, OVS_BAND_ATTR_STATS,
+                                         sizeof(struct ovs_flow_stats),
+                                         &band->stats))
+                        goto error;
+                nla_nest_end(reply, band_nla);
+        }
+        nla_nest_end(reply, nla);
+
+        return 0;
+error:
+        return -EMSGSIZE;
+}
+
+static int ovs_meter_cmd_features(struct sk_buff *skb, struct genl_info *info)
+{
+        struct sk_buff *reply;
+        struct ovs_header *ovs_reply_header;
+        struct nlattr *nla, *band_nla;
+        int err;
+
+        reply = ovs_meter_cmd_reply_start(info, OVS_METER_CMD_FEATURES,
+                                          &ovs_reply_header);
+        if (IS_ERR(reply))
+                return PTR_ERR(reply);
+
+        if (nla_put_u32(reply, OVS_METER_ATTR_MAX_METERS, U32_MAX) ||
+            nla_put_u32(reply, OVS_METER_ATTR_MAX_BANDS, DP_MAX_BANDS))
+                goto nla_put_failure;
+
+        nla = nla_nest_start(reply, OVS_METER_ATTR_BANDS);
+        if (!nla)
+                goto nla_put_failure;
+
+        band_nla = nla_nest_start(reply, OVS_BAND_ATTR_UNSPEC);
+        if (!band_nla)
+                goto nla_put_failure;
+        /* Currently only DROP band type is supported. */
+        if (nla_put_u32(reply, OVS_BAND_ATTR_TYPE, OVS_METER_BAND_TYPE_DROP))
+                goto nla_put_failure;
+        nla_nest_end(reply, band_nla);
+        nla_nest_end(reply, nla);
+
+        genlmsg_end(reply, ovs_reply_header);
+        return genlmsg_reply(reply, info);
+
+nla_put_failure:
+        nlmsg_free(reply);
+        err = -EMSGSIZE;
+        return err;
+}
+
+static struct dp_meter *dp_meter_create(struct nlattr **a)
+{
+        struct nlattr *nla;
+        int rem;
+        u16 n_bands = 0;
+        struct dp_meter *meter;
+        struct dp_meter_band *band;
+        int err;
+
+        /* Validate attributes, count the bands. */
+        if (!a[OVS_METER_ATTR_BANDS])
+                return ERR_PTR(-EINVAL);
+
+        nla_for_each_nested(nla, a[OVS_METER_ATTR_BANDS], rem)
+                if (++n_bands > DP_MAX_BANDS)
+                        return ERR_PTR(-EINVAL);
+
+        /* Allocate and set up the meter before locking anything. */
+        meter = kzalloc(n_bands * sizeof(struct dp_meter_band) +
+                        sizeof(*meter), GFP_KERNEL);
+        if (!meter)
+                return ERR_PTR(-ENOMEM);
+
+        meter->used = div_u64(ktime_get_ns(), 1000 * 1000);
+        meter->kbps = a[OVS_METER_ATTR_KBPS] ? 1 : 0;
+        meter->keep_stats = !a[OVS_METER_ATTR_CLEAR];
+        spin_lock_init(&meter->lock);
+        if (meter->keep_stats && a[OVS_METER_ATTR_STATS]) {
+                meter->stats = *(struct ovs_flow_stats *)
+                        nla_data(a[OVS_METER_ATTR_STATS]);
+        }
+        meter->n_bands = n_bands;
+
+        /* Set up meter bands. */
+        band = meter->bands;
+        nla_for_each_nested(nla, a[OVS_METER_ATTR_BANDS], rem) {
+                struct nlattr *attr[OVS_BAND_ATTR_MAX + 1];
+                u32 band_max_delta_t;
+
+                err = nla_parse((struct nlattr **)&attr, OVS_BAND_ATTR_MAX,
+                                nla_data(nla), nla_len(nla), band_policy,
+                                NULL);
+                if (err)
+                        goto exit_free_meter;
+
+                if (!attr[OVS_BAND_ATTR_TYPE] ||
+                    !attr[OVS_BAND_ATTR_RATE] ||
+                    !attr[OVS_BAND_ATTR_BURST]) {
+                        err = -EINVAL;
+                        goto exit_free_meter;
+                }
+
+                band->type = nla_get_u32(attr[OVS_BAND_ATTR_TYPE]);
+                band->rate = nla_get_u32(attr[OVS_BAND_ATTR_RATE]);
+                band->burst_size = nla_get_u32(attr[OVS_BAND_ATTR_BURST]);
+                /* Figure out max delta_t that is enough to fill any bucket.
+                 * Keep max_delta_t size to the bucket units:
+                 * pkts => 1/1000 packets, kilobits => bits.
+                 */
+                band_max_delta_t = (band->burst_size + band->rate) * 1000;
+                /* Start with a full bucket. */
+                band->bucket = band_max_delta_t;
+                if (band_max_delta_t > meter->max_delta_t)
+                        meter->max_delta_t = band_max_delta_t;
+                band++;
+        }
+
+        return meter;
+
+exit_free_meter:
+        kfree(meter);
+        return ERR_PTR(err);
+}
+
+static int ovs_meter_cmd_set(struct sk_buff *skb, struct genl_info *info)
+{
+        struct nlattr **a = info->attrs;
+        struct dp_meter *meter, *old_meter;
+        struct sk_buff *reply;
+        struct ovs_header *ovs_reply_header;
+        struct ovs_header *ovs_header = info->userhdr;
+        struct datapath *dp;
+        int err;
+        u32 meter_id;
+        bool failed;
+
+        meter = dp_meter_create(a);
+        if (IS_ERR_OR_NULL(meter))
+                return PTR_ERR(meter);
+
+        reply = ovs_meter_cmd_reply_start(info, OVS_METER_CMD_SET,
+                                          &ovs_reply_header);
+        if (IS_ERR(reply)) {
+                err = PTR_ERR(reply);
+                goto exit_free_meter;
+        }
+
+        ovs_lock();
+        dp = get_dp(sock_net(skb->sk), ovs_header->dp_ifindex);
+        if (!dp) {
+                err = -ENODEV;
+                goto exit_unlock;
+        }
+
+        if (!a[OVS_METER_ATTR_ID]) {
+                err = -ENODEV;
+                goto exit_unlock;
+        }
+
+        meter_id = nla_get_u32(a[OVS_METER_ATTR_ID]);
+
+        /* Cannot fail after this. */
+        old_meter = lookup_meter(dp, meter_id);
+        detach_meter(old_meter);
+        attach_meter(dp, meter);
+        ovs_unlock();
+
+        /* Build response with the meter_id and stats from
+         * the old meter, if any.
+         */
+        failed = nla_put_u32(reply, OVS_METER_ATTR_ID, meter_id);
+        WARN_ON(failed);
+        if (old_meter) {
+                spin_lock_bh(&old_meter->lock);
+                if (old_meter->keep_stats) {
+                        err = ovs_meter_cmd_reply_stats(reply, meter_id,
+                                                        old_meter);
+                        WARN_ON(err);
+                }
+                spin_unlock_bh(&old_meter->lock);
+                ovs_meter_free(old_meter);
+        }
+
+        genlmsg_end(reply, ovs_reply_header);
+        return genlmsg_reply(reply, info);
+
+exit_unlock:
+        ovs_unlock();
+        nlmsg_free(reply);
+exit_free_meter:
+        kfree(meter);
+        return err;
+}
+
+static int ovs_meter_cmd_get(struct sk_buff *skb, struct genl_info *info)
+{
+        struct nlattr **a = info->attrs;
+        u32 meter_id;
+        struct ovs_header *ovs_header = info->userhdr;
+        struct ovs_header *ovs_reply_header;
+        struct datapath *dp;
+        int err;
+        struct sk_buff *reply;
+        struct dp_meter *meter;
+
+        if (!a[OVS_METER_ATTR_ID])
+                return -EINVAL;
+
+        meter_id = nla_get_u32(a[OVS_METER_ATTR_ID]);
+
+        reply = ovs_meter_cmd_reply_start(info, OVS_METER_CMD_GET,
+                                          &ovs_reply_header);
+        if (IS_ERR(reply))
+                return PTR_ERR(reply);
+
+        ovs_lock();
+
+        dp = get_dp(sock_net(skb->sk), ovs_header->dp_ifindex);
+        if (!dp) {
+                err = -ENODEV;
+                goto exit_unlock;
+        }
+
+        /* Locate meter, copy stats. */
+        meter = lookup_meter(dp, meter_id);
+        if (!meter) {
+                err = -ENOENT;
+                goto exit_unlock;
+        }
+
+        spin_lock_bh(&meter->lock);
+        err = ovs_meter_cmd_reply_stats(reply, meter_id, meter);
+        spin_unlock_bh(&meter->lock);
+        if (err)
+                goto exit_unlock;
+
+        ovs_unlock();
+
+        genlmsg_end(reply, ovs_reply_header);
+        return genlmsg_reply(reply, info);
+
+exit_unlock:
+        ovs_unlock();
+        nlmsg_free(reply);
+        return err;
+}
+
+static int ovs_meter_cmd_del(struct sk_buff *skb, struct genl_info *info)
+{
+        struct nlattr **a = info->attrs;
+        u32 meter_id;
+        struct ovs_header *ovs_header = info->userhdr;
+        struct ovs_header *ovs_reply_header;
+        struct datapath *dp;
+        int err;
+        struct sk_buff *reply;
+        struct dp_meter *old_meter;
+
+        if (!a[OVS_METER_ATTR_ID])
+                return -EINVAL;
+        meter_id = nla_get_u32(a[OVS_METER_ATTR_ID]);
+
+        reply = ovs_meter_cmd_reply_start(info, OVS_METER_CMD_DEL,
+                                          &ovs_reply_header);
+        if (IS_ERR(reply))
+                return PTR_ERR(reply);
+
+        ovs_lock();
+
+        dp = get_dp(sock_net(skb->sk), ovs_header->dp_ifindex);
+        if (!dp) {
+                err = -ENODEV;
+                goto exit_unlock;
+        }
+
+        old_meter = lookup_meter(dp, meter_id);
+        if (old_meter) {
+                spin_lock_bh(&old_meter->lock);
+                err = ovs_meter_cmd_reply_stats(reply, meter_id, old_meter);
+                WARN_ON(err);
+                spin_unlock_bh(&old_meter->lock);
+                detach_meter(old_meter);
+        }
+        ovs_unlock();
+        ovs_meter_free(old_meter);
+        genlmsg_end(reply, ovs_reply_header);
+        return genlmsg_reply(reply, info);
+
+exit_unlock:
+        ovs_unlock();
+        nlmsg_free(reply);
+        return err;
+}
+
+/* Meter action execution.
+ *
+ * Return true 'meter_id' drop band is triggered. The 'skb' should be
+ * dropped by the caller'.
+ */
+bool ovs_meter_execute(struct datapath *dp, struct sk_buff *skb,
+                       struct sw_flow_key *key, u32 meter_id)
+{
+        struct dp_meter *meter;
+        struct dp_meter_band *band;
+        long long int now_ms = div_u64(ktime_get_ns(), 1000 * 1000);
+        long long int long_delta_ms;
+        u32 delta_ms;
+        u32 cost;
+        int i, band_exceeded_max = -1;
+        u32 band_exceeded_rate = 0;
+
+        meter = lookup_meter(dp, meter_id);
+        /* Do not drop the packet when there is no meter. */
+        if (!meter)
+                return false;
+
+        /* Lock the meter while using it. */
+        spin_lock(&meter->lock);
+
+        long_delta_ms = (now_ms - meter->used); /* ms */
+
+        /* Make sure delta_ms will not be too large, so that bucket will not
+         * wrap around below.
+         */
+        delta_ms = (long_delta_ms > (long long int)meter->max_delta_t)
+                   ? meter->max_delta_t : (u32)long_delta_ms;
+
+        /* Update meter statistics.
+         */
+        meter->used = now_ms;
+        meter->stats.n_packets += 1;
+        meter->stats.n_bytes += skb->len;
+
+        /* Bucket rate is either in kilobits per second, or in packets per
+         * second.  We maintain the bucket in the units of either bits or
+         * 1/1000th of a packet, correspondingly.
+         * Then, when rate is multiplied with milliseconds, we get the
+         * bucket units:
+         * msec * kbps = bits, and
+         * msec * packets/sec = 1/1000 packets.
+         *
+         * 'cost' is the number of bucket units in this packet.
+         */
+        cost = (meter->kbps) ? skb->len * 8 : 1000;
+
+        /* Update all bands and find the one hit with the highest rate. */
+        for (i = 0; i < meter->n_bands; ++i) {
+                long long int max_bucket_size;
+
+                band = &meter->bands[i];
+                max_bucket_size = (band->burst_size + band->rate) * 1000;
+
+                band->bucket += delta_ms * band->rate;
+                if (band->bucket > max_bucket_size)
+                        band->bucket = max_bucket_size;
+
+                if (band->bucket >= cost) {
+                        band->bucket -= cost;
+                } else if (band->rate > band_exceeded_rate) {
+                        band_exceeded_rate = band->rate;
+                        band_exceeded_max = i;
+                }
+        }
+
+        if (band_exceeded_max >= 0) {
+                /* Update band statistics. */
+                band = &meter->bands[band_exceeded_max];
+                band->stats.n_packets += 1;
+                band->stats.n_bytes += skb->len;
+
+                /* Drop band triggered, let the caller drop the 'skb'.  */
+                if (band->type == OVS_METER_BAND_TYPE_DROP) {
+                        spin_unlock(&meter->lock);
+                        return true;
+                }
+        }
+
+        spin_unlock(&meter->lock);
+        return false;
+}
+
+static struct genl_ops dp_meter_genl_ops[] = {
+        { .cmd = OVS_METER_CMD_FEATURES,
+                .flags = 0,               /* OK for unprivileged users. */
+                .policy = meter_policy,
+                .doit = ovs_meter_cmd_features
+        },
+        { .cmd = OVS_METER_CMD_SET,
+                .flags = GENL_ADMIN_PERM, /* Requires CAP_NET_ADMIN
+                                           *  privilege.
+                                           */
+                .policy = meter_policy,
+                .doit = ovs_meter_cmd_set,
+        },
+        { .cmd = OVS_METER_CMD_GET,
+                .flags = 0,               /* OK for unprivileged users. */
+                .policy = meter_policy,
+                .doit = ovs_meter_cmd_get,
+        },
+        { .cmd = OVS_METER_CMD_DEL,
+                .flags = GENL_ADMIN_PERM, /* Requires CAP_NET_ADMIN
+                                           *  privilege.
+                                           */
+                .policy = meter_policy,
+                .doit = ovs_meter_cmd_del
+        },
+};
+
+static const struct genl_multicast_group ovs_meter_multicast_group = {
+        .name = OVS_METER_MCGROUP,
+};
+
+struct genl_family dp_meter_genl_family __ro_after_init = {
+        .hdrsize = sizeof(struct ovs_header),
+        .name = OVS_METER_FAMILY,
+        .version = OVS_METER_VERSION,
+        .maxattr = OVS_METER_ATTR_MAX,
+        .netnsok = true,
+        .parallel_ops = true,
+        .ops = dp_meter_genl_ops,
+        .n_ops = ARRAY_SIZE(dp_meter_genl_ops),
+        .mcgrps = &ovs_meter_multicast_group,
+        .n_mcgrps = 1,
+        .module = THIS_MODULE,
+};
+
+int ovs_meters_init(struct datapath *dp)
+{
+        int i;
+
+        dp->meters = kmalloc_array(METER_HASH_BUCKETS,
+                                   sizeof(struct hlist_head), GFP_KERNEL);
+
+        if (!dp->meters)
+                return -ENOMEM;
+
+        for (i = 0; i < METER_HASH_BUCKETS; i++)
+                INIT_HLIST_HEAD(&dp->meters[i]);
+
+        return 0;
+}
+
+void ovs_meters_exit(struct datapath *dp)
+{
+        int i;
+
+        for (i = 0; i < METER_HASH_BUCKETS; i++) {
+                struct hlist_head *head = &dp->meters[i];
+                struct dp_meter *meter;
+                struct hlist_node *n;
+
+                hlist_for_each_entry_safe(meter, n, head, dp_hash_node)
+                        kfree(meter);
+        }
+
+        kfree(dp->meters);
+}
diff --git a/net/openvswitch/meter.h b/net/openvswitch/meter.h
new file mode 100644
index 000000000000..964ace2650f8
--- /dev/null
+++ b/net/openvswitch/meter.h
@@ -0,0 +1,54 @@
+/*
+ * Copyright (c) 2017 Nicira, Inc.
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of version 2 of the GNU General Public
+ * License as published by the Free Software Foundation.
+ */
+
+#ifndef METER_H
+#define METER_H 1
+
+#include <linux/init.h>
+#include <linux/module.h>
+#include <linux/kernel.h>
+#include <linux/netlink.h>
+#include <linux/openvswitch.h>
+#include <linux/genetlink.h>
+#include <linux/skbuff.h>
+
+#include "flow.h"
+struct datapath;
+
+#define DP_MAX_BANDS            1
+
+struct dp_meter_band {
+        u32 type;
+        u32 rate;
+        u32 burst_size;
+        u32 bucket; /* 1/1000 packets, or in bits */
+        struct ovs_flow_stats stats;
+};
+
+struct dp_meter {
+        spinlock_t lock;    /* Per meter lock */
+        struct rcu_head rcu;
+        struct hlist_node dp_hash_node; /*Element in datapath->meters
+                                         * hash table.
+                                         */
+        u32 id;
+        u16 kbps:1, keep_stats:1;
+        u16 n_bands;
+        u32 max_delta_t;
+        u64 used;
+        struct ovs_flow_stats stats;
+        struct dp_meter_band bands[];
+};
+
+extern struct genl_family dp_meter_genl_family;
+int ovs_meters_init(struct datapath *dp);
+void ovs_meters_exit(struct datapath *dp);
+bool ovs_meter_execute(struct datapath *dp, struct sk_buff *skb,
+                       struct sw_flow_key *key, u32 meter_id);
+
+#endif /* meter.h */
diff --git a/net/openvswitch/vport-netdev.c b/net/openvswitch/vport-netdev.c
index 0389398fa4ab..2e5e7a41d8ef 100644
--- a/net/openvswitch/vport-netdev.c
+++ b/net/openvswitch/vport-netdev.c
@@ -108,7 +108,8 @@ struct vport *ovs_netdev_link(struct vport *vport, const char *name)
 
         rtnl_lock();
         err = netdev_master_upper_dev_link(vport->dev,
-                                           get_dpdev(vport->dp), NULL, NULL);
+                                           get_dpdev(vport->dp),
+                                           NULL, NULL, NULL);
         if (err)
                 goto error_unlock;
 
diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
index 2986941164b1..737092ca9b4e 100644
--- a/net/packet/af_packet.c
+++ b/net/packet/af_packet.c
@@ -201,11 +201,8 @@ static void prb_retire_current_block(struct tpacket_kbdq_core *,
 static int prb_queue_frozen(struct tpacket_kbdq_core *);
 static void prb_open_block(struct tpacket_kbdq_core *,
                 struct tpacket_block_desc *);
-static void prb_retire_rx_blk_timer_expired(unsigned long);
+static void prb_retire_rx_blk_timer_expired(struct timer_list *);
 static void _prb_refresh_rx_retire_blk_timer(struct tpacket_kbdq_core *);
-static void prb_init_blk_timer(struct packet_sock *,
-                struct tpacket_kbdq_core *,
-                void (*func) (unsigned long));
 static void prb_fill_rxhash(struct tpacket_kbdq_core *, struct tpacket3_hdr *);
 static void prb_clear_rxhash(struct tpacket_kbdq_core *,
                 struct tpacket3_hdr *);
@@ -540,22 +537,14 @@ static void prb_shutdown_retire_blk_timer(struct packet_sock *po,
         prb_del_retire_blk_timer(pkc);
 }
 
-static void prb_init_blk_timer(struct packet_sock *po,
-                struct tpacket_kbdq_core *pkc,
-                void (*func) (unsigned long))
-{
-        init_timer(&pkc->retire_blk_timer);
-        pkc->retire_blk_timer.data = (long)po;
-        pkc->retire_blk_timer.function = func;
-        pkc->retire_blk_timer.expires = jiffies;
-}
-
 static void prb_setup_retire_blk_timer(struct packet_sock *po)
 {
         struct tpacket_kbdq_core *pkc;
 
         pkc = GET_PBDQC_FROM_RB(&po->rx_ring);
-        prb_init_blk_timer(po, pkc, prb_retire_rx_blk_timer_expired);
+        timer_setup(&pkc->retire_blk_timer, prb_retire_rx_blk_timer_expired,
+                    0);
+        pkc->retire_blk_timer.expires = jiffies;
 }
 
 static int prb_calc_retire_blk_tmo(struct packet_sock *po,
@@ -673,9 +662,10 @@ static void _prb_refresh_rx_retire_blk_timer(struct tpacket_kbdq_core *pkc)
  * prb_calc_retire_blk_tmo() calculates the tmo.
  *
  */
-static void prb_retire_rx_blk_timer_expired(unsigned long data)
+static void prb_retire_rx_blk_timer_expired(struct timer_list *t)
 {
-        struct packet_sock *po = (struct packet_sock *)data;
+        struct packet_sock *po =
+                from_timer(po, t, rx_ring.prb_bdqc.retire_blk_timer);
         struct tpacket_kbdq_core *pkc = GET_PBDQC_FROM_RB(&po->rx_ring);
         unsigned int frozen;
         struct tpacket_block_desc *pbd;
@@ -4570,6 +4560,7 @@ static int __net_init packet_net_init(struct net *net)
 static void __net_exit packet_net_exit(struct net *net)
 {
         remove_proc_entry("packet", net->proc_net);
+        WARN_ON_ONCE(!hlist_empty(&net->packet.sklist));
 }
 
 static struct pernet_operations packet_net_ops = {
diff --git a/net/phonet/af_phonet.c b/net/phonet/af_phonet.c
index f925753668a7..3b0ef691f5b1 100644
--- a/net/phonet/af_phonet.c
+++ b/net/phonet/af_phonet.c
@@ -35,11 +35,11 @@
 #include <net/phonet/pn_dev.h>
 
 /* Transport protocol registration */
-static struct phonet_protocol *proto_tab[PHONET_NPROTO] __read_mostly;
+static const struct phonet_protocol *proto_tab[PHONET_NPROTO] __read_mostly;
 
-static struct phonet_protocol *phonet_proto_get(unsigned int protocol)
+static const struct phonet_protocol *phonet_proto_get(unsigned int protocol)
 {
-        struct phonet_protocol *pp;
+        const struct phonet_protocol *pp;
 
         if (protocol >= PHONET_NPROTO)
                 return NULL;
@@ -53,7 +53,7 @@ static struct phonet_protocol *phonet_proto_get(unsigned int protocol)
         return pp;
 }
 
-static inline void phonet_proto_put(struct phonet_protocol *pp)
+static inline void phonet_proto_put(const struct phonet_protocol *pp)
 {
         module_put(pp->prot->owner);
 }
@@ -65,7 +65,7 @@ static int pn_socket_create(struct net *net, struct socket *sock, int protocol,
 {
         struct sock *sk;
         struct pn_sock *pn;
-        struct phonet_protocol *pnp;
+        const struct phonet_protocol *pnp;
         int err;
 
         if (!capable(CAP_SYS_ADMIN))
@@ -149,7 +149,7 @@ static int pn_header_parse(const struct sk_buff *skb, unsigned char *haddr)
         return 1;
 }
 
-struct header_ops phonet_header_ops = {
+const struct header_ops phonet_header_ops = {
         .create = pn_header_create,
         .parse = pn_header_parse,
 };
@@ -470,7 +470,7 @@ static struct packet_type phonet_packet_type __read_mostly = {
 static DEFINE_MUTEX(proto_tab_lock);
 
 int __init_or_module phonet_proto_register(unsigned int protocol,
-                                                struct phonet_protocol *pp)
+                                const struct phonet_protocol *pp)
 {
         int err = 0;
 
@@ -492,7 +492,8 @@ int __init_or_module phonet_proto_register(unsigned int protocol,
 }
 EXPORT_SYMBOL(phonet_proto_register);
 
-void phonet_proto_unregister(unsigned int protocol, struct phonet_protocol *pp)
+void phonet_proto_unregister(unsigned int protocol,
+                        const struct phonet_protocol *pp)
 {
         mutex_lock(&proto_tab_lock);
         BUG_ON(proto_tab[protocol] != pp);
diff --git a/net/phonet/datagram.c b/net/phonet/datagram.c
index 5e710435ffa9..b44fb9018fb8 100644
--- a/net/phonet/datagram.c
+++ b/net/phonet/datagram.c
@@ -195,7 +195,7 @@ static struct proto pn_proto = {
         .name           = "PHONET",
 };
 
-static struct phonet_protocol pn_dgram_proto = {
+static const struct phonet_protocol pn_dgram_proto = {
         .ops            = &phonet_dgram_ops,
         .prot           = &pn_proto,
         .sock_type      = SOCK_DGRAM,
diff --git a/net/phonet/pep.c b/net/phonet/pep.c
index e81537991ddf..9fc76b19cd3c 100644
--- a/net/phonet/pep.c
+++ b/net/phonet/pep.c
@@ -1351,7 +1351,7 @@ static struct proto pep_proto = {
         .name           = "PNPIPE",
 };
 
-static struct phonet_protocol pep_pn_proto = {
+static const struct phonet_protocol pep_pn_proto = {
         .ops            = &phonet_stream_ops,
         .prot           = &pep_proto,
         .sock_type      = SOCK_SEQPACKET,
diff --git a/net/phonet/pn_dev.c b/net/phonet/pn_dev.c
index 2cb4c5dfad6f..77787512fc32 100644
--- a/net/phonet/pn_dev.c
+++ b/net/phonet/pn_dev.c
@@ -331,7 +331,10 @@ static int __net_init phonet_init_net(struct net *net)
 
 static void __net_exit phonet_exit_net(struct net *net)
 {
+        struct phonet_net *pnn = phonet_pernet(net);
+
         remove_proc_entry("phonet", net->proc_net);
+        WARN_ON_ONCE(!list_empty(&pnn->pndevs.list));
 }
 
 static struct pernet_operations phonet_net_ops = {
diff --git a/net/qrtr/qrtr.c b/net/qrtr/qrtr.c
index 78418f38464a..77ab05e23001 100644
--- a/net/qrtr/qrtr.c
+++ b/net/qrtr/qrtr.c
@@ -20,26 +20,15 @@
 
 #include "qrtr.h"
 
-#define QRTR_PROTO_VER 1
+#define QRTR_PROTO_VER_1 1
+#define QRTR_PROTO_VER_2 3
 
 /* auto-bind range */
 #define QRTR_MIN_EPH_SOCKET 0x4000
 #define QRTR_MAX_EPH_SOCKET 0x7fff
 
-enum qrtr_pkt_type {
-        QRTR_TYPE_DATA          = 1,
-        QRTR_TYPE_HELLO         = 2,
-        QRTR_TYPE_BYE           = 3,
-        QRTR_TYPE_NEW_SERVER    = 4,
-        QRTR_TYPE_DEL_SERVER    = 5,
-        QRTR_TYPE_DEL_CLIENT    = 6,
-        QRTR_TYPE_RESUME_TX     = 7,
-        QRTR_TYPE_EXIT          = 8,
-        QRTR_TYPE_PING          = 9,
-};
-
 /**
- * struct qrtr_hdr - (I|R)PCrouter packet header
+ * struct qrtr_hdr_v1 - (I|R)PCrouter packet header version 1
  * @version: protocol version
  * @type: packet type; one of QRTR_TYPE_*
  * @src_node_id: source node
@@ -49,7 +38,7 @@ enum qrtr_pkt_type {
  * @dst_node_id: destination node
  * @dst_port_id: destination port
  */
-struct qrtr_hdr {
+struct qrtr_hdr_v1 {
         __le32 version;
         __le32 type;
         __le32 src_node_id;
@@ -60,9 +49,44 @@ struct qrtr_hdr {
         __le32 dst_port_id;
 } __packed;
 
-#define QRTR_HDR_SIZE sizeof(struct qrtr_hdr)
-#define QRTR_NODE_BCAST ((unsigned int)-1)
-#define QRTR_PORT_CTRL ((unsigned int)-2)
+/**
+ * struct qrtr_hdr_v2 - (I|R)PCrouter packet header later versions
+ * @version: protocol version
+ * @type: packet type; one of QRTR_TYPE_*
+ * @flags: bitmask of QRTR_FLAGS_*
+ * @optlen: length of optional header data
+ * @size: length of packet, excluding this header and optlen
+ * @src_node_id: source node
+ * @src_port_id: source port
+ * @dst_node_id: destination node
+ * @dst_port_id: destination port
+ */
+struct qrtr_hdr_v2 {
+        u8 version;
+        u8 type;
+        u8 flags;
+        u8 optlen;
+        __le32 size;
+        __le16 src_node_id;
+        __le16 src_port_id;
+        __le16 dst_node_id;
+        __le16 dst_port_id;
+};
+
+#define QRTR_FLAGS_CONFIRM_RX   BIT(0)
+
+struct qrtr_cb {
+        u32 src_node;
+        u32 src_port;
+        u32 dst_node;
+        u32 dst_port;
+
+        u8 type;
+        u8 confirm_rx;
+};
+
+#define QRTR_HDR_MAX_SIZE max_t(size_t, sizeof(struct qrtr_hdr_v1), \
+                                        sizeof(struct qrtr_hdr_v2))
 
 struct qrtr_sock {
         /* WARNING: sk must be the first member */
@@ -111,8 +135,12 @@ struct qrtr_node {
         struct list_head item;
 };
 
-static int qrtr_local_enqueue(struct qrtr_node *node, struct sk_buff *skb);
-static int qrtr_bcast_enqueue(struct qrtr_node *node, struct sk_buff *skb);
+static int qrtr_local_enqueue(struct qrtr_node *node, struct sk_buff *skb,
+                              int type, struct sockaddr_qrtr *from,
+                              struct sockaddr_qrtr *to);
+static int qrtr_bcast_enqueue(struct qrtr_node *node, struct sk_buff *skb,
+                              int type, struct sockaddr_qrtr *from,
+                              struct sockaddr_qrtr *to);
 
 /* Release node resources and free the node.
  *
@@ -150,10 +178,27 @@ static void qrtr_node_release(struct qrtr_node *node)
 }
 
 /* Pass an outgoing packet socket buffer to the endpoint driver. */
-static int qrtr_node_enqueue(struct qrtr_node *node, struct sk_buff *skb)
+static int qrtr_node_enqueue(struct qrtr_node *node, struct sk_buff *skb,
+                             int type, struct sockaddr_qrtr *from,
+                             struct sockaddr_qrtr *to)
 {
+        struct qrtr_hdr_v1 *hdr;
+        size_t len = skb->len;
         int rc = -ENODEV;
 
+        hdr = skb_push(skb, sizeof(*hdr));
+        hdr->version = cpu_to_le32(QRTR_PROTO_VER_1);
+        hdr->type = cpu_to_le32(type);
+        hdr->src_node_id = cpu_to_le32(from->sq_node);
+        hdr->src_port_id = cpu_to_le32(from->sq_port);
+        hdr->dst_node_id = cpu_to_le32(to->sq_node);
+        hdr->dst_port_id = cpu_to_le32(to->sq_port);
+
+        hdr->size = cpu_to_le32(len);
+        hdr->confirm_rx = 0;
+
+        skb_put_padto(skb, ALIGN(len, 4));
+
         mutex_lock(&node->ep_lock);
         if (node->ep)
                 rc = node->ep->xmit(node->ep, skb);
@@ -207,125 +252,103 @@ static void qrtr_node_assign(struct qrtr_node *node, unsigned int nid)
 int qrtr_endpoint_post(struct qrtr_endpoint *ep, const void *data, size_t len)
 {
         struct qrtr_node *node = ep->node;
-        const struct qrtr_hdr *phdr = data;
+        const struct qrtr_hdr_v1 *v1;
+        const struct qrtr_hdr_v2 *v2;
         struct sk_buff *skb;
-        unsigned int psize;
+        struct qrtr_cb *cb;
         unsigned int size;
-        unsigned int type;
         unsigned int ver;
-        unsigned int dst;
-
-        if (len < QRTR_HDR_SIZE || len & 3)
-                return -EINVAL;
-
-        ver = le32_to_cpu(phdr->version);
-        size = le32_to_cpu(phdr->size);
-        type = le32_to_cpu(phdr->type);
-        dst = le32_to_cpu(phdr->dst_port_id);
-
-        psize = (size + 3) & ~3;
+        size_t hdrlen;
 
-        if (ver != QRTR_PROTO_VER)
-                return -EINVAL;
-
-        if (len != psize + QRTR_HDR_SIZE)
-                return -EINVAL;
-
-        if (dst != QRTR_PORT_CTRL && type != QRTR_TYPE_DATA)
+        if (len & 3)
                 return -EINVAL;
 
         skb = netdev_alloc_skb(NULL, len);
         if (!skb)
                 return -ENOMEM;
 
-        skb_reset_transport_header(skb);
-        skb_put_data(skb, data, len);
-
-        skb_queue_tail(&node->rx_queue, skb);
-        schedule_work(&node->work);
-
-        return 0;
-}
-EXPORT_SYMBOL_GPL(qrtr_endpoint_post);
+        cb = (struct qrtr_cb *)skb->cb;
 
-static struct sk_buff *qrtr_alloc_ctrl_packet(u32 type, size_t pkt_len,
-                                              u32 src_node, u32 dst_node)
-{
-        struct qrtr_hdr *hdr;
-        struct sk_buff *skb;
-
-        skb = alloc_skb(QRTR_HDR_SIZE + pkt_len, GFP_KERNEL);
-        if (!skb)
-                return NULL;
-        skb_reset_transport_header(skb);
+        /* Version field in v1 is little endian, so this works for both cases */
+        ver = *(u8*)data;
 
-        hdr = skb_put(skb, QRTR_HDR_SIZE);
-        hdr->version = cpu_to_le32(QRTR_PROTO_VER);
-        hdr->type = cpu_to_le32(type);
-        hdr->src_node_id = cpu_to_le32(src_node);
-        hdr->src_port_id = cpu_to_le32(QRTR_PORT_CTRL);
-        hdr->confirm_rx = cpu_to_le32(0);
-        hdr->size = cpu_to_le32(pkt_len);
-        hdr->dst_node_id = cpu_to_le32(dst_node);
-        hdr->dst_port_id = cpu_to_le32(QRTR_PORT_CTRL);
+        switch (ver) {
+        case QRTR_PROTO_VER_1:
+                v1 = data;
+                hdrlen = sizeof(*v1);
 
-        return skb;
-}
+                cb->type = le32_to_cpu(v1->type);
+                cb->src_node = le32_to_cpu(v1->src_node_id);
+                cb->src_port = le32_to_cpu(v1->src_port_id);
+                cb->confirm_rx = !!v1->confirm_rx;
+                cb->dst_node = le32_to_cpu(v1->dst_node_id);
+                cb->dst_port = le32_to_cpu(v1->dst_port_id);
 
-/* Allocate and construct a resume-tx packet. */
-static struct sk_buff *qrtr_alloc_resume_tx(u32 src_node,
-                                            u32 dst_node, u32 port)
-{
-        const int pkt_len = 20;
-        struct sk_buff *skb;
-        __le32 *buf;
+                size = le32_to_cpu(v1->size);
+                break;
+        case QRTR_PROTO_VER_2:
+                v2 = data;
+                hdrlen = sizeof(*v2) + v2->optlen;
+
+                cb->type = v2->type;
+                cb->confirm_rx = !!(v2->flags & QRTR_FLAGS_CONFIRM_RX);
+                cb->src_node = le16_to_cpu(v2->src_node_id);
+                cb->src_port = le16_to_cpu(v2->src_port_id);
+                cb->dst_node = le16_to_cpu(v2->dst_node_id);
+                cb->dst_port = le16_to_cpu(v2->dst_port_id);
+
+                if (cb->src_port == (u16)QRTR_PORT_CTRL)
+                        cb->src_port = QRTR_PORT_CTRL;
+                if (cb->dst_port == (u16)QRTR_PORT_CTRL)
+                        cb->dst_port = QRTR_PORT_CTRL;
+
+                size = le32_to_cpu(v2->size);
+                break;
+        default:
+                pr_err("qrtr: Invalid version %d\n", ver);
+                goto err;
+        }
 
-        skb = qrtr_alloc_ctrl_packet(QRTR_TYPE_RESUME_TX, pkt_len,
-                                     src_node, dst_node);
-        if (!skb)
-                return NULL;
+        if (len != ALIGN(size, 4) + hdrlen)
+                goto err;
 
-        buf = skb_put_zero(skb, pkt_len);
-        buf[0] = cpu_to_le32(QRTR_TYPE_RESUME_TX);
-        buf[1] = cpu_to_le32(src_node);
-        buf[2] = cpu_to_le32(port);
+        if (cb->dst_port != QRTR_PORT_CTRL && cb->type != QRTR_TYPE_DATA)
+                goto err;
 
-        return skb;
-}
+        skb_put_data(skb, data + hdrlen, size);
 
-/* Allocate and construct a BYE message to signal remote termination */
-static struct sk_buff *qrtr_alloc_local_bye(u32 src_node)
-{
-        const int pkt_len = 20;
-        struct sk_buff *skb;
-        __le32 *buf;
+        skb_queue_tail(&node->rx_queue, skb);
+        schedule_work(&node->work);
 
-        skb = qrtr_alloc_ctrl_packet(QRTR_TYPE_BYE, pkt_len,
-                                     src_node, qrtr_local_nid);
-        if (!skb)
-                return NULL;
+        return 0;
 
-        buf = skb_put_zero(skb, pkt_len);
-        buf[0] = cpu_to_le32(QRTR_TYPE_BYE);
+err:
+        kfree_skb(skb);
+        return -EINVAL;
 
-        return skb;
 }
+EXPORT_SYMBOL_GPL(qrtr_endpoint_post);
 
-static struct sk_buff *qrtr_alloc_del_client(struct sockaddr_qrtr *sq)
+/**
+ * qrtr_alloc_ctrl_packet() - allocate control packet skb
+ * @pkt: reference to qrtr_ctrl_pkt pointer
+ *
+ * Returns newly allocated sk_buff, or NULL on failure
+ *
+ * This function allocates a sk_buff large enough to carry a qrtr_ctrl_pkt and
+ * on success returns a reference to the control packet in @pkt.
+ */
+static struct sk_buff *qrtr_alloc_ctrl_packet(struct qrtr_ctrl_pkt **pkt)
 {
-        const int pkt_len = 20;
+        const int pkt_len = sizeof(struct qrtr_ctrl_pkt);
         struct sk_buff *skb;
-        __le32 *buf;
 
-        skb = qrtr_alloc_ctrl_packet(QRTR_TYPE_DEL_CLIENT, pkt_len,
-                                     sq->sq_node, QRTR_NODE_BCAST);
+        skb = alloc_skb(QRTR_HDR_MAX_SIZE + pkt_len, GFP_KERNEL);
         if (!skb)
                 return NULL;
 
-        buf = skb_put_zero(skb, pkt_len);
-        buf[0] = cpu_to_le32(QRTR_TYPE_DEL_CLIENT);
-        buf[1] = cpu_to_le32(sq->sq_node);
-        buf[2] = cpu_to_le32(sq->sq_port);
+        skb_reserve(skb, QRTR_HDR_MAX_SIZE);
+        *pkt = skb_put_zero(skb, pkt_len);
 
         return skb;
 }
@@ -340,24 +363,26 @@ static void qrtr_port_put(struct qrtr_sock *ipc);
 static void qrtr_node_rx_work(struct work_struct *work)
 {
         struct qrtr_node *node = container_of(work, struct qrtr_node, work);
+        struct qrtr_ctrl_pkt *pkt;
+        struct sockaddr_qrtr dst;
+        struct sockaddr_qrtr src;
         struct sk_buff *skb;
 
         while ((skb = skb_dequeue(&node->rx_queue)) != NULL) {
-                const struct qrtr_hdr *phdr;
-                u32 dst_node, dst_port;
                 struct qrtr_sock *ipc;
-                u32 src_node;
+                struct qrtr_cb *cb;
                 int confirm;
 
-                phdr = (const struct qrtr_hdr *)skb_transport_header(skb);
-                src_node = le32_to_cpu(phdr->src_node_id);
-                dst_node = le32_to_cpu(phdr->dst_node_id);
-                dst_port = le32_to_cpu(phdr->dst_port_id);
-                confirm = !!phdr->confirm_rx;
+                cb = (struct qrtr_cb *)skb->cb;
+                src.sq_node = cb->src_node;
+                src.sq_port = cb->src_port;
+                dst.sq_node = cb->dst_node;
+                dst.sq_port = cb->dst_port;
+                confirm = !!cb->confirm_rx;
 
-                qrtr_node_assign(node, src_node);
+                qrtr_node_assign(node, cb->src_node);
 
-                ipc = qrtr_port_lookup(dst_port);
+                ipc = qrtr_port_lookup(cb->dst_port);
                 if (!ipc) {
                         kfree_skb(skb);
                 } else {
@@ -368,10 +393,16 @@ static void qrtr_node_rx_work(struct work_struct *work)
                 }
 
                 if (confirm) {
-                        skb = qrtr_alloc_resume_tx(dst_node, node->nid, dst_port);
+                        skb = qrtr_alloc_ctrl_packet(&pkt);
                         if (!skb)
                                 break;
-                        if (qrtr_node_enqueue(node, skb))
+
+                        pkt->cmd = cpu_to_le32(QRTR_TYPE_RESUME_TX);
+                        pkt->client.node = cpu_to_le32(dst.sq_node);
+                        pkt->client.port = cpu_to_le32(dst.sq_port);
+
+                        if (qrtr_node_enqueue(node, skb, QRTR_TYPE_RESUME_TX,
+                                              &dst, &src))
                                 break;
                 }
         }
@@ -421,6 +452,9 @@ EXPORT_SYMBOL_GPL(qrtr_endpoint_register);
 void qrtr_endpoint_unregister(struct qrtr_endpoint *ep)
 {
         struct qrtr_node *node = ep->node;
+        struct sockaddr_qrtr src = {AF_QIPCRTR, node->nid, QRTR_PORT_CTRL};
+        struct sockaddr_qrtr dst = {AF_QIPCRTR, qrtr_local_nid, QRTR_PORT_CTRL};
+        struct qrtr_ctrl_pkt *pkt;
         struct sk_buff *skb;
 
         mutex_lock(&node->ep_lock);
@@ -428,9 +462,11 @@ void qrtr_endpoint_unregister(struct qrtr_endpoint *ep)
         mutex_unlock(&node->ep_lock);
 
         /* Notify the local controller about the event */
-        skb = qrtr_alloc_local_bye(node->nid);
-        if (skb)
-                qrtr_local_enqueue(NULL, skb);
+        skb = qrtr_alloc_ctrl_packet(&pkt);
+        if (skb) {
+                pkt->cmd = cpu_to_le32(QRTR_TYPE_BYE);
+                qrtr_local_enqueue(NULL, skb, QRTR_TYPE_BYE, &src, &dst);
+        }
 
         qrtr_node_release(node);
         ep->node = NULL;
@@ -466,13 +502,24 @@ static void qrtr_port_put(struct qrtr_sock *ipc)
 /* Remove port assignment. */
 static void qrtr_port_remove(struct qrtr_sock *ipc)
 {
+        struct qrtr_ctrl_pkt *pkt;
         struct sk_buff *skb;
         int port = ipc->us.sq_port;
+        struct sockaddr_qrtr to;
 
-        skb = qrtr_alloc_del_client(&ipc->us);
+        to.sq_family = AF_QIPCRTR;
+        to.sq_node = QRTR_NODE_BCAST;
+        to.sq_port = QRTR_PORT_CTRL;
+
+        skb = qrtr_alloc_ctrl_packet(&pkt);
         if (skb) {
+                pkt->cmd = cpu_to_le32(QRTR_TYPE_DEL_CLIENT);
+                pkt->client.node = cpu_to_le32(ipc->us.sq_node);
+                pkt->client.port = cpu_to_le32(ipc->us.sq_port);
+
                 skb_set_owner_w(skb, &ipc->sk);
-                qrtr_bcast_enqueue(NULL, skb);
+                qrtr_bcast_enqueue(NULL, skb, QRTR_TYPE_DEL_CLIENT, &ipc->us,
+                                   &to);
         }
 
         if (port == QRTR_PORT_CTRL)
@@ -541,7 +588,7 @@ static void qrtr_reset_ports(void)
 
                 sock_hold(&ipc->sk);
                 ipc->sk.sk_err = ENETRESET;
-                wake_up_interruptible(sk_sleep(&ipc->sk));
+                ipc->sk.sk_error_report(&ipc->sk);
                 sock_put(&ipc->sk);
         }
         mutex_unlock(&qrtr_port_lock);
@@ -620,19 +667,23 @@ static int qrtr_bind(struct socket *sock, struct sockaddr *saddr, int len)
 }
 
 /* Queue packet to local peer socket. */
-static int qrtr_local_enqueue(struct qrtr_node *node, struct sk_buff *skb)
+static int qrtr_local_enqueue(struct qrtr_node *node, struct sk_buff *skb,
+                              int type, struct sockaddr_qrtr *from,
+                              struct sockaddr_qrtr *to)
 {
-        const struct qrtr_hdr *phdr;
         struct qrtr_sock *ipc;
+        struct qrtr_cb *cb;
 
-        phdr = (const struct qrtr_hdr *)skb_transport_header(skb);
-
-        ipc = qrtr_port_lookup(le32_to_cpu(phdr->dst_port_id));
+        ipc = qrtr_port_lookup(to->sq_port);
         if (!ipc || &ipc->sk == skb->sk) { /* do not send to self */
                 kfree_skb(skb);
                 return -ENODEV;
         }
 
+        cb = (struct qrtr_cb *)skb->cb;
+        cb->src_node = from->sq_node;
+        cb->src_port = from->sq_port;
+
         if (sock_queue_rcv_skb(&ipc->sk, skb)) {
                 qrtr_port_put(ipc);
                 kfree_skb(skb);
@@ -645,7 +696,9 @@ static int qrtr_local_enqueue(struct qrtr_node *node, struct sk_buff *skb)
 }
 
 /* Queue packet for broadcast. */
-static int qrtr_bcast_enqueue(struct qrtr_node *node, struct sk_buff *skb)
+static int qrtr_bcast_enqueue(struct qrtr_node *node, struct sk_buff *skb,
+                              int type, struct sockaddr_qrtr *from,
+                              struct sockaddr_qrtr *to)
 {
         struct sk_buff *skbn;
 
@@ -655,11 +708,11 @@ static int qrtr_bcast_enqueue(struct qrtr_node *node, struct sk_buff *skb)
                 if (!skbn)
                         break;
                 skb_set_owner_w(skbn, skb->sk);
-                qrtr_node_enqueue(node, skbn);
+                qrtr_node_enqueue(node, skbn, type, from, to);
         }
         mutex_unlock(&qrtr_node_lock);
 
-        qrtr_local_enqueue(node, skb);
+        qrtr_local_enqueue(node, skb, type, from, to);
 
         return 0;
 }
@@ -667,13 +720,14 @@ static int qrtr_bcast_enqueue(struct qrtr_node *node, struct sk_buff *skb)
 static int qrtr_sendmsg(struct socket *sock, struct msghdr *msg, size_t len)
 {
         DECLARE_SOCKADDR(struct sockaddr_qrtr *, addr, msg->msg_name);
-        int (*enqueue_fn)(struct qrtr_node *, struct sk_buff *);
+        int (*enqueue_fn)(struct qrtr_node *, struct sk_buff *, int,
+                          struct sockaddr_qrtr *, struct sockaddr_qrtr *);
         struct qrtr_sock *ipc = qrtr_sk(sock->sk);
         struct sock *sk = sock->sk;
         struct qrtr_node *node;
-        struct qrtr_hdr *hdr;
         struct sk_buff *skb;
         size_t plen;
+        u32 type = QRTR_TYPE_DATA;
         int rc;
 
         if (msg->msg_flags & ~(MSG_DONTWAIT))
@@ -722,37 +776,19 @@ static int qrtr_sendmsg(struct socket *sock, struct msghdr *msg, size_t len)
         }
 
         plen = (len + 3) & ~3;
-        skb = sock_alloc_send_skb(sk, plen + QRTR_HDR_SIZE,
+        skb = sock_alloc_send_skb(sk, plen + QRTR_HDR_MAX_SIZE,
                                   msg->msg_flags & MSG_DONTWAIT, &rc);
         if (!skb)
                 goto out_node;
 
-        skb_reset_transport_header(skb);
-        skb_put(skb, len + QRTR_HDR_SIZE);
-
-        hdr = (struct qrtr_hdr *)skb_transport_header(skb);
-        hdr->version = cpu_to_le32(QRTR_PROTO_VER);
-        hdr->src_node_id = cpu_to_le32(ipc->us.sq_node);
-        hdr->src_port_id = cpu_to_le32(ipc->us.sq_port);
-        hdr->confirm_rx = cpu_to_le32(0);
-        hdr->size = cpu_to_le32(len);
-        hdr->dst_node_id = cpu_to_le32(addr->sq_node);
-        hdr->dst_port_id = cpu_to_le32(addr->sq_port);
+        skb_reserve(skb, QRTR_HDR_MAX_SIZE);
 
-        rc = skb_copy_datagram_from_iter(skb, QRTR_HDR_SIZE,
-                                         &msg->msg_iter, len);
+        rc = memcpy_from_msg(skb_put(skb, len), msg, len);
         if (rc) {
                 kfree_skb(skb);
                 goto out_node;
         }
 
-        if (plen != len) {
-                rc = skb_pad(skb, plen - len);
-                if (rc)
-                        goto out_node;
-                skb_put(skb, plen - len);
-        }
-
         if (ipc->us.sq_port == QRTR_PORT_CTRL) {
                 if (len < 4) {
                         rc = -EINVAL;
@@ -761,12 +797,11 @@ static int qrtr_sendmsg(struct socket *sock, struct msghdr *msg, size_t len)
                 }
 
                 /* control messages already require the type as 'command' */
-                skb_copy_bits(skb, QRTR_HDR_SIZE, &hdr->type, 4);
-        } else {
-                hdr->type = cpu_to_le32(QRTR_TYPE_DATA);
+                skb_copy_bits(skb, 0, &type, 4);
+                type = le32_to_cpu(type);
         }
 
-        rc = enqueue_fn(node, skb);
+        rc = enqueue_fn(node, skb, type, &ipc->us, addr);
         if (rc >= 0)
                 rc = len;
 
@@ -781,9 +816,9 @@ static int qrtr_recvmsg(struct socket *sock, struct msghdr *msg,
                         size_t size, int flags)
 {
         DECLARE_SOCKADDR(struct sockaddr_qrtr *, addr, msg->msg_name);
-        const struct qrtr_hdr *phdr;
         struct sock *sk = sock->sk;
         struct sk_buff *skb;
+        struct qrtr_cb *cb;
         int copied, rc;
 
         lock_sock(sk);
@@ -800,22 +835,22 @@ static int qrtr_recvmsg(struct socket *sock, struct msghdr *msg,
                 return rc;
         }
 
-        phdr = (const struct qrtr_hdr *)skb_transport_header(skb);
-        copied = le32_to_cpu(phdr->size);
+        copied = skb->len;
         if (copied > size) {
                 copied = size;
                 msg->msg_flags |= MSG_TRUNC;
         }
 
-        rc = skb_copy_datagram_msg(skb, QRTR_HDR_SIZE, msg, copied);
+        rc = skb_copy_datagram_msg(skb, 0, msg, copied);
         if (rc < 0)
                 goto out;
         rc = copied;
 
         if (addr) {
+                cb = (struct qrtr_cb *)skb->cb;
                 addr->sq_family = AF_QIPCRTR;
-                addr->sq_node = le32_to_cpu(phdr->src_node_id);
-                addr->sq_port = le32_to_cpu(phdr->src_port_id);
+                addr->sq_node = cb->src_node;
+                addr->sq_port = cb->src_port;
                 msg->msg_namelen = sizeof(*addr);
         }
 
@@ -908,7 +943,7 @@ static int qrtr_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
         case TIOCINQ:
                 skb = skb_peek(&sk->sk_receive_queue);
                 if (skb)
-                        len = skb->len - QRTR_HDR_SIZE;
+                        len = skb->len;
                 rc = put_user(len, (int __user *)argp);
                 break;
         case SIOCGIFADDR:
diff --git a/net/rds/ib.c b/net/rds/ib.c
index a0954ace3774..36dd2099048a 100644
--- a/net/rds/ib.c
+++ b/net/rds/ib.c
@@ -126,6 +126,7 @@ void rds_ib_dev_put(struct rds_ib_device *rds_ibdev)
 static void rds_ib_add_one(struct ib_device *device)
 {
         struct rds_ib_device *rds_ibdev;
+        bool has_fr, has_fmr;
 
         /* Only handle IB (no iWARP) devices */
         if (device->node_type != RDMA_NODE_IB_CA)
@@ -143,11 +144,11 @@ static void rds_ib_add_one(struct ib_device *device)
         rds_ibdev->max_wrs = device->attrs.max_qp_wr;
         rds_ibdev->max_sge = min(device->attrs.max_sge, RDS_IB_MAX_SGE);
 
-        rds_ibdev->has_fr = (device->attrs.device_cap_flags &
-                                  IB_DEVICE_MEM_MGT_EXTENSIONS);
-        rds_ibdev->has_fmr = (device->alloc_fmr && device->dealloc_fmr &&
-                            device->map_phys_fmr && device->unmap_fmr);
-        rds_ibdev->use_fastreg = (rds_ibdev->has_fr && !rds_ibdev->has_fmr);
+        has_fr = (device->attrs.device_cap_flags &
+                  IB_DEVICE_MEM_MGT_EXTENSIONS);
+        has_fmr = (device->alloc_fmr && device->dealloc_fmr &&
+                   device->map_phys_fmr && device->unmap_fmr);
+        rds_ibdev->use_fastreg = (has_fr && !has_fmr);
 
         rds_ibdev->fmr_max_remaps = device->attrs.max_map_per_fmr?: 32;
         rds_ibdev->max_1m_mrs = device->attrs.max_mr ?
diff --git a/net/rds/ib.h b/net/rds/ib.h
index 86a8578d95b8..a6f4d7d68e95 100644
--- a/net/rds/ib.h
+++ b/net/rds/ib.h
@@ -216,8 +216,6 @@ struct rds_ib_device {
         struct list_head        conn_list;
         struct ib_device        *dev;
         struct ib_pd            *pd;
-        bool                    has_fmr;
-        bool                    has_fr;
         bool                    use_fastreg;
 
         unsigned int            max_mrs;
diff --git a/net/rds/ib_fmr.c b/net/rds/ib_fmr.c
index 86ef907067bb..e0f70c4051b6 100644
--- a/net/rds/ib_fmr.c
+++ b/net/rds/ib_fmr.c
@@ -139,8 +139,8 @@ static int rds_ib_map_fmr(struct rds_ib_device *rds_ibdev,
                 return -EINVAL;
         }
 
-        dma_pages = kmalloc_node(sizeof(u64) * page_cnt, GFP_ATOMIC,
-                                 rdsibdev_to_node(rds_ibdev));
+        dma_pages = kmalloc_array_node(sizeof(u64), page_cnt, GFP_ATOMIC,
+                                       rdsibdev_to_node(rds_ibdev));
         if (!dma_pages) {
                 ib_dma_unmap_sg(dev, sg, nents, DMA_BIDIRECTIONAL);
                 return -ENOMEM;
diff --git a/net/rds/ib_rdma.c b/net/rds/ib_rdma.c
index 9a3c54e659e9..e678699268a2 100644
--- a/net/rds/ib_rdma.c
+++ b/net/rds/ib_rdma.c
@@ -601,11 +601,11 @@ struct rds_ib_mr_pool *rds_ib_create_mr_pool(struct rds_ib_device *rds_ibdev,
         if (pool_type == RDS_IB_MR_1M_POOL) {
                 /* +1 allows for unaligned MRs */
                 pool->fmr_attr.max_pages = RDS_MR_1M_MSG_SIZE + 1;
-                pool->max_items = RDS_MR_1M_POOL_SIZE;
+                pool->max_items = rds_ibdev->max_1m_mrs;
         } else {
                 /* pool_type == RDS_IB_MR_8K_POOL */
                 pool->fmr_attr.max_pages = RDS_MR_8K_MSG_SIZE + 1;
-                pool->max_items = RDS_MR_8K_POOL_SIZE;
+                pool->max_items = rds_ibdev->max_8k_mrs;
         }
 
         pool->max_free_pinned = pool->max_items * pool->fmr_attr.max_pages / 4;
diff --git a/net/rose/af_rose.c b/net/rose/af_rose.c
index 4a9729257023..6a5c4992cf61 100644
--- a/net/rose/af_rose.c
+++ b/net/rose/af_rose.c
@@ -318,9 +318,11 @@ void rose_destroy_socket(struct sock *);
 /*
  *      Handler for deferred kills.
  */
-static void rose_destroy_timer(unsigned long data)
+static void rose_destroy_timer(struct timer_list *t)
 {
-        rose_destroy_socket((struct sock *)data);
+        struct sock *sk = from_timer(sk, t, sk_timer);
+
+        rose_destroy_socket(sk);
 }
 
 /*
@@ -353,8 +355,7 @@ void rose_destroy_socket(struct sock *sk)
 
         if (sk_has_allocations(sk)) {
                 /* Defer: outstanding buffers */
-                setup_timer(&sk->sk_timer, rose_destroy_timer,
-                                (unsigned long)sk);
+                timer_setup(&sk->sk_timer, rose_destroy_timer, 0);
                 sk->sk_timer.expires  = jiffies + 10 * HZ;
                 add_timer(&sk->sk_timer);
         } else
@@ -538,8 +539,8 @@ static int rose_create(struct net *net, struct socket *sock, int protocol,
         sock->ops    = &rose_proto_ops;
         sk->sk_protocol = protocol;
 
-        init_timer(&rose->timer);
-        init_timer(&rose->idletimer);
+        timer_setup(&rose->timer, NULL, 0);
+        timer_setup(&rose->idletimer, NULL, 0);
 
         rose->t1   = msecs_to_jiffies(sysctl_rose_call_request_timeout);
         rose->t2   = msecs_to_jiffies(sysctl_rose_reset_request_timeout);
@@ -582,8 +583,8 @@ static struct sock *rose_make_new(struct sock *osk)
         sk->sk_state    = TCP_ESTABLISHED;
         sock_copy_flags(sk, osk);
 
-        init_timer(&rose->timer);
-        init_timer(&rose->idletimer);
+        timer_setup(&rose->timer, NULL, 0);
+        timer_setup(&rose->idletimer, NULL, 0);
 
         orose           = rose_sk(osk);
         rose->t1        = orose->t1;
diff --git a/net/rose/rose_in.c b/net/rose/rose_in.c
index 0a6394754e81..9bbbfe325c5a 100644
--- a/net/rose/rose_in.c
+++ b/net/rose/rose_in.c
@@ -219,6 +219,7 @@ static int rose_state4_machine(struct sock *sk, struct sk_buff *skb, int framety
         switch (frametype) {
         case ROSE_RESET_REQUEST:
                 rose_write_internal(sk, ROSE_RESET_CONFIRMATION);
+                /* fall through */
         case ROSE_RESET_CONFIRMATION:
                 rose_stop_timer(sk);
                 rose_start_idletimer(sk);
diff --git a/net/rose/rose_link.c b/net/rose/rose_link.c
index c76638cc2cd5..62055d3069d2 100644
--- a/net/rose/rose_link.c
+++ b/net/rose/rose_link.c
@@ -27,8 +27,8 @@
 #include <linux/interrupt.h>
 #include <net/rose.h>
 
-static void rose_ftimer_expiry(unsigned long);
-static void rose_t0timer_expiry(unsigned long);
+static void rose_ftimer_expiry(struct timer_list *);
+static void rose_t0timer_expiry(struct timer_list *);
 
 static void rose_transmit_restart_confirmation(struct rose_neigh *neigh);
 static void rose_transmit_restart_request(struct rose_neigh *neigh);
@@ -37,8 +37,7 @@ void rose_start_ftimer(struct rose_neigh *neigh)
 {
         del_timer(&neigh->ftimer);
 
-        neigh->ftimer.data     = (unsigned long)neigh;
-        neigh->ftimer.function = &rose_ftimer_expiry;
+        neigh->ftimer.function = rose_ftimer_expiry;
         neigh->ftimer.expires  =
                 jiffies + msecs_to_jiffies(sysctl_rose_link_fail_timeout);
 
@@ -49,8 +48,7 @@ static void rose_start_t0timer(struct rose_neigh *neigh)
 {
         del_timer(&neigh->t0timer);
 
-        neigh->t0timer.data     = (unsigned long)neigh;
-        neigh->t0timer.function = &rose_t0timer_expiry;
+        neigh->t0timer.function = rose_t0timer_expiry;
         neigh->t0timer.expires  =
                 jiffies + msecs_to_jiffies(sysctl_rose_restart_request_timeout);
 
@@ -77,13 +75,13 @@ static int rose_t0timer_running(struct rose_neigh *neigh)
         return timer_pending(&neigh->t0timer);
 }
 
-static void rose_ftimer_expiry(unsigned long param)
+static void rose_ftimer_expiry(struct timer_list *t)
 {
 }
 
-static void rose_t0timer_expiry(unsigned long param)
+static void rose_t0timer_expiry(struct timer_list *t)
 {
-        struct rose_neigh *neigh = (struct rose_neigh *)param;
+        struct rose_neigh *neigh = from_timer(neigh, t, t0timer);
 
         rose_transmit_restart_request(neigh);
 
diff --git a/net/rose/rose_loopback.c b/net/rose/rose_loopback.c
index 344456206b70..7af4f99c4a93 100644
--- a/net/rose/rose_loopback.c
+++ b/net/rose/rose_loopback.c
@@ -19,12 +19,13 @@ static struct sk_buff_head loopback_queue;
 static struct timer_list loopback_timer;
 
 static void rose_set_loopback_timer(void);
+static void rose_loopback_timer(struct timer_list *unused);
 
 void rose_loopback_init(void)
 {
         skb_queue_head_init(&loopback_queue);
 
-        init_timer(&loopback_timer);
+        timer_setup(&loopback_timer, rose_loopback_timer, 0);
 }
 
 static int rose_loopback_running(void)
@@ -50,20 +51,16 @@ int rose_loopback_queue(struct sk_buff *skb, struct rose_neigh *neigh)
         return 1;
 }
 
-static void rose_loopback_timer(unsigned long);
 
 static void rose_set_loopback_timer(void)
 {
         del_timer(&loopback_timer);
 
-        loopback_timer.data     = 0;
-        loopback_timer.function = &rose_loopback_timer;
         loopback_timer.expires  = jiffies + 10;
-
         add_timer(&loopback_timer);
 }
 
-static void rose_loopback_timer(unsigned long param)
+static void rose_loopback_timer(struct timer_list *unused)
 {
         struct sk_buff *skb;
         struct net_device *dev;
diff --git a/net/rose/rose_route.c b/net/rose/rose_route.c
index 452bbb38d943..8ca3124df83f 100644
--- a/net/rose/rose_route.c
+++ b/net/rose/rose_route.c
@@ -104,8 +104,8 @@ static int __must_check rose_add_node(struct rose_route_struct *rose_route,
 
                 skb_queue_head_init(&rose_neigh->queue);
 
-                init_timer(&rose_neigh->ftimer);
-                init_timer(&rose_neigh->t0timer);
+                timer_setup(&rose_neigh->ftimer, NULL, 0);
+                timer_setup(&rose_neigh->t0timer, NULL, 0);
 
                 if (rose_route->ndigis != 0) {
                         rose_neigh->digipeat =
@@ -346,6 +346,7 @@ static int rose_del_node(struct rose_route_struct *rose_route,
                                 case 0:
                                         rose_node->neighbour[0] =
                                                 rose_node->neighbour[1];
+                                        /* fall through */
                                 case 1:
                                         rose_node->neighbour[1] =
                                                 rose_node->neighbour[2];
@@ -390,8 +391,8 @@ void rose_add_loopback_neigh(void)
 
         skb_queue_head_init(&sn->queue);
 
-        init_timer(&sn->ftimer);
-        init_timer(&sn->t0timer);
+        timer_setup(&sn->ftimer, NULL, 0);
+        timer_setup(&sn->t0timer, NULL, 0);
 
         spin_lock_bh(&rose_neigh_list_lock);
         sn->next = rose_neigh_list;
@@ -507,6 +508,7 @@ void rose_rt_device_down(struct net_device *dev)
                                 switch (i) {
                                 case 0:
                                         t->neighbour[0] = t->neighbour[1];
+                                        /* fall through */
                                 case 1:
                                         t->neighbour[1] = t->neighbour[2];
                                 case 2:
diff --git a/net/rose/rose_timer.c b/net/rose/rose_timer.c
index bc5469d6d9cb..74555fb95615 100644
--- a/net/rose/rose_timer.c
+++ b/net/rose/rose_timer.c
@@ -28,16 +28,15 @@
 #include <linux/interrupt.h>
 #include <net/rose.h>
 
-static void rose_heartbeat_expiry(unsigned long);
-static void rose_timer_expiry(unsigned long);
-static void rose_idletimer_expiry(unsigned long);
+static void rose_heartbeat_expiry(struct timer_list *t);
+static void rose_timer_expiry(struct timer_list *);
+static void rose_idletimer_expiry(struct timer_list *);
 
 void rose_start_heartbeat(struct sock *sk)
 {
         del_timer(&sk->sk_timer);
 
-        sk->sk_timer.data     = (unsigned long)sk;
-        sk->sk_timer.function = &rose_heartbeat_expiry;
+        sk->sk_timer.function = rose_heartbeat_expiry;
         sk->sk_timer.expires  = jiffies + 5 * HZ;
 
         add_timer(&sk->sk_timer);
@@ -49,8 +48,7 @@ void rose_start_t1timer(struct sock *sk)
 
         del_timer(&rose->timer);
 
-        rose->timer.data     = (unsigned long)sk;
-        rose->timer.function = &rose_timer_expiry;
+        rose->timer.function = rose_timer_expiry;
         rose->timer.expires  = jiffies + rose->t1;
 
         add_timer(&rose->timer);
@@ -62,8 +60,7 @@ void rose_start_t2timer(struct sock *sk)
 
         del_timer(&rose->timer);
 
-        rose->timer.data     = (unsigned long)sk;
-        rose->timer.function = &rose_timer_expiry;
+        rose->timer.function = rose_timer_expiry;
         rose->timer.expires  = jiffies + rose->t2;
 
         add_timer(&rose->timer);
@@ -75,8 +72,7 @@ void rose_start_t3timer(struct sock *sk)
 
         del_timer(&rose->timer);
 
-        rose->timer.data     = (unsigned long)sk;
-        rose->timer.function = &rose_timer_expiry;
+        rose->timer.function = rose_timer_expiry;
         rose->timer.expires  = jiffies + rose->t3;
 
         add_timer(&rose->timer);
@@ -88,8 +84,7 @@ void rose_start_hbtimer(struct sock *sk)
 
         del_timer(&rose->timer);
 
-        rose->timer.data     = (unsigned long)sk;
-        rose->timer.function = &rose_timer_expiry;
+        rose->timer.function = rose_timer_expiry;
         rose->timer.expires  = jiffies + rose->hb;
 
         add_timer(&rose->timer);
@@ -102,8 +97,7 @@ void rose_start_idletimer(struct sock *sk)
         del_timer(&rose->idletimer);
 
         if (rose->idle > 0) {
-                rose->idletimer.data     = (unsigned long)sk;
-                rose->idletimer.function = &rose_idletimer_expiry;
+                rose->idletimer.function = rose_idletimer_expiry;
                 rose->idletimer.expires  = jiffies + rose->idle;
 
                 add_timer(&rose->idletimer);
@@ -125,9 +119,9 @@ void rose_stop_idletimer(struct sock *sk)
         del_timer(&rose_sk(sk)->idletimer);
 }
 
-static void rose_heartbeat_expiry(unsigned long param)
+static void rose_heartbeat_expiry(struct timer_list *t)
 {
-        struct sock *sk = (struct sock *)param;
+        struct sock *sk = from_timer(sk, t, sk_timer);
         struct rose_sock *rose = rose_sk(sk);
 
         bh_lock_sock(sk);
@@ -163,10 +157,10 @@ static void rose_heartbeat_expiry(unsigned long param)
         bh_unlock_sock(sk);
 }
 
-static void rose_timer_expiry(unsigned long param)
+static void rose_timer_expiry(struct timer_list *t)
 {
-        struct sock *sk = (struct sock *)param;
-        struct rose_sock *rose = rose_sk(sk);
+        struct rose_sock *rose = from_timer(rose, t, timer);
+        struct sock *sk = &rose->sock;
 
         bh_lock_sock(sk);
         switch (rose->state) {
@@ -192,9 +186,10 @@ static void rose_timer_expiry(unsigned long param)
         bh_unlock_sock(sk);
 }
 
-static void rose_idletimer_expiry(unsigned long param)
+static void rose_idletimer_expiry(struct timer_list *t)
 {
-        struct sock *sk = (struct sock *)param;
+        struct rose_sock *rose = from_timer(rose, t, idletimer);
+        struct sock *sk = &rose->sock;
 
         bh_lock_sock(sk);
         rose_clear_queues(sk);
diff --git a/net/rxrpc/af_rxrpc.c b/net/rxrpc/af_rxrpc.c
index 4b0a8288c98a..9b5c46b052fd 100644
--- a/net/rxrpc/af_rxrpc.c
+++ b/net/rxrpc/af_rxrpc.c
@@ -246,6 +246,7 @@ static int rxrpc_listen(struct socket *sock, int backlog)
                         ret = 0;
                         break;
                 }
+                /* Fall through */
         default:
                 ret = -EBUSY;
                 break;
@@ -265,6 +266,7 @@ static int rxrpc_listen(struct socket *sock, int backlog)
  * @tx_total_len: Total length of data to transmit during the call (or -1)
  * @gfp: The allocation constraints
  * @notify_rx: Where to send notifications instead of socket queue
+ * @upgrade: Request service upgrade for call
  *
  * Allow a kernel service to begin a call on the nominated socket.  This just
  * sets up all the internal tracking structures and allocates connection and
@@ -279,7 +281,8 @@ struct rxrpc_call *rxrpc_kernel_begin_call(struct socket *sock,
                                            unsigned long user_call_ID,
                                            s64 tx_total_len,
                                            gfp_t gfp,
-                                           rxrpc_notify_rx_t notify_rx)
+                                           rxrpc_notify_rx_t notify_rx,
+                                           bool upgrade)
 {
         struct rxrpc_conn_parameters cp;
         struct rxrpc_call *call;
@@ -304,6 +307,7 @@ struct rxrpc_call *rxrpc_kernel_begin_call(struct socket *sock,
         cp.key                  = key;
         cp.security_level       = 0;
         cp.exclusive            = false;
+        cp.upgrade              = upgrade;
         cp.service_id           = srx->srx_service;
         call = rxrpc_new_client_call(rx, &cp, srx, user_call_ID, tx_total_len,
                                      gfp);
@@ -318,6 +322,14 @@ struct rxrpc_call *rxrpc_kernel_begin_call(struct socket *sock,
 }
 EXPORT_SYMBOL(rxrpc_kernel_begin_call);
 
+/*
+ * Dummy function used to stop the notifier talking to recvmsg().
+ */
+static void rxrpc_dummy_notify_rx(struct sock *sk, struct rxrpc_call *rxcall,
+                                  unsigned long call_user_ID)
+{
+}
+
 /**
  * rxrpc_kernel_end_call - Allow a kernel service to end a call it was using
  * @sock: The socket the call is on
@@ -332,12 +344,39 @@ void rxrpc_kernel_end_call(struct socket *sock, struct rxrpc_call *call)
 
         mutex_lock(&call->user_mutex);
         rxrpc_release_call(rxrpc_sk(sock->sk), call);
+
+        /* Make sure we're not going to call back into a kernel service */
+        if (call->notify_rx) {
+                spin_lock_bh(&call->notify_lock);
+                call->notify_rx = rxrpc_dummy_notify_rx;
+                spin_unlock_bh(&call->notify_lock);
+        }
+
         mutex_unlock(&call->user_mutex);
         rxrpc_put_call(call, rxrpc_call_put_kernel);
 }
 EXPORT_SYMBOL(rxrpc_kernel_end_call);
 
 /**
+ * rxrpc_kernel_check_life - Check to see whether a call is still alive
+ * @sock: The socket the call is on
+ * @call: The call to check
+ *
+ * Allow a kernel service to find out whether a call is still alive - ie. we're
+ * getting ACKs from the server.  Returns a number representing the life state
+ * which can be compared to that returned by a previous call.
+ *
+ * If this is a client call, ping ACKs will be sent to the server to find out
+ * whether it's still responsive and whether the call is still alive on the
+ * server.
+ */
+u32 rxrpc_kernel_check_life(struct socket *sock, struct rxrpc_call *call)
+{
+        return call->acks_latest;
+}
+EXPORT_SYMBOL(rxrpc_kernel_check_life);
+
+/**
  * rxrpc_kernel_check_call - Check a call's state
  * @sock: The socket the call is on
  * @call: The call to check
@@ -538,6 +577,7 @@ static int rxrpc_sendmsg(struct socket *sock, struct msghdr *m, size_t len)
                         m->msg_name = &rx->connect_srx;
                         m->msg_namelen = sizeof(rx->connect_srx);
                 }
+                /* Fall through */
         case RXRPC_SERVER_BOUND:
         case RXRPC_SERVER_LISTENING:
                 ret = rxrpc_do_sendmsg(rx, m, len);
diff --git a/net/rxrpc/ar-internal.h b/net/rxrpc/ar-internal.h
index ea5600b747cc..b2151993d384 100644
--- a/net/rxrpc/ar-internal.h
+++ b/net/rxrpc/ar-internal.h
@@ -525,6 +525,7 @@ struct rxrpc_call {
         unsigned long           flags;
         unsigned long           events;
         spinlock_t              lock;
+        spinlock_t              notify_lock;    /* Kernel notification lock */
         rwlock_t                state_lock;     /* lock for state transition */
         u32                     abort_code;     /* Local/remote abort code */
         int                     error;          /* Local error incurred */
diff --git a/net/rxrpc/call_event.c b/net/rxrpc/call_event.c
index 7a77844aab16..3574508baf9a 100644
--- a/net/rxrpc/call_event.c
+++ b/net/rxrpc/call_event.c
@@ -386,7 +386,7 @@ recheck_state:
 
         now = ktime_get_real();
         if (ktime_before(call->expire_at, now)) {
-                rxrpc_abort_call("EXP", call, 0, RX_CALL_TIMEOUT, -ETIME);
+                rxrpc_abort_call("EXP", call, 0, RX_USER_ABORT, -ETIME);
                 set_bit(RXRPC_CALL_EV_ABORT, &call->events);
                 goto recheck_state;
         }
diff --git a/net/rxrpc/call_object.c b/net/rxrpc/call_object.c
index fcdd6555a820..994dc2df57e4 100644
--- a/net/rxrpc/call_object.c
+++ b/net/rxrpc/call_object.c
@@ -45,9 +45,9 @@ const char *const rxrpc_call_completions[NR__RXRPC_CALL_COMPLETIONS] = {
 
 struct kmem_cache *rxrpc_call_jar;
 
-static void rxrpc_call_timer_expired(unsigned long _call)
+static void rxrpc_call_timer_expired(struct timer_list *t)
 {
-        struct rxrpc_call *call = (struct rxrpc_call *)_call;
+        struct rxrpc_call *call = from_timer(call, t, timer);
 
         _enter("%d", call->debug_id);
 
@@ -114,8 +114,7 @@ struct rxrpc_call *rxrpc_alloc_call(gfp_t gfp)
                 goto nomem_2;
 
         mutex_init(&call->user_mutex);
-        setup_timer(&call->timer, rxrpc_call_timer_expired,
-                    (unsigned long)call);
+        timer_setup(&call->timer, rxrpc_call_timer_expired, 0);
         INIT_WORK(&call->processor, &rxrpc_process_call);
         INIT_LIST_HEAD(&call->link);
         INIT_LIST_HEAD(&call->chan_wait_link);
@@ -124,6 +123,7 @@ struct rxrpc_call *rxrpc_alloc_call(gfp_t gfp)
         INIT_LIST_HEAD(&call->sock_link);
         init_waitqueue_head(&call->waitq);
         spin_lock_init(&call->lock);
+        spin_lock_init(&call->notify_lock);
         rwlock_init(&call->state_lock);
         atomic_set(&call->usage, 1);
         call->debug_id = atomic_inc_return(&rxrpc_debug_id);
diff --git a/net/rxrpc/input.c b/net/rxrpc/input.c
index e56e23ed2229..1b592073ec96 100644
--- a/net/rxrpc/input.c
+++ b/net/rxrpc/input.c
@@ -298,8 +298,6 @@ static bool rxrpc_end_tx_phase(struct rxrpc_call *call, bool reply_begun,
 
         write_unlock(&call->state_lock);
         if (call->state == RXRPC_CALL_CLIENT_AWAIT_REPLY) {
-                rxrpc_propose_ACK(call, RXRPC_ACK_IDLE, 0, 0, false, true,
-                                  rxrpc_propose_ack_client_tx_end);
                 trace_rxrpc_transmit(call, rxrpc_transmit_await_reply);
         } else {
                 trace_rxrpc_transmit(call, rxrpc_transmit_end);
@@ -1125,6 +1123,7 @@ void rxrpc_data_ready(struct sock *udp_sk)
         case RXRPC_PACKET_TYPE_BUSY:
                 if (sp->hdr.flags & RXRPC_CLIENT_INITIATED)
                         goto discard;
+                /* Fall through */
 
         case RXRPC_PACKET_TYPE_DATA:
                 if (sp->hdr.callNumber == 0)
diff --git a/net/rxrpc/output.c b/net/rxrpc/output.c
index 71e6f713fbe7..f47659c7b224 100644
--- a/net/rxrpc/output.c
+++ b/net/rxrpc/output.c
@@ -35,7 +35,8 @@ struct rxrpc_abort_buffer {
 /*
  * Fill out an ACK packet.
  */
-static size_t rxrpc_fill_out_ack(struct rxrpc_call *call,
+static size_t rxrpc_fill_out_ack(struct rxrpc_connection *conn,
+                                 struct rxrpc_call *call,
                                  struct rxrpc_ack_buffer *pkt,
                                  rxrpc_seq_t *_hard_ack,
                                  rxrpc_seq_t *_top,
@@ -77,8 +78,8 @@ static size_t rxrpc_fill_out_ack(struct rxrpc_call *call,
                 } while (before_eq(seq, top));
         }
 
-        mtu = call->conn->params.peer->if_mtu;
-        mtu -= call->conn->params.peer->hdrsize;
+        mtu = conn->params.peer->if_mtu;
+        mtu -= conn->params.peer->hdrsize;
         jmax = (call->nr_jumbo_bad > 3) ? 1 : rxrpc_rx_jumbo_max;
         pkt->ackinfo.rxMTU      = htonl(rxrpc_rx_mtu);
         pkt->ackinfo.maxMTU     = htonl(mtu);
@@ -148,7 +149,7 @@ int rxrpc_send_ack_packet(struct rxrpc_call *call, bool ping)
                 }
                 call->ackr_reason = 0;
         }
-        n = rxrpc_fill_out_ack(call, pkt, &hard_ack, &top, reason);
+        n = rxrpc_fill_out_ack(conn, call, pkt, &hard_ack, &top, reason);
 
         spin_unlock_bh(&call->lock);
 
@@ -221,6 +222,16 @@ int rxrpc_send_abort_packet(struct rxrpc_call *call)
         rxrpc_serial_t serial;
         int ret;
 
+        /* Don't bother sending aborts for a client call once the server has
+         * hard-ACK'd all of its request data.  After that point, we're not
+         * going to stop the operation proceeding, and whilst we might limit
+         * the reply, it's not worth it if we can send a new call on the same
+         * channel instead, thereby closing off this call.
+         */
+        if (rxrpc_is_client_call(call) &&
+            test_bit(RXRPC_CALL_TX_LAST, &call->flags))
+                return 0;
+
         spin_lock_bh(&call->lock);
         if (call->conn)
                 conn = rxrpc_get_connection_maybe(call->conn);
diff --git a/net/rxrpc/peer_object.c b/net/rxrpc/peer_object.c
index 5787f97f5330..d02a99f37f5f 100644
--- a/net/rxrpc/peer_object.c
+++ b/net/rxrpc/peer_object.c
@@ -411,3 +411,16 @@ void rxrpc_kernel_get_peer(struct socket *sock, struct rxrpc_call *call,
         *_srx = call->peer->srx;
 }
 EXPORT_SYMBOL(rxrpc_kernel_get_peer);
+
+/**
+ * rxrpc_kernel_get_rtt - Get a call's peer RTT
+ * @sock: The socket on which the call is in progress.
+ * @call: The call to query
+ *
+ * Get the call's peer RTT.
+ */
+u64 rxrpc_kernel_get_rtt(struct socket *sock, struct rxrpc_call *call)
+{
+        return call->peer->rtt;
+}
+EXPORT_SYMBOL(rxrpc_kernel_get_rtt);
diff --git a/net/rxrpc/recvmsg.c b/net/rxrpc/recvmsg.c
index bdece21f313d..8510a98b87e1 100644
--- a/net/rxrpc/recvmsg.c
+++ b/net/rxrpc/recvmsg.c
@@ -40,7 +40,9 @@ void rxrpc_notify_socket(struct rxrpc_call *call)
         sk = &rx->sk;
         if (rx && sk->sk_state < RXRPC_CLOSE) {
                 if (call->notify_rx) {
+                        spin_lock_bh(&call->notify_lock);
                         call->notify_rx(sk, call, call->user_call_ID);
+                        spin_unlock_bh(&call->notify_lock);
                 } else {
                         write_lock_bh(&rx->recvmsg_lock);
                         if (list_empty(&call->recvmsg_link)) {
@@ -607,6 +609,7 @@ wait_error:
  * @_offset: The running offset into the buffer.
  * @want_more: True if more data is expected to be read
  * @_abort: Where the abort code is stored if -ECONNABORTED is returned
+ * @_service: Where to store the actual service ID (may be upgraded)
  *
  * Allow a kernel service to receive data and pick up information about the
  * state of a call.  Returns 0 if got what was asked for and there's more
@@ -624,7 +627,7 @@ wait_error:
  */
 int rxrpc_kernel_recv_data(struct socket *sock, struct rxrpc_call *call,
                            void *buf, size_t size, size_t *_offset,
-                           bool want_more, u32 *_abort)
+                           bool want_more, u32 *_abort, u16 *_service)
 {
         struct iov_iter iter;
         struct kvec iov;
@@ -680,6 +683,8 @@ int rxrpc_kernel_recv_data(struct socket *sock, struct rxrpc_call *call,
 read_phase_complete:
         ret = 1;
 out:
+        if (_service)
+                *_service = call->service_id;
         mutex_unlock(&call->user_mutex);
         _leave(" = %d [%zu,%d]", ret, *_offset, *_abort);
         return ret;
diff --git a/net/rxrpc/sendmsg.c b/net/rxrpc/sendmsg.c
index 9ea6f972767e..7d2595582c09 100644
--- a/net/rxrpc/sendmsg.c
+++ b/net/rxrpc/sendmsg.c
@@ -38,12 +38,86 @@ struct rxrpc_send_params {
 };
 
 /*
+ * Wait for space to appear in the Tx queue or a signal to occur.
+ */
+static int rxrpc_wait_for_tx_window_intr(struct rxrpc_sock *rx,
+                                         struct rxrpc_call *call,
+                                         long *timeo)
+{
+        for (;;) {
+                set_current_state(TASK_INTERRUPTIBLE);
+                if (call->tx_top - call->tx_hard_ack <
+                    min_t(unsigned int, call->tx_winsize,
+                          call->cong_cwnd + call->cong_extra))
+                        return 0;
+
+                if (call->state >= RXRPC_CALL_COMPLETE)
+                        return call->error;
+
+                if (signal_pending(current))
+                        return sock_intr_errno(*timeo);
+
+                trace_rxrpc_transmit(call, rxrpc_transmit_wait);
+                mutex_unlock(&call->user_mutex);
+                *timeo = schedule_timeout(*timeo);
+                if (mutex_lock_interruptible(&call->user_mutex) < 0)
+                        return sock_intr_errno(*timeo);
+        }
+}
+
+/*
+ * Wait for space to appear in the Tx queue uninterruptibly, but with
+ * a timeout of 2*RTT if no progress was made and a signal occurred.
+ */
+static int rxrpc_wait_for_tx_window_nonintr(struct rxrpc_sock *rx,
+                                            struct rxrpc_call *call)
+{
+        rxrpc_seq_t tx_start, tx_win;
+        signed long rtt2, timeout;
+        u64 rtt;
+
+        rtt = READ_ONCE(call->peer->rtt);
+        rtt2 = nsecs_to_jiffies64(rtt) * 2;
+        if (rtt2 < 1)
+                rtt2 = 1;
+
+        timeout = rtt2;
+        tx_start = READ_ONCE(call->tx_hard_ack);
+
+        for (;;) {
+                set_current_state(TASK_UNINTERRUPTIBLE);
+
+                tx_win = READ_ONCE(call->tx_hard_ack);
+                if (call->tx_top - tx_win <
+                    min_t(unsigned int, call->tx_winsize,
+                          call->cong_cwnd + call->cong_extra))
+                        return 0;
+
+                if (call->state >= RXRPC_CALL_COMPLETE)
+                        return call->error;
+
+                if (timeout == 0 &&
+                    tx_win == tx_start && signal_pending(current))
+                        return -EINTR;
+
+                if (tx_win != tx_start) {
+                        timeout = rtt2;
+                        tx_start = tx_win;
+                }
+
+                trace_rxrpc_transmit(call, rxrpc_transmit_wait);
+                timeout = schedule_timeout(timeout);
+        }
+}
+
+/*
  * wait for space to appear in the transmit/ACK window
  * - caller holds the socket locked
  */
 static int rxrpc_wait_for_tx_window(struct rxrpc_sock *rx,
                                     struct rxrpc_call *call,
-                                    long *timeo)
+                                    long *timeo,
+                                    bool waitall)
 {
         DECLARE_WAITQUEUE(myself, current);
         int ret;
@@ -53,30 +127,10 @@ static int rxrpc_wait_for_tx_window(struct rxrpc_sock *rx,
 
         add_wait_queue(&call->waitq, &myself);
 
-        for (;;) {
-                set_current_state(TASK_INTERRUPTIBLE);
-                ret = 0;
-                if (call->tx_top - call->tx_hard_ack <
-                    min_t(unsigned int, call->tx_winsize,
-                          call->cong_cwnd + call->cong_extra))
-                        break;
-                if (call->state >= RXRPC_CALL_COMPLETE) {
-                        ret = call->error;
-                        break;
-                }
-                if (signal_pending(current)) {
-                        ret = sock_intr_errno(*timeo);
-                        break;
-                }
-
-                trace_rxrpc_transmit(call, rxrpc_transmit_wait);
-                mutex_unlock(&call->user_mutex);
-                *timeo = schedule_timeout(*timeo);
-                if (mutex_lock_interruptible(&call->user_mutex) < 0) {
-                        ret = sock_intr_errno(*timeo);
-                        break;
-                }
-        }
+        if (waitall)
+                ret = rxrpc_wait_for_tx_window_nonintr(rx, call);
+        else
+                ret = rxrpc_wait_for_tx_window_intr(rx, call, timeo);
 
         remove_wait_queue(&call->waitq, &myself);
         set_current_state(TASK_RUNNING);
@@ -166,6 +220,7 @@ static void rxrpc_queue_packet(struct rxrpc_sock *rx, struct rxrpc_call *call,
                                           ktime_get_real());
                         if (!last)
                                 break;
+                        /* Fall through */
                 case RXRPC_CALL_SERVER_SEND_REPLY:
                         call->state = RXRPC_CALL_SERVER_AWAIT_ACK;
                         rxrpc_notify_end_tx(rx, call, notify_end_tx);
@@ -254,7 +309,8 @@ static int rxrpc_send_data(struct rxrpc_sock *rx,
                                 if (msg->msg_flags & MSG_DONTWAIT)
                                         goto maybe_error;
                                 ret = rxrpc_wait_for_tx_window(rx, call,
-                                                               &timeo);
+                                                               &timeo,
+                                                               msg->msg_flags & MSG_WAITALL);
                                 if (ret < 0)
                                         goto maybe_error;
                         }
diff --git a/net/sched/Kconfig b/net/sched/Kconfig
index e70ed26485a2..c03d86a7775e 100644
--- a/net/sched/Kconfig
+++ b/net/sched/Kconfig
@@ -172,6 +172,17 @@ config NET_SCH_TBF
           To compile this code as a module, choose M here: the
           module will be called sch_tbf.
 
+config NET_SCH_CBS
+        tristate "Credit Based Shaper (CBS)"
+        ---help---
+          Say Y here if you want to use the Credit Based Shaper (CBS) packet
+          scheduling algorithm.
+
+          See the top of <file:net/sched/sch_cbs.c> for more details.
+
+          To compile this code as a module, choose M here: the
+          module will be called sch_cbs.
+
 config NET_SCH_GRED
         tristate "Generic Random Early Detection (GRED)"
         ---help---
diff --git a/net/sched/Makefile b/net/sched/Makefile
index 9e43a4721ef8..5b635447e3f8 100644
--- a/net/sched/Makefile
+++ b/net/sched/Makefile
@@ -53,6 +53,7 @@ obj-$(CONFIG_NET_SCH_FQ_CODEL)	+= sch_fq_codel.o
 obj-$(CONFIG_NET_SCH_FQ)        += sch_fq.o
 obj-$(CONFIG_NET_SCH_HHF)       += sch_hhf.o
 obj-$(CONFIG_NET_SCH_PIE)       += sch_pie.o
+obj-$(CONFIG_NET_SCH_CBS)       += sch_cbs.o
 
 obj-$(CONFIG_NET_CLS_U32)       += cls_u32.o
 obj-$(CONFIG_NET_CLS_ROUTE4)    += cls_route.o
diff --git a/net/sched/act_api.c b/net/sched/act_api.c
index 8f2c63514956..4d33a50a8a6d 100644
--- a/net/sched/act_api.c
+++ b/net/sched/act_api.c
@@ -21,6 +21,8 @@
 #include <linux/kmod.h>
 #include <linux/err.h>
 #include <linux/module.h>
+#include <linux/rhashtable.h>
+#include <linux/list.h>
 #include <net/net_namespace.h>
 #include <net/sock.h>
 #include <net/sch_generic.h>
@@ -1251,8 +1253,227 @@ out_module_put:
         return skb->len;
 }
 
+struct tcf_action_net {
+        struct rhashtable egdev_ht;
+};
+
+static unsigned int tcf_action_net_id;
+
+struct tcf_action_egdev_cb {
+        struct list_head list;
+        tc_setup_cb_t *cb;
+        void *cb_priv;
+};
+
+struct tcf_action_egdev {
+        struct rhash_head ht_node;
+        const struct net_device *dev;
+        unsigned int refcnt;
+        struct list_head cb_list;
+};
+
+static const struct rhashtable_params tcf_action_egdev_ht_params = {
+        .key_offset = offsetof(struct tcf_action_egdev, dev),
+        .head_offset = offsetof(struct tcf_action_egdev, ht_node),
+        .key_len = sizeof(const struct net_device *),
+};
+
+static struct tcf_action_egdev *
+tcf_action_egdev_lookup(const struct net_device *dev)
+{
+        struct net *net = dev_net(dev);
+        struct tcf_action_net *tan = net_generic(net, tcf_action_net_id);
+
+        return rhashtable_lookup_fast(&tan->egdev_ht, &dev,
+                                      tcf_action_egdev_ht_params);
+}
+
+static struct tcf_action_egdev *
+tcf_action_egdev_get(const struct net_device *dev)
+{
+        struct tcf_action_egdev *egdev;
+        struct tcf_action_net *tan;
+
+        egdev = tcf_action_egdev_lookup(dev);
+        if (egdev)
+                goto inc_ref;
+
+        egdev = kzalloc(sizeof(*egdev), GFP_KERNEL);
+        if (!egdev)
+                return NULL;
+        INIT_LIST_HEAD(&egdev->cb_list);
+        egdev->dev = dev;
+        tan = net_generic(dev_net(dev), tcf_action_net_id);
+        rhashtable_insert_fast(&tan->egdev_ht, &egdev->ht_node,
+                               tcf_action_egdev_ht_params);
+
+inc_ref:
+        egdev->refcnt++;
+        return egdev;
+}
+
+static void tcf_action_egdev_put(struct tcf_action_egdev *egdev)
+{
+        struct tcf_action_net *tan;
+
+        if (--egdev->refcnt)
+                return;
+        tan = net_generic(dev_net(egdev->dev), tcf_action_net_id);
+        rhashtable_remove_fast(&tan->egdev_ht, &egdev->ht_node,
+                               tcf_action_egdev_ht_params);
+        kfree(egdev);
+}
+
+static struct tcf_action_egdev_cb *
+tcf_action_egdev_cb_lookup(struct tcf_action_egdev *egdev,
+                           tc_setup_cb_t *cb, void *cb_priv)
+{
+        struct tcf_action_egdev_cb *egdev_cb;
+
+        list_for_each_entry(egdev_cb, &egdev->cb_list, list)
+                if (egdev_cb->cb == cb && egdev_cb->cb_priv == cb_priv)
+                        return egdev_cb;
+        return NULL;
+}
+
+static int tcf_action_egdev_cb_call(struct tcf_action_egdev *egdev,
+                                    enum tc_setup_type type,
+                                    void *type_data, bool err_stop)
+{
+        struct tcf_action_egdev_cb *egdev_cb;
+        int ok_count = 0;
+        int err;
+
+        list_for_each_entry(egdev_cb, &egdev->cb_list, list) {
+                err = egdev_cb->cb(type, type_data, egdev_cb->cb_priv);
+                if (err) {
+                        if (err_stop)
+                                return err;
+                } else {
+                        ok_count++;
+                }
+        }
+        return ok_count;
+}
+
+static int tcf_action_egdev_cb_add(struct tcf_action_egdev *egdev,
+                                   tc_setup_cb_t *cb, void *cb_priv)
+{
+        struct tcf_action_egdev_cb *egdev_cb;
+
+        egdev_cb = tcf_action_egdev_cb_lookup(egdev, cb, cb_priv);
+        if (WARN_ON(egdev_cb))
+                return -EEXIST;
+        egdev_cb = kzalloc(sizeof(*egdev_cb), GFP_KERNEL);
+        if (!egdev_cb)
+                return -ENOMEM;
+        egdev_cb->cb = cb;
+        egdev_cb->cb_priv = cb_priv;
+        list_add(&egdev_cb->list, &egdev->cb_list);
+        return 0;
+}
+
+static void tcf_action_egdev_cb_del(struct tcf_action_egdev *egdev,
+                                    tc_setup_cb_t *cb, void *cb_priv)
+{
+        struct tcf_action_egdev_cb *egdev_cb;
+
+        egdev_cb = tcf_action_egdev_cb_lookup(egdev, cb, cb_priv);
+        if (WARN_ON(!egdev_cb))
+                return;
+        list_del(&egdev_cb->list);
+        kfree(egdev_cb);
+}
+
+static int __tc_setup_cb_egdev_register(const struct net_device *dev,
+                                        tc_setup_cb_t *cb, void *cb_priv)
+{
+        struct tcf_action_egdev *egdev = tcf_action_egdev_get(dev);
+        int err;
+
+        if (!egdev)
+                return -ENOMEM;
+        err = tcf_action_egdev_cb_add(egdev, cb, cb_priv);
+        if (err)
+                goto err_cb_add;
+        return 0;
+
+err_cb_add:
+        tcf_action_egdev_put(egdev);
+        return err;
+}
+int tc_setup_cb_egdev_register(const struct net_device *dev,
+                               tc_setup_cb_t *cb, void *cb_priv)
+{
+        int err;
+
+        rtnl_lock();
+        err = __tc_setup_cb_egdev_register(dev, cb, cb_priv);
+        rtnl_unlock();
+        return err;
+}
+EXPORT_SYMBOL_GPL(tc_setup_cb_egdev_register);
+
+static void __tc_setup_cb_egdev_unregister(const struct net_device *dev,
+                                           tc_setup_cb_t *cb, void *cb_priv)
+{
+        struct tcf_action_egdev *egdev = tcf_action_egdev_lookup(dev);
+
+        if (WARN_ON(!egdev))
+                return;
+        tcf_action_egdev_cb_del(egdev, cb, cb_priv);
+        tcf_action_egdev_put(egdev);
+}
+void tc_setup_cb_egdev_unregister(const struct net_device *dev,
+                                  tc_setup_cb_t *cb, void *cb_priv)
+{
+        rtnl_lock();
+        __tc_setup_cb_egdev_unregister(dev, cb, cb_priv);
+        rtnl_unlock();
+}
+EXPORT_SYMBOL_GPL(tc_setup_cb_egdev_unregister);
+
+int tc_setup_cb_egdev_call(const struct net_device *dev,
+                           enum tc_setup_type type, void *type_data,
+                           bool err_stop)
+{
+        struct tcf_action_egdev *egdev = tcf_action_egdev_lookup(dev);
+
+        if (!egdev)
+                return 0;
+        return tcf_action_egdev_cb_call(egdev, type, type_data, err_stop);
+}
+EXPORT_SYMBOL_GPL(tc_setup_cb_egdev_call);
+
+static __net_init int tcf_action_net_init(struct net *net)
+{
+        struct tcf_action_net *tan = net_generic(net, tcf_action_net_id);
+
+        return rhashtable_init(&tan->egdev_ht, &tcf_action_egdev_ht_params);
+}
+
+static void __net_exit tcf_action_net_exit(struct net *net)
+{
+        struct tcf_action_net *tan = net_generic(net, tcf_action_net_id);
+
+        rhashtable_destroy(&tan->egdev_ht);
+}
+
+static struct pernet_operations tcf_action_net_ops = {
+        .init = tcf_action_net_init,
+        .exit = tcf_action_net_exit,
+        .id = &tcf_action_net_id,
+        .size = sizeof(struct tcf_action_net),
+};
+
 static int __init tc_action_init(void)
 {
+        int err;
+
+        err = register_pernet_subsys(&tcf_action_net_ops);
+        if (err)
+                return err;
+
         rtnl_register(PF_UNSPEC, RTM_NEWACTION, tc_ctl_action, NULL, 0);
         rtnl_register(PF_UNSPEC, RTM_DELACTION, tc_ctl_action, NULL, 0);
         rtnl_register(PF_UNSPEC, RTM_GETACTION, tc_ctl_action, tc_dump_action,
diff --git a/net/sched/act_bpf.c b/net/sched/act_bpf.c
index c0c707eb2c96..5ef8ce8c83d4 100644
--- a/net/sched/act_bpf.c
+++ b/net/sched/act_bpf.c
@@ -49,11 +49,11 @@ static int tcf_bpf(struct sk_buff *skb, const struct tc_action *act,
         filter = rcu_dereference(prog->filter);
         if (at_ingress) {
                 __skb_push(skb, skb->mac_len);
-                bpf_compute_data_end(skb);
+                bpf_compute_data_pointers(skb);
                 filter_res = BPF_PROG_RUN(filter, skb);
                 __skb_pull(skb, skb->mac_len);
         } else {
-                bpf_compute_data_end(skb);
+                bpf_compute_data_pointers(skb);
                 filter_res = BPF_PROG_RUN(filter, skb);
         }
         rcu_read_unlock();
diff --git a/net/sched/act_ife.c b/net/sched/act_ife.c
index 8ccd35825b6b..3007cb1310ea 100644
--- a/net/sched/act_ife.c
+++ b/net/sched/act_ife.c
@@ -248,6 +248,22 @@ static int ife_validate_metatype(struct tcf_meta_ops *ops, void *val, int len)
         return ret;
 }
 
+#ifdef CONFIG_MODULES
+static const char *ife_meta_id2name(u32 metaid)
+{
+        switch (metaid) {
+        case IFE_META_SKBMARK:
+                return "skbmark";
+        case IFE_META_PRIO:
+                return "skbprio";
+        case IFE_META_TCINDEX:
+                return "tcindex";
+        default:
+                return "unknown";
+        }
+}
+#endif
+
 /* called when adding new meta information
  * under ife->tcf_lock for existing action
 */
@@ -263,7 +279,7 @@ static int load_metaops_and_vet(struct tcf_ife_info *ife, u32 metaid,
                 if (exists)
                         spin_unlock_bh(&ife->tcf_lock);
                 rtnl_unlock();
-                request_module("ifemeta%u", metaid);
+                request_module("ife-meta-%s", ife_meta_id2name(metaid));
                 rtnl_lock();
                 if (exists)
                         spin_lock_bh(&ife->tcf_lock);
@@ -392,10 +408,14 @@ static void _tcf_ife_cleanup(struct tc_action *a, int bind)
 static void tcf_ife_cleanup(struct tc_action *a, int bind)
 {
         struct tcf_ife_info *ife = to_ife(a);
+        struct tcf_ife_params *p;
 
         spin_lock_bh(&ife->tcf_lock);
         _tcf_ife_cleanup(a, bind);
         spin_unlock_bh(&ife->tcf_lock);
+
+        p = rcu_dereference_protected(ife->params, 1);
+        kfree_rcu(p, rcu);
 }
 
 /* under ife->tcf_lock for existing action */
@@ -432,6 +452,7 @@ static int tcf_ife_init(struct net *net, struct nlattr *nla,
         struct tc_action_net *tn = net_generic(net, ife_net_id);
         struct nlattr *tb[TCA_IFE_MAX + 1];
         struct nlattr *tb2[IFE_META_MAX + 1];
+        struct tcf_ife_params *p, *p_old;
         struct tcf_ife_info *ife;
         u16 ife_type = ETH_P_IFE;
         struct tc_ife *parm;
@@ -450,24 +471,41 @@ static int tcf_ife_init(struct net *net, struct nlattr *nla,
 
         parm = nla_data(tb[TCA_IFE_PARMS]);
 
+        /* IFE_DECODE is 0 and indicates the opposite of IFE_ENCODE because
+         * they cannot run as the same time. Check on all other values which
+         * are not supported right now.
+         */
+        if (parm->flags & ~IFE_ENCODE)
+                return -EINVAL;
+
+        p = kzalloc(sizeof(*p), GFP_KERNEL);
+        if (!p)
+                return -ENOMEM;
+
         exists = tcf_idr_check(tn, parm->index, a, bind);
-        if (exists && bind)
+        if (exists && bind) {
+                kfree(p);
                 return 0;
+        }
 
         if (!exists) {
                 ret = tcf_idr_create(tn, parm->index, est, a, &act_ife_ops,
-                                     bind, false);
-                if (ret)
+                                     bind, true);
+                if (ret) {
+                        kfree(p);
                         return ret;
+                }
                 ret = ACT_P_CREATED;
         } else {
                 tcf_idr_release(*a, bind);
-                if (!ovr)
+                if (!ovr) {
+                        kfree(p);
                         return -EEXIST;
+                }
         }
 
         ife = to_ife(*a);
-        ife->flags = parm->flags;
+        p->flags = parm->flags;
 
         if (parm->flags & IFE_ENCODE) {
                 if (tb[TCA_IFE_TYPE])
@@ -478,24 +516,25 @@ static int tcf_ife_init(struct net *net, struct nlattr *nla,
                         saddr = nla_data(tb[TCA_IFE_SMAC]);
         }
 
-        if (exists)
-                spin_lock_bh(&ife->tcf_lock);
         ife->tcf_action = parm->action;
 
         if (parm->flags & IFE_ENCODE) {
                 if (daddr)
-                        ether_addr_copy(ife->eth_dst, daddr);
+                        ether_addr_copy(p->eth_dst, daddr);
                 else
-                        eth_zero_addr(ife->eth_dst);
+                        eth_zero_addr(p->eth_dst);
 
                 if (saddr)
-                        ether_addr_copy(ife->eth_src, saddr);
+                        ether_addr_copy(p->eth_src, saddr);
                 else
-                        eth_zero_addr(ife->eth_src);
+                        eth_zero_addr(p->eth_src);
 
-                ife->eth_type = ife_type;
+                p->eth_type = ife_type;
         }
 
+        if (exists)
+                spin_lock_bh(&ife->tcf_lock);
+
         if (ret == ACT_P_CREATED)
                 INIT_LIST_HEAD(&ife->metalist);
 
@@ -511,6 +550,7 @@ metadata_parse_err:
 
                         if (exists)
                                 spin_unlock_bh(&ife->tcf_lock);
+                        kfree(p);
                         return err;
                 }
 
@@ -531,6 +571,7 @@ metadata_parse_err:
 
                         if (exists)
                                 spin_unlock_bh(&ife->tcf_lock);
+                        kfree(p);
                         return err;
                 }
         }
@@ -538,6 +579,11 @@ metadata_parse_err:
         if (exists)
                 spin_unlock_bh(&ife->tcf_lock);
 
+        p_old = rtnl_dereference(ife->params);
+        rcu_assign_pointer(ife->params, p);
+        if (p_old)
+                kfree_rcu(p_old, rcu);
+
         if (ret == ACT_P_CREATED)
                 tcf_idr_insert(tn, *a);
 
@@ -549,12 +595,13 @@ static int tcf_ife_dump(struct sk_buff *skb, struct tc_action *a, int bind,
 {
         unsigned char *b = skb_tail_pointer(skb);
         struct tcf_ife_info *ife = to_ife(a);
+        struct tcf_ife_params *p = rtnl_dereference(ife->params);
         struct tc_ife opt = {
                 .index = ife->tcf_index,
                 .refcnt = ife->tcf_refcnt - ref,
                 .bindcnt = ife->tcf_bindcnt - bind,
                 .action = ife->tcf_action,
-                .flags = ife->flags,
+                .flags = p->flags,
         };
         struct tcf_t t;
 
@@ -565,17 +612,17 @@ static int tcf_ife_dump(struct sk_buff *skb, struct tc_action *a, int bind,
         if (nla_put_64bit(skb, TCA_IFE_TM, sizeof(t), &t, TCA_IFE_PAD))
                 goto nla_put_failure;
 
-        if (!is_zero_ether_addr(ife->eth_dst)) {
-                if (nla_put(skb, TCA_IFE_DMAC, ETH_ALEN, ife->eth_dst))
+        if (!is_zero_ether_addr(p->eth_dst)) {
+                if (nla_put(skb, TCA_IFE_DMAC, ETH_ALEN, p->eth_dst))
                         goto nla_put_failure;
         }
 
-        if (!is_zero_ether_addr(ife->eth_src)) {
-                if (nla_put(skb, TCA_IFE_SMAC, ETH_ALEN, ife->eth_src))
+        if (!is_zero_ether_addr(p->eth_src)) {
+                if (nla_put(skb, TCA_IFE_SMAC, ETH_ALEN, p->eth_src))
                         goto nla_put_failure;
         }
 
-        if (nla_put(skb, TCA_IFE_TYPE, 2, &ife->eth_type))
+        if (nla_put(skb, TCA_IFE_TYPE, 2, &p->eth_type))
                 goto nla_put_failure;
 
         if (dump_metalist(skb, ife)) {
@@ -617,19 +664,15 @@ static int tcf_ife_decode(struct sk_buff *skb, const struct tc_action *a,
         u8 *tlv_data;
         u16 metalen;
 
-        spin_lock(&ife->tcf_lock);
-        bstats_update(&ife->tcf_bstats, skb);
+        bstats_cpu_update(this_cpu_ptr(ife->common.cpu_bstats), skb);
         tcf_lastuse_update(&ife->tcf_tm);
-        spin_unlock(&ife->tcf_lock);
 
         if (skb_at_tc_ingress(skb))
                 skb_push(skb, skb->dev->hard_header_len);
 
         tlv_data = ife_decode(skb, &metalen);
         if (unlikely(!tlv_data)) {
-                spin_lock(&ife->tcf_lock);
-                ife->tcf_qstats.drops++;
-                spin_unlock(&ife->tcf_lock);
+                qstats_drop_inc(this_cpu_ptr(ife->common.cpu_qstats));
                 return TC_ACT_SHOT;
         }
 
@@ -647,14 +690,12 @@ static int tcf_ife_decode(struct sk_buff *skb, const struct tc_action *a,
                          */
                         pr_info_ratelimited("Unknown metaid %d dlen %d\n",
                                             mtype, dlen);
-                        ife->tcf_qstats.overlimits++;
+                        qstats_overlimit_inc(this_cpu_ptr(ife->common.cpu_qstats));
                 }
         }
 
         if (WARN_ON(tlv_data != ifehdr_end)) {
-                spin_lock(&ife->tcf_lock);
-                ife->tcf_qstats.drops++;
-                spin_unlock(&ife->tcf_lock);
+                qstats_drop_inc(this_cpu_ptr(ife->common.cpu_qstats));
                 return TC_ACT_SHOT;
         }
 
@@ -683,7 +724,7 @@ static int ife_get_sz(struct sk_buff *skb, struct tcf_ife_info *ife)
 }
 
 static int tcf_ife_encode(struct sk_buff *skb, const struct tc_action *a,
-                          struct tcf_result *res)
+                          struct tcf_result *res, struct tcf_ife_params *p)
 {
         struct tcf_ife_info *ife = to_ife(a);
         int action = ife->tcf_action;
@@ -706,23 +747,20 @@ static int tcf_ife_encode(struct sk_buff *skb, const struct tc_action *a,
                         exceed_mtu = true;
         }
 
-        spin_lock(&ife->tcf_lock);
-        bstats_update(&ife->tcf_bstats, skb);
+        bstats_cpu_update(this_cpu_ptr(ife->common.cpu_bstats), skb);
         tcf_lastuse_update(&ife->tcf_tm);
 
         if (!metalen) {         /* no metadata to send */
                 /* abuse overlimits to count when we allow packet
                  * with no metadata
                  */
-                ife->tcf_qstats.overlimits++;
-                spin_unlock(&ife->tcf_lock);
+                qstats_overlimit_inc(this_cpu_ptr(ife->common.cpu_qstats));
                 return action;
         }
         /* could be stupid policy setup or mtu config
          * so lets be conservative.. */
         if ((action == TC_ACT_SHOT) || exceed_mtu) {
-                ife->tcf_qstats.drops++;
-                spin_unlock(&ife->tcf_lock);
+                qstats_drop_inc(this_cpu_ptr(ife->common.cpu_qstats));
                 return TC_ACT_SHOT;
         }
 
@@ -731,6 +769,8 @@ static int tcf_ife_encode(struct sk_buff *skb, const struct tc_action *a,
 
         ife_meta = ife_encode(skb, metalen);
 
+        spin_lock(&ife->tcf_lock);
+
         /* XXX: we dont have a clever way of telling encode to
          * not repeat some of the computations that are done by
          * ops->presence_check...
@@ -742,25 +782,24 @@ static int tcf_ife_encode(struct sk_buff *skb, const struct tc_action *a,
                 }
                 if (err < 0) {
                         /* too corrupt to keep around if overwritten */
-                        ife->tcf_qstats.drops++;
                         spin_unlock(&ife->tcf_lock);
+                        qstats_drop_inc(this_cpu_ptr(ife->common.cpu_qstats));
                         return TC_ACT_SHOT;
                 }
                 skboff += err;
         }
+        spin_unlock(&ife->tcf_lock);
         oethh = (struct ethhdr *)skb->data;
 
-        if (!is_zero_ether_addr(ife->eth_src))
-                ether_addr_copy(oethh->h_source, ife->eth_src);
-        if (!is_zero_ether_addr(ife->eth_dst))
-                ether_addr_copy(oethh->h_dest, ife->eth_dst);
-        oethh->h_proto = htons(ife->eth_type);
+        if (!is_zero_ether_addr(p->eth_src))
+                ether_addr_copy(oethh->h_source, p->eth_src);
+        if (!is_zero_ether_addr(p->eth_dst))
+                ether_addr_copy(oethh->h_dest, p->eth_dst);
+        oethh->h_proto = htons(p->eth_type);
 
         if (skb_at_tc_ingress(skb))
                 skb_pull(skb, skb->dev->hard_header_len);
 
-        spin_unlock(&ife->tcf_lock);
-
         return action;
 }
 
@@ -768,21 +807,19 @@ static int tcf_ife_act(struct sk_buff *skb, const struct tc_action *a,
                        struct tcf_result *res)
 {
         struct tcf_ife_info *ife = to_ife(a);
+        struct tcf_ife_params *p;
+        int ret;
+
+        rcu_read_lock();
+        p = rcu_dereference(ife->params);
+        if (p->flags & IFE_ENCODE) {
+                ret = tcf_ife_encode(skb, a, res, p);
+                rcu_read_unlock();
+                return ret;
+        }
+        rcu_read_unlock();
 
-        if (ife->flags & IFE_ENCODE)
-                return tcf_ife_encode(skb, a, res);
-
-        if (!(ife->flags & IFE_ENCODE))
-                return tcf_ife_decode(skb, a, res);
-
-        pr_info_ratelimited("unknown failure(policy neither de/encode\n");
-        spin_lock(&ife->tcf_lock);
-        bstats_update(&ife->tcf_bstats, skb);
-        tcf_lastuse_update(&ife->tcf_tm);
-        ife->tcf_qstats.drops++;
-        spin_unlock(&ife->tcf_lock);
-
-        return TC_ACT_SHOT;
+        return tcf_ife_decode(skb, a, res);
 }
 
 static int tcf_ife_walker(struct net *net, struct sk_buff *skb,
diff --git a/net/sched/act_meta_mark.c b/net/sched/act_meta_mark.c
index 82892170ce4f..1e3f10e5da99 100644
--- a/net/sched/act_meta_mark.c
+++ b/net/sched/act_meta_mark.c
@@ -76,4 +76,4 @@ module_exit(ifemark_cleanup_module);
 MODULE_AUTHOR("Jamal Hadi Salim(2015)");
 MODULE_DESCRIPTION("Inter-FE skb mark metadata module");
 MODULE_LICENSE("GPL");
-MODULE_ALIAS_IFE_META(IFE_META_SKBMARK);
+MODULE_ALIAS_IFE_META("skbmark");
diff --git a/net/sched/act_meta_skbprio.c b/net/sched/act_meta_skbprio.c
index 26bf4d86030b..4033f9fc4d4a 100644
--- a/net/sched/act_meta_skbprio.c
+++ b/net/sched/act_meta_skbprio.c
@@ -73,4 +73,4 @@ module_exit(ifeprio_cleanup_module);
 MODULE_AUTHOR("Jamal Hadi Salim(2015)");
 MODULE_DESCRIPTION("Inter-FE skb prio metadata action");
 MODULE_LICENSE("GPL");
-MODULE_ALIAS_IFE_META(IFE_META_PRIO);
+MODULE_ALIAS_IFE_META("skbprio");
diff --git a/net/sched/act_meta_skbtcindex.c b/net/sched/act_meta_skbtcindex.c
index 3b35774ce890..2ea1f26c9e96 100644
--- a/net/sched/act_meta_skbtcindex.c
+++ b/net/sched/act_meta_skbtcindex.c
@@ -76,4 +76,4 @@ module_exit(ifetc_index_cleanup_module);
 MODULE_AUTHOR("Jamal Hadi Salim(2016)");
 MODULE_DESCRIPTION("Inter-FE skb tc_index metadata module");
 MODULE_LICENSE("GPL");
-MODULE_ALIAS_IFE_META(IFE_META_SKBTCINDEX);
+MODULE_ALIAS_IFE_META("tcindex");
diff --git a/net/sched/act_mirred.c b/net/sched/act_mirred.c
index 416627c66f08..8b3e59388480 100644
--- a/net/sched/act_mirred.c
+++ b/net/sched/act_mirred.c
@@ -140,6 +140,7 @@ static int tcf_mirred_init(struct net *net, struct nlattr *nla,
         m->tcfm_eaction = parm->eaction;
         if (dev != NULL) {
                 m->tcfm_ifindex = parm->ifindex;
+                m->net = net;
                 if (ret != ACT_P_CREATED)
                         dev_put(rcu_dereference_protected(m->tcfm_dev, 1));
                 dev_hold(dev);
@@ -313,15 +314,11 @@ static struct notifier_block mirred_device_notifier = {
         .notifier_call = mirred_device_event,
 };
 
-static int tcf_mirred_device(const struct tc_action *a, struct net *net,
-                             struct net_device **mirred_dev)
+static struct net_device *tcf_mirred_get_dev(const struct tc_action *a)
 {
-        int ifindex = tcf_mirred_ifindex(a);
+        struct tcf_mirred *m = to_mirred(a);
 
-        *mirred_dev = __dev_get_by_index(net, ifindex);
-        if (!*mirred_dev)
-                return -EINVAL;
-        return 0;
+        return __dev_get_by_index(m->net, m->tcfm_ifindex);
 }
 
 static struct tc_action_ops act_mirred_ops = {
@@ -336,7 +333,7 @@ static struct tc_action_ops act_mirred_ops = {
         .walk           =       tcf_mirred_walker,
         .lookup         =       tcf_mirred_search,
         .size           =       sizeof(struct tcf_mirred),
-        .get_dev        =       tcf_mirred_device,
+        .get_dev        =       tcf_mirred_get_dev,
 };
 
 static __net_init int mirred_init_net(struct net *net)
diff --git a/net/sched/act_vlan.c b/net/sched/act_vlan.c
index 16eb067a8d8f..97f717a13ad5 100644
--- a/net/sched/act_vlan.c
+++ b/net/sched/act_vlan.c
@@ -26,14 +26,13 @@ static int tcf_vlan(struct sk_buff *skb, const struct tc_action *a,
                     struct tcf_result *res)
 {
         struct tcf_vlan *v = to_vlan(a);
+        struct tcf_vlan_params *p;
         int action;
         int err;
         u16 tci;
 
-        spin_lock(&v->tcf_lock);
         tcf_lastuse_update(&v->tcf_tm);
-        bstats_update(&v->tcf_bstats, skb);
-        action = v->tcf_action;
+        bstats_cpu_update(this_cpu_ptr(v->common.cpu_bstats), skb);
 
         /* Ensure 'data' points at mac_header prior calling vlan manipulating
          * functions.
@@ -41,15 +40,21 @@ static int tcf_vlan(struct sk_buff *skb, const struct tc_action *a,
         if (skb_at_tc_ingress(skb))
                 skb_push_rcsum(skb, skb->mac_len);
 
-        switch (v->tcfv_action) {
+        rcu_read_lock();
+
+        action = READ_ONCE(v->tcf_action);
+
+        p = rcu_dereference(v->vlan_p);
+
+        switch (p->tcfv_action) {
         case TCA_VLAN_ACT_POP:
                 err = skb_vlan_pop(skb);
                 if (err)
                         goto drop;
                 break;
         case TCA_VLAN_ACT_PUSH:
-                err = skb_vlan_push(skb, v->tcfv_push_proto, v->tcfv_push_vid |
-                                    (v->tcfv_push_prio << VLAN_PRIO_SHIFT));
+                err = skb_vlan_push(skb, p->tcfv_push_proto, p->tcfv_push_vid |
+                                    (p->tcfv_push_prio << VLAN_PRIO_SHIFT));
                 if (err)
                         goto drop;
                 break;
@@ -68,14 +73,14 @@ static int tcf_vlan(struct sk_buff *skb, const struct tc_action *a,
                                 goto drop;
                 }
                 /* replace the vid */
-                tci = (tci & ~VLAN_VID_MASK) | v->tcfv_push_vid;
+                tci = (tci & ~VLAN_VID_MASK) | p->tcfv_push_vid;
                 /* replace prio bits, if tcfv_push_prio specified */
-                if (v->tcfv_push_prio) {
+                if (p->tcfv_push_prio) {
                         tci &= ~VLAN_PRIO_MASK;
-                        tci |= v->tcfv_push_prio << VLAN_PRIO_SHIFT;
+                        tci |= p->tcfv_push_prio << VLAN_PRIO_SHIFT;
                 }
                 /* put updated tci as hwaccel tag */
-                __vlan_hwaccel_put_tag(skb, v->tcfv_push_proto, tci);
+                __vlan_hwaccel_put_tag(skb, p->tcfv_push_proto, tci);
                 break;
         default:
                 BUG();
@@ -85,12 +90,13 @@ static int tcf_vlan(struct sk_buff *skb, const struct tc_action *a,
 
 drop:
         action = TC_ACT_SHOT;
-        v->tcf_qstats.drops++;
+        qstats_drop_inc(this_cpu_ptr(v->common.cpu_qstats));
+
 unlock:
+        rcu_read_unlock();
         if (skb_at_tc_ingress(skb))
                 skb_pull_rcsum(skb, skb->mac_len);
 
-        spin_unlock(&v->tcf_lock);
         return action;
 }
 
@@ -107,6 +113,7 @@ static int tcf_vlan_init(struct net *net, struct nlattr *nla,
 {
         struct tc_action_net *tn = net_generic(net, vlan_net_id);
         struct nlattr *tb[TCA_VLAN_MAX + 1];
+        struct tcf_vlan_params *p, *p_old;
         struct tc_vlan *parm;
         struct tcf_vlan *v;
         int action;
@@ -172,7 +179,7 @@ static int tcf_vlan_init(struct net *net, struct nlattr *nla,
 
         if (!exists) {
                 ret = tcf_idr_create(tn, parm->index, est, a,
-                                     &act_vlan_ops, bind, false);
+                                     &act_vlan_ops, bind, true);
                 if (ret)
                         return ret;
 
@@ -185,46 +192,67 @@ static int tcf_vlan_init(struct net *net, struct nlattr *nla,
 
         v = to_vlan(*a);
 
-        spin_lock_bh(&v->tcf_lock);
-
-        v->tcfv_action = action;
-        v->tcfv_push_vid = push_vid;
-        v->tcfv_push_prio = push_prio;
-        v->tcfv_push_proto = push_proto;
+        ASSERT_RTNL();
+        p = kzalloc(sizeof(*p), GFP_KERNEL);
+        if (!p) {
+                if (ovr)
+                        tcf_idr_release(*a, bind);
+                return -ENOMEM;
+        }
 
         v->tcf_action = parm->action;
 
-        spin_unlock_bh(&v->tcf_lock);
+        p_old = rtnl_dereference(v->vlan_p);
+
+        p->tcfv_action = action;
+        p->tcfv_push_vid = push_vid;
+        p->tcfv_push_prio = push_prio;
+        p->tcfv_push_proto = push_proto;
+
+        rcu_assign_pointer(v->vlan_p, p);
+
+        if (p_old)
+                kfree_rcu(p_old, rcu);
 
         if (ret == ACT_P_CREATED)
                 tcf_idr_insert(tn, *a);
         return ret;
 }
 
+static void tcf_vlan_cleanup(struct tc_action *a, int bind)
+{
+        struct tcf_vlan *v = to_vlan(a);
+        struct tcf_vlan_params *p;
+
+        p = rcu_dereference_protected(v->vlan_p, 1);
+        kfree_rcu(p, rcu);
+}
+
 static int tcf_vlan_dump(struct sk_buff *skb, struct tc_action *a,
                          int bind, int ref)
 {
         unsigned char *b = skb_tail_pointer(skb);
         struct tcf_vlan *v = to_vlan(a);
+        struct tcf_vlan_params *p = rtnl_dereference(v->vlan_p);
         struct tc_vlan opt = {
                 .index    = v->tcf_index,
                 .refcnt   = v->tcf_refcnt - ref,
                 .bindcnt  = v->tcf_bindcnt - bind,
                 .action   = v->tcf_action,
-                .v_action = v->tcfv_action,
+                .v_action = p->tcfv_action,
         };
         struct tcf_t t;
 
         if (nla_put(skb, TCA_VLAN_PARMS, sizeof(opt), &opt))
                 goto nla_put_failure;
 
-        if ((v->tcfv_action == TCA_VLAN_ACT_PUSH ||
-             v->tcfv_action == TCA_VLAN_ACT_MODIFY) &&
-            (nla_put_u16(skb, TCA_VLAN_PUSH_VLAN_ID, v->tcfv_push_vid) ||
+        if ((p->tcfv_action == TCA_VLAN_ACT_PUSH ||
+             p->tcfv_action == TCA_VLAN_ACT_MODIFY) &&
+            (nla_put_u16(skb, TCA_VLAN_PUSH_VLAN_ID, p->tcfv_push_vid) ||
              nla_put_be16(skb, TCA_VLAN_PUSH_VLAN_PROTOCOL,
-                          v->tcfv_push_proto) ||
+                          p->tcfv_push_proto) ||
              (nla_put_u8(skb, TCA_VLAN_PUSH_VLAN_PRIORITY,
-                                              v->tcfv_push_prio))))
+                                              p->tcfv_push_prio))))
                 goto nla_put_failure;
 
         tcf_tm_dump(&t, &v->tcf_tm);
@@ -260,6 +288,7 @@ static struct tc_action_ops act_vlan_ops = {
         .act            =       tcf_vlan,
         .dump           =       tcf_vlan_dump,
         .init           =       tcf_vlan_init,
+        .cleanup        =       tcf_vlan_cleanup,
         .walk           =       tcf_vlan_walker,
         .lookup         =       tcf_vlan_search,
         .size           =       sizeof(struct tcf_vlan),
diff --git a/net/sched/cls_api.c b/net/sched/cls_api.c
index ecbb019efcbd..ab255b421781 100644
--- a/net/sched/cls_api.c
+++ b/net/sched/cls_api.c
@@ -195,12 +195,19 @@ static struct tcf_chain *tcf_chain_create(struct tcf_block *block,
         return chain;
 }
 
+static void tcf_chain_head_change(struct tcf_chain *chain,
+                                  struct tcf_proto *tp_head)
+{
+        if (chain->chain_head_change)
+                chain->chain_head_change(tp_head,
+                                         chain->chain_head_change_priv);
+}
+
 static void tcf_chain_flush(struct tcf_chain *chain)
 {
         struct tcf_proto *tp;
 
-        if (chain->p_filter_chain)
-                RCU_INIT_POINTER(*chain->p_filter_chain, NULL);
+        tcf_chain_head_change(chain, NULL);
         while ((tp = rtnl_dereference(chain->filter_chain)) != NULL) {
                 RCU_INIT_POINTER(chain->filter_chain, tp->next);
                 tcf_chain_put(chain);
@@ -242,15 +249,35 @@ void tcf_chain_put(struct tcf_chain *chain)
 }
 EXPORT_SYMBOL(tcf_chain_put);
 
-static void
-tcf_chain_filter_chain_ptr_set(struct tcf_chain *chain,
-                               struct tcf_proto __rcu **p_filter_chain)
+static void tcf_block_offload_cmd(struct tcf_block *block, struct Qdisc *q,
+                                  struct tcf_block_ext_info *ei,
+                                  enum tc_block_command command)
 {
-        chain->p_filter_chain = p_filter_chain;
+        struct net_device *dev = q->dev_queue->dev;
+        struct tc_block_offload bo = {};
+
+        if (!dev->netdev_ops->ndo_setup_tc)
+                return;
+        bo.command = command;
+        bo.binder_type = ei->binder_type;
+        bo.block = block;
+        dev->netdev_ops->ndo_setup_tc(dev, TC_SETUP_BLOCK, &bo);
 }
 
-int tcf_block_get(struct tcf_block **p_block,
-                  struct tcf_proto __rcu **p_filter_chain)
+static void tcf_block_offload_bind(struct tcf_block *block, struct Qdisc *q,
+                                   struct tcf_block_ext_info *ei)
+{
+        tcf_block_offload_cmd(block, q, ei, TC_BLOCK_BIND);
+}
+
+static void tcf_block_offload_unbind(struct tcf_block *block, struct Qdisc *q,
+                                     struct tcf_block_ext_info *ei)
+{
+        tcf_block_offload_cmd(block, q, ei, TC_BLOCK_UNBIND);
+}
+
+int tcf_block_get_ext(struct tcf_block **p_block, struct Qdisc *q,
+                      struct tcf_block_ext_info *ei)
 {
         struct tcf_block *block = kzalloc(sizeof(*block), GFP_KERNEL);
         struct tcf_chain *chain;
@@ -259,13 +286,20 @@ int tcf_block_get(struct tcf_block **p_block,
         if (!block)
                 return -ENOMEM;
         INIT_LIST_HEAD(&block->chain_list);
+        INIT_LIST_HEAD(&block->cb_list);
+
         /* Create chain 0 by default, it has to be always present. */
         chain = tcf_chain_create(block, 0);
         if (!chain) {
                 err = -ENOMEM;
                 goto err_chain_create;
         }
-        tcf_chain_filter_chain_ptr_set(chain, p_filter_chain);
+        WARN_ON(!ei->chain_head_change);
+        chain->chain_head_change = ei->chain_head_change;
+        chain->chain_head_change_priv = ei->chain_head_change_priv;
+        block->net = qdisc_net(q);
+        block->q = q;
+        tcf_block_offload_bind(block, q, ei);
         *p_block = block;
         return 0;
 
@@ -273,6 +307,26 @@ err_chain_create:
         kfree(block);
         return err;
 }
+EXPORT_SYMBOL(tcf_block_get_ext);
+
+static void tcf_chain_head_change_dflt(struct tcf_proto *tp_head, void *priv)
+{
+        struct tcf_proto __rcu **p_filter_chain = priv;
+
+        rcu_assign_pointer(*p_filter_chain, tp_head);
+}
+
+int tcf_block_get(struct tcf_block **p_block,
+                  struct tcf_proto __rcu **p_filter_chain, struct Qdisc *q)
+{
+        struct tcf_block_ext_info ei = {
+                .chain_head_change = tcf_chain_head_change_dflt,
+                .chain_head_change_priv = p_filter_chain,
+        };
+
+        WARN_ON(!p_filter_chain);
+        return tcf_block_get_ext(p_block, q, &ei);
+}
 EXPORT_SYMBOL(tcf_block_get);
 
 static void tcf_block_put_final(struct work_struct *work)
@@ -292,25 +346,140 @@ static void tcf_block_put_final(struct work_struct *work)
  * actions should be all removed after flushing. However, filters are now
  * destroyed in tc filter workqueue with RTNL lock, they can not race here.
  */
-void tcf_block_put(struct tcf_block *block)
+void tcf_block_put_ext(struct tcf_block *block, struct Qdisc *q,
+                       struct tcf_block_ext_info *ei)
 {
         struct tcf_chain *chain, *tmp;
 
-        if (!block)
-                return;
-
         list_for_each_entry_safe(chain, tmp, &block->chain_list, list)
                 tcf_chain_flush(chain);
 
+        tcf_block_offload_unbind(block, q, ei);
+
         INIT_WORK(&block->work, tcf_block_put_final);
-        /* Wait for RCU callbacks to release the reference count and make
-         * sure their works have been queued before this.
+        /* Wait for existing RCU callbacks to cool down, make sure their works
+         * have been queued before this. We can not flush pending works here
+         * because we are holding the RTNL lock.
          */
         rcu_barrier();
         tcf_queue_work(&block->work);
 }
+EXPORT_SYMBOL(tcf_block_put_ext);
+
+void tcf_block_put(struct tcf_block *block)
+{
+        struct tcf_block_ext_info ei = {0, };
+
+        if (!block)
+                return;
+        tcf_block_put_ext(block, block->q, &ei);
+}
+
 EXPORT_SYMBOL(tcf_block_put);
 
+struct tcf_block_cb {
+        struct list_head list;
+        tc_setup_cb_t *cb;
+        void *cb_ident;
+        void *cb_priv;
+        unsigned int refcnt;
+};
+
+void *tcf_block_cb_priv(struct tcf_block_cb *block_cb)
+{
+        return block_cb->cb_priv;
+}
+EXPORT_SYMBOL(tcf_block_cb_priv);
+
+struct tcf_block_cb *tcf_block_cb_lookup(struct tcf_block *block,
+                                         tc_setup_cb_t *cb, void *cb_ident)
+{       struct tcf_block_cb *block_cb;
+
+        list_for_each_entry(block_cb, &block->cb_list, list)
+                if (block_cb->cb == cb && block_cb->cb_ident == cb_ident)
+                        return block_cb;
+        return NULL;
+}
+EXPORT_SYMBOL(tcf_block_cb_lookup);
+
+void tcf_block_cb_incref(struct tcf_block_cb *block_cb)
+{
+        block_cb->refcnt++;
+}
+EXPORT_SYMBOL(tcf_block_cb_incref);
+
+unsigned int tcf_block_cb_decref(struct tcf_block_cb *block_cb)
+{
+        return --block_cb->refcnt;
+}
+EXPORT_SYMBOL(tcf_block_cb_decref);
+
+struct tcf_block_cb *__tcf_block_cb_register(struct tcf_block *block,
+                                             tc_setup_cb_t *cb, void *cb_ident,
+                                             void *cb_priv)
+{
+        struct tcf_block_cb *block_cb;
+
+        block_cb = kzalloc(sizeof(*block_cb), GFP_KERNEL);
+        if (!block_cb)
+                return NULL;
+        block_cb->cb = cb;
+        block_cb->cb_ident = cb_ident;
+        block_cb->cb_priv = cb_priv;
+        list_add(&block_cb->list, &block->cb_list);
+        return block_cb;
+}
+EXPORT_SYMBOL(__tcf_block_cb_register);
+
+int tcf_block_cb_register(struct tcf_block *block,
+                          tc_setup_cb_t *cb, void *cb_ident,
+                          void *cb_priv)
+{
+        struct tcf_block_cb *block_cb;
+
+        block_cb = __tcf_block_cb_register(block, cb, cb_ident, cb_priv);
+        return block_cb ? 0 : -ENOMEM;
+}
+EXPORT_SYMBOL(tcf_block_cb_register);
+
+void __tcf_block_cb_unregister(struct tcf_block_cb *block_cb)
+{
+        list_del(&block_cb->list);
+        kfree(block_cb);
+}
+EXPORT_SYMBOL(__tcf_block_cb_unregister);
+
+void tcf_block_cb_unregister(struct tcf_block *block,
+                             tc_setup_cb_t *cb, void *cb_ident)
+{
+        struct tcf_block_cb *block_cb;
+
+        block_cb = tcf_block_cb_lookup(block, cb, cb_ident);
+        if (!block_cb)
+                return;
+        __tcf_block_cb_unregister(block_cb);
+}
+EXPORT_SYMBOL(tcf_block_cb_unregister);
+
+static int tcf_block_cb_call(struct tcf_block *block, enum tc_setup_type type,
+                             void *type_data, bool err_stop)
+{
+        struct tcf_block_cb *block_cb;
+        int ok_count = 0;
+        int err;
+
+        list_for_each_entry(block_cb, &block->cb_list, list) {
+                err = block_cb->cb(type, type_data, block_cb->cb_priv);
+                if (err) {
+                        if (err_stop)
+                                return err;
+                } else {
+                        ok_count++;
+                }
+        }
+        return ok_count;
+}
+
 /* Main classifier routine: scans classifier chain attached
  * to this qdisc, (optionally) tests for protocol and asks
  * specific classifiers.
@@ -379,9 +548,8 @@ static void tcf_chain_tp_insert(struct tcf_chain *chain,
                                 struct tcf_chain_info *chain_info,
                                 struct tcf_proto *tp)
 {
-        if (chain->p_filter_chain &&
-            *chain_info->pprev == chain->filter_chain)
-                rcu_assign_pointer(*chain->p_filter_chain, tp);
+        if (*chain_info->pprev == chain->filter_chain)
+                tcf_chain_head_change(chain, tp);
         RCU_INIT_POINTER(tp->next, tcf_chain_tp_prev(chain_info));
         rcu_assign_pointer(*chain_info->pprev, tp);
         tcf_chain_hold(chain);
@@ -393,8 +561,8 @@ static void tcf_chain_tp_remove(struct tcf_chain *chain,
 {
         struct tcf_proto *next = rtnl_dereference(chain_info->next);
 
-        if (chain->p_filter_chain && tp == chain->filter_chain)
-                RCU_INIT_POINTER(*chain->p_filter_chain, next);
+        if (tp == chain->filter_chain)
+                tcf_chain_head_change(chain, next);
         RCU_INIT_POINTER(*chain_info->pprev, next);
         tcf_chain_put(chain);
 }
@@ -427,8 +595,8 @@ static struct tcf_proto *tcf_chain_tp_find(struct tcf_chain *chain,
 }
 
 static int tcf_fill_node(struct net *net, struct sk_buff *skb,
-                         struct tcf_proto *tp, void *fh, u32 portid,
-                         u32 seq, u16 flags, int event)
+                         struct tcf_proto *tp, struct Qdisc *q, u32 parent,
+                         void *fh, u32 portid, u32 seq, u16 flags, int event)
 {
         struct tcmsg *tcm;
         struct nlmsghdr  *nlh;
@@ -441,8 +609,8 @@ static int tcf_fill_node(struct net *net, struct sk_buff *skb,
         tcm->tcm_family = AF_UNSPEC;
         tcm->tcm__pad1 = 0;
         tcm->tcm__pad2 = 0;
-        tcm->tcm_ifindex = qdisc_dev(tp->q)->ifindex;
-        tcm->tcm_parent = tp->classid;
+        tcm->tcm_ifindex = qdisc_dev(q)->ifindex;
+        tcm->tcm_parent = parent;
         tcm->tcm_info = TC_H_MAKE(tp->prio, tp->protocol);
         if (nla_put_string(skb, TCA_KIND, tp->ops->kind))
                 goto nla_put_failure;
@@ -465,6 +633,7 @@ nla_put_failure:
 
 static int tfilter_notify(struct net *net, struct sk_buff *oskb,
                           struct nlmsghdr *n, struct tcf_proto *tp,
+                          struct Qdisc *q, u32 parent,
                           void *fh, int event, bool unicast)
 {
         struct sk_buff *skb;
@@ -474,7 +643,7 @@ static int tfilter_notify(struct net *net, struct sk_buff *oskb,
         if (!skb)
                 return -ENOBUFS;
 
-        if (tcf_fill_node(net, skb, tp, fh, portid, n->nlmsg_seq,
+        if (tcf_fill_node(net, skb, tp, q, parent, fh, portid, n->nlmsg_seq,
                           n->nlmsg_flags, event) <= 0) {
                 kfree_skb(skb);
                 return -EINVAL;
@@ -489,6 +658,7 @@ static int tfilter_notify(struct net *net, struct sk_buff *oskb,
 
 static int tfilter_del_notify(struct net *net, struct sk_buff *oskb,
                               struct nlmsghdr *n, struct tcf_proto *tp,
+                              struct Qdisc *q, u32 parent,
                               void *fh, bool unicast, bool *last)
 {
         struct sk_buff *skb;
@@ -499,7 +669,7 @@ static int tfilter_del_notify(struct net *net, struct sk_buff *oskb,
         if (!skb)
                 return -ENOBUFS;
 
-        if (tcf_fill_node(net, skb, tp, fh, portid, n->nlmsg_seq,
+        if (tcf_fill_node(net, skb, tp, q, parent, fh, portid, n->nlmsg_seq,
                           n->nlmsg_flags, RTM_DELTFILTER) <= 0) {
                 kfree_skb(skb);
                 return -EINVAL;
@@ -519,6 +689,7 @@ static int tfilter_del_notify(struct net *net, struct sk_buff *oskb,
 }
 
 static void tfilter_notify_chain(struct net *net, struct sk_buff *oskb,
+                                 struct Qdisc *q, u32 parent,
                                  struct nlmsghdr *n,
                                  struct tcf_chain *chain, int event)
 {
@@ -526,7 +697,7 @@ static void tfilter_notify_chain(struct net *net, struct sk_buff *oskb,
 
         for (tp = rtnl_dereference(chain->filter_chain);
              tp; tp = rtnl_dereference(tp->next))
-                tfilter_notify(net, oskb, n, tp, 0, event, false);
+                tfilter_notify(net, oskb, n, tp, q, parent, 0, event, false);
 }
 
 /* Add/change/delete/get a filter node */
@@ -645,7 +816,8 @@ replay:
         }
 
         if (n->nlmsg_type == RTM_DELTFILTER && prio == 0) {
-                tfilter_notify_chain(net, skb, n, chain, RTM_DELTFILTER);
+                tfilter_notify_chain(net, skb, q, parent, n,
+                                     chain, RTM_DELTFILTER);
                 tcf_chain_flush(chain);
                 err = 0;
                 goto errout;
@@ -692,7 +864,7 @@ replay:
         if (!fh) {
                 if (n->nlmsg_type == RTM_DELTFILTER && t->tcm_handle == 0) {
                         tcf_chain_tp_remove(chain, &chain_info, tp);
-                        tfilter_notify(net, skb, n, tp, fh,
+                        tfilter_notify(net, skb, n, tp, q, parent, fh,
                                        RTM_DELTFILTER, false);
                         tcf_proto_destroy(tp);
                         err = 0;
@@ -717,8 +889,8 @@ replay:
                         }
                         break;
                 case RTM_DELTFILTER:
-                        err = tfilter_del_notify(net, skb, n, tp, fh, false,
-                                                 &last);
+                        err = tfilter_del_notify(net, skb, n, tp, q, parent,
+                                                 fh, false, &last);
                         if (err)
                                 goto errout;
                         if (last) {
@@ -727,7 +899,7 @@ replay:
                         }
                         goto errout;
                 case RTM_GETTFILTER:
-                        err = tfilter_notify(net, skb, n, tp, fh,
+                        err = tfilter_notify(net, skb, n, tp, q, parent, fh,
                                              RTM_NEWTFILTER, true);
                         goto errout;
                 default:
@@ -741,7 +913,8 @@ replay:
         if (err == 0) {
                 if (tp_created)
                         tcf_chain_tp_insert(chain, &chain_info, tp);
-                tfilter_notify(net, skb, n, tp, fh, RTM_NEWTFILTER, false);
+                tfilter_notify(net, skb, n, tp, q, parent, fh,
+                               RTM_NEWTFILTER, false);
         } else {
                 if (tp_created)
                         tcf_proto_destroy(tp);
@@ -760,6 +933,8 @@ struct tcf_dump_args {
         struct tcf_walker w;
         struct sk_buff *skb;
         struct netlink_callback *cb;
+        struct Qdisc *q;
+        u32 parent;
 };
 
 static int tcf_node_dump(struct tcf_proto *tp, void *n, struct tcf_walker *arg)
@@ -767,13 +942,14 @@ static int tcf_node_dump(struct tcf_proto *tp, void *n, struct tcf_walker *arg)
         struct tcf_dump_args *a = (void *)arg;
         struct net *net = sock_net(a->skb->sk);
 
-        return tcf_fill_node(net, a->skb, tp, n, NETLINK_CB(a->cb->skb).portid,
+        return tcf_fill_node(net, a->skb, tp, a->q, a->parent,
+                             n, NETLINK_CB(a->cb->skb).portid,
                              a->cb->nlh->nlmsg_seq, NLM_F_MULTI,
                              RTM_NEWTFILTER);
 }
 
-static bool tcf_chain_dump(struct tcf_chain *chain, struct sk_buff *skb,
-                           struct netlink_callback *cb,
+static bool tcf_chain_dump(struct tcf_chain *chain, struct Qdisc *q, u32 parent,
+                           struct sk_buff *skb, struct netlink_callback *cb,
                            long index_start, long *p_index)
 {
         struct net *net = sock_net(skb->sk);
@@ -795,7 +971,7 @@ static bool tcf_chain_dump(struct tcf_chain *chain, struct sk_buff *skb,
                         memset(&cb->args[1], 0,
                                sizeof(cb->args) - sizeof(cb->args[0]));
                 if (cb->args[1] == 0) {
-                        if (tcf_fill_node(net, skb, tp, 0,
+                        if (tcf_fill_node(net, skb, tp, q, parent, 0,
                                           NETLINK_CB(cb->skb).portid,
                                           cb->nlh->nlmsg_seq, NLM_F_MULTI,
                                           RTM_NEWTFILTER) <= 0)
@@ -808,6 +984,8 @@ static bool tcf_chain_dump(struct tcf_chain *chain, struct sk_buff *skb,
                 arg.w.fn = tcf_node_dump;
                 arg.skb = skb;
                 arg.cb = cb;
+                arg.q = q;
+                arg.parent = parent;
                 arg.w.stop = 0;
                 arg.w.skip = cb->args[1] - 1;
                 arg.w.count = 0;
@@ -833,6 +1011,7 @@ static int tc_dump_tfilter(struct sk_buff *skb, struct netlink_callback *cb)
         const struct Qdisc_class_ops *cops;
         long index_start;
         long index;
+        u32 parent;
         int err;
 
         if (nlmsg_len(cb->nlh) < sizeof(*tcm))
@@ -846,10 +1025,13 @@ static int tc_dump_tfilter(struct sk_buff *skb, struct netlink_callback *cb)
         if (!dev)
                 return skb->len;
 
-        if (!tcm->tcm_parent)
+        parent = tcm->tcm_parent;
+        if (!parent) {
                 q = dev->qdisc;
-        else
+                parent = q->handle;
+        } else {
                 q = qdisc_lookup(dev, TC_H_MAJ(tcm->tcm_parent));
+        }
         if (!q)
                 goto out;
         cops = q->ops->cl_ops;
@@ -873,7 +1055,8 @@ static int tc_dump_tfilter(struct sk_buff *skb, struct netlink_callback *cb)
                 if (tca[TCA_CHAIN] &&
                     nla_get_u32(tca[TCA_CHAIN]) != chain->index)
                         continue;
-                if (!tcf_chain_dump(chain, skb, cb, index_start, &index))
+                if (!tcf_chain_dump(chain, q, parent, skb, cb,
+                                    index_start, &index))
                         break;
         }
 
@@ -1015,29 +1198,56 @@ int tcf_exts_dump_stats(struct sk_buff *skb, struct tcf_exts *exts)
 }
 EXPORT_SYMBOL(tcf_exts_dump_stats);
 
-int tcf_exts_get_dev(struct net_device *dev, struct tcf_exts *exts,
-                     struct net_device **hw_dev)
+static int tc_exts_setup_cb_egdev_call(struct tcf_exts *exts,
+                                       enum tc_setup_type type,
+                                       void *type_data, bool err_stop)
 {
+        int ok_count = 0;
 #ifdef CONFIG_NET_CLS_ACT
         const struct tc_action *a;
-        LIST_HEAD(actions);
+        struct net_device *dev;
+        int i, ret;
 
         if (!tcf_exts_has_actions(exts))
-                return -EINVAL;
+                return 0;
 
-        tcf_exts_to_list(exts, &actions);
-        list_for_each_entry(a, &actions, list) {
-                if (a->ops->get_dev) {
-                        a->ops->get_dev(a, dev_net(dev), hw_dev);
-                        break;
-                }
+        for (i = 0; i < exts->nr_actions; i++) {
+                a = exts->actions[i];
+                if (!a->ops->get_dev)
+                        continue;
+                dev = a->ops->get_dev(a);
+                if (!dev)
+                        continue;
+                ret = tc_setup_cb_egdev_call(dev, type, type_data, err_stop);
+                if (ret < 0)
+                        return ret;
+                ok_count += ret;
         }
-        if (*hw_dev)
-                return 0;
 #endif
-        return -EOPNOTSUPP;
+        return ok_count;
+}
+
+int tc_setup_cb_call(struct tcf_block *block, struct tcf_exts *exts,
+                     enum tc_setup_type type, void *type_data, bool err_stop)
+{
+        int ok_count;
+        int ret;
+
+        ret = tcf_block_cb_call(block, type, type_data, err_stop);
+        if (ret < 0)
+                return ret;
+        ok_count = ret;
+
+        if (!exts)
+                return ok_count;
+        ret = tc_exts_setup_cb_egdev_call(exts, type, type_data, err_stop);
+        if (ret < 0)
+                return ret;
+        ok_count += ret;
+
+        return ok_count;
 }
-EXPORT_SYMBOL(tcf_exts_get_dev);
+EXPORT_SYMBOL(tc_setup_cb_call);
 
 static int __init tc_filter_init(void)
 {
diff --git a/net/sched/cls_basic.c b/net/sched/cls_basic.c
index e43c56d5b96a..5f169ded347e 100644
--- a/net/sched/cls_basic.c
+++ b/net/sched/cls_basic.c
@@ -17,13 +17,14 @@
 #include <linux/errno.h>
 #include <linux/rtnetlink.h>
 #include <linux/skbuff.h>
+#include <linux/idr.h>
 #include <net/netlink.h>
 #include <net/act_api.h>
 #include <net/pkt_cls.h>
 
 struct basic_head {
-        u32                     hgenerator;
         struct list_head        flist;
+        struct idr              handle_idr;
         struct rcu_head         rcu;
 };
 
@@ -81,6 +82,7 @@ static int basic_init(struct tcf_proto *tp)
         if (head == NULL)
                 return -ENOBUFS;
         INIT_LIST_HEAD(&head->flist);
+        idr_init(&head->handle_idr);
         rcu_assign_pointer(tp->root, head);
         return 0;
 }
@@ -118,11 +120,13 @@ static void basic_destroy(struct tcf_proto *tp)
         list_for_each_entry_safe(f, n, &head->flist, link) {
                 list_del_rcu(&f->link);
                 tcf_unbind_filter(tp, &f->res);
+                idr_remove_ext(&head->handle_idr, f->handle);
                 if (tcf_exts_get_net(&f->exts))
                         call_rcu(&f->rcu, basic_delete_filter);
                 else
                         __basic_delete_filter(f);
         }
+        idr_destroy(&head->handle_idr);
         kfree_rcu(head, rcu);
 }
 
@@ -133,6 +137,7 @@ static int basic_delete(struct tcf_proto *tp, void *arg, bool *last)
 
         list_del_rcu(&f->link);
         tcf_unbind_filter(tp, &f->res);
+        idr_remove_ext(&head->handle_idr, f->handle);
         tcf_exts_get_net(&f->exts);
         call_rcu(&f->rcu, basic_delete_filter);
         *last = list_empty(&head->flist);
@@ -177,6 +182,7 @@ static int basic_change(struct net *net, struct sk_buff *in_skb,
         struct nlattr *tb[TCA_BASIC_MAX + 1];
         struct basic_filter *fold = (struct basic_filter *) *arg;
         struct basic_filter *fnew;
+        unsigned long idr_index;
 
         if (tca[TCA_OPTIONS] == NULL)
                 return -EINVAL;
@@ -199,33 +205,33 @@ static int basic_change(struct net *net, struct sk_buff *in_skb,
         if (err < 0)
                 goto errout;
 
-        err = -EINVAL;
         if (handle) {
                 fnew->handle = handle;
-        } else if (fold) {
-                fnew->handle = fold->handle;
+                if (!fold) {
+                        err = idr_alloc_ext(&head->handle_idr, fnew, &idr_index,
+                                            handle, handle + 1, GFP_KERNEL);
+                        if (err)
+                                goto errout;
+                }
         } else {
-                unsigned int i = 0x80000000;
-                do {
-                        if (++head->hgenerator == 0x7FFFFFFF)
-                                head->hgenerator = 1;
-                } while (--i > 0 && basic_get(tp, head->hgenerator));
-
-                if (i <= 0) {
-                        pr_err("Insufficient number of handles\n");
+                err = idr_alloc_ext(&head->handle_idr, fnew, &idr_index,
+                                    1, 0x7FFFFFFF, GFP_KERNEL);
+                if (err)
                         goto errout;
-                }
-
-                fnew->handle = head->hgenerator;
+                fnew->handle = idr_index;
         }
 
         err = basic_set_parms(net, tp, fnew, base, tb, tca[TCA_RATE], ovr);
-        if (err < 0)
+        if (err < 0) {
+                if (!fold)
+                        idr_remove_ext(&head->handle_idr, fnew->handle);
                 goto errout;
+        }
 
         *arg = fnew;
 
         if (fold) {
+                idr_replace_ext(&head->handle_idr, fnew, fnew->handle);
                 list_replace_rcu(&fold->link, &fnew->link);
                 tcf_unbind_filter(tp, &fold->res);
                 tcf_exts_get_net(&fold->exts);
diff --git a/net/sched/cls_bpf.c b/net/sched/cls_bpf.c
index 990eb4d91d54..fb680dafac5a 100644
--- a/net/sched/cls_bpf.c
+++ b/net/sched/cls_bpf.c
@@ -17,6 +17,7 @@
 #include <linux/skbuff.h>
 #include <linux/filter.h>
 #include <linux/bpf.h>
+#include <linux/idr.h>
 
 #include <net/rtnetlink.h>
 #include <net/pkt_cls.h>
@@ -32,7 +33,7 @@ MODULE_DESCRIPTION("TC BPF based classifier");
 
 struct cls_bpf_head {
         struct list_head plist;
-        u32 hgen;
+        struct idr handle_idr;
         struct rcu_head rcu;
 };
 
@@ -102,11 +103,11 @@ static int cls_bpf_classify(struct sk_buff *skb, const struct tcf_proto *tp,
                 } else if (at_ingress) {
                         /* It is safe to push/pull even if skb_shared() */
                         __skb_push(skb, skb->mac_len);
-                        bpf_compute_data_end(skb);
+                        bpf_compute_data_pointers(skb);
                         filter_res = BPF_PROG_RUN(prog->filter, skb);
                         __skb_pull(skb, skb->mac_len);
                 } else {
-                        bpf_compute_data_end(skb);
+                        bpf_compute_data_pointers(skb);
                         filter_res = BPF_PROG_RUN(prog->filter, skb);
                 }
 
@@ -149,7 +150,9 @@ static bool cls_bpf_is_ebpf(const struct cls_bpf_prog *prog)
 static int cls_bpf_offload_cmd(struct tcf_proto *tp, struct cls_bpf_prog *prog,
                                enum tc_clsbpf_command cmd)
 {
-        struct net_device *dev = tp->q->dev_queue->dev;
+        bool addorrep = cmd == TC_CLSBPF_ADD || cmd == TC_CLSBPF_REPLACE;
+        struct tcf_block *block = tp->chain->block;
+        bool skip_sw = tc_skip_sw(prog->gen_flags);
         struct tc_cls_bpf_offload cls_bpf = {};
         int err;
 
@@ -161,17 +164,25 @@ static int cls_bpf_offload_cmd(struct tcf_proto *tp, struct cls_bpf_prog *prog,
         cls_bpf.exts_integrated = prog->exts_integrated;
         cls_bpf.gen_flags = prog->gen_flags;
 
-        err = dev->netdev_ops->ndo_setup_tc(dev, TC_SETUP_CLSBPF, &cls_bpf);
-        if (!err && (cmd == TC_CLSBPF_ADD || cmd == TC_CLSBPF_REPLACE))
-                prog->gen_flags |= TCA_CLS_FLAGS_IN_HW;
+        err = tc_setup_cb_call(block, NULL, TC_SETUP_CLSBPF, &cls_bpf, skip_sw);
+        if (addorrep) {
+                if (err < 0) {
+                        cls_bpf_offload_cmd(tp, prog, TC_CLSBPF_DESTROY);
+                        return err;
+                } else if (err > 0) {
+                        prog->gen_flags |= TCA_CLS_FLAGS_IN_HW;
+                }
+        }
+
+        if (addorrep && skip_sw && !(prog->gen_flags & TCA_CLS_FLAGS_IN_HW))
+                return -EINVAL;
 
-        return err;
+        return 0;
 }
 
 static int cls_bpf_offload(struct tcf_proto *tp, struct cls_bpf_prog *prog,
                            struct cls_bpf_prog *oldprog)
 {
-        struct net_device *dev = tp->q->dev_queue->dev;
         struct cls_bpf_prog *obj = prog;
         enum tc_clsbpf_command cmd;
         bool skip_sw;
@@ -181,7 +192,7 @@ static int cls_bpf_offload(struct tcf_proto *tp, struct cls_bpf_prog *prog,
                 (oldprog && tc_skip_sw(oldprog->gen_flags));
 
         if (oldprog && oldprog->offloaded) {
-                if (tc_should_offload(dev, prog->gen_flags)) {
+                if (!tc_skip_hw(prog->gen_flags)) {
                         cmd = TC_CLSBPF_REPLACE;
                 } else if (!tc_skip_sw(prog->gen_flags)) {
                         obj = oldprog;
@@ -190,14 +201,14 @@ static int cls_bpf_offload(struct tcf_proto *tp, struct cls_bpf_prog *prog,
                         return -EINVAL;
                 }
         } else {
-                if (!tc_should_offload(dev, prog->gen_flags))
+                if (tc_skip_hw(prog->gen_flags))
                         return skip_sw ? -EINVAL : 0;
                 cmd = TC_CLSBPF_ADD;
         }
 
         ret = cls_bpf_offload_cmd(tp, obj, cmd);
         if (ret)
-                return skip_sw ? ret : 0;
+                return ret;
 
         obj->offloaded = true;
         if (oldprog)
@@ -241,6 +252,7 @@ static int cls_bpf_init(struct tcf_proto *tp)
                 return -ENOBUFS;
 
         INIT_LIST_HEAD_RCU(&head->plist);
+        idr_init(&head->handle_idr);
         rcu_assign_pointer(tp->root, head);
 
         return 0;
@@ -280,6 +292,9 @@ static void cls_bpf_delete_prog_rcu(struct rcu_head *rcu)
 
 static void __cls_bpf_delete(struct tcf_proto *tp, struct cls_bpf_prog *prog)
 {
+        struct cls_bpf_head *head = rtnl_dereference(tp->root);
+
+        idr_remove_ext(&head->handle_idr, prog->handle);
         cls_bpf_stop_offload(tp, prog);
         list_del_rcu(&prog->link);
         tcf_unbind_filter(tp, &prog->res);
@@ -306,6 +321,7 @@ static void cls_bpf_destroy(struct tcf_proto *tp)
         list_for_each_entry_safe(prog, tmp, &head->plist, link)
                 __cls_bpf_delete(tp, prog);
 
+        idr_destroy(&head->handle_idr);
         kfree_rcu(head, rcu);
 }
 
@@ -362,7 +378,7 @@ static int cls_bpf_prog_from_ops(struct nlattr **tb, struct cls_bpf_prog *prog)
 }
 
 static int cls_bpf_prog_from_efd(struct nlattr **tb, struct cls_bpf_prog *prog,
-                                 const struct tcf_proto *tp)
+                                 u32 gen_flags, const struct tcf_proto *tp)
 {
         struct bpf_prog *fp;
         char *name = NULL;
@@ -370,7 +386,11 @@ static int cls_bpf_prog_from_efd(struct nlattr **tb, struct cls_bpf_prog *prog,
 
         bpf_fd = nla_get_u32(tb[TCA_BPF_FD]);
 
-        fp = bpf_prog_get_type(bpf_fd, BPF_PROG_TYPE_SCHED_CLS);
+        if (gen_flags & TCA_CLS_FLAGS_SKIP_SW)
+                fp = bpf_prog_get_type_dev(bpf_fd, BPF_PROG_TYPE_SCHED_CLS,
+                                           qdisc_dev(tp->q));
+        else
+                fp = bpf_prog_get_type(bpf_fd, BPF_PROG_TYPE_SCHED_CLS);
         if (IS_ERR(fp))
                 return PTR_ERR(fp);
 
@@ -428,7 +448,7 @@ static int cls_bpf_set_parms(struct net *net, struct tcf_proto *tp,
         prog->gen_flags = gen_flags;
 
         ret = is_bpf ? cls_bpf_prog_from_ops(tb, prog) :
-                       cls_bpf_prog_from_efd(tb, prog, tp);
+                       cls_bpf_prog_from_efd(tb, prog, gen_flags, tp);
         if (ret < 0)
                 return ret;
 
@@ -440,27 +460,6 @@ static int cls_bpf_set_parms(struct net *net, struct tcf_proto *tp,
         return 0;
 }
 
-static u32 cls_bpf_grab_new_handle(struct tcf_proto *tp,
-                                   struct cls_bpf_head *head)
-{
-        unsigned int i = 0x80000000;
-        u32 handle;
-
-        do {
-                if (++head->hgen == 0x7FFFFFFF)
-                        head->hgen = 1;
-        } while (--i > 0 && cls_bpf_get(tp, head->hgen));
-
-        if (unlikely(i == 0)) {
-                pr_err("Insufficient number of handles\n");
-                handle = 0;
-        } else {
-                handle = head->hgen;
-        }
-
-        return handle;
-}
-
 static int cls_bpf_change(struct net *net, struct sk_buff *in_skb,
                           struct tcf_proto *tp, unsigned long base,
                           u32 handle, struct nlattr **tca,
@@ -470,6 +469,7 @@ static int cls_bpf_change(struct net *net, struct sk_buff *in_skb,
         struct cls_bpf_prog *oldprog = *arg;
         struct nlattr *tb[TCA_BPF_MAX + 1];
         struct cls_bpf_prog *prog;
+        unsigned long idr_index;
         int ret;
 
         if (tca[TCA_OPTIONS] == NULL)
@@ -495,21 +495,30 @@ static int cls_bpf_change(struct net *net, struct sk_buff *in_skb,
                 }
         }
 
-        if (handle == 0)
-                prog->handle = cls_bpf_grab_new_handle(tp, head);
-        else
+        if (handle == 0) {
+                ret = idr_alloc_ext(&head->handle_idr, prog, &idr_index,
+                                    1, 0x7FFFFFFF, GFP_KERNEL);
+                if (ret)
+                        goto errout;
+                prog->handle = idr_index;
+        } else {
+                if (!oldprog) {
+                        ret = idr_alloc_ext(&head->handle_idr, prog, &idr_index,
+                                            handle, handle + 1, GFP_KERNEL);
+                        if (ret)
+                                goto errout;
+                }
                 prog->handle = handle;
-        if (prog->handle == 0) {
-                ret = -EINVAL;
-                goto errout;
         }
 
         ret = cls_bpf_set_parms(net, tp, prog, base, tb, tca[TCA_RATE], ovr);
         if (ret < 0)
-                goto errout;
+                goto errout_idr;
 
         ret = cls_bpf_offload(tp, prog, oldprog);
         if (ret) {
+                if (!oldprog)
+                        idr_remove_ext(&head->handle_idr, prog->handle);
                 __cls_bpf_delete_prog(prog);
                 return ret;
         }
@@ -518,6 +527,7 @@ static int cls_bpf_change(struct net *net, struct sk_buff *in_skb,
                 prog->gen_flags |= TCA_CLS_FLAGS_NOT_IN_HW;
 
         if (oldprog) {
+                idr_replace_ext(&head->handle_idr, prog, handle);
                 list_replace_rcu(&oldprog->link, &prog->link);
                 tcf_unbind_filter(tp, &oldprog->res);
                 tcf_exts_get_net(&oldprog->exts);
@@ -529,6 +539,9 @@ static int cls_bpf_change(struct net *net, struct sk_buff *in_skb,
         *arg = prog;
         return 0;
 
+errout_idr:
+        if (!oldprog)
+                idr_remove_ext(&head->handle_idr, prog->handle);
 errout:
         tcf_exts_destroy(&prog->exts);
         kfree(prog);
diff --git a/net/sched/cls_flow.c b/net/sched/cls_flow.c
index 85f765cff697..25c2a888e1f0 100644
--- a/net/sched/cls_flow.c
+++ b/net/sched/cls_flow.c
@@ -348,9 +348,9 @@ static int flow_classify(struct sk_buff *skb, const struct tcf_proto *tp,
         return -1;
 }
 
-static void flow_perturbation(unsigned long arg)
+static void flow_perturbation(struct timer_list *t)
 {
-        struct flow_filter *f = (struct flow_filter *)arg;
+        struct flow_filter *f = from_timer(f, t, perturb_timer);
 
         get_random_bytes(&f->hashrnd, 4);
         if (f->perturb_period)
@@ -510,8 +510,11 @@ static int flow_change(struct net *net, struct sk_buff *in_skb,
                         perturb_period = nla_get_u32(tb[TCA_FLOW_PERTURB]) * HZ;
                 }
 
-                if (TC_H_MAJ(baseclass) == 0)
-                        baseclass = TC_H_MAKE(tp->q->handle, baseclass);
+                if (TC_H_MAJ(baseclass) == 0) {
+                        struct Qdisc *q = tcf_block_q(tp->chain->block);
+
+                        baseclass = TC_H_MAKE(q->handle, baseclass);
+                }
                 if (TC_H_MIN(baseclass) == 0)
                         baseclass = TC_H_MAKE(baseclass, 1);
 
@@ -521,8 +524,7 @@ static int flow_change(struct net *net, struct sk_buff *in_skb,
                 get_random_bytes(&fnew->hashrnd, 4);
         }
 
-        setup_deferrable_timer(&fnew->perturb_timer, flow_perturbation,
-                               (unsigned long)fnew);
+        timer_setup(&fnew->perturb_timer, flow_perturbation, TIMER_DEFERRABLE);
 
         netif_keep_dst(qdisc_dev(tp->q));
 
diff --git a/net/sched/cls_flower.c b/net/sched/cls_flower.c
index 7a838d1c1c00..543a3e875d05 100644
--- a/net/sched/cls_flower.c
+++ b/net/sched/cls_flower.c
@@ -155,37 +155,12 @@ static int fl_classify(struct sk_buff *skb, const struct tcf_proto *tp,
         struct cls_fl_filter *f;
         struct fl_flow_key skb_key;
         struct fl_flow_key skb_mkey;
-        struct ip_tunnel_info *info;
 
         if (!atomic_read(&head->ht.nelems))
                 return -1;
 
         fl_clear_masked_range(&skb_key, &head->mask);
 
-        info = skb_tunnel_info(skb);
-        if (info) {
-                struct ip_tunnel_key *key = &info->key;
-
-                switch (ip_tunnel_info_af(info)) {
-                case AF_INET:
-                        skb_key.enc_control.addr_type =
-                                FLOW_DISSECTOR_KEY_IPV4_ADDRS;
-                        skb_key.enc_ipv4.src = key->u.ipv4.src;
-                        skb_key.enc_ipv4.dst = key->u.ipv4.dst;
-                        break;
-                case AF_INET6:
-                        skb_key.enc_control.addr_type =
-                                FLOW_DISSECTOR_KEY_IPV6_ADDRS;
-                        skb_key.enc_ipv6.src = key->u.ipv6.src;
-                        skb_key.enc_ipv6.dst = key->u.ipv6.dst;
-                        break;
-                }
-
-                skb_key.enc_key_id.keyid = tunnel_id_to_key32(key->tun_id);
-                skb_key.enc_tp.src = key->tp_src;
-                skb_key.enc_tp.dst = key->tp_dst;
-        }
-
         skb_key.indev_ifindex = skb->skb_iif;
         /* skb_flow_dissect() does not set n_proto in case an unknown protocol,
          * so do it rather here.
@@ -245,17 +220,14 @@ static void fl_destroy_filter(struct rcu_head *head)
 static void fl_hw_destroy_filter(struct tcf_proto *tp, struct cls_fl_filter *f)
 {
         struct tc_cls_flower_offload cls_flower = {};
-        struct net_device *dev = f->hw_dev;
-
-        if (!tc_can_offload(dev))
-                return;
+        struct tcf_block *block = tp->chain->block;
 
         tc_cls_common_offload_init(&cls_flower.common, tp);
         cls_flower.command = TC_CLSFLOWER_DESTROY;
         cls_flower.cookie = (unsigned long) f;
-        cls_flower.egress_dev = f->hw_dev != tp->q->dev_queue->dev;
 
-        dev->netdev_ops->ndo_setup_tc(dev, TC_SETUP_CLSFLOWER, &cls_flower);
+        tc_setup_cb_call(block, &f->exts, TC_SETUP_CLSFLOWER,
+                         &cls_flower, false);
 }
 
 static int fl_hw_replace_filter(struct tcf_proto *tp,
@@ -263,22 +235,11 @@ static int fl_hw_replace_filter(struct tcf_proto *tp,
                                 struct fl_flow_key *mask,
                                 struct cls_fl_filter *f)
 {
-        struct net_device *dev = tp->q->dev_queue->dev;
         struct tc_cls_flower_offload cls_flower = {};
+        struct tcf_block *block = tp->chain->block;
+        bool skip_sw = tc_skip_sw(f->flags);
         int err;
 
-        if (!tc_can_offload(dev)) {
-                if (tcf_exts_get_dev(dev, &f->exts, &f->hw_dev) ||
-                    (f->hw_dev && !tc_can_offload(f->hw_dev))) {
-                        f->hw_dev = dev;
-                        return tc_skip_sw(f->flags) ? -EINVAL : 0;
-                }
-                dev = f->hw_dev;
-                cls_flower.egress_dev = true;
-        } else {
-                f->hw_dev = dev;
-        }
-
         tc_cls_common_offload_init(&cls_flower.common, tp);
         cls_flower.command = TC_CLSFLOWER_REPLACE;
         cls_flower.cookie = (unsigned long) f;
@@ -286,33 +247,36 @@ static int fl_hw_replace_filter(struct tcf_proto *tp,
         cls_flower.mask = mask;
         cls_flower.key = &f->mkey;
         cls_flower.exts = &f->exts;
+        cls_flower.classid = f->res.classid;
 
-        err = dev->netdev_ops->ndo_setup_tc(dev, TC_SETUP_CLSFLOWER,
-                                            &cls_flower);
-        if (!err)
+        err = tc_setup_cb_call(block, &f->exts, TC_SETUP_CLSFLOWER,
+                               &cls_flower, skip_sw);
+        if (err < 0) {
+                fl_hw_destroy_filter(tp, f);
+                return err;
+        } else if (err > 0) {
                 f->flags |= TCA_CLS_FLAGS_IN_HW;
+        }
+
+        if (skip_sw && !(f->flags & TCA_CLS_FLAGS_IN_HW))
+                return -EINVAL;
 
-        if (tc_skip_sw(f->flags))
-                return err;
         return 0;
 }
 
 static void fl_hw_update_stats(struct tcf_proto *tp, struct cls_fl_filter *f)
 {
         struct tc_cls_flower_offload cls_flower = {};
-        struct net_device *dev = f->hw_dev;
-
-        if (!tc_can_offload(dev))
-                return;
+        struct tcf_block *block = tp->chain->block;
 
         tc_cls_common_offload_init(&cls_flower.common, tp);
         cls_flower.command = TC_CLSFLOWER_STATS;
         cls_flower.cookie = (unsigned long) f;
         cls_flower.exts = &f->exts;
-        cls_flower.egress_dev = f->hw_dev != tp->q->dev_queue->dev;
+        cls_flower.classid = f->res.classid;
 
-        dev->netdev_ops->ndo_setup_tc(dev, TC_SETUP_CLSFLOWER,
-                                      &cls_flower);
+        tc_setup_cb_call(block, &f->exts, TC_SETUP_CLSFLOWER,
+                         &cls_flower, false);
 }
 
 static void __fl_delete(struct tcf_proto *tp, struct cls_fl_filter *f)
diff --git a/net/sched/cls_fw.c b/net/sched/cls_fw.c
index 7f45e5ab8afc..20f0de1a960a 100644
--- a/net/sched/cls_fw.c
+++ b/net/sched/cls_fw.c
@@ -28,6 +28,7 @@
 #include <net/netlink.h>
 #include <net/act_api.h>
 #include <net/pkt_cls.h>
+#include <net/sch_generic.h>
 
 #define HTSIZE 256
 
@@ -86,9 +87,11 @@ static int fw_classify(struct sk_buff *skb, const struct tcf_proto *tp,
                         }
                 }
         } else {
+                struct Qdisc *q = tcf_block_q(tp->chain->block);
+
                 /* Old method: classify the packet using its skb mark. */
                 if (id && (TC_H_MAJ(id) == 0 ||
-                           !(TC_H_MAJ(id ^ tp->q->handle)))) {
+                           !(TC_H_MAJ(id ^ q->handle)))) {
                         res->classid = id;
                         res->class = 0;
                         return 0;
diff --git a/net/sched/cls_matchall.c b/net/sched/cls_matchall.c
index 3684153cd8a9..66d4e0099158 100644
--- a/net/sched/cls_matchall.c
+++ b/net/sched/cls_matchall.c
@@ -69,12 +69,27 @@ static void mall_destroy_rcu(struct rcu_head *rcu)
         tcf_queue_work(&head->work);
 }
 
+static void mall_destroy_hw_filter(struct tcf_proto *tp,
+                                   struct cls_mall_head *head,
+                                   unsigned long cookie)
+{
+        struct tc_cls_matchall_offload cls_mall = {};
+        struct tcf_block *block = tp->chain->block;
+
+        tc_cls_common_offload_init(&cls_mall.common, tp);
+        cls_mall.command = TC_CLSMATCHALL_DESTROY;
+        cls_mall.cookie = cookie;
+
+        tc_setup_cb_call(block, NULL, TC_SETUP_CLSMATCHALL, &cls_mall, false);
+}
+
 static int mall_replace_hw_filter(struct tcf_proto *tp,
                                   struct cls_mall_head *head,
                                   unsigned long cookie)
 {
-        struct net_device *dev = tp->q->dev_queue->dev;
         struct tc_cls_matchall_offload cls_mall = {};
+        struct tcf_block *block = tp->chain->block;
+        bool skip_sw = tc_skip_sw(head->flags);
         int err;
 
         tc_cls_common_offload_init(&cls_mall.common, tp);
@@ -82,37 +97,29 @@ static int mall_replace_hw_filter(struct tcf_proto *tp,
         cls_mall.exts = &head->exts;
         cls_mall.cookie = cookie;
 
-        err = dev->netdev_ops->ndo_setup_tc(dev, TC_SETUP_CLSMATCHALL,
-                                            &cls_mall);
-        if (!err)
+        err = tc_setup_cb_call(block, NULL, TC_SETUP_CLSMATCHALL,
+                               &cls_mall, skip_sw);
+        if (err < 0) {
+                mall_destroy_hw_filter(tp, head, cookie);
+                return err;
+        } else if (err > 0) {
                 head->flags |= TCA_CLS_FLAGS_IN_HW;
+        }
 
-        return err;
-}
-
-static void mall_destroy_hw_filter(struct tcf_proto *tp,
-                                   struct cls_mall_head *head,
-                                   unsigned long cookie)
-{
-        struct net_device *dev = tp->q->dev_queue->dev;
-        struct tc_cls_matchall_offload cls_mall = {};
-
-        tc_cls_common_offload_init(&cls_mall.common, tp);
-        cls_mall.command = TC_CLSMATCHALL_DESTROY;
-        cls_mall.cookie = cookie;
+        if (skip_sw && !(head->flags & TCA_CLS_FLAGS_IN_HW))
+                return -EINVAL;
 
-        dev->netdev_ops->ndo_setup_tc(dev, TC_SETUP_CLSMATCHALL, &cls_mall);
+        return 0;
 }
 
 static void mall_destroy(struct tcf_proto *tp)
 {
         struct cls_mall_head *head = rtnl_dereference(tp->root);
-        struct net_device *dev = tp->q->dev_queue->dev;
 
         if (!head)
                 return;
 
-        if (tc_should_offload(dev, head->flags))
+        if (!tc_skip_hw(head->flags))
                 mall_destroy_hw_filter(tp, head, (unsigned long) head);
 
         if (tcf_exts_get_net(&head->exts))
@@ -155,7 +162,6 @@ static int mall_change(struct net *net, struct sk_buff *in_skb,
                        void **arg, bool ovr)
 {
         struct cls_mall_head *head = rtnl_dereference(tp->root);
-        struct net_device *dev = tp->q->dev_queue->dev;
         struct nlattr *tb[TCA_MATCHALL_MAX + 1];
         struct cls_mall_head *new;
         u32 flags = 0;
@@ -195,14 +201,10 @@ static int mall_change(struct net *net, struct sk_buff *in_skb,
         if (err)
                 goto err_set_parms;
 
-        if (tc_should_offload(dev, flags)) {
+        if (!tc_skip_hw(new->flags)) {
                 err = mall_replace_hw_filter(tp, new, (unsigned long) new);
-                if (err) {
-                        if (tc_skip_sw(flags))
-                                goto err_replace_hw_filter;
-                        else
-                                err = 0;
-                }
+                if (err)
+                        goto err_replace_hw_filter;
         }
 
         if (!tc_in_hw(new->flags))
diff --git a/net/sched/cls_tcindex.c b/net/sched/cls_tcindex.c
index a76937ee0b2d..67467ae24c97 100644
--- a/net/sched/cls_tcindex.c
+++ b/net/sched/cls_tcindex.c
@@ -13,6 +13,7 @@
 #include <net/act_api.h>
 #include <net/netlink.h>
 #include <net/pkt_cls.h>
+#include <net/sch_generic.h>
 
 /*
  * Passing parameters to the root seems to be done more awkwardly than really
@@ -96,9 +97,11 @@ static int tcindex_classify(struct sk_buff *skb, const struct tcf_proto *tp,
 
         f = tcindex_lookup(p, key);
         if (!f) {
+                struct Qdisc *q = tcf_block_q(tp->chain->block);
+
                 if (!p->fall_through)
                         return -1;
-                res->classid = TC_H_MAKE(TC_H_MAJ(tp->q->handle), key);
+                res->classid = TC_H_MAKE(TC_H_MAJ(q->handle), key);
                 res->class = 0;
                 pr_debug("alg 0x%x\n", res->classid);
                 return 0;
diff --git a/net/sched/cls_u32.c b/net/sched/cls_u32.c
index b58eccb21f03..ac152b4f4247 100644
--- a/net/sched/cls_u32.c
+++ b/net/sched/cls_u32.c
@@ -46,6 +46,7 @@
 #include <net/act_api.h>
 #include <net/pkt_cls.h>
 #include <linux/netdevice.h>
+#include <linux/idr.h>
 
 struct tc_u_knode {
         struct tc_u_knode __rcu *next;
@@ -85,6 +86,7 @@ struct tc_u_hnode {
         struct tc_u_common      *tp_c;
         int                     refcnt;
         unsigned int            divisor;
+        struct idr              handle_idr;
         struct rcu_head         rcu;
         /* The 'ht' field MUST be the last field in structure to allow for
          * more entries allocated at end of structure.
@@ -94,9 +96,9 @@ struct tc_u_hnode {
 
 struct tc_u_common {
         struct tc_u_hnode __rcu *hlist;
-        struct Qdisc            *q;
+        struct tcf_block        *block;
         int                     refcnt;
-        u32                     hgenerator;
+        struct idr              handle_idr;
         struct hlist_node       hnode;
         struct rcu_head         rcu;
 };
@@ -314,19 +316,19 @@ static void *u32_get(struct tcf_proto *tp, u32 handle)
         return u32_lookup_key(ht, handle);
 }
 
-static u32 gen_new_htid(struct tc_u_common *tp_c)
+static u32 gen_new_htid(struct tc_u_common *tp_c, struct tc_u_hnode *ptr)
 {
-        int i = 0x800;
+        unsigned long idr_index;
+        int err;
 
-        /* hgenerator only used inside rtnl lock it is safe to increment
+        /* This is only used inside rtnl lock it is safe to increment
          * without read _copy_ update semantics
          */
-        do {
-                if (++tp_c->hgenerator == 0x7FF)
-                        tp_c->hgenerator = 1;
-        } while (--i > 0 && u32_lookup_ht(tp_c, (tp_c->hgenerator|0x800)<<20));
-
-        return i > 0 ? (tp_c->hgenerator|0x800)<<20 : 0;
+        err = idr_alloc_ext(&tp_c->handle_idr, ptr, &idr_index,
+                            1, 0x7FF, GFP_KERNEL);
+        if (err)
+                return 0;
+        return (u32)(idr_index | 0x800) << 20;
 }
 
 static struct hlist_head *tc_u_common_hash;
@@ -336,11 +338,7 @@ static struct hlist_head *tc_u_common_hash;
 
 static unsigned int tc_u_hash(const struct tcf_proto *tp)
 {
-        struct net_device *dev = tp->q->dev_queue->dev;
-        u32 qhandle = tp->q->handle;
-        int ifindex = dev->ifindex;
-
-        return hash_64((u64)ifindex << 32 | qhandle, U32_HASH_SHIFT);
+        return hash_ptr(tp->chain->block, U32_HASH_SHIFT);
 }
 
 static struct tc_u_common *tc_u_common_find(const struct tcf_proto *tp)
@@ -350,7 +348,7 @@ static struct tc_u_common *tc_u_common_find(const struct tcf_proto *tp)
 
         h = tc_u_hash(tp);
         hlist_for_each_entry(tc, &tc_u_common_hash[h], hnode) {
-                if (tc->q == tp->q)
+                if (tc->block == tp->chain->block)
                         return tc;
         }
         return NULL;
@@ -369,8 +367,9 @@ static int u32_init(struct tcf_proto *tp)
                 return -ENOBUFS;
 
         root_ht->refcnt++;
-        root_ht->handle = tp_c ? gen_new_htid(tp_c) : 0x80000000;
+        root_ht->handle = tp_c ? gen_new_htid(tp_c, root_ht) : 0x80000000;
         root_ht->prio = tp->prio;
+        idr_init(&root_ht->handle_idr);
 
         if (tp_c == NULL) {
                 tp_c = kzalloc(sizeof(*tp_c), GFP_KERNEL);
@@ -378,8 +377,9 @@ static int u32_init(struct tcf_proto *tp)
                         kfree(root_ht);
                         return -ENOBUFS;
                 }
-                tp_c->q = tp->q;
+                tp_c->block = tp->chain->block;
                 INIT_HLIST_NODE(&tp_c->hnode);
+                idr_init(&tp_c->handle_idr);
 
                 h = tc_u_hash(tp);
                 hlist_add_head(&tp_c->hnode, &tc_u_common_hash[h]);
@@ -487,71 +487,69 @@ static int u32_delete_key(struct tcf_proto *tp, struct tc_u_knode *key)
         return 0;
 }
 
-static void u32_remove_hw_knode(struct tcf_proto *tp, u32 handle)
+static void u32_clear_hw_hnode(struct tcf_proto *tp, struct tc_u_hnode *h)
 {
-        struct net_device *dev = tp->q->dev_queue->dev;
+        struct tcf_block *block = tp->chain->block;
         struct tc_cls_u32_offload cls_u32 = {};
 
-        if (!tc_should_offload(dev, 0))
-                return;
-
         tc_cls_common_offload_init(&cls_u32.common, tp);
-        cls_u32.command = TC_CLSU32_DELETE_KNODE;
-        cls_u32.knode.handle = handle;
+        cls_u32.command = TC_CLSU32_DELETE_HNODE;
+        cls_u32.hnode.divisor = h->divisor;
+        cls_u32.hnode.handle = h->handle;
+        cls_u32.hnode.prio = h->prio;
 
-        dev->netdev_ops->ndo_setup_tc(dev, TC_SETUP_CLSU32, &cls_u32);
+        tc_setup_cb_call(block, NULL, TC_SETUP_CLSU32, &cls_u32, false);
 }
 
 static int u32_replace_hw_hnode(struct tcf_proto *tp, struct tc_u_hnode *h,
                                 u32 flags)
 {
-        struct net_device *dev = tp->q->dev_queue->dev;
+        struct tcf_block *block = tp->chain->block;
         struct tc_cls_u32_offload cls_u32 = {};
+        bool skip_sw = tc_skip_sw(flags);
+        bool offloaded = false;
         int err;
 
-        if (!tc_should_offload(dev, flags))
-                return tc_skip_sw(flags) ? -EINVAL : 0;
-
         tc_cls_common_offload_init(&cls_u32.common, tp);
         cls_u32.command = TC_CLSU32_NEW_HNODE;
         cls_u32.hnode.divisor = h->divisor;
         cls_u32.hnode.handle = h->handle;
         cls_u32.hnode.prio = h->prio;
 
-        err = dev->netdev_ops->ndo_setup_tc(dev, TC_SETUP_CLSU32, &cls_u32);
-        if (tc_skip_sw(flags))
+        err = tc_setup_cb_call(block, NULL, TC_SETUP_CLSU32, &cls_u32, skip_sw);
+        if (err < 0) {
+                u32_clear_hw_hnode(tp, h);
                 return err;
+        } else if (err > 0) {
+                offloaded = true;
+        }
+
+        if (skip_sw && !offloaded)
+                return -EINVAL;
 
         return 0;
 }
 
-static void u32_clear_hw_hnode(struct tcf_proto *tp, struct tc_u_hnode *h)
+static void u32_remove_hw_knode(struct tcf_proto *tp, u32 handle)
 {
-        struct net_device *dev = tp->q->dev_queue->dev;
+        struct tcf_block *block = tp->chain->block;
         struct tc_cls_u32_offload cls_u32 = {};
 
-        if (!tc_should_offload(dev, 0))
-                return;
-
         tc_cls_common_offload_init(&cls_u32.common, tp);
-        cls_u32.command = TC_CLSU32_DELETE_HNODE;
-        cls_u32.hnode.divisor = h->divisor;
-        cls_u32.hnode.handle = h->handle;
-        cls_u32.hnode.prio = h->prio;
+        cls_u32.command = TC_CLSU32_DELETE_KNODE;
+        cls_u32.knode.handle = handle;
 
-        dev->netdev_ops->ndo_setup_tc(dev, TC_SETUP_CLSU32, &cls_u32);
+        tc_setup_cb_call(block, NULL, TC_SETUP_CLSU32, &cls_u32, false);
 }
 
 static int u32_replace_hw_knode(struct tcf_proto *tp, struct tc_u_knode *n,
                                 u32 flags)
 {
-        struct net_device *dev = tp->q->dev_queue->dev;
+        struct tcf_block *block = tp->chain->block;
         struct tc_cls_u32_offload cls_u32 = {};
+        bool skip_sw = tc_skip_sw(flags);
         int err;
 
-        if (!tc_should_offload(dev, flags))
-                return tc_skip_sw(flags) ? -EINVAL : 0;
-
         tc_cls_common_offload_init(&cls_u32.common, tp);
         cls_u32.command = TC_CLSU32_REPLACE_KNODE;
         cls_u32.knode.handle = n->handle;
@@ -568,13 +566,16 @@ static int u32_replace_hw_knode(struct tcf_proto *tp, struct tc_u_knode *n,
         if (n->ht_down)
                 cls_u32.knode.link_handle = n->ht_down->handle;
 
-        err = dev->netdev_ops->ndo_setup_tc(dev, TC_SETUP_CLSU32, &cls_u32);
-
-        if (!err)
+        err = tc_setup_cb_call(block, NULL, TC_SETUP_CLSU32, &cls_u32, skip_sw);
+        if (err < 0) {
+                u32_remove_hw_knode(tp, n->handle);
+                return err;
+        } else if (err > 0) {
                 n->flags |= TCA_CLS_FLAGS_IN_HW;
+        }
 
-        if (tc_skip_sw(flags))
-                return err;
+        if (skip_sw && !(n->flags & TCA_CLS_FLAGS_IN_HW))
+                return -EINVAL;
 
         return 0;
 }
@@ -590,6 +591,7 @@ static void u32_clear_hnode(struct tcf_proto *tp, struct tc_u_hnode *ht)
                                          rtnl_dereference(n->next));
                         tcf_unbind_filter(tp, &n->res);
                         u32_remove_hw_knode(tp, n->handle);
+                        idr_remove_ext(&ht->handle_idr, n->handle);
                         if (tcf_exts_get_net(&n->exts))
                                 call_rcu(&n->rcu, u32_delete_key_freepf_rcu);
                         else
@@ -614,6 +616,8 @@ static int u32_destroy_hnode(struct tcf_proto *tp, struct tc_u_hnode *ht)
              hn = &phn->next, phn = rtnl_dereference(*hn)) {
                 if (phn == ht) {
                         u32_clear_hw_hnode(tp, ht);
+                        idr_destroy(&ht->handle_idr);
+                        idr_remove_ext(&tp_c->handle_idr, ht->handle);
                         RCU_INIT_POINTER(*hn, ht->next);
                         kfree_rcu(ht, rcu);
                         return 0;
@@ -661,6 +665,7 @@ static void u32_destroy(struct tcf_proto *tp)
                         kfree_rcu(ht, rcu);
                 }
 
+                idr_destroy(&tp_c->handle_idr);
                 kfree(tp_c);
         }
 
@@ -729,27 +734,21 @@ ret:
         return ret;
 }
 
-#define NR_U32_NODE (1<<12)
-static u32 gen_new_kid(struct tc_u_hnode *ht, u32 handle)
+static u32 gen_new_kid(struct tc_u_hnode *ht, u32 htid)
 {
-        struct tc_u_knode *n;
-        unsigned long i;
-        unsigned long *bitmap = kzalloc(BITS_TO_LONGS(NR_U32_NODE) * sizeof(unsigned long),
-                                        GFP_KERNEL);
-        if (!bitmap)
-                return handle | 0xFFF;
-
-        for (n = rtnl_dereference(ht->ht[TC_U32_HASH(handle)]);
-             n;
-             n = rtnl_dereference(n->next))
-                set_bit(TC_U32_NODE(n->handle), bitmap);
-
-        i = find_next_zero_bit(bitmap, NR_U32_NODE, 0x800);
-        if (i >= NR_U32_NODE)
-                i = find_next_zero_bit(bitmap, NR_U32_NODE, 1);
+        unsigned long idr_index;
+        u32 start = htid | 0x800;
+        u32 max = htid | 0xFFF;
+        u32 min = htid;
+
+        if (idr_alloc_ext(&ht->handle_idr, NULL, &idr_index,
+                          start, max + 1, GFP_KERNEL)) {
+                if (idr_alloc_ext(&ht->handle_idr, NULL, &idr_index,
+                                  min + 1, max + 1, GFP_KERNEL))
+                        return max;
+        }
 
-        kfree(bitmap);
-        return handle | (i >= NR_U32_NODE ? 0xFFF : i);
+        return (u32)idr_index;
 }
 
 static const struct nla_policy u32_policy[TCA_U32_MAX + 1] = {
@@ -834,6 +833,7 @@ static void u32_replace_knode(struct tcf_proto *tp, struct tc_u_common *tp_c,
                 if (pins->handle == n->handle)
                         break;
 
+        idr_replace_ext(&ht->handle_idr, n, n->handle);
         RCU_INIT_POINTER(n->next, pins->next);
         rcu_assign_pointer(*ins, n);
 }
@@ -966,22 +966,33 @@ static int u32_change(struct net *net, struct sk_buff *in_skb,
                         return -EINVAL;
                 if (TC_U32_KEY(handle))
                         return -EINVAL;
-                if (handle == 0) {
-                        handle = gen_new_htid(tp->data);
-                        if (handle == 0)
-                                return -ENOMEM;
-                }
                 ht = kzalloc(sizeof(*ht) + divisor*sizeof(void *), GFP_KERNEL);
                 if (ht == NULL)
                         return -ENOBUFS;
+                if (handle == 0) {
+                        handle = gen_new_htid(tp->data, ht);
+                        if (handle == 0) {
+                                kfree(ht);
+                                return -ENOMEM;
+                        }
+                } else {
+                        err = idr_alloc_ext(&tp_c->handle_idr, ht, NULL,
+                                            handle, handle + 1, GFP_KERNEL);
+                        if (err) {
+                                kfree(ht);
+                                return err;
+                        }
+                }
                 ht->tp_c = tp_c;
                 ht->refcnt = 1;
                 ht->divisor = divisor;
                 ht->handle = handle;
                 ht->prio = tp->prio;
+                idr_init(&ht->handle_idr);
 
                 err = u32_replace_hw_hnode(tp, ht, flags);
                 if (err) {
+                        idr_remove_ext(&tp_c->handle_idr, handle);
                         kfree(ht);
                         return err;
                 }
@@ -1015,24 +1026,33 @@ static int u32_change(struct net *net, struct sk_buff *in_skb,
                 if (TC_U32_HTID(handle) && TC_U32_HTID(handle^htid))
                         return -EINVAL;
                 handle = htid | TC_U32_NODE(handle);
+                err = idr_alloc_ext(&ht->handle_idr, NULL, NULL,
+                                    handle, handle + 1,
+                                    GFP_KERNEL);
+                if (err)
+                        return err;
         } else
                 handle = gen_new_kid(ht, htid);
 
-        if (tb[TCA_U32_SEL] == NULL)
-                return -EINVAL;
+        if (tb[TCA_U32_SEL] == NULL) {
+                err = -EINVAL;
+                goto erridr;
+        }
 
         s = nla_data(tb[TCA_U32_SEL]);
 
         n = kzalloc(sizeof(*n) + s->nkeys*sizeof(struct tc_u32_key), GFP_KERNEL);
-        if (n == NULL)
-                return -ENOBUFS;
+        if (n == NULL) {
+                err = -ENOBUFS;
+                goto erridr;
+        }
 
 #ifdef CONFIG_CLS_U32_PERF
         size = sizeof(struct tc_u32_pcnt) + s->nkeys * sizeof(u64);
         n->pf = __alloc_percpu(size, __alignof__(struct tc_u32_pcnt));
         if (!n->pf) {
-                kfree(n);
-                return -ENOBUFS;
+                err = -ENOBUFS;
+                goto errfree;
         }
 #endif
 
@@ -1095,9 +1115,12 @@ errhw:
 errout:
         tcf_exts_destroy(&n->exts);
 #ifdef CONFIG_CLS_U32_PERF
+errfree:
         free_percpu(n->pf);
 #endif
         kfree(n);
+erridr:
+        idr_remove_ext(&ht->handle_idr, handle);
         return err;
 }
 
diff --git a/net/sched/ematch.c b/net/sched/ematch.c
index 03b677bc0700..1331a4c2d8ff 100644
--- a/net/sched/ematch.c
+++ b/net/sched/ematch.c
@@ -178,7 +178,7 @@ static int tcf_em_validate(struct tcf_proto *tp,
         struct tcf_ematch_hdr *em_hdr = nla_data(nla);
         int data_len = nla_len(nla) - sizeof(*em_hdr);
         void *data = (void *) em_hdr + sizeof(*em_hdr);
-        struct net *net = dev_net(qdisc_dev(tp->q));
+        struct net *net = tp->chain->block->net;
 
         if (!TCF_EM_REL_VALID(em_hdr->flags))
                 goto errout;
diff --git a/net/sched/sch_api.c b/net/sched/sch_api.c
index 22bc6fc48311..b6c4f536876b 100644
--- a/net/sched/sch_api.c
+++ b/net/sched/sch_api.c
@@ -1502,7 +1502,6 @@ static int tc_dump_qdisc(struct sk_buff *skb, struct netlink_callback *cb)
         int s_idx, s_q_idx;
         struct net_device *dev;
         const struct nlmsghdr *nlh = cb->nlh;
-        struct tcmsg *tcm = nlmsg_data(nlh);
         struct nlattr *tca[TCA_MAX + 1];
         int err;
 
@@ -1512,7 +1511,7 @@ static int tc_dump_qdisc(struct sk_buff *skb, struct netlink_callback *cb)
         idx = 0;
         ASSERT_RTNL();
 
-        err = nlmsg_parse(nlh, sizeof(*tcm), tca, TCA_MAX, NULL, NULL);
+        err = nlmsg_parse(nlh, sizeof(struct tcmsg), tca, TCA_MAX, NULL, NULL);
         if (err < 0)
                 return err;
 
@@ -1664,9 +1663,11 @@ static int tcf_node_bind(struct tcf_proto *tp, void *n, struct tcf_walker *arg)
         struct tcf_bind_args *a = (void *)arg;
 
         if (tp->ops->bind_class) {
-                tcf_tree_lock(tp);
+                struct Qdisc *q = tcf_block_q(tp->chain->block);
+
+                sch_tree_lock(q);
                 tp->ops->bind_class(n, a->classid, a->cl);
-                tcf_tree_unlock(tp);
+                sch_tree_unlock(q);
         }
         return 0;
 }
diff --git a/net/sched/sch_atm.c b/net/sched/sch_atm.c
index c5fcdf1a58a0..2dbd249c0b2f 100644
--- a/net/sched/sch_atm.c
+++ b/net/sched/sch_atm.c
@@ -281,7 +281,7 @@ static int atm_tc_change(struct Qdisc *sch, u32 classid, u32 parent,
                 goto err_out;
         }
 
-        error = tcf_block_get(&flow->block, &flow->filter_list);
+        error = tcf_block_get(&flow->block, &flow->filter_list, sch);
         if (error) {
                 kfree(flow);
                 goto err_out;
@@ -546,7 +546,7 @@ static int atm_tc_init(struct Qdisc *sch, struct nlattr *opt)
                 p->link.q = &noop_qdisc;
         pr_debug("atm_tc_init: link (%p) qdisc %p\n", &p->link, p->link.q);
 
-        err = tcf_block_get(&p->link.block, &p->link.filter_list);
+        err = tcf_block_get(&p->link.block, &p->link.filter_list, sch);
         if (err)
                 return err;
 
diff --git a/net/sched/sch_cbq.c b/net/sched/sch_cbq.c
index dcef97fa8047..6361be7881f1 100644
--- a/net/sched/sch_cbq.c
+++ b/net/sched/sch_cbq.c
@@ -255,6 +255,7 @@ cbq_classify(struct sk_buff *skb, struct Qdisc *sch, int *qerr)
                 case TC_ACT_STOLEN:
                 case TC_ACT_TRAP:
                         *qerr = NET_XMIT_SUCCESS | __NET_XMIT_STOLEN;
+                        /* fall through */
                 case TC_ACT_SHOT:
                         return NULL;
                 case TC_ACT_RECLASSIFY:
@@ -1566,7 +1567,7 @@ cbq_change_class(struct Qdisc *sch, u32 classid, u32 parentid, struct nlattr **t
         if (cl == NULL)
                 goto failure;
 
-        err = tcf_block_get(&cl->block, &cl->filter_list);
+        err = tcf_block_get(&cl->block, &cl->filter_list, sch);
         if (err) {
                 kfree(cl);
                 return err;
diff --git a/net/sched/sch_cbs.c b/net/sched/sch_cbs.c
new file mode 100644
index 000000000000..7a72980c1509
--- /dev/null
+++ b/net/sched/sch_cbs.c
@@ -0,0 +1,373 @@
+/*
+ * net/sched/sch_cbs.c  Credit Based Shaper
+ *
+ *              This program is free software; you can redistribute it and/or
+ *              modify it under the terms of the GNU General Public License
+ *              as published by the Free Software Foundation; either version
+ *              2 of the License, or (at your option) any later version.
+ *
+ * Authors:     Vinicius Costa Gomes <vinicius.gomes@intel.com>
+ *
+ */
+
+/* Credit Based Shaper (CBS)
+ * =========================
+ *
+ * This is a simple rate-limiting shaper aimed at TSN applications on
+ * systems with known traffic workloads.
+ *
+ * Its algorithm is defined by the IEEE 802.1Q-2014 Specification,
+ * Section 8.6.8.2, and explained in more detail in the Annex L of the
+ * same specification.
+ *
+ * There are four tunables to be considered:
+ *
+ *      'idleslope': Idleslope is the rate of credits that is
+ *      accumulated (in kilobits per second) when there is at least
+ *      one packet waiting for transmission. Packets are transmitted
+ *      when the current value of credits is equal or greater than
+ *      zero. When there is no packet to be transmitted the amount of
+ *      credits is set to zero. This is the main tunable of the CBS
+ *      algorithm.
+ *
+ *      'sendslope':
+ *      Sendslope is the rate of credits that is depleted (it should be a
+ *      negative number of kilobits per second) when a transmission is
+ *      ocurring. It can be calculated as follows, (IEEE 802.1Q-2014 Section
+ *      8.6.8.2 item g):
+ *
+ *      sendslope = idleslope - port_transmit_rate
+ *
+ *      'hicredit': Hicredit defines the maximum amount of credits (in
+ *      bytes) that can be accumulated. Hicredit depends on the
+ *      characteristics of interfering traffic,
+ *      'max_interference_size' is the maximum size of any burst of
+ *      traffic that can delay the transmission of a frame that is
+ *      available for transmission for this traffic class, (IEEE
+ *      802.1Q-2014 Annex L, Equation L-3):
+ *
+ *      hicredit = max_interference_size * (idleslope / port_transmit_rate)
+ *
+ *      'locredit': Locredit is the minimum amount of credits that can
+ *      be reached. It is a function of the traffic flowing through
+ *      this qdisc (IEEE 802.1Q-2014 Annex L, Equation L-2):
+ *
+ *      locredit = max_frame_size * (sendslope / port_transmit_rate)
+ */
+
+#include <linux/module.h>
+#include <linux/types.h>
+#include <linux/kernel.h>
+#include <linux/string.h>
+#include <linux/errno.h>
+#include <linux/skbuff.h>
+#include <net/netlink.h>
+#include <net/sch_generic.h>
+#include <net/pkt_sched.h>
+
+#define BYTES_PER_KBIT (1000LL / 8)
+
+struct cbs_sched_data {
+        bool offload;
+        int queue;
+        s64 port_rate; /* in bytes/s */
+        s64 last; /* timestamp in ns */
+        s64 credits; /* in bytes */
+        s32 locredit; /* in bytes */
+        s32 hicredit; /* in bytes */
+        s64 sendslope; /* in bytes/s */
+        s64 idleslope; /* in bytes/s */
+        struct qdisc_watchdog watchdog;
+        int (*enqueue)(struct sk_buff *skb, struct Qdisc *sch);
+        struct sk_buff *(*dequeue)(struct Qdisc *sch);
+};
+
+static int cbs_enqueue_offload(struct sk_buff *skb, struct Qdisc *sch)
+{
+        return qdisc_enqueue_tail(skb, sch);
+}
+
+static int cbs_enqueue_soft(struct sk_buff *skb, struct Qdisc *sch)
+{
+        struct cbs_sched_data *q = qdisc_priv(sch);
+
+        if (sch->q.qlen == 0 && q->credits > 0) {
+                /* We need to stop accumulating credits when there's
+                 * no enqueued packets and q->credits is positive.
+                 */
+                q->credits = 0;
+                q->last = ktime_get_ns();
+        }
+
+        return qdisc_enqueue_tail(skb, sch);
+}
+
+static int cbs_enqueue(struct sk_buff *skb, struct Qdisc *sch,
+                       struct sk_buff **to_free)
+{
+        struct cbs_sched_data *q = qdisc_priv(sch);
+
+        return q->enqueue(skb, sch);
+}
+
+/* timediff is in ns, slope is in bytes/s */
+static s64 timediff_to_credits(s64 timediff, s64 slope)
+{
+        return div64_s64(timediff * slope, NSEC_PER_SEC);
+}
+
+static s64 delay_from_credits(s64 credits, s64 slope)
+{
+        if (unlikely(slope == 0))
+                return S64_MAX;
+
+        return div64_s64(-credits * NSEC_PER_SEC, slope);
+}
+
+static s64 credits_from_len(unsigned int len, s64 slope, s64 port_rate)
+{
+        if (unlikely(port_rate == 0))
+                return S64_MAX;
+
+        return div64_s64(len * slope, port_rate);
+}
+
+static struct sk_buff *cbs_dequeue_soft(struct Qdisc *sch)
+{
+        struct cbs_sched_data *q = qdisc_priv(sch);
+        s64 now = ktime_get_ns();
+        struct sk_buff *skb;
+        s64 credits;
+        int len;
+
+        if (q->credits < 0) {
+                credits = timediff_to_credits(now - q->last, q->idleslope);
+
+                credits = q->credits + credits;
+                q->credits = min_t(s64, credits, q->hicredit);
+
+                if (q->credits < 0) {
+                        s64 delay;
+
+                        delay = delay_from_credits(q->credits, q->idleslope);
+                        qdisc_watchdog_schedule_ns(&q->watchdog, now + delay);
+
+                        q->last = now;
+
+                        return NULL;
+                }
+        }
+
+        skb = qdisc_dequeue_head(sch);
+        if (!skb)
+                return NULL;
+
+        len = qdisc_pkt_len(skb);
+
+        /* As sendslope is a negative number, this will decrease the
+         * amount of q->credits.
+         */
+        credits = credits_from_len(len, q->sendslope, q->port_rate);
+        credits += q->credits;
+
+        q->credits = max_t(s64, credits, q->locredit);
+        q->last = now;
+
+        return skb;
+}
+
+static struct sk_buff *cbs_dequeue_offload(struct Qdisc *sch)
+{
+        return qdisc_dequeue_head(sch);
+}
+
+static struct sk_buff *cbs_dequeue(struct Qdisc *sch)
+{
+        struct cbs_sched_data *q = qdisc_priv(sch);
+
+        return q->dequeue(sch);
+}
+
+static const struct nla_policy cbs_policy[TCA_CBS_MAX + 1] = {
+        [TCA_CBS_PARMS] = { .len = sizeof(struct tc_cbs_qopt) },
+};
+
+static void cbs_disable_offload(struct net_device *dev,
+                                struct cbs_sched_data *q)
+{
+        struct tc_cbs_qopt_offload cbs = { };
+        const struct net_device_ops *ops;
+        int err;
+
+        if (!q->offload)
+                return;
+
+        q->enqueue = cbs_enqueue_soft;
+        q->dequeue = cbs_dequeue_soft;
+
+        ops = dev->netdev_ops;
+        if (!ops->ndo_setup_tc)
+                return;
+
+        cbs.queue = q->queue;
+        cbs.enable = 0;
+
+        err = ops->ndo_setup_tc(dev, TC_SETUP_QDISC_CBS, &cbs);
+        if (err < 0)
+                pr_warn("Couldn't disable CBS offload for queue %d\n",
+                        cbs.queue);
+}
+
+static int cbs_enable_offload(struct net_device *dev, struct cbs_sched_data *q,
+                              const struct tc_cbs_qopt *opt)
+{
+        const struct net_device_ops *ops = dev->netdev_ops;
+        struct tc_cbs_qopt_offload cbs = { };
+        int err;
+
+        if (!ops->ndo_setup_tc)
+                return -EOPNOTSUPP;
+
+        cbs.queue = q->queue;
+
+        cbs.enable = 1;
+        cbs.hicredit = opt->hicredit;
+        cbs.locredit = opt->locredit;
+        cbs.idleslope = opt->idleslope;
+        cbs.sendslope = opt->sendslope;
+
+        err = ops->ndo_setup_tc(dev, TC_SETUP_QDISC_CBS, &cbs);
+        if (err < 0)
+                return err;
+
+        q->enqueue = cbs_enqueue_offload;
+        q->dequeue = cbs_dequeue_offload;
+
+        return 0;
+}
+
+static int cbs_change(struct Qdisc *sch, struct nlattr *opt)
+{
+        struct cbs_sched_data *q = qdisc_priv(sch);
+        struct net_device *dev = qdisc_dev(sch);
+        struct nlattr *tb[TCA_CBS_MAX + 1];
+        struct tc_cbs_qopt *qopt;
+        int err;
+
+        err = nla_parse_nested(tb, TCA_CBS_MAX, opt, cbs_policy, NULL);
+        if (err < 0)
+                return err;
+
+        if (!tb[TCA_CBS_PARMS])
+                return -EINVAL;
+
+        qopt = nla_data(tb[TCA_CBS_PARMS]);
+
+        if (!qopt->offload) {
+                struct ethtool_link_ksettings ecmd;
+                s64 link_speed;
+
+                if (!__ethtool_get_link_ksettings(dev, &ecmd))
+                        link_speed = ecmd.base.speed;
+                else
+                        link_speed = SPEED_1000;
+
+                q->port_rate = link_speed * 1000 * BYTES_PER_KBIT;
+
+                cbs_disable_offload(dev, q);
+        } else {
+                err = cbs_enable_offload(dev, q, qopt);
+                if (err < 0)
+                        return err;
+        }
+
+        /* Everything went OK, save the parameters used. */
+        q->hicredit = qopt->hicredit;
+        q->locredit = qopt->locredit;
+        q->idleslope = qopt->idleslope * BYTES_PER_KBIT;
+        q->sendslope = qopt->sendslope * BYTES_PER_KBIT;
+        q->offload = qopt->offload;
+
+        return 0;
+}
+
+static int cbs_init(struct Qdisc *sch, struct nlattr *opt)
+{
+        struct cbs_sched_data *q = qdisc_priv(sch);
+        struct net_device *dev = qdisc_dev(sch);
+
+        if (!opt)
+                return -EINVAL;
+
+        q->queue = sch->dev_queue - netdev_get_tx_queue(dev, 0);
+
+        q->enqueue = cbs_enqueue_soft;
+        q->dequeue = cbs_dequeue_soft;
+
+        qdisc_watchdog_init(&q->watchdog, sch);
+
+        return cbs_change(sch, opt);
+}
+
+static void cbs_destroy(struct Qdisc *sch)
+{
+        struct cbs_sched_data *q = qdisc_priv(sch);
+        struct net_device *dev = qdisc_dev(sch);
+
+        qdisc_watchdog_cancel(&q->watchdog);
+
+        cbs_disable_offload(dev, q);
+}
+
+static int cbs_dump(struct Qdisc *sch, struct sk_buff *skb)
+{
+        struct cbs_sched_data *q = qdisc_priv(sch);
+        struct tc_cbs_qopt opt = { };
+        struct nlattr *nest;
+
+        nest = nla_nest_start(skb, TCA_OPTIONS);
+        if (!nest)
+                goto nla_put_failure;
+
+        opt.hicredit = q->hicredit;
+        opt.locredit = q->locredit;
+        opt.sendslope = div64_s64(q->sendslope, BYTES_PER_KBIT);
+        opt.idleslope = div64_s64(q->idleslope, BYTES_PER_KBIT);
+        opt.offload = q->offload;
+
+        if (nla_put(skb, TCA_CBS_PARMS, sizeof(opt), &opt))
+                goto nla_put_failure;
+
+        return nla_nest_end(skb, nest);
+
+nla_put_failure:
+        nla_nest_cancel(skb, nest);
+        return -1;
+}
+
+static struct Qdisc_ops cbs_qdisc_ops __read_mostly = {
+        .id             =       "cbs",
+        .priv_size      =       sizeof(struct cbs_sched_data),
+        .enqueue        =       cbs_enqueue,
+        .dequeue        =       cbs_dequeue,
+        .peek           =       qdisc_peek_dequeued,
+        .init           =       cbs_init,
+        .reset          =       qdisc_reset_queue,
+        .destroy        =       cbs_destroy,
+        .change         =       cbs_change,
+        .dump           =       cbs_dump,
+        .owner          =       THIS_MODULE,
+};
+
+static int __init cbs_module_init(void)
+{
+        return register_qdisc(&cbs_qdisc_ops);
+}
+
+static void __exit cbs_module_exit(void)
+{
+        unregister_qdisc(&cbs_qdisc_ops);
+}
+module_init(cbs_module_init)
+module_exit(cbs_module_exit)
+MODULE_LICENSE("GPL");
diff --git a/net/sched/sch_drr.c b/net/sched/sch_drr.c
index 2d0e8d4bdc29..5bbcef3dcd8c 100644
--- a/net/sched/sch_drr.c
+++ b/net/sched/sch_drr.c
@@ -321,6 +321,7 @@ static struct drr_class *drr_classify(struct sk_buff *skb, struct Qdisc *sch,
                 case TC_ACT_STOLEN:
                 case TC_ACT_TRAP:
                         *qerr = NET_XMIT_SUCCESS | __NET_XMIT_STOLEN;
+                        /* fall through */
                 case TC_ACT_SHOT:
                         return NULL;
                 }
@@ -412,7 +413,7 @@ static int drr_init_qdisc(struct Qdisc *sch, struct nlattr *opt)
         struct drr_sched *q = qdisc_priv(sch);
         int err;
 
-        err = tcf_block_get(&q->block, &q->filter_list);
+        err = tcf_block_get(&q->block, &q->filter_list, sch);
         if (err)
                 return err;
         err = qdisc_class_hash_init(&q->clhash);
diff --git a/net/sched/sch_dsmark.c b/net/sched/sch_dsmark.c
index 2836c80c7aa5..fb4fb71c68cf 100644
--- a/net/sched/sch_dsmark.c
+++ b/net/sched/sch_dsmark.c
@@ -344,7 +344,7 @@ static int dsmark_init(struct Qdisc *sch, struct nlattr *opt)
         if (!opt)
                 goto errout;
 
-        err = tcf_block_get(&p->block, &p->filter_list);
+        err = tcf_block_get(&p->block, &p->filter_list, sch);
         if (err)
                 return err;
 
diff --git a/net/sched/sch_fq_codel.c b/net/sched/sch_fq_codel.c
index de3b57ceca7b..0305d791ea94 100644
--- a/net/sched/sch_fq_codel.c
+++ b/net/sched/sch_fq_codel.c
@@ -105,6 +105,7 @@ static unsigned int fq_codel_classify(struct sk_buff *skb, struct Qdisc *sch,
                 case TC_ACT_QUEUED:
                 case TC_ACT_TRAP:
                         *qerr = NET_XMIT_SUCCESS | __NET_XMIT_STOLEN;
+                        /* fall through */
                 case TC_ACT_SHOT:
                         return 0;
                 }
@@ -481,7 +482,7 @@ static int fq_codel_init(struct Qdisc *sch, struct nlattr *opt)
                         return err;
         }
 
-        err = tcf_block_get(&q->block, &q->filter_list);
+        err = tcf_block_get(&q->block, &q->filter_list, sch);
         if (err)
                 return err;
 
diff --git a/net/sched/sch_generic.c b/net/sched/sch_generic.c
index bf8c81e07c70..3839cbbdc32b 100644
--- a/net/sched/sch_generic.c
+++ b/net/sched/sch_generic.c
@@ -288,9 +288,9 @@ unsigned long dev_trans_start(struct net_device *dev)
 }
 EXPORT_SYMBOL(dev_trans_start);
 
-static void dev_watchdog(unsigned long arg)
+static void dev_watchdog(struct timer_list *t)
 {
-        struct net_device *dev = (struct net_device *)arg;
+        struct net_device *dev = from_timer(dev, t, watchdog_timer);
 
         netif_tx_lock(dev);
         if (!qdisc_tx_is_noop(dev)) {
@@ -603,8 +603,14 @@ struct Qdisc *qdisc_alloc(struct netdev_queue *dev_queue,
         struct Qdisc *sch;
         unsigned int size = QDISC_ALIGN(sizeof(*sch)) + ops->priv_size;
         int err = -ENOBUFS;
-        struct net_device *dev = dev_queue->dev;
+        struct net_device *dev;
+
+        if (!dev_queue) {
+                err = -EINVAL;
+                goto errout;
+        }
 
+        dev = dev_queue->dev;
         p = kzalloc_node(size, GFP_KERNEL,
                          netdev_queue_numa_node_read(dev_queue));
 
@@ -689,10 +695,8 @@ void qdisc_reset(struct Qdisc *qdisc)
 }
 EXPORT_SYMBOL(qdisc_reset);
 
-static void qdisc_rcu_free(struct rcu_head *head)
+static void qdisc_free(struct Qdisc *qdisc)
 {
-        struct Qdisc *qdisc = container_of(head, struct Qdisc, rcu_head);
-
         if (qdisc_is_percpu_stats(qdisc)) {
                 free_percpu(qdisc->cpu_bstats);
                 free_percpu(qdisc->cpu_qstats);
@@ -725,11 +729,7 @@ void qdisc_destroy(struct Qdisc *qdisc)
 
         kfree_skb_list(qdisc->gso_skb);
         kfree_skb(qdisc->skb_bad_txq);
-        /*
-         * gen_estimator est_timer() might access qdisc->q.lock,
-         * wait a RCU grace period before freeing qdisc.
-         */
-        call_rcu(&qdisc->rcu_head, qdisc_rcu_free);
+        qdisc_free(qdisc);
 }
 EXPORT_SYMBOL(qdisc_destroy);
 
@@ -960,7 +960,7 @@ void dev_init_scheduler(struct net_device *dev)
         if (dev_ingress_queue(dev))
                 dev_init_scheduler_queue(dev, dev_ingress_queue(dev), &noop_qdisc);
 
-        setup_timer(&dev->watchdog_timer, dev_watchdog, (unsigned long)dev);
+        timer_setup(&dev->watchdog_timer, dev_watchdog, 0);
 }
 
 static void shutdown_scheduler_queue(struct net_device *dev,
@@ -1024,3 +1024,49 @@ void psched_ratecfg_precompute(struct psched_ratecfg *r,
         }
 }
 EXPORT_SYMBOL(psched_ratecfg_precompute);
+
+static void mini_qdisc_rcu_func(struct rcu_head *head)
+{
+}
+
+void mini_qdisc_pair_swap(struct mini_Qdisc_pair *miniqp,
+                          struct tcf_proto *tp_head)
+{
+        struct mini_Qdisc *miniq_old = rtnl_dereference(*miniqp->p_miniq);
+        struct mini_Qdisc *miniq;
+
+        if (!tp_head) {
+                RCU_INIT_POINTER(*miniqp->p_miniq, NULL);
+                return;
+        }
+
+        miniq = !miniq_old || miniq_old == &miniqp->miniq2 ?
+                &miniqp->miniq1 : &miniqp->miniq2;
+
+        /* We need to make sure that readers won't see the miniq
+         * we are about to modify. So wait until previous call_rcu_bh callback
+         * is done.
+         */
+        rcu_barrier_bh();
+        miniq->filter_list = tp_head;
+        rcu_assign_pointer(*miniqp->p_miniq, miniq);
+
+        if (miniq_old)
+                /* This is counterpart of the rcu barrier above. We need to
+                 * block potential new user of miniq_old until all readers
+                 * are not seeing it.
+                 */
+                call_rcu_bh(&miniq_old->rcu, mini_qdisc_rcu_func);
+}
+EXPORT_SYMBOL(mini_qdisc_pair_swap);
+
+void mini_qdisc_pair_init(struct mini_Qdisc_pair *miniqp, struct Qdisc *qdisc,
+                          struct mini_Qdisc __rcu **p_miniq)
+{
+        miniqp->miniq1.cpu_bstats = qdisc->cpu_bstats;
+        miniqp->miniq1.cpu_qstats = qdisc->cpu_qstats;
+        miniqp->miniq2.cpu_bstats = qdisc->cpu_bstats;
+        miniqp->miniq2.cpu_qstats = qdisc->cpu_qstats;
+        miniqp->p_miniq = p_miniq;
+}
+EXPORT_SYMBOL(mini_qdisc_pair_init);
diff --git a/net/sched/sch_hfsc.c b/net/sched/sch_hfsc.c
index 3f88b75488b0..d04068a97d81 100644
--- a/net/sched/sch_hfsc.c
+++ b/net/sched/sch_hfsc.c
@@ -1033,7 +1033,7 @@ hfsc_change_class(struct Qdisc *sch, u32 classid, u32 parentid,
         if (cl == NULL)
                 return -ENOBUFS;
 
-        err = tcf_block_get(&cl->block, &cl->filter_list);
+        err = tcf_block_get(&cl->block, &cl->filter_list, sch);
         if (err) {
                 kfree(cl);
                 return err;
@@ -1144,6 +1144,7 @@ hfsc_classify(struct sk_buff *skb, struct Qdisc *sch, int *qerr)
                 case TC_ACT_STOLEN:
                 case TC_ACT_TRAP:
                         *qerr = NET_XMIT_SUCCESS | __NET_XMIT_STOLEN;
+                        /* fall through */
                 case TC_ACT_SHOT:
                         return NULL;
                 }
@@ -1405,7 +1406,7 @@ hfsc_init_qdisc(struct Qdisc *sch, struct nlattr *opt)
                 return err;
         q->eligible = RB_ROOT;
 
-        err = tcf_block_get(&q->root.block, &q->root.filter_list);
+        err = tcf_block_get(&q->root.block, &q->root.filter_list, sch);
         if (err)
                 return err;
 
diff --git a/net/sched/sch_htb.c b/net/sched/sch_htb.c
index 7e148376ba52..fa0380730ff0 100644
--- a/net/sched/sch_htb.c
+++ b/net/sched/sch_htb.c
@@ -142,6 +142,7 @@ struct htb_class {
         struct rb_node          node[TC_HTB_NUMPRIO];   /* node for self or feed tree */
 
         unsigned int drops ____cacheline_aligned_in_smp;
+        unsigned int            overlimits;
 };
 
 struct htb_level {
@@ -243,6 +244,7 @@ static struct htb_class *htb_classify(struct sk_buff *skb, struct Qdisc *sch,
                 case TC_ACT_STOLEN:
                 case TC_ACT_TRAP:
                         *qerr = NET_XMIT_SUCCESS | __NET_XMIT_STOLEN;
+                        /* fall through */
                 case TC_ACT_SHOT:
                         return NULL;
                 }
@@ -533,6 +535,9 @@ htb_change_class_mode(struct htb_sched *q, struct htb_class *cl, s64 *diff)
         if (new_mode == cl->cmode)
                 return;
 
+        if (new_mode == HTB_CANT_SEND)
+                cl->overlimits++;
+
         if (cl->prio_activity) {        /* not necessary: speed optimization */
                 if (cl->cmode != HTB_CANT_SEND)
                         htb_deactivate_prios(q, cl);
@@ -1026,7 +1031,7 @@ static int htb_init(struct Qdisc *sch, struct nlattr *opt)
         if (!opt)
                 return -EINVAL;
 
-        err = tcf_block_get(&q->block, &q->filter_list);
+        err = tcf_block_get(&q->block, &q->filter_list, sch);
         if (err)
                 return err;
 
@@ -1143,6 +1148,7 @@ htb_dump_class_stats(struct Qdisc *sch, unsigned long arg, struct gnet_dump *d)
         struct htb_class *cl = (struct htb_class *)arg;
         struct gnet_stats_queue qs = {
                 .drops = cl->drops,
+                .overlimits = cl->overlimits,
         };
         __u32 qlen = 0;
 
@@ -1388,7 +1394,7 @@ static int htb_change_class(struct Qdisc *sch, u32 classid,
                 if (!cl)
                         goto failure;
 
-                err = tcf_block_get(&cl->block, &cl->filter_list);
+                err = tcf_block_get(&cl->block, &cl->filter_list, sch);
                 if (err) {
                         kfree(cl);
                         goto failure;
diff --git a/net/sched/sch_ingress.c b/net/sched/sch_ingress.c
index 44de4ee51ce9..5ecc38f35d47 100644
--- a/net/sched/sch_ingress.c
+++ b/net/sched/sch_ingress.c
@@ -20,6 +20,8 @@
 
 struct ingress_sched_data {
         struct tcf_block *block;
+        struct tcf_block_ext_info block_info;
+        struct mini_Qdisc_pair miniqp;
 };
 
 static struct Qdisc *ingress_leaf(struct Qdisc *sch, unsigned long arg)
@@ -53,13 +55,26 @@ static struct tcf_block *ingress_tcf_block(struct Qdisc *sch, unsigned long cl)
         return q->block;
 }
 
+static void clsact_chain_head_change(struct tcf_proto *tp_head, void *priv)
+{
+        struct mini_Qdisc_pair *miniqp = priv;
+
+        mini_qdisc_pair_swap(miniqp, tp_head);
+}
+
 static int ingress_init(struct Qdisc *sch, struct nlattr *opt)
 {
         struct ingress_sched_data *q = qdisc_priv(sch);
         struct net_device *dev = qdisc_dev(sch);
         int err;
 
-        err = tcf_block_get(&q->block, &dev->ingress_cl_list);
+        mini_qdisc_pair_init(&q->miniqp, sch, &dev->miniq_ingress);
+
+        q->block_info.binder_type = TCF_BLOCK_BINDER_TYPE_CLSACT_INGRESS;
+        q->block_info.chain_head_change = clsact_chain_head_change;
+        q->block_info.chain_head_change_priv = &q->miniqp;
+
+        err = tcf_block_get_ext(&q->block, sch, &q->block_info);
         if (err)
                 return err;
 
@@ -73,7 +88,7 @@ static void ingress_destroy(struct Qdisc *sch)
 {
         struct ingress_sched_data *q = qdisc_priv(sch);
 
-        tcf_block_put(q->block);
+        tcf_block_put_ext(q->block, sch, &q->block_info);
         net_dec_ingress_queue();
 }
 
@@ -114,6 +129,10 @@ static struct Qdisc_ops ingress_qdisc_ops __read_mostly = {
 struct clsact_sched_data {
         struct tcf_block *ingress_block;
         struct tcf_block *egress_block;
+        struct tcf_block_ext_info ingress_block_info;
+        struct tcf_block_ext_info egress_block_info;
+        struct mini_Qdisc_pair miniqp_ingress;
+        struct mini_Qdisc_pair miniqp_egress;
 };
 
 static unsigned long clsact_find(struct Qdisc *sch, u32 classid)
@@ -153,13 +172,25 @@ static int clsact_init(struct Qdisc *sch, struct nlattr *opt)
         struct net_device *dev = qdisc_dev(sch);
         int err;
 
-        err = tcf_block_get(&q->ingress_block, &dev->ingress_cl_list);
+        mini_qdisc_pair_init(&q->miniqp_ingress, sch, &dev->miniq_ingress);
+
+        q->ingress_block_info.binder_type = TCF_BLOCK_BINDER_TYPE_CLSACT_INGRESS;
+        q->ingress_block_info.chain_head_change = clsact_chain_head_change;
+        q->ingress_block_info.chain_head_change_priv = &q->miniqp_ingress;
+
+        err = tcf_block_get_ext(&q->ingress_block, sch, &q->ingress_block_info);
         if (err)
                 return err;
 
-        err = tcf_block_get(&q->egress_block, &dev->egress_cl_list);
+        mini_qdisc_pair_init(&q->miniqp_egress, sch, &dev->miniq_egress);
+
+        q->egress_block_info.binder_type = TCF_BLOCK_BINDER_TYPE_CLSACT_EGRESS;
+        q->egress_block_info.chain_head_change = clsact_chain_head_change;
+        q->egress_block_info.chain_head_change_priv = &q->miniqp_egress;
+
+        err = tcf_block_get_ext(&q->egress_block, sch, &q->egress_block_info);
         if (err)
-                return err;
+                goto err_egress_block_get;
 
         net_inc_ingress_queue();
         net_inc_egress_queue();
@@ -167,14 +198,18 @@ static int clsact_init(struct Qdisc *sch, struct nlattr *opt)
         sch->flags |= TCQ_F_CPUSTATS;
 
         return 0;
+
+err_egress_block_get:
+        tcf_block_put_ext(q->ingress_block, sch, &q->ingress_block_info);
+        return err;
 }
 
 static void clsact_destroy(struct Qdisc *sch)
 {
         struct clsact_sched_data *q = qdisc_priv(sch);
 
-        tcf_block_put(q->egress_block);
-        tcf_block_put(q->ingress_block);
+        tcf_block_put_ext(q->egress_block, sch, &q->egress_block_info);
+        tcf_block_put_ext(q->ingress_block, sch, &q->ingress_block_info);
 
         net_dec_ingress_queue();
         net_dec_egress_queue();
diff --git a/net/sched/sch_mq.c b/net/sched/sch_mq.c
index f3a3e507422b..213b586a06a0 100644
--- a/net/sched/sch_mq.c
+++ b/net/sched/sch_mq.c
@@ -130,15 +130,7 @@ static struct netdev_queue *mq_queue_get(struct Qdisc *sch, unsigned long cl)
 static struct netdev_queue *mq_select_queue(struct Qdisc *sch,
                                             struct tcmsg *tcm)
 {
-        unsigned int ntx = TC_H_MIN(tcm->tcm_parent);
-        struct netdev_queue *dev_queue = mq_queue_get(sch, ntx);
-
-        if (!dev_queue) {
-                struct net_device *dev = qdisc_dev(sch);
-
-                return netdev_get_tx_queue(dev, 0);
-        }
-        return dev_queue;
+        return mq_queue_get(sch, TC_H_MIN(tcm->tcm_parent));
 }
 
 static int mq_graft(struct Qdisc *sch, unsigned long cl, struct Qdisc *new,
diff --git a/net/sched/sch_mqprio.c b/net/sched/sch_mqprio.c
index 6bcdfe6e7b63..b85885a9d8a1 100644
--- a/net/sched/sch_mqprio.c
+++ b/net/sched/sch_mqprio.c
@@ -18,10 +18,16 @@
 #include <net/netlink.h>
 #include <net/pkt_sched.h>
 #include <net/sch_generic.h>
+#include <net/pkt_cls.h>
 
 struct mqprio_sched {
         struct Qdisc            **qdiscs;
+        u16 mode;
+        u16 shaper;
         int hw_offload;
+        u32 flags;
+        u64 min_rate[TC_QOPT_MAX_QUEUE];
+        u64 max_rate[TC_QOPT_MAX_QUEUE];
 };
 
 static void mqprio_destroy(struct Qdisc *sch)
@@ -39,9 +45,18 @@ static void mqprio_destroy(struct Qdisc *sch)
         }
 
         if (priv->hw_offload && dev->netdev_ops->ndo_setup_tc) {
-                struct tc_mqprio_qopt mqprio = {};
-
-                dev->netdev_ops->ndo_setup_tc(dev, TC_SETUP_MQPRIO, &mqprio);
+                struct tc_mqprio_qopt_offload mqprio = { { 0 } };
+
+                switch (priv->mode) {
+                case TC_MQPRIO_MODE_DCB:
+                case TC_MQPRIO_MODE_CHANNEL:
+                        dev->netdev_ops->ndo_setup_tc(dev,
+                                                      TC_SETUP_QDISC_MQPRIO,
+                                                      &mqprio);
+                        break;
+                default:
+                        return;
+                }
         } else {
                 netdev_set_num_tc(dev, 0);
         }
@@ -97,6 +112,26 @@ static int mqprio_parse_opt(struct net_device *dev, struct tc_mqprio_qopt *qopt)
         return 0;
 }
 
+static const struct nla_policy mqprio_policy[TCA_MQPRIO_MAX + 1] = {
+        [TCA_MQPRIO_MODE]       = { .len = sizeof(u16) },
+        [TCA_MQPRIO_SHAPER]     = { .len = sizeof(u16) },
+        [TCA_MQPRIO_MIN_RATE64] = { .type = NLA_NESTED },
+        [TCA_MQPRIO_MAX_RATE64] = { .type = NLA_NESTED },
+};
+
+static int parse_attr(struct nlattr *tb[], int maxtype, struct nlattr *nla,
+                      const struct nla_policy *policy, int len)
+{
+        int nested_len = nla_len(nla) - NLA_ALIGN(len);
+
+        if (nested_len >= nla_attr_size(0))
+                return nla_parse(tb, maxtype, nla_data(nla) + NLA_ALIGN(len),
+                                 nested_len, policy, NULL);
+
+        memset(tb, 0, sizeof(struct nlattr *) * (maxtype + 1));
+        return 0;
+}
+
 static int mqprio_init(struct Qdisc *sch, struct nlattr *opt)
 {
         struct net_device *dev = qdisc_dev(sch);
@@ -105,6 +140,10 @@ static int mqprio_init(struct Qdisc *sch, struct nlattr *opt)
         struct Qdisc *qdisc;
         int i, err = -EOPNOTSUPP;
         struct tc_mqprio_qopt *qopt = NULL;
+        struct nlattr *tb[TCA_MQPRIO_MAX + 1];
+        struct nlattr *attr;
+        int rem;
+        int len;
 
         BUILD_BUG_ON(TC_MAX_QUEUE != TC_QOPT_MAX_QUEUE);
         BUILD_BUG_ON(TC_BITMASK != TC_QOPT_BITMASK);
@@ -115,6 +154,10 @@ static int mqprio_init(struct Qdisc *sch, struct nlattr *opt)
         if (!netif_is_multiqueue(dev))
                 return -EOPNOTSUPP;
 
+        /* make certain can allocate enough classids to handle queues */
+        if (dev->num_tx_queues >= TC_H_MIN_PRIORITY)
+                return -ENOMEM;
+
         if (!opt || nla_len(opt) < sizeof(*qopt))
                 return -EINVAL;
 
@@ -122,6 +165,59 @@ static int mqprio_init(struct Qdisc *sch, struct nlattr *opt)
         if (mqprio_parse_opt(dev, qopt))
                 return -EINVAL;
 
+        len = nla_len(opt) - NLA_ALIGN(sizeof(*qopt));
+        if (len > 0) {
+                err = parse_attr(tb, TCA_MQPRIO_MAX, opt, mqprio_policy,
+                                 sizeof(*qopt));
+                if (err < 0)
+                        return err;
+
+                if (!qopt->hw)
+                        return -EINVAL;
+
+                if (tb[TCA_MQPRIO_MODE]) {
+                        priv->flags |= TC_MQPRIO_F_MODE;
+                        priv->mode = *(u16 *)nla_data(tb[TCA_MQPRIO_MODE]);
+                }
+
+                if (tb[TCA_MQPRIO_SHAPER]) {
+                        priv->flags |= TC_MQPRIO_F_SHAPER;
+                        priv->shaper = *(u16 *)nla_data(tb[TCA_MQPRIO_SHAPER]);
+                }
+
+                if (tb[TCA_MQPRIO_MIN_RATE64]) {
+                        if (priv->shaper != TC_MQPRIO_SHAPER_BW_RATE)
+                                return -EINVAL;
+                        i = 0;
+                        nla_for_each_nested(attr, tb[TCA_MQPRIO_MIN_RATE64],
+                                            rem) {
+                                if (nla_type(attr) != TCA_MQPRIO_MIN_RATE64)
+                                        return -EINVAL;
+                                if (i >= qopt->num_tc)
+                                        break;
+                                priv->min_rate[i] = *(u64 *)nla_data(attr);
+                                i++;
+                        }
+                        priv->flags |= TC_MQPRIO_F_MIN_RATE;
+                }
+
+                if (tb[TCA_MQPRIO_MAX_RATE64]) {
+                        if (priv->shaper != TC_MQPRIO_SHAPER_BW_RATE)
+                                return -EINVAL;
+                        i = 0;
+                        nla_for_each_nested(attr, tb[TCA_MQPRIO_MAX_RATE64],
+                                            rem) {
+                                if (nla_type(attr) != TCA_MQPRIO_MAX_RATE64)
+                                        return -EINVAL;
+                                if (i >= qopt->num_tc)
+                                        break;
+                                priv->max_rate[i] = *(u64 *)nla_data(attr);
+                                i++;
+                        }
+                        priv->flags |= TC_MQPRIO_F_MAX_RATE;
+                }
+        }
+
         /* pre-allocate qdisc, attachment can't fail */
         priv->qdiscs = kcalloc(dev->num_tx_queues, sizeof(priv->qdiscs[0]),
                                GFP_KERNEL);
@@ -146,14 +242,36 @@ static int mqprio_init(struct Qdisc *sch, struct nlattr *opt)
          * supplied and verified mapping
          */
         if (qopt->hw) {
-                struct tc_mqprio_qopt mqprio = *qopt;
+                struct tc_mqprio_qopt_offload mqprio = {.qopt = *qopt};
 
-                err = dev->netdev_ops->ndo_setup_tc(dev, TC_SETUP_MQPRIO,
+                switch (priv->mode) {
+                case TC_MQPRIO_MODE_DCB:
+                        if (priv->shaper != TC_MQPRIO_SHAPER_DCB)
+                                return -EINVAL;
+                        break;
+                case TC_MQPRIO_MODE_CHANNEL:
+                        mqprio.flags = priv->flags;
+                        if (priv->flags & TC_MQPRIO_F_MODE)
+                                mqprio.mode = priv->mode;
+                        if (priv->flags & TC_MQPRIO_F_SHAPER)
+                                mqprio.shaper = priv->shaper;
+                        if (priv->flags & TC_MQPRIO_F_MIN_RATE)
+                                for (i = 0; i < mqprio.qopt.num_tc; i++)
+                                        mqprio.min_rate[i] = priv->min_rate[i];
+                        if (priv->flags & TC_MQPRIO_F_MAX_RATE)
+                                for (i = 0; i < mqprio.qopt.num_tc; i++)
+                                        mqprio.max_rate[i] = priv->max_rate[i];
+                        break;
+                default:
+                        return -EINVAL;
+                }
+                err = dev->netdev_ops->ndo_setup_tc(dev,
+                                                    TC_SETUP_QDISC_MQPRIO,
                                                     &mqprio);
                 if (err)
                         return err;
 
-                priv->hw_offload = mqprio.hw;
+                priv->hw_offload = mqprio.qopt.hw;
         } else {
                 netdev_set_num_tc(dev, qopt->num_tc);
                 for (i = 0; i < qopt->num_tc; i++)
@@ -193,7 +311,7 @@ static struct netdev_queue *mqprio_queue_get(struct Qdisc *sch,
                                              unsigned long cl)
 {
         struct net_device *dev = qdisc_dev(sch);
-        unsigned long ntx = cl - 1 - netdev_get_num_tc(dev);
+        unsigned long ntx = cl - 1;
 
         if (ntx >= dev->num_tx_queues)
                 return NULL;
@@ -223,11 +341,51 @@ static int mqprio_graft(struct Qdisc *sch, unsigned long cl, struct Qdisc *new,
         return 0;
 }
 
+static int dump_rates(struct mqprio_sched *priv,
+                      struct tc_mqprio_qopt *opt, struct sk_buff *skb)
+{
+        struct nlattr *nest;
+        int i;
+
+        if (priv->flags & TC_MQPRIO_F_MIN_RATE) {
+                nest = nla_nest_start(skb, TCA_MQPRIO_MIN_RATE64);
+                if (!nest)
+                        goto nla_put_failure;
+
+                for (i = 0; i < opt->num_tc; i++) {
+                        if (nla_put(skb, TCA_MQPRIO_MIN_RATE64,
+                                    sizeof(priv->min_rate[i]),
+                                    &priv->min_rate[i]))
+                                goto nla_put_failure;
+                }
+                nla_nest_end(skb, nest);
+        }
+
+        if (priv->flags & TC_MQPRIO_F_MAX_RATE) {
+                nest = nla_nest_start(skb, TCA_MQPRIO_MAX_RATE64);
+                if (!nest)
+                        goto nla_put_failure;
+
+                for (i = 0; i < opt->num_tc; i++) {
+                        if (nla_put(skb, TCA_MQPRIO_MAX_RATE64,
+                                    sizeof(priv->max_rate[i]),
+                                    &priv->max_rate[i]))
+                                goto nla_put_failure;
+                }
+                nla_nest_end(skb, nest);
+        }
+        return 0;
+
+nla_put_failure:
+        nla_nest_cancel(skb, nest);
+        return -1;
+}
+
 static int mqprio_dump(struct Qdisc *sch, struct sk_buff *skb)
 {
         struct net_device *dev = qdisc_dev(sch);
         struct mqprio_sched *priv = qdisc_priv(sch);
-        unsigned char *b = skb_tail_pointer(skb);
+        struct nlattr *nla = (struct nlattr *)skb_tail_pointer(skb);
         struct tc_mqprio_qopt opt = { 0 };
         struct Qdisc *qdisc;
         unsigned int i;
@@ -258,12 +416,25 @@ static int mqprio_dump(struct Qdisc *sch, struct sk_buff *skb)
                 opt.offset[i] = dev->tc_to_txq[i].offset;
         }
 
-        if (nla_put(skb, TCA_OPTIONS, sizeof(opt), &opt))
+        if (nla_put(skb, TCA_OPTIONS, NLA_ALIGN(sizeof(opt)), &opt))
+                goto nla_put_failure;
+
+        if ((priv->flags & TC_MQPRIO_F_MODE) &&
+            nla_put_u16(skb, TCA_MQPRIO_MODE, priv->mode))
                 goto nla_put_failure;
 
-        return skb->len;
+        if ((priv->flags & TC_MQPRIO_F_SHAPER) &&
+            nla_put_u16(skb, TCA_MQPRIO_SHAPER, priv->shaper))
+                goto nla_put_failure;
+
+        if ((priv->flags & TC_MQPRIO_F_MIN_RATE ||
+             priv->flags & TC_MQPRIO_F_MAX_RATE) &&
+            (dump_rates(priv, &opt, skb) != 0))
+                goto nla_put_failure;
+
+        return nla_nest_end(skb, nla);
 nla_put_failure:
-        nlmsg_trim(skb, b);
+        nlmsg_trim(skb, nla);
         return -1;
 }
 
@@ -282,38 +453,35 @@ static unsigned long mqprio_find(struct Qdisc *sch, u32 classid)
         struct net_device *dev = qdisc_dev(sch);
         unsigned int ntx = TC_H_MIN(classid);
 
-        if (ntx > dev->num_tx_queues + netdev_get_num_tc(dev))
-                return 0;
-        return ntx;
+        /* There are essentially two regions here that have valid classid
+         * values. The first region will have a classid value of 1 through
+         * num_tx_queues. All of these are backed by actual Qdiscs.
+         */
+        if (ntx < TC_H_MIN_PRIORITY)
+                return (ntx <= dev->num_tx_queues) ? ntx : 0;
+
+        /* The second region represents the hardware traffic classes. These
+         * are represented by classid values of TC_H_MIN_PRIORITY through
+         * TC_H_MIN_PRIORITY + netdev_get_num_tc - 1
+         */
+        return ((ntx - TC_H_MIN_PRIORITY) < netdev_get_num_tc(dev)) ? ntx : 0;
 }
 
 static int mqprio_dump_class(struct Qdisc *sch, unsigned long cl,
                          struct sk_buff *skb, struct tcmsg *tcm)
 {
-        struct net_device *dev = qdisc_dev(sch);
+        if (cl < TC_H_MIN_PRIORITY) {
+                struct netdev_queue *dev_queue = mqprio_queue_get(sch, cl);
+                struct net_device *dev = qdisc_dev(sch);
+                int tc = netdev_txq_to_tc(dev, cl - 1);
 
-        if (cl <= netdev_get_num_tc(dev)) {
+                tcm->tcm_parent = (tc < 0) ? 0 :
+                        TC_H_MAKE(TC_H_MAJ(sch->handle),
+                                  TC_H_MIN(tc + TC_H_MIN_PRIORITY));
+                tcm->tcm_info = dev_queue->qdisc_sleeping->handle;
+        } else {
                 tcm->tcm_parent = TC_H_ROOT;
                 tcm->tcm_info = 0;
-        } else {
-                int i;
-                struct netdev_queue *dev_queue;
-
-                dev_queue = mqprio_queue_get(sch, cl);
-                tcm->tcm_parent = 0;
-                for (i = 0; i < netdev_get_num_tc(dev); i++) {
-                        struct netdev_tc_txq tc = dev->tc_to_txq[i];
-                        int q_idx = cl - netdev_get_num_tc(dev);
-
-                        if (q_idx > tc.offset &&
-                            q_idx <= tc.offset + tc.count) {
-                                tcm->tcm_parent =
-                                        TC_H_MAKE(TC_H_MAJ(sch->handle),
-                                                  TC_H_MIN(i + 1));
-                                break;
-                        }
-                }
-                tcm->tcm_info = dev_queue->qdisc_sleeping->handle;
         }
         tcm->tcm_handle |= TC_H_MIN(cl);
         return 0;
@@ -324,15 +492,14 @@ static int mqprio_dump_class_stats(struct Qdisc *sch, unsigned long cl,
         __releases(d->lock)
         __acquires(d->lock)
 {
-        struct net_device *dev = qdisc_dev(sch);
-
-        if (cl <= netdev_get_num_tc(dev)) {
+        if (cl >= TC_H_MIN_PRIORITY) {
                 int i;
                 __u32 qlen = 0;
                 struct Qdisc *qdisc;
                 struct gnet_stats_queue qstats = {0};
                 struct gnet_stats_basic_packed bstats = {0};
-                struct netdev_tc_txq tc = dev->tc_to_txq[cl - 1];
+                struct net_device *dev = qdisc_dev(sch);
+                struct netdev_tc_txq tc = dev->tc_to_txq[cl & TC_BITMASK];
 
                 /* Drop lock here it will be reclaimed before touching
                  * statistics this is required because the d->lock we
@@ -385,17 +552,36 @@ static void mqprio_walk(struct Qdisc *sch, struct qdisc_walker *arg)
 
         /* Walk hierarchy with a virtual class per tc */
         arg->count = arg->skip;
-        for (ntx = arg->skip;
-             ntx < dev->num_tx_queues + netdev_get_num_tc(dev);
-             ntx++) {
+        for (ntx = arg->skip; ntx < netdev_get_num_tc(dev); ntx++) {
+                if (arg->fn(sch, ntx + TC_H_MIN_PRIORITY, arg) < 0) {
+                        arg->stop = 1;
+                        return;
+                }
+                arg->count++;
+        }
+
+        /* Pad the values and skip over unused traffic classes */
+        if (ntx < TC_MAX_QUEUE) {
+                arg->count = TC_MAX_QUEUE;
+                ntx = TC_MAX_QUEUE;
+        }
+
+        /* Reset offset, sort out remaining per-queue qdiscs */
+        for (ntx -= TC_MAX_QUEUE; ntx < dev->num_tx_queues; ntx++) {
                 if (arg->fn(sch, ntx + 1, arg) < 0) {
                         arg->stop = 1;
-                        break;
+                        return;
                 }
                 arg->count++;
         }
 }
 
+static struct netdev_queue *mqprio_select_queue(struct Qdisc *sch,
+                                                struct tcmsg *tcm)
+{
+        return mqprio_queue_get(sch, TC_H_MIN(tcm->tcm_parent));
+}
+
 static const struct Qdisc_class_ops mqprio_class_ops = {
         .graft          = mqprio_graft,
         .leaf           = mqprio_leaf,
@@ -403,6 +589,7 @@ static const struct Qdisc_class_ops mqprio_class_ops = {
         .walk           = mqprio_walk,
         .dump           = mqprio_dump_class,
         .dump_stats     = mqprio_dump_class_stats,
+        .select_queue   = mqprio_select_queue,
 };
 
 static struct Qdisc_ops mqprio_qdisc_ops __read_mostly = {
diff --git a/net/sched/sch_multiq.c b/net/sched/sch_multiq.c
index ff4fc3e0facd..012216386c0b 100644
--- a/net/sched/sch_multiq.c
+++ b/net/sched/sch_multiq.c
@@ -54,6 +54,7 @@ multiq_classify(struct sk_buff *skb, struct Qdisc *sch, int *qerr)
         case TC_ACT_QUEUED:
         case TC_ACT_TRAP:
                 *qerr = NET_XMIT_SUCCESS | __NET_XMIT_STOLEN;
+                /* fall through */
         case TC_ACT_SHOT:
                 return NULL;
         }
@@ -245,7 +246,7 @@ static int multiq_init(struct Qdisc *sch, struct nlattr *opt)
         if (opt == NULL)
                 return -EINVAL;
 
-        err = tcf_block_get(&q->block, &q->filter_list);
+        err = tcf_block_get(&q->block, &q->filter_list, sch);
         if (err)
                 return err;
 
diff --git a/net/sched/sch_netem.c b/net/sched/sch_netem.c
index b1266e75ca43..dd70924cbcdf 100644
--- a/net/sched/sch_netem.c
+++ b/net/sched/sch_netem.c
@@ -77,8 +77,8 @@ struct netem_sched_data {
 
         struct qdisc_watchdog watchdog;
 
-        psched_tdiff_t latency;
-        psched_tdiff_t jitter;
+        s64 latency;
+        s64 jitter;
 
         u32 loss;
         u32 ecn;
@@ -135,6 +135,13 @@ struct netem_sched_data {
                 u32 a5; /* p23 used only in 4-states */
         } clg;
 
+        struct tc_netem_slot slot_config;
+        struct slotstate {
+                u64 slot_next;
+                s32 packets_left;
+                s32 bytes_left;
+        } slot;
+
 };
 
 /* Time stamp put into socket buffer control block
@@ -145,16 +152,9 @@ struct netem_sched_data {
  * we save skb->tstamp value in skb->cb[] before destroying it.
  */
 struct netem_skb_cb {
-        psched_time_t   time_to_send;
-        ktime_t         tstamp_save;
+        u64             time_to_send;
 };
 
-
-static struct sk_buff *netem_rb_to_skb(struct rb_node *rb)
-{
-        return rb_entry(rb, struct sk_buff, rbnode);
-}
-
 static inline struct netem_skb_cb *netem_skb_cb(struct sk_buff *skb)
 {
         /* we assume we can use skb next/prev/tstamp as storage for rb_node */
@@ -312,11 +312,11 @@ static bool loss_event(struct netem_sched_data *q)
  * std deviation sigma.  Uses table lookup to approximate the desired
  * distribution, and a uniformly-distributed pseudo-random source.
  */
-static psched_tdiff_t tabledist(psched_tdiff_t mu, psched_tdiff_t sigma,
-                                struct crndstate *state,
-                                const struct disttable *dist)
+static s64 tabledist(s64 mu, s32 sigma,
+                     struct crndstate *state,
+                     const struct disttable *dist)
 {
-        psched_tdiff_t x;
+        s64 x;
         long t;
         u32 rnd;
 
@@ -327,7 +327,7 @@ static psched_tdiff_t tabledist(psched_tdiff_t mu, psched_tdiff_t sigma,
 
         /* default uniform distribution */
         if (dist == NULL)
-                return (rnd % (2*sigma)) - sigma + mu;
+                return (rnd % (2 * sigma)) - sigma + mu;
 
         t = dist->table[rnd % dist->size];
         x = (sigma % NETEM_DIST_SCALE) * t;
@@ -339,10 +339,8 @@ static psched_tdiff_t tabledist(psched_tdiff_t mu, psched_tdiff_t sigma,
         return  x / NETEM_DIST_SCALE + (sigma / NETEM_DIST_SCALE) * t + mu;
 }
 
-static psched_time_t packet_len_2_sched_time(unsigned int len, struct netem_sched_data *q)
+static u64 packet_time_ns(u64 len, const struct netem_sched_data *q)
 {
-        u64 ticks;
-
         len += q->packet_overhead;
 
         if (q->cell_size) {
@@ -353,21 +351,19 @@ static psched_time_t packet_len_2_sched_time(unsigned int len, struct netem_sche
                 len = cells * (q->cell_size + q->cell_overhead);
         }
 
-        ticks = (u64)len * NSEC_PER_SEC;
-
-        do_div(ticks, q->rate);
-        return PSCHED_NS2TICKS(ticks);
+        return div64_u64(len * NSEC_PER_SEC, q->rate);
 }
 
 static void tfifo_reset(struct Qdisc *sch)
 {
         struct netem_sched_data *q = qdisc_priv(sch);
-        struct rb_node *p;
+        struct rb_node *p = rb_first(&q->t_root);
 
-        while ((p = rb_first(&q->t_root))) {
-                struct sk_buff *skb = netem_rb_to_skb(p);
+        while (p) {
+                struct sk_buff *skb = rb_to_skb(p);
 
-                rb_erase(p, &q->t_root);
+                p = rb_next(p);
+                rb_erase(&skb->rbnode, &q->t_root);
                 rtnl_kfree_skbs(skb, skb);
         }
 }
@@ -375,14 +371,14 @@ static void tfifo_reset(struct Qdisc *sch)
 static void tfifo_enqueue(struct sk_buff *nskb, struct Qdisc *sch)
 {
         struct netem_sched_data *q = qdisc_priv(sch);
-        psched_time_t tnext = netem_skb_cb(nskb)->time_to_send;
+        u64 tnext = netem_skb_cb(nskb)->time_to_send;
         struct rb_node **p = &q->t_root.rb_node, *parent = NULL;
 
         while (*p) {
                 struct sk_buff *skb;
 
                 parent = *p;
-                skb = netem_rb_to_skb(parent);
+                skb = rb_to_skb(parent);
                 if (tnext >= netem_skb_cb(skb)->time_to_send)
                         p = &parent->rb_right;
                 else
@@ -521,13 +517,13 @@ static int netem_enqueue(struct sk_buff *skb, struct Qdisc *sch,
         if (q->gap == 0 ||              /* not doing reordering */
             q->counter < q->gap - 1 ||  /* inside last reordering gap */
             q->reorder < get_crandom(&q->reorder_cor)) {
-                psched_time_t now;
-                psched_tdiff_t delay;
+                u64 now;
+                s64 delay;
 
                 delay = tabledist(q->latency, q->jitter,
                                   &q->delay_cor, q->delay_dist);
 
-                now = psched_get_time();
+                now = ktime_get_ns();
 
                 if (q->rate) {
                         struct netem_skb_cb *last = NULL;
@@ -538,7 +534,7 @@ static int netem_enqueue(struct sk_buff *skb, struct Qdisc *sch,
                                 struct sk_buff *t_skb;
                                 struct netem_skb_cb *t_last;
 
-                                t_skb = netem_rb_to_skb(rb_last(&q->t_root));
+                                t_skb = skb_rb_last(&q->t_root);
                                 t_last = netem_skb_cb(t_skb);
                                 if (!last ||
                                     t_last->time_to_send > last->time_to_send) {
@@ -553,15 +549,14 @@ static int netem_enqueue(struct sk_buff *skb, struct Qdisc *sch,
                                  * from delay.
                                  */
                                 delay -= last->time_to_send - now;
-                                delay = max_t(psched_tdiff_t, 0, delay);
+                                delay = max_t(s64, 0, delay);
                                 now = last->time_to_send;
                         }
 
-                        delay += packet_len_2_sched_time(qdisc_pkt_len(skb), q);
+                        delay += packet_time_ns(qdisc_pkt_len(skb), q);
                 }
 
                 cb->time_to_send = now + delay;
-                cb->tstamp_save = skb->tstamp;
                 ++q->counter;
                 tfifo_enqueue(skb, sch);
         } else {
@@ -569,7 +564,7 @@ static int netem_enqueue(struct sk_buff *skb, struct Qdisc *sch,
                  * Do re-ordering by putting one out of N packets at the front
                  * of the queue.
                  */
-                cb->time_to_send = psched_get_time();
+                cb->time_to_send = ktime_get_ns();
                 q->counter = 0;
 
                 netem_enqueue_skb_head(&sch->q, skb);
@@ -600,6 +595,20 @@ finish_segs:
         return NET_XMIT_SUCCESS;
 }
 
+/* Delay the next round with a new future slot with a
+ * correct number of bytes and packets.
+ */
+
+static void get_slot_next(struct netem_sched_data *q, u64 now)
+{
+        q->slot.slot_next = now + q->slot_config.min_delay +
+                (prandom_u32() *
+                        (q->slot_config.max_delay -
+                                q->slot_config.min_delay) >> 32);
+        q->slot.packets_left = q->slot_config.max_packets;
+        q->slot.bytes_left = q->slot_config.max_bytes;
+}
+
 static struct sk_buff *netem_dequeue(struct Qdisc *sch)
 {
         struct netem_sched_data *q = qdisc_priv(sch);
@@ -616,20 +625,26 @@ deliver:
         }
         p = rb_first(&q->t_root);
         if (p) {
-                psched_time_t time_to_send;
+                u64 time_to_send;
+                u64 now = ktime_get_ns();
 
-                skb = netem_rb_to_skb(p);
+                skb = rb_to_skb(p);
 
                 /* if more time remaining? */
                 time_to_send = netem_skb_cb(skb)->time_to_send;
-                if (time_to_send <= psched_get_time()) {
-                        rb_erase(p, &q->t_root);
+                if (q->slot.slot_next && q->slot.slot_next < time_to_send)
+                        get_slot_next(q, now);
 
+                if (time_to_send <= now &&  q->slot.slot_next <= now) {
+                        rb_erase(p, &q->t_root);
                         sch->q.qlen--;
                         qdisc_qstats_backlog_dec(sch, skb);
                         skb->next = NULL;
                         skb->prev = NULL;
-                        skb->tstamp = netem_skb_cb(skb)->tstamp_save;
+                        /* skb->dev shares skb->rbnode area,
+                         * we need to restore its value.
+                         */
+                        skb->dev = qdisc_dev(sch);
 
 #ifdef CONFIG_NET_CLS_ACT
                         /*
@@ -640,6 +655,14 @@ deliver:
                                 skb->tstamp = 0;
 #endif
 
+                        if (q->slot.slot_next) {
+                                q->slot.packets_left--;
+                                q->slot.bytes_left -= qdisc_pkt_len(skb);
+                                if (q->slot.packets_left <= 0 ||
+                                    q->slot.bytes_left <= 0)
+                                        get_slot_next(q, now);
+                        }
+
                         if (q->qdisc) {
                                 unsigned int pkt_len = qdisc_pkt_len(skb);
                                 struct sk_buff *to_free = NULL;
@@ -663,7 +686,10 @@ deliver:
                         if (skb)
                                 goto deliver;
                 }
-                qdisc_watchdog_schedule(&q->watchdog, time_to_send);
+
+                qdisc_watchdog_schedule_ns(&q->watchdog,
+                                           max(time_to_send,
+                                               q->slot.slot_next));
         }
 
         if (q->qdisc) {
@@ -694,6 +720,7 @@ static void dist_free(struct disttable *d)
  * Distribution data is a variable size payload containing
  * signed 16 bit values.
  */
+
 static int get_dist_table(struct Qdisc *sch, const struct nlattr *attr)
 {
         struct netem_sched_data *q = qdisc_priv(sch);
@@ -724,6 +751,23 @@ static int get_dist_table(struct Qdisc *sch, const struct nlattr *attr)
         return 0;
 }
 
+static void get_slot(struct netem_sched_data *q, const struct nlattr *attr)
+{
+        const struct tc_netem_slot *c = nla_data(attr);
+
+        q->slot_config = *c;
+        if (q->slot_config.max_packets == 0)
+                q->slot_config.max_packets = INT_MAX;
+        if (q->slot_config.max_bytes == 0)
+                q->slot_config.max_bytes = INT_MAX;
+        q->slot.packets_left = q->slot_config.max_packets;
+        q->slot.bytes_left = q->slot_config.max_bytes;
+        if (q->slot_config.min_delay | q->slot_config.max_delay)
+                q->slot.slot_next = ktime_get_ns();
+        else
+                q->slot.slot_next = 0;
+}
+
 static void get_correlation(struct netem_sched_data *q, const struct nlattr *attr)
 {
         const struct tc_netem_corr *c = nla_data(attr);
@@ -825,6 +869,9 @@ static const struct nla_policy netem_policy[TCA_NETEM_MAX + 1] = {
         [TCA_NETEM_LOSS]        = { .type = NLA_NESTED },
         [TCA_NETEM_ECN]         = { .type = NLA_U32 },
         [TCA_NETEM_RATE64]      = { .type = NLA_U64 },
+        [TCA_NETEM_LATENCY64]   = { .type = NLA_S64 },
+        [TCA_NETEM_JITTER64]    = { .type = NLA_S64 },
+        [TCA_NETEM_SLOT]        = { .len = sizeof(struct tc_netem_slot) },
 };
 
 static int parse_attr(struct nlattr *tb[], int maxtype, struct nlattr *nla,
@@ -892,8 +939,8 @@ static int netem_change(struct Qdisc *sch, struct nlattr *opt)
 
         sch->limit = qopt->limit;
 
-        q->latency = qopt->latency;
-        q->jitter = qopt->jitter;
+        q->latency = PSCHED_TICKS2NS(qopt->latency);
+        q->jitter = PSCHED_TICKS2NS(qopt->jitter);
         q->limit = qopt->limit;
         q->gap = qopt->gap;
         q->counter = 0;
@@ -922,9 +969,18 @@ static int netem_change(struct Qdisc *sch, struct nlattr *opt)
                 q->rate = max_t(u64, q->rate,
                                 nla_get_u64(tb[TCA_NETEM_RATE64]));
 
+        if (tb[TCA_NETEM_LATENCY64])
+                q->latency = nla_get_s64(tb[TCA_NETEM_LATENCY64]);
+
+        if (tb[TCA_NETEM_JITTER64])
+                q->jitter = nla_get_s64(tb[TCA_NETEM_JITTER64]);
+
         if (tb[TCA_NETEM_ECN])
                 q->ecn = nla_get_u32(tb[TCA_NETEM_ECN]);
 
+        if (tb[TCA_NETEM_SLOT])
+                get_slot(q, tb[TCA_NETEM_SLOT]);
+
         return ret;
 }
 
@@ -1014,9 +1070,12 @@ static int netem_dump(struct Qdisc *sch, struct sk_buff *skb)
         struct tc_netem_reorder reorder;
         struct tc_netem_corrupt corrupt;
         struct tc_netem_rate rate;
+        struct tc_netem_slot slot;
 
-        qopt.latency = q->latency;
-        qopt.jitter = q->jitter;
+        qopt.latency = min_t(psched_tdiff_t, PSCHED_NS2TICKS(q->latency),
+                             UINT_MAX);
+        qopt.jitter = min_t(psched_tdiff_t, PSCHED_NS2TICKS(q->jitter),
+                            UINT_MAX);
         qopt.limit = q->limit;
         qopt.loss = q->loss;
         qopt.gap = q->gap;
@@ -1024,6 +1083,12 @@ static int netem_dump(struct Qdisc *sch, struct sk_buff *skb)
         if (nla_put(skb, TCA_OPTIONS, sizeof(qopt), &qopt))
                 goto nla_put_failure;
 
+        if (nla_put(skb, TCA_NETEM_LATENCY64, sizeof(q->latency), &q->latency))
+                goto nla_put_failure;
+
+        if (nla_put(skb, TCA_NETEM_JITTER64, sizeof(q->jitter), &q->jitter))
+                goto nla_put_failure;
+
         cor.delay_corr = q->delay_cor.rho;
         cor.loss_corr = q->loss_cor.rho;
         cor.dup_corr = q->dup_cor.rho;
@@ -1060,6 +1125,16 @@ static int netem_dump(struct Qdisc *sch, struct sk_buff *skb)
         if (dump_loss_model(q, skb) != 0)
                 goto nla_put_failure;
 
+        if (q->slot_config.min_delay | q->slot_config.max_delay) {
+                slot = q->slot_config;
+                if (slot.max_packets == INT_MAX)
+                        slot.max_packets = 0;
+                if (slot.max_bytes == INT_MAX)
+                        slot.max_bytes = 0;
+                if (nla_put(skb, TCA_NETEM_SLOT, sizeof(slot), &slot))
+                        goto nla_put_failure;
+        }
+
         return nla_nest_end(skb, nla);
 
 nla_put_failure:
diff --git a/net/sched/sch_pie.c b/net/sched/sch_pie.c
index 6c2791d6102d..776c694c77c7 100644
--- a/net/sched/sch_pie.c
+++ b/net/sched/sch_pie.c
@@ -74,6 +74,7 @@ struct pie_sched_data {
         struct pie_vars vars;
         struct pie_stats stats;
         struct timer_list adapt_timer;
+        struct Qdisc *sch;
 };
 
 static void pie_params_init(struct pie_params *params)
@@ -422,10 +423,10 @@ static void calculate_probability(struct Qdisc *sch)
                 pie_vars_init(&q->vars);
 }
 
-static void pie_timer(unsigned long arg)
+static void pie_timer(struct timer_list *t)
 {
-        struct Qdisc *sch = (struct Qdisc *)arg;
-        struct pie_sched_data *q = qdisc_priv(sch);
+        struct pie_sched_data *q = from_timer(q, t, adapt_timer);
+        struct Qdisc *sch = q->sch;
         spinlock_t *root_lock = qdisc_lock(qdisc_root_sleeping(sch));
 
         spin_lock(root_lock);
@@ -446,7 +447,8 @@ static int pie_init(struct Qdisc *sch, struct nlattr *opt)
         pie_vars_init(&q->vars);
         sch->limit = q->params.limit;
 
-        setup_timer(&q->adapt_timer, pie_timer, (unsigned long)sch);
+        q->sch = sch;
+        timer_setup(&q->adapt_timer, pie_timer, 0);
 
         if (opt) {
                 int err = pie_change(sch, opt);
diff --git a/net/sched/sch_prio.c b/net/sched/sch_prio.c
index 2dd6c68ae91e..2c79559a0d31 100644
--- a/net/sched/sch_prio.c
+++ b/net/sched/sch_prio.c
@@ -50,6 +50,7 @@ prio_classify(struct sk_buff *skb, struct Qdisc *sch, int *qerr)
                 case TC_ACT_QUEUED:
                 case TC_ACT_TRAP:
                         *qerr = NET_XMIT_SUCCESS | __NET_XMIT_STOLEN;
+                        /* fall through */
                 case TC_ACT_SHOT:
                         return NULL;
                 }
@@ -212,7 +213,7 @@ static int prio_init(struct Qdisc *sch, struct nlattr *opt)
         if (!opt)
                 return -EINVAL;
 
-        err = tcf_block_get(&q->block, &q->filter_list);
+        err = tcf_block_get(&q->block, &q->filter_list, sch);
         if (err)
                 return err;
 
diff --git a/net/sched/sch_qfq.c b/net/sched/sch_qfq.c
index 6ddfd4991108..6962b37a3ad3 100644
--- a/net/sched/sch_qfq.c
+++ b/net/sched/sch_qfq.c
@@ -709,6 +709,7 @@ static struct qfq_class *qfq_classify(struct sk_buff *skb, struct Qdisc *sch,
                 case TC_ACT_STOLEN:
                 case TC_ACT_TRAP:
                         *qerr = NET_XMIT_SUCCESS | __NET_XMIT_STOLEN;
+                        /* fall through */
                 case TC_ACT_SHOT:
                         return NULL;
                 }
@@ -1419,7 +1420,7 @@ static int qfq_init_qdisc(struct Qdisc *sch, struct nlattr *opt)
         int i, j, err;
         u32 max_cl_shift, maxbudg_shift, max_classes;
 
-        err = tcf_block_get(&q->block, &q->filter_list);
+        err = tcf_block_get(&q->block, &q->filter_list, sch);
         if (err)
                 return err;
 
diff --git a/net/sched/sch_red.c b/net/sched/sch_red.c
index 93b9d70a9b28..7f8ea9e297c3 100644
--- a/net/sched/sch_red.c
+++ b/net/sched/sch_red.c
@@ -19,6 +19,7 @@
 #include <linux/kernel.h>
 #include <linux/skbuff.h>
 #include <net/pkt_sched.h>
+#include <net/pkt_cls.h>
 #include <net/inet_ecn.h>
 #include <net/red.h>
 
@@ -40,6 +41,7 @@ struct red_sched_data {
         u32                     limit;          /* HARD maximal queue length */
         unsigned char           flags;
         struct timer_list       adapt_timer;
+        struct Qdisc            *sch;
         struct red_parms        parms;
         struct red_vars         vars;
         struct red_stats        stats;
@@ -147,11 +149,37 @@ static void red_reset(struct Qdisc *sch)
         red_restart(&q->vars);
 }
 
+static int red_offload(struct Qdisc *sch, bool enable)
+{
+        struct red_sched_data *q = qdisc_priv(sch);
+        struct net_device *dev = qdisc_dev(sch);
+        struct tc_red_qopt_offload opt = {
+                .handle = sch->handle,
+                .parent = sch->parent,
+        };
+
+        if (!tc_can_offload(dev) || !dev->netdev_ops->ndo_setup_tc)
+                return -EOPNOTSUPP;
+
+        if (enable) {
+                opt.command = TC_RED_REPLACE;
+                opt.set.min = q->parms.qth_min >> q->parms.Wlog;
+                opt.set.max = q->parms.qth_max >> q->parms.Wlog;
+                opt.set.probability = q->parms.max_P;
+                opt.set.is_ecn = red_use_ecn(q);
+        } else {
+                opt.command = TC_RED_DESTROY;
+        }
+
+        return dev->netdev_ops->ndo_setup_tc(dev, TC_SETUP_QDISC_RED, &opt);
+}
+
 static void red_destroy(struct Qdisc *sch)
 {
         struct red_sched_data *q = qdisc_priv(sch);
 
         del_timer_sync(&q->adapt_timer);
+        red_offload(sch, false);
         qdisc_destroy(q->qdisc);
 }
 
@@ -218,13 +246,14 @@ static int red_change(struct Qdisc *sch, struct nlattr *opt)
                 red_start_of_idle_period(&q->vars);
 
         sch_tree_unlock(sch);
+        red_offload(sch, true);
         return 0;
 }
 
-static inline void red_adaptative_timer(unsigned long arg)
+static inline void red_adaptative_timer(struct timer_list *t)
 {
-        struct Qdisc *sch = (struct Qdisc *)arg;
-        struct red_sched_data *q = qdisc_priv(sch);
+        struct red_sched_data *q = from_timer(q, t, adapt_timer);
+        struct Qdisc *sch = q->sch;
         spinlock_t *root_lock = qdisc_lock(qdisc_root_sleeping(sch));
 
         spin_lock(root_lock);
@@ -238,10 +267,40 @@ static int red_init(struct Qdisc *sch, struct nlattr *opt)
         struct red_sched_data *q = qdisc_priv(sch);
 
         q->qdisc = &noop_qdisc;
-        setup_timer(&q->adapt_timer, red_adaptative_timer, (unsigned long)sch);
+        q->sch = sch;
+        timer_setup(&q->adapt_timer, red_adaptative_timer, 0);
         return red_change(sch, opt);
 }
 
+static int red_dump_offload(struct Qdisc *sch, struct tc_red_qopt *opt)
+{
+        struct net_device *dev = qdisc_dev(sch);
+        struct tc_red_qopt_offload hw_stats = {
+                .command = TC_RED_STATS,
+                .handle = sch->handle,
+                .parent = sch->parent,
+                {
+                        .stats.bstats = &sch->bstats,
+                        .stats.qstats = &sch->qstats,
+                },
+        };
+        int err;
+
+        opt->flags &= ~TC_RED_OFFLOADED;
+        if (!tc_can_offload(dev) || !dev->netdev_ops->ndo_setup_tc)
+                return 0;
+
+        err = dev->netdev_ops->ndo_setup_tc(dev, TC_SETUP_QDISC_RED,
+                                            &hw_stats);
+        if (err == -EOPNOTSUPP)
+                return 0;
+
+        if (!err)
+                opt->flags |= TC_RED_OFFLOADED;
+
+        return err;
+}
+
 static int red_dump(struct Qdisc *sch, struct sk_buff *skb)
 {
         struct red_sched_data *q = qdisc_priv(sch);
@@ -255,8 +314,13 @@ static int red_dump(struct Qdisc *sch, struct sk_buff *skb)
                 .Plog           = q->parms.Plog,
                 .Scell_log      = q->parms.Scell_log,
         };
+        int err;
 
         sch->qstats.backlog = q->qdisc->qstats.backlog;
+        err = red_dump_offload(sch, &opt);
+        if (err)
+                goto nla_put_failure;
+
         opts = nla_nest_start(skb, TCA_OPTIONS);
         if (opts == NULL)
                 goto nla_put_failure;
@@ -273,6 +337,7 @@ nla_put_failure:
 static int red_dump_stats(struct Qdisc *sch, struct gnet_dump *d)
 {
         struct red_sched_data *q = qdisc_priv(sch);
+        struct net_device *dev = qdisc_dev(sch);
         struct tc_red_xstats st = {
                 .early  = q->stats.prob_drop + q->stats.forced_drop,
                 .pdrop  = q->stats.pdrop,
@@ -280,6 +345,26 @@ static int red_dump_stats(struct Qdisc *sch, struct gnet_dump *d)
                 .marked = q->stats.prob_mark + q->stats.forced_mark,
         };
 
+        if (tc_can_offload(dev) &&  dev->netdev_ops->ndo_setup_tc) {
+                struct red_stats hw_stats = {0};
+                struct tc_red_qopt_offload hw_stats_request = {
+                        .command = TC_RED_XSTATS,
+                        .handle = sch->handle,
+                        .parent = sch->parent,
+                        {
+                                .xstats = &hw_stats,
+                        },
+                };
+                if (!dev->netdev_ops->ndo_setup_tc(dev,
+                                                   TC_SETUP_QDISC_RED,
+                                                   &hw_stats_request)) {
+                        st.early += hw_stats.prob_drop + hw_stats.forced_drop;
+                        st.pdrop += hw_stats.pdrop;
+                        st.other += hw_stats.other;
+                        st.marked += hw_stats.prob_mark + hw_stats.forced_mark;
+                }
+        }
+
         return gnet_stats_copy_app(d, &st, sizeof(st));
 }
 
diff --git a/net/sched/sch_sfb.c b/net/sched/sch_sfb.c
index cc39e170b4aa..0678debdd856 100644
--- a/net/sched/sch_sfb.c
+++ b/net/sched/sch_sfb.c
@@ -268,6 +268,7 @@ static bool sfb_classify(struct sk_buff *skb, struct tcf_proto *fl,
                 case TC_ACT_QUEUED:
                 case TC_ACT_TRAP:
                         *qerr = NET_XMIT_SUCCESS | __NET_XMIT_STOLEN;
+                        /* fall through */
                 case TC_ACT_SHOT:
                         return false;
                 }
@@ -553,7 +554,7 @@ static int sfb_init(struct Qdisc *sch, struct nlattr *opt)
         struct sfb_sched_data *q = qdisc_priv(sch);
         int err;
 
-        err = tcf_block_get(&q->block, &q->filter_list);
+        err = tcf_block_get(&q->block, &q->filter_list, sch);
         if (err)
                 return err;
 
diff --git a/net/sched/sch_sfq.c b/net/sched/sch_sfq.c
index 74ea863b8240..890f4a4564e7 100644
--- a/net/sched/sch_sfq.c
+++ b/net/sched/sch_sfq.c
@@ -145,6 +145,7 @@ struct sfq_sched_data {
         int             perturb_period;
         unsigned int    quantum;        /* Allotment per round: MUST BE >= MTU */
         struct timer_list perturb_timer;
+        struct Qdisc    *sch;
 };
 
 /*
@@ -189,6 +190,7 @@ static unsigned int sfq_classify(struct sk_buff *skb, struct Qdisc *sch,
                 case TC_ACT_QUEUED:
                 case TC_ACT_TRAP:
                         *qerr = NET_XMIT_SUCCESS | __NET_XMIT_STOLEN;
+                        /* fall through */
                 case TC_ACT_SHOT:
                         return 0;
                 }
@@ -604,10 +606,10 @@ drop:
         qdisc_tree_reduce_backlog(sch, dropped, drop_len);
 }
 
-static void sfq_perturbation(unsigned long arg)
+static void sfq_perturbation(struct timer_list *t)
 {
-        struct Qdisc *sch = (struct Qdisc *)arg;
-        struct sfq_sched_data *q = qdisc_priv(sch);
+        struct sfq_sched_data *q = from_timer(q, t, perturb_timer);
+        struct Qdisc *sch = q->sch;
         spinlock_t *root_lock = qdisc_lock(qdisc_root_sleeping(sch));
 
         spin_lock(root_lock);
@@ -722,10 +724,9 @@ static int sfq_init(struct Qdisc *sch, struct nlattr *opt)
         int i;
         int err;
 
-        setup_deferrable_timer(&q->perturb_timer, sfq_perturbation,
-                               (unsigned long)sch);
+        timer_setup(&q->perturb_timer, sfq_perturbation, TIMER_DEFERRABLE);
 
-        err = tcf_block_get(&q->block, &q->filter_list);
+        err = tcf_block_get(&q->block, &q->filter_list, sch);
         if (err)
                 return err;
 
diff --git a/net/sctp/Makefile b/net/sctp/Makefile
index 8c434af3e68f..1ca84a288443 100644
--- a/net/sctp/Makefile
+++ b/net/sctp/Makefile
@@ -13,7 +13,8 @@ sctp-y := sm_statetable.o sm_statefuns.o sm_sideeffect.o \
           inqueue.o outqueue.o ulpqueue.o \
           tsnmap.o bind_addr.o socket.o primitive.o \
           output.o input.o debug.o stream.o auth.o \
-          offload.o
+          offload.o stream_sched.o stream_sched_prio.o \
+          stream_sched_rr.o
 
 sctp_probe-y := probe.o
 
diff --git a/net/sctp/associola.c b/net/sctp/associola.c
index dfb9651e818b..69394f4d6091 100644
--- a/net/sctp/associola.c
+++ b/net/sctp/associola.c
@@ -149,8 +149,7 @@ static struct sctp_association *sctp_association_init(
 
         /* Initializes the timers */
         for (i = SCTP_EVENT_TIMEOUT_NONE; i < SCTP_NUM_TIMEOUT_TYPES; ++i)
-                setup_timer(&asoc->timers[i], sctp_timer_events[i],
-                                (unsigned long)asoc);
+                timer_setup(&asoc->timers[i], sctp_timer_events[i], 0);
 
         /* Pull default initialization values from the sock options.
          * Note: This assumes that the values have already been
diff --git a/net/sctp/chunk.c b/net/sctp/chunk.c
index 3afac275ee82..7b261afc47b9 100644
--- a/net/sctp/chunk.c
+++ b/net/sctp/chunk.c
@@ -311,10 +311,10 @@ int sctp_chunk_abandoned(struct sctp_chunk *chunk)
 
                 if (chunk->sent_count) {
                         chunk->asoc->abandoned_sent[SCTP_PR_INDEX(TTL)]++;
-                        streamout->abandoned_sent[SCTP_PR_INDEX(TTL)]++;
+                        streamout->ext->abandoned_sent[SCTP_PR_INDEX(TTL)]++;
                 } else {
                         chunk->asoc->abandoned_unsent[SCTP_PR_INDEX(TTL)]++;
-                        streamout->abandoned_unsent[SCTP_PR_INDEX(TTL)]++;
+                        streamout->ext->abandoned_unsent[SCTP_PR_INDEX(TTL)]++;
                 }
                 return 1;
         } else if (SCTP_PR_RTX_ENABLED(chunk->sinfo.sinfo_flags) &&
@@ -323,7 +323,7 @@ int sctp_chunk_abandoned(struct sctp_chunk *chunk)
                         &chunk->asoc->stream.out[chunk->sinfo.sinfo_stream];
 
                 chunk->asoc->abandoned_sent[SCTP_PR_INDEX(RTX)]++;
-                streamout->abandoned_sent[SCTP_PR_INDEX(RTX)]++;
+                streamout->ext->abandoned_sent[SCTP_PR_INDEX(RTX)]++;
                 return 1;
         } else if (!SCTP_PR_POLICY(chunk->sinfo.sinfo_flags) &&
                    chunk->msg->expires_at &&
diff --git a/net/sctp/ipv6.c b/net/sctp/ipv6.c
index a6dfa86c0201..3b18085e3b10 100644
--- a/net/sctp/ipv6.c
+++ b/net/sctp/ipv6.c
@@ -807,9 +807,10 @@ static void sctp_inet6_skb_msgname(struct sk_buff *skb, char *msgname,
                 addr->v6.sin6_flowinfo = 0;
                 addr->v6.sin6_port = sh->source;
                 addr->v6.sin6_addr = ipv6_hdr(skb)->saddr;
-                if (ipv6_addr_type(&addr->v6.sin6_addr) & IPV6_ADDR_LINKLOCAL) {
+                if (ipv6_addr_type(&addr->v6.sin6_addr) & IPV6_ADDR_LINKLOCAL)
                         addr->v6.sin6_scope_id = sctp_v6_skb_iif(skb);
-                }
+                else
+                        addr->v6.sin6_scope_id = 0;
         }
 
         *addr_len = sctp_v6_addr_to_user(sctp_sk(skb->sk), addr);
diff --git a/net/sctp/outqueue.c b/net/sctp/outqueue.c
index 2966ff400755..4db012aa25f7 100644
--- a/net/sctp/outqueue.c
+++ b/net/sctp/outqueue.c
@@ -50,6 +50,7 @@
 
 #include <net/sctp/sctp.h>
 #include <net/sctp/sm.h>
+#include <net/sctp/stream_sched.h>
 
 /* Declare internal functions here.  */
 static int sctp_acked(struct sctp_sackhdr *sack, __u32 tsn);
@@ -72,32 +73,38 @@ static void sctp_outq_flush(struct sctp_outq *q, int rtx_timeout, gfp_t gfp);
 
 /* Add data to the front of the queue. */
 static inline void sctp_outq_head_data(struct sctp_outq *q,
-                                        struct sctp_chunk *ch)
+                                       struct sctp_chunk *ch)
 {
+        struct sctp_stream_out_ext *oute;
+        __u16 stream;
+
         list_add(&ch->list, &q->out_chunk_list);
         q->out_qlen += ch->skb->len;
+
+        stream = sctp_chunk_stream_no(ch);
+        oute = q->asoc->stream.out[stream].ext;
+        list_add(&ch->stream_list, &oute->outq);
 }
 
 /* Take data from the front of the queue. */
 static inline struct sctp_chunk *sctp_outq_dequeue_data(struct sctp_outq *q)
 {
-        struct sctp_chunk *ch = NULL;
-
-        if (!list_empty(&q->out_chunk_list)) {
-                struct list_head *entry = q->out_chunk_list.next;
-
-                ch = list_entry(entry, struct sctp_chunk, list);
-                list_del_init(entry);
-                q->out_qlen -= ch->skb->len;
-        }
-        return ch;
+        return q->sched->dequeue(q);
 }
+
 /* Add data chunk to the end of the queue. */
 static inline void sctp_outq_tail_data(struct sctp_outq *q,
                                        struct sctp_chunk *ch)
 {
+        struct sctp_stream_out_ext *oute;
+        __u16 stream;
+
         list_add_tail(&ch->list, &q->out_chunk_list);
         q->out_qlen += ch->skb->len;
+
+        stream = sctp_chunk_stream_no(ch);
+        oute = q->asoc->stream.out[stream].ext;
+        list_add_tail(&ch->stream_list, &oute->outq);
 }
 
 /*
@@ -207,6 +214,7 @@ void sctp_outq_init(struct sctp_association *asoc, struct sctp_outq *q)
         INIT_LIST_HEAD(&q->retransmit);
         INIT_LIST_HEAD(&q->sacked);
         INIT_LIST_HEAD(&q->abandoned);
+        sctp_sched_set_sched(asoc, SCTP_SS_FCFS);
 }
 
 /* Free the outqueue structure and any related pending chunks.
@@ -258,6 +266,7 @@ static void __sctp_outq_teardown(struct sctp_outq *q)
 
         /* Throw away any leftover data chunks. */
         while ((chunk = sctp_outq_dequeue_data(q)) != NULL) {
+                sctp_sched_dequeue_done(q, chunk);
 
                 /* Mark as send failure. */
                 sctp_chunk_fail(chunk, q->error);
@@ -366,7 +375,7 @@ static int sctp_prsctp_prune_sent(struct sctp_association *asoc,
                 streamout = &asoc->stream.out[chk->sinfo.sinfo_stream];
                 asoc->sent_cnt_removable--;
                 asoc->abandoned_sent[SCTP_PR_INDEX(PRIO)]++;
-                streamout->abandoned_sent[SCTP_PR_INDEX(PRIO)]++;
+                streamout->ext->abandoned_sent[SCTP_PR_INDEX(PRIO)]++;
 
                 if (!chk->tsn_gap_acked) {
                         if (chk->transport)
@@ -391,20 +400,21 @@ static int sctp_prsctp_prune_unsent(struct sctp_association *asoc,
         struct sctp_outq *q = &asoc->outqueue;
         struct sctp_chunk *chk, *temp;
 
+        q->sched->unsched_all(&asoc->stream);
+
         list_for_each_entry_safe(chk, temp, &q->out_chunk_list, list) {
                 if (!SCTP_PR_PRIO_ENABLED(chk->sinfo.sinfo_flags) ||
                     chk->sinfo.sinfo_timetolive <= sinfo->sinfo_timetolive)
                         continue;
 
-                list_del_init(&chk->list);
-                q->out_qlen -= chk->skb->len;
+                sctp_sched_dequeue_common(q, chk);
                 asoc->sent_cnt_removable--;
                 asoc->abandoned_unsent[SCTP_PR_INDEX(PRIO)]++;
                 if (chk->sinfo.sinfo_stream < asoc->stream.outcnt) {
                         struct sctp_stream_out *streamout =
                                 &asoc->stream.out[chk->sinfo.sinfo_stream];
 
-                        streamout->abandoned_unsent[SCTP_PR_INDEX(PRIO)]++;
+                        streamout->ext->abandoned_unsent[SCTP_PR_INDEX(PRIO)]++;
                 }
 
                 msg_len -= SCTP_DATA_SNDSIZE(chk) +
@@ -415,6 +425,8 @@ static int sctp_prsctp_prune_unsent(struct sctp_association *asoc,
                         break;
         }
 
+        q->sched->sched_all(&asoc->stream);
+
         return msg_len;
 }
 
@@ -1033,22 +1045,9 @@ static void sctp_outq_flush(struct sctp_outq *q, int rtx_timeout, gfp_t gfp)
                 while ((chunk = sctp_outq_dequeue_data(q)) != NULL) {
                         __u32 sid = ntohs(chunk->subh.data_hdr->stream);
 
-                        /* RFC 2960 6.5 Every DATA chunk MUST carry a valid
-                         * stream identifier.
-                         */
-                        if (chunk->sinfo.sinfo_stream >= asoc->stream.outcnt) {
-
-                                /* Mark as failed send. */
-                                sctp_chunk_fail(chunk, SCTP_ERROR_INV_STRM);
-                                if (asoc->peer.prsctp_capable &&
-                                    SCTP_PR_PRIO_ENABLED(chunk->sinfo.sinfo_flags))
-                                        asoc->sent_cnt_removable--;
-                                sctp_chunk_free(chunk);
-                                continue;
-                        }
-
                         /* Has this chunk expired? */
                         if (sctp_chunk_abandoned(chunk)) {
+                                sctp_sched_dequeue_done(q, chunk);
                                 sctp_chunk_fail(chunk, 0);
                                 sctp_chunk_free(chunk);
                                 continue;
@@ -1070,6 +1069,7 @@ static void sctp_outq_flush(struct sctp_outq *q, int rtx_timeout, gfp_t gfp)
                                 new_transport = asoc->peer.active_path;
                         if (new_transport->state == SCTP_UNCONFIRMED) {
                                 WARN_ONCE(1, "Attempt to send packet on unconfirmed path.");
+                                sctp_sched_dequeue_done(q, chunk);
                                 sctp_chunk_fail(chunk, 0);
                                 sctp_chunk_free(chunk);
                                 continue;
@@ -1133,6 +1133,11 @@ static void sctp_outq_flush(struct sctp_outq *q, int rtx_timeout, gfp_t gfp)
                                 else
                                         asoc->stats.oodchunks++;
 
+                                /* Only now it's safe to consider this
+                                 * chunk as sent, sched-wise.
+                                 */
+                                sctp_sched_dequeue_done(q, chunk);
+
                                 break;
 
                         default:
diff --git a/net/sctp/protocol.c b/net/sctp/protocol.c
index fcd80feb293f..f5172c21349b 100644
--- a/net/sctp/protocol.c
+++ b/net/sctp/protocol.c
@@ -622,9 +622,9 @@ static void sctp_v4_ecn_capable(struct sock *sk)
         INET_ECN_xmit(sk);
 }
 
-static void sctp_addr_wq_timeout_handler(unsigned long arg)
+static void sctp_addr_wq_timeout_handler(struct timer_list *t)
 {
-        struct net *net = (struct net *)arg;
+        struct net *net = from_timer(net, t, sctp.addr_wq_timer);
         struct sctp_sockaddr_entry *addrw, *temp;
         struct sctp_sock *sp;
 
@@ -1304,8 +1304,7 @@ static int __net_init sctp_defaults_init(struct net *net)
         INIT_LIST_HEAD(&net->sctp.auto_asconf_splist);
         spin_lock_init(&net->sctp.addr_wq_lock);
         net->sctp.addr_wq_timer.expires = 0;
-        setup_timer(&net->sctp.addr_wq_timer, sctp_addr_wq_timeout_handler,
-                    (unsigned long)net);
+        timer_setup(&net->sctp.addr_wq_timer, sctp_addr_wq_timeout_handler, 0);
 
         return 0;
 
diff --git a/net/sctp/sm_make_chunk.c b/net/sctp/sm_make_chunk.c
index 514465b03829..9bf575f2e8ed 100644
--- a/net/sctp/sm_make_chunk.c
+++ b/net/sctp/sm_make_chunk.c
@@ -3594,8 +3594,8 @@ struct sctp_chunk *sctp_make_strreset_req(
                                         __u16 stream_num, __be16 *stream_list,
                                         bool out, bool in)
 {
+        __u16 stream_len = stream_num * sizeof(__u16);
         struct sctp_strreset_outreq outreq;
-        __u16 stream_len = stream_num * 2;
         struct sctp_strreset_inreq inreq;
         struct sctp_chunk *retval;
         __u16 outlen, inlen;
diff --git a/net/sctp/sm_sideeffect.c b/net/sctp/sm_sideeffect.c
index e2d9a4b49c9c..df94d77401e7 100644
--- a/net/sctp/sm_sideeffect.c
+++ b/net/sctp/sm_sideeffect.c
@@ -50,6 +50,7 @@
 #include <net/sock.h>
 #include <net/sctp/sctp.h>
 #include <net/sctp/sm.h>
+#include <net/sctp/stream_sched.h>
 
 static int sctp_cmd_interpreter(enum sctp_event event_type,
                                 union sctp_subtype subtype,
@@ -242,9 +243,10 @@ nomem:
 /* When the T3-RTX timer expires, it calls this function to create the
  * relevant state machine event.
  */
-void sctp_generate_t3_rtx_event(unsigned long peer)
+void sctp_generate_t3_rtx_event(struct timer_list *t)
 {
-        struct sctp_transport *transport = (struct sctp_transport *) peer;
+        struct sctp_transport *transport =
+                from_timer(transport, t, T3_rtx_timer);
         struct sctp_association *asoc = transport->asoc;
         struct sock *sk = asoc->base.sk;
         struct net *net = sock_net(sk);
@@ -318,50 +320,63 @@ out_unlock:
         sctp_association_put(asoc);
 }
 
-static void sctp_generate_t1_cookie_event(unsigned long data)
+static void sctp_generate_t1_cookie_event(struct timer_list *t)
 {
-        struct sctp_association *asoc = (struct sctp_association *) data;
+        struct sctp_association *asoc =
+                from_timer(asoc, t, timers[SCTP_EVENT_TIMEOUT_T1_COOKIE]);
+
         sctp_generate_timeout_event(asoc, SCTP_EVENT_TIMEOUT_T1_COOKIE);
 }
 
-static void sctp_generate_t1_init_event(unsigned long data)
+static void sctp_generate_t1_init_event(struct timer_list *t)
 {
-        struct sctp_association *asoc = (struct sctp_association *) data;
+        struct sctp_association *asoc =
+                from_timer(asoc, t, timers[SCTP_EVENT_TIMEOUT_T1_INIT]);
+
         sctp_generate_timeout_event(asoc, SCTP_EVENT_TIMEOUT_T1_INIT);
 }
 
-static void sctp_generate_t2_shutdown_event(unsigned long data)
+static void sctp_generate_t2_shutdown_event(struct timer_list *t)
 {
-        struct sctp_association *asoc = (struct sctp_association *) data;
+        struct sctp_association *asoc =
+                from_timer(asoc, t, timers[SCTP_EVENT_TIMEOUT_T2_SHUTDOWN]);
+
         sctp_generate_timeout_event(asoc, SCTP_EVENT_TIMEOUT_T2_SHUTDOWN);
 }
 
-static void sctp_generate_t4_rto_event(unsigned long data)
+static void sctp_generate_t4_rto_event(struct timer_list *t)
 {
-        struct sctp_association *asoc = (struct sctp_association *) data;
+        struct sctp_association *asoc =
+                from_timer(asoc, t, timers[SCTP_EVENT_TIMEOUT_T4_RTO]);
+
         sctp_generate_timeout_event(asoc, SCTP_EVENT_TIMEOUT_T4_RTO);
 }
 
-static void sctp_generate_t5_shutdown_guard_event(unsigned long data)
+static void sctp_generate_t5_shutdown_guard_event(struct timer_list *t)
 {
-        struct sctp_association *asoc = (struct sctp_association *)data;
+        struct sctp_association *asoc =
+                from_timer(asoc, t,
+                           timers[SCTP_EVENT_TIMEOUT_T5_SHUTDOWN_GUARD]);
+
         sctp_generate_timeout_event(asoc,
                                     SCTP_EVENT_TIMEOUT_T5_SHUTDOWN_GUARD);
 
 } /* sctp_generate_t5_shutdown_guard_event() */
 
-static void sctp_generate_autoclose_event(unsigned long data)
+static void sctp_generate_autoclose_event(struct timer_list *t)
 {
-        struct sctp_association *asoc = (struct sctp_association *) data;
+        struct sctp_association *asoc =
+                from_timer(asoc, t, timers[SCTP_EVENT_TIMEOUT_AUTOCLOSE]);
+
         sctp_generate_timeout_event(asoc, SCTP_EVENT_TIMEOUT_AUTOCLOSE);
 }
 
 /* Generate a heart beat event.  If the sock is busy, reschedule.   Make
  * sure that the transport is still valid.
  */
-void sctp_generate_heartbeat_event(unsigned long data)
+void sctp_generate_heartbeat_event(struct timer_list *t)
 {
-        struct sctp_transport *transport = (struct sctp_transport *) data;
+        struct sctp_transport *transport = from_timer(transport, t, hb_timer);
         struct sctp_association *asoc = transport->asoc;
         struct sock *sk = asoc->base.sk;
         struct net *net = sock_net(sk);
@@ -404,9 +419,10 @@ out_unlock:
 /* Handle the timeout of the ICMP protocol unreachable timer.  Trigger
  * the correct state machine transition that will close the association.
  */
-void sctp_generate_proto_unreach_event(unsigned long data)
+void sctp_generate_proto_unreach_event(struct timer_list *t)
 {
-        struct sctp_transport *transport = (struct sctp_transport *)data;
+        struct sctp_transport *transport =
+                from_timer(transport, t, proto_unreach_timer);
         struct sctp_association *asoc = transport->asoc;
         struct sock *sk = asoc->base.sk;
         struct net *net = sock_net(sk);
@@ -438,9 +454,10 @@ out_unlock:
 }
 
  /* Handle the timeout of the RE-CONFIG timer. */
-void sctp_generate_reconf_event(unsigned long data)
+void sctp_generate_reconf_event(struct timer_list *t)
 {
-        struct sctp_transport *transport = (struct sctp_transport *)data;
+        struct sctp_transport *transport =
+                from_timer(transport, t, reconf_timer);
         struct sctp_association *asoc = transport->asoc;
         struct sock *sk = asoc->base.sk;
         struct net *net = sock_net(sk);
@@ -470,24 +487,27 @@ out_unlock:
 }
 
 /* Inject a SACK Timeout event into the state machine.  */
-static void sctp_generate_sack_event(unsigned long data)
+static void sctp_generate_sack_event(struct timer_list *t)
 {
-        struct sctp_association *asoc = (struct sctp_association *)data;
+        struct sctp_association *asoc =
+                from_timer(asoc, t, timers[SCTP_EVENT_TIMEOUT_SACK]);
+
         sctp_generate_timeout_event(asoc, SCTP_EVENT_TIMEOUT_SACK);
 }
 
 sctp_timer_event_t *sctp_timer_events[SCTP_NUM_TIMEOUT_TYPES] = {
-        NULL,
-        sctp_generate_t1_cookie_event,
-        sctp_generate_t1_init_event,
-        sctp_generate_t2_shutdown_event,
-        NULL,
-        sctp_generate_t4_rto_event,
-        sctp_generate_t5_shutdown_guard_event,
-        NULL,
-        NULL,
-        sctp_generate_sack_event,
-        sctp_generate_autoclose_event,
+        [SCTP_EVENT_TIMEOUT_NONE] =             NULL,
+        [SCTP_EVENT_TIMEOUT_T1_COOKIE] =        sctp_generate_t1_cookie_event,
+        [SCTP_EVENT_TIMEOUT_T1_INIT] =          sctp_generate_t1_init_event,
+        [SCTP_EVENT_TIMEOUT_T2_SHUTDOWN] =      sctp_generate_t2_shutdown_event,
+        [SCTP_EVENT_TIMEOUT_T3_RTX] =           NULL,
+        [SCTP_EVENT_TIMEOUT_T4_RTO] =           sctp_generate_t4_rto_event,
+        [SCTP_EVENT_TIMEOUT_T5_SHUTDOWN_GUARD] =
+                                        sctp_generate_t5_shutdown_guard_event,
+        [SCTP_EVENT_TIMEOUT_HEARTBEAT] =        NULL,
+        [SCTP_EVENT_TIMEOUT_RECONF] =           NULL,
+        [SCTP_EVENT_TIMEOUT_SACK] =             sctp_generate_sack_event,
+        [SCTP_EVENT_TIMEOUT_AUTOCLOSE] =        sctp_generate_autoclose_event,
 };
 
 
@@ -1089,6 +1109,8 @@ static void sctp_cmd_send_msg(struct sctp_association *asoc,
 
         list_for_each_entry(chunk, &msg->chunks, frag_list)
                 sctp_outq_tail(&asoc->outqueue, chunk, gfp);
+
+        asoc->outqueue.sched->enqueue(&asoc->outqueue, msg);
 }
 
 
diff --git a/net/sctp/socket.c b/net/sctp/socket.c
index 6f45d1713452..3204a9b29407 100644
--- a/net/sctp/socket.c
+++ b/net/sctp/socket.c
@@ -79,12 +79,13 @@
 #include <net/sock.h>
 #include <net/sctp/sctp.h>
 #include <net/sctp/sm.h>
+#include <net/sctp/stream_sched.h>
 
 /* Forward declarations for internal helper functions. */
 static int sctp_writeable(struct sock *sk);
 static void sctp_wfree(struct sk_buff *skb);
-static int sctp_wait_for_sndbuf(struct sctp_association *, long *timeo_p,
-                                size_t msg_len);
+static int sctp_wait_for_sndbuf(struct sctp_association *asoc, long *timeo_p,
+                                size_t msg_len, struct sock **orig_sk);
 static int sctp_wait_for_packet(struct sock *sk, int *err, long *timeo_p);
 static int sctp_wait_for_connect(struct sctp_association *, long *timeo_p);
 static int sctp_wait_for_accept(struct sock *sk, long timeo);
@@ -1957,14 +1958,28 @@ static int sctp_sendmsg(struct sock *sk, struct msghdr *msg, size_t msg_len)
                 goto out_free;
         }
 
+        /* Allocate sctp_stream_out_ext if not already done */
+        if (unlikely(!asoc->stream.out[sinfo->sinfo_stream].ext)) {
+                err = sctp_stream_init_ext(&asoc->stream, sinfo->sinfo_stream);
+                if (err)
+                        goto out_free;
+        }
+
         if (sctp_wspace(asoc) < msg_len)
                 sctp_prsctp_prune(asoc, sinfo, msg_len - sctp_wspace(asoc));
 
         timeo = sock_sndtimeo(sk, msg->msg_flags & MSG_DONTWAIT);
         if (!sctp_wspace(asoc)) {
-                err = sctp_wait_for_sndbuf(asoc, &timeo, msg_len);
-                if (err)
+                /* sk can be changed by peel off when waiting for buf. */
+                err = sctp_wait_for_sndbuf(asoc, &timeo, msg_len, &sk);
+                if (err) {
+                        if (err == -ESRCH) {
+                                /* asoc is already dead. */
+                                new_asoc = NULL;
+                                err = -EPIPE;
+                        }
                         goto out_free;
+                }
         }
 
         /* If an address is passed with the sendto/sendmsg call, it is used
@@ -3125,9 +3140,9 @@ static int sctp_setsockopt_mappedv4(struct sock *sk, char __user *optval, unsign
  */
 static int sctp_setsockopt_maxseg(struct sock *sk, char __user *optval, unsigned int optlen)
 {
+        struct sctp_sock *sp = sctp_sk(sk);
         struct sctp_assoc_value params;
         struct sctp_association *asoc;
-        struct sctp_sock *sp = sctp_sk(sk);
         int val;
 
         if (optlen == sizeof(int)) {
@@ -3143,26 +3158,35 @@ static int sctp_setsockopt_maxseg(struct sock *sk, char __user *optval, unsigned
                 if (copy_from_user(&params, optval, optlen))
                         return -EFAULT;
                 val = params.assoc_value;
-        } else
+        } else {
                 return -EINVAL;
+        }
 
-        if ((val != 0) && ((val < 8) || (val > SCTP_MAX_CHUNK_LEN)))
-                return -EINVAL;
+        if (val) {
+                int min_len, max_len;
 
-        asoc = sctp_id2assoc(sk, params.assoc_id);
-        if (!asoc && params.assoc_id && sctp_style(sk, UDP))
-                return -EINVAL;
+                min_len = SCTP_DEFAULT_MINSEGMENT - sp->pf->af->net_header_len;
+                min_len -= sizeof(struct sctphdr) +
+                           sizeof(struct sctp_data_chunk);
+
+                max_len = SCTP_MAX_CHUNK_LEN - sizeof(struct sctp_data_chunk);
+
+                if (val < min_len || val > max_len)
+                        return -EINVAL;
+        }
 
+        asoc = sctp_id2assoc(sk, params.assoc_id);
         if (asoc) {
                 if (val == 0) {
-                        val = asoc->pathmtu;
-                        val -= sp->pf->af->net_header_len;
+                        val = asoc->pathmtu - sp->pf->af->net_header_len;
                         val -= sizeof(struct sctphdr) +
-                                        sizeof(struct sctp_data_chunk);
+                               sizeof(struct sctp_data_chunk);
                 }
                 asoc->user_frag = val;
                 asoc->frag_point = sctp_frag_point(asoc, asoc->pathmtu);
         } else {
+                if (params.assoc_id && sctp_style(sk, UDP))
+                        return -EINVAL;
                 sp->user_frag = val;
         }
 
@@ -3937,6 +3961,64 @@ out:
         return retval;
 }
 
+static int sctp_setsockopt_scheduler(struct sock *sk,
+                                     char __user *optval,
+                                     unsigned int optlen)
+{
+        struct sctp_association *asoc;
+        struct sctp_assoc_value params;
+        int retval = -EINVAL;
+
+        if (optlen < sizeof(params))
+                goto out;
+
+        optlen = sizeof(params);
+        if (copy_from_user(&params, optval, optlen)) {
+                retval = -EFAULT;
+                goto out;
+        }
+
+        if (params.assoc_value > SCTP_SS_MAX)
+                goto out;
+
+        asoc = sctp_id2assoc(sk, params.assoc_id);
+        if (!asoc)
+                goto out;
+
+        retval = sctp_sched_set_sched(asoc, params.assoc_value);
+
+out:
+        return retval;
+}
+
+static int sctp_setsockopt_scheduler_value(struct sock *sk,
+                                           char __user *optval,
+                                           unsigned int optlen)
+{
+        struct sctp_association *asoc;
+        struct sctp_stream_value params;
+        int retval = -EINVAL;
+
+        if (optlen < sizeof(params))
+                goto out;
+
+        optlen = sizeof(params);
+        if (copy_from_user(&params, optval, optlen)) {
+                retval = -EFAULT;
+                goto out;
+        }
+
+        asoc = sctp_id2assoc(sk, params.assoc_id);
+        if (!asoc)
+                goto out;
+
+        retval = sctp_sched_set_value(asoc, params.stream_id,
+                                      params.stream_value, GFP_KERNEL);
+
+out:
+        return retval;
+}
+
 /* API 6.2 setsockopt(), getsockopt()
  *
  * Applications use setsockopt() and getsockopt() to set or retrieve
@@ -4118,6 +4200,12 @@ static int sctp_setsockopt(struct sock *sk, int level, int optname,
         case SCTP_ADD_STREAMS:
                 retval = sctp_setsockopt_add_streams(sk, optval, optlen);
                 break;
+        case SCTP_STREAM_SCHEDULER:
+                retval = sctp_setsockopt_scheduler(sk, optval, optlen);
+                break;
+        case SCTP_STREAM_SCHEDULER_VALUE:
+                retval = sctp_setsockopt_scheduler_value(sk, optval, optlen);
+                break;
         default:
                 retval = -ENOPROTOOPT;
                 break;
@@ -4943,12 +5031,6 @@ int sctp_do_peeloff(struct sock *sk, sctp_assoc_t id, struct socket **sockp)
         if (!asoc)
                 return -EINVAL;
 
-        /* If there is a thread waiting on more sndbuf space for
-         * sending on this asoc, it cannot be peeled.
-         */
-        if (waitqueue_active(&asoc->wait))
-                return -EBUSY;
-
         /* An association cannot be branched off from an already peeled-off
          * socket, nor is this supported for tcp style sockets.
          */
@@ -6679,7 +6761,7 @@ static int sctp_getsockopt_pr_streamstatus(struct sock *sk, int len,
                                            char __user *optval,
                                            int __user *optlen)
 {
-        struct sctp_stream_out *streamout;
+        struct sctp_stream_out_ext *streamoute;
         struct sctp_association *asoc;
         struct sctp_prstatus params;
         int retval = -EINVAL;
@@ -6702,21 +6784,29 @@ static int sctp_getsockopt_pr_streamstatus(struct sock *sk, int len,
         if (!asoc || params.sprstat_sid >= asoc->stream.outcnt)
                 goto out;
 
-        streamout = &asoc->stream.out[params.sprstat_sid];
+        streamoute = asoc->stream.out[params.sprstat_sid].ext;
+        if (!streamoute) {
+                /* Not allocated yet, means all stats are 0 */
+                params.sprstat_abandoned_unsent = 0;
+                params.sprstat_abandoned_sent = 0;
+                retval = 0;
+                goto out;
+        }
+
         if (policy == SCTP_PR_SCTP_NONE) {
                 params.sprstat_abandoned_unsent = 0;
                 params.sprstat_abandoned_sent = 0;
                 for (policy = 0; policy <= SCTP_PR_INDEX(MAX); policy++) {
                         params.sprstat_abandoned_unsent +=
-                                streamout->abandoned_unsent[policy];
+                                streamoute->abandoned_unsent[policy];
                         params.sprstat_abandoned_sent +=
-                                streamout->abandoned_sent[policy];
+                                streamoute->abandoned_sent[policy];
                 }
         } else {
                 params.sprstat_abandoned_unsent =
-                        streamout->abandoned_unsent[__SCTP_PR_INDEX(policy)];
+                        streamoute->abandoned_unsent[__SCTP_PR_INDEX(policy)];
                 params.sprstat_abandoned_sent =
-                        streamout->abandoned_sent[__SCTP_PR_INDEX(policy)];
+                        streamoute->abandoned_sent[__SCTP_PR_INDEX(policy)];
         }
 
         if (put_user(len, optlen) || copy_to_user(optval, &params, len)) {
@@ -6812,6 +6902,85 @@ out:
         return retval;
 }
 
+static int sctp_getsockopt_scheduler(struct sock *sk, int len,
+                                     char __user *optval,
+                                     int __user *optlen)
+{
+        struct sctp_assoc_value params;
+        struct sctp_association *asoc;
+        int retval = -EFAULT;
+
+        if (len < sizeof(params)) {
+                retval = -EINVAL;
+                goto out;
+        }
+
+        len = sizeof(params);
+        if (copy_from_user(&params, optval, len))
+                goto out;
+
+        asoc = sctp_id2assoc(sk, params.assoc_id);
+        if (!asoc) {
+                retval = -EINVAL;
+                goto out;
+        }
+
+        params.assoc_value = sctp_sched_get_sched(asoc);
+
+        if (put_user(len, optlen))
+                goto out;
+
+        if (copy_to_user(optval, &params, len))
+                goto out;
+
+        retval = 0;
+
+out:
+        return retval;
+}
+
+static int sctp_getsockopt_scheduler_value(struct sock *sk, int len,
+                                           char __user *optval,
+                                           int __user *optlen)
+{
+        struct sctp_stream_value params;
+        struct sctp_association *asoc;
+        int retval = -EFAULT;
+
+        if (len < sizeof(params)) {
+                retval = -EINVAL;
+                goto out;
+        }
+
+        len = sizeof(params);
+        if (copy_from_user(&params, optval, len))
+                goto out;
+
+        asoc = sctp_id2assoc(sk, params.assoc_id);
+        if (!asoc) {
+                retval = -EINVAL;
+                goto out;
+        }
+
+        retval = sctp_sched_get_value(asoc, params.stream_id,
+                                      &params.stream_value);
+        if (retval)
+                goto out;
+
+        if (put_user(len, optlen)) {
+                retval = -EFAULT;
+                goto out;
+        }
+
+        if (copy_to_user(optval, &params, len)) {
+                retval = -EFAULT;
+                goto out;
+        }
+
+out:
+        return retval;
+}
+
 static int sctp_getsockopt(struct sock *sk, int level, int optname,
                            char __user *optval, int __user *optlen)
 {
@@ -6994,6 +7163,14 @@ static int sctp_getsockopt(struct sock *sk, int level, int optname,
                 retval = sctp_getsockopt_enable_strreset(sk, len, optval,
                                                          optlen);
                 break;
+        case SCTP_STREAM_SCHEDULER:
+                retval = sctp_getsockopt_scheduler(sk, len, optval,
+                                                   optlen);
+                break;
+        case SCTP_STREAM_SCHEDULER_VALUE:
+                retval = sctp_getsockopt_scheduler_value(sk, len, optval,
+                                                         optlen);
+                break;
         default:
                 retval = -ENOPROTOOPT;
                 break;
@@ -7822,7 +7999,7 @@ void sctp_sock_rfree(struct sk_buff *skb)
 
 /* Helper function to wait for space in the sndbuf.  */
 static int sctp_wait_for_sndbuf(struct sctp_association *asoc, long *timeo_p,
-                                size_t msg_len)
+                                size_t msg_len, struct sock **orig_sk)
 {
         struct sock *sk = asoc->base.sk;
         int err = 0;
@@ -7839,10 +8016,11 @@ static int sctp_wait_for_sndbuf(struct sctp_association *asoc, long *timeo_p,
         for (;;) {
                 prepare_to_wait_exclusive(&asoc->wait, &wait,
                                           TASK_INTERRUPTIBLE);
+                if (asoc->base.dead)
+                        goto do_dead;
                 if (!*timeo_p)
                         goto do_nonblock;
-                if (sk->sk_err || asoc->state >= SCTP_STATE_SHUTDOWN_PENDING ||
-                    asoc->base.dead)
+                if (sk->sk_err || asoc->state >= SCTP_STATE_SHUTDOWN_PENDING)
                         goto do_error;
                 if (signal_pending(current))
                         goto do_interrupted;
@@ -7855,11 +8033,17 @@ static int sctp_wait_for_sndbuf(struct sctp_association *asoc, long *timeo_p,
                 release_sock(sk);
                 current_timeo = schedule_timeout(current_timeo);
                 lock_sock(sk);
+                if (sk != asoc->base.sk) {
+                        release_sock(sk);
+                        sk = asoc->base.sk;
+                        lock_sock(sk);
+                }
 
                 *timeo_p = current_timeo;
         }
 
 out:
+        *orig_sk = sk;
         finish_wait(&asoc->wait, &wait);
 
         /* Release the association's refcnt.  */
@@ -7867,6 +8051,10 @@ out:
 
         return err;
 
+do_dead:
+        err = -ESRCH;
+        goto out;
+
 do_error:
         err = -EPIPE;
         goto out;
diff --git a/net/sctp/stream.c b/net/sctp/stream.c
index fa8371ff05c4..a11db21dc8a0 100644
--- a/net/sctp/stream.c
+++ b/net/sctp/stream.c
@@ -32,44 +32,181 @@
  *    Xin Long <lucien.xin@gmail.com>
  */
 
+#include <linux/list.h>
 #include <net/sctp/sctp.h>
 #include <net/sctp/sm.h>
+#include <net/sctp/stream_sched.h>
+
+/* Migrates chunks from stream queues to new stream queues if needed,
+ * but not across associations. Also, removes those chunks to streams
+ * higher than the new max.
+ */
+static void sctp_stream_outq_migrate(struct sctp_stream *stream,
+                                     struct sctp_stream *new, __u16 outcnt)
+{
+        struct sctp_association *asoc;
+        struct sctp_chunk *ch, *temp;
+        struct sctp_outq *outq;
+        int i;
+
+        asoc = container_of(stream, struct sctp_association, stream);
+        outq = &asoc->outqueue;
+
+        list_for_each_entry_safe(ch, temp, &outq->out_chunk_list, list) {
+                __u16 sid = sctp_chunk_stream_no(ch);
+
+                if (sid < outcnt)
+                        continue;
+
+                sctp_sched_dequeue_common(outq, ch);
+                /* No need to call dequeue_done here because
+                 * the chunks are not scheduled by now.
+                 */
+
+                /* Mark as failed send. */
+                sctp_chunk_fail(ch, SCTP_ERROR_INV_STRM);
+                if (asoc->peer.prsctp_capable &&
+                    SCTP_PR_PRIO_ENABLED(ch->sinfo.sinfo_flags))
+                        asoc->sent_cnt_removable--;
+
+                sctp_chunk_free(ch);
+        }
+
+        if (new) {
+                /* Here we actually move the old ext stuff into the new
+                 * buffer, because we want to keep it. Then
+                 * sctp_stream_update will swap ->out pointers.
+                 */
+                for (i = 0; i < outcnt; i++) {
+                        kfree(new->out[i].ext);
+                        new->out[i].ext = stream->out[i].ext;
+                        stream->out[i].ext = NULL;
+                }
+        }
+
+        for (i = outcnt; i < stream->outcnt; i++)
+                kfree(stream->out[i].ext);
+}
+
+static int sctp_stream_alloc_out(struct sctp_stream *stream, __u16 outcnt,
+                                 gfp_t gfp)
+{
+        struct sctp_stream_out *out;
+
+        out = kmalloc_array(outcnt, sizeof(*out), gfp);
+        if (!out)
+                return -ENOMEM;
+
+        if (stream->out) {
+                memcpy(out, stream->out, min(outcnt, stream->outcnt) *
+                                         sizeof(*out));
+                kfree(stream->out);
+        }
+
+        if (outcnt > stream->outcnt)
+                memset(out + stream->outcnt, 0,
+                       (outcnt - stream->outcnt) * sizeof(*out));
+
+        stream->out = out;
+
+        return 0;
+}
+
+static int sctp_stream_alloc_in(struct sctp_stream *stream, __u16 incnt,
+                                gfp_t gfp)
+{
+        struct sctp_stream_in *in;
+
+        in = kmalloc_array(incnt, sizeof(*stream->in), gfp);
+
+        if (!in)
+                return -ENOMEM;
+
+        if (stream->in) {
+                memcpy(in, stream->in, min(incnt, stream->incnt) *
+                                       sizeof(*in));
+                kfree(stream->in);
+        }
+
+        if (incnt > stream->incnt)
+                memset(in + stream->incnt, 0,
+                       (incnt - stream->incnt) * sizeof(*in));
+
+        stream->in = in;
+
+        return 0;
+}
 
 int sctp_stream_init(struct sctp_stream *stream, __u16 outcnt, __u16 incnt,
                      gfp_t gfp)
 {
-        int i;
+        struct sctp_sched_ops *sched = sctp_sched_ops_from_stream(stream);
+        int i, ret = 0;
+
+        gfp |= __GFP_NOWARN;
 
         /* Initial stream->out size may be very big, so free it and alloc
-         * a new one with new outcnt to save memory.
+         * a new one with new outcnt to save memory if needed.
          */
-        kfree(stream->out);
+        if (outcnt == stream->outcnt)
+                goto in;
 
-        stream->out = kcalloc(outcnt, sizeof(*stream->out), gfp);
-        if (!stream->out)
-                return -ENOMEM;
+        /* Filter out chunks queued on streams that won't exist anymore */
+        sched->unsched_all(stream);
+        sctp_stream_outq_migrate(stream, NULL, outcnt);
+        sched->sched_all(stream);
+
+        i = sctp_stream_alloc_out(stream, outcnt, gfp);
+        if (i)
+                return i;
 
         stream->outcnt = outcnt;
         for (i = 0; i < stream->outcnt; i++)
                 stream->out[i].state = SCTP_STREAM_OPEN;
 
+        sched->init(stream);
+
+in:
         if (!incnt)
-                return 0;
+                goto out;
 
-        stream->in = kcalloc(incnt, sizeof(*stream->in), gfp);
-        if (!stream->in) {
-                kfree(stream->out);
-                stream->out = NULL;
-                return -ENOMEM;
+        i = sctp_stream_alloc_in(stream, incnt, gfp);
+        if (i) {
+                ret = -ENOMEM;
+                goto free;
         }
 
         stream->incnt = incnt;
+        goto out;
 
-        return 0;
+free:
+        sched->free(stream);
+        kfree(stream->out);
+        stream->out = NULL;
+out:
+        return ret;
+}
+
+int sctp_stream_init_ext(struct sctp_stream *stream, __u16 sid)
+{
+        struct sctp_stream_out_ext *soute;
+
+        soute = kzalloc(sizeof(*soute), GFP_KERNEL);
+        if (!soute)
+                return -ENOMEM;
+        stream->out[sid].ext = soute;
+
+        return sctp_sched_init_sid(stream, sid, GFP_KERNEL);
 }
 
 void sctp_stream_free(struct sctp_stream *stream)
 {
+        struct sctp_sched_ops *sched = sctp_sched_ops_from_stream(stream);
+        int i;
+
+        sched->free(stream);
+        for (i = 0; i < stream->outcnt; i++)
+                kfree(stream->out[i].ext);
         kfree(stream->out);
         kfree(stream->in);
 }
@@ -87,6 +224,10 @@ void sctp_stream_clear(struct sctp_stream *stream)
 
 void sctp_stream_update(struct sctp_stream *stream, struct sctp_stream *new)
 {
+        struct sctp_sched_ops *sched = sctp_sched_ops_from_stream(stream);
+
+        sched->unsched_all(stream);
+        sctp_stream_outq_migrate(stream, new, new->outcnt);
         sctp_stream_free(stream);
 
         stream->out = new->out;
@@ -94,6 +235,8 @@ void sctp_stream_update(struct sctp_stream *stream, struct sctp_stream *new)
         stream->outcnt = new->outcnt;
         stream->incnt  = new->incnt;
 
+        sched->sched_all(stream);
+
         new->out = NULL;
         new->in  = NULL;
 }
@@ -139,15 +282,31 @@ int sctp_send_reset_streams(struct sctp_association *asoc,
 
         str_nums = params->srs_number_streams;
         str_list = params->srs_stream_list;
-        if (out && str_nums)
-                for (i = 0; i < str_nums; i++)
-                        if (str_list[i] >= stream->outcnt)
-                                goto out;
+        if (str_nums) {
+                int param_len = 0;
 
-        if (in && str_nums)
-                for (i = 0; i < str_nums; i++)
-                        if (str_list[i] >= stream->incnt)
-                                goto out;
+                if (out) {
+                        for (i = 0; i < str_nums; i++)
+                                if (str_list[i] >= stream->outcnt)
+                                        goto out;
+
+                        param_len = str_nums * sizeof(__u16) +
+                                    sizeof(struct sctp_strreset_outreq);
+                }
+
+                if (in) {
+                        for (i = 0; i < str_nums; i++)
+                                if (str_list[i] >= stream->incnt)
+                                        goto out;
+
+                        param_len += str_nums * sizeof(__u16) +
+                                     sizeof(struct sctp_strreset_inreq);
+                }
+
+                if (param_len > SCTP_MAX_CHUNK_LEN -
+                                sizeof(struct sctp_reconf_chunk))
+                        goto out;
+        }
 
         nstr_list = kcalloc(str_nums, sizeof(__be16), GFP_KERNEL);
         if (!nstr_list) {
@@ -250,7 +409,7 @@ int sctp_send_add_streams(struct sctp_association *asoc,
 {
         struct sctp_stream *stream = &asoc->stream;
         struct sctp_chunk *chunk = NULL;
-        int retval = -ENOMEM;
+        int retval;
         __u32 outcnt, incnt;
         __u16 out, in;
 
@@ -276,20 +435,16 @@ int sctp_send_add_streams(struct sctp_association *asoc,
         }
 
         if (out) {
-                struct sctp_stream_out *streamout;
-
-                streamout = krealloc(stream->out, outcnt * sizeof(*streamout),
-                                     GFP_KERNEL);
-                if (!streamout)
+                retval = sctp_stream_alloc_out(stream, outcnt, GFP_KERNEL);
+                if (retval)
                         goto out;
-
-                memset(streamout + stream->outcnt, 0, out * sizeof(*streamout));
-                stream->out = streamout;
         }
 
         chunk = sctp_make_strreset_addstrm(asoc, out, in);
-        if (!chunk)
+        if (!chunk) {
+                retval = -ENOMEM;
                 goto out;
+        }
 
         asoc->strreset_chunk = chunk;
         sctp_chunk_hold(asoc->strreset_chunk);
@@ -609,7 +764,6 @@ struct sctp_chunk *sctp_process_strreset_addstrm_out(
         struct sctp_strreset_addstrm *addstrm = param.v;
         struct sctp_stream *stream = &asoc->stream;
         __u32 result = SCTP_STRRESET_DENIED;
-        struct sctp_stream_in *streamin;
         __u32 request_seq, incnt;
         __u16 in, i;
 
@@ -656,13 +810,9 @@ struct sctp_chunk *sctp_process_strreset_addstrm_out(
         if (!in || incnt > SCTP_MAX_STREAM)
                 goto out;
 
-        streamin = krealloc(stream->in, incnt * sizeof(*streamin),
-                            GFP_ATOMIC);
-        if (!streamin)
+        if (sctp_stream_alloc_in(stream, incnt, GFP_ATOMIC))
                 goto out;
 
-        memset(streamin + stream->incnt, 0, in * sizeof(*streamin));
-        stream->in = streamin;
         stream->incnt = incnt;
 
         result = SCTP_STRRESET_PERFORMED;
@@ -684,10 +834,10 @@ struct sctp_chunk *sctp_process_strreset_addstrm_in(
         struct sctp_strreset_addstrm *addstrm = param.v;
         struct sctp_stream *stream = &asoc->stream;
         __u32 result = SCTP_STRRESET_DENIED;
-        struct sctp_stream_out *streamout;
         struct sctp_chunk *chunk = NULL;
         __u32 request_seq, outcnt;
         __u16 out, i;
+        int ret;
 
         request_seq = ntohl(addstrm->request_seq);
         if (TSN_lt(asoc->strreset_inseq, request_seq) ||
@@ -716,14 +866,10 @@ struct sctp_chunk *sctp_process_strreset_addstrm_in(
         if (!out || outcnt > SCTP_MAX_STREAM)
                 goto out;
 
-        streamout = krealloc(stream->out, outcnt * sizeof(*streamout),
-                             GFP_ATOMIC);
-        if (!streamout)
+        ret = sctp_stream_alloc_out(stream, outcnt, GFP_ATOMIC);
+        if (ret)
                 goto out;
 
-        memset(streamout + stream->outcnt, 0, out * sizeof(*streamout));
-        stream->out = streamout;
-
         chunk = sctp_make_strreset_addstrm(asoc, out, 0);
         if (!chunk)
                 goto out;
diff --git a/net/sctp/stream_sched.c b/net/sctp/stream_sched.c
new file mode 100644
index 000000000000..0b83ec51e43b
--- /dev/null
+++ b/net/sctp/stream_sched.c
@@ -0,0 +1,275 @@
+/* SCTP kernel implementation
+ * (C) Copyright Red Hat Inc. 2017
+ *
+ * This file is part of the SCTP kernel implementation
+ *
+ * These functions manipulate sctp stream queue/scheduling.
+ *
+ * This SCTP implementation is free software;
+ * you can redistribute it and/or modify it under the terms of
+ * the GNU General Public License as published by
+ * the Free Software Foundation; either version 2, or (at your option)
+ * any later version.
+ *
+ * This SCTP implementation is distributed in the hope that it
+ * will be useful, but WITHOUT ANY WARRANTY; without even the implied
+ *                 ************************
+ * warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
+ * See the GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with GNU CC; see the file COPYING.  If not, see
+ * <http://www.gnu.org/licenses/>.
+ *
+ * Please send any bug reports or fixes you make to the
+ * email addresched(es):
+ *    lksctp developers <linux-sctp@vger.kernel.org>
+ *
+ * Written or modified by:
+ *    Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
+ */
+
+#include <linux/list.h>
+#include <net/sctp/sctp.h>
+#include <net/sctp/sm.h>
+#include <net/sctp/stream_sched.h>
+
+/* First Come First Serve (a.k.a. FIFO)
+ * RFC DRAFT ndata Section 3.1
+ */
+static int sctp_sched_fcfs_set(struct sctp_stream *stream, __u16 sid,
+                               __u16 value, gfp_t gfp)
+{
+        return 0;
+}
+
+static int sctp_sched_fcfs_get(struct sctp_stream *stream, __u16 sid,
+                               __u16 *value)
+{
+        *value = 0;
+        return 0;
+}
+
+static int sctp_sched_fcfs_init(struct sctp_stream *stream)
+{
+        return 0;
+}
+
+static int sctp_sched_fcfs_init_sid(struct sctp_stream *stream, __u16 sid,
+                                    gfp_t gfp)
+{
+        return 0;
+}
+
+static void sctp_sched_fcfs_free(struct sctp_stream *stream)
+{
+}
+
+static void sctp_sched_fcfs_enqueue(struct sctp_outq *q,
+                                    struct sctp_datamsg *msg)
+{
+}
+
+static struct sctp_chunk *sctp_sched_fcfs_dequeue(struct sctp_outq *q)
+{
+        struct sctp_stream *stream = &q->asoc->stream;
+        struct sctp_chunk *ch = NULL;
+        struct list_head *entry;
+
+        if (list_empty(&q->out_chunk_list))
+                goto out;
+
+        if (stream->out_curr) {
+                ch = list_entry(stream->out_curr->ext->outq.next,
+                                struct sctp_chunk, stream_list);
+        } else {
+                entry = q->out_chunk_list.next;
+                ch = list_entry(entry, struct sctp_chunk, list);
+        }
+
+        sctp_sched_dequeue_common(q, ch);
+
+out:
+        return ch;
+}
+
+static void sctp_sched_fcfs_dequeue_done(struct sctp_outq *q,
+                                         struct sctp_chunk *chunk)
+{
+}
+
+static void sctp_sched_fcfs_sched_all(struct sctp_stream *stream)
+{
+}
+
+static void sctp_sched_fcfs_unsched_all(struct sctp_stream *stream)
+{
+}
+
+static struct sctp_sched_ops sctp_sched_fcfs = {
+        .set = sctp_sched_fcfs_set,
+        .get = sctp_sched_fcfs_get,
+        .init = sctp_sched_fcfs_init,
+        .init_sid = sctp_sched_fcfs_init_sid,
+        .free = sctp_sched_fcfs_free,
+        .enqueue = sctp_sched_fcfs_enqueue,
+        .dequeue = sctp_sched_fcfs_dequeue,
+        .dequeue_done = sctp_sched_fcfs_dequeue_done,
+        .sched_all = sctp_sched_fcfs_sched_all,
+        .unsched_all = sctp_sched_fcfs_unsched_all,
+};
+
+/* API to other parts of the stack */
+
+extern struct sctp_sched_ops sctp_sched_prio;
+extern struct sctp_sched_ops sctp_sched_rr;
+
+static struct sctp_sched_ops *sctp_sched_ops[] = {
+        &sctp_sched_fcfs,
+        &sctp_sched_prio,
+        &sctp_sched_rr,
+};
+
+int sctp_sched_set_sched(struct sctp_association *asoc,
+                         enum sctp_sched_type sched)
+{
+        struct sctp_sched_ops *n = sctp_sched_ops[sched];
+        struct sctp_sched_ops *old = asoc->outqueue.sched;
+        struct sctp_datamsg *msg = NULL;
+        struct sctp_chunk *ch;
+        int i, ret = 0;
+
+        if (old == n)
+                return ret;
+
+        if (sched > SCTP_SS_MAX)
+                return -EINVAL;
+
+        if (old) {
+                old->free(&asoc->stream);
+
+                /* Give the next scheduler a clean slate. */
+                for (i = 0; i < asoc->stream.outcnt; i++) {
+                        void *p = asoc->stream.out[i].ext;
+
+                        if (!p)
+                                continue;
+
+                        p += offsetofend(struct sctp_stream_out_ext, outq);
+                        memset(p, 0, sizeof(struct sctp_stream_out_ext) -
+                                     offsetofend(struct sctp_stream_out_ext, outq));
+                }
+        }
+
+        asoc->outqueue.sched = n;
+        n->init(&asoc->stream);
+        for (i = 0; i < asoc->stream.outcnt; i++) {
+                if (!asoc->stream.out[i].ext)
+                        continue;
+
+                ret = n->init_sid(&asoc->stream, i, GFP_KERNEL);
+                if (ret)
+                        goto err;
+        }
+
+        /* We have to requeue all chunks already queued. */
+        list_for_each_entry(ch, &asoc->outqueue.out_chunk_list, list) {
+                if (ch->msg == msg)
+                        continue;
+                msg = ch->msg;
+                n->enqueue(&asoc->outqueue, msg);
+        }
+
+        return ret;
+
+err:
+        n->free(&asoc->stream);
+        asoc->outqueue.sched = &sctp_sched_fcfs; /* Always safe */
+
+        return ret;
+}
+
+int sctp_sched_get_sched(struct sctp_association *asoc)
+{
+        int i;
+
+        for (i = 0; i <= SCTP_SS_MAX; i++)
+                if (asoc->outqueue.sched == sctp_sched_ops[i])
+                        return i;
+
+        return 0;
+}
+
+int sctp_sched_set_value(struct sctp_association *asoc, __u16 sid,
+                         __u16 value, gfp_t gfp)
+{
+        if (sid >= asoc->stream.outcnt)
+                return -EINVAL;
+
+        if (!asoc->stream.out[sid].ext) {
+                int ret;
+
+                ret = sctp_stream_init_ext(&asoc->stream, sid);
+                if (ret)
+                        return ret;
+        }
+
+        return asoc->outqueue.sched->set(&asoc->stream, sid, value, gfp);
+}
+
+int sctp_sched_get_value(struct sctp_association *asoc, __u16 sid,
+                         __u16 *value)
+{
+        if (sid >= asoc->stream.outcnt)
+                return -EINVAL;
+
+        if (!asoc->stream.out[sid].ext)
+                return 0;
+
+        return asoc->outqueue.sched->get(&asoc->stream, sid, value);
+}
+
+void sctp_sched_dequeue_done(struct sctp_outq *q, struct sctp_chunk *ch)
+{
+        if (!list_is_last(&ch->frag_list, &ch->msg->chunks)) {
+                struct sctp_stream_out *sout;
+                __u16 sid;
+
+                /* datamsg is not finish, so save it as current one,
+                 * in case application switch scheduler or a higher
+                 * priority stream comes in.
+                 */
+                sid = sctp_chunk_stream_no(ch);
+                sout = &q->asoc->stream.out[sid];
+                q->asoc->stream.out_curr = sout;
+                return;
+        }
+
+        q->asoc->stream.out_curr = NULL;
+        q->sched->dequeue_done(q, ch);
+}
+
+/* Auxiliary functions for the schedulers */
+void sctp_sched_dequeue_common(struct sctp_outq *q, struct sctp_chunk *ch)
+{
+        list_del_init(&ch->list);
+        list_del_init(&ch->stream_list);
+        q->out_qlen -= ch->skb->len;
+}
+
+int sctp_sched_init_sid(struct sctp_stream *stream, __u16 sid, gfp_t gfp)
+{
+        struct sctp_sched_ops *sched = sctp_sched_ops_from_stream(stream);
+
+        INIT_LIST_HEAD(&stream->out[sid].ext->outq);
+        return sched->init_sid(stream, sid, gfp);
+}
+
+struct sctp_sched_ops *sctp_sched_ops_from_stream(struct sctp_stream *stream)
+{
+        struct sctp_association *asoc;
+
+        asoc = container_of(stream, struct sctp_association, stream);
+
+        return asoc->outqueue.sched;
+}
diff --git a/net/sctp/stream_sched_prio.c b/net/sctp/stream_sched_prio.c
new file mode 100644
index 000000000000..384dbf3c8760
--- /dev/null
+++ b/net/sctp/stream_sched_prio.c
@@ -0,0 +1,347 @@
+/* SCTP kernel implementation
+ * (C) Copyright Red Hat Inc. 2017
+ *
+ * This file is part of the SCTP kernel implementation
+ *
+ * These functions manipulate sctp stream queue/scheduling.
+ *
+ * This SCTP implementation is free software;
+ * you can redistribute it and/or modify it under the terms of
+ * the GNU General Public License as published by
+ * the Free Software Foundation; either version 2, or (at your option)
+ * any later version.
+ *
+ * This SCTP implementation is distributed in the hope that it
+ * will be useful, but WITHOUT ANY WARRANTY; without even the implied
+ *                 ************************
+ * warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
+ * See the GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with GNU CC; see the file COPYING.  If not, see
+ * <http://www.gnu.org/licenses/>.
+ *
+ * Please send any bug reports or fixes you make to the
+ * email addresched(es):
+ *    lksctp developers <linux-sctp@vger.kernel.org>
+ *
+ * Written or modified by:
+ *    Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
+ */
+
+#include <linux/list.h>
+#include <net/sctp/sctp.h>
+#include <net/sctp/sm.h>
+#include <net/sctp/stream_sched.h>
+
+/* Priority handling
+ * RFC DRAFT ndata section 3.4
+ */
+
+static void sctp_sched_prio_unsched_all(struct sctp_stream *stream);
+
+static struct sctp_stream_priorities *sctp_sched_prio_new_head(
+                        struct sctp_stream *stream, int prio, gfp_t gfp)
+{
+        struct sctp_stream_priorities *p;
+
+        p = kmalloc(sizeof(*p), gfp);
+        if (!p)
+                return NULL;
+
+        INIT_LIST_HEAD(&p->prio_sched);
+        INIT_LIST_HEAD(&p->active);
+        p->next = NULL;
+        p->prio = prio;
+
+        return p;
+}
+
+static struct sctp_stream_priorities *sctp_sched_prio_get_head(
+                        struct sctp_stream *stream, int prio, gfp_t gfp)
+{
+        struct sctp_stream_priorities *p;
+        int i;
+
+        /* Look into scheduled priorities first, as they are sorted and
+         * we can find it fast IF it's scheduled.
+         */
+        list_for_each_entry(p, &stream->prio_list, prio_sched) {
+                if (p->prio == prio)
+                        return p;
+                if (p->prio > prio)
+                        break;
+        }
+
+        /* No luck. So we search on all streams now. */
+        for (i = 0; i < stream->outcnt; i++) {
+                if (!stream->out[i].ext)
+                        continue;
+
+                p = stream->out[i].ext->prio_head;
+                if (!p)
+                        /* Means all other streams won't be initialized
+                         * as well.
+                         */
+                        break;
+                if (p->prio == prio)
+                        return p;
+        }
+
+        /* If not even there, allocate a new one. */
+        return sctp_sched_prio_new_head(stream, prio, gfp);
+}
+
+static void sctp_sched_prio_next_stream(struct sctp_stream_priorities *p)
+{
+        struct list_head *pos;
+
+        pos = p->next->prio_list.next;
+        if (pos == &p->active)
+                pos = pos->next;
+        p->next = list_entry(pos, struct sctp_stream_out_ext, prio_list);
+}
+
+static bool sctp_sched_prio_unsched(struct sctp_stream_out_ext *soute)
+{
+        bool scheduled = false;
+
+        if (!list_empty(&soute->prio_list)) {
+                struct sctp_stream_priorities *prio_head = soute->prio_head;
+
+                /* Scheduled */
+                scheduled = true;
+
+                if (prio_head->next == soute)
+                        /* Try to move to the next stream */
+                        sctp_sched_prio_next_stream(prio_head);
+
+                list_del_init(&soute->prio_list);
+
+                /* Also unsched the priority if this was the last stream */
+                if (list_empty(&prio_head->active)) {
+                        list_del_init(&prio_head->prio_sched);
+                        /* If there is no stream left, clear next */
+                        prio_head->next = NULL;
+                }
+        }
+
+        return scheduled;
+}
+
+static void sctp_sched_prio_sched(struct sctp_stream *stream,
+                                  struct sctp_stream_out_ext *soute)
+{
+        struct sctp_stream_priorities *prio, *prio_head;
+
+        prio_head = soute->prio_head;
+
+        /* Nothing to do if already scheduled */
+        if (!list_empty(&soute->prio_list))
+                return;
+
+        /* Schedule the stream. If there is a next, we schedule the new
+         * one before it, so it's the last in round robin order.
+         * If there isn't, we also have to schedule the priority.
+         */
+        if (prio_head->next) {
+                list_add(&soute->prio_list, prio_head->next->prio_list.prev);
+                return;
+        }
+
+        list_add(&soute->prio_list, &prio_head->active);
+        prio_head->next = soute;
+
+        list_for_each_entry(prio, &stream->prio_list, prio_sched) {
+                if (prio->prio > prio_head->prio) {
+                        list_add(&prio_head->prio_sched, prio->prio_sched.prev);
+                        return;
+                }
+        }
+
+        list_add_tail(&prio_head->prio_sched, &stream->prio_list);
+}
+
+static int sctp_sched_prio_set(struct sctp_stream *stream, __u16 sid,
+                               __u16 prio, gfp_t gfp)
+{
+        struct sctp_stream_out *sout = &stream->out[sid];
+        struct sctp_stream_out_ext *soute = sout->ext;
+        struct sctp_stream_priorities *prio_head, *old;
+        bool reschedule = false;
+        int i;
+
+        prio_head = sctp_sched_prio_get_head(stream, prio, gfp);
+        if (!prio_head)
+                return -ENOMEM;
+
+        reschedule = sctp_sched_prio_unsched(soute);
+        old = soute->prio_head;
+        soute->prio_head = prio_head;
+        if (reschedule)
+                sctp_sched_prio_sched(stream, soute);
+
+        if (!old)
+                /* Happens when we set the priority for the first time */
+                return 0;
+
+        for (i = 0; i < stream->outcnt; i++) {
+                soute = stream->out[i].ext;
+                if (soute && soute->prio_head == old)
+                        /* It's still in use, nothing else to do here. */
+                        return 0;
+        }
+
+        /* No hits, we are good to free it. */
+        kfree(old);
+
+        return 0;
+}
+
+static int sctp_sched_prio_get(struct sctp_stream *stream, __u16 sid,
+                               __u16 *value)
+{
+        *value = stream->out[sid].ext->prio_head->prio;
+        return 0;
+}
+
+static int sctp_sched_prio_init(struct sctp_stream *stream)
+{
+        INIT_LIST_HEAD(&stream->prio_list);
+
+        return 0;
+}
+
+static int sctp_sched_prio_init_sid(struct sctp_stream *stream, __u16 sid,
+                                    gfp_t gfp)
+{
+        INIT_LIST_HEAD(&stream->out[sid].ext->prio_list);
+        return sctp_sched_prio_set(stream, sid, 0, gfp);
+}
+
+static void sctp_sched_prio_free(struct sctp_stream *stream)
+{
+        struct sctp_stream_priorities *prio, *n;
+        LIST_HEAD(list);
+        int i;
+
+        /* As we don't keep a list of priorities, to avoid multiple
+         * frees we have to do it in 3 steps:
+         *   1. unsched everyone, so the lists are free to use in 2.
+         *   2. build the list of the priorities
+         *   3. free the list
+         */
+        sctp_sched_prio_unsched_all(stream);
+        for (i = 0; i < stream->outcnt; i++) {
+                if (!stream->out[i].ext)
+                        continue;
+                prio = stream->out[i].ext->prio_head;
+                if (prio && list_empty(&prio->prio_sched))
+                        list_add(&prio->prio_sched, &list);
+        }
+        list_for_each_entry_safe(prio, n, &list, prio_sched) {
+                list_del_init(&prio->prio_sched);
+                kfree(prio);
+        }
+}
+
+static void sctp_sched_prio_enqueue(struct sctp_outq *q,
+                                    struct sctp_datamsg *msg)
+{
+        struct sctp_stream *stream;
+        struct sctp_chunk *ch;
+        __u16 sid;
+
+        ch = list_first_entry(&msg->chunks, struct sctp_chunk, frag_list);
+        sid = sctp_chunk_stream_no(ch);
+        stream = &q->asoc->stream;
+        sctp_sched_prio_sched(stream, stream->out[sid].ext);
+}
+
+static struct sctp_chunk *sctp_sched_prio_dequeue(struct sctp_outq *q)
+{
+        struct sctp_stream *stream = &q->asoc->stream;
+        struct sctp_stream_priorities *prio;
+        struct sctp_stream_out_ext *soute;
+        struct sctp_chunk *ch = NULL;
+
+        /* Bail out quickly if queue is empty */
+        if (list_empty(&q->out_chunk_list))
+                goto out;
+
+        /* Find which chunk is next. It's easy, it's either the current
+         * one or the first chunk on the next active stream.
+         */
+        if (stream->out_curr) {
+                soute = stream->out_curr->ext;
+        } else {
+                prio = list_entry(stream->prio_list.next,
+                                  struct sctp_stream_priorities, prio_sched);
+                soute = prio->next;
+        }
+        ch = list_entry(soute->outq.next, struct sctp_chunk, stream_list);
+        sctp_sched_dequeue_common(q, ch);
+
+out:
+        return ch;
+}
+
+static void sctp_sched_prio_dequeue_done(struct sctp_outq *q,
+                                         struct sctp_chunk *ch)
+{
+        struct sctp_stream_priorities *prio;
+        struct sctp_stream_out_ext *soute;
+        __u16 sid;
+
+        /* Last chunk on that msg, move to the next stream on
+         * this priority.
+         */
+        sid = sctp_chunk_stream_no(ch);
+        soute = q->asoc->stream.out[sid].ext;
+        prio = soute->prio_head;
+
+        sctp_sched_prio_next_stream(prio);
+
+        if (list_empty(&soute->outq))
+                sctp_sched_prio_unsched(soute);
+}
+
+static void sctp_sched_prio_sched_all(struct sctp_stream *stream)
+{
+        struct sctp_association *asoc;
+        struct sctp_stream_out *sout;
+        struct sctp_chunk *ch;
+
+        asoc = container_of(stream, struct sctp_association, stream);
+        list_for_each_entry(ch, &asoc->outqueue.out_chunk_list, list) {
+                __u16 sid;
+
+                sid = sctp_chunk_stream_no(ch);
+                sout = &stream->out[sid];
+                if (sout->ext)
+                        sctp_sched_prio_sched(stream, sout->ext);
+        }
+}
+
+static void sctp_sched_prio_unsched_all(struct sctp_stream *stream)
+{
+        struct sctp_stream_priorities *p, *tmp;
+        struct sctp_stream_out_ext *soute, *souttmp;
+
+        list_for_each_entry_safe(p, tmp, &stream->prio_list, prio_sched)
+                list_for_each_entry_safe(soute, souttmp, &p->active, prio_list)
+                        sctp_sched_prio_unsched(soute);
+}
+
+struct sctp_sched_ops sctp_sched_prio = {
+        .set = sctp_sched_prio_set,
+        .get = sctp_sched_prio_get,
+        .init = sctp_sched_prio_init,
+        .init_sid = sctp_sched_prio_init_sid,
+        .free = sctp_sched_prio_free,
+        .enqueue = sctp_sched_prio_enqueue,
+        .dequeue = sctp_sched_prio_dequeue,
+        .dequeue_done = sctp_sched_prio_dequeue_done,
+        .sched_all = sctp_sched_prio_sched_all,
+        .unsched_all = sctp_sched_prio_unsched_all,
+};
diff --git a/net/sctp/stream_sched_rr.c b/net/sctp/stream_sched_rr.c
new file mode 100644
index 000000000000..7612a438c5b9
--- /dev/null
+++ b/net/sctp/stream_sched_rr.c
@@ -0,0 +1,201 @@
+/* SCTP kernel implementation
+ * (C) Copyright Red Hat Inc. 2017
+ *
+ * This file is part of the SCTP kernel implementation
+ *
+ * These functions manipulate sctp stream queue/scheduling.
+ *
+ * This SCTP implementation is free software;
+ * you can redistribute it and/or modify it under the terms of
+ * the GNU General Public License as published by
+ * the Free Software Foundation; either version 2, or (at your option)
+ * any later version.
+ *
+ * This SCTP implementation is distributed in the hope that it
+ * will be useful, but WITHOUT ANY WARRANTY; without even the implied
+ *                 ************************
+ * warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
+ * See the GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with GNU CC; see the file COPYING.  If not, see
+ * <http://www.gnu.org/licenses/>.
+ *
+ * Please send any bug reports or fixes you make to the
+ * email addresched(es):
+ *    lksctp developers <linux-sctp@vger.kernel.org>
+ *
+ * Written or modified by:
+ *    Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
+ */
+
+#include <linux/list.h>
+#include <net/sctp/sctp.h>
+#include <net/sctp/sm.h>
+#include <net/sctp/stream_sched.h>
+
+/* Priority handling
+ * RFC DRAFT ndata section 3.2
+ */
+static void sctp_sched_rr_unsched_all(struct sctp_stream *stream);
+
+static void sctp_sched_rr_next_stream(struct sctp_stream *stream)
+{
+        struct list_head *pos;
+
+        pos = stream->rr_next->rr_list.next;
+        if (pos == &stream->rr_list)
+                pos = pos->next;
+        stream->rr_next = list_entry(pos, struct sctp_stream_out_ext, rr_list);
+}
+
+static void sctp_sched_rr_unsched(struct sctp_stream *stream,
+                                  struct sctp_stream_out_ext *soute)
+{
+        if (stream->rr_next == soute)
+                /* Try to move to the next stream */
+                sctp_sched_rr_next_stream(stream);
+
+        list_del_init(&soute->rr_list);
+
+        /* If we have no other stream queued, clear next */
+        if (list_empty(&stream->rr_list))
+                stream->rr_next = NULL;
+}
+
+static void sctp_sched_rr_sched(struct sctp_stream *stream,
+                                struct sctp_stream_out_ext *soute)
+{
+        if (!list_empty(&soute->rr_list))
+                /* Already scheduled. */
+                return;
+
+        /* Schedule the stream */
+        list_add_tail(&soute->rr_list, &stream->rr_list);
+
+        if (!stream->rr_next)
+                stream->rr_next = soute;
+}
+
+static int sctp_sched_rr_set(struct sctp_stream *stream, __u16 sid,
+                             __u16 prio, gfp_t gfp)
+{
+        return 0;
+}
+
+static int sctp_sched_rr_get(struct sctp_stream *stream, __u16 sid,
+                             __u16 *value)
+{
+        return 0;
+}
+
+static int sctp_sched_rr_init(struct sctp_stream *stream)
+{
+        INIT_LIST_HEAD(&stream->rr_list);
+        stream->rr_next = NULL;
+
+        return 0;
+}
+
+static int sctp_sched_rr_init_sid(struct sctp_stream *stream, __u16 sid,
+                                  gfp_t gfp)
+{
+        INIT_LIST_HEAD(&stream->out[sid].ext->rr_list);
+
+        return 0;
+}
+
+static void sctp_sched_rr_free(struct sctp_stream *stream)
+{
+        sctp_sched_rr_unsched_all(stream);
+}
+
+static void sctp_sched_rr_enqueue(struct sctp_outq *q,
+                                  struct sctp_datamsg *msg)
+{
+        struct sctp_stream *stream;
+        struct sctp_chunk *ch;
+        __u16 sid;
+
+        ch = list_first_entry(&msg->chunks, struct sctp_chunk, frag_list);
+        sid = sctp_chunk_stream_no(ch);
+        stream = &q->asoc->stream;
+        sctp_sched_rr_sched(stream, stream->out[sid].ext);
+}
+
+static struct sctp_chunk *sctp_sched_rr_dequeue(struct sctp_outq *q)
+{
+        struct sctp_stream *stream = &q->asoc->stream;
+        struct sctp_stream_out_ext *soute;
+        struct sctp_chunk *ch = NULL;
+
+        /* Bail out quickly if queue is empty */
+        if (list_empty(&q->out_chunk_list))
+                goto out;
+
+        /* Find which chunk is next */
+        if (stream->out_curr)
+                soute = stream->out_curr->ext;
+        else
+                soute = stream->rr_next;
+        ch = list_entry(soute->outq.next, struct sctp_chunk, stream_list);
+
+        sctp_sched_dequeue_common(q, ch);
+
+out:
+        return ch;
+}
+
+static void sctp_sched_rr_dequeue_done(struct sctp_outq *q,
+                                       struct sctp_chunk *ch)
+{
+        struct sctp_stream_out_ext *soute;
+        __u16 sid;
+
+        /* Last chunk on that msg, move to the next stream */
+        sid = sctp_chunk_stream_no(ch);
+        soute = q->asoc->stream.out[sid].ext;
+
+        sctp_sched_rr_next_stream(&q->asoc->stream);
+
+        if (list_empty(&soute->outq))
+                sctp_sched_rr_unsched(&q->asoc->stream, soute);
+}
+
+static void sctp_sched_rr_sched_all(struct sctp_stream *stream)
+{
+        struct sctp_association *asoc;
+        struct sctp_stream_out_ext *soute;
+        struct sctp_chunk *ch;
+
+        asoc = container_of(stream, struct sctp_association, stream);
+        list_for_each_entry(ch, &asoc->outqueue.out_chunk_list, list) {
+                __u16 sid;
+
+                sid = sctp_chunk_stream_no(ch);
+                soute = stream->out[sid].ext;
+                if (soute)
+                        sctp_sched_rr_sched(stream, soute);
+        }
+}
+
+static void sctp_sched_rr_unsched_all(struct sctp_stream *stream)
+{
+        struct sctp_stream_out_ext *soute, *tmp;
+
+        list_for_each_entry_safe(soute, tmp, &stream->rr_list, rr_list)
+                sctp_sched_rr_unsched(stream, soute);
+}
+
+struct sctp_sched_ops sctp_sched_rr = {
+        .set = sctp_sched_rr_set,
+        .get = sctp_sched_rr_get,
+        .init = sctp_sched_rr_init,
+        .init_sid = sctp_sched_rr_init_sid,
+        .free = sctp_sched_rr_free,
+        .enqueue = sctp_sched_rr_enqueue,
+        .dequeue = sctp_sched_rr_dequeue,
+        .dequeue_done = sctp_sched_rr_dequeue_done,
+        .sched_all = sctp_sched_rr_sched_all,
+        .unsched_all = sctp_sched_rr_unsched_all,
+};
diff --git a/net/sctp/transport.c b/net/sctp/transport.c
index 2d9bd3776bc8..1e5a22430cf5 100644
--- a/net/sctp/transport.c
+++ b/net/sctp/transport.c
@@ -87,14 +87,11 @@ static struct sctp_transport *sctp_transport_init(struct net *net,
         INIT_LIST_HEAD(&peer->send_ready);
         INIT_LIST_HEAD(&peer->transports);
 
-        setup_timer(&peer->T3_rtx_timer, sctp_generate_t3_rtx_event,
-                    (unsigned long)peer);
-        setup_timer(&peer->hb_timer, sctp_generate_heartbeat_event,
-                    (unsigned long)peer);
-        setup_timer(&peer->reconf_timer, sctp_generate_reconf_event,
-                    (unsigned long)peer);
-        setup_timer(&peer->proto_unreach_timer,
-                    sctp_generate_proto_unreach_event, (unsigned long)peer);
+        timer_setup(&peer->T3_rtx_timer, sctp_generate_t3_rtx_event, 0);
+        timer_setup(&peer->hb_timer, sctp_generate_heartbeat_event, 0);
+        timer_setup(&peer->reconf_timer, sctp_generate_reconf_event, 0);
+        timer_setup(&peer->proto_unreach_timer,
+                    sctp_generate_proto_unreach_event, 0);
 
         /* Initialize the 64-bit random nonce sent with heartbeat. */
         get_random_bytes(&peer->hb_nonce, sizeof(peer->hb_nonce));
diff --git a/net/smc/af_smc.c b/net/smc/af_smc.c
index 745f145d4c4d..6451c5013e06 100644
--- a/net/smc/af_smc.c
+++ b/net/smc/af_smc.c
@@ -390,6 +390,12 @@ static int smc_connect_rdma(struct smc_sock *smc)
         int rc = 0;
         u8 ibport;
 
+        if (!tcp_sk(smc->clcsock->sk)->syn_smc) {
+                /* peer has not signalled SMC-capability */
+                smc->use_fallback = true;
+                goto out_connected;
+        }
+
         /* IPSec connections opt out of SMC-R optimizations */
         if (using_ipsec(smc)) {
                 reason_code = SMC_CLC_DECL_IPSEC;
@@ -555,6 +561,7 @@ static int smc_connect(struct socket *sock, struct sockaddr *addr,
         }
 
         smc_copy_sock_settings_to_clc(smc);
+        tcp_sk(smc->clcsock->sk)->syn_smc = 1;
         rc = kernel_connect(smc->clcsock, addr, alen, flags);
         if (rc)
                 goto out;
@@ -759,6 +766,12 @@ static void smc_listen_work(struct work_struct *work)
         u8 prefix_len;
         u8 ibport;
 
+        /* check if peer is smc capable */
+        if (!tcp_sk(newclcsock->sk)->syn_smc) {
+                new_smc->use_fallback = true;
+                goto out_connected;
+        }
+
         /* do inband token exchange -
          *wait for and receive SMC Proposal CLC message
          */
@@ -808,7 +821,7 @@ static void smc_listen_work(struct work_struct *work)
                 rc = local_contact;
                 if (rc == -ENOMEM)
                         reason_code = SMC_CLC_DECL_MEM;/* insufficient memory*/
-                goto decline_rdma;
+                goto decline_rdma_unlock;
         }
         link = &new_smc->conn.lgr->lnk[SMC_SINGLE_LINK];
 
@@ -816,7 +829,7 @@ static void smc_listen_work(struct work_struct *work)
         rc = smc_buf_create(new_smc);
         if (rc) {
                 reason_code = SMC_CLC_DECL_MEM;
-                goto decline_rdma;
+                goto decline_rdma_unlock;
         }
 
         smc_close_init(new_smc);
@@ -831,7 +844,7 @@ static void smc_listen_work(struct work_struct *work)
                                              buf_desc->mr_rx[SMC_SINGLE_LINK]);
                         if (rc) {
                                 reason_code = SMC_CLC_DECL_INTERR;
-                                goto decline_rdma;
+                                goto decline_rdma_unlock;
                         }
                 }
         }
@@ -839,15 +852,15 @@ static void smc_listen_work(struct work_struct *work)
 
         rc = smc_clc_send_accept(new_smc, local_contact);
         if (rc)
-                goto out_err;
+                goto out_err_unlock;
 
         /* receive SMC Confirm CLC message */
         reason_code = smc_clc_wait_msg(new_smc, &cclc, sizeof(cclc),
                                        SMC_CLC_CONFIRM);
         if (reason_code < 0)
-                goto out_err;
+                goto out_err_unlock;
         if (reason_code > 0)
-                goto decline_rdma;
+                goto decline_rdma_unlock;
         smc_conn_save_peer_info(new_smc, &cclc);
         if (local_contact == SMC_FIRST_CONTACT)
                 smc_link_save_peer_info(link, &cclc);
@@ -855,34 +868,34 @@ static void smc_listen_work(struct work_struct *work)
         rc = smc_rmb_rtoken_handling(&new_smc->conn, &cclc);
         if (rc) {
                 reason_code = SMC_CLC_DECL_INTERR;
-                goto decline_rdma;
+                goto decline_rdma_unlock;
         }
 
         if (local_contact == SMC_FIRST_CONTACT) {
                 rc = smc_ib_ready_link(link);
                 if (rc) {
                         reason_code = SMC_CLC_DECL_INTERR;
-                        goto decline_rdma;
+                        goto decline_rdma_unlock;
                 }
                 /* QP confirmation over RoCE fabric */
                 reason_code = smc_serv_conf_first_link(new_smc);
                 if (reason_code < 0) {
                         /* peer is not aware of a problem */
                         rc = reason_code;
-                        goto out_err;
+                        goto out_err_unlock;
                 }
                 if (reason_code > 0)
-                        goto decline_rdma;
+                        goto decline_rdma_unlock;
         }
 
         smc_tx_init(new_smc);
+        mutex_unlock(&smc_create_lgr_pending);
 
 out_connected:
         sk_refcnt_debug_inc(newsmcsk);
         if (newsmcsk->sk_state == SMC_INIT)
                 newsmcsk->sk_state = SMC_ACTIVE;
 enqueue:
-        mutex_unlock(&smc_create_lgr_pending);
         lock_sock_nested(&lsmc->sk, SINGLE_DEPTH_NESTING);
         if (lsmc->sk.sk_state == SMC_LISTEN) {
                 smc_accept_enqueue(&lsmc->sk, newsmcsk);
@@ -896,6 +909,8 @@ enqueue:
         sock_put(&lsmc->sk); /* sock_hold in smc_tcp_listen_work */
         return;
 
+decline_rdma_unlock:
+        mutex_unlock(&smc_create_lgr_pending);
 decline_rdma:
         /* RDMA setup failed, switch back to TCP */
         smc_conn_free(&new_smc->conn);
@@ -907,6 +922,8 @@ decline_rdma:
         }
         goto out_connected;
 
+out_err_unlock:
+        mutex_unlock(&smc_create_lgr_pending);
 out_err:
         newsmcsk->sk_state = SMC_CLOSED;
         smc_conn_free(&new_smc->conn);
@@ -963,6 +980,7 @@ static int smc_listen(struct socket *sock, int backlog)
          * them to the clc socket -- copy smc socket options to clc socket
          */
         smc_copy_sock_settings_to_clc(smc);
+        tcp_sk(smc->clcsock->sk)->syn_smc = 1;
 
         rc = kernel_listen(smc->clcsock, backlog);
         if (rc)
@@ -1405,6 +1423,7 @@ static int __init smc_init(void)
                 goto out_sock;
         }
 
+        static_branch_enable(&tcp_have_smc);
         return 0;
 
 out_sock:
@@ -1429,6 +1448,7 @@ static void __exit smc_exit(void)
                 list_del_init(&lgr->list);
                 smc_lgr_free(lgr); /* free link group */
         }
+        static_branch_disable(&tcp_have_smc);
         smc_ib_unregister_client();
         sock_unregister(PF_SMC);
         proto_unregister(&smc_proto);
diff --git a/net/smc/smc_cdc.c b/net/smc/smc_cdc.c
index 535e72cfc64b..87f7bede6eab 100644
--- a/net/smc/smc_cdc.c
+++ b/net/smc/smc_cdc.c
@@ -63,10 +63,12 @@ static void smc_cdc_tx_handler(struct smc_wr_tx_pend_priv *pnd_snd,
         bh_unlock_sock(&smc->sk);
 }
 
-int smc_cdc_get_free_slot(struct smc_link *link,
+int smc_cdc_get_free_slot(struct smc_connection *conn,
                           struct smc_wr_buf **wr_buf,
                           struct smc_cdc_tx_pend **pend)
 {
+        struct smc_link *link = &conn->lgr->lnk[SMC_SINGLE_LINK];
+
         return smc_wr_tx_get_free_slot(link, smc_cdc_tx_handler, wr_buf,
                                        (struct smc_wr_tx_pend_priv **)pend);
 }
@@ -119,8 +121,7 @@ int smc_cdc_get_slot_and_msg_send(struct smc_connection *conn)
         struct smc_wr_buf *wr_buf;
         int rc;
 
-        rc = smc_cdc_get_free_slot(&conn->lgr->lnk[SMC_SINGLE_LINK], &wr_buf,
-                                   &pend);
+        rc = smc_cdc_get_free_slot(conn, &wr_buf, &pend);
         if (rc)
                 return rc;
 
diff --git a/net/smc/smc_cdc.h b/net/smc/smc_cdc.h
index bea61dadaf36..149ceda1b088 100644
--- a/net/smc/smc_cdc.h
+++ b/net/smc/smc_cdc.h
@@ -207,7 +207,8 @@ static inline void smc_cdc_msg_to_host(struct smc_host_cdc_msg *local,
 
 struct smc_cdc_tx_pend;
 
-int smc_cdc_get_free_slot(struct smc_link *link, struct smc_wr_buf **wr_buf,
+int smc_cdc_get_free_slot(struct smc_connection *conn,
+                          struct smc_wr_buf **wr_buf,
                           struct smc_cdc_tx_pend **pend);
 void smc_cdc_tx_dismiss_slots(struct smc_connection *conn);
 int smc_cdc_msg_send(struct smc_connection *conn, struct smc_wr_buf *wr_buf,
diff --git a/net/smc/smc_close.c b/net/smc/smc_close.c
index 2427a1f3d0d1..48615d2ac4aa 100644
--- a/net/smc/smc_close.c
+++ b/net/smc/smc_close.c
@@ -361,7 +361,8 @@ static void smc_close_passive_work(struct work_struct *work)
         case SMC_PEERCLOSEWAIT1:
                 if (rxflags->peer_done_writing)
                         sk->sk_state = SMC_PEERCLOSEWAIT2;
-                /* fall through to check for closing */
+                /* fall through */
+                /* to check for closing */
         case SMC_PEERCLOSEWAIT2:
         case SMC_PEERFINCLOSEWAIT:
                 if (!smc_cdc_rxed_any_close(&smc->conn))
diff --git a/net/smc/smc_core.c b/net/smc/smc_core.c
index 413e3868fbf3..2578fbd95664 100644
--- a/net/smc/smc_core.c
+++ b/net/smc/smc_core.c
@@ -381,10 +381,14 @@ static int smc_link_determine_gid(struct smc_link_group *lgr)
                 if (ib_query_gid(lnk->smcibdev->ibdev, lnk->ibport, i, &gid,
                                  &gattr))
                         continue;
-                if (gattr.ndev &&
-                    (vlan_dev_vlan_id(gattr.ndev) == lgr->vlan_id)) {
-                        lnk->gid = gid;
-                        return 0;
+                if (gattr.ndev) {
+                        if (is_vlan_dev(gattr.ndev) &&
+                            vlan_dev_vlan_id(gattr.ndev) == lgr->vlan_id) {
+                                lnk->gid = gid;
+                                dev_put(gattr.ndev);
+                                return 0;
+                        }
+                        dev_put(gattr.ndev);
                 }
         }
         return -ENODEV;
diff --git a/net/smc/smc_ib.c b/net/smc/smc_ib.c
index 9033b8a36fe1..90f1a7f9085c 100644
--- a/net/smc/smc_ib.c
+++ b/net/smc/smc_ib.c
@@ -370,26 +370,17 @@ void smc_ib_buf_unmap_sg(struct smc_ib_device *smcibdev,
 
 static int smc_ib_fill_gid_and_mac(struct smc_ib_device *smcibdev, u8 ibport)
 {
-        struct net_device *ndev;
+        struct ib_gid_attr gattr;
         int rc;
 
         rc = ib_query_gid(smcibdev->ibdev, ibport, 0,
-                          &smcibdev->gid[ibport - 1], NULL);
-        /* the SMC protocol requires specification of the roce MAC address;
-         * if net_device cannot be determined, it can be derived from gid 0
-         */
-        ndev = smcibdev->ibdev->get_netdev(smcibdev->ibdev, ibport);
-        if (ndev) {
-                memcpy(&smcibdev->mac, ndev->dev_addr, ETH_ALEN);
-                dev_put(ndev);
-        } else if (!rc) {
-                memcpy(&smcibdev->mac[ibport - 1][0],
-                       &smcibdev->gid[ibport - 1].raw[8], 3);
-                memcpy(&smcibdev->mac[ibport - 1][3],
-                       &smcibdev->gid[ibport - 1].raw[13], 3);
-                smcibdev->mac[ibport - 1][0] &= ~0x02;
-        }
-        return rc;
+                          &smcibdev->gid[ibport - 1], &gattr);
+        if (rc || !gattr.ndev)
+                return -ENODEV;
+
+        memcpy(smcibdev->mac[ibport - 1], gattr.ndev->dev_addr, ETH_ALEN);
+        dev_put(gattr.ndev);
+        return 0;
 }
 
 /* Create an identifier unique for this instance of SMC-R.
@@ -420,6 +411,7 @@ int smc_ib_remember_port_attr(struct smc_ib_device *smcibdev, u8 ibport)
                            &smcibdev->pattr[ibport - 1]);
         if (rc)
                 goto out;
+        /* the SMC protocol requires specification of the RoCE MAC address */
         rc = smc_ib_fill_gid_and_mac(smcibdev, ibport);
         if (rc)
                 goto out;
diff --git a/net/smc/smc_tx.c b/net/smc/smc_tx.c
index 710ab3fbf607..c48dc2d5fd3a 100644
--- a/net/smc/smc_tx.c
+++ b/net/smc/smc_tx.c
@@ -397,8 +397,7 @@ int smc_tx_sndbuf_nonempty(struct smc_connection *conn)
         int rc;
 
         spin_lock_bh(&conn->send_lock);
-        rc = smc_cdc_get_free_slot(&conn->lgr->lnk[SMC_SINGLE_LINK], &wr_buf,
-                                   &pend);
+        rc = smc_cdc_get_free_slot(conn, &wr_buf, &pend);
         if (rc < 0) {
                 if (rc == -EBUSY) {
                         struct smc_sock *smc =
@@ -467,8 +466,7 @@ void smc_tx_consumer_update(struct smc_connection *conn)
             ((to_confirm > conn->rmbe_update_limit) &&
              ((to_confirm > (conn->rmbe_size / 2)) ||
               conn->local_rx_ctrl.prod_flags.write_blocked))) {
-                rc = smc_cdc_get_free_slot(&conn->lgr->lnk[SMC_SINGLE_LINK],
-                                           &wr_buf, &pend);
+                rc = smc_cdc_get_free_slot(conn, &wr_buf, &pend);
                 if (!rc)
                         rc = smc_cdc_msg_send(conn, wr_buf, pend);
                 if (rc < 0) {
diff --git a/net/socket.c b/net/socket.c
index c729625eb5d3..42d8e9c9ccd5 100644
--- a/net/socket.c
+++ b/net/socket.c
@@ -568,7 +568,6 @@ struct socket *sock_alloc(void)
 
         sock = SOCKET_I(inode);
 
-        kmemcheck_annotate_bitfield(sock, type);
         inode->i_ino = get_next_ino();
         inode->i_mode = S_IFSOCK | S_IRWXUGO;
         inode->i_uid = current_fsuid();
diff --git a/net/sunrpc/auth_gss/svcauth_gss.c b/net/sunrpc/auth_gss/svcauth_gss.c
index 7b1ee5a0b03c..73165e9ca5bf 100644
--- a/net/sunrpc/auth_gss/svcauth_gss.c
+++ b/net/sunrpc/auth_gss/svcauth_gss.c
@@ -855,11 +855,13 @@ unwrap_integ_data(struct svc_rqst *rqstp, struct xdr_buf *buf, u32 seq, struct g
                 return stat;
         if (integ_len > buf->len)
                 return stat;
-        if (xdr_buf_subsegment(buf, &integ_buf, 0, integ_len))
-                BUG();
+        if (xdr_buf_subsegment(buf, &integ_buf, 0, integ_len)) {
+                WARN_ON_ONCE(1);
+                return stat;
+        }
         /* copy out mic... */
         if (read_u32_from_xdr_buf(buf, integ_len, &mic.len))
-                BUG();
+                return stat;
         if (mic.len > RPC_MAX_AUTH_SIZE)
                 return stat;
         mic.data = kmalloc(mic.len, GFP_KERNEL);
@@ -1611,8 +1613,10 @@ svcauth_gss_wrap_resp_integ(struct svc_rqst *rqstp)
         BUG_ON(integ_len % 4);
         *p++ = htonl(integ_len);
         *p++ = htonl(gc->gc_seq);
-        if (xdr_buf_subsegment(resbuf, &integ_buf, integ_offset, integ_len))
-                BUG();
+        if (xdr_buf_subsegment(resbuf, &integ_buf, integ_offset, integ_len)) {
+                WARN_ON_ONCE(1);
+                goto out_err;
+        }
         if (resbuf->tail[0].iov_base == NULL) {
                 if (resbuf->head[0].iov_len + RPC_MAX_AUTH_SIZE > PAGE_SIZE)
                         goto out_err;
diff --git a/net/sunrpc/clnt.c b/net/sunrpc/clnt.c
index 2ad827db2704..a801da812f86 100644
--- a/net/sunrpc/clnt.c
+++ b/net/sunrpc/clnt.c
@@ -1491,7 +1491,6 @@ rpc_restart_call(struct rpc_task *task)
 }
 EXPORT_SYMBOL_GPL(rpc_restart_call);
 
-#if IS_ENABLED(CONFIG_SUNRPC_DEBUG)
 const char
 *rpc_proc_name(const struct rpc_task *task)
 {
@@ -1505,7 +1504,6 @@ const char
         } else
                 return "no proc";
 }
-#endif
 
 /*
  * 0.  Initial state
@@ -1519,6 +1517,7 @@ call_start(struct rpc_task *task)
         struct rpc_clnt *clnt = task->tk_client;
         int idx = task->tk_msg.rpc_proc->p_statidx;
 
+        trace_rpc_request(task);
         dprintk("RPC: %5u call_start %s%d proc %s (%s)\n", task->tk_pid,
                         clnt->cl_program->name, clnt->cl_vers,
                         rpc_proc_name(task),
@@ -1586,6 +1585,7 @@ call_reserveresult(struct rpc_task *task)
         switch (status) {
         case -ENOMEM:
                 rpc_delay(task, HZ >> 2);
+                /* fall through */
         case -EAGAIN:   /* woken up; retry */
                 task->tk_action = call_retry_reserve;
                 return;
@@ -1647,10 +1647,13 @@ call_refreshresult(struct rpc_task *task)
                 /* Use rate-limiting and a max number of retries if refresh
                  * had status 0 but failed to update the cred.
                  */
+                /* fall through */
         case -ETIMEDOUT:
                 rpc_delay(task, 3*HZ);
+                /* fall through */
         case -EAGAIN:
                 status = -EACCES;
+                /* fall through */
         case -EKEYEXPIRED:
                 if (!task->tk_cred_retry)
                         break;
@@ -1911,6 +1914,7 @@ call_connect_status(struct rpc_task *task)
                         task->tk_action = call_bind;
                         return;
                 }
+                /* fall through */
         case -ECONNRESET:
         case -ECONNABORTED:
         case -ENETUNREACH:
@@ -1924,6 +1928,7 @@ call_connect_status(struct rpc_task *task)
                         break;
                 /* retry with existing socket, after a delay */
                 rpc_delay(task, 3*HZ);
+                /* fall through */
         case -EAGAIN:
                 /* Check for timeouts before looping back to call_bind */
         case -ETIMEDOUT:
@@ -2025,6 +2030,7 @@ call_transmit_status(struct rpc_task *task)
                         rpc_exit(task, task->tk_status);
                         break;
                 }
+                /* fall through */
         case -ECONNRESET:
         case -ECONNABORTED:
         case -EADDRINUSE:
@@ -2145,6 +2151,7 @@ call_status(struct rpc_task *task)
                  * were a timeout.
                  */
                 rpc_delay(task, 3*HZ);
+                /* fall through */
         case -ETIMEDOUT:
                 task->tk_action = call_timeout;
                 break;
@@ -2152,14 +2159,17 @@ call_status(struct rpc_task *task)
         case -ECONNRESET:
         case -ECONNABORTED:
                 rpc_force_rebind(clnt);
+                /* fall through */
         case -EADDRINUSE:
                 rpc_delay(task, 3*HZ);
+                /* fall through */
         case -EPIPE:
         case -ENOTCONN:
                 task->tk_action = call_bind;
                 break;
         case -ENOBUFS:
                 rpc_delay(task, HZ>>2);
+                /* fall through */
         case -EAGAIN:
                 task->tk_action = call_transmit;
                 break;
diff --git a/net/sunrpc/rpc_pipe.c b/net/sunrpc/rpc_pipe.c
index 61a504fb1ae2..7803f3b6aa53 100644
--- a/net/sunrpc/rpc_pipe.c
+++ b/net/sunrpc/rpc_pipe.c
@@ -1410,8 +1410,8 @@ rpc_fill_super(struct super_block *sb, void *data, int silent)
                 return PTR_ERR(gssd_dentry);
         }
 
-        dprintk("RPC:       sending pipefs MOUNT notification for net %p%s\n",
-                net, NET_NAME(net));
+        dprintk("RPC:       sending pipefs MOUNT notification for net %x%s\n",
+                net->ns.inum, NET_NAME(net));
         mutex_lock(&sn->pipefs_sb_lock);
         sn->pipefs_sb = sb;
         err = blocking_notifier_call_chain(&rpc_pipefs_notifier_list,
@@ -1462,8 +1462,8 @@ static void rpc_kill_sb(struct super_block *sb)
                 goto out;
         }
         sn->pipefs_sb = NULL;
-        dprintk("RPC:       sending pipefs UMOUNT notification for net %p%s\n",
-                net, NET_NAME(net));
+        dprintk("RPC:       sending pipefs UMOUNT notification for net %x%s\n",
+                net->ns.inum, NET_NAME(net));
         blocking_notifier_call_chain(&rpc_pipefs_notifier_list,
                                            RPC_PIPEFS_UMOUNT,
                                            sb);
diff --git a/net/sunrpc/rpcb_clnt.c b/net/sunrpc/rpcb_clnt.c
index ea0676f199c8..c526f8fb37c9 100644
--- a/net/sunrpc/rpcb_clnt.c
+++ b/net/sunrpc/rpcb_clnt.c
@@ -216,9 +216,9 @@ static void rpcb_set_local(struct net *net, struct rpc_clnt *clnt,
         smp_wmb(); 
         sn->rpcb_users = 1;
         dprintk("RPC:       created new rpcb local clients (rpcb_local_clnt: "
-                        "%p, rpcb_local_clnt4: %p) for net %p%s\n",
-                        sn->rpcb_local_clnt, sn->rpcb_local_clnt4,
-                        net, (net == &init_net) ? " (init_net)" : "");
+                "%p, rpcb_local_clnt4: %p) for net %x%s\n",
+                sn->rpcb_local_clnt, sn->rpcb_local_clnt4,
+                net->ns.inum, (net == &init_net) ? " (init_net)" : "");
 }
 
 /*
diff --git a/net/sunrpc/sched.c b/net/sunrpc/sched.c
index 0cc83839c13c..b1b49edd7c4d 100644
--- a/net/sunrpc/sched.c
+++ b/net/sunrpc/sched.c
@@ -44,7 +44,7 @@ static mempool_t	*rpc_buffer_mempool __read_mostly;
 
 static void                     rpc_async_schedule(struct work_struct *);
 static void                      rpc_release_task(struct rpc_task *task);
-static void __rpc_queue_timer_fn(unsigned long ptr);
+static void __rpc_queue_timer_fn(struct timer_list *t);
 
 /*
  * RPC tasks sit here while waiting for conditions to improve.
@@ -228,7 +228,7 @@ static void __rpc_init_priority_wait_queue(struct rpc_wait_queue *queue, const c
         queue->maxpriority = nr_queues - 1;
         rpc_reset_waitqueue_priority(queue);
         queue->qlen = 0;
-        setup_timer(&queue->timer_list.timer, __rpc_queue_timer_fn, (unsigned long)queue);
+        timer_setup(&queue->timer_list.timer, __rpc_queue_timer_fn, 0);
         INIT_LIST_HEAD(&queue->timer_list.list);
         rpc_assign_waitqueue_name(queue, qname);
 }
@@ -274,10 +274,9 @@ static inline void rpc_task_set_debuginfo(struct rpc_task *task)
 
 static void rpc_set_active(struct rpc_task *task)
 {
-        trace_rpc_task_begin(task->tk_client, task, NULL);
-
         rpc_task_set_debuginfo(task);
         set_bit(RPC_TASK_ACTIVE, &task->tk_runstate);
+        trace_rpc_task_begin(task->tk_client, task, NULL);
 }
 
 /*
@@ -635,9 +634,9 @@ void rpc_wake_up_status(struct rpc_wait_queue *queue, int status)
 }
 EXPORT_SYMBOL_GPL(rpc_wake_up_status);
 
-static void __rpc_queue_timer_fn(unsigned long ptr)
+static void __rpc_queue_timer_fn(struct timer_list *t)
 {
-        struct rpc_wait_queue *queue = (struct rpc_wait_queue *)ptr;
+        struct rpc_wait_queue *queue = from_timer(queue, t, timer_list.timer);
         struct rpc_task *task, *n;
         unsigned long expires, now, timeo;
 
diff --git a/net/sunrpc/sunrpc_syms.c b/net/sunrpc/sunrpc_syms.c
index c73de181467a..56f9eff74150 100644
--- a/net/sunrpc/sunrpc_syms.c
+++ b/net/sunrpc/sunrpc_syms.c
@@ -65,10 +65,13 @@ err_proc:
 
 static __net_exit void sunrpc_exit_net(struct net *net)
 {
+        struct sunrpc_net *sn = net_generic(net, sunrpc_net_id);
+
         rpc_pipefs_exit_net(net);
         unix_gid_cache_destroy(net);
         ip_map_cache_destroy(net);
         rpc_proc_exit(net);
+        WARN_ON_ONCE(!list_empty(&sn->all_clients));
 }
 
 static struct pernet_operations sunrpc_net_ops = {
diff --git a/net/sunrpc/svc.c b/net/sunrpc/svc.c
index aa04666f929d..387cc4add6f6 100644
--- a/net/sunrpc/svc.c
+++ b/net/sunrpc/svc.c
@@ -50,7 +50,7 @@ EXPORT_SYMBOL_GPL(svc_pool_map);
 static DEFINE_MUTEX(svc_pool_map_mutex);/* protects svc_pool_map.count only */
 
 static int
-param_set_pool_mode(const char *val, struct kernel_param *kp)
+param_set_pool_mode(const char *val, const struct kernel_param *kp)
 {
         int *ip = (int *)kp->arg;
         struct svc_pool_map *m = &svc_pool_map;
@@ -80,7 +80,7 @@ out:
 }
 
 static int
-param_get_pool_mode(char *buf, struct kernel_param *kp)
+param_get_pool_mode(char *buf, const struct kernel_param *kp)
 {
         int *ip = (int *)kp->arg;
 
@@ -455,7 +455,7 @@ __svc_create(struct svc_program *prog, unsigned int bufsize, int npools,
         serv->sv_xdrsize   = xdrsize;
         INIT_LIST_HEAD(&serv->sv_tempsocks);
         INIT_LIST_HEAD(&serv->sv_permsocks);
-        init_timer(&serv->sv_temptimer);
+        timer_setup(&serv->sv_temptimer, NULL, 0);
         spin_lock_init(&serv->sv_lock);
 
         __svc_init_bc(serv);
diff --git a/net/sunrpc/svc_xprt.c b/net/sunrpc/svc_xprt.c
index d16a8b423c20..f9307bd6644b 100644
--- a/net/sunrpc/svc_xprt.c
+++ b/net/sunrpc/svc_xprt.c
@@ -28,7 +28,7 @@ module_param(svc_rpc_per_connection_limit, uint, 0644);
 static struct svc_deferred_req *svc_deferred_dequeue(struct svc_xprt *xprt);
 static int svc_deferred_recv(struct svc_rqst *rqstp);
 static struct cache_deferred_req *svc_defer(struct cache_req *req);
-static void svc_age_temp_xprts(unsigned long closure);
+static void svc_age_temp_xprts(struct timer_list *t);
 static void svc_delete_xprt(struct svc_xprt *xprt);
 
 /* apparently the "standard" is that clients close
@@ -250,9 +250,9 @@ void svc_add_new_perm_xprt(struct svc_serv *serv, struct svc_xprt *new)
         svc_xprt_received(new);
 }
 
-int _svc_create_xprt(struct svc_serv *serv, const char *xprt_name,
-                    struct net *net, const int family,
-                    const unsigned short port, int flags)
+static int _svc_create_xprt(struct svc_serv *serv, const char *xprt_name,
+                            struct net *net, const int family,
+                            const unsigned short port, int flags)
 {
         struct svc_xprt_class *xcl;
 
@@ -380,7 +380,6 @@ void svc_xprt_do_enqueue(struct svc_xprt *xprt)
         struct svc_pool *pool;
         struct svc_rqst *rqstp = NULL;
         int cpu;
-        bool queued = false;
 
         if (!svc_xprt_has_something_to_do(xprt))
                 goto out;
@@ -401,58 +400,25 @@ void svc_xprt_do_enqueue(struct svc_xprt *xprt)
 
         atomic_long_inc(&pool->sp_stats.packets);
 
-redo_search:
+        dprintk("svc: transport %p put into queue\n", xprt);
+        spin_lock_bh(&pool->sp_lock);
+        list_add_tail(&xprt->xpt_ready, &pool->sp_sockets);
+        pool->sp_stats.sockets_queued++;
+        spin_unlock_bh(&pool->sp_lock);
+
         /* find a thread for this xprt */
         rcu_read_lock();
         list_for_each_entry_rcu(rqstp, &pool->sp_all_threads, rq_all) {
-                /* Do a lockless check first */
-                if (test_bit(RQ_BUSY, &rqstp->rq_flags))
+                if (test_and_set_bit(RQ_BUSY, &rqstp->rq_flags))
                         continue;
-
-                /*
-                 * Once the xprt has been queued, it can only be dequeued by
-                 * the task that intends to service it. All we can do at that
-                 * point is to try to wake this thread back up so that it can
-                 * do so.
-                 */
-                if (!queued) {
-                        spin_lock_bh(&rqstp->rq_lock);
-                        if (test_and_set_bit(RQ_BUSY, &rqstp->rq_flags)) {
-                                /* already busy, move on... */
-                                spin_unlock_bh(&rqstp->rq_lock);
-                                continue;
-                        }
-
-                        /* this one will do */
-                        rqstp->rq_xprt = xprt;
-                        svc_xprt_get(xprt);
-                        spin_unlock_bh(&rqstp->rq_lock);
-                }
-                rcu_read_unlock();
-
                 atomic_long_inc(&pool->sp_stats.threads_woken);
                 wake_up_process(rqstp->rq_task);
-                put_cpu();
-                goto out;
-        }
-        rcu_read_unlock();
-
-        /*
-         * We didn't find an idle thread to use, so we need to queue the xprt.
-         * Do so and then search again. If we find one, we can't hook this one
-         * up to it directly but we can wake the thread up in the hopes that it
-         * will pick it up once it searches for a xprt to service.
-         */
-        if (!queued) {
-                queued = true;
-                dprintk("svc: transport %p put into queue\n", xprt);
-                spin_lock_bh(&pool->sp_lock);
-                list_add_tail(&xprt->xpt_ready, &pool->sp_sockets);
-                pool->sp_stats.sockets_queued++;
-                spin_unlock_bh(&pool->sp_lock);
-                goto redo_search;
+                goto out_unlock;
         }
+        set_bit(SP_CONGESTED, &pool->sp_flags);
         rqstp = NULL;
+out_unlock:
+        rcu_read_unlock();
         put_cpu();
 out:
         trace_svc_xprt_do_enqueue(xprt, rqstp);
@@ -721,38 +687,25 @@ rqst_should_sleep(struct svc_rqst *rqstp)
 
 static struct svc_xprt *svc_get_next_xprt(struct svc_rqst *rqstp, long timeout)
 {
-        struct svc_xprt *xprt;
         struct svc_pool         *pool = rqstp->rq_pool;
         long                    time_left = 0;
 
         /* rq_xprt should be clear on entry */
         WARN_ON_ONCE(rqstp->rq_xprt);
 
-        /* Normally we will wait up to 5 seconds for any required
-         * cache information to be provided.
-         */
-        rqstp->rq_chandle.thread_wait = 5*HZ;
-
-        xprt = svc_xprt_dequeue(pool);
-        if (xprt) {
-                rqstp->rq_xprt = xprt;
-
-                /* As there is a shortage of threads and this request
-                 * had to be queued, don't allow the thread to wait so
-                 * long for cache updates.
-                 */
-                rqstp->rq_chandle.thread_wait = 1*HZ;
-                clear_bit(SP_TASK_PENDING, &pool->sp_flags);
-                return xprt;
-        }
+        rqstp->rq_xprt = svc_xprt_dequeue(pool);
+        if (rqstp->rq_xprt)
+                goto out_found;
 
         /*
          * We have to be able to interrupt this wait
          * to bring down the daemons ...
          */
         set_current_state(TASK_INTERRUPTIBLE);
+        smp_mb__before_atomic();
+        clear_bit(SP_CONGESTED, &pool->sp_flags);
         clear_bit(RQ_BUSY, &rqstp->rq_flags);
-        smp_mb();
+        smp_mb__after_atomic();
 
         if (likely(rqst_should_sleep(rqstp)))
                 time_left = schedule_timeout(timeout);
@@ -761,13 +714,11 @@ static struct svc_xprt *svc_get_next_xprt(struct svc_rqst *rqstp, long timeout)
 
         try_to_freeze();
 
-        spin_lock_bh(&rqstp->rq_lock);
         set_bit(RQ_BUSY, &rqstp->rq_flags);
-        spin_unlock_bh(&rqstp->rq_lock);
-
-        xprt = rqstp->rq_xprt;
-        if (xprt != NULL)
-                return xprt;
+        smp_mb__after_atomic();
+        rqstp->rq_xprt = svc_xprt_dequeue(pool);
+        if (rqstp->rq_xprt)
+                goto out_found;
 
         if (!time_left)
                 atomic_long_inc(&pool->sp_stats.threads_timedout);
@@ -775,6 +726,15 @@ static struct svc_xprt *svc_get_next_xprt(struct svc_rqst *rqstp, long timeout)
         if (signalled() || kthread_should_stop())
                 return ERR_PTR(-EINTR);
         return ERR_PTR(-EAGAIN);
+out_found:
+        /* Normally we will wait up to 5 seconds for any required
+         * cache information to be provided.
+         */
+        if (!test_bit(SP_CONGESTED, &pool->sp_flags))
+                rqstp->rq_chandle.thread_wait = 5*HZ;
+        else
+                rqstp->rq_chandle.thread_wait = 1*HZ;
+        return rqstp->rq_xprt;
 }
 
 static void svc_add_new_temp_xprt(struct svc_serv *serv, struct svc_xprt *newxpt)
@@ -785,8 +745,7 @@ static void svc_add_new_temp_xprt(struct svc_serv *serv, struct svc_xprt *newxpt
         serv->sv_tmpcnt++;
         if (serv->sv_temptimer.function == NULL) {
                 /* setup timer to age temp transports */
-                setup_timer(&serv->sv_temptimer, svc_age_temp_xprts,
-                            (unsigned long)serv);
+                serv->sv_temptimer.function = svc_age_temp_xprts;
                 mod_timer(&serv->sv_temptimer,
                           jiffies + svc_conn_age_period * HZ);
         }
@@ -960,9 +919,9 @@ out:
  * Timer function to close old temporary transports, using
  * a mark-and-sweep algorithm.
  */
-static void svc_age_temp_xprts(unsigned long closure)
+static void svc_age_temp_xprts(struct timer_list *t)
 {
-        struct svc_serv *serv = (struct svc_serv *)closure;
+        struct svc_serv *serv = from_timer(serv, t, sv_temptimer);
         struct svc_xprt *xprt;
         struct list_head *le, *next;
 
diff --git a/net/sunrpc/xprt.c b/net/sunrpc/xprt.c
index 898485e3ece4..333b9d697ae5 100644
--- a/net/sunrpc/xprt.c
+++ b/net/sunrpc/xprt.c
@@ -696,9 +696,9 @@ xprt_schedule_autodisconnect(struct rpc_xprt *xprt)
 }
 
 static void
-xprt_init_autodisconnect(unsigned long data)
+xprt_init_autodisconnect(struct timer_list *t)
 {
-        struct rpc_xprt *xprt = (struct rpc_xprt *)data;
+        struct rpc_xprt *xprt = from_timer(xprt, t, timer);
 
         spin_lock(&xprt->transport_lock);
         if (!list_empty(&xprt->recv))
@@ -1139,6 +1139,7 @@ void xprt_alloc_slot(struct rpc_xprt *xprt, struct rpc_task *task)
         case -EAGAIN:
                 xprt_add_backlog(xprt, task);
                 dprintk("RPC:       waiting for request slot\n");
+                /* fall through */
         default:
                 task->tk_status = -EAGAIN;
         }
@@ -1422,10 +1423,9 @@ found:
                 xprt->idle_timeout = 0;
         INIT_WORK(&xprt->task_cleanup, xprt_autoclose);
         if (xprt_has_timer(xprt))
-                setup_timer(&xprt->timer, xprt_init_autodisconnect,
-                            (unsigned long)xprt);
+                timer_setup(&xprt->timer, xprt_init_autodisconnect, 0);
         else
-                init_timer(&xprt->timer);
+                timer_setup(&xprt->timer, NULL, 0);
 
         if (strlen(args->servername) > RPC_MAXNETNAMELEN) {
                 xprt_destroy(xprt);
diff --git a/net/sunrpc/xprtrdma/backchannel.c b/net/sunrpc/xprtrdma/backchannel.c
index 823a781ec89c..8b818bb3518a 100644
--- a/net/sunrpc/xprtrdma/backchannel.c
+++ b/net/sunrpc/xprtrdma/backchannel.c
@@ -43,7 +43,7 @@ static int rpcrdma_bc_setup_rqst(struct rpcrdma_xprt *r_xprt,
         req = rpcrdma_create_req(r_xprt);
         if (IS_ERR(req))
                 return PTR_ERR(req);
-        req->rl_backchannel = true;
+        __set_bit(RPCRDMA_REQ_F_BACKCHANNEL, &req->rl_flags);
 
         rb = rpcrdma_alloc_regbuf(RPCRDMA_HDRBUF_SIZE,
                                   DMA_TO_DEVICE, GFP_KERNEL);
@@ -223,8 +223,8 @@ int rpcrdma_bc_marshal_reply(struct rpc_rqst *rqst)
         *p++ = xdr_zero;
         *p = xdr_zero;
 
-        if (!rpcrdma_prepare_send_sges(&r_xprt->rx_ia, req, RPCRDMA_HDRLEN_MIN,
-                                       &rqst->rq_snd_buf, rpcrdma_noch))
+        if (rpcrdma_prepare_send_sges(r_xprt, req, RPCRDMA_HDRLEN_MIN,
+                                      &rqst->rq_snd_buf, rpcrdma_noch))
                 return -EIO;
         return 0;
 }
diff --git a/net/sunrpc/xprtrdma/fmr_ops.c b/net/sunrpc/xprtrdma/fmr_ops.c
index fa759dd2b0f3..29fc84c7ff98 100644
--- a/net/sunrpc/xprtrdma/fmr_ops.c
+++ b/net/sunrpc/xprtrdma/fmr_ops.c
@@ -306,28 +306,9 @@ out_reset:
         }
 }
 
-/* Use a slow, safe mechanism to invalidate all memory regions
- * that were registered for "req".
- */
-static void
-fmr_op_unmap_safe(struct rpcrdma_xprt *r_xprt, struct rpcrdma_req *req,
-                  bool sync)
-{
-        struct rpcrdma_mw *mw;
-
-        while (!list_empty(&req->rl_registered)) {
-                mw = rpcrdma_pop_mw(&req->rl_registered);
-                if (sync)
-                        fmr_op_recover_mr(mw);
-                else
-                        rpcrdma_defer_mr_recovery(mw);
-        }
-}
-
 const struct rpcrdma_memreg_ops rpcrdma_fmr_memreg_ops = {
         .ro_map                         = fmr_op_map,
         .ro_unmap_sync                  = fmr_op_unmap_sync,
-        .ro_unmap_safe                  = fmr_op_unmap_safe,
         .ro_recover_mr                  = fmr_op_recover_mr,
         .ro_open                        = fmr_op_open,
         .ro_maxpages                    = fmr_op_maxpages,
diff --git a/net/sunrpc/xprtrdma/frwr_ops.c b/net/sunrpc/xprtrdma/frwr_ops.c
index 35d7517ef0e6..773e66e10a15 100644
--- a/net/sunrpc/xprtrdma/frwr_ops.c
+++ b/net/sunrpc/xprtrdma/frwr_ops.c
@@ -420,7 +420,6 @@ frwr_op_map(struct rpcrdma_xprt *r_xprt, struct rpcrdma_mr_seg *seg,
                          IB_ACCESS_REMOTE_WRITE | IB_ACCESS_LOCAL_WRITE :
                          IB_ACCESS_REMOTE_READ;
 
-        rpcrdma_set_signaled(&r_xprt->rx_ep, &reg_wr->wr);
         rc = ib_post_send(ia->ri_id->qp, &reg_wr->wr, &bad_wr);
         if (rc)
                 goto out_senderr;
@@ -508,12 +507,6 @@ frwr_op_unmap_sync(struct rpcrdma_xprt *r_xprt, struct list_head *mws)
         f->fr_cqe.done = frwr_wc_localinv_wake;
         reinit_completion(&f->fr_linv_done);
 
-        /* Initialize CQ count, since there is always a signaled
-         * WR being posted here.  The new cqcount depends on how
-         * many SQEs are about to be consumed.
-         */
-        rpcrdma_init_cqcount(&r_xprt->rx_ep, count);
-
         /* Transport disconnect drains the receive CQ before it
          * replaces the QP. The RPC reply handler won't call us
          * unless ri_id->qp is a valid pointer.
@@ -546,7 +539,6 @@ reset_mrs:
         /* Find and reset the MRs in the LOCAL_INV WRs that did not
          * get posted.
          */
-        rpcrdma_init_cqcount(&r_xprt->rx_ep, -count);
         while (bad_wr) {
                 f = container_of(bad_wr, struct rpcrdma_frmr,
                                  fr_invwr);
@@ -559,28 +551,9 @@ reset_mrs:
         goto unmap;
 }
 
-/* Use a slow, safe mechanism to invalidate all memory regions
- * that were registered for "req".
- */
-static void
-frwr_op_unmap_safe(struct rpcrdma_xprt *r_xprt, struct rpcrdma_req *req,
-                   bool sync)
-{
-        struct rpcrdma_mw *mw;
-
-        while (!list_empty(&req->rl_registered)) {
-                mw = rpcrdma_pop_mw(&req->rl_registered);
-                if (sync)
-                        frwr_op_recover_mr(mw);
-                else
-                        rpcrdma_defer_mr_recovery(mw);
-        }
-}
-
 const struct rpcrdma_memreg_ops rpcrdma_frwr_memreg_ops = {
         .ro_map                         = frwr_op_map,
         .ro_unmap_sync                  = frwr_op_unmap_sync,
-        .ro_unmap_safe                  = frwr_op_unmap_safe,
         .ro_recover_mr                  = frwr_op_recover_mr,
         .ro_open                        = frwr_op_open,
         .ro_maxpages                    = frwr_op_maxpages,
diff --git a/net/sunrpc/xprtrdma/rpc_rdma.c b/net/sunrpc/xprtrdma/rpc_rdma.c
index f1889f4d4803..ed34dc0f144c 100644
--- a/net/sunrpc/xprtrdma/rpc_rdma.c
+++ b/net/sunrpc/xprtrdma/rpc_rdma.c
@@ -1,4 +1,5 @@
 /*
+ * Copyright (c) 2014-2017 Oracle.  All rights reserved.
  * Copyright (c) 2003-2007 Network Appliance, Inc. All rights reserved.
  *
  * This software is available to you under a choice of one of two
@@ -75,11 +76,11 @@ static unsigned int rpcrdma_max_call_header_size(unsigned int maxsegs)
 
         /* Maximum Read list size */
         maxsegs += 2;   /* segment for head and tail buffers */
-        size = maxsegs * sizeof(struct rpcrdma_read_chunk);
+        size = maxsegs * rpcrdma_readchunk_maxsz * sizeof(__be32);
 
         /* Minimal Read chunk size */
         size += sizeof(__be32); /* segment count */
-        size += sizeof(struct rpcrdma_segment);
+        size += rpcrdma_segment_maxsz * sizeof(__be32);
         size += sizeof(__be32); /* list discriminator */
 
         dprintk("RPC:       %s: max call header size = %u\n",
@@ -102,7 +103,7 @@ static unsigned int rpcrdma_max_reply_header_size(unsigned int maxsegs)
         /* Maximum Write list size */
         maxsegs += 2;   /* segment for head and tail buffers */
         size = sizeof(__be32);          /* segment count */
-        size += maxsegs * sizeof(struct rpcrdma_segment);
+        size += maxsegs * rpcrdma_segment_maxsz * sizeof(__be32);
         size += sizeof(__be32); /* list discriminator */
 
         dprintk("RPC:       %s: max reply header size = %u\n",
@@ -511,27 +512,60 @@ rpcrdma_encode_reply_chunk(struct rpcrdma_xprt *r_xprt, struct rpcrdma_req *req,
         return 0;
 }
 
-/* Prepare the RPC-over-RDMA header SGE.
+/**
+ * rpcrdma_unmap_sendctx - DMA-unmap Send buffers
+ * @sc: sendctx containing SGEs to unmap
+ *
+ */
+void
+rpcrdma_unmap_sendctx(struct rpcrdma_sendctx *sc)
+{
+        struct rpcrdma_ia *ia = &sc->sc_xprt->rx_ia;
+        struct ib_sge *sge;
+        unsigned int count;
+
+        dprintk("RPC:       %s: unmapping %u sges for sc=%p\n",
+                __func__, sc->sc_unmap_count, sc);
+
+        /* The first two SGEs contain the transport header and
+         * the inline buffer. These are always left mapped so
+         * they can be cheaply re-used.
+         */
+        sge = &sc->sc_sges[2];
+        for (count = sc->sc_unmap_count; count; ++sge, --count)
+                ib_dma_unmap_page(ia->ri_device,
+                                  sge->addr, sge->length, DMA_TO_DEVICE);
+
+        if (test_and_clear_bit(RPCRDMA_REQ_F_TX_RESOURCES, &sc->sc_req->rl_flags)) {
+                smp_mb__after_atomic();
+                wake_up_bit(&sc->sc_req->rl_flags, RPCRDMA_REQ_F_TX_RESOURCES);
+        }
+}
+
+/* Prepare an SGE for the RPC-over-RDMA transport header.
  */
 static bool
 rpcrdma_prepare_hdr_sge(struct rpcrdma_ia *ia, struct rpcrdma_req *req,
                         u32 len)
 {
+        struct rpcrdma_sendctx *sc = req->rl_sendctx;
         struct rpcrdma_regbuf *rb = req->rl_rdmabuf;
-        struct ib_sge *sge = &req->rl_send_sge[0];
+        struct ib_sge *sge = sc->sc_sges;
 
-        if (unlikely(!rpcrdma_regbuf_is_mapped(rb))) {
-                if (!__rpcrdma_dma_map_regbuf(ia, rb))
-                        return false;
-                sge->addr = rdmab_addr(rb);
-                sge->lkey = rdmab_lkey(rb);
-        }
+        if (!rpcrdma_dma_map_regbuf(ia, rb))
+                goto out_regbuf;
+        sge->addr = rdmab_addr(rb);
         sge->length = len;
+        sge->lkey = rdmab_lkey(rb);
 
         ib_dma_sync_single_for_device(rdmab_device(rb), sge->addr,
                                       sge->length, DMA_TO_DEVICE);
-        req->rl_send_wr.num_sge++;
+        sc->sc_wr.num_sge++;
         return true;
+
+out_regbuf:
+        pr_err("rpcrdma: failed to DMA map a Send buffer\n");
+        return false;
 }
 
 /* Prepare the Send SGEs. The head and tail iovec, and each entry
@@ -541,10 +575,11 @@ static bool
 rpcrdma_prepare_msg_sges(struct rpcrdma_ia *ia, struct rpcrdma_req *req,
                          struct xdr_buf *xdr, enum rpcrdma_chunktype rtype)
 {
+        struct rpcrdma_sendctx *sc = req->rl_sendctx;
         unsigned int sge_no, page_base, len, remaining;
         struct rpcrdma_regbuf *rb = req->rl_sendbuf;
         struct ib_device *device = ia->ri_device;
-        struct ib_sge *sge = req->rl_send_sge;
+        struct ib_sge *sge = sc->sc_sges;
         u32 lkey = ia->ri_pd->local_dma_lkey;
         struct page *page, **ppages;
 
@@ -552,7 +587,7 @@ rpcrdma_prepare_msg_sges(struct rpcrdma_ia *ia, struct rpcrdma_req *req,
          * DMA-mapped. Sync the content that has changed.
          */
         if (!rpcrdma_dma_map_regbuf(ia, rb))
-                return false;
+                goto out_regbuf;
         sge_no = 1;
         sge[sge_no].addr = rdmab_addr(rb);
         sge[sge_no].length = xdr->head[0].iov_len;
@@ -607,7 +642,7 @@ rpcrdma_prepare_msg_sges(struct rpcrdma_ia *ia, struct rpcrdma_req *req,
                         sge[sge_no].length = len;
                         sge[sge_no].lkey = lkey;
 
-                        req->rl_mapped_sges++;
+                        sc->sc_unmap_count++;
                         ppages++;
                         remaining -= len;
                         page_base = 0;
@@ -633,56 +668,61 @@ map_tail:
                         goto out_mapping_err;
                 sge[sge_no].length = len;
                 sge[sge_no].lkey = lkey;
-                req->rl_mapped_sges++;
+                sc->sc_unmap_count++;
         }
 
 out:
-        req->rl_send_wr.num_sge = sge_no + 1;
+        sc->sc_wr.num_sge += sge_no;
+        if (sc->sc_unmap_count)
+                __set_bit(RPCRDMA_REQ_F_TX_RESOURCES, &req->rl_flags);
         return true;
 
+out_regbuf:
+        pr_err("rpcrdma: failed to DMA map a Send buffer\n");
+        return false;
+
 out_mapping_overflow:
+        rpcrdma_unmap_sendctx(sc);
         pr_err("rpcrdma: too many Send SGEs (%u)\n", sge_no);
         return false;
 
 out_mapping_err:
+        rpcrdma_unmap_sendctx(sc);
         pr_err("rpcrdma: Send mapping error\n");
         return false;
 }
 
-bool
-rpcrdma_prepare_send_sges(struct rpcrdma_ia *ia, struct rpcrdma_req *req,
-                          u32 hdrlen, struct xdr_buf *xdr,
-                          enum rpcrdma_chunktype rtype)
+/**
+ * rpcrdma_prepare_send_sges - Construct SGEs for a Send WR
+ * @r_xprt: controlling transport
+ * @req: context of RPC Call being marshalled
+ * @hdrlen: size of transport header, in bytes
+ * @xdr: xdr_buf containing RPC Call
+ * @rtype: chunk type being encoded
+ *
+ * Returns 0 on success; otherwise a negative errno is returned.
+ */
+int
+rpcrdma_prepare_send_sges(struct rpcrdma_xprt *r_xprt,
+                          struct rpcrdma_req *req, u32 hdrlen,
+                          struct xdr_buf *xdr, enum rpcrdma_chunktype rtype)
 {
-        req->rl_send_wr.num_sge = 0;
-        req->rl_mapped_sges = 0;
-
-        if (!rpcrdma_prepare_hdr_sge(ia, req, hdrlen))
-                goto out_map;
+        req->rl_sendctx = rpcrdma_sendctx_get_locked(&r_xprt->rx_buf);
+        if (!req->rl_sendctx)
+                return -ENOBUFS;
+        req->rl_sendctx->sc_wr.num_sge = 0;
+        req->rl_sendctx->sc_unmap_count = 0;
+        req->rl_sendctx->sc_req = req;
+        __clear_bit(RPCRDMA_REQ_F_TX_RESOURCES, &req->rl_flags);
+
+        if (!rpcrdma_prepare_hdr_sge(&r_xprt->rx_ia, req, hdrlen))
+                return -EIO;
 
         if (rtype != rpcrdma_areadch)
-                if (!rpcrdma_prepare_msg_sges(ia, req, xdr, rtype))
-                        goto out_map;
-
-        return true;
-
-out_map:
-        pr_err("rpcrdma: failed to DMA map a Send buffer\n");
-        return false;
-}
-
-void
-rpcrdma_unmap_sges(struct rpcrdma_ia *ia, struct rpcrdma_req *req)
-{
-        struct ib_device *device = ia->ri_device;
-        struct ib_sge *sge;
-        int count;
+                if (!rpcrdma_prepare_msg_sges(&r_xprt->rx_ia, req, xdr, rtype))
+                        return -EIO;
 
-        sge = &req->rl_send_sge[2];
-        for (count = req->rl_mapped_sges; count--; sge++)
-                ib_dma_unmap_page(device, sge->addr, sge->length,
-                                  DMA_TO_DEVICE);
-        req->rl_mapped_sges = 0;
+        return 0;
 }
 
 /**
@@ -833,12 +873,10 @@ rpcrdma_marshal_req(struct rpcrdma_xprt *r_xprt, struct rpc_rqst *rqst)
                 transfertypes[rtype], transfertypes[wtype],
                 xdr_stream_pos(xdr));
 
-        if (!rpcrdma_prepare_send_sges(&r_xprt->rx_ia, req,
-                                       xdr_stream_pos(xdr),
-                                       &rqst->rq_snd_buf, rtype)) {
-                ret = -EIO;
+        ret = rpcrdma_prepare_send_sges(r_xprt, req, xdr_stream_pos(xdr),
+                                        &rqst->rq_snd_buf, rtype);
+        if (ret)
                 goto out_err;
-        }
         return 0;
 
 out_err:
@@ -970,14 +1008,13 @@ rpcrdma_mark_remote_invalidation(struct list_head *mws,
  * straightforward to check the RPC header's direction field.
  */
 static bool
-rpcrdma_is_bcall(struct rpcrdma_xprt *r_xprt, struct rpcrdma_rep *rep,
-                 __be32 xid, __be32 proc)
+rpcrdma_is_bcall(struct rpcrdma_xprt *r_xprt, struct rpcrdma_rep *rep)
 #if defined(CONFIG_SUNRPC_BACKCHANNEL)
 {
         struct xdr_stream *xdr = &rep->rr_stream;
         __be32 *p;
 
-        if (proc != rdma_msg)
+        if (rep->rr_proc != rdma_msg)
                 return false;
 
         /* Peek at stream contents without advancing. */
@@ -992,7 +1029,7 @@ rpcrdma_is_bcall(struct rpcrdma_xprt *r_xprt, struct rpcrdma_rep *rep,
                 return false;
 
         /* RPC header */
-        if (*p++ != xid)
+        if (*p++ != rep->rr_xid)
                 return false;
         if (*p != cpu_to_be32(RPC_CALL))
                 return false;
@@ -1212,105 +1249,170 @@ rpcrdma_decode_error(struct rpcrdma_xprt *r_xprt, struct rpcrdma_rep *rep,
         return -EREMOTEIO;
 }
 
+/* Perform XID lookup, reconstruction of the RPC reply, and
+ * RPC completion while holding the transport lock to ensure
+ * the rep, rqst, and rq_task pointers remain stable.
+ */
+void rpcrdma_complete_rqst(struct rpcrdma_rep *rep)
+{
+        struct rpcrdma_xprt *r_xprt = rep->rr_rxprt;
+        struct rpc_xprt *xprt = &r_xprt->rx_xprt;
+        struct rpc_rqst *rqst = rep->rr_rqst;
+        unsigned long cwnd;
+        int status;
+
+        xprt->reestablish_timeout = 0;
+
+        switch (rep->rr_proc) {
+        case rdma_msg:
+                status = rpcrdma_decode_msg(r_xprt, rep, rqst);
+                break;
+        case rdma_nomsg:
+                status = rpcrdma_decode_nomsg(r_xprt, rep);
+                break;
+        case rdma_error:
+                status = rpcrdma_decode_error(r_xprt, rep, rqst);
+                break;
+        default:
+                status = -EIO;
+        }
+        if (status < 0)
+                goto out_badheader;
+
+out:
+        spin_lock(&xprt->recv_lock);
+        cwnd = xprt->cwnd;
+        xprt->cwnd = r_xprt->rx_buf.rb_credits << RPC_CWNDSHIFT;
+        if (xprt->cwnd > cwnd)
+                xprt_release_rqst_cong(rqst->rq_task);
+
+        xprt_complete_rqst(rqst->rq_task, status);
+        xprt_unpin_rqst(rqst);
+        spin_unlock(&xprt->recv_lock);
+        return;
+
+/* If the incoming reply terminated a pending RPC, the next
+ * RPC call will post a replacement receive buffer as it is
+ * being marshaled.
+ */
+out_badheader:
+        dprintk("RPC: %5u %s: invalid rpcrdma reply (type %u)\n",
+                rqst->rq_task->tk_pid, __func__, be32_to_cpu(rep->rr_proc));
+        r_xprt->rx_stats.bad_reply_count++;
+        status = -EIO;
+        goto out;
+}
+
+void rpcrdma_release_rqst(struct rpcrdma_xprt *r_xprt, struct rpcrdma_req *req)
+{
+        /* Invalidate and unmap the data payloads before waking
+         * the waiting application. This guarantees the memory
+         * regions are properly fenced from the server before the
+         * application accesses the data. It also ensures proper
+         * send flow control: waking the next RPC waits until this
+         * RPC has relinquished all its Send Queue entries.
+         */
+        if (!list_empty(&req->rl_registered))
+                r_xprt->rx_ia.ri_ops->ro_unmap_sync(r_xprt,
+                                                    &req->rl_registered);
+
+        /* Ensure that any DMA mapped pages associated with
+         * the Send of the RPC Call have been unmapped before
+         * allowing the RPC to complete. This protects argument
+         * memory not controlled by the RPC client from being
+         * re-used before we're done with it.
+         */
+        if (test_bit(RPCRDMA_REQ_F_TX_RESOURCES, &req->rl_flags)) {
+                r_xprt->rx_stats.reply_waits_for_send++;
+                out_of_line_wait_on_bit(&req->rl_flags,
+                                        RPCRDMA_REQ_F_TX_RESOURCES,
+                                        bit_wait,
+                                        TASK_UNINTERRUPTIBLE);
+        }
+}
+
+/* Reply handling runs in the poll worker thread. Anything that
+ * might wait is deferred to a separate workqueue.
+ */
+void rpcrdma_deferred_completion(struct work_struct *work)
+{
+        struct rpcrdma_rep *rep =
+                        container_of(work, struct rpcrdma_rep, rr_work);
+        struct rpcrdma_req *req = rpcr_to_rdmar(rep->rr_rqst);
+
+        rpcrdma_mark_remote_invalidation(&req->rl_registered, rep);
+        rpcrdma_release_rqst(rep->rr_rxprt, req);
+        rpcrdma_complete_rqst(rep);
+}
+
 /* Process received RPC/RDMA messages.
  *
  * Errors must result in the RPC task either being awakened, or
  * allowed to timeout, to discover the errors at that time.
  */
-void
-rpcrdma_reply_handler(struct work_struct *work)
+void rpcrdma_reply_handler(struct rpcrdma_rep *rep)
 {
-        struct rpcrdma_rep *rep =
-                        container_of(work, struct rpcrdma_rep, rr_work);
         struct rpcrdma_xprt *r_xprt = rep->rr_rxprt;
         struct rpc_xprt *xprt = &r_xprt->rx_xprt;
-        struct xdr_stream *xdr = &rep->rr_stream;
+        struct rpcrdma_buffer *buf = &r_xprt->rx_buf;
         struct rpcrdma_req *req;
         struct rpc_rqst *rqst;
-        __be32 *p, xid, vers, proc;
-        unsigned long cwnd;
-        int status;
+        u32 credits;
+        __be32 *p;
 
         dprintk("RPC:       %s: incoming rep %p\n", __func__, rep);
 
         if (rep->rr_hdrbuf.head[0].iov_len == 0)
                 goto out_badstatus;
 
-        xdr_init_decode(xdr, &rep->rr_hdrbuf,
+        xdr_init_decode(&rep->rr_stream, &rep->rr_hdrbuf,
                         rep->rr_hdrbuf.head[0].iov_base);
 
         /* Fixed transport header fields */
-        p = xdr_inline_decode(xdr, 4 * sizeof(*p));
+        p = xdr_inline_decode(&rep->rr_stream, 4 * sizeof(*p));
         if (unlikely(!p))
                 goto out_shortreply;
-        xid = *p++;
-        vers = *p++;
-        p++;    /* credits */
-        proc = *p++;
+        rep->rr_xid = *p++;
+        rep->rr_vers = *p++;
+        credits = be32_to_cpu(*p++);
+        rep->rr_proc = *p++;
+
+        if (rep->rr_vers != rpcrdma_version)
+                goto out_badversion;
 
-        if (rpcrdma_is_bcall(r_xprt, rep, xid, proc))
+        if (rpcrdma_is_bcall(r_xprt, rep))
                 return;
 
         /* Match incoming rpcrdma_rep to an rpcrdma_req to
          * get context for handling any incoming chunks.
          */
         spin_lock(&xprt->recv_lock);
-        rqst = xprt_lookup_rqst(xprt, xid);
+        rqst = xprt_lookup_rqst(xprt, rep->rr_xid);
         if (!rqst)
                 goto out_norqst;
         xprt_pin_rqst(rqst);
+
+        if (credits == 0)
+                credits = 1;    /* don't deadlock */
+        else if (credits > buf->rb_max_requests)
+                credits = buf->rb_max_requests;
+        buf->rb_credits = credits;
+
         spin_unlock(&xprt->recv_lock);
+
         req = rpcr_to_rdmar(rqst);
         req->rl_reply = rep;
+        rep->rr_rqst = rqst;
+        clear_bit(RPCRDMA_REQ_F_PENDING, &req->rl_flags);
 
         dprintk("RPC:       %s: reply %p completes request %p (xid 0x%08x)\n",
-                __func__, rep, req, be32_to_cpu(xid));
-
-        /* Invalidate and unmap the data payloads before waking the
-         * waiting application. This guarantees the memory regions
-         * are properly fenced from the server before the application
-         * accesses the data. It also ensures proper send flow control:
-         * waking the next RPC waits until this RPC has relinquished
-         * all its Send Queue entries.
-         */
-        if (!list_empty(&req->rl_registered)) {
-                rpcrdma_mark_remote_invalidation(&req->rl_registered, rep);
-                r_xprt->rx_ia.ri_ops->ro_unmap_sync(r_xprt,
-                                                    &req->rl_registered);
-        }
-
-        xprt->reestablish_timeout = 0;
-        if (vers != rpcrdma_version)
-                goto out_badversion;
+                __func__, rep, req, be32_to_cpu(rep->rr_xid));
 
-        switch (proc) {
-        case rdma_msg:
-                status = rpcrdma_decode_msg(r_xprt, rep, rqst);
-                break;
-        case rdma_nomsg:
-                status = rpcrdma_decode_nomsg(r_xprt, rep);
-                break;
-        case rdma_error:
-                status = rpcrdma_decode_error(r_xprt, rep, rqst);
-                break;
-        default:
-                status = -EIO;
-        }
-        if (status < 0)
-                goto out_badheader;
-
-out:
-        spin_lock(&xprt->recv_lock);
-        cwnd = xprt->cwnd;
-        xprt->cwnd = atomic_read(&r_xprt->rx_buf.rb_credits) << RPC_CWNDSHIFT;
-        if (xprt->cwnd > cwnd)
-                xprt_release_rqst_cong(rqst->rq_task);
-
-        xprt_complete_rqst(rqst->rq_task, status);
-        xprt_unpin_rqst(rqst);
-        spin_unlock(&xprt->recv_lock);
-        dprintk("RPC:       %s: xprt_complete_rqst(0x%p, 0x%p, %d)\n",
-                __func__, xprt, rqst, status);
+        if (list_empty(&req->rl_registered) &&
+            !test_bit(RPCRDMA_REQ_F_TX_RESOURCES, &req->rl_flags))
+                rpcrdma_complete_rqst(rep);
+        else
+                queue_work(rpcrdma_receive_wq, &rep->rr_work);
         return;
 
 out_badstatus:
@@ -1321,37 +1423,22 @@ out_badstatus:
         }
         return;
 
-/* If the incoming reply terminated a pending RPC, the next
- * RPC call will post a replacement receive buffer as it is
- * being marshaled.
- */
 out_badversion:
         dprintk("RPC:       %s: invalid version %d\n",
-                __func__, be32_to_cpu(vers));
-        status = -EIO;
-        r_xprt->rx_stats.bad_reply_count++;
-        goto out;
-
-out_badheader:
-        dprintk("RPC: %5u %s: invalid rpcrdma reply (type %u)\n",
-                rqst->rq_task->tk_pid, __func__, be32_to_cpu(proc));
-        r_xprt->rx_stats.bad_reply_count++;
-        status = -EIO;
-        goto out;
+                __func__, be32_to_cpu(rep->rr_vers));
+        goto repost;
 
-/* The req was still available, but by the time the recv_lock
- * was acquired, the rqst and task had been released. Thus the RPC
- * has already been terminated.
+/* The RPC transaction has already been terminated, or the header
+ * is corrupt.
  */
 out_norqst:
         spin_unlock(&xprt->recv_lock);
         dprintk("RPC:       %s: no match for incoming xid 0x%08x\n",
-                __func__, be32_to_cpu(xid));
+                __func__, be32_to_cpu(rep->rr_xid));
         goto repost;
 
 out_shortreply:
         dprintk("RPC:       %s: short/invalid reply\n", __func__);
-        goto repost;
 
 /* If no pending RPC transaction was matched, post a replacement
  * receive buffer before returning.
diff --git a/net/sunrpc/xprtrdma/svc_rdma_backchannel.c b/net/sunrpc/xprtrdma/svc_rdma_backchannel.c
index 992594b7cc6b..af7893501e40 100644
--- a/net/sunrpc/xprtrdma/svc_rdma_backchannel.c
+++ b/net/sunrpc/xprtrdma/svc_rdma_backchannel.c
@@ -133,6 +133,10 @@ static int svc_rdma_bc_sendto(struct svcxprt_rdma *rdma,
         if (ret)
                 goto out_err;
 
+        /* Bump page refcnt so Send completion doesn't release
+         * the rq_buffer before all retransmits are complete.
+         */
+        get_page(virt_to_page(rqst->rq_buffer));
         ret = svc_rdma_post_send_wr(rdma, ctxt, 1, 0);
         if (ret)
                 goto out_unmap;
@@ -165,7 +169,6 @@ xprt_rdma_bc_allocate(struct rpc_task *task)
                 return -EINVAL;
         }
 
-        /* svc_rdma_sendto releases this page */
         page = alloc_page(RPCRDMA_DEF_GFP);
         if (!page)
                 return -ENOMEM;
@@ -184,6 +187,7 @@ xprt_rdma_bc_free(struct rpc_task *task)
 {
         struct rpc_rqst *rqst = task->tk_rqstp;
 
+        put_page(virt_to_page(rqst->rq_buffer));
         kfree(rqst->rq_rbuffer);
 }
 
diff --git a/net/sunrpc/xprtrdma/svc_rdma_transport.c b/net/sunrpc/xprtrdma/svc_rdma_transport.c
index 5caf8e722a11..46ec069150d5 100644
--- a/net/sunrpc/xprtrdma/svc_rdma_transport.c
+++ b/net/sunrpc/xprtrdma/svc_rdma_transport.c
@@ -290,6 +290,7 @@ static void qp_event_handler(struct ib_event *event, void *context)
                         ib_event_msg(event->event), event->event,
                         event->element.qp);
                 set_bit(XPT_CLOSE, &xprt->xpt_flags);
+                svc_xprt_enqueue(xprt);
                 break;
         }
 }
@@ -322,8 +323,7 @@ static void svc_rdma_wc_receive(struct ib_cq *cq, struct ib_wc *wc)
         set_bit(XPT_DATA, &xprt->sc_xprt.xpt_flags);
         if (test_bit(RDMAXPRT_CONN_PENDING, &xprt->sc_flags))
                 goto out;
-        svc_xprt_enqueue(&xprt->sc_xprt);
-        goto out;
+        goto out_enqueue;
 
 flushed:
         if (wc->status != IB_WC_WR_FLUSH_ERR)
@@ -333,6 +333,8 @@ flushed:
         set_bit(XPT_CLOSE, &xprt->sc_xprt.xpt_flags);
         svc_rdma_put_context(ctxt, 1);
 
+out_enqueue:
+        svc_xprt_enqueue(&xprt->sc_xprt);
 out:
         svc_xprt_put(&xprt->sc_xprt);
 }
@@ -358,6 +360,7 @@ void svc_rdma_wc_send(struct ib_cq *cq, struct ib_wc *wc)
 
         if (unlikely(wc->status != IB_WC_SUCCESS)) {
                 set_bit(XPT_CLOSE, &xprt->sc_xprt.xpt_flags);
+                svc_xprt_enqueue(&xprt->sc_xprt);
                 if (wc->status != IB_WC_WR_FLUSH_ERR)
                         pr_err("svcrdma: Send: %s (%u/0x%x)\n",
                                ib_wc_status_msg(wc->status),
@@ -569,8 +572,10 @@ static int rdma_listen_handler(struct rdma_cm_id *cma_id,
         case RDMA_CM_EVENT_DEVICE_REMOVAL:
                 dprintk("svcrdma: Device removal xprt=%p, cm_id=%p\n",
                         xprt, cma_id);
-                if (xprt)
+                if (xprt) {
                         set_bit(XPT_CLOSE, &xprt->sc_xprt.xpt_flags);
+                        svc_xprt_enqueue(&xprt->sc_xprt);
+                }
                 break;
 
         default:
diff --git a/net/sunrpc/xprtrdma/transport.c b/net/sunrpc/xprtrdma/transport.c
index c84e2b644e13..646c24494ea7 100644
--- a/net/sunrpc/xprtrdma/transport.c
+++ b/net/sunrpc/xprtrdma/transport.c
@@ -1,4 +1,5 @@
 /*
+ * Copyright (c) 2014-2017 Oracle.  All rights reserved.
  * Copyright (c) 2003-2007 Network Appliance, Inc. All rights reserved.
  *
  * This software is available to you under a choice of one of two
@@ -678,16 +679,14 @@ xprt_rdma_free(struct rpc_task *task)
         struct rpc_rqst *rqst = task->tk_rqstp;
         struct rpcrdma_xprt *r_xprt = rpcx_to_rdmax(rqst->rq_xprt);
         struct rpcrdma_req *req = rpcr_to_rdmar(rqst);
-        struct rpcrdma_ia *ia = &r_xprt->rx_ia;
 
-        if (req->rl_backchannel)
+        if (test_bit(RPCRDMA_REQ_F_BACKCHANNEL, &req->rl_flags))
                 return;
 
         dprintk("RPC:       %s: called on 0x%p\n", __func__, req->rl_reply);
 
-        if (!list_empty(&req->rl_registered))
-                ia->ri_ops->ro_unmap_safe(r_xprt, req, !RPC_IS_ASYNC(task));
-        rpcrdma_unmap_sges(ia, req);
+        if (test_bit(RPCRDMA_REQ_F_PENDING, &req->rl_flags))
+                rpcrdma_release_rqst(r_xprt, req);
         rpcrdma_buffer_put(req);
 }
 
@@ -728,7 +727,8 @@ xprt_rdma_send_request(struct rpc_task *task)
 
         /* On retransmit, remove any previously registered chunks */
         if (unlikely(!list_empty(&req->rl_registered)))
-                r_xprt->rx_ia.ri_ops->ro_unmap_safe(r_xprt, req, false);
+                r_xprt->rx_ia.ri_ops->ro_unmap_sync(r_xprt,
+                                                    &req->rl_registered);
 
         rc = rpcrdma_marshal_req(r_xprt, rqst);
         if (rc < 0)
@@ -742,6 +742,7 @@ xprt_rdma_send_request(struct rpc_task *task)
                 goto drop_connection;
         req->rl_connect_cookie = xprt->connect_cookie;
 
+        set_bit(RPCRDMA_REQ_F_PENDING, &req->rl_flags);
         if (rpcrdma_ep_post(&r_xprt->rx_ia, &r_xprt->rx_ep, req))
                 goto drop_connection;
 
@@ -789,11 +790,13 @@ void xprt_rdma_print_stats(struct rpc_xprt *xprt, struct seq_file *seq)
                    r_xprt->rx_stats.failed_marshal_count,
                    r_xprt->rx_stats.bad_reply_count,
                    r_xprt->rx_stats.nomsg_call_count);
-        seq_printf(seq, "%lu %lu %lu %lu\n",
+        seq_printf(seq, "%lu %lu %lu %lu %lu %lu\n",
                    r_xprt->rx_stats.mrs_recovered,
                    r_xprt->rx_stats.mrs_orphaned,
                    r_xprt->rx_stats.mrs_allocated,
-                   r_xprt->rx_stats.local_inv_needed);
+                   r_xprt->rx_stats.local_inv_needed,
+                   r_xprt->rx_stats.empty_sendctx_q,
+                   r_xprt->rx_stats.reply_waits_for_send);
 }
 
 static int
diff --git a/net/sunrpc/xprtrdma/verbs.c b/net/sunrpc/xprtrdma/verbs.c
index 11a1fbf7e59e..710b3f77db82 100644
--- a/net/sunrpc/xprtrdma/verbs.c
+++ b/net/sunrpc/xprtrdma/verbs.c
@@ -1,4 +1,5 @@
 /*
+ * Copyright (c) 2014-2017 Oracle.  All rights reserved.
  * Copyright (c) 2003-2007 Network Appliance, Inc. All rights reserved.
  *
  * This software is available to you under a choice of one of two
@@ -49,9 +50,10 @@
 
 #include <linux/interrupt.h>
 #include <linux/slab.h>
-#include <linux/prefetch.h>
 #include <linux/sunrpc/addr.h>
 #include <linux/sunrpc/svc_rdma.h>
+
+#include <asm-generic/barrier.h>
 #include <asm/bitops.h>
 
 #include <rdma/ib_cm.h>
@@ -73,7 +75,7 @@ static void rpcrdma_create_mrs(struct rpcrdma_xprt *r_xprt);
 static void rpcrdma_destroy_mrs(struct rpcrdma_buffer *buf);
 static void rpcrdma_dma_unmap_regbuf(struct rpcrdma_regbuf *rb);
 
-static struct workqueue_struct *rpcrdma_receive_wq __read_mostly;
+struct workqueue_struct *rpcrdma_receive_wq __read_mostly;
 
 int
 rpcrdma_alloc_wq(void)
@@ -126,30 +128,17 @@ rpcrdma_qp_async_error_upcall(struct ib_event *event, void *context)
 static void
 rpcrdma_wc_send(struct ib_cq *cq, struct ib_wc *wc)
 {
+        struct ib_cqe *cqe = wc->wr_cqe;
+        struct rpcrdma_sendctx *sc =
+                container_of(cqe, struct rpcrdma_sendctx, sc_cqe);
+
         /* WARNING: Only wr_cqe and status are reliable at this point */
         if (wc->status != IB_WC_SUCCESS && wc->status != IB_WC_WR_FLUSH_ERR)
                 pr_err("rpcrdma: Send: %s (%u/0x%x)\n",
                        ib_wc_status_msg(wc->status),
                        wc->status, wc->vendor_err);
-}
-
-/* Perform basic sanity checking to avoid using garbage
- * to update the credit grant value.
- */
-static void
-rpcrdma_update_granted_credits(struct rpcrdma_rep *rep)
-{
-        struct rpcrdma_buffer *buffer = &rep->rr_rxprt->rx_buf;
-        __be32 *p = rep->rr_rdmabuf->rg_base;
-        u32 credits;
 
-        credits = be32_to_cpup(p + 2);
-        if (credits == 0)
-                credits = 1;    /* don't deadlock */
-        else if (credits > buffer->rb_max_requests)
-                credits = buffer->rb_max_requests;
-
-        atomic_set(&buffer->rb_credits, credits);
+        rpcrdma_sendctx_put_locked(sc);
 }
 
 /**
@@ -181,11 +170,8 @@ rpcrdma_wc_receive(struct ib_cq *cq, struct ib_wc *wc)
                                    rdmab_addr(rep->rr_rdmabuf),
                                    wc->byte_len, DMA_FROM_DEVICE);
 
-        if (wc->byte_len >= RPCRDMA_HDRLEN_ERR)
-                rpcrdma_update_granted_credits(rep);
-
 out_schedule:
-        queue_work(rpcrdma_receive_wq, &rep->rr_work);
+        rpcrdma_reply_handler(rep);
         return;
 
 out_fail:
@@ -295,7 +281,7 @@ rpcrdma_conn_upcall(struct rdma_cm_id *id, struct rdma_cm_event *event)
         case RDMA_CM_EVENT_DISCONNECTED:
                 connstate = -ECONNABORTED;
 connected:
-                atomic_set(&xprt->rx_buf.rb_credits, 1);
+                xprt->rx_buf.rb_credits = 1;
                 ep->rep_connected = connstate;
                 rpcrdma_conn_func(ep);
                 wake_up_all(&ep->rep_connect_wait);
@@ -564,16 +550,15 @@ rpcrdma_ep_create(struct rpcrdma_ep *ep, struct rpcrdma_ia *ia,
                 ep->rep_attr.cap.max_recv_sge);
 
         /* set trigger for requesting send completion */
-        ep->rep_cqinit = ep->rep_attr.cap.max_send_wr/2 - 1;
-        if (ep->rep_cqinit <= 2)
-                ep->rep_cqinit = 0;     /* always signal? */
-        rpcrdma_init_cqcount(ep, 0);
+        ep->rep_send_batch = min_t(unsigned int, RPCRDMA_MAX_SEND_BATCH,
+                                   cdata->max_requests >> 2);
+        ep->rep_send_count = ep->rep_send_batch;
         init_waitqueue_head(&ep->rep_connect_wait);
         INIT_DELAYED_WORK(&ep->rep_connect_worker, rpcrdma_connect_worker);
 
         sendcq = ib_alloc_cq(ia->ri_device, NULL,
                              ep->rep_attr.cap.max_send_wr + 1,
-                             0, IB_POLL_SOFTIRQ);
+                             1, IB_POLL_WORKQUEUE);
         if (IS_ERR(sendcq)) {
                 rc = PTR_ERR(sendcq);
                 dprintk("RPC:       %s: failed to create send CQ: %i\n",
@@ -583,7 +568,7 @@ rpcrdma_ep_create(struct rpcrdma_ep *ep, struct rpcrdma_ia *ia,
 
         recvcq = ib_alloc_cq(ia->ri_device, NULL,
                              ep->rep_attr.cap.max_recv_wr + 1,
-                             0, IB_POLL_SOFTIRQ);
+                             0, IB_POLL_WORKQUEUE);
         if (IS_ERR(recvcq)) {
                 rc = PTR_ERR(recvcq);
                 dprintk("RPC:       %s: failed to create recv CQ: %i\n",
@@ -846,6 +831,168 @@ rpcrdma_ep_disconnect(struct rpcrdma_ep *ep, struct rpcrdma_ia *ia)
         ib_drain_qp(ia->ri_id->qp);
 }
 
+/* Fixed-size circular FIFO queue. This implementation is wait-free and
+ * lock-free.
+ *
+ * Consumer is the code path that posts Sends. This path dequeues a
+ * sendctx for use by a Send operation. Multiple consumer threads
+ * are serialized by the RPC transport lock, which allows only one
+ * ->send_request call at a time.
+ *
+ * Producer is the code path that handles Send completions. This path
+ * enqueues a sendctx that has been completed. Multiple producer
+ * threads are serialized by the ib_poll_cq() function.
+ */
+
+/* rpcrdma_sendctxs_destroy() assumes caller has already quiesced
+ * queue activity, and ib_drain_qp has flushed all remaining Send
+ * requests.
+ */
+static void rpcrdma_sendctxs_destroy(struct rpcrdma_buffer *buf)
+{
+        unsigned long i;
+
+        for (i = 0; i <= buf->rb_sc_last; i++)
+                kfree(buf->rb_sc_ctxs[i]);
+        kfree(buf->rb_sc_ctxs);
+}
+
+static struct rpcrdma_sendctx *rpcrdma_sendctx_create(struct rpcrdma_ia *ia)
+{
+        struct rpcrdma_sendctx *sc;
+
+        sc = kzalloc(sizeof(*sc) +
+                     ia->ri_max_send_sges * sizeof(struct ib_sge),
+                     GFP_KERNEL);
+        if (!sc)
+                return NULL;
+
+        sc->sc_wr.wr_cqe = &sc->sc_cqe;
+        sc->sc_wr.sg_list = sc->sc_sges;
+        sc->sc_wr.opcode = IB_WR_SEND;
+        sc->sc_cqe.done = rpcrdma_wc_send;
+        return sc;
+}
+
+static int rpcrdma_sendctxs_create(struct rpcrdma_xprt *r_xprt)
+{
+        struct rpcrdma_buffer *buf = &r_xprt->rx_buf;
+        struct rpcrdma_sendctx *sc;
+        unsigned long i;
+
+        /* Maximum number of concurrent outstanding Send WRs. Capping
+         * the circular queue size stops Send Queue overflow by causing
+         * the ->send_request call to fail temporarily before too many
+         * Sends are posted.
+         */
+        i = buf->rb_max_requests + RPCRDMA_MAX_BC_REQUESTS;
+        dprintk("RPC:       %s: allocating %lu send_ctxs\n", __func__, i);
+        buf->rb_sc_ctxs = kcalloc(i, sizeof(sc), GFP_KERNEL);
+        if (!buf->rb_sc_ctxs)
+                return -ENOMEM;
+
+        buf->rb_sc_last = i - 1;
+        for (i = 0; i <= buf->rb_sc_last; i++) {
+                sc = rpcrdma_sendctx_create(&r_xprt->rx_ia);
+                if (!sc)
+                        goto out_destroy;
+
+                sc->sc_xprt = r_xprt;
+                buf->rb_sc_ctxs[i] = sc;
+        }
+
+        return 0;
+
+out_destroy:
+        rpcrdma_sendctxs_destroy(buf);
+        return -ENOMEM;
+}
+
+/* The sendctx queue is not guaranteed to have a size that is a
+ * power of two, thus the helpers in circ_buf.h cannot be used.
+ * The other option is to use modulus (%), which can be expensive.
+ */
+static unsigned long rpcrdma_sendctx_next(struct rpcrdma_buffer *buf,
+                                          unsigned long item)
+{
+        return likely(item < buf->rb_sc_last) ? item + 1 : 0;
+}
+
+/**
+ * rpcrdma_sendctx_get_locked - Acquire a send context
+ * @buf: transport buffers from which to acquire an unused context
+ *
+ * Returns pointer to a free send completion context; or NULL if
+ * the queue is empty.
+ *
+ * Usage: Called to acquire an SGE array before preparing a Send WR.
+ *
+ * The caller serializes calls to this function (per rpcrdma_buffer),
+ * and provides an effective memory barrier that flushes the new value
+ * of rb_sc_head.
+ */
+struct rpcrdma_sendctx *rpcrdma_sendctx_get_locked(struct rpcrdma_buffer *buf)
+{
+        struct rpcrdma_xprt *r_xprt;
+        struct rpcrdma_sendctx *sc;
+        unsigned long next_head;
+
+        next_head = rpcrdma_sendctx_next(buf, buf->rb_sc_head);
+
+        if (next_head == READ_ONCE(buf->rb_sc_tail))
+                goto out_emptyq;
+
+        /* ORDER: item must be accessed _before_ head is updated */
+        sc = buf->rb_sc_ctxs[next_head];
+
+        /* Releasing the lock in the caller acts as a memory
+         * barrier that flushes rb_sc_head.
+         */
+        buf->rb_sc_head = next_head;
+
+        return sc;
+
+out_emptyq:
+        /* The queue is "empty" if there have not been enough Send
+         * completions recently. This is a sign the Send Queue is
+         * backing up. Cause the caller to pause and try again.
+         */
+        dprintk("RPC:       %s: empty sendctx queue\n", __func__);
+        r_xprt = container_of(buf, struct rpcrdma_xprt, rx_buf);
+        r_xprt->rx_stats.empty_sendctx_q++;
+        return NULL;
+}
+
+/**
+ * rpcrdma_sendctx_put_locked - Release a send context
+ * @sc: send context to release
+ *
+ * Usage: Called from Send completion to return a sendctxt
+ * to the queue.
+ *
+ * The caller serializes calls to this function (per rpcrdma_buffer).
+ */
+void rpcrdma_sendctx_put_locked(struct rpcrdma_sendctx *sc)
+{
+        struct rpcrdma_buffer *buf = &sc->sc_xprt->rx_buf;
+        unsigned long next_tail;
+
+        /* Unmap SGEs of previously completed by unsignaled
+         * Sends by walking up the queue until @sc is found.
+         */
+        next_tail = buf->rb_sc_tail;
+        do {
+                next_tail = rpcrdma_sendctx_next(buf, next_tail);
+
+                /* ORDER: item must be accessed _before_ tail is updated */
+                rpcrdma_unmap_sendctx(buf->rb_sc_ctxs[next_tail]);
+
+        } while (buf->rb_sc_ctxs[next_tail] != sc);
+
+        /* Paired with READ_ONCE */
+        smp_store_release(&buf->rb_sc_tail, next_tail);
+}
+
 static void
 rpcrdma_mr_recovery_worker(struct work_struct *work)
 {
@@ -941,13 +1088,8 @@ rpcrdma_create_req(struct rpcrdma_xprt *r_xprt)
         spin_lock(&buffer->rb_reqslock);
         list_add(&req->rl_all, &buffer->rb_allreqs);
         spin_unlock(&buffer->rb_reqslock);
-        req->rl_cqe.done = rpcrdma_wc_send;
         req->rl_buffer = &r_xprt->rx_buf;
         INIT_LIST_HEAD(&req->rl_registered);
-        req->rl_send_wr.next = NULL;
-        req->rl_send_wr.wr_cqe = &req->rl_cqe;
-        req->rl_send_wr.sg_list = req->rl_send_sge;
-        req->rl_send_wr.opcode = IB_WR_SEND;
         return req;
 }
 
@@ -974,7 +1116,7 @@ rpcrdma_create_rep(struct rpcrdma_xprt *r_xprt)
 
         rep->rr_cqe.done = rpcrdma_wc_receive;
         rep->rr_rxprt = r_xprt;
-        INIT_WORK(&rep->rr_work, rpcrdma_reply_handler);
+        INIT_WORK(&rep->rr_work, rpcrdma_deferred_completion);
         rep->rr_recv_wr.next = NULL;
         rep->rr_recv_wr.wr_cqe = &rep->rr_cqe;
         rep->rr_recv_wr.sg_list = &rep->rr_rdmabuf->rg_iov;
@@ -995,7 +1137,6 @@ rpcrdma_buffer_create(struct rpcrdma_xprt *r_xprt)
 
         buf->rb_max_requests = r_xprt->rx_data.max_requests;
         buf->rb_bc_srv_max_requests = 0;
-        atomic_set(&buf->rb_credits, 1);
         spin_lock_init(&buf->rb_mwlock);
         spin_lock_init(&buf->rb_lock);
         spin_lock_init(&buf->rb_recovery_lock);
@@ -1022,7 +1163,6 @@ rpcrdma_buffer_create(struct rpcrdma_xprt *r_xprt)
                         rc = PTR_ERR(req);
                         goto out;
                 }
-                req->rl_backchannel = false;
                 list_add(&req->rl_list, &buf->rb_send_bufs);
         }
 
@@ -1040,6 +1180,10 @@ rpcrdma_buffer_create(struct rpcrdma_xprt *r_xprt)
                 list_add(&rep->rr_list, &buf->rb_recv_bufs);
         }
 
+        rc = rpcrdma_sendctxs_create(r_xprt);
+        if (rc)
+                goto out;
+
         return 0;
 out:
         rpcrdma_buffer_destroy(buf);
@@ -1116,6 +1260,8 @@ rpcrdma_buffer_destroy(struct rpcrdma_buffer *buf)
         cancel_delayed_work_sync(&buf->rb_recovery_worker);
         cancel_delayed_work_sync(&buf->rb_refresh_worker);
 
+        rpcrdma_sendctxs_destroy(buf);
+
         while (!list_empty(&buf->rb_recv_bufs)) {
                 struct rpcrdma_rep *rep;
 
@@ -1231,7 +1377,6 @@ rpcrdma_buffer_put(struct rpcrdma_req *req)
         struct rpcrdma_buffer *buffers = req->rl_buffer;
         struct rpcrdma_rep *rep = req->rl_reply;
 
-        req->rl_send_wr.num_sge = 0;
         req->rl_reply = NULL;
 
         spin_lock(&buffers->rb_lock);
@@ -1363,7 +1508,7 @@ rpcrdma_ep_post(struct rpcrdma_ia *ia,
                 struct rpcrdma_ep *ep,
                 struct rpcrdma_req *req)
 {
-        struct ib_send_wr *send_wr = &req->rl_send_wr;
+        struct ib_send_wr *send_wr = &req->rl_sendctx->sc_wr;
         struct ib_send_wr *send_wr_fail;
         int rc;
 
@@ -1377,7 +1522,14 @@ rpcrdma_ep_post(struct rpcrdma_ia *ia,
         dprintk("RPC:       %s: posting %d s/g entries\n",
                 __func__, send_wr->num_sge);
 
-        rpcrdma_set_signaled(ep, send_wr);
+        if (!ep->rep_send_count ||
+            test_bit(RPCRDMA_REQ_F_TX_RESOURCES, &req->rl_flags)) {
+                send_wr->send_flags |= IB_SEND_SIGNALED;
+                ep->rep_send_count = ep->rep_send_batch;
+        } else {
+                send_wr->send_flags &= ~IB_SEND_SIGNALED;
+                --ep->rep_send_count;
+        }
         rc = ib_post_send(ia->ri_id->qp, send_wr, &send_wr_fail);
         if (rc)
                 goto out_postsend_err;
diff --git a/net/sunrpc/xprtrdma/xprt_rdma.h b/net/sunrpc/xprtrdma/xprt_rdma.h
index e26a97d2f922..51686d9eac5f 100644
--- a/net/sunrpc/xprtrdma/xprt_rdma.h
+++ b/net/sunrpc/xprtrdma/xprt_rdma.h
@@ -1,4 +1,5 @@
 /*
+ * Copyright (c) 2014-2017 Oracle.  All rights reserved.
  * Copyright (c) 2003-2007 Network Appliance, Inc. All rights reserved.
  *
  * This software is available to you under a choice of one of two
@@ -93,8 +94,8 @@ enum {
  */
 
 struct rpcrdma_ep {
-        atomic_t                rep_cqcount;
-        int                     rep_cqinit;
+        unsigned int            rep_send_count;
+        unsigned int            rep_send_batch;
         int                     rep_connected;
         struct ib_qp_init_attr  rep_attr;
         wait_queue_head_t       rep_connect_wait;
@@ -104,25 +105,6 @@ struct rpcrdma_ep {
         struct delayed_work     rep_connect_worker;
 };
 
-static inline void
-rpcrdma_init_cqcount(struct rpcrdma_ep *ep, int count)
-{
-        atomic_set(&ep->rep_cqcount, ep->rep_cqinit - count);
-}
-
-/* To update send queue accounting, provider must take a
- * send completion every now and then.
- */
-static inline void
-rpcrdma_set_signaled(struct rpcrdma_ep *ep, struct ib_send_wr *send_wr)
-{
-        send_wr->send_flags = 0;
-        if (unlikely(atomic_sub_return(1, &ep->rep_cqcount) <= 0)) {
-                rpcrdma_init_cqcount(ep, 0);
-                send_wr->send_flags = IB_SEND_SIGNALED;
-        }
-}
-
 /* Pre-allocate extra Work Requests for handling backward receives
  * and sends. This is a fixed value because the Work Queues are
  * allocated when the forward channel is set up.
@@ -164,12 +146,6 @@ rdmab_lkey(struct rpcrdma_regbuf *rb)
         return rb->rg_iov.lkey;
 }
 
-static inline struct rpcrdma_msg *
-rdmab_to_msg(struct rpcrdma_regbuf *rb)
-{
-        return (struct rpcrdma_msg *)rb->rg_base;
-}
-
 static inline struct ib_device *
 rdmab_device(struct rpcrdma_regbuf *rb)
 {
@@ -202,22 +178,24 @@ enum {
 };
 
 /*
- * struct rpcrdma_rep -- this structure encapsulates state required to recv
- * and complete a reply, asychronously. It needs several pieces of
- * state:
- *   o recv buffer (posted to provider)
- *   o ib_sge (also donated to provider)
- *   o status of reply (length, success or not)
- *   o bookkeeping state to get run by reply handler (list, etc)
+ * struct rpcrdma_rep -- this structure encapsulates state required
+ * to receive and complete an RPC Reply, asychronously. It needs
+ * several pieces of state:
  *
- * These are allocated during initialization, per-transport instance.
+ *   o receive buffer and ib_sge (donated to provider)
+ *   o status of receive (success or not, length, inv rkey)
+ *   o bookkeeping state to get run by reply handler (XDR stream)
  *
- * N of these are associated with a transport instance, and stored in
- * struct rpcrdma_buffer. N is the max number of outstanding requests.
+ * These structures are allocated during transport initialization.
+ * N of these are associated with a transport instance, managed by
+ * struct rpcrdma_buffer. N is the max number of outstanding RPCs.
  */
 
 struct rpcrdma_rep {
         struct ib_cqe           rr_cqe;
+        __be32                  rr_xid;
+        __be32                  rr_vers;
+        __be32                  rr_proc;
         int                     rr_wc_flags;
         u32                     rr_inv_rkey;
         struct rpcrdma_regbuf   *rr_rdmabuf;
@@ -225,10 +203,34 @@ struct rpcrdma_rep {
         struct work_struct      rr_work;
         struct xdr_buf          rr_hdrbuf;
         struct xdr_stream       rr_stream;
+        struct rpc_rqst         *rr_rqst;
         struct list_head        rr_list;
         struct ib_recv_wr       rr_recv_wr;
 };
 
+/* struct rpcrdma_sendctx - DMA mapped SGEs to unmap after Send completes
+ */
+struct rpcrdma_req;
+struct rpcrdma_xprt;
+struct rpcrdma_sendctx {
+        struct ib_send_wr       sc_wr;
+        struct ib_cqe           sc_cqe;
+        struct rpcrdma_xprt     *sc_xprt;
+        struct rpcrdma_req      *sc_req;
+        unsigned int            sc_unmap_count;
+        struct ib_sge           sc_sges[];
+};
+
+/* Limit the number of SGEs that can be unmapped during one
+ * Send completion. This caps the amount of work a single
+ * completion can do before returning to the provider.
+ *
+ * Setting this to zero disables Send completion batching.
+ */
+enum {
+        RPCRDMA_MAX_SEND_BATCH = 7,
+};
+
 /*
  * struct rpcrdma_mw - external memory region metadata
  *
@@ -340,26 +342,30 @@ enum {
 struct rpcrdma_buffer;
 struct rpcrdma_req {
         struct list_head        rl_list;
-        unsigned int            rl_mapped_sges;
         unsigned int            rl_connect_cookie;
         struct rpcrdma_buffer   *rl_buffer;
         struct rpcrdma_rep      *rl_reply;
         struct xdr_stream       rl_stream;
         struct xdr_buf          rl_hdrbuf;
-        struct ib_send_wr       rl_send_wr;
-        struct ib_sge           rl_send_sge[RPCRDMA_MAX_SEND_SGES];
+        struct rpcrdma_sendctx  *rl_sendctx;
         struct rpcrdma_regbuf   *rl_rdmabuf;    /* xprt header */
         struct rpcrdma_regbuf   *rl_sendbuf;    /* rq_snd_buf */
         struct rpcrdma_regbuf   *rl_recvbuf;    /* rq_rcv_buf */
 
-        struct ib_cqe           rl_cqe;
         struct list_head        rl_all;
-        bool                    rl_backchannel;
+        unsigned long           rl_flags;
 
         struct list_head        rl_registered;  /* registered segments */
         struct rpcrdma_mr_seg   rl_segments[RPCRDMA_MAX_SEGS];
 };
 
+/* rl_flags */
+enum {
+        RPCRDMA_REQ_F_BACKCHANNEL = 0,
+        RPCRDMA_REQ_F_PENDING,
+        RPCRDMA_REQ_F_TX_RESOURCES,
+};
+
 static inline void
 rpcrdma_set_xprtdata(struct rpc_rqst *rqst, struct rpcrdma_req *req)
 {
@@ -399,12 +405,17 @@ struct rpcrdma_buffer {
         struct list_head        rb_mws;
         struct list_head        rb_all;
 
+        unsigned long           rb_sc_head;
+        unsigned long           rb_sc_tail;
+        unsigned long           rb_sc_last;
+        struct rpcrdma_sendctx  **rb_sc_ctxs;
+
         spinlock_t              rb_lock;        /* protect buf lists */
         int                     rb_send_count, rb_recv_count;
         struct list_head        rb_send_bufs;
         struct list_head        rb_recv_bufs;
         u32                     rb_max_requests;
-        atomic_t                rb_credits;     /* most recent credit grant */
+        u32                     rb_credits;     /* most recent credit grant */
 
         u32                     rb_bc_srv_max_requests;
         spinlock_t              rb_reqslock;    /* protect rb_allreqs */
@@ -453,10 +464,12 @@ struct rpcrdma_stats {
         unsigned long           mrs_recovered;
         unsigned long           mrs_orphaned;
         unsigned long           mrs_allocated;
+        unsigned long           empty_sendctx_q;
 
         /* accessed when receiving a reply */
         unsigned long long      total_rdma_reply;
         unsigned long long      fixup_copy_count;
+        unsigned long           reply_waits_for_send;
         unsigned long           local_inv_needed;
         unsigned long           nomsg_call_count;
         unsigned long           bcall_count;
@@ -473,8 +486,6 @@ struct rpcrdma_memreg_ops {
                                   struct rpcrdma_mw **);
         void            (*ro_unmap_sync)(struct rpcrdma_xprt *,
                                          struct list_head *);
-        void            (*ro_unmap_safe)(struct rpcrdma_xprt *,
-                                         struct rpcrdma_req *, bool);
         void            (*ro_recover_mr)(struct rpcrdma_mw *);
         int             (*ro_open)(struct rpcrdma_ia *,
                                    struct rpcrdma_ep *,
@@ -532,6 +543,8 @@ void rpcrdma_ia_close(struct rpcrdma_ia *);
 bool frwr_is_supported(struct rpcrdma_ia *);
 bool fmr_is_supported(struct rpcrdma_ia *);
 
+extern struct workqueue_struct *rpcrdma_receive_wq;
+
 /*
  * Endpoint calls - xprtrdma/verbs.c
  */
@@ -554,6 +567,8 @@ struct rpcrdma_rep *rpcrdma_create_rep(struct rpcrdma_xprt *);
 void rpcrdma_destroy_req(struct rpcrdma_req *);
 int rpcrdma_buffer_create(struct rpcrdma_xprt *);
 void rpcrdma_buffer_destroy(struct rpcrdma_buffer *);
+struct rpcrdma_sendctx *rpcrdma_sendctx_get_locked(struct rpcrdma_buffer *buf);
+void rpcrdma_sendctx_put_locked(struct rpcrdma_sendctx *sc);
 
 struct rpcrdma_mw *rpcrdma_get_mw(struct rpcrdma_xprt *);
 void rpcrdma_put_mw(struct rpcrdma_xprt *, struct rpcrdma_mw *);
@@ -610,12 +625,18 @@ enum rpcrdma_chunktype {
         rpcrdma_replych
 };
 
-bool rpcrdma_prepare_send_sges(struct rpcrdma_ia *, struct rpcrdma_req *,
-                               u32, struct xdr_buf *, enum rpcrdma_chunktype);
-void rpcrdma_unmap_sges(struct rpcrdma_ia *, struct rpcrdma_req *);
+int rpcrdma_prepare_send_sges(struct rpcrdma_xprt *r_xprt,
+                              struct rpcrdma_req *req, u32 hdrlen,
+                              struct xdr_buf *xdr,
+                              enum rpcrdma_chunktype rtype);
+void rpcrdma_unmap_sendctx(struct rpcrdma_sendctx *sc);
 int rpcrdma_marshal_req(struct rpcrdma_xprt *r_xprt, struct rpc_rqst *rqst);
 void rpcrdma_set_max_header_sizes(struct rpcrdma_xprt *);
-void rpcrdma_reply_handler(struct work_struct *work);
+void rpcrdma_complete_rqst(struct rpcrdma_rep *rep);
+void rpcrdma_reply_handler(struct rpcrdma_rep *rep);
+void rpcrdma_release_rqst(struct rpcrdma_xprt *r_xprt,
+                          struct rpcrdma_req *req);
+void rpcrdma_deferred_completion(struct work_struct *work);
 
 static inline void rpcrdma_set_xdrlen(struct xdr_buf *xdr, size_t len)
 {
diff --git a/net/sunrpc/xprtsock.c b/net/sunrpc/xprtsock.c
index 4dad5da388d6..9cc850c2719e 100644
--- a/net/sunrpc/xprtsock.c
+++ b/net/sunrpc/xprtsock.c
@@ -552,6 +552,7 @@ static int xs_local_send_request(struct rpc_task *task)
         default:
                 dprintk("RPC:       sendmsg returned unrecognized error %d\n",
                         -status);
+                /* fall through */
         case -EPIPE:
                 xs_close(xprt);
                 status = -ENOTCONN;
@@ -1611,6 +1612,7 @@ static void xs_tcp_state_change(struct sock *sk)
                 xprt->connect_cookie++;
                 clear_bit(XPRT_CONNECTED, &xprt->state);
                 xs_tcp_force_close(xprt);
+                /* fall through */
         case TCP_CLOSING:
                 /*
                  * If the server closed down the connection, make sure that
@@ -2368,6 +2370,7 @@ static int xs_tcp_finish_connecting(struct rpc_xprt *xprt, struct socket *sock)
         switch (ret) {
         case 0:
                 xs_set_srcport(transport, sock);
+                /* fall through */
         case -EINPROGRESS:
                 /* SYN_SENT! */
                 if (xprt->reestablish_timeout < XS_TCP_INIT_REEST_TO)
@@ -2419,6 +2422,7 @@ static void xs_tcp_setup_socket(struct work_struct *work)
         default:
                 printk("%s: connect returned unhandled error %d\n",
                         __func__, status);
+                /* fall through */
         case -EADDRNOTAVAIL:
                 /* We're probably in TIME_WAIT. Get rid of existing socket,
                  * and retry
diff --git a/net/switchdev/switchdev.c b/net/switchdev/switchdev.c
index 0531b41d1f2d..74b9d916a58b 100644
--- a/net/switchdev/switchdev.c
+++ b/net/switchdev/switchdev.c
@@ -345,6 +345,8 @@ static size_t switchdev_obj_size(const struct switchdev_obj *obj)
                 return sizeof(struct switchdev_obj_port_vlan);
         case SWITCHDEV_OBJ_ID_PORT_MDB:
                 return sizeof(struct switchdev_obj_port_mdb);
+        case SWITCHDEV_OBJ_ID_HOST_MDB:
+                return sizeof(struct switchdev_obj_port_mdb);
         default:
                 BUG();
         }
diff --git a/net/tipc/Makefile b/net/tipc/Makefile
index 2bfaa9d4b403..37bb0bfbd936 100644
--- a/net/tipc/Makefile
+++ b/net/tipc/Makefile
@@ -9,7 +9,7 @@ tipc-y	+= addr.o bcast.o bearer.o \
            core.o link.o discover.o msg.o  \
            name_distr.o  subscr.o monitor.o name_table.o net.o  \
            netlink.o netlink_compat.o node.o socket.o eth_media.o \
-           server.o socket.o
+           server.o socket.o group.o
 
 tipc-$(CONFIG_TIPC_MEDIA_UDP)   += udp_media.o
 tipc-$(CONFIG_TIPC_MEDIA_IB)    += ib_media.o
diff --git a/net/tipc/bcast.c b/net/tipc/bcast.c
index a140dd4a84af..329325bd553e 100644
--- a/net/tipc/bcast.c
+++ b/net/tipc/bcast.c
@@ -258,20 +258,20 @@ static int tipc_bcast_xmit(struct net *net, struct sk_buff_head *pkts,
 static int tipc_rcast_xmit(struct net *net, struct sk_buff_head *pkts,
                            struct tipc_nlist *dests, u16 *cong_link_cnt)
 {
+        struct tipc_dest *dst, *tmp;
         struct sk_buff_head _pkts;
-        struct u32_item *n, *tmp;
-        u32 dst, selector;
+        u32 dnode, selector;
 
         selector = msg_link_selector(buf_msg(skb_peek(pkts)));
         skb_queue_head_init(&_pkts);
 
-        list_for_each_entry_safe(n, tmp, &dests->list, list) {
-                dst = n->value;
-                if (!tipc_msg_pskb_copy(dst, pkts, &_pkts))
+        list_for_each_entry_safe(dst, tmp, &dests->list, list) {
+                dnode = dst->node;
+                if (!tipc_msg_pskb_copy(dnode, pkts, &_pkts))
                         return -ENOMEM;
 
                 /* Any other return value than -ELINKCONG is ignored */
-                if (tipc_node_xmit(net, &_pkts, dst, selector) == -ELINKCONG)
+                if (tipc_node_xmit(net, &_pkts, dnode, selector) == -ELINKCONG)
                         (*cong_link_cnt)++;
         }
         return 0;
@@ -554,7 +554,7 @@ void tipc_nlist_add(struct tipc_nlist *nl, u32 node)
 {
         if (node == nl->self)
                 nl->local = true;
-        else if (u32_push(&nl->list, node))
+        else if (tipc_dest_push(&nl->list, node, 0))
                 nl->remote++;
 }
 
@@ -562,13 +562,13 @@ void tipc_nlist_del(struct tipc_nlist *nl, u32 node)
 {
         if (node == nl->self)
                 nl->local = false;
-        else if (u32_del(&nl->list, node))
+        else if (tipc_dest_del(&nl->list, node, 0))
                 nl->remote--;
 }
 
 void tipc_nlist_purge(struct tipc_nlist *nl)
 {
-        u32_list_purge(&nl->list);
+        tipc_dest_list_purge(&nl->list);
         nl->remote = 0;
         nl->local = 0;
 }
diff --git a/net/tipc/core.h b/net/tipc/core.h
index 5cc5398be722..964342689f2c 100644
--- a/net/tipc/core.h
+++ b/net/tipc/core.h
@@ -132,6 +132,11 @@ static inline struct list_head *tipc_nodes(struct net *net)
         return &tipc_net(net)->node_list;
 }
 
+static inline struct tipc_server *tipc_topsrv(struct net *net)
+{
+        return tipc_net(net)->topsrv;
+}
+
 static inline unsigned int tipc_hashfn(u32 addr)
 {
         return addr & (NODE_HTABLE_SIZE - 1);
diff --git a/net/tipc/discover.c b/net/tipc/discover.c
index 02462d67d191..92e4828c6b09 100644
--- a/net/tipc/discover.c
+++ b/net/tipc/discover.c
@@ -224,9 +224,9 @@ void tipc_disc_remove_dest(struct tipc_link_req *req)
  *
  * Called whenever a link setup request timer associated with a bearer expires.
  */
-static void disc_timeout(unsigned long data)
+static void disc_timeout(struct timer_list *t)
 {
-        struct tipc_link_req *req = (struct tipc_link_req *)data;
+        struct tipc_link_req *req = from_timer(req, t, timer);
         struct sk_buff *skb;
         int max_delay;
 
@@ -292,7 +292,7 @@ int tipc_disc_create(struct net *net, struct tipc_bearer *b,
         req->num_nodes = 0;
         req->timer_intv = TIPC_LINK_REQ_INIT;
         spin_lock_init(&req->lock);
-        setup_timer(&req->timer, disc_timeout, (unsigned long)req);
+        timer_setup(&req->timer, disc_timeout, 0);
         mod_timer(&req->timer, jiffies + req->timer_intv);
         b->link_req = req;
         *skb = skb_clone(req->buf, GFP_ATOMIC);
diff --git a/net/tipc/group.c b/net/tipc/group.c
new file mode 100644
index 000000000000..12777cac638a
--- /dev/null
+++ b/net/tipc/group.c
@@ -0,0 +1,871 @@
+/*
+ * net/tipc/group.c: TIPC group messaging code
+ *
+ * Copyright (c) 2017, Ericsson AB
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. Neither the names of the copyright holders nor the names of its
+ *    contributors may be used to endorse or promote products derived from
+ *    this software without specific prior written permission.
+ *
+ * Alternatively, this software may be distributed under the terms of the
+ * GNU General Public License ("GPL") version 2 as published by the Free
+ * Software Foundation.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE
+ * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "core.h"
+#include "addr.h"
+#include "group.h"
+#include "bcast.h"
+#include "server.h"
+#include "msg.h"
+#include "socket.h"
+#include "node.h"
+#include "name_table.h"
+#include "subscr.h"
+
+#define ADV_UNIT (((MAX_MSG_SIZE + MAX_H_SIZE) / FLOWCTL_BLK_SZ) + 1)
+#define ADV_IDLE ADV_UNIT
+#define ADV_ACTIVE (ADV_UNIT * 12)
+
+enum mbr_state {
+        MBR_QUARANTINED,
+        MBR_DISCOVERED,
+        MBR_JOINING,
+        MBR_PUBLISHED,
+        MBR_JOINED,
+        MBR_PENDING,
+        MBR_ACTIVE,
+        MBR_RECLAIMING,
+        MBR_REMITTED,
+        MBR_LEAVING
+};
+
+struct tipc_member {
+        struct rb_node tree_node;
+        struct list_head list;
+        struct list_head congested;
+        struct sk_buff *event_msg;
+        struct sk_buff_head deferredq;
+        struct tipc_group *group;
+        u32 node;
+        u32 port;
+        u32 instance;
+        enum mbr_state state;
+        u16 advertised;
+        u16 window;
+        u16 bc_rcv_nxt;
+        u16 bc_syncpt;
+        u16 bc_acked;
+        bool usr_pending;
+};
+
+struct tipc_group {
+        struct rb_root members;
+        struct list_head congested;
+        struct list_head pending;
+        struct list_head active;
+        struct list_head reclaiming;
+        struct tipc_nlist dests;
+        struct net *net;
+        int subid;
+        u32 type;
+        u32 instance;
+        u32 domain;
+        u32 scope;
+        u32 portid;
+        u16 member_cnt;
+        u16 active_cnt;
+        u16 max_active;
+        u16 bc_snd_nxt;
+        u16 bc_ackers;
+        bool loopback;
+        bool events;
+};
+
+static void tipc_group_proto_xmit(struct tipc_group *grp, struct tipc_member *m,
+                                  int mtyp, struct sk_buff_head *xmitq);
+
+static void tipc_group_decr_active(struct tipc_group *grp,
+                                   struct tipc_member *m)
+{
+        if (m->state == MBR_ACTIVE || m->state == MBR_RECLAIMING)
+                grp->active_cnt--;
+}
+
+static int tipc_group_rcvbuf_limit(struct tipc_group *grp)
+{
+        int max_active, active_pool, idle_pool;
+        int mcnt = grp->member_cnt + 1;
+
+        /* Limit simultaneous reception from other members */
+        max_active = min(mcnt / 8, 64);
+        max_active = max(max_active, 16);
+        grp->max_active = max_active;
+
+        /* Reserve blocks for active and idle members */
+        active_pool = max_active * ADV_ACTIVE;
+        idle_pool = (mcnt - max_active) * ADV_IDLE;
+
+        /* Scale to bytes, considering worst-case truesize/msgsize ratio */
+        return (active_pool + idle_pool) * FLOWCTL_BLK_SZ * 4;
+}
+
+u16 tipc_group_bc_snd_nxt(struct tipc_group *grp)
+{
+        return grp->bc_snd_nxt;
+}
+
+static bool tipc_group_is_enabled(struct tipc_member *m)
+{
+        return m->state != MBR_QUARANTINED && m->state != MBR_LEAVING;
+}
+
+static bool tipc_group_is_receiver(struct tipc_member *m)
+{
+        return m && m->state >= MBR_JOINED;
+}
+
+u32 tipc_group_exclude(struct tipc_group *grp)
+{
+        if (!grp->loopback)
+                return grp->portid;
+        return 0;
+}
+
+int tipc_group_size(struct tipc_group *grp)
+{
+        return grp->member_cnt;
+}
+
+struct tipc_group *tipc_group_create(struct net *net, u32 portid,
+                                     struct tipc_group_req *mreq)
+{
+        struct tipc_group *grp;
+        u32 type = mreq->type;
+
+        grp = kzalloc(sizeof(*grp), GFP_ATOMIC);
+        if (!grp)
+                return NULL;
+        tipc_nlist_init(&grp->dests, tipc_own_addr(net));
+        INIT_LIST_HEAD(&grp->congested);
+        INIT_LIST_HEAD(&grp->active);
+        INIT_LIST_HEAD(&grp->pending);
+        INIT_LIST_HEAD(&grp->reclaiming);
+        grp->members = RB_ROOT;
+        grp->net = net;
+        grp->portid = portid;
+        grp->domain = addr_domain(net, mreq->scope);
+        grp->type = type;
+        grp->instance = mreq->instance;
+        grp->scope = mreq->scope;
+        grp->loopback = mreq->flags & TIPC_GROUP_LOOPBACK;
+        grp->events = mreq->flags & TIPC_GROUP_MEMBER_EVTS;
+        if (tipc_topsrv_kern_subscr(net, portid, type, 0, ~0, &grp->subid))
+                return grp;
+        kfree(grp);
+        return NULL;
+}
+
+void tipc_group_delete(struct net *net, struct tipc_group *grp)
+{
+        struct rb_root *tree = &grp->members;
+        struct tipc_member *m, *tmp;
+        struct sk_buff_head xmitq;
+
+        __skb_queue_head_init(&xmitq);
+
+        rbtree_postorder_for_each_entry_safe(m, tmp, tree, tree_node) {
+                tipc_group_proto_xmit(grp, m, GRP_LEAVE_MSG, &xmitq);
+                list_del(&m->list);
+                kfree(m);
+        }
+        tipc_node_distr_xmit(net, &xmitq);
+        tipc_nlist_purge(&grp->dests);
+        tipc_topsrv_kern_unsubscr(net, grp->subid);
+        kfree(grp);
+}
+
+struct tipc_member *tipc_group_find_member(struct tipc_group *grp,
+                                           u32 node, u32 port)
+{
+        struct rb_node *n = grp->members.rb_node;
+        u64 nkey, key = (u64)node << 32 | port;
+        struct tipc_member *m;
+
+        while (n) {
+                m = container_of(n, struct tipc_member, tree_node);
+                nkey = (u64)m->node << 32 | m->port;
+                if (key < nkey)
+                        n = n->rb_left;
+                else if (key > nkey)
+                        n = n->rb_right;
+                else
+                        return m;
+        }
+        return NULL;
+}
+
+static struct tipc_member *tipc_group_find_dest(struct tipc_group *grp,
+                                                u32 node, u32 port)
+{
+        struct tipc_member *m;
+
+        m = tipc_group_find_member(grp, node, port);
+        if (m && tipc_group_is_enabled(m))
+                return m;
+        return NULL;
+}
+
+static struct tipc_member *tipc_group_find_node(struct tipc_group *grp,
+                                                u32 node)
+{
+        struct tipc_member *m;
+        struct rb_node *n;
+
+        for (n = rb_first(&grp->members); n; n = rb_next(n)) {
+                m = container_of(n, struct tipc_member, tree_node);
+                if (m->node == node)
+                        return m;
+        }
+        return NULL;
+}
+
+static void tipc_group_add_to_tree(struct tipc_group *grp,
+                                   struct tipc_member *m)
+{
+        u64 nkey, key = (u64)m->node << 32 | m->port;
+        struct rb_node **n, *parent = NULL;
+        struct tipc_member *tmp;
+
+        n = &grp->members.rb_node;
+        while (*n) {
+                tmp = container_of(*n, struct tipc_member, tree_node);
+                parent = *n;
+                tmp = container_of(parent, struct tipc_member, tree_node);
+                nkey = (u64)tmp->node << 32 | tmp->port;
+                if (key < nkey)
+                        n = &(*n)->rb_left;
+                else if (key > nkey)
+                        n = &(*n)->rb_right;
+                else
+                        return;
+        }
+        rb_link_node(&m->tree_node, parent, n);
+        rb_insert_color(&m->tree_node, &grp->members);
+}
+
+static struct tipc_member *tipc_group_create_member(struct tipc_group *grp,
+                                                    u32 node, u32 port,
+                                                    int state)
+{
+        struct tipc_member *m;
+
+        m = kzalloc(sizeof(*m), GFP_ATOMIC);
+        if (!m)
+                return NULL;
+        INIT_LIST_HEAD(&m->list);
+        INIT_LIST_HEAD(&m->congested);
+        __skb_queue_head_init(&m->deferredq);
+        m->group = grp;
+        m->node = node;
+        m->port = port;
+        m->bc_acked = grp->bc_snd_nxt - 1;
+        grp->member_cnt++;
+        tipc_group_add_to_tree(grp, m);
+        tipc_nlist_add(&grp->dests, m->node);
+        m->state = state;
+        return m;
+}
+
+void tipc_group_add_member(struct tipc_group *grp, u32 node, u32 port)
+{
+        tipc_group_create_member(grp, node, port, MBR_DISCOVERED);
+}
+
+static void tipc_group_delete_member(struct tipc_group *grp,
+                                     struct tipc_member *m)
+{
+        rb_erase(&m->tree_node, &grp->members);
+        grp->member_cnt--;
+
+        /* Check if we were waiting for replicast ack from this member */
+        if (grp->bc_ackers && less(m->bc_acked, grp->bc_snd_nxt - 1))
+                grp->bc_ackers--;
+
+        list_del_init(&m->list);
+        list_del_init(&m->congested);
+        tipc_group_decr_active(grp, m);
+
+        /* If last member on a node, remove node from dest list */
+        if (!tipc_group_find_node(grp, m->node))
+                tipc_nlist_del(&grp->dests, m->node);
+
+        kfree(m);
+}
+
+struct tipc_nlist *tipc_group_dests(struct tipc_group *grp)
+{
+        return &grp->dests;
+}
+
+void tipc_group_self(struct tipc_group *grp, struct tipc_name_seq *seq,
+                     int *scope)
+{
+        seq->type = grp->type;
+        seq->lower = grp->instance;
+        seq->upper = grp->instance;
+        *scope = grp->scope;
+}
+
+void tipc_group_update_member(struct tipc_member *m, int len)
+{
+        struct tipc_group *grp = m->group;
+        struct tipc_member *_m, *tmp;
+
+        if (!tipc_group_is_enabled(m))
+                return;
+
+        m->window -= len;
+
+        if (m->window >= ADV_IDLE)
+                return;
+
+        if (!list_empty(&m->congested))
+                return;
+
+        /* Sort member into congested members' list */
+        list_for_each_entry_safe(_m, tmp, &grp->congested, congested) {
+                if (m->window > _m->window)
+                        continue;
+                list_add_tail(&m->congested, &_m->congested);
+                return;
+        }
+        list_add_tail(&m->congested, &grp->congested);
+}
+
+void tipc_group_update_bc_members(struct tipc_group *grp, int len, bool ack)
+{
+        u16 prev = grp->bc_snd_nxt - 1;
+        struct tipc_member *m;
+        struct rb_node *n;
+
+        for (n = rb_first(&grp->members); n; n = rb_next(n)) {
+                m = container_of(n, struct tipc_member, tree_node);
+                if (tipc_group_is_enabled(m)) {
+                        tipc_group_update_member(m, len);
+                        m->bc_acked = prev;
+                }
+        }
+
+        /* Mark number of acknowledges to expect, if any */
+        if (ack)
+                grp->bc_ackers = grp->member_cnt;
+        grp->bc_snd_nxt++;
+}
+
+bool tipc_group_cong(struct tipc_group *grp, u32 dnode, u32 dport,
+                     int len, struct tipc_member **mbr)
+{
+        struct sk_buff_head xmitq;
+        struct tipc_member *m;
+        int adv, state;
+
+        m = tipc_group_find_dest(grp, dnode, dport);
+        *mbr = m;
+        if (!m)
+                return false;
+        if (m->usr_pending)
+                return true;
+        if (m->window >= len)
+                return false;
+        m->usr_pending = true;
+
+        /* If not fully advertised, do it now to prevent mutual blocking */
+        adv = m->advertised;
+        state = m->state;
+        if (state < MBR_JOINED)
+                return true;
+        if (state == MBR_JOINED && adv == ADV_IDLE)
+                return true;
+        if (state == MBR_ACTIVE && adv == ADV_ACTIVE)
+                return true;
+        if (state == MBR_PENDING && adv == ADV_IDLE)
+                return true;
+        skb_queue_head_init(&xmitq);
+        tipc_group_proto_xmit(grp, m, GRP_ADV_MSG, &xmitq);
+        tipc_node_distr_xmit(grp->net, &xmitq);
+        return true;
+}
+
+bool tipc_group_bc_cong(struct tipc_group *grp, int len)
+{
+        struct tipc_member *m = NULL;
+
+        /* If prev bcast was replicast, reject until all receivers have acked */
+        if (grp->bc_ackers)
+                return true;
+
+        if (list_empty(&grp->congested))
+                return false;
+
+        m = list_first_entry(&grp->congested, struct tipc_member, congested);
+        if (m->window >= len)
+                return false;
+
+        return tipc_group_cong(grp, m->node, m->port, len, &m);
+}
+
+/* tipc_group_sort_msg() - sort msg into queue by bcast sequence number
+ */
+static void tipc_group_sort_msg(struct sk_buff *skb, struct sk_buff_head *defq)
+{
+        struct tipc_msg *_hdr, *hdr = buf_msg(skb);
+        u16 bc_seqno = msg_grp_bc_seqno(hdr);
+        struct sk_buff *_skb, *tmp;
+        int mtyp = msg_type(hdr);
+
+        /* Bcast/mcast may be bypassed by ucast or other bcast, - sort it in */
+        if (mtyp == TIPC_GRP_BCAST_MSG || mtyp == TIPC_GRP_MCAST_MSG) {
+                skb_queue_walk_safe(defq, _skb, tmp) {
+                        _hdr = buf_msg(_skb);
+                        if (!less(bc_seqno, msg_grp_bc_seqno(_hdr)))
+                                continue;
+                        __skb_queue_before(defq, _skb, skb);
+                        return;
+                }
+                /* Bcast was not bypassed, - add to tail */
+        }
+        /* Unicasts are never bypassed, - always add to tail */
+        __skb_queue_tail(defq, skb);
+}
+
+/* tipc_group_filter_msg() - determine if we should accept arriving message
+ */
+void tipc_group_filter_msg(struct tipc_group *grp, struct sk_buff_head *inputq,
+                           struct sk_buff_head *xmitq)
+{
+        struct sk_buff *skb = __skb_dequeue(inputq);
+        bool ack, deliver, update, leave = false;
+        struct sk_buff_head *defq;
+        struct tipc_member *m;
+        struct tipc_msg *hdr;
+        u32 node, port;
+        int mtyp, blks;
+
+        if (!skb)
+                return;
+
+        hdr = buf_msg(skb);
+        node =  msg_orignode(hdr);
+        port = msg_origport(hdr);
+
+        if (!msg_in_group(hdr))
+                goto drop;
+
+        m = tipc_group_find_member(grp, node, port);
+        if (!tipc_group_is_receiver(m))
+                goto drop;
+
+        if (less(msg_grp_bc_seqno(hdr), m->bc_rcv_nxt))
+                goto drop;
+
+        TIPC_SKB_CB(skb)->orig_member = m->instance;
+        defq = &m->deferredq;
+        tipc_group_sort_msg(skb, defq);
+
+        while ((skb = skb_peek(defq))) {
+                hdr = buf_msg(skb);
+                mtyp = msg_type(hdr);
+                deliver = true;
+                ack = false;
+                update = false;
+
+                if (more(msg_grp_bc_seqno(hdr), m->bc_rcv_nxt))
+                        break;
+
+                /* Decide what to do with message */
+                switch (mtyp) {
+                case TIPC_GRP_MCAST_MSG:
+                        if (msg_nameinst(hdr) != grp->instance) {
+                                update = true;
+                                deliver = false;
+                        }
+                        /* Fall thru */
+                case TIPC_GRP_BCAST_MSG:
+                        m->bc_rcv_nxt++;
+                        ack = msg_grp_bc_ack_req(hdr);
+                        break;
+                case TIPC_GRP_UCAST_MSG:
+                        break;
+                case TIPC_GRP_MEMBER_EVT:
+                        if (m->state == MBR_LEAVING)
+                                leave = true;
+                        if (!grp->events)
+                                deliver = false;
+                        break;
+                default:
+                        break;
+                }
+
+                /* Execute decisions */
+                __skb_dequeue(defq);
+                if (deliver)
+                        __skb_queue_tail(inputq, skb);
+                else
+                        kfree_skb(skb);
+
+                if (ack)
+                        tipc_group_proto_xmit(grp, m, GRP_ACK_MSG, xmitq);
+
+                if (leave) {
+                        __skb_queue_purge(defq);
+                        tipc_group_delete_member(grp, m);
+                        break;
+                }
+                if (!update)
+                        continue;
+
+                blks = msg_blocks(hdr);
+                tipc_group_update_rcv_win(grp, blks, node, port, xmitq);
+        }
+        return;
+drop:
+        kfree_skb(skb);
+}
+
+void tipc_group_update_rcv_win(struct tipc_group *grp, int blks, u32 node,
+                               u32 port, struct sk_buff_head *xmitq)
+{
+        struct list_head *active = &grp->active;
+        int max_active = grp->max_active;
+        int reclaim_limit = max_active * 3 / 4;
+        int active_cnt = grp->active_cnt;
+        struct tipc_member *m, *rm;
+
+        m = tipc_group_find_member(grp, node, port);
+        if (!m)
+                return;
+
+        m->advertised -= blks;
+
+        switch (m->state) {
+        case MBR_JOINED:
+                /* Reclaim advertised space from least active member */
+                if (!list_empty(active) && active_cnt >= reclaim_limit) {
+                        rm = list_first_entry(active, struct tipc_member, list);
+                        rm->state = MBR_RECLAIMING;
+                        list_move_tail(&rm->list, &grp->reclaiming);
+                        tipc_group_proto_xmit(grp, rm, GRP_RECLAIM_MSG, xmitq);
+                }
+                /* If max active, become pending and wait for reclaimed space */
+                if (active_cnt >= max_active) {
+                        m->state = MBR_PENDING;
+                        list_add_tail(&m->list, &grp->pending);
+                        break;
+                }
+                /* Otherwise become active */
+                m->state = MBR_ACTIVE;
+                list_add_tail(&m->list, &grp->active);
+                grp->active_cnt++;
+                /* Fall through */
+        case MBR_ACTIVE:
+                if (!list_is_last(&m->list, &grp->active))
+                        list_move_tail(&m->list, &grp->active);
+                if (m->advertised > (ADV_ACTIVE * 3 / 4))
+                        break;
+                tipc_group_proto_xmit(grp, m, GRP_ADV_MSG, xmitq);
+                break;
+        case MBR_REMITTED:
+                if (m->advertised > ADV_IDLE)
+                        break;
+                m->state = MBR_JOINED;
+                if (m->advertised < ADV_IDLE) {
+                        pr_warn_ratelimited("Rcv unexpected msg after REMIT\n");
+                        tipc_group_proto_xmit(grp, m, GRP_ADV_MSG, xmitq);
+                }
+                break;
+        case MBR_RECLAIMING:
+        case MBR_DISCOVERED:
+        case MBR_JOINING:
+        case MBR_LEAVING:
+        default:
+                break;
+        }
+}
+
+static void tipc_group_proto_xmit(struct tipc_group *grp, struct tipc_member *m,
+                                  int mtyp, struct sk_buff_head *xmitq)
+{
+        struct tipc_msg *hdr;
+        struct sk_buff *skb;
+        int adv = 0;
+
+        skb = tipc_msg_create(GROUP_PROTOCOL, mtyp, INT_H_SIZE, 0,
+                              m->node, tipc_own_addr(grp->net),
+                              m->port, grp->portid, 0);
+        if (!skb)
+                return;
+
+        if (m->state == MBR_ACTIVE)
+                adv = ADV_ACTIVE - m->advertised;
+        else if (m->state == MBR_JOINED || m->state == MBR_PENDING)
+                adv = ADV_IDLE - m->advertised;
+
+        hdr = buf_msg(skb);
+
+        if (mtyp == GRP_JOIN_MSG) {
+                msg_set_grp_bc_syncpt(hdr, grp->bc_snd_nxt);
+                msg_set_adv_win(hdr, adv);
+                m->advertised += adv;
+        } else if (mtyp == GRP_LEAVE_MSG) {
+                msg_set_grp_bc_syncpt(hdr, grp->bc_snd_nxt);
+        } else if (mtyp == GRP_ADV_MSG) {
+                msg_set_adv_win(hdr, adv);
+                m->advertised += adv;
+        } else if (mtyp == GRP_ACK_MSG) {
+                msg_set_grp_bc_acked(hdr, m->bc_rcv_nxt);
+        } else if (mtyp == GRP_REMIT_MSG) {
+                msg_set_grp_remitted(hdr, m->window);
+        }
+        __skb_queue_tail(xmitq, skb);
+}
+
+void tipc_group_proto_rcv(struct tipc_group *grp, bool *usr_wakeup,
+                          struct tipc_msg *hdr, struct sk_buff_head *inputq,
+                          struct sk_buff_head *xmitq)
+{
+        u32 node = msg_orignode(hdr);
+        u32 port = msg_origport(hdr);
+        struct tipc_member *m, *pm;
+        struct tipc_msg *ehdr;
+        u16 remitted, in_flight;
+
+        if (!grp)
+                return;
+
+        m = tipc_group_find_member(grp, node, port);
+
+        switch (msg_type(hdr)) {
+        case GRP_JOIN_MSG:
+                if (!m)
+                        m = tipc_group_create_member(grp, node, port,
+                                                     MBR_QUARANTINED);
+                if (!m)
+                        return;
+                m->bc_syncpt = msg_grp_bc_syncpt(hdr);
+                m->bc_rcv_nxt = m->bc_syncpt;
+                m->window += msg_adv_win(hdr);
+
+                /* Wait until PUBLISH event is received */
+                if (m->state == MBR_DISCOVERED) {
+                        m->state = MBR_JOINING;
+                } else if (m->state == MBR_PUBLISHED) {
+                        m->state = MBR_JOINED;
+                        *usr_wakeup = true;
+                        m->usr_pending = false;
+                        tipc_group_proto_xmit(grp, m, GRP_ADV_MSG, xmitq);
+                        ehdr = buf_msg(m->event_msg);
+                        msg_set_grp_bc_seqno(ehdr, m->bc_syncpt);
+                        __skb_queue_tail(inputq, m->event_msg);
+                }
+                if (m->window < ADV_IDLE)
+                        tipc_group_update_member(m, 0);
+                else
+                        list_del_init(&m->congested);
+                return;
+        case GRP_LEAVE_MSG:
+                if (!m)
+                        return;
+                m->bc_syncpt = msg_grp_bc_syncpt(hdr);
+
+                /* Wait until WITHDRAW event is received */
+                if (m->state != MBR_LEAVING) {
+                        tipc_group_decr_active(grp, m);
+                        m->state = MBR_LEAVING;
+                        return;
+                }
+                /* Otherwise deliver already received WITHDRAW event */
+                ehdr = buf_msg(m->event_msg);
+                msg_set_grp_bc_seqno(ehdr, m->bc_syncpt);
+                __skb_queue_tail(inputq, m->event_msg);
+                *usr_wakeup = true;
+                list_del_init(&m->congested);
+                return;
+        case GRP_ADV_MSG:
+                if (!m)
+                        return;
+                m->window += msg_adv_win(hdr);
+                *usr_wakeup = m->usr_pending;
+                m->usr_pending = false;
+                list_del_init(&m->congested);
+                return;
+        case GRP_ACK_MSG:
+                if (!m)
+                        return;
+                m->bc_acked = msg_grp_bc_acked(hdr);
+                if (--grp->bc_ackers)
+                        break;
+                *usr_wakeup = true;
+                m->usr_pending = false;
+                return;
+        case GRP_RECLAIM_MSG:
+                if (!m)
+                        return;
+                *usr_wakeup = m->usr_pending;
+                m->usr_pending = false;
+                tipc_group_proto_xmit(grp, m, GRP_REMIT_MSG, xmitq);
+                m->window = ADV_IDLE;
+                return;
+        case GRP_REMIT_MSG:
+                if (!m || m->state != MBR_RECLAIMING)
+                        return;
+
+                list_del_init(&m->list);
+                grp->active_cnt--;
+                remitted = msg_grp_remitted(hdr);
+
+                /* Messages preceding the REMIT still in receive queue */
+                if (m->advertised > remitted) {
+                        m->state = MBR_REMITTED;
+                        in_flight = m->advertised - remitted;
+                }
+                /* All messages preceding the REMIT have been read */
+                if (m->advertised <= remitted) {
+                        m->state = MBR_JOINED;
+                        in_flight = 0;
+                }
+                /* ..and the REMIT overtaken by more messages => re-advertise */
+                if (m->advertised < remitted)
+                        tipc_group_proto_xmit(grp, m, GRP_ADV_MSG, xmitq);
+
+                m->advertised = ADV_IDLE + in_flight;
+
+                /* Set oldest pending member to active and advertise */
+                if (list_empty(&grp->pending))
+                        return;
+                pm = list_first_entry(&grp->pending, struct tipc_member, list);
+                pm->state = MBR_ACTIVE;
+                list_move_tail(&pm->list, &grp->active);
+                grp->active_cnt++;
+                if (pm->advertised <= (ADV_ACTIVE * 3 / 4))
+                        tipc_group_proto_xmit(grp, pm, GRP_ADV_MSG, xmitq);
+                return;
+        default:
+                pr_warn("Received unknown GROUP_PROTO message\n");
+        }
+}
+
+/* tipc_group_member_evt() - receive and handle a member up/down event
+ */
+void tipc_group_member_evt(struct tipc_group *grp,
+                           bool *usr_wakeup,
+                           int *sk_rcvbuf,
+                           struct sk_buff *skb,
+                           struct sk_buff_head *inputq,
+                           struct sk_buff_head *xmitq)
+{
+        struct tipc_msg *hdr = buf_msg(skb);
+        struct tipc_event *evt = (void *)msg_data(hdr);
+        u32 instance = evt->found_lower;
+        u32 node = evt->port.node;
+        u32 port = evt->port.ref;
+        int event = evt->event;
+        struct tipc_member *m;
+        struct net *net;
+        bool node_up;
+        u32 self;
+
+        if (!grp)
+                goto drop;
+
+        net = grp->net;
+        self = tipc_own_addr(net);
+        if (!grp->loopback && node == self && port == grp->portid)
+                goto drop;
+
+        /* Convert message before delivery to user */
+        msg_set_hdr_sz(hdr, GROUP_H_SIZE);
+        msg_set_user(hdr, TIPC_CRITICAL_IMPORTANCE);
+        msg_set_type(hdr, TIPC_GRP_MEMBER_EVT);
+        msg_set_origport(hdr, port);
+        msg_set_orignode(hdr, node);
+        msg_set_nametype(hdr, grp->type);
+        msg_set_grp_evt(hdr, event);
+
+        m = tipc_group_find_member(grp, node, port);
+
+        if (event == TIPC_PUBLISHED) {
+                if (!m)
+                        m = tipc_group_create_member(grp, node, port,
+                                                     MBR_DISCOVERED);
+                if (!m)
+                        goto drop;
+
+                /* Hold back event if JOIN message not yet received */
+                if (m->state == MBR_DISCOVERED) {
+                        m->event_msg = skb;
+                        m->state = MBR_PUBLISHED;
+                } else {
+                        msg_set_grp_bc_seqno(hdr, m->bc_syncpt);
+                        __skb_queue_tail(inputq, skb);
+                        m->state = MBR_JOINED;
+                        *usr_wakeup = true;
+                        m->usr_pending = false;
+                }
+                m->instance = instance;
+                TIPC_SKB_CB(skb)->orig_member = m->instance;
+                tipc_group_proto_xmit(grp, m, GRP_JOIN_MSG, xmitq);
+                if (m->window < ADV_IDLE)
+                        tipc_group_update_member(m, 0);
+                else
+                        list_del_init(&m->congested);
+        } else if (event == TIPC_WITHDRAWN) {
+                if (!m)
+                        goto drop;
+
+                TIPC_SKB_CB(skb)->orig_member = m->instance;
+
+                *usr_wakeup = true;
+                m->usr_pending = false;
+                node_up = tipc_node_is_up(net, node);
+
+                /* Hold back event if more messages might be expected */
+                if (m->state != MBR_LEAVING && node_up) {
+                        m->event_msg = skb;
+                        tipc_group_decr_active(grp, m);
+                        m->state = MBR_LEAVING;
+                } else {
+                        if (node_up)
+                                msg_set_grp_bc_seqno(hdr, m->bc_syncpt);
+                        else
+                                msg_set_grp_bc_seqno(hdr, m->bc_rcv_nxt);
+                        __skb_queue_tail(inputq, skb);
+                }
+                list_del_init(&m->congested);
+        }
+        *sk_rcvbuf = tipc_group_rcvbuf_limit(grp);
+        return;
+drop:
+        kfree_skb(skb);
+}
diff --git a/net/tipc/group.h b/net/tipc/group.h
new file mode 100644
index 000000000000..d525e1cd7de5
--- /dev/null
+++ b/net/tipc/group.h
@@ -0,0 +1,73 @@
+/*
+ * net/tipc/group.h: Include file for TIPC group unicast/multicast functions
+ *
+ * Copyright (c) 2017, Ericsson AB
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. Neither the names of the copyright holders nor the names of its
+ *    contributors may be used to endorse or promote products derived from
+ *    this software without specific prior written permission.
+ *
+ * Alternatively, this software may be distributed under the terms of the
+ * GNU General Public License ("GPL") version 2 as published by the Free
+ * Software Foundation.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE
+ * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef _TIPC_GROUP_H
+#define _TIPC_GROUP_H
+
+#include "core.h"
+
+struct tipc_group;
+struct tipc_member;
+struct tipc_msg;
+
+struct tipc_group *tipc_group_create(struct net *net, u32 portid,
+                                     struct tipc_group_req *mreq);
+void tipc_group_delete(struct net *net, struct tipc_group *grp);
+void tipc_group_add_member(struct tipc_group *grp, u32 node, u32 port);
+struct tipc_nlist *tipc_group_dests(struct tipc_group *grp);
+void tipc_group_self(struct tipc_group *grp, struct tipc_name_seq *seq,
+                     int *scope);
+u32 tipc_group_exclude(struct tipc_group *grp);
+void tipc_group_filter_msg(struct tipc_group *grp,
+                           struct sk_buff_head *inputq,
+                           struct sk_buff_head *xmitq);
+void tipc_group_member_evt(struct tipc_group *grp, bool *wakeup,
+                           int *sk_rcvbuf, struct sk_buff *skb,
+                           struct sk_buff_head *inputq,
+                           struct sk_buff_head *xmitq);
+void tipc_group_proto_rcv(struct tipc_group *grp, bool *wakeup,
+                          struct tipc_msg *hdr,
+                          struct sk_buff_head *inputq,
+                          struct sk_buff_head *xmitq);
+void tipc_group_update_bc_members(struct tipc_group *grp, int len, bool ack);
+bool tipc_group_cong(struct tipc_group *grp, u32 dnode, u32 dport,
+                     int len, struct tipc_member **m);
+bool tipc_group_bc_cong(struct tipc_group *grp, int len);
+void tipc_group_update_rcv_win(struct tipc_group *grp, int blks, u32 node,
+                               u32 port, struct sk_buff_head *xmitq);
+u16 tipc_group_bc_snd_nxt(struct tipc_group *grp);
+void tipc_group_update_member(struct tipc_member *m, int len);
+int tipc_group_size(struct tipc_group *grp);
+#endif
diff --git a/net/tipc/link.c b/net/tipc/link.c
index ac0144f532aa..6bce0b1117bd 100644
--- a/net/tipc/link.c
+++ b/net/tipc/link.c
@@ -239,7 +239,8 @@ static int link_is_up(struct tipc_link *l)
 static int tipc_link_proto_rcv(struct tipc_link *l, struct sk_buff *skb,
                                struct sk_buff_head *xmitq);
 static void tipc_link_build_proto_msg(struct tipc_link *l, int mtyp, bool probe,
-                                      u16 rcvgap, int tolerance, int priority,
+                                      bool probe_reply, u16 rcvgap,
+                                      int tolerance, int priority,
                                       struct sk_buff_head *xmitq);
 static void link_print(struct tipc_link *l, const char *str);
 static int tipc_link_build_nack_msg(struct tipc_link *l,
@@ -773,7 +774,7 @@ int tipc_link_timeout(struct tipc_link *l, struct sk_buff_head *xmitq)
         }
 
         if (state || probe || setup)
-                tipc_link_build_proto_msg(l, mtyp, probe, 0, 0, 0, xmitq);
+                tipc_link_build_proto_msg(l, mtyp, probe, 0, 0, 0, 0, xmitq);
 
         return rc;
 }
@@ -1039,6 +1040,7 @@ int tipc_link_retrans(struct tipc_link *l, struct tipc_link *nacker,
 static bool tipc_data_input(struct tipc_link *l, struct sk_buff *skb,
                             struct sk_buff_head *inputq)
 {
+        struct sk_buff_head *mc_inputq = l->bc_rcvlink->inputq;
         struct tipc_msg *hdr = buf_msg(skb);
 
         switch (msg_user(hdr)) {
@@ -1046,13 +1048,16 @@ static bool tipc_data_input(struct tipc_link *l, struct sk_buff *skb,
         case TIPC_MEDIUM_IMPORTANCE:
         case TIPC_HIGH_IMPORTANCE:
         case TIPC_CRITICAL_IMPORTANCE:
-                if (unlikely(msg_type(hdr) == TIPC_MCAST_MSG)) {
-                        skb_queue_tail(l->bc_rcvlink->inputq, skb);
+                if (unlikely(msg_in_group(hdr) || msg_mcast(hdr))) {
+                        skb_queue_tail(mc_inputq, skb);
                         return true;
                 }
         case CONN_MANAGER:
                 skb_queue_tail(inputq, skb);
                 return true;
+        case GROUP_PROTOCOL:
+                skb_queue_tail(mc_inputq, skb);
+                return true;
         case NAME_DISTRIBUTOR:
                 l->bc_rcvlink->state = LINK_ESTABLISHED;
                 skb_queue_tail(l->namedq, skb);
@@ -1170,7 +1175,7 @@ int tipc_link_build_state_msg(struct tipc_link *l, struct sk_buff_head *xmitq)
         /* Unicast ACK */
         l->rcv_unacked = 0;
         l->stats.sent_acks++;
-        tipc_link_build_proto_msg(l, STATE_MSG, 0, 0, 0, 0, xmitq);
+        tipc_link_build_proto_msg(l, STATE_MSG, 0, 0, 0, 0, 0, xmitq);
         return 0;
 }
 
@@ -1184,7 +1189,7 @@ void tipc_link_build_reset_msg(struct tipc_link *l, struct sk_buff_head *xmitq)
         if (l->state == LINK_ESTABLISHING)
                 mtyp = ACTIVATE_MSG;
 
-        tipc_link_build_proto_msg(l, mtyp, 0, 0, 0, 0, xmitq);
+        tipc_link_build_proto_msg(l, mtyp, 0, 0, 0, 0, 0, xmitq);
 
         /* Inform peer that this endpoint is going down if applicable */
         skb = skb_peek_tail(xmitq);
@@ -1211,7 +1216,7 @@ static int tipc_link_build_nack_msg(struct tipc_link *l,
         }
 
         if ((skb_queue_len(&l->deferdq) == 1) || !(def_cnt % TIPC_NACK_INTV))
-                tipc_link_build_proto_msg(l, STATE_MSG, 0, 0, 0, 0, xmitq);
+                tipc_link_build_proto_msg(l, STATE_MSG, 0, 0, 0, 0, 0, xmitq);
         return 0;
 }
 
@@ -1285,7 +1290,8 @@ drop:
 }
 
 static void tipc_link_build_proto_msg(struct tipc_link *l, int mtyp, bool probe,
-                                      u16 rcvgap, int tolerance, int priority,
+                                      bool probe_reply, u16 rcvgap,
+                                      int tolerance, int priority,
                                       struct sk_buff_head *xmitq)
 {
         struct tipc_link *bcl = l->bc_rcvlink;
@@ -1333,6 +1339,7 @@ static void tipc_link_build_proto_msg(struct tipc_link *l, int mtyp, bool probe,
                 msg_set_seq_gap(hdr, rcvgap);
                 msg_set_bc_gap(hdr, link_bc_rcv_gap(bcl));
                 msg_set_probe(hdr, probe);
+                msg_set_is_keepalive(hdr, probe || probe_reply);
                 tipc_mon_prep(l->net, data, &dlen, mstate, l->bearer_id);
                 msg_set_size(hdr, INT_H_SIZE + dlen);
                 skb_trim(skb, INT_H_SIZE + dlen);
@@ -1438,6 +1445,7 @@ static int tipc_link_proto_rcv(struct tipc_link *l, struct sk_buff *skb,
         u16 rcv_nxt = l->rcv_nxt;
         u16 dlen = msg_data_sz(hdr);
         int mtyp = msg_type(hdr);
+        bool reply = msg_probe(hdr);
         void *data;
         char *if_name;
         int rc = 0;
@@ -1524,9 +1532,9 @@ static int tipc_link_proto_rcv(struct tipc_link *l, struct sk_buff *skb,
                 /* Send NACK if peer has sent pkts we haven't received yet */
                 if (more(peers_snd_nxt, rcv_nxt) && !tipc_link_is_synching(l))
                         rcvgap = peers_snd_nxt - l->rcv_nxt;
-                if (rcvgap || (msg_probe(hdr)))
-                        tipc_link_build_proto_msg(l, STATE_MSG, 0, rcvgap,
-                                                  0, 0, xmitq);
+                if (rcvgap || reply)
+                        tipc_link_build_proto_msg(l, STATE_MSG, 0, reply,
+                                                  rcvgap, 0, 0, xmitq);
                 tipc_link_release_pkts(l, ack);
 
                 /* If NACK, retransmit will now start at right position */
@@ -2118,14 +2126,14 @@ void tipc_link_set_tolerance(struct tipc_link *l, u32 tol,
                              struct sk_buff_head *xmitq)
 {
         l->tolerance = tol;
-        tipc_link_build_proto_msg(l, STATE_MSG, 0, 0, tol, 0, xmitq);
+        tipc_link_build_proto_msg(l, STATE_MSG, 0, 0, 0, tol, 0, xmitq);
 }
 
 void tipc_link_set_prio(struct tipc_link *l, u32 prio,
                         struct sk_buff_head *xmitq)
 {
         l->priority = prio;
-        tipc_link_build_proto_msg(l, STATE_MSG, 0, 0, 0, prio, xmitq);
+        tipc_link_build_proto_msg(l, STATE_MSG, 0, 0, 0, 0, prio, xmitq);
 }
 
 void tipc_link_set_abort_limit(struct tipc_link *l, u32 limit)
diff --git a/net/tipc/monitor.c b/net/tipc/monitor.c
index 9e109bb1a207..8e884ed06d4b 100644
--- a/net/tipc/monitor.c
+++ b/net/tipc/monitor.c
@@ -530,8 +530,11 @@ void tipc_mon_prep(struct net *net, void *data, int *dlen,
         u16 gen = mon->dom_gen;
         u16 len;
 
-        if (!tipc_mon_is_active(net, mon))
+        /* Send invalid record if not active */
+        if (!tipc_mon_is_active(net, mon)) {
+                dom->len = 0;
                 return;
+        }
 
         /* Send only a dummy record with ack if peer has acked our last sent */
         if (likely(state->acked_gen == gen)) {
@@ -559,6 +562,12 @@ void tipc_mon_get_state(struct net *net, u32 addr,
         struct tipc_monitor *mon = tipc_monitor(net, bearer_id);
         struct tipc_peer *peer;
 
+        if (!tipc_mon_is_active(net, mon)) {
+                state->probing = false;
+                state->monitoring = true;
+                return;
+        }
+
         /* Used cached state if table has not changed */
         if (!state->probing &&
             (state->list_gen == mon->list_gen) &&
@@ -578,9 +587,9 @@ void tipc_mon_get_state(struct net *net, u32 addr,
         read_unlock_bh(&mon->lock);
 }
 
-static void mon_timeout(unsigned long m)
+static void mon_timeout(struct timer_list *t)
 {
-        struct tipc_monitor *mon = (void *)m;
+        struct tipc_monitor *mon = from_timer(mon, t, timer);
         struct tipc_peer *self;
         int best_member_cnt = dom_size(mon->peer_cnt) - 1;
 
@@ -623,7 +632,7 @@ int tipc_mon_create(struct net *net, int bearer_id)
         self->is_up = true;
         self->is_head = true;
         INIT_LIST_HEAD(&self->list);
-        setup_timer(&mon->timer, mon_timeout, (unsigned long)mon);
+        timer_setup(&mon->timer, mon_timeout, 0);
         mon->timer_intv = msecs_to_jiffies(MON_TIMEOUT + (tn->random & 0xffff));
         mod_timer(&mon->timer, jiffies + mon->timer_intv);
         return 0;
diff --git a/net/tipc/msg.c b/net/tipc/msg.c
index 17146c16ee2d..b0d07b35909d 100644
--- a/net/tipc/msg.c
+++ b/net/tipc/msg.c
@@ -174,7 +174,7 @@ int tipc_buf_append(struct sk_buff **headbuf, struct sk_buff **buf)
 
         if (fragid == LAST_FRAGMENT) {
                 TIPC_SKB_CB(head)->validated = false;
-                if (unlikely(!tipc_msg_validate(head)))
+                if (unlikely(!tipc_msg_validate(&head)))
                         goto err;
                 *buf = head;
                 TIPC_SKB_CB(head)->tail = NULL;
@@ -201,11 +201,21 @@ err:
  * TIPC will ignore the excess, under the assumption that it is optional info
  * introduced by a later release of the protocol.
  */
-bool tipc_msg_validate(struct sk_buff *skb)
+bool tipc_msg_validate(struct sk_buff **_skb)
 {
-        struct tipc_msg *msg;
+        struct sk_buff *skb = *_skb;
+        struct tipc_msg *hdr;
         int msz, hsz;
 
+        /* Ensure that flow control ratio condition is satisfied */
+        if (unlikely(skb->truesize / buf_roundup_len(skb) > 4)) {
+                skb = skb_copy(skb, GFP_ATOMIC);
+                if (!skb)
+                        return false;
+                kfree_skb(*_skb);
+                *_skb = skb;
+        }
+
         if (unlikely(TIPC_SKB_CB(skb)->validated))
                 return true;
         if (unlikely(!pskb_may_pull(skb, MIN_H_SIZE)))
@@ -217,11 +227,11 @@ bool tipc_msg_validate(struct sk_buff *skb)
         if (unlikely(!pskb_may_pull(skb, hsz)))
                 return false;
 
-        msg = buf_msg(skb);
-        if (unlikely(msg_version(msg) != TIPC_VERSION))
+        hdr = buf_msg(skb);
+        if (unlikely(msg_version(hdr) != TIPC_VERSION))
                 return false;
 
-        msz = msg_size(msg);
+        msz = msg_size(hdr);
         if (unlikely(msz < hsz))
                 return false;
         if (unlikely((msz - hsz) > TIPC_MAX_USER_MSG_SIZE))
@@ -411,7 +421,7 @@ bool tipc_msg_extract(struct sk_buff *skb, struct sk_buff **iskb, int *pos)
         skb_pull(*iskb, offset);
         imsz = msg_size(buf_msg(*iskb));
         skb_trim(*iskb, imsz);
-        if (unlikely(!tipc_msg_validate(*iskb)))
+        if (unlikely(!tipc_msg_validate(iskb)))
                 goto none;
         *pos += align(imsz);
         return true;
@@ -666,3 +676,10 @@ void __tipc_skb_queue_sorted(struct sk_buff_head *list, u16 seqno,
         }
         kfree_skb(skb);
 }
+
+void tipc_skb_reject(struct net *net, int err, struct sk_buff *skb,
+                     struct sk_buff_head *xmitq)
+{
+        if (tipc_msg_reverse(tipc_own_addr(net), &skb, err))
+                __skb_queue_tail(xmitq, skb);
+}
diff --git a/net/tipc/msg.h b/net/tipc/msg.h
index c843fd2bc48d..3e4384c222f7 100644
--- a/net/tipc/msg.h
+++ b/net/tipc/msg.h
@@ -1,7 +1,7 @@
 /*
  * net/tipc/msg.h: Include file for TIPC message header routines
  *
- * Copyright (c) 2000-2007, 2014-2015 Ericsson AB
+ * Copyright (c) 2000-2007, 2014-2017 Ericsson AB
  * Copyright (c) 2005-2008, 2010-2011, Wind River Systems
  * All rights reserved.
  *
@@ -61,10 +61,14 @@ struct plist;
 /*
  * Payload message types
  */
-#define TIPC_CONN_MSG           0
-#define TIPC_MCAST_MSG          1
-#define TIPC_NAMED_MSG          2
-#define TIPC_DIRECT_MSG         3
+#define TIPC_CONN_MSG           0
+#define TIPC_MCAST_MSG          1
+#define TIPC_NAMED_MSG          2
+#define TIPC_DIRECT_MSG         3
+#define TIPC_GRP_MEMBER_EVT     4
+#define TIPC_GRP_BCAST_MSG      5
+#define TIPC_GRP_MCAST_MSG      6
+#define TIPC_GRP_UCAST_MSG      7
 
 /*
  * Internal message users
@@ -73,11 +77,13 @@ struct plist;
 #define  MSG_BUNDLER          6
 #define  LINK_PROTOCOL        7
 #define  CONN_MANAGER         8
+#define  GROUP_PROTOCOL       9
 #define  TUNNEL_PROTOCOL      10
 #define  NAME_DISTRIBUTOR     11
 #define  MSG_FRAGMENTER       12
 #define  LINK_CONFIG          13
 #define  SOCK_WAKEUP          14       /* pseudo user */
+#define  TOP_SRV              15       /* pseudo user */
 
 /*
  * Message header sizes
@@ -86,6 +92,7 @@ struct plist;
 #define BASIC_H_SIZE              32    /* Basic payload message */
 #define NAMED_H_SIZE              40    /* Named payload message */
 #define MCAST_H_SIZE              44    /* Multicast payload message */
+#define GROUP_H_SIZE              44    /* Group payload message */
 #define INT_H_SIZE                40    /* Internal messages */
 #define MIN_H_SIZE                24    /* Smallest legal TIPC header size */
 #define MAX_H_SIZE                60    /* Largest possible TIPC header size */
@@ -96,6 +103,7 @@ struct plist;
 
 struct tipc_skb_cb {
         u32 bytes_read;
+        u32 orig_member;
         struct sk_buff *tail;
         bool validated;
         u16 chain_imp;
@@ -188,6 +196,11 @@ static inline u32 msg_size(struct tipc_msg *m)
         return msg_bits(m, 0, 0, 0x1ffff);
 }
 
+static inline u32 msg_blocks(struct tipc_msg *m)
+{
+        return (msg_size(m) / 1024) + 1;
+}
+
 static inline u32 msg_data_sz(struct tipc_msg *m)
 {
         return msg_size(m) - msg_hdr_sz(m);
@@ -213,6 +226,16 @@ static inline void msg_set_dest_droppable(struct tipc_msg *m, u32 d)
         msg_set_bits(m, 0, 19, 1, d);
 }
 
+static inline int msg_is_keepalive(struct tipc_msg *m)
+{
+        return msg_bits(m, 0, 19, 1);
+}
+
+static inline void msg_set_is_keepalive(struct tipc_msg *m, u32 d)
+{
+        msg_set_bits(m, 0, 19, 1, d);
+}
+
 static inline int msg_src_droppable(struct tipc_msg *m)
 {
         return msg_bits(m, 0, 18, 1);
@@ -251,6 +274,18 @@ static inline void msg_set_type(struct tipc_msg *m, u32 n)
         msg_set_bits(m, 1, 29, 0x7, n);
 }
 
+static inline int msg_in_group(struct tipc_msg *m)
+{
+        int mtyp = msg_type(m);
+
+        return mtyp >= TIPC_GRP_MEMBER_EVT && mtyp <= TIPC_GRP_UCAST_MSG;
+}
+
+static inline bool msg_is_grp_evt(struct tipc_msg *m)
+{
+        return msg_type(m) == TIPC_GRP_MEMBER_EVT;
+}
+
 static inline u32 msg_named(struct tipc_msg *m)
 {
         return msg_type(m) == TIPC_NAMED_MSG;
@@ -258,7 +293,10 @@ static inline u32 msg_named(struct tipc_msg *m)
 
 static inline u32 msg_mcast(struct tipc_msg *m)
 {
-        return msg_type(m) == TIPC_MCAST_MSG;
+        int mtyp = msg_type(m);
+
+        return ((mtyp == TIPC_MCAST_MSG) || (mtyp == TIPC_GRP_BCAST_MSG) ||
+                (mtyp == TIPC_GRP_MCAST_MSG));
 }
 
 static inline u32 msg_connected(struct tipc_msg *m)
@@ -514,6 +552,16 @@ static inline void msg_set_nameupper(struct tipc_msg *m, u32 n)
 #define DSC_RESP_MSG            1
 
 /*
+ * Group protocol message types
+ */
+#define GRP_JOIN_MSG         0
+#define GRP_LEAVE_MSG        1
+#define GRP_ADV_MSG          2
+#define GRP_ACK_MSG          3
+#define GRP_RECLAIM_MSG      4
+#define GRP_REMIT_MSG        5
+
+/*
  * Word 1
  */
 static inline u32 msg_seq_gap(struct tipc_msg *m)
@@ -764,12 +812,12 @@ static inline void msg_set_conn_ack(struct tipc_msg *m, u32 n)
         msg_set_bits(m, 9, 16, 0xffff, n);
 }
 
-static inline u32 msg_adv_win(struct tipc_msg *m)
+static inline u16 msg_adv_win(struct tipc_msg *m)
 {
         return msg_bits(m, 9, 0, 0xffff);
 }
 
-static inline void msg_set_adv_win(struct tipc_msg *m, u32 n)
+static inline void msg_set_adv_win(struct tipc_msg *m, u16 n)
 {
         msg_set_bits(m, 9, 0, 0xffff, n);
 }
@@ -794,6 +842,68 @@ static inline void msg_set_link_tolerance(struct tipc_msg *m, u32 n)
         msg_set_bits(m, 9, 0, 0xffff, n);
 }
 
+static inline u16 msg_grp_bc_syncpt(struct tipc_msg *m)
+{
+        return msg_bits(m, 9, 16, 0xffff);
+}
+
+static inline void msg_set_grp_bc_syncpt(struct tipc_msg *m, u16 n)
+{
+        msg_set_bits(m, 9, 16, 0xffff, n);
+}
+
+static inline u16 msg_grp_bc_acked(struct tipc_msg *m)
+{
+        return msg_bits(m, 9, 16, 0xffff);
+}
+
+static inline void msg_set_grp_bc_acked(struct tipc_msg *m, u16 n)
+{
+        msg_set_bits(m, 9, 16, 0xffff, n);
+}
+
+static inline u16 msg_grp_remitted(struct tipc_msg *m)
+{
+        return msg_bits(m, 9, 16, 0xffff);
+}
+
+static inline void msg_set_grp_remitted(struct tipc_msg *m, u16 n)
+{
+        msg_set_bits(m, 9, 16, 0xffff, n);
+}
+
+/* Word 10
+ */
+static inline u16 msg_grp_evt(struct tipc_msg *m)
+{
+        return msg_bits(m, 10, 0, 0x3);
+}
+
+static inline void msg_set_grp_evt(struct tipc_msg *m, int n)
+{
+        msg_set_bits(m, 10, 0, 0x3, n);
+}
+
+static inline u16 msg_grp_bc_ack_req(struct tipc_msg *m)
+{
+        return msg_bits(m, 10, 0, 0x1);
+}
+
+static inline void msg_set_grp_bc_ack_req(struct tipc_msg *m, bool n)
+{
+        msg_set_bits(m, 10, 0, 0x1, n);
+}
+
+static inline u16 msg_grp_bc_seqno(struct tipc_msg *m)
+{
+        return msg_bits(m, 10, 16, 0xffff);
+}
+
+static inline void msg_set_grp_bc_seqno(struct tipc_msg *m, u32 n)
+{
+        msg_set_bits(m, 10, 16, 0xffff, n);
+}
+
 static inline bool msg_peer_link_is_up(struct tipc_msg *m)
 {
         if (likely(msg_user(m) != LINK_PROTOCOL))
@@ -816,8 +926,10 @@ static inline bool msg_is_reset(struct tipc_msg *hdr)
 }
 
 struct sk_buff *tipc_buf_acquire(u32 size, gfp_t gfp);
-bool tipc_msg_validate(struct sk_buff *skb);
+bool tipc_msg_validate(struct sk_buff **_skb);
 bool tipc_msg_reverse(u32 own_addr, struct sk_buff **skb, int err);
+void tipc_skb_reject(struct net *net, int err, struct sk_buff *skb,
+                     struct sk_buff_head *xmitq);
 void tipc_msg_init(u32 own_addr, struct tipc_msg *m, u32 user, u32 type,
                    u32 hsize, u32 destnode);
 struct sk_buff *tipc_msg_create(uint user, uint type, uint hdr_sz,
@@ -842,6 +954,11 @@ static inline u16 buf_seqno(struct sk_buff *skb)
         return msg_seqno(buf_msg(skb));
 }
 
+static inline int buf_roundup_len(struct sk_buff *skb)
+{
+        return (skb->len / 1024 + 1) * 1024;
+}
+
 /* tipc_skb_peek(): peek and reserve first buffer in list
  * @list: list to be peeked in
  * Returns pointer to first buffer in list, if any
diff --git a/net/tipc/name_table.c b/net/tipc/name_table.c
index bd0aac87b41a..b3829bcf63c7 100644
--- a/net/tipc/name_table.c
+++ b/net/tipc/name_table.c
@@ -43,6 +43,7 @@
 #include "bcast.h"
 #include "addr.h"
 #include "node.h"
+#include "group.h"
 #include <net/genetlink.h>
 
 #define TIPC_NAMETBL_SIZE 1024          /* must be a power of 2 */
@@ -596,18 +597,47 @@ not_found:
         return ref;
 }
 
-/**
- * tipc_nametbl_mc_translate - find multicast destinations
- *
- * Creates list of all local ports that overlap the given multicast address;
- * also determines if any off-node ports overlap.
- *
- * Note: Publications with a scope narrower than 'limit' are ignored.
- * (i.e. local node-scope publications mustn't receive messages arriving
- * from another node, even if the multcast link brought it here)
- *
- * Returns non-zero if any off-node ports overlap
- */
+bool tipc_nametbl_lookup(struct net *net, u32 type, u32 instance, u32 domain,
+                         struct list_head *dsts, int *dstcnt, u32 exclude,
+                         bool all)
+{
+        u32 self = tipc_own_addr(net);
+        struct publication *publ;
+        struct name_info *info;
+        struct name_seq *seq;
+        struct sub_seq *sseq;
+
+        if (!tipc_in_scope(domain, self))
+                return false;
+
+        *dstcnt = 0;
+        rcu_read_lock();
+        seq = nametbl_find_seq(net, type);
+        if (unlikely(!seq))
+                goto exit;
+        spin_lock_bh(&seq->lock);
+        sseq = nameseq_find_subseq(seq, instance);
+        if (likely(sseq)) {
+                info = sseq->info;
+                list_for_each_entry(publ, &info->zone_list, zone_list) {
+                        if (!tipc_in_scope(domain, publ->node))
+                                continue;
+                        if (publ->ref == exclude && publ->node == self)
+                                continue;
+                        tipc_dest_push(dsts, publ->node, publ->ref);
+                        (*dstcnt)++;
+                        if (all)
+                                continue;
+                        list_move_tail(&publ->zone_list, &info->zone_list);
+                        break;
+                }
+        }
+        spin_unlock_bh(&seq->lock);
+exit:
+        rcu_read_unlock();
+        return !list_empty(dsts);
+}
+
 int tipc_nametbl_mc_translate(struct net *net, u32 type, u32 lower, u32 upper,
                               u32 limit, struct list_head *dports)
 {
@@ -634,7 +664,7 @@ int tipc_nametbl_mc_translate(struct net *net, u32 type, u32 lower, u32 upper,
                 info = sseq->info;
                 list_for_each_entry(publ, &info->node_list, node_list) {
                         if (publ->scope <= limit)
-                                u32_push(dports, publ->ref);
+                                tipc_dest_push(dports, 0, publ->ref);
                 }
 
                 if (info->cluster_list_size != info->node_list_size)
@@ -667,7 +697,7 @@ void tipc_nametbl_lookup_dst_nodes(struct net *net, u32 type, u32 lower,
         spin_lock_bh(&seq->lock);
         sseq = seq->sseqs + nameseq_locate_subseq(seq, lower);
         stop = seq->sseqs + seq->first_free;
-        for (; sseq->lower <= upper && sseq != stop; sseq++) {
+        for (; sseq != stop && sseq->lower <= upper; sseq++) {
                 info = sseq->info;
                 list_for_each_entry(publ, &info->zone_list, zone_list) {
                         if (tipc_in_scope(domain, publ->node))
@@ -679,6 +709,37 @@ exit:
         rcu_read_unlock();
 }
 
+/* tipc_nametbl_build_group - build list of communication group members
+ */
+void tipc_nametbl_build_group(struct net *net, struct tipc_group *grp,
+                              u32 type, u32 domain)
+{
+        struct sub_seq *sseq, *stop;
+        struct name_info *info;
+        struct publication *p;
+        struct name_seq *seq;
+
+        rcu_read_lock();
+        seq = nametbl_find_seq(net, type);
+        if (!seq)
+                goto exit;
+
+        spin_lock_bh(&seq->lock);
+        sseq = seq->sseqs;
+        stop = seq->sseqs + seq->first_free;
+        for (; sseq != stop; sseq++) {
+                info = sseq->info;
+                list_for_each_entry(p, &info->zone_list, zone_list) {
+                        if (!tipc_in_scope(domain, p->node))
+                                continue;
+                        tipc_group_add_member(grp, p->node, p->ref);
+                }
+        }
+        spin_unlock_bh(&seq->lock);
+exit:
+        rcu_read_unlock();
+}
+
 /*
  * tipc_nametbl_publish - add name publication to network name tables
  */
@@ -1057,78 +1118,79 @@ int tipc_nl_name_table_dump(struct sk_buff *skb, struct netlink_callback *cb)
         return skb->len;
 }
 
-bool u32_find(struct list_head *l, u32 value)
+struct tipc_dest *tipc_dest_find(struct list_head *l, u32 node, u32 port)
 {
-        struct u32_item *item;
+        u64 value = (u64)node << 32 | port;
+        struct tipc_dest *dst;
 
-        list_for_each_entry(item, l, list) {
-                if (item->value == value)
-                        return true;
+        list_for_each_entry(dst, l, list) {
+                if (dst->value != value)
+                        continue;
+                return dst;
         }
-        return false;
+        return NULL;
 }
 
-bool u32_push(struct list_head *l, u32 value)
+bool tipc_dest_push(struct list_head *l, u32 node, u32 port)
 {
-        struct u32_item *item;
+        u64 value = (u64)node << 32 | port;
+        struct tipc_dest *dst;
 
-        list_for_each_entry(item, l, list) {
-                if (item->value == value)
-                        return false;
-        }
-        item = kmalloc(sizeof(*item), GFP_ATOMIC);
-        if (unlikely(!item))
+        if (tipc_dest_find(l, node, port))
                 return false;
 
-        item->value = value;
-        list_add(&item->list, l);
+        dst = kmalloc(sizeof(*dst), GFP_ATOMIC);
+        if (unlikely(!dst))
+                return false;
+        dst->value = value;
+        list_add(&dst->list, l);
         return true;
 }
 
-u32 u32_pop(struct list_head *l)
+bool tipc_dest_pop(struct list_head *l, u32 *node, u32 *port)
 {
-        struct u32_item *item;
-        u32 value = 0;
+        struct tipc_dest *dst;
 
         if (list_empty(l))
-                return 0;
-        item = list_first_entry(l, typeof(*item), list);
-        value = item->value;
-        list_del(&item->list);
-        kfree(item);
-        return value;
+                return false;
+        dst = list_first_entry(l, typeof(*dst), list);
+        if (port)
+                *port = dst->port;
+        if (node)
+                *node = dst->node;
+        list_del(&dst->list);
+        kfree(dst);
+        return true;
 }
 
-bool u32_del(struct list_head *l, u32 value)
+bool tipc_dest_del(struct list_head *l, u32 node, u32 port)
 {
-        struct u32_item *item, *tmp;
+        struct tipc_dest *dst;
 
-        list_for_each_entry_safe(item, tmp, l, list) {
-                if (item->value != value)
-                        continue;
-                list_del(&item->list);
-                kfree(item);
-                return true;
-        }
-        return false;
+        dst = tipc_dest_find(l, node, port);
+        if (!dst)
+                return false;
+        list_del(&dst->list);
+        kfree(dst);
+        return true;
 }
 
-void u32_list_purge(struct list_head *l)
+void tipc_dest_list_purge(struct list_head *l)
 {
-        struct u32_item *item, *tmp;
+        struct tipc_dest *dst, *tmp;
 
-        list_for_each_entry_safe(item, tmp, l, list) {
-                list_del(&item->list);
-                kfree(item);
+        list_for_each_entry_safe(dst, tmp, l, list) {
+                list_del(&dst->list);
+                kfree(dst);
         }
 }
 
-int u32_list_len(struct list_head *l)
+int tipc_dest_list_len(struct list_head *l)
 {
-        struct u32_item *item;
+        struct tipc_dest *dst;
         int i = 0;
 
-        list_for_each_entry(item, l, list) {
+        list_for_each_entry(dst, l, list) {
                 i++;
         }
         return i;
diff --git a/net/tipc/name_table.h b/net/tipc/name_table.h
index 6ebdeb1d84a5..71926e429446 100644
--- a/net/tipc/name_table.h
+++ b/net/tipc/name_table.h
@@ -40,6 +40,7 @@
 struct tipc_subscription;
 struct tipc_plist;
 struct tipc_nlist;
+struct tipc_group;
 
 /*
  * TIPC name types reserved for internal TIPC use (both current and planned)
@@ -101,9 +102,14 @@ int tipc_nl_name_table_dump(struct sk_buff *skb, struct netlink_callback *cb);
 u32 tipc_nametbl_translate(struct net *net, u32 type, u32 instance, u32 *node);
 int tipc_nametbl_mc_translate(struct net *net, u32 type, u32 lower, u32 upper,
                               u32 limit, struct list_head *dports);
+void tipc_nametbl_build_group(struct net *net, struct tipc_group *grp,
+                              u32 type, u32 domain);
 void tipc_nametbl_lookup_dst_nodes(struct net *net, u32 type, u32 lower,
                                    u32 upper, u32 domain,
                                    struct tipc_nlist *nodes);
+bool tipc_nametbl_lookup(struct net *net, u32 type, u32 instance, u32 domain,
+                         struct list_head *dsts, int *dstcnt, u32 exclude,
+                         bool all);
 struct publication *tipc_nametbl_publish(struct net *net, u32 type, u32 lower,
                                          u32 upper, u32 scope, u32 port_ref,
                                          u32 key);
@@ -120,16 +126,22 @@ void tipc_nametbl_unsubscribe(struct tipc_subscription *s);
 int tipc_nametbl_init(struct net *net);
 void tipc_nametbl_stop(struct net *net);
 
-struct u32_item {
+struct tipc_dest {
         struct list_head list;
-        u32 value;
+        union {
+                struct {
+                        u32 port;
+                        u32 node;
+                };
+                u64 value;
+        };
 };
 
-bool u32_push(struct list_head *l, u32 value);
-u32 u32_pop(struct list_head *l);
-bool u32_find(struct list_head *l, u32 value);
-bool u32_del(struct list_head *l, u32 value);
-void u32_list_purge(struct list_head *l);
-int u32_list_len(struct list_head *l);
+struct tipc_dest *tipc_dest_find(struct list_head *l, u32 node, u32 port);
+bool tipc_dest_push(struct list_head *l, u32 node, u32 port);
+bool tipc_dest_pop(struct list_head *l, u32 *node, u32 *port);
+bool tipc_dest_del(struct list_head *l, u32 node, u32 port);
+void tipc_dest_list_purge(struct list_head *l);
+int tipc_dest_list_len(struct list_head *l);
 
 #endif
diff --git a/net/tipc/node.c b/net/tipc/node.c
index 198dbc7adbe1..507017fe0f1b 100644
--- a/net/tipc/node.c
+++ b/net/tipc/node.c
@@ -153,11 +153,11 @@ static void tipc_node_link_down(struct tipc_node *n, int bearer_id,
                                 bool delete);
 static void node_lost_contact(struct tipc_node *n, struct sk_buff_head *inputq);
 static void tipc_node_delete(struct tipc_node *node);
-static void tipc_node_timeout(unsigned long data);
+static void tipc_node_timeout(struct timer_list *t);
 static void tipc_node_fsm_evt(struct tipc_node *n, int evt);
 static struct tipc_node *tipc_node_find(struct net *net, u32 addr);
 static void tipc_node_put(struct tipc_node *node);
-static bool tipc_node_is_up(struct tipc_node *n);
+static bool node_is_up(struct tipc_node *n);
 
 struct tipc_sock_conn {
         u32 port;
@@ -361,7 +361,7 @@ struct tipc_node *tipc_node_create(struct net *net, u32 addr, u16 capabilities)
                 goto exit;
         }
         tipc_node_get(n);
-        setup_timer(&n->timer, tipc_node_timeout, (unsigned long)n);
+        timer_setup(&n->timer, tipc_node_timeout, 0);
         n->keepalive_intv = U32_MAX;
         hlist_add_head_rcu(&n->hash, &tn->node_htable[tipc_hashfn(addr)]);
         list_for_each_entry_rcu(temp_node, &tn->node_list, list) {
@@ -500,9 +500,9 @@ void tipc_node_remove_conn(struct net *net, u32 dnode, u32 port)
 
 /* tipc_node_timeout - handle expiration of node timer
  */
-static void tipc_node_timeout(unsigned long data)
+static void tipc_node_timeout(struct timer_list *t)
 {
-        struct tipc_node *n = (struct tipc_node *)data;
+        struct tipc_node *n = from_timer(n, t, timer);
         struct tipc_link_entry *le;
         struct sk_buff_head xmitq;
         int bearer_id;
@@ -657,7 +657,7 @@ static void __tipc_node_link_down(struct tipc_node *n, int *bearer_id,
                 *slot1 = i;
         }
 
-        if (!tipc_node_is_up(n)) {
+        if (!node_is_up(n)) {
                 if (tipc_link_peer_is_down(l))
                         tipc_node_fsm_evt(n, PEER_LOST_CONTACT_EVT);
                 tipc_node_fsm_evt(n, SELF_LOST_CONTACT_EVT);
@@ -717,11 +717,27 @@ static void tipc_node_link_down(struct tipc_node *n, int bearer_id, bool delete)
         tipc_sk_rcv(n->net, &le->inputq);
 }
 
-static bool tipc_node_is_up(struct tipc_node *n)
+static bool node_is_up(struct tipc_node *n)
 {
         return n->active_links[0] != INVALID_BEARER_ID;
 }
 
+bool tipc_node_is_up(struct net *net, u32 addr)
+{
+        struct tipc_node *n;
+        bool retval = false;
+
+        if (in_own_node(net, addr))
+                return true;
+
+        n = tipc_node_find(net, addr);
+        if (!n)
+                return false;
+        retval = node_is_up(n);
+        tipc_node_put(n);
+        return retval;
+}
+
 void tipc_node_check_dest(struct net *net, u32 onode,
                           struct tipc_bearer *b,
                           u16 capabilities, u32 signature,
@@ -1149,7 +1165,7 @@ static int __tipc_nl_add_node(struct tipc_nl_msg *msg, struct tipc_node *node)
 
         if (nla_put_u32(msg->skb, TIPC_NLA_NODE_ADDR, node->addr))
                 goto attr_msg_full;
-        if (tipc_node_is_up(node))
+        if (node_is_up(node))
                 if (nla_put_flag(msg->skb, TIPC_NLA_NODE_UP))
                         goto attr_msg_full;
 
@@ -1238,6 +1254,22 @@ int tipc_node_xmit_skb(struct net *net, struct sk_buff *skb, u32 dnode,
         return 0;
 }
 
+/* tipc_node_distr_xmit(): send single buffer msgs to individual destinations
+ * Note: this is only for SYSTEM_IMPORTANCE messages, which cannot be rejected
+ */
+int tipc_node_distr_xmit(struct net *net, struct sk_buff_head *xmitq)
+{
+        struct sk_buff *skb;
+        u32 selector, dnode;
+
+        while ((skb = __skb_dequeue(xmitq))) {
+                selector = msg_origport(buf_msg(skb));
+                dnode = msg_destnode(buf_msg(skb));
+                tipc_node_xmit_skb(net, skb, dnode, selector);
+        }
+        return 0;
+}
+
 void tipc_node_broadcast(struct net *net, struct sk_buff *skb)
 {
         struct sk_buff *txskb;
@@ -1249,7 +1281,7 @@ void tipc_node_broadcast(struct net *net, struct sk_buff *skb)
                 dst = n->addr;
                 if (in_own_node(net, dst))
                         continue;
-                if (!tipc_node_is_up(n))
+                if (!node_is_up(n))
                         continue;
                 txskb = pskb_copy(skb, GFP_ATOMIC);
                 if (!txskb)
@@ -1507,7 +1539,7 @@ void tipc_rcv(struct net *net, struct sk_buff *skb, struct tipc_bearer *b)
         __skb_queue_head_init(&xmitq);
 
         /* Ensure message is well-formed before touching the header */
-        if (unlikely(!tipc_msg_validate(skb)))
+        if (unlikely(!tipc_msg_validate(&skb)))
                 goto discard;
         hdr = buf_msg(skb);
         usr = msg_user(hdr);
diff --git a/net/tipc/node.h b/net/tipc/node.h
index 898c22916984..acd58d23a70e 100644
--- a/net/tipc/node.h
+++ b/net/tipc/node.h
@@ -48,7 +48,8 @@ enum {
         TIPC_BCAST_SYNCH      = (1 << 1),
         TIPC_BCAST_STATE_NACK = (1 << 2),
         TIPC_BLOCK_FLOWCTL    = (1 << 3),
-        TIPC_BCAST_RCAST      = (1 << 4)
+        TIPC_BCAST_RCAST      = (1 << 4),
+        TIPC_MCAST_GROUPS     = (1 << 5)
 };
 
 #define TIPC_NODE_CAPABILITIES (TIPC_BCAST_SYNCH | \
@@ -68,6 +69,7 @@ int tipc_node_get_linkname(struct net *net, u32 bearer_id, u32 node,
                            char *linkname, size_t len);
 int tipc_node_xmit(struct net *net, struct sk_buff_head *list, u32 dnode,
                    int selector);
+int tipc_node_distr_xmit(struct net *net, struct sk_buff_head *list);
 int tipc_node_xmit_skb(struct net *net, struct sk_buff *skb, u32 dest,
                        u32 selector);
 void tipc_node_subscribe(struct net *net, struct list_head *subscr, u32 addr);
@@ -76,6 +78,7 @@ void tipc_node_broadcast(struct net *net, struct sk_buff *skb);
 int tipc_node_add_conn(struct net *net, u32 dnode, u32 port, u32 peer_port);
 void tipc_node_remove_conn(struct net *net, u32 dnode, u32 port);
 int tipc_node_get_mtu(struct net *net, u32 addr, u32 sel);
+bool tipc_node_is_up(struct net *net, u32 addr);
 u16 tipc_node_get_capabilities(struct net *net, u32 addr);
 int tipc_nl_node_dump(struct sk_buff *skb, struct netlink_callback *cb);
 int tipc_nl_node_dump_link(struct sk_buff *skb, struct netlink_callback *cb);
diff --git a/net/tipc/server.c b/net/tipc/server.c
index 3cd6402e812c..acaef80fb88c 100644
--- a/net/tipc/server.c
+++ b/net/tipc/server.c
@@ -36,6 +36,8 @@
 #include "server.h"
 #include "core.h"
 #include "socket.h"
+#include "addr.h"
+#include "msg.h"
 #include <net/sock.h>
 #include <linux/module.h>
 
@@ -105,13 +107,11 @@ static void tipc_conn_kref_release(struct kref *kref)
                 kernel_bind(sock, (struct sockaddr *)saddr, sizeof(*saddr));
                 sock_release(sock);
                 con->sock = NULL;
-
-                spin_lock_bh(&s->idr_lock);
-                idr_remove(&s->conn_idr, con->conid);
-                s->idr_in_use--;
-                spin_unlock_bh(&s->idr_lock);
         }
-
+        spin_lock_bh(&s->idr_lock);
+        idr_remove(&s->conn_idr, con->conid);
+        s->idr_in_use--;
+        spin_unlock_bh(&s->idr_lock);
         tipc_clean_outqueues(con);
         kfree(con);
 }
@@ -197,7 +197,8 @@ static void tipc_close_conn(struct tipc_conn *con)
         struct tipc_server *s = con->server;
 
         if (test_and_clear_bit(CF_CONNECTED, &con->flags)) {
-                tipc_unregister_callbacks(con);
+                if (con->sock)
+                        tipc_unregister_callbacks(con);
 
                 if (con->conid)
                         s->tipc_conn_release(con->conid, con->usr_data);
@@ -207,8 +208,8 @@ static void tipc_close_conn(struct tipc_conn *con)
                  * are harmless for us here as we have already deleted this
                  * connection from server connection list.
                  */
-                kernel_sock_shutdown(con->sock, SHUT_RDWR);
-
+                if (con->sock)
+                        kernel_sock_shutdown(con->sock, SHUT_RDWR);
                 conn_put(con);
         }
 }
@@ -487,38 +488,104 @@ void tipc_conn_terminate(struct tipc_server *s, int conid)
         }
 }
 
+bool tipc_topsrv_kern_subscr(struct net *net, u32 port, u32 type,
+                             u32 lower, u32 upper, int *conid)
+{
+        struct tipc_subscriber *scbr;
+        struct tipc_subscr sub;
+        struct tipc_server *s;
+        struct tipc_conn *con;
+
+        sub.seq.type = type;
+        sub.seq.lower = lower;
+        sub.seq.upper = upper;
+        sub.timeout = TIPC_WAIT_FOREVER;
+        sub.filter = TIPC_SUB_PORTS;
+        *(u32 *)&sub.usr_handle = port;
+
+        con = tipc_alloc_conn(tipc_topsrv(net));
+        if (IS_ERR(con))
+                return false;
+
+        *conid = con->conid;
+        s = con->server;
+        scbr = s->tipc_conn_new(*conid);
+        if (!scbr) {
+                tipc_close_conn(con);
+                return false;
+        }
+
+        con->usr_data = scbr;
+        con->sock = NULL;
+        s->tipc_conn_recvmsg(net, *conid, NULL, scbr, &sub, sizeof(sub));
+        return true;
+}
+
+void tipc_topsrv_kern_unsubscr(struct net *net, int conid)
+{
+        struct tipc_conn *con;
+
+        con = tipc_conn_lookup(tipc_topsrv(net), conid);
+        if (!con)
+                return;
+        tipc_close_conn(con);
+        conn_put(con);
+}
+
+static void tipc_send_kern_top_evt(struct net *net, struct tipc_event *evt)
+{
+        u32 port = *(u32 *)&evt->s.usr_handle;
+        u32 self = tipc_own_addr(net);
+        struct sk_buff_head evtq;
+        struct sk_buff *skb;
+
+        skb = tipc_msg_create(TOP_SRV, 0, INT_H_SIZE, sizeof(*evt),
+                              self, self, port, port, 0);
+        if (!skb)
+                return;
+        msg_set_dest_droppable(buf_msg(skb), true);
+        memcpy(msg_data(buf_msg(skb)), evt, sizeof(*evt));
+        skb_queue_head_init(&evtq);
+        __skb_queue_tail(&evtq, skb);
+        tipc_sk_rcv(net, &evtq);
+}
+
 static void tipc_send_to_sock(struct tipc_conn *con)
 {
-        int count = 0;
         struct tipc_server *s = con->server;
         struct outqueue_entry *e;
+        struct tipc_event *evt;
         struct msghdr msg;
+        int count = 0;
         int ret;
 
         spin_lock_bh(&con->outqueue_lock);
         while (test_bit(CF_CONNECTED, &con->flags)) {
-                e = list_entry(con->outqueue.next, struct outqueue_entry,
-                               list);
+                e = list_entry(con->outqueue.next, struct outqueue_entry, list);
                 if ((struct list_head *) e == &con->outqueue)
                         break;
-                spin_unlock_bh(&con->outqueue_lock);
 
-                memset(&msg, 0, sizeof(msg));
-                msg.msg_flags = MSG_DONTWAIT;
+                spin_unlock_bh(&con->outqueue_lock);
 
-                if (s->type == SOCK_DGRAM || s->type == SOCK_RDM) {
-                        msg.msg_name = &e->dest;
-                        msg.msg_namelen = sizeof(struct sockaddr_tipc);
-                }
-                ret = kernel_sendmsg(con->sock, &msg, &e->iov, 1,
-                                     e->iov.iov_len);
-                if (ret == -EWOULDBLOCK || ret == 0) {
-                        cond_resched();
-                        goto out;
-                } else if (ret < 0) {
-                        goto send_err;
+                if (con->sock) {
+                        memset(&msg, 0, sizeof(msg));
+                        msg.msg_flags = MSG_DONTWAIT;
+                        if (s->type == SOCK_DGRAM || s->type == SOCK_RDM) {
+                                msg.msg_name = &e->dest;
+                                msg.msg_namelen = sizeof(struct sockaddr_tipc);
+                        }
+                        ret = kernel_sendmsg(con->sock, &msg, &e->iov, 1,
+                                             e->iov.iov_len);
+                        if (ret == -EWOULDBLOCK || ret == 0) {
+                                cond_resched();
+                                goto out;
+                        } else if (ret < 0) {
+                                goto send_err;
+                        }
+                } else {
+                        evt = e->iov.iov_base;
+                        tipc_send_kern_top_evt(s->net, evt);
                 }
-
                 /* Don't starve users filling buffers */
                 if (++count >= MAX_SEND_MSG_COUNT) {
                         cond_resched();
diff --git a/net/tipc/server.h b/net/tipc/server.h
index 34f8055afa3b..2113c9192633 100644
--- a/net/tipc/server.h
+++ b/net/tipc/server.h
@@ -83,13 +83,16 @@ struct tipc_server {
 int tipc_conn_sendmsg(struct tipc_server *s, int conid,
                       struct sockaddr_tipc *addr, void *data, size_t len);
 
+bool tipc_topsrv_kern_subscr(struct net *net, u32 port, u32 type,
+                             u32 lower, u32 upper, int *conid);
+void tipc_topsrv_kern_unsubscr(struct net *net, int conid);
+
 /**
  * tipc_conn_terminate - terminate connection with server
  *
  * Note: Must call it in process context since it might sleep
  */
 void tipc_conn_terminate(struct tipc_server *s, int conid);
-
 int tipc_server_start(struct tipc_server *s);
 
 void tipc_server_stop(struct tipc_server *s);
diff --git a/net/tipc/socket.c b/net/tipc/socket.c
index d50edd6e0019..5d18c0caa92b 100644
--- a/net/tipc/socket.c
+++ b/net/tipc/socket.c
@@ -1,7 +1,7 @@
 /*
  * net/tipc/socket.c: TIPC socket API
  *
- * Copyright (c) 2001-2007, 2012-2016, Ericsson AB
+ * Copyright (c) 2001-2007, 2012-2017, Ericsson AB
  * Copyright (c) 2004-2008, 2010-2013, Wind River Systems
  * All rights reserved.
  *
@@ -45,9 +45,10 @@
 #include "socket.h"
 #include "bcast.h"
 #include "netlink.h"
+#include "group.h"
 
 #define CONN_TIMEOUT_DEFAULT    8000    /* default connect timeout = 8s */
-#define CONN_PROBING_INTERVAL   msecs_to_jiffies(3600000)  /* [ms] => 1 h */
+#define CONN_PROBING_INTV       msecs_to_jiffies(3600000)  /* [ms] => 1 h */
 #define TIPC_FWD_MSG            1
 #define TIPC_MAX_PORT           0xffffffff
 #define TIPC_MIN_PORT           1
@@ -61,6 +62,11 @@ enum {
         TIPC_CONNECTING = TCP_SYN_SENT,
 };
 
+struct sockaddr_pair {
+        struct sockaddr_tipc sock;
+        struct sockaddr_tipc member;
+};
+
 /**
  * struct tipc_sock - TIPC socket structure
  * @sk: socket - interacts with 'port' and with user via the socket API
@@ -78,7 +84,7 @@ enum {
  * @conn_timeout: the time we can wait for an unresponded setup request
  * @dupl_rcvcnt: number of bytes counted twice, in both backlog and rcv queue
  * @cong_link_cnt: number of congested links
- * @sent_unacked: # messages sent by socket, and not yet acked by peer
+ * @snt_unacked: # messages sent by socket, and not yet acked by peer
  * @rcv_unacked: # messages read by user, but not yet acked back to peer
  * @peer: 'connected' peer for dgram/rdm
  * @node: hash table node
@@ -109,20 +115,22 @@ struct tipc_sock {
         struct rhash_head node;
         struct tipc_mc_method mc_method;
         struct rcu_head rcu;
+        struct tipc_group *group;
 };
 
-static int tipc_backlog_rcv(struct sock *sk, struct sk_buff *skb);
+static int tipc_sk_backlog_rcv(struct sock *sk, struct sk_buff *skb);
 static void tipc_data_ready(struct sock *sk);
 static void tipc_write_space(struct sock *sk);
 static void tipc_sock_destruct(struct sock *sk);
 static int tipc_release(struct socket *sock);
 static int tipc_accept(struct socket *sock, struct socket *new_sock, int flags,
                        bool kern);
-static void tipc_sk_timeout(unsigned long data);
+static void tipc_sk_timeout(struct timer_list *t);
 static int tipc_sk_publish(struct tipc_sock *tsk, uint scope,
                            struct tipc_name_seq const *seq);
 static int tipc_sk_withdraw(struct tipc_sock *tsk, uint scope,
                             struct tipc_name_seq const *seq);
+static int tipc_sk_leave(struct tipc_sock *tsk);
 static struct tipc_sock *tipc_sk_lookup(struct net *net, u32 portid);
 static int tipc_sk_insert(struct tipc_sock *tsk);
 static void tipc_sk_remove(struct tipc_sock *tsk);
@@ -193,6 +201,11 @@ static bool tsk_conn_cong(struct tipc_sock *tsk)
         return tsk->snt_unacked > tsk->snd_win;
 }
 
+static u16 tsk_blocks(int len)
+{
+        return ((len / FLOWCTL_BLK_SZ) + 1);
+}
+
 /* tsk_blocks(): translate a buffer size in bytes to number of
  * advertisable blocks, taking into account the ratio truesize(len)/len
  * We can trust that this ratio is always < 4 for len >= FLOWCTL_BLK_SZ
@@ -451,9 +464,9 @@ static int tipc_sk_create(struct net *net, struct socket *sock,
                       NAMED_H_SIZE, 0);
 
         msg_set_origport(msg, tsk->portid);
-        setup_timer(&sk->sk_timer, tipc_sk_timeout, (unsigned long)tsk);
+        timer_setup(&sk->sk_timer, tipc_sk_timeout, 0);
         sk->sk_shutdown = 0;
-        sk->sk_backlog_rcv = tipc_backlog_rcv;
+        sk->sk_backlog_rcv = tipc_sk_backlog_rcv;
         sk->sk_rcvbuf = sysctl_tipc_rmem[1];
         sk->sk_data_ready = tipc_data_ready;
         sk->sk_write_space = tipc_write_space;
@@ -559,13 +572,14 @@ static int tipc_release(struct socket *sock)
 
         __tipc_shutdown(sock, TIPC_ERR_NO_PORT);
         sk->sk_shutdown = SHUTDOWN_MASK;
+        tipc_sk_leave(tsk);
         tipc_sk_withdraw(tsk, 0, NULL);
         sk_stop_timer(sk, &sk->sk_timer);
         tipc_sk_remove(tsk);
 
         /* Reject any messages that accumulated in backlog queue */
         release_sock(sk);
-        u32_list_purge(&tsk->cong_links);
+        tipc_dest_list_purge(&tsk->cong_links);
         tsk->cong_link_cnt = 0;
         call_rcu(&tsk->rcu, tipc_sk_callback);
         sock->sk = NULL;
@@ -601,7 +615,10 @@ static int tipc_bind(struct socket *sock, struct sockaddr *uaddr,
                 res = tipc_sk_withdraw(tsk, 0, NULL);
                 goto exit;
         }
-
+        if (tsk->group) {
+                res = -EACCES;
+                goto exit;
+        }
         if (uaddr_len < sizeof(struct sockaddr_tipc)) {
                 res = -EINVAL;
                 goto exit;
@@ -698,38 +715,41 @@ static unsigned int tipc_poll(struct file *file, struct socket *sock,
 {
         struct sock *sk = sock->sk;
         struct tipc_sock *tsk = tipc_sk(sk);
-        u32 mask = 0;
+        struct tipc_group *grp = tsk->group;
+        u32 revents = 0;
 
         sock_poll_wait(file, sk_sleep(sk), wait);
 
         if (sk->sk_shutdown & RCV_SHUTDOWN)
-                mask |= POLLRDHUP | POLLIN | POLLRDNORM;
+                revents |= POLLRDHUP | POLLIN | POLLRDNORM;
         if (sk->sk_shutdown == SHUTDOWN_MASK)
-                mask |= POLLHUP;
+                revents |= POLLHUP;
 
         switch (sk->sk_state) {
         case TIPC_ESTABLISHED:
                 if (!tsk->cong_link_cnt && !tsk_conn_cong(tsk))
-                        mask |= POLLOUT;
+                        revents |= POLLOUT;
                 /* fall thru' */
         case TIPC_LISTEN:
         case TIPC_CONNECTING:
                 if (!skb_queue_empty(&sk->sk_receive_queue))
-                        mask |= (POLLIN | POLLRDNORM);
+                        revents |= POLLIN | POLLRDNORM;
                 break;
         case TIPC_OPEN:
-                if (!tsk->cong_link_cnt)
-                        mask |= POLLOUT;
-                if (tipc_sk_type_connectionless(sk) &&
-                    (!skb_queue_empty(&sk->sk_receive_queue)))
-                        mask |= (POLLIN | POLLRDNORM);
+                if (!grp || tipc_group_size(grp))
+                        if (!tsk->cong_link_cnt)
+                                revents |= POLLOUT;
+                if (!tipc_sk_type_connectionless(sk))
+                        break;
+                if (skb_queue_empty(&sk->sk_receive_queue))
+                        break;
+                revents |= POLLIN | POLLRDNORM;
                 break;
         case TIPC_DISCONNECTING:
-                mask = (POLLIN | POLLRDNORM | POLLHUP);
+                revents = POLLIN | POLLRDNORM | POLLHUP;
                 break;
         }
-
-        return mask;
+        return revents;
 }
 
 /**
@@ -757,6 +777,9 @@ static int tipc_sendmcast(struct  socket *sock, struct tipc_name_seq *seq,
         struct tipc_nlist dsts;
         int rc;
 
+        if (tsk->group)
+                return -EACCES;
+
         /* Block or return if any destination link is congested */
         rc = tipc_wait_for_cond(sock, &timeout, !tsk->cong_link_cnt);
         if (unlikely(rc))
@@ -794,6 +817,296 @@ static int tipc_sendmcast(struct  socket *sock, struct tipc_name_seq *seq,
 }
 
 /**
+ * tipc_send_group_msg - send a message to a member in the group
+ * @net: network namespace
+ * @m: message to send
+ * @mb: group member
+ * @dnode: destination node
+ * @dport: destination port
+ * @dlen: total length of message data
+ */
+static int tipc_send_group_msg(struct net *net, struct tipc_sock *tsk,
+                               struct msghdr *m, struct tipc_member *mb,
+                               u32 dnode, u32 dport, int dlen)
+{
+        u16 bc_snd_nxt = tipc_group_bc_snd_nxt(tsk->group);
+        struct tipc_mc_method *method = &tsk->mc_method;
+        int blks = tsk_blocks(GROUP_H_SIZE + dlen);
+        struct tipc_msg *hdr = &tsk->phdr;
+        struct sk_buff_head pkts;
+        int mtu, rc;
+
+        /* Complete message header */
+        msg_set_type(hdr, TIPC_GRP_UCAST_MSG);
+        msg_set_hdr_sz(hdr, GROUP_H_SIZE);
+        msg_set_destport(hdr, dport);
+        msg_set_destnode(hdr, dnode);
+        msg_set_grp_bc_seqno(hdr, bc_snd_nxt);
+
+        /* Build message as chain of buffers */
+        skb_queue_head_init(&pkts);
+        mtu = tipc_node_get_mtu(net, dnode, tsk->portid);
+        rc = tipc_msg_build(hdr, m, 0, dlen, mtu, &pkts);
+        if (unlikely(rc != dlen))
+                return rc;
+
+        /* Send message */
+        rc = tipc_node_xmit(net, &pkts, dnode, tsk->portid);
+        if (unlikely(rc == -ELINKCONG)) {
+                tipc_dest_push(&tsk->cong_links, dnode, 0);
+                tsk->cong_link_cnt++;
+        }
+
+        /* Update send window */
+        tipc_group_update_member(mb, blks);
+
+        /* A broadcast sent within next EXPIRE period must follow same path */
+        method->rcast = true;
+        method->mandatory = true;
+        return dlen;
+}
+
+/**
+ * tipc_send_group_unicast - send message to a member in the group
+ * @sock: socket structure
+ * @m: message to send
+ * @dlen: total length of message data
+ * @timeout: timeout to wait for wakeup
+ *
+ * Called from function tipc_sendmsg(), which has done all sanity checks
+ * Returns the number of bytes sent on success, or errno
+ */
+static int tipc_send_group_unicast(struct socket *sock, struct msghdr *m,
+                                   int dlen, long timeout)
+{
+        struct sock *sk = sock->sk;
+        DECLARE_SOCKADDR(struct sockaddr_tipc *, dest, m->msg_name);
+        int blks = tsk_blocks(GROUP_H_SIZE + dlen);
+        struct tipc_sock *tsk = tipc_sk(sk);
+        struct tipc_group *grp = tsk->group;
+        struct net *net = sock_net(sk);
+        struct tipc_member *mb = NULL;
+        u32 node, port;
+        int rc;
+
+        node = dest->addr.id.node;
+        port = dest->addr.id.ref;
+        if (!port && !node)
+                return -EHOSTUNREACH;
+
+        /* Block or return if destination link or member is congested */
+        rc = tipc_wait_for_cond(sock, &timeout,
+                                !tipc_dest_find(&tsk->cong_links, node, 0) &&
+                                !tipc_group_cong(grp, node, port, blks, &mb));
+        if (unlikely(rc))
+                return rc;
+
+        if (unlikely(!mb))
+                return -EHOSTUNREACH;
+
+        rc = tipc_send_group_msg(net, tsk, m, mb, node, port, dlen);
+
+        return rc ? rc : dlen;
+}
+
+/**
+ * tipc_send_group_anycast - send message to any member with given identity
+ * @sock: socket structure
+ * @m: message to send
+ * @dlen: total length of message data
+ * @timeout: timeout to wait for wakeup
+ *
+ * Called from function tipc_sendmsg(), which has done all sanity checks
+ * Returns the number of bytes sent on success, or errno
+ */
+static int tipc_send_group_anycast(struct socket *sock, struct msghdr *m,
+                                   int dlen, long timeout)
+{
+        DECLARE_SOCKADDR(struct sockaddr_tipc *, dest, m->msg_name);
+        struct sock *sk = sock->sk;
+        struct tipc_sock *tsk = tipc_sk(sk);
+        struct list_head *cong_links = &tsk->cong_links;
+        int blks = tsk_blocks(GROUP_H_SIZE + dlen);
+        struct tipc_group *grp = tsk->group;
+        struct tipc_member *first = NULL;
+        struct tipc_member *mbr = NULL;
+        struct net *net = sock_net(sk);
+        u32 node, port, exclude;
+        u32 type, inst, domain;
+        struct list_head dsts;
+        int lookups = 0;
+        int dstcnt, rc;
+        bool cong;
+
+        INIT_LIST_HEAD(&dsts);
+
+        type = dest->addr.name.name.type;
+        inst = dest->addr.name.name.instance;
+        domain = addr_domain(net, dest->scope);
+        exclude = tipc_group_exclude(grp);
+
+        while (++lookups < 4) {
+                first = NULL;
+
+                /* Look for a non-congested destination member, if any */
+                while (1) {
+                        if (!tipc_nametbl_lookup(net, type, inst, domain, &dsts,
+                                                 &dstcnt, exclude, false))
+                                return -EHOSTUNREACH;
+                        tipc_dest_pop(&dsts, &node, &port);
+                        cong = tipc_group_cong(grp, node, port, blks, &mbr);
+                        if (!cong)
+                                break;
+                        if (mbr == first)
+                                break;
+                        if (!first)
+                                first = mbr;
+                }
+
+                /* Start over if destination was not in member list */
+                if (unlikely(!mbr))
+                        continue;
+
+                if (likely(!cong && !tipc_dest_find(cong_links, node, 0)))
+                        break;
+
+                /* Block or return if destination link or member is congested */
+                rc = tipc_wait_for_cond(sock, &timeout,
+                                        !tipc_dest_find(cong_links, node, 0) &&
+                                        !tipc_group_cong(grp, node, port,
+                                                         blks, &mbr));
+                if (unlikely(rc))
+                        return rc;
+
+                /* Send, unless destination disappeared while waiting */
+                if (likely(mbr))
+                        break;
+        }
+
+        if (unlikely(lookups >= 4))
+                return -EHOSTUNREACH;
+
+        rc = tipc_send_group_msg(net, tsk, m, mbr, node, port, dlen);
+
+        return rc ? rc : dlen;
+}
+
+/**
+ * tipc_send_group_bcast - send message to all members in communication group
+ * @sk: socket structure
+ * @m: message to send
+ * @dlen: total length of message data
+ * @timeout: timeout to wait for wakeup
+ *
+ * Called from function tipc_sendmsg(), which has done all sanity checks
+ * Returns the number of bytes sent on success, or errno
+ */
+static int tipc_send_group_bcast(struct socket *sock, struct msghdr *m,
+                                 int dlen, long timeout)
+{
+        DECLARE_SOCKADDR(struct sockaddr_tipc *, dest, m->msg_name);
+        struct sock *sk = sock->sk;
+        struct net *net = sock_net(sk);
+        struct tipc_sock *tsk = tipc_sk(sk);
+        struct tipc_group *grp = tsk->group;
+        struct tipc_nlist *dsts = tipc_group_dests(grp);
+        struct tipc_mc_method *method = &tsk->mc_method;
+        bool ack = method->mandatory && method->rcast;
+        int blks = tsk_blocks(MCAST_H_SIZE + dlen);
+        struct tipc_msg *hdr = &tsk->phdr;
+        int mtu = tipc_bcast_get_mtu(net);
+        struct sk_buff_head pkts;
+        int rc = -EHOSTUNREACH;
+
+        if (!dsts->local && !dsts->remote)
+                return -EHOSTUNREACH;
+
+        /* Block or return if any destination link or member is congested */
+        rc = tipc_wait_for_cond(sock, &timeout, !tsk->cong_link_cnt &&
+                                !tipc_group_bc_cong(grp, blks));
+        if (unlikely(rc))
+                return rc;
+
+        /* Complete message header */
+        if (dest) {
+                msg_set_type(hdr, TIPC_GRP_MCAST_MSG);
+                msg_set_nameinst(hdr, dest->addr.name.name.instance);
+        } else {
+                msg_set_type(hdr, TIPC_GRP_BCAST_MSG);
+                msg_set_nameinst(hdr, 0);
+        }
+        msg_set_hdr_sz(hdr, GROUP_H_SIZE);
+        msg_set_destport(hdr, 0);
+        msg_set_destnode(hdr, 0);
+        msg_set_grp_bc_seqno(hdr, tipc_group_bc_snd_nxt(grp));
+
+        /* Avoid getting stuck with repeated forced replicasts */
+        msg_set_grp_bc_ack_req(hdr, ack);
+
+        /* Build message as chain of buffers */
+        skb_queue_head_init(&pkts);
+        rc = tipc_msg_build(hdr, m, 0, dlen, mtu, &pkts);
+        if (unlikely(rc != dlen))
+                return rc;
+
+        /* Send message */
+        rc = tipc_mcast_xmit(net, &pkts, method, dsts, &tsk->cong_link_cnt);
+        if (unlikely(rc))
+                return rc;
+
+        /* Update broadcast sequence number and send windows */
+        tipc_group_update_bc_members(tsk->group, blks, ack);
+
+        /* Broadcast link is now free to choose method for next broadcast */
+        method->mandatory = false;
+        method->expires = jiffies;
+
+        return dlen;
+}
+
+/**
+ * tipc_send_group_mcast - send message to all members with given identity
+ * @sock: socket structure
+ * @m: message to send
+ * @dlen: total length of message data
+ * @timeout: timeout to wait for wakeup
+ *
+ * Called from function tipc_sendmsg(), which has done all sanity checks
+ * Returns the number of bytes sent on success, or errno
+ */
+static int tipc_send_group_mcast(struct socket *sock, struct msghdr *m,
+                                 int dlen, long timeout)
+{
+        struct sock *sk = sock->sk;
+        DECLARE_SOCKADDR(struct sockaddr_tipc *, dest, m->msg_name);
+        struct tipc_name_seq *seq = &dest->addr.nameseq;
+        struct tipc_sock *tsk = tipc_sk(sk);
+        struct tipc_group *grp = tsk->group;
+        struct net *net = sock_net(sk);
+        u32 domain, exclude, dstcnt;
+        struct list_head dsts;
+
+        INIT_LIST_HEAD(&dsts);
+
+        if (seq->lower != seq->upper)
+                return -ENOTSUPP;
+
+        domain = addr_domain(net, dest->scope);
+        exclude = tipc_group_exclude(grp);
+        if (!tipc_nametbl_lookup(net, seq->type, seq->lower, domain,
+                                 &dsts, &dstcnt, exclude, true))
+                return -EHOSTUNREACH;
+
+        if (dstcnt == 1) {
+                tipc_dest_pop(&dsts, &dest->addr.id.node, &dest->addr.id.ref);
+                return tipc_send_group_unicast(sock, m, dlen, timeout);
+        }
+
+        tipc_dest_list_purge(&dsts);
+        return tipc_send_group_bcast(sock, m, dlen, timeout);
+}
+
+/**
  * tipc_sk_mcast_rcv - Deliver multicast messages to all destination sockets
  * @arrvq: queue with arriving messages, to be cloned after destination lookup
  * @inputq: queue with cloned messages, delivered to socket after dest lookup
@@ -803,13 +1116,15 @@ static int tipc_sendmcast(struct  socket *sock, struct tipc_name_seq *seq,
 void tipc_sk_mcast_rcv(struct net *net, struct sk_buff_head *arrvq,
                        struct sk_buff_head *inputq)
 {
-        struct tipc_msg *msg;
-        struct list_head dports;
-        u32 portid;
         u32 scope = TIPC_CLUSTER_SCOPE;
-        struct sk_buff_head tmpq;
-        uint hsz;
+        u32 self = tipc_own_addr(net);
         struct sk_buff *skb, *_skb;
+        u32 lower = 0, upper = ~0;
+        struct sk_buff_head tmpq;
+        u32 portid, oport, onode;
+        struct list_head dports;
+        struct tipc_msg *msg;
+        int user, mtyp, hsz;
 
         __skb_queue_head_init(&tmpq);
         INIT_LIST_HEAD(&dports);
@@ -817,17 +1132,32 @@ void tipc_sk_mcast_rcv(struct net *net, struct sk_buff_head *arrvq,
         skb = tipc_skb_peek(arrvq, &inputq->lock);
         for (; skb; skb = tipc_skb_peek(arrvq, &inputq->lock)) {
                 msg = buf_msg(skb);
+                user = msg_user(msg);
+                mtyp = msg_type(msg);
+                if (mtyp == TIPC_GRP_UCAST_MSG || user == GROUP_PROTOCOL) {
+                        spin_lock_bh(&inputq->lock);
+                        if (skb_peek(arrvq) == skb) {
+                                __skb_dequeue(arrvq);
+                                __skb_queue_tail(inputq, skb);
+                        }
+                        refcount_dec(&skb->users);
+                        spin_unlock_bh(&inputq->lock);
+                        continue;
+                }
                 hsz = skb_headroom(skb) + msg_hdr_sz(msg);
-
-                if (in_own_node(net, msg_orignode(msg)))
+                oport = msg_origport(msg);
+                onode = msg_orignode(msg);
+                if (onode == self)
                         scope = TIPC_NODE_SCOPE;
 
                 /* Create destination port list and message clones: */
-                tipc_nametbl_mc_translate(net,
-                                          msg_nametype(msg), msg_namelower(msg),
-                                          msg_nameupper(msg), scope, &dports);
-                portid = u32_pop(&dports);
-                for (; portid; portid = u32_pop(&dports)) {
+                if (!msg_in_group(msg)) {
+                        lower = msg_namelower(msg);
+                        upper = msg_nameupper(msg);
+                }
+                tipc_nametbl_mc_translate(net, msg_nametype(msg), lower, upper,
+                                          scope, &dports);
+                while (tipc_dest_pop(&dports, NULL, &portid)) {
                         _skb = __pskb_copy(skb, hsz, GFP_ATOMIC);
                         if (_skb) {
                                 msg_set_destport(buf_msg(_skb), portid);
@@ -850,16 +1180,16 @@ void tipc_sk_mcast_rcv(struct net *net, struct sk_buff_head *arrvq,
 }
 
 /**
- * tipc_sk_proto_rcv - receive a connection mng protocol message
+ * tipc_sk_conn_proto_rcv - receive a connection mng protocol message
  * @tsk: receiving socket
  * @skb: pointer to message buffer.
  */
-static void tipc_sk_proto_rcv(struct tipc_sock *tsk, struct sk_buff *skb,
-                              struct sk_buff_head *xmitq)
+static void tipc_sk_conn_proto_rcv(struct tipc_sock *tsk, struct sk_buff *skb,
+                                   struct sk_buff_head *xmitq)
 {
-        struct sock *sk = &tsk->sk;
-        u32 onode = tsk_own_node(tsk);
         struct tipc_msg *hdr = buf_msg(skb);
+        u32 onode = tsk_own_node(tsk);
+        struct sock *sk = &tsk->sk;
         int mtyp = msg_type(hdr);
         bool conn_cong;
 
@@ -931,6 +1261,7 @@ static int __tipc_sendmsg(struct socket *sock, struct msghdr *m, size_t dlen)
         long timeout = sock_sndtimeo(sk, m->msg_flags & MSG_DONTWAIT);
         struct list_head *clinks = &tsk->cong_links;
         bool syn = !tipc_sk_type_connectionless(sk);
+        struct tipc_group *grp = tsk->group;
         struct tipc_msg *hdr = &tsk->phdr;
         struct tipc_name_seq *seq;
         struct sk_buff_head pkts;
@@ -941,18 +1272,31 @@ static int __tipc_sendmsg(struct socket *sock, struct msghdr *m, size_t dlen)
         if (unlikely(dlen > TIPC_MAX_USER_MSG_SIZE))
                 return -EMSGSIZE;
 
+        if (likely(dest)) {
+                if (unlikely(m->msg_namelen < sizeof(*dest)))
+                        return -EINVAL;
+                if (unlikely(dest->family != AF_TIPC))
+                        return -EINVAL;
+        }
+
+        if (grp) {
+                if (!dest)
+                        return tipc_send_group_bcast(sock, m, dlen, timeout);
+                if (dest->addrtype == TIPC_ADDR_NAME)
+                        return tipc_send_group_anycast(sock, m, dlen, timeout);
+                if (dest->addrtype == TIPC_ADDR_ID)
+                        return tipc_send_group_unicast(sock, m, dlen, timeout);
+                if (dest->addrtype == TIPC_ADDR_MCAST)
+                        return tipc_send_group_mcast(sock, m, dlen, timeout);
+                return -EINVAL;
+        }
+
         if (unlikely(!dest)) {
                 dest = &tsk->peer;
                 if (!syn || dest->family != AF_TIPC)
                         return -EDESTADDRREQ;
         }
 
-        if (unlikely(m->msg_namelen < sizeof(*dest)))
-                return -EINVAL;
-
-        if (unlikely(dest->family != AF_TIPC))
-                return -EINVAL;
-
         if (unlikely(syn)) {
                 if (sk->sk_state == TIPC_LISTEN)
                         return -EPIPE;
@@ -985,7 +1329,6 @@ static int __tipc_sendmsg(struct socket *sock, struct msghdr *m, size_t dlen)
                 msg_set_destport(hdr, dport);
                 if (unlikely(!dport && !dnode))
                         return -EHOSTUNREACH;
-
         } else if (dest->addrtype == TIPC_ADDR_ID) {
                 dnode = dest->addr.id.node;
                 msg_set_type(hdr, TIPC_DIRECT_MSG);
@@ -996,7 +1339,8 @@ static int __tipc_sendmsg(struct socket *sock, struct msghdr *m, size_t dlen)
         }
 
         /* Block or return if destination link is congested */
-        rc = tipc_wait_for_cond(sock, &timeout, !u32_find(clinks, dnode));
+        rc = tipc_wait_for_cond(sock, &timeout,
+                                !tipc_dest_find(clinks, dnode, 0));
         if (unlikely(rc))
                 return rc;
 
@@ -1008,7 +1352,7 @@ static int __tipc_sendmsg(struct socket *sock, struct msghdr *m, size_t dlen)
 
         rc = tipc_node_xmit(net, &pkts, dnode, tsk->portid);
         if (unlikely(rc == -ELINKCONG)) {
-                u32_push(clinks, dnode);
+                tipc_dest_push(clinks, dnode, 0);
                 tsk->cong_link_cnt++;
                 rc = 0;
         }
@@ -1128,7 +1472,7 @@ static void tipc_sk_finish_conn(struct tipc_sock *tsk, u32 peer_port,
         msg_set_lookup_scope(msg, 0);
         msg_set_hdr_sz(msg, SHORT_H_SIZE);
 
-        sk_reset_timer(sk, &sk->sk_timer, jiffies + CONN_PROBING_INTERVAL);
+        sk_reset_timer(sk, &sk->sk_timer, jiffies + CONN_PROBING_INTV);
         tipc_set_sk_state(sk, TIPC_ESTABLISHED);
         tipc_node_add_conn(net, peer_node, tsk->portid, peer_port);
         tsk->max_pkt = tipc_node_get_mtu(net, peer_node, tsk->portid);
@@ -1142,26 +1486,38 @@ static void tipc_sk_finish_conn(struct tipc_sock *tsk, u32 peer_port,
 }
 
 /**
- * set_orig_addr - capture sender's address for received message
+ * tipc_sk_set_orig_addr - capture sender's address for received message
  * @m: descriptor for message info
- * @msg: received message header
+ * @hdr: received message header
  *
  * Note: Address is not captured if not requested by receiver.
  */
-static void set_orig_addr(struct msghdr *m, struct tipc_msg *msg)
+static void tipc_sk_set_orig_addr(struct msghdr *m, struct sk_buff *skb)
 {
-        DECLARE_SOCKADDR(struct sockaddr_tipc *, addr, m->msg_name);
+        DECLARE_SOCKADDR(struct sockaddr_pair *, srcaddr, m->msg_name);
+        struct tipc_msg *hdr = buf_msg(skb);
 
-        if (addr) {
-                addr->family = AF_TIPC;
-                addr->addrtype = TIPC_ADDR_ID;
-                memset(&addr->addr, 0, sizeof(addr->addr));
-                addr->addr.id.ref = msg_origport(msg);
-                addr->addr.id.node = msg_orignode(msg);
-                addr->addr.name.domain = 0;     /* could leave uninitialized */
-                addr->scope = 0;                /* could leave uninitialized */
-                m->msg_namelen = sizeof(struct sockaddr_tipc);
-        }
+        if (!srcaddr)
+                return;
+
+        srcaddr->sock.family = AF_TIPC;
+        srcaddr->sock.addrtype = TIPC_ADDR_ID;
+        srcaddr->sock.addr.id.ref = msg_origport(hdr);
+        srcaddr->sock.addr.id.node = msg_orignode(hdr);
+        srcaddr->sock.addr.name.domain = 0;
+        srcaddr->sock.scope = 0;
+        m->msg_namelen = sizeof(struct sockaddr_tipc);
+
+        if (!msg_in_group(hdr))
+                return;
+
+        /* Group message users may also want to know sending member's id */
+        srcaddr->member.family = AF_TIPC;
+        srcaddr->member.addrtype = TIPC_ADDR_NAME;
+        srcaddr->member.addr.name.name.type = msg_nametype(hdr);
+        srcaddr->member.addr.name.name.instance = TIPC_SKB_CB(skb)->orig_member;
+        srcaddr->member.addr.name.domain = 0;
+        m->msg_namelen = sizeof(*srcaddr);
 }
 
 /**
@@ -1318,11 +1674,13 @@ static int tipc_recvmsg(struct socket *sock, struct msghdr *m,
                         size_t buflen,  int flags)
 {
         struct sock *sk = sock->sk;
-        struct tipc_sock *tsk = tipc_sk(sk);
-        struct sk_buff *skb;
-        struct tipc_msg *hdr;
         bool connected = !tipc_sk_type_connectionless(sk);
+        struct tipc_sock *tsk = tipc_sk(sk);
         int rc, err, hlen, dlen, copy;
+        struct sk_buff_head xmitq;
+        struct tipc_msg *hdr;
+        struct sk_buff *skb;
+        bool grp_evt;
         long timeout;
 
         /* Catch invalid receive requests */
@@ -1336,8 +1694,8 @@ static int tipc_recvmsg(struct socket *sock, struct msghdr *m,
         }
         timeout = sock_rcvtimeo(sk, flags & MSG_DONTWAIT);
 
+        /* Step rcv queue to first msg with data or error; wait if necessary */
         do {
-                /* Look at first msg in receive queue; wait if necessary */
                 rc = tipc_wait_for_rcvmsg(sock, &timeout);
                 if (unlikely(rc))
                         goto exit;
@@ -1346,13 +1704,14 @@ static int tipc_recvmsg(struct socket *sock, struct msghdr *m,
                 dlen = msg_data_sz(hdr);
                 hlen = msg_hdr_sz(hdr);
                 err = msg_errcode(hdr);
+                grp_evt = msg_is_grp_evt(hdr);
                 if (likely(dlen || err))
                         break;
                 tsk_advance_rx_queue(sk);
         } while (1);
 
         /* Collect msg meta data, including error code and rejected data */
-        set_orig_addr(m, hdr);
+        tipc_sk_set_orig_addr(m, skb);
         rc = tipc_sk_anc_data_recv(m, hdr, tsk);
         if (unlikely(rc))
                 goto exit;
@@ -1372,15 +1731,33 @@ static int tipc_recvmsg(struct socket *sock, struct msghdr *m,
         if (unlikely(rc))
                 goto exit;
 
+        /* Mark message as group event if applicable */
+        if (unlikely(grp_evt)) {
+                if (msg_grp_evt(hdr) == TIPC_WITHDRAWN)
+                        m->msg_flags |= MSG_EOR;
+                m->msg_flags |= MSG_OOB;
+                copy = 0;
+        }
+
         /* Caption of data or error code/rejected data was successful */
         if (unlikely(flags & MSG_PEEK))
                 goto exit;
 
+        /* Send group flow control advertisement when applicable */
+        if (tsk->group && msg_in_group(hdr) && !grp_evt) {
+                skb_queue_head_init(&xmitq);
+                tipc_group_update_rcv_win(tsk->group, tsk_blocks(hlen + dlen),
+                                          msg_orignode(hdr), msg_origport(hdr),
+                                          &xmitq);
+                tipc_node_distr_xmit(sock_net(sk), &xmitq);
+        }
+
         tsk_advance_rx_queue(sk);
+
         if (likely(!connected))
                 goto exit;
 
-        /* Send connection flow control ack when applicable */
+        /* Send connection flow control advertisement when applicable */
         tsk->rcv_unacked += tsk_inc(tsk, hlen + dlen);
         if (tsk->rcv_unacked >= tsk->rcv_win / TIPC_ACK_RATE)
                 tipc_sk_send_ack(tsk);
@@ -1446,7 +1823,7 @@ static int tipc_recvstream(struct socket *sock, struct msghdr *m,
 
                 /* Collect msg meta data, incl. error code and rejected data */
                 if (!copied) {
-                        set_orig_addr(m, hdr);
+                        tipc_sk_set_orig_addr(m, skb);
                         rc = tipc_sk_anc_data_recv(m, hdr, tsk);
                         if (rc)
                                 break;
@@ -1532,14 +1909,51 @@ static void tipc_sock_destruct(struct sock *sk)
         __skb_queue_purge(&sk->sk_receive_queue);
 }
 
+static void tipc_sk_proto_rcv(struct sock *sk,
+                              struct sk_buff_head *inputq,
+                              struct sk_buff_head *xmitq)
+{
+        struct sk_buff *skb = __skb_dequeue(inputq);
+        struct tipc_sock *tsk = tipc_sk(sk);
+        struct tipc_msg *hdr = buf_msg(skb);
+        struct tipc_group *grp = tsk->group;
+        bool wakeup = false;
+
+        switch (msg_user(hdr)) {
+        case CONN_MANAGER:
+                tipc_sk_conn_proto_rcv(tsk, skb, xmitq);
+                return;
+        case SOCK_WAKEUP:
+                tipc_dest_del(&tsk->cong_links, msg_orignode(hdr), 0);
+                tsk->cong_link_cnt--;
+                wakeup = true;
+                break;
+        case GROUP_PROTOCOL:
+                tipc_group_proto_rcv(grp, &wakeup, hdr, inputq, xmitq);
+                break;
+        case TOP_SRV:
+                tipc_group_member_evt(tsk->group, &wakeup, &sk->sk_rcvbuf,
+                                      skb, inputq, xmitq);
+                skb = NULL;
+                break;
+        default:
+                break;
+        }
+
+        if (wakeup)
+                sk->sk_write_space(sk);
+
+        kfree_skb(skb);
+}
+
 /**
- * filter_connect - Handle all incoming messages for a connection-based socket
+ * tipc_filter_connect - Handle incoming message for a connection-based socket
  * @tsk: TIPC socket
  * @skb: pointer to message buffer. Set to NULL if buffer is consumed
  *
  * Returns true if everything ok, false otherwise
  */
-static bool filter_connect(struct tipc_sock *tsk, struct sk_buff *skb)
+static bool tipc_sk_filter_connect(struct tipc_sock *tsk, struct sk_buff *skb)
 {
         struct sock *sk = &tsk->sk;
         struct net *net = sock_net(sk);
@@ -1643,6 +2057,9 @@ static unsigned int rcvbuf_limit(struct sock *sk, struct sk_buff *skb)
         struct tipc_sock *tsk = tipc_sk(sk);
         struct tipc_msg *hdr = buf_msg(skb);
 
+        if (unlikely(msg_in_group(hdr)))
+                return sk->sk_rcvbuf;
+
         if (unlikely(!msg_connected(hdr)))
                 return sk->sk_rcvbuf << msg_importance(hdr);
 
@@ -1653,7 +2070,7 @@ static unsigned int rcvbuf_limit(struct sock *sk, struct sk_buff *skb)
 }
 
 /**
- * filter_rcv - validate incoming message
+ * tipc_sk_filter_rcv - validate incoming message
  * @sk: socket
  * @skb: pointer to message.
  *
@@ -1662,99 +2079,71 @@ static unsigned int rcvbuf_limit(struct sock *sk, struct sk_buff *skb)
  *
  * Called with socket lock already taken
  *
- * Returns true if message was added to socket receive queue, otherwise false
  */
-static bool filter_rcv(struct sock *sk, struct sk_buff *skb,
-                       struct sk_buff_head *xmitq)
+static void tipc_sk_filter_rcv(struct sock *sk, struct sk_buff *skb,
+                               struct sk_buff_head *xmitq)
 {
+        bool sk_conn = !tipc_sk_type_connectionless(sk);
         struct tipc_sock *tsk = tipc_sk(sk);
+        struct tipc_group *grp = tsk->group;
         struct tipc_msg *hdr = buf_msg(skb);
-        unsigned int limit = rcvbuf_limit(sk, skb);
-        int err = TIPC_OK;
-        int usr = msg_user(hdr);
-        u32 onode;
+        struct net *net = sock_net(sk);
+        struct sk_buff_head inputq;
+        int limit, err = TIPC_OK;
 
-        if (unlikely(msg_user(hdr) == CONN_MANAGER)) {
-                tipc_sk_proto_rcv(tsk, skb, xmitq);
-                return false;
-        }
+        TIPC_SKB_CB(skb)->bytes_read = 0;
+        __skb_queue_head_init(&inputq);
+        __skb_queue_tail(&inputq, skb);
 
-        if (unlikely(usr == SOCK_WAKEUP)) {
-                onode = msg_orignode(hdr);
-                kfree_skb(skb);
-                u32_del(&tsk->cong_links, onode);
-                tsk->cong_link_cnt--;
-                sk->sk_write_space(sk);
-                return false;
-        }
+        if (unlikely(!msg_isdata(hdr)))
+                tipc_sk_proto_rcv(sk, &inputq, xmitq);
 
-        /* Drop if illegal message type */
-        if (unlikely(msg_type(hdr) > TIPC_DIRECT_MSG)) {
-                kfree_skb(skb);
-                return false;
-        }
+        if (unlikely(grp))
+                tipc_group_filter_msg(grp, &inputq, xmitq);
 
-        /* Reject if wrong message type for current socket state */
-        if (tipc_sk_type_connectionless(sk)) {
-                if (msg_connected(hdr)) {
+        /* Validate and add to receive buffer if there is space */
+        while ((skb = __skb_dequeue(&inputq))) {
+                hdr = buf_msg(skb);
+                limit = rcvbuf_limit(sk, skb);
+                if ((sk_conn && !tipc_sk_filter_connect(tsk, skb)) ||
+                    (!sk_conn && msg_connected(hdr)) ||
+                    (!grp && msg_in_group(hdr)))
                         err = TIPC_ERR_NO_PORT;
-                        goto reject;
-                }
-        } else if (unlikely(!filter_connect(tsk, skb))) {
-                err = TIPC_ERR_NO_PORT;
-                goto reject;
-        }
+                else if (sk_rmem_alloc_get(sk) + skb->truesize >= limit)
+                        err = TIPC_ERR_OVERLOAD;
 
-        /* Reject message if there isn't room to queue it */
-        if (unlikely(sk_rmem_alloc_get(sk) + skb->truesize >= limit)) {
-                err = TIPC_ERR_OVERLOAD;
-                goto reject;
+                if (unlikely(err)) {
+                        tipc_skb_reject(net, err, skb, xmitq);
+                        err = TIPC_OK;
+                        continue;
+                }
+                __skb_queue_tail(&sk->sk_receive_queue, skb);
+                skb_set_owner_r(skb, sk);
+                sk->sk_data_ready(sk);
         }
-
-        /* Enqueue message */
-        TIPC_SKB_CB(skb)->bytes_read = 0;
-        __skb_queue_tail(&sk->sk_receive_queue, skb);
-        skb_set_owner_r(skb, sk);
-
-        sk->sk_data_ready(sk);
-        return true;
-
-reject:
-        if (tipc_msg_reverse(tsk_own_node(tsk), &skb, err))
-                __skb_queue_tail(xmitq, skb);
-        return false;
 }
 
 /**
- * tipc_backlog_rcv - handle incoming message from backlog queue
+ * tipc_sk_backlog_rcv - handle incoming message from backlog queue
  * @sk: socket
  * @skb: message
  *
  * Caller must hold socket lock
- *
- * Returns 0
  */
-static int tipc_backlog_rcv(struct sock *sk, struct sk_buff *skb)
+static int tipc_sk_backlog_rcv(struct sock *sk, struct sk_buff *skb)
 {
-        unsigned int truesize = skb->truesize;
+        unsigned int before = sk_rmem_alloc_get(sk);
         struct sk_buff_head xmitq;
-        u32 dnode, selector;
+        unsigned int added;
 
         __skb_queue_head_init(&xmitq);
 
-        if (likely(filter_rcv(sk, skb, &xmitq))) {
-                atomic_add(truesize, &tipc_sk(sk)->dupl_rcvcnt);
-                return 0;
-        }
+        tipc_sk_filter_rcv(sk, skb, &xmitq);
+        added = sk_rmem_alloc_get(sk) - before;
+        atomic_add(added, &tipc_sk(sk)->dupl_rcvcnt);
 
-        if (skb_queue_empty(&xmitq))
-                return 0;
-
-        /* Send response/rejected message */
-        skb = __skb_dequeue(&xmitq);
-        dnode = msg_destnode(buf_msg(skb));
-        selector = msg_origport(buf_msg(skb));
-        tipc_node_xmit_skb(sock_net(sk), skb, dnode, selector);
+        /* Send pending response/rejected messages, if any */
+        tipc_node_distr_xmit(sock_net(sk), &xmitq);
         return 0;
 }
 
@@ -1786,7 +2175,7 @@ static void tipc_sk_enqueue(struct sk_buff_head *inputq, struct sock *sk,
 
                 /* Add message directly to receive queue if possible */
                 if (!sock_owned_by_user(sk)) {
-                        filter_rcv(sk, skb, xmitq);
+                        tipc_sk_filter_rcv(sk, skb, xmitq);
                         continue;
                 }
 
@@ -1833,14 +2222,10 @@ void tipc_sk_rcv(struct net *net, struct sk_buff_head *inputq)
                                 spin_unlock_bh(&sk->sk_lock.slock);
                         }
                         /* Send pending response/rejected messages, if any */
-                        while ((skb = __skb_dequeue(&xmitq))) {
-                                dnode = msg_destnode(buf_msg(skb));
-                                tipc_node_xmit_skb(net, skb, dnode, dport);
-                        }
+                        tipc_node_distr_xmit(sock_net(sk), &xmitq);
                         sock_put(sk);
                         continue;
                 }
-
                 /* No destination socket => dequeue skb if still there */
                 skb = tipc_skb_dequeue(inputq, dport);
                 if (!skb)
@@ -1903,28 +2288,32 @@ static int tipc_connect(struct socket *sock, struct sockaddr *dest,
         int previous;
         int res = 0;
 
+        if (destlen != sizeof(struct sockaddr_tipc))
+                return -EINVAL;
+
         lock_sock(sk);
 
-        /* DGRAM/RDM connect(), just save the destaddr */
-        if (tipc_sk_type_connectionless(sk)) {
-                if (dst->family == AF_UNSPEC) {
-                        memset(&tsk->peer, 0, sizeof(struct sockaddr_tipc));
-                } else if (destlen != sizeof(struct sockaddr_tipc)) {
-                        res = -EINVAL;
-                } else {
-                        memcpy(&tsk->peer, dest, destlen);
-                }
+        if (tsk->group) {
+                res = -EINVAL;
                 goto exit;
         }
 
-        /*
-         * Reject connection attempt using multicast address
-         *
-         * Note: send_msg() validates the rest of the address fields,
-         *       so there's no need to do it here
-         */
-        if (dst->addrtype == TIPC_ADDR_MCAST) {
+        if (dst->family == AF_UNSPEC) {
+                memset(&tsk->peer, 0, sizeof(struct sockaddr_tipc));
+                if (!tipc_sk_type_connectionless(sk))
+                        res = -EINVAL;
+                goto exit;
+        } else if (dst->family != AF_TIPC) {
                 res = -EINVAL;
+        }
+        if (dst->addrtype != TIPC_ADDR_ID && dst->addrtype != TIPC_ADDR_NAME)
+                res = -EINVAL;
+        if (res)
+                goto exit;
+
+        /* DGRAM/RDM connect(), just save the destaddr */
+        if (tipc_sk_type_connectionless(sk)) {
+                memcpy(&tsk->peer, dest, destlen);
                 goto exit;
         }
 
@@ -2141,46 +2530,43 @@ static int tipc_shutdown(struct socket *sock, int how)
         return res;
 }
 
-static void tipc_sk_timeout(unsigned long data)
+static void tipc_sk_timeout(struct timer_list *t)
 {
-        struct tipc_sock *tsk = (struct tipc_sock *)data;
-        struct sock *sk = &tsk->sk;
-        struct sk_buff *skb = NULL;
-        u32 peer_port, peer_node;
+        struct sock *sk = from_timer(sk, t, sk_timer);
+        struct tipc_sock *tsk = tipc_sk(sk);
+        u32 peer_port = tsk_peer_port(tsk);
+        u32 peer_node = tsk_peer_node(tsk);
         u32 own_node = tsk_own_node(tsk);
+        u32 own_port = tsk->portid;
+        struct net *net = sock_net(sk);
+        struct sk_buff *skb = NULL;
 
         bh_lock_sock(sk);
-        if (!tipc_sk_connected(sk)) {
-                bh_unlock_sock(sk);
+        if (!tipc_sk_connected(sk))
+                goto exit;
+
+        /* Try again later if socket is busy */
+        if (sock_owned_by_user(sk)) {
+                sk_reset_timer(sk, &sk->sk_timer, jiffies + HZ / 20);
                 goto exit;
         }
-        peer_port = tsk_peer_port(tsk);
-        peer_node = tsk_peer_node(tsk);
 
         if (tsk->probe_unacked) {
-                if (!sock_owned_by_user(sk)) {
-                        tipc_set_sk_state(sk, TIPC_DISCONNECTING);
-                        tipc_node_remove_conn(sock_net(sk), tsk_peer_node(tsk),
-                                              tsk_peer_port(tsk));
-                        sk->sk_state_change(sk);
-                } else {
-                        /* Try again later */
-                        sk_reset_timer(sk, &sk->sk_timer, (HZ / 20));
-                }
-
-                bh_unlock_sock(sk);
+                tipc_set_sk_state(sk, TIPC_DISCONNECTING);
+                tipc_node_remove_conn(net, peer_node, peer_port);
+                sk->sk_state_change(sk);
                 goto exit;
         }
-
-        skb = tipc_msg_create(CONN_MANAGER, CONN_PROBE,
-                              INT_H_SIZE, 0, peer_node, own_node,
-                              peer_port, tsk->portid, TIPC_OK);
+        /* Send new probe */
+        skb = tipc_msg_create(CONN_MANAGER, CONN_PROBE, INT_H_SIZE, 0,
+                              peer_node, own_node, peer_port, own_port,
+                              TIPC_OK);
         tsk->probe_unacked = true;
-        sk_reset_timer(sk, &sk->sk_timer, jiffies + CONN_PROBING_INTERVAL);
+        sk_reset_timer(sk, &sk->sk_timer, jiffies + CONN_PROBING_INTV);
+exit:
         bh_unlock_sock(sk);
         if (skb)
-                tipc_node_xmit_skb(sock_net(sk), skb, peer_node, tsk->portid);
-exit:
+                tipc_node_xmit_skb(net, skb, peer_node, own_port);
         sock_put(sk);
 }
 
@@ -2345,6 +2731,58 @@ void tipc_sk_rht_destroy(struct net *net)
         rhashtable_destroy(&tn->sk_rht);
 }
 
+static int tipc_sk_join(struct tipc_sock *tsk, struct tipc_group_req *mreq)
+{
+        struct net *net = sock_net(&tsk->sk);
+        u32 domain = addr_domain(net, mreq->scope);
+        struct tipc_group *grp = tsk->group;
+        struct tipc_msg *hdr = &tsk->phdr;
+        struct tipc_name_seq seq;
+        int rc;
+
+        if (mreq->type < TIPC_RESERVED_TYPES)
+                return -EACCES;
+        if (grp)
+                return -EACCES;
+        grp = tipc_group_create(net, tsk->portid, mreq);
+        if (!grp)
+                return -ENOMEM;
+        tsk->group = grp;
+        msg_set_lookup_scope(hdr, mreq->scope);
+        msg_set_nametype(hdr, mreq->type);
+        msg_set_dest_droppable(hdr, true);
+        seq.type = mreq->type;
+        seq.lower = mreq->instance;
+        seq.upper = seq.lower;
+        tipc_nametbl_build_group(net, grp, mreq->type, domain);
+        rc = tipc_sk_publish(tsk, mreq->scope, &seq);
+        if (rc) {
+                tipc_group_delete(net, grp);
+                tsk->group = NULL;
+        }
+
+        /* Eliminate any risk that a broadcast overtakes the sent JOIN */
+        tsk->mc_method.rcast = true;
+        tsk->mc_method.mandatory = true;
+        return rc;
+}
+
+static int tipc_sk_leave(struct tipc_sock *tsk)
+{
+        struct net *net = sock_net(&tsk->sk);
+        struct tipc_group *grp = tsk->group;
+        struct tipc_name_seq seq;
+        int scope;
+
+        if (!grp)
+                return -EINVAL;
+        tipc_group_self(grp, &seq, &scope);
+        tipc_group_delete(net, grp);
+        tsk->group = NULL;
+        tipc_sk_withdraw(tsk, scope, &seq);
+        return 0;
+}
+
 /**
  * tipc_setsockopt - set socket option
  * @sock: socket structure
@@ -2363,6 +2801,7 @@ static int tipc_setsockopt(struct socket *sock, int lvl, int opt,
 {
         struct sock *sk = sock->sk;
         struct tipc_sock *tsk = tipc_sk(sk);
+        struct tipc_group_req mreq;
         u32 value = 0;
         int res = 0;
 
@@ -2378,9 +2817,14 @@ static int tipc_setsockopt(struct socket *sock, int lvl, int opt,
         case TIPC_CONN_TIMEOUT:
                 if (ol < sizeof(value))
                         return -EINVAL;
-                res = get_user(value, (u32 __user *)ov);
-                if (res)
-                        return res;
+                if (get_user(value, (u32 __user *)ov))
+                        return -EFAULT;
+                break;
+        case TIPC_GROUP_JOIN:
+                if (ol < sizeof(mreq))
+                        return -EINVAL;
+                if (copy_from_user(&mreq, ov, sizeof(mreq)))
+                        return -EFAULT;
                 break;
         default:
                 if (ov || ol)
@@ -2413,6 +2857,12 @@ static int tipc_setsockopt(struct socket *sock, int lvl, int opt,
                 tsk->mc_method.rcast = true;
                 tsk->mc_method.mandatory = true;
                 break;
+        case TIPC_GROUP_JOIN:
+                res = tipc_sk_join(tsk, &mreq);
+                break;
+        case TIPC_GROUP_LEAVE:
+                res = tipc_sk_leave(tsk);
+                break;
         default:
                 res = -EINVAL;
         }
@@ -2440,7 +2890,8 @@ static int tipc_getsockopt(struct socket *sock, int lvl, int opt,
 {
         struct sock *sk = sock->sk;
         struct tipc_sock *tsk = tipc_sk(sk);
-        int len;
+        struct tipc_name_seq seq;
+        int len, scope;
         u32 value;
         int res;
 
@@ -2474,6 +2925,12 @@ static int tipc_getsockopt(struct socket *sock, int lvl, int opt,
         case TIPC_SOCK_RECVQ_DEPTH:
                 value = skb_queue_len(&sk->sk_receive_queue);
                 break;
+        case TIPC_GROUP_JOIN:
+                seq.type = 0;
+                if (tsk->group)
+                        tipc_group_self(tsk->group, &seq, &scope);
+                value = seq.type;
+                break;
         default:
                 res = -EINVAL;
         }
diff --git a/net/tipc/subscr.c b/net/tipc/subscr.c
index be3d9e3183dc..251065dfd8df 100644
--- a/net/tipc/subscr.c
+++ b/net/tipc/subscr.c
@@ -133,9 +133,9 @@ void tipc_subscrp_report_overlap(struct tipc_subscription *sub, u32 found_lower,
                                 node);
 }
 
-static void tipc_subscrp_timeout(unsigned long data)
+static void tipc_subscrp_timeout(struct timer_list *t)
 {
-        struct tipc_subscription *sub = (struct tipc_subscription *)data;
+        struct tipc_subscription *sub = from_timer(sub, t, timer);
         struct tipc_subscriber *subscriber = sub->subscriber;
 
         spin_lock_bh(&subscriber->lock);
@@ -303,7 +303,7 @@ static void tipc_subscrp_subscribe(struct net *net, struct tipc_subscr *s,
         tipc_subscrb_get(subscriber);
         spin_unlock_bh(&subscriber->lock);
 
-        setup_timer(&sub->timer, tipc_subscrp_timeout, (unsigned long)sub);
+        timer_setup(&sub->timer, tipc_subscrp_timeout, 0);
         timeout = htohl(sub->evt.s.timeout, swap);
 
         if (timeout != TIPC_WAIT_FOREVER)
diff --git a/net/tls/tls_main.c b/net/tls/tls_main.c
index 60aff60e30ad..e07ee3ae0023 100644
--- a/net/tls/tls_main.c
+++ b/net/tls/tls_main.c
@@ -45,8 +45,18 @@ MODULE_AUTHOR("Mellanox Technologies");
 MODULE_DESCRIPTION("Transport Layer Security Support");
 MODULE_LICENSE("Dual BSD/GPL");
 
-static struct proto tls_base_prot;
-static struct proto tls_sw_prot;
+enum {
+        TLS_BASE_TX,
+        TLS_SW_TX,
+        TLS_NUM_CONFIG,
+};
+
+static struct proto tls_prots[TLS_NUM_CONFIG];
+
+static inline void update_sk_prot(struct sock *sk, struct tls_context *ctx)
+{
+        sk->sk_prot = &tls_prots[ctx->tx_conf];
+}
 
 int wait_on_pending_writer(struct sock *sk, long *timeo)
 {
@@ -216,6 +226,12 @@ static void tls_sk_proto_close(struct sock *sk, long timeout)
         void (*sk_proto_close)(struct sock *sk, long timeout);
 
         lock_sock(sk);
+        sk_proto_close = ctx->sk_proto_close;
+
+        if (ctx->tx_conf == TLS_BASE_TX) {
+                kfree(ctx);
+                goto skip_tx_cleanup;
+        }
 
         if (!tls_complete_pending_work(sk, ctx, 0, &timeo))
                 tls_handle_open_record(sk, 0);
@@ -232,13 +248,14 @@ static void tls_sk_proto_close(struct sock *sk, long timeout)
                         sg++;
                 }
         }
-        ctx->free_resources(sk);
+
         kfree(ctx->rec_seq);
         kfree(ctx->iv);
 
-        sk_proto_close = ctx->sk_proto_close;
-        kfree(ctx);
+        if (ctx->tx_conf == TLS_SW_TX)
+                tls_sw_free_tx_resources(sk);
 
+skip_tx_cleanup:
         release_sock(sk);
         sk_proto_close(sk, timeout);
 }
@@ -338,46 +355,41 @@ static int tls_getsockopt(struct sock *sk, int level, int optname,
 static int do_tls_setsockopt_tx(struct sock *sk, char __user *optval,
                                 unsigned int optlen)
 {
-        struct tls_crypto_info *crypto_info, tmp_crypto_info;
+        struct tls_crypto_info *crypto_info;
         struct tls_context *ctx = tls_get_ctx(sk);
-        struct proto *prot = NULL;
         int rc = 0;
+        int tx_conf;
 
         if (!optval || (optlen < sizeof(*crypto_info))) {
                 rc = -EINVAL;
                 goto out;
         }
 
-        rc = copy_from_user(&tmp_crypto_info, optval, sizeof(*crypto_info));
+        crypto_info = &ctx->crypto_send;
+        /* Currently we don't support set crypto info more than one time */
+        if (TLS_CRYPTO_INFO_READY(crypto_info))
+                goto out;
+
+        rc = copy_from_user(crypto_info, optval, sizeof(*crypto_info));
         if (rc) {
                 rc = -EFAULT;
                 goto out;
         }
 
         /* check version */
-        if (tmp_crypto_info.version != TLS_1_2_VERSION) {
+        if (crypto_info->version != TLS_1_2_VERSION) {
                 rc = -ENOTSUPP;
-                goto out;
+                goto err_crypto_info;
         }
 
-        /* get user crypto info */
-        crypto_info = &ctx->crypto_send;
-
-        /* Currently we don't support set crypto info more than one time */
-        if (TLS_CRYPTO_INFO_READY(crypto_info))
-                goto out;
-
-        switch (tmp_crypto_info.cipher_type) {
+        switch (crypto_info->cipher_type) {
         case TLS_CIPHER_AES_GCM_128: {
                 if (optlen != sizeof(struct tls12_crypto_info_aes_gcm_128)) {
                         rc = -EINVAL;
                         goto out;
                 }
-                rc = copy_from_user(
-                  crypto_info,
-                  optval,
-                  sizeof(struct tls12_crypto_info_aes_gcm_128));
-
+                rc = copy_from_user(crypto_info + 1, optval + sizeof(*crypto_info),
+                                    optlen - sizeof(*crypto_info));
                 if (rc) {
                         rc = -EFAULT;
                         goto err_crypto_info;
@@ -389,18 +401,16 @@ static int do_tls_setsockopt_tx(struct sock *sk, char __user *optval,
                 goto out;
         }
 
-        ctx->sk_write_space = sk->sk_write_space;
-        sk->sk_write_space = tls_write_space;
-
-        ctx->sk_proto_close = sk->sk_prot->close;
-
         /* currently SW is default, we will have ethtool in future */
         rc = tls_set_sw_offload(sk, ctx);
-        prot = &tls_sw_prot;
+        tx_conf = TLS_SW_TX;
         if (rc)
                 goto err_crypto_info;
 
-        sk->sk_prot = prot;
+        ctx->tx_conf = tx_conf;
+        update_sk_prot(sk, ctx);
+        ctx->sk_write_space = sk->sk_write_space;
+        sk->sk_write_space = tls_write_space;
         goto out;
 
 err_crypto_info:
@@ -453,7 +463,10 @@ static int tls_init(struct sock *sk)
         icsk->icsk_ulp_data = ctx;
         ctx->setsockopt = sk->sk_prot->setsockopt;
         ctx->getsockopt = sk->sk_prot->getsockopt;
-        sk->sk_prot = &tls_base_prot;
+        ctx->sk_proto_close = sk->sk_prot->close;
+
+        ctx->tx_conf = TLS_BASE_TX;
+        update_sk_prot(sk, ctx);
 out:
         return rc;
 }
@@ -464,16 +477,21 @@ static struct tcp_ulp_ops tcp_tls_ulp_ops __read_mostly = {
         .init                   = tls_init,
 };
 
+static void build_protos(struct proto *prot, struct proto *base)
+{
+        prot[TLS_BASE_TX] = *base;
+        prot[TLS_BASE_TX].setsockopt    = tls_setsockopt;
+        prot[TLS_BASE_TX].getsockopt    = tls_getsockopt;
+        prot[TLS_BASE_TX].close         = tls_sk_proto_close;
+
+        prot[TLS_SW_TX] = prot[TLS_BASE_TX];
+        prot[TLS_SW_TX].sendmsg         = tls_sw_sendmsg;
+        prot[TLS_SW_TX].sendpage        = tls_sw_sendpage;
+}
+
 static int __init tls_register(void)
 {
-        tls_base_prot                   = tcp_prot;
-        tls_base_prot.setsockopt        = tls_setsockopt;
-        tls_base_prot.getsockopt        = tls_getsockopt;
-
-        tls_sw_prot                     = tls_base_prot;
-        tls_sw_prot.sendmsg             = tls_sw_sendmsg;
-        tls_sw_prot.sendpage            = tls_sw_sendpage;
-        tls_sw_prot.close               = tls_sk_proto_close;
+        build_protos(tls_prots, &tcp_prot);
 
         tcp_register_ulp(&tcp_tls_ulp_ops);
 
diff --git a/net/tls/tls_sw.c b/net/tls/tls_sw.c
index 7d80040a37b6..73d19210dd49 100644
--- a/net/tls/tls_sw.c
+++ b/net/tls/tls_sw.c
@@ -39,22 +39,6 @@
 
 #include <net/tls.h>
 
-static inline void tls_make_aad(int recv,
-                                char *buf,
-                                size_t size,
-                                char *record_sequence,
-                                int record_sequence_size,
-                                unsigned char record_type)
-{
-        memcpy(buf, record_sequence, record_sequence_size);
-
-        buf[8] = record_type;
-        buf[9] = TLS_1_2_VERSION_MAJOR;
-        buf[10] = TLS_1_2_VERSION_MINOR;
-        buf[11] = size >> 8;
-        buf[12] = size & 0xFF;
-}
-
 static void trim_sg(struct sock *sk, struct scatterlist *sg,
                     int *sg_num_elem, unsigned int *sg_size, int target_size)
 {
@@ -219,7 +203,7 @@ static int tls_do_encryption(struct tls_context *tls_ctx,
         struct aead_request *aead_req;
         int rc;
 
-        aead_req = kmalloc(req_size, flags);
+        aead_req = kzalloc(req_size, flags);
         if (!aead_req)
                 return -ENOMEM;
 
@@ -249,7 +233,7 @@ static int tls_push_record(struct sock *sk, int flags,
         sg_mark_end(ctx->sg_plaintext_data + ctx->sg_plaintext_num_elem - 1);
         sg_mark_end(ctx->sg_encrypted_data + ctx->sg_encrypted_num_elem - 1);
 
-        tls_make_aad(0, ctx->aad_space, ctx->sg_plaintext_size,
+        tls_make_aad(ctx->aad_space, ctx->sg_plaintext_size,
                      tls_ctx->rec_seq, tls_ctx->rec_seq_size,
                      record_type);
 
@@ -639,7 +623,7 @@ sendpage_end:
         return ret;
 }
 
-static void tls_sw_free_resources(struct sock *sk)
+void tls_sw_free_tx_resources(struct sock *sk)
 {
         struct tls_context *tls_ctx = tls_get_ctx(sk);
         struct tls_sw_context *ctx = tls_sw_ctx(tls_ctx);
@@ -650,6 +634,7 @@ static void tls_sw_free_resources(struct sock *sk)
         tls_free_both_sg(sk);
 
         kfree(ctx);
+        kfree(tls_ctx);
 }
 
 int tls_set_sw_offload(struct sock *sk, struct tls_context *ctx)
@@ -679,7 +664,6 @@ int tls_set_sw_offload(struct sock *sk, struct tls_context *ctx)
         }
 
         ctx->priv_ctx = (struct tls_offload_context *)sw_ctx;
-        ctx->free_resources = tls_sw_free_resources;
 
         crypto_info = &ctx->crypto_send;
         switch (crypto_info->cipher_type) {
diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
index 7f46bab4ce5c..a9ee634f3c42 100644
--- a/net/unix/af_unix.c
+++ b/net/unix/af_unix.c
@@ -814,6 +814,7 @@ static int unix_create(struct net *net, struct socket *sock, int protocol,
                  */
         case SOCK_RAW:
                 sock->type = SOCK_DGRAM;
+                /* fall through */
         case SOCK_DGRAM:
                 sock->ops = &unix_dgram_ops;
                 break;
diff --git a/net/vmw_vsock/Kconfig b/net/vmw_vsock/Kconfig
index a24369d175fd..970f96489fe7 100644
--- a/net/vmw_vsock/Kconfig
+++ b/net/vmw_vsock/Kconfig
@@ -15,6 +15,16 @@ config VSOCKETS
           To compile this driver as a module, choose M here: the module
           will be called vsock. If unsure, say N.
 
+config VSOCKETS_DIAG
+        tristate "Virtual Sockets monitoring interface"
+        depends on VSOCKETS
+        default y
+        help
+          Support for PF_VSOCK sockets monitoring interface used by the ss tool.
+          If unsure, say Y.
+
+          Enable this module so userspace applications can query open sockets.
+
 config VMWARE_VMCI_VSOCKETS
         tristate "VMware VMCI transport for Virtual Sockets"
         depends on VSOCKETS && VMWARE_VMCI
diff --git a/net/vmw_vsock/Makefile b/net/vmw_vsock/Makefile
index 30a263320e4f..7c6f9a0b67b0 100644
--- a/net/vmw_vsock/Makefile
+++ b/net/vmw_vsock/Makefile
@@ -1,5 +1,6 @@
 # SPDX-License-Identifier: GPL-2.0
 obj-$(CONFIG_VSOCKETS) += vsock.o
+obj-$(CONFIG_VSOCKETS_DIAG) += vsock_diag.o
 obj-$(CONFIG_VMWARE_VMCI_VSOCKETS) += vmw_vsock_vmci_transport.o
 obj-$(CONFIG_VIRTIO_VSOCKETS) += vmw_vsock_virtio_transport.o
 obj-$(CONFIG_VIRTIO_VSOCKETS_COMMON) += vmw_vsock_virtio_transport_common.o
@@ -7,6 +8,8 @@ obj-$(CONFIG_HYPERV_VSOCKETS) += hv_sock.o
 
 vsock-y += af_vsock.o af_vsock_tap.o vsock_addr.o
 
+vsock_diag-y += diag.o
+
 vmw_vsock_vmci_transport-y += vmci_transport.o vmci_transport_notify.o \
         vmci_transport_notify_qstate.o
 
diff --git a/net/vmw_vsock/af_vsock.c b/net/vmw_vsock/af_vsock.c
index dfc8c51e4d74..5d28abf87fbf 100644
--- a/net/vmw_vsock/af_vsock.c
+++ b/net/vmw_vsock/af_vsock.c
@@ -36,7 +36,7 @@
  * not support simultaneous connects (two "client" sockets connecting).
  *
  * - "Server" sockets are referred to as listener sockets throughout this
- * implementation because they are in the VSOCK_SS_LISTEN state.  When a
+ * implementation because they are in the TCP_LISTEN state.  When a
  * connection request is received (the second kind of socket mentioned above),
  * we create a new socket and refer to it as a pending socket.  These pending
  * sockets are placed on the pending connection list of the listener socket.
@@ -82,6 +82,15 @@
  * argument, we must ensure the reference count is increased to ensure the
  * socket isn't freed before the function is run; the deferred function will
  * then drop the reference.
+ *
+ * - sk->sk_state uses the TCP state constants because they are widely used by
+ * other address families and exposed to userspace tools like ss(8):
+ *
+ *   TCP_CLOSE - unconnected
+ *   TCP_SYN_SENT - connecting
+ *   TCP_ESTABLISHED - connected
+ *   TCP_CLOSING - disconnecting
+ *   TCP_LISTEN - listening
  */
 
 #include <linux/types.h>
@@ -153,7 +162,6 @@ EXPORT_SYMBOL_GPL(vm_sockets_get_local_cid);
  * vsock_bind_table[VSOCK_HASH_SIZE] is for unbound sockets.  The hash function
  * mods with VSOCK_HASH_SIZE to ensure this.
  */
-#define VSOCK_HASH_SIZE         251
 #define MAX_PORT_RETRIES        24
 
 #define VSOCK_HASH(addr)        ((addr)->svm_port % VSOCK_HASH_SIZE)
@@ -168,9 +176,12 @@ EXPORT_SYMBOL_GPL(vm_sockets_get_local_cid);
 #define vsock_connected_sockets_vsk(vsk)                                \
         vsock_connected_sockets(&(vsk)->remote_addr, &(vsk)->local_addr)
 
-static struct list_head vsock_bind_table[VSOCK_HASH_SIZE + 1];
-static struct list_head vsock_connected_table[VSOCK_HASH_SIZE];
-static DEFINE_SPINLOCK(vsock_table_lock);
+struct list_head vsock_bind_table[VSOCK_HASH_SIZE + 1];
+EXPORT_SYMBOL_GPL(vsock_bind_table);
+struct list_head vsock_connected_table[VSOCK_HASH_SIZE];
+EXPORT_SYMBOL_GPL(vsock_connected_table);
+DEFINE_SPINLOCK(vsock_table_lock);
+EXPORT_SYMBOL_GPL(vsock_table_lock);
 
 /* Autobind this socket to the local address if necessary. */
 static int vsock_auto_bind(struct vsock_sock *vsk)
@@ -184,7 +195,7 @@ static int vsock_auto_bind(struct vsock_sock *vsk)
         return __vsock_bind(sk, &local_addr);
 }
 
-static void vsock_init_tables(void)
+static int __init vsock_init_tables(void)
 {
         int i;
 
@@ -193,6 +204,7 @@ static void vsock_init_tables(void)
 
         for (i = 0; i < ARRAY_SIZE(vsock_connected_table); i++)
                 INIT_LIST_HEAD(&vsock_connected_table[i]);
+        return 0;
 }
 
 static void __vsock_insert_bound(struct list_head *list,
@@ -248,16 +260,6 @@ static struct sock *__vsock_find_connected_socket(struct sockaddr_vm *src,
         return NULL;
 }
 
-static bool __vsock_in_bound_table(struct vsock_sock *vsk)
-{
-        return !list_empty(&vsk->bound_table);
-}
-
-static bool __vsock_in_connected_table(struct vsock_sock *vsk)
-{
-        return !list_empty(&vsk->connected_table);
-}
-
 static void vsock_insert_unbound(struct vsock_sock *vsk)
 {
         spin_lock_bh(&vsock_table_lock);
@@ -485,7 +487,7 @@ void vsock_pending_work(struct work_struct *work)
         if (vsock_in_connected_table(vsk))
                 vsock_remove_connected(vsk);
 
-        sk->sk_state = SS_FREE;
+        sk->sk_state = TCP_CLOSE;
 
 out:
         release_sock(sk);
@@ -625,7 +627,6 @@ struct sock *__vsock_create(struct net *net,
 
         sk->sk_destruct = vsock_sk_destruct;
         sk->sk_backlog_rcv = vsock_queue_rcv_skb;
-        sk->sk_state = 0;
         sock_reset_flag(sk, SOCK_DONE);
 
         INIT_LIST_HEAD(&vsk->bound_table);
@@ -899,7 +900,7 @@ static unsigned int vsock_poll(struct file *file, struct socket *sock,
                 /* Listening sockets that have connections in their accept
                  * queue can be read.
                  */
-                if (sk->sk_state == VSOCK_SS_LISTEN
+                if (sk->sk_state == TCP_LISTEN
                     && !vsock_is_accept_queue_empty(sk))
                         mask |= POLLIN | POLLRDNORM;
 
@@ -928,7 +929,7 @@ static unsigned int vsock_poll(struct file *file, struct socket *sock,
                 }
 
                 /* Connected sockets that can produce data can be written. */
-                if (sk->sk_state == SS_CONNECTED) {
+                if (sk->sk_state == TCP_ESTABLISHED) {
                         if (!(sk->sk_shutdown & SEND_SHUTDOWN)) {
                                 bool space_avail_now = false;
                                 int ret = transport->notify_poll_out(
@@ -950,7 +951,7 @@ static unsigned int vsock_poll(struct file *file, struct socket *sock,
                  * POLLOUT|POLLWRNORM when peer is closed and nothing to read,
                  * but local send is not shutdown.
                  */
-                if (sk->sk_state == SS_UNCONNECTED) {
+                if (sk->sk_state == TCP_CLOSE) {
                         if (!(sk->sk_shutdown & SEND_SHUTDOWN))
                                 mask |= POLLOUT | POLLWRNORM;
 
@@ -1120,9 +1121,9 @@ static void vsock_connect_timeout(struct work_struct *work)
         sk = sk_vsock(vsk);
 
         lock_sock(sk);
-        if (sk->sk_state == SS_CONNECTING &&
+        if (sk->sk_state == TCP_SYN_SENT &&
             (sk->sk_shutdown != SHUTDOWN_MASK)) {
-                sk->sk_state = SS_UNCONNECTED;
+                sk->sk_state = TCP_CLOSE;
                 sk->sk_err = ETIMEDOUT;
                 sk->sk_error_report(sk);
                 cancel = 1;
@@ -1168,7 +1169,7 @@ static int vsock_stream_connect(struct socket *sock, struct sockaddr *addr,
                 err = -EALREADY;
                 break;
         default:
-                if ((sk->sk_state == VSOCK_SS_LISTEN) ||
+                if ((sk->sk_state == TCP_LISTEN) ||
                     vsock_addr_cast(addr, addr_len, &remote_addr) != 0) {
                         err = -EINVAL;
                         goto out;
@@ -1191,7 +1192,7 @@ static int vsock_stream_connect(struct socket *sock, struct sockaddr *addr,
                 if (err)
                         goto out;
 
-                sk->sk_state = SS_CONNECTING;
+                sk->sk_state = TCP_SYN_SENT;
 
                 err = transport->connect(vsk);
                 if (err < 0)
@@ -1211,7 +1212,7 @@ static int vsock_stream_connect(struct socket *sock, struct sockaddr *addr,
         timeout = vsk->connect_timeout;
         prepare_to_wait(sk_sleep(sk), &wait, TASK_INTERRUPTIBLE);
 
-        while (sk->sk_state != SS_CONNECTED && sk->sk_err == 0) {
+        while (sk->sk_state != TCP_ESTABLISHED && sk->sk_err == 0) {
                 if (flags & O_NONBLOCK) {
                         /* If we're not going to block, we schedule a timeout
                          * function to generate a timeout on the connection
@@ -1234,13 +1235,13 @@ static int vsock_stream_connect(struct socket *sock, struct sockaddr *addr,
 
                 if (signal_pending(current)) {
                         err = sock_intr_errno(timeout);
-                        sk->sk_state = SS_UNCONNECTED;
+                        sk->sk_state = TCP_CLOSE;
                         sock->state = SS_UNCONNECTED;
                         vsock_transport_cancel_pkt(vsk);
                         goto out_wait;
                 } else if (timeout == 0) {
                         err = -ETIMEDOUT;
-                        sk->sk_state = SS_UNCONNECTED;
+                        sk->sk_state = TCP_CLOSE;
                         sock->state = SS_UNCONNECTED;
                         vsock_transport_cancel_pkt(vsk);
                         goto out_wait;
@@ -1251,7 +1252,7 @@ static int vsock_stream_connect(struct socket *sock, struct sockaddr *addr,
 
         if (sk->sk_err) {
                 err = -sk->sk_err;
-                sk->sk_state = SS_UNCONNECTED;
+                sk->sk_state = TCP_CLOSE;
                 sock->state = SS_UNCONNECTED;
         } else {
                 err = 0;
@@ -1284,7 +1285,7 @@ static int vsock_accept(struct socket *sock, struct socket *newsock, int flags,
                 goto out;
         }
 
-        if (listener->sk_state != VSOCK_SS_LISTEN) {
+        if (listener->sk_state != TCP_LISTEN) {
                 err = -EINVAL;
                 goto out;
         }
@@ -1374,7 +1375,7 @@ static int vsock_listen(struct socket *sock, int backlog)
         }
 
         sk->sk_max_ack_backlog = backlog;
-        sk->sk_state = VSOCK_SS_LISTEN;
+        sk->sk_state = TCP_LISTEN;
 
         err = 0;
 
@@ -1554,7 +1555,7 @@ static int vsock_stream_sendmsg(struct socket *sock, struct msghdr *msg,
 
         /* Callers should not provide a destination with stream sockets. */
         if (msg->msg_namelen) {
-                err = sk->sk_state == SS_CONNECTED ? -EISCONN : -EOPNOTSUPP;
+                err = sk->sk_state == TCP_ESTABLISHED ? -EISCONN : -EOPNOTSUPP;
                 goto out;
         }
 
@@ -1565,7 +1566,7 @@ static int vsock_stream_sendmsg(struct socket *sock, struct msghdr *msg,
                 goto out;
         }
 
-        if (sk->sk_state != SS_CONNECTED ||
+        if (sk->sk_state != TCP_ESTABLISHED ||
             !vsock_addr_bound(&vsk->local_addr)) {
                 err = -ENOTCONN;
                 goto out;
@@ -1689,7 +1690,7 @@ vsock_stream_recvmsg(struct socket *sock, struct msghdr *msg, size_t len,
 
         lock_sock(sk);
 
-        if (sk->sk_state != SS_CONNECTED) {
+        if (sk->sk_state != TCP_ESTABLISHED) {
                 /* Recvmsg is supposed to return 0 if a peer performs an
                  * orderly shutdown. Differentiate between that case and when a
                  * peer has not connected or a local shutdown occured with the
@@ -1957,8 +1958,6 @@ int __vsock_core_init(const struct vsock_transport *t, struct module *owner)
         vsock_proto.owner = owner;
         transport = t;
 
-        vsock_init_tables();
-
         vsock_device.minor = MISC_DYNAMIC_MINOR;
         err = misc_register(&vsock_device);
         if (err) {
@@ -2019,6 +2018,8 @@ const struct vsock_transport *vsock_core_get_transport(void)
 }
 EXPORT_SYMBOL_GPL(vsock_core_get_transport);
 
+module_init(vsock_init_tables);
+
 MODULE_AUTHOR("VMware, Inc.");
 MODULE_DESCRIPTION("VMware Virtual Socket Family");
 MODULE_VERSION("1.0.2.0-k");
diff --git a/net/vmw_vsock/diag.c b/net/vmw_vsock/diag.c
new file mode 100644
index 000000000000..31b567652250
--- /dev/null
+++ b/net/vmw_vsock/diag.c
@@ -0,0 +1,186 @@
+/*
+ * vsock sock_diag(7) module
+ *
+ * Copyright (C) 2017 Red Hat, Inc.
+ * Author: Stefan Hajnoczi <stefanha@redhat.com>
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the Free
+ * Software Foundation version 2 and no later version.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ */
+
+#include <linux/module.h>
+#include <linux/sock_diag.h>
+#include <linux/vm_sockets_diag.h>
+#include <net/af_vsock.h>
+
+static int sk_diag_fill(struct sock *sk, struct sk_buff *skb,
+                        u32 portid, u32 seq, u32 flags)
+{
+        struct vsock_sock *vsk = vsock_sk(sk);
+        struct vsock_diag_msg *rep;
+        struct nlmsghdr *nlh;
+
+        nlh = nlmsg_put(skb, portid, seq, SOCK_DIAG_BY_FAMILY, sizeof(*rep),
+                        flags);
+        if (!nlh)
+                return -EMSGSIZE;
+
+        rep = nlmsg_data(nlh);
+        rep->vdiag_family = AF_VSOCK;
+
+        /* Lock order dictates that sk_lock is acquired before
+         * vsock_table_lock, so we cannot lock here.  Simply don't take
+         * sk_lock; sk is guaranteed to stay alive since vsock_table_lock is
+         * held.
+         */
+        rep->vdiag_type = sk->sk_type;
+        rep->vdiag_state = sk->sk_state;
+        rep->vdiag_shutdown = sk->sk_shutdown;
+        rep->vdiag_src_cid = vsk->local_addr.svm_cid;
+        rep->vdiag_src_port = vsk->local_addr.svm_port;
+        rep->vdiag_dst_cid = vsk->remote_addr.svm_cid;
+        rep->vdiag_dst_port = vsk->remote_addr.svm_port;
+        rep->vdiag_ino = sock_i_ino(sk);
+
+        sock_diag_save_cookie(sk, rep->vdiag_cookie);
+
+        return 0;
+}
+
+static int vsock_diag_dump(struct sk_buff *skb, struct netlink_callback *cb)
+{
+        struct vsock_diag_req *req;
+        struct vsock_sock *vsk;
+        unsigned int bucket;
+        unsigned int last_i;
+        unsigned int table;
+        struct net *net;
+        unsigned int i;
+
+        req = nlmsg_data(cb->nlh);
+        net = sock_net(skb->sk);
+
+        /* State saved between calls: */
+        table = cb->args[0];
+        bucket = cb->args[1];
+        i = last_i = cb->args[2];
+
+        /* TODO VMCI pending sockets? */
+
+        spin_lock_bh(&vsock_table_lock);
+
+        /* Bind table (locally created sockets) */
+        if (table == 0) {
+                while (bucket < ARRAY_SIZE(vsock_bind_table)) {
+                        struct list_head *head = &vsock_bind_table[bucket];
+
+                        i = 0;
+                        list_for_each_entry(vsk, head, bound_table) {
+                                struct sock *sk = sk_vsock(vsk);
+
+                                if (!net_eq(sock_net(sk), net))
+                                        continue;
+                                if (i < last_i)
+                                        goto next_bind;
+                                if (!(req->vdiag_states & (1 << sk->sk_state)))
+                                        goto next_bind;
+                                if (sk_diag_fill(sk, skb,
+                                                 NETLINK_CB(cb->skb).portid,
+                                                 cb->nlh->nlmsg_seq,
+                                                 NLM_F_MULTI) < 0)
+                                        goto done;
+next_bind:
+                                i++;
+                        }
+                        last_i = 0;
+                        bucket++;
+                }
+
+                table++;
+                bucket = 0;
+        }
+
+        /* Connected table (accepted connections) */
+        while (bucket < ARRAY_SIZE(vsock_connected_table)) {
+                struct list_head *head = &vsock_connected_table[bucket];
+
+                i = 0;
+                list_for_each_entry(vsk, head, connected_table) {
+                        struct sock *sk = sk_vsock(vsk);
+
+                        /* Skip sockets we've already seen above */
+                        if (__vsock_in_bound_table(vsk))
+                                continue;
+
+                        if (!net_eq(sock_net(sk), net))
+                                continue;
+                        if (i < last_i)
+                                goto next_connected;
+                        if (!(req->vdiag_states & (1 << sk->sk_state)))
+                                goto next_connected;
+                        if (sk_diag_fill(sk, skb,
+                                         NETLINK_CB(cb->skb).portid,
+                                         cb->nlh->nlmsg_seq,
+                                         NLM_F_MULTI) < 0)
+                                goto done;
+next_connected:
+                        i++;
+                }
+                last_i = 0;
+                bucket++;
+        }
+
+done:
+        spin_unlock_bh(&vsock_table_lock);
+
+        cb->args[0] = table;
+        cb->args[1] = bucket;
+        cb->args[2] = i;
+
+        return skb->len;
+}
+
+static int vsock_diag_handler_dump(struct sk_buff *skb, struct nlmsghdr *h)
+{
+        int hdrlen = sizeof(struct vsock_diag_req);
+        struct net *net = sock_net(skb->sk);
+
+        if (nlmsg_len(h) < hdrlen)
+                return -EINVAL;
+
+        if (h->nlmsg_flags & NLM_F_DUMP) {
+                struct netlink_dump_control c = {
+                        .dump = vsock_diag_dump,
+                };
+                return netlink_dump_start(net->diag_nlsk, skb, h, &c);
+        }
+
+        return -EOPNOTSUPP;
+}
+
+static const struct sock_diag_handler vsock_diag_handler = {
+        .family = AF_VSOCK,
+        .dump = vsock_diag_handler_dump,
+};
+
+static int __init vsock_diag_init(void)
+{
+        return sock_diag_register(&vsock_diag_handler);
+}
+
+static void __exit vsock_diag_exit(void)
+{
+        sock_diag_unregister(&vsock_diag_handler);
+}
+
+module_init(vsock_diag_init);
+module_exit(vsock_diag_exit);
+MODULE_LICENSE("GPL");
+MODULE_ALIAS_NET_PF_PROTO_TYPE(PF_NETLINK, NETLINK_SOCK_DIAG,
+                               40 /* AF_VSOCK */);
diff --git a/net/vmw_vsock/hyperv_transport.c b/net/vmw_vsock/hyperv_transport.c
index e21991fe883a..5583df708b8c 100644
--- a/net/vmw_vsock/hyperv_transport.c
+++ b/net/vmw_vsock/hyperv_transport.c
@@ -312,7 +312,7 @@ static void hvs_close_connection(struct vmbus_channel *chan)
 
         lock_sock(sk);
 
-        sk->sk_state = SS_UNCONNECTED;
+        sk->sk_state = TCP_CLOSE;
         sock_set_flag(sk, SOCK_DONE);
         vsk->peer_shutdown |= SEND_SHUTDOWN | RCV_SHUTDOWN;
 
@@ -349,9 +349,8 @@ static void hvs_open_connection(struct vmbus_channel *chan)
                 return;
 
         lock_sock(sk);
-
-        if ((conn_from_host && sk->sk_state != VSOCK_SS_LISTEN) ||
-            (!conn_from_host && sk->sk_state != SS_CONNECTING))
+        if ((conn_from_host && sk->sk_state != TCP_LISTEN) ||
+            (!conn_from_host && sk->sk_state != TCP_SYN_SENT))
                 goto out;
 
         if (conn_from_host) {
@@ -363,7 +362,7 @@ static void hvs_open_connection(struct vmbus_channel *chan)
                 if (!new)
                         goto out;
 
-                new->sk_state = SS_CONNECTING;
+                new->sk_state = TCP_SYN_SENT;
                 vnew = vsock_sk(new);
                 hvs_new = vnew->trans;
                 hvs_new->chan = chan;
@@ -390,7 +389,7 @@ static void hvs_open_connection(struct vmbus_channel *chan)
         vmbus_set_chn_rescind_callback(chan, hvs_close_connection);
 
         if (conn_from_host) {
-                new->sk_state = SS_CONNECTED;
+                new->sk_state = TCP_ESTABLISHED;
                 sk->sk_ack_backlog++;
 
                 hvs_addr_init(&vnew->local_addr, if_type);
@@ -403,7 +402,7 @@ static void hvs_open_connection(struct vmbus_channel *chan)
 
                 vsock_enqueue_accept(sk, new);
         } else {
-                sk->sk_state = SS_CONNECTED;
+                sk->sk_state = TCP_ESTABLISHED;
                 sk->sk_socket->state = SS_CONNECTED;
 
                 vsock_insert_connected(vsock_sk(sk));
diff --git a/net/vmw_vsock/virtio_transport.c b/net/vmw_vsock/virtio_transport.c
index 403d86e80162..8e03bd3f3668 100644
--- a/net/vmw_vsock/virtio_transport.c
+++ b/net/vmw_vsock/virtio_transport.c
@@ -414,7 +414,7 @@ static void virtio_vsock_event_fill(struct virtio_vsock *vsock)
 static void virtio_vsock_reset_sock(struct sock *sk)
 {
         lock_sock(sk);
-        sk->sk_state = SS_UNCONNECTED;
+        sk->sk_state = TCP_CLOSE;
         sk->sk_err = ECONNRESET;
         sk->sk_error_report(sk);
         release_sock(sk);
diff --git a/net/vmw_vsock/virtio_transport_common.c b/net/vmw_vsock/virtio_transport_common.c
index edba7ab97563..3ae3a33da70b 100644
--- a/net/vmw_vsock/virtio_transport_common.c
+++ b/net/vmw_vsock/virtio_transport_common.c
@@ -708,7 +708,7 @@ static void virtio_transport_do_close(struct vsock_sock *vsk,
         sock_set_flag(sk, SOCK_DONE);
         vsk->peer_shutdown = SHUTDOWN_MASK;
         if (vsock_stream_has_data(vsk) <= 0)
-                sk->sk_state = SS_DISCONNECTING;
+                sk->sk_state = TCP_CLOSING;
         sk->sk_state_change(sk);
 
         if (vsk->close_work_scheduled &&
@@ -748,8 +748,8 @@ static bool virtio_transport_close(struct vsock_sock *vsk)
 {
         struct sock *sk = &vsk->sk;
 
-        if (!(sk->sk_state == SS_CONNECTED ||
-              sk->sk_state == SS_DISCONNECTING))
+        if (!(sk->sk_state == TCP_ESTABLISHED ||
+              sk->sk_state == TCP_CLOSING))
                 return true;
 
         /* Already received SHUTDOWN from peer, reply with RST */
@@ -801,7 +801,7 @@ virtio_transport_recv_connecting(struct sock *sk,
 
         switch (le16_to_cpu(pkt->hdr.op)) {
         case VIRTIO_VSOCK_OP_RESPONSE:
-                sk->sk_state = SS_CONNECTED;
+                sk->sk_state = TCP_ESTABLISHED;
                 sk->sk_socket->state = SS_CONNECTED;
                 vsock_insert_connected(vsk);
                 sk->sk_state_change(sk);
@@ -821,7 +821,7 @@ virtio_transport_recv_connecting(struct sock *sk,
 
 destroy:
         virtio_transport_reset(vsk, pkt);
-        sk->sk_state = SS_UNCONNECTED;
+        sk->sk_state = TCP_CLOSE;
         sk->sk_err = skerr;
         sk->sk_error_report(sk);
         return err;
@@ -857,7 +857,7 @@ virtio_transport_recv_connected(struct sock *sk,
                         vsk->peer_shutdown |= SEND_SHUTDOWN;
                 if (vsk->peer_shutdown == SHUTDOWN_MASK &&
                     vsock_stream_has_data(vsk) <= 0)
-                        sk->sk_state = SS_DISCONNECTING;
+                        sk->sk_state = TCP_CLOSING;
                 if (le32_to_cpu(pkt->hdr.flags))
                         sk->sk_state_change(sk);
                 break;
@@ -928,7 +928,7 @@ virtio_transport_recv_listen(struct sock *sk, struct virtio_vsock_pkt *pkt)
 
         lock_sock_nested(child, SINGLE_DEPTH_NESTING);
 
-        child->sk_state = SS_CONNECTED;
+        child->sk_state = TCP_ESTABLISHED;
 
         vchild = vsock_sk(child);
         vsock_addr_init(&vchild->local_addr, le64_to_cpu(pkt->hdr.dst_cid),
@@ -1016,18 +1016,18 @@ void virtio_transport_recv_pkt(struct virtio_vsock_pkt *pkt)
                 sk->sk_write_space(sk);
 
         switch (sk->sk_state) {
-        case VSOCK_SS_LISTEN:
+        case TCP_LISTEN:
                 virtio_transport_recv_listen(sk, pkt);
                 virtio_transport_free_pkt(pkt);
                 break;
-        case SS_CONNECTING:
+        case TCP_SYN_SENT:
                 virtio_transport_recv_connecting(sk, pkt);
                 virtio_transport_free_pkt(pkt);
                 break;
-        case SS_CONNECTED:
+        case TCP_ESTABLISHED:
                 virtio_transport_recv_connected(sk, pkt);
                 break;
-        case SS_DISCONNECTING:
+        case TCP_CLOSING:
                 virtio_transport_recv_disconnecting(sk, pkt);
                 virtio_transport_free_pkt(pkt);
                 break;
diff --git a/net/vmw_vsock/vmci_transport.c b/net/vmw_vsock/vmci_transport.c
index 10ae7823a19d..391775e3575c 100644
--- a/net/vmw_vsock/vmci_transport.c
+++ b/net/vmw_vsock/vmci_transport.c
@@ -21,7 +21,6 @@
 #include <linux/kernel.h>
 #include <linux/kmod.h>
 #include <linux/list.h>
-#include <linux/miscdevice.h>
 #include <linux/module.h>
 #include <linux/mutex.h>
 #include <linux/net.h>
@@ -743,7 +742,7 @@ static int vmci_transport_recv_stream_cb(void *data, struct vmci_datagram *dg)
                 /* The local context ID may be out of date, update it. */
                 vsk->local_addr.svm_cid = dst.svm_cid;
 
-                if (sk->sk_state == SS_CONNECTED)
+                if (sk->sk_state == TCP_ESTABLISHED)
                         vmci_trans(vsk)->notify_ops->handle_notify_pkt(
                                         sk, pkt, true, &dst, &src,
                                         &bh_process_pkt);
@@ -801,7 +800,9 @@ static void vmci_transport_handle_detach(struct sock *sk)
                  * left in our consume queue.
                  */
                 if (vsock_stream_has_data(vsk) <= 0) {
-                        if (sk->sk_state == SS_CONNECTING) {
+                        sk->sk_state = TCP_CLOSE;
+
+                        if (sk->sk_state == TCP_SYN_SENT) {
                                 /* The peer may detach from a queue pair while
                                  * we are still in the connecting state, i.e.,
                                  * if the peer VM is killed after attaching to
@@ -810,12 +811,10 @@ static void vmci_transport_handle_detach(struct sock *sk)
                                  * event like a reset.
                                  */
 
-                                sk->sk_state = SS_UNCONNECTED;
                                 sk->sk_err = ECONNRESET;
                                 sk->sk_error_report(sk);
                                 return;
                         }
-                        sk->sk_state = SS_UNCONNECTED;
                 }
                 sk->sk_state_change(sk);
         }
@@ -883,17 +882,17 @@ static void vmci_transport_recv_pkt_work(struct work_struct *work)
         vsock_sk(sk)->local_addr.svm_cid = pkt->dg.dst.context;
 
         switch (sk->sk_state) {
-        case VSOCK_SS_LISTEN:
+        case TCP_LISTEN:
                 vmci_transport_recv_listen(sk, pkt);
                 break;
-        case SS_CONNECTING:
+        case TCP_SYN_SENT:
                 /* Processing of pending connections for servers goes through
                  * the listening socket, so see vmci_transport_recv_listen()
                  * for that path.
                  */
                 vmci_transport_recv_connecting_client(sk, pkt);
                 break;
-        case SS_CONNECTED:
+        case TCP_ESTABLISHED:
                 vmci_transport_recv_connected(sk, pkt);
                 break;
         default:
@@ -942,7 +941,7 @@ static int vmci_transport_recv_listen(struct sock *sk,
                 vsock_sk(pending)->local_addr.svm_cid = pkt->dg.dst.context;
 
                 switch (pending->sk_state) {
-                case SS_CONNECTING:
+                case TCP_SYN_SENT:
                         err = vmci_transport_recv_connecting_server(sk,
                                                                     pending,
                                                                     pkt);
@@ -1072,7 +1071,7 @@ static int vmci_transport_recv_listen(struct sock *sk,
         vsock_add_pending(sk, pending);
         sk->sk_ack_backlog++;
 
-        pending->sk_state = SS_CONNECTING;
+        pending->sk_state = TCP_SYN_SENT;
         vmci_trans(vpending)->produce_size =
                 vmci_trans(vpending)->consume_size = qp_size;
         vmci_trans(vpending)->queue_pair_size = qp_size;
@@ -1197,11 +1196,11 @@ vmci_transport_recv_connecting_server(struct sock *listener,
          * the socket will be valid until it is removed from the queue.
          *
          * If we fail sending the attach below, we remove the socket from the
-         * connected list and move the socket to SS_UNCONNECTED before
+         * connected list and move the socket to TCP_CLOSE before
          * releasing the lock, so a pending slow path processing of an incoming
          * packet will not see the socket in the connected state in that case.
          */
-        pending->sk_state = SS_CONNECTED;
+        pending->sk_state = TCP_ESTABLISHED;
 
         vsock_insert_connected(vpending);
 
@@ -1232,7 +1231,7 @@ vmci_transport_recv_connecting_server(struct sock *listener,
 
 destroy:
         pending->sk_err = skerr;
-        pending->sk_state = SS_UNCONNECTED;
+        pending->sk_state = TCP_CLOSE;
         /* As long as we drop our reference, all necessary cleanup will handle
          * when the cleanup function drops its reference and our destruct
          * implementation is called.  Note that since the listen handler will
@@ -1270,7 +1269,7 @@ vmci_transport_recv_connecting_client(struct sock *sk,
                  * accounting (it can already be found since it's in the bound
                  * table).
                  */
-                sk->sk_state = SS_CONNECTED;
+                sk->sk_state = TCP_ESTABLISHED;
                 sk->sk_socket->state = SS_CONNECTED;
                 vsock_insert_connected(vsk);
                 sk->sk_state_change(sk);
@@ -1338,7 +1337,7 @@ vmci_transport_recv_connecting_client(struct sock *sk,
 destroy:
         vmci_transport_send_reset(sk, pkt);
 
-        sk->sk_state = SS_UNCONNECTED;
+        sk->sk_state = TCP_CLOSE;
         sk->sk_err = skerr;
         sk->sk_error_report(sk);
         return err;
@@ -1526,7 +1525,7 @@ static int vmci_transport_recv_connected(struct sock *sk,
                 sock_set_flag(sk, SOCK_DONE);
                 vsk->peer_shutdown = SHUTDOWN_MASK;
                 if (vsock_stream_has_data(vsk) <= 0)
-                        sk->sk_state = SS_DISCONNECTING;
+                        sk->sk_state = TCP_CLOSING;
 
                 sk->sk_state_change(sk);
                 break;
@@ -1790,7 +1789,7 @@ static int vmci_transport_connect(struct vsock_sock *vsk)
                 err = vmci_transport_send_conn_request(
                         sk, vmci_trans(vsk)->queue_pair_size);
                 if (err < 0) {
-                        sk->sk_state = SS_UNCONNECTED;
+                        sk->sk_state = TCP_CLOSE;
                         return err;
                 }
         } else {
@@ -1800,7 +1799,7 @@ static int vmci_transport_connect(struct vsock_sock *vsk)
                                 sk, vmci_trans(vsk)->queue_pair_size,
                                 supported_proto_versions);
                 if (err < 0) {
-                        sk->sk_state = SS_UNCONNECTED;
+                        sk->sk_state = TCP_CLOSE;
                         return err;
                 }
 
diff --git a/net/vmw_vsock/vmci_transport_notify.c b/net/vmw_vsock/vmci_transport_notify.c
index 1406db4d97d1..41fb427f150a 100644
--- a/net/vmw_vsock/vmci_transport_notify.c
+++ b/net/vmw_vsock/vmci_transport_notify.c
@@ -355,7 +355,7 @@ vmci_transport_notify_pkt_poll_in(struct sock *sk,
                  * queue. Ask for notifications when there is something to
                  * read.
                  */
-                if (sk->sk_state == SS_CONNECTED) {
+                if (sk->sk_state == TCP_ESTABLISHED) {
                         if (!send_waiting_read(sk, 1))
                                 return -1;
 
diff --git a/net/vmw_vsock/vmci_transport_notify_qstate.c b/net/vmw_vsock/vmci_transport_notify_qstate.c
index f3a0afc46208..0cc84f2bb05e 100644
--- a/net/vmw_vsock/vmci_transport_notify_qstate.c
+++ b/net/vmw_vsock/vmci_transport_notify_qstate.c
@@ -176,7 +176,7 @@ vmci_transport_notify_pkt_poll_in(struct sock *sk,
                  * queue. Ask for notifications when there is something to
                  * read.
                  */
-                if (sk->sk_state == SS_CONNECTED)
+                if (sk->sk_state == TCP_ESTABLISHED)
                         vsock_block_update_write_window(sk);
                 *data_ready_now = false;
         }
diff --git a/net/wireless/.gitignore b/net/wireless/.gitignore
index c33451b896d9..61cbc304a3d3 100644
--- a/net/wireless/.gitignore
+++ b/net/wireless/.gitignore
@@ -1 +1,2 @@
-regdb.c
+shipped-certs.c
+extra-certs.c
diff --git a/net/wireless/Kconfig b/net/wireless/Kconfig
index 6c606120abfe..da91bb547db3 100644
--- a/net/wireless/Kconfig
+++ b/net/wireless/Kconfig
@@ -19,6 +19,7 @@ config WEXT_PRIV
 config CFG80211
         tristate "cfg80211 - wireless configuration API"
         depends on RFKILL || !RFKILL
+        select FW_LOADER
         ---help---
           cfg80211 is the Linux wireless LAN (802.11) configuration API.
           Enable this if you have a wireless device.
@@ -82,6 +83,36 @@ config CFG80211_CERTIFICATION_ONUS
           you are a wireless researcher and are working in a controlled
           and approved environment by your local regulatory agency.
 
+config CFG80211_REQUIRE_SIGNED_REGDB
+        bool "require regdb signature" if CFG80211_CERTIFICATION_ONUS
+        default y
+        select SYSTEM_DATA_VERIFICATION
+        help
+          Require that in addition to the "regulatory.db" file a
+          "regulatory.db.p7s" can be loaded with a valid PKCS#7
+          signature for the regulatory.db file made by one of the
+          keys in the certs/ directory.
+
+config CFG80211_USE_KERNEL_REGDB_KEYS
+        bool "allow regdb keys shipped with the kernel" if CFG80211_CERTIFICATION_ONUS
+        default y
+        depends on CFG80211_REQUIRE_SIGNED_REGDB
+        help
+          Allow the regulatory database to be signed by one of the keys for
+          which certificates are part of the kernel sources
+          (in net/wireless/certs/).
+
+          This is currently only Seth Forshee's key, who is the regulatory
+          database maintainer.
+
+config CFG80211_EXTRA_REGDB_KEYDIR
+        string "additional regdb key directory" if CFG80211_CERTIFICATION_ONUS
+        depends on CFG80211_REQUIRE_SIGNED_REGDB
+        help
+          If selected, point to a directory with DER-encoded X.509
+          certificates like in the kernel sources (net/wireless/certs/)
+          that shall be accepted for a signed regulatory database.
+
 config CFG80211_REG_CELLULAR_HINTS
         bool "cfg80211 regulatory support for cellular base station hints"
         depends on CFG80211_CERTIFICATION_ONUS
@@ -139,35 +170,14 @@ config CFG80211_DEBUGFS
 
           If unsure, say N.
 
-config CFG80211_INTERNAL_REGDB
-        bool "use statically compiled regulatory rules database" if EXPERT
-        default n
-        depends on CFG80211
-        ---help---
-          This option generates an internal data structure representing
-          the wireless regulatory rules described in net/wireless/db.txt
-          and includes code to query that database. This is an alternative
-          to using CRDA for defining regulatory rules for the kernel.
-
-          Using this option requires some parsing of the db.txt at build time,
-          the parser will be upkept with the latest wireless-regdb updates but
-          older wireless-regdb formats will be ignored. The parser may later
-          be replaced to avoid issues with conflicts on versions of
-          wireless-regdb.
-
-          For details see:
-
-          http://wireless.kernel.org/en/developers/Regulatory
-
-          Most distributions have a CRDA package. So if unsure, say N.
-
 config CFG80211_CRDA_SUPPORT
-        bool "support CRDA" if CFG80211_INTERNAL_REGDB
+        bool "support CRDA" if EXPERT
         default y
         depends on CFG80211
         help
           You should enable this option unless you know for sure you have no
-          need for it, for example when using internal regdb (above.)
+          need for it, for example when using internal regdb (above) or the
+          database loaded as a firmware file.
 
           If unsure, say Y.
 
diff --git a/net/wireless/Makefile b/net/wireless/Makefile
index b7c0300e0b08..278d979c211a 100644
--- a/net/wireless/Makefile
+++ b/net/wireless/Makefile
@@ -15,11 +15,27 @@ cfg80211-y += mlme.o ibss.o sme.o chan.o ethtool.o mesh.o ap.o trace.o ocb.o
 cfg80211-$(CONFIG_OF) += of.o
 cfg80211-$(CONFIG_CFG80211_DEBUGFS) += debugfs.o
 cfg80211-$(CONFIG_CFG80211_WEXT) += wext-compat.o wext-sme.o
-cfg80211-$(CONFIG_CFG80211_INTERNAL_REGDB) += regdb.o
 
 CFLAGS_trace.o := -I$(src)
 
-$(obj)/regdb.c: $(src)/db.txt $(src)/genregdb.awk
-        @$(AWK) -f $(srctree)/$(src)/genregdb.awk < $< > $@
+cfg80211-$(CONFIG_CFG80211_USE_KERNEL_REGDB_KEYS) += shipped-certs.o
+ifneq ($(CONFIG_CFG80211_EXTRA_REGDB_KEYDIR),)
+cfg80211-y += extra-certs.o
+endif
 
-clean-files := regdb.c
+$(obj)/shipped-certs.c: $(wildcard $(srctree)/$(src)/certs/*.x509)
+        @$(kecho) "  GEN     $@"
+        @echo '#include "reg.h"' > $@
+        @echo 'const u8 shipped_regdb_certs[] = {' >> $@
+        @for f in $^ ; do hexdump -v -e '1/1 "0x%.2x," "\n"' < $$f >> $@ ; done
+        @echo '};' >> $@
+        @echo 'unsigned int shipped_regdb_certs_len = sizeof(shipped_regdb_certs);' >> $@
+
+$(obj)/extra-certs.c: $(CONFIG_CFG80211_EXTRA_REGDB_KEYDIR:"%"=%) \
+                      $(wildcard $(CONFIG_CFG80211_EXTRA_REGDB_KEYDIR:"%"=%)/*.x509)
+        @$(kecho) "  GEN     $@"
+        @echo '#include "reg.h"' > $@
+        @echo 'const u8 extra_regdb_certs[] = {' >> $@
+        @for f in $^ ; do test -f $$f && hexdump -v -e '1/1 "0x%.2x," "\n"' < $$f >> $@ || true ; done
+        @echo '};' >> $@
+        @echo 'unsigned int extra_regdb_certs_len = sizeof(extra_regdb_certs);' >> $@
diff --git a/net/wireless/certs/sforshee.x509 b/net/wireless/certs/sforshee.x509
new file mode 100644
index 000000000000..c6f8f9d6b988
--- /dev/null
+++ b/net/wireless/certs/sforshee.x509
diff --git a/net/wireless/chan.c b/net/wireless/chan.c
index fad1b5baf8ff..a48859982a32 100644
--- a/net/wireless/chan.c
+++ b/net/wireless/chan.c
@@ -465,7 +465,7 @@ bool cfg80211_is_sub_chan(struct cfg80211_chan_def *chandef,
                           struct ieee80211_channel *chan)
 {
         int width;
-        u32 cf_offset, freq;
+        u32 freq;
 
         if (chandef->chan->center_freq == chan->center_freq)
                 return true;
@@ -474,8 +474,6 @@ bool cfg80211_is_sub_chan(struct cfg80211_chan_def *chandef,
         if (width <= 20)
                 return false;
 
-        cf_offset = width / 2 - 10;
-
         for (freq = chandef->center_freq1 - width / 2 + 10;
              freq <= chandef->center_freq1 + width / 2 - 10; freq += 20) {
                 if (chan->center_freq == freq)
diff --git a/net/wireless/core.c b/net/wireless/core.c
index 7b33e8c366bc..fdde0d98fde1 100644
--- a/net/wireless/core.c
+++ b/net/wireless/core.c
@@ -1384,7 +1384,7 @@ out_fail_sysfs:
 out_fail_pernet:
         return err;
 }
-subsys_initcall(cfg80211_init);
+fs_initcall(cfg80211_init);
 
 static void __exit cfg80211_exit(void)
 {
diff --git a/net/wireless/core.h b/net/wireless/core.h
index 705835047f98..d2f7e8b8a097 100644
--- a/net/wireless/core.h
+++ b/net/wireless/core.h
@@ -217,6 +217,7 @@ enum cfg80211_event_type {
         EVENT_DISCONNECTED,
         EVENT_IBSS_JOINED,
         EVENT_STOPPED,
+        EVENT_PORT_AUTHORIZED,
 };
 
 struct cfg80211_event {
@@ -236,6 +237,9 @@ struct cfg80211_event {
                         u8 bssid[ETH_ALEN];
                         struct ieee80211_channel *channel;
                 } ij;
+                struct {
+                        u8 bssid[ETH_ALEN];
+                } pa;
         };
 };
 
@@ -386,6 +390,7 @@ int cfg80211_disconnect(struct cfg80211_registered_device *rdev,
                         bool wextev);
 void __cfg80211_roamed(struct wireless_dev *wdev,
                        struct cfg80211_roam_info *info);
+void __cfg80211_port_authorized(struct wireless_dev *wdev, const u8 *bssid);
 int cfg80211_mgd_wext_connect(struct cfg80211_registered_device *rdev,
                               struct wireless_dev *wdev);
 void cfg80211_autodisconnect_wk(struct work_struct *work);
diff --git a/net/wireless/db.txt b/net/wireless/db.txt
deleted file mode 100644
index a2fc3a09ccdc..000000000000
--- a/net/wireless/db.txt
+++ /dev/null
@@ -1,17 +0,0 @@
-#
-# This file is a placeholder to prevent accidental build breakage if someone
-# enables CONFIG_CFG80211_INTERNAL_REGDB.  Almost no one actually needs to
-# enable that build option.
-#
-# You should be using CRDA instead.  It is even better if you use the CRDA
-# package provided by your distribution, since they will probably keep it
-# up-to-date on your behalf.
-#
-# If you _really_ intend to use CONFIG_CFG80211_INTERNAL_REGDB then you will
-# need to replace this file with one containing appropriately formatted
-# regulatory rules that cover the regulatory domains you will be using.  Your
-# best option is to extract the db.txt file from the wireless-regdb git
-# repository:
-#
-#   git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless-regdb.git
-#
diff --git a/net/wireless/genregdb.awk b/net/wireless/genregdb.awk
deleted file mode 100644
index baf2426b555a..000000000000
--- a/net/wireless/genregdb.awk
+++ /dev/null
@@ -1,158 +0,0 @@
-#!/usr/bin/awk -f
-#
-# genregdb.awk -- generate regdb.c from db.txt
-#
-# Actually, it reads from stdin (presumed to be db.txt) and writes
-# to stdout (presumed to be regdb.c), but close enough...
-#
-# Copyright 2009 John W. Linville <linville@tuxdriver.com>
-#
-# Permission to use, copy, modify, and/or distribute this software for any
-# purpose with or without fee is hereby granted, provided that the above
-# copyright notice and this permission notice appear in all copies.
-#
-# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
-# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
-# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
-# ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
-# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
-# ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
-# OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
-
-BEGIN {
-        active = 0
-        rules = 0;
-        print "/*"
-        print " * DO NOT EDIT -- file generated from data in db.txt"
-        print " */"
-        print ""
-        print "#include <linux/nl80211.h>"
-        print "#include <net/cfg80211.h>"
-        print "#include \"regdb.h\""
-        print ""
-        regdb = "const struct ieee80211_regdomain *reg_regdb[] = {\n"
-}
-
-function parse_country_head() {
-        country=$2
-        sub(/:/, "", country)
-        printf "static const struct ieee80211_regdomain regdom_%s = {\n", country
-        printf "\t.alpha2 = \"%s\",\n", country
-        if ($NF ~ /DFS-ETSI/)
-                printf "\t.dfs_region = NL80211_DFS_ETSI,\n"
-        else if ($NF ~ /DFS-FCC/)
-                printf "\t.dfs_region = NL80211_DFS_FCC,\n"
-        else if ($NF ~ /DFS-JP/)
-                printf "\t.dfs_region = NL80211_DFS_JP,\n"
-        printf "\t.reg_rules = {\n"
-        active = 1
-        regdb = regdb "\t&regdom_" country ",\n"
-}
-
-function parse_reg_rule()
-{
-        flag_starts_at = 7
-
-        start = $1
-        sub(/\(/, "", start)
-        end = $3
-        bw = $5
-        sub(/\),/, "", bw)
-        gain = 0
-        power = $6
-        # power might be in mW...
-        units = $7
-        dfs_cac = 0
-
-        sub(/\(/, "", power)
-        sub(/\),/, "", power)
-        sub(/\),/, "", units)
-        sub(/\)/, "", units)
-
-        if (units == "mW") {
-                flag_starts_at = 8
-                power = 10 * log(power)/log(10)
-                if ($8 ~ /[[:digit:]]/) {
-                        flag_starts_at = 9
-                        dfs_cac = $8
-                }
-        } else {
-                if ($7 ~ /[[:digit:]]/) {
-                        flag_starts_at = 8
-                        dfs_cac = $7
-                }
-        }
-        sub(/\(/, "", dfs_cac)
-        sub(/\),/, "", dfs_cac)
-        flagstr = ""
-        for (i=flag_starts_at; i<=NF; i++)
-                flagstr = flagstr $i
-        split(flagstr, flagarray, ",")
-        flags = ""
-        for (arg in flagarray) {
-                if (flagarray[arg] == "NO-OFDM") {
-                        flags = flags "\n\t\t\tNL80211_RRF_NO_OFDM | "
-                } else if (flagarray[arg] == "NO-CCK") {
-                        flags = flags "\n\t\t\tNL80211_RRF_NO_CCK | "
-                } else if (flagarray[arg] == "NO-INDOOR") {
-                        flags = flags "\n\t\t\tNL80211_RRF_NO_INDOOR | "
-                } else if (flagarray[arg] == "NO-OUTDOOR") {
-                        flags = flags "\n\t\t\tNL80211_RRF_NO_OUTDOOR | "
-                } else if (flagarray[arg] == "DFS") {
-                        flags = flags "\n\t\t\tNL80211_RRF_DFS | "
-                } else if (flagarray[arg] == "PTP-ONLY") {
-                        flags = flags "\n\t\t\tNL80211_RRF_PTP_ONLY | "
-                } else if (flagarray[arg] == "PTMP-ONLY") {
-                        flags = flags "\n\t\t\tNL80211_RRF_PTMP_ONLY | "
-                } else if (flagarray[arg] == "PASSIVE-SCAN") {
-                        flags = flags "\n\t\t\tNL80211_RRF_NO_IR | "
-                } else if (flagarray[arg] == "NO-IBSS") {
-                        flags = flags "\n\t\t\tNL80211_RRF_NO_IR | "
-                } else if (flagarray[arg] == "NO-IR") {
-                        flags = flags "\n\t\t\tNL80211_RRF_NO_IR | "
-                } else if (flagarray[arg] == "AUTO-BW") {
-                        flags = flags "\n\t\t\tNL80211_RRF_AUTO_BW | "
-                }
-
-        }
-        flags = flags "0"
-        printf "\t\tREG_RULE_EXT(%d, %d, %d, %d, %.0f, %d, %s),\n", start, end, bw, gain, power, dfs_cac, flags
-        rules++
-}
-
-function print_tail_country()
-{
-        active = 0
-        printf "\t},\n"
-        printf "\t.n_reg_rules = %d\n", rules
-        printf "};\n\n"
-        rules = 0;
-}
-
-/^[ \t]*#/ {
-        # Ignore
-}
-
-!active && /^[ \t]*$/ {
-        # Ignore
-}
-
-!active && /country/ {
-        parse_country_head()
-}
-
-active && /^[ \t]*\(/ {
-        parse_reg_rule()
-}
-
-active && /^[ \t]*$/ {
-        print_tail_country()
-}
-
-END {
-        if (active)
-                print_tail_country()
-        print regdb "};"
-        print ""
-        print "int reg_regdb_size = ARRAY_SIZE(reg_regdb);"
-}
diff --git a/net/wireless/lib80211.c b/net/wireless/lib80211.c
index 459611577d3d..801d4781a73b 100644
--- a/net/wireless/lib80211.c
+++ b/net/wireless/lib80211.c
@@ -44,7 +44,7 @@ static DEFINE_SPINLOCK(lib80211_crypto_lock);
 static void lib80211_crypt_deinit_entries(struct lib80211_crypt_info *info,
                                           int force);
 static void lib80211_crypt_quiescing(struct lib80211_crypt_info *info);
-static void lib80211_crypt_deinit_handler(unsigned long data);
+static void lib80211_crypt_deinit_handler(struct timer_list *t);
 
 int lib80211_crypt_info_init(struct lib80211_crypt_info *info, char *name,
                                 spinlock_t *lock)
@@ -55,8 +55,8 @@ int lib80211_crypt_info_init(struct lib80211_crypt_info *info, char *name,
         info->lock = lock;
 
         INIT_LIST_HEAD(&info->crypt_deinit_list);
-        setup_timer(&info->crypt_deinit_timer, lib80211_crypt_deinit_handler,
-                        (unsigned long)info);
+        timer_setup(&info->crypt_deinit_timer, lib80211_crypt_deinit_handler,
+                    0);
 
         return 0;
 }
@@ -116,9 +116,10 @@ static void lib80211_crypt_quiescing(struct lib80211_crypt_info *info)
         spin_unlock_irqrestore(info->lock, flags);
 }
 
-static void lib80211_crypt_deinit_handler(unsigned long data)
+static void lib80211_crypt_deinit_handler(struct timer_list *t)
 {
-        struct lib80211_crypt_info *info = (struct lib80211_crypt_info *)data;
+        struct lib80211_crypt_info *info = from_timer(info, t,
+                                                      crypt_deinit_timer);
         unsigned long flags;
 
         lib80211_crypt_deinit_entries(info, 0);
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index eb866647a27a..b1ac23ca20c8 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -2130,6 +2130,15 @@ static int nl80211_parse_chandef(struct cfg80211_registered_device *rdev,
                 case NL80211_CHAN_HT40MINUS:
                         cfg80211_chandef_create(chandef, chandef->chan,
                                                 chantype);
+                        /* user input for center_freq is incorrect */
+                        if (info->attrs[NL80211_ATTR_CENTER_FREQ1] &&
+                            chandef->center_freq1 != nla_get_u32(
+                                        info->attrs[NL80211_ATTR_CENTER_FREQ1]))
+                                return -EINVAL;
+                        /* center_freq2 must be zero */
+                        if (info->attrs[NL80211_ATTR_CENTER_FREQ2] &&
+                            nla_get_u32(info->attrs[NL80211_ATTR_CENTER_FREQ2]))
+                                return -EINVAL;
                         break;
                 default:
                         return -EINVAL;
@@ -2596,10 +2605,32 @@ static int nl80211_send_iface(struct sk_buff *msg, u32 portid, u32 seq, int flag
                         goto nla_put_failure;
         }
 
-        if (wdev->ssid_len) {
-                if (nla_put(msg, NL80211_ATTR_SSID, wdev->ssid_len, wdev->ssid))
+        wdev_lock(wdev);
+        switch (wdev->iftype) {
+        case NL80211_IFTYPE_AP:
+                if (wdev->ssid_len &&
+                    nla_put(msg, NL80211_ATTR_SSID, wdev->ssid_len, wdev->ssid))
                         goto nla_put_failure;
+                break;
+        case NL80211_IFTYPE_STATION:
+        case NL80211_IFTYPE_P2P_CLIENT:
+        case NL80211_IFTYPE_ADHOC: {
+                const u8 *ssid_ie;
+                if (!wdev->current_bss)
+                        break;
+                ssid_ie = ieee80211_bss_get_ie(&wdev->current_bss->pub,
+                                               WLAN_EID_SSID);
+                if (!ssid_ie)
+                        break;
+                if (nla_put(msg, NL80211_ATTR_SSID, ssid_ie[1], ssid_ie + 2))
+                        goto nla_put_failure;
+                break;
+                }
+        default:
+                /* nothing */
+                break;
         }
+        wdev_unlock(wdev);
 
         genlmsg_end(msg, hdr);
         return 0;
@@ -5677,6 +5708,11 @@ static int nl80211_req_set_reg(struct sk_buff *skb, struct genl_info *info)
         }
 }
 
+static int nl80211_reload_regdb(struct sk_buff *skb, struct genl_info *info)
+{
+        return reg_reload_regdb();
+}
+
 static int nl80211_get_mesh_config(struct sk_buff *skb,
                                    struct genl_info *info)
 {
@@ -6277,7 +6313,7 @@ static int nl80211_send_regdom(struct sk_buff *msg, struct netlink_callback *cb,
         if (!hdr)
                 return -1;
 
-        genl_dump_check_consistent(cb, hdr, &nl80211_fam);
+        genl_dump_check_consistent(cb, hdr);
 
         if (nl80211_put_regdom(regdom, msg))
                 goto nla_put_failure;
@@ -6618,6 +6654,77 @@ static bool cfg80211_off_channel_oper_allowed(struct wireless_dev *wdev)
         return regulatory_pre_cac_allowed(wdev->wiphy);
 }
 
+static int
+nl80211_check_scan_flags(struct wiphy *wiphy, struct wireless_dev *wdev,
+                         void *request, struct nlattr **attrs,
+                         bool is_sched_scan)
+{
+        u8 *mac_addr, *mac_addr_mask;
+        u32 *flags;
+        enum nl80211_feature_flags randomness_flag;
+
+        if (!attrs[NL80211_ATTR_SCAN_FLAGS])
+                return 0;
+
+        if (is_sched_scan) {
+                struct cfg80211_sched_scan_request *req = request;
+
+                randomness_flag = wdev ?
+                                  NL80211_FEATURE_SCHED_SCAN_RANDOM_MAC_ADDR :
+                                  NL80211_FEATURE_ND_RANDOM_MAC_ADDR;
+                flags = &req->flags;
+                mac_addr = req->mac_addr;
+                mac_addr_mask = req->mac_addr_mask;
+        } else {
+                struct cfg80211_scan_request *req = request;
+
+                randomness_flag = NL80211_FEATURE_SCAN_RANDOM_MAC_ADDR;
+                flags = &req->flags;
+                mac_addr = req->mac_addr;
+                mac_addr_mask = req->mac_addr_mask;
+        }
+
+        *flags = nla_get_u32(attrs[NL80211_ATTR_SCAN_FLAGS]);
+
+        if ((*flags & NL80211_SCAN_FLAG_LOW_PRIORITY) &&
+            !(wiphy->features & NL80211_FEATURE_LOW_PRIORITY_SCAN))
+                return -EOPNOTSUPP;
+
+        if (*flags & NL80211_SCAN_FLAG_RANDOM_ADDR) {
+                int err;
+
+                if (!(wiphy->features & randomness_flag) ||
+                    (wdev && wdev->current_bss))
+                        return -EOPNOTSUPP;
+
+                err = nl80211_parse_random_mac(attrs, mac_addr, mac_addr_mask);
+                if (err)
+                        return err;
+        }
+
+        if ((*flags & NL80211_SCAN_FLAG_FILS_MAX_CHANNEL_TIME) &&
+            !wiphy_ext_feature_isset(wiphy,
+                                     NL80211_EXT_FEATURE_FILS_MAX_CHANNEL_TIME))
+                return -EOPNOTSUPP;
+
+        if ((*flags & NL80211_SCAN_FLAG_ACCEPT_BCAST_PROBE_RESP) &&
+           !wiphy_ext_feature_isset(wiphy,
+                                    NL80211_EXT_FEATURE_ACCEPT_BCAST_PROBE_RESP))
+                return -EOPNOTSUPP;
+
+        if ((*flags & NL80211_SCAN_FLAG_OCE_PROBE_REQ_DEFERRAL_SUPPRESSION) &&
+            !wiphy_ext_feature_isset(wiphy,
+                                     NL80211_EXT_FEATURE_OCE_PROBE_REQ_DEFERRAL_SUPPRESSION))
+                return -EOPNOTSUPP;
+
+        if ((*flags & NL80211_SCAN_FLAG_OCE_PROBE_REQ_HIGH_TX_RATE) &&
+            !wiphy_ext_feature_isset(wiphy,
+                                     NL80211_EXT_FEATURE_OCE_PROBE_REQ_HIGH_TX_RATE))
+                return -EOPNOTSUPP;
+
+        return 0;
+}
+
 static int nl80211_trigger_scan(struct sk_buff *skb, struct genl_info *info)
 {
         struct cfg80211_registered_device *rdev = info->user_ptr[0];
@@ -6823,34 +6930,10 @@ static int nl80211_trigger_scan(struct sk_buff *skb, struct genl_info *info)
                         nla_get_flag(info->attrs[NL80211_ATTR_MEASUREMENT_DURATION_MANDATORY]);
         }
 
-        if (info->attrs[NL80211_ATTR_SCAN_FLAGS]) {
-                request->flags = nla_get_u32(
-                        info->attrs[NL80211_ATTR_SCAN_FLAGS]);
-                if ((request->flags & NL80211_SCAN_FLAG_LOW_PRIORITY) &&
-                    !(wiphy->features & NL80211_FEATURE_LOW_PRIORITY_SCAN)) {
-                        err = -EOPNOTSUPP;
-                        goto out_free;
-                }
-
-                if (request->flags & NL80211_SCAN_FLAG_RANDOM_ADDR) {
-                        if (!(wiphy->features &
-                                        NL80211_FEATURE_SCAN_RANDOM_MAC_ADDR)) {
-                                err = -EOPNOTSUPP;
-                                goto out_free;
-                        }
-
-                        if (wdev->current_bss) {
-                                err = -EOPNOTSUPP;
-                                goto out_free;
-                        }
-
-                        err = nl80211_parse_random_mac(info->attrs,
-                                                       request->mac_addr,
-                                                       request->mac_addr_mask);
-                        if (err)
-                                goto out_free;
-                }
-        }
+        err = nl80211_check_scan_flags(wiphy, wdev, request, info->attrs,
+                                       false);
+        if (err)
+                goto out_free;
 
         request->no_cck =
                 nla_get_flag(info->attrs[NL80211_ATTR_TX_NO_CCK_RATE]);
@@ -7298,37 +7381,9 @@ nl80211_parse_sched_scan(struct wiphy *wiphy, struct wireless_dev *wdev,
                        request->ie_len);
         }
 
-        if (attrs[NL80211_ATTR_SCAN_FLAGS]) {
-                request->flags = nla_get_u32(
-                        attrs[NL80211_ATTR_SCAN_FLAGS]);
-                if ((request->flags & NL80211_SCAN_FLAG_LOW_PRIORITY) &&
-                    !(wiphy->features & NL80211_FEATURE_LOW_PRIORITY_SCAN)) {
-                        err = -EOPNOTSUPP;
-                        goto out_free;
-                }
-
-                if (request->flags & NL80211_SCAN_FLAG_RANDOM_ADDR) {
-                        u32 flg = NL80211_FEATURE_SCHED_SCAN_RANDOM_MAC_ADDR;
-
-                        if (!wdev) /* must be net-detect */
-                                flg = NL80211_FEATURE_ND_RANDOM_MAC_ADDR;
-
-                        if (!(wiphy->features & flg)) {
-                                err = -EOPNOTSUPP;
-                                goto out_free;
-                        }
-
-                        if (wdev && wdev->current_bss) {
-                                err = -EOPNOTSUPP;
-                                goto out_free;
-                        }
-
-                        err = nl80211_parse_random_mac(attrs, request->mac_addr,
-                                                       request->mac_addr_mask);
-                        if (err)
-                                goto out_free;
-                }
-        }
+        err = nl80211_check_scan_flags(wiphy, wdev, request, attrs, true);
+        if (err)
+                goto out_free;
 
         if (attrs[NL80211_ATTR_SCHED_SCAN_DELAY])
                 request->delay =
@@ -7689,7 +7744,7 @@ static int nl80211_send_bss(struct sk_buff *msg, struct netlink_callback *cb,
         if (!hdr)
                 return -1;
 
-        genl_dump_check_consistent(cb, hdr, &nl80211_fam);
+        genl_dump_check_consistent(cb, hdr);
 
         if (nla_put_u32(msg, NL80211_ATTR_GENERATION, rdev->bss_generation))
                 goto nla_put_failure;
@@ -8932,8 +8987,14 @@ static int nl80211_connect(struct sk_buff *skb, struct genl_info *info)
 
         if (info->attrs[NL80211_ATTR_USE_MFP]) {
                 connect.mfp = nla_get_u32(info->attrs[NL80211_ATTR_USE_MFP]);
+                if (connect.mfp == NL80211_MFP_OPTIONAL &&
+                    !wiphy_ext_feature_isset(&rdev->wiphy,
+                                             NL80211_EXT_FEATURE_MFP_OPTIONAL))
+                        return -EOPNOTSUPP;
+
                 if (connect.mfp != NL80211_MFP_REQUIRED &&
-                    connect.mfp != NL80211_MFP_NO)
+                    connect.mfp != NL80211_MFP_NO &&
+                    connect.mfp != NL80211_MFP_OPTIONAL)
                         return -EINVAL;
         } else {
                 connect.mfp = NL80211_MFP_NO;
@@ -12685,6 +12746,12 @@ static const struct genl_ops nl80211_ops[] = {
                 .flags = GENL_ADMIN_PERM,
         },
         {
+                .cmd = NL80211_CMD_RELOAD_REGDB,
+                .doit = nl80211_reload_regdb,
+                .policy = nl80211_policy,
+                .flags = GENL_ADMIN_PERM,
+        },
+        {
                 .cmd = NL80211_CMD_GET_MESH_CONFIG,
                 .doit = nl80211_get_mesh_config,
                 .policy = nl80211_policy,
@@ -13812,9 +13879,7 @@ void nl80211_send_roamed(struct cfg80211_registered_device *rdev,
                      info->req_ie)) ||
             (info->resp_ie &&
              nla_put(msg, NL80211_ATTR_RESP_IE, info->resp_ie_len,
-                     info->resp_ie)) ||
-            (info->authorized &&
-             nla_put_flag(msg, NL80211_ATTR_PORT_AUTHORIZED)))
+                     info->resp_ie)))
                 goto nla_put_failure;
 
         genlmsg_end(msg, hdr);
@@ -13828,6 +13893,36 @@ void nl80211_send_roamed(struct cfg80211_registered_device *rdev,
         nlmsg_free(msg);
 }
 
+void nl80211_send_port_authorized(struct cfg80211_registered_device *rdev,
+                                  struct net_device *netdev, const u8 *bssid)
+{
+        struct sk_buff *msg;
+        void *hdr;
+
+        msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
+        if (!msg)
+                return;
+
+        hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_PORT_AUTHORIZED);
+        if (!hdr) {
+                nlmsg_free(msg);
+                return;
+        }
+
+        if (nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid))
+                goto nla_put_failure;
+
+        genlmsg_end(msg, hdr);
+
+        genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
+                                NL80211_MCGRP_MLME, GFP_KERNEL);
+        return;
+
+ nla_put_failure:
+        genlmsg_cancel(msg, hdr);
+        nlmsg_free(msg);
+}
+
 void nl80211_send_disconnected(struct cfg80211_registered_device *rdev,
                                struct net_device *netdev, u16 reason,
                                const u8 *ie, size_t ie_len, bool from_ap)
diff --git a/net/wireless/nl80211.h b/net/wireless/nl80211.h
index fc415c8f7aac..79e47fe60c35 100644
--- a/net/wireless/nl80211.h
+++ b/net/wireless/nl80211.h
@@ -59,6 +59,8 @@ void nl80211_send_connect_result(struct cfg80211_registered_device *rdev,
 void nl80211_send_roamed(struct cfg80211_registered_device *rdev,
                          struct net_device *netdev,
                          struct cfg80211_roam_info *info, gfp_t gfp);
+void nl80211_send_port_authorized(struct cfg80211_registered_device *rdev,
+                                  struct net_device *netdev, const u8 *bssid);
 void nl80211_send_disconnected(struct cfg80211_registered_device *rdev,
                                struct net_device *netdev, u16 reason,
                                const u8 *ie, size_t ie_len, bool from_ap);
diff --git a/net/wireless/reg.c b/net/wireless/reg.c
index 6e94f6934a0e..78e71b0390be 100644
--- a/net/wireless/reg.c
+++ b/net/wireless/reg.c
@@ -53,12 +53,13 @@
 #include <linux/ctype.h>
 #include <linux/nl80211.h>
 #include <linux/platform_device.h>
+#include <linux/verification.h>
 #include <linux/moduleparam.h>
+#include <linux/firmware.h>
 #include <net/cfg80211.h>
 #include "core.h"
 #include "reg.h"
 #include "rdev-ops.h"
-#include "regdb.h"
 #include "nl80211.h"
 
 /*
@@ -100,7 +101,7 @@ static struct regulatory_request core_request_world = {
 static struct regulatory_request __rcu *last_request =
         (void __force __rcu *)&core_request_world;
 
-/* To trigger userspace events */
+/* To trigger userspace events and load firmware */
 static struct platform_device *reg_pdev;
 
 /*
@@ -443,7 +444,6 @@ reg_copy_regd(const struct ieee80211_regdomain *src_regd)
         return regd;
 }
 
-#ifdef CONFIG_CFG80211_INTERNAL_REGDB
 struct reg_regdb_apply_request {
         struct list_head list;
         const struct ieee80211_regdomain *regdom;
@@ -475,55 +475,26 @@ static void reg_regdb_apply(struct work_struct *work)
 
 static DECLARE_WORK(reg_regdb_work, reg_regdb_apply);
 
-static int reg_query_builtin(const char *alpha2)
+static int reg_schedule_apply(const struct ieee80211_regdomain *regdom)
 {
-        const struct ieee80211_regdomain *regdom = NULL;
         struct reg_regdb_apply_request *request;
-        unsigned int i;
-
-        for (i = 0; i < reg_regdb_size; i++) {
-                if (alpha2_equal(alpha2, reg_regdb[i]->alpha2)) {
-                        regdom = reg_regdb[i];
-                        break;
-                }
-        }
-
-        if (!regdom)
-                return -ENODATA;
 
         request = kzalloc(sizeof(struct reg_regdb_apply_request), GFP_KERNEL);
-        if (!request)
-                return -ENOMEM;
-
-        request->regdom = reg_copy_regd(regdom);
-        if (IS_ERR_OR_NULL(request->regdom)) {
-                kfree(request);
+        if (!request) {
+                kfree(regdom);
                 return -ENOMEM;
         }
 
+        request->regdom = regdom;
+
         mutex_lock(&reg_regdb_apply_mutex);
         list_add_tail(&request->list, &reg_regdb_apply_list);
         mutex_unlock(&reg_regdb_apply_mutex);
 
         schedule_work(&reg_regdb_work);
-
         return 0;
 }
 
-/* Feel free to add any other sanity checks here */
-static void reg_regdb_size_check(void)
-{
-        /* We should ideally BUILD_BUG_ON() but then random builds would fail */
-        WARN_ONCE(!reg_regdb_size, "db.txt is empty, you should update it...");
-}
-#else
-static inline void reg_regdb_size_check(void) {}
-static inline int reg_query_builtin(const char *alpha2)
-{
-        return -ENODATA;
-}
-#endif /* CONFIG_CFG80211_INTERNAL_REGDB */
-
 #ifdef CONFIG_CFG80211_CRDA_SUPPORT
 /* Max number of consecutive attempts to communicate with CRDA  */
 #define REG_MAX_CRDA_TIMEOUTS 10
@@ -599,10 +570,402 @@ static inline int call_crda(const char *alpha2)
 }
 #endif /* CONFIG_CFG80211_CRDA_SUPPORT */
 
+/* code to directly load a firmware database through request_firmware */
+static const struct fwdb_header *regdb;
+
+struct fwdb_country {
+        u8 alpha2[2];
+        __be16 coll_ptr;
+        /* this struct cannot be extended */
+} __packed __aligned(4);
+
+struct fwdb_collection {
+        u8 len;
+        u8 n_rules;
+        u8 dfs_region;
+        /* no optional data yet */
+        /* aligned to 2, then followed by __be16 array of rule pointers */
+} __packed __aligned(4);
+
+enum fwdb_flags {
+        FWDB_FLAG_NO_OFDM       = BIT(0),
+        FWDB_FLAG_NO_OUTDOOR    = BIT(1),
+        FWDB_FLAG_DFS           = BIT(2),
+        FWDB_FLAG_NO_IR         = BIT(3),
+        FWDB_FLAG_AUTO_BW       = BIT(4),
+};
+
+struct fwdb_rule {
+        u8 len;
+        u8 flags;
+        __be16 max_eirp;
+        __be32 start, end, max_bw;
+        /* start of optional data */
+        __be16 cac_timeout;
+} __packed __aligned(4);
+
+#define FWDB_MAGIC 0x52474442
+#define FWDB_VERSION 20
+
+struct fwdb_header {
+        __be32 magic;
+        __be32 version;
+        struct fwdb_country country[];
+} __packed __aligned(4);
+
+static bool valid_rule(const u8 *data, unsigned int size, u16 rule_ptr)
+{
+        struct fwdb_rule *rule = (void *)(data + (rule_ptr << 2));
+
+        if ((u8 *)rule + sizeof(rule->len) > data + size)
+                return false;
+
+        /* mandatory fields */
+        if (rule->len < offsetofend(struct fwdb_rule, max_bw))
+                return false;
+
+        return true;
+}
+
+static bool valid_country(const u8 *data, unsigned int size,
+                          const struct fwdb_country *country)
+{
+        unsigned int ptr = be16_to_cpu(country->coll_ptr) << 2;
+        struct fwdb_collection *coll = (void *)(data + ptr);
+        __be16 *rules_ptr;
+        unsigned int i;
+
+        /* make sure we can read len/n_rules */
+        if ((u8 *)coll + offsetofend(typeof(*coll), n_rules) > data + size)
+                return false;
+
+        /* make sure base struct and all rules fit */
+        if ((u8 *)coll + ALIGN(coll->len, 2) +
+            (coll->n_rules * 2) > data + size)
+                return false;
+
+        /* mandatory fields must exist */
+        if (coll->len < offsetofend(struct fwdb_collection, dfs_region))
+                return false;
+
+        rules_ptr = (void *)((u8 *)coll + ALIGN(coll->len, 2));
+
+        for (i = 0; i < coll->n_rules; i++) {
+                u16 rule_ptr = be16_to_cpu(rules_ptr[i]);
+
+                if (!valid_rule(data, size, rule_ptr))
+                        return false;
+        }
+
+        return true;
+}
+
+#ifdef CONFIG_CFG80211_REQUIRE_SIGNED_REGDB
+static struct key *builtin_regdb_keys;
+
+static void __init load_keys_from_buffer(const u8 *p, unsigned int buflen)
+{
+        const u8 *end = p + buflen;
+        size_t plen;
+        key_ref_t key;
+
+        while (p < end) {
+                /* Each cert begins with an ASN.1 SEQUENCE tag and must be more
+                 * than 256 bytes in size.
+                 */
+                if (end - p < 4)
+                        goto dodgy_cert;
+                if (p[0] != 0x30 &&
+                    p[1] != 0x82)
+                        goto dodgy_cert;
+                plen = (p[2] << 8) | p[3];
+                plen += 4;
+                if (plen > end - p)
+                        goto dodgy_cert;
+
+                key = key_create_or_update(make_key_ref(builtin_regdb_keys, 1),
+                                           "asymmetric", NULL, p, plen,
+                                           ((KEY_POS_ALL & ~KEY_POS_SETATTR) |
+                                            KEY_USR_VIEW | KEY_USR_READ),
+                                           KEY_ALLOC_NOT_IN_QUOTA |
+                                           KEY_ALLOC_BUILT_IN |
+                                           KEY_ALLOC_BYPASS_RESTRICTION);
+                if (IS_ERR(key)) {
+                        pr_err("Problem loading in-kernel X.509 certificate (%ld)\n",
+                               PTR_ERR(key));
+                } else {
+                        pr_notice("Loaded X.509 cert '%s'\n",
+                                  key_ref_to_ptr(key)->description);
+                        key_ref_put(key);
+                }
+                p += plen;
+        }
+
+        return;
+
+dodgy_cert:
+        pr_err("Problem parsing in-kernel X.509 certificate list\n");
+}
+
+static int __init load_builtin_regdb_keys(void)
+{
+        builtin_regdb_keys =
+                keyring_alloc(".builtin_regdb_keys",
+                              KUIDT_INIT(0), KGIDT_INIT(0), current_cred(),
+                              ((KEY_POS_ALL & ~KEY_POS_SETATTR) |
+                              KEY_USR_VIEW | KEY_USR_READ | KEY_USR_SEARCH),
+                              KEY_ALLOC_NOT_IN_QUOTA, NULL, NULL);
+        if (IS_ERR(builtin_regdb_keys))
+                return PTR_ERR(builtin_regdb_keys);
+
+        pr_notice("Loading compiled-in X.509 certificates for regulatory database\n");
+
+#ifdef CONFIG_CFG80211_USE_KERNEL_REGDB_KEYS
+        load_keys_from_buffer(shipped_regdb_certs, shipped_regdb_certs_len);
+#endif
+#ifdef CONFIG_CFG80211_EXTRA_REGDB_KEYDIR
+        if (CONFIG_CFG80211_EXTRA_REGDB_KEYDIR[0] != '\0')
+                load_keys_from_buffer(extra_regdb_certs, extra_regdb_certs_len);
+#endif
+
+        return 0;
+}
+
+static bool regdb_has_valid_signature(const u8 *data, unsigned int size)
+{
+        const struct firmware *sig;
+        bool result;
+
+        if (request_firmware(&sig, "regulatory.db.p7s", &reg_pdev->dev))
+                return false;
+
+        result = verify_pkcs7_signature(data, size, sig->data, sig->size,
+                                        builtin_regdb_keys,
+                                        VERIFYING_UNSPECIFIED_SIGNATURE,
+                                        NULL, NULL) == 0;
+
+        release_firmware(sig);
+
+        return result;
+}
+
+static void free_regdb_keyring(void)
+{
+        key_put(builtin_regdb_keys);
+}
+#else
+static int load_builtin_regdb_keys(void)
+{
+        return 0;
+}
+
+static bool regdb_has_valid_signature(const u8 *data, unsigned int size)
+{
+        return true;
+}
+
+static void free_regdb_keyring(void)
+{
+}
+#endif /* CONFIG_CFG80211_REQUIRE_SIGNED_REGDB */
+
+static bool valid_regdb(const u8 *data, unsigned int size)
+{
+        const struct fwdb_header *hdr = (void *)data;
+        const struct fwdb_country *country;
+
+        if (size < sizeof(*hdr))
+                return false;
+
+        if (hdr->magic != cpu_to_be32(FWDB_MAGIC))
+                return false;
+
+        if (hdr->version != cpu_to_be32(FWDB_VERSION))
+                return false;
+
+        if (!regdb_has_valid_signature(data, size))
+                return false;
+
+        country = &hdr->country[0];
+        while ((u8 *)(country + 1) <= data + size) {
+                if (!country->coll_ptr)
+                        break;
+                if (!valid_country(data, size, country))
+                        return false;
+                country++;
+        }
+
+        return true;
+}
+
+static int regdb_query_country(const struct fwdb_header *db,
+                               const struct fwdb_country *country)
+{
+        unsigned int ptr = be16_to_cpu(country->coll_ptr) << 2;
+        struct fwdb_collection *coll = (void *)((u8 *)db + ptr);
+        struct ieee80211_regdomain *regdom;
+        unsigned int size_of_regd;
+        unsigned int i;
+
+        size_of_regd =
+                sizeof(struct ieee80211_regdomain) +
+                coll->n_rules * sizeof(struct ieee80211_reg_rule);
+
+        regdom = kzalloc(size_of_regd, GFP_KERNEL);
+        if (!regdom)
+                return -ENOMEM;
+
+        regdom->n_reg_rules = coll->n_rules;
+        regdom->alpha2[0] = country->alpha2[0];
+        regdom->alpha2[1] = country->alpha2[1];
+        regdom->dfs_region = coll->dfs_region;
+
+        for (i = 0; i < regdom->n_reg_rules; i++) {
+                __be16 *rules_ptr = (void *)((u8 *)coll + ALIGN(coll->len, 2));
+                unsigned int rule_ptr = be16_to_cpu(rules_ptr[i]) << 2;
+                struct fwdb_rule *rule = (void *)((u8 *)db + rule_ptr);
+                struct ieee80211_reg_rule *rrule = &regdom->reg_rules[i];
+
+                rrule->freq_range.start_freq_khz = be32_to_cpu(rule->start);
+                rrule->freq_range.end_freq_khz = be32_to_cpu(rule->end);
+                rrule->freq_range.max_bandwidth_khz = be32_to_cpu(rule->max_bw);
+
+                rrule->power_rule.max_antenna_gain = 0;
+                rrule->power_rule.max_eirp = be16_to_cpu(rule->max_eirp);
+
+                rrule->flags = 0;
+                if (rule->flags & FWDB_FLAG_NO_OFDM)
+                        rrule->flags |= NL80211_RRF_NO_OFDM;
+                if (rule->flags & FWDB_FLAG_NO_OUTDOOR)
+                        rrule->flags |= NL80211_RRF_NO_OUTDOOR;
+                if (rule->flags & FWDB_FLAG_DFS)
+                        rrule->flags |= NL80211_RRF_DFS;
+                if (rule->flags & FWDB_FLAG_NO_IR)
+                        rrule->flags |= NL80211_RRF_NO_IR;
+                if (rule->flags & FWDB_FLAG_AUTO_BW)
+                        rrule->flags |= NL80211_RRF_AUTO_BW;
+
+                rrule->dfs_cac_ms = 0;
+
+                /* handle optional data */
+                if (rule->len >= offsetofend(struct fwdb_rule, cac_timeout))
+                        rrule->dfs_cac_ms =
+                                1000 * be16_to_cpu(rule->cac_timeout);
+        }
+
+        return reg_schedule_apply(regdom);
+}
+
+static int query_regdb(const char *alpha2)
+{
+        const struct fwdb_header *hdr = regdb;
+        const struct fwdb_country *country;
+
+        ASSERT_RTNL();
+
+        if (IS_ERR(regdb))
+                return PTR_ERR(regdb);
+
+        country = &hdr->country[0];
+        while (country->coll_ptr) {
+                if (alpha2_equal(alpha2, country->alpha2))
+                        return regdb_query_country(regdb, country);
+                country++;
+        }
+
+        return -ENODATA;
+}
+
+static void regdb_fw_cb(const struct firmware *fw, void *context)
+{
+        int set_error = 0;
+        bool restore = true;
+        void *db;
+
+        if (!fw) {
+                pr_info("failed to load regulatory.db\n");
+                set_error = -ENODATA;
+        } else if (!valid_regdb(fw->data, fw->size)) {
+                pr_info("loaded regulatory.db is malformed or signature is missing/invalid\n");
+                set_error = -EINVAL;
+        }
+
+        rtnl_lock();
+        if (WARN_ON(regdb && !IS_ERR(regdb))) {
+                /* just restore and free new db */
+        } else if (set_error) {
+                regdb = ERR_PTR(set_error);
+        } else if (fw) {
+                db = kmemdup(fw->data, fw->size, GFP_KERNEL);
+                if (db) {
+                        regdb = db;
+                        restore = context && query_regdb(context);
+                } else {
+                        restore = true;
+                }
+        }
+
+        if (restore)
+                restore_regulatory_settings(true);
+
+        rtnl_unlock();
+
+        kfree(context);
+
+        release_firmware(fw);
+}
+
+static int query_regdb_file(const char *alpha2)
+{
+        ASSERT_RTNL();
+
+        if (regdb)
+                return query_regdb(alpha2);
+
+        alpha2 = kmemdup(alpha2, 2, GFP_KERNEL);
+        if (!alpha2)
+                return -ENOMEM;
+
+        return request_firmware_nowait(THIS_MODULE, true, "regulatory.db",
+                                       &reg_pdev->dev, GFP_KERNEL,
+                                       (void *)alpha2, regdb_fw_cb);
+}
+
+int reg_reload_regdb(void)
+{
+        const struct firmware *fw;
+        void *db;
+        int err;
+
+        err = request_firmware(&fw, "regulatory.db", &reg_pdev->dev);
+        if (err)
+                return err;
+
+        if (!valid_regdb(fw->data, fw->size)) {
+                err = -ENODATA;
+                goto out;
+        }
+
+        db = kmemdup(fw->data, fw->size, GFP_KERNEL);
+        if (!db) {
+                err = -ENOMEM;
+                goto out;
+        }
+
+        rtnl_lock();
+        if (!IS_ERR_OR_NULL(regdb))
+                kfree(regdb);
+        regdb = db;
+        rtnl_unlock();
+
+ out:
+        release_firmware(fw);
+        return err;
+}
+
 static bool reg_query_database(struct regulatory_request *request)
 {
-        /* query internal regulatory database (if it exists) */
-        if (reg_query_builtin(request->alpha2) == 0)
+        if (query_regdb_file(request->alpha2) == 0)
                 return true;
 
         if (call_crda(request->alpha2) == 0)
@@ -3281,24 +3644,13 @@ void regulatory_propagate_dfs_state(struct wiphy *wiphy,
         }
 }
 
-int __init regulatory_init(void)
+static int __init regulatory_init_db(void)
 {
-        int err = 0;
-
-        reg_pdev = platform_device_register_simple("regulatory", 0, NULL, 0);
-        if (IS_ERR(reg_pdev))
-                return PTR_ERR(reg_pdev);
+        int err;
 
-        spin_lock_init(&reg_requests_lock);
-        spin_lock_init(&reg_pending_beacons_lock);
-        spin_lock_init(&reg_indoor_lock);
-
-        reg_regdb_size_check();
-
-        rcu_assign_pointer(cfg80211_regdomain, cfg80211_world_regdom);
-
-        user_alpha2[0] = '9';
-        user_alpha2[1] = '7';
+        err = load_builtin_regdb_keys();
+        if (err)
+                return err;
 
         /* We always try to get an update for the static regdomain */
         err = regulatory_hint_core(cfg80211_world_regdom->alpha2);
@@ -3327,6 +3679,31 @@ int __init regulatory_init(void)
 
         return 0;
 }
+#ifndef MODULE
+late_initcall(regulatory_init_db);
+#endif
+
+int __init regulatory_init(void)
+{
+        reg_pdev = platform_device_register_simple("regulatory", 0, NULL, 0);
+        if (IS_ERR(reg_pdev))
+                return PTR_ERR(reg_pdev);
+
+        spin_lock_init(&reg_requests_lock);
+        spin_lock_init(&reg_pending_beacons_lock);
+        spin_lock_init(&reg_indoor_lock);
+
+        rcu_assign_pointer(cfg80211_regdomain, cfg80211_world_regdom);
+
+        user_alpha2[0] = '9';
+        user_alpha2[1] = '7';
+
+#ifdef MODULE
+        return regulatory_init_db();
+#else
+        return 0;
+#endif
+}
 
 void regulatory_exit(void)
 {
@@ -3360,4 +3737,9 @@ void regulatory_exit(void)
                 list_del(&reg_request->list);
                 kfree(reg_request);
         }
+
+        if (!IS_ERR_OR_NULL(regdb))
+                kfree(regdb);
+
+        free_regdb_keyring();
 }
diff --git a/net/wireless/reg.h b/net/wireless/reg.h
index ca7fedf2e7a1..9ceeb5f3a7cb 100644
--- a/net/wireless/reg.h
+++ b/net/wireless/reg.h
@@ -1,5 +1,8 @@
 #ifndef __NET_WIRELESS_REG_H
 #define __NET_WIRELESS_REG_H
+
+#include <net/cfg80211.h>
+
 /*
  * Copyright 2008-2011  Luis R. Rodriguez <mcgrof@qca.qualcomm.com>
  *
@@ -179,4 +182,15 @@ void regulatory_propagate_dfs_state(struct wiphy *wiphy,
  * @wiphy2 - wiphy it's dfs_region to be checked against that of wiphy1
  */
 bool reg_dfs_domain_same(struct wiphy *wiphy1, struct wiphy *wiphy2);
+
+/**
+ * reg_reload_regdb - reload the regulatory.db firmware file
+ */
+int reg_reload_regdb(void);
+
+extern const u8 shipped_regdb_certs[];
+extern unsigned int shipped_regdb_certs_len;
+extern const u8 extra_regdb_certs[];
+extern unsigned int extra_regdb_certs_len;
+
 #endif  /* __NET_WIRELESS_REG_H */
diff --git a/net/wireless/regdb.h b/net/wireless/regdb.h
deleted file mode 100644
index 3279cfcefb0c..000000000000
--- a/net/wireless/regdb.h
+++ /dev/null
@@ -1,23 +0,0 @@
-#ifndef __REGDB_H__
-#define __REGDB_H__
-
-/*
- * Copyright 2009 John W. Linville <linville@tuxdriver.com>
- *
- * Permission to use, copy, modify, and/or distribute this software for any
- * purpose with or without fee is hereby granted, provided that the above
- * copyright notice and this permission notice appear in all copies.
- *
- * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
- * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
- * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
- * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
- * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
- * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
- * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
- */
-
-extern const struct ieee80211_regdomain *reg_regdb[];
-extern int reg_regdb_size;
-
-#endif /* __REGDB_H__ */
diff --git a/net/wireless/sme.c b/net/wireless/sme.c
index 3dd05a08c60a..fdb3646274a5 100644
--- a/net/wireless/sme.c
+++ b/net/wireless/sme.c
@@ -956,7 +956,6 @@ void cfg80211_roamed(struct net_device *dev, struct cfg80211_roam_info *info,
         ev->rm.resp_ie_len = info->resp_ie_len;
         memcpy((void *)ev->rm.resp_ie, info->resp_ie, info->resp_ie_len);
         ev->rm.bss = info->bss;
-        ev->rm.authorized = info->authorized;
 
         spin_lock_irqsave(&wdev->event_lock, flags);
         list_add_tail(&ev->list, &wdev->event_list);
@@ -965,6 +964,50 @@ void cfg80211_roamed(struct net_device *dev, struct cfg80211_roam_info *info,
 }
 EXPORT_SYMBOL(cfg80211_roamed);
 
+void __cfg80211_port_authorized(struct wireless_dev *wdev, const u8 *bssid)
+{
+        ASSERT_WDEV_LOCK(wdev);
+
+        if (WARN_ON(wdev->iftype != NL80211_IFTYPE_STATION))
+                return;
+
+        if (WARN_ON(!wdev->current_bss) ||
+            WARN_ON(!ether_addr_equal(wdev->current_bss->pub.bssid, bssid)))
+                return;
+
+        nl80211_send_port_authorized(wiphy_to_rdev(wdev->wiphy), wdev->netdev,
+                                     bssid);
+}
+
+void cfg80211_port_authorized(struct net_device *dev, const u8 *bssid,
+                              gfp_t gfp)
+{
+        struct wireless_dev *wdev = dev->ieee80211_ptr;
+        struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
+        struct cfg80211_event *ev;
+        unsigned long flags;
+
+        if (WARN_ON(!bssid))
+                return;
+
+        ev = kzalloc(sizeof(*ev), gfp);
+        if (!ev)
+                return;
+
+        ev->type = EVENT_PORT_AUTHORIZED;
+        memcpy(ev->pa.bssid, bssid, ETH_ALEN);
+
+        /*
+         * Use the wdev event list so that if there are pending
+         * connected/roamed events, they will be reported first.
+         */
+        spin_lock_irqsave(&wdev->event_lock, flags);
+        list_add_tail(&ev->list, &wdev->event_list);
+        spin_unlock_irqrestore(&wdev->event_lock, flags);
+        queue_work(cfg80211_wq, &rdev->event_work);
+}
+EXPORT_SYMBOL(cfg80211_port_authorized);
+
 void __cfg80211_disconnected(struct net_device *dev, const u8 *ie,
                              size_t ie_len, u16 reason, bool from_ap)
 {
diff --git a/net/wireless/util.c b/net/wireless/util.c
index c1238d582fd1..c69160694b6c 100644
--- a/net/wireless/util.c
+++ b/net/wireless/util.c
@@ -158,32 +158,30 @@ static void set_mandatory_flags_band(struct ieee80211_supported_band *sband)
         case NL80211_BAND_2GHZ:
                 want = 7;
                 for (i = 0; i < sband->n_bitrates; i++) {
-                        if (sband->bitrates[i].bitrate == 10) {
+                        switch (sband->bitrates[i].bitrate) {
+                        case 10:
+                        case 20:
+                        case 55:
+                        case 110:
                                 sband->bitrates[i].flags |=
                                         IEEE80211_RATE_MANDATORY_B |
                                         IEEE80211_RATE_MANDATORY_G;
                                 want--;
-                        }
-
-                        if (sband->bitrates[i].bitrate == 20 ||
-                            sband->bitrates[i].bitrate == 55 ||
-                            sband->bitrates[i].bitrate == 110 ||
-                            sband->bitrates[i].bitrate == 60 ||
-                            sband->bitrates[i].bitrate == 120 ||
-                            sband->bitrates[i].bitrate == 240) {
+                                break;
+                        case 60:
+                        case 120:
+                        case 240:
                                 sband->bitrates[i].flags |=
                                         IEEE80211_RATE_MANDATORY_G;
                                 want--;
-                        }
-
-                        if (sband->bitrates[i].bitrate != 10 &&
-                            sband->bitrates[i].bitrate != 20 &&
-                            sband->bitrates[i].bitrate != 55 &&
-                            sband->bitrates[i].bitrate != 110)
+                                /* fall through */
+                        default:
                                 sband->bitrates[i].flags |=
                                         IEEE80211_RATE_ERP_G;
+                                break;
+                        }
                 }
-                WARN_ON(want != 0 && want != 3 && want != 6);
+                WARN_ON(want != 0 && want != 3);
                 break;
         case NL80211_BAND_60GHZ:
                 /* check for mandatory HT MCS 1..4 */
@@ -530,121 +528,6 @@ int ieee80211_data_to_8023_exthdr(struct sk_buff *skb, struct ethhdr *ehdr,
 }
 EXPORT_SYMBOL(ieee80211_data_to_8023_exthdr);
 
-int ieee80211_data_from_8023(struct sk_buff *skb, const u8 *addr,
-                             enum nl80211_iftype iftype,
-                             const u8 *bssid, bool qos)
-{
-        struct ieee80211_hdr hdr;
-        u16 hdrlen, ethertype;
-        __le16 fc;
-        const u8 *encaps_data;
-        int encaps_len, skip_header_bytes;
-        int nh_pos, h_pos;
-        int head_need;
-
-        if (unlikely(skb->len < ETH_HLEN))
-                return -EINVAL;
-
-        nh_pos = skb_network_header(skb) - skb->data;
-        h_pos = skb_transport_header(skb) - skb->data;
-
-        /* convert Ethernet header to proper 802.11 header (based on
-         * operation mode) */
-        ethertype = (skb->data[12] << 8) | skb->data[13];
-        fc = cpu_to_le16(IEEE80211_FTYPE_DATA | IEEE80211_STYPE_DATA);
-
-        switch (iftype) {
-        case NL80211_IFTYPE_AP:
-        case NL80211_IFTYPE_AP_VLAN:
-        case NL80211_IFTYPE_P2P_GO:
-                fc |= cpu_to_le16(IEEE80211_FCTL_FROMDS);
-                /* DA BSSID SA */
-                memcpy(hdr.addr1, skb->data, ETH_ALEN);
-                memcpy(hdr.addr2, addr, ETH_ALEN);
-                memcpy(hdr.addr3, skb->data + ETH_ALEN, ETH_ALEN);
-                hdrlen = 24;
-                break;
-        case NL80211_IFTYPE_STATION:
-        case NL80211_IFTYPE_P2P_CLIENT:
-                fc |= cpu_to_le16(IEEE80211_FCTL_TODS);
-                /* BSSID SA DA */
-                memcpy(hdr.addr1, bssid, ETH_ALEN);
-                memcpy(hdr.addr2, skb->data + ETH_ALEN, ETH_ALEN);
-                memcpy(hdr.addr3, skb->data, ETH_ALEN);
-                hdrlen = 24;
-                break;
-        case NL80211_IFTYPE_OCB:
-        case NL80211_IFTYPE_ADHOC:
-                /* DA SA BSSID */
-                memcpy(hdr.addr1, skb->data, ETH_ALEN);
-                memcpy(hdr.addr2, skb->data + ETH_ALEN, ETH_ALEN);
-                memcpy(hdr.addr3, bssid, ETH_ALEN);
-                hdrlen = 24;
-                break;
-        default:
-                return -EOPNOTSUPP;
-        }
-
-        if (qos) {
-                fc |= cpu_to_le16(IEEE80211_STYPE_QOS_DATA);
-                hdrlen += 2;
-        }
-
-        hdr.frame_control = fc;
-        hdr.duration_id = 0;
-        hdr.seq_ctrl = 0;
-
-        skip_header_bytes = ETH_HLEN;
-        if (ethertype == ETH_P_AARP || ethertype == ETH_P_IPX) {
-                encaps_data = bridge_tunnel_header;
-                encaps_len = sizeof(bridge_tunnel_header);
-                skip_header_bytes -= 2;
-        } else if (ethertype >= ETH_P_802_3_MIN) {
-                encaps_data = rfc1042_header;
-                encaps_len = sizeof(rfc1042_header);
-                skip_header_bytes -= 2;
-        } else {
-                encaps_data = NULL;
-                encaps_len = 0;
-        }
-
-        skb_pull(skb, skip_header_bytes);
-        nh_pos -= skip_header_bytes;
-        h_pos -= skip_header_bytes;
-
-        head_need = hdrlen + encaps_len - skb_headroom(skb);
-
-        if (head_need > 0 || skb_cloned(skb)) {
-                head_need = max(head_need, 0);
-                if (head_need)
-                        skb_orphan(skb);
-
-                if (pskb_expand_head(skb, head_need, 0, GFP_ATOMIC))
-                        return -ENOMEM;
-        }
-
-        if (encaps_data) {
-                memcpy(skb_push(skb, encaps_len), encaps_data, encaps_len);
-                nh_pos += encaps_len;
-                h_pos += encaps_len;
-        }
-
-        memcpy(skb_push(skb, hdrlen), &hdr, hdrlen);
-
-        nh_pos += hdrlen;
-        h_pos += hdrlen;
-
-        /* Update skb pointers to various headers since this modified frame
-         * is going to go through Linux networking code that may potentially
-         * need things like pointer to IP header. */
-        skb_reset_mac_header(skb);
-        skb_set_network_header(skb, nh_pos);
-        skb_set_transport_header(skb, h_pos);
-
-        return 0;
-}
-EXPORT_SYMBOL(ieee80211_data_from_8023);
-
 static void
 __frame_add_frag(struct sk_buff *skb, struct page *page,
                  void *ptr, int len, int size)
@@ -964,6 +847,9 @@ void cfg80211_process_wdev_events(struct wireless_dev *wdev)
                 case EVENT_STOPPED:
                         __cfg80211_leave(wiphy_to_rdev(wdev->wiphy), wdev);
                         break;
+                case EVENT_PORT_AUTHORIZED:
+                        __cfg80211_port_authorized(wdev, ev->pa.bssid);
+                        break;
                 }
                 wdev_unlock(wdev);
 
@@ -1368,13 +1254,29 @@ int cfg80211_get_p2p_attr(const u8 *ies, unsigned int len,
 }
 EXPORT_SYMBOL(cfg80211_get_p2p_attr);
 
-static bool ieee80211_id_in_list(const u8 *ids, int n_ids, u8 id)
+static bool ieee80211_id_in_list(const u8 *ids, int n_ids, u8 id, bool id_ext)
 {
         int i;
 
-        for (i = 0; i < n_ids; i++)
-                if (ids[i] == id)
+        /* Make sure array values are legal */
+        if (WARN_ON(ids[n_ids - 1] == WLAN_EID_EXTENSION))
+                return false;
+
+        i = 0;
+        while (i < n_ids) {
+                if (ids[i] == WLAN_EID_EXTENSION) {
+                        if (id_ext && (ids[i + 1] == id))
+                                return true;
+
+                        i += 2;
+                        continue;
+                }
+
+                if (ids[i] == id && !id_ext)
                         return true;
+
+                i++;
+        }
         return false;
 }
 
@@ -1404,14 +1306,36 @@ size_t ieee80211_ie_split_ric(const u8 *ies, size_t ielen,
 {
         size_t pos = offset;
 
-        while (pos < ielen && ieee80211_id_in_list(ids, n_ids, ies[pos])) {
+        while (pos < ielen) {
+                u8 ext = 0;
+
+                if (ies[pos] == WLAN_EID_EXTENSION)
+                        ext = 2;
+                if ((pos + ext) >= ielen)
+                        break;
+
+                if (!ieee80211_id_in_list(ids, n_ids, ies[pos + ext],
+                                          ies[pos] == WLAN_EID_EXTENSION))
+                        break;
+
                 if (ies[pos] == WLAN_EID_RIC_DATA && n_after_ric) {
                         pos = skip_ie(ies, ielen, pos);
 
-                        while (pos < ielen &&
-                               !ieee80211_id_in_list(after_ric, n_after_ric,
-                                                     ies[pos]))
-                                pos = skip_ie(ies, ielen, pos);
+                        while (pos < ielen) {
+                                if (ies[pos] == WLAN_EID_EXTENSION)
+                                        ext = 2;
+                                else
+                                        ext = 0;
+
+                                if ((pos + ext) >= ielen)
+                                        break;
+
+                                if (!ieee80211_id_in_list(after_ric,
+                                                          n_after_ric,
+                                                          ies[pos + ext],
+                                                          ext == 2))
+                                        pos = skip_ie(ies, ielen, pos);
+                        }
                 } else {
                         pos = skip_ie(ies, ielen, pos);
                 }
diff --git a/net/x25/af_x25.c b/net/x25/af_x25.c
index ac095936552d..562cc11131f6 100644
--- a/net/x25/af_x25.c
+++ b/net/x25/af_x25.c
@@ -374,9 +374,11 @@ static void __x25_destroy_socket(struct sock *);
 /*
  *      handler for deferred kills.
  */
-static void x25_destroy_timer(unsigned long data)
+static void x25_destroy_timer(struct timer_list *t)
 {
-        x25_destroy_socket_from_timer((struct sock *)data);
+        struct sock *sk = from_timer(sk, t, sk_timer);
+
+        x25_destroy_socket_from_timer(sk);
 }
 
 /*
@@ -414,7 +416,6 @@ static void __x25_destroy_socket(struct sock *sk)
                 /* Defer: outstanding buffers */
                 sk->sk_timer.expires  = jiffies + 10 * HZ;
                 sk->sk_timer.function = x25_destroy_timer;
-                sk->sk_timer.data = (unsigned long)sk;
                 add_timer(&sk->sk_timer);
         } else {
                 /* drop last reference so sock_put will free */
diff --git a/net/x25/x25_facilities.c b/net/x25/x25_facilities.c
index 997ff7b2509b..ad1734d36ed7 100644
--- a/net/x25/x25_facilities.c
+++ b/net/x25/x25_facilities.c
@@ -103,7 +103,7 @@ int x25_parse_facilities(struct sk_buff *skb, struct x25_facilities *facilities,
                                         *vc_fac_mask |= X25_MASK_REVERSE;
                                         break;
                                 }
-
+                                /*fall through */
                         case X25_FAC_THROUGHPUT:
                                 facilities->throughput = p[1];
                                 *vc_fac_mask |= X25_MASK_THROUGHPUT;
diff --git a/net/x25/x25_in.c b/net/x25/x25_in.c
index 7ac50098a375..3c12cae32001 100644
--- a/net/x25/x25_in.c
+++ b/net/x25/x25_in.c
@@ -345,6 +345,7 @@ static int x25_state4_machine(struct sock *sk, struct sk_buff *skb, int frametyp
 
                 case X25_RESET_REQUEST:
                         x25_write_internal(sk, X25_RESET_CONFIRMATION);
+                        /* fall through */
                 case X25_RESET_CONFIRMATION: {
                         x25_stop_timer(sk);
                         x25->condition = 0x00;
diff --git a/net/x25/x25_link.c b/net/x25/x25_link.c
index e0cd04d28352..a6a8ab09b914 100644
--- a/net/x25/x25_link.c
+++ b/net/x25/x25_link.c
@@ -36,7 +36,7 @@
 LIST_HEAD(x25_neigh_list);
 DEFINE_RWLOCK(x25_neigh_list_lock);
 
-static void x25_t20timer_expiry(unsigned long);
+static void x25_t20timer_expiry(struct timer_list *);
 
 static void x25_transmit_restart_confirmation(struct x25_neigh *nb);
 static void x25_transmit_restart_request(struct x25_neigh *nb);
@@ -49,9 +49,9 @@ static inline void x25_start_t20timer(struct x25_neigh *nb)
         mod_timer(&nb->t20timer, jiffies + nb->t20);
 }
 
-static void x25_t20timer_expiry(unsigned long param)
+static void x25_t20timer_expiry(struct timer_list *t)
 {
-        struct x25_neigh *nb = (struct x25_neigh *)param;
+        struct x25_neigh *nb = from_timer(nb, t, t20timer);
 
         x25_transmit_restart_request(nb);
 
@@ -252,7 +252,7 @@ void x25_link_device_up(struct net_device *dev)
                 return;
 
         skb_queue_head_init(&nb->queue);
-        setup_timer(&nb->t20timer, x25_t20timer_expiry, (unsigned long)nb);
+        timer_setup(&nb->t20timer, x25_t20timer_expiry, 0);
 
         dev_hold(dev);
         nb->dev      = dev;
diff --git a/net/x25/x25_timer.c b/net/x25/x25_timer.c
index 5c5db1a36399..fa3461002b3e 100644
--- a/net/x25/x25_timer.c
+++ b/net/x25/x25_timer.c
@@ -26,18 +26,17 @@
 #include <net/tcp_states.h>
 #include <net/x25.h>
 
-static void x25_heartbeat_expiry(unsigned long);
-static void x25_timer_expiry(unsigned long);
+static void x25_heartbeat_expiry(struct timer_list *t);
+static void x25_timer_expiry(struct timer_list *t);
 
 void x25_init_timers(struct sock *sk)
 {
         struct x25_sock *x25 = x25_sk(sk);
 
-        setup_timer(&x25->timer, x25_timer_expiry, (unsigned long)sk);
+        timer_setup(&x25->timer, x25_timer_expiry, 0);
 
         /* initialized by sock_init_data */
-        sk->sk_timer.data     = (unsigned long)sk;
-        sk->sk_timer.function = &x25_heartbeat_expiry;
+        sk->sk_timer.function = x25_heartbeat_expiry;
 }
 
 void x25_start_heartbeat(struct sock *sk)
@@ -93,9 +92,9 @@ unsigned long x25_display_timer(struct sock *sk)
         return x25->timer.expires - jiffies;
 }
 
-static void x25_heartbeat_expiry(unsigned long param)
+static void x25_heartbeat_expiry(struct timer_list *t)
 {
-        struct sock *sk = (struct sock *)param;
+        struct sock *sk = from_timer(sk, t, sk_timer);
 
         bh_lock_sock(sk);
         if (sock_owned_by_user(sk)) /* can currently only occur in state 3 */
@@ -160,9 +159,10 @@ static inline void x25_do_timer_expiry(struct sock * sk)
         }
 }
 
-static void x25_timer_expiry(unsigned long param)
+static void x25_timer_expiry(struct timer_list *t)
 {
-        struct sock *sk = (struct sock *)param;
+        struct x25_sock *x25 = from_timer(x25, t, timer);
+        struct sock *sk = &x25->sk;
 
         bh_lock_sock(sk);
         if (sock_owned_by_user(sk)) { /* can currently only occur in state 3 */
diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c
index 6eb228a70131..9542975eb2f9 100644
--- a/net/xfrm/xfrm_policy.c
+++ b/net/xfrm/xfrm_policy.c
@@ -57,7 +57,7 @@ static __read_mostly seqcount_t xfrm_policy_hash_generation;
 static void xfrm_init_pmtu(struct dst_entry *dst);
 static int stale_bundle(struct dst_entry *dst);
 static int xfrm_bundle_ok(struct xfrm_dst *xdst);
-static void xfrm_policy_queue_process(unsigned long arg);
+static void xfrm_policy_queue_process(struct timer_list *t);
 
 static void __xfrm_policy_link(struct xfrm_policy *pol, int dir);
 static struct xfrm_policy *__xfrm_policy_unlink(struct xfrm_policy *pol,
@@ -179,9 +179,9 @@ static inline unsigned long make_jiffies(long secs)
                 return secs*HZ;
 }
 
-static void xfrm_policy_timer(unsigned long data)
+static void xfrm_policy_timer(struct timer_list *t)
 {
-        struct xfrm_policy *xp = (struct xfrm_policy *)data;
+        struct xfrm_policy *xp = from_timer(xp, t, timer);
         unsigned long now = get_seconds();
         long next = LONG_MAX;
         int warn = 0;
@@ -267,10 +267,9 @@ struct xfrm_policy *xfrm_policy_alloc(struct net *net, gfp_t gfp)
                 rwlock_init(&policy->lock);
                 refcount_set(&policy->refcnt, 1);
                 skb_queue_head_init(&policy->polq.hold_queue);
-                setup_timer(&policy->timer, xfrm_policy_timer,
-                                (unsigned long)policy);
-                setup_timer(&policy->polq.hold_timer, xfrm_policy_queue_process,
-                            (unsigned long)policy);
+                timer_setup(&policy->timer, xfrm_policy_timer, 0);
+                timer_setup(&policy->polq.hold_timer,
+                            xfrm_policy_queue_process, 0);
         }
         return policy;
 }
@@ -1306,6 +1305,7 @@ static struct xfrm_policy *clone_policy(const struct xfrm_policy *old, int dir)
                 newp->xfrm_nr = old->xfrm_nr;
                 newp->index = old->index;
                 newp->type = old->type;
+                newp->family = old->family;
                 memcpy(newp->xfrm_vec, old->xfrm_vec,
                        newp->xfrm_nr*sizeof(struct xfrm_tmpl));
                 spin_lock_bh(&net->xfrm.xfrm_policy_lock);
@@ -1361,29 +1361,36 @@ xfrm_tmpl_resolve_one(struct xfrm_policy *policy, const struct flowi *fl,
         struct net *net = xp_net(policy);
         int nx;
         int i, error;
+        xfrm_address_t *daddr = xfrm_flowi_daddr(fl, family);
+        xfrm_address_t *saddr = xfrm_flowi_saddr(fl, family);
         xfrm_address_t tmp;
 
         for (nx = 0, i = 0; i < policy->xfrm_nr; i++) {
                 struct xfrm_state *x;
-                xfrm_address_t *local;
-                xfrm_address_t *remote;
+                xfrm_address_t *remote = daddr;
+                xfrm_address_t *local  = saddr;
                 struct xfrm_tmpl *tmpl = &policy->xfrm_vec[i];
 
-                remote = &tmpl->id.daddr;
-                local = &tmpl->saddr;
-                if (xfrm_addr_any(local, tmpl->encap_family)) {
-                        error = xfrm_get_saddr(net, fl->flowi_oif,
-                                               &tmp, remote,
-                                               tmpl->encap_family, 0);
-                        if (error)
-                                goto fail;
-                        local = &tmp;
+                if (tmpl->mode == XFRM_MODE_TUNNEL ||
+                    tmpl->mode == XFRM_MODE_BEET) {
+                        remote = &tmpl->id.daddr;
+                        local = &tmpl->saddr;
+                        if (xfrm_addr_any(local, tmpl->encap_family)) {
+                                error = xfrm_get_saddr(net, fl->flowi_oif,
+                                                       &tmp, remote,
+                                                       tmpl->encap_family, 0);
+                                if (error)
+                                        goto fail;
+                                local = &tmp;
+                        }
                 }
 
                 x = xfrm_state_find(remote, local, fl, tmpl, policy, &error, family);
 
                 if (x && x->km.state == XFRM_STATE_VALID) {
                         xfrm[nx++] = x;
+                        daddr = remote;
+                        saddr = local;
                         continue;
                 }
                 if (x) {
@@ -1851,12 +1858,12 @@ xfrm_resolve_and_create_bundle(struct xfrm_policy **pols, int num_pols,
         return xdst;
 }
 
-static void xfrm_policy_queue_process(unsigned long arg)
+static void xfrm_policy_queue_process(struct timer_list *t)
 {
         struct sk_buff *skb;
         struct sock *sk;
         struct dst_entry *dst;
-        struct xfrm_policy *pol = (struct xfrm_policy *)arg;
+        struct xfrm_policy *pol = from_timer(pol, t, polq.hold_timer);
         struct net *net = xp_net(pol);
         struct xfrm_policy_queue *pq = &pol->polq;
         struct flowi fl;
diff --git a/net/xfrm/xfrm_state.c b/net/xfrm/xfrm_state.c
index 1f5cee2269af..065d89606888 100644
--- a/net/xfrm/xfrm_state.c
+++ b/net/xfrm/xfrm_state.c
@@ -556,7 +556,7 @@ out:
         return HRTIMER_NORESTART;
 }
 
-static void xfrm_replay_timer_handler(unsigned long data);
+static void xfrm_replay_timer_handler(struct timer_list *t);
 
 struct xfrm_state *xfrm_state_alloc(struct net *net)
 {
@@ -574,8 +574,7 @@ struct xfrm_state *xfrm_state_alloc(struct net *net)
                 INIT_HLIST_NODE(&x->byspi);
                 tasklet_hrtimer_init(&x->mtimer, xfrm_timer_handler,
                                         CLOCK_BOOTTIME, HRTIMER_MODE_ABS);
-                setup_timer(&x->rtimer, xfrm_replay_timer_handler,
-                                (unsigned long)x);
+                timer_setup(&x->rtimer, xfrm_replay_timer_handler, 0);
                 x->curlft.add_time = get_seconds();
                 x->lft.soft_byte_limit = XFRM_INF;
                 x->lft.soft_packet_limit = XFRM_INF;
@@ -1879,9 +1878,9 @@ void xfrm_state_walk_done(struct xfrm_state_walk *walk, struct net *net)
 }
 EXPORT_SYMBOL(xfrm_state_walk_done);
 
-static void xfrm_replay_timer_handler(unsigned long data)
+static void xfrm_replay_timer_handler(struct timer_list *t)
 {
-        struct xfrm_state *x = (struct xfrm_state *)data;
+        struct xfrm_state *x = from_timer(x, t, rtimer);
 
         spin_lock(&x->lock);
 
diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c
index e44a0fed48dd..983b0233767b 100644
--- a/net/xfrm/xfrm_user.c
+++ b/net/xfrm/xfrm_user.c
@@ -42,7 +42,7 @@ static int verify_one_alg(struct nlattr **attrs, enum xfrm_attr_type_t type)
                 return 0;
 
         algp = nla_data(rt);
-        if (nla_len(rt) < xfrm_alg_len(algp))
+        if (nla_len(rt) < (int)xfrm_alg_len(algp))
                 return -EINVAL;
 
         switch (type) {
@@ -68,7 +68,7 @@ static int verify_auth_trunc(struct nlattr **attrs)
                 return 0;
 
         algp = nla_data(rt);
-        if (nla_len(rt) < xfrm_alg_auth_len(algp))
+        if (nla_len(rt) < (int)xfrm_alg_auth_len(algp))
                 return -EINVAL;
 
         algp->alg_name[sizeof(algp->alg_name) - 1] = '\0';
@@ -84,7 +84,7 @@ static int verify_aead(struct nlattr **attrs)
                 return 0;
 
         algp = nla_data(rt);
-        if (nla_len(rt) < aead_len(algp))
+        if (nla_len(rt) < (int)aead_len(algp))
                 return -EINVAL;
 
         algp->alg_name[sizeof(algp->alg_name) - 1] = '\0';
@@ -130,7 +130,7 @@ static inline int verify_replay(struct xfrm_usersa_info *p,
                 if (rs->bmp_len > XFRMA_REPLAY_ESN_MAX / sizeof(rs->bmp[0]) / 8)
                         return -EINVAL;
 
-                if (nla_len(rt) < xfrm_replay_state_esn_len(rs) &&
+                if (nla_len(rt) < (int)xfrm_replay_state_esn_len(rs) &&
                     nla_len(rt) != sizeof(*rs))
                         return -EINVAL;
         }
@@ -404,7 +404,7 @@ static inline int xfrm_replay_verify_len(struct xfrm_replay_state_esn *replay_es
                                          struct nlattr *rp)
 {
         struct xfrm_replay_state_esn *up;
-        int ulen;
+        unsigned int ulen;
 
         if (!replay_esn || !rp)
                 return 0;
@@ -414,7 +414,7 @@ static inline int xfrm_replay_verify_len(struct xfrm_replay_state_esn *replay_es
 
         /* Check the overall length and the internal bitmap length to avoid
          * potential overflow. */
-        if (nla_len(rp) < ulen ||
+        if (nla_len(rp) < (int)ulen ||
             xfrm_replay_state_esn_len(replay_esn) != ulen ||
             replay_esn->bmp_len != up->bmp_len)
                 return -EINVAL;
@@ -430,14 +430,14 @@ static int xfrm_alloc_replay_state_esn(struct xfrm_replay_state_esn **replay_esn
                                        struct nlattr *rta)
 {
         struct xfrm_replay_state_esn *p, *pp, *up;
-        int klen, ulen;
+        unsigned int klen, ulen;
 
         if (!rta)
                 return 0;
 
         up = nla_data(rta);
         klen = xfrm_replay_state_esn_len(up);
-        ulen = nla_len(rta) >= klen ? klen : sizeof(*up);
+        ulen = nla_len(rta) >= (int)klen ? klen : sizeof(*up);
 
         p = kzalloc(klen, GFP_KERNEL);
         if (!p)
@@ -458,9 +458,9 @@ static int xfrm_alloc_replay_state_esn(struct xfrm_replay_state_esn **replay_esn
         return 0;
 }
 
-static inline int xfrm_user_sec_ctx_size(struct xfrm_sec_ctx *xfrm_ctx)
+static inline unsigned int xfrm_user_sec_ctx_size(struct xfrm_sec_ctx *xfrm_ctx)
 {
-        int len = 0;
+        unsigned int len = 0;
 
         if (xfrm_ctx) {
                 len += sizeof(struct xfrm_user_sec_ctx);
@@ -1032,7 +1032,7 @@ static inline int xfrm_nlmsg_multicast(struct net *net, struct sk_buff *skb,
                 return -1;
 }
 
-static inline size_t xfrm_spdinfo_msgsize(void)
+static inline unsigned int xfrm_spdinfo_msgsize(void)
 {
         return NLMSG_ALIGN(4)
                + nla_total_size(sizeof(struct xfrmu_spdinfo))
@@ -1147,18 +1147,19 @@ static int xfrm_get_spdinfo(struct sk_buff *skb, struct nlmsghdr *nlh,
         u32 *flags = nlmsg_data(nlh);
         u32 sportid = NETLINK_CB(skb).portid;
         u32 seq = nlh->nlmsg_seq;
+        int err;
 
         r_skb = nlmsg_new(xfrm_spdinfo_msgsize(), GFP_ATOMIC);
         if (r_skb == NULL)
                 return -ENOMEM;
 
-        if (build_spdinfo(r_skb, net, sportid, seq, *flags) < 0)
-                BUG();
+        err = build_spdinfo(r_skb, net, sportid, seq, *flags);
+        BUG_ON(err < 0);
 
         return nlmsg_unicast(net->xfrm.nlsk, r_skb, sportid);
 }
 
-static inline size_t xfrm_sadinfo_msgsize(void)
+static inline unsigned int xfrm_sadinfo_msgsize(void)
 {
         return NLMSG_ALIGN(4)
                + nla_total_size(sizeof(struct xfrmu_sadhinfo))
@@ -1205,13 +1206,14 @@ static int xfrm_get_sadinfo(struct sk_buff *skb, struct nlmsghdr *nlh,
         u32 *flags = nlmsg_data(nlh);
         u32 sportid = NETLINK_CB(skb).portid;
         u32 seq = nlh->nlmsg_seq;
+        int err;
 
         r_skb = nlmsg_new(xfrm_sadinfo_msgsize(), GFP_ATOMIC);
         if (r_skb == NULL)
                 return -ENOMEM;
 
-        if (build_sadinfo(r_skb, net, sportid, seq, *flags) < 0)
-                BUG();
+        err = build_sadinfo(r_skb, net, sportid, seq, *flags);
+        BUG_ON(err < 0);
 
         return nlmsg_unicast(net->xfrm.nlsk, r_skb, sportid);
 }
@@ -1634,7 +1636,7 @@ static inline int copy_to_user_sec_ctx(struct xfrm_policy *xp, struct sk_buff *s
                 return copy_sec_ctx(xp->security, skb);
         return 0;
 }
-static inline size_t userpolicy_type_attrsize(void)
+static inline unsigned int userpolicy_type_attrsize(void)
 {
 #ifdef CONFIG_XFRM_SUB_POLICY
         return nla_total_size(sizeof(struct xfrm_userpolicy_type));
@@ -1853,9 +1855,9 @@ static int xfrm_flush_sa(struct sk_buff *skb, struct nlmsghdr *nlh,
         return 0;
 }
 
-static inline size_t xfrm_aevent_msgsize(struct xfrm_state *x)
+static inline unsigned int xfrm_aevent_msgsize(struct xfrm_state *x)
 {
-        size_t replay_size = x->replay_esn ?
+        unsigned int replay_size = x->replay_esn ?
                               xfrm_replay_state_esn_len(x->replay_esn) :
                               sizeof(struct xfrm_replay_state);
 
@@ -1960,8 +1962,9 @@ static int xfrm_get_ae(struct sk_buff *skb, struct nlmsghdr *nlh,
         c.seq = nlh->nlmsg_seq;
         c.portid = nlh->nlmsg_pid;
 
-        if (build_aevent(r_skb, x, &c) < 0)
-                BUG();
+        err = build_aevent(r_skb, x, &c);
+        BUG_ON(err < 0);
+
         err = nlmsg_unicast(net->xfrm.nlsk, r_skb, NETLINK_CB(skb).portid);
         spin_unlock_bh(&x->lock);
         xfrm_state_put(x);
@@ -2324,8 +2327,8 @@ static int copy_to_user_kmaddress(const struct xfrm_kmaddress *k, struct sk_buff
         return nla_put(skb, XFRMA_KMADDRESS, sizeof(uk), &uk);
 }
 
-static inline size_t xfrm_migrate_msgsize(int num_migrate, int with_kma,
-                                          int with_encp)
+static inline unsigned int xfrm_migrate_msgsize(int num_migrate, int with_kma,
+                                                int with_encp)
 {
         return NLMSG_ALIGN(sizeof(struct xfrm_userpolicy_id))
               + (with_kma ? nla_total_size(sizeof(struct xfrm_kmaddress)) : 0)
@@ -2388,6 +2391,7 @@ static int xfrm_send_migrate(const struct xfrm_selector *sel, u8 dir, u8 type,
 {
         struct net *net = &init_net;
         struct sk_buff *skb;
+        int err;
 
         skb = nlmsg_new(xfrm_migrate_msgsize(num_migrate, !!k, !!encap),
                         GFP_ATOMIC);
@@ -2395,8 +2399,8 @@ static int xfrm_send_migrate(const struct xfrm_selector *sel, u8 dir, u8 type,
                 return -ENOMEM;
 
         /* build migrate */
-        if (build_migrate(skb, m, num_migrate, k, sel, encap, dir, type) < 0)
-                BUG();
+        err = build_migrate(skb, m, num_migrate, k, sel, encap, dir, type);
+        BUG_ON(err < 0);
 
         return xfrm_nlmsg_multicast(net, skb, 0, XFRMNLGRP_MIGRATE);
 }
@@ -2572,7 +2576,7 @@ static void xfrm_netlink_rcv(struct sk_buff *skb)
         mutex_unlock(&net->xfrm.xfrm_cfg_mutex);
 }
 
-static inline size_t xfrm_expire_msgsize(void)
+static inline unsigned int xfrm_expire_msgsize(void)
 {
         return NLMSG_ALIGN(sizeof(struct xfrm_user_expire))
                + nla_total_size(sizeof(struct xfrm_mark));
@@ -2623,13 +2627,14 @@ static int xfrm_aevent_state_notify(struct xfrm_state *x, const struct km_event
 {
         struct net *net = xs_net(x);
         struct sk_buff *skb;
+        int err;
 
         skb = nlmsg_new(xfrm_aevent_msgsize(x), GFP_ATOMIC);
         if (skb == NULL)
                 return -ENOMEM;
 
-        if (build_aevent(skb, x, c) < 0)
-                BUG();
+        err = build_aevent(skb, x, c);
+        BUG_ON(err < 0);
 
         return xfrm_nlmsg_multicast(net, skb, 0, XFRMNLGRP_AEVENTS);
 }
@@ -2660,9 +2665,9 @@ static int xfrm_notify_sa_flush(const struct km_event *c)
         return xfrm_nlmsg_multicast(net, skb, 0, XFRMNLGRP_SA);
 }
 
-static inline size_t xfrm_sa_len(struct xfrm_state *x)
+static inline unsigned int xfrm_sa_len(struct xfrm_state *x)
 {
-        size_t l = 0;
+        unsigned int l = 0;
         if (x->aead)
                 l += nla_total_size(aead_len(x->aead));
         if (x->aalg) {
@@ -2707,8 +2712,9 @@ static int xfrm_notify_sa(struct xfrm_state *x, const struct km_event *c)
         struct xfrm_usersa_id *id;
         struct nlmsghdr *nlh;
         struct sk_buff *skb;
-        int len = xfrm_sa_len(x);
-        int headlen, err;
+        unsigned int len = xfrm_sa_len(x);
+        unsigned int headlen;
+        int err;
 
         headlen = sizeof(*p);
         if (c->event == XFRM_MSG_DELSA) {
@@ -2782,8 +2788,8 @@ static int xfrm_send_state_notify(struct xfrm_state *x, const struct km_event *c
 
 }
 
-static inline size_t xfrm_acquire_msgsize(struct xfrm_state *x,
-                                          struct xfrm_policy *xp)
+static inline unsigned int xfrm_acquire_msgsize(struct xfrm_state *x,
+                                                struct xfrm_policy *xp)
 {
         return NLMSG_ALIGN(sizeof(struct xfrm_user_acquire))
                + nla_total_size(sizeof(struct xfrm_user_tmpl) * xp->xfrm_nr)
@@ -2835,13 +2841,14 @@ static int xfrm_send_acquire(struct xfrm_state *x, struct xfrm_tmpl *xt,
 {
         struct net *net = xs_net(x);
         struct sk_buff *skb;
+        int err;
 
         skb = nlmsg_new(xfrm_acquire_msgsize(x, xp), GFP_ATOMIC);
         if (skb == NULL)
                 return -ENOMEM;
 
-        if (build_acquire(skb, x, xt, xp) < 0)
-                BUG();
+        err = build_acquire(skb, x, xt, xp);
+        BUG_ON(err < 0);
 
         return xfrm_nlmsg_multicast(net, skb, 0, XFRMNLGRP_ACQUIRE);
 }
@@ -2906,7 +2913,7 @@ static struct xfrm_policy *xfrm_compile_policy(struct sock *sk, int opt,
         return xp;
 }
 
-static inline size_t xfrm_polexpire_msgsize(struct xfrm_policy *xp)
+static inline unsigned int xfrm_polexpire_msgsize(struct xfrm_policy *xp)
 {
         return NLMSG_ALIGN(sizeof(struct xfrm_user_polexpire))
                + nla_total_size(sizeof(struct xfrm_user_tmpl) * xp->xfrm_nr)
@@ -2950,26 +2957,28 @@ static int xfrm_exp_policy_notify(struct xfrm_policy *xp, int dir, const struct
 {
         struct net *net = xp_net(xp);
         struct sk_buff *skb;
+        int err;
 
         skb = nlmsg_new(xfrm_polexpire_msgsize(xp), GFP_ATOMIC);
         if (skb == NULL)
                 return -ENOMEM;
 
-        if (build_polexpire(skb, xp, dir, c) < 0)
-                BUG();
+        err = build_polexpire(skb, xp, dir, c);
+        BUG_ON(err < 0);
 
         return xfrm_nlmsg_multicast(net, skb, 0, XFRMNLGRP_EXPIRE);
 }
 
 static int xfrm_notify_policy(struct xfrm_policy *xp, int dir, const struct km_event *c)
 {
-        int len = nla_total_size(sizeof(struct xfrm_user_tmpl) * xp->xfrm_nr);
+        unsigned int len = nla_total_size(sizeof(struct xfrm_user_tmpl) * xp->xfrm_nr);
         struct net *net = xp_net(xp);
         struct xfrm_userpolicy_info *p;
         struct xfrm_userpolicy_id *id;
         struct nlmsghdr *nlh;
         struct sk_buff *skb;
-        int headlen, err;
+        unsigned int headlen;
+        int err;
 
         headlen = sizeof(*p);
         if (c->event == XFRM_MSG_DELPOLICY) {
@@ -3076,7 +3085,7 @@ static int xfrm_send_policy_notify(struct xfrm_policy *xp, int dir, const struct
 
 }
 
-static inline size_t xfrm_report_msgsize(void)
+static inline unsigned int xfrm_report_msgsize(void)
 {
         return NLMSG_ALIGN(sizeof(struct xfrm_user_report));
 }
@@ -3110,18 +3119,19 @@ static int xfrm_send_report(struct net *net, u8 proto,
                             struct xfrm_selector *sel, xfrm_address_t *addr)
 {
         struct sk_buff *skb;
+        int err;
 
         skb = nlmsg_new(xfrm_report_msgsize(), GFP_ATOMIC);
         if (skb == NULL)
                 return -ENOMEM;
 
-        if (build_report(skb, proto, sel, addr) < 0)
-                BUG();
+        err = build_report(skb, proto, sel, addr);
+        BUG_ON(err < 0);
 
         return xfrm_nlmsg_multicast(net, skb, 0, XFRMNLGRP_REPORT);
 }
 
-static inline size_t xfrm_mapping_msgsize(void)
+static inline unsigned int xfrm_mapping_msgsize(void)
 {
         return NLMSG_ALIGN(sizeof(struct xfrm_user_mapping));
 }
@@ -3157,6 +3167,7 @@ static int xfrm_send_mapping(struct xfrm_state *x, xfrm_address_t *ipaddr,
 {
         struct net *net = xs_net(x);
         struct sk_buff *skb;
+        int err;
 
         if (x->id.proto != IPPROTO_ESP)
                 return -EINVAL;
@@ -3168,8 +3179,8 @@ static int xfrm_send_mapping(struct xfrm_state *x, xfrm_address_t *ipaddr,
         if (skb == NULL)
                 return -ENOMEM;
 
-        if (build_mapping(skb, x, ipaddr, sport) < 0)
-                BUG();
+        err = build_mapping(skb, x, ipaddr, sport);
+        BUG_ON(err < 0);
 
         return xfrm_nlmsg_multicast(net, skb, 0, XFRMNLGRP_MAPPING);
 }