240 files changed, 15877 insertions, 3545 deletions

diff --git a/net/802/Kconfig b/net/802/Kconfig
index be33d27c8e69..80d4bf78905d 100644
--- a/net/802/Kconfig
+++ b/net/802/Kconfig
@@ -5,3 +5,6 @@ config STP
 config GARP
         tristate
         select STP
+
+config MRP
+        tristate
diff --git a/net/802/Makefile b/net/802/Makefile
index a30d6e385aed..37e654d6615e 100644
--- a/net/802/Makefile
+++ b/net/802/Makefile
@@ -11,3 +11,4 @@ obj-$(CONFIG_IPX)	+= p8022.o psnap.o p8023.o
 obj-$(CONFIG_ATALK)     += p8022.o psnap.o
 obj-$(CONFIG_STP)       += stp.o
 obj-$(CONFIG_GARP)      += garp.o
+obj-$(CONFIG_MRP)       += mrp.o
diff --git a/net/802/mrp.c b/net/802/mrp.c
new file mode 100644
index 000000000000..a4cc3229952a
--- /dev/null
+++ b/net/802/mrp.c
@@ -0,0 +1,895 @@
+/*
+ *      IEEE 802.1Q Multiple Registration Protocol (MRP)
+ *
+ *      Copyright (c) 2012 Massachusetts Institute of Technology
+ *
+ *      Adapted from code in net/802/garp.c
+ *      Copyright (c) 2008 Patrick McHardy <kaber@trash.net>
+ *
+ *      This program is free software; you can redistribute it and/or
+ *      modify it under the terms of the GNU General Public License
+ *      version 2 as published by the Free Software Foundation.
+ */
+#include <linux/kernel.h>
+#include <linux/timer.h>
+#include <linux/skbuff.h>
+#include <linux/netdevice.h>
+#include <linux/etherdevice.h>
+#include <linux/rtnetlink.h>
+#include <linux/slab.h>
+#include <linux/module.h>
+#include <net/mrp.h>
+#include <asm/unaligned.h>
+
+static unsigned int mrp_join_time __read_mostly = 200;
+module_param(mrp_join_time, uint, 0644);
+MODULE_PARM_DESC(mrp_join_time, "Join time in ms (default 200ms)");
+MODULE_LICENSE("GPL");
+
+static const u8
+mrp_applicant_state_table[MRP_APPLICANT_MAX + 1][MRP_EVENT_MAX + 1] = {
+        [MRP_APPLICANT_VO] = {
+                [MRP_EVENT_NEW]         = MRP_APPLICANT_VN,
+                [MRP_EVENT_JOIN]        = MRP_APPLICANT_VP,
+                [MRP_EVENT_LV]          = MRP_APPLICANT_VO,
+                [MRP_EVENT_TX]          = MRP_APPLICANT_VO,
+                [MRP_EVENT_R_NEW]       = MRP_APPLICANT_VO,
+                [MRP_EVENT_R_JOIN_IN]   = MRP_APPLICANT_AO,
+                [MRP_EVENT_R_IN]        = MRP_APPLICANT_VO,
+                [MRP_EVENT_R_JOIN_MT]   = MRP_APPLICANT_VO,
+                [MRP_EVENT_R_MT]        = MRP_APPLICANT_VO,
+                [MRP_EVENT_R_LV]        = MRP_APPLICANT_VO,
+                [MRP_EVENT_R_LA]        = MRP_APPLICANT_VO,
+                [MRP_EVENT_REDECLARE]   = MRP_APPLICANT_VO,
+                [MRP_EVENT_PERIODIC]    = MRP_APPLICANT_VO,
+        },
+        [MRP_APPLICANT_VP] = {
+                [MRP_EVENT_NEW]         = MRP_APPLICANT_VN,
+                [MRP_EVENT_JOIN]        = MRP_APPLICANT_VP,
+                [MRP_EVENT_LV]          = MRP_APPLICANT_VO,
+                [MRP_EVENT_TX]          = MRP_APPLICANT_AA,
+                [MRP_EVENT_R_NEW]       = MRP_APPLICANT_VP,
+                [MRP_EVENT_R_JOIN_IN]   = MRP_APPLICANT_AP,
+                [MRP_EVENT_R_IN]        = MRP_APPLICANT_VP,
+                [MRP_EVENT_R_JOIN_MT]   = MRP_APPLICANT_VP,
+                [MRP_EVENT_R_MT]        = MRP_APPLICANT_VP,
+                [MRP_EVENT_R_LV]        = MRP_APPLICANT_VP,
+                [MRP_EVENT_R_LA]        = MRP_APPLICANT_VP,
+                [MRP_EVENT_REDECLARE]   = MRP_APPLICANT_VP,
+                [MRP_EVENT_PERIODIC]    = MRP_APPLICANT_VP,
+        },
+        [MRP_APPLICANT_VN] = {
+                [MRP_EVENT_NEW]         = MRP_APPLICANT_VN,
+                [MRP_EVENT_JOIN]        = MRP_APPLICANT_VN,
+                [MRP_EVENT_LV]          = MRP_APPLICANT_LA,
+                [MRP_EVENT_TX]          = MRP_APPLICANT_AN,
+                [MRP_EVENT_R_NEW]       = MRP_APPLICANT_VN,
+                [MRP_EVENT_R_JOIN_IN]   = MRP_APPLICANT_VN,
+                [MRP_EVENT_R_IN]        = MRP_APPLICANT_VN,
+                [MRP_EVENT_R_JOIN_MT]   = MRP_APPLICANT_VN,
+                [MRP_EVENT_R_MT]        = MRP_APPLICANT_VN,
+                [MRP_EVENT_R_LV]        = MRP_APPLICANT_VN,
+                [MRP_EVENT_R_LA]        = MRP_APPLICANT_VN,
+                [MRP_EVENT_REDECLARE]   = MRP_APPLICANT_VN,
+                [MRP_EVENT_PERIODIC]    = MRP_APPLICANT_VN,
+        },
+        [MRP_APPLICANT_AN] = {
+                [MRP_EVENT_NEW]         = MRP_APPLICANT_AN,
+                [MRP_EVENT_JOIN]        = MRP_APPLICANT_AN,
+                [MRP_EVENT_LV]          = MRP_APPLICANT_LA,
+                [MRP_EVENT_TX]          = MRP_APPLICANT_QA,
+                [MRP_EVENT_R_NEW]       = MRP_APPLICANT_AN,
+                [MRP_EVENT_R_JOIN_IN]   = MRP_APPLICANT_AN,
+                [MRP_EVENT_R_IN]        = MRP_APPLICANT_AN,
+                [MRP_EVENT_R_JOIN_MT]   = MRP_APPLICANT_AN,
+                [MRP_EVENT_R_MT]        = MRP_APPLICANT_AN,
+                [MRP_EVENT_R_LV]        = MRP_APPLICANT_VN,
+                [MRP_EVENT_R_LA]        = MRP_APPLICANT_VN,
+                [MRP_EVENT_REDECLARE]   = MRP_APPLICANT_VN,
+                [MRP_EVENT_PERIODIC]    = MRP_APPLICANT_AN,
+        },
+        [MRP_APPLICANT_AA] = {
+                [MRP_EVENT_NEW]         = MRP_APPLICANT_VN,
+                [MRP_EVENT_JOIN]        = MRP_APPLICANT_AA,
+                [MRP_EVENT_LV]          = MRP_APPLICANT_LA,
+                [MRP_EVENT_TX]          = MRP_APPLICANT_QA,
+                [MRP_EVENT_R_NEW]       = MRP_APPLICANT_AA,
+                [MRP_EVENT_R_JOIN_IN]   = MRP_APPLICANT_QA,
+                [MRP_EVENT_R_IN]        = MRP_APPLICANT_AA,
+                [MRP_EVENT_R_JOIN_MT]   = MRP_APPLICANT_AA,
+                [MRP_EVENT_R_MT]        = MRP_APPLICANT_AA,
+                [MRP_EVENT_R_LV]        = MRP_APPLICANT_VP,
+                [MRP_EVENT_R_LA]        = MRP_APPLICANT_VP,
+                [MRP_EVENT_REDECLARE]   = MRP_APPLICANT_VP,
+                [MRP_EVENT_PERIODIC]    = MRP_APPLICANT_AA,
+        },
+        [MRP_APPLICANT_QA] = {
+                [MRP_EVENT_NEW]         = MRP_APPLICANT_VN,
+                [MRP_EVENT_JOIN]        = MRP_APPLICANT_QA,
+                [MRP_EVENT_LV]          = MRP_APPLICANT_LA,
+                [MRP_EVENT_TX]          = MRP_APPLICANT_QA,
+                [MRP_EVENT_R_NEW]       = MRP_APPLICANT_QA,
+                [MRP_EVENT_R_JOIN_IN]   = MRP_APPLICANT_QA,
+                [MRP_EVENT_R_IN]        = MRP_APPLICANT_QA,
+                [MRP_EVENT_R_JOIN_MT]   = MRP_APPLICANT_AA,
+                [MRP_EVENT_R_MT]        = MRP_APPLICANT_AA,
+                [MRP_EVENT_R_LV]        = MRP_APPLICANT_VP,
+                [MRP_EVENT_R_LA]        = MRP_APPLICANT_VP,
+                [MRP_EVENT_REDECLARE]   = MRP_APPLICANT_VP,
+                [MRP_EVENT_PERIODIC]    = MRP_APPLICANT_AA,
+        },
+        [MRP_APPLICANT_LA] = {
+                [MRP_EVENT_NEW]         = MRP_APPLICANT_VN,
+                [MRP_EVENT_JOIN]        = MRP_APPLICANT_AA,
+                [MRP_EVENT_LV]          = MRP_APPLICANT_LA,
+                [MRP_EVENT_TX]          = MRP_APPLICANT_VO,
+                [MRP_EVENT_R_NEW]       = MRP_APPLICANT_LA,
+                [MRP_EVENT_R_JOIN_IN]   = MRP_APPLICANT_LA,
+                [MRP_EVENT_R_IN]        = MRP_APPLICANT_LA,
+                [MRP_EVENT_R_JOIN_MT]   = MRP_APPLICANT_LA,
+                [MRP_EVENT_R_MT]        = MRP_APPLICANT_LA,
+                [MRP_EVENT_R_LV]        = MRP_APPLICANT_LA,
+                [MRP_EVENT_R_LA]        = MRP_APPLICANT_LA,
+                [MRP_EVENT_REDECLARE]   = MRP_APPLICANT_LA,
+                [MRP_EVENT_PERIODIC]    = MRP_APPLICANT_LA,
+        },
+        [MRP_APPLICANT_AO] = {
+                [MRP_EVENT_NEW]         = MRP_APPLICANT_VN,
+                [MRP_EVENT_JOIN]        = MRP_APPLICANT_AP,
+                [MRP_EVENT_LV]          = MRP_APPLICANT_AO,
+                [MRP_EVENT_TX]          = MRP_APPLICANT_AO,
+                [MRP_EVENT_R_NEW]       = MRP_APPLICANT_AO,
+                [MRP_EVENT_R_JOIN_IN]   = MRP_APPLICANT_QO,
+                [MRP_EVENT_R_IN]        = MRP_APPLICANT_AO,
+                [MRP_EVENT_R_JOIN_MT]   = MRP_APPLICANT_AO,
+                [MRP_EVENT_R_MT]        = MRP_APPLICANT_AO,
+                [MRP_EVENT_R_LV]        = MRP_APPLICANT_VO,
+                [MRP_EVENT_R_LA]        = MRP_APPLICANT_VO,
+                [MRP_EVENT_REDECLARE]   = MRP_APPLICANT_VO,
+                [MRP_EVENT_PERIODIC]    = MRP_APPLICANT_AO,
+        },
+        [MRP_APPLICANT_QO] = {
+                [MRP_EVENT_NEW]         = MRP_APPLICANT_VN,
+                [MRP_EVENT_JOIN]        = MRP_APPLICANT_QP,
+                [MRP_EVENT_LV]          = MRP_APPLICANT_QO,
+                [MRP_EVENT_TX]          = MRP_APPLICANT_QO,
+                [MRP_EVENT_R_NEW]       = MRP_APPLICANT_QO,
+                [MRP_EVENT_R_JOIN_IN]   = MRP_APPLICANT_QO,
+                [MRP_EVENT_R_IN]        = MRP_APPLICANT_QO,
+                [MRP_EVENT_R_JOIN_MT]   = MRP_APPLICANT_AO,
+                [MRP_EVENT_R_MT]        = MRP_APPLICANT_AO,
+                [MRP_EVENT_R_LV]        = MRP_APPLICANT_VO,
+                [MRP_EVENT_R_LA]        = MRP_APPLICANT_VO,
+                [MRP_EVENT_REDECLARE]   = MRP_APPLICANT_VO,
+                [MRP_EVENT_PERIODIC]    = MRP_APPLICANT_QO,
+        },
+        [MRP_APPLICANT_AP] = {
+                [MRP_EVENT_NEW]         = MRP_APPLICANT_VN,
+                [MRP_EVENT_JOIN]        = MRP_APPLICANT_AP,
+                [MRP_EVENT_LV]          = MRP_APPLICANT_AO,
+                [MRP_EVENT_TX]          = MRP_APPLICANT_QA,
+                [MRP_EVENT_R_NEW]       = MRP_APPLICANT_AP,
+                [MRP_EVENT_R_JOIN_IN]   = MRP_APPLICANT_QP,
+                [MRP_EVENT_R_IN]        = MRP_APPLICANT_AP,
+                [MRP_EVENT_R_JOIN_MT]   = MRP_APPLICANT_AP,
+                [MRP_EVENT_R_MT]        = MRP_APPLICANT_AP,
+                [MRP_EVENT_R_LV]        = MRP_APPLICANT_VP,
+                [MRP_EVENT_R_LA]        = MRP_APPLICANT_VP,
+                [MRP_EVENT_REDECLARE]   = MRP_APPLICANT_VP,
+                [MRP_EVENT_PERIODIC]    = MRP_APPLICANT_AP,
+        },
+        [MRP_APPLICANT_QP] = {
+                [MRP_EVENT_NEW]         = MRP_APPLICANT_VN,
+                [MRP_EVENT_JOIN]        = MRP_APPLICANT_QP,
+                [MRP_EVENT_LV]          = MRP_APPLICANT_QO,
+                [MRP_EVENT_TX]          = MRP_APPLICANT_QP,
+                [MRP_EVENT_R_NEW]       = MRP_APPLICANT_QP,
+                [MRP_EVENT_R_JOIN_IN]   = MRP_APPLICANT_QP,
+                [MRP_EVENT_R_IN]        = MRP_APPLICANT_QP,
+                [MRP_EVENT_R_JOIN_MT]   = MRP_APPLICANT_AP,
+                [MRP_EVENT_R_MT]        = MRP_APPLICANT_AP,
+                [MRP_EVENT_R_LV]        = MRP_APPLICANT_VP,
+                [MRP_EVENT_R_LA]        = MRP_APPLICANT_VP,
+                [MRP_EVENT_REDECLARE]   = MRP_APPLICANT_VP,
+                [MRP_EVENT_PERIODIC]    = MRP_APPLICANT_AP,
+        },
+};
+
+static const u8
+mrp_tx_action_table[MRP_APPLICANT_MAX + 1] = {
+        [MRP_APPLICANT_VO] = MRP_TX_ACTION_S_IN_OPTIONAL,
+        [MRP_APPLICANT_VP] = MRP_TX_ACTION_S_JOIN_IN,
+        [MRP_APPLICANT_VN] = MRP_TX_ACTION_S_NEW,
+        [MRP_APPLICANT_AN] = MRP_TX_ACTION_S_NEW,
+        [MRP_APPLICANT_AA] = MRP_TX_ACTION_S_JOIN_IN,
+        [MRP_APPLICANT_QA] = MRP_TX_ACTION_S_JOIN_IN_OPTIONAL,
+        [MRP_APPLICANT_LA] = MRP_TX_ACTION_S_LV,
+        [MRP_APPLICANT_AO] = MRP_TX_ACTION_S_IN_OPTIONAL,
+        [MRP_APPLICANT_QO] = MRP_TX_ACTION_S_IN_OPTIONAL,
+        [MRP_APPLICANT_AP] = MRP_TX_ACTION_S_JOIN_IN,
+        [MRP_APPLICANT_QP] = MRP_TX_ACTION_S_IN_OPTIONAL,
+};
+
+static void mrp_attrvalue_inc(void *value, u8 len)
+{
+        u8 *v = (u8 *)value;
+
+        /* Add 1 to the last byte. If it becomes zero,
+         * go to the previous byte and repeat.
+         */
+        while (len > 0 && !++v[--len])
+                ;
+}
+
+static int mrp_attr_cmp(const struct mrp_attr *attr,
+                         const void *value, u8 len, u8 type)
+{
+        if (attr->type != type)
+                return attr->type - type;
+        if (attr->len != len)
+                return attr->len - len;
+        return memcmp(attr->value, value, len);
+}
+
+static struct mrp_attr *mrp_attr_lookup(const struct mrp_applicant *app,
+                                        const void *value, u8 len, u8 type)
+{
+        struct rb_node *parent = app->mad.rb_node;
+        struct mrp_attr *attr;
+        int d;
+
+        while (parent) {
+                attr = rb_entry(parent, struct mrp_attr, node);
+                d = mrp_attr_cmp(attr, value, len, type);
+                if (d > 0)
+                        parent = parent->rb_left;
+                else if (d < 0)
+                        parent = parent->rb_right;
+                else
+                        return attr;
+        }
+        return NULL;
+}
+
+static struct mrp_attr *mrp_attr_create(struct mrp_applicant *app,
+                                        const void *value, u8 len, u8 type)
+{
+        struct rb_node *parent = NULL, **p = &app->mad.rb_node;
+        struct mrp_attr *attr;
+        int d;
+
+        while (*p) {
+                parent = *p;
+                attr = rb_entry(parent, struct mrp_attr, node);
+                d = mrp_attr_cmp(attr, value, len, type);
+                if (d > 0)
+                        p = &parent->rb_left;
+                else if (d < 0)
+                        p = &parent->rb_right;
+                else {
+                        /* The attribute already exists; re-use it. */
+                        return attr;
+                }
+        }
+        attr = kmalloc(sizeof(*attr) + len, GFP_ATOMIC);
+        if (!attr)
+                return attr;
+        attr->state = MRP_APPLICANT_VO;
+        attr->type  = type;
+        attr->len   = len;
+        memcpy(attr->value, value, len);
+
+        rb_link_node(&attr->node, parent, p);
+        rb_insert_color(&attr->node, &app->mad);
+        return attr;
+}
+
+static void mrp_attr_destroy(struct mrp_applicant *app, struct mrp_attr *attr)
+{
+        rb_erase(&attr->node, &app->mad);
+        kfree(attr);
+}
+
+static int mrp_pdu_init(struct mrp_applicant *app)
+{
+        struct sk_buff *skb;
+        struct mrp_pdu_hdr *ph;
+
+        skb = alloc_skb(app->dev->mtu + LL_RESERVED_SPACE(app->dev),
+                        GFP_ATOMIC);
+        if (!skb)
+                return -ENOMEM;
+
+        skb->dev = app->dev;
+        skb->protocol = app->app->pkttype.type;
+        skb_reserve(skb, LL_RESERVED_SPACE(app->dev));
+        skb_reset_network_header(skb);
+        skb_reset_transport_header(skb);
+
+        ph = (struct mrp_pdu_hdr *)__skb_put(skb, sizeof(*ph));
+        ph->version = app->app->version;
+
+        app->pdu = skb;
+        return 0;
+}
+
+static int mrp_pdu_append_end_mark(struct mrp_applicant *app)
+{
+        __be16 *endmark;
+
+        if (skb_tailroom(app->pdu) < sizeof(*endmark))
+                return -1;
+        endmark = (__be16 *)__skb_put(app->pdu, sizeof(*endmark));
+        put_unaligned(MRP_END_MARK, endmark);
+        return 0;
+}
+
+static void mrp_pdu_queue(struct mrp_applicant *app)
+{
+        if (!app->pdu)
+                return;
+
+        if (mrp_cb(app->pdu)->mh)
+                mrp_pdu_append_end_mark(app);
+        mrp_pdu_append_end_mark(app);
+
+        dev_hard_header(app->pdu, app->dev, ntohs(app->app->pkttype.type),
+                        app->app->group_address, app->dev->dev_addr,
+                        app->pdu->len);
+
+        skb_queue_tail(&app->queue, app->pdu);
+        app->pdu = NULL;
+}
+
+static void mrp_queue_xmit(struct mrp_applicant *app)
+{
+        struct sk_buff *skb;
+
+        while ((skb = skb_dequeue(&app->queue)))
+                dev_queue_xmit(skb);
+}
+
+static int mrp_pdu_append_msg_hdr(struct mrp_applicant *app,
+                                  u8 attrtype, u8 attrlen)
+{
+        struct mrp_msg_hdr *mh;
+
+        if (mrp_cb(app->pdu)->mh) {
+                if (mrp_pdu_append_end_mark(app) < 0)
+                        return -1;
+                mrp_cb(app->pdu)->mh = NULL;
+                mrp_cb(app->pdu)->vah = NULL;
+        }
+
+        if (skb_tailroom(app->pdu) < sizeof(*mh))
+                return -1;
+        mh = (struct mrp_msg_hdr *)__skb_put(app->pdu, sizeof(*mh));
+        mh->attrtype = attrtype;
+        mh->attrlen = attrlen;
+        mrp_cb(app->pdu)->mh = mh;
+        return 0;
+}
+
+static int mrp_pdu_append_vecattr_hdr(struct mrp_applicant *app,
+                                      const void *firstattrvalue, u8 attrlen)
+{
+        struct mrp_vecattr_hdr *vah;
+
+        if (skb_tailroom(app->pdu) < sizeof(*vah) + attrlen)
+                return -1;
+        vah = (struct mrp_vecattr_hdr *)__skb_put(app->pdu,
+                                                  sizeof(*vah) + attrlen);
+        put_unaligned(0, &vah->lenflags);
+        memcpy(vah->firstattrvalue, firstattrvalue, attrlen);
+        mrp_cb(app->pdu)->vah = vah;
+        memcpy(mrp_cb(app->pdu)->attrvalue, firstattrvalue, attrlen);
+        return 0;
+}
+
+static int mrp_pdu_append_vecattr_event(struct mrp_applicant *app,
+                                        const struct mrp_attr *attr,
+                                        enum mrp_vecattr_event vaevent)
+{
+        u16 len, pos;
+        u8 *vaevents;
+        int err;
+again:
+        if (!app->pdu) {
+                err = mrp_pdu_init(app);
+                if (err < 0)
+                        return err;
+        }
+
+        /* If there is no Message header in the PDU, or the Message header is
+         * for a different attribute type, add an EndMark (if necessary) and a
+         * new Message header to the PDU.
+         */
+        if (!mrp_cb(app->pdu)->mh ||
+            mrp_cb(app->pdu)->mh->attrtype != attr->type ||
+            mrp_cb(app->pdu)->mh->attrlen != attr->len) {
+                if (mrp_pdu_append_msg_hdr(app, attr->type, attr->len) < 0)
+                        goto queue;
+        }
+
+        /* If there is no VectorAttribute header for this Message in the PDU,
+         * or this attribute's value does not sequentially follow the previous
+         * attribute's value, add a new VectorAttribute header to the PDU.
+         */
+        if (!mrp_cb(app->pdu)->vah ||
+            memcmp(mrp_cb(app->pdu)->attrvalue, attr->value, attr->len)) {
+                if (mrp_pdu_append_vecattr_hdr(app, attr->value, attr->len) < 0)
+                        goto queue;
+        }
+
+        len = be16_to_cpu(get_unaligned(&mrp_cb(app->pdu)->vah->lenflags));
+        pos = len % 3;
+
+        /* Events are packed into Vectors in the PDU, three to a byte. Add a
+         * byte to the end of the Vector if necessary.
+         */
+        if (!pos) {
+                if (skb_tailroom(app->pdu) < sizeof(u8))
+                        goto queue;
+                vaevents = (u8 *)__skb_put(app->pdu, sizeof(u8));
+        } else {
+                vaevents = (u8 *)(skb_tail_pointer(app->pdu) - sizeof(u8));
+        }
+
+        switch (pos) {
+        case 0:
+                *vaevents = vaevent * (__MRP_VECATTR_EVENT_MAX *
+                                       __MRP_VECATTR_EVENT_MAX);
+                break;
+        case 1:
+                *vaevents += vaevent * __MRP_VECATTR_EVENT_MAX;
+                break;
+        case 2:
+                *vaevents += vaevent;
+                break;
+        default:
+                WARN_ON(1);
+        }
+
+        /* Increment the length of the VectorAttribute in the PDU, as well as
+         * the value of the next attribute that would continue its Vector.
+         */
+        put_unaligned(cpu_to_be16(++len), &mrp_cb(app->pdu)->vah->lenflags);
+        mrp_attrvalue_inc(mrp_cb(app->pdu)->attrvalue, attr->len);
+
+        return 0;
+
+queue:
+        mrp_pdu_queue(app);
+        goto again;
+}
+
+static void mrp_attr_event(struct mrp_applicant *app,
+                           struct mrp_attr *attr, enum mrp_event event)
+{
+        enum mrp_applicant_state state;
+
+        state = mrp_applicant_state_table[attr->state][event];
+        if (state == MRP_APPLICANT_INVALID) {
+                WARN_ON(1);
+                return;
+        }
+
+        if (event == MRP_EVENT_TX) {
+                /* When appending the attribute fails, don't update its state
+                 * in order to retry at the next TX event.
+                 */
+
+                switch (mrp_tx_action_table[attr->state]) {
+                case MRP_TX_ACTION_NONE:
+                case MRP_TX_ACTION_S_JOIN_IN_OPTIONAL:
+                case MRP_TX_ACTION_S_IN_OPTIONAL:
+                        break;
+                case MRP_TX_ACTION_S_NEW:
+                        if (mrp_pdu_append_vecattr_event(
+                                    app, attr, MRP_VECATTR_EVENT_NEW) < 0)
+                                return;
+                        break;
+                case MRP_TX_ACTION_S_JOIN_IN:
+                        if (mrp_pdu_append_vecattr_event(
+                                    app, attr, MRP_VECATTR_EVENT_JOIN_IN) < 0)
+                                return;
+                        break;
+                case MRP_TX_ACTION_S_LV:
+                        if (mrp_pdu_append_vecattr_event(
+                                    app, attr, MRP_VECATTR_EVENT_LV) < 0)
+                                return;
+                        /* As a pure applicant, sending a leave message
+                         * implies that the attribute was unregistered and
+                         * can be destroyed.
+                         */
+                        mrp_attr_destroy(app, attr);
+                        return;
+                default:
+                        WARN_ON(1);
+                }
+        }
+
+        attr->state = state;
+}
+
+int mrp_request_join(const struct net_device *dev,
+                     const struct mrp_application *appl,
+                     const void *value, u8 len, u8 type)
+{
+        struct mrp_port *port = rtnl_dereference(dev->mrp_port);
+        struct mrp_applicant *app = rtnl_dereference(
+                port->applicants[appl->type]);
+        struct mrp_attr *attr;
+
+        if (sizeof(struct mrp_skb_cb) + len >
+            FIELD_SIZEOF(struct sk_buff, cb))
+                return -ENOMEM;
+
+        spin_lock_bh(&app->lock);
+        attr = mrp_attr_create(app, value, len, type);
+        if (!attr) {
+                spin_unlock_bh(&app->lock);
+                return -ENOMEM;
+        }
+        mrp_attr_event(app, attr, MRP_EVENT_JOIN);
+        spin_unlock_bh(&app->lock);
+        return 0;
+}
+EXPORT_SYMBOL_GPL(mrp_request_join);
+
+void mrp_request_leave(const struct net_device *dev,
+                       const struct mrp_application *appl,
+                       const void *value, u8 len, u8 type)
+{
+        struct mrp_port *port = rtnl_dereference(dev->mrp_port);
+        struct mrp_applicant *app = rtnl_dereference(
+                port->applicants[appl->type]);
+        struct mrp_attr *attr;
+
+        if (sizeof(struct mrp_skb_cb) + len >
+            FIELD_SIZEOF(struct sk_buff, cb))
+                return;
+
+        spin_lock_bh(&app->lock);
+        attr = mrp_attr_lookup(app, value, len, type);
+        if (!attr) {
+                spin_unlock_bh(&app->lock);
+                return;
+        }
+        mrp_attr_event(app, attr, MRP_EVENT_LV);
+        spin_unlock_bh(&app->lock);
+}
+EXPORT_SYMBOL_GPL(mrp_request_leave);
+
+static void mrp_mad_event(struct mrp_applicant *app, enum mrp_event event)
+{
+        struct rb_node *node, *next;
+        struct mrp_attr *attr;
+
+        for (node = rb_first(&app->mad);
+             next = node ? rb_next(node) : NULL, node != NULL;
+             node = next) {
+                attr = rb_entry(node, struct mrp_attr, node);
+                mrp_attr_event(app, attr, event);
+        }
+}
+
+static void mrp_join_timer_arm(struct mrp_applicant *app)
+{
+        unsigned long delay;
+
+        delay = (u64)msecs_to_jiffies(mrp_join_time) * net_random() >> 32;
+        mod_timer(&app->join_timer, jiffies + delay);
+}
+
+static void mrp_join_timer(unsigned long data)
+{
+        struct mrp_applicant *app = (struct mrp_applicant *)data;
+
+        spin_lock(&app->lock);
+        mrp_mad_event(app, MRP_EVENT_TX);
+        mrp_pdu_queue(app);
+        spin_unlock(&app->lock);
+
+        mrp_queue_xmit(app);
+        mrp_join_timer_arm(app);
+}
+
+static int mrp_pdu_parse_end_mark(struct sk_buff *skb, int *offset)
+{
+        __be16 endmark;
+
+        if (skb_copy_bits(skb, *offset, &endmark, sizeof(endmark)) < 0)
+                return -1;
+        if (endmark == MRP_END_MARK) {
+                *offset += sizeof(endmark);
+                return -1;
+        }
+        return 0;
+}
+
+static void mrp_pdu_parse_vecattr_event(struct mrp_applicant *app,
+                                        struct sk_buff *skb,
+                                        enum mrp_vecattr_event vaevent)
+{
+        struct mrp_attr *attr;
+        enum mrp_event event;
+
+        attr = mrp_attr_lookup(app, mrp_cb(skb)->attrvalue,
+                               mrp_cb(skb)->mh->attrlen,
+                               mrp_cb(skb)->mh->attrtype);
+        if (attr == NULL)
+                return;
+
+        switch (vaevent) {
+        case MRP_VECATTR_EVENT_NEW:
+                event = MRP_EVENT_R_NEW;
+                break;
+        case MRP_VECATTR_EVENT_JOIN_IN:
+                event = MRP_EVENT_R_JOIN_IN;
+                break;
+        case MRP_VECATTR_EVENT_IN:
+                event = MRP_EVENT_R_IN;
+                break;
+        case MRP_VECATTR_EVENT_JOIN_MT:
+                event = MRP_EVENT_R_JOIN_MT;
+                break;
+        case MRP_VECATTR_EVENT_MT:
+                event = MRP_EVENT_R_MT;
+                break;
+        case MRP_VECATTR_EVENT_LV:
+                event = MRP_EVENT_R_LV;
+                break;
+        default:
+                return;
+        }
+
+        mrp_attr_event(app, attr, event);
+}
+
+static int mrp_pdu_parse_vecattr(struct mrp_applicant *app,
+                                 struct sk_buff *skb, int *offset)
+{
+        struct mrp_vecattr_hdr _vah;
+        u16 valen;
+        u8 vaevents, vaevent;
+
+        mrp_cb(skb)->vah = skb_header_pointer(skb, *offset, sizeof(_vah),
+                                              &_vah);
+        if (!mrp_cb(skb)->vah)
+                return -1;
+        *offset += sizeof(_vah);
+
+        if (get_unaligned(&mrp_cb(skb)->vah->lenflags) &
+            MRP_VECATTR_HDR_FLAG_LA)
+                mrp_mad_event(app, MRP_EVENT_R_LA);
+        valen = be16_to_cpu(get_unaligned(&mrp_cb(skb)->vah->lenflags) &
+                            MRP_VECATTR_HDR_LEN_MASK);
+
+        /* The VectorAttribute structure in a PDU carries event information
+         * about one or more attributes having consecutive values. Only the
+         * value for the first attribute is contained in the structure. So
+         * we make a copy of that value, and then increment it each time we
+         * advance to the next event in its Vector.
+         */
+        if (sizeof(struct mrp_skb_cb) + mrp_cb(skb)->mh->attrlen >
+            FIELD_SIZEOF(struct sk_buff, cb))
+                return -1;
+        if (skb_copy_bits(skb, *offset, mrp_cb(skb)->attrvalue,
+                          mrp_cb(skb)->mh->attrlen) < 0)
+                return -1;
+        *offset += mrp_cb(skb)->mh->attrlen;
+
+        /* In a VectorAttribute, the Vector contains events which are packed
+         * three to a byte. We process one byte of the Vector at a time.
+         */
+        while (valen > 0) {
+                if (skb_copy_bits(skb, *offset, &vaevents,
+                                  sizeof(vaevents)) < 0)
+                        return -1;
+                *offset += sizeof(vaevents);
+
+                /* Extract and process the first event. */
+                vaevent = vaevents / (__MRP_VECATTR_EVENT_MAX *
+                                      __MRP_VECATTR_EVENT_MAX);
+                if (vaevent >= __MRP_VECATTR_EVENT_MAX) {
+                        /* The byte is malformed; stop processing. */
+                        return -1;
+                }
+                mrp_pdu_parse_vecattr_event(app, skb, vaevent);
+
+                /* If present, extract and process the second event. */
+                if (!--valen)
+                        break;
+                mrp_attrvalue_inc(mrp_cb(skb)->attrvalue,
+                                  mrp_cb(skb)->mh->attrlen);
+                vaevents %= (__MRP_VECATTR_EVENT_MAX *
+                             __MRP_VECATTR_EVENT_MAX);
+                vaevent = vaevents / __MRP_VECATTR_EVENT_MAX;
+                mrp_pdu_parse_vecattr_event(app, skb, vaevent);
+
+                /* If present, extract and process the third event. */
+                if (!--valen)
+                        break;
+                mrp_attrvalue_inc(mrp_cb(skb)->attrvalue,
+                                  mrp_cb(skb)->mh->attrlen);
+                vaevents %= __MRP_VECATTR_EVENT_MAX;
+                vaevent = vaevents;
+                mrp_pdu_parse_vecattr_event(app, skb, vaevent);
+        }
+        return 0;
+}
+
+static int mrp_pdu_parse_msg(struct mrp_applicant *app, struct sk_buff *skb,
+                             int *offset)
+{
+        struct mrp_msg_hdr _mh;
+
+        mrp_cb(skb)->mh = skb_header_pointer(skb, *offset, sizeof(_mh), &_mh);
+        if (!mrp_cb(skb)->mh)
+                return -1;
+        *offset += sizeof(_mh);
+
+        if (mrp_cb(skb)->mh->attrtype == 0 ||
+            mrp_cb(skb)->mh->attrtype > app->app->maxattr ||
+            mrp_cb(skb)->mh->attrlen == 0)
+                return -1;
+
+        while (skb->len > *offset) {
+                if (mrp_pdu_parse_end_mark(skb, offset) < 0)
+                        break;
+                if (mrp_pdu_parse_vecattr(app, skb, offset) < 0)
+                        return -1;
+        }
+        return 0;
+}
+
+static int mrp_rcv(struct sk_buff *skb, struct net_device *dev,
+                   struct packet_type *pt, struct net_device *orig_dev)
+{
+        struct mrp_application *appl = container_of(pt, struct mrp_application,
+                                                    pkttype);
+        struct mrp_port *port;
+        struct mrp_applicant *app;
+        struct mrp_pdu_hdr _ph;
+        const struct mrp_pdu_hdr *ph;
+        int offset = skb_network_offset(skb);
+
+        /* If the interface is in promiscuous mode, drop the packet if
+         * it was unicast to another host.
+         */
+        if (unlikely(skb->pkt_type == PACKET_OTHERHOST))
+                goto out;
+        skb = skb_share_check(skb, GFP_ATOMIC);
+        if (unlikely(!skb))
+                goto out;
+        port = rcu_dereference(dev->mrp_port);
+        if (unlikely(!port))
+                goto out;
+        app = rcu_dereference(port->applicants[appl->type]);
+        if (unlikely(!app))
+                goto out;
+
+        ph = skb_header_pointer(skb, offset, sizeof(_ph), &_ph);
+        if (!ph)
+                goto out;
+        offset += sizeof(_ph);
+
+        if (ph->version != app->app->version)
+                goto out;
+
+        spin_lock(&app->lock);
+        while (skb->len > offset) {
+                if (mrp_pdu_parse_end_mark(skb, &offset) < 0)
+                        break;
+                if (mrp_pdu_parse_msg(app, skb, &offset) < 0)
+                        break;
+        }
+        spin_unlock(&app->lock);
+out:
+        kfree_skb(skb);
+        return 0;
+}
+
+static int mrp_init_port(struct net_device *dev)
+{
+        struct mrp_port *port;
+
+        port = kzalloc(sizeof(*port), GFP_KERNEL);
+        if (!port)
+                return -ENOMEM;
+        rcu_assign_pointer(dev->mrp_port, port);
+        return 0;
+}
+
+static void mrp_release_port(struct net_device *dev)
+{
+        struct mrp_port *port = rtnl_dereference(dev->mrp_port);
+        unsigned int i;
+
+        for (i = 0; i <= MRP_APPLICATION_MAX; i++) {
+                if (rtnl_dereference(port->applicants[i]))
+                        return;
+        }
+        RCU_INIT_POINTER(dev->mrp_port, NULL);
+        kfree_rcu(port, rcu);
+}
+
+int mrp_init_applicant(struct net_device *dev, struct mrp_application *appl)
+{
+        struct mrp_applicant *app;
+        int err;
+
+        ASSERT_RTNL();
+
+        if (!rtnl_dereference(dev->mrp_port)) {
+                err = mrp_init_port(dev);
+                if (err < 0)
+                        goto err1;
+        }
+
+        err = -ENOMEM;
+        app = kzalloc(sizeof(*app), GFP_KERNEL);
+        if (!app)
+                goto err2;
+
+        err = dev_mc_add(dev, appl->group_address);
+        if (err < 0)
+                goto err3;
+
+        app->dev = dev;
+        app->app = appl;
+        app->mad = RB_ROOT;
+        spin_lock_init(&app->lock);
+        skb_queue_head_init(&app->queue);
+        rcu_assign_pointer(dev->mrp_port->applicants[appl->type], app);
+        setup_timer(&app->join_timer, mrp_join_timer, (unsigned long)app);
+        mrp_join_timer_arm(app);
+        return 0;
+
+err3:
+        kfree(app);
+err2:
+        mrp_release_port(dev);
+err1:
+        return err;
+}
+EXPORT_SYMBOL_GPL(mrp_init_applicant);
+
+void mrp_uninit_applicant(struct net_device *dev, struct mrp_application *appl)
+{
+        struct mrp_port *port = rtnl_dereference(dev->mrp_port);
+        struct mrp_applicant *app = rtnl_dereference(
+                port->applicants[appl->type]);
+
+        ASSERT_RTNL();
+
+        RCU_INIT_POINTER(port->applicants[appl->type], NULL);
+
+        /* Delete timer and generate a final TX event to flush out
+         * all pending messages before the applicant is gone.
+         */
+        del_timer_sync(&app->join_timer);
+        mrp_mad_event(app, MRP_EVENT_TX);
+        mrp_pdu_queue(app);
+        mrp_queue_xmit(app);
+
+        dev_mc_del(dev, appl->group_address);
+        kfree_rcu(app, rcu);
+        mrp_release_port(dev);
+}
+EXPORT_SYMBOL_GPL(mrp_uninit_applicant);
+
+int mrp_register_application(struct mrp_application *appl)
+{
+        appl->pkttype.func = mrp_rcv;
+        dev_add_pack(&appl->pkttype);
+        return 0;
+}
+EXPORT_SYMBOL_GPL(mrp_register_application);
+
+void mrp_unregister_application(struct mrp_application *appl)
+{
+        dev_remove_pack(&appl->pkttype);
+}
+EXPORT_SYMBOL_GPL(mrp_unregister_application);
diff --git a/net/8021q/Kconfig b/net/8021q/Kconfig
index fa073a54963e..8f7517df41a5 100644
--- a/net/8021q/Kconfig
+++ b/net/8021q/Kconfig
@@ -27,3 +27,14 @@ config VLAN_8021Q_GVRP
           automatic propagation of registered VLANs to switches.
 
           If unsure, say N.
+
+config VLAN_8021Q_MVRP
+        bool "MVRP (Multiple VLAN Registration Protocol) support"
+        depends on VLAN_8021Q
+        select MRP
+        help
+          Select this to enable MVRP end-system support. MVRP is used for
+          automatic propagation of registered VLANs to switches; it
+          supersedes GVRP and is not backwards-compatible.
+
+          If unsure, say N.
diff --git a/net/8021q/Makefile b/net/8021q/Makefile
index 9f4f174ead1c..7bc8db08d7ef 100644
--- a/net/8021q/Makefile
+++ b/net/8021q/Makefile
@@ -6,5 +6,6 @@ obj-$(CONFIG_VLAN_8021Q)		+= 8021q.o
 
 8021q-y                                 := vlan.o vlan_dev.o vlan_netlink.o
 8021q-$(CONFIG_VLAN_8021Q_GVRP)         += vlan_gvrp.o
+8021q-$(CONFIG_VLAN_8021Q_MVRP)         += vlan_mvrp.o
 8021q-$(CONFIG_PROC_FS)                 += vlanproc.o
 
diff --git a/net/8021q/vlan.c b/net/8021q/vlan.c
index addc578d5443..a18714469bf7 100644
--- a/net/8021q/vlan.c
+++ b/net/8021q/vlan.c
@@ -95,6 +95,8 @@ void unregister_vlan_dev(struct net_device *dev, struct list_head *head)
 
         grp->nr_vlan_devs--;
 
+        if (vlan->flags & VLAN_FLAG_MVRP)
+                vlan_mvrp_request_leave(dev);
         if (vlan->flags & VLAN_FLAG_GVRP)
                 vlan_gvrp_request_leave(dev);
 
@@ -107,8 +109,10 @@ void unregister_vlan_dev(struct net_device *dev, struct list_head *head)
 
         netdev_upper_dev_unlink(real_dev, dev);
 
-        if (grp->nr_vlan_devs == 0)
+        if (grp->nr_vlan_devs == 0) {
+                vlan_mvrp_uninit_applicant(real_dev);
                 vlan_gvrp_uninit_applicant(real_dev);
+        }
 
         /* Get rid of the vlan's reference to real_dev */
         dev_put(real_dev);
@@ -151,15 +155,18 @@ int register_vlan_dev(struct net_device *dev)
                 err = vlan_gvrp_init_applicant(real_dev);
                 if (err < 0)
                         goto out_vid_del;
+                err = vlan_mvrp_init_applicant(real_dev);
+                if (err < 0)
+                        goto out_uninit_gvrp;
         }
 
         err = vlan_group_prealloc_vid(grp, vlan_id);
         if (err < 0)
-                goto out_uninit_applicant;
+                goto out_uninit_mvrp;
 
         err = netdev_upper_dev_link(real_dev, dev);
         if (err)
-                goto out_uninit_applicant;
+                goto out_uninit_mvrp;
 
         err = register_netdevice(dev);
         if (err < 0)
@@ -181,7 +188,10 @@ int register_vlan_dev(struct net_device *dev)
 
 out_upper_dev_unlink:
         netdev_upper_dev_unlink(real_dev, dev);
-out_uninit_applicant:
+out_uninit_mvrp:
+        if (grp->nr_vlan_devs == 0)
+                vlan_mvrp_uninit_applicant(real_dev);
+out_uninit_gvrp:
         if (grp->nr_vlan_devs == 0)
                 vlan_gvrp_uninit_applicant(real_dev);
 out_vid_del:
@@ -655,13 +665,19 @@ static int __init vlan_proto_init(void)
         if (err < 0)
                 goto err3;
 
-        err = vlan_netlink_init();
+        err = vlan_mvrp_init();
         if (err < 0)
                 goto err4;
 
+        err = vlan_netlink_init();
+        if (err < 0)
+                goto err5;
+
         vlan_ioctl_set(vlan_ioctl_handler);
         return 0;
 
+err5:
+        vlan_mvrp_uninit();
 err4:
         vlan_gvrp_uninit();
 err3:
@@ -682,6 +698,7 @@ static void __exit vlan_cleanup_module(void)
         unregister_pernet_subsys(&vlan_net_ops);
         rcu_barrier(); /* Wait for completion of call_rcu()'s */
 
+        vlan_mvrp_uninit();
         vlan_gvrp_uninit();
 }
 
diff --git a/net/8021q/vlan.h b/net/8021q/vlan.h
index a4886d94c40c..670f1e8cfc0f 100644
--- a/net/8021q/vlan.h
+++ b/net/8021q/vlan.h
@@ -171,6 +171,22 @@ static inline int vlan_gvrp_init(void) { return 0; }
 static inline void vlan_gvrp_uninit(void) {}
 #endif
 
+#ifdef CONFIG_VLAN_8021Q_MVRP
+extern int vlan_mvrp_request_join(const struct net_device *dev);
+extern void vlan_mvrp_request_leave(const struct net_device *dev);
+extern int vlan_mvrp_init_applicant(struct net_device *dev);
+extern void vlan_mvrp_uninit_applicant(struct net_device *dev);
+extern int vlan_mvrp_init(void);
+extern void vlan_mvrp_uninit(void);
+#else
+static inline int vlan_mvrp_request_join(const struct net_device *dev) { return 0; }
+static inline void vlan_mvrp_request_leave(const struct net_device *dev) {}
+static inline int vlan_mvrp_init_applicant(struct net_device *dev) { return 0; }
+static inline void vlan_mvrp_uninit_applicant(struct net_device *dev) {}
+static inline int vlan_mvrp_init(void) { return 0; }
+static inline void vlan_mvrp_uninit(void) {}
+#endif
+
 extern const char vlan_fullname[];
 extern const char vlan_version[];
 extern int vlan_netlink_init(void);
diff --git a/net/8021q/vlan_core.c b/net/8021q/vlan_core.c
index 71b64fde8dc9..f3b6f515eba6 100644
--- a/net/8021q/vlan_core.c
+++ b/net/8021q/vlan_core.c
@@ -144,6 +144,7 @@ err_free:
         kfree_skb(skb);
         return NULL;
 }
+EXPORT_SYMBOL(vlan_untag);
 
 
 /*
diff --git a/net/8021q/vlan_dev.c b/net/8021q/vlan_dev.c
index 09f9108d4688..19cf81bf9f69 100644
--- a/net/8021q/vlan_dev.c
+++ b/net/8021q/vlan_dev.c
@@ -261,7 +261,7 @@ int vlan_dev_change_flags(const struct net_device *dev, u32 flags, u32 mask)
         u32 old_flags = vlan->flags;
 
         if (mask & ~(VLAN_FLAG_REORDER_HDR | VLAN_FLAG_GVRP |
-                     VLAN_FLAG_LOOSE_BINDING))
+                     VLAN_FLAG_LOOSE_BINDING | VLAN_FLAG_MVRP))
                 return -EINVAL;
 
         vlan->flags = (old_flags & ~mask) | (flags & mask);
@@ -272,6 +272,13 @@ int vlan_dev_change_flags(const struct net_device *dev, u32 flags, u32 mask)
                 else
                         vlan_gvrp_request_leave(dev);
         }
+
+        if (netif_running(dev) && (vlan->flags ^ old_flags) & VLAN_FLAG_MVRP) {
+                if (vlan->flags & VLAN_FLAG_MVRP)
+                        vlan_mvrp_request_join(dev);
+                else
+                        vlan_mvrp_request_leave(dev);
+        }
         return 0;
 }
 
@@ -312,6 +319,9 @@ static int vlan_dev_open(struct net_device *dev)
         if (vlan->flags & VLAN_FLAG_GVRP)
                 vlan_gvrp_request_join(dev);
 
+        if (vlan->flags & VLAN_FLAG_MVRP)
+                vlan_mvrp_request_join(dev);
+
         if (netif_carrier_ok(real_dev))
                 netif_carrier_on(dev);
         return 0;
@@ -723,7 +733,7 @@ static void vlan_dev_netpoll_cleanup(struct net_device *dev)
 
         vlan->netpoll = NULL;
 
-        __netpoll_free_rcu(netpoll);
+        __netpoll_free_async(netpoll);
 }
 #endif /* CONFIG_NET_POLL_CONTROLLER */
 
diff --git a/net/8021q/vlan_mvrp.c b/net/8021q/vlan_mvrp.c
new file mode 100644
index 000000000000..d9ec1d5964aa
--- /dev/null
+++ b/net/8021q/vlan_mvrp.c
@@ -0,0 +1,72 @@
+/*
+ *      IEEE 802.1Q Multiple VLAN Registration Protocol (MVRP)
+ *
+ *      Copyright (c) 2012 Massachusetts Institute of Technology
+ *
+ *      Adapted from code in net/8021q/vlan_gvrp.c
+ *      Copyright (c) 2008 Patrick McHardy <kaber@trash.net>
+ *
+ *      This program is free software; you can redistribute it and/or
+ *      modify it under the terms of the GNU General Public License
+ *      version 2 as published by the Free Software Foundation.
+ */
+#include <linux/types.h>
+#include <linux/if_ether.h>
+#include <linux/if_vlan.h>
+#include <net/mrp.h>
+#include "vlan.h"
+
+#define MRP_MVRP_ADDRESS        { 0x01, 0x80, 0xc2, 0x00, 0x00, 0x21 }
+
+enum mvrp_attributes {
+        MVRP_ATTR_INVALID,
+        MVRP_ATTR_VID,
+        __MVRP_ATTR_MAX
+};
+#define MVRP_ATTR_MAX   (__MVRP_ATTR_MAX - 1)
+
+static struct mrp_application vlan_mrp_app __read_mostly = {
+        .type           = MRP_APPLICATION_MVRP,
+        .maxattr        = MVRP_ATTR_MAX,
+        .pkttype.type   = htons(ETH_P_MVRP),
+        .group_address  = MRP_MVRP_ADDRESS,
+        .version        = 0,
+};
+
+int vlan_mvrp_request_join(const struct net_device *dev)
+{
+        const struct vlan_dev_priv *vlan = vlan_dev_priv(dev);
+        __be16 vlan_id = htons(vlan->vlan_id);
+
+        return mrp_request_join(vlan->real_dev, &vlan_mrp_app,
+                                &vlan_id, sizeof(vlan_id), MVRP_ATTR_VID);
+}
+
+void vlan_mvrp_request_leave(const struct net_device *dev)
+{
+        const struct vlan_dev_priv *vlan = vlan_dev_priv(dev);
+        __be16 vlan_id = htons(vlan->vlan_id);
+
+        mrp_request_leave(vlan->real_dev, &vlan_mrp_app,
+                          &vlan_id, sizeof(vlan_id), MVRP_ATTR_VID);
+}
+
+int vlan_mvrp_init_applicant(struct net_device *dev)
+{
+        return mrp_init_applicant(dev, &vlan_mrp_app);
+}
+
+void vlan_mvrp_uninit_applicant(struct net_device *dev)
+{
+        mrp_uninit_applicant(dev, &vlan_mrp_app);
+}
+
+int __init vlan_mvrp_init(void)
+{
+        return mrp_register_application(&vlan_mrp_app);
+}
+
+void vlan_mvrp_uninit(void)
+{
+        mrp_unregister_application(&vlan_mrp_app);
+}
diff --git a/net/8021q/vlan_netlink.c b/net/8021q/vlan_netlink.c
index 708c80ea1874..1789658b7cd7 100644
--- a/net/8021q/vlan_netlink.c
+++ b/net/8021q/vlan_netlink.c
@@ -62,7 +62,7 @@ static int vlan_validate(struct nlattr *tb[], struct nlattr *data[])
                 flags = nla_data(data[IFLA_VLAN_FLAGS]);
                 if ((flags->flags & flags->mask) &
                     ~(VLAN_FLAG_REORDER_HDR | VLAN_FLAG_GVRP |
-                      VLAN_FLAG_LOOSE_BINDING))
+                      VLAN_FLAG_LOOSE_BINDING | VLAN_FLAG_MVRP))
                         return -EINVAL;
         }
 
diff --git a/net/8021q/vlanproc.c b/net/8021q/vlanproc.c
index 4de77ea5fa37..dc526ec965e4 100644
--- a/net/8021q/vlanproc.c
+++ b/net/8021q/vlanproc.c
@@ -131,7 +131,7 @@ void vlan_proc_cleanup(struct net *net)
                 remove_proc_entry(name_conf, vn->proc_vlan_dir);
 
         if (vn->proc_vlan_dir)
-                proc_net_remove(net, name_root);
+                remove_proc_entry(name_root, net->proc_net);
 
         /* Dynamically added entries should be cleaned up as their vlan_device
          * is removed, so we should not have to take care of it here...
diff --git a/net/Kconfig b/net/Kconfig
index c31348e70aad..5a1888bb036d 100644
--- a/net/Kconfig
+++ b/net/Kconfig
@@ -217,6 +217,7 @@ source "net/dcb/Kconfig"
 source "net/dns_resolver/Kconfig"
 source "net/batman-adv/Kconfig"
 source "net/openvswitch/Kconfig"
+source "net/vmw_vsock/Kconfig"
 
 config RPS
         boolean
diff --git a/net/Makefile b/net/Makefile
index c5aa8b3b49dc..091e7b04f301 100644
--- a/net/Makefile
+++ b/net/Makefile
@@ -69,3 +69,4 @@ obj-$(CONFIG_CEPH_LIB)		+= ceph/
 obj-$(CONFIG_BATMAN_ADV)        += batman-adv/
 obj-$(CONFIG_NFC)               += nfc/
 obj-$(CONFIG_OPENVSWITCH)       += openvswitch/
+obj-$(CONFIG_VSOCKETS)  += vmw_vsock/
diff --git a/net/atm/proc.c b/net/atm/proc.c
index 0d020de8d233..b4e75340b162 100644
--- a/net/atm/proc.c
+++ b/net/atm/proc.c
@@ -460,7 +460,7 @@ static void atm_proc_dirs_remove(void)
                 if (e->dirent)
                         remove_proc_entry(e->name, atm_proc_root);
         }
-        proc_net_remove(&init_net, "atm");
+        remove_proc_entry("atm", init_net.proc_net);
 }
 
 int __init atm_proc_init(void)
diff --git a/net/ax25/af_ax25.c b/net/ax25/af_ax25.c
index 779095ded689..69a06c47b648 100644
--- a/net/ax25/af_ax25.c
+++ b/net/ax25/af_ax25.c
@@ -1992,9 +1992,10 @@ static int __init ax25_init(void)
         dev_add_pack(&ax25_packet_type);
         register_netdevice_notifier(&ax25_dev_notifier);
 
-        proc_net_fops_create(&init_net, "ax25_route", S_IRUGO, &ax25_route_fops);
-        proc_net_fops_create(&init_net, "ax25", S_IRUGO, &ax25_info_fops);
-        proc_net_fops_create(&init_net, "ax25_calls", S_IRUGO, &ax25_uid_fops);
+        proc_create("ax25_route", S_IRUGO, init_net.proc_net,
+                    &ax25_route_fops);
+        proc_create("ax25", S_IRUGO, init_net.proc_net, &ax25_info_fops);
+        proc_create("ax25_calls", S_IRUGO, init_net.proc_net, &ax25_uid_fops);
 out:
         return rc;
 }
@@ -2008,9 +2009,9 @@ MODULE_ALIAS_NETPROTO(PF_AX25);
 
 static void __exit ax25_exit(void)
 {
-        proc_net_remove(&init_net, "ax25_route");
-        proc_net_remove(&init_net, "ax25");
-        proc_net_remove(&init_net, "ax25_calls");
+        remove_proc_entry("ax25_route", init_net.proc_net);
+        remove_proc_entry("ax25", init_net.proc_net);
+        remove_proc_entry("ax25_calls", init_net.proc_net);
 
         unregister_netdevice_notifier(&ax25_dev_notifier);
 
diff --git a/net/batman-adv/distributed-arp-table.c b/net/batman-adv/distributed-arp-table.c
index ea0bd31d41c2..761a59002e34 100644
--- a/net/batman-adv/distributed-arp-table.c
+++ b/net/batman-adv/distributed-arp-table.c
@@ -440,7 +440,7 @@ static bool batadv_is_orig_node_eligible(struct batadv_dat_candidate *res,
         /* this is an hash collision with the temporary selected node. Choose
          * the one with the lowest address
          */
-        if ((tmp_max == max) &&
+        if ((tmp_max == max) && max_orig_node &&
             (batadv_compare_eth(candidate->orig, max_orig_node->orig) > 0))
                 goto out;
 
diff --git a/net/bluetooth/a2mp.c b/net/bluetooth/a2mp.c
index 2f67d5ecc907..eb0f4b16ff09 100644
--- a/net/bluetooth/a2mp.c
+++ b/net/bluetooth/a2mp.c
@@ -290,7 +290,7 @@ static int a2mp_getinfo_req(struct amp_mgr *mgr, struct sk_buff *skb,
                 goto done;
         }
 
-        mgr->state = READ_LOC_AMP_INFO;
+        set_bit(READ_LOC_AMP_INFO, &mgr->state);
         hci_send_cmd(hdev, HCI_OP_READ_LOCAL_AMP_INFO, 0, NULL);
 
 done:
@@ -499,8 +499,16 @@ send_rsp:
         if (hdev)
                 hci_dev_put(hdev);
 
-        a2mp_send(mgr, A2MP_CREATEPHYSLINK_RSP, hdr->ident, sizeof(rsp),
-                  &rsp);
+        /* Reply error now and success after HCI Write Remote AMP Assoc
+           command complete with success status
+         */
+        if (rsp.status != A2MP_STATUS_SUCCESS) {
+                a2mp_send(mgr, A2MP_CREATEPHYSLINK_RSP, hdr->ident,
+                          sizeof(rsp), &rsp);
+        } else {
+                set_bit(WRITE_REMOTE_AMP_ASSOC, &mgr->state);
+                mgr->ident = hdr->ident;
+        }
 
         skb_pull(skb, le16_to_cpu(hdr->len));
         return 0;
@@ -840,7 +848,7 @@ struct amp_mgr *amp_mgr_lookup_by_state(u8 state)
 
         mutex_lock(&amp_mgr_list_lock);
         list_for_each_entry(mgr, &amp_mgr_list, list) {
-                if (mgr->state == state) {
+                if (test_and_clear_bit(state, &mgr->state)) {
                         amp_mgr_get(mgr);
                         mutex_unlock(&amp_mgr_list_lock);
                         return mgr;
@@ -949,6 +957,32 @@ clean:
         kfree(req);
 }
 
+void a2mp_send_create_phy_link_rsp(struct hci_dev *hdev, u8 status)
+{
+        struct amp_mgr *mgr;
+        struct a2mp_physlink_rsp rsp;
+        struct hci_conn *hs_hcon;
+
+        mgr = amp_mgr_lookup_by_state(WRITE_REMOTE_AMP_ASSOC);
+        if (!mgr)
+                return;
+
+        hs_hcon = hci_conn_hash_lookup_state(hdev, AMP_LINK, BT_CONNECT);
+        if (!hs_hcon) {
+                rsp.status = A2MP_STATUS_UNABLE_START_LINK_CREATION;
+        } else {
+                rsp.remote_id = hs_hcon->remote_id;
+                rsp.status = A2MP_STATUS_SUCCESS;
+        }
+
+        BT_DBG("%s mgr %p hs_hcon %p status %u", hdev->name, mgr, hs_hcon,
+               status);
+
+        rsp.local_id = hdev->id;
+        a2mp_send(mgr, A2MP_CREATEPHYSLINK_RSP, mgr->ident, sizeof(rsp), &rsp);
+        amp_mgr_put(mgr);
+}
+
 void a2mp_discover_amp(struct l2cap_chan *chan)
 {
         struct l2cap_conn *conn = chan->conn;
diff --git a/net/bluetooth/af_bluetooth.c b/net/bluetooth/af_bluetooth.c
index 5355df63d39b..d3ee69b35a78 100644
--- a/net/bluetooth/af_bluetooth.c
+++ b/net/bluetooth/af_bluetooth.c
@@ -641,7 +641,7 @@ int bt_procfs_init(struct module* module, struct net *net, const char *name,
         sk_list->fops.llseek    = seq_lseek;
         sk_list->fops.release   = seq_release_private;
 
-        pde = proc_net_fops_create(net, name, 0, &sk_list->fops);
+        pde = proc_create(name, 0, net->proc_net, &sk_list->fops);
         if (!pde)
                 return -ENOMEM;
 
@@ -652,7 +652,7 @@ int bt_procfs_init(struct module* module, struct net *net, const char *name,
 
 void bt_procfs_cleanup(struct net *net, const char *name)
 {
-        proc_net_remove(net, name);
+        remove_proc_entry(name, net->proc_net);
 }
 #else
 int bt_procfs_init(struct module* module, struct net *net, const char *name,
diff --git a/net/bluetooth/amp.c b/net/bluetooth/amp.c
index 1b0d92c0643a..d459ed43c779 100644
--- a/net/bluetooth/amp.c
+++ b/net/bluetooth/amp.c
@@ -236,7 +236,7 @@ void amp_read_loc_assoc(struct hci_dev *hdev, struct amp_mgr *mgr)
 
         cp.max_len = cpu_to_le16(hdev->amp_assoc_size);
 
-        mgr->state = READ_LOC_AMP_ASSOC;
+        set_bit(READ_LOC_AMP_ASSOC, &mgr->state);
         hci_send_cmd(hdev, HCI_OP_READ_LOCAL_AMP_ASSOC, sizeof(cp), &cp);
 }
 
@@ -250,7 +250,7 @@ void amp_read_loc_assoc_final_data(struct hci_dev *hdev,
         cp.len_so_far = cpu_to_le16(0);
         cp.max_len = cpu_to_le16(hdev->amp_assoc_size);
 
-        mgr->state = READ_LOC_AMP_ASSOC_FINAL;
+        set_bit(READ_LOC_AMP_ASSOC_FINAL, &mgr->state);
 
         /* Read Local AMP Assoc final link information data */
         hci_send_cmd(hdev, HCI_OP_READ_LOCAL_AMP_ASSOC, sizeof(cp), &cp);
@@ -317,7 +317,9 @@ void amp_write_rem_assoc_continue(struct hci_dev *hdev, u8 handle)
         if (!hcon)
                 return;
 
-        amp_write_rem_assoc_frag(hdev, hcon);
+        /* Send A2MP create phylink rsp when all fragments are written */
+        if (amp_write_rem_assoc_frag(hdev, hcon))
+                a2mp_send_create_phy_link_rsp(hdev, 0);
 }
 
 void amp_write_remote_assoc(struct hci_dev *hdev, u8 handle)
@@ -403,26 +405,20 @@ void amp_physical_cfm(struct hci_conn *bredr_hcon, struct hci_conn *hs_hcon)
 
 void amp_create_logical_link(struct l2cap_chan *chan)
 {
+        struct hci_conn *hs_hcon = chan->hs_hcon;
         struct hci_cp_create_accept_logical_link cp;
-        struct hci_conn *hcon;
         struct hci_dev *hdev;
 
-        BT_DBG("chan %p", chan);
+        BT_DBG("chan %p hs_hcon %p dst %pMR", chan, hs_hcon, chan->conn->dst);
 
-        if (!chan->hs_hcon)
+        if (!hs_hcon)
                 return;
 
         hdev = hci_dev_hold(chan->hs_hcon->hdev);
         if (!hdev)
                 return;
 
-        BT_DBG("chan %p dst %pMR", chan, chan->conn->dst);
-
-        hcon = hci_conn_hash_lookup_ba(hdev, AMP_LINK, chan->conn->dst);
-        if (!hcon)
-                goto done;
-
-        cp.phy_handle = hcon->handle;
+        cp.phy_handle = hs_hcon->handle;
 
         cp.tx_flow_spec.id = chan->local_id;
         cp.tx_flow_spec.stype = chan->local_stype;
@@ -438,14 +434,13 @@ void amp_create_logical_link(struct l2cap_chan *chan)
         cp.rx_flow_spec.acc_lat = cpu_to_le32(chan->remote_acc_lat);
         cp.rx_flow_spec.flush_to = cpu_to_le32(chan->remote_flush_to);
 
-        if (hcon->out)
+        if (hs_hcon->out)
                 hci_send_cmd(hdev, HCI_OP_CREATE_LOGICAL_LINK, sizeof(cp),
                              &cp);
         else
                 hci_send_cmd(hdev, HCI_OP_ACCEPT_LOGICAL_LINK, sizeof(cp),
                              &cp);
 
-done:
         hci_dev_put(hdev);
 }
 
diff --git a/net/bluetooth/bnep/core.c b/net/bluetooth/bnep/core.c
index a5b639702637..e430b1abcd2f 100644
--- a/net/bluetooth/bnep/core.c
+++ b/net/bluetooth/bnep/core.c
@@ -33,7 +33,6 @@
 
 #include <net/bluetooth/bluetooth.h>
 #include <net/bluetooth/hci_core.h>
-#include <net/bluetooth/l2cap.h>
 
 #include "bnep.h"
 
diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c
index 25bfce0666eb..4925a02ae7e4 100644
--- a/net/bluetooth/hci_conn.c
+++ b/net/bluetooth/hci_conn.c
@@ -249,12 +249,12 @@ static void hci_conn_disconnect(struct hci_conn *conn)
         __u8 reason = hci_proto_disconn_ind(conn);
 
         switch (conn->type) {
-        case ACL_LINK:
-                hci_acl_disconn(conn, reason);
-                break;
         case AMP_LINK:
                 hci_amp_disconn(conn, reason);
                 break;
+        default:
+                hci_acl_disconn(conn, reason);
+                break;
         }
 }
 
diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c
index 0f78e34220c9..22e77a786545 100644
--- a/net/bluetooth/hci_core.c
+++ b/net/bluetooth/hci_core.c
@@ -1146,7 +1146,8 @@ static void hci_power_on(struct work_struct *work)
                 return;
 
         if (test_bit(HCI_AUTO_OFF, &hdev->dev_flags))
-                schedule_delayed_work(&hdev->power_off, HCI_AUTO_OFF_TIMEOUT);
+                queue_delayed_work(hdev->req_workqueue, &hdev->power_off,
+                                   HCI_AUTO_OFF_TIMEOUT);
 
         if (test_and_clear_bit(HCI_SETUP, &hdev->dev_flags))
                 mgmt_index_added(hdev);
@@ -1182,14 +1183,10 @@ static void hci_discov_off(struct work_struct *work)
 
 int hci_uuids_clear(struct hci_dev *hdev)
 {
-        struct list_head *p, *n;
-
-        list_for_each_safe(p, n, &hdev->uuids) {
-                struct bt_uuid *uuid;
+        struct bt_uuid *uuid, *tmp;
 
-                uuid = list_entry(p, struct bt_uuid, list);
-
-                list_del(p);
+        list_for_each_entry_safe(uuid, tmp, &hdev->uuids, list) {
+                list_del(&uuid->list);
                 kfree(uuid);
         }
 
@@ -1621,8 +1618,8 @@ static int hci_do_le_scan(struct hci_dev *hdev, u8 type, u16 interval,
         if (err < 0)
                 return err;
 
-        schedule_delayed_work(&hdev->le_scan_disable,
-                              msecs_to_jiffies(timeout));
+        queue_delayed_work(hdev->workqueue, &hdev->le_scan_disable,
+                           msecs_to_jiffies(timeout));
 
         return 0;
 }
@@ -1799,6 +1796,15 @@ int hci_register_dev(struct hci_dev *hdev)
                 goto err;
         }
 
+        hdev->req_workqueue = alloc_workqueue(hdev->name,
+                                              WQ_HIGHPRI | WQ_UNBOUND |
+                                              WQ_MEM_RECLAIM, 1);
+        if (!hdev->req_workqueue) {
+                destroy_workqueue(hdev->workqueue);
+                error = -ENOMEM;
+                goto err;
+        }
+
         error = hci_add_sysfs(hdev);
         if (error < 0)
                 goto err_wqueue;
@@ -1821,12 +1827,13 @@ int hci_register_dev(struct hci_dev *hdev)
         hci_notify(hdev, HCI_DEV_REG);
         hci_dev_hold(hdev);
 
-        schedule_work(&hdev->power_on);
+        queue_work(hdev->req_workqueue, &hdev->power_on);
 
         return id;
 
 err_wqueue:
         destroy_workqueue(hdev->workqueue);
+        destroy_workqueue(hdev->req_workqueue);
 err:
         ida_simple_remove(&hci_index_ida, hdev->id);
         write_lock(&hci_dev_list_lock);
@@ -1880,6 +1887,7 @@ void hci_unregister_dev(struct hci_dev *hdev)
         hci_del_sysfs(hdev);
 
         destroy_workqueue(hdev->workqueue);
+        destroy_workqueue(hdev->req_workqueue);
 
         hci_dev_lock(hdev);
         hci_blacklist_clear(hdev);
diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c
index 81b44481d0d9..477726a63512 100644
--- a/net/bluetooth/hci_event.c
+++ b/net/bluetooth/hci_event.c
@@ -609,8 +609,17 @@ static void le_setup(struct hci_dev *hdev)
         /* Read LE Buffer Size */
         hci_send_cmd(hdev, HCI_OP_LE_READ_BUFFER_SIZE, 0, NULL);
 
+        /* Read LE Local Supported Features */
+        hci_send_cmd(hdev, HCI_OP_LE_READ_LOCAL_FEATURES, 0, NULL);
+
         /* Read LE Advertising Channel TX Power */
         hci_send_cmd(hdev, HCI_OP_LE_READ_ADV_TX_POWER, 0, NULL);
+
+        /* Read LE White List Size */
+        hci_send_cmd(hdev, HCI_OP_LE_READ_WHITE_LIST_SIZE, 0, NULL);
+
+        /* Read LE Supported States */
+        hci_send_cmd(hdev, HCI_OP_LE_READ_SUPPORTED_STATES, 0, NULL);
 }
 
 static void hci_setup(struct hci_dev *hdev)
@@ -1090,6 +1099,19 @@ static void hci_cc_le_read_buffer_size(struct hci_dev *hdev,
         hci_req_complete(hdev, HCI_OP_LE_READ_BUFFER_SIZE, rp->status);
 }
 
+static void hci_cc_le_read_local_features(struct hci_dev *hdev,
+                                          struct sk_buff *skb)
+{
+        struct hci_rp_le_read_local_features *rp = (void *) skb->data;
+
+        BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
+
+        if (!rp->status)
+                memcpy(hdev->le_features, rp->features, 8);
+
+        hci_req_complete(hdev, HCI_OP_LE_READ_LOCAL_FEATURES, rp->status);
+}
+
 static void hci_cc_le_read_adv_tx_power(struct hci_dev *hdev,
                                         struct sk_buff *skb)
 {
@@ -1290,6 +1312,19 @@ static void hci_cc_le_set_scan_enable(struct hci_dev *hdev,
         }
 }
 
+static void hci_cc_le_read_white_list_size(struct hci_dev *hdev,
+                                           struct sk_buff *skb)
+{
+        struct hci_rp_le_read_white_list_size *rp = (void *) skb->data;
+
+        BT_DBG("%s status 0x%2.2x size %u", hdev->name, rp->status, rp->size);
+
+        if (!rp->status)
+                hdev->le_white_list_size = rp->size;
+
+        hci_req_complete(hdev, HCI_OP_LE_READ_WHITE_LIST_SIZE, rp->status);
+}
+
 static void hci_cc_le_ltk_reply(struct hci_dev *hdev, struct sk_buff *skb)
 {
         struct hci_rp_le_ltk_reply *rp = (void *) skb->data;
@@ -1314,6 +1349,19 @@ static void hci_cc_le_ltk_neg_reply(struct hci_dev *hdev, struct sk_buff *skb)
         hci_req_complete(hdev, HCI_OP_LE_LTK_NEG_REPLY, rp->status);
 }
 
+static void hci_cc_le_read_supported_states(struct hci_dev *hdev,
+                                            struct sk_buff *skb)
+{
+        struct hci_rp_le_read_supported_states *rp = (void *) skb->data;
+
+        BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
+
+        if (!rp->status)
+                memcpy(hdev->le_states, rp->le_states, 8);
+
+        hci_req_complete(hdev, HCI_OP_LE_READ_SUPPORTED_STATES, rp->status);
+}
+
 static void hci_cc_write_le_host_supported(struct hci_dev *hdev,
                                            struct sk_buff *skb)
 {
@@ -2628,6 +2676,10 @@ static void hci_cmd_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
                 hci_cc_le_read_buffer_size(hdev, skb);
                 break;
 
+        case HCI_OP_LE_READ_LOCAL_FEATURES:
+                hci_cc_le_read_local_features(hdev, skb);
+                break;
+
         case HCI_OP_LE_READ_ADV_TX_POWER:
                 hci_cc_le_read_adv_tx_power(hdev, skb);
                 break;
@@ -2664,6 +2716,10 @@ static void hci_cmd_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
                 hci_cc_le_set_scan_enable(hdev, skb);
                 break;
 
+        case HCI_OP_LE_READ_WHITE_LIST_SIZE:
+                hci_cc_le_read_white_list_size(hdev, skb);
+                break;
+
         case HCI_OP_LE_LTK_REPLY:
                 hci_cc_le_ltk_reply(hdev, skb);
                 break;
@@ -2672,6 +2728,10 @@ static void hci_cmd_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
                 hci_cc_le_ltk_neg_reply(hdev, skb);
                 break;
 
+        case HCI_OP_LE_READ_SUPPORTED_STATES:
+                hci_cc_le_read_supported_states(hdev, skb);
+                break;
+
         case HCI_OP_WRITE_LE_HOST_SUPPORTED:
                 hci_cc_write_le_host_supported(hdev, skb);
                 break;
@@ -3928,8 +3988,6 @@ static void hci_le_adv_report_evt(struct hci_dev *hdev, struct sk_buff *skb)
         void *ptr = &skb->data[1];
         s8 rssi;
 
-        hci_dev_lock(hdev);
-
         while (num_reports--) {
                 struct hci_ev_le_advertising_info *ev = ptr;
 
@@ -3939,8 +3997,6 @@ static void hci_le_adv_report_evt(struct hci_dev *hdev, struct sk_buff *skb)
 
                 ptr += sizeof(*ev) + ev->length + 1;
         }
-
-        hci_dev_unlock(hdev);
 }
 
 static void hci_le_ltk_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
diff --git a/net/bluetooth/hci_sysfs.c b/net/bluetooth/hci_sysfs.c
index 55cceee02a84..23b4e242a31a 100644
--- a/net/bluetooth/hci_sysfs.c
+++ b/net/bluetooth/hci_sysfs.c
@@ -2,6 +2,7 @@
 
 #include <linux/debugfs.h>
 #include <linux/module.h>
+#include <asm/unaligned.h>
 
 #include <net/bluetooth/bluetooth.h>
 #include <net/bluetooth/hci_core.h>
@@ -461,19 +462,18 @@ static const struct file_operations blacklist_fops = {
 
 static void print_bt_uuid(struct seq_file *f, u8 *uuid)
 {
-        __be32 data0, data4;
-        __be16 data1, data2, data3, data5;
+        u32 data0, data5;
+        u16 data1, data2, data3, data4;
 
-        memcpy(&data0, &uuid[0], 4);
-        memcpy(&data1, &uuid[4], 2);
-        memcpy(&data2, &uuid[6], 2);
-        memcpy(&data3, &uuid[8], 2);
-        memcpy(&data4, &uuid[10], 4);
-        memcpy(&data5, &uuid[14], 2);
+        data5 = get_unaligned_le32(uuid);
+        data4 = get_unaligned_le16(uuid + 4);
+        data3 = get_unaligned_le16(uuid + 6);
+        data2 = get_unaligned_le16(uuid + 8);
+        data1 = get_unaligned_le16(uuid + 10);
+        data0 = get_unaligned_le32(uuid + 12);
 
-        seq_printf(f, "%.8x-%.4x-%.4x-%.4x-%.8x%.4x\n",
-                   ntohl(data0), ntohs(data1), ntohs(data2), ntohs(data3),
-                   ntohl(data4), ntohs(data5));
+        seq_printf(f, "%.8x-%.4x-%.4x-%.4x-%.4x%.8x\n",
+                   data0, data1, data2, data3, data4, data5);
 }
 
 static int uuids_show(struct seq_file *f, void *p)
diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
index 22e658322845..7c7e9321f1ea 100644
--- a/net/bluetooth/l2cap_core.c
+++ b/net/bluetooth/l2cap_core.c
@@ -1527,17 +1527,12 @@ static struct l2cap_conn *l2cap_conn_add(struct hci_conn *hcon, u8 status)
         BT_DBG("hcon %p conn %p hchan %p", hcon, conn, hchan);
 
         switch (hcon->type) {
-        case AMP_LINK:
-                conn->mtu = hcon->hdev->block_mtu;
-                break;
-
         case LE_LINK:
                 if (hcon->hdev->le_mtu) {
                         conn->mtu = hcon->hdev->le_mtu;
                         break;
                 }
                 /* fall through */
-
         default:
                 conn->mtu = hcon->hdev->acl_mtu;
                 break;
diff --git a/net/bluetooth/mgmt.c b/net/bluetooth/mgmt.c
index f559b966279c..39395c7144aa 100644
--- a/net/bluetooth/mgmt.c
+++ b/net/bluetooth/mgmt.c
@@ -35,7 +35,7 @@
 bool enable_hs;
 
 #define MGMT_VERSION    1
-#define MGMT_REVISION   2
+#define MGMT_REVISION   3
 
 static const u16 mgmt_commands[] = {
         MGMT_OP_READ_INDEX_LIST,
@@ -435,35 +435,117 @@ static u32 get_current_settings(struct hci_dev *hdev)
 
 #define PNP_INFO_SVCLASS_ID             0x1200
 
-static u8 bluetooth_base_uuid[] = {
-                        0xFB, 0x34, 0x9B, 0x5F, 0x80, 0x00, 0x00, 0x80,
-                        0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-};
+static u8 *create_uuid16_list(struct hci_dev *hdev, u8 *data, ptrdiff_t len)
+{
+        u8 *ptr = data, *uuids_start = NULL;
+        struct bt_uuid *uuid;
+
+        if (len < 4)
+                return ptr;
+
+        list_for_each_entry(uuid, &hdev->uuids, list) {
+                u16 uuid16;
+
+                if (uuid->size != 16)
+                        continue;
+
+                uuid16 = get_unaligned_le16(&uuid->uuid[12]);
+                if (uuid16 < 0x1100)
+                        continue;
+
+                if (uuid16 == PNP_INFO_SVCLASS_ID)
+                        continue;
 
-static u16 get_uuid16(u8 *uuid128)
+                if (!uuids_start) {
+                        uuids_start = ptr;
+                        uuids_start[0] = 1;
+                        uuids_start[1] = EIR_UUID16_ALL;
+                        ptr += 2;
+                }
+
+                /* Stop if not enough space to put next UUID */
+                if ((ptr - data) + sizeof(u16) > len) {
+                        uuids_start[1] = EIR_UUID16_SOME;
+                        break;
+                }
+
+                *ptr++ = (uuid16 & 0x00ff);
+                *ptr++ = (uuid16 & 0xff00) >> 8;
+                uuids_start[0] += sizeof(uuid16);
+        }
+
+        return ptr;
+}
+
+static u8 *create_uuid32_list(struct hci_dev *hdev, u8 *data, ptrdiff_t len)
 {
-        u32 val;
-        int i;
+        u8 *ptr = data, *uuids_start = NULL;
+        struct bt_uuid *uuid;
+
+        if (len < 6)
+                return ptr;
 
-        for (i = 0; i < 12; i++) {
-                if (bluetooth_base_uuid[i] != uuid128[i])
-                        return 0;
+        list_for_each_entry(uuid, &hdev->uuids, list) {
+                if (uuid->size != 32)
+                        continue;
+
+                if (!uuids_start) {
+                        uuids_start = ptr;
+                        uuids_start[0] = 1;
+                        uuids_start[1] = EIR_UUID32_ALL;
+                        ptr += 2;
+                }
+
+                /* Stop if not enough space to put next UUID */
+                if ((ptr - data) + sizeof(u32) > len) {
+                        uuids_start[1] = EIR_UUID32_SOME;
+                        break;
+                }
+
+                memcpy(ptr, &uuid->uuid[12], sizeof(u32));
+                ptr += sizeof(u32);
+                uuids_start[0] += sizeof(u32);
         }
 
-        val = get_unaligned_le32(&uuid128[12]);
-        if (val > 0xffff)
-                return 0;
+        return ptr;
+}
+
+static u8 *create_uuid128_list(struct hci_dev *hdev, u8 *data, ptrdiff_t len)
+{
+        u8 *ptr = data, *uuids_start = NULL;
+        struct bt_uuid *uuid;
+
+        if (len < 18)
+                return ptr;
 
-        return (u16) val;
+        list_for_each_entry(uuid, &hdev->uuids, list) {
+                if (uuid->size != 128)
+                        continue;
+
+                if (!uuids_start) {
+                        uuids_start = ptr;
+                        uuids_start[0] = 1;
+                        uuids_start[1] = EIR_UUID128_ALL;
+                        ptr += 2;
+                }
+
+                /* Stop if not enough space to put next UUID */
+                if ((ptr - data) + 16 > len) {
+                        uuids_start[1] = EIR_UUID128_SOME;
+                        break;
+                }
+
+                memcpy(ptr, uuid->uuid, 16);
+                ptr += 16;
+                uuids_start[0] += 16;
+        }
+
+        return ptr;
 }
 
 static void create_eir(struct hci_dev *hdev, u8 *data)
 {
         u8 *ptr = data;
-        u16 eir_len = 0;
-        u16 uuid16_list[HCI_MAX_EIR_LENGTH / sizeof(u16)];
-        int i, truncated = 0;
-        struct bt_uuid *uuid;
         size_t name_len;
 
         name_len = strlen(hdev->dev_name);
@@ -481,7 +563,6 @@ static void create_eir(struct hci_dev *hdev, u8 *data)
 
                 memcpy(ptr + 2, hdev->dev_name, name_len);
 
-                eir_len += (name_len + 2);
                 ptr += (name_len + 2);
         }
 
@@ -490,7 +571,6 @@ static void create_eir(struct hci_dev *hdev, u8 *data)
                 ptr[1] = EIR_TX_POWER;
                 ptr[2] = (u8) hdev->inq_tx_power;
 
-                eir_len += 3;
                 ptr += 3;
         }
 
@@ -503,60 +583,12 @@ static void create_eir(struct hci_dev *hdev, u8 *data)
                 put_unaligned_le16(hdev->devid_product, ptr + 6);
                 put_unaligned_le16(hdev->devid_version, ptr + 8);
 
-                eir_len += 10;
                 ptr += 10;
         }
 
-        memset(uuid16_list, 0, sizeof(uuid16_list));
-
-        /* Group all UUID16 types */
-        list_for_each_entry(uuid, &hdev->uuids, list) {
-                u16 uuid16;
-
-                uuid16 = get_uuid16(uuid->uuid);
-                if (uuid16 == 0)
-                        return;
-
-                if (uuid16 < 0x1100)
-                        continue;
-
-                if (uuid16 == PNP_INFO_SVCLASS_ID)
-                        continue;
-
-                /* Stop if not enough space to put next UUID */
-                if (eir_len + 2 + sizeof(u16) > HCI_MAX_EIR_LENGTH) {
-                        truncated = 1;
-                        break;
-                }
-
-                /* Check for duplicates */
-                for (i = 0; uuid16_list[i] != 0; i++)
-                        if (uuid16_list[i] == uuid16)
-                                break;
-
-                if (uuid16_list[i] == 0) {
-                        uuid16_list[i] = uuid16;
-                        eir_len += sizeof(u16);
-                }
-        }
-
-        if (uuid16_list[0] != 0) {
-                u8 *length = ptr;
-
-                /* EIR Data type */
-                ptr[1] = truncated ? EIR_UUID16_SOME : EIR_UUID16_ALL;
-
-                ptr += 2;
-                eir_len += 2;
-
-                for (i = 0; uuid16_list[i] != 0; i++) {
-                        *ptr++ = (uuid16_list[i] & 0x00ff);
-                        *ptr++ = (uuid16_list[i] & 0xff00) >> 8;
-                }
-
-                /* EIR Data length */
-                *length = (i * sizeof(u16)) + 1;
-        }
+        ptr = create_uuid16_list(hdev, ptr, HCI_MAX_EIR_LENGTH - (ptr - data));
+        ptr = create_uuid32_list(hdev, ptr, HCI_MAX_EIR_LENGTH - (ptr - data));
+        ptr = create_uuid128_list(hdev, ptr, HCI_MAX_EIR_LENGTH - (ptr - data));
 }
 
 static int update_eir(struct hci_dev *hdev)
@@ -728,13 +760,9 @@ static void mgmt_pending_foreach(u16 opcode, struct hci_dev *hdev,
                                             void *data),
                                  void *data)
 {
-        struct list_head *p, *n;
-
-        list_for_each_safe(p, n, &hdev->mgmt_pending) {
-                struct pending_cmd *cmd;
-
-                cmd = list_entry(p, struct pending_cmd, list);
+        struct pending_cmd *cmd, *tmp;
 
+        list_for_each_entry_safe(cmd, tmp, &hdev->mgmt_pending, list) {
                 if (opcode > 0 && cmd->opcode != opcode)
                         continue;
 
@@ -777,14 +805,19 @@ static int set_powered(struct sock *sk, struct hci_dev *hdev, void *data,
 
         BT_DBG("request for %s", hdev->name);
 
+        if (cp->val != 0x00 && cp->val != 0x01)
+                return cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
+                                  MGMT_STATUS_INVALID_PARAMS);
+
         hci_dev_lock(hdev);
 
         if (test_and_clear_bit(HCI_AUTO_OFF, &hdev->dev_flags)) {
                 cancel_delayed_work(&hdev->power_off);
 
                 if (cp->val) {
-                        err = send_settings_rsp(sk, MGMT_OP_SET_POWERED, hdev);
-                        mgmt_powered(hdev, 1);
+                        mgmt_pending_add(sk, MGMT_OP_SET_POWERED, hdev,
+                                         data, len);
+                        err = mgmt_powered(hdev, 1);
                         goto failed;
                 }
         }
@@ -807,9 +840,9 @@ static int set_powered(struct sock *sk, struct hci_dev *hdev, void *data,
         }
 
         if (cp->val)
-                schedule_work(&hdev->power_on);
+                queue_work(hdev->req_workqueue, &hdev->power_on);
         else
-                schedule_work(&hdev->power_off.work);
+                queue_work(hdev->req_workqueue, &hdev->power_off.work);
 
         err = 0;
 
@@ -872,6 +905,10 @@ static int set_discoverable(struct sock *sk, struct hci_dev *hdev, void *data,
                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
                                  MGMT_STATUS_NOT_SUPPORTED);
 
+        if (cp->val != 0x00 && cp->val != 0x01)
+                return cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
+                                  MGMT_STATUS_INVALID_PARAMS);
+
         timeout = __le16_to_cpu(cp->timeout);
         if (!cp->val && timeout > 0)
                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
@@ -971,6 +1008,10 @@ static int set_connectable(struct sock *sk, struct hci_dev *hdev, void *data,
                 return cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
                                   MGMT_STATUS_NOT_SUPPORTED);
 
+        if (cp->val != 0x00 && cp->val != 0x01)
+                return cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
+                                  MGMT_STATUS_INVALID_PARAMS);
+
         hci_dev_lock(hdev);
 
         if (!hdev_is_powered(hdev)) {
@@ -1041,6 +1082,10 @@ static int set_pairable(struct sock *sk, struct hci_dev *hdev, void *data,
 
         BT_DBG("request for %s", hdev->name);
 
+        if (cp->val != 0x00 && cp->val != 0x01)
+                return cmd_status(sk, hdev->id, MGMT_OP_SET_PAIRABLE,
+                                  MGMT_STATUS_INVALID_PARAMS);
+
         hci_dev_lock(hdev);
 
         if (cp->val)
@@ -1073,6 +1118,10 @@ static int set_link_security(struct sock *sk, struct hci_dev *hdev, void *data,
                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
                                   MGMT_STATUS_NOT_SUPPORTED);
 
+        if (cp->val != 0x00 && cp->val != 0x01)
+                return cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
+                                  MGMT_STATUS_INVALID_PARAMS);
+
         hci_dev_lock(hdev);
 
         if (!hdev_is_powered(hdev)) {
@@ -1133,13 +1182,15 @@ static int set_ssp(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
 
         BT_DBG("request for %s", hdev->name);
 
-        hci_dev_lock(hdev);
+        if (!lmp_ssp_capable(hdev))
+                return cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
+                                  MGMT_STATUS_NOT_SUPPORTED);
 
-        if (!lmp_ssp_capable(hdev)) {
-                err = cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
-                                 MGMT_STATUS_NOT_SUPPORTED);
-                goto failed;
-        }
+        if (cp->val != 0x00 && cp->val != 0x01)
+                return cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
+                                  MGMT_STATUS_INVALID_PARAMS);
+
+        hci_dev_lock(hdev);
 
         val = !!cp->val;
 
@@ -1199,6 +1250,10 @@ static int set_hs(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
                 return cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
                                   MGMT_STATUS_NOT_SUPPORTED);
 
+        if (cp->val != 0x00 && cp->val != 0x01)
+                return cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
+                                  MGMT_STATUS_INVALID_PARAMS);
+
         if (cp->val)
                 set_bit(HCI_HS_ENABLED, &hdev->dev_flags);
         else
@@ -1217,13 +1272,15 @@ static int set_le(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
 
         BT_DBG("request for %s", hdev->name);
 
-        hci_dev_lock(hdev);
+        if (!lmp_le_capable(hdev))
+                return cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
+                                  MGMT_STATUS_NOT_SUPPORTED);
 
-        if (!lmp_le_capable(hdev)) {
-                err = cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
-                                 MGMT_STATUS_NOT_SUPPORTED);
-                goto unlock;
-        }
+        if (cp->val != 0x00 && cp->val != 0x01)
+                return cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
+                                  MGMT_STATUS_INVALID_PARAMS);
+
+        hci_dev_lock(hdev);
 
         val = !!cp->val;
         enabled = lmp_host_le_capable(hdev);
@@ -1275,6 +1332,25 @@ unlock:
         return err;
 }
 
+static const u8 bluetooth_base_uuid[] = {
+                        0xfb, 0x34, 0x9b, 0x5f, 0x80, 0x00, 0x00, 0x80,
+                        0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+};
+
+static u8 get_uuid_size(const u8 *uuid)
+{
+        u32 val;
+
+        if (memcmp(uuid, bluetooth_base_uuid, 12))
+                return 128;
+
+        val = get_unaligned_le32(&uuid[12]);
+        if (val > 0xffff)
+                return 32;
+
+        return 16;
+}
+
 static int add_uuid(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
 {
         struct mgmt_cp_add_uuid *cp = data;
@@ -1300,8 +1376,9 @@ static int add_uuid(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
 
         memcpy(uuid->uuid, cp->uuid, 16);
         uuid->svc_hint = cp->svc_hint;
+        uuid->size = get_uuid_size(cp->uuid);
 
-        list_add(&uuid->list, &hdev->uuids);
+        list_add_tail(&uuid->list, &hdev->uuids);
 
         err = update_class(hdev);
         if (err < 0)
@@ -1332,7 +1409,8 @@ static bool enable_service_cache(struct hci_dev *hdev)
                 return false;
 
         if (!test_and_set_bit(HCI_SERVICE_CACHE, &hdev->dev_flags)) {
-                schedule_delayed_work(&hdev->service_cache, CACHE_TIMEOUT);
+                queue_delayed_work(hdev->workqueue, &hdev->service_cache,
+                                   CACHE_TIMEOUT);
                 return true;
         }
 
@@ -1344,7 +1422,7 @@ static int remove_uuid(struct sock *sk, struct hci_dev *hdev, void *data,
 {
         struct mgmt_cp_remove_uuid *cp = data;
         struct pending_cmd *cmd;
-        struct list_head *p, *n;
+        struct bt_uuid *match, *tmp;
         u8 bt_uuid_any[] = { 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 };
         int err, found;
 
@@ -1372,9 +1450,7 @@ static int remove_uuid(struct sock *sk, struct hci_dev *hdev, void *data,
 
         found = 0;
 
-        list_for_each_safe(p, n, &hdev->uuids) {
-                struct bt_uuid *match = list_entry(p, struct bt_uuid, list);
-
+        list_for_each_entry_safe(match, tmp, &hdev->uuids, list) {
                 if (memcmp(match->uuid, cp->uuid, 16) != 0)
                         continue;
 
@@ -1422,13 +1498,19 @@ static int set_dev_class(struct sock *sk, struct hci_dev *hdev, void *data,
 
         BT_DBG("request for %s", hdev->name);
 
-        hci_dev_lock(hdev);
+        if (!lmp_bredr_capable(hdev))
+                return cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
+                                  MGMT_STATUS_NOT_SUPPORTED);
 
-        if (test_bit(HCI_PENDING_CLASS, &hdev->dev_flags)) {
-                err = cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
-                                 MGMT_STATUS_BUSY);
-                goto unlock;
-        }
+        if (test_bit(HCI_PENDING_CLASS, &hdev->dev_flags))
+                return cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
+                                  MGMT_STATUS_BUSY);
+
+        if ((cp->minor & 0x03) != 0 || (cp->major & 0xe0) != 0)
+                return cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
+                                  MGMT_STATUS_INVALID_PARAMS);
+
+        hci_dev_lock(hdev);
 
         hdev->major_class = cp->major;
         hdev->minor_class = cp->minor;
@@ -1483,9 +1565,21 @@ static int load_link_keys(struct sock *sk, struct hci_dev *hdev, void *data,
                                   MGMT_STATUS_INVALID_PARAMS);
         }
 
+        if (cp->debug_keys != 0x00 && cp->debug_keys != 0x01)
+                return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
+                                  MGMT_STATUS_INVALID_PARAMS);
+
         BT_DBG("%s debug_keys %u key_count %u", hdev->name, cp->debug_keys,
                key_count);
 
+        for (i = 0; i < key_count; i++) {
+                struct mgmt_link_key_info *key = &cp->keys[i];
+
+                if (key->addr.type != BDADDR_BREDR)
+                        return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
+                                          MGMT_STATUS_INVALID_PARAMS);
+        }
+
         hci_dev_lock(hdev);
 
         hci_link_keys_clear(hdev);
@@ -1533,12 +1627,22 @@ static int unpair_device(struct sock *sk, struct hci_dev *hdev, void *data,
         struct hci_conn *conn;
         int err;
 
-        hci_dev_lock(hdev);
-
         memset(&rp, 0, sizeof(rp));
         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
         rp.addr.type = cp->addr.type;
 
+        if (!bdaddr_type_is_valid(cp->addr.type))
+                return cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
+                                    MGMT_STATUS_INVALID_PARAMS,
+                                    &rp, sizeof(rp));
+
+        if (cp->disconnect != 0x00 && cp->disconnect != 0x01)
+                return cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
+                                    MGMT_STATUS_INVALID_PARAMS,
+                                    &rp, sizeof(rp));
+
+        hci_dev_lock(hdev);
+
         if (!hdev_is_powered(hdev)) {
                 err = cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
                                    MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp));
@@ -1596,6 +1700,7 @@ static int disconnect(struct sock *sk, struct hci_dev *hdev, void *data,
                       u16 len)
 {
         struct mgmt_cp_disconnect *cp = data;
+        struct mgmt_rp_disconnect rp;
         struct hci_cp_disconnect dc;
         struct pending_cmd *cmd;
         struct hci_conn *conn;
@@ -1603,17 +1708,26 @@ static int disconnect(struct sock *sk, struct hci_dev *hdev, void *data,
 
         BT_DBG("");
 
+        memset(&rp, 0, sizeof(rp));
+        bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
+        rp.addr.type = cp->addr.type;
+
+        if (!bdaddr_type_is_valid(cp->addr.type))
+                return cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
+                                    MGMT_STATUS_INVALID_PARAMS,
+                                    &rp, sizeof(rp));
+
         hci_dev_lock(hdev);
 
         if (!test_bit(HCI_UP, &hdev->flags)) {
-                err = cmd_status(sk, hdev->id, MGMT_OP_DISCONNECT,
-                                 MGMT_STATUS_NOT_POWERED);
+                err = cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
+                                   MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp));
                 goto failed;
         }
 
         if (mgmt_pending_find(MGMT_OP_DISCONNECT, hdev)) {
-                err = cmd_status(sk, hdev->id, MGMT_OP_DISCONNECT,
-                                 MGMT_STATUS_BUSY);
+                err = cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
+                                   MGMT_STATUS_BUSY, &rp, sizeof(rp));
                 goto failed;
         }
 
@@ -1624,8 +1738,8 @@ static int disconnect(struct sock *sk, struct hci_dev *hdev, void *data,
                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->addr.bdaddr);
 
         if (!conn || conn->state == BT_OPEN || conn->state == BT_CLOSED) {
-                err = cmd_status(sk, hdev->id, MGMT_OP_DISCONNECT,
-                                 MGMT_STATUS_NOT_CONNECTED);
+                err = cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
+                                   MGMT_STATUS_NOT_CONNECTED, &rp, sizeof(rp));
                 goto failed;
         }
 
@@ -1903,11 +2017,20 @@ static int pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
 
         BT_DBG("");
 
+        memset(&rp, 0, sizeof(rp));
+        bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
+        rp.addr.type = cp->addr.type;
+
+        if (!bdaddr_type_is_valid(cp->addr.type))
+                return cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
+                                    MGMT_STATUS_INVALID_PARAMS,
+                                    &rp, sizeof(rp));
+
         hci_dev_lock(hdev);
 
         if (!hdev_is_powered(hdev)) {
-                err = cmd_status(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
-                                 MGMT_STATUS_NOT_POWERED);
+                err = cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
+                                   MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp));
                 goto unlock;
         }
 
@@ -1924,10 +2047,6 @@ static int pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
                 conn = hci_connect(hdev, LE_LINK, &cp->addr.bdaddr,
                                    cp->addr.type, sec_level, auth_type);
 
-        memset(&rp, 0, sizeof(rp));
-        bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
-        rp.addr.type = cp->addr.type;
-
         if (IS_ERR(conn)) {
                 int status;
 
@@ -2254,24 +2373,16 @@ static int add_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
 
         hci_dev_lock(hdev);
 
-        if (!hdev_is_powered(hdev)) {
-                err = cmd_complete(sk, hdev->id, MGMT_OP_ADD_REMOTE_OOB_DATA,
-                                   MGMT_STATUS_NOT_POWERED, &cp->addr,
-                                   sizeof(cp->addr));
-                goto unlock;
-        }
-
         err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr, cp->hash,
                                       cp->randomizer);
         if (err < 0)
                 status = MGMT_STATUS_FAILED;
         else
-                status = 0;
+                status = MGMT_STATUS_SUCCESS;
 
         err = cmd_complete(sk, hdev->id, MGMT_OP_ADD_REMOTE_OOB_DATA, status,
                            &cp->addr, sizeof(cp->addr));
 
-unlock:
         hci_dev_unlock(hdev);
         return err;
 }
@@ -2287,24 +2398,15 @@ static int remove_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
 
         hci_dev_lock(hdev);
 
-        if (!hdev_is_powered(hdev)) {
-                err = cmd_complete(sk, hdev->id,
-                                   MGMT_OP_REMOVE_REMOTE_OOB_DATA,
-                                   MGMT_STATUS_NOT_POWERED, &cp->addr,
-                                   sizeof(cp->addr));
-                goto unlock;
-        }
-
         err = hci_remove_remote_oob_data(hdev, &cp->addr.bdaddr);
         if (err < 0)
                 status = MGMT_STATUS_INVALID_PARAMS;
         else
-                status = 0;
+                status = MGMT_STATUS_SUCCESS;
 
         err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_REMOTE_OOB_DATA,
                            status, &cp->addr, sizeof(cp->addr));
 
-unlock:
         hci_dev_unlock(hdev);
         return err;
 }
@@ -2365,31 +2467,45 @@ static int start_discovery(struct sock *sk, struct hci_dev *hdev,
 
         switch (hdev->discovery.type) {
         case DISCOV_TYPE_BREDR:
-                if (lmp_bredr_capable(hdev))
-                        err = hci_do_inquiry(hdev, INQUIRY_LEN_BREDR);
-                else
-                        err = -ENOTSUPP;
+                if (!lmp_bredr_capable(hdev)) {
+                        err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
+                                         MGMT_STATUS_NOT_SUPPORTED);
+                        mgmt_pending_remove(cmd);
+                        goto failed;
+                }
+
+                err = hci_do_inquiry(hdev, INQUIRY_LEN_BREDR);
                 break;
 
         case DISCOV_TYPE_LE:
-                if (lmp_host_le_capable(hdev))
-                        err = hci_le_scan(hdev, LE_SCAN_TYPE, LE_SCAN_INT,
-                                          LE_SCAN_WIN, LE_SCAN_TIMEOUT_LE_ONLY);
-                else
-                        err = -ENOTSUPP;
+                if (!lmp_host_le_capable(hdev)) {
+                        err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
+                                         MGMT_STATUS_NOT_SUPPORTED);
+                        mgmt_pending_remove(cmd);
+                        goto failed;
+                }
+
+                err = hci_le_scan(hdev, LE_SCAN_TYPE, LE_SCAN_INT,
+                                  LE_SCAN_WIN, LE_SCAN_TIMEOUT_LE_ONLY);
                 break;
 
         case DISCOV_TYPE_INTERLEAVED:
-                if (lmp_host_le_capable(hdev) && lmp_bredr_capable(hdev))
-                        err = hci_le_scan(hdev, LE_SCAN_TYPE, LE_SCAN_INT,
-                                          LE_SCAN_WIN,
-                                          LE_SCAN_TIMEOUT_BREDR_LE);
-                else
-                        err = -ENOTSUPP;
+                if (!lmp_host_le_capable(hdev) || !lmp_bredr_capable(hdev)) {
+                        err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
+                                         MGMT_STATUS_NOT_SUPPORTED);
+                        mgmt_pending_remove(cmd);
+                        goto failed;
+                }
+
+                err = hci_le_scan(hdev, LE_SCAN_TYPE, LE_SCAN_INT, LE_SCAN_WIN,
+                                  LE_SCAN_TIMEOUT_BREDR_LE);
                 break;
 
         default:
-                err = -EINVAL;
+                err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
+                                 MGMT_STATUS_INVALID_PARAMS);
+                mgmt_pending_remove(cmd);
+                goto failed;
         }
 
         if (err < 0)
@@ -2510,7 +2626,8 @@ static int confirm_name(struct sock *sk, struct hci_dev *hdev, void *data,
                 hci_inquiry_cache_update_resolve(hdev, e);
         }
 
-        err = 0;
+        err = cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME, 0, &cp->addr,
+                           sizeof(cp->addr));
 
 failed:
         hci_dev_unlock(hdev);
@@ -2526,13 +2643,18 @@ static int block_device(struct sock *sk, struct hci_dev *hdev, void *data,
 
         BT_DBG("%s", hdev->name);
 
+        if (!bdaddr_type_is_valid(cp->addr.type))
+                return cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE,
+                                    MGMT_STATUS_INVALID_PARAMS,
+                                    &cp->addr, sizeof(cp->addr));
+
         hci_dev_lock(hdev);
 
         err = hci_blacklist_add(hdev, &cp->addr.bdaddr, cp->addr.type);
         if (err < 0)
                 status = MGMT_STATUS_FAILED;
         else
-                status = 0;
+                status = MGMT_STATUS_SUCCESS;
 
         err = cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE, status,
                            &cp->addr, sizeof(cp->addr));
@@ -2551,13 +2673,18 @@ static int unblock_device(struct sock *sk, struct hci_dev *hdev, void *data,
 
         BT_DBG("%s", hdev->name);
 
+        if (!bdaddr_type_is_valid(cp->addr.type))
+                return cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE,
+                                    MGMT_STATUS_INVALID_PARAMS,
+                                    &cp->addr, sizeof(cp->addr));
+
         hci_dev_lock(hdev);
 
         err = hci_blacklist_del(hdev, &cp->addr.bdaddr, cp->addr.type);
         if (err < 0)
                 status = MGMT_STATUS_INVALID_PARAMS;
         else
-                status = 0;
+                status = MGMT_STATUS_SUCCESS;
 
         err = cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE, status,
                            &cp->addr, sizeof(cp->addr));
@@ -2612,6 +2739,10 @@ static int set_fast_connectable(struct sock *sk, struct hci_dev *hdev,
                 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
                                   MGMT_STATUS_NOT_SUPPORTED);
 
+        if (cp->val != 0x00 && cp->val != 0x01)
+                return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
+                                  MGMT_STATUS_INVALID_PARAMS);
+
         if (!hdev_is_powered(hdev))
                 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
                                   MGMT_STATUS_NOT_POWERED);
@@ -2659,12 +2790,23 @@ done:
         return err;
 }
 
+static bool ltk_is_valid(struct mgmt_ltk_info *key)
+{
+        if (key->authenticated != 0x00 && key->authenticated != 0x01)
+                return false;
+        if (key->master != 0x00 && key->master != 0x01)
+                return false;
+        if (!bdaddr_type_is_le(key->addr.type))
+                return false;
+        return true;
+}
+
 static int load_long_term_keys(struct sock *sk, struct hci_dev *hdev,
                                void *cp_data, u16 len)
 {
         struct mgmt_cp_load_long_term_keys *cp = cp_data;
         u16 key_count, expected_len;
-        int i;
+        int i, err;
 
         key_count = __le16_to_cpu(cp->key_count);
 
@@ -2674,11 +2816,20 @@ static int load_long_term_keys(struct sock *sk, struct hci_dev *hdev,
                 BT_ERR("load_keys: expected %u bytes, got %u bytes",
                        len, expected_len);
                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
-                                  EINVAL);
+                                  MGMT_STATUS_INVALID_PARAMS);
         }
 
         BT_DBG("%s key_count %u", hdev->name, key_count);
 
+        for (i = 0; i < key_count; i++) {
+                struct mgmt_ltk_info *key = &cp->keys[i];
+
+                if (!ltk_is_valid(key))
+                        return cmd_status(sk, hdev->id,
+                                          MGMT_OP_LOAD_LONG_TERM_KEYS,
+                                          MGMT_STATUS_INVALID_PARAMS);
+        }
+
         hci_dev_lock(hdev);
 
         hci_smp_ltks_clear(hdev);
@@ -2698,9 +2849,12 @@ static int load_long_term_keys(struct sock *sk, struct hci_dev *hdev,
                             key->enc_size, key->ediv, key->rand);
         }
 
+        err = cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS, 0,
+                           NULL, 0);
+
         hci_dev_unlock(hdev);
 
-        return 0;
+        return err;
 }
 
 static const struct mgmt_handler {
@@ -2915,6 +3069,8 @@ int mgmt_powered(struct hci_dev *hdev, u8 powered)
         mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
 
         if (powered) {
+                u8 link_sec;
+
                 if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags) &&
                     !lmp_host_ssp_capable(hdev)) {
                         u8 ssp = 1;
@@ -2938,6 +3094,11 @@ int mgmt_powered(struct hci_dev *hdev, u8 powered)
                                              sizeof(cp), &cp);
                 }
 
+                link_sec = test_bit(HCI_LINK_SECURITY, &hdev->dev_flags);
+                if (link_sec != test_bit(HCI_AUTH, &hdev->flags))
+                        hci_send_cmd(hdev, HCI_OP_WRITE_AUTH_ENABLE,
+                                     sizeof(link_sec), &link_sec);
+
                 if (lmp_bredr_capable(hdev)) {
                         set_bredr_scan(hdev);
                         update_class(hdev);
@@ -2946,7 +3107,13 @@ int mgmt_powered(struct hci_dev *hdev, u8 powered)
                 }
         } else {
                 u8 status = MGMT_STATUS_NOT_POWERED;
+                u8 zero_cod[] = { 0, 0, 0 };
+
                 mgmt_pending_foreach(0, hdev, cmd_status_rsp, &status);
+
+                if (memcmp(hdev->dev_class, zero_cod, sizeof(zero_cod)) != 0)
+                        mgmt_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev,
+                                   zero_cod, sizeof(zero_cod), NULL);
         }
 
         err = new_settings(hdev, match.sk);
diff --git a/net/bluetooth/sco.c b/net/bluetooth/sco.c
index 57f250c20e39..b5178d62064e 100644
--- a/net/bluetooth/sco.c
+++ b/net/bluetooth/sco.c
@@ -900,8 +900,6 @@ static void sco_conn_ready(struct sco_conn *conn)
 
         BT_DBG("conn %p", conn);
 
-        sco_conn_lock(conn);
-
         if (sk) {
                 sco_sock_clear_timer(sk);
                 bh_lock_sock(sk);
@@ -909,9 +907,13 @@ static void sco_conn_ready(struct sco_conn *conn)
                 sk->sk_state_change(sk);
                 bh_unlock_sock(sk);
         } else {
+                sco_conn_lock(conn);
+
                 parent = sco_get_sock_listen(conn->src);
-                if (!parent)
-                        goto done;
+                if (!parent) {
+                        sco_conn_unlock(conn);
+                        return;
+                }
 
                 bh_lock_sock(parent);
 
@@ -919,7 +921,8 @@ static void sco_conn_ready(struct sco_conn *conn)
                                     BTPROTO_SCO, GFP_ATOMIC);
                 if (!sk) {
                         bh_unlock_sock(parent);
-                        goto done;
+                        sco_conn_unlock(conn);
+                        return;
                 }
 
                 sco_sock_init(sk, parent);
@@ -939,10 +942,9 @@ static void sco_conn_ready(struct sco_conn *conn)
                 parent->sk_data_ready(parent, 1);
 
                 bh_unlock_sock(parent);
-        }
 
-done:
-        sco_conn_unlock(conn);
+                sco_conn_unlock(conn);
+        }
 }
 
 /* ----- SCO interface with lower layer (HCI) ----- */
diff --git a/net/bluetooth/smp.c b/net/bluetooth/smp.c
index 68a9587c9694..5abefb12891d 100644
--- a/net/bluetooth/smp.c
+++ b/net/bluetooth/smp.c
@@ -859,6 +859,19 @@ int smp_sig_channel(struct l2cap_conn *conn, struct sk_buff *skb)
 
         skb_pull(skb, sizeof(code));
 
+        /*
+         * The SMP context must be initialized for all other PDUs except
+         * pairing and security requests. If we get any other PDU when
+         * not initialized simply disconnect (done if this function
+         * returns an error).
+         */
+        if (code != SMP_CMD_PAIRING_REQ && code != SMP_CMD_SECURITY_REQ &&
+            !conn->smp_chan) {
+                BT_ERR("Unexpected SMP command 0x%02x. Disconnecting.", code);
+                kfree_skb(skb);
+                return -ENOTSUPP;
+        }
+
         switch (code) {
         case SMP_CMD_PAIRING_REQ:
                 reason = smp_cmd_pairing_req(conn, skb);
diff --git a/net/bridge/Kconfig b/net/bridge/Kconfig
index 6dee7bf648a9..aa0d3b2f1bb7 100644
--- a/net/bridge/Kconfig
+++ b/net/bridge/Kconfig
@@ -46,3 +46,17 @@ config BRIDGE_IGMP_SNOOPING
           Say N to exclude this support and reduce the binary size.
 
           If unsure, say Y.
+
+config BRIDGE_VLAN_FILTERING
+        bool "VLAN filtering"
+        depends on BRIDGE
+        depends on VLAN_8021Q
+        default n
+        ---help---
+          If you say Y here, then the Ethernet bridge will be able selectively
+          receive and forward traffic based on VLAN information in the packet
+          any VLAN information configured on the bridge port or bridge device.
+
+          Say N to exclude this support and reduce the binary size.
+
+          If unsure, say Y.
diff --git a/net/bridge/Makefile b/net/bridge/Makefile
index e859098f5ee9..e85498b2f166 100644
--- a/net/bridge/Makefile
+++ b/net/bridge/Makefile
@@ -14,4 +14,6 @@ bridge-$(CONFIG_BRIDGE_NETFILTER) += br_netfilter.o
 
 bridge-$(CONFIG_BRIDGE_IGMP_SNOOPING) += br_multicast.o br_mdb.o
 
+bridge-$(CONFIG_BRIDGE_VLAN_FILTERING) += br_vlan.o
+
 obj-$(CONFIG_BRIDGE_NF_EBTABLES) += netfilter/
diff --git a/net/bridge/br_device.c b/net/bridge/br_device.c
index e1bc090bc00a..d5f1d3fd4b28 100644
--- a/net/bridge/br_device.c
+++ b/net/bridge/br_device.c
@@ -30,6 +30,7 @@ netdev_tx_t br_dev_xmit(struct sk_buff *skb, struct net_device *dev)
         struct net_bridge_fdb_entry *dst;
         struct net_bridge_mdb_entry *mdst;
         struct br_cpu_netstats *brstats = this_cpu_ptr(br->stats);
+        u16 vid = 0;
 
         rcu_read_lock();
 #ifdef CONFIG_BRIDGE_NETFILTER
@@ -45,6 +46,9 @@ netdev_tx_t br_dev_xmit(struct sk_buff *skb, struct net_device *dev)
         brstats->tx_bytes += skb->len;
         u64_stats_update_end(&brstats->syncp);
 
+        if (!br_allowed_ingress(br, br_get_vlan_info(br), skb, &vid))
+                goto out;
+
         BR_INPUT_SKB_CB(skb)->brdev = dev;
 
         skb_reset_mac_header(skb);
@@ -67,7 +71,7 @@ netdev_tx_t br_dev_xmit(struct sk_buff *skb, struct net_device *dev)
                         br_multicast_deliver(mdst, skb);
                 else
                         br_flood_deliver(br, skb);
-        } else if ((dst = __br_fdb_get(br, dest)) != NULL)
+        } else if ((dst = __br_fdb_get(br, dest, vid)) != NULL)
                 br_deliver(dst->dst, skb);
         else
                 br_flood_deliver(br, skb);
@@ -176,7 +180,6 @@ static int br_set_mac_address(struct net_device *dev, void *p)
                 br_fdb_change_mac_address(br, addr->sa_data);
                 br_stp_change_bridge_id(br, addr->sa_data);
         }
-        br->flags |= BR_SET_MAC_ADDR;
         spin_unlock_bh(&br->lock);
 
         return 0;
@@ -266,7 +269,7 @@ void br_netpoll_disable(struct net_bridge_port *p)
 
         p->np = NULL;
 
-        __netpoll_free_rcu(np);
+        __netpoll_free_async(np);
 }
 
 #endif
@@ -314,6 +317,7 @@ static const struct net_device_ops br_netdev_ops = {
         .ndo_fdb_dump            = br_fdb_dump,
         .ndo_bridge_getlink      = br_getlink,
         .ndo_bridge_setlink      = br_setlink,
+        .ndo_bridge_dellink      = br_dellink,
 };
 
 static void br_dev_free(struct net_device *dev)
diff --git a/net/bridge/br_fdb.c b/net/bridge/br_fdb.c
index d9576e6de2b8..8117900af4de 100644
--- a/net/bridge/br_fdb.c
+++ b/net/bridge/br_fdb.c
@@ -23,11 +23,12 @@
 #include <linux/slab.h>
 #include <linux/atomic.h>
 #include <asm/unaligned.h>
+#include <linux/if_vlan.h>
 #include "br_private.h"
 
 static struct kmem_cache *br_fdb_cache __read_mostly;
 static int fdb_insert(struct net_bridge *br, struct net_bridge_port *source,
-                      const unsigned char *addr);
+                      const unsigned char *addr, u16 vid);
 static void fdb_notify(struct net_bridge *br,
                        const struct net_bridge_fdb_entry *, int);
 
@@ -67,11 +68,11 @@ static inline int has_expired(const struct net_bridge *br,
                 time_before_eq(fdb->updated + hold_time(br), jiffies);
 }
 
-static inline int br_mac_hash(const unsigned char *mac)
+static inline int br_mac_hash(const unsigned char *mac, __u16 vid)
 {
-        /* use 1 byte of OUI cnd 3 bytes of NIC */
+        /* use 1 byte of OUI and 3 bytes of NIC */
         u32 key = get_unaligned((u32 *)(mac + 2));
-        return jhash_1word(key, fdb_salt) & (BR_HASH_SIZE - 1);
+        return jhash_2words(key, vid, fdb_salt) & (BR_HASH_SIZE - 1);
 }
 
 static void fdb_rcu_free(struct rcu_head *head)
@@ -91,6 +92,7 @@ static void fdb_delete(struct net_bridge *br, struct net_bridge_fdb_entry *f)
 void br_fdb_changeaddr(struct net_bridge_port *p, const unsigned char *newaddr)
 {
         struct net_bridge *br = p->br;
+        bool no_vlan = (nbp_get_vlan_info(p) == NULL) ? true : false;
         int i;
 
         spin_lock_bh(&br->hash_lock);
@@ -105,10 +107,12 @@ void br_fdb_changeaddr(struct net_bridge_port *p, const unsigned char *newaddr)
                         if (f->dst == p && f->is_local) {
                                 /* maybe another port has same hw addr? */
                                 struct net_bridge_port *op;
+                                u16 vid = f->vlan_id;
                                 list_for_each_entry(op, &br->port_list, list) {
                                         if (op != p &&
                                             ether_addr_equal(op->dev->dev_addr,
-                                                             f->addr.addr)) {
+                                                             f->addr.addr) &&
+                                            nbp_vlan_find(op, vid)) {
                                                 f->dst = op;
                                                 goto insert;
                                         }
@@ -116,27 +120,55 @@ void br_fdb_changeaddr(struct net_bridge_port *p, const unsigned char *newaddr)
 
                                 /* delete old one */
                                 fdb_delete(br, f);
-                                goto insert;
+insert:
+                                /* insert new address,  may fail if invalid
+                                 * address or dup.
+                                 */
+                                fdb_insert(br, p, newaddr, vid);
+
+                                /* if this port has no vlan information
+                                 * configured, we can safely be done at
+                                 * this point.
+                                 */
+                                if (no_vlan)
+                                        goto done;
                         }
                 }
         }
- insert:
-        /* insert new address,  may fail if invalid address or dup. */
-        fdb_insert(br, p, newaddr);
 
+done:
         spin_unlock_bh(&br->hash_lock);
 }
 
 void br_fdb_change_mac_address(struct net_bridge *br, const u8 *newaddr)
 {
         struct net_bridge_fdb_entry *f;
+        struct net_port_vlans *pv;
+        u16 vid = 0;
 
         /* If old entry was unassociated with any port, then delete it. */
-        f = __br_fdb_get(br, br->dev->dev_addr);
+        f = __br_fdb_get(br, br->dev->dev_addr, 0);
         if (f && f->is_local && !f->dst)
                 fdb_delete(br, f);
 
-        fdb_insert(br, NULL, newaddr);
+        fdb_insert(br, NULL, newaddr, 0);
+
+        /* Now remove and add entries for every VLAN configured on the
+         * bridge.  This function runs under RTNL so the bitmap will not
+         * change from under us.
+         */
+        pv = br_get_vlan_info(br);
+        if (!pv)
+                return;
+
+        for (vid = find_next_bit(pv->vlan_bitmap, BR_VLAN_BITMAP_LEN, vid);
+             vid < BR_VLAN_BITMAP_LEN;
+             vid = find_next_bit(pv->vlan_bitmap, BR_VLAN_BITMAP_LEN, vid+1)) {
+                f = __br_fdb_get(br, br->dev->dev_addr, vid);
+                if (f && f->is_local && !f->dst)
+                        fdb_delete(br, f);
+                fdb_insert(br, NULL, newaddr, vid);
+        }
 }
 
 void br_fdb_cleanup(unsigned long _data)
@@ -231,13 +263,16 @@ void br_fdb_delete_by_port(struct net_bridge *br,
 
 /* No locking or refcounting, assumes caller has rcu_read_lock */
 struct net_bridge_fdb_entry *__br_fdb_get(struct net_bridge *br,
-                                          const unsigned char *addr)
+                                          const unsigned char *addr,
+                                          __u16 vid)
 {
         struct hlist_node *h;
         struct net_bridge_fdb_entry *fdb;
 
-        hlist_for_each_entry_rcu(fdb, h, &br->hash[br_mac_hash(addr)], hlist) {
-                if (ether_addr_equal(fdb->addr.addr, addr)) {
+        hlist_for_each_entry_rcu(fdb, h,
+                                &br->hash[br_mac_hash(addr, vid)], hlist) {
+                if (ether_addr_equal(fdb->addr.addr, addr) &&
+                    fdb->vlan_id == vid) {
                         if (unlikely(has_expired(br, fdb)))
                                 break;
                         return fdb;
@@ -261,7 +296,7 @@ int br_fdb_test_addr(struct net_device *dev, unsigned char *addr)
         if (!port)
                 ret = 0;
         else {
-                fdb = __br_fdb_get(port->br, addr);
+                fdb = __br_fdb_get(port->br, addr, 0);
                 ret = fdb && fdb->dst && fdb->dst->dev != dev &&
                         fdb->dst->state == BR_STATE_FORWARDING;
         }
@@ -325,26 +360,30 @@ int br_fdb_fillbuf(struct net_bridge *br, void *buf,
 }
 
 static struct net_bridge_fdb_entry *fdb_find(struct hlist_head *head,
-                                             const unsigned char *addr)
+                                             const unsigned char *addr,
+                                             __u16 vid)
 {
         struct hlist_node *h;
         struct net_bridge_fdb_entry *fdb;
 
         hlist_for_each_entry(fdb, h, head, hlist) {
-                if (ether_addr_equal(fdb->addr.addr, addr))
+                if (ether_addr_equal(fdb->addr.addr, addr) &&
+                    fdb->vlan_id == vid)
                         return fdb;
         }
         return NULL;
 }
 
 static struct net_bridge_fdb_entry *fdb_find_rcu(struct hlist_head *head,
-                                                 const unsigned char *addr)
+                                                 const unsigned char *addr,
+                                                 __u16 vid)
 {
         struct hlist_node *h;
         struct net_bridge_fdb_entry *fdb;
 
         hlist_for_each_entry_rcu(fdb, h, head, hlist) {
-                if (ether_addr_equal(fdb->addr.addr, addr))
+                if (ether_addr_equal(fdb->addr.addr, addr) &&
+                    fdb->vlan_id == vid)
                         return fdb;
         }
         return NULL;
@@ -352,7 +391,8 @@ static struct net_bridge_fdb_entry *fdb_find_rcu(struct hlist_head *head,
 
 static struct net_bridge_fdb_entry *fdb_create(struct hlist_head *head,
                                                struct net_bridge_port *source,
-                                               const unsigned char *addr)
+                                               const unsigned char *addr,
+                                               __u16 vid)
 {
         struct net_bridge_fdb_entry *fdb;
 
@@ -360,6 +400,7 @@ static struct net_bridge_fdb_entry *fdb_create(struct hlist_head *head,
         if (fdb) {
                 memcpy(fdb->addr.addr, addr, ETH_ALEN);
                 fdb->dst = source;
+                fdb->vlan_id = vid;
                 fdb->is_local = 0;
                 fdb->is_static = 0;
                 fdb->updated = fdb->used = jiffies;
@@ -369,15 +410,15 @@ static struct net_bridge_fdb_entry *fdb_create(struct hlist_head *head,
 }
 
 static int fdb_insert(struct net_bridge *br, struct net_bridge_port *source,
-                  const unsigned char *addr)
+                  const unsigned char *addr, u16 vid)
 {
-        struct hlist_head *head = &br->hash[br_mac_hash(addr)];
+        struct hlist_head *head = &br->hash[br_mac_hash(addr, vid)];
         struct net_bridge_fdb_entry *fdb;
 
         if (!is_valid_ether_addr(addr))
                 return -EINVAL;
 
-        fdb = fdb_find(head, addr);
+        fdb = fdb_find(head, addr, vid);
         if (fdb) {
                 /* it is okay to have multiple ports with same
                  * address, just use the first one.
@@ -390,7 +431,7 @@ static int fdb_insert(struct net_bridge *br, struct net_bridge_port *source,
                 fdb_delete(br, fdb);
         }
 
-        fdb = fdb_create(head, source, addr);
+        fdb = fdb_create(head, source, addr, vid);
         if (!fdb)
                 return -ENOMEM;
 
@@ -401,20 +442,20 @@ static int fdb_insert(struct net_bridge *br, struct net_bridge_port *source,
 
 /* Add entry for local address of interface */
 int br_fdb_insert(struct net_bridge *br, struct net_bridge_port *source,
-                  const unsigned char *addr)
+                  const unsigned char *addr, u16 vid)
 {
         int ret;
 
         spin_lock_bh(&br->hash_lock);
-        ret = fdb_insert(br, source, addr);
+        ret = fdb_insert(br, source, addr, vid);
         spin_unlock_bh(&br->hash_lock);
         return ret;
 }
 
 void br_fdb_update(struct net_bridge *br, struct net_bridge_port *source,
-                   const unsigned char *addr)
+                   const unsigned char *addr, u16 vid)
 {
-        struct hlist_head *head = &br->hash[br_mac_hash(addr)];
+        struct hlist_head *head = &br->hash[br_mac_hash(addr, vid)];
         struct net_bridge_fdb_entry *fdb;
 
         /* some users want to always flood. */
@@ -426,7 +467,7 @@ void br_fdb_update(struct net_bridge *br, struct net_bridge_port *source,
               source->state == BR_STATE_FORWARDING))
                 return;
 
-        fdb = fdb_find_rcu(head, addr);
+        fdb = fdb_find_rcu(head, addr, vid);
         if (likely(fdb)) {
                 /* attempt to update an entry for a local interface */
                 if (unlikely(fdb->is_local)) {
@@ -441,8 +482,8 @@ void br_fdb_update(struct net_bridge *br, struct net_bridge_port *source,
                 }
         } else {
                 spin_lock(&br->hash_lock);
-                if (likely(!fdb_find(head, addr))) {
-                        fdb = fdb_create(head, source, addr);
+                if (likely(!fdb_find(head, addr, vid))) {
+                        fdb = fdb_create(head, source, addr, vid);
                         if (fdb)
                                 fdb_notify(br, fdb, RTM_NEWNEIGH);
                 }
@@ -495,6 +536,10 @@ static int fdb_fill_info(struct sk_buff *skb, const struct net_bridge *br,
         ci.ndm_refcnt    = 0;
         if (nla_put(skb, NDA_CACHEINFO, sizeof(ci), &ci))
                 goto nla_put_failure;
+
+        if (nla_put(skb, NDA_VLAN, sizeof(u16), &fdb->vlan_id))
+                goto nla_put_failure;
+
         return nlmsg_end(skb, nlh);
 
 nla_put_failure:
@@ -506,6 +551,7 @@ static inline size_t fdb_nlmsg_size(void)
 {
         return NLMSG_ALIGN(sizeof(struct ndmsg))
                 + nla_total_size(ETH_ALEN) /* NDA_LLADDR */
+                + nla_total_size(sizeof(u16)) /* NDA_VLAN */
                 + nla_total_size(sizeof(struct nda_cacheinfo));
 }
 
@@ -571,18 +617,18 @@ out:
 
 /* Update (create or replace) forwarding database entry */
 static int fdb_add_entry(struct net_bridge_port *source, const __u8 *addr,
-                         __u16 state, __u16 flags)
+                         __u16 state, __u16 flags, __u16 vid)
 {
         struct net_bridge *br = source->br;
-        struct hlist_head *head = &br->hash[br_mac_hash(addr)];
+        struct hlist_head *head = &br->hash[br_mac_hash(addr, vid)];
         struct net_bridge_fdb_entry *fdb;
 
-        fdb = fdb_find(head, addr);
+        fdb = fdb_find(head, addr, vid);
         if (fdb == NULL) {
                 if (!(flags & NLM_F_CREATE))
                         return -ENOENT;
 
-                fdb = fdb_create(head, source, addr);
+                fdb = fdb_create(head, source, addr, vid);
                 if (!fdb)
                         return -ENOMEM;
                 fdb_notify(br, fdb, RTM_NEWNEIGH);
@@ -607,6 +653,25 @@ static int fdb_add_entry(struct net_bridge_port *source, const __u8 *addr,
         return 0;
 }
 
+static int __br_fdb_add(struct ndmsg *ndm, struct net_bridge_port *p,
+               const unsigned char *addr, u16 nlh_flags, u16 vid)
+{
+        int err = 0;
+
+        if (ndm->ndm_flags & NTF_USE) {
+                rcu_read_lock();
+                br_fdb_update(p->br, p, addr, vid);
+                rcu_read_unlock();
+        } else {
+                spin_lock_bh(&p->br->hash_lock);
+                err = fdb_add_entry(p, addr, ndm->ndm_state,
+                                    nlh_flags, vid);
+                spin_unlock_bh(&p->br->hash_lock);
+        }
+
+        return err;
+}
+
 /* Add new permanent fdb entry with RTM_NEWNEIGH */
 int br_fdb_add(struct ndmsg *ndm, struct nlattr *tb[],
                struct net_device *dev,
@@ -614,12 +679,29 @@ int br_fdb_add(struct ndmsg *ndm, struct nlattr *tb[],
 {
         struct net_bridge_port *p;
         int err = 0;
+        struct net_port_vlans *pv;
+        unsigned short vid = VLAN_N_VID;
 
         if (!(ndm->ndm_state & (NUD_PERMANENT|NUD_NOARP|NUD_REACHABLE))) {
                 pr_info("bridge: RTM_NEWNEIGH with invalid state %#x\n", ndm->ndm_state);
                 return -EINVAL;
         }
 
+        if (tb[NDA_VLAN]) {
+                if (nla_len(tb[NDA_VLAN]) != sizeof(unsigned short)) {
+                        pr_info("bridge: RTM_NEWNEIGH with invalid vlan\n");
+                        return -EINVAL;
+                }
+
+                vid = nla_get_u16(tb[NDA_VLAN]);
+
+                if (vid >= VLAN_N_VID) {
+                        pr_info("bridge: RTM_NEWNEIGH with invalid vlan id %d\n",
+                                vid);
+                        return -EINVAL;
+                }
+        }
+
         p = br_port_get_rtnl(dev);
         if (p == NULL) {
                 pr_info("bridge: RTM_NEWNEIGH %s not a bridge port\n",
@@ -627,40 +709,90 @@ int br_fdb_add(struct ndmsg *ndm, struct nlattr *tb[],
                 return -EINVAL;
         }
 
-        if (ndm->ndm_flags & NTF_USE) {
-                rcu_read_lock();
-                br_fdb_update(p->br, p, addr);
-                rcu_read_unlock();
+        pv = nbp_get_vlan_info(p);
+        if (vid != VLAN_N_VID) {
+                if (!pv || !test_bit(vid, pv->vlan_bitmap)) {
+                        pr_info("bridge: RTM_NEWNEIGH with unconfigured "
+                                "vlan %d on port %s\n", vid, dev->name);
+                        return -EINVAL;
+                }
+
+                /* VID was specified, so use it. */
+                err = __br_fdb_add(ndm, p, addr, nlh_flags, vid);
         } else {
-                spin_lock_bh(&p->br->hash_lock);
-                err = fdb_add_entry(p, addr, ndm->ndm_state, nlh_flags);
-                spin_unlock_bh(&p->br->hash_lock);
+                if (!pv || bitmap_empty(pv->vlan_bitmap, BR_VLAN_BITMAP_LEN)) {
+                        err = __br_fdb_add(ndm, p, addr, nlh_flags, 0);
+                        goto out;
+                }
+
+                /* We have vlans configured on this port and user didn't
+                 * specify a VLAN.  To be nice, add/update entry for every
+                 * vlan on this port.
+                 */
+                vid = find_first_bit(pv->vlan_bitmap, BR_VLAN_BITMAP_LEN);
+                while (vid < BR_VLAN_BITMAP_LEN) {
+                        err = __br_fdb_add(ndm, p, addr, nlh_flags, vid);
+                        if (err)
+                                goto out;
+                        vid = find_next_bit(pv->vlan_bitmap,
+                                            BR_VLAN_BITMAP_LEN, vid+1);
+                }
         }
 
+out:
         return err;
 }
 
-static int fdb_delete_by_addr(struct net_bridge_port *p, const u8 *addr)
+int fdb_delete_by_addr(struct net_bridge *br, const u8 *addr,
+                       u16 vlan)
 {
-        struct net_bridge *br = p->br;
-        struct hlist_head *head = &br->hash[br_mac_hash(addr)];
+        struct hlist_head *head = &br->hash[br_mac_hash(addr, vlan)];
         struct net_bridge_fdb_entry *fdb;
 
-        fdb = fdb_find(head, addr);
+        fdb = fdb_find(head, addr, vlan);
         if (!fdb)
                 return -ENOENT;
 
-        fdb_delete(p->br, fdb);
+        fdb_delete(br, fdb);
         return 0;
 }
 
+static int __br_fdb_delete(struct net_bridge_port *p,
+                           const unsigned char *addr, u16 vid)
+{
+        int err;
+
+        spin_lock_bh(&p->br->hash_lock);
+        err = fdb_delete_by_addr(p->br, addr, vid);
+        spin_unlock_bh(&p->br->hash_lock);
+
+        return err;
+}
+
 /* Remove neighbor entry with RTM_DELNEIGH */
-int br_fdb_delete(struct ndmsg *ndm, struct net_device *dev,
+int br_fdb_delete(struct ndmsg *ndm, struct nlattr *tb[],
+                  struct net_device *dev,
                   const unsigned char *addr)
 {
         struct net_bridge_port *p;
         int err;
+        struct net_port_vlans *pv;
+        unsigned short vid = VLAN_N_VID;
+
+        if (tb[NDA_VLAN]) {
+                if (nla_len(tb[NDA_VLAN]) != sizeof(unsigned short)) {
+                        pr_info("bridge: RTM_NEWNEIGH with invalid vlan\n");
+                        return -EINVAL;
+                }
+
+                vid = nla_get_u16(tb[NDA_VLAN]);
 
+                if (vid >= VLAN_N_VID) {
+                        pr_info("bridge: RTM_NEWNEIGH with invalid vlan id %d\n",
+                                vid);
+                        return -EINVAL;
+                }
+        }
         p = br_port_get_rtnl(dev);
         if (p == NULL) {
                 pr_info("bridge: RTM_DELNEIGH %s not a bridge port\n",
@@ -668,9 +800,33 @@ int br_fdb_delete(struct ndmsg *ndm, struct net_device *dev,
                 return -EINVAL;
         }
 
-        spin_lock_bh(&p->br->hash_lock);
-        err = fdb_delete_by_addr(p, addr);
-        spin_unlock_bh(&p->br->hash_lock);
+        pv = nbp_get_vlan_info(p);
+        if (vid != VLAN_N_VID) {
+                if (!pv || !test_bit(vid, pv->vlan_bitmap)) {
+                        pr_info("bridge: RTM_DELNEIGH with unconfigured "
+                                "vlan %d on port %s\n", vid, dev->name);
+                        return -EINVAL;
+                }
+
+                err = __br_fdb_delete(p, addr, vid);
+        } else {
+                if (!pv || bitmap_empty(pv->vlan_bitmap, BR_VLAN_BITMAP_LEN)) {
+                        err = __br_fdb_delete(p, addr, 0);
+                        goto out;
+                }
 
+                /* We have vlans configured on this port and user didn't
+                 * specify a VLAN.  To be nice, add/update entry for every
+                 * vlan on this port.
+                 */
+                err = -ENOENT;
+                vid = find_first_bit(pv->vlan_bitmap, BR_VLAN_BITMAP_LEN);
+                while (vid < BR_VLAN_BITMAP_LEN) {
+                        err &= __br_fdb_delete(p, addr, vid);
+                        vid = find_next_bit(pv->vlan_bitmap,
+                                            BR_VLAN_BITMAP_LEN, vid+1);
+                }
+        }
+out:
         return err;
 }
diff --git a/net/bridge/br_forward.c b/net/bridge/br_forward.c
index 02015a505d2a..092b20e4ee4c 100644
--- a/net/bridge/br_forward.c
+++ b/net/bridge/br_forward.c
@@ -31,6 +31,7 @@ static inline int should_deliver(const struct net_bridge_port *p,
                                  const struct sk_buff *skb)
 {
         return (((p->flags & BR_HAIRPIN_MODE) || skb->dev != p->dev) &&
+                br_allowed_egress(p->br, nbp_get_vlan_info(p), skb) &&
                 p->state == BR_STATE_FORWARDING);
 }
 
@@ -63,6 +64,10 @@ int br_forward_finish(struct sk_buff *skb)
 
 static void __br_deliver(const struct net_bridge_port *to, struct sk_buff *skb)
 {
+        skb = br_handle_vlan(to->br, nbp_get_vlan_info(to), skb);
+        if (!skb)
+                return;
+
         skb->dev = to->dev;
 
         if (unlikely(netpoll_tx_running(to->br->dev))) {
@@ -88,6 +93,10 @@ static void __br_forward(const struct net_bridge_port *to, struct sk_buff *skb)
                 return;
         }
 
+        skb = br_handle_vlan(to->br, nbp_get_vlan_info(to), skb);
+        if (!skb)
+                return;
+
         indev = skb->dev;
         skb->dev = to->dev;
         skb_forward_csum(skb);
diff --git a/net/bridge/br_if.c b/net/bridge/br_if.c
index 2148d474a04f..ef1b91431c6b 100644
--- a/net/bridge/br_if.c
+++ b/net/bridge/br_if.c
@@ -23,6 +23,7 @@
 #include <linux/if_ether.h>
 #include <linux/slab.h>
 #include <net/sock.h>
+#include <linux/if_vlan.h>
 
 #include "br_private.h"
 
@@ -139,6 +140,7 @@ static void del_nbp(struct net_bridge_port *p)
 
         br_ifinfo_notify(RTM_DELLINK, p);
 
+        nbp_vlan_flush(p);
         br_fdb_delete_by_port(br, p, 1);
 
         list_del_rcu(&p->list);
@@ -395,7 +397,7 @@ int br_add_if(struct net_bridge *br, struct net_device *dev)
 
         dev_set_mtu(br->dev, br_min_mtu(br));
 
-        if (br_fdb_insert(br, p, dev->dev_addr))
+        if (br_fdb_insert(br, p, dev->dev_addr, 0))
                 netdev_err(dev, "failed insert local address bridge forwarding table\n");
 
         kobject_uevent(&p->kobj, KOBJ_ADD);
diff --git a/net/bridge/br_input.c b/net/bridge/br_input.c
index 4b34207419b1..480330151898 100644
--- a/net/bridge/br_input.c
+++ b/net/bridge/br_input.c
@@ -17,6 +17,7 @@
 #include <linux/etherdevice.h>
 #include <linux/netfilter_bridge.h>
 #include <linux/export.h>
+#include <linux/rculist.h>
 #include "br_private.h"
 
 /* Hook for brouter */
@@ -34,6 +35,20 @@ static int br_pass_frame_up(struct sk_buff *skb)
         brstats->rx_bytes += skb->len;
         u64_stats_update_end(&brstats->syncp);
 
+        /* Bridge is just like any other port.  Make sure the
+         * packet is allowed except in promisc modue when someone
+         * may be running packet capture.
+         */
+        if (!(brdev->flags & IFF_PROMISC) &&
+            !br_allowed_egress(br, br_get_vlan_info(br), skb)) {
+                kfree_skb(skb);
+                return NET_RX_DROP;
+        }
+
+        skb = br_handle_vlan(br, br_get_vlan_info(br), skb);
+        if (!skb)
+                return NET_RX_DROP;
+
         indev = skb->dev;
         skb->dev = brdev;
 
@@ -50,13 +65,17 @@ int br_handle_frame_finish(struct sk_buff *skb)
         struct net_bridge_fdb_entry *dst;
         struct net_bridge_mdb_entry *mdst;
         struct sk_buff *skb2;
+        u16 vid = 0;
 
         if (!p || p->state == BR_STATE_DISABLED)
                 goto drop;
 
+        if (!br_allowed_ingress(p->br, nbp_get_vlan_info(p), skb, &vid))
+                goto drop;
+
         /* insert into forwarding database after filtering to avoid spoofing */
         br = p->br;
-        br_fdb_update(br, p, eth_hdr(skb)->h_source);
+        br_fdb_update(br, p, eth_hdr(skb)->h_source, vid);
 
         if (!is_broadcast_ether_addr(dest) && is_multicast_ether_addr(dest) &&
             br_multicast_rcv(br, p, skb))
@@ -91,7 +110,8 @@ int br_handle_frame_finish(struct sk_buff *skb)
                         skb2 = skb;
 
                 br->dev->stats.multicast++;
-        } else if ((dst = __br_fdb_get(br, dest)) && dst->is_local) {
+        } else if ((dst = __br_fdb_get(br, dest, vid)) &&
+                        dst->is_local) {
                 skb2 = skb;
                 /* Do not forward the packet since it's local. */
                 skb = NULL;
@@ -119,8 +139,10 @@ drop:
 static int br_handle_local_finish(struct sk_buff *skb)
 {
         struct net_bridge_port *p = br_port_get_rcu(skb->dev);
+        u16 vid = 0;
 
-        br_fdb_update(p->br, p, eth_hdr(skb)->h_source);
+        br_vlan_get_tag(skb, &vid);
+        br_fdb_update(p->br, p, eth_hdr(skb)->h_source, vid);
         return 0;        /* process further */
 }
 
diff --git a/net/bridge/br_multicast.c b/net/bridge/br_multicast.c
index 6d6f26531de2..7d886b0a8b7b 100644
--- a/net/bridge/br_multicast.c
+++ b/net/bridge/br_multicast.c
@@ -39,6 +39,8 @@ static inline int br_ip_equal(const struct br_ip *a, const struct br_ip *b)
 {
         if (a->proto != b->proto)
                 return 0;
+        if (a->vid != b->vid)
+                return 0;
         switch (a->proto) {
         case htons(ETH_P_IP):
                 return a->u.ip4 == b->u.ip4;
@@ -50,16 +52,19 @@ static inline int br_ip_equal(const struct br_ip *a, const struct br_ip *b)
         return 0;
 }
 
-static inline int __br_ip4_hash(struct net_bridge_mdb_htable *mdb, __be32 ip)
+static inline int __br_ip4_hash(struct net_bridge_mdb_htable *mdb, __be32 ip,
+                                __u16 vid)
 {
-        return jhash_1word(mdb->secret, (__force u32)ip) & (mdb->max - 1);
+        return jhash_2words((__force u32)ip, vid, mdb->secret) & (mdb->max - 1);
 }
 
 #if IS_ENABLED(CONFIG_IPV6)
 static inline int __br_ip6_hash(struct net_bridge_mdb_htable *mdb,
-                                const struct in6_addr *ip)
+                                const struct in6_addr *ip,
+                                __u16 vid)
 {
-        return jhash2((__force u32 *)ip->s6_addr32, 4, mdb->secret) & (mdb->max - 1);
+        return jhash_2words(ipv6_addr_hash(ip), vid,
+                            mdb->secret) & (mdb->max - 1);
 }
 #endif
 
@@ -68,10 +73,10 @@ static inline int br_ip_hash(struct net_bridge_mdb_htable *mdb,
 {
         switch (ip->proto) {
         case htons(ETH_P_IP):
-                return __br_ip4_hash(mdb, ip->u.ip4);
+                return __br_ip4_hash(mdb, ip->u.ip4, ip->vid);
 #if IS_ENABLED(CONFIG_IPV6)
         case htons(ETH_P_IPV6):
-                return __br_ip6_hash(mdb, &ip->u.ip6);
+                return __br_ip6_hash(mdb, &ip->u.ip6, ip->vid);
 #endif
         }
         return 0;
@@ -101,24 +106,27 @@ struct net_bridge_mdb_entry *br_mdb_ip_get(struct net_bridge_mdb_htable *mdb,
 }
 
 static struct net_bridge_mdb_entry *br_mdb_ip4_get(
-        struct net_bridge_mdb_htable *mdb, __be32 dst)
+        struct net_bridge_mdb_htable *mdb, __be32 dst, __u16 vid)
 {
         struct br_ip br_dst;
 
         br_dst.u.ip4 = dst;
         br_dst.proto = htons(ETH_P_IP);
+        br_dst.vid = vid;
 
         return br_mdb_ip_get(mdb, &br_dst);
 }
 
 #if IS_ENABLED(CONFIG_IPV6)
 static struct net_bridge_mdb_entry *br_mdb_ip6_get(
-        struct net_bridge_mdb_htable *mdb, const struct in6_addr *dst)
+        struct net_bridge_mdb_htable *mdb, const struct in6_addr *dst,
+        __u16 vid)
 {
         struct br_ip br_dst;
 
         br_dst.u.ip6 = *dst;
         br_dst.proto = htons(ETH_P_IPV6);
+        br_dst.vid = vid;
 
         return br_mdb_ip_get(mdb, &br_dst);
 }
@@ -694,7 +702,8 @@ err:
 
 static int br_ip4_multicast_add_group(struct net_bridge *br,
                                       struct net_bridge_port *port,
-                                      __be32 group)
+                                      __be32 group,
+                                      __u16 vid)
 {
         struct br_ip br_group;
 
@@ -703,6 +712,7 @@ static int br_ip4_multicast_add_group(struct net_bridge *br,
 
         br_group.u.ip4 = group;
         br_group.proto = htons(ETH_P_IP);
+        br_group.vid = vid;
 
         return br_multicast_add_group(br, port, &br_group);
 }
@@ -710,7 +720,8 @@ static int br_ip4_multicast_add_group(struct net_bridge *br,
 #if IS_ENABLED(CONFIG_IPV6)
 static int br_ip6_multicast_add_group(struct net_bridge *br,
                                       struct net_bridge_port *port,
-                                      const struct in6_addr *group)
+                                      const struct in6_addr *group,
+                                      __u16 vid)
 {
         struct br_ip br_group;
 
@@ -719,6 +730,7 @@ static int br_ip6_multicast_add_group(struct net_bridge *br,
 
         br_group.u.ip6 = *group;
         br_group.proto = htons(ETH_P_IPV6);
+        br_group.vid = vid;
 
         return br_multicast_add_group(br, port, &br_group);
 }
@@ -895,10 +907,12 @@ static int br_ip4_multicast_igmp3_report(struct net_bridge *br,
         int type;
         int err = 0;
         __be32 group;
+        u16 vid = 0;
 
         if (!pskb_may_pull(skb, sizeof(*ih)))
                 return -EINVAL;
 
+        br_vlan_get_tag(skb, &vid);
         ih = igmpv3_report_hdr(skb);
         num = ntohs(ih->ngrec);
         len = sizeof(*ih);
@@ -930,7 +944,7 @@ static int br_ip4_multicast_igmp3_report(struct net_bridge *br,
                         continue;
                 }
 
-                err = br_ip4_multicast_add_group(br, port, group);
+                err = br_ip4_multicast_add_group(br, port, group, vid);
                 if (err)
                         break;
         }
@@ -949,10 +963,12 @@ static int br_ip6_multicast_mld2_report(struct net_bridge *br,
         int len;
         int num;
         int err = 0;
+        u16 vid = 0;
 
         if (!pskb_may_pull(skb, sizeof(*icmp6h)))
                 return -EINVAL;
 
+        br_vlan_get_tag(skb, &vid);
         icmp6h = icmp6_hdr(skb);
         num = ntohs(icmp6h->icmp6_dataun.un_data16[1]);
         len = sizeof(*icmp6h);
@@ -990,7 +1006,8 @@ static int br_ip6_multicast_mld2_report(struct net_bridge *br,
                         continue;
                 }
 
-                err = br_ip6_multicast_add_group(br, port, &grec->grec_mca);
+                err = br_ip6_multicast_add_group(br, port, &grec->grec_mca,
+                                                 vid);
                 if (!err)
                         break;
         }
@@ -1074,6 +1091,7 @@ static int br_ip4_multicast_query(struct net_bridge *br,
         unsigned long now = jiffies;
         __be32 group;
         int err = 0;
+        u16 vid = 0;
 
         spin_lock(&br->multicast_lock);
         if (!netif_running(br->dev) ||
@@ -1108,7 +1126,8 @@ static int br_ip4_multicast_query(struct net_bridge *br,
         if (!group)
                 goto out;
 
-        mp = br_mdb_ip4_get(mlock_dereference(br->mdb, br), group);
+        br_vlan_get_tag(skb, &vid);
+        mp = br_mdb_ip4_get(mlock_dereference(br->mdb, br), group, vid);
         if (!mp)
                 goto out;
 
@@ -1149,6 +1168,7 @@ static int br_ip6_multicast_query(struct net_bridge *br,
         unsigned long now = jiffies;
         const struct in6_addr *group = NULL;
         int err = 0;
+        u16 vid = 0;
 
         spin_lock(&br->multicast_lock);
         if (!netif_running(br->dev) ||
@@ -1180,7 +1200,8 @@ static int br_ip6_multicast_query(struct net_bridge *br,
         if (!group)
                 goto out;
 
-        mp = br_mdb_ip6_get(mlock_dereference(br->mdb, br), group);
+        br_vlan_get_tag(skb, &vid);
+        mp = br_mdb_ip6_get(mlock_dereference(br->mdb, br), group, vid);
         if (!mp)
                 goto out;
 
@@ -1286,7 +1307,8 @@ out:
 
 static void br_ip4_multicast_leave_group(struct net_bridge *br,
                                          struct net_bridge_port *port,
-                                         __be32 group)
+                                         __be32 group,
+                                         __u16 vid)
 {
         struct br_ip br_group;
 
@@ -1295,6 +1317,7 @@ static void br_ip4_multicast_leave_group(struct net_bridge *br,
 
         br_group.u.ip4 = group;
         br_group.proto = htons(ETH_P_IP);
+        br_group.vid = vid;
 
         br_multicast_leave_group(br, port, &br_group);
 }
@@ -1302,7 +1325,8 @@ static void br_ip4_multicast_leave_group(struct net_bridge *br,
 #if IS_ENABLED(CONFIG_IPV6)
 static void br_ip6_multicast_leave_group(struct net_bridge *br,
                                          struct net_bridge_port *port,
-                                         const struct in6_addr *group)
+                                         const struct in6_addr *group,
+                                         __u16 vid)
 {
         struct br_ip br_group;
 
@@ -1311,6 +1335,7 @@ static void br_ip6_multicast_leave_group(struct net_bridge *br,
 
         br_group.u.ip6 = *group;
         br_group.proto = htons(ETH_P_IPV6);
+        br_group.vid = vid;
 
         br_multicast_leave_group(br, port, &br_group);
 }
@@ -1326,6 +1351,7 @@ static int br_multicast_ipv4_rcv(struct net_bridge *br,
         unsigned int len;
         unsigned int offset;
         int err;
+        u16 vid = 0;
 
         /* We treat OOM as packet loss for now. */
         if (!pskb_may_pull(skb, sizeof(*iph)))
@@ -1386,6 +1412,7 @@ static int br_multicast_ipv4_rcv(struct net_bridge *br,
 
         err = 0;
 
+        br_vlan_get_tag(skb2, &vid);
         BR_INPUT_SKB_CB(skb)->igmp = 1;
         ih = igmp_hdr(skb2);
 
@@ -1393,7 +1420,7 @@ static int br_multicast_ipv4_rcv(struct net_bridge *br,
         case IGMP_HOST_MEMBERSHIP_REPORT:
         case IGMPV2_HOST_MEMBERSHIP_REPORT:
                 BR_INPUT_SKB_CB(skb)->mrouters_only = 1;
-                err = br_ip4_multicast_add_group(br, port, ih->group);
+                err = br_ip4_multicast_add_group(br, port, ih->group, vid);
                 break;
         case IGMPV3_HOST_MEMBERSHIP_REPORT:
                 err = br_ip4_multicast_igmp3_report(br, port, skb2);
@@ -1402,7 +1429,7 @@ static int br_multicast_ipv4_rcv(struct net_bridge *br,
                 err = br_ip4_multicast_query(br, port, skb2);
                 break;
         case IGMP_HOST_LEAVE_MESSAGE:
-                br_ip4_multicast_leave_group(br, port, ih->group);
+                br_ip4_multicast_leave_group(br, port, ih->group, vid);
                 break;
         }
 
@@ -1427,6 +1454,7 @@ static int br_multicast_ipv6_rcv(struct net_bridge *br,
         unsigned int len;
         int offset;
         int err;
+        u16 vid = 0;
 
         if (!pskb_may_pull(skb, sizeof(*ip6h)))
                 return -EINVAL;
@@ -1510,6 +1538,7 @@ static int br_multicast_ipv6_rcv(struct net_bridge *br,
 
         err = 0;
 
+        br_vlan_get_tag(skb, &vid);
         BR_INPUT_SKB_CB(skb)->igmp = 1;
 
         switch (icmp6_type) {
@@ -1522,7 +1551,7 @@ static int br_multicast_ipv6_rcv(struct net_bridge *br,
                 }
                 mld = (struct mld_msg *)skb_transport_header(skb2);
                 BR_INPUT_SKB_CB(skb)->mrouters_only = 1;
-                err = br_ip6_multicast_add_group(br, port, &mld->mld_mca);
+                err = br_ip6_multicast_add_group(br, port, &mld->mld_mca, vid);
                 break;
             }
         case ICMPV6_MLD2_REPORT:
@@ -1539,7 +1568,7 @@ static int br_multicast_ipv6_rcv(struct net_bridge *br,
                         goto out;
                 }
                 mld = (struct mld_msg *)skb_transport_header(skb2);
-                br_ip6_multicast_leave_group(br, port, &mld->mld_mca);
+                br_ip6_multicast_leave_group(br, port, &mld->mld_mca, vid);
             }
         }
 
diff --git a/net/bridge/br_netlink.c b/net/bridge/br_netlink.c
index 39ca9796f3f7..27aa3ee517ce 100644
--- a/net/bridge/br_netlink.c
+++ b/net/bridge/br_netlink.c
@@ -16,6 +16,7 @@
 #include <net/rtnetlink.h>
 #include <net/net_namespace.h>
 #include <net/sock.h>
+#include <uapi/linux/if_bridge.h>
 
 #include "br_private.h"
 #include "br_private_stp.h"
@@ -64,15 +65,21 @@ static int br_port_fill_attrs(struct sk_buff *skb,
  * Create one netlink message for one interface
  * Contains port and master info as well as carrier and bridge state.
  */
-static int br_fill_ifinfo(struct sk_buff *skb, const struct net_bridge_port *port,
-                          u32 pid, u32 seq, int event, unsigned int flags)
+static int br_fill_ifinfo(struct sk_buff *skb,
+                          const struct net_bridge_port *port,
+                          u32 pid, u32 seq, int event, unsigned int flags,
+                          u32 filter_mask, const struct net_device *dev)
 {
-        const struct net_bridge *br = port->br;
-        const struct net_device *dev = port->dev;
+        const struct net_bridge *br;
         struct ifinfomsg *hdr;
         struct nlmsghdr *nlh;
         u8 operstate = netif_running(dev) ? dev->operstate : IF_OPER_DOWN;
 
+        if (port)
+                br = port->br;
+        else
+                br = netdev_priv(dev);
+
         br_debug(br, "br_fill_info event %d port %s master %s\n",
                      event, dev->name, br->dev->name);
 
@@ -98,7 +105,7 @@ static int br_fill_ifinfo(struct sk_buff *skb, const struct net_bridge_port *por
              nla_put_u32(skb, IFLA_LINK, dev->iflink)))
                 goto nla_put_failure;
 
-        if (event == RTM_NEWLINK) {
+        if (event == RTM_NEWLINK && port) {
                 struct nlattr *nest
                         = nla_nest_start(skb, IFLA_PROTINFO | NLA_F_NESTED);
 
@@ -107,6 +114,48 @@ static int br_fill_ifinfo(struct sk_buff *skb, const struct net_bridge_port *por
                 nla_nest_end(skb, nest);
         }
 
+        /* Check if  the VID information is requested */
+        if (filter_mask & RTEXT_FILTER_BRVLAN) {
+                struct nlattr *af;
+                const struct net_port_vlans *pv;
+                struct bridge_vlan_info vinfo;
+                u16 vid;
+                u16 pvid;
+
+                if (port)
+                        pv = nbp_get_vlan_info(port);
+                else
+                        pv = br_get_vlan_info(br);
+
+                if (!pv || bitmap_empty(pv->vlan_bitmap, BR_VLAN_BITMAP_LEN))
+                        goto done;
+
+                af = nla_nest_start(skb, IFLA_AF_SPEC);
+                if (!af)
+                        goto nla_put_failure;
+
+                pvid = br_get_pvid(pv);
+                for (vid = find_first_bit(pv->vlan_bitmap, BR_VLAN_BITMAP_LEN);
+                     vid < BR_VLAN_BITMAP_LEN;
+                     vid = find_next_bit(pv->vlan_bitmap,
+                                         BR_VLAN_BITMAP_LEN, vid+1)) {
+                        vinfo.vid = vid;
+                        vinfo.flags = 0;
+                        if (vid == pvid)
+                                vinfo.flags |= BRIDGE_VLAN_INFO_PVID;
+
+                        if (test_bit(vid, pv->untagged_bitmap))
+                                vinfo.flags |= BRIDGE_VLAN_INFO_UNTAGGED;
+
+                        if (nla_put(skb, IFLA_BRIDGE_VLAN_INFO,
+                                    sizeof(vinfo), &vinfo))
+                                goto nla_put_failure;
+                }
+
+                nla_nest_end(skb, af);
+        }
+
+done:
         return nlmsg_end(skb, nlh);
 
 nla_put_failure:
@@ -119,10 +168,14 @@ nla_put_failure:
  */
 void br_ifinfo_notify(int event, struct net_bridge_port *port)
 {
-        struct net *net = dev_net(port->dev);
+        struct net *net;
         struct sk_buff *skb;
         int err = -ENOBUFS;
 
+        if (!port)
+                return;
+
+        net = dev_net(port->dev);
         br_debug(port->br, "port %u(%s) event %d\n",
                  (unsigned int)port->port_no, port->dev->name, event);
 
@@ -130,7 +183,7 @@ void br_ifinfo_notify(int event, struct net_bridge_port *port)
         if (skb == NULL)
                 goto errout;
 
-        err = br_fill_ifinfo(skb, port, 0, 0, event, 0);
+        err = br_fill_ifinfo(skb, port, 0, 0, event, 0, 0, port->dev);
         if (err < 0) {
                 /* -EMSGSIZE implies BUG in br_nlmsg_size() */
                 WARN_ON(err == -EMSGSIZE);
@@ -144,24 +197,85 @@ errout:
                 rtnl_set_sk_err(net, RTNLGRP_LINK, err);
 }
 
+
 /*
  * Dump information about all ports, in response to GETLINK
  */
 int br_getlink(struct sk_buff *skb, u32 pid, u32 seq,
-               struct net_device *dev)
+               struct net_device *dev, u32 filter_mask)
 {
         int err = 0;
         struct net_bridge_port *port = br_port_get_rcu(dev);
 
-        /* not a bridge port */
-        if (!port)
+        /* not a bridge port and  */
+        if (!port && !(filter_mask & RTEXT_FILTER_BRVLAN))
                 goto out;
 
-        err = br_fill_ifinfo(skb, port, pid, seq, RTM_NEWLINK, NLM_F_MULTI);
+        err = br_fill_ifinfo(skb, port, pid, seq, RTM_NEWLINK, NLM_F_MULTI,
+                             filter_mask, dev);
 out:
         return err;
 }
 
+static const struct nla_policy ifla_br_policy[IFLA_MAX+1] = {
+        [IFLA_BRIDGE_FLAGS]     = { .type = NLA_U16 },
+        [IFLA_BRIDGE_MODE]      = { .type = NLA_U16 },
+        [IFLA_BRIDGE_VLAN_INFO] = { .type = NLA_BINARY,
+                                    .len = sizeof(struct bridge_vlan_info), },
+};
+
+static int br_afspec(struct net_bridge *br,
+                     struct net_bridge_port *p,
+                     struct nlattr *af_spec,
+                     int cmd)
+{
+        struct nlattr *tb[IFLA_BRIDGE_MAX+1];
+        int err = 0;
+
+        err = nla_parse_nested(tb, IFLA_BRIDGE_MAX, af_spec, ifla_br_policy);
+        if (err)
+                return err;
+
+        if (tb[IFLA_BRIDGE_VLAN_INFO]) {
+                struct bridge_vlan_info *vinfo;
+
+                vinfo = nla_data(tb[IFLA_BRIDGE_VLAN_INFO]);
+
+                if (vinfo->vid >= VLAN_N_VID)
+                        return -EINVAL;
+
+                switch (cmd) {
+                case RTM_SETLINK:
+                        if (p) {
+                                err = nbp_vlan_add(p, vinfo->vid, vinfo->flags);
+                                if (err)
+                                        break;
+
+                                if (vinfo->flags & BRIDGE_VLAN_INFO_MASTER)
+                                        err = br_vlan_add(p->br, vinfo->vid,
+                                                          vinfo->flags);
+                        } else
+                                err = br_vlan_add(br, vinfo->vid, vinfo->flags);
+
+                        if (err)
+                                break;
+
+                        break;
+
+                case RTM_DELLINK:
+                        if (p) {
+                                nbp_vlan_delete(p, vinfo->vid);
+                                if (vinfo->flags & BRIDGE_VLAN_INFO_MASTER)
+                                        br_vlan_delete(p->br, vinfo->vid);
+                        } else
+                                br_vlan_delete(br, vinfo->vid);
+                        break;
+                }
+        }
+
+        return err;
+}
+
 static const struct nla_policy ifla_brport_policy[IFLA_BRPORT_MAX + 1] = {
         [IFLA_BRPORT_STATE]     = { .type = NLA_U8 },
         [IFLA_BRPORT_COST]      = { .type = NLA_U32 },
@@ -241,6 +355,7 @@ int br_setlink(struct net_device *dev, struct nlmsghdr *nlh)
 {
         struct ifinfomsg *ifm;
         struct nlattr *protinfo;
+        struct nlattr *afspec;
         struct net_bridge_port *p;
         struct nlattr *tb[IFLA_BRPORT_MAX + 1];
         int err;
@@ -248,38 +363,76 @@ int br_setlink(struct net_device *dev, struct nlmsghdr *nlh)
         ifm = nlmsg_data(nlh);
 
         protinfo = nlmsg_find_attr(nlh, sizeof(*ifm), IFLA_PROTINFO);
-        if (!protinfo)
+        afspec = nlmsg_find_attr(nlh, sizeof(*ifm), IFLA_AF_SPEC);
+        if (!protinfo && !afspec)
                 return 0;
 
         p = br_port_get_rtnl(dev);
-        if (!p)
+        /* We want to accept dev as bridge itself if the AF_SPEC
+         * is set to see if someone is setting vlan info on the brigde
+         */
+        if (!p && ((dev->priv_flags & IFF_EBRIDGE) && !afspec))
                 return -EINVAL;
 
-        if (protinfo->nla_type & NLA_F_NESTED) {
-                err = nla_parse_nested(tb, IFLA_BRPORT_MAX,
-                                       protinfo, ifla_brport_policy);
+        if (p && protinfo) {
+                if (protinfo->nla_type & NLA_F_NESTED) {
+                        err = nla_parse_nested(tb, IFLA_BRPORT_MAX,
+                                               protinfo, ifla_brport_policy);
+                        if (err)
+                                return err;
+
+                        spin_lock_bh(&p->br->lock);
+                        err = br_setport(p, tb);
+                        spin_unlock_bh(&p->br->lock);
+                } else {
+                        /* Binary compatability with old RSTP */
+                        if (nla_len(protinfo) < sizeof(u8))
+                                return -EINVAL;
+
+                        spin_lock_bh(&p->br->lock);
+                        err = br_set_port_state(p, nla_get_u8(protinfo));
+                        spin_unlock_bh(&p->br->lock);
+                }
                 if (err)
-                        return err;
-
-                spin_lock_bh(&p->br->lock);
-                err = br_setport(p, tb);
-                spin_unlock_bh(&p->br->lock);
-        } else {
-                /* Binary compatability with old RSTP */
-                if (nla_len(protinfo) < sizeof(u8))
-                        return -EINVAL;
+                        goto out;
+        }
 
-                spin_lock_bh(&p->br->lock);
-                err = br_set_port_state(p, nla_get_u8(protinfo));
-                spin_unlock_bh(&p->br->lock);
+        if (afspec) {
+                err = br_afspec((struct net_bridge *)netdev_priv(dev), p,
+                                afspec, RTM_SETLINK);
         }
 
         if (err == 0)
                 br_ifinfo_notify(RTM_NEWLINK, p);
 
+out:
         return err;
 }
 
+/* Delete port information */
+int br_dellink(struct net_device *dev, struct nlmsghdr *nlh)
+{
+        struct ifinfomsg *ifm;
+        struct nlattr *afspec;
+        struct net_bridge_port *p;
+        int err;
+
+        ifm = nlmsg_data(nlh);
+
+        afspec = nlmsg_find_attr(nlh, sizeof(*ifm), IFLA_AF_SPEC);
+        if (!afspec)
+                return 0;
+
+        p = br_port_get_rtnl(dev);
+        /* We want to accept dev as bridge itself as well */
+        if (!p && !(dev->priv_flags & IFF_EBRIDGE))
+                return -EINVAL;
+
+        err = br_afspec((struct net_bridge *)netdev_priv(dev), p,
+                        afspec, RTM_DELLINK);
+
+        return err;
+}
 static int br_validate(struct nlattr *tb[], struct nlattr *data[])
 {
         if (tb[IFLA_ADDRESS]) {
@@ -292,6 +445,29 @@ static int br_validate(struct nlattr *tb[], struct nlattr *data[])
         return 0;
 }
 
+static size_t br_get_link_af_size(const struct net_device *dev)
+{
+        struct net_port_vlans *pv;
+
+        if (br_port_exists(dev))
+                pv = nbp_get_vlan_info(br_port_get_rcu(dev));
+        else if (dev->priv_flags & IFF_EBRIDGE)
+                pv = br_get_vlan_info((struct net_bridge *)netdev_priv(dev));
+        else
+                return 0;
+
+        if (!pv)
+                return 0;
+
+        /* Each VLAN is returned in bridge_vlan_info along with flags */
+        return pv->num_vlans * nla_total_size(sizeof(struct bridge_vlan_info));
+}
+
+static struct rtnl_af_ops br_af_ops = {
+        .family                 = AF_BRIDGE,
+        .get_link_af_size       = br_get_link_af_size,
+};
+
 struct rtnl_link_ops br_link_ops __read_mostly = {
         .kind           = "bridge",
         .priv_size      = sizeof(struct net_bridge),
@@ -305,11 +481,18 @@ int __init br_netlink_init(void)
         int err;
 
         br_mdb_init();
-        err = rtnl_link_register(&br_link_ops);
+        err = rtnl_af_register(&br_af_ops);
         if (err)
                 goto out;
 
+        err = rtnl_link_register(&br_link_ops);
+        if (err)
+                goto out_af;
+
         return 0;
+
+out_af:
+        rtnl_af_unregister(&br_af_ops);
 out:
         br_mdb_uninit();
         return err;
@@ -318,5 +501,6 @@ out:
 void __exit br_netlink_fini(void)
 {
         br_mdb_uninit();
+        rtnl_af_unregister(&br_af_ops);
         rtnl_link_unregister(&br_link_ops);
 }
diff --git a/net/bridge/br_private.h b/net/bridge/br_private.h
index 711094aed41a..6d314c4e6bcb 100644
--- a/net/bridge/br_private.h
+++ b/net/bridge/br_private.h
@@ -18,6 +18,7 @@
 #include <linux/netpoll.h>
 #include <linux/u64_stats_sync.h>
 #include <net/route.h>
+#include <linux/if_vlan.h>
 
 #define BR_HASH_BITS 8
 #define BR_HASH_SIZE (1 << BR_HASH_BITS)
@@ -26,6 +27,7 @@
 
 #define BR_PORT_BITS    10
 #define BR_MAX_PORTS    (1<<BR_PORT_BITS)
+#define BR_VLAN_BITMAP_LEN      BITS_TO_LONGS(VLAN_N_VID)
 
 #define BR_VERSION      "2.3"
 
@@ -61,6 +63,20 @@ struct br_ip
 #endif
         } u;
         __be16          proto;
+        __u16           vid;
+};
+
+struct net_port_vlans {
+        u16                             port_idx;
+        u16                             pvid;
+        union {
+                struct net_bridge_port          *port;
+                struct net_bridge               *br;
+        }                               parent;
+        struct rcu_head                 rcu;
+        unsigned long                   vlan_bitmap[BR_VLAN_BITMAP_LEN];
+        unsigned long                   untagged_bitmap[BR_VLAN_BITMAP_LEN];
+        u16                             num_vlans;
 };
 
 struct net_bridge_fdb_entry
@@ -74,6 +90,7 @@ struct net_bridge_fdb_entry
         mac_addr                        addr;
         unsigned char                   is_local;
         unsigned char                   is_static;
+        __u16                           vlan_id;
 };
 
 struct net_bridge_port_group {
@@ -156,6 +173,9 @@ struct net_bridge_port
 #ifdef CONFIG_NET_POLL_CONTROLLER
         struct netpoll                  *np;
 #endif
+#ifdef CONFIG_BRIDGE_VLAN_FILTERING
+        struct net_port_vlans __rcu     *vlan_info;
+#endif
 };
 
 #define br_port_exists(dev) (dev->priv_flags & IFF_BRIDGE_PORT)
@@ -197,9 +217,6 @@ struct net_bridge
         bool                            nf_call_ip6tables;
         bool                            nf_call_arptables;
 #endif
-        unsigned long                   flags;
-#define BR_SET_MAC_ADDR         0x00000001
-
         u16                             group_fwd_mask;
 
         /* STP */
@@ -260,6 +277,10 @@ struct net_bridge
         struct timer_list               topology_change_timer;
         struct timer_list               gc_timer;
         struct kobject                  *ifobj;
+#ifdef CONFIG_BRIDGE_VLAN_FILTERING
+        u8                              vlan_enabled;
+        struct net_port_vlans __rcu     *vlan_info;
+#endif
 };
 
 struct br_input_skb_cb {
@@ -355,18 +376,22 @@ extern void br_fdb_cleanup(unsigned long arg);
 extern void br_fdb_delete_by_port(struct net_bridge *br,
                                   const struct net_bridge_port *p, int do_all);
 extern struct net_bridge_fdb_entry *__br_fdb_get(struct net_bridge *br,
-                                                 const unsigned char *addr);
+                                                 const unsigned char *addr,
+                                                 __u16 vid);
 extern int br_fdb_test_addr(struct net_device *dev, unsigned char *addr);
 extern int br_fdb_fillbuf(struct net_bridge *br, void *buf,
                           unsigned long count, unsigned long off);
 extern int br_fdb_insert(struct net_bridge *br,
                          struct net_bridge_port *source,
-                         const unsigned char *addr);
+                         const unsigned char *addr,
+                         u16 vid);
 extern void br_fdb_update(struct net_bridge *br,
                           struct net_bridge_port *source,
-                          const unsigned char *addr);
+                          const unsigned char *addr,
+                          u16 vid);
+extern int fdb_delete_by_addr(struct net_bridge *br, const u8 *addr, u16 vid);
 
-extern int br_fdb_delete(struct ndmsg *ndm,
+extern int br_fdb_delete(struct ndmsg *ndm, struct nlattr *tb[],
                          struct net_device *dev,
                          const unsigned char *addr);
 extern int br_fdb_add(struct ndmsg *nlh, struct nlattr *tb[],
@@ -534,6 +559,142 @@ static inline void br_mdb_uninit(void)
 }
 #endif
 
+/* br_vlan.c */
+#ifdef CONFIG_BRIDGE_VLAN_FILTERING
+extern bool br_allowed_ingress(struct net_bridge *br, struct net_port_vlans *v,
+                               struct sk_buff *skb, u16 *vid);
+extern bool br_allowed_egress(struct net_bridge *br,
+                              const struct net_port_vlans *v,
+                              const struct sk_buff *skb);
+extern struct sk_buff *br_handle_vlan(struct net_bridge *br,
+                                      const struct net_port_vlans *v,
+                                      struct sk_buff *skb);
+extern int br_vlan_add(struct net_bridge *br, u16 vid, u16 flags);
+extern int br_vlan_delete(struct net_bridge *br, u16 vid);
+extern void br_vlan_flush(struct net_bridge *br);
+extern int br_vlan_filter_toggle(struct net_bridge *br, unsigned long val);
+extern int nbp_vlan_add(struct net_bridge_port *port, u16 vid, u16 flags);
+extern int nbp_vlan_delete(struct net_bridge_port *port, u16 vid);
+extern void nbp_vlan_flush(struct net_bridge_port *port);
+extern bool nbp_vlan_find(struct net_bridge_port *port, u16 vid);
+
+static inline struct net_port_vlans *br_get_vlan_info(
+                                                const struct net_bridge *br)
+{
+        return rcu_dereference_rtnl(br->vlan_info);
+}
+
+static inline struct net_port_vlans *nbp_get_vlan_info(
+                                                const struct net_bridge_port *p)
+{
+        return rcu_dereference_rtnl(p->vlan_info);
+}
+
+/* Since bridge now depends on 8021Q module, but the time bridge sees the
+ * skb, the vlan tag will always be present if the frame was tagged.
+ */
+static inline int br_vlan_get_tag(const struct sk_buff *skb, u16 *vid)
+{
+        int err = 0;
+
+        if (vlan_tx_tag_present(skb))
+                *vid = vlan_tx_tag_get(skb) & VLAN_VID_MASK;
+        else {
+                *vid = 0;
+                err = -EINVAL;
+        }
+
+        return err;
+}
+
+static inline u16 br_get_pvid(const struct net_port_vlans *v)
+{
+        /* Return just the VID if it is set, or VLAN_N_VID (invalid vid) if
+         * vid wasn't set
+         */
+        smp_rmb();
+        return (v->pvid & VLAN_TAG_PRESENT) ?
+                        (v->pvid & ~VLAN_TAG_PRESENT) :
+                        VLAN_N_VID;
+}
+
+#else
+static inline bool br_allowed_ingress(struct net_bridge *br,
+                                      struct net_port_vlans *v,
+                                      struct sk_buff *skb,
+                                      u16 *vid)
+{
+        return true;
+}
+
+static inline bool br_allowed_egress(struct net_bridge *br,
+                                     const struct net_port_vlans *v,
+                                     const struct sk_buff *skb)
+{
+        return true;
+}
+
+static inline struct sk_buff *br_handle_vlan(struct net_bridge *br,
+                                             const struct net_port_vlans *v,
+                                             struct sk_buff *skb)
+{
+        return skb;
+}
+
+static inline int br_vlan_add(struct net_bridge *br, u16 vid, u16 flags)
+{
+        return -EOPNOTSUPP;
+}
+
+static inline int br_vlan_delete(struct net_bridge *br, u16 vid)
+{
+        return -EOPNOTSUPP;
+}
+
+static inline void br_vlan_flush(struct net_bridge *br)
+{
+}
+
+static inline int nbp_vlan_add(struct net_bridge_port *port, u16 vid, u16 flags)
+{
+        return -EOPNOTSUPP;
+}
+
+static inline int nbp_vlan_delete(struct net_bridge_port *port, u16 vid)
+{
+        return -EOPNOTSUPP;
+}
+
+static inline void nbp_vlan_flush(struct net_bridge_port *port)
+{
+}
+
+static inline struct net_port_vlans *br_get_vlan_info(
+                                                const struct net_bridge *br)
+{
+        return NULL;
+}
+static inline struct net_port_vlans *nbp_get_vlan_info(
+                                                const struct net_bridge_port *p)
+{
+        return NULL;
+}
+
+static inline bool nbp_vlan_find(struct net_bridge_port *port, u16 vid)
+{
+        return false;
+}
+
+static inline u16 br_vlan_get_tag(const struct sk_buff *skb, u16 *tag)
+{
+        return 0;
+}
+static inline u16 br_get_pvid(const struct net_port_vlans *v)
+{
+        return VLAN_N_VID;      /* Returns invalid vid */
+}
+#endif
+
 /* br_netfilter.c */
 #ifdef CONFIG_BRIDGE_NETFILTER
 extern int br_netfilter_init(void);
@@ -594,8 +755,9 @@ extern int br_netlink_init(void);
 extern void br_netlink_fini(void);
 extern void br_ifinfo_notify(int event, struct net_bridge_port *port);
 extern int br_setlink(struct net_device *dev, struct nlmsghdr *nlmsg);
+extern int br_dellink(struct net_device *dev, struct nlmsghdr *nlmsg);
 extern int br_getlink(struct sk_buff *skb, u32 pid, u32 seq,
-                      struct net_device *dev);
+                      struct net_device *dev, u32 filter_mask);
 
 #ifdef CONFIG_SYSFS
 /* br_sysfs_if.c */
diff --git a/net/bridge/br_stp_bpdu.c b/net/bridge/br_stp_bpdu.c
index 7f884e3fb955..8660ea3be705 100644
--- a/net/bridge/br_stp_bpdu.c
+++ b/net/bridge/br_stp_bpdu.c
@@ -16,6 +16,7 @@
 #include <linux/etherdevice.h>
 #include <linux/llc.h>
 #include <linux/slab.h>
+#include <linux/pkt_sched.h>
 #include <net/net_namespace.h>
 #include <net/llc.h>
 #include <net/llc_pdu.h>
@@ -40,6 +41,7 @@ static void br_send_bpdu(struct net_bridge_port *p,
 
         skb->dev = p->dev;
         skb->protocol = htons(ETH_P_802_2);
+        skb->priority = TC_PRIO_CONTROL;
 
         skb_reserve(skb, LLC_RESERVE);
         memcpy(__skb_put(skb, length), data, length);
diff --git a/net/bridge/br_stp_if.c b/net/bridge/br_stp_if.c
index 7b5197c7de13..0bdb4ebd362b 100644
--- a/net/bridge/br_stp_if.c
+++ b/net/bridge/br_stp_if.c
@@ -216,7 +216,7 @@ bool br_stp_recalculate_bridge_id(struct net_bridge *br)
         struct net_bridge_port *p;
 
         /* user has chosen a value so keep it */
-        if (br->flags & BR_SET_MAC_ADDR)
+        if (br->dev->addr_assign_type == NET_ADDR_SET)
                 return false;
 
         list_for_each_entry(p, &br->port_list, list) {
diff --git a/net/bridge/br_sysfs_br.c b/net/bridge/br_sysfs_br.c
index 5913a3a0047b..8baa9c08e1a4 100644
--- a/net/bridge/br_sysfs_br.c
+++ b/net/bridge/br_sysfs_br.c
@@ -691,6 +691,24 @@ static ssize_t store_nf_call_arptables(
 static DEVICE_ATTR(nf_call_arptables, S_IRUGO | S_IWUSR,
                    show_nf_call_arptables, store_nf_call_arptables);
 #endif
+#ifdef CONFIG_BRIDGE_VLAN_FILTERING
+static ssize_t show_vlan_filtering(struct device *d,
+                                   struct device_attribute *attr,
+                                   char *buf)
+{
+        struct net_bridge *br = to_bridge(d);
+        return sprintf(buf, "%d\n", br->vlan_enabled);
+}
+
+static ssize_t store_vlan_filtering(struct device *d,
+                                    struct device_attribute *attr,
+                                    const char *buf, size_t len)
+{
+        return store_bridge_parm(d, buf, len, br_vlan_filter_toggle);
+}
+static DEVICE_ATTR(vlan_filtering, S_IRUGO | S_IWUSR,
+                   show_vlan_filtering, store_vlan_filtering);
+#endif
 
 static struct attribute *bridge_attrs[] = {
         &dev_attr_forward_delay.attr,
@@ -732,6 +750,9 @@ static struct attribute *bridge_attrs[] = {
         &dev_attr_nf_call_ip6tables.attr,
         &dev_attr_nf_call_arptables.attr,
 #endif
+#ifdef CONFIG_BRIDGE_VLAN_FILTERING
+        &dev_attr_vlan_filtering.attr,
+#endif
         NULL
 };
 
diff --git a/net/bridge/br_vlan.c b/net/bridge/br_vlan.c
new file mode 100644
index 000000000000..93dde75923f0
--- /dev/null
+++ b/net/bridge/br_vlan.c
@@ -0,0 +1,415 @@
+#include <linux/kernel.h>
+#include <linux/netdevice.h>
+#include <linux/rtnetlink.h>
+#include <linux/slab.h>
+
+#include "br_private.h"
+
+static void __vlan_add_pvid(struct net_port_vlans *v, u16 vid)
+{
+        if (v->pvid == vid)
+                return;
+
+        smp_wmb();
+        v->pvid = vid;
+}
+
+static void __vlan_delete_pvid(struct net_port_vlans *v, u16 vid)
+{
+        if (v->pvid != vid)
+                return;
+
+        smp_wmb();
+        v->pvid = 0;
+}
+
+static void __vlan_add_flags(struct net_port_vlans *v, u16 vid, u16 flags)
+{
+        if (flags & BRIDGE_VLAN_INFO_PVID)
+                __vlan_add_pvid(v, vid);
+
+        if (flags & BRIDGE_VLAN_INFO_UNTAGGED)
+                set_bit(vid, v->untagged_bitmap);
+}
+
+static int __vlan_add(struct net_port_vlans *v, u16 vid, u16 flags)
+{
+        struct net_bridge_port *p = NULL;
+        struct net_bridge *br;
+        struct net_device *dev;
+        int err;
+
+        if (test_bit(vid, v->vlan_bitmap)) {
+                __vlan_add_flags(v, vid, flags);
+                return 0;
+        }
+
+        if (vid) {
+                if (v->port_idx) {
+                        p = v->parent.port;
+                        br = p->br;
+                        dev = p->dev;
+                } else {
+                        br = v->parent.br;
+                        dev = br->dev;
+                }
+
+                if (p && (dev->features & NETIF_F_HW_VLAN_FILTER)) {
+                        /* Add VLAN to the device filter if it is supported.
+                         * Stricly speaking, this is not necessary now, since
+                         * devices are made promiscuous by the bridge, but if
+                         * that ever changes this code will allow tagged
+                         * traffic to enter the bridge.
+                         */
+                        err = dev->netdev_ops->ndo_vlan_rx_add_vid(dev, vid);
+                        if (err)
+                                return err;
+                }
+
+                err = br_fdb_insert(br, p, dev->dev_addr, vid);
+                if (err) {
+                        br_err(br, "failed insert local address into bridge "
+                               "forwarding table\n");
+                        goto out_filt;
+                }
+
+        }
+
+        set_bit(vid, v->vlan_bitmap);
+        v->num_vlans++;
+        __vlan_add_flags(v, vid, flags);
+
+        return 0;
+
+out_filt:
+        if (p && (dev->features & NETIF_F_HW_VLAN_FILTER))
+                dev->netdev_ops->ndo_vlan_rx_kill_vid(dev, vid);
+        return err;
+}
+
+static int __vlan_del(struct net_port_vlans *v, u16 vid)
+{
+        if (!test_bit(vid, v->vlan_bitmap))
+                return -EINVAL;
+
+        __vlan_delete_pvid(v, vid);
+        clear_bit(vid, v->untagged_bitmap);
+
+        if (v->port_idx && vid) {
+                struct net_device *dev = v->parent.port->dev;
+
+                if (dev->features & NETIF_F_HW_VLAN_FILTER)
+                        dev->netdev_ops->ndo_vlan_rx_kill_vid(dev, vid);
+        }
+
+        clear_bit(vid, v->vlan_bitmap);
+        v->num_vlans--;
+        if (bitmap_empty(v->vlan_bitmap, BR_VLAN_BITMAP_LEN)) {
+                if (v->port_idx)
+                        rcu_assign_pointer(v->parent.port->vlan_info, NULL);
+                else
+                        rcu_assign_pointer(v->parent.br->vlan_info, NULL);
+                kfree_rcu(v, rcu);
+        }
+        return 0;
+}
+
+static void __vlan_flush(struct net_port_vlans *v)
+{
+        smp_wmb();
+        v->pvid = 0;
+        bitmap_zero(v->vlan_bitmap, BR_VLAN_BITMAP_LEN);
+        if (v->port_idx)
+                rcu_assign_pointer(v->parent.port->vlan_info, NULL);
+        else
+                rcu_assign_pointer(v->parent.br->vlan_info, NULL);
+        kfree_rcu(v, rcu);
+}
+
+/* Strip the tag from the packet.  Will return skb with tci set 0.  */
+static struct sk_buff *br_vlan_untag(struct sk_buff *skb)
+{
+        if (skb->protocol != htons(ETH_P_8021Q)) {
+                skb->vlan_tci = 0;
+                return skb;
+        }
+
+        skb->vlan_tci = 0;
+        skb = vlan_untag(skb);
+        if (skb)
+                skb->vlan_tci = 0;
+
+        return skb;
+}
+
+struct sk_buff *br_handle_vlan(struct net_bridge *br,
+                               const struct net_port_vlans *pv,
+                               struct sk_buff *skb)
+{
+        u16 vid;
+
+        if (!br->vlan_enabled)
+                goto out;
+
+        /* At this point, we know that the frame was filtered and contains
+         * a valid vlan id.  If the vlan id is set in the untagged bitmap,
+         * send untagged; otherwise, send taged.
+         */
+        br_vlan_get_tag(skb, &vid);
+        if (test_bit(vid, pv->untagged_bitmap))
+                skb = br_vlan_untag(skb);
+        else {
+                /* Egress policy says "send tagged".  If output device
+                 * is the  bridge, we need to add the VLAN header
+                 * ourselves since we'll be going through the RX path.
+                 * Sending to ports puts the frame on the TX path and
+                 * we let dev_hard_start_xmit() add the header.
+                 */
+                if (skb->protocol != htons(ETH_P_8021Q) &&
+                    pv->port_idx == 0) {
+                        /* vlan_put_tag expects skb->data to point to
+                         * mac header.
+                         */
+                        skb_push(skb, ETH_HLEN);
+                        skb = __vlan_put_tag(skb, skb->vlan_tci);
+                        if (!skb)
+                                goto out;
+                        /* put skb->data back to where it was */
+                        skb_pull(skb, ETH_HLEN);
+                        skb->vlan_tci = 0;
+                }
+        }
+
+out:
+        return skb;
+}
+
+/* Called under RCU */
+bool br_allowed_ingress(struct net_bridge *br, struct net_port_vlans *v,
+                        struct sk_buff *skb, u16 *vid)
+{
+        /* If VLAN filtering is disabled on the bridge, all packets are
+         * permitted.
+         */
+        if (!br->vlan_enabled)
+                return true;
+
+        /* If there are no vlan in the permitted list, all packets are
+         * rejected.
+         */
+        if (!v)
+                return false;
+
+        if (br_vlan_get_tag(skb, vid)) {
+                u16 pvid = br_get_pvid(v);
+
+                /* Frame did not have a tag.  See if pvid is set
+                 * on this port.  That tells us which vlan untagged
+                 * traffic belongs to.
+                 */
+                if (pvid == VLAN_N_VID)
+                        return false;
+
+                /* PVID is set on this port.  Any untagged ingress
+                 * frame is considered to belong to this vlan.
+                 */
+                __vlan_hwaccel_put_tag(skb, pvid);
+                return true;
+        }
+
+        /* Frame had a valid vlan tag.  See if vlan is allowed */
+        if (test_bit(*vid, v->vlan_bitmap))
+                return true;
+
+        return false;
+}
+
+/* Called under RCU. */
+bool br_allowed_egress(struct net_bridge *br,
+                       const struct net_port_vlans *v,
+                       const struct sk_buff *skb)
+{
+        u16 vid;
+
+        if (!br->vlan_enabled)
+                return true;
+
+        if (!v)
+                return false;
+
+        br_vlan_get_tag(skb, &vid);
+        if (test_bit(vid, v->vlan_bitmap))
+                return true;
+
+        return false;
+}
+
+/* Must be protected by RTNL */
+int br_vlan_add(struct net_bridge *br, u16 vid, u16 flags)
+{
+        struct net_port_vlans *pv = NULL;
+        int err;
+
+        ASSERT_RTNL();
+
+        pv = rtnl_dereference(br->vlan_info);
+        if (pv)
+                return __vlan_add(pv, vid, flags);
+
+        /* Create port vlan infomration
+         */
+        pv = kzalloc(sizeof(*pv), GFP_KERNEL);
+        if (!pv)
+                return -ENOMEM;
+
+        pv->parent.br = br;
+        err = __vlan_add(pv, vid, flags);
+        if (err)
+                goto out;
+
+        rcu_assign_pointer(br->vlan_info, pv);
+        return 0;
+out:
+        kfree(pv);
+        return err;
+}
+
+/* Must be protected by RTNL */
+int br_vlan_delete(struct net_bridge *br, u16 vid)
+{
+        struct net_port_vlans *pv;
+
+        ASSERT_RTNL();
+
+        pv = rtnl_dereference(br->vlan_info);
+        if (!pv)
+                return -EINVAL;
+
+        if (vid) {
+                /* If the VID !=0 remove fdb for this vid. VID 0 is special
+                 * in that it's the default and is always there in the fdb.
+                 */
+                spin_lock_bh(&br->hash_lock);
+                fdb_delete_by_addr(br, br->dev->dev_addr, vid);
+                spin_unlock_bh(&br->hash_lock);
+        }
+
+        __vlan_del(pv, vid);
+        return 0;
+}
+
+void br_vlan_flush(struct net_bridge *br)
+{
+        struct net_port_vlans *pv;
+
+        ASSERT_RTNL();
+        pv = rtnl_dereference(br->vlan_info);
+        if (!pv)
+                return;
+
+        __vlan_flush(pv);
+}
+
+int br_vlan_filter_toggle(struct net_bridge *br, unsigned long val)
+{
+        if (!rtnl_trylock())
+                return restart_syscall();
+
+        if (br->vlan_enabled == val)
+                goto unlock;
+
+        br->vlan_enabled = val;
+
+unlock:
+        rtnl_unlock();
+        return 0;
+}
+
+/* Must be protected by RTNL */
+int nbp_vlan_add(struct net_bridge_port *port, u16 vid, u16 flags)
+{
+        struct net_port_vlans *pv = NULL;
+        int err;
+
+        ASSERT_RTNL();
+
+        pv = rtnl_dereference(port->vlan_info);
+        if (pv)
+                return __vlan_add(pv, vid, flags);
+
+        /* Create port vlan infomration
+         */
+        pv = kzalloc(sizeof(*pv), GFP_KERNEL);
+        if (!pv) {
+                err = -ENOMEM;
+                goto clean_up;
+        }
+
+        pv->port_idx = port->port_no;
+        pv->parent.port = port;
+        err = __vlan_add(pv, vid, flags);
+        if (err)
+                goto clean_up;
+
+        rcu_assign_pointer(port->vlan_info, pv);
+        return 0;
+
+clean_up:
+        kfree(pv);
+        return err;
+}
+
+/* Must be protected by RTNL */
+int nbp_vlan_delete(struct net_bridge_port *port, u16 vid)
+{
+        struct net_port_vlans *pv;
+
+        ASSERT_RTNL();
+
+        pv = rtnl_dereference(port->vlan_info);
+        if (!pv)
+                return -EINVAL;
+
+        if (vid) {
+                /* If the VID !=0 remove fdb for this vid. VID 0 is special
+                 * in that it's the default and is always there in the fdb.
+                 */
+                spin_lock_bh(&port->br->hash_lock);
+                fdb_delete_by_addr(port->br, port->dev->dev_addr, vid);
+                spin_unlock_bh(&port->br->hash_lock);
+        }
+
+        return __vlan_del(pv, vid);
+}
+
+void nbp_vlan_flush(struct net_bridge_port *port)
+{
+        struct net_port_vlans *pv;
+
+        ASSERT_RTNL();
+
+        pv = rtnl_dereference(port->vlan_info);
+        if (!pv)
+                return;
+
+        __vlan_flush(pv);
+}
+
+bool nbp_vlan_find(struct net_bridge_port *port, u16 vid)
+{
+        struct net_port_vlans *pv;
+        bool found = false;
+
+        rcu_read_lock();
+        pv = rcu_dereference(port->vlan_info);
+
+        if (!pv)
+                goto out;
+
+        if (test_bit(vid, pv->vlan_bitmap))
+                found = true;
+
+out:
+        rcu_read_unlock();
+        return found;
+}
diff --git a/net/can/bcm.c b/net/can/bcm.c
index 28e12d18f0f1..5dcb20076f39 100644
--- a/net/can/bcm.c
+++ b/net/can/bcm.c
@@ -1633,7 +1633,7 @@ static void __exit bcm_module_exit(void)
         can_proto_unregister(&bcm_can_proto);
 
         if (proc_dir)
-                proc_net_remove(&init_net, "can-bcm");
+                remove_proc_entry("can-bcm", init_net.proc_net);
 }
 
 module_init(bcm_module_init);
diff --git a/net/can/proc.c b/net/can/proc.c
index ae566902d2bf..497335892146 100644
--- a/net/can/proc.c
+++ b/net/can/proc.c
@@ -531,5 +531,5 @@ void can_remove_proc(void)
                 can_remove_proc_readentry(CAN_PROC_RCVLIST_SFF);
 
         if (can_dir)
-                proc_net_remove(&init_net, "can");
+                remove_proc_entry("can", init_net.proc_net);
 }
diff --git a/net/core/Makefile b/net/core/Makefile
index 674641b13aea..0c5e3618c80b 100644
--- a/net/core/Makefile
+++ b/net/core/Makefile
@@ -9,7 +9,7 @@ obj-$(CONFIG_SYSCTL) += sysctl_net_core.o
 
 obj-y                += dev.o ethtool.o dev_addr_lists.o dst.o netevent.o \
                         neighbour.o rtnetlink.o utils.o link_watch.o filter.o \
-                        sock_diag.o
+                        sock_diag.o dev_ioctl.o
 
 obj-$(CONFIG_XFRM) += flow.o
 obj-y += net-sysfs.o
diff --git a/net/core/datagram.c b/net/core/datagram.c
index 0337e2b76862..368f9c3f9dc6 100644
--- a/net/core/datagram.c
+++ b/net/core/datagram.c
@@ -187,7 +187,7 @@ struct sk_buff *__skb_recv_datagram(struct sock *sk, unsigned int flags,
                 skb_queue_walk(queue, skb) {
                         *peeked = skb->peeked;
                         if (flags & MSG_PEEK) {
-                                if (*off >= skb->len) {
+                                if (*off >= skb->len && skb->len) {
                                         *off -= skb->len;
                                         continue;
                                 }
diff --git a/net/core/dev.c b/net/core/dev.c
index a87bc74e9fd0..decf55f9ad80 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -106,7 +106,6 @@
 #include <net/xfrm.h>
 #include <linux/highmem.h>
 #include <linux/init.h>
-#include <linux/kmod.h>
 #include <linux/module.h>
 #include <linux/netpoll.h>
 #include <linux/rcupdate.h>
@@ -132,7 +131,6 @@
 #include <linux/pci.h>
 #include <linux/inetdevice.h>
 #include <linux/cpu_rmap.h>
-#include <linux/net_tstamp.h>
 #include <linux/static_key.h>
 
 #include "net-sysfs.h"
@@ -1226,36 +1224,6 @@ void netdev_notify_peers(struct net_device *dev)
 }
 EXPORT_SYMBOL(netdev_notify_peers);
 
-/**
- *      dev_load        - load a network module
- *      @net: the applicable net namespace
- *      @name: name of interface
- *
- *      If a network interface is not present and the process has suitable
- *      privileges this function loads the module. If module loading is not
- *      available in this kernel then it becomes a nop.
- */
-
-void dev_load(struct net *net, const char *name)
-{
-        struct net_device *dev;
-        int no_module;
-
-        rcu_read_lock();
-        dev = dev_get_by_name_rcu(net, name);
-        rcu_read_unlock();
-
-        no_module = !dev;
-        if (no_module && capable(CAP_NET_ADMIN))
-                no_module = request_module("netdev-%s", name);
-        if (no_module && capable(CAP_SYS_MODULE)) {
-                if (!request_module("%s", name))
-                        pr_warn("Loading kernel module for a network device with CAP_SYS_MODULE (deprecated).  Use CAP_NET_ADMIN and alias netdev-%s instead.\n",
-                                name);
-        }
-}
-EXPORT_SYMBOL(dev_load);
-
 static int __dev_open(struct net_device *dev)
 {
         const struct net_device_ops *ops = dev->netdev_ops;
@@ -1266,6 +1234,14 @@ static int __dev_open(struct net_device *dev)
         if (!netif_device_present(dev))
                 return -ENODEV;
 
+        /* Block netpoll from trying to do any rx path servicing.
+         * If we don't do this there is a chance ndo_poll_controller
+         * or ndo_poll may be running while we open the device
+         */
+        ret = netpoll_rx_disable(dev);
+        if (ret)
+                return ret;
+
         ret = call_netdevice_notifiers(NETDEV_PRE_UP, dev);
         ret = notifier_to_errno(ret);
         if (ret)
@@ -1279,6 +1255,8 @@ static int __dev_open(struct net_device *dev)
         if (!ret && ops->ndo_open)
                 ret = ops->ndo_open(dev);
 
+        netpoll_rx_enable(dev);
+
         if (ret)
                 clear_bit(__LINK_STATE_START, &dev->state);
         else {
@@ -1370,9 +1348,16 @@ static int __dev_close(struct net_device *dev)
         int retval;
         LIST_HEAD(single);
 
+        /* Temporarily disable netpoll until the interface is down */
+        retval = netpoll_rx_disable(dev);
+        if (retval)
+                return retval;
+
         list_add(&dev->unreg_list, &single);
         retval = __dev_close_many(&single);
         list_del(&single);
+
+        netpoll_rx_enable(dev);
         return retval;
 }
 
@@ -1408,14 +1393,22 @@ static int dev_close_many(struct list_head *head)
  */
 int dev_close(struct net_device *dev)
 {
+        int ret = 0;
         if (dev->flags & IFF_UP) {
                 LIST_HEAD(single);
 
+                /* Block netpoll rx while the interface is going down */
+                ret = netpoll_rx_disable(dev);
+                if (ret)
+                        return ret;
+
                 list_add(&dev->unreg_list, &single);
                 dev_close_many(&single);
                 list_del(&single);
+
+                netpoll_rx_enable(dev);
         }
-        return 0;
+        return ret;
 }
 EXPORT_SYMBOL(dev_close);
 
@@ -1620,57 +1613,6 @@ static inline void net_timestamp_set(struct sk_buff *skb)
                         __net_timestamp(SKB);           \
         }                                               \
 
-static int net_hwtstamp_validate(struct ifreq *ifr)
-{
-        struct hwtstamp_config cfg;
-        enum hwtstamp_tx_types tx_type;
-        enum hwtstamp_rx_filters rx_filter;
-        int tx_type_valid = 0;
-        int rx_filter_valid = 0;
-
-        if (copy_from_user(&cfg, ifr->ifr_data, sizeof(cfg)))
-                return -EFAULT;
-
-        if (cfg.flags) /* reserved for future extensions */
-                return -EINVAL;
-
-        tx_type = cfg.tx_type;
-        rx_filter = cfg.rx_filter;
-
-        switch (tx_type) {
-        case HWTSTAMP_TX_OFF:
-        case HWTSTAMP_TX_ON:
-        case HWTSTAMP_TX_ONESTEP_SYNC:
-                tx_type_valid = 1;
-                break;
-        }
-
-        switch (rx_filter) {
-        case HWTSTAMP_FILTER_NONE:
-        case HWTSTAMP_FILTER_ALL:
-        case HWTSTAMP_FILTER_SOME:
-        case HWTSTAMP_FILTER_PTP_V1_L4_EVENT:
-        case HWTSTAMP_FILTER_PTP_V1_L4_SYNC:
-        case HWTSTAMP_FILTER_PTP_V1_L4_DELAY_REQ:
-        case HWTSTAMP_FILTER_PTP_V2_L4_EVENT:
-        case HWTSTAMP_FILTER_PTP_V2_L4_SYNC:
-        case HWTSTAMP_FILTER_PTP_V2_L4_DELAY_REQ:
-        case HWTSTAMP_FILTER_PTP_V2_L2_EVENT:
-        case HWTSTAMP_FILTER_PTP_V2_L2_SYNC:
-        case HWTSTAMP_FILTER_PTP_V2_L2_DELAY_REQ:
-        case HWTSTAMP_FILTER_PTP_V2_EVENT:
-        case HWTSTAMP_FILTER_PTP_V2_SYNC:
-        case HWTSTAMP_FILTER_PTP_V2_DELAY_REQ:
-                rx_filter_valid = 1;
-                break;
-        }
-
-        if (!tx_type_valid || !rx_filter_valid)
-                return -ERANGE;
-
-        return 0;
-}
-
 static inline bool is_skb_forwardable(struct net_device *dev,
                                       struct sk_buff *skb)
 {
@@ -2303,25 +2245,19 @@ out:
 EXPORT_SYMBOL(skb_checksum_help);
 
 /**
- *      skb_gso_segment - Perform segmentation on skb.
+ *      skb_mac_gso_segment - mac layer segmentation handler.
  *      @skb: buffer to segment
  *      @features: features for the output path (see dev->features)
- *
- *      This function segments the given skb and returns a list of segments.
- *
- *      It may return NULL if the skb requires no segmentation.  This is
- *      only possible when GSO is used for verifying header integrity.
  */
-struct sk_buff *skb_gso_segment(struct sk_buff *skb,
-        netdev_features_t features)
+struct sk_buff *skb_mac_gso_segment(struct sk_buff *skb,
+                                    netdev_features_t features)
 {
         struct sk_buff *segs = ERR_PTR(-EPROTONOSUPPORT);
         struct packet_offload *ptype;
         __be16 type = skb->protocol;
-        int vlan_depth = ETH_HLEN;
-        int err;
 
         while (type == htons(ETH_P_8021Q)) {
+                int vlan_depth = ETH_HLEN;
                 struct vlan_hdr *vh;
 
                 if (unlikely(!pskb_may_pull(skb, vlan_depth + VLAN_HLEN)))
@@ -2332,22 +2268,14 @@ struct sk_buff *skb_gso_segment(struct sk_buff *skb,
                 vlan_depth += VLAN_HLEN;
         }
 
-        skb_reset_mac_header(skb);
-        skb->mac_len = skb->network_header - skb->mac_header;
         __skb_pull(skb, skb->mac_len);
 
-        if (unlikely(skb->ip_summed != CHECKSUM_PARTIAL)) {
-                skb_warn_bad_offload(skb);
-
-                if (skb_header_cloned(skb) &&
-                    (err = pskb_expand_head(skb, 0, 0, GFP_ATOMIC)))
-                        return ERR_PTR(err);
-        }
-
         rcu_read_lock();
         list_for_each_entry_rcu(ptype, &offload_base, list) {
                 if (ptype->type == type && ptype->callbacks.gso_segment) {
                         if (unlikely(skb->ip_summed != CHECKSUM_PARTIAL)) {
+                                int err;
+
                                 err = ptype->callbacks.gso_send_check(skb);
                                 segs = ERR_PTR(err);
                                 if (err || skb_gso_ok(skb, features))
@@ -2365,7 +2293,50 @@ struct sk_buff *skb_gso_segment(struct sk_buff *skb,
 
         return segs;
 }
-EXPORT_SYMBOL(skb_gso_segment);
+EXPORT_SYMBOL(skb_mac_gso_segment);
+
+
+/* openvswitch calls this on rx path, so we need a different check.
+ */
+static inline bool skb_needs_check(struct sk_buff *skb, bool tx_path)
+{
+        if (tx_path)
+                return skb->ip_summed != CHECKSUM_PARTIAL;
+        else
+                return skb->ip_summed == CHECKSUM_NONE;
+}
+
+/**
+ *      __skb_gso_segment - Perform segmentation on skb.
+ *      @skb: buffer to segment
+ *      @features: features for the output path (see dev->features)
+ *      @tx_path: whether it is called in TX path
+ *
+ *      This function segments the given skb and returns a list of segments.
+ *
+ *      It may return NULL if the skb requires no segmentation.  This is
+ *      only possible when GSO is used for verifying header integrity.
+ */
+struct sk_buff *__skb_gso_segment(struct sk_buff *skb,
+                                  netdev_features_t features, bool tx_path)
+{
+        if (unlikely(skb_needs_check(skb, tx_path))) {
+                int err;
+
+                skb_warn_bad_offload(skb);
+
+                if (skb_header_cloned(skb) &&
+                    (err = pskb_expand_head(skb, 0, 0, GFP_ATOMIC)))
+                        return ERR_PTR(err);
+        }
+
+        SKB_GSO_CB(skb)->mac_offset = skb_headroom(skb);
+        skb_reset_mac_header(skb);
+        skb_reset_mac_len(skb);
+
+        return skb_mac_gso_segment(skb, features);
+}
+EXPORT_SYMBOL(__skb_gso_segment);
 
 /* Take action when hardware reception checksum errors are detected. */
 #ifdef CONFIG_BUG
@@ -2799,6 +2770,8 @@ int dev_queue_xmit(struct sk_buff *skb)
         struct Qdisc *q;
         int rc = -ENOMEM;
 
+        skb_reset_mac_header(skb);
+
         /* Disable soft irqs for various locks below. Also
          * stops preemption for RCU.
          */
@@ -3419,7 +3392,7 @@ static bool skb_pfmemalloc_protocol(struct sk_buff *skb)
         }
 }
 
-static int __netif_receive_skb(struct sk_buff *skb)
+static int __netif_receive_skb_core(struct sk_buff *skb, bool pfmemalloc)
 {
         struct packet_type *ptype, *pt_prev;
         rx_handler_func_t *rx_handler;
@@ -3428,24 +3401,11 @@ static int __netif_receive_skb(struct sk_buff *skb)
         bool deliver_exact = false;
         int ret = NET_RX_DROP;
         __be16 type;
-        unsigned long pflags = current->flags;
 
         net_timestamp_check(!netdev_tstamp_prequeue, skb);
 
         trace_netif_receive_skb(skb);
 
-        /*
-         * PFMEMALLOC skbs are special, they should
-         * - be delivered to SOCK_MEMALLOC sockets only
-         * - stay away from userspace
-         * - have bounded memory usage
-         *
-         * Use PF_MEMALLOC as this saves us from propagating the allocation
-         * context down to all allocation sites.
-         */
-        if (sk_memalloc_socks() && skb_pfmemalloc(skb))
-                current->flags |= PF_MEMALLOC;
-
         /* if we've gotten here through NAPI, check netpoll */
         if (netpoll_receive_skb(skb))
                 goto out;
@@ -3479,7 +3439,7 @@ another_round:
         }
 #endif
 
-        if (sk_memalloc_socks() && skb_pfmemalloc(skb))
+        if (pfmemalloc)
                 goto skip_taps;
 
         list_for_each_entry_rcu(ptype, &ptype_all, list) {
@@ -3498,8 +3458,7 @@ skip_taps:
 ncls:
 #endif
 
-        if (sk_memalloc_socks() && skb_pfmemalloc(skb)
-                                && !skb_pfmemalloc_protocol(skb))
+        if (pfmemalloc && !skb_pfmemalloc_protocol(skb))
                 goto drop;
 
         if (vlan_tx_tag_present(skb)) {
@@ -3569,7 +3528,31 @@ drop:
 unlock:
         rcu_read_unlock();
 out:
-        tsk_restore_flags(current, pflags, PF_MEMALLOC);
+        return ret;
+}
+
+static int __netif_receive_skb(struct sk_buff *skb)
+{
+        int ret;
+
+        if (sk_memalloc_socks() && skb_pfmemalloc(skb)) {
+                unsigned long pflags = current->flags;
+
+                /*
+                 * PFMEMALLOC skbs are special, they should
+                 * - be delivered to SOCK_MEMALLOC sockets only
+                 * - stay away from userspace
+                 * - have bounded memory usage
+                 *
+                 * Use PF_MEMALLOC as this saves us from propagating the allocation
+                 * context down to all allocation sites.
+                 */
+                current->flags |= PF_MEMALLOC;
+                ret = __netif_receive_skb_core(skb, true);
+                tsk_restore_flags(current, pflags, PF_MEMALLOC);
+        } else
+                ret = __netif_receive_skb_core(skb, false);
+
         return ret;
 }
 
@@ -3736,7 +3719,6 @@ static enum gro_result dev_gro_receive(struct napi_struct *napi, struct sk_buff
         __be16 type = skb->protocol;
         struct list_head *head = &offload_base;
         int same_flow;
-        int mac_len;
         enum gro_result ret;
 
         if (!(skb->dev->features & NETIF_F_GRO) || netpoll_rx_on(skb))
@@ -3753,8 +3735,7 @@ static enum gro_result dev_gro_receive(struct napi_struct *napi, struct sk_buff
                         continue;
 
                 skb_set_network_header(skb, skb_gro_offset(skb));
-                mac_len = skb->network_header - skb->mac_header;
-                skb->mac_len = mac_len;
+                skb_reset_mac_len(skb);
                 NAPI_GRO_CB(skb)->same_flow = 0;
                 NAPI_GRO_CB(skb)->flush = 0;
                 NAPI_GRO_CB(skb)->free = 0;
@@ -4236,127 +4217,6 @@ softnet_break:
         goto out;
 }
 
-static gifconf_func_t *gifconf_list[NPROTO];
-
-/**
- *      register_gifconf        -       register a SIOCGIF handler
- *      @family: Address family
- *      @gifconf: Function handler
- *
- *      Register protocol dependent address dumping routines. The handler
- *      that is passed must not be freed or reused until it has been replaced
- *      by another handler.
- */
-int register_gifconf(unsigned int family, gifconf_func_t *gifconf)
-{
-        if (family >= NPROTO)
-                return -EINVAL;
-        gifconf_list[family] = gifconf;
-        return 0;
-}
-EXPORT_SYMBOL(register_gifconf);
-
-
-/*
- *      Map an interface index to its name (SIOCGIFNAME)
- */
-
-/*
- *      We need this ioctl for efficient implementation of the
- *      if_indextoname() function required by the IPv6 API.  Without
- *      it, we would have to search all the interfaces to find a
- *      match.  --pb
- */
-
-static int dev_ifname(struct net *net, struct ifreq __user *arg)
-{
-        struct net_device *dev;
-        struct ifreq ifr;
-        unsigned seq;
-
-        /*
-         *      Fetch the caller's info block.
-         */
-
-        if (copy_from_user(&ifr, arg, sizeof(struct ifreq)))
-                return -EFAULT;
-
-retry:
-        seq = read_seqcount_begin(&devnet_rename_seq);
-        rcu_read_lock();
-        dev = dev_get_by_index_rcu(net, ifr.ifr_ifindex);
-        if (!dev) {
-                rcu_read_unlock();
-                return -ENODEV;
-        }
-
-        strcpy(ifr.ifr_name, dev->name);
-        rcu_read_unlock();
-        if (read_seqcount_retry(&devnet_rename_seq, seq))
-                goto retry;
-
-        if (copy_to_user(arg, &ifr, sizeof(struct ifreq)))
-                return -EFAULT;
-        return 0;
-}
-
-/*
- *      Perform a SIOCGIFCONF call. This structure will change
- *      size eventually, and there is nothing I can do about it.
- *      Thus we will need a 'compatibility mode'.
- */
-
-static int dev_ifconf(struct net *net, char __user *arg)
-{
-        struct ifconf ifc;
-        struct net_device *dev;
-        char __user *pos;
-        int len;
-        int total;
-        int i;
-
-        /*
-         *      Fetch the caller's info block.
-         */
-
-        if (copy_from_user(&ifc, arg, sizeof(struct ifconf)))
-                return -EFAULT;
-
-        pos = ifc.ifc_buf;
-        len = ifc.ifc_len;
-
-        /*
-         *      Loop over the interfaces, and write an info block for each.
-         */
-
-        total = 0;
-        for_each_netdev(net, dev) {
-                for (i = 0; i < NPROTO; i++) {
-                        if (gifconf_list[i]) {
-                                int done;
-                                if (!pos)
-                                        done = gifconf_list[i](dev, NULL, 0);
-                                else
-                                        done = gifconf_list[i](dev, pos + total,
-                                                               len - total);
-                                if (done < 0)
-                                        return -EFAULT;
-                                total += done;
-                        }
-                }
-        }
-
-        /*
-         *      All done.  Write the updated control block back to the caller.
-         */
-        ifc.ifc_len = total;
-
-        /*
-         *      Both BSD and Solaris return 0 here, so we do too.
-         */
-        return copy_to_user(arg, &ifc, sizeof(struct ifconf)) ? -EFAULT : 0;
-}
-
 #ifdef CONFIG_PROC_FS
 
 #define BUCKET_SPACE (32 - NETDEV_HASHBITS - 1)
@@ -4658,11 +4518,12 @@ static int __net_init dev_proc_net_init(struct net *net)
 {
         int rc = -ENOMEM;
 
-        if (!proc_net_fops_create(net, "dev", S_IRUGO, &dev_seq_fops))
+        if (!proc_create("dev", S_IRUGO, net->proc_net, &dev_seq_fops))
                 goto out;
-        if (!proc_net_fops_create(net, "softnet_stat", S_IRUGO, &softnet_seq_fops))
+        if (!proc_create("softnet_stat", S_IRUGO, net->proc_net,
+                         &softnet_seq_fops))
                 goto out_dev;
-        if (!proc_net_fops_create(net, "ptype", S_IRUGO, &ptype_seq_fops))
+        if (!proc_create("ptype", S_IRUGO, net->proc_net, &ptype_seq_fops))
                 goto out_softnet;
 
         if (wext_proc_init(net))
@@ -4671,11 +4532,11 @@ static int __net_init dev_proc_net_init(struct net *net)
 out:
         return rc;
 out_ptype:
-        proc_net_remove(net, "ptype");
+        remove_proc_entry("ptype", net->proc_net);
 out_softnet:
-        proc_net_remove(net, "softnet_stat");
+        remove_proc_entry("softnet_stat", net->proc_net);
 out_dev:
-        proc_net_remove(net, "dev");
+        remove_proc_entry("dev", net->proc_net);
         goto out;
 }
 
@@ -4683,9 +4544,9 @@ static void __net_exit dev_proc_net_exit(struct net *net)
 {
         wext_proc_exit(net);
 
-        proc_net_remove(net, "ptype");
-        proc_net_remove(net, "softnet_stat");
-        proc_net_remove(net, "dev");
+        remove_proc_entry("ptype", net->proc_net);
+        remove_proc_entry("softnet_stat", net->proc_net);
+        remove_proc_entry("dev", net->proc_net);
 }
 
 static struct pernet_operations __net_initdata dev_proc_ops = {
@@ -5317,375 +5178,6 @@ int dev_change_carrier(struct net_device *dev, bool new_carrier)
 }
 EXPORT_SYMBOL(dev_change_carrier);
 
-/*
- *      Perform the SIOCxIFxxx calls, inside rcu_read_lock()
- */
-static int dev_ifsioc_locked(struct net *net, struct ifreq *ifr, unsigned int cmd)
-{
-        int err;
-        struct net_device *dev = dev_get_by_name_rcu(net, ifr->ifr_name);
-
-        if (!dev)
-                return -ENODEV;
-
-        switch (cmd) {
-        case SIOCGIFFLAGS:      /* Get interface flags */
-                ifr->ifr_flags = (short) dev_get_flags(dev);
-                return 0;
-
-        case SIOCGIFMETRIC:     /* Get the metric on the interface
-                                   (currently unused) */
-                ifr->ifr_metric = 0;
-                return 0;
-
-        case SIOCGIFMTU:        /* Get the MTU of a device */
-                ifr->ifr_mtu = dev->mtu;
-                return 0;
-
-        case SIOCGIFHWADDR:
-                if (!dev->addr_len)
-                        memset(ifr->ifr_hwaddr.sa_data, 0, sizeof ifr->ifr_hwaddr.sa_data);
-                else
-                        memcpy(ifr->ifr_hwaddr.sa_data, dev->dev_addr,
-                               min(sizeof ifr->ifr_hwaddr.sa_data, (size_t) dev->addr_len));
-                ifr->ifr_hwaddr.sa_family = dev->type;
-                return 0;
-
-        case SIOCGIFSLAVE:
-                err = -EINVAL;
-                break;
-
-        case SIOCGIFMAP:
-                ifr->ifr_map.mem_start = dev->mem_start;
-                ifr->ifr_map.mem_end   = dev->mem_end;
-                ifr->ifr_map.base_addr = dev->base_addr;
-                ifr->ifr_map.irq       = dev->irq;
-                ifr->ifr_map.dma       = dev->dma;
-                ifr->ifr_map.port      = dev->if_port;
-                return 0;
-
-        case SIOCGIFINDEX:
-                ifr->ifr_ifindex = dev->ifindex;
-                return 0;
-
-        case SIOCGIFTXQLEN:
-                ifr->ifr_qlen = dev->tx_queue_len;
-                return 0;
-
-        default:
-                /* dev_ioctl() should ensure this case
-                 * is never reached
-                 */
-                WARN_ON(1);
-                err = -ENOTTY;
-                break;
-
-        }
-        return err;
-}
-
-/*
- *      Perform the SIOCxIFxxx calls, inside rtnl_lock()
- */
-static int dev_ifsioc(struct net *net, struct ifreq *ifr, unsigned int cmd)
-{
-        int err;
-        struct net_device *dev = __dev_get_by_name(net, ifr->ifr_name);
-        const struct net_device_ops *ops;
-
-        if (!dev)
-                return -ENODEV;
-
-        ops = dev->netdev_ops;
-
-        switch (cmd) {
-        case SIOCSIFFLAGS:      /* Set interface flags */
-                return dev_change_flags(dev, ifr->ifr_flags);
-
-        case SIOCSIFMETRIC:     /* Set the metric on the interface
-                                   (currently unused) */
-                return -EOPNOTSUPP;
-
-        case SIOCSIFMTU:        /* Set the MTU of a device */
-                return dev_set_mtu(dev, ifr->ifr_mtu);
-
-        case SIOCSIFHWADDR:
-                return dev_set_mac_address(dev, &ifr->ifr_hwaddr);
-
-        case SIOCSIFHWBROADCAST:
-                if (ifr->ifr_hwaddr.sa_family != dev->type)
-                        return -EINVAL;
-                memcpy(dev->broadcast, ifr->ifr_hwaddr.sa_data,
-                       min(sizeof ifr->ifr_hwaddr.sa_data, (size_t) dev->addr_len));
-                call_netdevice_notifiers(NETDEV_CHANGEADDR, dev);
-                return 0;
-
-        case SIOCSIFMAP:
-                if (ops->ndo_set_config) {
-                        if (!netif_device_present(dev))
-                                return -ENODEV;
-                        return ops->ndo_set_config(dev, &ifr->ifr_map);
-                }
-                return -EOPNOTSUPP;
-
-        case SIOCADDMULTI:
-                if (!ops->ndo_set_rx_mode ||
-                    ifr->ifr_hwaddr.sa_family != AF_UNSPEC)
-                        return -EINVAL;
-                if (!netif_device_present(dev))
-                        return -ENODEV;
-                return dev_mc_add_global(dev, ifr->ifr_hwaddr.sa_data);
-
-        case SIOCDELMULTI:
-                if (!ops->ndo_set_rx_mode ||
-                    ifr->ifr_hwaddr.sa_family != AF_UNSPEC)
-                        return -EINVAL;
-                if (!netif_device_present(dev))
-                        return -ENODEV;
-                return dev_mc_del_global(dev, ifr->ifr_hwaddr.sa_data);
-
-        case SIOCSIFTXQLEN:
-                if (ifr->ifr_qlen < 0)
-                        return -EINVAL;
-                dev->tx_queue_len = ifr->ifr_qlen;
-                return 0;
-
-        case SIOCSIFNAME:
-                ifr->ifr_newname[IFNAMSIZ-1] = '\0';
-                return dev_change_name(dev, ifr->ifr_newname);
-
-        case SIOCSHWTSTAMP:
-                err = net_hwtstamp_validate(ifr);
-                if (err)
-                        return err;
-                /* fall through */
-
-        /*
-         *      Unknown or private ioctl
-         */
-        default:
-                if ((cmd >= SIOCDEVPRIVATE &&
-                    cmd <= SIOCDEVPRIVATE + 15) ||
-                    cmd == SIOCBONDENSLAVE ||
-                    cmd == SIOCBONDRELEASE ||
-                    cmd == SIOCBONDSETHWADDR ||
-                    cmd == SIOCBONDSLAVEINFOQUERY ||
-                    cmd == SIOCBONDINFOQUERY ||
-                    cmd == SIOCBONDCHANGEACTIVE ||
-                    cmd == SIOCGMIIPHY ||
-                    cmd == SIOCGMIIREG ||
-                    cmd == SIOCSMIIREG ||
-                    cmd == SIOCBRADDIF ||
-                    cmd == SIOCBRDELIF ||
-                    cmd == SIOCSHWTSTAMP ||
-                    cmd == SIOCWANDEV) {
-                        err = -EOPNOTSUPP;
-                        if (ops->ndo_do_ioctl) {
-                                if (netif_device_present(dev))
-                                        err = ops->ndo_do_ioctl(dev, ifr, cmd);
-                                else
-                                        err = -ENODEV;
-                        }
-                } else
-                        err = -EINVAL;
-
-        }
-        return err;
-}
-
-/*
- *      This function handles all "interface"-type I/O control requests. The actual
- *      'doing' part of this is dev_ifsioc above.
- */
-
-/**
- *      dev_ioctl       -       network device ioctl
- *      @net: the applicable net namespace
- *      @cmd: command to issue
- *      @arg: pointer to a struct ifreq in user space
- *
- *      Issue ioctl functions to devices. This is normally called by the
- *      user space syscall interfaces but can sometimes be useful for
- *      other purposes. The return value is the return from the syscall if
- *      positive or a negative errno code on error.
- */
-
-int dev_ioctl(struct net *net, unsigned int cmd, void __user *arg)
-{
-        struct ifreq ifr;
-        int ret;
-        char *colon;
-
-        /* One special case: SIOCGIFCONF takes ifconf argument
-           and requires shared lock, because it sleeps writing
-           to user space.
-         */
-
-        if (cmd == SIOCGIFCONF) {
-                rtnl_lock();
-                ret = dev_ifconf(net, (char __user *) arg);
-                rtnl_unlock();
-                return ret;
-        }
-        if (cmd == SIOCGIFNAME)
-                return dev_ifname(net, (struct ifreq __user *)arg);
-
-        if (copy_from_user(&ifr, arg, sizeof(struct ifreq)))
-                return -EFAULT;
-
-        ifr.ifr_name[IFNAMSIZ-1] = 0;
-
-        colon = strchr(ifr.ifr_name, ':');
-        if (colon)
-                *colon = 0;
-
-        /*
-         *      See which interface the caller is talking about.
-         */
-
-        switch (cmd) {
-        /*
-         *      These ioctl calls:
-         *      - can be done by all.
-         *      - atomic and do not require locking.
-         *      - return a value
-         */
-        case SIOCGIFFLAGS:
-        case SIOCGIFMETRIC:
-        case SIOCGIFMTU:
-        case SIOCGIFHWADDR:
-        case SIOCGIFSLAVE:
-        case SIOCGIFMAP:
-        case SIOCGIFINDEX:
-        case SIOCGIFTXQLEN:
-                dev_load(net, ifr.ifr_name);
-                rcu_read_lock();
-                ret = dev_ifsioc_locked(net, &ifr, cmd);
-                rcu_read_unlock();
-                if (!ret) {
-                        if (colon)
-                                *colon = ':';
-                        if (copy_to_user(arg, &ifr,
-                                         sizeof(struct ifreq)))
-                                ret = -EFAULT;
-                }
-                return ret;
-
-        case SIOCETHTOOL:
-                dev_load(net, ifr.ifr_name);
-                rtnl_lock();
-                ret = dev_ethtool(net, &ifr);
-                rtnl_unlock();
-                if (!ret) {
-                        if (colon)
-                                *colon = ':';
-                        if (copy_to_user(arg, &ifr,
-                                         sizeof(struct ifreq)))
-                                ret = -EFAULT;
-                }
-                return ret;
-
-        /*
-         *      These ioctl calls:
-         *      - require superuser power.
-         *      - require strict serialization.
-         *      - return a value
-         */
-        case SIOCGMIIPHY:
-        case SIOCGMIIREG:
-        case SIOCSIFNAME:
-                if (!ns_capable(net->user_ns, CAP_NET_ADMIN))
-                        return -EPERM;
-                dev_load(net, ifr.ifr_name);
-                rtnl_lock();
-                ret = dev_ifsioc(net, &ifr, cmd);
-                rtnl_unlock();
-                if (!ret) {
-                        if (colon)
-                                *colon = ':';
-                        if (copy_to_user(arg, &ifr,
-                                         sizeof(struct ifreq)))
-                                ret = -EFAULT;
-                }
-                return ret;
-
-        /*
-         *      These ioctl calls:
-         *      - require superuser power.
-         *      - require strict serialization.
-         *      - do not return a value
-         */
-        case SIOCSIFMAP:
-        case SIOCSIFTXQLEN:
-                if (!capable(CAP_NET_ADMIN))
-                        return -EPERM;
-                /* fall through */
-        /*
-         *      These ioctl calls:
-         *      - require local superuser power.
-         *      - require strict serialization.
-         *      - do not return a value
-         */
-        case SIOCSIFFLAGS:
-        case SIOCSIFMETRIC:
-        case SIOCSIFMTU:
-        case SIOCSIFHWADDR:
-        case SIOCSIFSLAVE:
-        case SIOCADDMULTI:
-        case SIOCDELMULTI:
-        case SIOCSIFHWBROADCAST:
-        case SIOCSMIIREG:
-        case SIOCBONDENSLAVE:
-        case SIOCBONDRELEASE:
-        case SIOCBONDSETHWADDR:
-        case SIOCBONDCHANGEACTIVE:
-        case SIOCBRADDIF:
-        case SIOCBRDELIF:
-        case SIOCSHWTSTAMP:
-                if (!ns_capable(net->user_ns, CAP_NET_ADMIN))
-                        return -EPERM;
-                /* fall through */
-        case SIOCBONDSLAVEINFOQUERY:
-        case SIOCBONDINFOQUERY:
-                dev_load(net, ifr.ifr_name);
-                rtnl_lock();
-                ret = dev_ifsioc(net, &ifr, cmd);
-                rtnl_unlock();
-                return ret;
-
-        case SIOCGIFMEM:
-                /* Get the per device memory space. We can add this but
-                 * currently do not support it */
-        case SIOCSIFMEM:
-                /* Set the per device memory buffer space.
-                 * Not applicable in our case */
-        case SIOCSIFLINK:
-                return -ENOTTY;
-
-        /*
-         *      Unknown or private ioctl.
-         */
-        default:
-                if (cmd == SIOCWANDEV ||
-                    (cmd >= SIOCDEVPRIVATE &&
-                     cmd <= SIOCDEVPRIVATE + 15)) {
-                        dev_load(net, ifr.ifr_name);
-                        rtnl_lock();
-                        ret = dev_ifsioc(net, &ifr, cmd);
-                        rtnl_unlock();
-                        if (!ret && copy_to_user(arg, &ifr,
-                                                 sizeof(struct ifreq)))
-                                ret = -EFAULT;
-                        return ret;
-                }
-                /* Take care of Wireless Extensions */
-                if (cmd >= SIOCIWFIRST && cmd <= SIOCIWLAST)
-                        return wext_handle_ioctl(net, &ifr, cmd, arg);
-                return -ENOTTY;
-        }
-}
-
-
 /**
  *      dev_new_index   -       allocate an ifindex
  *      @net: the applicable net namespace
@@ -5958,10 +5450,9 @@ static int netif_alloc_rx_queues(struct net_device *dev)
         BUG_ON(count < 1);
 
         rx = kcalloc(count, sizeof(struct netdev_rx_queue), GFP_KERNEL);
-        if (!rx) {
-                pr_err("netdev: Unable to allocate %u rx queues\n", count);
+        if (!rx)
                 return -ENOMEM;
-        }
+
         dev->_rx = rx;
 
         for (i = 0; i < count; i++)
@@ -5992,10 +5483,9 @@ static int netif_alloc_netdev_queues(struct net_device *dev)
         BUG_ON(count < 1);
 
         tx = kcalloc(count, sizeof(struct netdev_queue), GFP_KERNEL);
-        if (!tx) {
-                pr_err("netdev: Unable to allocate %u tx queues\n", count);
+        if (!tx)
                 return -ENOMEM;
-        }
+
         dev->_tx = tx;
 
         netdev_for_each_tx_queue(dev, netdev_init_one_queue, NULL);
@@ -6482,10 +5972,8 @@ struct net_device *alloc_netdev_mqs(int sizeof_priv, const char *name,
         alloc_size += NETDEV_ALIGN - 1;
 
         p = kzalloc(alloc_size, GFP_KERNEL);
-        if (!p) {
-                pr_err("alloc_netdev: Unable to allocate device\n");
+        if (!p)
                 return NULL;
-        }
 
         dev = PTR_ALIGN(p, NETDEV_ALIGN);
         dev->padded = (char *)dev - (char *)p;
diff --git a/net/core/dev_addr_lists.c b/net/core/dev_addr_lists.c
index b079c7bbc157..89562529df45 100644
--- a/net/core/dev_addr_lists.c
+++ b/net/core/dev_addr_lists.c
@@ -780,14 +780,14 @@ static const struct file_operations dev_mc_seq_fops = {
 
 static int __net_init dev_mc_net_init(struct net *net)
 {
-        if (!proc_net_fops_create(net, "dev_mcast", 0, &dev_mc_seq_fops))
+        if (!proc_create("dev_mcast", 0, net->proc_net, &dev_mc_seq_fops))
                 return -ENOMEM;
         return 0;
 }
 
 static void __net_exit dev_mc_net_exit(struct net *net)
 {
-        proc_net_remove(net, "dev_mcast");
+        remove_proc_entry("dev_mcast", net->proc_net);
 }
 
 static struct pernet_operations __net_initdata dev_mc_net_ops = {
diff --git a/net/core/dev_ioctl.c b/net/core/dev_ioctl.c
new file mode 100644
index 000000000000..6cc0481faade
--- /dev/null
+++ b/net/core/dev_ioctl.c
@@ -0,0 +1,576 @@
+#include <linux/kmod.h>
+#include <linux/netdevice.h>
+#include <linux/etherdevice.h>
+#include <linux/rtnetlink.h>
+#include <linux/net_tstamp.h>
+#include <linux/wireless.h>
+#include <net/wext.h>
+
+/*
+ *      Map an interface index to its name (SIOCGIFNAME)
+ */
+
+/*
+ *      We need this ioctl for efficient implementation of the
+ *      if_indextoname() function required by the IPv6 API.  Without
+ *      it, we would have to search all the interfaces to find a
+ *      match.  --pb
+ */
+
+static int dev_ifname(struct net *net, struct ifreq __user *arg)
+{
+        struct net_device *dev;
+        struct ifreq ifr;
+        unsigned seq;
+
+        /*
+         *      Fetch the caller's info block.
+         */
+
+        if (copy_from_user(&ifr, arg, sizeof(struct ifreq)))
+                return -EFAULT;
+
+retry:
+        seq = read_seqcount_begin(&devnet_rename_seq);
+        rcu_read_lock();
+        dev = dev_get_by_index_rcu(net, ifr.ifr_ifindex);
+        if (!dev) {
+                rcu_read_unlock();
+                return -ENODEV;
+        }
+
+        strcpy(ifr.ifr_name, dev->name);
+        rcu_read_unlock();
+        if (read_seqcount_retry(&devnet_rename_seq, seq))
+                goto retry;
+
+        if (copy_to_user(arg, &ifr, sizeof(struct ifreq)))
+                return -EFAULT;
+        return 0;
+}
+
+static gifconf_func_t *gifconf_list[NPROTO];
+
+/**
+ *      register_gifconf        -       register a SIOCGIF handler
+ *      @family: Address family
+ *      @gifconf: Function handler
+ *
+ *      Register protocol dependent address dumping routines. The handler
+ *      that is passed must not be freed or reused until it has been replaced
+ *      by another handler.
+ */
+int register_gifconf(unsigned int family, gifconf_func_t *gifconf)
+{
+        if (family >= NPROTO)
+                return -EINVAL;
+        gifconf_list[family] = gifconf;
+        return 0;
+}
+EXPORT_SYMBOL(register_gifconf);
+
+/*
+ *      Perform a SIOCGIFCONF call. This structure will change
+ *      size eventually, and there is nothing I can do about it.
+ *      Thus we will need a 'compatibility mode'.
+ */
+
+static int dev_ifconf(struct net *net, char __user *arg)
+{
+        struct ifconf ifc;
+        struct net_device *dev;
+        char __user *pos;
+        int len;
+        int total;
+        int i;
+
+        /*
+         *      Fetch the caller's info block.
+         */
+
+        if (copy_from_user(&ifc, arg, sizeof(struct ifconf)))
+                return -EFAULT;
+
+        pos = ifc.ifc_buf;
+        len = ifc.ifc_len;
+
+        /*
+         *      Loop over the interfaces, and write an info block for each.
+         */
+
+        total = 0;
+        for_each_netdev(net, dev) {
+                for (i = 0; i < NPROTO; i++) {
+                        if (gifconf_list[i]) {
+                                int done;
+                                if (!pos)
+                                        done = gifconf_list[i](dev, NULL, 0);
+                                else
+                                        done = gifconf_list[i](dev, pos + total,
+                                                               len - total);
+                                if (done < 0)
+                                        return -EFAULT;
+                                total += done;
+                        }
+                }
+        }
+
+        /*
+         *      All done.  Write the updated control block back to the caller.
+         */
+        ifc.ifc_len = total;
+
+        /*
+         *      Both BSD and Solaris return 0 here, so we do too.
+         */
+        return copy_to_user(arg, &ifc, sizeof(struct ifconf)) ? -EFAULT : 0;
+}
+
+/*
+ *      Perform the SIOCxIFxxx calls, inside rcu_read_lock()
+ */
+static int dev_ifsioc_locked(struct net *net, struct ifreq *ifr, unsigned int cmd)
+{
+        int err;
+        struct net_device *dev = dev_get_by_name_rcu(net, ifr->ifr_name);
+
+        if (!dev)
+                return -ENODEV;
+
+        switch (cmd) {
+        case SIOCGIFFLAGS:      /* Get interface flags */
+                ifr->ifr_flags = (short) dev_get_flags(dev);
+                return 0;
+
+        case SIOCGIFMETRIC:     /* Get the metric on the interface
+                                   (currently unused) */
+                ifr->ifr_metric = 0;
+                return 0;
+
+        case SIOCGIFMTU:        /* Get the MTU of a device */
+                ifr->ifr_mtu = dev->mtu;
+                return 0;
+
+        case SIOCGIFHWADDR:
+                if (!dev->addr_len)
+                        memset(ifr->ifr_hwaddr.sa_data, 0, sizeof ifr->ifr_hwaddr.sa_data);
+                else
+                        memcpy(ifr->ifr_hwaddr.sa_data, dev->dev_addr,
+                               min(sizeof ifr->ifr_hwaddr.sa_data, (size_t) dev->addr_len));
+                ifr->ifr_hwaddr.sa_family = dev->type;
+                return 0;
+
+        case SIOCGIFSLAVE:
+                err = -EINVAL;
+                break;
+
+        case SIOCGIFMAP:
+                ifr->ifr_map.mem_start = dev->mem_start;
+                ifr->ifr_map.mem_end   = dev->mem_end;
+                ifr->ifr_map.base_addr = dev->base_addr;
+                ifr->ifr_map.irq       = dev->irq;
+                ifr->ifr_map.dma       = dev->dma;
+                ifr->ifr_map.port      = dev->if_port;
+                return 0;
+
+        case SIOCGIFINDEX:
+                ifr->ifr_ifindex = dev->ifindex;
+                return 0;
+
+        case SIOCGIFTXQLEN:
+                ifr->ifr_qlen = dev->tx_queue_len;
+                return 0;
+
+        default:
+                /* dev_ioctl() should ensure this case
+                 * is never reached
+                 */
+                WARN_ON(1);
+                err = -ENOTTY;
+                break;
+
+        }
+        return err;
+}
+
+static int net_hwtstamp_validate(struct ifreq *ifr)
+{
+        struct hwtstamp_config cfg;
+        enum hwtstamp_tx_types tx_type;
+        enum hwtstamp_rx_filters rx_filter;
+        int tx_type_valid = 0;
+        int rx_filter_valid = 0;
+
+        if (copy_from_user(&cfg, ifr->ifr_data, sizeof(cfg)))
+                return -EFAULT;
+
+        if (cfg.flags) /* reserved for future extensions */
+                return -EINVAL;
+
+        tx_type = cfg.tx_type;
+        rx_filter = cfg.rx_filter;
+
+        switch (tx_type) {
+        case HWTSTAMP_TX_OFF:
+        case HWTSTAMP_TX_ON:
+        case HWTSTAMP_TX_ONESTEP_SYNC:
+                tx_type_valid = 1;
+                break;
+        }
+
+        switch (rx_filter) {
+        case HWTSTAMP_FILTER_NONE:
+        case HWTSTAMP_FILTER_ALL:
+        case HWTSTAMP_FILTER_SOME:
+        case HWTSTAMP_FILTER_PTP_V1_L4_EVENT:
+        case HWTSTAMP_FILTER_PTP_V1_L4_SYNC:
+        case HWTSTAMP_FILTER_PTP_V1_L4_DELAY_REQ:
+        case HWTSTAMP_FILTER_PTP_V2_L4_EVENT:
+        case HWTSTAMP_FILTER_PTP_V2_L4_SYNC:
+        case HWTSTAMP_FILTER_PTP_V2_L4_DELAY_REQ:
+        case HWTSTAMP_FILTER_PTP_V2_L2_EVENT:
+        case HWTSTAMP_FILTER_PTP_V2_L2_SYNC:
+        case HWTSTAMP_FILTER_PTP_V2_L2_DELAY_REQ:
+        case HWTSTAMP_FILTER_PTP_V2_EVENT:
+        case HWTSTAMP_FILTER_PTP_V2_SYNC:
+        case HWTSTAMP_FILTER_PTP_V2_DELAY_REQ:
+                rx_filter_valid = 1;
+                break;
+        }
+
+        if (!tx_type_valid || !rx_filter_valid)
+                return -ERANGE;
+
+        return 0;
+}
+
+/*
+ *      Perform the SIOCxIFxxx calls, inside rtnl_lock()
+ */
+static int dev_ifsioc(struct net *net, struct ifreq *ifr, unsigned int cmd)
+{
+        int err;
+        struct net_device *dev = __dev_get_by_name(net, ifr->ifr_name);
+        const struct net_device_ops *ops;
+
+        if (!dev)
+                return -ENODEV;
+
+        ops = dev->netdev_ops;
+
+        switch (cmd) {
+        case SIOCSIFFLAGS:      /* Set interface flags */
+                return dev_change_flags(dev, ifr->ifr_flags);
+
+        case SIOCSIFMETRIC:     /* Set the metric on the interface
+                                   (currently unused) */
+                return -EOPNOTSUPP;
+
+        case SIOCSIFMTU:        /* Set the MTU of a device */
+                return dev_set_mtu(dev, ifr->ifr_mtu);
+
+        case SIOCSIFHWADDR:
+                return dev_set_mac_address(dev, &ifr->ifr_hwaddr);
+
+        case SIOCSIFHWBROADCAST:
+                if (ifr->ifr_hwaddr.sa_family != dev->type)
+                        return -EINVAL;
+                memcpy(dev->broadcast, ifr->ifr_hwaddr.sa_data,
+                       min(sizeof ifr->ifr_hwaddr.sa_data, (size_t) dev->addr_len));
+                call_netdevice_notifiers(NETDEV_CHANGEADDR, dev);
+                return 0;
+
+        case SIOCSIFMAP:
+                if (ops->ndo_set_config) {
+                        if (!netif_device_present(dev))
+                                return -ENODEV;
+                        return ops->ndo_set_config(dev, &ifr->ifr_map);
+                }
+                return -EOPNOTSUPP;
+
+        case SIOCADDMULTI:
+                if (!ops->ndo_set_rx_mode ||
+                    ifr->ifr_hwaddr.sa_family != AF_UNSPEC)
+                        return -EINVAL;
+                if (!netif_device_present(dev))
+                        return -ENODEV;
+                return dev_mc_add_global(dev, ifr->ifr_hwaddr.sa_data);
+
+        case SIOCDELMULTI:
+                if (!ops->ndo_set_rx_mode ||
+                    ifr->ifr_hwaddr.sa_family != AF_UNSPEC)
+                        return -EINVAL;
+                if (!netif_device_present(dev))
+                        return -ENODEV;
+                return dev_mc_del_global(dev, ifr->ifr_hwaddr.sa_data);
+
+        case SIOCSIFTXQLEN:
+                if (ifr->ifr_qlen < 0)
+                        return -EINVAL;
+                dev->tx_queue_len = ifr->ifr_qlen;
+                return 0;
+
+        case SIOCSIFNAME:
+                ifr->ifr_newname[IFNAMSIZ-1] = '\0';
+                return dev_change_name(dev, ifr->ifr_newname);
+
+        case SIOCSHWTSTAMP:
+                err = net_hwtstamp_validate(ifr);
+                if (err)
+                        return err;
+                /* fall through */
+
+        /*
+         *      Unknown or private ioctl
+         */
+        default:
+                if ((cmd >= SIOCDEVPRIVATE &&
+                    cmd <= SIOCDEVPRIVATE + 15) ||
+                    cmd == SIOCBONDENSLAVE ||
+                    cmd == SIOCBONDRELEASE ||
+                    cmd == SIOCBONDSETHWADDR ||
+                    cmd == SIOCBONDSLAVEINFOQUERY ||
+                    cmd == SIOCBONDINFOQUERY ||
+                    cmd == SIOCBONDCHANGEACTIVE ||
+                    cmd == SIOCGMIIPHY ||
+                    cmd == SIOCGMIIREG ||
+                    cmd == SIOCSMIIREG ||
+                    cmd == SIOCBRADDIF ||
+                    cmd == SIOCBRDELIF ||
+                    cmd == SIOCSHWTSTAMP ||
+                    cmd == SIOCWANDEV) {
+                        err = -EOPNOTSUPP;
+                        if (ops->ndo_do_ioctl) {
+                                if (netif_device_present(dev))
+                                        err = ops->ndo_do_ioctl(dev, ifr, cmd);
+                                else
+                                        err = -ENODEV;
+                        }
+                } else
+                        err = -EINVAL;
+
+        }
+        return err;
+}
+
+/**
+ *      dev_load        - load a network module
+ *      @net: the applicable net namespace
+ *      @name: name of interface
+ *
+ *      If a network interface is not present and the process has suitable
+ *      privileges this function loads the module. If module loading is not
+ *      available in this kernel then it becomes a nop.
+ */
+
+void dev_load(struct net *net, const char *name)
+{
+        struct net_device *dev;
+        int no_module;
+
+        rcu_read_lock();
+        dev = dev_get_by_name_rcu(net, name);
+        rcu_read_unlock();
+
+        no_module = !dev;
+        if (no_module && capable(CAP_NET_ADMIN))
+                no_module = request_module("netdev-%s", name);
+        if (no_module && capable(CAP_SYS_MODULE)) {
+                if (!request_module("%s", name))
+                        pr_warn("Loading kernel module for a network device with CAP_SYS_MODULE (deprecated).  Use CAP_NET_ADMIN and alias netdev-%s instead.\n",
+                                name);
+        }
+}
+EXPORT_SYMBOL(dev_load);
+
+/*
+ *      This function handles all "interface"-type I/O control requests. The actual
+ *      'doing' part of this is dev_ifsioc above.
+ */
+
+/**
+ *      dev_ioctl       -       network device ioctl
+ *      @net: the applicable net namespace
+ *      @cmd: command to issue
+ *      @arg: pointer to a struct ifreq in user space
+ *
+ *      Issue ioctl functions to devices. This is normally called by the
+ *      user space syscall interfaces but can sometimes be useful for
+ *      other purposes. The return value is the return from the syscall if
+ *      positive or a negative errno code on error.
+ */
+
+int dev_ioctl(struct net *net, unsigned int cmd, void __user *arg)
+{
+        struct ifreq ifr;
+        int ret;
+        char *colon;
+
+        /* One special case: SIOCGIFCONF takes ifconf argument
+           and requires shared lock, because it sleeps writing
+           to user space.
+         */
+
+        if (cmd == SIOCGIFCONF) {
+                rtnl_lock();
+                ret = dev_ifconf(net, (char __user *) arg);
+                rtnl_unlock();
+                return ret;
+        }
+        if (cmd == SIOCGIFNAME)
+                return dev_ifname(net, (struct ifreq __user *)arg);
+
+        if (copy_from_user(&ifr, arg, sizeof(struct ifreq)))
+                return -EFAULT;
+
+        ifr.ifr_name[IFNAMSIZ-1] = 0;
+
+        colon = strchr(ifr.ifr_name, ':');
+        if (colon)
+                *colon = 0;
+
+        /*
+         *      See which interface the caller is talking about.
+         */
+
+        switch (cmd) {
+        /*
+         *      These ioctl calls:
+         *      - can be done by all.
+         *      - atomic and do not require locking.
+         *      - return a value
+         */
+        case SIOCGIFFLAGS:
+        case SIOCGIFMETRIC:
+        case SIOCGIFMTU:
+        case SIOCGIFHWADDR:
+        case SIOCGIFSLAVE:
+        case SIOCGIFMAP:
+        case SIOCGIFINDEX:
+        case SIOCGIFTXQLEN:
+                dev_load(net, ifr.ifr_name);
+                rcu_read_lock();
+                ret = dev_ifsioc_locked(net, &ifr, cmd);
+                rcu_read_unlock();
+                if (!ret) {
+                        if (colon)
+                                *colon = ':';
+                        if (copy_to_user(arg, &ifr,
+                                         sizeof(struct ifreq)))
+                                ret = -EFAULT;
+                }
+                return ret;
+
+        case SIOCETHTOOL:
+                dev_load(net, ifr.ifr_name);
+                rtnl_lock();
+                ret = dev_ethtool(net, &ifr);
+                rtnl_unlock();
+                if (!ret) {
+                        if (colon)
+                                *colon = ':';
+                        if (copy_to_user(arg, &ifr,
+                                         sizeof(struct ifreq)))
+                                ret = -EFAULT;
+                }
+                return ret;
+
+        /*
+         *      These ioctl calls:
+         *      - require superuser power.
+         *      - require strict serialization.
+         *      - return a value
+         */
+        case SIOCGMIIPHY:
+        case SIOCGMIIREG:
+        case SIOCSIFNAME:
+                if (!ns_capable(net->user_ns, CAP_NET_ADMIN))
+                        return -EPERM;
+                dev_load(net, ifr.ifr_name);
+                rtnl_lock();
+                ret = dev_ifsioc(net, &ifr, cmd);
+                rtnl_unlock();
+                if (!ret) {
+                        if (colon)
+                                *colon = ':';
+                        if (copy_to_user(arg, &ifr,
+                                         sizeof(struct ifreq)))
+                                ret = -EFAULT;
+                }
+                return ret;
+
+        /*
+         *      These ioctl calls:
+         *      - require superuser power.
+         *      - require strict serialization.
+         *      - do not return a value
+         */
+        case SIOCSIFMAP:
+        case SIOCSIFTXQLEN:
+                if (!capable(CAP_NET_ADMIN))
+                        return -EPERM;
+                /* fall through */
+        /*
+         *      These ioctl calls:
+         *      - require local superuser power.
+         *      - require strict serialization.
+         *      - do not return a value
+         */
+        case SIOCSIFFLAGS:
+        case SIOCSIFMETRIC:
+        case SIOCSIFMTU:
+        case SIOCSIFHWADDR:
+        case SIOCSIFSLAVE:
+        case SIOCADDMULTI:
+        case SIOCDELMULTI:
+        case SIOCSIFHWBROADCAST:
+        case SIOCSMIIREG:
+        case SIOCBONDENSLAVE:
+        case SIOCBONDRELEASE:
+        case SIOCBONDSETHWADDR:
+        case SIOCBONDCHANGEACTIVE:
+        case SIOCBRADDIF:
+        case SIOCBRDELIF:
+        case SIOCSHWTSTAMP:
+                if (!ns_capable(net->user_ns, CAP_NET_ADMIN))
+                        return -EPERM;
+                /* fall through */
+        case SIOCBONDSLAVEINFOQUERY:
+        case SIOCBONDINFOQUERY:
+                dev_load(net, ifr.ifr_name);
+                rtnl_lock();
+                ret = dev_ifsioc(net, &ifr, cmd);
+                rtnl_unlock();
+                return ret;
+
+        case SIOCGIFMEM:
+                /* Get the per device memory space. We can add this but
+                 * currently do not support it */
+        case SIOCSIFMEM:
+                /* Set the per device memory buffer space.
+                 * Not applicable in our case */
+        case SIOCSIFLINK:
+                return -ENOTTY;
+
+        /*
+         *      Unknown or private ioctl.
+         */
+        default:
+                if (cmd == SIOCWANDEV ||
+                    (cmd >= SIOCDEVPRIVATE &&
+                     cmd <= SIOCDEVPRIVATE + 15)) {
+                        dev_load(net, ifr.ifr_name);
+                        rtnl_lock();
+                        ret = dev_ifsioc(net, &ifr, cmd);
+                        rtnl_unlock();
+                        if (!ret && copy_to_user(arg, &ifr,
+                                                 sizeof(struct ifreq)))
+                                ret = -EFAULT;
+                        return ret;
+                }
+                /* Take care of Wireless Extensions */
+                if (cmd >= SIOCIWFIRST && cmd <= SIOCIWLAST)
+                        return wext_handle_ioctl(net, &ifr, cmd, arg);
+                return -ENOTTY;
+        }
+}
diff --git a/net/core/ethtool.c b/net/core/ethtool.c
index d9d55209db67..3e9b2c3e30f0 100644
--- a/net/core/ethtool.c
+++ b/net/core/ethtool.c
@@ -77,6 +77,7 @@ static const char netdev_features_strings[NETDEV_FEATURE_COUNT][ETH_GSTRING_LEN]
         [NETIF_F_TSO_ECN_BIT] =          "tx-tcp-ecn-segmentation",
         [NETIF_F_TSO6_BIT] =             "tx-tcp6-segmentation",
         [NETIF_F_FSO_BIT] =              "tx-fcoe-segmentation",
+        [NETIF_F_GSO_GRE_BIT] =          "tx-gre-segmentation",
 
         [NETIF_F_FCOE_CRC_BIT] =         "tx-checksum-fcoe-crc",
         [NETIF_F_SCTP_CSUM_BIT] =        "tx-checksum-sctp",
diff --git a/net/core/netpoll.c b/net/core/netpoll.c
index 331ccb90f915..fa32899006a2 100644
--- a/net/core/netpoll.c
+++ b/net/core/netpoll.c
@@ -47,6 +47,8 @@ static struct sk_buff_head skb_pool;
 
 static atomic_t trapped;
 
+static struct srcu_struct netpoll_srcu;
+
 #define USEC_PER_POLL   50
 #define NETPOLL_RX_ENABLED  1
 #define NETPOLL_RX_DROP     2
@@ -59,6 +61,7 @@ static atomic_t trapped;
 
 static void zap_completion_queue(void);
 static void netpoll_neigh_reply(struct sk_buff *skb, struct netpoll_info *npinfo);
+static void netpoll_async_cleanup(struct work_struct *work);
 
 static unsigned int carrier_timeout = 4;
 module_param(carrier_timeout, uint, 0644);
@@ -199,18 +202,31 @@ static void netpoll_poll_dev(struct net_device *dev)
         const struct net_device_ops *ops;
         struct netpoll_info *ni = rcu_dereference_bh(dev->npinfo);
 
-        if (!dev || !netif_running(dev))
+        /* Don't do any rx activity if the dev_lock mutex is held
+         * the dev_open/close paths use this to block netpoll activity
+         * while changing device state
+         */
+        if (!mutex_trylock(&ni->dev_lock))
                 return;
 
+        if (!netif_running(dev)) {
+                mutex_unlock(&ni->dev_lock);
+                return;
+        }
+
         ops = dev->netdev_ops;
-        if (!ops->ndo_poll_controller)
+        if (!ops->ndo_poll_controller) {
+                mutex_unlock(&ni->dev_lock);
                 return;
+        }
 
         /* Process pending work on NIC */
         ops->ndo_poll_controller(dev);
 
         poll_napi(dev);
 
+        mutex_unlock(&ni->dev_lock);
+
         if (dev->flags & IFF_SLAVE) {
                 if (ni) {
                         struct net_device *bond_dev;
@@ -231,6 +247,31 @@ static void netpoll_poll_dev(struct net_device *dev)
         zap_completion_queue();
 }
 
+int netpoll_rx_disable(struct net_device *dev)
+{
+        struct netpoll_info *ni;
+        int idx;
+        might_sleep();
+        idx = srcu_read_lock(&netpoll_srcu);
+        ni = srcu_dereference(dev->npinfo, &netpoll_srcu);
+        if (ni)
+                mutex_lock(&ni->dev_lock);
+        srcu_read_unlock(&netpoll_srcu, idx);
+        return 0;
+}
+EXPORT_SYMBOL(netpoll_rx_disable);
+
+void netpoll_rx_enable(struct net_device *dev)
+{
+        struct netpoll_info *ni;
+        rcu_read_lock();
+        ni = rcu_dereference(dev->npinfo);
+        if (ni)
+                mutex_unlock(&ni->dev_lock);
+        rcu_read_unlock();
+}
+EXPORT_SYMBOL(netpoll_rx_enable);
+
 static void refill_skbs(void)
 {
         struct sk_buff *skb;
@@ -666,7 +707,7 @@ static void netpoll_neigh_reply(struct sk_buff *skb, struct netpoll_info *npinfo
                         icmp6h->icmp6_type = NDISC_NEIGHBOUR_ADVERTISEMENT;
                         icmp6h->icmp6_router = 0;
                         icmp6h->icmp6_solicited = 1;
-                        target = (struct in6_addr *)skb_transport_header(send_skb) + sizeof(struct icmp6hdr);
+                        target = (struct in6_addr *)(skb_transport_header(send_skb) + sizeof(struct icmp6hdr));
                         *target = msg->target;
                         icmp6h->icmp6_cksum = csum_ipv6_magic(saddr, daddr, size,
                                                               IPPROTO_ICMPV6,
@@ -984,6 +1025,7 @@ int __netpoll_setup(struct netpoll *np, struct net_device *ndev, gfp_t gfp)
 
         np->dev = ndev;
         strlcpy(np->dev_name, ndev->name, IFNAMSIZ);
+        INIT_WORK(&np->cleanup_work, netpoll_async_cleanup);
 
         if ((ndev->priv_flags & IFF_DISABLE_NETPOLL) ||
             !ndev->netdev_ops->ndo_poll_controller) {
@@ -1004,6 +1046,7 @@ int __netpoll_setup(struct netpoll *np, struct net_device *ndev, gfp_t gfp)
                 INIT_LIST_HEAD(&npinfo->rx_np);
 
                 spin_lock_init(&npinfo->rx_lock);
+                mutex_init(&npinfo->dev_lock);
                 skb_queue_head_init(&npinfo->neigh_tx);
                 skb_queue_head_init(&npinfo->txq);
                 INIT_DELAYED_WORK(&npinfo->tx_work, queue_process);
@@ -1017,7 +1060,7 @@ int __netpoll_setup(struct netpoll *np, struct net_device *ndev, gfp_t gfp)
                                 goto free_npinfo;
                 }
         } else {
-                npinfo = ndev->npinfo;
+                npinfo = rtnl_dereference(ndev->npinfo);
                 atomic_inc(&npinfo->refcnt);
         }
 
@@ -1169,6 +1212,7 @@ EXPORT_SYMBOL(netpoll_setup);
 static int __init netpoll_init(void)
 {
         skb_queue_head_init(&skb_pool);
+        init_srcu_struct(&netpoll_srcu);
         return 0;
 }
 core_initcall(netpoll_init);
@@ -1196,7 +1240,11 @@ void __netpoll_cleanup(struct netpoll *np)
         struct netpoll_info *npinfo;
         unsigned long flags;
 
-        npinfo = np->dev->npinfo;
+        /* rtnl_dereference would be preferable here but
+         * rcu_cleanup_netpoll path can put us in here safely without
+         * holding the rtnl, so plain rcu_dereference it is
+         */
+        npinfo = rtnl_dereference(np->dev->npinfo);
         if (!npinfo)
                 return;
 
@@ -1208,6 +1256,8 @@ void __netpoll_cleanup(struct netpoll *np)
                 spin_unlock_irqrestore(&npinfo->rx_lock, flags);
         }
 
+        synchronize_srcu(&netpoll_srcu);
+
         if (atomic_dec_and_test(&npinfo->refcnt)) {
                 const struct net_device_ops *ops;
 
@@ -1215,25 +1265,27 @@ void __netpoll_cleanup(struct netpoll *np)
                 if (ops->ndo_netpoll_cleanup)
                         ops->ndo_netpoll_cleanup(np->dev);
 
-                RCU_INIT_POINTER(np->dev->npinfo, NULL);
+                rcu_assign_pointer(np->dev->npinfo, NULL);
                 call_rcu_bh(&npinfo->rcu, rcu_cleanup_netpoll_info);
         }
 }
 EXPORT_SYMBOL_GPL(__netpoll_cleanup);
 
-static void rcu_cleanup_netpoll(struct rcu_head *rcu_head)
+static void netpoll_async_cleanup(struct work_struct *work)
 {
-        struct netpoll *np = container_of(rcu_head, struct netpoll, rcu);
+        struct netpoll *np = container_of(work, struct netpoll, cleanup_work);
 
+        rtnl_lock();
         __netpoll_cleanup(np);
+        rtnl_unlock();
         kfree(np);
 }
 
-void __netpoll_free_rcu(struct netpoll *np)
+void __netpoll_free_async(struct netpoll *np)
 {
-        call_rcu_bh(&np->rcu, rcu_cleanup_netpoll);
+        schedule_work(&np->cleanup_work);
 }
-EXPORT_SYMBOL_GPL(__netpoll_free_rcu);
+EXPORT_SYMBOL_GPL(__netpoll_free_async);
 
 void netpoll_cleanup(struct netpoll *np)
 {
diff --git a/net/core/netprio_cgroup.c b/net/core/netprio_cgroup.c
index 5e67defe2cb0..0777d0aa18c3 100644
--- a/net/core/netprio_cgroup.c
+++ b/net/core/netprio_cgroup.c
@@ -69,10 +69,8 @@ static int extend_netdev_table(struct net_device *dev, u32 target_idx)
 
         /* allocate & copy */
         new = kzalloc(new_sz, GFP_KERNEL);
-        if (!new) {
-                pr_warn("Unable to alloc new priomap!\n");
+        if (!new)
                 return -ENOMEM;
-        }
 
         if (old)
                 memcpy(new->priomap, old->priomap,
diff --git a/net/core/pktgen.c b/net/core/pktgen.c
index 797769551b91..6048fc1da1c2 100644
--- a/net/core/pktgen.c
+++ b/net/core/pktgen.c
@@ -1790,10 +1790,13 @@ static ssize_t pktgen_thread_write(struct file *file,
                         return -EFAULT;
                 i += len;
                 mutex_lock(&pktgen_thread_lock);
-                pktgen_add_device(t, f);
+                ret = pktgen_add_device(t, f);
                 mutex_unlock(&pktgen_thread_lock);
-                ret = count;
-                sprintf(pg_result, "OK: add_device=%s", f);
+                if (!ret) {
+                        ret = count;
+                        sprintf(pg_result, "OK: add_device=%s", f);
+                } else
+                        sprintf(pg_result, "ERROR: can not add device %s", f);
                 goto out;
         }
 
@@ -3647,7 +3650,7 @@ static int __net_init pg_net_init(struct net *net)
 remove_entry:
         remove_proc_entry(PGCTRL, pn->proc_dir);
 remove:
-        proc_net_remove(pn->net, PG_PROC_DIR);
+        remove_proc_entry(PG_PROC_DIR, pn->net->proc_net);
         return ret;
 }
 
@@ -3673,7 +3676,7 @@ static void __net_exit pg_net_exit(struct net *net)
         }
 
         remove_proc_entry(PGCTRL, pn->proc_dir);
-        proc_net_remove(pn->net, PG_PROC_DIR);
+        remove_proc_entry(PG_PROC_DIR, pn->net->proc_net);
 }
 
 static struct pernet_operations pg_net_ops = {
diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
index c1e4db60eeca..d8aa20f6a46e 100644
--- a/net/core/rtnetlink.c
+++ b/net/core/rtnetlink.c
@@ -2119,13 +2119,17 @@ static int rtnl_fdb_del(struct sk_buff *skb, struct nlmsghdr *nlh, void *arg)
 {
         struct net *net = sock_net(skb->sk);
         struct ndmsg *ndm;
-        struct nlattr *llattr;
+        struct nlattr *tb[NDA_MAX+1];
         struct net_device *dev;
         int err = -EINVAL;
         __u8 *addr;
 
-        if (nlmsg_len(nlh) < sizeof(*ndm))
-                return -EINVAL;
+        if (!capable(CAP_NET_ADMIN))
+                return -EPERM;
+
+        err = nlmsg_parse(nlh, sizeof(*ndm), tb, NDA_MAX, NULL);
+        if (err < 0)
+                return err;
 
         ndm = nlmsg_data(nlh);
         if (ndm->ndm_ifindex == 0) {
@@ -2139,13 +2143,17 @@ static int rtnl_fdb_del(struct sk_buff *skb, struct nlmsghdr *nlh, void *arg)
                 return -ENODEV;
         }
 
-        llattr = nlmsg_find_attr(nlh, sizeof(*ndm), NDA_LLADDR);
-        if (llattr == NULL || nla_len(llattr) != ETH_ALEN) {
-                pr_info("PF_BRIGDE: RTM_DELNEIGH with invalid address\n");
+        if (!tb[NDA_LLADDR] || nla_len(tb[NDA_LLADDR]) != ETH_ALEN) {
+                pr_info("PF_BRIDGE: RTM_DELNEIGH with invalid address\n");
+                return -EINVAL;
+        }
+
+        addr = nla_data(tb[NDA_LLADDR]);
+        if (!is_valid_ether_addr(addr)) {
+                pr_info("PF_BRIDGE: RTM_DELNEIGH with invalid ether address\n");
                 return -EINVAL;
         }
 
-        addr = nla_data(llattr);
         err = -EOPNOTSUPP;
 
         /* Support fdb on master device the net/bridge default case */
@@ -2155,7 +2163,7 @@ static int rtnl_fdb_del(struct sk_buff *skb, struct nlmsghdr *nlh, void *arg)
                 const struct net_device_ops *ops = br_dev->netdev_ops;
 
                 if (ops->ndo_fdb_del)
-                        err = ops->ndo_fdb_del(ndm, dev, addr);
+                        err = ops->ndo_fdb_del(ndm, tb, dev, addr);
 
                 if (err)
                         goto out;
@@ -2165,7 +2173,7 @@ static int rtnl_fdb_del(struct sk_buff *skb, struct nlmsghdr *nlh, void *arg)
 
         /* Embedded bridge, macvlan, and any other device support */
         if ((ndm->ndm_flags & NTF_SELF) && dev->netdev_ops->ndo_fdb_del) {
-                err = dev->netdev_ops->ndo_fdb_del(ndm, dev, addr);
+                err = dev->netdev_ops->ndo_fdb_del(ndm, tb, dev, addr);
 
                 if (!err) {
                         rtnl_fdb_notify(dev, addr, RTM_DELNEIGH);
@@ -2315,6 +2323,13 @@ static int rtnl_bridge_getlink(struct sk_buff *skb, struct netlink_callback *cb)
         int idx = 0;
         u32 portid = NETLINK_CB(cb->skb).portid;
         u32 seq = cb->nlh->nlmsg_seq;
+        struct nlattr *extfilt;
+        u32 filter_mask = 0;
+
+        extfilt = nlmsg_find_attr(cb->nlh, sizeof(struct rtgenmsg),
+                                  IFLA_EXT_MASK);
+        if (extfilt)
+                filter_mask = nla_get_u32(extfilt);
 
         rcu_read_lock();
         for_each_netdev_rcu(net, dev) {
@@ -2324,14 +2339,15 @@ static int rtnl_bridge_getlink(struct sk_buff *skb, struct netlink_callback *cb)
                 if (br_dev && br_dev->netdev_ops->ndo_bridge_getlink) {
                         if (idx >= cb->args[0] &&
                             br_dev->netdev_ops->ndo_bridge_getlink(
-                                    skb, portid, seq, dev) < 0)
+                                    skb, portid, seq, dev, filter_mask) < 0)
                                 break;
                         idx++;
                 }
 
                 if (ops->ndo_bridge_getlink) {
                         if (idx >= cb->args[0] &&
-                            ops->ndo_bridge_getlink(skb, portid, seq, dev) < 0)
+                            ops->ndo_bridge_getlink(skb, portid, seq, dev,
+                                                    filter_mask) < 0)
                                 break;
                         idx++;
                 }
@@ -2372,14 +2388,14 @@ static int rtnl_bridge_notify(struct net_device *dev, u16 flags)
 
         if ((!flags || (flags & BRIDGE_FLAGS_MASTER)) &&
             br_dev && br_dev->netdev_ops->ndo_bridge_getlink) {
-                err = br_dev->netdev_ops->ndo_bridge_getlink(skb, 0, 0, dev);
+                err = br_dev->netdev_ops->ndo_bridge_getlink(skb, 0, 0, dev, 0);
                 if (err < 0)
                         goto errout;
         }
 
         if ((flags & BRIDGE_FLAGS_SELF) &&
             dev->netdev_ops->ndo_bridge_getlink) {
-                err = dev->netdev_ops->ndo_bridge_getlink(skb, 0, 0, dev);
+                err = dev->netdev_ops->ndo_bridge_getlink(skb, 0, 0, dev, 0);
                 if (err < 0)
                         goto errout;
         }
@@ -2464,6 +2480,77 @@ out:
         return err;
 }
 
+static int rtnl_bridge_dellink(struct sk_buff *skb, struct nlmsghdr *nlh,
+                               void *arg)
+{
+        struct net *net = sock_net(skb->sk);
+        struct ifinfomsg *ifm;
+        struct net_device *dev;
+        struct nlattr *br_spec, *attr = NULL;
+        int rem, err = -EOPNOTSUPP;
+        u16 oflags, flags = 0;
+        bool have_flags = false;
+
+        if (nlmsg_len(nlh) < sizeof(*ifm))
+                return -EINVAL;
+
+        ifm = nlmsg_data(nlh);
+        if (ifm->ifi_family != AF_BRIDGE)
+                return -EPFNOSUPPORT;
+
+        dev = __dev_get_by_index(net, ifm->ifi_index);
+        if (!dev) {
+                pr_info("PF_BRIDGE: RTM_SETLINK with unknown ifindex\n");
+                return -ENODEV;
+        }
+
+        br_spec = nlmsg_find_attr(nlh, sizeof(struct ifinfomsg), IFLA_AF_SPEC);
+        if (br_spec) {
+                nla_for_each_nested(attr, br_spec, rem) {
+                        if (nla_type(attr) == IFLA_BRIDGE_FLAGS) {
+                                have_flags = true;
+                                flags = nla_get_u16(attr);
+                                break;
+                        }
+                }
+        }
+
+        oflags = flags;
+
+        if (!flags || (flags & BRIDGE_FLAGS_MASTER)) {
+                struct net_device *br_dev = netdev_master_upper_dev_get(dev);
+
+                if (!br_dev || !br_dev->netdev_ops->ndo_bridge_dellink) {
+                        err = -EOPNOTSUPP;
+                        goto out;
+                }
+
+                err = br_dev->netdev_ops->ndo_bridge_dellink(dev, nlh);
+                if (err)
+                        goto out;
+
+                flags &= ~BRIDGE_FLAGS_MASTER;
+        }
+
+        if ((flags & BRIDGE_FLAGS_SELF)) {
+                if (!dev->netdev_ops->ndo_bridge_dellink)
+                        err = -EOPNOTSUPP;
+                else
+                        err = dev->netdev_ops->ndo_bridge_dellink(dev, nlh);
+
+                if (!err)
+                        flags &= ~BRIDGE_FLAGS_SELF;
+        }
+
+        if (have_flags)
+                memcpy(nla_data(attr), &flags, sizeof(flags));
+        /* Generate event to notify upper layer of bridge change */
+        if (!err)
+                err = rtnl_bridge_notify(dev, oflags);
+out:
+        return err;
+}
+
 /* Protected by RTNL sempahore.  */
 static struct rtattr **rta_buf;
 static int rtattr_max;
@@ -2647,6 +2734,7 @@ void __init rtnetlink_init(void)
         rtnl_register(PF_BRIDGE, RTM_GETNEIGH, NULL, rtnl_fdb_dump, NULL);
 
         rtnl_register(PF_BRIDGE, RTM_GETLINK, NULL, rtnl_bridge_getlink, NULL);
+        rtnl_register(PF_BRIDGE, RTM_DELLINK, rtnl_bridge_dellink, NULL, NULL);
         rtnl_register(PF_BRIDGE, RTM_SETLINK, rtnl_bridge_setlink, NULL, NULL);
 }
 
diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index bddc1dd2e7f2..2a3ca33c30aa 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -104,47 +104,37 @@ static const struct pipe_buf_operations sock_pipe_buf_ops = {
         .get = sock_pipe_buf_get,
 };
 
-/*
- *      Keep out-of-line to prevent kernel bloat.
- *      __builtin_return_address is not used because it is not always
- *      reliable.
- */
-
 /**
- *      skb_over_panic  -       private function
- *      @skb: buffer
- *      @sz: size
- *      @here: address
- *
- *      Out of line support code for skb_put(). Not user callable.
+ *      skb_panic - private function for out-of-line support
+ *      @skb:   buffer
+ *      @sz:    size
+ *      @addr:  address
+ *      @msg:   skb_over_panic or skb_under_panic
+ *
+ *      Out-of-line support for skb_put() and skb_push().
+ *      Called via the wrapper skb_over_panic() or skb_under_panic().
+ *      Keep out of line to prevent kernel bloat.
+ *      __builtin_return_address is not used because it is not always reliable.
  */
-static void skb_over_panic(struct sk_buff *skb, int sz, void *here)
+static void skb_panic(struct sk_buff *skb, unsigned int sz, void *addr,
+                      const char msg[])
 {
         pr_emerg("%s: text:%p len:%d put:%d head:%p data:%p tail:%#lx end:%#lx dev:%s\n",
-                 __func__, here, skb->len, sz, skb->head, skb->data,
+                 msg, addr, skb->len, sz, skb->head, skb->data,
                  (unsigned long)skb->tail, (unsigned long)skb->end,
                  skb->dev ? skb->dev->name : "<NULL>");
         BUG();
 }
 
-/**
- *      skb_under_panic -       private function
- *      @skb: buffer
- *      @sz: size
- *      @here: address
- *
- *      Out of line support code for skb_push(). Not user callable.
- */
-
-static void skb_under_panic(struct sk_buff *skb, int sz, void *here)
+static void skb_over_panic(struct sk_buff *skb, unsigned int sz, void *addr)
 {
-        pr_emerg("%s: text:%p len:%d put:%d head:%p data:%p tail:%#lx end:%#lx dev:%s\n",
-                 __func__, here, skb->len, sz, skb->head, skb->data,
-                 (unsigned long)skb->tail, (unsigned long)skb->end,
-                 skb->dev ? skb->dev->name : "<NULL>");
-        BUG();
+        skb_panic(skb, sz, addr, __func__);
 }
 
+static void skb_under_panic(struct sk_buff *skb, unsigned int sz, void *addr)
+{
+        skb_panic(skb, sz, addr, __func__);
+}
 
 /*
  * kmalloc_reserve is a wrapper around kmalloc_node_track_caller that tells
@@ -351,10 +341,6 @@ struct netdev_alloc_cache {
 };
 static DEFINE_PER_CPU(struct netdev_alloc_cache, netdev_alloc_cache);
 
-#define NETDEV_FRAG_PAGE_MAX_ORDER get_order(32768)
-#define NETDEV_FRAG_PAGE_MAX_SIZE  (PAGE_SIZE << NETDEV_FRAG_PAGE_MAX_ORDER)
-#define NETDEV_PAGECNT_MAX_BIAS    NETDEV_FRAG_PAGE_MAX_SIZE
-
 static void *__netdev_alloc_frag(unsigned int fragsz, gfp_t gfp_mask)
 {
         struct netdev_alloc_cache *nc;
@@ -686,7 +672,7 @@ static void __copy_skb_header(struct sk_buff *new, const struct sk_buff *old)
         new->network_header     = old->network_header;
         new->mac_header         = old->mac_header;
         new->inner_transport_header = old->inner_transport_header;
-        new->inner_network_header = old->inner_transport_header;
+        new->inner_network_header = old->inner_network_header;
         skb_dst_copy(new, old);
         new->rxhash             = old->rxhash;
         new->ooo_okay           = old->ooo_okay;
@@ -2340,8 +2326,7 @@ void skb_split(struct sk_buff *skb, struct sk_buff *skb1, const u32 len)
 {
         int pos = skb_headlen(skb);
 
-        skb_shinfo(skb1)->gso_type = skb_shinfo(skb)->gso_type;
-
+        skb_shinfo(skb)->tx_flags = skb_shinfo(skb1)->tx_flags & SKBTX_SHARED_FRAG;
         if (len < pos)  /* Split line is inside header. */
                 skb_split_inside_header(skb, skb1, len, pos);
         else            /* Second chunk has no header, nothing to copy. */
@@ -2753,6 +2738,7 @@ struct sk_buff *skb_segment(struct sk_buff *skb, netdev_features_t features)
         unsigned int mss = skb_shinfo(skb)->gso_size;
         unsigned int doffset = skb->data - skb_mac_header(skb);
         unsigned int offset = doffset;
+        unsigned int tnl_hlen = skb_tnl_header_len(skb);
         unsigned int headroom;
         unsigned int len;
         int sg = !!(features & NETIF_F_SG);
@@ -2829,7 +2815,10 @@ struct sk_buff *skb_segment(struct sk_buff *skb, netdev_features_t features)
                 skb_set_network_header(nskb, skb->mac_len);
                 nskb->transport_header = (nskb->network_header +
                                           skb_network_header_len(skb));
-                skb_copy_from_linear_data(skb, nskb->data, doffset);
+
+                skb_copy_from_linear_data_offset(skb, -tnl_hlen,
+                                                 nskb->data - tnl_hlen,
+                                                 doffset + tnl_hlen);
 
                 if (fskb != skb_shinfo(skb)->frag_list)
                         continue;
@@ -2847,7 +2836,7 @@ struct sk_buff *skb_segment(struct sk_buff *skb, netdev_features_t features)
                 skb_copy_from_linear_data_offset(skb, offset,
                                                  skb_put(nskb, hsize), hsize);
 
-                skb_shinfo(nskb)->gso_type = skb_shinfo(skb)->gso_type;
+                skb_shinfo(nskb)->tx_flags = skb_shinfo(skb)->tx_flags & SKBTX_SHARED_FRAG;
 
                 while (pos < offset + len && i < nfrags) {
                         *frag = skb_shinfo(skb)->frags[i];
diff --git a/net/core/sock.c b/net/core/sock.c
index f1e14e20d181..fe96c5d34299 100644
--- a/net/core/sock.c
+++ b/net/core/sock.c
@@ -2836,7 +2836,7 @@ static const struct file_operations proto_seq_fops = {
 
 static __net_init int proto_init_net(struct net *net)
 {
-        if (!proc_net_fops_create(net, "protocols", S_IRUGO, &proto_seq_fops))
+        if (!proc_create("protocols", S_IRUGO, net->proc_net, &proto_seq_fops))
                 return -ENOMEM;
 
         return 0;
@@ -2844,7 +2844,7 @@ static __net_init int proto_init_net(struct net *net)
 
 static __net_exit void proto_exit_net(struct net *net)
 {
-        proc_net_remove(net, "protocols");
+        remove_proc_entry("protocols", net->proc_net);
 }
 
 
diff --git a/net/dccp/probe.c b/net/dccp/probe.c
index 0a8d6ebd9b45..4c6bdf97a657 100644
--- a/net/dccp/probe.c
+++ b/net/dccp/probe.c
@@ -171,7 +171,7 @@ static __init int dccpprobe_init(void)
         spin_lock_init(&dccpw.lock);
         if (kfifo_alloc(&dccpw.fifo, bufsize, GFP_KERNEL))
                 return ret;
-        if (!proc_net_fops_create(&init_net, procname, S_IRUSR, &dccpprobe_fops))
+        if (!proc_create(procname, S_IRUSR, init_net.proc_net, &dccpprobe_fops))
                 goto err0;
 
         ret = setup_jprobe();
@@ -181,7 +181,7 @@ static __init int dccpprobe_init(void)
         pr_info("DCCP watch registered (port=%d)\n", port);
         return 0;
 err1:
-        proc_net_remove(&init_net, procname);
+        remove_proc_entry(procname, init_net.proc_net);
 err0:
         kfifo_free(&dccpw.fifo);
         return ret;
@@ -191,7 +191,7 @@ module_init(dccpprobe_init);
 static __exit void dccpprobe_exit(void)
 {
         kfifo_free(&dccpw.fifo);
-        proc_net_remove(&init_net, procname);
+        remove_proc_entry(procname, init_net.proc_net);
         unregister_jprobe(&dccp_send_probe);
 
 }
diff --git a/net/decnet/af_decnet.c b/net/decnet/af_decnet.c
index 64d9843f9e04..c4a2def5b7bd 100644
--- a/net/decnet/af_decnet.c
+++ b/net/decnet/af_decnet.c
@@ -2384,7 +2384,7 @@ static int __init decnet_init(void)
         dev_add_pack(&dn_dix_packet_type);
         register_netdevice_notifier(&dn_dev_notifier);
 
-        proc_net_fops_create(&init_net, "decnet", S_IRUGO, &dn_socket_seq_fops);
+        proc_create("decnet", S_IRUGO, init_net.proc_net, &dn_socket_seq_fops);
         dn_register_sysctl();
 out:
         return rc;
@@ -2413,7 +2413,7 @@ static void __exit decnet_exit(void)
         dn_neigh_cleanup();
         dn_fib_cleanup();
 
-        proc_net_remove(&init_net, "decnet");
+        remove_proc_entry("decnet", init_net.proc_net);
 
         proto_unregister(&dn_proto);
 
diff --git a/net/decnet/dn_dev.c b/net/decnet/dn_dev.c
index e47ba9fc4a0e..c8da116d84a4 100644
--- a/net/decnet/dn_dev.c
+++ b/net/decnet/dn_dev.c
@@ -1412,7 +1412,7 @@ void __init dn_dev_init(void)
         rtnl_register(PF_DECnet, RTM_DELADDR, dn_nl_deladdr, NULL, NULL);
         rtnl_register(PF_DECnet, RTM_GETADDR, NULL, dn_nl_dump_ifaddr, NULL);
 
-        proc_net_fops_create(&init_net, "decnet_dev", S_IRUGO, &dn_dev_seq_fops);
+        proc_create("decnet_dev", S_IRUGO, init_net.proc_net, &dn_dev_seq_fops);
 
 #ifdef CONFIG_SYSCTL
         {
@@ -1433,7 +1433,7 @@ void __exit dn_dev_cleanup(void)
         }
 #endif /* CONFIG_SYSCTL */
 
-        proc_net_remove(&init_net, "decnet_dev");
+        remove_proc_entry("decnet_dev", init_net.proc_net);
 
         dn_dev_devices_off();
 }
diff --git a/net/decnet/dn_neigh.c b/net/decnet/dn_neigh.c
index 3aede1b459fd..f8637f93d318 100644
--- a/net/decnet/dn_neigh.c
+++ b/net/decnet/dn_neigh.c
@@ -95,7 +95,7 @@ static u32 dn_neigh_hash(const void *pkey,
 
 struct neigh_table dn_neigh_table = {
         .family =                       PF_DECnet,
-        .entry_size =                   sizeof(struct dn_neigh),
+        .entry_size =                   NEIGH_ENTRY_SIZE(sizeof(struct dn_neigh)),
         .key_len =                      sizeof(__le16),
         .hash =                         dn_neigh_hash,
         .constructor =                  dn_neigh_construct,
@@ -590,11 +590,12 @@ static const struct file_operations dn_neigh_seq_fops = {
 void __init dn_neigh_init(void)
 {
         neigh_table_init(&dn_neigh_table);
-        proc_net_fops_create(&init_net, "decnet_neigh", S_IRUGO, &dn_neigh_seq_fops);
+        proc_create("decnet_neigh", S_IRUGO, init_net.proc_net,
+                    &dn_neigh_seq_fops);
 }
 
 void __exit dn_neigh_cleanup(void)
 {
-        proc_net_remove(&init_net, "decnet_neigh");
+        remove_proc_entry("decnet_neigh", init_net.proc_net);
         neigh_table_clear(&dn_neigh_table);
 }
diff --git a/net/decnet/dn_route.c b/net/decnet/dn_route.c
index 1550028fcd8e..5ac0e153ef83 100644
--- a/net/decnet/dn_route.c
+++ b/net/decnet/dn_route.c
@@ -1901,7 +1901,8 @@ void __init dn_route_init(void)
 
         dn_dst_ops.gc_thresh = (dn_rt_hash_mask + 1);
 
-        proc_net_fops_create(&init_net, "decnet_cache", S_IRUGO, &dn_rt_cache_seq_fops);
+        proc_create("decnet_cache", S_IRUGO, init_net.proc_net,
+                    &dn_rt_cache_seq_fops);
 
 #ifdef CONFIG_DECNET_ROUTER
         rtnl_register(PF_DECnet, RTM_GETROUTE, dn_cache_getroute,
@@ -1917,7 +1918,7 @@ void __exit dn_route_cleanup(void)
         del_timer(&dn_route_timer);
         dn_run_flush(0);
 
-        proc_net_remove(&init_net, "decnet_cache");
+        remove_proc_entry("decnet_cache", init_net.proc_net);
         dst_entries_destroy(&dn_dst_ops);
 }
 
diff --git a/net/ieee802154/6lowpan.c b/net/ieee802154/6lowpan.c
index 09cba81d2c4a..43b95ca61114 100644
--- a/net/ieee802154/6lowpan.c
+++ b/net/ieee802154/6lowpan.c
@@ -377,17 +377,14 @@ static int lowpan_header_create(struct sk_buff *skb,
         struct ipv6hdr *hdr;
         const u8 *saddr = _saddr;
         const u8 *daddr = _daddr;
-        u8 *head;
+        u8 head[100];
         struct ieee802154_addr sa, da;
 
+        /* TODO:
+         * if this package isn't ipv6 one, where should it be routed?
+         */
         if (type != ETH_P_IPV6)
                 return 0;
-                /* TODO:
-                 * if this package isn't ipv6 one, where should it be routed?
-                 */
-        head = kzalloc(100, GFP_KERNEL);
-        if (head == NULL)
-                return -ENOMEM;
 
         hdr = ipv6_hdr(skb);
         hc06_ptr = head + 2;
@@ -561,8 +558,6 @@ static int lowpan_header_create(struct sk_buff *skb,
         skb_pull(skb, sizeof(struct ipv6hdr));
         memcpy(skb_push(skb, hc06_ptr - head), head, hc06_ptr - head);
 
-        kfree(head);
-
         lowpan_raw_dump_table(__func__, "raw skb data dump", skb->data,
                                 skb->len);
 
@@ -1267,7 +1262,7 @@ static inline int __init lowpan_netlink_init(void)
         return rtnl_link_register(&lowpan_link_ops);
 }
 
-static inline void __init lowpan_netlink_fini(void)
+static inline void lowpan_netlink_fini(void)
 {
         rtnl_link_unregister(&lowpan_link_ops);
 }
diff --git a/net/ipv4/af_inet.c b/net/ipv4/af_inet.c
index 49ddca31c4da..e225a4e5b572 100644
--- a/net/ipv4/af_inet.c
+++ b/net/ipv4/af_inet.c
@@ -263,21 +263,6 @@ void build_ehash_secret(void)
 }
 EXPORT_SYMBOL(build_ehash_secret);
 
-static inline int inet_netns_ok(struct net *net, __u8 protocol)
-{
-        const struct net_protocol *ipprot;
-
-        if (net_eq(net, &init_net))
-                return 1;
-
-        ipprot = rcu_dereference(inet_protos[protocol]);
-        if (ipprot == NULL) {
-                /* raw IP is OK */
-                return 1;
-        }
-        return ipprot->netns_ok;
-}
-
 /*
  *      Create an inet socket.
  */
@@ -350,10 +335,6 @@ lookup_protocol:
             !ns_capable(net->user_ns, CAP_NET_RAW))
                 goto out_rcu_unlock;
 
-        err = -EAFNOSUPPORT;
-        if (!inet_netns_ok(net, protocol))
-                goto out_rcu_unlock;
-
         sock->ops = answer->ops;
         answer_prot = answer->prot;
         answer_no_check = answer->no_check;
@@ -1306,7 +1287,7 @@ static struct sk_buff *inet_gso_segment(struct sk_buff *skb,
                        SKB_GSO_UDP |
                        SKB_GSO_DODGY |
                        SKB_GSO_TCP_ECN |
-                       SKB_GSO_SHARED_FRAG |
+                       SKB_GSO_GRE |
                        0)))
                 goto out;
 
diff --git a/net/ipv4/ah4.c b/net/ipv4/ah4.c
index a69b4e4a02b5..2e7f1948216f 100644
--- a/net/ipv4/ah4.c
+++ b/net/ipv4/ah4.c
@@ -321,8 +321,7 @@ static int ah_input(struct xfrm_state *x, struct sk_buff *skb)
 
         /* We are going to _remove_ AH header to keep sockets happy,
          * so... Later this can change. */
-        if (skb_cloned(skb) &&
-            pskb_expand_head(skb, 0, 0, GFP_ATOMIC))
+        if (skb_unclone(skb, GFP_ATOMIC))
                 goto out;
 
         skb->ip_summed = CHECKSUM_NONE;
diff --git a/net/ipv4/arp.c b/net/ipv4/arp.c
index 9547a273b9e9..fea4929f6200 100644
--- a/net/ipv4/arp.c
+++ b/net/ipv4/arp.c
@@ -928,24 +928,25 @@ static void parp_redo(struct sk_buff *skb)
 static int arp_rcv(struct sk_buff *skb, struct net_device *dev,
                    struct packet_type *pt, struct net_device *orig_dev)
 {
-        struct arphdr *arp;
+        const struct arphdr *arp;
+
+        if (dev->flags & IFF_NOARP ||
+            skb->pkt_type == PACKET_OTHERHOST ||
+            skb->pkt_type == PACKET_LOOPBACK)
+                goto freeskb;
+
+        skb = skb_share_check(skb, GFP_ATOMIC);
+        if (!skb)
+                goto out_of_mem;
 
         /* ARP header, plus 2 device addresses, plus 2 IP addresses.  */
         if (!pskb_may_pull(skb, arp_hdr_len(dev)))
                 goto freeskb;
 
         arp = arp_hdr(skb);
-        if (arp->ar_hln != dev->addr_len ||
-            dev->flags & IFF_NOARP ||
-            skb->pkt_type == PACKET_OTHERHOST ||
-            skb->pkt_type == PACKET_LOOPBACK ||
-            arp->ar_pln != 4)
+        if (arp->ar_hln != dev->addr_len || arp->ar_pln != 4)
                 goto freeskb;
 
-        skb = skb_share_check(skb, GFP_ATOMIC);
-        if (skb == NULL)
-                goto out_of_mem;
-
         memset(NEIGH_CB(skb), 0, sizeof(struct neighbour_cb));
 
         return NF_HOOK(NFPROTO_ARP, NF_ARP_IN, skb, dev, NULL, arp_process);
@@ -1404,14 +1405,14 @@ static const struct file_operations arp_seq_fops = {
 
 static int __net_init arp_net_init(struct net *net)
 {
-        if (!proc_net_fops_create(net, "arp", S_IRUGO, &arp_seq_fops))
+        if (!proc_create("arp", S_IRUGO, net->proc_net, &arp_seq_fops))
                 return -ENOMEM;
         return 0;
 }
 
 static void __net_exit arp_net_exit(struct net *net)
 {
-        proc_net_remove(net, "arp");
+        remove_proc_entry("arp", net->proc_net);
 }
 
 static struct pernet_operations arp_net_ops = {
diff --git a/net/ipv4/fib_trie.c b/net/ipv4/fib_trie.c
index 31d771ca9a70..61e03da3e1f5 100644
--- a/net/ipv4/fib_trie.c
+++ b/net/ipv4/fib_trie.c
@@ -2607,31 +2607,31 @@ static const struct file_operations fib_route_fops = {
 
 int __net_init fib_proc_init(struct net *net)
 {
-        if (!proc_net_fops_create(net, "fib_trie", S_IRUGO, &fib_trie_fops))
+        if (!proc_create("fib_trie", S_IRUGO, net->proc_net, &fib_trie_fops))
                 goto out1;
 
-        if (!proc_net_fops_create(net, "fib_triestat", S_IRUGO,
-                                  &fib_triestat_fops))
+        if (!proc_create("fib_triestat", S_IRUGO, net->proc_net,
+                         &fib_triestat_fops))
                 goto out2;
 
-        if (!proc_net_fops_create(net, "route", S_IRUGO, &fib_route_fops))
+        if (!proc_create("route", S_IRUGO, net->proc_net, &fib_route_fops))
                 goto out3;
 
         return 0;
 
 out3:
-        proc_net_remove(net, "fib_triestat");
+        remove_proc_entry("fib_triestat", net->proc_net);
 out2:
-        proc_net_remove(net, "fib_trie");
+        remove_proc_entry("fib_trie", net->proc_net);
 out1:
         return -ENOMEM;
 }
 
 void __net_exit fib_proc_exit(struct net *net)
 {
-        proc_net_remove(net, "fib_trie");
-        proc_net_remove(net, "fib_triestat");
-        proc_net_remove(net, "route");
+        remove_proc_entry("fib_trie", net->proc_net);
+        remove_proc_entry("fib_triestat", net->proc_net);
+        remove_proc_entry("route", net->proc_net);
 }
 
 #endif /* CONFIG_PROC_FS */
diff --git a/net/ipv4/gre.c b/net/ipv4/gre.c
index 42a491055c76..7a4c710c4cdd 100644
--- a/net/ipv4/gre.c
+++ b/net/ipv4/gre.c
@@ -19,6 +19,7 @@
 #include <linux/in.h>
 #include <linux/ip.h>
 #include <linux/netdevice.h>
+#include <linux/if_tunnel.h>
 #include <linux/spinlock.h>
 #include <net/protocol.h>
 #include <net/gre.h>
@@ -26,6 +27,11 @@
 
 static const struct gre_protocol __rcu *gre_proto[GREPROTO_MAX] __read_mostly;
 static DEFINE_SPINLOCK(gre_proto_lock);
+struct gre_base_hdr {
+        __be16 flags;
+        __be16 protocol;
+};
+#define GRE_HEADER_SECTION 4
 
 int gre_add_protocol(const struct gre_protocol *proto, u8 version)
 {
@@ -112,12 +118,117 @@ static void gre_err(struct sk_buff *skb, u32 info)
         rcu_read_unlock();
 }
 
+static struct sk_buff *gre_gso_segment(struct sk_buff *skb,
+                                       netdev_features_t features)
+{
+        struct sk_buff *segs = ERR_PTR(-EINVAL);
+        netdev_features_t enc_features;
+        int ghl = GRE_HEADER_SECTION;
+        struct gre_base_hdr *greh;
+        int mac_len = skb->mac_len;
+        int tnl_hlen;
+        bool csum;
+
+        if (unlikely(skb_shinfo(skb)->gso_type &
+                                ~(SKB_GSO_TCPV4 |
+                                  SKB_GSO_TCPV6 |
+                                  SKB_GSO_UDP |
+                                  SKB_GSO_DODGY |
+                                  SKB_GSO_TCP_ECN |
+                                  SKB_GSO_GRE)))
+                goto out;
+
+        if (unlikely(!pskb_may_pull(skb, sizeof(*greh))))
+                goto out;
+
+        greh = (struct gre_base_hdr *)skb_transport_header(skb);
+
+        if (greh->flags & GRE_KEY)
+                ghl += GRE_HEADER_SECTION;
+        if (greh->flags & GRE_SEQ)
+                ghl += GRE_HEADER_SECTION;
+        if (greh->flags & GRE_CSUM) {
+                ghl += GRE_HEADER_SECTION;
+                csum = true;
+        } else
+                csum = false;
+
+        /* setup inner skb. */
+        if (greh->protocol == htons(ETH_P_TEB)) {
+                struct ethhdr *eth = eth_hdr(skb);
+                skb->protocol = eth->h_proto;
+        } else {
+                skb->protocol = greh->protocol;
+        }
+
+        skb->encapsulation = 0;
+
+        if (unlikely(!pskb_may_pull(skb, ghl)))
+                goto out;
+        __skb_pull(skb, ghl);
+        skb_reset_mac_header(skb);
+        skb_set_network_header(skb, skb_inner_network_offset(skb));
+        skb->mac_len = skb_inner_network_offset(skb);
+
+        /* segment inner packet. */
+        enc_features = skb->dev->hw_enc_features & netif_skb_features(skb);
+        segs = skb_mac_gso_segment(skb, enc_features);
+        if (!segs || IS_ERR(segs))
+                goto out;
+
+        skb = segs;
+        tnl_hlen = skb_tnl_header_len(skb);
+        do {
+                __skb_push(skb, ghl);
+                if (csum) {
+                        __be32 *pcsum;
+
+                        if (skb_has_shared_frag(skb)) {
+                                int err;
+
+                                err = __skb_linearize(skb);
+                                if (err) {
+                                        kfree_skb(segs);
+                                        segs = ERR_PTR(err);
+                                        goto out;
+                                }
+                        }
+
+                        greh = (struct gre_base_hdr *)(skb->data);
+                        pcsum = (__be32 *)(greh + 1);
+                        *pcsum = 0;
+                        *(__sum16 *)pcsum = csum_fold(skb_checksum(skb, 0, skb->len, 0));
+                }
+                __skb_push(skb, tnl_hlen - ghl);
+
+                skb_reset_mac_header(skb);
+                skb_set_network_header(skb, mac_len);
+                skb->mac_len = mac_len;
+        } while ((skb = skb->next));
+out:
+        return segs;
+}
+
+static int gre_gso_send_check(struct sk_buff *skb)
+{
+        if (!skb->encapsulation)
+                return -EINVAL;
+        return 0;
+}
+
 static const struct net_protocol net_gre_protocol = {
         .handler     = gre_rcv,
         .err_handler = gre_err,
         .netns_ok    = 1,
 };
 
+static const struct net_offload gre_offload = {
+        .callbacks = {
+                .gso_send_check =       gre_gso_send_check,
+                .gso_segment    =       gre_gso_segment,
+        },
+};
+
 static int __init gre_init(void)
 {
         pr_info("GRE over IPv4 demultiplexor driver\n");
@@ -127,11 +238,18 @@ static int __init gre_init(void)
                 return -EAGAIN;
         }
 
+        if (inet_add_offload(&gre_offload, IPPROTO_GRE)) {
+                pr_err("can't add protocol offload\n");
+                inet_del_protocol(&net_gre_protocol, IPPROTO_GRE);
+                return -EAGAIN;
+        }
+
         return 0;
 }
 
 static void __exit gre_exit(void)
 {
+        inet_del_offload(&gre_offload, IPPROTO_GRE);
         inet_del_protocol(&net_gre_protocol, IPPROTO_GRE);
 }
 
diff --git a/net/ipv4/igmp.c b/net/ipv4/igmp.c
index 736ab70fd179..d8c232794bcb 100644
--- a/net/ipv4/igmp.c
+++ b/net/ipv4/igmp.c
@@ -2646,24 +2646,25 @@ static int __net_init igmp_net_init(struct net *net)
 {
         struct proc_dir_entry *pde;
 
-        pde = proc_net_fops_create(net, "igmp", S_IRUGO, &igmp_mc_seq_fops);
+        pde = proc_create("igmp", S_IRUGO, net->proc_net, &igmp_mc_seq_fops);
         if (!pde)
                 goto out_igmp;
-        pde = proc_net_fops_create(net, "mcfilter", S_IRUGO, &igmp_mcf_seq_fops);
+        pde = proc_create("mcfilter", S_IRUGO, net->proc_net,
+                          &igmp_mcf_seq_fops);
         if (!pde)
                 goto out_mcfilter;
         return 0;
 
 out_mcfilter:
-        proc_net_remove(net, "igmp");
+        remove_proc_entry("igmp", net->proc_net);
 out_igmp:
         return -ENOMEM;
 }
 
 static void __net_exit igmp_net_exit(struct net *net)
 {
-        proc_net_remove(net, "mcfilter");
-        proc_net_remove(net, "igmp");
+        remove_proc_entry("mcfilter", net->proc_net);
+        remove_proc_entry("igmp", net->proc_net);
 }
 
 static struct pernet_operations igmp_net_ops = {
diff --git a/net/ipv4/ip_fragment.c b/net/ipv4/ip_fragment.c
index 1211613c6c34..b6d30acb600c 100644
--- a/net/ipv4/ip_fragment.c
+++ b/net/ipv4/ip_fragment.c
@@ -590,7 +590,7 @@ static int ip_frag_reasm(struct ipq *qp, struct sk_buff *prev,
                 goto out_oversize;
 
         /* Head of list must not be cloned. */
-        if (skb_cloned(head) && pskb_expand_head(head, 0, 0, GFP_ATOMIC))
+        if (skb_unclone(head, GFP_ATOMIC))
                 goto out_nomem;
 
         /* If the first fragment is fragmented itself, we split
diff --git a/net/ipv4/ip_gre.c b/net/ipv4/ip_gre.c
index 00a14b9864ea..a56f1182c176 100644
--- a/net/ipv4/ip_gre.c
+++ b/net/ipv4/ip_gre.c
@@ -735,8 +735,33 @@ drop:
         return 0;
 }
 
+static struct sk_buff *handle_offloads(struct sk_buff *skb)
+{
+        int err;
+
+        if (skb_is_gso(skb)) {
+                err = skb_unclone(skb, GFP_ATOMIC);
+                if (unlikely(err))
+                        goto error;
+                skb_shinfo(skb)->gso_type |= SKB_GSO_GRE;
+                return skb;
+        } else if (skb->ip_summed == CHECKSUM_PARTIAL) {
+                err = skb_checksum_help(skb);
+                if (unlikely(err))
+                        goto error;
+        }
+        skb->ip_summed = CHECKSUM_NONE;
+
+        return skb;
+
+error:
+        kfree_skb(skb);
+        return ERR_PTR(err);
+}
+
 static netdev_tx_t ipgre_tunnel_xmit(struct sk_buff *skb, struct net_device *dev)
 {
+        struct pcpu_tstats *tstats = this_cpu_ptr(dev->tstats);
         struct ip_tunnel *tunnel = netdev_priv(dev);
         const struct iphdr  *old_iph;
         const struct iphdr  *tiph;
@@ -751,10 +776,19 @@ static netdev_tx_t ipgre_tunnel_xmit(struct sk_buff *skb, struct net_device *dev
         __be32 dst;
         int    mtu;
         u8     ttl;
+        int    err;
+        int    pkt_len;
 
-        if (skb->ip_summed == CHECKSUM_PARTIAL &&
-            skb_checksum_help(skb))
-                goto tx_error;
+        skb = handle_offloads(skb);
+        if (IS_ERR(skb)) {
+                dev->stats.tx_dropped++;
+                return NETDEV_TX_OK;
+        }
+
+        if (!skb->encapsulation) {
+                skb_reset_inner_headers(skb);
+                skb->encapsulation = 1;
+        }
 
         old_iph = ip_hdr(skb);
 
@@ -855,7 +889,8 @@ static netdev_tx_t ipgre_tunnel_xmit(struct sk_buff *skb, struct net_device *dev
         if (skb->protocol == htons(ETH_P_IP)) {
                 df |= (old_iph->frag_off&htons(IP_DF));
 
-                if ((old_iph->frag_off&htons(IP_DF)) &&
+                if (!skb_is_gso(skb) &&
+                    (old_iph->frag_off&htons(IP_DF)) &&
                     mtu < ntohs(old_iph->tot_len)) {
                         icmp_send(skb, ICMP_DEST_UNREACH, ICMP_FRAG_NEEDED, htonl(mtu));
                         ip_rt_put(rt);
@@ -875,7 +910,9 @@ static netdev_tx_t ipgre_tunnel_xmit(struct sk_buff *skb, struct net_device *dev
                         }
                 }
 
-                if (mtu >= IPV6_MIN_MTU && mtu < skb->len - tunnel->hlen + gre_hlen) {
+                if (!skb_is_gso(skb) &&
+                    mtu >= IPV6_MIN_MTU &&
+                    mtu < skb->len - tunnel->hlen + gre_hlen) {
                         icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu);
                         ip_rt_put(rt);
                         goto tx_error;
@@ -936,6 +973,7 @@ static netdev_tx_t ipgre_tunnel_xmit(struct sk_buff *skb, struct net_device *dev
         iph->daddr              =       fl4.daddr;
         iph->saddr              =       fl4.saddr;
         iph->ttl                =       ttl;
+        iph->id                 =       0;
 
         if (ttl == 0) {
                 if (skb->protocol == htons(ETH_P_IP))
@@ -964,9 +1002,19 @@ static netdev_tx_t ipgre_tunnel_xmit(struct sk_buff *skb, struct net_device *dev
                         *ptr = tunnel->parms.o_key;
                         ptr--;
                 }
-                if (tunnel->parms.o_flags&GRE_CSUM) {
+                /* Skip GRE checksum if skb is getting offloaded. */
+                if (!(skb_shinfo(skb)->gso_type & SKB_GSO_GRE) &&
+                    (tunnel->parms.o_flags&GRE_CSUM)) {
                         int offset = skb_transport_offset(skb);
 
+                        if (skb_has_shared_frag(skb)) {
+                                err = __skb_linearize(skb);
+                                if (err) {
+                                        ip_rt_put(rt);
+                                        goto tx_error;
+                                }
+                        }
+
                         *ptr = 0;
                         *(__sum16 *)ptr = csum_fold(skb_checksum(skb, offset,
                                                                  skb->len - offset,
@@ -974,7 +1022,19 @@ static netdev_tx_t ipgre_tunnel_xmit(struct sk_buff *skb, struct net_device *dev
                 }
         }
 
-        iptunnel_xmit(skb, dev);
+        nf_reset(skb);
+
+        pkt_len = skb->len - skb_transport_offset(skb);
+        err = ip_local_out(skb);
+        if (likely(net_xmit_eval(err) == 0)) {
+                u64_stats_update_begin(&tstats->syncp);
+                tstats->tx_bytes += pkt_len;
+                tstats->tx_packets++;
+                u64_stats_update_end(&tstats->syncp);
+        } else {
+                dev->stats.tx_errors++;
+                dev->stats.tx_aborted_errors++;
+        }
         return NETDEV_TX_OK;
 
 #if IS_ENABLED(CONFIG_IPV6)
@@ -1044,6 +1104,11 @@ static int ipgre_tunnel_bind_dev(struct net_device *dev)
                 mtu = 68;
 
         tunnel->hlen = addend;
+        /* TCP offload with GRE SEQ is not supported. */
+        if (!(tunnel->parms.o_flags & GRE_SEQ)) {
+                dev->features           |= NETIF_F_GSO_SOFTWARE;
+                dev->hw_features        |= NETIF_F_GSO_SOFTWARE;
+        }
 
         return mtu;
 }
@@ -1593,6 +1658,9 @@ static void ipgre_tap_setup(struct net_device *dev)
 
         dev->iflink             = 0;
         dev->features           |= NETIF_F_NETNS_LOCAL;
+
+        dev->features           |= GRE_FEATURES;
+        dev->hw_features        |= GRE_FEATURES;
 }
 
 static int ipgre_newlink(struct net *src_net, struct net_device *dev, struct nlattr *tb[],
diff --git a/net/ipv4/ip_input.c b/net/ipv4/ip_input.c
index f1395a6fb35f..87abd3e2bd32 100644
--- a/net/ipv4/ip_input.c
+++ b/net/ipv4/ip_input.c
@@ -208,13 +208,6 @@ static int ip_local_deliver_finish(struct sk_buff *skb)
                 if (ipprot != NULL) {
                         int ret;
 
-                        if (!net_eq(net, &init_net) && !ipprot->netns_ok) {
-                                net_info_ratelimited("%s: proto %d isn't netns-ready\n",
-                                                     __func__, protocol);
-                                kfree_skb(skb);
-                                goto out;
-                        }
-
                         if (!ipprot->no_policy) {
                                 if (!xfrm4_policy_check(NULL, XFRM_POLICY_IN, skb)) {
                                         kfree_skb(skb);
diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c
index 3e98ed2bff55..5e12dca7b3dd 100644
--- a/net/ipv4/ip_output.c
+++ b/net/ipv4/ip_output.c
@@ -598,6 +598,7 @@ slow_path:
         /* for offloaded checksums cleanup checksum before fragmentation */
         if ((skb->ip_summed == CHECKSUM_PARTIAL) && skb_checksum_help(skb))
                 goto fail;
+        iph = ip_hdr(skb);
 
         left = skb->len - hlen;         /* Space per frame */
         ptr = hlen;             /* Where to start from */
diff --git a/net/ipv4/ipconfig.c b/net/ipv4/ipconfig.c
index a2e50ae80b53..98cbc6877019 100644
--- a/net/ipv4/ipconfig.c
+++ b/net/ipv4/ipconfig.c
@@ -1394,7 +1394,7 @@ static int __init ip_auto_config(void)
         unsigned int i;
 
 #ifdef CONFIG_PROC_FS
-        proc_net_fops_create(&init_net, "pnp", S_IRUGO, &pnp_seq_fops);
+        proc_create("pnp", S_IRUGO, init_net.proc_net, &pnp_seq_fops);
 #endif /* CONFIG_PROC_FS */
 
         if (!ic_enable)
diff --git a/net/ipv4/ipmr.c b/net/ipv4/ipmr.c
index 7085b9b51e7f..5f95b3aa579e 100644
--- a/net/ipv4/ipmr.c
+++ b/net/ipv4/ipmr.c
@@ -2703,16 +2703,16 @@ static int __net_init ipmr_net_init(struct net *net)
 
 #ifdef CONFIG_PROC_FS
         err = -ENOMEM;
-        if (!proc_net_fops_create(net, "ip_mr_vif", 0, &ipmr_vif_fops))
+        if (!proc_create("ip_mr_vif", 0, net->proc_net, &ipmr_vif_fops))
                 goto proc_vif_fail;
-        if (!proc_net_fops_create(net, "ip_mr_cache", 0, &ipmr_mfc_fops))
+        if (!proc_create("ip_mr_cache", 0, net->proc_net, &ipmr_mfc_fops))
                 goto proc_cache_fail;
 #endif
         return 0;
 
 #ifdef CONFIG_PROC_FS
 proc_cache_fail:
-        proc_net_remove(net, "ip_mr_vif");
+        remove_proc_entry("ip_mr_vif", net->proc_net);
 proc_vif_fail:
         ipmr_rules_exit(net);
 #endif
@@ -2723,8 +2723,8 @@ fail:
 static void __net_exit ipmr_net_exit(struct net *net)
 {
 #ifdef CONFIG_PROC_FS
-        proc_net_remove(net, "ip_mr_cache");
-        proc_net_remove(net, "ip_mr_vif");
+        remove_proc_entry("ip_mr_cache", net->proc_net);
+        remove_proc_entry("ip_mr_vif", net->proc_net);
 #endif
         ipmr_rules_exit(net);
 }
diff --git a/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4_compat.c b/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4_compat.c
index 9682b36df38c..f2ca12794081 100644
--- a/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4_compat.c
+++ b/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4_compat.c
@@ -417,12 +417,12 @@ static int __net_init ip_conntrack_net_init(struct net *net)
 {
         struct proc_dir_entry *proc, *proc_exp, *proc_stat;
 
-        proc = proc_net_fops_create(net, "ip_conntrack", 0440, &ct_file_ops);
+        proc = proc_create("ip_conntrack", 0440, net->proc_net, &ct_file_ops);
         if (!proc)
                 goto err1;
 
-        proc_exp = proc_net_fops_create(net, "ip_conntrack_expect", 0440,
-                                        &ip_exp_file_ops);
+        proc_exp = proc_create("ip_conntrack_expect", 0440, net->proc_net,
+                               &ip_exp_file_ops);
         if (!proc_exp)
                 goto err2;
 
@@ -433,9 +433,9 @@ static int __net_init ip_conntrack_net_init(struct net *net)
         return 0;
 
 err3:
-        proc_net_remove(net, "ip_conntrack_expect");
+        remove_proc_entry("ip_conntrack_expect", net->proc_net);
 err2:
-        proc_net_remove(net, "ip_conntrack");
+        remove_proc_entry("ip_conntrack", net->proc_net);
 err1:
         return -ENOMEM;
 }
@@ -443,8 +443,8 @@ err1:
 static void __net_exit ip_conntrack_net_exit(struct net *net)
 {
         remove_proc_entry("ip_conntrack", net->proc_net_stat);
-        proc_net_remove(net, "ip_conntrack_expect");
-        proc_net_remove(net, "ip_conntrack");
+        remove_proc_entry("ip_conntrack_expect", net->proc_net);
+        remove_proc_entry("ip_conntrack", net->proc_net);
 }
 
 static struct pernet_operations ip_conntrack_net_ops = {
diff --git a/net/ipv4/ping.c b/net/ipv4/ping.c
index 6f9c07268cf6..55c4ee1bba06 100644
--- a/net/ipv4/ping.c
+++ b/net/ipv4/ping.c
@@ -889,7 +889,7 @@ static int ping_proc_register(struct net *net)
         struct proc_dir_entry *p;
         int rc = 0;
 
-        p = proc_net_fops_create(net, "icmp", S_IRUGO, &ping_seq_fops);
+        p = proc_create("icmp", S_IRUGO, net->proc_net, &ping_seq_fops);
         if (!p)
                 rc = -ENOMEM;
         return rc;
@@ -897,7 +897,7 @@ static int ping_proc_register(struct net *net)
 
 static void ping_proc_unregister(struct net *net)
 {
-        proc_net_remove(net, "icmp");
+        remove_proc_entry("icmp", net->proc_net);
 }
 
 
diff --git a/net/ipv4/proc.c b/net/ipv4/proc.c
index 8de53e1ddd54..32030a24e776 100644
--- a/net/ipv4/proc.c
+++ b/net/ipv4/proc.c
@@ -471,28 +471,29 @@ static const struct file_operations netstat_seq_fops = {
 
 static __net_init int ip_proc_init_net(struct net *net)
 {
-        if (!proc_net_fops_create(net, "sockstat", S_IRUGO, &sockstat_seq_fops))
+        if (!proc_create("sockstat", S_IRUGO, net->proc_net,
+                         &sockstat_seq_fops))
                 goto out_sockstat;
-        if (!proc_net_fops_create(net, "netstat", S_IRUGO, &netstat_seq_fops))
+        if (!proc_create("netstat", S_IRUGO, net->proc_net, &netstat_seq_fops))
                 goto out_netstat;
-        if (!proc_net_fops_create(net, "snmp", S_IRUGO, &snmp_seq_fops))
+        if (!proc_create("snmp", S_IRUGO, net->proc_net, &snmp_seq_fops))
                 goto out_snmp;
 
         return 0;
 
 out_snmp:
-        proc_net_remove(net, "netstat");
+        remove_proc_entry("netstat", net->proc_net);
 out_netstat:
-        proc_net_remove(net, "sockstat");
+        remove_proc_entry("sockstat", net->proc_net);
 out_sockstat:
         return -ENOMEM;
 }
 
 static __net_exit void ip_proc_exit_net(struct net *net)
 {
-        proc_net_remove(net, "snmp");
-        proc_net_remove(net, "netstat");
-        proc_net_remove(net, "sockstat");
+        remove_proc_entry("snmp", net->proc_net);
+        remove_proc_entry("netstat", net->proc_net);
+        remove_proc_entry("sockstat", net->proc_net);
 }
 
 static __net_initdata struct pernet_operations ip_proc_ops = {
diff --git a/net/ipv4/protocol.c b/net/ipv4/protocol.c
index 0f9d09f54bd9..ce848461acbb 100644
--- a/net/ipv4/protocol.c
+++ b/net/ipv4/protocol.c
@@ -37,6 +37,12 @@ const struct net_offload __rcu *inet_offloads[MAX_INET_PROTOS] __read_mostly;
 
 int inet_add_protocol(const struct net_protocol *prot, unsigned char protocol)
 {
+        if (!prot->netns_ok) {
+                pr_err("Protocol %u is not namespace aware, cannot register.\n",
+                        protocol);
+                return -EINVAL;
+        }
+
         return !cmpxchg((const struct net_protocol **)&inet_protos[protocol],
                         NULL, prot) ? 0 : -1;
 }
diff --git a/net/ipv4/raw.c b/net/ipv4/raw.c
index 6f08991409c3..53ddebc292b6 100644
--- a/net/ipv4/raw.c
+++ b/net/ipv4/raw.c
@@ -1050,7 +1050,7 @@ static const struct file_operations raw_seq_fops = {
 
 static __net_init int raw_init_net(struct net *net)
 {
-        if (!proc_net_fops_create(net, "raw", S_IRUGO, &raw_seq_fops))
+        if (!proc_create("raw", S_IRUGO, net->proc_net, &raw_seq_fops))
                 return -ENOMEM;
 
         return 0;
@@ -1058,7 +1058,7 @@ static __net_init int raw_init_net(struct net *net)
 
 static __net_exit void raw_exit_net(struct net *net)
 {
-        proc_net_remove(net, "raw");
+        remove_proc_entry("raw", net->proc_net);
 }
 
 static __net_initdata struct pernet_operations raw_net_ops = {
diff --git a/net/ipv4/route.c b/net/ipv4/route.c
index a0fcc47fee73..3bdd1b1ad1b3 100644
--- a/net/ipv4/route.c
+++ b/net/ipv4/route.c
@@ -384,8 +384,8 @@ static int __net_init ip_rt_do_proc_init(struct net *net)
 {
         struct proc_dir_entry *pde;
 
-        pde = proc_net_fops_create(net, "rt_cache", S_IRUGO,
-                        &rt_cache_seq_fops);
+        pde = proc_create("rt_cache", S_IRUGO, net->proc_net,
+                          &rt_cache_seq_fops);
         if (!pde)
                 goto err1;
 
diff --git a/net/ipv4/sysctl_net_ipv4.c b/net/ipv4/sysctl_net_ipv4.c
index 2622707602d1..960fd29d9b8e 100644
--- a/net/ipv4/sysctl_net_ipv4.c
+++ b/net/ipv4/sysctl_net_ipv4.c
@@ -633,13 +633,6 @@ static struct ctl_table ipv4_table[] = {
                 .proc_handler   = proc_tcp_congestion_control,
         },
         {
-                .procname       = "tcp_abc",
-                .data           = &sysctl_tcp_abc,
-                .maxlen         = sizeof(int),
-                .mode           = 0644,
-                .proc_handler   = proc_dointvec,
-        },
-        {
                 .procname       = "tcp_mtu_probing",
                 .data           = &sysctl_tcp_mtu_probing,
                 .maxlen         = sizeof(int),
diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
index 3ec1f69c5ceb..7a5ba48c2cc9 100644
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -400,6 +400,8 @@ void tcp_init_sock(struct sock *sk)
         tcp_enable_early_retrans(tp);
         icsk->icsk_ca_ops = &tcp_init_congestion_ops;
 
+        tp->tsoffset = 0;
+
         sk->sk_state = TCP_CLOSE;
 
         sk->sk_write_space = sk_stream_write_space;
@@ -895,8 +897,7 @@ new_segment:
                         get_page(page);
                         skb_fill_page_desc(skb, i, page, offset, copy);
                 }
-
-                skb_shinfo(skb)->gso_type |= SKB_GSO_SHARED_FRAG;
+                skb_shinfo(skb)->tx_flags |= SKBTX_SHARED_FRAG;
 
                 skb->len += copy;
                 skb->data_len += copy;
@@ -2289,7 +2290,6 @@ int tcp_disconnect(struct sock *sk, int flags)
         tp->packets_out = 0;
         tp->snd_ssthresh = TCP_INFINITE_SSTHRESH;
         tp->snd_cwnd_cnt = 0;
-        tp->bytes_acked = 0;
         tp->window_clamp = 0;
         tcp_set_ca_state(sk, TCP_CA_Open);
         tcp_clear_retrans(tp);
@@ -2713,6 +2713,12 @@ static int do_tcp_setsockopt(struct sock *sk, int level,
                 else
                         err = -EINVAL;
                 break;
+        case TCP_TIMESTAMP:
+                if (!tp->repair)
+                        err = -EPERM;
+                else
+                        tp->tsoffset = val - tcp_time_stamp;
+                break;
         default:
                 err = -ENOPROTOOPT;
                 break;
@@ -2961,6 +2967,9 @@ static int do_tcp_getsockopt(struct sock *sk, int level,
         case TCP_USER_TIMEOUT:
                 val = jiffies_to_msecs(icsk->icsk_user_timeout);
                 break;
+        case TCP_TIMESTAMP:
+                val = tcp_time_stamp + tp->tsoffset;
+                break;
         default:
                 return -ENOPROTOOPT;
         }
@@ -3034,7 +3043,7 @@ struct sk_buff *tcp_tso_segment(struct sk_buff *skb,
                                SKB_GSO_DODGY |
                                SKB_GSO_TCP_ECN |
                                SKB_GSO_TCPV6 |
-                               SKB_GSO_SHARED_FRAG |
+                               SKB_GSO_GRE |
                                0) ||
                              !(type & (SKB_GSO_TCPV4 | SKB_GSO_TCPV6))))
                         goto out;
diff --git a/net/ipv4/tcp_cong.c b/net/ipv4/tcp_cong.c
index 291f2ed7cc31..019c2389a341 100644
--- a/net/ipv4/tcp_cong.c
+++ b/net/ipv4/tcp_cong.c
@@ -310,35 +310,24 @@ void tcp_slow_start(struct tcp_sock *tp)
 {
         int cnt; /* increase in packets */
         unsigned int delta = 0;
+        u32 snd_cwnd = tp->snd_cwnd;
 
-        /* RFC3465: ABC Slow start
-         * Increase only after a full MSS of bytes is acked
-         *
-         * TCP sender SHOULD increase cwnd by the number of
-         * previously unacknowledged bytes ACKed by each incoming
-         * acknowledgment, provided the increase is not more than L
-         */
-        if (sysctl_tcp_abc && tp->bytes_acked < tp->mss_cache)
-                return;
+        if (unlikely(!snd_cwnd)) {
+                pr_err_once("snd_cwnd is nul, please report this bug.\n");
+                snd_cwnd = 1U;
+        }
 
         if (sysctl_tcp_max_ssthresh > 0 && tp->snd_cwnd > sysctl_tcp_max_ssthresh)
                 cnt = sysctl_tcp_max_ssthresh >> 1;     /* limited slow start */
         else
-                cnt = tp->snd_cwnd;                     /* exponential increase */
-
-        /* RFC3465: ABC
-         * We MAY increase by 2 if discovered delayed ack
-         */
-        if (sysctl_tcp_abc > 1 && tp->bytes_acked >= 2*tp->mss_cache)
-                cnt <<= 1;
-        tp->bytes_acked = 0;
+                cnt = snd_cwnd;                         /* exponential increase */
 
         tp->snd_cwnd_cnt += cnt;
-        while (tp->snd_cwnd_cnt >= tp->snd_cwnd) {
-                tp->snd_cwnd_cnt -= tp->snd_cwnd;
+        while (tp->snd_cwnd_cnt >= snd_cwnd) {
+                tp->snd_cwnd_cnt -= snd_cwnd;
                 delta++;
         }
-        tp->snd_cwnd = min(tp->snd_cwnd + delta, tp->snd_cwnd_clamp);
+        tp->snd_cwnd = min(snd_cwnd + delta, tp->snd_cwnd_clamp);
 }
 EXPORT_SYMBOL_GPL(tcp_slow_start);
 
@@ -372,20 +361,9 @@ void tcp_reno_cong_avoid(struct sock *sk, u32 ack, u32 in_flight)
         /* In "safe" area, increase. */
         if (tp->snd_cwnd <= tp->snd_ssthresh)
                 tcp_slow_start(tp);
-
         /* In dangerous area, increase slowly. */
-        else if (sysctl_tcp_abc) {
-                /* RFC3465: Appropriate Byte Count
-                 * increase once for each full cwnd acked
-                 */
-                if (tp->bytes_acked >= tp->snd_cwnd*tp->mss_cache) {
-                        tp->bytes_acked -= tp->snd_cwnd*tp->mss_cache;
-                        if (tp->snd_cwnd < tp->snd_cwnd_clamp)
-                                tp->snd_cwnd++;
-                }
-        } else {
+        else
                 tcp_cong_avoid_ai(tp, tp->snd_cwnd);
-        }
 }
 EXPORT_SYMBOL_GPL(tcp_reno_cong_avoid);
 
diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index 492c7cfe1453..a759e19496d2 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -98,7 +98,6 @@ int sysctl_tcp_frto_response __read_mostly;
 int sysctl_tcp_thin_dupack __read_mostly;
 
 int sysctl_tcp_moderate_rcvbuf __read_mostly = 1;
-int sysctl_tcp_abc __read_mostly;
 int sysctl_tcp_early_retrans __read_mostly = 2;
 
 #define FLAG_DATA               0x01 /* Incoming frame contained data.          */
@@ -1240,13 +1239,13 @@ static bool tcp_shifted_skb(struct sock *sk, struct sk_buff *skb,
          */
         if (!skb_shinfo(prev)->gso_size) {
                 skb_shinfo(prev)->gso_size = mss;
-                skb_shinfo(prev)->gso_type |= sk->sk_gso_type;
+                skb_shinfo(prev)->gso_type = sk->sk_gso_type;
         }
 
         /* CHECKME: To clear or not to clear? Mimics normal skb currently */
         if (skb_shinfo(skb)->gso_segs <= 1) {
                 skb_shinfo(skb)->gso_size = 0;
-                skb_shinfo(skb)->gso_type &= SKB_GSO_SHARED_FRAG;
+                skb_shinfo(skb)->gso_type = 0;
         }
 
         /* Difference in this won't matter, both ACKed by the same cumul. ACK */
@@ -2007,7 +2006,6 @@ static void tcp_enter_frto_loss(struct sock *sk, int allowed_segments, int flag)
         tp->snd_cwnd_cnt = 0;
         tp->snd_cwnd_stamp = tcp_time_stamp;
         tp->frto_counter = 0;
-        tp->bytes_acked = 0;
 
         tp->reordering = min_t(unsigned int, tp->reordering,
                                sysctl_tcp_reordering);
@@ -2056,7 +2054,6 @@ void tcp_enter_loss(struct sock *sk, int how)
         tp->snd_cwnd_cnt   = 0;
         tp->snd_cwnd_stamp = tcp_time_stamp;
 
-        tp->bytes_acked = 0;
         tcp_clear_retrans_partial(tp);
 
         if (tcp_is_reno(tp))
@@ -2684,7 +2681,6 @@ static void tcp_init_cwnd_reduction(struct sock *sk, const bool set_ssthresh)
         struct tcp_sock *tp = tcp_sk(sk);
 
         tp->high_seq = tp->snd_nxt;
-        tp->bytes_acked = 0;
         tp->snd_cwnd_cnt = 0;
         tp->prior_cwnd = tp->snd_cwnd;
         tp->prr_delivered = 0;
@@ -2735,7 +2731,6 @@ void tcp_enter_cwr(struct sock *sk, const int set_ssthresh)
         struct tcp_sock *tp = tcp_sk(sk);
 
         tp->prior_ssthresh = 0;
-        tp->bytes_acked = 0;
         if (inet_csk(sk)->icsk_ca_state < TCP_CA_CWR) {
                 tp->undo_marker = 0;
                 tcp_init_cwnd_reduction(sk, set_ssthresh);
@@ -3417,7 +3412,6 @@ static void tcp_conservative_spur_to_response(struct tcp_sock *tp)
 {
         tp->snd_cwnd = min(tp->snd_cwnd, tp->snd_ssthresh);
         tp->snd_cwnd_cnt = 0;
-        tp->bytes_acked = 0;
         TCP_ECN_queue_cwr(tp);
         tcp_moderate_cwnd(tp);
 }
@@ -3502,6 +3496,11 @@ static bool tcp_process_frto(struct sock *sk, int flag)
                 }
         } else {
                 if (!(flag & FLAG_DATA_ACKED) && (tp->frto_counter == 1)) {
+                        if (!tcp_packets_in_flight(tp)) {
+                                tcp_enter_frto_loss(sk, 2, flag);
+                                return true;
+                        }
+
                         /* Prevent sending of new data. */
                         tp->snd_cwnd = min(tp->snd_cwnd,
                                            tcp_packets_in_flight(tp));
@@ -3608,15 +3607,6 @@ static int tcp_ack(struct sock *sk, const struct sk_buff *skb, int flag)
         if (after(ack, prior_snd_una))
                 flag |= FLAG_SND_UNA_ADVANCED;
 
-        if (sysctl_tcp_abc) {
-                if (icsk->icsk_ca_state < TCP_CA_CWR)
-                        tp->bytes_acked += ack - prior_snd_una;
-                else if (icsk->icsk_ca_state == TCP_CA_Loss)
-                        /* we assume just one segment left network */
-                        tp->bytes_acked += min(ack - prior_snd_una,
-                                               tp->mss_cache);
-        }
-
         prior_fackets = tp->fackets_out;
         prior_in_flight = tcp_packets_in_flight(tp);
 
@@ -3870,7 +3860,7 @@ static bool tcp_parse_aligned_timestamp(struct tcp_sock *tp, const struct tcphdr
                 ++ptr;
                 tp->rx_opt.rcv_tsval = ntohl(*ptr);
                 ++ptr;
-                tp->rx_opt.rcv_tsecr = ntohl(*ptr);
+                tp->rx_opt.rcv_tsecr = ntohl(*ptr) - tp->tsoffset;
                 return true;
         }
         return false;
@@ -3894,7 +3884,11 @@ static bool tcp_fast_parse_options(const struct sk_buff *skb,
                 if (tcp_parse_aligned_timestamp(tp, th))
                         return true;
         }
+
         tcp_parse_options(skb, &tp->rx_opt, hvpp, 1, NULL);
+        if (tp->rx_opt.saw_tstamp)
+                tp->rx_opt.rcv_tsecr -= tp->tsoffset;
+
         return true;
 }
 
@@ -5647,8 +5641,7 @@ static bool tcp_rcv_fastopen_synack(struct sock *sk, struct sk_buff *synack,
          * the remote receives only the retransmitted (regular) SYNs: either
          * the original SYN-data or the corresponding SYN-ACK is lost.
          */
-        syn_drop = (cookie->len <= 0 && data &&
-                    inet_csk(sk)->icsk_retransmits);
+        syn_drop = (cookie->len <= 0 && data && tp->total_retrans);
 
         tcp_fastopen_cache_set(sk, mss, cookie, syn_drop);
 
@@ -5676,6 +5669,8 @@ static int tcp_rcv_synsent_state_process(struct sock *sk, struct sk_buff *skb,
         int saved_clamp = tp->rx_opt.mss_clamp;
 
         tcp_parse_options(skb, &tp->rx_opt, &hash_location, 0, &foc);
+        if (tp->rx_opt.saw_tstamp)
+                tp->rx_opt.rcv_tsecr -= tp->tsoffset;
 
         if (th->ack) {
                 /* rfc793:
diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
index 5a1cfc692df0..145d3bf8df86 100644
--- a/net/ipv4/tcp_ipv4.c
+++ b/net/ipv4/tcp_ipv4.c
@@ -496,6 +496,7 @@ void tcp_v4_err(struct sk_buff *icmp_skb, u32 info)
                  * errors returned from accept().
                  */
                 inet_csk_reqsk_queue_drop(sk, req, prev);
+                NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_LISTENDROPS);
                 goto out;
 
         case TCP_SYN_SENT:
@@ -725,7 +726,7 @@ release_sk1:
  */
 
 static void tcp_v4_send_ack(struct sk_buff *skb, u32 seq, u32 ack,
-                            u32 win, u32 ts, int oif,
+                            u32 win, u32 tsval, u32 tsecr, int oif,
                             struct tcp_md5sig_key *key,
                             int reply_flags, u8 tos)
 {
@@ -746,12 +747,12 @@ static void tcp_v4_send_ack(struct sk_buff *skb, u32 seq, u32 ack,
 
         arg.iov[0].iov_base = (unsigned char *)&rep;
         arg.iov[0].iov_len  = sizeof(rep.th);
-        if (ts) {
+        if (tsecr) {
                 rep.opt[0] = htonl((TCPOPT_NOP << 24) | (TCPOPT_NOP << 16) |
                                    (TCPOPT_TIMESTAMP << 8) |
                                    TCPOLEN_TIMESTAMP);
-                rep.opt[1] = htonl(tcp_time_stamp);
-                rep.opt[2] = htonl(ts);
+                rep.opt[1] = htonl(tsval);
+                rep.opt[2] = htonl(tsecr);
                 arg.iov[0].iov_len += TCPOLEN_TSTAMP_ALIGNED;
         }
 
@@ -766,7 +767,7 @@ static void tcp_v4_send_ack(struct sk_buff *skb, u32 seq, u32 ack,
 
 #ifdef CONFIG_TCP_MD5SIG
         if (key) {
-                int offset = (ts) ? 3 : 0;
+                int offset = (tsecr) ? 3 : 0;
 
                 rep.opt[offset++] = htonl((TCPOPT_NOP << 24) |
                                           (TCPOPT_NOP << 16) |
@@ -801,6 +802,7 @@ static void tcp_v4_timewait_ack(struct sock *sk, struct sk_buff *skb)
 
         tcp_v4_send_ack(skb, tcptw->tw_snd_nxt, tcptw->tw_rcv_nxt,
                         tcptw->tw_rcv_wnd >> tw->tw_rcv_wscale,
+                        tcp_time_stamp + tcptw->tw_ts_offset,
                         tcptw->tw_ts_recent,
                         tw->tw_bound_dev_if,
                         tcp_twsk_md5_key(tcptw),
@@ -820,6 +822,7 @@ static void tcp_v4_reqsk_send_ack(struct sock *sk, struct sk_buff *skb,
         tcp_v4_send_ack(skb, (sk->sk_state == TCP_LISTEN) ?
                         tcp_rsk(req)->snt_isn + 1 : tcp_sk(sk)->snd_nxt,
                         tcp_rsk(req)->rcv_nxt, req->rcv_wnd,
+                        tcp_time_stamp,
                         req->ts_recent,
                         0,
                         tcp_md5_do_lookup(sk, (union tcp_md5_addr *)&ip_hdr(skb)->daddr,
@@ -1501,8 +1504,10 @@ int tcp_v4_conn_request(struct sock *sk, struct sk_buff *skb)
          * clogging syn queue with openreqs with exponentially increasing
          * timeout.
          */
-        if (sk_acceptq_is_full(sk) && inet_csk_reqsk_queue_young(sk) > 1)
+        if (sk_acceptq_is_full(sk) && inet_csk_reqsk_queue_young(sk) > 1) {
+                NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_LISTENOVERFLOWS);
                 goto drop;
+        }
 
         req = inet_reqsk_alloc(&tcp_request_sock_ops);
         if (!req)
@@ -1667,6 +1672,7 @@ drop_and_release:
 drop_and_free:
         reqsk_free(req);
 drop:
+        NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_LISTENDROPS);
         return 0;
 }
 EXPORT_SYMBOL(tcp_v4_conn_request);
@@ -2610,7 +2616,7 @@ EXPORT_SYMBOL(tcp_proc_register);
 
 void tcp_proc_unregister(struct net *net, struct tcp_seq_afinfo *afinfo)
 {
-        proc_net_remove(net, afinfo->name);
+        remove_proc_entry(afinfo->name, net->proc_net);
 }
 EXPORT_SYMBOL(tcp_proc_unregister);
 
diff --git a/net/ipv4/tcp_minisocks.c b/net/ipv4/tcp_minisocks.c
index f35f2dfb6401..b83a49cc3816 100644
--- a/net/ipv4/tcp_minisocks.c
+++ b/net/ipv4/tcp_minisocks.c
@@ -102,6 +102,7 @@ tcp_timewait_state_process(struct inet_timewait_sock *tw, struct sk_buff *skb,
                 tcp_parse_options(skb, &tmp_opt, &hash_location, 0, NULL);
 
                 if (tmp_opt.saw_tstamp) {
+                        tmp_opt.rcv_tsecr       -= tcptw->tw_ts_offset;
                         tmp_opt.ts_recent       = tcptw->tw_ts_recent;
                         tmp_opt.ts_recent_stamp = tcptw->tw_ts_recent_stamp;
                         paws_reject = tcp_paws_reject(&tmp_opt, th->rst);
@@ -288,6 +289,7 @@ void tcp_time_wait(struct sock *sk, int state, int timeo)
                 tcptw->tw_rcv_wnd       = tcp_receive_window(tp);
                 tcptw->tw_ts_recent     = tp->rx_opt.ts_recent;
                 tcptw->tw_ts_recent_stamp = tp->rx_opt.ts_recent_stamp;
+                tcptw->tw_ts_offset     = tp->tsoffset;
 
 #if IS_ENABLED(CONFIG_IPV6)
                 if (tw->tw_family == PF_INET6) {
@@ -446,7 +448,6 @@ struct sock *tcp_create_openreq_child(struct sock *sk, struct request_sock *req,
                  */
                 newtp->snd_cwnd = TCP_INIT_CWND;
                 newtp->snd_cwnd_cnt = 0;
-                newtp->bytes_acked = 0;
 
                 newtp->frto_counter = 0;
                 newtp->frto_highmark = 0;
@@ -500,6 +501,7 @@ struct sock *tcp_create_openreq_child(struct sock *sk, struct request_sock *req,
                         newtp->rx_opt.ts_recent_stamp = 0;
                         newtp->tcp_header_len = sizeof(struct tcphdr);
                 }
+                newtp->tsoffset = 0;
 #ifdef CONFIG_TCP_MD5SIG
                 newtp->md5sig_info = NULL;      /*XXX*/
                 if (newtp->af_specific->md5_lookup(sk, newsk))
diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
index 367e2ec01da1..fd0cea114b5d 100644
--- a/net/ipv4/tcp_output.c
+++ b/net/ipv4/tcp_output.c
@@ -622,7 +622,7 @@ static unsigned int tcp_syn_options(struct sock *sk, struct sk_buff *skb,
 
         if (likely(sysctl_tcp_timestamps && *md5 == NULL)) {
                 opts->options |= OPTION_TS;
-                opts->tsval = TCP_SKB_CB(skb)->when;
+                opts->tsval = TCP_SKB_CB(skb)->when + tp->tsoffset;
                 opts->tsecr = tp->rx_opt.ts_recent;
                 remaining -= TCPOLEN_TSTAMP_ALIGNED;
         }
@@ -806,7 +806,7 @@ static unsigned int tcp_established_options(struct sock *sk, struct sk_buff *skb
 
         if (likely(tp->rx_opt.tstamp_ok)) {
                 opts->options |= OPTION_TS;
-                opts->tsval = tcb ? tcb->when : 0;
+                opts->tsval = tcb ? tcb->when + tp->tsoffset : 0;
                 opts->tsecr = tp->rx_opt.ts_recent;
                 size += TCPOLEN_TSTAMP_ALIGNED;
         }
@@ -1133,7 +1133,6 @@ static void tcp_queue_skb(struct sock *sk, struct sk_buff *skb)
 static void tcp_set_skb_tso_segs(const struct sock *sk, struct sk_buff *skb,
                                  unsigned int mss_now)
 {
-        skb_shinfo(skb)->gso_type &= SKB_GSO_SHARED_FRAG;
         if (skb->len <= mss_now || !sk_can_gso(sk) ||
             skb->ip_summed == CHECKSUM_NONE) {
                 /* Avoid the costly divide in the normal
@@ -1141,10 +1140,11 @@ static void tcp_set_skb_tso_segs(const struct sock *sk, struct sk_buff *skb,
                  */
                 skb_shinfo(skb)->gso_segs = 1;
                 skb_shinfo(skb)->gso_size = 0;
+                skb_shinfo(skb)->gso_type = 0;
         } else {
                 skb_shinfo(skb)->gso_segs = DIV_ROUND_UP(skb->len, mss_now);
                 skb_shinfo(skb)->gso_size = mss_now;
-                skb_shinfo(skb)->gso_type |= sk->sk_gso_type;
+                skb_shinfo(skb)->gso_type = sk->sk_gso_type;
         }
 }
 
@@ -1331,7 +1331,7 @@ static void __pskb_trim_head(struct sk_buff *skb, int len)
 /* Remove acked data from a packet in the transmit queue. */
 int tcp_trim_head(struct sock *sk, struct sk_buff *skb, u32 len)
 {
-        if (skb_cloned(skb) && pskb_expand_head(skb, 0, 0, GFP_ATOMIC))
+        if (skb_unclone(skb, GFP_ATOMIC))
                 return -ENOMEM;
 
         __pskb_trim_head(skb, len);
diff --git a/net/ipv4/tcp_probe.c b/net/ipv4/tcp_probe.c
index 4526fe68e60e..d4943f67aff2 100644
--- a/net/ipv4/tcp_probe.c
+++ b/net/ipv4/tcp_probe.c
@@ -234,7 +234,7 @@ static __init int tcpprobe_init(void)
         if (!tcp_probe.log)
                 goto err0;
 
-        if (!proc_net_fops_create(&init_net, procname, S_IRUSR, &tcpprobe_fops))
+        if (!proc_create(procname, S_IRUSR, init_net.proc_net, &tcpprobe_fops))
                 goto err0;
 
         ret = register_jprobe(&tcp_jprobe);
@@ -244,7 +244,7 @@ static __init int tcpprobe_init(void)
         pr_info("probe registered (port=%d) bufsize=%u\n", port, bufsize);
         return 0;
  err1:
-        proc_net_remove(&init_net, procname);
+        remove_proc_entry(procname, init_net.proc_net);
  err0:
         kfree(tcp_probe.log);
         return ret;
@@ -253,7 +253,7 @@ module_init(tcpprobe_init);
 
 static __exit void tcpprobe_exit(void)
 {
-        proc_net_remove(&init_net, procname);
+        remove_proc_entry(procname, init_net.proc_net);
         unregister_jprobe(&tcp_jprobe);
         kfree(tcp_probe.log);
 }
diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
index 6791aac06ea9..265c42cf963c 100644
--- a/net/ipv4/udp.c
+++ b/net/ipv4/udp.c
@@ -2122,7 +2122,7 @@ EXPORT_SYMBOL(udp_proc_register);
 
 void udp_proc_unregister(struct net *net, struct udp_seq_afinfo *afinfo)
 {
-        proc_net_remove(net, afinfo->name);
+        remove_proc_entry(afinfo->name, net->proc_net);
 }
 EXPORT_SYMBOL(udp_proc_unregister);
 
@@ -2305,7 +2305,8 @@ struct sk_buff *udp4_ufo_fragment(struct sk_buff *skb,
                 /* Packet is from an untrusted source, reset gso_segs. */
                 int type = skb_shinfo(skb)->gso_type;
 
-                if (unlikely(type & ~(SKB_GSO_UDP | SKB_GSO_DODGY) ||
+                if (unlikely(type & ~(SKB_GSO_UDP | SKB_GSO_DODGY |
+                                      SKB_GSO_GRE) ||
                              !(type & (SKB_GSO_UDP))))
                         goto out;
 
diff --git a/net/ipv4/xfrm4_input.c b/net/ipv4/xfrm4_input.c
index 06814b6216dc..1f12c8b45864 100644
--- a/net/ipv4/xfrm4_input.c
+++ b/net/ipv4/xfrm4_input.c
@@ -132,7 +132,7 @@ int xfrm4_udp_encap_rcv(struct sock *sk, struct sk_buff *skb)
          * header and optional ESP marker bytes) and then modify the
          * protocol to ESP, and then call into the transform receiver.
          */
-        if (skb_cloned(skb) && pskb_expand_head(skb, 0, 0, GFP_ATOMIC))
+        if (skb_unclone(skb, GFP_ATOMIC))
                 goto drop;
 
         /* Now we can update and verify the packet length... */
diff --git a/net/ipv4/xfrm4_mode_tunnel.c b/net/ipv4/xfrm4_mode_tunnel.c
index ddee0a099a2c..fe5189e2e114 100644
--- a/net/ipv4/xfrm4_mode_tunnel.c
+++ b/net/ipv4/xfrm4_mode_tunnel.c
@@ -142,8 +142,8 @@ static int xfrm4_mode_tunnel_input(struct xfrm_state *x, struct sk_buff *skb)
         for_each_input_rcu(rcv_notify_handlers, handler)
                 handler->handler(skb);
 
-        if (skb_cloned(skb) &&
-            (err = pskb_expand_head(skb, 0, 0, GFP_ATOMIC)))
+        err = skb_unclone(skb, GFP_ATOMIC);
+        if (err)
                 goto out;
 
         if (x->props.flags & XFRM_STATE_DECAP_DSCP)
diff --git a/net/ipv4/xfrm4_policy.c b/net/ipv4/xfrm4_policy.c
index 3be0ac2c1920..9a459be24af7 100644
--- a/net/ipv4/xfrm4_policy.c
+++ b/net/ipv4/xfrm4_policy.c
@@ -262,21 +262,56 @@ static struct ctl_table xfrm4_policy_table[] = {
         { }
 };
 
-static struct ctl_table_header *sysctl_hdr;
-#endif
-
-static void __init xfrm4_policy_init(void)
+static int __net_init xfrm4_net_init(struct net *net)
 {
-        xfrm_policy_register_afinfo(&xfrm4_policy_afinfo);
+        struct ctl_table *table;
+        struct ctl_table_header *hdr;
+
+        table = xfrm4_policy_table;
+        if (!net_eq(net, &init_net)) {
+                table = kmemdup(table, sizeof(xfrm4_policy_table), GFP_KERNEL);
+                if (!table)
+                        goto err_alloc;
+
+                table[0].data = &net->xfrm.xfrm4_dst_ops.gc_thresh;
+        }
+
+        hdr = register_net_sysctl(net, "net/ipv4", table);
+        if (!hdr)
+                goto err_reg;
+
+        net->ipv4.xfrm4_hdr = hdr;
+        return 0;
+
+err_reg:
+        if (!net_eq(net, &init_net))
+                kfree(table);
+err_alloc:
+        return -ENOMEM;
 }
 
-static void __exit xfrm4_policy_fini(void)
+static void __net_exit xfrm4_net_exit(struct net *net)
 {
-#ifdef CONFIG_SYSCTL
-        if (sysctl_hdr)
-                unregister_net_sysctl_table(sysctl_hdr);
+        struct ctl_table *table;
+
+        if (net->ipv4.xfrm4_hdr == NULL)
+                return;
+
+        table = net->ipv4.xfrm4_hdr->ctl_table_arg;
+        unregister_net_sysctl_table(net->ipv4.xfrm4_hdr);
+        if (!net_eq(net, &init_net))
+                kfree(table);
+}
+
+static struct pernet_operations __net_initdata xfrm4_net_ops = {
+        .init   = xfrm4_net_init,
+        .exit   = xfrm4_net_exit,
+};
 #endif
-        xfrm_policy_unregister_afinfo(&xfrm4_policy_afinfo);
+
+static void __init xfrm4_policy_init(void)
+{
+        xfrm_policy_register_afinfo(&xfrm4_policy_afinfo);
 }
 
 void __init xfrm4_init(void)
@@ -286,8 +321,7 @@ void __init xfrm4_init(void)
         xfrm4_state_init();
         xfrm4_policy_init();
 #ifdef CONFIG_SYSCTL
-        sysctl_hdr = register_net_sysctl(&init_net, "net/ipv4",
-                                         xfrm4_policy_table);
+        register_pernet_subsys(&xfrm4_net_ops);
 #endif
 }
 
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index 7f7332b44699..4dc0d44a5d31 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -244,6 +244,9 @@ const struct in6_addr in6addr_any = IN6ADDR_ANY_INIT;
 const struct in6_addr in6addr_loopback = IN6ADDR_LOOPBACK_INIT;
 const struct in6_addr in6addr_linklocal_allnodes = IN6ADDR_LINKLOCAL_ALLNODES_INIT;
 const struct in6_addr in6addr_linklocal_allrouters = IN6ADDR_LINKLOCAL_ALLROUTERS_INIT;
+const struct in6_addr in6addr_interfacelocal_allnodes = IN6ADDR_INTERFACELOCAL_ALLNODES_INIT;
+const struct in6_addr in6addr_interfacelocal_allrouters = IN6ADDR_INTERFACELOCAL_ALLROUTERS_INIT;
+const struct in6_addr in6addr_sitelocal_allrouters = IN6ADDR_SITELOCAL_ALLROUTERS_INIT;
 
 /* Check if a valid qdisc is available */
 static inline bool addrconf_qdisc_ok(const struct net_device *dev)
@@ -428,6 +431,9 @@ static struct inet6_dev *ipv6_add_dev(struct net_device *dev)
         /* protected by rtnl_lock */
         rcu_assign_pointer(dev->ip6_ptr, ndev);
 
+        /* Join interface-local all-node multicast group */
+        ipv6_dev_mc_inc(dev, &in6addr_interfacelocal_allnodes);
+
         /* Join all-node multicast group */
         ipv6_dev_mc_inc(dev, &in6addr_linklocal_allnodes);
 
@@ -611,10 +617,15 @@ static void dev_forward_change(struct inet6_dev *idev)
         if (idev->cnf.forwarding)
                 dev_disable_lro(dev);
         if (dev->flags & IFF_MULTICAST) {
-                if (idev->cnf.forwarding)
+                if (idev->cnf.forwarding) {
                         ipv6_dev_mc_inc(dev, &in6addr_linklocal_allrouters);
-                else
+                        ipv6_dev_mc_inc(dev, &in6addr_interfacelocal_allrouters);
+                        ipv6_dev_mc_inc(dev, &in6addr_sitelocal_allrouters);
+                } else {
                         ipv6_dev_mc_dec(dev, &in6addr_linklocal_allrouters);
+                        ipv6_dev_mc_dec(dev, &in6addr_interfacelocal_allrouters);
+                        ipv6_dev_mc_dec(dev, &in6addr_sitelocal_allrouters);
+                }
         }
 
         list_for_each_entry(ifa, &idev->addr_list, if_list) {
@@ -1656,6 +1667,7 @@ static int addrconf_ifid_eui64(u8 *eui, struct net_device *dev)
         if (dev->addr_len != IEEE802154_ADDR_LEN)
                 return -1;
         memcpy(eui, dev->dev_addr, 8);
+        eui[0] ^= 2;
         return 0;
 }
 
@@ -3313,14 +3325,14 @@ static const struct file_operations if6_fops = {
 
 static int __net_init if6_proc_net_init(struct net *net)
 {
-        if (!proc_net_fops_create(net, "if_inet6", S_IRUGO, &if6_fops))
+        if (!proc_create("if_inet6", S_IRUGO, net->proc_net, &if6_fops))
                 return -ENOMEM;
         return 0;
 }
 
 static void __net_exit if6_proc_net_exit(struct net *net)
 {
-       proc_net_remove(net, "if_inet6");
+        remove_proc_entry("if_inet6", net->proc_net);
 }
 
 static struct pernet_operations if6_proc_net_ops = {
diff --git a/net/ipv6/ah6.c b/net/ipv6/ah6.c
index 384233188ac1..bb02e176cb70 100644
--- a/net/ipv6/ah6.c
+++ b/net/ipv6/ah6.c
@@ -521,8 +521,7 @@ static int ah6_input(struct xfrm_state *x, struct sk_buff *skb)
 
         /* We are going to _remove_ AH header to keep sockets happy,
          * so... Later this can change. */
-        if (skb_cloned(skb) &&
-            pskb_expand_head(skb, 0, 0, GFP_ATOMIC))
+        if (skb_unclone(skb, GFP_ATOMIC))
                 goto out;
 
         skb->ip_summed = CHECKSUM_NONE;
diff --git a/net/ipv6/anycast.c b/net/ipv6/anycast.c
index 921b8b398a8c..5a80f15a9de2 100644
--- a/net/ipv6/anycast.c
+++ b/net/ipv6/anycast.c
@@ -509,7 +509,7 @@ static const struct file_operations ac6_seq_fops = {
 
 int __net_init ac6_proc_init(struct net *net)
 {
-        if (!proc_net_fops_create(net, "anycast6", S_IRUGO, &ac6_seq_fops))
+        if (!proc_create("anycast6", S_IRUGO, net->proc_net, &ac6_seq_fops))
                 return -ENOMEM;
 
         return 0;
@@ -517,7 +517,7 @@ int __net_init ac6_proc_init(struct net *net)
 
 void ac6_proc_exit(struct net *net)
 {
-        proc_net_remove(net, "anycast6");
+        remove_proc_entry("anycast6", net->proc_net);
 }
 #endif
 
diff --git a/net/ipv6/datagram.c b/net/ipv6/datagram.c
index 33be36398a78..f5a54782a340 100644
--- a/net/ipv6/datagram.c
+++ b/net/ipv6/datagram.c
@@ -380,7 +380,7 @@ int ipv6_recv_error(struct sock *sk, struct msghdr *msg, int len)
                 if (skb->protocol == htons(ETH_P_IPV6)) {
                         sin->sin6_addr = ipv6_hdr(skb)->saddr;
                         if (np->rxopt.all)
-                                datagram_recv_ctl(sk, msg, skb);
+                                ip6_datagram_recv_ctl(sk, msg, skb);
                         if (ipv6_addr_type(&sin->sin6_addr) & IPV6_ADDR_LINKLOCAL)
                                 sin->sin6_scope_id = IP6CB(skb)->iif;
                 } else {
@@ -468,7 +468,8 @@ out:
 }
 
 
-int datagram_recv_ctl(struct sock *sk, struct msghdr *msg, struct sk_buff *skb)
+int ip6_datagram_recv_ctl(struct sock *sk, struct msghdr *msg,
+                          struct sk_buff *skb)
 {
         struct ipv6_pinfo *np = inet6_sk(sk);
         struct inet6_skb_parm *opt = IP6CB(skb);
@@ -598,11 +599,12 @@ int datagram_recv_ctl(struct sock *sk, struct msghdr *msg, struct sk_buff *skb)
         }
         return 0;
 }
+EXPORT_SYMBOL_GPL(ip6_datagram_recv_ctl);
 
-int datagram_send_ctl(struct net *net, struct sock *sk,
-                      struct msghdr *msg, struct flowi6 *fl6,
-                      struct ipv6_txoptions *opt,
-                      int *hlimit, int *tclass, int *dontfrag)
+int ip6_datagram_send_ctl(struct net *net, struct sock *sk,
+                          struct msghdr *msg, struct flowi6 *fl6,
+                          struct ipv6_txoptions *opt,
+                          int *hlimit, int *tclass, int *dontfrag)
 {
         struct in6_pktinfo *src_info;
         struct cmsghdr *cmsg;
@@ -872,4 +874,4 @@ int datagram_send_ctl(struct net *net, struct sock *sk,
 exit_f:
         return err;
 }
-EXPORT_SYMBOL_GPL(datagram_send_ctl);
+EXPORT_SYMBOL_GPL(ip6_datagram_send_ctl);
diff --git a/net/ipv6/ip6_flowlabel.c b/net/ipv6/ip6_flowlabel.c
index 22494afd981c..b973ed3d06cf 100644
--- a/net/ipv6/ip6_flowlabel.c
+++ b/net/ipv6/ip6_flowlabel.c
@@ -65,13 +65,13 @@ static DEFINE_SPINLOCK(ip6_fl_lock);
 static DEFINE_SPINLOCK(ip6_sk_fl_lock);
 
 #define for_each_fl_rcu(hash, fl)                               \
-        for (fl = rcu_dereference(fl_ht[(hash)]);               \
+        for (fl = rcu_dereference_bh(fl_ht[(hash)]);            \
              fl != NULL;                                        \
-             fl = rcu_dereference(fl->next))
+             fl = rcu_dereference_bh(fl->next))
 #define for_each_fl_continue_rcu(fl)                            \
-        for (fl = rcu_dereference(fl->next);                    \
+        for (fl = rcu_dereference_bh(fl->next);                 \
              fl != NULL;                                        \
-             fl = rcu_dereference(fl->next))
+             fl = rcu_dereference_bh(fl->next))
 
 #define for_each_sk_fl_rcu(np, sfl)                             \
         for (sfl = rcu_dereference_bh(np->ipv6_fl_list);        \
@@ -390,8 +390,8 @@ fl_create(struct net *net, struct sock *sk, struct in6_flowlabel_req *freq,
                 msg.msg_control = (void*)(fl->opt+1);
                 memset(&flowi6, 0, sizeof(flowi6));
 
-                err = datagram_send_ctl(net, sk, &msg, &flowi6, fl->opt, &junk,
-                                        &junk, &junk);
+                err = ip6_datagram_send_ctl(net, sk, &msg, &flowi6, fl->opt,
+                                            &junk, &junk, &junk);
                 if (err)
                         goto done;
                 err = -EINVAL;
@@ -806,15 +806,15 @@ static const struct file_operations ip6fl_seq_fops = {
 
 static int __net_init ip6_flowlabel_proc_init(struct net *net)
 {
-        if (!proc_net_fops_create(net, "ip6_flowlabel",
-                                  S_IRUGO, &ip6fl_seq_fops))
+        if (!proc_create("ip6_flowlabel", S_IRUGO, net->proc_net,
+                         &ip6fl_seq_fops))
                 return -ENOMEM;
         return 0;
 }
 
 static void __net_exit ip6_flowlabel_proc_fini(struct net *net)
 {
-        proc_net_remove(net, "ip6_flowlabel");
+        remove_proc_entry("ip6_flowlabel", net->proc_net);
 }
 #else
 static inline int ip6_flowlabel_proc_init(struct net *net)
diff --git a/net/ipv6/ip6_gre.c b/net/ipv6/ip6_gre.c
index db91fe3466a3..e4efffe2522e 100644
--- a/net/ipv6/ip6_gre.c
+++ b/net/ipv6/ip6_gre.c
@@ -958,7 +958,7 @@ static netdev_tx_t ip6gre_tunnel_xmit(struct sk_buff *skb,
         int ret;
 
         if (!ip6_tnl_xmit_ctl(t))
-                return -1;
+                goto tx_err;
 
         switch (skb->protocol) {
         case htons(ETH_P_IP):
diff --git a/net/ipv6/ip6_input.c b/net/ipv6/ip6_input.c
index 4ac5bf30e16a..5b10414e619e 100644
--- a/net/ipv6/ip6_input.c
+++ b/net/ipv6/ip6_input.c
@@ -118,6 +118,15 @@ int ipv6_rcv(struct sk_buff *skb, struct net_device *dev, struct packet_type *pt
             ipv6_addr_loopback(&hdr->daddr))
                 goto err;
 
+        /* RFC4291 2.7
+         * Nodes must not originate a packet to a multicast address whose scope
+         * field contains the reserved value 0; if such a packet is received, it
+         * must be silently dropped.
+         */
+        if (ipv6_addr_is_multicast(&hdr->daddr) &&
+            IPV6_ADDR_MC_SCOPE(&hdr->daddr) == 0)
+                goto err;
+
         /*
          * RFC4291 2.7
          * Multicast addresses must not be used as source addresses in IPv6
diff --git a/net/ipv6/ip6_offload.c b/net/ipv6/ip6_offload.c
index d141fc32a2ea..8234c1dcdf72 100644
--- a/net/ipv6/ip6_offload.c
+++ b/net/ipv6/ip6_offload.c
@@ -99,8 +99,8 @@ static struct sk_buff *ipv6_gso_segment(struct sk_buff *skb,
                      ~(SKB_GSO_UDP |
                        SKB_GSO_DODGY |
                        SKB_GSO_TCP_ECN |
+                       SKB_GSO_GRE |
                        SKB_GSO_TCPV6 |
-                       SKB_GSO_SHARED_FRAG |
                        0)))
                 goto out;
 
diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
index 906b7e6dd7fb..155eccfa7760 100644
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -120,6 +120,13 @@ static int ip6_finish_output2(struct sk_buff *skb)
 
                 IP6_UPD_PO_STATS(dev_net(dev), idev, IPSTATS_MIB_OUTMCAST,
                                 skb->len);
+
+                if (IPV6_ADDR_MC_SCOPE(&ipv6_hdr(skb)->daddr) <=
+                    IPV6_ADDR_SCOPE_NODELOCAL &&
+                    !(dev->flags & IFF_LOOPBACK)) {
+                        kfree_skb(skb);
+                        return 0;
+                }
         }
 
         rcu_read_lock_bh();
@@ -242,9 +249,8 @@ int ip6_xmit(struct sock *sk, struct sk_buff *skb, struct flowi6 *fl6,
                                dst->dev, dst_output);
         }
 
-        net_dbg_ratelimited("IPv6: sending pkt_too_big to self\n");
         skb->dev = dst->dev;
-        icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu);
+        ipv6_local_error(sk, EMSGSIZE, fl6, mtu);
         IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)), IPSTATS_MIB_FRAGFAILS);
         kfree_skb(skb);
         return -EMSGSIZE;
diff --git a/net/ipv6/ip6mr.c b/net/ipv6/ip6mr.c
index 351ce98e90d9..96bfb4e4b820 100644
--- a/net/ipv6/ip6mr.c
+++ b/net/ipv6/ip6mr.c
@@ -1359,9 +1359,9 @@ static int __net_init ip6mr_net_init(struct net *net)
 
 #ifdef CONFIG_PROC_FS
         err = -ENOMEM;
-        if (!proc_net_fops_create(net, "ip6_mr_vif", 0, &ip6mr_vif_fops))
+        if (!proc_create("ip6_mr_vif", 0, net->proc_net, &ip6mr_vif_fops))
                 goto proc_vif_fail;
-        if (!proc_net_fops_create(net, "ip6_mr_cache", 0, &ip6mr_mfc_fops))
+        if (!proc_create("ip6_mr_cache", 0, net->proc_net, &ip6mr_mfc_fops))
                 goto proc_cache_fail;
 #endif
 
@@ -1369,7 +1369,7 @@ static int __net_init ip6mr_net_init(struct net *net)
 
 #ifdef CONFIG_PROC_FS
 proc_cache_fail:
-        proc_net_remove(net, "ip6_mr_vif");
+        remove_proc_entry("ip6_mr_vif", net->proc_net);
 proc_vif_fail:
         ip6mr_rules_exit(net);
 #endif
@@ -1380,8 +1380,8 @@ fail:
 static void __net_exit ip6mr_net_exit(struct net *net)
 {
 #ifdef CONFIG_PROC_FS
-        proc_net_remove(net, "ip6_mr_cache");
-        proc_net_remove(net, "ip6_mr_vif");
+        remove_proc_entry("ip6_mr_cache", net->proc_net);
+        remove_proc_entry("ip6_mr_vif", net->proc_net);
 #endif
         ip6mr_rules_exit(net);
 }
diff --git a/net/ipv6/ipv6_sockglue.c b/net/ipv6/ipv6_sockglue.c
index ee94d31c9d4d..d1e2e8ef29c5 100644
--- a/net/ipv6/ipv6_sockglue.c
+++ b/net/ipv6/ipv6_sockglue.c
@@ -476,8 +476,8 @@ sticky_done:
                 msg.msg_controllen = optlen;
                 msg.msg_control = (void*)(opt+1);
 
-                retv = datagram_send_ctl(net, sk, &msg, &fl6, opt, &junk, &junk,
-                                         &junk);
+                retv = ip6_datagram_send_ctl(net, sk, &msg, &fl6, opt, &junk,
+                                             &junk, &junk);
                 if (retv)
                         goto done;
 update:
@@ -1002,7 +1002,7 @@ static int do_ipv6_getsockopt(struct sock *sk, int level, int optname,
                 release_sock(sk);
 
                 if (skb) {
-                        int err = datagram_recv_ctl(sk, &msg, skb);
+                        int err = ip6_datagram_recv_ctl(sk, &msg, skb);
                         kfree_skb(skb);
                         if (err)
                                 return err;
diff --git a/net/ipv6/mcast.c b/net/ipv6/mcast.c
index e5de48551864..bfa6cc36ef2a 100644
--- a/net/ipv6/mcast.c
+++ b/net/ipv6/mcast.c
@@ -661,6 +661,10 @@ static void igmp6_group_added(struct ifmcaddr6 *mc)
         struct net_device *dev = mc->idev->dev;
         char buf[MAX_ADDR_LEN];
 
+        if (IPV6_ADDR_MC_SCOPE(&mc->mca_addr) <
+            IPV6_ADDR_SCOPE_LINKLOCAL)
+                return;
+
         spin_lock_bh(&mc->mca_lock);
         if (!(mc->mca_flags&MAF_LOADED)) {
                 mc->mca_flags |= MAF_LOADED;
@@ -687,6 +691,10 @@ static void igmp6_group_dropped(struct ifmcaddr6 *mc)
         struct net_device *dev = mc->idev->dev;
         char buf[MAX_ADDR_LEN];
 
+        if (IPV6_ADDR_MC_SCOPE(&mc->mca_addr) <
+            IPV6_ADDR_SCOPE_LINKLOCAL)
+                return;
+
         spin_lock_bh(&mc->mca_lock);
         if (mc->mca_flags&MAF_LOADED) {
                 mc->mca_flags &= ~MAF_LOADED;
@@ -2591,10 +2599,10 @@ static int __net_init igmp6_proc_init(struct net *net)
         int err;
 
         err = -ENOMEM;
-        if (!proc_net_fops_create(net, "igmp6", S_IRUGO, &igmp6_mc_seq_fops))
+        if (!proc_create("igmp6", S_IRUGO, net->proc_net, &igmp6_mc_seq_fops))
                 goto out;
-        if (!proc_net_fops_create(net, "mcfilter6", S_IRUGO,
-                                  &igmp6_mcf_seq_fops))
+        if (!proc_create("mcfilter6", S_IRUGO, net->proc_net,
+                         &igmp6_mcf_seq_fops))
                 goto out_proc_net_igmp6;
 
         err = 0;
@@ -2602,14 +2610,14 @@ out:
         return err;
 
 out_proc_net_igmp6:
-        proc_net_remove(net, "igmp6");
+        remove_proc_entry("igmp6", net->proc_net);
         goto out;
 }
 
 static void __net_exit igmp6_proc_exit(struct net *net)
 {
-        proc_net_remove(net, "mcfilter6");
-        proc_net_remove(net, "igmp6");
+        remove_proc_entry("mcfilter6", net->proc_net);
+        remove_proc_entry("igmp6", net->proc_net);
 }
 #else
 static inline int igmp6_proc_init(struct net *net)
diff --git a/net/ipv6/netfilter/ip6t_NPT.c b/net/ipv6/netfilter/ip6t_NPT.c
index 7302b0b7b642..83acc1405a18 100644
--- a/net/ipv6/netfilter/ip6t_NPT.c
+++ b/net/ipv6/netfilter/ip6t_NPT.c
@@ -9,6 +9,7 @@
 #include <linux/module.h>
 #include <linux/skbuff.h>
 #include <linux/ipv6.h>
+#include <net/ipv6.h>
 #include <linux/netfilter.h>
 #include <linux/netfilter_ipv6.h>
 #include <linux/netfilter_ipv6/ip6t_NPT.h>
@@ -18,11 +19,20 @@ static int ip6t_npt_checkentry(const struct xt_tgchk_param *par)
 {
         struct ip6t_npt_tginfo *npt = par->targinfo;
         __wsum src_sum = 0, dst_sum = 0;
+        struct in6_addr pfx;
         unsigned int i;
 
         if (npt->src_pfx_len > 64 || npt->dst_pfx_len > 64)
                 return -EINVAL;
 
+        /* Ensure that LSB of prefix is zero */
+        ipv6_addr_prefix(&pfx, &npt->src_pfx.in6, npt->src_pfx_len);
+        if (!ipv6_addr_equal(&pfx, &npt->src_pfx.in6))
+                return -EINVAL;
+        ipv6_addr_prefix(&pfx, &npt->dst_pfx.in6, npt->dst_pfx_len);
+        if (!ipv6_addr_equal(&pfx, &npt->dst_pfx.in6))
+                return -EINVAL;
+
         for (i = 0; i < ARRAY_SIZE(npt->src_pfx.in6.s6_addr16); i++) {
                 src_sum = csum_add(src_sum,
                                 (__force __wsum)npt->src_pfx.in6.s6_addr16[i]);
@@ -30,7 +40,7 @@ static int ip6t_npt_checkentry(const struct xt_tgchk_param *par)
                                 (__force __wsum)npt->dst_pfx.in6.s6_addr16[i]);
         }
 
-        npt->adjustment = (__force __sum16) csum_sub(src_sum, dst_sum);
+        npt->adjustment = ~csum_fold(csum_sub(src_sum, dst_sum));
         return 0;
 }
 
@@ -51,7 +61,7 @@ static bool ip6t_npt_map_pfx(const struct ip6t_npt_tginfo *npt,
 
                 idx = i / 32;
                 addr->s6_addr32[idx] &= mask;
-                addr->s6_addr32[idx] |= npt->dst_pfx.in6.s6_addr32[idx];
+                addr->s6_addr32[idx] |= ~mask & npt->dst_pfx.in6.s6_addr32[idx];
         }
 
         if (pfx_len <= 48)
@@ -66,8 +76,8 @@ static bool ip6t_npt_map_pfx(const struct ip6t_npt_tginfo *npt,
                         return false;
         }
 
-        sum = (__force __sum16) csum_add((__force __wsum)addr->s6_addr16[idx],
-                         npt->adjustment);
+        sum = ~csum_fold(csum_add(csum_unfold((__force __sum16)addr->s6_addr16[idx]),
+                                  csum_unfold(npt->adjustment)));
         if (sum == CSUM_MANGLED_0)
                 sum = 0;
         *(__force __sum16 *)&addr->s6_addr16[idx] = sum;
diff --git a/net/ipv6/netfilter/nf_conntrack_reasm.c b/net/ipv6/netfilter/nf_conntrack_reasm.c
index c674f158efa8..54087e96d7b8 100644
--- a/net/ipv6/netfilter/nf_conntrack_reasm.c
+++ b/net/ipv6/netfilter/nf_conntrack_reasm.c
@@ -97,9 +97,9 @@ static int nf_ct_frag6_sysctl_register(struct net *net)
                 if (table == NULL)
                         goto err_alloc;
 
-                table[0].data = &net->ipv6.frags.high_thresh;
-                table[1].data = &net->ipv6.frags.low_thresh;
-                table[2].data = &net->ipv6.frags.timeout;
+                table[0].data = &net->nf_frag.frags.timeout;
+                table[1].data = &net->nf_frag.frags.low_thresh;
+                table[2].data = &net->nf_frag.frags.high_thresh;
         }
 
         hdr = register_net_sysctl(net, "net/netfilter", table);
@@ -368,7 +368,7 @@ nf_ct_frag6_reasm(struct frag_queue *fq, struct net_device *dev)
         }
 
         /* Head of list must not be cloned. */
-        if (skb_cloned(head) && pskb_expand_head(head, 0, 0, GFP_ATOMIC)) {
+        if (skb_unclone(head, GFP_ATOMIC)) {
                 pr_debug("skb is cloned but can't expand head");
                 goto out_oom;
         }
diff --git a/net/ipv6/proc.c b/net/ipv6/proc.c
index 745a32042950..bbbe53a99b57 100644
--- a/net/ipv6/proc.c
+++ b/net/ipv6/proc.c
@@ -295,11 +295,11 @@ int snmp6_unregister_dev(struct inet6_dev *idev)
 
 static int __net_init ipv6_proc_init_net(struct net *net)
 {
-        if (!proc_net_fops_create(net, "sockstat6", S_IRUGO,
-                        &sockstat6_seq_fops))
+        if (!proc_create("sockstat6", S_IRUGO, net->proc_net,
+                         &sockstat6_seq_fops))
                 return -ENOMEM;
 
-        if (!proc_net_fops_create(net, "snmp6", S_IRUGO, &snmp6_seq_fops))
+        if (!proc_create("snmp6", S_IRUGO, net->proc_net, &snmp6_seq_fops))
                 goto proc_snmp6_fail;
 
         net->mib.proc_net_devsnmp6 = proc_mkdir("dev_snmp6", net->proc_net);
@@ -308,17 +308,17 @@ static int __net_init ipv6_proc_init_net(struct net *net)
         return 0;
 
 proc_dev_snmp6_fail:
-        proc_net_remove(net, "snmp6");
+        remove_proc_entry("snmp6", net->proc_net);
 proc_snmp6_fail:
-        proc_net_remove(net, "sockstat6");
+        remove_proc_entry("sockstat6", net->proc_net);
         return -ENOMEM;
 }
 
 static void __net_exit ipv6_proc_exit_net(struct net *net)
 {
-        proc_net_remove(net, "sockstat6");
-        proc_net_remove(net, "dev_snmp6");
-        proc_net_remove(net, "snmp6");
+        remove_proc_entry("sockstat6", net->proc_net);
+        remove_proc_entry("dev_snmp6", net->proc_net);
+        remove_proc_entry("snmp6", net->proc_net);
 }
 
 static struct pernet_operations ipv6_proc_ops = {
diff --git a/net/ipv6/raw.c b/net/ipv6/raw.c
index 6cd29b1e8b92..c65907db8c44 100644
--- a/net/ipv6/raw.c
+++ b/net/ipv6/raw.c
@@ -507,7 +507,7 @@ static int rawv6_recvmsg(struct kiocb *iocb, struct sock *sk,
         sock_recv_ts_and_drops(msg, sk, skb);
 
         if (np->rxopt.all)
-                datagram_recv_ctl(sk, msg, skb);
+                ip6_datagram_recv_ctl(sk, msg, skb);
 
         err = copied;
         if (flags & MSG_TRUNC)
@@ -822,8 +822,8 @@ static int rawv6_sendmsg(struct kiocb *iocb, struct sock *sk,
                 memset(opt, 0, sizeof(struct ipv6_txoptions));
                 opt->tot_len = sizeof(struct ipv6_txoptions);
 
-                err = datagram_send_ctl(sock_net(sk), sk, msg, &fl6, opt,
-                                        &hlimit, &tclass, &dontfrag);
+                err = ip6_datagram_send_ctl(sock_net(sk), sk, msg, &fl6, opt,
+                                            &hlimit, &tclass, &dontfrag);
                 if (err < 0) {
                         fl6_sock_release(flowlabel);
                         return err;
@@ -1292,7 +1292,7 @@ static const struct file_operations raw6_seq_fops = {
 
 static int __net_init raw6_init_net(struct net *net)
 {
-        if (!proc_net_fops_create(net, "raw6", S_IRUGO, &raw6_seq_fops))
+        if (!proc_create("raw6", S_IRUGO, net->proc_net, &raw6_seq_fops))
                 return -ENOMEM;
 
         return 0;
@@ -1300,7 +1300,7 @@ static int __net_init raw6_init_net(struct net *net)
 
 static void __net_exit raw6_exit_net(struct net *net)
 {
-        proc_net_remove(net, "raw6");
+        remove_proc_entry("raw6", net->proc_net);
 }
 
 static struct pernet_operations raw6_net_ops = {
diff --git a/net/ipv6/reassembly.c b/net/ipv6/reassembly.c
index bab2c270f292..3c6a77290c6e 100644
--- a/net/ipv6/reassembly.c
+++ b/net/ipv6/reassembly.c
@@ -79,20 +79,8 @@ unsigned int inet6_hash_frag(__be32 id, const struct in6_addr *saddr,
 {
         u32 c;
 
-        c = jhash_3words((__force u32)saddr->s6_addr32[0],
-                         (__force u32)saddr->s6_addr32[1],
-                         (__force u32)saddr->s6_addr32[2],
-                         rnd);
-
-        c = jhash_3words((__force u32)saddr->s6_addr32[3],
-                         (__force u32)daddr->s6_addr32[0],
-                         (__force u32)daddr->s6_addr32[1],
-                         c);
-
-        c =  jhash_3words((__force u32)daddr->s6_addr32[2],
-                          (__force u32)daddr->s6_addr32[3],
-                          (__force u32)id,
-                          c);
+        c = jhash_3words(ipv6_addr_hash(saddr), ipv6_addr_hash(daddr),
+                         (__force u32)id, rnd);
 
         return c & (INETFRAGS_HASHSZ - 1);
 }
@@ -404,7 +392,7 @@ static int ip6_frag_reasm(struct frag_queue *fq, struct sk_buff *prev,
                 goto out_oversize;
 
         /* Head of list must not be cloned. */
-        if (skb_cloned(head) && pskb_expand_head(head, 0, 0, GFP_ATOMIC))
+        if (skb_unclone(head, GFP_ATOMIC))
                 goto out_oom;
 
         /* If the first fragment is fragmented itself, we split
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index f3328bc1174f..515bb51e05a8 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -2995,8 +2995,8 @@ static void __net_exit ip6_route_net_exit(struct net *net)
 static int __net_init ip6_route_net_init_late(struct net *net)
 {
 #ifdef CONFIG_PROC_FS
-        proc_net_fops_create(net, "ipv6_route", 0, &ipv6_route_proc_fops);
-        proc_net_fops_create(net, "rt6_stats", S_IRUGO, &rt6_stats_seq_fops);
+        proc_create("ipv6_route", 0, net->proc_net, &ipv6_route_proc_fops);
+        proc_create("rt6_stats", S_IRUGO, net->proc_net, &rt6_stats_seq_fops);
 #endif
         return 0;
 }
@@ -3004,8 +3004,8 @@ static int __net_init ip6_route_net_init_late(struct net *net)
 static void __net_exit ip6_route_net_exit_late(struct net *net)
 {
 #ifdef CONFIG_PROC_FS
-        proc_net_remove(net, "ipv6_route");
-        proc_net_remove(net, "rt6_stats");
+        remove_proc_entry("ipv6_route", net->proc_net);
+        remove_proc_entry("rt6_stats", net->proc_net);
 #endif
 }
 
diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
index 06087e58738a..9b6460055df5 100644
--- a/net/ipv6/tcp_ipv6.c
+++ b/net/ipv6/tcp_ipv6.c
@@ -423,6 +423,7 @@ static void tcp_v6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
                 }
 
                 inet_csk_reqsk_queue_drop(sk, req, prev);
+                NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_LISTENDROPS);
                 goto out;
 
         case TCP_SYN_SENT:
@@ -712,7 +713,8 @@ static const struct tcp_request_sock_ops tcp_request_sock_ipv6_ops = {
 #endif
 
 static void tcp_v6_send_response(struct sk_buff *skb, u32 seq, u32 ack, u32 win,
-                                 u32 ts, struct tcp_md5sig_key *key, int rst, u8 tclass)
+                                 u32 tsval, u32 tsecr,
+                                 struct tcp_md5sig_key *key, int rst, u8 tclass)
 {
         const struct tcphdr *th = tcp_hdr(skb);
         struct tcphdr *t1;
@@ -724,7 +726,7 @@ static void tcp_v6_send_response(struct sk_buff *skb, u32 seq, u32 ack, u32 win,
         struct dst_entry *dst;
         __be32 *topt;
 
-        if (ts)
+        if (tsecr)
                 tot_len += TCPOLEN_TSTAMP_ALIGNED;
 #ifdef CONFIG_TCP_MD5SIG
         if (key)
@@ -754,11 +756,11 @@ static void tcp_v6_send_response(struct sk_buff *skb, u32 seq, u32 ack, u32 win,
 
         topt = (__be32 *)(t1 + 1);
 
-        if (ts) {
+        if (tsecr) {
                 *topt++ = htonl((TCPOPT_NOP << 24) | (TCPOPT_NOP << 16) |
                                 (TCPOPT_TIMESTAMP << 8) | TCPOLEN_TIMESTAMP);
-                *topt++ = htonl(tcp_time_stamp);
-                *topt++ = htonl(ts);
+                *topt++ = htonl(tsval);
+                *topt++ = htonl(tsecr);
         }
 
 #ifdef CONFIG_TCP_MD5SIG
@@ -859,7 +861,7 @@ static void tcp_v6_send_reset(struct sock *sk, struct sk_buff *skb)
                 ack_seq = ntohl(th->seq) + th->syn + th->fin + skb->len -
                           (th->doff << 2);
 
-        tcp_v6_send_response(skb, seq, ack_seq, 0, 0, key, 1, 0);
+        tcp_v6_send_response(skb, seq, ack_seq, 0, 0, 0, key, 1, 0);
 
 #ifdef CONFIG_TCP_MD5SIG
 release_sk1:
@@ -870,10 +872,11 @@ release_sk1:
 #endif
 }
 
-static void tcp_v6_send_ack(struct sk_buff *skb, u32 seq, u32 ack, u32 win, u32 ts,
+static void tcp_v6_send_ack(struct sk_buff *skb, u32 seq, u32 ack,
+                            u32 win, u32 tsval, u32 tsecr,
                             struct tcp_md5sig_key *key, u8 tclass)
 {
-        tcp_v6_send_response(skb, seq, ack, win, ts, key, 0, tclass);
+        tcp_v6_send_response(skb, seq, ack, win, tsval, tsecr, key, 0, tclass);
 }
 
 static void tcp_v6_timewait_ack(struct sock *sk, struct sk_buff *skb)
@@ -883,6 +886,7 @@ static void tcp_v6_timewait_ack(struct sock *sk, struct sk_buff *skb)
 
         tcp_v6_send_ack(skb, tcptw->tw_snd_nxt, tcptw->tw_rcv_nxt,
                         tcptw->tw_rcv_wnd >> tw->tw_rcv_wscale,
+                        tcp_time_stamp + tcptw->tw_ts_offset,
                         tcptw->tw_ts_recent, tcp_twsk_md5_key(tcptw),
                         tw->tw_tclass);
 
@@ -892,7 +896,8 @@ static void tcp_v6_timewait_ack(struct sock *sk, struct sk_buff *skb)
 static void tcp_v6_reqsk_send_ack(struct sock *sk, struct sk_buff *skb,
                                   struct request_sock *req)
 {
-        tcp_v6_send_ack(skb, tcp_rsk(req)->snt_isn + 1, tcp_rsk(req)->rcv_isn + 1, req->rcv_wnd, req->ts_recent,
+        tcp_v6_send_ack(skb, tcp_rsk(req)->snt_isn + 1, tcp_rsk(req)->rcv_isn + 1,
+                        req->rcv_wnd, tcp_time_stamp, req->ts_recent,
                         tcp_v6_md5_do_lookup(sk, &ipv6_hdr(skb)->daddr), 0);
 }
 
@@ -959,8 +964,10 @@ static int tcp_v6_conn_request(struct sock *sk, struct sk_buff *skb)
                         goto drop;
         }
 
-        if (sk_acceptq_is_full(sk) && inet_csk_reqsk_queue_young(sk) > 1)
+        if (sk_acceptq_is_full(sk) && inet_csk_reqsk_queue_young(sk) > 1) {
+                NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_LISTENOVERFLOWS);
                 goto drop;
+        }
 
         req = inet6_reqsk_alloc(&tcp6_request_sock_ops);
         if (req == NULL)
@@ -1109,6 +1116,7 @@ drop_and_release:
 drop_and_free:
         reqsk_free(req);
 drop:
+        NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_LISTENDROPS);
         return 0; /* don't send reset */
 }
 
diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
index cb5bf497c09c..599e1ba6d1ce 100644
--- a/net/ipv6/udp.c
+++ b/net/ipv6/udp.c
@@ -467,7 +467,7 @@ try_again:
                         ip_cmsg_recv(msg, skb);
         } else {
                 if (np->rxopt.all)
-                        datagram_recv_ctl(sk, msg, skb);
+                        ip6_datagram_recv_ctl(sk, msg, skb);
         }
 
         err = copied;
@@ -1143,8 +1143,8 @@ do_udp_sendmsg:
                 memset(opt, 0, sizeof(struct ipv6_txoptions));
                 opt->tot_len = sizeof(*opt);
 
-                err = datagram_send_ctl(sock_net(sk), sk, msg, &fl6, opt,
-                                        &hlimit, &tclass, &dontfrag);
+                err = ip6_datagram_send_ctl(sock_net(sk), sk, msg, &fl6, opt,
+                                            &hlimit, &tclass, &dontfrag);
                 if (err < 0) {
                         fl6_sock_release(flowlabel);
                         return err;
diff --git a/net/ipv6/udp_offload.c b/net/ipv6/udp_offload.c
index 0c8934a317c2..cf05cf073c51 100644
--- a/net/ipv6/udp_offload.c
+++ b/net/ipv6/udp_offload.c
@@ -56,7 +56,8 @@ static struct sk_buff *udp6_ufo_fragment(struct sk_buff *skb,
                 /* Packet is from an untrusted source, reset gso_segs. */
                 int type = skb_shinfo(skb)->gso_type;
 
-                if (unlikely(type & ~(SKB_GSO_UDP | SKB_GSO_DODGY) ||
+                if (unlikely(type & ~(SKB_GSO_UDP | SKB_GSO_DODGY |
+                                      SKB_GSO_GRE) ||
                              !(type & (SKB_GSO_UDP))))
                         goto out;
 
diff --git a/net/ipv6/xfrm6_mode_tunnel.c b/net/ipv6/xfrm6_mode_tunnel.c
index 9f2095b19ad0..9bf6a74a71d2 100644
--- a/net/ipv6/xfrm6_mode_tunnel.c
+++ b/net/ipv6/xfrm6_mode_tunnel.c
@@ -69,8 +69,8 @@ static int xfrm6_mode_tunnel_input(struct xfrm_state *x, struct sk_buff *skb)
         if (!pskb_may_pull(skb, sizeof(struct ipv6hdr)))
                 goto out;
 
-        if (skb_cloned(skb) &&
-            (err = pskb_expand_head(skb, 0, 0, GFP_ATOMIC)))
+        err = skb_unclone(skb, GFP_ATOMIC);
+        if (err)
                 goto out;
 
         if (x->props.flags & XFRM_STATE_DECAP_DSCP)
diff --git a/net/ipv6/xfrm6_policy.c b/net/ipv6/xfrm6_policy.c
index 128273744332..4ef7bdb65440 100644
--- a/net/ipv6/xfrm6_policy.c
+++ b/net/ipv6/xfrm6_policy.c
@@ -320,7 +320,51 @@ static struct ctl_table xfrm6_policy_table[] = {
         { }
 };
 
-static struct ctl_table_header *sysctl_hdr;
+static int __net_init xfrm6_net_init(struct net *net)
+{
+        struct ctl_table *table;
+        struct ctl_table_header *hdr;
+
+        table = xfrm6_policy_table;
+        if (!net_eq(net, &init_net)) {
+                table = kmemdup(table, sizeof(xfrm6_policy_table), GFP_KERNEL);
+                if (!table)
+                        goto err_alloc;
+
+                table[0].data = &net->xfrm.xfrm6_dst_ops.gc_thresh;
+        }
+
+        hdr = register_net_sysctl(net, "net/ipv6", table);
+        if (!hdr)
+                goto err_reg;
+
+        net->ipv6.sysctl.xfrm6_hdr = hdr;
+        return 0;
+
+err_reg:
+        if (!net_eq(net, &init_net))
+                kfree(table);
+err_alloc:
+        return -ENOMEM;
+}
+
+static void __net_exit xfrm6_net_exit(struct net *net)
+{
+        struct ctl_table *table;
+
+        if (net->ipv6.sysctl.xfrm6_hdr == NULL)
+                return;
+
+        table = net->ipv6.sysctl.xfrm6_hdr->ctl_table_arg;
+        unregister_net_sysctl_table(net->ipv6.sysctl.xfrm6_hdr);
+        if (!net_eq(net, &init_net))
+                kfree(table);
+}
+
+static struct pernet_operations xfrm6_net_ops = {
+        .init   = xfrm6_net_init,
+        .exit   = xfrm6_net_exit,
+};
 #endif
 
 int __init xfrm6_init(void)
@@ -339,8 +383,7 @@ int __init xfrm6_init(void)
                 goto out_policy;
 
 #ifdef CONFIG_SYSCTL
-        sysctl_hdr = register_net_sysctl(&init_net, "net/ipv6",
-                                         xfrm6_policy_table);
+        register_pernet_subsys(&xfrm6_net_ops);
 #endif
 out:
         return ret;
@@ -352,8 +395,7 @@ out_policy:
 void xfrm6_fini(void)
 {
 #ifdef CONFIG_SYSCTL
-        if (sysctl_hdr)
-                unregister_net_sysctl_table(sysctl_hdr);
+        unregister_pernet_subsys(&xfrm6_net_ops);
 #endif
         xfrm6_policy_fini();
         xfrm6_state_fini();
diff --git a/net/key/af_key.c b/net/key/af_key.c
index cc2630ac8061..9ef79851f297 100644
--- a/net/key/af_key.c
+++ b/net/key/af_key.c
@@ -203,7 +203,6 @@ static int pfkey_broadcast_one(struct sk_buff *skb, struct sk_buff **skb2,
         }
         if (*skb2 != NULL) {
                 if (atomic_read(&sk->sk_rmem_alloc) <= sk->sk_rcvbuf) {
-                        skb_orphan(*skb2);
                         skb_set_owner_r(*skb2, sk);
                         skb_queue_tail(&sk->sk_receive_queue, *skb2);
                         sk->sk_data_ready(sk, (*skb2)->len);
@@ -816,18 +815,21 @@ static struct sk_buff *__pfkey_xfrm_state2msg(const struct xfrm_state *x,
         sa->sadb_sa_auth = 0;
         if (x->aalg) {
                 struct xfrm_algo_desc *a = xfrm_aalg_get_byname(x->aalg->alg_name, 0);
-                sa->sadb_sa_auth = a ? a->desc.sadb_alg_id : 0;
+                sa->sadb_sa_auth = (a && a->pfkey_supported) ?
+                                        a->desc.sadb_alg_id : 0;
         }
         sa->sadb_sa_encrypt = 0;
         BUG_ON(x->ealg && x->calg);
         if (x->ealg) {
                 struct xfrm_algo_desc *a = xfrm_ealg_get_byname(x->ealg->alg_name, 0);
-                sa->sadb_sa_encrypt = a ? a->desc.sadb_alg_id : 0;
+                sa->sadb_sa_encrypt = (a && a->pfkey_supported) ?
+                                        a->desc.sadb_alg_id : 0;
         }
         /* KAME compatible: sadb_sa_encrypt is overloaded with calg id */
         if (x->calg) {
                 struct xfrm_algo_desc *a = xfrm_calg_get_byname(x->calg->alg_name, 0);
-                sa->sadb_sa_encrypt = a ? a->desc.sadb_alg_id : 0;
+                sa->sadb_sa_encrypt = (a && a->pfkey_supported) ?
+                                        a->desc.sadb_alg_id : 0;
         }
 
         sa->sadb_sa_flags = 0;
@@ -1138,7 +1140,7 @@ static struct xfrm_state * pfkey_msg2xfrm_state(struct net *net,
         if (sa->sadb_sa_auth) {
                 int keysize = 0;
                 struct xfrm_algo_desc *a = xfrm_aalg_get_byid(sa->sadb_sa_auth);
-                if (!a) {
+                if (!a || !a->pfkey_supported) {
                         err = -ENOSYS;
                         goto out;
                 }
@@ -1160,7 +1162,7 @@ static struct xfrm_state * pfkey_msg2xfrm_state(struct net *net,
         if (sa->sadb_sa_encrypt) {
                 if (hdr->sadb_msg_satype == SADB_X_SATYPE_IPCOMP) {
                         struct xfrm_algo_desc *a = xfrm_calg_get_byid(sa->sadb_sa_encrypt);
-                        if (!a) {
+                        if (!a || !a->pfkey_supported) {
                                 err = -ENOSYS;
                                 goto out;
                         }
@@ -1172,7 +1174,7 @@ static struct xfrm_state * pfkey_msg2xfrm_state(struct net *net,
                 } else {
                         int keysize = 0;
                         struct xfrm_algo_desc *a = xfrm_ealg_get_byid(sa->sadb_sa_encrypt);
-                        if (!a) {
+                        if (!a || !a->pfkey_supported) {
                                 err = -ENOSYS;
                                 goto out;
                         }
@@ -1578,13 +1580,13 @@ static struct sk_buff *compose_sadb_supported(const struct sadb_msg *orig,
         struct sadb_msg *hdr;
         int len, auth_len, enc_len, i;
 
-        auth_len = xfrm_count_auth_supported();
+        auth_len = xfrm_count_pfkey_auth_supported();
         if (auth_len) {
                 auth_len *= sizeof(struct sadb_alg);
                 auth_len += sizeof(struct sadb_supported);
         }
 
-        enc_len = xfrm_count_enc_supported();
+        enc_len = xfrm_count_pfkey_enc_supported();
         if (enc_len) {
                 enc_len *= sizeof(struct sadb_alg);
                 enc_len += sizeof(struct sadb_supported);
@@ -1615,6 +1617,8 @@ static struct sk_buff *compose_sadb_supported(const struct sadb_msg *orig,
                         struct xfrm_algo_desc *aalg = xfrm_aalg_get_byidx(i);
                         if (!aalg)
                                 break;
+                        if (!aalg->pfkey_supported)
+                                continue;
                         if (aalg->available)
                                 *ap++ = aalg->desc;
                 }
@@ -1634,6 +1638,8 @@ static struct sk_buff *compose_sadb_supported(const struct sadb_msg *orig,
                         struct xfrm_algo_desc *ealg = xfrm_ealg_get_byidx(i);
                         if (!ealg)
                                 break;
+                        if (!ealg->pfkey_supported)
+                                continue;
                         if (ealg->available)
                                 *ap++ = ealg->desc;
                 }
@@ -2825,6 +2831,8 @@ static int count_ah_combs(const struct xfrm_tmpl *t)
                 const struct xfrm_algo_desc *aalg = xfrm_aalg_get_byidx(i);
                 if (!aalg)
                         break;
+                if (!aalg->pfkey_supported)
+                        continue;
                 if (aalg_tmpl_set(t, aalg) && aalg->available)
                         sz += sizeof(struct sadb_comb);
         }
@@ -2840,6 +2848,9 @@ static int count_esp_combs(const struct xfrm_tmpl *t)
                 if (!ealg)
                         break;
 
+                if (!ealg->pfkey_supported)
+                        continue;
+
                 if (!(ealg_tmpl_set(t, ealg) && ealg->available))
                         continue;
 
@@ -2848,6 +2859,9 @@ static int count_esp_combs(const struct xfrm_tmpl *t)
                         if (!aalg)
                                 break;
 
+                        if (!aalg->pfkey_supported)
+                                continue;
+
                         if (aalg_tmpl_set(t, aalg) && aalg->available)
                                 sz += sizeof(struct sadb_comb);
                 }
@@ -2871,6 +2885,9 @@ static void dump_ah_combs(struct sk_buff *skb, const struct xfrm_tmpl *t)
                 if (!aalg)
                         break;
 
+                if (!aalg->pfkey_supported)
+                        continue;
+
                 if (aalg_tmpl_set(t, aalg) && aalg->available) {
                         struct sadb_comb *c;
                         c = (struct sadb_comb*)skb_put(skb, sizeof(struct sadb_comb));
@@ -2903,6 +2920,9 @@ static void dump_esp_combs(struct sk_buff *skb, const struct xfrm_tmpl *t)
                 if (!ealg)
                         break;
 
+                if (!ealg->pfkey_supported)
+                        continue;
+
                 if (!(ealg_tmpl_set(t, ealg) && ealg->available))
                         continue;
 
@@ -2911,6 +2931,8 @@ static void dump_esp_combs(struct sk_buff *skb, const struct xfrm_tmpl *t)
                         const struct xfrm_algo_desc *aalg = xfrm_aalg_get_byidx(k);
                         if (!aalg)
                                 break;
+                        if (!aalg->pfkey_supported)
+                                continue;
                         if (!(aalg_tmpl_set(t, aalg) && aalg->available))
                                 continue;
                         c = (struct sadb_comb*)skb_put(skb, sizeof(struct sadb_comb));
@@ -3718,7 +3740,7 @@ static int __net_init pfkey_init_proc(struct net *net)
 {
         struct proc_dir_entry *e;
 
-        e = proc_net_fops_create(net, "pfkey", 0, &pfkey_proc_ops);
+        e = proc_create("pfkey", 0, net->proc_net, &pfkey_proc_ops);
         if (e == NULL)
                 return -ENOMEM;
 
@@ -3727,7 +3749,7 @@ static int __net_init pfkey_init_proc(struct net *net)
 
 static void __net_exit pfkey_exit_proc(struct net *net)
 {
-        proc_net_remove(net, "pfkey");
+        remove_proc_entry("pfkey", net->proc_net);
 }
 #else
 static inline int pfkey_init_proc(struct net *net)
diff --git a/net/l2tp/l2tp_core.c b/net/l2tp/l2tp_core.c
index 1a9f3723c13c..dcfd64e83ab7 100644
--- a/net/l2tp/l2tp_core.c
+++ b/net/l2tp/l2tp_core.c
@@ -101,6 +101,7 @@ struct l2tp_skb_cb {
 
 static atomic_t l2tp_tunnel_count;
 static atomic_t l2tp_session_count;
+static struct workqueue_struct *l2tp_wq;
 
 /* per-net private data for this module */
 static unsigned int l2tp_net_id;
@@ -122,7 +123,6 @@ static inline struct l2tp_net *l2tp_pernet(struct net *net)
         return net_generic(net, l2tp_net_id);
 }
 
-
 /* Tunnel reference counts. Incremented per session that is added to
  * the tunnel.
  */
@@ -168,6 +168,51 @@ l2tp_session_id_hash_2(struct l2tp_net *pn, u32 session_id)
 
 }
 
+/* Lookup the tunnel socket, possibly involving the fs code if the socket is
+ * owned by userspace.  A struct sock returned from this function must be
+ * released using l2tp_tunnel_sock_put once you're done with it.
+ */
+struct sock *l2tp_tunnel_sock_lookup(struct l2tp_tunnel *tunnel)
+{
+        int err = 0;
+        struct socket *sock = NULL;
+        struct sock *sk = NULL;
+
+        if (!tunnel)
+                goto out;
+
+        if (tunnel->fd >= 0) {
+                /* Socket is owned by userspace, who might be in the process
+                 * of closing it.  Look the socket up using the fd to ensure
+                 * consistency.
+                 */
+                sock = sockfd_lookup(tunnel->fd, &err);
+                if (sock)
+                        sk = sock->sk;
+        } else {
+                /* Socket is owned by kernelspace */
+                sk = tunnel->sock;
+        }
+
+out:
+        return sk;
+}
+EXPORT_SYMBOL_GPL(l2tp_tunnel_sock_lookup);
+
+/* Drop a reference to a tunnel socket obtained via. l2tp_tunnel_sock_put */
+void l2tp_tunnel_sock_put(struct sock *sk)
+{
+        struct l2tp_tunnel *tunnel = l2tp_sock_to_tunnel(sk);
+        if (tunnel) {
+                if (tunnel->fd >= 0) {
+                        /* Socket is owned by userspace */
+                        sockfd_put(sk->sk_socket);
+                }
+                sock_put(sk);
+        }
+}
+EXPORT_SYMBOL_GPL(l2tp_tunnel_sock_put);
+
 /* Lookup a session by id in the global session list
  */
 static struct l2tp_session *l2tp_session_find_2(struct net *net, u32 session_id)
@@ -1123,8 +1168,6 @@ int l2tp_xmit_skb(struct l2tp_session *session, struct sk_buff *skb, int hdr_len
         struct udphdr *uh;
         struct inet_sock *inet;
         __wsum csum;
-        int old_headroom;
-        int new_headroom;
         int headroom;
         int uhlen = (tunnel->encap == L2TP_ENCAPTYPE_UDP) ? sizeof(struct udphdr) : 0;
         int udp_len;
@@ -1136,16 +1179,12 @@ int l2tp_xmit_skb(struct l2tp_session *session, struct sk_buff *skb, int hdr_len
          */
         headroom = NET_SKB_PAD + sizeof(struct iphdr) +
                 uhlen + hdr_len;
-        old_headroom = skb_headroom(skb);
         if (skb_cow_head(skb, headroom)) {
                 kfree_skb(skb);
                 return NET_XMIT_DROP;
         }
 
-        new_headroom = skb_headroom(skb);
         skb_orphan(skb);
-        skb->truesize += new_headroom - old_headroom;
-
         /* Setup L2TP header */
         session->build_header(session, __skb_push(skb, hdr_len));
 
@@ -1232,6 +1271,7 @@ EXPORT_SYMBOL_GPL(l2tp_xmit_skb);
 static void l2tp_tunnel_destruct(struct sock *sk)
 {
         struct l2tp_tunnel *tunnel;
+        struct l2tp_net *pn;
 
         tunnel = sk->sk_user_data;
         if (tunnel == NULL)
@@ -1239,9 +1279,8 @@ static void l2tp_tunnel_destruct(struct sock *sk)
 
         l2tp_info(tunnel, L2TP_MSG_CONTROL, "%s: closing...\n", tunnel->name);
 
-        /* Close all sessions */
-        l2tp_tunnel_closeall(tunnel);
 
+        /* Disable udp encapsulation */
         switch (tunnel->encap) {
         case L2TP_ENCAPTYPE_UDP:
                 /* No longer an encapsulation socket. See net/ipv4/udp.c */
@@ -1253,17 +1292,23 @@ static void l2tp_tunnel_destruct(struct sock *sk)
         }
 
         /* Remove hooks into tunnel socket */
-        tunnel->sock = NULL;
         sk->sk_destruct = tunnel->old_sk_destruct;
         sk->sk_user_data = NULL;
+        tunnel->sock = NULL;
 
-        /* Call the original destructor */
-        if (sk->sk_destruct)
-                (*sk->sk_destruct)(sk);
+        /* Remove the tunnel struct from the tunnel list */
+        pn = l2tp_pernet(tunnel->l2tp_net);
+        spin_lock_bh(&pn->l2tp_tunnel_list_lock);
+        list_del_rcu(&tunnel->list);
+        spin_unlock_bh(&pn->l2tp_tunnel_list_lock);
+        atomic_dec(&l2tp_tunnel_count);
 
-        /* We're finished with the socket */
+        l2tp_tunnel_closeall(tunnel);
         l2tp_tunnel_dec_refcount(tunnel);
 
+        /* Call the original destructor */
+        if (sk->sk_destruct)
+                (*sk->sk_destruct)(sk);
 end:
         return;
 }
@@ -1337,48 +1382,77 @@ again:
  */
 static void l2tp_tunnel_free(struct l2tp_tunnel *tunnel)
 {
-        struct l2tp_net *pn = l2tp_pernet(tunnel->l2tp_net);
-
         BUG_ON(atomic_read(&tunnel->ref_count) != 0);
         BUG_ON(tunnel->sock != NULL);
-
         l2tp_info(tunnel, L2TP_MSG_CONTROL, "%s: free...\n", tunnel->name);
-
-        /* Remove from tunnel list */
-        spin_lock_bh(&pn->l2tp_tunnel_list_lock);
-        list_del_rcu(&tunnel->list);
         kfree_rcu(tunnel, rcu);
-        spin_unlock_bh(&pn->l2tp_tunnel_list_lock);
+}
 
-        atomic_dec(&l2tp_tunnel_count);
+/* Workqueue tunnel deletion function */
+static void l2tp_tunnel_del_work(struct work_struct *work)
+{
+        struct l2tp_tunnel *tunnel = NULL;
+        struct socket *sock = NULL;
+        struct sock *sk = NULL;
+
+        tunnel = container_of(work, struct l2tp_tunnel, del_work);
+        sk = l2tp_tunnel_sock_lookup(tunnel);
+        if (!sk)
+                return;
+
+        sock = sk->sk_socket;
+        BUG_ON(!sock);
+
+        /* If the tunnel socket was created directly by the kernel, use the
+         * sk_* API to release the socket now.  Otherwise go through the
+         * inet_* layer to shut the socket down, and let userspace close it.
+         * In either case the tunnel resources are freed in the socket
+         * destructor when the tunnel socket goes away.
+         */
+        if (sock->file == NULL) {
+                kernel_sock_shutdown(sock, SHUT_RDWR);
+                sk_release_kernel(sk);
+        } else {
+                inet_shutdown(sock, 2);
+        }
+
+        l2tp_tunnel_sock_put(sk);
 }
 
 /* Create a socket for the tunnel, if one isn't set up by
  * userspace. This is used for static tunnels where there is no
  * managing L2TP daemon.
+ *
+ * Since we don't want these sockets to keep a namespace alive by
+ * themselves, we drop the socket's namespace refcount after creation.
+ * These sockets are freed when the namespace exits using the pernet
+ * exit hook.
  */
-static int l2tp_tunnel_sock_create(u32 tunnel_id, u32 peer_tunnel_id, struct l2tp_tunnel_cfg *cfg, struct socket **sockp)
+static int l2tp_tunnel_sock_create(struct net *net,
+                                u32 tunnel_id,
+                                u32 peer_tunnel_id,
+                                struct l2tp_tunnel_cfg *cfg,
+                                struct socket **sockp)
 {
         int err = -EINVAL;
-        struct sockaddr_in udp_addr;
+        struct socket *sock = NULL;
+        struct sockaddr_in udp_addr = {0};
+        struct sockaddr_l2tpip ip_addr = {0};
 #if IS_ENABLED(CONFIG_IPV6)
-        struct sockaddr_in6 udp6_addr;
-        struct sockaddr_l2tpip6 ip6_addr;
+        struct sockaddr_in6 udp6_addr = {0};
+        struct sockaddr_l2tpip6 ip6_addr = {0};
 #endif
-        struct sockaddr_l2tpip ip_addr;
-        struct socket *sock = NULL;
 
         switch (cfg->encap) {
         case L2TP_ENCAPTYPE_UDP:
 #if IS_ENABLED(CONFIG_IPV6)
                 if (cfg->local_ip6 && cfg->peer_ip6) {
-                        err = sock_create(AF_INET6, SOCK_DGRAM, 0, sockp);
+                        err = sock_create_kern(AF_INET6, SOCK_DGRAM, 0, &sock);
                         if (err < 0)
                                 goto out;
 
-                        sock = *sockp;
+                        sk_change_net(sock->sk, net);
 
-                        memset(&udp6_addr, 0, sizeof(udp6_addr));
                         udp6_addr.sin6_family = AF_INET6;
                         memcpy(&udp6_addr.sin6_addr, cfg->local_ip6,
                                sizeof(udp6_addr.sin6_addr));
@@ -1400,13 +1474,12 @@ static int l2tp_tunnel_sock_create(u32 tunnel_id, u32 peer_tunnel_id, struct l2t
                 } else
 #endif
                 {
-                        err = sock_create(AF_INET, SOCK_DGRAM, 0, sockp);
+                        err = sock_create_kern(AF_INET, SOCK_DGRAM, 0, &sock);
                         if (err < 0)
                                 goto out;
 
-                        sock = *sockp;
+                        sk_change_net(sock->sk, net);
 
-                        memset(&udp_addr, 0, sizeof(udp_addr));
                         udp_addr.sin_family = AF_INET;
                         udp_addr.sin_addr = cfg->local_ip;
                         udp_addr.sin_port = htons(cfg->local_udp_port);
@@ -1433,14 +1506,13 @@ static int l2tp_tunnel_sock_create(u32 tunnel_id, u32 peer_tunnel_id, struct l2t
         case L2TP_ENCAPTYPE_IP:
 #if IS_ENABLED(CONFIG_IPV6)
                 if (cfg->local_ip6 && cfg->peer_ip6) {
-                        err = sock_create(AF_INET6, SOCK_DGRAM, IPPROTO_L2TP,
-                                          sockp);
+                        err = sock_create_kern(AF_INET6, SOCK_DGRAM,
+                                          IPPROTO_L2TP, &sock);
                         if (err < 0)
                                 goto out;
 
-                        sock = *sockp;
+                        sk_change_net(sock->sk, net);
 
-                        memset(&ip6_addr, 0, sizeof(ip6_addr));
                         ip6_addr.l2tp_family = AF_INET6;
                         memcpy(&ip6_addr.l2tp_addr, cfg->local_ip6,
                                sizeof(ip6_addr.l2tp_addr));
@@ -1462,14 +1534,13 @@ static int l2tp_tunnel_sock_create(u32 tunnel_id, u32 peer_tunnel_id, struct l2t
                 } else
 #endif
                 {
-                        err = sock_create(AF_INET, SOCK_DGRAM, IPPROTO_L2TP,
-                                          sockp);
+                        err = sock_create_kern(AF_INET, SOCK_DGRAM,
+                                          IPPROTO_L2TP, &sock);
                         if (err < 0)
                                 goto out;
 
-                        sock = *sockp;
+                        sk_change_net(sock->sk, net);
 
-                        memset(&ip_addr, 0, sizeof(ip_addr));
                         ip_addr.l2tp_family = AF_INET;
                         ip_addr.l2tp_addr = cfg->local_ip;
                         ip_addr.l2tp_conn_id = tunnel_id;
@@ -1493,8 +1564,10 @@ static int l2tp_tunnel_sock_create(u32 tunnel_id, u32 peer_tunnel_id, struct l2t
         }
 
 out:
+        *sockp = sock;
         if ((err < 0) && sock) {
-                sock_release(sock);
+                kernel_sock_shutdown(sock, SHUT_RDWR);
+                sk_release_kernel(sock->sk);
                 *sockp = NULL;
         }
 
@@ -1517,15 +1590,23 @@ int l2tp_tunnel_create(struct net *net, int fd, int version, u32 tunnel_id, u32
          * kernel socket.
          */
         if (fd < 0) {
-                err = l2tp_tunnel_sock_create(tunnel_id, peer_tunnel_id, cfg, &sock);
+                err = l2tp_tunnel_sock_create(net, tunnel_id, peer_tunnel_id,
+                                cfg, &sock);
                 if (err < 0)
                         goto err;
         } else {
-                err = -EBADF;
                 sock = sockfd_lookup(fd, &err);
                 if (!sock) {
-                        pr_err("tunl %hu: sockfd_lookup(fd=%d) returned %d\n",
+                        pr_err("tunl %u: sockfd_lookup(fd=%d) returned %d\n",
                                tunnel_id, fd, err);
+                        err = -EBADF;
+                        goto err;
+                }
+
+                /* Reject namespace mismatches */
+                if (!net_eq(sock_net(sock->sk), net)) {
+                        pr_err("tunl %u: netns mismatch\n", tunnel_id);
+                        err = -EINVAL;
                         goto err;
                 }
         }
@@ -1607,10 +1688,14 @@ int l2tp_tunnel_create(struct net *net, int fd, int version, u32 tunnel_id, u32
         tunnel->old_sk_destruct = sk->sk_destruct;
         sk->sk_destruct = &l2tp_tunnel_destruct;
         tunnel->sock = sk;
+        tunnel->fd = fd;
         lockdep_set_class_and_name(&sk->sk_lock.slock, &l2tp_socket_class, "l2tp_sock");
 
         sk->sk_allocation = GFP_ATOMIC;
 
+        /* Init delete workqueue struct */
+        INIT_WORK(&tunnel->del_work, l2tp_tunnel_del_work);
+
         /* Add tunnel to our list */
         INIT_LIST_HEAD(&tunnel->list);
         atomic_inc(&l2tp_tunnel_count);
@@ -1642,25 +1727,7 @@ EXPORT_SYMBOL_GPL(l2tp_tunnel_create);
  */
 int l2tp_tunnel_delete(struct l2tp_tunnel *tunnel)
 {
-        int err = 0;
-        struct socket *sock = tunnel->sock ? tunnel->sock->sk_socket : NULL;
-
-        /* Force the tunnel socket to close. This will eventually
-         * cause the tunnel to be deleted via the normal socket close
-         * mechanisms when userspace closes the tunnel socket.
-         */
-        if (sock != NULL) {
-                err = inet_shutdown(sock, 2);
-
-                /* If the tunnel's socket was created by the kernel,
-                 * close the socket here since the socket was not
-                 * created by userspace.
-                 */
-                if (sock->file == NULL)
-                        err = inet_release(sock);
-        }
-
-        return err;
+        return (false == queue_work(l2tp_wq, &tunnel->del_work));
 }
 EXPORT_SYMBOL_GPL(l2tp_tunnel_delete);
 
@@ -1844,8 +1911,21 @@ static __net_init int l2tp_init_net(struct net *net)
         return 0;
 }
 
+static __net_exit void l2tp_exit_net(struct net *net)
+{
+        struct l2tp_net *pn = l2tp_pernet(net);
+        struct l2tp_tunnel *tunnel = NULL;
+
+        rcu_read_lock_bh();
+        list_for_each_entry_rcu(tunnel, &pn->l2tp_tunnel_list, list) {
+                (void)l2tp_tunnel_delete(tunnel);
+        }
+        rcu_read_unlock_bh();
+}
+
 static struct pernet_operations l2tp_net_ops = {
         .init = l2tp_init_net,
+        .exit = l2tp_exit_net,
         .id   = &l2tp_net_id,
         .size = sizeof(struct l2tp_net),
 };
@@ -1858,6 +1938,13 @@ static int __init l2tp_init(void)
         if (rc)
                 goto out;
 
+        l2tp_wq = alloc_workqueue("l2tp", WQ_NON_REENTRANT | WQ_UNBOUND, 0);
+        if (!l2tp_wq) {
+                pr_err("alloc_workqueue failed\n");
+                rc = -ENOMEM;
+                goto out;
+        }
+
         pr_info("L2TP core driver, %s\n", L2TP_DRV_VERSION);
 
 out:
@@ -1867,6 +1954,10 @@ out:
 static void __exit l2tp_exit(void)
 {
         unregister_pernet_device(&l2tp_net_ops);
+        if (l2tp_wq) {
+                destroy_workqueue(l2tp_wq);
+                l2tp_wq = NULL;
+        }
 }
 
 module_init(l2tp_init);
diff --git a/net/l2tp/l2tp_core.h b/net/l2tp/l2tp_core.h
index 56d583e083a7..8eb8f1d47f3a 100644
--- a/net/l2tp/l2tp_core.h
+++ b/net/l2tp/l2tp_core.h
@@ -188,7 +188,10 @@ struct l2tp_tunnel {
         int (*recv_payload_hook)(struct sk_buff *skb);
         void (*old_sk_destruct)(struct sock *);
         struct sock             *sock;          /* Parent socket */
-        int                     fd;
+        int                     fd;             /* Parent fd, if tunnel socket
+                                                 * was created by userspace */
+
+        struct work_struct      del_work;
 
         uint8_t                 priv[0];        /* private data */
 };
@@ -228,6 +231,8 @@ out:
         return tunnel;
 }
 
+extern struct sock *l2tp_tunnel_sock_lookup(struct l2tp_tunnel *tunnel);
+extern void l2tp_tunnel_sock_put(struct sock *sk);
 extern struct l2tp_session *l2tp_session_find(struct net *net, struct l2tp_tunnel *tunnel, u32 session_id);
 extern struct l2tp_session *l2tp_session_find_nth(struct l2tp_tunnel *tunnel, int nth);
 extern struct l2tp_session *l2tp_session_find_by_ifname(struct net *net, char *ifname);
diff --git a/net/l2tp/l2tp_ip.c b/net/l2tp/l2tp_ip.c
index 61d8b75d2686..f7ac8f42fee2 100644
--- a/net/l2tp/l2tp_ip.c
+++ b/net/l2tp/l2tp_ip.c
@@ -115,6 +115,7 @@ static inline struct sock *l2tp_ip_bind_lookup(struct net *net, __be32 laddr, in
  */
 static int l2tp_ip_recv(struct sk_buff *skb)
 {
+        struct net *net = dev_net(skb->dev);
         struct sock *sk;
         u32 session_id;
         u32 tunnel_id;
@@ -142,7 +143,7 @@ static int l2tp_ip_recv(struct sk_buff *skb)
         }
 
         /* Ok, this is a data packet. Lookup the session. */
-        session = l2tp_session_find(&init_net, NULL, session_id);
+        session = l2tp_session_find(net, NULL, session_id);
         if (session == NULL)
                 goto discard;
 
@@ -173,14 +174,14 @@ pass_up:
                 goto discard;
 
         tunnel_id = ntohl(*(__be32 *) &skb->data[4]);
-        tunnel = l2tp_tunnel_find(&init_net, tunnel_id);
+        tunnel = l2tp_tunnel_find(net, tunnel_id);
         if (tunnel != NULL)
                 sk = tunnel->sock;
         else {
                 struct iphdr *iph = (struct iphdr *) skb_network_header(skb);
 
                 read_lock_bh(&l2tp_ip_lock);
-                sk = __l2tp_ip_bind_lookup(&init_net, iph->daddr, 0, tunnel_id);
+                sk = __l2tp_ip_bind_lookup(net, iph->daddr, 0, tunnel_id);
                 read_unlock_bh(&l2tp_ip_lock);
         }
 
@@ -239,6 +240,7 @@ static int l2tp_ip_bind(struct sock *sk, struct sockaddr *uaddr, int addr_len)
 {
         struct inet_sock *inet = inet_sk(sk);
         struct sockaddr_l2tpip *addr = (struct sockaddr_l2tpip *) uaddr;
+        struct net *net = sock_net(sk);
         int ret;
         int chk_addr_ret;
 
@@ -251,7 +253,8 @@ static int l2tp_ip_bind(struct sock *sk, struct sockaddr *uaddr, int addr_len)
 
         ret = -EADDRINUSE;
         read_lock_bh(&l2tp_ip_lock);
-        if (__l2tp_ip_bind_lookup(&init_net, addr->l2tp_addr.s_addr, sk->sk_bound_dev_if, addr->l2tp_conn_id))
+        if (__l2tp_ip_bind_lookup(net, addr->l2tp_addr.s_addr,
+                                  sk->sk_bound_dev_if, addr->l2tp_conn_id))
                 goto out_in_use;
 
         read_unlock_bh(&l2tp_ip_lock);
@@ -260,7 +263,7 @@ static int l2tp_ip_bind(struct sock *sk, struct sockaddr *uaddr, int addr_len)
         if (sk->sk_state != TCP_CLOSE || addr_len < sizeof(struct sockaddr_l2tpip))
                 goto out;
 
-        chk_addr_ret = inet_addr_type(&init_net, addr->l2tp_addr.s_addr);
+        chk_addr_ret = inet_addr_type(net, addr->l2tp_addr.s_addr);
         ret = -EADDRNOTAVAIL;
         if (addr->l2tp_addr.s_addr && chk_addr_ret != RTN_LOCAL &&
             chk_addr_ret != RTN_MULTICAST && chk_addr_ret != RTN_BROADCAST)
@@ -369,7 +372,7 @@ static int l2tp_ip_backlog_recv(struct sock *sk, struct sk_buff *skb)
         return 0;
 
 drop:
-        IP_INC_STATS(&init_net, IPSTATS_MIB_INDISCARDS);
+        IP_INC_STATS(sock_net(sk), IPSTATS_MIB_INDISCARDS);
         kfree_skb(skb);
         return -1;
 }
@@ -605,6 +608,7 @@ static struct inet_protosw l2tp_ip_protosw = {
 
 static struct net_protocol l2tp_ip_protocol __read_mostly = {
         .handler        = l2tp_ip_recv,
+        .netns_ok       = 1,
 };
 
 static int __init l2tp_ip_init(void)
diff --git a/net/l2tp/l2tp_ip6.c b/net/l2tp/l2tp_ip6.c
index 927547171bc7..8ee4a86ae996 100644
--- a/net/l2tp/l2tp_ip6.c
+++ b/net/l2tp/l2tp_ip6.c
@@ -554,8 +554,8 @@ static int l2tp_ip6_sendmsg(struct kiocb *iocb, struct sock *sk,
                 memset(opt, 0, sizeof(struct ipv6_txoptions));
                 opt->tot_len = sizeof(struct ipv6_txoptions);
 
-                err = datagram_send_ctl(sock_net(sk), sk, msg, &fl6, opt,
-                                        &hlimit, &tclass, &dontfrag);
+                err = ip6_datagram_send_ctl(sock_net(sk), sk, msg, &fl6, opt,
+                                            &hlimit, &tclass, &dontfrag);
                 if (err < 0) {
                         fl6_sock_release(flowlabel);
                         return err;
@@ -646,7 +646,7 @@ static int l2tp_ip6_recvmsg(struct kiocb *iocb, struct sock *sk,
                             struct msghdr *msg, size_t len, int noblock,
                             int flags, int *addr_len)
 {
-        struct inet_sock *inet = inet_sk(sk);
+        struct ipv6_pinfo *np = inet6_sk(sk);
         struct sockaddr_l2tpip6 *lsa = (struct sockaddr_l2tpip6 *)msg->msg_name;
         size_t copied = 0;
         int err = -EOPNOTSUPP;
@@ -688,8 +688,8 @@ static int l2tp_ip6_recvmsg(struct kiocb *iocb, struct sock *sk,
                         lsa->l2tp_scope_id = IP6CB(skb)->iif;
         }
 
-        if (inet->cmsg_flags)
-                ip_cmsg_recv(msg, skb);
+        if (np->rxopt.all)
+                ip6_datagram_recv_ctl(sk, msg, skb);
 
         if (flags & MSG_TRUNC)
                 copied = skb->len;
diff --git a/net/l2tp/l2tp_netlink.c b/net/l2tp/l2tp_netlink.c
index bbba3a19e944..c1bab22db85e 100644
--- a/net/l2tp/l2tp_netlink.c
+++ b/net/l2tp/l2tp_netlink.c
@@ -37,6 +37,7 @@ static struct genl_family l2tp_nl_family = {
         .version        = L2TP_GENL_VERSION,
         .hdrsize        = 0,
         .maxattr        = L2TP_ATTR_MAX,
+        .netnsok        = true,
 };
 
 /* Accessed under genl lock */
diff --git a/net/l2tp/l2tp_ppp.c b/net/l2tp/l2tp_ppp.c
index 286366ef8930..3f4e3afc191a 100644
--- a/net/l2tp/l2tp_ppp.c
+++ b/net/l2tp/l2tp_ppp.c
@@ -388,8 +388,6 @@ static int pppol2tp_xmit(struct ppp_channel *chan, struct sk_buff *skb)
         struct l2tp_session *session;
         struct l2tp_tunnel *tunnel;
         struct pppol2tp_session *ps;
-        int old_headroom;
-        int new_headroom;
         int uhlen, headroom;
 
         if (sock_flag(sk, SOCK_DEAD) || !(sk->sk_state & PPPOX_CONNECTED))
@@ -408,7 +406,6 @@ static int pppol2tp_xmit(struct ppp_channel *chan, struct sk_buff *skb)
         if (tunnel == NULL)
                 goto abort_put_sess;
 
-        old_headroom = skb_headroom(skb);
         uhlen = (tunnel->encap == L2TP_ENCAPTYPE_UDP) ? sizeof(struct udphdr) : 0;
         headroom = NET_SKB_PAD +
                    sizeof(struct iphdr) + /* IP header */
@@ -418,9 +415,6 @@ static int pppol2tp_xmit(struct ppp_channel *chan, struct sk_buff *skb)
         if (skb_cow_head(skb, headroom))
                 goto abort_put_sess_tun;
 
-        new_headroom = skb_headroom(skb);
-        skb->truesize += new_headroom - old_headroom;
-
         /* Setup PPP header */
         __skb_push(skb, sizeof(ppph));
         skb->data[0] = ppph[0];
@@ -1789,7 +1783,8 @@ static __net_init int pppol2tp_init_net(struct net *net)
         struct proc_dir_entry *pde;
         int err = 0;
 
-        pde = proc_net_fops_create(net, "pppol2tp", S_IRUGO, &pppol2tp_proc_fops);
+        pde = proc_create("pppol2tp", S_IRUGO, net->proc_net,
+                          &pppol2tp_proc_fops);
         if (!pde) {
                 err = -ENOMEM;
                 goto out;
@@ -1801,7 +1796,7 @@ out:
 
 static __net_exit void pppol2tp_exit_net(struct net *net)
 {
-        proc_net_remove(net, "pppol2tp");
+        remove_proc_entry("pppol2tp", net->proc_net);
 }
 
 static struct pernet_operations pppol2tp_net_ops = {
diff --git a/net/mac80211/Kconfig b/net/mac80211/Kconfig
index b4ecf267a34b..0ecf947ad378 100644
--- a/net/mac80211/Kconfig
+++ b/net/mac80211/Kconfig
@@ -258,6 +258,17 @@ config MAC80211_MESH_SYNC_DEBUG
 
           Do not select this option.
 
+config MAC80211_MESH_PS_DEBUG
+        bool "Verbose mesh powersave debugging"
+        depends on MAC80211_DEBUG_MENU
+        depends on MAC80211_MESH
+        ---help---
+          Selecting this option causes mac80211 to print out very verbose mesh
+          powersave debugging messages (when mac80211 is taking part in a
+          mesh network).
+
+          Do not select this option.
+
 config MAC80211_TDLS_DEBUG
         bool "Verbose TDLS debugging"
         depends on MAC80211_DEBUG_MENU
diff --git a/net/mac80211/Makefile b/net/mac80211/Makefile
index 4911202334d9..9d7d840aac6d 100644
--- a/net/mac80211/Makefile
+++ b/net/mac80211/Makefile
@@ -39,7 +39,8 @@ mac80211-$(CONFIG_MAC80211_MESH) += \
         mesh_pathtbl.o \
         mesh_plink.o \
         mesh_hwmp.o \
-        mesh_sync.o
+        mesh_sync.o \
+        mesh_ps.o
 
 mac80211-$(CONFIG_PM) += pm.o
 
diff --git a/net/mac80211/agg-rx.c b/net/mac80211/agg-rx.c
index 808338a1bce5..31bf2586fb84 100644
--- a/net/mac80211/agg-rx.c
+++ b/net/mac80211/agg-rx.c
@@ -83,8 +83,8 @@ void ___ieee80211_stop_rx_ba_session(struct sta_info *sta, u16 tid,
         if (drv_ampdu_action(local, sta->sdata, IEEE80211_AMPDU_RX_STOP,
                              &sta->sta, tid, NULL, 0))
                 sdata_info(sta->sdata,
-                           "HW problem - can not stop rx aggregation for tid %d\n",
-                           tid);
+                           "HW problem - can not stop rx aggregation for %pM tid %d\n",
+                           sta->sta.addr, tid);
 
         /* check if this is a self generated aggregation halt */
         if (initiator == WLAN_BACK_RECIPIENT && tx)
@@ -159,7 +159,8 @@ static void sta_rx_agg_session_timer_expired(unsigned long data)
         }
         rcu_read_unlock();
 
-        ht_dbg(sta->sdata, "rx session timer expired on tid %d\n", (u16)*ptid);
+        ht_dbg(sta->sdata, "RX session timer expired on %pM tid %d\n",
+               sta->sta.addr, (u16)*ptid);
 
         set_bit(*ptid, sta->ampdu_mlme.tid_rx_timer_expired);
         ieee80211_queue_work(&sta->local->hw, &sta->ampdu_mlme.work);
@@ -247,7 +248,9 @@ void ieee80211_process_addba_request(struct ieee80211_local *local,
         status = WLAN_STATUS_REQUEST_DECLINED;
 
         if (test_sta_flag(sta, WLAN_STA_BLOCK_BA)) {
-                ht_dbg(sta->sdata, "Suspend in progress - Denying ADDBA request\n");
+                ht_dbg(sta->sdata,
+                       "Suspend in progress - Denying ADDBA request (%pM tid %d)\n",
+                       sta->sta.addr, tid);
                 goto end_no_lock;
         }
 
@@ -317,7 +320,8 @@ void ieee80211_process_addba_request(struct ieee80211_local *local,
 
         ret = drv_ampdu_action(local, sta->sdata, IEEE80211_AMPDU_RX_START,
                                &sta->sta, tid, &start_seq_num, 0);
-        ht_dbg(sta->sdata, "Rx A-MPDU request on tid %d result %d\n", tid, ret);
+        ht_dbg(sta->sdata, "Rx A-MPDU request on %pM tid %d result %d\n",
+               sta->sta.addr, tid, ret);
         if (ret) {
                 kfree(tid_agg_rx->reorder_buf);
                 kfree(tid_agg_rx->reorder_time);
diff --git a/net/mac80211/agg-tx.c b/net/mac80211/agg-tx.c
index 2f0ccbc5f13e..13b7683de5a4 100644
--- a/net/mac80211/agg-tx.c
+++ b/net/mac80211/agg-tx.c
@@ -296,7 +296,7 @@ int ___ieee80211_stop_tx_ba_session(struct sta_info *sta, u16 tid,
                                        IEEE80211_AMPDU_TX_STOP_FLUSH_CONT,
                                        &sta->sta, tid, NULL, 0);
                 WARN_ON_ONCE(ret);
-                goto remove_tid_tx;
+                return 0;
         }
 
         if (test_bit(HT_AGG_STATE_WANT_START, &tid_tx->state)) {
@@ -354,12 +354,15 @@ int ___ieee80211_stop_tx_ba_session(struct sta_info *sta, u16 tid,
                  */
         }
 
-        if (reason == AGG_STOP_DESTROY_STA) {
- remove_tid_tx:
-                spin_lock_bh(&sta->lock);
-                ieee80211_remove_tid_tx(sta, tid);
-                spin_unlock_bh(&sta->lock);
-        }
+        /*
+         * In the case of AGG_STOP_DESTROY_STA, the driver won't
+         * necessarily call ieee80211_stop_tx_ba_cb(), so this may
+         * seem like we can leave the tid_tx data pending forever.
+         * This is true, in a way, but "forever" is only until the
+         * station struct is actually destroyed. In the meantime,
+         * leaving it around ensures that we don't transmit packets
+         * to the driver on this TID which might confuse it.
+         */
 
         return 0;
 }
@@ -387,12 +390,13 @@ static void sta_addba_resp_timer_expired(unsigned long data)
             test_bit(HT_AGG_STATE_RESPONSE_RECEIVED, &tid_tx->state)) {
                 rcu_read_unlock();
                 ht_dbg(sta->sdata,
-                       "timer expired on tid %d but we are not (or no longer) expecting addBA response there\n",
-                       tid);
+                       "timer expired on %pM tid %d but we are not (or no longer) expecting addBA response there\n",
+                       sta->sta.addr, tid);
                 return;
         }
 
-        ht_dbg(sta->sdata, "addBA response timer expired on tid %d\n", tid);
+        ht_dbg(sta->sdata, "addBA response timer expired on %pM tid %d\n",
+               sta->sta.addr, tid);
 
         ieee80211_stop_tx_ba_session(&sta->sta, tid);
         rcu_read_unlock();
@@ -429,7 +433,8 @@ void ieee80211_tx_ba_session_handle_start(struct sta_info *sta, int tid)
                                &sta->sta, tid, &start_seq_num, 0);
         if (ret) {
                 ht_dbg(sdata,
-                       "BA request denied - HW unavailable for tid %d\n", tid);
+                       "BA request denied - HW unavailable for %pM tid %d\n",
+                       sta->sta.addr, tid);
                 spin_lock_bh(&sta->lock);
                 ieee80211_agg_splice_packets(sdata, tid_tx, tid);
                 ieee80211_assign_tid_tx(sta, tid, NULL);
@@ -442,7 +447,8 @@ void ieee80211_tx_ba_session_handle_start(struct sta_info *sta, int tid)
 
         /* activate the timer for the recipient's addBA response */
         mod_timer(&tid_tx->addba_resp_timer, jiffies + ADDBA_RESP_INTERVAL);
-        ht_dbg(sdata, "activated addBA response timer on tid %d\n", tid);
+        ht_dbg(sdata, "activated addBA response timer on %pM tid %d\n",
+               sta->sta.addr, tid);
 
         spin_lock_bh(&sta->lock);
         sta->ampdu_mlme.last_addba_req_time[tid] = jiffies;
@@ -489,7 +495,8 @@ static void sta_tx_agg_session_timer_expired(unsigned long data)
 
         rcu_read_unlock();
 
-        ht_dbg(sta->sdata, "tx session timer expired on tid %d\n", (u16)*ptid);
+        ht_dbg(sta->sdata, "tx session timer expired on %pM tid %d\n",
+               sta->sta.addr, (u16)*ptid);
 
         ieee80211_stop_tx_ba_session(&sta->sta, *ptid);
 }
@@ -525,7 +532,8 @@ int ieee80211_start_tx_ba_session(struct ieee80211_sta *pubsta, u16 tid,
 
         if (test_sta_flag(sta, WLAN_STA_BLOCK_BA)) {
                 ht_dbg(sdata,
-                       "BA sessions blocked - Denying BA session request\n");
+                       "BA sessions blocked - Denying BA session request %pM tid %d\n",
+                       sta->sta.addr, tid);
                 return -EINVAL;
         }
 
@@ -566,8 +574,8 @@ int ieee80211_start_tx_ba_session(struct ieee80211_sta *pubsta, u16 tid,
             time_before(jiffies, sta->ampdu_mlme.last_addba_req_time[tid] +
                         HT_AGG_RETRIES_PERIOD)) {
                 ht_dbg(sdata,
-                       "BA request denied - waiting a grace period after %d failed requests on tid %u\n",
-                       sta->ampdu_mlme.addba_req_num[tid], tid);
+                       "BA request denied - waiting a grace period after %d failed requests on %pM tid %u\n",
+                       sta->ampdu_mlme.addba_req_num[tid], sta->sta.addr, tid);
                 ret = -EBUSY;
                 goto err_unlock_sta;
         }
@@ -576,8 +584,8 @@ int ieee80211_start_tx_ba_session(struct ieee80211_sta *pubsta, u16 tid,
         /* check if the TID is not in aggregation flow already */
         if (tid_tx || sta->ampdu_mlme.tid_start_tx[tid]) {
                 ht_dbg(sdata,
-                       "BA request denied - session is not idle on tid %u\n",
-                       tid);
+                       "BA request denied - session is not idle on %pM tid %u\n",
+                       sta->sta.addr, tid);
                 ret = -EAGAIN;
                 goto err_unlock_sta;
         }
@@ -632,7 +640,8 @@ static void ieee80211_agg_tx_operational(struct ieee80211_local *local,
 
         tid_tx = rcu_dereference_protected_tid_tx(sta, tid);
 
-        ht_dbg(sta->sdata, "Aggregation is on for tid %d\n", tid);
+        ht_dbg(sta->sdata, "Aggregation is on for %pM tid %d\n",
+               sta->sta.addr, tid);
 
         drv_ampdu_action(local, sta->sdata,
                          IEEE80211_AMPDU_TX_OPERATIONAL,
@@ -802,7 +811,9 @@ void ieee80211_stop_tx_ba_cb(struct ieee80211_vif *vif, u8 *ra, u8 tid)
         tid_tx = rcu_dereference_protected_tid_tx(sta, tid);
 
         if (!tid_tx || !test_bit(HT_AGG_STATE_STOPPING, &tid_tx->state)) {
-                ht_dbg(sdata, "unexpected callback to A-MPDU stop\n");
+                ht_dbg(sdata,
+                       "unexpected callback to A-MPDU stop for %pM tid %d\n",
+                       sta->sta.addr, tid);
                 goto unlock_sta;
         }
 
@@ -861,13 +872,15 @@ void ieee80211_process_addba_resp(struct ieee80211_local *local,
                 goto out;
 
         if (mgmt->u.action.u.addba_resp.dialog_token != tid_tx->dialog_token) {
-                ht_dbg(sta->sdata, "wrong addBA response token, tid %d\n", tid);
+                ht_dbg(sta->sdata, "wrong addBA response token, %pM tid %d\n",
+                       sta->sta.addr, tid);
                 goto out;
         }
 
         del_timer_sync(&tid_tx->addba_resp_timer);
 
-        ht_dbg(sta->sdata, "switched off addBA timer for tid %d\n", tid);
+        ht_dbg(sta->sdata, "switched off addBA timer for %pM tid %d\n",
+               sta->sta.addr, tid);
 
         /*
          * addba_resp_timer may have fired before we got here, and
@@ -877,8 +890,8 @@ void ieee80211_process_addba_resp(struct ieee80211_local *local,
         if (test_bit(HT_AGG_STATE_WANT_STOP, &tid_tx->state) ||
             test_bit(HT_AGG_STATE_STOPPING, &tid_tx->state)) {
                 ht_dbg(sta->sdata,
-                       "got addBA resp for tid %d but we already gave up\n",
-                       tid);
+                       "got addBA resp for %pM tid %d but we already gave up\n",
+                       sta->sta.addr, tid);
                 goto out;
         }
 
diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
index 661b878bd19c..179dcbd8be1c 100644
--- a/net/mac80211/cfg.c
+++ b/net/mac80211/cfg.c
@@ -492,7 +492,10 @@ static void sta_set_sinfo(struct sta_info *sta, struct station_info *sinfo)
 #ifdef CONFIG_MAC80211_MESH
                 sinfo->filled |= STATION_INFO_LLID |
                                  STATION_INFO_PLID |
-                                 STATION_INFO_PLINK_STATE;
+                                 STATION_INFO_PLINK_STATE |
+                                 STATION_INFO_LOCAL_PM |
+                                 STATION_INFO_PEER_PM |
+                                 STATION_INFO_NONPEER_PM;
 
                 sinfo->llid = le16_to_cpu(sta->llid);
                 sinfo->plid = le16_to_cpu(sta->plid);
@@ -501,6 +504,9 @@ static void sta_set_sinfo(struct sta_info *sta, struct station_info *sinfo)
                         sinfo->filled |= STATION_INFO_T_OFFSET;
                         sinfo->t_offset = sta->t_offset;
                 }
+                sinfo->local_pm = sta->local_pm;
+                sinfo->peer_pm = sta->peer_pm;
+                sinfo->nonpeer_pm = sta->nonpeer_pm;
 #endif
         }
 
@@ -922,11 +928,13 @@ static int ieee80211_start_ap(struct wiphy *wiphy, struct net_device *dev,
         /* TODO: make hostapd tell us what it wants */
         sdata->smps_mode = IEEE80211_SMPS_OFF;
         sdata->needed_rx_chains = sdata->local->rx_chains;
+        sdata->radar_required = params->radar_required;
 
         err = ieee80211_vif_use_channel(sdata, &params->chandef,
                                         IEEE80211_CHANCTX_SHARED);
         if (err)
                 return err;
+        ieee80211_vif_copy_chanctx_to_vlans(sdata, false);
 
         /*
          * Apply control port protocol, this allows us to
@@ -1041,6 +1049,7 @@ static int ieee80211_stop_ap(struct wiphy *wiphy, struct net_device *dev)
         local->total_ps_buffered -= skb_queue_len(&sdata->u.ap.ps.bc_buf);
         skb_queue_purge(&sdata->u.ap.ps.bc_buf);
 
+        ieee80211_vif_copy_chanctx_to_vlans(sdata, true);
         ieee80211_vif_release_channel(sdata);
 
         return 0;
@@ -1243,25 +1252,26 @@ static int sta_apply_parameters(struct ieee80211_local *local,
 
         if (params->ht_capa)
                 ieee80211_ht_cap_ie_to_sta_ht_cap(sdata, sband,
-                                                  params->ht_capa,
-                                                  &sta->sta.ht_cap);
+                                                  params->ht_capa, sta);
 
         if (params->vht_capa)
                 ieee80211_vht_cap_ie_to_sta_vht_cap(sdata, sband,
-                                                    params->vht_capa,
-                                                    &sta->sta.vht_cap);
+                                                    params->vht_capa, sta);
 
         if (ieee80211_vif_is_mesh(&sdata->vif)) {
 #ifdef CONFIG_MAC80211_MESH
+                u32 changed = 0;
                 if (sdata->u.mesh.security & IEEE80211_MESH_SEC_SECURED) {
-                        u32 changed = 0;
-
                         switch (params->plink_state) {
                         case NL80211_PLINK_ESTAB:
                                 if (sta->plink_state != NL80211_PLINK_ESTAB)
                                         changed = mesh_plink_inc_estab_count(
                                                         sdata);
                                 sta->plink_state = params->plink_state;
+
+                                ieee80211_mps_sta_status_update(sta);
+                                changed |= ieee80211_mps_set_sta_local_pm(sta,
+                                              sdata->u.mesh.mshcfg.power_mode);
                                 break;
                         case NL80211_PLINK_LISTEN:
                         case NL80211_PLINK_BLOCKED:
@@ -1273,22 +1283,31 @@ static int sta_apply_parameters(struct ieee80211_local *local,
                                         changed = mesh_plink_dec_estab_count(
                                                         sdata);
                                 sta->plink_state = params->plink_state;
+
+                                ieee80211_mps_sta_status_update(sta);
+                                changed |=
+                                      ieee80211_mps_local_status_update(sdata);
                                 break;
                         default:
                                 /*  nothing  */
                                 break;
                         }
-                        ieee80211_bss_info_change_notify(sdata, changed);
                 } else {
                         switch (params->plink_action) {
                         case PLINK_ACTION_OPEN:
-                                mesh_plink_open(sta);
+                                changed |= mesh_plink_open(sta);
                                 break;
                         case PLINK_ACTION_BLOCK:
-                                mesh_plink_block(sta);
+                                changed |= mesh_plink_block(sta);
                                 break;
                         }
                 }
+
+                if (params->local_pm)
+                        changed |=
+                              ieee80211_mps_set_sta_local_pm(sta,
+                                                             params->local_pm);
+                ieee80211_bss_info_change_notify(sdata, changed);
 #endif
         }
 
@@ -1393,9 +1412,11 @@ static int ieee80211_change_station(struct wiphy *wiphy,
                 return -ENOENT;
         }
 
-        /* in station mode, supported rates are only valid with TDLS */
+        /* in station mode, some updates are only valid with TDLS */
         if (sdata->vif.type == NL80211_IFTYPE_STATION &&
-            params->supported_rates &&
+            (params->supported_rates || params->ht_capa || params->vht_capa ||
+             params->sta_modify_mask ||
+             (params->sta_flags_mask & BIT(NL80211_STA_FLAG_WME))) &&
             !test_sta_flag(sta, WLAN_STA_TDLS_PEER)) {
                 mutex_unlock(&local->sta_mtx);
                 return -EINVAL;
@@ -1777,6 +1798,14 @@ static int ieee80211_update_mesh_config(struct wiphy *wiphy,
         if (_chg_mesh_attr(NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL, mask))
                 conf->dot11MeshHWMPconfirmationInterval =
                         nconf->dot11MeshHWMPconfirmationInterval;
+        if (_chg_mesh_attr(NL80211_MESHCONF_POWER_MODE, mask)) {
+                conf->power_mode = nconf->power_mode;
+                ieee80211_mps_local_status_update(sdata);
+        }
+        if (_chg_mesh_attr(NL80211_MESHCONF_AWAKE_WINDOW, mask))
+                conf->dot11MeshAwakeWindowDuration =
+                        nconf->dot11MeshAwakeWindowDuration;
+        ieee80211_mbss_info_change_notify(sdata, BSS_CHANGED_BEACON);
         return 0;
 }
 
@@ -1802,9 +1831,7 @@ static int ieee80211_join_mesh(struct wiphy *wiphy, struct net_device *dev,
         if (err)
                 return err;
 
-        ieee80211_start_mesh(sdata);
-
-        return 0;
+        return ieee80211_start_mesh(sdata);
 }
 
 static int ieee80211_leave_mesh(struct wiphy *wiphy, struct net_device *dev)
@@ -2058,7 +2085,8 @@ static int ieee80211_set_mcast_rate(struct wiphy *wiphy, struct net_device *dev,
 {
         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
 
-        memcpy(sdata->vif.bss_conf.mcast_rate, rate, sizeof(rate));
+        memcpy(sdata->vif.bss_conf.mcast_rate, rate,
+               sizeof(int) * IEEE80211_NUM_BANDS);
 
         return 0;
 }
@@ -2368,7 +2396,8 @@ static int ieee80211_start_roc_work(struct ieee80211_local *local,
         INIT_LIST_HEAD(&roc->dependents);
 
         /* if there's one pending or we're scanning, queue this one */
-        if (!list_empty(&local->roc_list) || local->scanning)
+        if (!list_empty(&local->roc_list) ||
+            local->scanning || local->radar_detect_enabled)
                 goto out_check_combine;
 
         /* if not HW assist, just queue & schedule work */
@@ -2618,6 +2647,37 @@ static int ieee80211_cancel_remain_on_channel(struct wiphy *wiphy,
         return ieee80211_cancel_roc(local, cookie, false);
 }
 
+static int ieee80211_start_radar_detection(struct wiphy *wiphy,
+                                           struct net_device *dev,
+                                           struct cfg80211_chan_def *chandef)
+{
+        struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
+        struct ieee80211_local *local = sdata->local;
+        unsigned long timeout;
+        int err;
+
+        if (!list_empty(&local->roc_list) || local->scanning)
+                return -EBUSY;
+
+        /* whatever, but channel contexts should not complain about that one */
+        sdata->smps_mode = IEEE80211_SMPS_OFF;
+        sdata->needed_rx_chains = local->rx_chains;
+        sdata->radar_required = true;
+
+        mutex_lock(&local->iflist_mtx);
+        err = ieee80211_vif_use_channel(sdata, chandef,
+                                        IEEE80211_CHANCTX_SHARED);
+        mutex_unlock(&local->iflist_mtx);
+        if (err)
+                return err;
+
+        timeout = msecs_to_jiffies(IEEE80211_DFS_MIN_CAC_TIME_MS);
+        ieee80211_queue_delayed_work(&sdata->local->hw,
+                                     &sdata->dfs_cac_timer_work, timeout);
+
+        return 0;
+}
+
 static int ieee80211_mgmt_tx(struct wiphy *wiphy, struct wireless_dev *wdev,
                              struct ieee80211_channel *chan, bool offchan,
                              unsigned int wait, const u8 *buf, size_t len,
@@ -2722,7 +2782,8 @@ static int ieee80211_mgmt_tx(struct wiphy *wiphy, struct wireless_dev *wdev,
                 goto out_unlock;
         }
 
-        IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_CTL_TX_OFFCHAN;
+        IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_CTL_TX_OFFCHAN |
+                                        IEEE80211_TX_INTFL_OFFCHAN_TX_OK;
         if (local->hw.flags & IEEE80211_HW_QUEUE_CONTROL)
                 IEEE80211_SKB_CB(skb)->hw_queue =
                         local->hw.offchannel_tx_hw_queue;
@@ -3322,4 +3383,5 @@ struct cfg80211_ops mac80211_config_ops = {
         .get_et_stats = ieee80211_get_et_stats,
         .get_et_strings = ieee80211_get_et_strings,
         .get_channel = ieee80211_cfg_get_channel,
+        .start_radar_detection = ieee80211_start_radar_detection,
 };
diff --git a/net/mac80211/chan.c b/net/mac80211/chan.c
index 1bfe0a8b19d2..78c0d90dd641 100644
--- a/net/mac80211/chan.c
+++ b/net/mac80211/chan.c
@@ -9,7 +9,7 @@
 #include "ieee80211_i.h"
 #include "driver-ops.h"
 
-static void ieee80211_change_chandef(struct ieee80211_local *local,
+static void ieee80211_change_chanctx(struct ieee80211_local *local,
                                      struct ieee80211_chanctx *ctx,
                                      const struct cfg80211_chan_def *chandef)
 {
@@ -49,7 +49,7 @@ ieee80211_find_chanctx(struct ieee80211_local *local,
                 if (!compat)
                         continue;
 
-                ieee80211_change_chandef(local, ctx, compat);
+                ieee80211_change_chanctx(local, ctx, compat);
 
                 return ctx;
         }
@@ -91,6 +91,10 @@ ieee80211_new_chanctx(struct ieee80211_local *local,
 
         list_add_rcu(&ctx->list, &local->chanctx_list);
 
+        mutex_lock(&local->mtx);
+        ieee80211_recalc_idle(local);
+        mutex_unlock(&local->mtx);
+
         return ctx;
 }
 
@@ -110,6 +114,10 @@ static void ieee80211_free_chanctx(struct ieee80211_local *local,
 
         list_del_rcu(&ctx->list);
         kfree_rcu(ctx, rcu_head);
+
+        mutex_lock(&local->mtx);
+        ieee80211_recalc_idle(local);
+        mutex_unlock(&local->mtx);
 }
 
 static int ieee80211_assign_vif_chanctx(struct ieee80211_sub_if_data *sdata,
@@ -128,6 +136,11 @@ static int ieee80211_assign_vif_chanctx(struct ieee80211_sub_if_data *sdata,
         ctx->refcount++;
 
         ieee80211_recalc_txpower(sdata);
+        sdata->vif.bss_conf.idle = false;
+
+        if (sdata->vif.type != NL80211_IFTYPE_P2P_DEVICE &&
+            sdata->vif.type != NL80211_IFTYPE_MONITOR)
+                ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_IDLE);
 
         return 0;
 }
@@ -162,7 +175,7 @@ static void ieee80211_recalc_chanctx_chantype(struct ieee80211_local *local,
         if (WARN_ON_ONCE(!compat))
                 return;
 
-        ieee80211_change_chandef(local, ctx, compat);
+        ieee80211_change_chanctx(local, ctx, compat);
 }
 
 static void ieee80211_unassign_vif_chanctx(struct ieee80211_sub_if_data *sdata,
@@ -175,11 +188,18 @@ static void ieee80211_unassign_vif_chanctx(struct ieee80211_sub_if_data *sdata,
         ctx->refcount--;
         rcu_assign_pointer(sdata->vif.chanctx_conf, NULL);
 
+        sdata->vif.bss_conf.idle = true;
+
+        if (sdata->vif.type != NL80211_IFTYPE_P2P_DEVICE &&
+            sdata->vif.type != NL80211_IFTYPE_MONITOR)
+                ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_IDLE);
+
         drv_unassign_vif_chanctx(local, sdata, ctx);
 
         if (ctx->refcount > 0) {
                 ieee80211_recalc_chanctx_chantype(sdata->local, ctx);
                 ieee80211_recalc_smps_chanctx(local, ctx);
+                ieee80211_recalc_radar_chanctx(local, ctx);
         }
 }
 
@@ -198,20 +218,42 @@ static void __ieee80211_vif_release_channel(struct ieee80211_sub_if_data *sdata)
 
         ctx = container_of(conf, struct ieee80211_chanctx, conf);
 
-        if (sdata->vif.type == NL80211_IFTYPE_AP) {
-                struct ieee80211_sub_if_data *vlan;
-
-                /* for the VLAN list */
-                ASSERT_RTNL();
-                list_for_each_entry(vlan, &sdata->u.ap.vlans, u.vlan.list)
-                        rcu_assign_pointer(vlan->vif.chanctx_conf, NULL);
-        }
-
         ieee80211_unassign_vif_chanctx(sdata, ctx);
         if (ctx->refcount == 0)
                 ieee80211_free_chanctx(local, ctx);
 }
 
+void ieee80211_recalc_radar_chanctx(struct ieee80211_local *local,
+                                    struct ieee80211_chanctx *chanctx)
+{
+        struct ieee80211_sub_if_data *sdata;
+        bool radar_enabled = false;
+
+        lockdep_assert_held(&local->chanctx_mtx);
+
+        rcu_read_lock();
+        list_for_each_entry_rcu(sdata, &local->interfaces, list) {
+                if (sdata->radar_required) {
+                        radar_enabled = true;
+                        break;
+                }
+        }
+        rcu_read_unlock();
+
+        if (radar_enabled == chanctx->conf.radar_enabled)
+                return;
+
+        chanctx->conf.radar_enabled = radar_enabled;
+        local->radar_detect_enabled = chanctx->conf.radar_enabled;
+
+        if (!local->use_chanctx) {
+                local->hw.conf.radar_enabled = chanctx->conf.radar_enabled;
+                ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_CHANNEL);
+        }
+
+        drv_change_chanctx(local, chanctx, IEEE80211_CHANCTX_CHANGE_RADAR);
+}
+
 void ieee80211_recalc_smps_chanctx(struct ieee80211_local *local,
                                    struct ieee80211_chanctx *chanctx)
 {
@@ -326,16 +368,57 @@ int ieee80211_vif_use_channel(struct ieee80211_sub_if_data *sdata,
                 goto out;
         }
 
-        if (sdata->vif.type == NL80211_IFTYPE_AP) {
-                struct ieee80211_sub_if_data *vlan;
+        ieee80211_recalc_smps_chanctx(local, ctx);
+        ieee80211_recalc_radar_chanctx(local, ctx);
+ out:
+        mutex_unlock(&local->chanctx_mtx);
+        return ret;
+}
+
+int ieee80211_vif_change_bandwidth(struct ieee80211_sub_if_data *sdata,
+                                   const struct cfg80211_chan_def *chandef,
+                                   u32 *changed)
+{
+        struct ieee80211_local *local = sdata->local;
+        struct ieee80211_chanctx_conf *conf;
+        struct ieee80211_chanctx *ctx;
+        int ret;
+
+        if (!cfg80211_chandef_usable(sdata->local->hw.wiphy, chandef,
+                                     IEEE80211_CHAN_DISABLED))
+                return -EINVAL;
+
+        mutex_lock(&local->chanctx_mtx);
+        if (cfg80211_chandef_identical(chandef, &sdata->vif.bss_conf.chandef)) {
+                ret = 0;
+                goto out;
+        }
+
+        if (chandef->width == NL80211_CHAN_WIDTH_20_NOHT ||
+            sdata->vif.bss_conf.chandef.width == NL80211_CHAN_WIDTH_20_NOHT) {
+                ret = -EINVAL;
+                goto out;
+        }
 
-                /* for the VLAN list */
-                ASSERT_RTNL();
-                list_for_each_entry(vlan, &sdata->u.ap.vlans, u.vlan.list)
-                        rcu_assign_pointer(vlan->vif.chanctx_conf, &ctx->conf);
+        conf = rcu_dereference_protected(sdata->vif.chanctx_conf,
+                                         lockdep_is_held(&local->chanctx_mtx));
+        if (!conf) {
+                ret = -EINVAL;
+                goto out;
         }
 
-        ieee80211_recalc_smps_chanctx(local, ctx);
+        ctx = container_of(conf, struct ieee80211_chanctx, conf);
+        if (!cfg80211_chandef_compatible(&conf->def, chandef)) {
+                ret = -EINVAL;
+                goto out;
+        }
+
+        sdata->vif.bss_conf.chandef = *chandef;
+
+        ieee80211_recalc_chanctx_chantype(local, ctx);
+
+        *changed |= BSS_CHANGED_BANDWIDTH;
+        ret = 0;
  out:
         mutex_unlock(&local->chanctx_mtx);
         return ret;
@@ -369,6 +452,40 @@ void ieee80211_vif_vlan_copy_chanctx(struct ieee80211_sub_if_data *sdata)
         mutex_unlock(&local->chanctx_mtx);
 }
 
+void ieee80211_vif_copy_chanctx_to_vlans(struct ieee80211_sub_if_data *sdata,
+                                         bool clear)
+{
+        struct ieee80211_local *local = sdata->local;
+        struct ieee80211_sub_if_data *vlan;
+        struct ieee80211_chanctx_conf *conf;
+
+        ASSERT_RTNL();
+
+        if (WARN_ON(sdata->vif.type != NL80211_IFTYPE_AP))
+                return;
+
+        mutex_lock(&local->chanctx_mtx);
+
+        /*
+         * Check that conf exists, even when clearing this function
+         * must be called with the AP's channel context still there
+         * as it would otherwise cause VLANs to have an invalid
+         * channel context pointer for a while, possibly pointing
+         * to a channel context that has already been freed.
+         */
+        conf = rcu_dereference_protected(sdata->vif.chanctx_conf,
+                                lockdep_is_held(&local->chanctx_mtx));
+        WARN_ON(!conf);
+
+        if (clear)
+                conf = NULL;
+
+        list_for_each_entry(vlan, &sdata->u.ap.vlans, u.vlan.list)
+                rcu_assign_pointer(vlan->vif.chanctx_conf, conf);
+
+        mutex_unlock(&local->chanctx_mtx);
+}
+
 void ieee80211_iter_chan_contexts_atomic(
         struct ieee80211_hw *hw,
         void (*iter)(struct ieee80211_hw *hw,
diff --git a/net/mac80211/debug.h b/net/mac80211/debug.h
index 8f383a576016..4ccc5ed6237d 100644
--- a/net/mac80211/debug.h
+++ b/net/mac80211/debug.h
@@ -44,6 +44,12 @@
 #define MAC80211_MESH_SYNC_DEBUG 0
 #endif
 
+#ifdef CONFIG_MAC80211_MESH_PS_DEBUG
+#define MAC80211_MESH_PS_DEBUG 1
+#else
+#define MAC80211_MESH_PS_DEBUG 0
+#endif
+
 #ifdef CONFIG_MAC80211_TDLS_DEBUG
 #define MAC80211_TDLS_DEBUG 1
 #else
@@ -151,6 +157,10 @@ do {									\
         _sdata_dbg(MAC80211_MESH_SYNC_DEBUG,                            \
                    sdata, fmt, ##__VA_ARGS__)
 
+#define mps_dbg(sdata, fmt, ...)                                        \
+        _sdata_dbg(MAC80211_MESH_PS_DEBUG,                              \
+                   sdata, fmt, ##__VA_ARGS__)
+
 #define tdls_dbg(sdata, fmt, ...)                                       \
         _sdata_dbg(MAC80211_TDLS_DEBUG,                                 \
                    sdata, fmt, ##__VA_ARGS__)
diff --git a/net/mac80211/debugfs.c b/net/mac80211/debugfs.c
index 466f4b45dd94..b0e32d628114 100644
--- a/net/mac80211/debugfs.c
+++ b/net/mac80211/debugfs.c
@@ -121,8 +121,8 @@ static ssize_t hwflags_read(struct file *file, char __user *user_buf,
                 sf += snprintf(buf + sf, mxln - sf, "SIGNAL_UNSPEC\n");
         if (local->hw.flags & IEEE80211_HW_SIGNAL_DBM)
                 sf += snprintf(buf + sf, mxln - sf, "SIGNAL_DBM\n");
-        if (local->hw.flags & IEEE80211_HW_NEED_DTIM_PERIOD)
-                sf += snprintf(buf + sf, mxln - sf, "NEED_DTIM_PERIOD\n");
+        if (local->hw.flags & IEEE80211_HW_NEED_DTIM_BEFORE_ASSOC)
+                sf += snprintf(buf + sf, mxln - sf, "NEED_DTIM_BEFORE_ASSOC\n");
         if (local->hw.flags & IEEE80211_HW_SPECTRUM_MGMT)
                 sf += snprintf(buf + sf, mxln - sf, "SPECTRUM_MGMT\n");
         if (local->hw.flags & IEEE80211_HW_AMPDU_AGGREGATION)
@@ -151,8 +151,6 @@ static ssize_t hwflags_read(struct file *file, char __user *user_buf,
                 sf += snprintf(buf + sf, mxln - sf, "AP_LINK_PS\n");
         if (local->hw.flags & IEEE80211_HW_TX_AMPDU_SETUP_IN_HW)
                 sf += snprintf(buf + sf, mxln - sf, "TX_AMPDU_SETUP_IN_HW\n");
-        if (local->hw.flags & IEEE80211_HW_SCAN_WHILE_IDLE)
-                sf += snprintf(buf + sf, mxln - sf, "SCAN_WHILE_IDLE\n");
 
         rv = simple_read_from_buffer(user_buf, count, ppos, buf, strlen(buf));
         kfree(buf);
diff --git a/net/mac80211/debugfs_netdev.c b/net/mac80211/debugfs_netdev.c
index cbde5cc49a40..059bbb82e84f 100644
--- a/net/mac80211/debugfs_netdev.c
+++ b/net/mac80211/debugfs_netdev.c
@@ -515,6 +515,9 @@ IEEE80211_IF_FILE(dot11MeshHWMProotInterval,
                   u.mesh.mshcfg.dot11MeshHWMProotInterval, DEC);
 IEEE80211_IF_FILE(dot11MeshHWMPconfirmationInterval,
                   u.mesh.mshcfg.dot11MeshHWMPconfirmationInterval, DEC);
+IEEE80211_IF_FILE(power_mode, u.mesh.mshcfg.power_mode, DEC);
+IEEE80211_IF_FILE(dot11MeshAwakeWindowDuration,
+                  u.mesh.mshcfg.dot11MeshAwakeWindowDuration, DEC);
 #endif
 
 #define DEBUGFS_ADD_MODE(name, mode) \
@@ -620,6 +623,8 @@ static void add_mesh_config(struct ieee80211_sub_if_data *sdata)
         MESHPARAMS_ADD(dot11MeshHWMPactivePathToRootTimeout);
         MESHPARAMS_ADD(dot11MeshHWMProotInterval);
         MESHPARAMS_ADD(dot11MeshHWMPconfirmationInterval);
+        MESHPARAMS_ADD(power_mode);
+        MESHPARAMS_ADD(dot11MeshAwakeWindowDuration);
 #undef MESHPARAMS_ADD
 }
 #endif
diff --git a/net/mac80211/debugfs_sta.c b/net/mac80211/debugfs_sta.c
index 6fb1168b9f16..c7591f73dbc3 100644
--- a/net/mac80211/debugfs_sta.c
+++ b/net/mac80211/debugfs_sta.c
@@ -65,7 +65,7 @@ static ssize_t sta_flags_read(struct file *file, char __user *userbuf,
         test_sta_flag(sta, WLAN_STA_##flg) ? #flg "\n" : ""
 
         int res = scnprintf(buf, sizeof(buf),
-                            "%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s",
+                            "%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s",
                             TEST(AUTH), TEST(ASSOC), TEST(PS_STA),
                             TEST(PS_DRIVER), TEST(AUTHORIZED),
                             TEST(SHORT_PREAMBLE),
@@ -74,7 +74,8 @@ static ssize_t sta_flags_read(struct file *file, char __user *userbuf,
                             TEST(UAPSD), TEST(SP), TEST(TDLS_PEER),
                             TEST(TDLS_PEER_AUTH), TEST(4ADDR_EVENT),
                             TEST(INSERTED), TEST(RATE_CONTROL),
-                            TEST(TOFFSET_KNOWN));
+                            TEST(TOFFSET_KNOWN), TEST(MPSP_OWNER),
+                            TEST(MPSP_RECIPIENT));
 #undef TEST
         return simple_read_from_buffer(userbuf, count, ppos, buf, res);
 }
diff --git a/net/mac80211/driver-ops.h b/net/mac80211/driver-ops.h
index 0c07f94c5378..ee56d0779d8b 100644
--- a/net/mac80211/driver-ops.h
+++ b/net/mac80211/driver-ops.h
@@ -207,13 +207,16 @@ static inline void drv_bss_info_changed(struct ieee80211_local *local,
 {
         might_sleep();
 
-        WARN_ON_ONCE(changed & (BSS_CHANGED_BEACON |
-                                BSS_CHANGED_BEACON_ENABLED) &&
-                     sdata->vif.type != NL80211_IFTYPE_AP &&
-                     sdata->vif.type != NL80211_IFTYPE_ADHOC &&
-                     sdata->vif.type != NL80211_IFTYPE_MESH_POINT);
-        WARN_ON_ONCE(sdata->vif.type == NL80211_IFTYPE_P2P_DEVICE &&
-                     changed & ~BSS_CHANGED_IDLE);
+        if (WARN_ON_ONCE(changed & (BSS_CHANGED_BEACON |
+                                    BSS_CHANGED_BEACON_ENABLED) &&
+                         sdata->vif.type != NL80211_IFTYPE_AP &&
+                         sdata->vif.type != NL80211_IFTYPE_ADHOC &&
+                         sdata->vif.type != NL80211_IFTYPE_MESH_POINT))
+                return;
+
+        if (WARN_ON_ONCE(sdata->vif.type == NL80211_IFTYPE_P2P_DEVICE ||
+                         sdata->vif.type == NL80211_IFTYPE_MONITOR))
+                return;
 
         check_sdata_in_driver(sdata);
 
@@ -528,6 +531,43 @@ static inline void drv_sta_remove_debugfs(struct ieee80211_local *local,
                 local->ops->sta_remove_debugfs(&local->hw, &sdata->vif,
                                                sta, dir);
 }
+
+static inline
+void drv_add_interface_debugfs(struct ieee80211_local *local,
+                               struct ieee80211_sub_if_data *sdata)
+{
+        might_sleep();
+
+        check_sdata_in_driver(sdata);
+
+        if (!local->ops->add_interface_debugfs)
+                return;
+
+        local->ops->add_interface_debugfs(&local->hw, &sdata->vif,
+                                          sdata->debugfs.dir);
+}
+
+static inline
+void drv_remove_interface_debugfs(struct ieee80211_local *local,
+                                  struct ieee80211_sub_if_data *sdata)
+{
+        might_sleep();
+
+        check_sdata_in_driver(sdata);
+
+        if (!local->ops->remove_interface_debugfs)
+                return;
+
+        local->ops->remove_interface_debugfs(&local->hw, &sdata->vif,
+                                             sdata->debugfs.dir);
+}
+#else
+static inline
+void drv_add_interface_debugfs(struct ieee80211_local *local,
+                               struct ieee80211_sub_if_data *sdata) {}
+static inline
+void drv_remove_interface_debugfs(struct ieee80211_local *local,
+                                  struct ieee80211_sub_if_data *sdata) {}
 #endif
 
 static inline __must_check
@@ -569,7 +609,8 @@ static inline void drv_sta_rc_update(struct ieee80211_local *local,
         check_sdata_in_driver(sdata);
 
         WARN_ON(changed & IEEE80211_RC_SUPP_RATES_CHANGED &&
-                sdata->vif.type != NL80211_IFTYPE_ADHOC);
+                (sdata->vif.type != NL80211_IFTYPE_ADHOC &&
+                 sdata->vif.type != NL80211_IFTYPE_MESH_POINT));
 
         trace_drv_sta_rc_update(local, sdata, sta, changed);
         if (local->ops->sta_rc_update)
@@ -845,11 +886,12 @@ static inline void drv_set_rekey_data(struct ieee80211_local *local,
 }
 
 static inline void drv_rssi_callback(struct ieee80211_local *local,
+                                     struct ieee80211_sub_if_data *sdata,
                                      const enum ieee80211_rssi_event event)
 {
-        trace_drv_rssi_callback(local, event);
+        trace_drv_rssi_callback(local, sdata, event);
         if (local->ops->rssi_callback)
-                local->ops->rssi_callback(&local->hw, event);
+                local->ops->rssi_callback(&local->hw, &sdata->vif, event);
         trace_drv_return_void(local);
 }
 
@@ -1020,4 +1062,32 @@ static inline void drv_restart_complete(struct ieee80211_local *local)
         trace_drv_return_void(local);
 }
 
+static inline void
+drv_set_default_unicast_key(struct ieee80211_local *local,
+                            struct ieee80211_sub_if_data *sdata,
+                            int key_idx)
+{
+        check_sdata_in_driver(sdata);
+
+        WARN_ON_ONCE(key_idx < -1 || key_idx > 3);
+
+        trace_drv_set_default_unicast_key(local, sdata, key_idx);
+        if (local->ops->set_default_unicast_key)
+                local->ops->set_default_unicast_key(&local->hw, &sdata->vif,
+                                                    key_idx);
+        trace_drv_return_void(local);
+}
+
+#if IS_ENABLED(CONFIG_IPV6)
+static inline void drv_ipv6_addr_change(struct ieee80211_local *local,
+                                        struct ieee80211_sub_if_data *sdata,
+                                        struct inet6_dev *idev)
+{
+        trace_drv_ipv6_addr_change(local, sdata);
+        if (local->ops->ipv6_addr_change)
+                local->ops->ipv6_addr_change(&local->hw, &sdata->vif, idev);
+        trace_drv_return_void(local);
+}
+#endif
+
 #endif /* __MAC80211_DRIVER_OPS */
diff --git a/net/mac80211/ht.c b/net/mac80211/ht.c
index 61ac7c48ac0c..0db25d4bb223 100644
--- a/net/mac80211/ht.c
+++ b/net/mac80211/ht.c
@@ -37,6 +37,9 @@ void ieee80211_apply_htcap_overrides(struct ieee80211_sub_if_data *sdata,
         u8 *smask = (u8 *)(&sdata->u.mgd.ht_capa_mask.mcs.rx_mask);
         int i;
 
+        if (!ht_cap->ht_supported)
+                return;
+
         if (sdata->vif.type != NL80211_IFTYPE_STATION) {
                 /* AP interfaces call this code when adding new stations,
                  * so just silently ignore non station interfaces.
@@ -89,22 +92,24 @@ void ieee80211_apply_htcap_overrides(struct ieee80211_sub_if_data *sdata,
 }
 
 
-void ieee80211_ht_cap_ie_to_sta_ht_cap(struct ieee80211_sub_if_data *sdata,
+bool ieee80211_ht_cap_ie_to_sta_ht_cap(struct ieee80211_sub_if_data *sdata,
                                        struct ieee80211_supported_band *sband,
-                                       struct ieee80211_ht_cap *ht_cap_ie,
-                                       struct ieee80211_sta_ht_cap *ht_cap)
+                                       const struct ieee80211_ht_cap *ht_cap_ie,
+                                       struct sta_info *sta)
 {
+        struct ieee80211_sta_ht_cap ht_cap;
         u8 ampdu_info, tx_mcs_set_cap;
         int i, max_tx_streams;
+        bool changed;
+        enum ieee80211_sta_rx_bandwidth bw;
+        enum ieee80211_smps_mode smps_mode;
 
-        BUG_ON(!ht_cap);
-
-        memset(ht_cap, 0, sizeof(*ht_cap));
+        memset(&ht_cap, 0, sizeof(ht_cap));
 
         if (!ht_cap_ie || !sband->ht_cap.ht_supported)
-                return;
+                goto apply;
 
-        ht_cap->ht_supported = true;
+        ht_cap.ht_supported = true;
 
         /*
          * The bits listed in this expression should be
@@ -112,7 +117,7 @@ void ieee80211_ht_cap_ie_to_sta_ht_cap(struct ieee80211_sub_if_data *sdata,
          * advertises more then we can't use those thus
          * we mask them out.
          */
-        ht_cap->cap = le16_to_cpu(ht_cap_ie->cap_info) &
+        ht_cap.cap = le16_to_cpu(ht_cap_ie->cap_info) &
                 (sband->ht_cap.cap |
                  ~(IEEE80211_HT_CAP_LDPC_CODING |
                    IEEE80211_HT_CAP_SUP_WIDTH_20_40 |
@@ -121,44 +126,30 @@ void ieee80211_ht_cap_ie_to_sta_ht_cap(struct ieee80211_sub_if_data *sdata,
                    IEEE80211_HT_CAP_SGI_40 |
                    IEEE80211_HT_CAP_DSSSCCK40));
 
-        /* Unset 40 MHz if we're not using a 40 MHz channel */
-        switch (sdata->vif.bss_conf.chandef.width) {
-        case NL80211_CHAN_WIDTH_20_NOHT:
-        case NL80211_CHAN_WIDTH_20:
-                ht_cap->cap &= ~IEEE80211_HT_CAP_SGI_40;
-                ht_cap->cap &= ~IEEE80211_HT_CAP_SUP_WIDTH_20_40;
-                break;
-        case NL80211_CHAN_WIDTH_40:
-        case NL80211_CHAN_WIDTH_80:
-        case NL80211_CHAN_WIDTH_80P80:
-        case NL80211_CHAN_WIDTH_160:
-                break;
-        }
-
         /*
          * The STBC bits are asymmetric -- if we don't have
          * TX then mask out the peer's RX and vice versa.
          */
         if (!(sband->ht_cap.cap & IEEE80211_HT_CAP_TX_STBC))
-                ht_cap->cap &= ~IEEE80211_HT_CAP_RX_STBC;
+                ht_cap.cap &= ~IEEE80211_HT_CAP_RX_STBC;
         if (!(sband->ht_cap.cap & IEEE80211_HT_CAP_RX_STBC))
-                ht_cap->cap &= ~IEEE80211_HT_CAP_TX_STBC;
+                ht_cap.cap &= ~IEEE80211_HT_CAP_TX_STBC;
 
         ampdu_info = ht_cap_ie->ampdu_params_info;
-        ht_cap->ampdu_factor =
+        ht_cap.ampdu_factor =
                 ampdu_info & IEEE80211_HT_AMPDU_PARM_FACTOR;
-        ht_cap->ampdu_density =
+        ht_cap.ampdu_density =
                 (ampdu_info & IEEE80211_HT_AMPDU_PARM_DENSITY) >> 2;
 
         /* own MCS TX capabilities */
         tx_mcs_set_cap = sband->ht_cap.mcs.tx_params;
 
         /* Copy peer MCS TX capabilities, the driver might need them. */
-        ht_cap->mcs.tx_params = ht_cap_ie->mcs.tx_params;
+        ht_cap.mcs.tx_params = ht_cap_ie->mcs.tx_params;
 
         /* can we TX with MCS rates? */
         if (!(tx_mcs_set_cap & IEEE80211_HT_MCS_TX_DEFINED))
-                return;
+                goto apply;
 
         /* Counting from 0, therefore +1 */
         if (tx_mcs_set_cap & IEEE80211_HT_MCS_TX_RX_DIFF)
@@ -176,25 +167,75 @@ void ieee80211_ht_cap_ie_to_sta_ht_cap(struct ieee80211_sub_if_data *sdata,
          * - remainder are multiple spatial streams using unequal modulation
          */
         for (i = 0; i < max_tx_streams; i++)
-                ht_cap->mcs.rx_mask[i] =
+                ht_cap.mcs.rx_mask[i] =
                         sband->ht_cap.mcs.rx_mask[i] & ht_cap_ie->mcs.rx_mask[i];
 
         if (tx_mcs_set_cap & IEEE80211_HT_MCS_TX_UNEQUAL_MODULATION)
                 for (i = IEEE80211_HT_MCS_UNEQUAL_MODULATION_START_BYTE;
                      i < IEEE80211_HT_MCS_MASK_LEN; i++)
-                        ht_cap->mcs.rx_mask[i] =
+                        ht_cap.mcs.rx_mask[i] =
                                 sband->ht_cap.mcs.rx_mask[i] &
                                         ht_cap_ie->mcs.rx_mask[i];
 
         /* handle MCS rate 32 too */
         if (sband->ht_cap.mcs.rx_mask[32/8] & ht_cap_ie->mcs.rx_mask[32/8] & 1)
-                ht_cap->mcs.rx_mask[32/8] |= 1;
+                ht_cap.mcs.rx_mask[32/8] |= 1;
 
+ apply:
         /*
          * If user has specified capability over-rides, take care
          * of that here.
          */
-        ieee80211_apply_htcap_overrides(sdata, ht_cap);
+        ieee80211_apply_htcap_overrides(sdata, &ht_cap);
+
+        changed = memcmp(&sta->sta.ht_cap, &ht_cap, sizeof(ht_cap));
+
+        memcpy(&sta->sta.ht_cap, &ht_cap, sizeof(ht_cap));
+
+        switch (sdata->vif.bss_conf.chandef.width) {
+        default:
+                WARN_ON_ONCE(1);
+                /* fall through */
+        case NL80211_CHAN_WIDTH_20_NOHT:
+        case NL80211_CHAN_WIDTH_20:
+                bw = IEEE80211_STA_RX_BW_20;
+                break;
+        case NL80211_CHAN_WIDTH_40:
+        case NL80211_CHAN_WIDTH_80:
+        case NL80211_CHAN_WIDTH_80P80:
+        case NL80211_CHAN_WIDTH_160:
+                bw = ht_cap.cap & IEEE80211_HT_CAP_SUP_WIDTH_20_40 ?
+                                IEEE80211_STA_RX_BW_40 : IEEE80211_STA_RX_BW_20;
+                break;
+        }
+
+        if (bw != sta->sta.bandwidth)
+                changed = true;
+        sta->sta.bandwidth = bw;
+
+        sta->cur_max_bandwidth =
+                ht_cap.cap & IEEE80211_HT_CAP_SUP_WIDTH_20_40 ?
+                                IEEE80211_STA_RX_BW_40 : IEEE80211_STA_RX_BW_20;
+
+        switch ((ht_cap.cap & IEEE80211_HT_CAP_SM_PS)
+                        >> IEEE80211_HT_CAP_SM_PS_SHIFT) {
+        case WLAN_HT_CAP_SM_PS_INVALID:
+        case WLAN_HT_CAP_SM_PS_STATIC:
+                smps_mode = IEEE80211_SMPS_STATIC;
+                break;
+        case WLAN_HT_CAP_SM_PS_DYNAMIC:
+                smps_mode = IEEE80211_SMPS_DYNAMIC;
+                break;
+        case WLAN_HT_CAP_SM_PS_DISABLED:
+                smps_mode = IEEE80211_SMPS_OFF;
+                break;
+        }
+
+        if (smps_mode != sta->sta.smps_mode)
+                changed = true;
+        sta->sta.smps_mode = smps_mode;
+
+        return changed;
 }
 
 void ieee80211_sta_tear_down_BA_sessions(struct sta_info *sta,
@@ -406,6 +447,9 @@ void ieee80211_request_smps(struct ieee80211_vif *vif,
         if (WARN_ON(smps_mode == IEEE80211_SMPS_OFF))
                 smps_mode = IEEE80211_SMPS_AUTOMATIC;
 
+        if (sdata->u.mgd.driver_smps_mode == smps_mode)
+                return;
+
         sdata->u.mgd.driver_smps_mode = smps_mode;
 
         ieee80211_queue_work(&sdata->local->hw,
diff --git a/net/mac80211/ibss.c b/net/mac80211/ibss.c
index b4b866f41919..40b71dfcc79d 100644
--- a/net/mac80211/ibss.c
+++ b/net/mac80211/ibss.c
@@ -228,7 +228,7 @@ static void __ieee80211_sta_join_ibss(struct ieee80211_sub_if_data *sdata,
 
         bss = cfg80211_inform_bss_frame(local->hw.wiphy, chan,
                                         mgmt, skb->len, 0, GFP_KERNEL);
-        cfg80211_put_bss(bss);
+        cfg80211_put_bss(local->hw.wiphy, bss);
         netif_carrier_on(sdata->dev);
         cfg80211_ibss_joined(sdata->dev, ifibss->bssid, GFP_KERNEL);
 }
@@ -242,6 +242,8 @@ static void ieee80211_sta_join_ibss(struct ieee80211_sub_if_data *sdata,
         u32 basic_rates;
         int i, j;
         u16 beacon_int = cbss->beacon_interval;
+        const struct cfg80211_bss_ies *ies;
+        u64 tsf;
 
         lockdep_assert_held(&sdata->u.ibss.mtx);
 
@@ -265,13 +267,17 @@ static void ieee80211_sta_join_ibss(struct ieee80211_sub_if_data *sdata,
                 }
         }
 
+        rcu_read_lock();
+        ies = rcu_dereference(cbss->ies);
+        tsf = ies->tsf;
+        rcu_read_unlock();
+
         __ieee80211_sta_join_ibss(sdata, cbss->bssid,
                                   beacon_int,
                                   cbss->channel,
                                   basic_rates,
                                   cbss->capability,
-                                  cbss->tsf,
-                                  false);
+                                  tsf, false);
 }
 
 static struct sta_info *ieee80211_ibss_finish_sta(struct sta_info *sta,
@@ -302,7 +308,7 @@ static struct sta_info *ieee80211_ibss_finish_sta(struct sta_info *sta,
                          "TX Auth SA=%pM DA=%pM BSSID=%pM (auth_transaction=1)\n",
                          sdata->vif.addr, addr, sdata->u.ibss.bssid);
                 ieee80211_send_auth(sdata, 1, WLAN_AUTH_OPEN, 0, NULL, 0,
-                                    addr, sdata->u.ibss.bssid, NULL, 0, 0);
+                                    addr, sdata->u.ibss.bssid, NULL, 0, 0, 0);
         }
         return sta;
 }
@@ -422,7 +428,7 @@ static void ieee80211_rx_mgmt_auth_ibss(struct ieee80211_sub_if_data *sdata,
          * has actually implemented this.
          */
         ieee80211_send_auth(sdata, 2, WLAN_AUTH_OPEN, 0, NULL, 0,
-                            mgmt->sa, sdata->u.ibss.bssid, NULL, 0, 0);
+                            mgmt->sa, sdata->u.ibss.bssid, NULL, 0, 0, 0);
 }
 
 static void ieee80211_rx_bss_info(struct ieee80211_sub_if_data *sdata,
@@ -490,33 +496,26 @@ static void ieee80211_rx_bss_info(struct ieee80211_sub_if_data *sdata,
                 if (sta && elems->ht_operation && elems->ht_cap_elem &&
                     sdata->u.ibss.channel_type != NL80211_CHAN_NO_HT) {
                         /* we both use HT */
-                        struct ieee80211_sta_ht_cap sta_ht_cap_new;
+                        struct ieee80211_ht_cap htcap_ie;
                         struct cfg80211_chan_def chandef;
 
                         ieee80211_ht_oper_to_chandef(channel,
                                                      elems->ht_operation,
                                                      &chandef);
 
-                        ieee80211_ht_cap_ie_to_sta_ht_cap(sdata, sband,
-                                                          elems->ht_cap_elem,
-                                                          &sta_ht_cap_new);
+                        memcpy(&htcap_ie, elems->ht_cap_elem, sizeof(htcap_ie));
 
                         /*
                          * fall back to HT20 if we don't use or use
                          * the other extension channel
                          */
-                        if (chandef.width != NL80211_CHAN_WIDTH_40 ||
-                            cfg80211_get_chandef_type(&chandef) !=
+                        if (cfg80211_get_chandef_type(&chandef) !=
                                                 sdata->u.ibss.channel_type)
-                                sta_ht_cap_new.cap &=
-                                        ~IEEE80211_HT_CAP_SUP_WIDTH_20_40;
-
-                        if (memcmp(&sta->sta.ht_cap, &sta_ht_cap_new,
-                                   sizeof(sta_ht_cap_new))) {
-                                memcpy(&sta->sta.ht_cap, &sta_ht_cap_new,
-                                       sizeof(sta_ht_cap_new));
-                                rates_updated = true;
-                        }
+                                htcap_ie.cap_info &=
+                                        cpu_to_le16(~IEEE80211_HT_CAP_SUP_WIDTH_20_40);
+
+                        rates_updated |= ieee80211_ht_cap_ie_to_sta_ht_cap(
+                                                sdata, sband, &htcap_ie, sta);
                 }
 
                 if (sta && rates_updated) {
@@ -535,8 +534,8 @@ static void ieee80211_rx_bss_info(struct ieee80211_sub_if_data *sdata,
 
         cbss = container_of((void *)bss, struct cfg80211_bss, priv);
 
-        /* was just updated in ieee80211_bss_info_update */
-        beacon_timestamp = cbss->tsf;
+        /* same for beacon and probe response */
+        beacon_timestamp = le64_to_cpu(mgmt->u.beacon.timestamp);
 
         /* check if we need to merge IBSS */
 
@@ -1102,10 +1101,6 @@ int ieee80211_ibss_join(struct ieee80211_sub_if_data *sdata,
 
         mutex_unlock(&sdata->u.ibss.mtx);
 
-        mutex_lock(&sdata->local->mtx);
-        ieee80211_recalc_idle(sdata->local);
-        mutex_unlock(&sdata->local->mtx);
-
         /*
          * 802.11n-2009 9.13.3.1: In an IBSS, the HT Protection field is
          * reserved, but an HT STA shall protect HT transmissions as though
@@ -1159,7 +1154,7 @@ int ieee80211_ibss_leave(struct ieee80211_sub_if_data *sdata)
 
                 if (cbss) {
                         cfg80211_unlink_bss(local->hw.wiphy, cbss);
-                        cfg80211_put_bss(cbss);
+                        cfg80211_put_bss(local->hw.wiphy, cbss);
                 }
         }
 
@@ -1203,9 +1198,5 @@ int ieee80211_ibss_leave(struct ieee80211_sub_if_data *sdata)
 
         mutex_unlock(&sdata->u.ibss.mtx);
 
-        mutex_lock(&local->mtx);
-        ieee80211_recalc_idle(sdata->local);
-        mutex_unlock(&local->mtx);
-
         return 0;
 }
diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h
index 63f0430c131e..388580a1bada 100644
--- a/net/mac80211/ieee80211_i.h
+++ b/net/mac80211/ieee80211_i.h
@@ -86,23 +86,11 @@ struct ieee80211_fragment_entry {
 
 
 struct ieee80211_bss {
-        /* don't want to look up all the time */
-        size_t ssid_len;
-        u8 ssid[IEEE80211_MAX_SSID_LEN];
-
-        u32 device_ts;
+        u32 device_ts_beacon, device_ts_presp;
 
         bool wmm_used;
         bool uapsd_supported;
 
-        unsigned long last_probe_resp;
-
-#ifdef CONFIG_MAC80211_MESH
-        u8 *mesh_id;
-        size_t mesh_id_len;
-        u8 *mesh_cfg;
-#endif
-
 #define IEEE80211_MAX_SUPP_RATES 32
         u8 supp_rates[IEEE80211_MAX_SUPP_RATES];
         size_t supp_rates_len;
@@ -153,31 +141,6 @@ enum ieee80211_bss_valid_data_flags {
         IEEE80211_BSS_VALID_ERP                 = BIT(3)
 };
 
-static inline u8 *bss_mesh_cfg(struct ieee80211_bss *bss)
-{
-#ifdef CONFIG_MAC80211_MESH
-        return bss->mesh_cfg;
-#endif
-        return NULL;
-}
-
-static inline u8 *bss_mesh_id(struct ieee80211_bss *bss)
-{
-#ifdef CONFIG_MAC80211_MESH
-        return bss->mesh_id;
-#endif
-        return NULL;
-}
-
-static inline u8 bss_mesh_id_len(struct ieee80211_bss *bss)
-{
-#ifdef CONFIG_MAC80211_MESH
-        return bss->mesh_id_len;
-#endif
-        return 0;
-}
-
-
 typedef unsigned __bitwise__ ieee80211_tx_result;
 #define TX_CONTINUE     ((__force ieee80211_tx_result) 0u)
 #define TX_DROP         ((__force ieee80211_tx_result) 1u)
@@ -380,6 +343,7 @@ struct ieee80211_mgd_auth_data {
         u8 key[WLAN_KEY_LEN_WEP104];
         u8 key_len, key_idx;
         bool done;
+        bool timeout_started;
 
         u16 sae_trans, sae_status;
         size_t data_len;
@@ -399,9 +363,9 @@ struct ieee80211_mgd_assoc_data {
         u8 ssid_len;
         u8 supp_rates_len;
         bool wmm, uapsd;
-        bool have_beacon;
-        bool sent_assoc;
+        bool have_beacon, need_beacon;
         bool synced;
+        bool timeout_started;
 
         u8 ap_ht_param;
 
@@ -425,6 +389,7 @@ struct ieee80211_if_managed {
         unsigned long probe_timeout;
         int probe_send_count;
         bool nullfunc_failed;
+        bool connection_loss;
 
         struct mutex mtx;
         struct cfg80211_bss *associated;
@@ -449,6 +414,10 @@ struct ieee80211_if_managed {
         bool beacon_crc_valid;
         u32 beacon_crc;
 
+        bool status_acked;
+        bool status_received;
+        __le16 status_fc;
+
         enum {
                 IEEE80211_MFP_DISABLED,
                 IEEE80211_MFP_OPTIONAL,
@@ -611,6 +580,9 @@ struct ieee80211_if_mesh {
         u32 mesh_seqnum;
         bool accepting_plinks;
         int num_gates;
+        struct beacon_data __rcu *beacon;
+        /* just protects beacon updates for now */
+        struct mutex mtx;
         const u8 *ie;
         u8 ie_len;
         enum {
@@ -623,6 +595,11 @@ struct ieee80211_if_mesh {
         s64 sync_offset_clockdrift_max;
         spinlock_t sync_offset_lock;
         bool adjusting_tbtt;
+        /* mesh power save */
+        enum nl80211_mesh_power_mode nonpeer_pm;
+        int ps_peers_light_sleep;
+        int ps_peers_deep_sleep;
+        struct ps_data ps;
 };
 
 #ifdef CONFIG_MAC80211_MESH
@@ -717,9 +694,6 @@ struct ieee80211_sub_if_data {
 
         char name[IFNAMSIZ];
 
-        /* to detect idle changes */
-        bool old_idle;
-
         /* Fragment table for host-based reassembly */
         struct ieee80211_fragment_entry fragments[IEEE80211_FRAGMENT_MAX];
         unsigned int fragment_next;
@@ -747,14 +721,15 @@ struct ieee80211_sub_if_data {
         struct work_struct work;
         struct sk_buff_head skb_queue;
 
-        bool arp_filter_state;
-
         u8 needed_rx_chains;
         enum ieee80211_smps_mode smps_mode;
 
         int user_power_level; /* in dBm */
         int ap_power_level; /* in dBm */
 
+        bool radar_required;
+        struct delayed_work dfs_cac_timer_work;
+
         /*
          * AP this belongs to: self in AP mode and
          * corresponding AP in VLAN mode, NULL for
@@ -842,6 +817,7 @@ enum queue_stop_reason {
         IEEE80211_QUEUE_STOP_REASON_AGGREGATION,
         IEEE80211_QUEUE_STOP_REASON_SUSPEND,
         IEEE80211_QUEUE_STOP_REASON_SKB_ADD,
+        IEEE80211_QUEUE_STOP_REASON_OFFCHANNEL,
 };
 
 #ifdef CONFIG_MAC80211_LEDS
@@ -974,6 +950,10 @@ struct ieee80211_local {
         /* wowlan is enabled -- don't reconfig on resume */
         bool wowlan;
 
+        /* DFS/radar detection is enabled */
+        bool radar_detect_enabled;
+        struct work_struct radar_detected_work;
+
         /* number of RX chains the hardware has */
         u8 rx_chains;
 
@@ -988,14 +968,7 @@ struct ieee80211_local {
         struct sk_buff_head skb_queue;
         struct sk_buff_head skb_queue_unreliable;
 
-        /*
-         * Internal FIFO queue which is shared between multiple rx path
-         * stages. Its main task is to provide a serialization mechanism,
-         * so all rx handlers can enjoy having exclusive access to their
-         * private data structures.
-         */
-        struct sk_buff_head rx_skb_queue;
-        bool running_rx_handler;        /* protected by rx_skb_queue.lock */
+        spinlock_t rx_path_lock;
 
         /* Station data */
         /*
@@ -1129,14 +1102,13 @@ struct ieee80211_local {
         struct timer_list dynamic_ps_timer;
         struct notifier_block network_latency_notifier;
         struct notifier_block ifa_notifier;
+        struct notifier_block ifa6_notifier;
 
         /*
          * The dynamic ps timeout configured from user space via WEXT -
          * this will override whatever chosen by mac80211 internally.
          */
         int dynamic_ps_forced_timeout;
-        int dynamic_ps_user_timeout;
-        bool disable_dynamic_ps;
 
         int user_power_level; /* in dBm, for all interfaces */
 
@@ -1194,40 +1166,41 @@ struct ieee80211_ra_tid {
 
 /* Parsed Information Elements */
 struct ieee802_11_elems {
-        u8 *ie_start;
+        const u8 *ie_start;
         size_t total_len;
 
         /* pointers to IEs */
-        u8 *ssid;
-        u8 *supp_rates;
-        u8 *fh_params;
-        u8 *ds_params;
-        u8 *cf_params;
-        struct ieee80211_tim_ie *tim;
-        u8 *ibss_params;
-        u8 *challenge;
-        u8 *wpa;
-        u8 *rsn;
-        u8 *erp_info;
-        u8 *ext_supp_rates;
-        u8 *wmm_info;
-        u8 *wmm_param;
-        struct ieee80211_ht_cap *ht_cap_elem;
-        struct ieee80211_ht_operation *ht_operation;
-        struct ieee80211_vht_cap *vht_cap_elem;
-        struct ieee80211_vht_operation *vht_operation;
-        struct ieee80211_meshconf_ie *mesh_config;
-        u8 *mesh_id;
-        u8 *peering;
-        u8 *preq;
-        u8 *prep;
-        u8 *perr;
-        struct ieee80211_rann_ie *rann;
-        struct ieee80211_channel_sw_ie *ch_switch_ie;
-        u8 *country_elem;
-        u8 *pwr_constr_elem;
-        u8 *quiet_elem; /* first quite element */
-        u8 *timeout_int;
+        const u8 *ssid;
+        const u8 *supp_rates;
+        const u8 *fh_params;
+        const u8 *ds_params;
+        const u8 *cf_params;
+        const struct ieee80211_tim_ie *tim;
+        const u8 *ibss_params;
+        const u8 *challenge;
+        const u8 *rsn;
+        const u8 *erp_info;
+        const u8 *ext_supp_rates;
+        const u8 *wmm_info;
+        const u8 *wmm_param;
+        const struct ieee80211_ht_cap *ht_cap_elem;
+        const struct ieee80211_ht_operation *ht_operation;
+        const struct ieee80211_vht_cap *vht_cap_elem;
+        const struct ieee80211_vht_operation *vht_operation;
+        const struct ieee80211_meshconf_ie *mesh_config;
+        const u8 *mesh_id;
+        const u8 *peering;
+        const __le16 *awake_window;
+        const u8 *preq;
+        const u8 *prep;
+        const u8 *perr;
+        const struct ieee80211_rann_ie *rann;
+        const struct ieee80211_channel_sw_ie *ch_switch_ie;
+        const u8 *country_elem;
+        const u8 *pwr_constr_elem;
+        const u8 *quiet_elem;   /* first quite element */
+        const u8 *timeout_int;
+        const u8 *opmode_notif;
 
         /* length of them, respectively */
         u8 ssid_len;
@@ -1238,7 +1211,6 @@ struct ieee802_11_elems {
         u8 tim_len;
         u8 ibss_params_len;
         u8 challenge_len;
-        u8 wpa_len;
         u8 rsn_len;
         u8 erp_info_len;
         u8 ext_supp_rates_len;
@@ -1307,10 +1279,10 @@ void ieee80211_recalc_ps_vif(struct ieee80211_sub_if_data *sdata);
 int ieee80211_max_network_latency(struct notifier_block *nb,
                                   unsigned long data, void *dummy);
 int ieee80211_set_arp_filter(struct ieee80211_sub_if_data *sdata);
-void ieee80211_sta_process_chanswitch(struct ieee80211_sub_if_data *sdata,
-                                      struct ieee80211_channel_sw_ie *sw_elem,
-                                      struct ieee80211_bss *bss,
-                                      u64 timestamp);
+void
+ieee80211_sta_process_chanswitch(struct ieee80211_sub_if_data *sdata,
+                                 const struct ieee80211_channel_sw_ie *sw_elem,
+                                 struct ieee80211_bss *bss, u64 timestamp);
 void ieee80211_sta_quiesce(struct ieee80211_sub_if_data *sdata);
 void ieee80211_sta_restart(struct ieee80211_sub_if_data *sdata);
 void ieee80211_sta_work(struct ieee80211_sub_if_data *sdata);
@@ -1319,6 +1291,8 @@ void ieee80211_sta_rx_queued_mgmt(struct ieee80211_sub_if_data *sdata,
 void ieee80211_sta_reset_beacon_monitor(struct ieee80211_sub_if_data *sdata);
 void ieee80211_sta_reset_conn_monitor(struct ieee80211_sub_if_data *sdata);
 void ieee80211_mgd_stop(struct ieee80211_sub_if_data *sdata);
+void ieee80211_mgd_conn_tx_status(struct ieee80211_sub_if_data *sdata,
+                                  __le16 fc, bool acked);
 
 /* IBSS code */
 void ieee80211_ibss_notify_scan_completed(struct ieee80211_local *local);
@@ -1414,10 +1388,10 @@ void ieee80211_purge_tx_queue(struct ieee80211_hw *hw,
 /* HT */
 void ieee80211_apply_htcap_overrides(struct ieee80211_sub_if_data *sdata,
                                      struct ieee80211_sta_ht_cap *ht_cap);
-void ieee80211_ht_cap_ie_to_sta_ht_cap(struct ieee80211_sub_if_data *sdata,
+bool ieee80211_ht_cap_ie_to_sta_ht_cap(struct ieee80211_sub_if_data *sdata,
                                        struct ieee80211_supported_band *sband,
-                                       struct ieee80211_ht_cap *ht_cap_ie,
-                                       struct ieee80211_sta_ht_cap *ht_cap);
+                                       const struct ieee80211_ht_cap *ht_cap_ie,
+                                       struct sta_info *sta);
 void ieee80211_send_delba(struct ieee80211_sub_if_data *sdata,
                           const u8 *da, u16 tid,
                           u16 initiator, u16 reason_code);
@@ -1457,10 +1431,17 @@ void ieee80211_release_reorder_timeout(struct sta_info *sta, int tid);
 u8 ieee80211_mcs_to_chains(const struct ieee80211_mcs_info *mcs);
 
 /* VHT */
-void ieee80211_vht_cap_ie_to_sta_vht_cap(struct ieee80211_sub_if_data *sdata,
-                                         struct ieee80211_supported_band *sband,
-                                         struct ieee80211_vht_cap *vht_cap_ie,
-                                         struct ieee80211_sta_vht_cap *vht_cap);
+void
+ieee80211_vht_cap_ie_to_sta_vht_cap(struct ieee80211_sub_if_data *sdata,
+                                    struct ieee80211_supported_band *sband,
+                                    const struct ieee80211_vht_cap *vht_cap_ie,
+                                    struct sta_info *sta);
+enum ieee80211_sta_rx_bandwidth ieee80211_sta_cur_vht_bw(struct sta_info *sta);
+void ieee80211_sta_set_rx_nss(struct sta_info *sta);
+void ieee80211_vht_handle_opmode(struct ieee80211_sub_if_data *sdata,
+                                 struct sta_info *sta, u8 opmode,
+                                 enum ieee80211_band band, bool nss_only);
+
 /* Spectrum management */
 void ieee80211_process_measurement_req(struct ieee80211_sub_if_data *sdata,
                                        struct ieee80211_mgmt *mgmt,
@@ -1578,8 +1559,9 @@ static inline void ieee80211_add_pending_skbs(struct ieee80211_local *local,
 
 void ieee80211_send_auth(struct ieee80211_sub_if_data *sdata,
                          u16 transaction, u16 auth_alg, u16 status,
-                         u8 *extra, size_t extra_len, const u8 *bssid,
-                         const u8 *da, const u8 *key, u8 key_len, u8 key_idx);
+                         const u8 *extra, size_t extra_len, const u8 *bssid,
+                         const u8 *da, const u8 *key, u8 key_len, u8 key_idx,
+                         u32 tx_flags);
 void ieee80211_send_deauth_disassoc(struct ieee80211_sub_if_data *sdata,
                                     const u8 *bssid, u16 stype, u16 reason,
                                     bool send_frame, u8 *frame_buf);
@@ -1596,7 +1578,7 @@ struct sk_buff *ieee80211_build_probe_req(struct ieee80211_sub_if_data *sdata,
 void ieee80211_send_probe_req(struct ieee80211_sub_if_data *sdata, u8 *dst,
                               const u8 *ssid, size_t ssid_len,
                               const u8 *ie, size_t ie_len,
-                              u32 ratemask, bool directed, bool no_cck,
+                              u32 ratemask, bool directed, u32 tx_flags,
                               struct ieee80211_channel *channel, bool scan);
 
 void ieee80211_sta_def_wmm_params(struct ieee80211_sub_if_data *sdata,
@@ -1628,18 +1610,31 @@ int ieee80211_add_ext_srates_ie(struct ieee80211_sub_if_data *sdata,
 
 /* channel management */
 void ieee80211_ht_oper_to_chandef(struct ieee80211_channel *control_chan,
-                                  struct ieee80211_ht_operation *ht_oper,
+                                  const struct ieee80211_ht_operation *ht_oper,
                                   struct cfg80211_chan_def *chandef);
 
 int __must_check
 ieee80211_vif_use_channel(struct ieee80211_sub_if_data *sdata,
                           const struct cfg80211_chan_def *chandef,
                           enum ieee80211_chanctx_mode mode);
+int __must_check
+ieee80211_vif_change_bandwidth(struct ieee80211_sub_if_data *sdata,
+                               const struct cfg80211_chan_def *chandef,
+                               u32 *changed);
 void ieee80211_vif_release_channel(struct ieee80211_sub_if_data *sdata);
 void ieee80211_vif_vlan_copy_chanctx(struct ieee80211_sub_if_data *sdata);
+void ieee80211_vif_copy_chanctx_to_vlans(struct ieee80211_sub_if_data *sdata,
+                                         bool clear);
 
 void ieee80211_recalc_smps_chanctx(struct ieee80211_local *local,
                                    struct ieee80211_chanctx *chanctx);
+void ieee80211_recalc_radar_chanctx(struct ieee80211_local *local,
+                                    struct ieee80211_chanctx *chanctx);
+
+void ieee80211_dfs_cac_timer(unsigned long data);
+void ieee80211_dfs_cac_timer_work(struct work_struct *work);
+void ieee80211_dfs_cac_cancel(struct ieee80211_local *local);
+void ieee80211_dfs_radar_detected_work(struct work_struct *work);
 
 #ifdef CONFIG_MAC80211_NOINLINE
 #define debug_noinline noinline
diff --git a/net/mac80211/iface.c b/net/mac80211/iface.c
index 06fac2991d40..86c83084542a 100644
--- a/net/mac80211/iface.c
+++ b/net/mac80211/iface.c
@@ -78,8 +78,7 @@ void ieee80211_recalc_txpower(struct ieee80211_sub_if_data *sdata)
                 ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_TXPOWER);
 }
 
-static u32 ieee80211_idle_off(struct ieee80211_local *local,
-                              const char *reason)
+static u32 ieee80211_idle_off(struct ieee80211_local *local)
 {
         if (!(local->hw.conf.flags & IEEE80211_CONF_IDLE))
                 return 0;
@@ -99,110 +98,45 @@ static u32 ieee80211_idle_on(struct ieee80211_local *local)
         return IEEE80211_CONF_CHANGE_IDLE;
 }
 
-static u32 __ieee80211_recalc_idle(struct ieee80211_local *local)
+void ieee80211_recalc_idle(struct ieee80211_local *local)
 {
-        struct ieee80211_sub_if_data *sdata;
-        int count = 0;
-        bool working = false, scanning = false;
+        bool working = false, scanning, active;
         unsigned int led_trig_start = 0, led_trig_stop = 0;
         struct ieee80211_roc_work *roc;
+        u32 change;
 
-#ifdef CONFIG_PROVE_LOCKING
-        WARN_ON(debug_locks && !lockdep_rtnl_is_held() &&
-                !lockdep_is_held(&local->iflist_mtx));
-#endif
         lockdep_assert_held(&local->mtx);
 
-        list_for_each_entry(sdata, &local->interfaces, list) {
-                if (!ieee80211_sdata_running(sdata)) {
-                        sdata->vif.bss_conf.idle = true;
-                        continue;
-                }
-
-                sdata->old_idle = sdata->vif.bss_conf.idle;
-
-                /* do not count disabled managed interfaces */
-                if (sdata->vif.type == NL80211_IFTYPE_STATION &&
-                    !sdata->u.mgd.associated &&
-                    !sdata->u.mgd.auth_data &&
-                    !sdata->u.mgd.assoc_data) {
-                        sdata->vif.bss_conf.idle = true;
-                        continue;
-                }
-                /* do not count unused IBSS interfaces */
-                if (sdata->vif.type == NL80211_IFTYPE_ADHOC &&
-                    !sdata->u.ibss.ssid_len) {
-                        sdata->vif.bss_conf.idle = true;
-                        continue;
-                }
-
-                if (sdata->vif.type == NL80211_IFTYPE_P2P_DEVICE)
-                        continue;
-
-                /* count everything else */
-                sdata->vif.bss_conf.idle = false;
-                count++;
-        }
+        active = !list_empty(&local->chanctx_list);
 
         if (!local->ops->remain_on_channel) {
                 list_for_each_entry(roc, &local->roc_list, list) {
                         working = true;
-                        roc->sdata->vif.bss_conf.idle = false;
+                        break;
                 }
         }
 
-        sdata = rcu_dereference_protected(local->scan_sdata,
-                                          lockdep_is_held(&local->mtx));
-        if (sdata && !(local->hw.flags & IEEE80211_HW_SCAN_WHILE_IDLE)) {
-                scanning = true;
-                sdata->vif.bss_conf.idle = false;
-        }
-
-        list_for_each_entry(sdata, &local->interfaces, list) {
-                if (sdata->vif.type == NL80211_IFTYPE_MONITOR ||
-                    sdata->vif.type == NL80211_IFTYPE_AP_VLAN ||
-                    sdata->vif.type == NL80211_IFTYPE_P2P_DEVICE)
-                        continue;
-                if (sdata->old_idle == sdata->vif.bss_conf.idle)
-                        continue;
-                if (!ieee80211_sdata_running(sdata))
-                        continue;
-                ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_IDLE);
-        }
+        scanning = test_bit(SCAN_SW_SCANNING, &local->scanning) ||
+                   test_bit(SCAN_ONCHANNEL_SCANNING, &local->scanning);
 
         if (working || scanning)
                 led_trig_start |= IEEE80211_TPT_LEDTRIG_FL_WORK;
         else
                 led_trig_stop |= IEEE80211_TPT_LEDTRIG_FL_WORK;
 
-        if (count)
+        if (active)
                 led_trig_start |= IEEE80211_TPT_LEDTRIG_FL_CONNECTED;
         else
                 led_trig_stop |= IEEE80211_TPT_LEDTRIG_FL_CONNECTED;
 
         ieee80211_mod_tpt_led_trig(local, led_trig_start, led_trig_stop);
 
-        if (working)
-                return ieee80211_idle_off(local, "working");
-        if (scanning)
-                return ieee80211_idle_off(local, "scanning");
-        if (!count)
-                return ieee80211_idle_on(local);
+        if (working || scanning || active)
+                change = ieee80211_idle_off(local);
         else
-                return ieee80211_idle_off(local, "in use");
-
-        return 0;
-}
-
-void ieee80211_recalc_idle(struct ieee80211_local *local)
-{
-        u32 chg;
-
-        mutex_lock(&local->iflist_mtx);
-        chg = __ieee80211_recalc_idle(local);
-        mutex_unlock(&local->iflist_mtx);
-        if (chg)
-                ieee80211_hw_config(local, chg);
+                change = ieee80211_idle_on(local);
+        if (change)
+                ieee80211_hw_config(local, change);
 }
 
 static int ieee80211_change_mtu(struct net_device *dev, int new_mtu)
@@ -621,6 +555,8 @@ int ieee80211_do_open(struct wireless_dev *wdev, bool coming_up)
                                 goto err_del_interface;
                 }
 
+                drv_add_interface_debugfs(local, sdata);
+
                 if (sdata->vif.type == NL80211_IFTYPE_AP) {
                         local->fif_pspoll++;
                         local->fif_probe_req++;
@@ -694,10 +630,6 @@ int ieee80211_do_open(struct wireless_dev *wdev, bool coming_up)
         if (sdata->flags & IEEE80211_SDATA_PROMISC)
                 atomic_inc(&local->iff_promiscs);
 
-        mutex_lock(&local->mtx);
-        hw_reconf_flags |= __ieee80211_recalc_idle(local);
-        mutex_unlock(&local->mtx);
-
         if (coming_up)
                 local->open_count++;
 
@@ -748,6 +680,7 @@ static void ieee80211_do_stop(struct ieee80211_sub_if_data *sdata,
         struct sk_buff *skb, *tmp;
         u32 hw_reconf_flags = 0;
         int i, flushed;
+        struct ps_data *ps;
 
         clear_bit(SDATA_STATE_RUNNING, &sdata->state);
 
@@ -817,6 +750,16 @@ static void ieee80211_do_stop(struct ieee80211_sub_if_data *sdata,
 
         cancel_work_sync(&sdata->recalc_smps);
 
+        cancel_delayed_work_sync(&sdata->dfs_cac_timer_work);
+
+        if (sdata->wdev.cac_started) {
+                mutex_lock(&local->iflist_mtx);
+                ieee80211_vif_release_channel(sdata);
+                mutex_unlock(&local->iflist_mtx);
+                cfg80211_cac_event(sdata->dev, NL80211_RADAR_CAC_ABORTED,
+                                   GFP_KERNEL);
+        }
+
         /* APs need special treatment */
         if (sdata->vif.type == NL80211_IFTYPE_AP) {
                 struct ieee80211_sub_if_data *vlan, *tmpsdata;
@@ -826,6 +769,19 @@ static void ieee80211_do_stop(struct ieee80211_sub_if_data *sdata,
                                          u.vlan.list)
                         dev_close(vlan->dev);
                 WARN_ON(!list_empty(&sdata->u.ap.vlans));
+        } else if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN) {
+                /* remove all packets in parent bc_buf pointing to this dev */
+                ps = &sdata->bss->ps;
+
+                spin_lock_irqsave(&ps->bc_buf.lock, flags);
+                skb_queue_walk_safe(&ps->bc_buf, skb, tmp) {
+                        if (skb->dev == sdata->dev) {
+                                __skb_unlink(skb, &ps->bc_buf);
+                                local->total_ps_buffered--;
+                                ieee80211_free_txskb(&local->hw, skb);
+                        }
+                }
+                spin_unlock_irqrestore(&ps->bc_buf.lock, flags);
         } else if (sdata->vif.type == NL80211_IFTYPE_STATION) {
                 ieee80211_mgd_stop(sdata);
         }
@@ -882,16 +838,14 @@ static void ieee80211_do_stop(struct ieee80211_sub_if_data *sdata,
                  */
                 ieee80211_free_keys(sdata);
 
+                drv_remove_interface_debugfs(local, sdata);
+
                 if (going_down)
                         drv_remove_interface(local, sdata);
         }
 
         sdata->bss = NULL;
 
-        mutex_lock(&local->mtx);
-        hw_reconf_flags |= __ieee80211_recalc_idle(local);
-        mutex_unlock(&local->mtx);
-
         ieee80211_recalc_ps(local, -1);
 
         if (local->open_count == 0) {
@@ -1574,9 +1528,6 @@ int ieee80211_if_add(struct ieee80211_local *local, const char *name,
         /* initialise type-independent data */
         sdata->wdev.wiphy = local->hw.wiphy;
         sdata->local = local;
-#ifdef CONFIG_INET
-        sdata->arp_filter_state = true;
-#endif
 
         for (i = 0; i < IEEE80211_FRAGMENT_MAX; i++)
                 skb_queue_head_init(&sdata->fragments[i].skb_list);
@@ -1586,6 +1537,8 @@ int ieee80211_if_add(struct ieee80211_local *local, const char *name,
         spin_lock_init(&sdata->cleanup_stations_lock);
         INIT_LIST_HEAD(&sdata->cleanup_stations);
         INIT_WORK(&sdata->cleanup_stations_wk, ieee80211_cleanup_sdata_stas_wk);
+        INIT_DELAYED_WORK(&sdata->dfs_cac_timer_work,
+                          ieee80211_dfs_cac_timer_work);
 
         for (i = 0; i < IEEE80211_NUM_BANDS; i++) {
                 struct ieee80211_supported_band *sband;
diff --git a/net/mac80211/key.c b/net/mac80211/key.c
index 619c5d697999..ef252eb58c36 100644
--- a/net/mac80211/key.c
+++ b/net/mac80211/key.c
@@ -204,8 +204,11 @@ static void __ieee80211_set_default_key(struct ieee80211_sub_if_data *sdata,
         if (idx >= 0 && idx < NUM_DEFAULT_KEYS)
                 key = key_mtx_dereference(sdata->local, sdata->keys[idx]);
 
-        if (uni)
+        if (uni) {
                 rcu_assign_pointer(sdata->default_unicast_key, key);
+                drv_set_default_unicast_key(sdata->local, sdata, idx);
+        }
+
         if (multi)
                 rcu_assign_pointer(sdata->default_multicast_key, key);
 
diff --git a/net/mac80211/main.c b/net/mac80211/main.c
index 39cfe8f10ad2..f9747689d604 100644
--- a/net/mac80211/main.c
+++ b/net/mac80211/main.c
@@ -23,6 +23,7 @@
 #include <linux/inetdevice.h>
 #include <net/net_namespace.h>
 #include <net/cfg80211.h>
+#include <net/addrconf.h>
 
 #include "ieee80211_i.h"
 #include "driver-ops.h"
@@ -33,8 +34,6 @@
 #include "cfg.h"
 #include "debugfs.h"
 
-static struct lock_class_key ieee80211_rx_skb_queue_class;
-
 void ieee80211_configure_filter(struct ieee80211_local *local)
 {
         u64 mc;
@@ -349,27 +348,19 @@ static int ieee80211_ifa_changed(struct notifier_block *nb,
 
         /* Copy the addresses to the bss_conf list */
         ifa = idev->ifa_list;
-        while (c < IEEE80211_BSS_ARP_ADDR_LIST_LEN && ifa) {
-                bss_conf->arp_addr_list[c] = ifa->ifa_address;
+        while (ifa) {
+                if (c < IEEE80211_BSS_ARP_ADDR_LIST_LEN)
+                        bss_conf->arp_addr_list[c] = ifa->ifa_address;
                 ifa = ifa->ifa_next;
                 c++;
         }
 
-        /* If not all addresses fit the list, disable filtering */
-        if (ifa) {
-                sdata->arp_filter_state = false;
-                c = 0;
-        } else {
-                sdata->arp_filter_state = true;
-        }
         bss_conf->arp_addr_cnt = c;
 
         /* Configure driver only if associated (which also implies it is up) */
-        if (ifmgd->associated) {
-                bss_conf->arp_filter_enabled = sdata->arp_filter_state;
+        if (ifmgd->associated)
                 ieee80211_bss_info_change_notify(sdata,
                                                  BSS_CHANGED_ARP_FILTER);
-        }
 
         mutex_unlock(&ifmgd->mtx);
 
@@ -377,6 +368,37 @@ static int ieee80211_ifa_changed(struct notifier_block *nb,
 }
 #endif
 
+#if IS_ENABLED(CONFIG_IPV6)
+static int ieee80211_ifa6_changed(struct notifier_block *nb,
+                                  unsigned long data, void *arg)
+{
+        struct inet6_ifaddr *ifa = (struct inet6_ifaddr *)arg;
+        struct inet6_dev *idev = ifa->idev;
+        struct net_device *ndev = ifa->idev->dev;
+        struct ieee80211_local *local =
+                container_of(nb, struct ieee80211_local, ifa6_notifier);
+        struct wireless_dev *wdev = ndev->ieee80211_ptr;
+        struct ieee80211_sub_if_data *sdata;
+
+        /* Make sure it's our interface that got changed */
+        if (!wdev || wdev->wiphy != local->hw.wiphy)
+                return NOTIFY_DONE;
+
+        sdata = IEEE80211_DEV_TO_SUB_IF(ndev);
+
+        /*
+         * For now only support station mode. This is mostly because
+         * doing AP would have to handle AP_VLAN in some way ...
+         */
+        if (sdata->vif.type != NL80211_IFTYPE_STATION)
+                return NOTIFY_DONE;
+
+        drv_ipv6_addr_change(local, sdata, idev);
+
+        return NOTIFY_DONE;
+}
+#endif
+
 static int ieee80211_napi_poll(struct napi_struct *napi, int budget)
 {
         struct ieee80211_local *local =
@@ -479,6 +501,11 @@ static const struct ieee80211_ht_cap mac80211_ht_capa_mod_mask = {
         },
 };
 
+static const u8 extended_capabilities[] = {
+        0, 0, 0, 0, 0, 0, 0,
+        WLAN_EXT_CAPA8_OPMODE_NOTIF,
+};
+
 struct ieee80211_hw *ieee80211_alloc_hw(size_t priv_data_len,
                                         const struct ieee80211_ops *ops)
 {
@@ -535,14 +562,17 @@ struct ieee80211_hw *ieee80211_alloc_hw(size_t priv_data_len,
                         WIPHY_FLAG_REPORTS_OBSS |
                         WIPHY_FLAG_OFFCHAN_TX;
 
+        wiphy->extended_capabilities = extended_capabilities;
+        wiphy->extended_capabilities_mask = extended_capabilities;
+        wiphy->extended_capabilities_len = ARRAY_SIZE(extended_capabilities);
+
         if (ops->remain_on_channel)
                 wiphy->flags |= WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL;
 
         wiphy->features |= NL80211_FEATURE_SK_TX_STATUS |
                            NL80211_FEATURE_SAE |
                            NL80211_FEATURE_HT_IBSS |
-                           NL80211_FEATURE_VIF_TXPOWER |
-                           NL80211_FEATURE_FULL_AP_CLIENT_STATE;
+                           NL80211_FEATURE_VIF_TXPOWER;
 
         if (!ops->hw_scan)
                 wiphy->features |= NL80211_FEATURE_LOW_PRIORITY_SCAN |
@@ -589,25 +619,19 @@ struct ieee80211_hw *ieee80211_alloc_hw(size_t priv_data_len,
 
         mutex_init(&local->key_mtx);
         spin_lock_init(&local->filter_lock);
+        spin_lock_init(&local->rx_path_lock);
         spin_lock_init(&local->queue_stop_reason_lock);
 
         INIT_LIST_HEAD(&local->chanctx_list);
         mutex_init(&local->chanctx_mtx);
 
-        /*
-         * The rx_skb_queue is only accessed from tasklets,
-         * but other SKB queues are used from within IRQ
-         * context. Therefore, this one needs a different
-         * locking class so our direct, non-irq-safe use of
-         * the queue's lock doesn't throw lockdep warnings.
-         */
-        skb_queue_head_init_class(&local->rx_skb_queue,
-                                  &ieee80211_rx_skb_queue_class);
-
         INIT_DELAYED_WORK(&local->scan_work, ieee80211_scan_work);
 
         INIT_WORK(&local->restart_work, ieee80211_restart_work);
 
+        INIT_WORK(&local->radar_detected_work,
+                  ieee80211_dfs_radar_detected_work);
+
         INIT_WORK(&local->reconfig_filter, ieee80211_reconfig_filter);
         local->smps_mode = IEEE80211_SMPS_OFF;
 
@@ -683,9 +707,6 @@ int ieee80211_register_hw(struct ieee80211_hw *hw)
                 return -EINVAL;
 #endif
 
-        if ((hw->flags & IEEE80211_HW_SCAN_WHILE_IDLE) && !local->ops->hw_scan)
-                return -EINVAL;
-
         if (!local->use_chanctx) {
                 for (i = 0; i < local->hw.wiphy->n_iface_combinations; i++) {
                         const struct ieee80211_iface_combination *comb;
@@ -703,6 +724,16 @@ int ieee80211_register_hw(struct ieee80211_hw *hw)
                  */
                 if (local->hw.wiphy->interface_modes & BIT(NL80211_IFTYPE_WDS))
                         return -EINVAL;
+
+                /* DFS currently not supported with channel context drivers */
+                for (i = 0; i < local->hw.wiphy->n_iface_combinations; i++) {
+                        const struct ieee80211_iface_combination *comb;
+
+                        comb = &local->hw.wiphy->iface_combinations[i];
+
+                        if (comb->radar_detect_widths)
+                                return -EINVAL;
+                }
         }
 
         /* Only HW csum features are currently compatible with mac80211 */
@@ -985,12 +1016,25 @@ int ieee80211_register_hw(struct ieee80211_hw *hw)
                 goto fail_ifa;
 #endif
 
+#if IS_ENABLED(CONFIG_IPV6)
+        local->ifa6_notifier.notifier_call = ieee80211_ifa6_changed;
+        result = register_inet6addr_notifier(&local->ifa6_notifier);
+        if (result)
+                goto fail_ifa6;
+#endif
+
         netif_napi_add(&local->napi_dev, &local->napi, ieee80211_napi_poll,
                         local->hw.napi_weight);
 
         return 0;
 
+#if IS_ENABLED(CONFIG_IPV6)
+ fail_ifa6:
 #ifdef CONFIG_INET
+        unregister_inetaddr_notifier(&local->ifa_notifier);
+#endif
+#endif
+#if defined(CONFIG_INET) || defined(CONFIG_IPV6)
  fail_ifa:
         pm_qos_remove_notifier(PM_QOS_NETWORK_LATENCY,
                                &local->network_latency_notifier);
@@ -1026,6 +1070,9 @@ void ieee80211_unregister_hw(struct ieee80211_hw *hw)
 #ifdef CONFIG_INET
         unregister_inetaddr_notifier(&local->ifa_notifier);
 #endif
+#if IS_ENABLED(CONFIG_IPV6)
+        unregister_inet6addr_notifier(&local->ifa6_notifier);
+#endif
 
         rtnl_lock();
 
@@ -1049,7 +1096,6 @@ void ieee80211_unregister_hw(struct ieee80211_hw *hw)
                 wiphy_warn(local->hw.wiphy, "skb_queue not empty\n");
         skb_queue_purge(&local->skb_queue);
         skb_queue_purge(&local->skb_queue_unreliable);
-        skb_queue_purge(&local->rx_skb_queue);
 
         destroy_workqueue(local->workqueue);
         wiphy_unregister(local->hw.wiphy);
diff --git a/net/mac80211/mesh.c b/net/mac80211/mesh.c
index 694e27376afa..a77d40ed4e61 100644
--- a/net/mac80211/mesh.c
+++ b/net/mac80211/mesh.c
@@ -149,6 +149,31 @@ u32 mesh_accept_plinks_update(struct ieee80211_sub_if_data *sdata)
         return changed;
 }
 
+/*
+ * mesh_sta_cleanup - clean up any mesh sta state
+ *
+ * @sta: mesh sta to clean up.
+ */
+void mesh_sta_cleanup(struct sta_info *sta)
+{
+        struct ieee80211_sub_if_data *sdata = sta->sdata;
+        u32 changed;
+
+        /*
+         * maybe userspace handles peer allocation and peering, but in either
+         * case the beacon is still generated by the kernel and we might need
+         * an update.
+         */
+        changed = mesh_accept_plinks_update(sdata);
+        if (sdata->u.mesh.security == IEEE80211_MESH_SEC_NONE) {
+                changed |= mesh_plink_deactivate(sta);
+                del_timer_sync(&sta->plink_timer);
+        }
+
+        if (changed)
+                ieee80211_mbss_info_change_notify(sdata, changed);
+}
+
 int mesh_rmc_init(struct ieee80211_sub_if_data *sdata)
 {
         int i;
@@ -261,6 +286,9 @@ mesh_add_meshconf_ie(struct sk_buff *skb, struct ieee80211_sub_if_data *sdata)
         *pos = IEEE80211_MESHCONF_CAPAB_FORWARDING;
         *pos |= ifmsh->accepting_plinks ?
             IEEE80211_MESHCONF_CAPAB_ACCEPT_PLINKS : 0x00;
+        /* Mesh PS mode. See IEEE802.11-2012 8.4.2.100.8 */
+        *pos |= ifmsh->ps_peers_deep_sleep ?
+            IEEE80211_MESHCONF_CAPAB_POWER_SAVE_LEVEL : 0x00;
         *pos++ |= ifmsh->adjusting_tbtt ?
             IEEE80211_MESHCONF_CAPAB_TBTT_ADJUSTING : 0x00;
         *pos++ = 0x00;
@@ -286,6 +314,29 @@ mesh_add_meshid_ie(struct sk_buff *skb, struct ieee80211_sub_if_data *sdata)
         return 0;
 }
 
+int mesh_add_awake_window_ie(struct sk_buff *skb,
+                             struct ieee80211_sub_if_data *sdata)
+{
+        struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
+        u8 *pos;
+
+        /* see IEEE802.11-2012 13.14.6 */
+        if (ifmsh->ps_peers_light_sleep == 0 &&
+            ifmsh->ps_peers_deep_sleep == 0 &&
+            ifmsh->nonpeer_pm == NL80211_MESH_POWER_ACTIVE)
+                return 0;
+
+        if (skb_tailroom(skb) < 4)
+                return -ENOMEM;
+
+        pos = skb_put(skb, 2 + 2);
+        *pos++ = WLAN_EID_MESH_AWAKE_WINDOW;
+        *pos++ = 2;
+        put_unaligned_le16(ifmsh->mshcfg.dot11MeshAwakeWindowDuration, pos);
+
+        return 0;
+}
+
 int
 mesh_add_vendor_ies(struct sk_buff *skb, struct ieee80211_sub_if_data *sdata)
 {
@@ -342,8 +393,6 @@ mesh_add_rsn_ie(struct sk_buff *skb, struct ieee80211_sub_if_data *sdata)
 int mesh_add_ds_params_ie(struct sk_buff *skb,
                           struct ieee80211_sub_if_data *sdata)
 {
-        struct ieee80211_local *local = sdata->local;
-        struct ieee80211_supported_band *sband;
         struct ieee80211_chanctx_conf *chanctx_conf;
         struct ieee80211_channel *chan;
         u8 *pos;
@@ -360,13 +409,10 @@ int mesh_add_ds_params_ie(struct sk_buff *skb,
         chan = chanctx_conf->def.chan;
         rcu_read_unlock();
 
-        sband = local->hw.wiphy->bands[chan->band];
-        if (sband->band == IEEE80211_BAND_2GHZ) {
-                pos = skb_put(skb, 2 + 1);
-                *pos++ = WLAN_EID_DS_PARAMS;
-                *pos++ = 1;
-                *pos++ = ieee80211_frequency_to_channel(chan->center_freq);
-        }
+        pos = skb_put(skb, 2 + 1);
+        *pos++ = WLAN_EID_DS_PARAMS;
+        *pos++ = 1;
+        *pos++ = ieee80211_frequency_to_channel(chan->center_freq);
 
         return 0;
 }
@@ -547,7 +593,7 @@ static void ieee80211_mesh_housekeeping(struct ieee80211_sub_if_data *sdata,
         mesh_path_expire(sdata);
 
         changed = mesh_accept_plinks_update(sdata);
-        ieee80211_bss_info_change_notify(sdata, changed);
+        ieee80211_mbss_info_change_notify(sdata, changed);
 
         mod_timer(&ifmsh->housekeeping_timer,
                   round_jiffies(jiffies + IEEE80211_MESH_HOUSEKEEPING_INTERVAL));
@@ -598,7 +644,140 @@ void ieee80211_mesh_restart(struct ieee80211_sub_if_data *sdata)
 }
 #endif
 
-void ieee80211_start_mesh(struct ieee80211_sub_if_data *sdata)
+static int
+ieee80211_mesh_build_beacon(struct ieee80211_if_mesh *ifmsh)
+{
+        struct beacon_data *bcn;
+        int head_len, tail_len;
+        struct sk_buff *skb;
+        struct ieee80211_mgmt *mgmt;
+        struct ieee80211_chanctx_conf *chanctx_conf;
+        enum ieee80211_band band;
+        u8 *pos;
+        struct ieee80211_sub_if_data *sdata;
+        int hdr_len = offsetof(struct ieee80211_mgmt, u.beacon) +
+                      sizeof(mgmt->u.beacon);
+
+        sdata = container_of(ifmsh, struct ieee80211_sub_if_data, u.mesh);
+        rcu_read_lock();
+        chanctx_conf = rcu_dereference(sdata->vif.chanctx_conf);
+        band = chanctx_conf->def.chan->band;
+        rcu_read_unlock();
+
+        head_len = hdr_len +
+                   2 + /* NULL SSID */
+                   2 + 8 + /* supported rates */
+                   2 + 3; /* DS params */
+        tail_len = 2 + (IEEE80211_MAX_SUPP_RATES - 8) +
+                   2 + sizeof(struct ieee80211_ht_cap) +
+                   2 + sizeof(struct ieee80211_ht_operation) +
+                   2 + ifmsh->mesh_id_len +
+                   2 + sizeof(struct ieee80211_meshconf_ie) +
+                   2 + sizeof(__le16) + /* awake window */
+                   ifmsh->ie_len;
+
+        bcn = kzalloc(sizeof(*bcn) + head_len + tail_len, GFP_KERNEL);
+        /* need an skb for IE builders to operate on */
+        skb = dev_alloc_skb(max(head_len, tail_len));
+
+        if (!bcn || !skb)
+                goto out_free;
+
+        /*
+         * pointers go into the block we allocated,
+         * memory is | beacon_data | head | tail |
+         */
+        bcn->head = ((u8 *) bcn) + sizeof(*bcn);
+
+        /* fill in the head */
+        mgmt = (struct ieee80211_mgmt *) skb_put(skb, hdr_len);
+        memset(mgmt, 0, hdr_len);
+        mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
+                                          IEEE80211_STYPE_BEACON);
+        eth_broadcast_addr(mgmt->da);
+        memcpy(mgmt->sa, sdata->vif.addr, ETH_ALEN);
+        memcpy(mgmt->bssid, sdata->vif.addr, ETH_ALEN);
+        ieee80211_mps_set_frame_flags(sdata, NULL, (void *) mgmt);
+        mgmt->u.beacon.beacon_int =
+                cpu_to_le16(sdata->vif.bss_conf.beacon_int);
+        mgmt->u.beacon.capab_info |= cpu_to_le16(
+                sdata->u.mesh.security ? WLAN_CAPABILITY_PRIVACY : 0);
+
+        pos = skb_put(skb, 2);
+        *pos++ = WLAN_EID_SSID;
+        *pos++ = 0x0;
+
+        if (ieee80211_add_srates_ie(sdata, skb, true, band) ||
+            mesh_add_ds_params_ie(skb, sdata))
+                goto out_free;
+
+        bcn->head_len = skb->len;
+        memcpy(bcn->head, skb->data, bcn->head_len);
+
+        /* now the tail */
+        skb_trim(skb, 0);
+        bcn->tail = bcn->head + bcn->head_len;
+
+        if (ieee80211_add_ext_srates_ie(sdata, skb, true, band) ||
+            mesh_add_rsn_ie(skb, sdata) ||
+            mesh_add_ht_cap_ie(skb, sdata) ||
+            mesh_add_ht_oper_ie(skb, sdata) ||
+            mesh_add_meshid_ie(skb, sdata) ||
+            mesh_add_meshconf_ie(skb, sdata) ||
+            mesh_add_awake_window_ie(skb, sdata) ||
+            mesh_add_vendor_ies(skb, sdata))
+                goto out_free;
+
+        bcn->tail_len = skb->len;
+        memcpy(bcn->tail, skb->data, bcn->tail_len);
+
+        dev_kfree_skb(skb);
+        rcu_assign_pointer(ifmsh->beacon, bcn);
+        return 0;
+out_free:
+        kfree(bcn);
+        dev_kfree_skb(skb);
+        return -ENOMEM;
+}
+
+static int
+ieee80211_mesh_rebuild_beacon(struct ieee80211_if_mesh *ifmsh)
+{
+        struct ieee80211_sub_if_data *sdata;
+        struct beacon_data *old_bcn;
+        int ret;
+        sdata = container_of(ifmsh, struct ieee80211_sub_if_data, u.mesh);
+
+        mutex_lock(&ifmsh->mtx);
+
+        old_bcn = rcu_dereference_protected(ifmsh->beacon,
+                                            lockdep_is_held(&ifmsh->mtx));
+        ret = ieee80211_mesh_build_beacon(ifmsh);
+        if (ret)
+                /* just reuse old beacon */
+                goto out;
+
+        if (old_bcn)
+                kfree_rcu(old_bcn, rcu_head);
+out:
+        mutex_unlock(&ifmsh->mtx);
+        return ret;
+}
+
+void ieee80211_mbss_info_change_notify(struct ieee80211_sub_if_data *sdata,
+                                       u32 changed)
+{
+        if (sdata->vif.bss_conf.enable_beacon &&
+            (changed & (BSS_CHANGED_BEACON |
+                        BSS_CHANGED_HT |
+                        BSS_CHANGED_BASIC_RATES |
+                        BSS_CHANGED_BEACON_INT)))
+                if (ieee80211_mesh_rebuild_beacon(&sdata->u.mesh))
+                        return;
+        ieee80211_bss_info_change_notify(sdata, changed);
+}
+
+int ieee80211_start_mesh(struct ieee80211_sub_if_data *sdata)
 {
         struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
         struct ieee80211_local *local = sdata->local;
@@ -629,20 +808,24 @@ void ieee80211_start_mesh(struct ieee80211_sub_if_data *sdata)
         sdata->vif.bss_conf.basic_rates =
                 ieee80211_mandatory_rates(local, band);
 
-        if (band == IEEE80211_BAND_5GHZ) {
-                sdata->vif.bss_conf.use_short_slot = true;
-                changed |= BSS_CHANGED_ERP_SLOT;
+        changed |= ieee80211_mps_local_status_update(sdata);
+
+        if (ieee80211_mesh_build_beacon(ifmsh)) {
+                ieee80211_stop_mesh(sdata);
+                return -ENOMEM;
         }
 
         ieee80211_bss_info_change_notify(sdata, changed);
 
         netif_carrier_on(sdata->dev);
+        return 0;
 }
 
 void ieee80211_stop_mesh(struct ieee80211_sub_if_data *sdata)
 {
         struct ieee80211_local *local = sdata->local;
         struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
+        struct beacon_data *bcn;
 
         netif_carrier_off(sdata->dev);
 
@@ -651,11 +834,21 @@ void ieee80211_stop_mesh(struct ieee80211_sub_if_data *sdata)
         sdata->vif.bss_conf.enable_beacon = false;
         clear_bit(SDATA_STATE_OFFCHANNEL_BEACON_STOPPED, &sdata->state);
         ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_BEACON_ENABLED);
+        mutex_lock(&ifmsh->mtx);
+        bcn = rcu_dereference_protected(ifmsh->beacon,
+                                        lockdep_is_held(&ifmsh->mtx));
+        rcu_assign_pointer(ifmsh->beacon, NULL);
+        kfree_rcu(bcn, rcu_head);
+        mutex_unlock(&ifmsh->mtx);
 
         /* flush STAs and mpaths on this iface */
         sta_info_flush(sdata);
         mesh_path_flush_by_iface(sdata);
 
+        /* free all potentially still buffered group-addressed frames */
+        local->total_ps_buffered -= skb_queue_len(&ifmsh->ps.bc_buf);
+        skb_queue_purge(&ifmsh->ps.bc_buf);
+
         del_timer_sync(&sdata->u.mesh.housekeeping_timer);
         del_timer_sync(&sdata->u.mesh.mesh_path_root_timer);
         del_timer_sync(&sdata->u.mesh.mesh_path_timer);
@@ -675,6 +868,63 @@ void ieee80211_stop_mesh(struct ieee80211_sub_if_data *sdata)
         sdata->u.mesh.timers_running = 0;
 }
 
+static void
+ieee80211_mesh_rx_probe_req(struct ieee80211_sub_if_data *sdata,
+                            struct ieee80211_mgmt *mgmt, size_t len)
+{
+        struct ieee80211_local *local = sdata->local;
+        struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
+        struct sk_buff *presp;
+        struct beacon_data *bcn;
+        struct ieee80211_mgmt *hdr;
+        struct ieee802_11_elems elems;
+        size_t baselen;
+        u8 *pos, *end;
+
+        end = ((u8 *) mgmt) + len;
+        pos = mgmt->u.probe_req.variable;
+        baselen = (u8 *) pos - (u8 *) mgmt;
+        if (baselen > len)
+                return;
+
+        ieee802_11_parse_elems(pos, len - baselen, &elems);
+
+        /* 802.11-2012 10.1.4.3.2 */
+        if ((!ether_addr_equal(mgmt->da, sdata->vif.addr) &&
+             !is_broadcast_ether_addr(mgmt->da)) ||
+            elems.ssid_len != 0)
+                return;
+
+        if (elems.mesh_id_len != 0 &&
+            (elems.mesh_id_len != ifmsh->mesh_id_len ||
+             memcmp(elems.mesh_id, ifmsh->mesh_id, ifmsh->mesh_id_len)))
+                return;
+
+        rcu_read_lock();
+        bcn = rcu_dereference(ifmsh->beacon);
+
+        if (!bcn)
+                goto out;
+
+        presp = dev_alloc_skb(local->tx_headroom +
+                              bcn->head_len + bcn->tail_len);
+        if (!presp)
+                goto out;
+
+        skb_reserve(presp, local->tx_headroom);
+        memcpy(skb_put(presp, bcn->head_len), bcn->head, bcn->head_len);
+        memcpy(skb_put(presp, bcn->tail_len), bcn->tail, bcn->tail_len);
+        hdr = (struct ieee80211_mgmt *) presp->data;
+        hdr->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
+                                         IEEE80211_STYPE_PROBE_RESP);
+        memcpy(hdr->da, mgmt->sa, ETH_ALEN);
+        mpl_dbg(sdata, "sending probe resp. to %pM\n", hdr->da);
+        IEEE80211_SKB_CB(presp)->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT;
+        ieee80211_tx_skb(sdata, presp);
+out:
+        rcu_read_unlock();
+}
+
 static void ieee80211_mesh_rx_bcn_presp(struct ieee80211_sub_if_data *sdata,
                                         u16 stype,
                                         struct ieee80211_mgmt *mgmt,
@@ -764,6 +1014,9 @@ void ieee80211_mesh_rx_queued_mgmt(struct ieee80211_sub_if_data *sdata,
                 ieee80211_mesh_rx_bcn_presp(sdata, stype, mgmt, skb->len,
                                             rx_status);
                 break;
+        case IEEE80211_STYPE_PROBE_REQ:
+                ieee80211_mesh_rx_probe_req(sdata, mgmt, skb->len);
+                break;
         case IEEE80211_STYPE_ACTION:
                 ieee80211_mesh_rx_mgmt_action(sdata, mgmt, skb->len, rx_status);
                 break;
@@ -833,8 +1086,11 @@ void ieee80211_mesh_init_sdata(struct ieee80211_sub_if_data *sdata)
                     ieee80211_mesh_path_root_timer,
                     (unsigned long) sdata);
         INIT_LIST_HEAD(&ifmsh->preq_queue.list);
+        skb_queue_head_init(&ifmsh->ps.bc_buf);
         spin_lock_init(&ifmsh->mesh_preq_queue_lock);
         spin_lock_init(&ifmsh->sync_offset_lock);
+        RCU_INIT_POINTER(ifmsh->beacon, NULL);
+        mutex_init(&ifmsh->mtx);
 
         sdata->vif.bss_conf.bssid = zero_addr;
 }
diff --git a/net/mac80211/mesh.h b/net/mac80211/mesh.h
index aff301544c7f..1a1da877b1d2 100644
--- a/net/mac80211/mesh.h
+++ b/net/mac80211/mesh.h
@@ -222,6 +222,8 @@ int mesh_add_meshid_ie(struct sk_buff *skb,
                        struct ieee80211_sub_if_data *sdata);
 int mesh_add_rsn_ie(struct sk_buff *skb,
                     struct ieee80211_sub_if_data *sdata);
+int mesh_add_awake_window_ie(struct sk_buff *skb,
+                             struct ieee80211_sub_if_data *sdata);
 int mesh_add_vendor_ies(struct sk_buff *skb,
                         struct ieee80211_sub_if_data *sdata);
 int mesh_add_ds_params_ie(struct sk_buff *skb,
@@ -237,10 +239,28 @@ void ieee80211s_update_metric(struct ieee80211_local *local,
                 struct sta_info *sta, struct sk_buff *skb);
 void ieee80211s_stop(void);
 void ieee80211_mesh_init_sdata(struct ieee80211_sub_if_data *sdata);
-void ieee80211_start_mesh(struct ieee80211_sub_if_data *sdata);
+int ieee80211_start_mesh(struct ieee80211_sub_if_data *sdata);
 void ieee80211_stop_mesh(struct ieee80211_sub_if_data *sdata);
 void ieee80211_mesh_root_setup(struct ieee80211_if_mesh *ifmsh);
 const struct ieee80211_mesh_sync_ops *ieee80211_mesh_sync_ops_get(u8 method);
+/* wrapper for ieee80211_bss_info_change_notify() */
+void ieee80211_mbss_info_change_notify(struct ieee80211_sub_if_data *sdata,
+                                       u32 changed);
+
+/* mesh power save */
+u32 ieee80211_mps_local_status_update(struct ieee80211_sub_if_data *sdata);
+u32 ieee80211_mps_set_sta_local_pm(struct sta_info *sta,
+                                   enum nl80211_mesh_power_mode pm);
+void ieee80211_mps_set_frame_flags(struct ieee80211_sub_if_data *sdata,
+                                   struct sta_info *sta,
+                                   struct ieee80211_hdr *hdr);
+void ieee80211_mps_sta_status_update(struct sta_info *sta);
+void ieee80211_mps_rx_h_sta_process(struct sta_info *sta,
+                                    struct ieee80211_hdr *hdr);
+void ieee80211_mpsp_trigger_process(u8 *qc, struct sta_info *sta,
+                                    bool tx, bool acked);
+void ieee80211_mps_frame_release(struct sta_info *sta,
+                                 struct ieee802_11_elems *elems);
 
 /* Mesh paths */
 int mesh_nexthop_lookup(struct sk_buff *skb,
@@ -248,8 +268,8 @@ int mesh_nexthop_lookup(struct sk_buff *skb,
 int mesh_nexthop_resolve(struct sk_buff *skb,
                          struct ieee80211_sub_if_data *sdata);
 void mesh_path_start_discovery(struct ieee80211_sub_if_data *sdata);
-struct mesh_path *mesh_path_lookup(u8 *dst,
-                struct ieee80211_sub_if_data *sdata);
+struct mesh_path *mesh_path_lookup(const u8 *dst,
+                                   struct ieee80211_sub_if_data *sdata);
 struct mesh_path *mpp_path_lookup(u8 *dst,
                                   struct ieee80211_sub_if_data *sdata);
 int mpp_path_add(u8 *dst, u8 *mpp, struct ieee80211_sub_if_data *sdata);
@@ -259,7 +279,7 @@ void mesh_path_fix_nexthop(struct mesh_path *mpath, struct sta_info *next_hop);
 void mesh_path_expire(struct ieee80211_sub_if_data *sdata);
 void mesh_rx_path_sel_frame(struct ieee80211_sub_if_data *sdata,
                 struct ieee80211_mgmt *mgmt, size_t len);
-int mesh_path_add(u8 *dst, struct ieee80211_sub_if_data *sdata);
+int mesh_path_add(const u8 *dst, struct ieee80211_sub_if_data *sdata);
 
 int mesh_path_add_gate(struct mesh_path *mpath);
 int mesh_path_send_to_gates(struct mesh_path *mpath);
@@ -271,20 +291,22 @@ void mesh_neighbour_update(struct ieee80211_sub_if_data *sdata,
 bool mesh_peer_accepts_plinks(struct ieee802_11_elems *ie);
 u32 mesh_accept_plinks_update(struct ieee80211_sub_if_data *sdata);
 void mesh_plink_broken(struct sta_info *sta);
-void mesh_plink_deactivate(struct sta_info *sta);
-int mesh_plink_open(struct sta_info *sta);
-void mesh_plink_block(struct sta_info *sta);
+u32 mesh_plink_deactivate(struct sta_info *sta);
+u32 mesh_plink_open(struct sta_info *sta);
+u32 mesh_plink_block(struct sta_info *sta);
 void mesh_rx_plink_frame(struct ieee80211_sub_if_data *sdata,
                          struct ieee80211_mgmt *mgmt, size_t len,
                          struct ieee80211_rx_status *rx_status);
+void mesh_sta_cleanup(struct sta_info *sta);
 
 /* Private interfaces */
 /* Mesh tables */
 void mesh_mpath_table_grow(void);
 void mesh_mpp_table_grow(void);
 /* Mesh paths */
-int mesh_path_error_tx(u8 ttl, u8 *target, __le32 target_sn, __le16 target_rcode,
-                       const u8 *ra, struct ieee80211_sub_if_data *sdata);
+int mesh_path_error_tx(u8 ttl, const u8 *target, __le32 target_sn,
+                       __le16 target_rcode, const u8 *ra,
+                       struct ieee80211_sub_if_data *sdata);
 void mesh_path_assign_nexthop(struct mesh_path *mpath, struct sta_info *sta);
 void mesh_path_flush_pending(struct mesh_path *mpath);
 void mesh_path_tx_pending(struct mesh_path *mpath);
diff --git a/net/mac80211/mesh_hwmp.c b/net/mac80211/mesh_hwmp.c
index 6b4603a90031..585c1e26cca8 100644
--- a/net/mac80211/mesh_hwmp.c
+++ b/net/mac80211/mesh_hwmp.c
@@ -30,14 +30,14 @@
 
 static void mesh_queue_preq(struct mesh_path *, u8);
 
-static inline u32 u32_field_get(u8 *preq_elem, int offset, bool ae)
+static inline u32 u32_field_get(const u8 *preq_elem, int offset, bool ae)
 {
         if (ae)
                 offset += 6;
         return get_unaligned_le32(preq_elem + offset);
 }
 
-static inline u32 u16_field_get(u8 *preq_elem, int offset, bool ae)
+static inline u32 u16_field_get(const u8 *preq_elem, int offset, bool ae)
 {
         if (ae)
                 offset += 6;
@@ -102,10 +102,13 @@ enum mpath_frame_type {
 static const u8 broadcast_addr[ETH_ALEN] = {0xff, 0xff, 0xff, 0xff, 0xff, 0xff};
 
 static int mesh_path_sel_frame_tx(enum mpath_frame_type action, u8 flags,
-                u8 *orig_addr, __le32 orig_sn, u8 target_flags, u8 *target,
-                __le32 target_sn, const u8 *da, u8 hop_count, u8 ttl,
-                __le32 lifetime, __le32 metric, __le32 preq_id,
-                struct ieee80211_sub_if_data *sdata)
+                                  const u8 *orig_addr, __le32 orig_sn,
+                                  u8 target_flags, const u8 *target,
+                                  __le32 target_sn, const u8 *da,
+                                  u8 hop_count, u8 ttl,
+                                  __le32 lifetime, __le32 metric,
+                                  __le32 preq_id,
+                                  struct ieee80211_sub_if_data *sdata)
 {
         struct ieee80211_local *local = sdata->local;
         struct sk_buff *skb;
@@ -205,6 +208,7 @@ static void prepare_frame_for_deferred_tx(struct ieee80211_sub_if_data *sdata,
                 struct sk_buff *skb)
 {
         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
+        struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
 
         skb_set_mac_header(skb, 0);
         skb_set_network_header(skb, 0);
@@ -217,6 +221,7 @@ static void prepare_frame_for_deferred_tx(struct ieee80211_sub_if_data *sdata,
         info->control.vif = &sdata->vif;
         info->flags |= IEEE80211_TX_INTFL_NEED_TXPROCESSING;
         ieee80211_set_qos_hdr(sdata, skb);
+        ieee80211_mps_set_frame_flags(sdata, NULL, hdr);
 }
 
 /**
@@ -233,7 +238,7 @@ static void prepare_frame_for_deferred_tx(struct ieee80211_sub_if_data *sdata,
  * also acquires in the TX path.  To avoid a deadlock we don't transmit the
  * frame directly but add it to the pending queue instead.
  */
-int mesh_path_error_tx(u8 ttl, u8 *target, __le32 target_sn,
+int mesh_path_error_tx(u8 ttl, const u8 *target, __le32 target_sn,
                        __le16 target_rcode, const u8 *ra,
                        struct ieee80211_sub_if_data *sdata)
 {
@@ -367,14 +372,14 @@ static u32 airtime_link_metric_get(struct ieee80211_local *local,
  * path routing information is updated.
  */
 static u32 hwmp_route_info_get(struct ieee80211_sub_if_data *sdata,
-                            struct ieee80211_mgmt *mgmt,
-                            u8 *hwmp_ie, enum mpath_frame_type action)
+                               struct ieee80211_mgmt *mgmt,
+                               const u8 *hwmp_ie, enum mpath_frame_type action)
 {
         struct ieee80211_local *local = sdata->local;
         struct mesh_path *mpath;
         struct sta_info *sta;
         bool fresh_info;
-        u8 *orig_addr, *ta;
+        const u8 *orig_addr, *ta;
         u32 orig_sn, orig_metric;
         unsigned long orig_lifetime, exp_time;
         u32 last_hop_metric, new_metric;
@@ -509,11 +514,11 @@ static u32 hwmp_route_info_get(struct ieee80211_sub_if_data *sdata,
 
 static void hwmp_preq_frame_process(struct ieee80211_sub_if_data *sdata,
                                     struct ieee80211_mgmt *mgmt,
-                                    u8 *preq_elem, u32 metric)
+                                    const u8 *preq_elem, u32 metric)
 {
         struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
         struct mesh_path *mpath = NULL;
-        u8 *target_addr, *orig_addr;
+        const u8 *target_addr, *orig_addr;
         const u8 *da;
         u8 target_flags, ttl, flags;
         u32 orig_sn, target_sn, lifetime, orig_metric;
@@ -646,11 +651,11 @@ next_hop_deref_protected(struct mesh_path *mpath)
 
 static void hwmp_prep_frame_process(struct ieee80211_sub_if_data *sdata,
                                     struct ieee80211_mgmt *mgmt,
-                                    u8 *prep_elem, u32 metric)
+                                    const u8 *prep_elem, u32 metric)
 {
         struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
         struct mesh_path *mpath;
-        u8 *target_addr, *orig_addr;
+        const u8 *target_addr, *orig_addr;
         u8 ttl, hopcount, flags;
         u8 next_hop[ETH_ALEN];
         u32 target_sn, orig_sn, lifetime;
@@ -709,12 +714,13 @@ fail:
 }
 
 static void hwmp_perr_frame_process(struct ieee80211_sub_if_data *sdata,
-                             struct ieee80211_mgmt *mgmt, u8 *perr_elem)
+                                    struct ieee80211_mgmt *mgmt,
+                                    const u8 *perr_elem)
 {
         struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
         struct mesh_path *mpath;
         u8 ttl;
-        u8 *ta, *target_addr;
+        const u8 *ta, *target_addr;
         u32 target_sn;
         u16 target_rcode;
 
@@ -756,15 +762,15 @@ endperr:
 }
 
 static void hwmp_rann_frame_process(struct ieee80211_sub_if_data *sdata,
-                                struct ieee80211_mgmt *mgmt,
-                                struct ieee80211_rann_ie *rann)
+                                    struct ieee80211_mgmt *mgmt,
+                                    const struct ieee80211_rann_ie *rann)
 {
         struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
         struct ieee80211_local *local = sdata->local;
         struct sta_info *sta;
         struct mesh_path *mpath;
         u8 ttl, flags, hopcount;
-        u8 *orig_addr;
+        const u8 *orig_addr;
         u32 orig_sn, metric, metric_txsta, interval;
         bool root_is_gate;
 
@@ -1080,6 +1086,10 @@ int mesh_nexthop_resolve(struct sk_buff *skb,
         u8 *target_addr = hdr->addr3;
         int err = 0;
 
+        /* Nulls are only sent to peers for PS and should be pre-addressed */
+        if (ieee80211_is_qos_nullfunc(hdr->frame_control))
+                return 0;
+
         rcu_read_lock();
         err = mesh_nexthop_lookup(skb, sdata);
         if (!err)
@@ -1151,6 +1161,7 @@ int mesh_nexthop_lookup(struct sk_buff *skb,
         if (next_hop) {
                 memcpy(hdr->addr1, next_hop->sta.addr, ETH_ALEN);
                 memcpy(hdr->addr2, sdata->vif.addr, ETH_ALEN);
+                ieee80211_mps_set_frame_flags(sdata, next_hop, hdr);
                 err = 0;
         }
 
diff --git a/net/mac80211/mesh_pathtbl.c b/net/mac80211/mesh_pathtbl.c
index aa749818860e..2ce4c4023a97 100644
--- a/net/mac80211/mesh_pathtbl.c
+++ b/net/mac80211/mesh_pathtbl.c
@@ -181,7 +181,7 @@ errcopy:
         return -ENOMEM;
 }
 
-static u32 mesh_table_hash(u8 *addr, struct ieee80211_sub_if_data *sdata,
+static u32 mesh_table_hash(const u8 *addr, struct ieee80211_sub_if_data *sdata,
                            struct mesh_table *tbl)
 {
         /* Use last four bytes of hw addr and interface index as hash index */
@@ -212,6 +212,7 @@ void mesh_path_assign_nexthop(struct mesh_path *mpath, struct sta_info *sta)
                 hdr = (struct ieee80211_hdr *) skb->data;
                 memcpy(hdr->addr1, sta->sta.addr, ETH_ALEN);
                 memcpy(hdr->addr2, mpath->sdata->vif.addr, ETH_ALEN);
+                ieee80211_mps_set_frame_flags(sta->sdata, sta, hdr);
         }
 
         spin_unlock_irqrestore(&mpath->frame_queue.lock, flags);
@@ -325,8 +326,8 @@ static void mesh_path_move_to_queue(struct mesh_path *gate_mpath,
 }
 
 
-static struct mesh_path *mpath_lookup(struct mesh_table *tbl, u8 *dst,
-                                          struct ieee80211_sub_if_data *sdata)
+static struct mesh_path *mpath_lookup(struct mesh_table *tbl, const u8 *dst,
+                                      struct ieee80211_sub_if_data *sdata)
 {
         struct mesh_path *mpath;
         struct hlist_node *n;
@@ -358,7 +359,8 @@ static struct mesh_path *mpath_lookup(struct mesh_table *tbl, u8 *dst,
  *
  * Locking: must be called within a read rcu section.
  */
-struct mesh_path *mesh_path_lookup(u8 *dst, struct ieee80211_sub_if_data *sdata)
+struct mesh_path *mesh_path_lookup(const u8 *dst,
+                                   struct ieee80211_sub_if_data *sdata)
 {
         return mpath_lookup(rcu_dereference(mesh_paths), dst, sdata);
 }
@@ -493,7 +495,7 @@ int mesh_gate_num(struct ieee80211_sub_if_data *sdata)
  *
  * State: the initial state of the new path is set to 0
  */
-int mesh_path_add(u8 *dst, struct ieee80211_sub_if_data *sdata)
+int mesh_path_add(const u8 *dst, struct ieee80211_sub_if_data *sdata)
 {
         struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
         struct ieee80211_local *local = sdata->local;
diff --git a/net/mac80211/mesh_plink.c b/net/mac80211/mesh_plink.c
index 9e0416696a83..f7526e509aa8 100644
--- a/net/mac80211/mesh_plink.c
+++ b/net/mac80211/mesh_plink.c
@@ -56,27 +56,63 @@ static inline void mesh_plink_fsm_restart(struct sta_info *sta)
 }
 
 /*
- * Allocate mesh sta entry and insert into station table
+ * mesh_set_short_slot_time - enable / disable ERP short slot time.
+ *
+ * The standard indirectly mandates mesh STAs to turn off short slot time by
+ * disallowing advertising this (802.11-2012 8.4.1.4), but that doesn't mean we
+ * can't be sneaky about it. Enable short slot time if all mesh STAs in the
+ * MBSS support ERP rates.
+ *
+ * Returns BSS_CHANGED_ERP_SLOT or 0 for no change.
  */
-static struct sta_info *mesh_plink_alloc(struct ieee80211_sub_if_data *sdata,
-                                         u8 *hw_addr)
+static u32 mesh_set_short_slot_time(struct ieee80211_sub_if_data *sdata)
 {
+        struct ieee80211_local *local = sdata->local;
+        enum ieee80211_band band = ieee80211_get_sdata_band(sdata);
+        struct ieee80211_supported_band *sband = local->hw.wiphy->bands[band];
         struct sta_info *sta;
+        u32 erp_rates = 0, changed = 0;
+        int i;
+        bool short_slot = false;
 
-        if (sdata->local->num_sta >= MESH_MAX_PLINKS)
-                return NULL;
+        if (band == IEEE80211_BAND_5GHZ) {
+                /* (IEEE 802.11-2012 19.4.5) */
+                short_slot = true;
+                goto out;
+        } else if (band != IEEE80211_BAND_2GHZ ||
+                   (band == IEEE80211_BAND_2GHZ &&
+                    local->hw.flags & IEEE80211_HW_2GHZ_SHORT_SLOT_INCAPABLE))
+                goto out;
 
-        sta = sta_info_alloc(sdata, hw_addr, GFP_KERNEL);
-        if (!sta)
-                return NULL;
+        for (i = 0; i < sband->n_bitrates; i++)
+                if (sband->bitrates[i].flags & IEEE80211_RATE_ERP_G)
+                        erp_rates |= BIT(i);
 
-        sta_info_pre_move_state(sta, IEEE80211_STA_AUTH);
-        sta_info_pre_move_state(sta, IEEE80211_STA_ASSOC);
-        sta_info_pre_move_state(sta, IEEE80211_STA_AUTHORIZED);
+        if (!erp_rates)
+                goto out;
 
-        set_sta_flag(sta, WLAN_STA_WME);
+        rcu_read_lock();
+        list_for_each_entry_rcu(sta, &local->sta_list, list) {
+                if (sdata != sta->sdata ||
+                    sta->plink_state != NL80211_PLINK_ESTAB)
+                        continue;
 
-        return sta;
+                short_slot = false;
+                if (erp_rates & sta->sta.supp_rates[band])
+                        short_slot = true;
+                 else
+                        break;
+        }
+        rcu_read_unlock();
+
+out:
+        if (sdata->vif.bss_conf.use_short_slot != short_slot) {
+                sdata->vif.bss_conf.use_short_slot = short_slot;
+                changed = BSS_CHANGED_ERP_SLOT;
+                mpl_dbg(sdata, "mesh_plink %pM: ERP short slot time %d\n",
+                        sdata->vif.addr, short_slot);
+        }
+        return changed;
 }
 
 /**
@@ -165,6 +201,9 @@ static u32 __mesh_plink_deactivate(struct sta_info *sta)
         sta->plink_state = NL80211_PLINK_BLOCKED;
         mesh_path_flush_by_nexthop(sta);
 
+        ieee80211_mps_sta_status_update(sta);
+        changed |= ieee80211_mps_local_status_update(sdata);
+
         return changed;
 }
 
@@ -175,7 +214,7 @@ static u32 __mesh_plink_deactivate(struct sta_info *sta)
  *
  * All mesh paths with this peer as next hop will be flushed
  */
-void mesh_plink_deactivate(struct sta_info *sta)
+u32 mesh_plink_deactivate(struct sta_info *sta)
 {
         struct ieee80211_sub_if_data *sdata = sta->sdata;
         u32 changed;
@@ -188,7 +227,7 @@ void mesh_plink_deactivate(struct sta_info *sta)
                             sta->reason);
         spin_unlock_bh(&sta->lock);
 
-        ieee80211_bss_info_change_notify(sdata, changed);
+        return changed;
 }
 
 static int mesh_plink_frame_tx(struct ieee80211_sub_if_data *sdata,
@@ -309,59 +348,32 @@ free:
         return err;
 }
 
-/**
- * mesh_peer_init - initialize new mesh peer and return resulting sta_info
- *
- * @sdata: local meshif
- * @addr: peer's address
- * @elems: IEs from beacon or mesh peering frame
- *
- * call under RCU
- */
-static struct sta_info *mesh_peer_init(struct ieee80211_sub_if_data *sdata,
-                                       u8 *addr,
-                                       struct ieee802_11_elems *elems)
+static void mesh_sta_info_init(struct ieee80211_sub_if_data *sdata,
+                               struct sta_info *sta,
+                               struct ieee802_11_elems *elems, bool insert)
 {
         struct ieee80211_local *local = sdata->local;
         enum ieee80211_band band = ieee80211_get_sdata_band(sdata);
         struct ieee80211_supported_band *sband;
-        u32 rates, basic_rates = 0;
-        struct sta_info *sta;
-        bool insert = false;
+        u32 rates, basic_rates = 0, changed = 0;
 
         sband = local->hw.wiphy->bands[band];
         rates = ieee80211_sta_get_rates(local, elems, band, &basic_rates);
 
-        sta = sta_info_get(sdata, addr);
-        if (!sta) {
-                /* Userspace handles peer allocation when security is enabled */
-                if (sdata->u.mesh.security & IEEE80211_MESH_SEC_AUTHED) {
-                        cfg80211_notify_new_peer_candidate(sdata->dev, addr,
-                                                           elems->ie_start,
-                                                           elems->total_len,
-                                                           GFP_ATOMIC);
-                        return NULL;
-                }
-
-                sta = mesh_plink_alloc(sdata, addr);
-                if (!sta)
-                        return NULL;
-                insert = true;
-        }
-
         spin_lock_bh(&sta->lock);
         sta->last_rx = jiffies;
-        if (sta->plink_state == NL80211_PLINK_ESTAB) {
-                spin_unlock_bh(&sta->lock);
-                return sta;
-        }
 
+        /* rates and capabilities don't change during peering */
+        if (sta->plink_state == NL80211_PLINK_ESTAB)
+                goto out;
+
+        if (sta->sta.supp_rates[band] != rates)
+                changed |= IEEE80211_RC_SUPP_RATES_CHANGED;
         sta->sta.supp_rates[band] = rates;
         if (elems->ht_cap_elem &&
             sdata->vif.bss_conf.chandef.width != NL80211_CHAN_WIDTH_20_NOHT)
                 ieee80211_ht_cap_ie_to_sta_ht_cap(sdata, sband,
-                                                  elems->ht_cap_elem,
-                                                  &sta->sta.ht_cap);
+                                                  elems->ht_cap_elem, sta);
         else
                 memset(&sta->sta.ht_cap, 0, sizeof(sta->sta.ht_cap));
 
@@ -370,31 +382,119 @@ static struct sta_info *mesh_peer_init(struct ieee80211_sub_if_data *sdata,
 
                 if (!(elems->ht_operation->ht_param &
                       IEEE80211_HT_PARAM_CHAN_WIDTH_ANY))
-                        sta->sta.ht_cap.cap &=
-                                            ~IEEE80211_HT_CAP_SUP_WIDTH_20_40;
+                        sta->sta.bandwidth = IEEE80211_STA_RX_BW_20;
                 ieee80211_ht_oper_to_chandef(sdata->vif.bss_conf.chandef.chan,
                                              elems->ht_operation, &chandef);
+                if (sta->ch_width != chandef.width)
+                        changed |= IEEE80211_RC_BW_CHANGED;
                 sta->ch_width = chandef.width;
         }
 
         if (insert)
                 rate_control_rate_init(sta);
+        else
+                rate_control_rate_update(local, sband, sta, changed);
+out:
         spin_unlock_bh(&sta->lock);
+}
 
-        if (insert && sta_info_insert(sta))
+static struct sta_info *
+__mesh_sta_info_alloc(struct ieee80211_sub_if_data *sdata, u8 *hw_addr)
+{
+        struct sta_info *sta;
+
+        if (sdata->local->num_sta >= MESH_MAX_PLINKS)
                 return NULL;
 
+        sta = sta_info_alloc(sdata, hw_addr, GFP_KERNEL);
+        if (!sta)
+                return NULL;
+
+        sta->plink_state = NL80211_PLINK_LISTEN;
+        init_timer(&sta->plink_timer);
+
+        sta_info_pre_move_state(sta, IEEE80211_STA_AUTH);
+        sta_info_pre_move_state(sta, IEEE80211_STA_ASSOC);
+        sta_info_pre_move_state(sta, IEEE80211_STA_AUTHORIZED);
+
+        set_sta_flag(sta, WLAN_STA_WME);
+
+        return sta;
+}
+
+static struct sta_info *
+mesh_sta_info_alloc(struct ieee80211_sub_if_data *sdata, u8 *addr,
+                    struct ieee802_11_elems *elems)
+{
+        struct sta_info *sta = NULL;
+
+        /* Userspace handles peer allocation when security is enabled */
+        if (sdata->u.mesh.security & IEEE80211_MESH_SEC_AUTHED)
+                cfg80211_notify_new_peer_candidate(sdata->dev, addr,
+                                                   elems->ie_start,
+                                                   elems->total_len,
+                                                   GFP_KERNEL);
+        else
+                sta = __mesh_sta_info_alloc(sdata, addr);
+
+        return sta;
+}
+
+/*
+ * mesh_sta_info_get - return mesh sta info entry for @addr.
+ *
+ * @sdata: local meshif
+ * @addr: peer's address
+ * @elems: IEs from beacon or mesh peering frame.
+ *
+ * Return existing or newly allocated sta_info under RCU read lock.
+ * (re)initialize with given IEs.
+ */
+static struct sta_info *
+mesh_sta_info_get(struct ieee80211_sub_if_data *sdata,
+                  u8 *addr, struct ieee802_11_elems *elems) __acquires(RCU)
+{
+        struct sta_info *sta = NULL;
+
+        rcu_read_lock();
+        sta = sta_info_get(sdata, addr);
+        if (sta) {
+                mesh_sta_info_init(sdata, sta, elems, false);
+        } else {
+                rcu_read_unlock();
+                /* can't run atomic */
+                sta = mesh_sta_info_alloc(sdata, addr, elems);
+                if (!sta) {
+                        rcu_read_lock();
+                        return NULL;
+                }
+
+                mesh_sta_info_init(sdata, sta, elems, true);
+
+                if (sta_info_insert_rcu(sta))
+                        return NULL;
+        }
+
         return sta;
 }
 
+/*
+ * mesh_neighbour_update - update or initialize new mesh neighbor.
+ *
+ * @sdata: local meshif
+ * @addr: peer's address
+ * @elems: IEs from beacon or mesh peering frame
+ *
+ * Initiates peering if appropriate.
+ */
 void mesh_neighbour_update(struct ieee80211_sub_if_data *sdata,
                            u8 *hw_addr,
                            struct ieee802_11_elems *elems)
 {
         struct sta_info *sta;
+        u32 changed = 0;
 
-        rcu_read_lock();
-        sta = mesh_peer_init(sdata, hw_addr, elems);
+        sta = mesh_sta_info_get(sdata, hw_addr, elems);
         if (!sta)
                 goto out;
 
@@ -403,10 +503,12 @@ void mesh_neighbour_update(struct ieee80211_sub_if_data *sdata,
             sdata->u.mesh.accepting_plinks &&
             sdata->u.mesh.mshcfg.auto_open_plinks &&
             rssi_threshold_check(sta, sdata))
-                mesh_plink_open(sta);
+                changed = mesh_plink_open(sta);
 
+        ieee80211_mps_frame_release(sta, elems);
 out:
         rcu_read_unlock();
+        ieee80211_mbss_info_change_notify(sdata, changed);
 }
 
 static void mesh_plink_timer(unsigned long data)
@@ -490,6 +592,13 @@ static void mesh_plink_timer(unsigned long data)
 #ifdef CONFIG_PM
 void mesh_plink_quiesce(struct sta_info *sta)
 {
+        if (!ieee80211_vif_is_mesh(&sta->sdata->vif))
+                return;
+
+        /* no kernel mesh sta timers have been initialized */
+        if (sta->sdata->u.mesh.security != IEEE80211_MESH_SEC_NONE)
+                return;
+
         if (del_timer_sync(&sta->plink_timer))
                 sta->plink_timer_was_running = true;
 }
@@ -512,13 +621,14 @@ static inline void mesh_plink_timer_set(struct sta_info *sta, int timeout)
         add_timer(&sta->plink_timer);
 }
 
-int mesh_plink_open(struct sta_info *sta)
+u32 mesh_plink_open(struct sta_info *sta)
 {
         __le16 llid;
         struct ieee80211_sub_if_data *sdata = sta->sdata;
+        u32 changed;
 
         if (!test_sta_flag(sta, WLAN_STA_AUTH))
-                return -EPERM;
+                return 0;
 
         spin_lock_bh(&sta->lock);
         get_random_bytes(&llid, 2);
@@ -526,7 +636,7 @@ int mesh_plink_open(struct sta_info *sta)
         if (sta->plink_state != NL80211_PLINK_LISTEN &&
             sta->plink_state != NL80211_PLINK_BLOCKED) {
                 spin_unlock_bh(&sta->lock);
-                return -EBUSY;
+                return 0;
         }
         sta->plink_state = NL80211_PLINK_OPN_SNT;
         mesh_plink_timer_set(sta, sdata->u.mesh.mshcfg.dot11MeshRetryTimeout);
@@ -535,13 +645,16 @@ int mesh_plink_open(struct sta_info *sta)
                 "Mesh plink: starting establishment with %pM\n",
                 sta->sta.addr);
 
-        return mesh_plink_frame_tx(sdata, WLAN_SP_MESH_PEERING_OPEN,
-                                   sta->sta.addr, llid, 0, 0);
+        /* set the non-peer mode to active during peering */
+        changed = ieee80211_mps_local_status_update(sdata);
+
+        mesh_plink_frame_tx(sdata, WLAN_SP_MESH_PEERING_OPEN,
+                            sta->sta.addr, llid, 0, 0);
+        return changed;
 }
 
-void mesh_plink_block(struct sta_info *sta)
+u32 mesh_plink_block(struct sta_info *sta)
 {
-        struct ieee80211_sub_if_data *sdata = sta->sdata;
         u32 changed;
 
         spin_lock_bh(&sta->lock);
@@ -549,7 +662,7 @@ void mesh_plink_block(struct sta_info *sta)
         sta->plink_state = NL80211_PLINK_BLOCKED;
         spin_unlock_bh(&sta->lock);
 
-        ieee80211_bss_info_change_notify(sdata, changed);
+        return changed;
 }
 
 
@@ -632,6 +745,7 @@ void mesh_rx_plink_frame(struct ieee80211_sub_if_data *sdata, struct ieee80211_m
             (ftype == WLAN_SP_MESH_PEERING_CLOSE && ie_len == 8))
                 memcpy(&llid, PLINK_GET_PLID(elems.peering), 2);
 
+        /* WARNING: Only for sta pointer, is dropped & re-acquired */
         rcu_read_lock();
 
         sta = sta_info_get(sdata, mgmt->sa);
@@ -735,8 +849,9 @@ void mesh_rx_plink_frame(struct ieee80211_sub_if_data *sdata, struct ieee80211_m
         }
 
         if (event == OPN_ACPT) {
+                rcu_read_unlock();
                 /* allocate sta entry if necessary and update info */
-                sta = mesh_peer_init(sdata, mgmt->sa, &elems);
+                sta = mesh_sta_info_get(sdata, mgmt->sa, &elems);
                 if (!sta) {
                         mpl_dbg(sdata, "Mesh plink: failed to init peer!\n");
                         rcu_read_unlock();
@@ -766,6 +881,10 @@ void mesh_rx_plink_frame(struct ieee80211_sub_if_data *sdata, struct ieee80211_m
                         sta->llid = llid;
                         mesh_plink_timer_set(sta,
                                              mshcfg->dot11MeshRetryTimeout);
+
+                        /* set the non-peer mode to active during peering */
+                        changed |= ieee80211_mps_local_status_update(sdata);
+
                         spin_unlock_bh(&sta->lock);
                         mesh_plink_frame_tx(sdata,
                                             WLAN_SP_MESH_PEERING_OPEN,
@@ -856,8 +975,12 @@ void mesh_rx_plink_frame(struct ieee80211_sub_if_data *sdata, struct ieee80211_m
                         spin_unlock_bh(&sta->lock);
                         changed |= mesh_plink_inc_estab_count(sdata);
                         changed |= mesh_set_ht_prot_mode(sdata);
+                        changed |= mesh_set_short_slot_time(sdata);
                         mpl_dbg(sdata, "Mesh plink with %pM ESTABLISHED\n",
                                 sta->sta.addr);
+                        ieee80211_mps_sta_status_update(sta);
+                        changed |= ieee80211_mps_set_sta_local_pm(sta,
+                                                       mshcfg->power_mode);
                         break;
                 default:
                         spin_unlock_bh(&sta->lock);
@@ -891,11 +1014,15 @@ void mesh_rx_plink_frame(struct ieee80211_sub_if_data *sdata, struct ieee80211_m
                         spin_unlock_bh(&sta->lock);
                         changed |= mesh_plink_inc_estab_count(sdata);
                         changed |= mesh_set_ht_prot_mode(sdata);
+                        changed |= mesh_set_short_slot_time(sdata);
                         mpl_dbg(sdata, "Mesh plink with %pM ESTABLISHED\n",
                                 sta->sta.addr);
                         mesh_plink_frame_tx(sdata,
                                             WLAN_SP_MESH_PEERING_CONFIRM,
                                             sta->sta.addr, llid, plid, 0);
+                        ieee80211_mps_sta_status_update(sta);
+                        changed |= ieee80211_mps_set_sta_local_pm(sta,
+                                                        mshcfg->power_mode);
                         break;
                 default:
                         spin_unlock_bh(&sta->lock);
@@ -914,6 +1041,7 @@ void mesh_rx_plink_frame(struct ieee80211_sub_if_data *sdata, struct ieee80211_m
                         mod_plink_timer(sta, mshcfg->dot11MeshHoldingTimeout);
                         spin_unlock_bh(&sta->lock);
                         changed |= mesh_set_ht_prot_mode(sdata);
+                        changed |= mesh_set_short_slot_time(sdata);
                         mesh_plink_frame_tx(sdata, WLAN_SP_MESH_PEERING_CLOSE,
                                             sta->sta.addr, llid, plid, reason);
                         break;
@@ -962,5 +1090,5 @@ void mesh_rx_plink_frame(struct ieee80211_sub_if_data *sdata, struct ieee80211_m
         rcu_read_unlock();
 
         if (changed)
-                ieee80211_bss_info_change_notify(sdata, changed);
+                ieee80211_mbss_info_change_notify(sdata, changed);
 }
diff --git a/net/mac80211/mesh_ps.c b/net/mac80211/mesh_ps.c
new file mode 100644
index 000000000000..3b7bfc01ee36
--- /dev/null
+++ b/net/mac80211/mesh_ps.c
@@ -0,0 +1,598 @@
+/*
+ * Copyright 2012-2013, Marco Porsch <marco.porsch@s2005.tu-chemnitz.de>
+ * Copyright 2012-2013, cozybit Inc.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+
+#include "mesh.h"
+#include "wme.h"
+
+
+/* mesh PS management */
+
+/**
+ * mps_qos_null_get - create pre-addressed QoS Null frame for mesh powersave
+ */
+static struct sk_buff *mps_qos_null_get(struct sta_info *sta)
+{
+        struct ieee80211_sub_if_data *sdata = sta->sdata;
+        struct ieee80211_local *local = sdata->local;
+        struct ieee80211_hdr *nullfunc; /* use 4addr header */
+        struct sk_buff *skb;
+        int size = sizeof(*nullfunc);
+        __le16 fc;
+
+        skb = dev_alloc_skb(local->hw.extra_tx_headroom + size + 2);
+        if (!skb)
+                return NULL;
+        skb_reserve(skb, local->hw.extra_tx_headroom);
+
+        nullfunc = (struct ieee80211_hdr *) skb_put(skb, size);
+        fc = cpu_to_le16(IEEE80211_FTYPE_DATA | IEEE80211_STYPE_QOS_NULLFUNC);
+        ieee80211_fill_mesh_addresses(nullfunc, &fc, sta->sta.addr,
+                                      sdata->vif.addr);
+        nullfunc->frame_control = fc;
+        nullfunc->duration_id = 0;
+        /* no address resolution for this frame -> set addr 1 immediately */
+        memcpy(nullfunc->addr1, sta->sta.addr, ETH_ALEN);
+        memset(skb_put(skb, 2), 0, 2); /* append QoS control field */
+        ieee80211_mps_set_frame_flags(sdata, sta, nullfunc);
+
+        return skb;
+}
+
+/**
+ * mps_qos_null_tx - send a QoS Null to indicate link-specific power mode
+ */
+static void mps_qos_null_tx(struct sta_info *sta)
+{
+        struct sk_buff *skb;
+
+        skb = mps_qos_null_get(sta);
+        if (!skb)
+                return;
+
+        mps_dbg(sta->sdata, "announcing peer-specific power mode to %pM\n",
+                sta->sta.addr);
+
+        /* don't unintentionally start a MPSP */
+        if (!test_sta_flag(sta, WLAN_STA_PS_STA)) {
+                u8 *qc = ieee80211_get_qos_ctl((void *) skb->data);
+
+                qc[0] |= IEEE80211_QOS_CTL_EOSP;
+        }
+
+        ieee80211_tx_skb(sta->sdata, skb);
+}
+
+/**
+ * ieee80211_mps_local_status_update - track status of local link-specific PMs
+ *
+ * @sdata: local mesh subif
+ *
+ * sets the non-peer power mode and triggers the driver PS (re-)configuration
+ * Return BSS_CHANGED_BEACON if a beacon update is necessary.
+ */
+u32 ieee80211_mps_local_status_update(struct ieee80211_sub_if_data *sdata)
+{
+        struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
+        struct sta_info *sta;
+        bool peering = false;
+        int light_sleep_cnt = 0;
+        int deep_sleep_cnt = 0;
+        u32 changed = 0;
+        enum nl80211_mesh_power_mode nonpeer_pm;
+
+        rcu_read_lock();
+        list_for_each_entry_rcu(sta, &sdata->local->sta_list, list) {
+                if (sdata != sta->sdata)
+                        continue;
+
+                switch (sta->plink_state) {
+                case NL80211_PLINK_OPN_SNT:
+                case NL80211_PLINK_OPN_RCVD:
+                case NL80211_PLINK_CNF_RCVD:
+                        peering = true;
+                        break;
+                case NL80211_PLINK_ESTAB:
+                        if (sta->local_pm == NL80211_MESH_POWER_LIGHT_SLEEP)
+                                light_sleep_cnt++;
+                        else if (sta->local_pm == NL80211_MESH_POWER_DEEP_SLEEP)
+                                deep_sleep_cnt++;
+                        break;
+                default:
+                        break;
+                }
+        }
+        rcu_read_unlock();
+
+        /*
+         * Set non-peer mode to active during peering/scanning/authentication
+         * (see IEEE802.11-2012 13.14.8.3). The non-peer mesh power mode is
+         * deep sleep if the local STA is in light or deep sleep towards at
+         * least one mesh peer (see 13.14.3.1). Otherwise, set it to the
+         * user-configured default value.
+         */
+        if (peering) {
+                mps_dbg(sdata, "setting non-peer PM to active for peering\n");
+                nonpeer_pm = NL80211_MESH_POWER_ACTIVE;
+        } else if (light_sleep_cnt || deep_sleep_cnt) {
+                mps_dbg(sdata, "setting non-peer PM to deep sleep\n");
+                nonpeer_pm = NL80211_MESH_POWER_DEEP_SLEEP;
+        } else {
+                mps_dbg(sdata, "setting non-peer PM to user value\n");
+                nonpeer_pm = ifmsh->mshcfg.power_mode;
+        }
+
+        /* need update if sleep counts move between 0 and non-zero */
+        if (ifmsh->nonpeer_pm != nonpeer_pm ||
+            !ifmsh->ps_peers_light_sleep != !light_sleep_cnt ||
+            !ifmsh->ps_peers_deep_sleep != !deep_sleep_cnt)
+                changed = BSS_CHANGED_BEACON;
+
+        ifmsh->nonpeer_pm = nonpeer_pm;
+        ifmsh->ps_peers_light_sleep = light_sleep_cnt;
+        ifmsh->ps_peers_deep_sleep = deep_sleep_cnt;
+
+        return changed;
+}
+
+/**
+ * ieee80211_mps_set_sta_local_pm - set local PM towards a mesh STA
+ *
+ * @sta: mesh STA
+ * @pm: the power mode to set
+ * Return BSS_CHANGED_BEACON if a beacon update is in order.
+ */
+u32 ieee80211_mps_set_sta_local_pm(struct sta_info *sta,
+                                   enum nl80211_mesh_power_mode pm)
+{
+        struct ieee80211_sub_if_data *sdata = sta->sdata;
+
+        mps_dbg(sdata, "local STA operates in mode %d with %pM\n",
+                pm, sta->sta.addr);
+
+        sta->local_pm = pm;
+
+        /*
+         * announce peer-specific power mode transition
+         * (see IEEE802.11-2012 13.14.3.2 and 13.14.3.3)
+         */
+        if (sta->plink_state == NL80211_PLINK_ESTAB)
+                mps_qos_null_tx(sta);
+
+        return ieee80211_mps_local_status_update(sdata);
+}
+
+/**
+ * ieee80211_mps_set_frame_flags - set mesh PS flags in FC (and QoS Control)
+ *
+ * @sdata: local mesh subif
+ * @sta: mesh STA
+ * @hdr: 802.11 frame header
+ *
+ * see IEEE802.11-2012 8.2.4.1.7 and 8.2.4.5.11
+ *
+ * NOTE: sta must be given when an individually-addressed QoS frame header
+ * is handled, for group-addressed and management frames it is not used
+ */
+void ieee80211_mps_set_frame_flags(struct ieee80211_sub_if_data *sdata,
+                                   struct sta_info *sta,
+                                   struct ieee80211_hdr *hdr)
+{
+        enum nl80211_mesh_power_mode pm;
+        u8 *qc;
+
+        if (WARN_ON(is_unicast_ether_addr(hdr->addr1) &&
+                    ieee80211_is_data_qos(hdr->frame_control) &&
+                    !sta))
+                return;
+
+        if (is_unicast_ether_addr(hdr->addr1) &&
+            ieee80211_is_data_qos(hdr->frame_control) &&
+            sta->plink_state == NL80211_PLINK_ESTAB)
+                pm = sta->local_pm;
+        else
+                pm = sdata->u.mesh.nonpeer_pm;
+
+        if (pm == NL80211_MESH_POWER_ACTIVE)
+                hdr->frame_control &= cpu_to_le16(~IEEE80211_FCTL_PM);
+        else
+                hdr->frame_control |= cpu_to_le16(IEEE80211_FCTL_PM);
+
+        if (!ieee80211_is_data_qos(hdr->frame_control))
+                return;
+
+        qc = ieee80211_get_qos_ctl(hdr);
+
+        if ((is_unicast_ether_addr(hdr->addr1) &&
+             pm == NL80211_MESH_POWER_DEEP_SLEEP) ||
+            (is_multicast_ether_addr(hdr->addr1) &&
+             sdata->u.mesh.ps_peers_deep_sleep > 0))
+                qc[1] |= (IEEE80211_QOS_CTL_MESH_PS_LEVEL >> 8);
+        else
+                qc[1] &= ~(IEEE80211_QOS_CTL_MESH_PS_LEVEL >> 8);
+}
+
+/**
+ * ieee80211_mps_sta_status_update - update buffering status of neighbor STA
+ *
+ * @sta: mesh STA
+ *
+ * called after change of peering status or non-peer/peer-specific power mode
+ */
+void ieee80211_mps_sta_status_update(struct sta_info *sta)
+{
+        enum nl80211_mesh_power_mode pm;
+        bool do_buffer;
+
+        /*
+         * use peer-specific power mode if peering is established and the
+         * peer's power mode is known
+         */
+        if (sta->plink_state == NL80211_PLINK_ESTAB &&
+            sta->peer_pm != NL80211_MESH_POWER_UNKNOWN)
+                pm = sta->peer_pm;
+        else
+                pm = sta->nonpeer_pm;
+
+        do_buffer = (pm != NL80211_MESH_POWER_ACTIVE);
+
+        /* Don't let the same PS state be set twice */
+        if (test_sta_flag(sta, WLAN_STA_PS_STA) == do_buffer)
+                return;
+
+        if (do_buffer) {
+                set_sta_flag(sta, WLAN_STA_PS_STA);
+                atomic_inc(&sta->sdata->u.mesh.ps.num_sta_ps);
+                mps_dbg(sta->sdata, "start PS buffering frames towards %pM\n",
+                        sta->sta.addr);
+        } else {
+                ieee80211_sta_ps_deliver_wakeup(sta);
+        }
+
+        /* clear the MPSP flags for non-peers or active STA */
+        if (sta->plink_state != NL80211_PLINK_ESTAB) {
+                clear_sta_flag(sta, WLAN_STA_MPSP_OWNER);
+                clear_sta_flag(sta, WLAN_STA_MPSP_RECIPIENT);
+        } else if (!do_buffer) {
+                clear_sta_flag(sta, WLAN_STA_MPSP_OWNER);
+        }
+}
+
+static void mps_set_sta_peer_pm(struct sta_info *sta,
+                                struct ieee80211_hdr *hdr)
+{
+        enum nl80211_mesh_power_mode pm;
+        u8 *qc = ieee80211_get_qos_ctl(hdr);
+
+        /*
+         * Test Power Management field of frame control (PW) and
+         * mesh power save level subfield of QoS control field (PSL)
+         *
+         * | PM | PSL| Mesh PM |
+         * +----+----+---------+
+         * | 0  |Rsrv|  Active |
+         * | 1  | 0  |  Light  |
+         * | 1  | 1  |  Deep   |
+         */
+        if (ieee80211_has_pm(hdr->frame_control)) {
+                if (qc[1] & (IEEE80211_QOS_CTL_MESH_PS_LEVEL >> 8))
+                        pm = NL80211_MESH_POWER_DEEP_SLEEP;
+                else
+                        pm = NL80211_MESH_POWER_LIGHT_SLEEP;
+        } else {
+                pm = NL80211_MESH_POWER_ACTIVE;
+        }
+
+        if (sta->peer_pm == pm)
+                return;
+
+        mps_dbg(sta->sdata, "STA %pM enters mode %d\n",
+                sta->sta.addr, pm);
+
+        sta->peer_pm = pm;
+
+        ieee80211_mps_sta_status_update(sta);
+}
+
+static void mps_set_sta_nonpeer_pm(struct sta_info *sta,
+                                   struct ieee80211_hdr *hdr)
+{
+        enum nl80211_mesh_power_mode pm;
+
+        if (ieee80211_has_pm(hdr->frame_control))
+                pm = NL80211_MESH_POWER_DEEP_SLEEP;
+        else
+                pm = NL80211_MESH_POWER_ACTIVE;
+
+        if (sta->nonpeer_pm == pm)
+                return;
+
+        mps_dbg(sta->sdata, "STA %pM sets non-peer mode to %d\n",
+                sta->sta.addr, pm);
+
+        sta->nonpeer_pm = pm;
+
+        ieee80211_mps_sta_status_update(sta);
+}
+
+/**
+ * ieee80211_mps_rx_h_sta_process - frame receive handler for mesh powersave
+ *
+ * @sta: STA info that transmitted the frame
+ * @hdr: IEEE 802.11 (QoS) Header
+ */
+void ieee80211_mps_rx_h_sta_process(struct sta_info *sta,
+                                    struct ieee80211_hdr *hdr)
+{
+        if (is_unicast_ether_addr(hdr->addr1) &&
+            ieee80211_is_data_qos(hdr->frame_control)) {
+                /*
+                 * individually addressed QoS Data/Null frames contain
+                 * peer link-specific PS mode towards the local STA
+                 */
+                mps_set_sta_peer_pm(sta, hdr);
+
+                /* check for mesh Peer Service Period trigger frames */
+                ieee80211_mpsp_trigger_process(ieee80211_get_qos_ctl(hdr),
+                                               sta, false, false);
+        } else {
+                /*
+                 * can only determine non-peer PS mode
+                 * (see IEEE802.11-2012 8.2.4.1.7)
+                 */
+                mps_set_sta_nonpeer_pm(sta, hdr);
+        }
+}
+
+
+/* mesh PS frame release */
+
+static void mpsp_trigger_send(struct sta_info *sta, bool rspi, bool eosp)
+{
+        struct ieee80211_sub_if_data *sdata = sta->sdata;
+        struct sk_buff *skb;
+        struct ieee80211_hdr *nullfunc;
+        struct ieee80211_tx_info *info;
+        u8 *qc;
+
+        skb = mps_qos_null_get(sta);
+        if (!skb)
+                return;
+
+        nullfunc = (struct ieee80211_hdr *) skb->data;
+        if (!eosp)
+                nullfunc->frame_control |=
+                                cpu_to_le16(IEEE80211_FCTL_MOREDATA);
+        /*
+         * | RSPI | EOSP |  MPSP triggering   |
+         * +------+------+--------------------+
+         * |  0   |  0   | local STA is owner |
+         * |  0   |  1   | no MPSP (MPSP end) |
+         * |  1   |  0   | both STA are owner |
+         * |  1   |  1   | peer STA is owner  | see IEEE802.11-2012 13.14.9.2
+         */
+        qc = ieee80211_get_qos_ctl(nullfunc);
+        if (rspi)
+                qc[1] |= (IEEE80211_QOS_CTL_RSPI >> 8);
+        if (eosp)
+                qc[0] |= IEEE80211_QOS_CTL_EOSP;
+
+        info = IEEE80211_SKB_CB(skb);
+
+        info->flags |= IEEE80211_TX_CTL_NO_PS_BUFFER |
+                       IEEE80211_TX_CTL_REQ_TX_STATUS;
+
+        mps_dbg(sdata, "sending MPSP trigger%s%s to %pM\n",
+                rspi ? " RSPI" : "", eosp ? " EOSP" : "", sta->sta.addr);
+
+        ieee80211_tx_skb(sdata, skb);
+}
+
+/**
+ * mpsp_qos_null_append - append QoS Null frame to MPSP skb queue if needed
+ *
+ * To properly end a mesh MPSP the last transmitted frame has to set the EOSP
+ * flag in the QoS Control field. In case the current tailing frame is not a
+ * QoS Data frame, append a QoS Null to carry the flag.
+ */
+static void mpsp_qos_null_append(struct sta_info *sta,
+                                 struct sk_buff_head *frames)
+{
+        struct ieee80211_sub_if_data *sdata = sta->sdata;
+        struct sk_buff *new_skb, *skb = skb_peek_tail(frames);
+        struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
+        struct ieee80211_tx_info *info;
+
+        if (ieee80211_is_data_qos(hdr->frame_control))
+                return;
+
+        new_skb = mps_qos_null_get(sta);
+        if (!new_skb)
+                return;
+
+        mps_dbg(sdata, "appending QoS Null in MPSP towards %pM\n",
+                sta->sta.addr);
+        /*
+         * This frame has to be transmitted last. Assign lowest priority to
+         * make sure it cannot pass other frames when releasing multiple ACs.
+         */
+        new_skb->priority = 1;
+        skb_set_queue_mapping(new_skb, IEEE80211_AC_BK);
+        ieee80211_set_qos_hdr(sdata, new_skb);
+
+        info = IEEE80211_SKB_CB(new_skb);
+        info->control.vif = &sdata->vif;
+        info->flags |= IEEE80211_TX_INTFL_NEED_TXPROCESSING;
+
+        __skb_queue_tail(frames, new_skb);
+}
+
+/**
+ * mps_frame_deliver - transmit frames during mesh powersave
+ *
+ * @sta: STA info to transmit to
+ * @n_frames: number of frames to transmit. -1 for all
+ */
+static void mps_frame_deliver(struct sta_info *sta, int n_frames)
+{
+        struct ieee80211_sub_if_data *sdata = sta->sdata;
+        struct ieee80211_local *local = sdata->local;
+        int ac;
+        struct sk_buff_head frames;
+        struct sk_buff *skb;
+        bool more_data = false;
+
+        skb_queue_head_init(&frames);
+
+        /* collect frame(s) from buffers */
+        for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
+                while (n_frames != 0) {
+                        skb = skb_dequeue(&sta->tx_filtered[ac]);
+                        if (!skb) {
+                                skb = skb_dequeue(
+                                        &sta->ps_tx_buf[ac]);
+                                if (skb)
+                                        local->total_ps_buffered--;
+                        }
+                        if (!skb)
+                                break;
+                        n_frames--;
+                        __skb_queue_tail(&frames, skb);
+                }
+
+                if (!skb_queue_empty(&sta->tx_filtered[ac]) ||
+                    !skb_queue_empty(&sta->ps_tx_buf[ac]))
+                        more_data = true;
+        }
+
+        /* nothing to send? -> EOSP */
+        if (skb_queue_empty(&frames)) {
+                mpsp_trigger_send(sta, false, true);
+                return;
+        }
+
+        /* in a MPSP make sure the last skb is a QoS Data frame */
+        if (test_sta_flag(sta, WLAN_STA_MPSP_OWNER))
+                mpsp_qos_null_append(sta, &frames);
+
+        mps_dbg(sta->sdata, "sending %d frames to PS STA %pM\n",
+                skb_queue_len(&frames), sta->sta.addr);
+
+        /* prepare collected frames for transmission */
+        skb_queue_walk(&frames, skb) {
+                struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
+                struct ieee80211_hdr *hdr = (void *) skb->data;
+
+                /*
+                 * Tell TX path to send this frame even though the
+                 * STA may still remain is PS mode after this frame
+                 * exchange.
+                 */
+                info->flags |= IEEE80211_TX_CTL_NO_PS_BUFFER;
+
+                if (more_data || !skb_queue_is_last(&frames, skb))
+                        hdr->frame_control |=
+                                cpu_to_le16(IEEE80211_FCTL_MOREDATA);
+                else
+                        hdr->frame_control &=
+                                cpu_to_le16(~IEEE80211_FCTL_MOREDATA);
+
+                if (skb_queue_is_last(&frames, skb) &&
+                    ieee80211_is_data_qos(hdr->frame_control)) {
+                        u8 *qoshdr = ieee80211_get_qos_ctl(hdr);
+
+                        /* MPSP trigger frame ends service period */
+                        *qoshdr |= IEEE80211_QOS_CTL_EOSP;
+                        info->flags |= IEEE80211_TX_CTL_REQ_TX_STATUS;
+                }
+        }
+
+        ieee80211_add_pending_skbs(local, &frames);
+        sta_info_recalc_tim(sta);
+}
+
+/**
+ * ieee80211_mpsp_trigger_process - track status of mesh Peer Service Periods
+ *
+ * @qc: QoS Control field
+ * @sta: peer to start a MPSP with
+ * @tx: frame was transmitted by the local STA
+ * @acked: frame has been transmitted successfully
+ *
+ * NOTE: active mode STA may only serve as MPSP owner
+ */
+void ieee80211_mpsp_trigger_process(u8 *qc, struct sta_info *sta,
+                                    bool tx, bool acked)
+{
+        u8 rspi = qc[1] & (IEEE80211_QOS_CTL_RSPI >> 8);
+        u8 eosp = qc[0] & IEEE80211_QOS_CTL_EOSP;
+
+        if (tx) {
+                if (rspi && acked)
+                        set_sta_flag(sta, WLAN_STA_MPSP_RECIPIENT);
+
+                if (eosp)
+                        clear_sta_flag(sta, WLAN_STA_MPSP_OWNER);
+                else if (acked &&
+                         test_sta_flag(sta, WLAN_STA_PS_STA) &&
+                         !test_and_set_sta_flag(sta, WLAN_STA_MPSP_OWNER))
+                        mps_frame_deliver(sta, -1);
+        } else {
+                if (eosp)
+                        clear_sta_flag(sta, WLAN_STA_MPSP_RECIPIENT);
+                else if (sta->local_pm != NL80211_MESH_POWER_ACTIVE)
+                        set_sta_flag(sta, WLAN_STA_MPSP_RECIPIENT);
+
+                if (rspi && !test_and_set_sta_flag(sta, WLAN_STA_MPSP_OWNER))
+                        mps_frame_deliver(sta, -1);
+        }
+}
+
+/**
+ * ieee80211_mps_frame_release - release buffered frames in response to beacon
+ *
+ * @sta: mesh STA
+ * @elems: beacon IEs
+ *
+ * For peers if we have individually-addressed frames buffered or the peer
+ * indicates buffered frames, send a corresponding MPSP trigger frame. Since
+ * we do not evaluate the awake window duration, QoS Nulls are used as MPSP
+ * trigger frames. If the neighbour STA is not a peer, only send single frames.
+ */
+void ieee80211_mps_frame_release(struct sta_info *sta,
+                                 struct ieee802_11_elems *elems)
+{
+        int ac, buffer_local = 0;
+        bool has_buffered = false;
+
+        /* TIM map only for LLID <= IEEE80211_MAX_AID */
+        if (sta->plink_state == NL80211_PLINK_ESTAB)
+                has_buffered = ieee80211_check_tim(elems->tim, elems->tim_len,
+                                le16_to_cpu(sta->llid) % IEEE80211_MAX_AID);
+
+        if (has_buffered)
+                mps_dbg(sta->sdata, "%pM indicates buffered frames\n",
+                        sta->sta.addr);
+
+        /* only transmit to PS STA with announced, non-zero awake window */
+        if (test_sta_flag(sta, WLAN_STA_PS_STA) &&
+            (!elems->awake_window || !le16_to_cpu(*elems->awake_window)))
+                return;
+
+        for (ac = 0; ac < IEEE80211_NUM_ACS; ac++)
+                buffer_local += skb_queue_len(&sta->ps_tx_buf[ac]) +
+                                skb_queue_len(&sta->tx_filtered[ac]);
+
+        if (!has_buffered && !buffer_local)
+                return;
+
+        if (sta->plink_state == NL80211_PLINK_ESTAB)
+                mpsp_trigger_send(sta, has_buffered, !buffer_local);
+        else
+                mps_frame_deliver(sta, 1);
+}
diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
index e930175771ff..9f6464f3e05f 100644
--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
@@ -30,11 +30,13 @@
 #include "rate.h"
 #include "led.h"
 
-#define IEEE80211_AUTH_TIMEOUT (HZ / 5)
-#define IEEE80211_AUTH_MAX_TRIES 3
-#define IEEE80211_AUTH_WAIT_ASSOC (HZ * 5)
-#define IEEE80211_ASSOC_TIMEOUT (HZ / 5)
-#define IEEE80211_ASSOC_MAX_TRIES 3
+#define IEEE80211_AUTH_TIMEOUT          (HZ / 5)
+#define IEEE80211_AUTH_TIMEOUT_SHORT    (HZ / 10)
+#define IEEE80211_AUTH_MAX_TRIES        3
+#define IEEE80211_AUTH_WAIT_ASSOC       (HZ * 5)
+#define IEEE80211_ASSOC_TIMEOUT         (HZ / 5)
+#define IEEE80211_ASSOC_TIMEOUT_SHORT   (HZ / 10)
+#define IEEE80211_ASSOC_MAX_TRIES       3
 
 static int max_nullfunc_tries = 2;
 module_param(max_nullfunc_tries, int, 0644);
@@ -112,6 +114,9 @@ enum rx_mgmt_action {
 
         /* caller must call cfg80211_send_assoc_timeout() */
         RX_MGMT_CFG80211_ASSOC_TIMEOUT,
+
+        /* used when a processed beacon causes a deauth */
+        RX_MGMT_CFG80211_TX_DEAUTH,
 };
 
 /* utils */
@@ -172,79 +177,331 @@ static int ecw2cw(int ecw)
         return (1 << ecw) - 1;
 }
 
-static u32 ieee80211_config_ht_tx(struct ieee80211_sub_if_data *sdata,
-                                  struct ieee80211_ht_operation *ht_oper,
-                                  const u8 *bssid, bool reconfig)
+static u32 chandef_downgrade(struct cfg80211_chan_def *c)
+{
+        u32 ret;
+        int tmp;
+
+        switch (c->width) {
+        case NL80211_CHAN_WIDTH_20:
+                c->width = NL80211_CHAN_WIDTH_20_NOHT;
+                ret = IEEE80211_STA_DISABLE_HT | IEEE80211_STA_DISABLE_VHT;
+                break;
+        case NL80211_CHAN_WIDTH_40:
+                c->width = NL80211_CHAN_WIDTH_20;
+                c->center_freq1 = c->chan->center_freq;
+                ret = IEEE80211_STA_DISABLE_40MHZ |
+                      IEEE80211_STA_DISABLE_VHT;
+                break;
+        case NL80211_CHAN_WIDTH_80:
+                tmp = (30 + c->chan->center_freq - c->center_freq1)/20;
+                /* n_P40 */
+                tmp /= 2;
+                /* freq_P40 */
+                c->center_freq1 = c->center_freq1 - 20 + 40 * tmp;
+                c->width = NL80211_CHAN_WIDTH_40;
+                ret = IEEE80211_STA_DISABLE_VHT;
+                break;
+        case NL80211_CHAN_WIDTH_80P80:
+                c->center_freq2 = 0;
+                c->width = NL80211_CHAN_WIDTH_80;
+                ret = IEEE80211_STA_DISABLE_80P80MHZ |
+                      IEEE80211_STA_DISABLE_160MHZ;
+                break;
+        case NL80211_CHAN_WIDTH_160:
+                /* n_P20 */
+                tmp = (70 + c->chan->center_freq - c->center_freq1)/20;
+                /* n_P80 */
+                tmp /= 4;
+                c->center_freq1 = c->center_freq1 - 40 + 80 * tmp;
+                c->width = NL80211_CHAN_WIDTH_80;
+                ret = IEEE80211_STA_DISABLE_80P80MHZ |
+                      IEEE80211_STA_DISABLE_160MHZ;
+                break;
+        default:
+        case NL80211_CHAN_WIDTH_20_NOHT:
+                WARN_ON_ONCE(1);
+                c->width = NL80211_CHAN_WIDTH_20_NOHT;
+                ret = IEEE80211_STA_DISABLE_HT | IEEE80211_STA_DISABLE_VHT;
+                break;
+        }
+
+        WARN_ON_ONCE(!cfg80211_chandef_valid(c));
+
+        return ret;
+}
+
+static u32
+ieee80211_determine_chantype(struct ieee80211_sub_if_data *sdata,
+                             struct ieee80211_supported_band *sband,
+                             struct ieee80211_channel *channel,
+                             const struct ieee80211_ht_operation *ht_oper,
+                             const struct ieee80211_vht_operation *vht_oper,
+                             struct cfg80211_chan_def *chandef, bool verbose)
+{
+        struct cfg80211_chan_def vht_chandef;
+        u32 ht_cfreq, ret;
+
+        chandef->chan = channel;
+        chandef->width = NL80211_CHAN_WIDTH_20_NOHT;
+        chandef->center_freq1 = channel->center_freq;
+        chandef->center_freq2 = 0;
+
+        if (!ht_oper || !sband->ht_cap.ht_supported) {
+                ret = IEEE80211_STA_DISABLE_HT | IEEE80211_STA_DISABLE_VHT;
+                goto out;
+        }
+
+        chandef->width = NL80211_CHAN_WIDTH_20;
+
+        ht_cfreq = ieee80211_channel_to_frequency(ht_oper->primary_chan,
+                                                  channel->band);
+        /* check that channel matches the right operating channel */
+        if (channel->center_freq != ht_cfreq) {
+                /*
+                 * It's possible that some APs are confused here;
+                 * Netgear WNDR3700 sometimes reports 4 higher than
+                 * the actual channel in association responses, but
+                 * since we look at probe response/beacon data here
+                 * it should be OK.
+                 */
+                if (verbose)
+                        sdata_info(sdata,
+                                   "Wrong control channel: center-freq: %d ht-cfreq: %d ht->primary_chan: %d band: %d - Disabling HT\n",
+                                   channel->center_freq, ht_cfreq,
+                                   ht_oper->primary_chan, channel->band);
+                ret = IEEE80211_STA_DISABLE_HT | IEEE80211_STA_DISABLE_VHT;
+                goto out;
+        }
+
+        /* check 40 MHz support, if we have it */
+        if (sband->ht_cap.cap & IEEE80211_HT_CAP_SUP_WIDTH_20_40) {
+                switch (ht_oper->ht_param & IEEE80211_HT_PARAM_CHA_SEC_OFFSET) {
+                case IEEE80211_HT_PARAM_CHA_SEC_ABOVE:
+                        chandef->width = NL80211_CHAN_WIDTH_40;
+                        chandef->center_freq1 += 10;
+                        break;
+                case IEEE80211_HT_PARAM_CHA_SEC_BELOW:
+                        chandef->width = NL80211_CHAN_WIDTH_40;
+                        chandef->center_freq1 -= 10;
+                        break;
+                }
+        } else {
+                /* 40 MHz (and 80 MHz) must be supported for VHT */
+                ret = IEEE80211_STA_DISABLE_VHT;
+                goto out;
+        }
+
+        if (!vht_oper || !sband->vht_cap.vht_supported) {
+                ret = IEEE80211_STA_DISABLE_VHT;
+                goto out;
+        }
+
+        vht_chandef.chan = channel;
+        vht_chandef.center_freq1 =
+                ieee80211_channel_to_frequency(vht_oper->center_freq_seg1_idx,
+                                               channel->band);
+        vht_chandef.center_freq2 = 0;
+
+        if (vht_oper->center_freq_seg2_idx)
+                vht_chandef.center_freq2 =
+                        ieee80211_channel_to_frequency(
+                                vht_oper->center_freq_seg2_idx,
+                                channel->band);
+
+        switch (vht_oper->chan_width) {
+        case IEEE80211_VHT_CHANWIDTH_USE_HT:
+                vht_chandef.width = chandef->width;
+                break;
+        case IEEE80211_VHT_CHANWIDTH_80MHZ:
+                vht_chandef.width = NL80211_CHAN_WIDTH_80;
+                break;
+        case IEEE80211_VHT_CHANWIDTH_160MHZ:
+                vht_chandef.width = NL80211_CHAN_WIDTH_160;
+                break;
+        case IEEE80211_VHT_CHANWIDTH_80P80MHZ:
+                vht_chandef.width = NL80211_CHAN_WIDTH_80P80;
+                break;
+        default:
+                if (verbose)
+                        sdata_info(sdata,
+                                   "AP VHT operation IE has invalid channel width (%d), disable VHT\n",
+                                   vht_oper->chan_width);
+                ret = IEEE80211_STA_DISABLE_VHT;
+                goto out;
+        }
+
+        if (!cfg80211_chandef_valid(&vht_chandef)) {
+                if (verbose)
+                        sdata_info(sdata,
+                                   "AP VHT information is invalid, disable VHT\n");
+                ret = IEEE80211_STA_DISABLE_VHT;
+                goto out;
+        }
+
+        if (cfg80211_chandef_identical(chandef, &vht_chandef)) {
+                ret = 0;
+                goto out;
+        }
+
+        if (!cfg80211_chandef_compatible(chandef, &vht_chandef)) {
+                if (verbose)
+                        sdata_info(sdata,
+                                   "AP VHT information doesn't match HT, disable VHT\n");
+                ret = IEEE80211_STA_DISABLE_VHT;
+                goto out;
+        }
+
+        *chandef = vht_chandef;
+
+        ret = 0;
+
+out:
+        /* don't print the message below for VHT mismatch if VHT is disabled */
+        if (ret & IEEE80211_STA_DISABLE_VHT)
+                vht_chandef = *chandef;
+
+        while (!cfg80211_chandef_usable(sdata->local->hw.wiphy, chandef,
+                                        IEEE80211_CHAN_DISABLED)) {
+                if (WARN_ON(chandef->width == NL80211_CHAN_WIDTH_20_NOHT)) {
+                        ret = IEEE80211_STA_DISABLE_HT |
+                              IEEE80211_STA_DISABLE_VHT;
+                        goto out;
+                }
+
+                ret |= chandef_downgrade(chandef);
+        }
+
+        if (chandef->width != vht_chandef.width && verbose)
+                sdata_info(sdata,
+                           "capabilities/regulatory prevented using AP HT/VHT configuration, downgraded\n");
+
+        WARN_ON_ONCE(!cfg80211_chandef_valid(chandef));
+        return ret;
+}
+
+static int ieee80211_config_bw(struct ieee80211_sub_if_data *sdata,
+                               struct sta_info *sta,
+                               const struct ieee80211_ht_operation *ht_oper,
+                               const struct ieee80211_vht_operation *vht_oper,
+                               const u8 *bssid, u32 *changed)
 {
         struct ieee80211_local *local = sdata->local;
+        struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
         struct ieee80211_supported_band *sband;
-        struct ieee80211_chanctx_conf *chanctx_conf;
         struct ieee80211_channel *chan;
-        struct sta_info *sta;
-        u32 changed = 0;
+        struct cfg80211_chan_def chandef;
         u16 ht_opmode;
-        bool disable_40 = false;
+        u32 flags;
+        enum ieee80211_sta_rx_bandwidth new_sta_bw;
+        int ret;
 
-        rcu_read_lock();
-        chanctx_conf = rcu_dereference(sdata->vif.chanctx_conf);
-        if (WARN_ON(!chanctx_conf)) {
-                rcu_read_unlock();
+        /* if HT was/is disabled, don't track any bandwidth changes */
+        if (ifmgd->flags & IEEE80211_STA_DISABLE_HT || !ht_oper)
                 return 0;
-        }
-        chan = chanctx_conf->def.chan;
-        rcu_read_unlock();
+
+        /* don't check VHT if we associated as non-VHT station */
+        if (ifmgd->flags & IEEE80211_STA_DISABLE_VHT)
+                vht_oper = NULL;
+
+        if (WARN_ON_ONCE(!sta))
+                return -EINVAL;
+
+        chan = sdata->vif.bss_conf.chandef.chan;
         sband = local->hw.wiphy->bands[chan->band];
 
-        switch (sdata->vif.bss_conf.chandef.width) {
+        /* calculate new channel (type) based on HT/VHT operation IEs */
+        flags = ieee80211_determine_chantype(sdata, sband, chan, ht_oper,
+                                             vht_oper, &chandef, false);
+
+        /*
+         * Downgrade the new channel if we associated with restricted
+         * capabilities. For example, if we associated as a 20 MHz STA
+         * to a 40 MHz AP (due to regulatory, capabilities or config
+         * reasons) then switching to a 40 MHz channel now won't do us
+         * any good -- we couldn't use it with the AP.
+         */
+        if (ifmgd->flags & IEEE80211_STA_DISABLE_80P80MHZ &&
+            chandef.width == NL80211_CHAN_WIDTH_80P80)
+                flags |= chandef_downgrade(&chandef);
+        if (ifmgd->flags & IEEE80211_STA_DISABLE_160MHZ &&
+            chandef.width == NL80211_CHAN_WIDTH_160)
+                flags |= chandef_downgrade(&chandef);
+        if (ifmgd->flags & IEEE80211_STA_DISABLE_40MHZ &&
+            chandef.width > NL80211_CHAN_WIDTH_20)
+                flags |= chandef_downgrade(&chandef);
+
+        if (cfg80211_chandef_identical(&chandef, &sdata->vif.bss_conf.chandef))
+                return 0;
+
+        sdata_info(sdata,
+                   "AP %pM changed bandwidth, new config is %d MHz, width %d (%d/%d MHz)\n",
+                   ifmgd->bssid, chandef.chan->center_freq, chandef.width,
+                   chandef.center_freq1, chandef.center_freq2);
+
+        if (flags != (ifmgd->flags & (IEEE80211_STA_DISABLE_HT |
+                                      IEEE80211_STA_DISABLE_VHT |
+                                      IEEE80211_STA_DISABLE_40MHZ |
+                                      IEEE80211_STA_DISABLE_80P80MHZ |
+                                      IEEE80211_STA_DISABLE_160MHZ)) ||
+            !cfg80211_chandef_valid(&chandef)) {
+                sdata_info(sdata,
+                           "AP %pM changed bandwidth in a way we can't support - disconnect\n",
+                           ifmgd->bssid);
+                return -EINVAL;
+        }
+
+        switch (chandef.width) {
+        case NL80211_CHAN_WIDTH_20_NOHT:
+        case NL80211_CHAN_WIDTH_20:
+                new_sta_bw = IEEE80211_STA_RX_BW_20;
+                break;
         case NL80211_CHAN_WIDTH_40:
-                if (sdata->vif.bss_conf.chandef.chan->center_freq >
-                                sdata->vif.bss_conf.chandef.center_freq1 &&
-                    chan->flags & IEEE80211_CHAN_NO_HT40MINUS)
-                        disable_40 = true;
-                if (sdata->vif.bss_conf.chandef.chan->center_freq <
-                                sdata->vif.bss_conf.chandef.center_freq1 &&
-                    chan->flags & IEEE80211_CHAN_NO_HT40PLUS)
-                        disable_40 = true;
+                new_sta_bw = IEEE80211_STA_RX_BW_40;
                 break;
-        default:
+        case NL80211_CHAN_WIDTH_80:
+                new_sta_bw = IEEE80211_STA_RX_BW_80;
                 break;
+        case NL80211_CHAN_WIDTH_80P80:
+        case NL80211_CHAN_WIDTH_160:
+                new_sta_bw = IEEE80211_STA_RX_BW_160;
+                break;
+        default:
+                return -EINVAL;
         }
 
-        /* This can change during the lifetime of the BSS */
-        if (!(ht_oper->ht_param & IEEE80211_HT_PARAM_CHAN_WIDTH_ANY))
-                disable_40 = true;
-
-        mutex_lock(&local->sta_mtx);
-        sta = sta_info_get(sdata, bssid);
-
-        WARN_ON_ONCE(!sta);
-
-        if (sta && !sta->supports_40mhz)
-                disable_40 = true;
+        if (new_sta_bw > sta->cur_max_bandwidth)
+                new_sta_bw = sta->cur_max_bandwidth;
 
-        if (sta && (!reconfig ||
-                    (disable_40 != !(sta->sta.ht_cap.cap &
-                                        IEEE80211_HT_CAP_SUP_WIDTH_20_40)))) {
+        if (new_sta_bw < sta->sta.bandwidth) {
+                sta->sta.bandwidth = new_sta_bw;
+                rate_control_rate_update(local, sband, sta,
+                                         IEEE80211_RC_BW_CHANGED);
+        }
 
-                if (disable_40)
-                        sta->sta.ht_cap.cap &= ~IEEE80211_HT_CAP_SUP_WIDTH_20_40;
-                else
-                        sta->sta.ht_cap.cap |= IEEE80211_HT_CAP_SUP_WIDTH_20_40;
+        ret = ieee80211_vif_change_bandwidth(sdata, &chandef, changed);
+        if (ret) {
+                sdata_info(sdata,
+                           "AP %pM changed bandwidth to incompatible one - disconnect\n",
+                           ifmgd->bssid);
+                return ret;
+        }
 
+        if (new_sta_bw > sta->sta.bandwidth) {
+                sta->sta.bandwidth = new_sta_bw;
                 rate_control_rate_update(local, sband, sta,
                                          IEEE80211_RC_BW_CHANGED);
         }
-        mutex_unlock(&local->sta_mtx);
 
         ht_opmode = le16_to_cpu(ht_oper->operation_mode);
 
         /* if bss configuration changed store the new one */
-        if (!reconfig || (sdata->vif.bss_conf.ht_operation_mode != ht_opmode)) {
-                changed |= BSS_CHANGED_HT;
+        if (sdata->vif.bss_conf.ht_operation_mode != ht_opmode) {
+                *changed |= BSS_CHANGED_HT;
                 sdata->vif.bss_conf.ht_operation_mode = ht_opmode;
         }
 
-        return changed;
+        return 0;
 }
 
 /* frame sending functions */
@@ -644,6 +901,9 @@ static void ieee80211_send_assoc(struct ieee80211_sub_if_data *sdata)
         drv_mgd_prepare_tx(local, sdata);
 
         IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT;
+        if (local->hw.flags & IEEE80211_HW_REPORTS_TX_ACK_STATUS)
+                IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_CTL_REQ_TX_STATUS |
+                                                IEEE80211_TX_INTFL_MLME_CONN_TX;
         ieee80211_tx_skb(sdata, skb);
 }
 
@@ -680,7 +940,8 @@ void ieee80211_send_nullfunc(struct ieee80211_local *local,
         if (powersave)
                 nullfunc->frame_control |= cpu_to_le16(IEEE80211_FCTL_PM);
 
-        IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT;
+        IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT |
+                                        IEEE80211_TX_INTFL_OFFCHAN_TX_OK;
         if (ifmgd->flags & (IEEE80211_STA_BEACON_POLL |
                             IEEE80211_STA_CONNECTION_POLL))
                 IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_CTL_USE_MINRATE;
@@ -784,10 +1045,10 @@ static void ieee80211_chswitch_timer(unsigned long data)
         ieee80211_queue_work(&sdata->local->hw, &ifmgd->chswitch_work);
 }
 
-void ieee80211_sta_process_chanswitch(struct ieee80211_sub_if_data *sdata,
-                                      struct ieee80211_channel_sw_ie *sw_elem,
-                                      struct ieee80211_bss *bss,
-                                      u64 timestamp)
+void
+ieee80211_sta_process_chanswitch(struct ieee80211_sub_if_data *sdata,
+                                 const struct ieee80211_channel_sw_ie *sw_elem,
+                                 struct ieee80211_bss *bss, u64 timestamp)
 {
         struct cfg80211_bss *cbss =
                 container_of((void *)bss, struct cfg80211_bss, priv);
@@ -946,39 +1207,6 @@ static u32 ieee80211_handle_pwr_constr(struct ieee80211_sub_if_data *sdata,
         return 0;
 }
 
-void ieee80211_enable_dyn_ps(struct ieee80211_vif *vif)
-{
-        struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
-        struct ieee80211_local *local = sdata->local;
-        struct ieee80211_conf *conf = &local->hw.conf;
-
-        WARN_ON(sdata->vif.type != NL80211_IFTYPE_STATION ||
-                !(local->hw.flags & IEEE80211_HW_SUPPORTS_PS) ||
-                (local->hw.flags & IEEE80211_HW_SUPPORTS_DYNAMIC_PS));
-
-        local->disable_dynamic_ps = false;
-        conf->dynamic_ps_timeout = local->dynamic_ps_user_timeout;
-}
-EXPORT_SYMBOL(ieee80211_enable_dyn_ps);
-
-void ieee80211_disable_dyn_ps(struct ieee80211_vif *vif)
-{
-        struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
-        struct ieee80211_local *local = sdata->local;
-        struct ieee80211_conf *conf = &local->hw.conf;
-
-        WARN_ON(sdata->vif.type != NL80211_IFTYPE_STATION ||
-                !(local->hw.flags & IEEE80211_HW_SUPPORTS_PS) ||
-                (local->hw.flags & IEEE80211_HW_SUPPORTS_DYNAMIC_PS));
-
-        local->disable_dynamic_ps = true;
-        conf->dynamic_ps_timeout = 0;
-        del_timer_sync(&local->dynamic_ps_timer);
-        ieee80211_queue_work(&local->hw,
-                             &local->dynamic_ps_enable_work);
-}
-EXPORT_SYMBOL(ieee80211_disable_dyn_ps);
-
 /* powersave */
 static void ieee80211_enable_ps(struct ieee80211_local *local,
                                 struct ieee80211_sub_if_data *sdata)
@@ -1081,7 +1309,6 @@ void ieee80211_recalc_ps(struct ieee80211_local *local, s32 latency)
         }
 
         if (count == 1 && ieee80211_powersave_allowed(found)) {
-                struct ieee80211_conf *conf = &local->hw.conf;
                 s32 beaconint_us;
 
                 if (latency < 0)
@@ -1105,10 +1332,7 @@ void ieee80211_recalc_ps(struct ieee80211_local *local, s32 latency)
                         else
                                 timeout = 100;
                 }
-                local->dynamic_ps_user_timeout = timeout;
-                if (!local->disable_dynamic_ps)
-                        conf->dynamic_ps_timeout =
-                                local->dynamic_ps_user_timeout;
+                local->hw.conf.dynamic_ps_timeout = timeout;
 
                 if (beaconint_us > latency) {
                         local->ps_sdata = NULL;
@@ -1178,8 +1402,7 @@ void ieee80211_dynamic_ps_enable_work(struct work_struct *work)
         if (local->hw.conf.flags & IEEE80211_CONF_PS)
                 return;
 
-        if (!local->disable_dynamic_ps &&
-            local->hw.conf.dynamic_ps_timeout > 0) {
+        if (local->hw.conf.dynamic_ps_timeout > 0) {
                 /* don't enter PS if TX frames are pending */
                 if (drv_tx_frames_pending(local)) {
                         mod_timer(&local->dynamic_ps_timer, jiffies +
@@ -1244,16 +1467,30 @@ void ieee80211_dynamic_ps_timer(unsigned long data)
         ieee80211_queue_work(&local->hw, &local->dynamic_ps_enable_work);
 }
 
+void ieee80211_dfs_cac_timer_work(struct work_struct *work)
+{
+        struct delayed_work *delayed_work =
+                container_of(work, struct delayed_work, work);
+        struct ieee80211_sub_if_data *sdata =
+                container_of(delayed_work, struct ieee80211_sub_if_data,
+                             dfs_cac_timer_work);
+
+        ieee80211_vif_release_channel(sdata);
+
+        cfg80211_cac_event(sdata->dev, NL80211_RADAR_CAC_FINISHED, GFP_KERNEL);
+}
+
 /* MLME */
 static bool ieee80211_sta_wmm_params(struct ieee80211_local *local,
                                      struct ieee80211_sub_if_data *sdata,
-                                     u8 *wmm_param, size_t wmm_param_len)
+                                     const u8 *wmm_param, size_t wmm_param_len)
 {
         struct ieee80211_tx_queue_params params;
         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
         size_t left;
         int count;
-        u8 *pos, uapsd_queues = 0;
+        const u8 *pos;
+        u8 uapsd_queues = 0;
 
         if (!local->ops->conf_tx)
                 return false;
@@ -1445,7 +1682,7 @@ static void ieee80211_set_associated(struct ieee80211_sub_if_data *sdata,
 
         ieee80211_led_assoc(local, 1);
 
-        if (local->hw.flags & IEEE80211_HW_NEED_DTIM_PERIOD) {
+        if (sdata->u.mgd.assoc_data->have_beacon) {
                 /*
                  * If the AP is buggy we may get here with no DTIM period
                  * known, so assume it's 1 which is the only safe assumption
@@ -1453,6 +1690,7 @@ static void ieee80211_set_associated(struct ieee80211_sub_if_data *sdata,
                  * probably just won't work at all.
                  */
                 bss_conf->dtim_period = sdata->u.mgd.dtim_period ?: 1;
+                bss_info_changed |= BSS_CHANGED_DTIM_PERIOD;
         } else {
                 bss_conf->dtim_period = 0;
         }
@@ -1465,10 +1703,8 @@ static void ieee80211_set_associated(struct ieee80211_sub_if_data *sdata,
                 bss_info_changed |= BSS_CHANGED_CQM;
 
         /* Enable ARP filtering */
-        if (bss_conf->arp_filter_enabled != sdata->arp_filter_state) {
-                bss_conf->arp_filter_enabled = sdata->arp_filter_state;
+        if (bss_conf->arp_addr_cnt)
                 bss_info_changed |= BSS_CHANGED_ARP_FILTER;
-        }
 
         ieee80211_bss_info_change_notify(sdata, bss_info_changed);
 
@@ -1489,7 +1725,6 @@ static void ieee80211_set_disassoc(struct ieee80211_sub_if_data *sdata,
 {
         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
         struct ieee80211_local *local = sdata->local;
-        struct sta_info *sta;
         u32 changed = 0;
 
         ASSERT_MGD_MTX(ifmgd);
@@ -1521,14 +1756,6 @@ static void ieee80211_set_disassoc(struct ieee80211_sub_if_data *sdata,
         netif_tx_stop_all_queues(sdata->dev);
         netif_carrier_off(sdata->dev);
 
-        mutex_lock(&local->sta_mtx);
-        sta = sta_info_get(sdata, ifmgd->bssid);
-        if (sta) {
-                set_sta_flag(sta, WLAN_STA_BLOCK_BA);
-                ieee80211_sta_tear_down_BA_sessions(sta, AGG_STOP_DESTROY_STA);
-        }
-        mutex_unlock(&local->sta_mtx);
-
         /*
          * if we want to get out of ps before disassoc (why?) we have
          * to do it before sending disassoc, as otherwise the null-packet
@@ -1582,10 +1809,8 @@ static void ieee80211_set_disassoc(struct ieee80211_sub_if_data *sdata,
         cancel_work_sync(&local->dynamic_ps_enable_work);
 
         /* Disable ARP filtering */
-        if (sdata->vif.bss_conf.arp_filter_enabled) {
-                sdata->vif.bss_conf.arp_filter_enabled = false;
+        if (sdata->vif.bss_conf.arp_addr_cnt)
                 changed |= BSS_CHANGED_ARP_FILTER;
-        }
 
         sdata->vif.bss_conf.qos = false;
         changed |= BSS_CHANGED_QOS;
@@ -1668,17 +1893,18 @@ void ieee80211_sta_tx_notify(struct ieee80211_sub_if_data *sdata,
         if (!ieee80211_is_data(hdr->frame_control))
             return;
 
-        if (ack)
-                ieee80211_sta_reset_conn_monitor(sdata);
-
         if (ieee80211_is_nullfunc(hdr->frame_control) &&
             sdata->u.mgd.probe_send_count > 0) {
                 if (ack)
-                        sdata->u.mgd.probe_send_count = 0;
+                        ieee80211_sta_reset_conn_monitor(sdata);
                 else
                         sdata->u.mgd.nullfunc_failed = true;
                 ieee80211_queue_work(&sdata->local->hw, &sdata->work);
+                return;
         }
+
+        if (ack)
+                ieee80211_sta_reset_conn_monitor(sdata);
 }
 
 static void ieee80211_mgd_probe_ap_send(struct ieee80211_sub_if_data *sdata)
@@ -1719,7 +1945,7 @@ static void ieee80211_mgd_probe_ap_send(struct ieee80211_sub_if_data *sdata)
                         ssid_len = ssid[1];
 
                 ieee80211_send_probe_req(sdata, dst, ssid + 2, ssid_len, NULL,
-                                         0, (u32) -1, true, false,
+                                         0, (u32) -1, true, 0,
                                          ifmgd->associated->channel, false);
                 rcu_read_unlock();
         }
@@ -1753,7 +1979,7 @@ static void ieee80211_mgd_probe_ap(struct ieee80211_sub_if_data *sdata,
 
         if (beacon)
                 mlme_dbg_ratelimited(sdata,
-                                     "detected beacon loss from AP - sending probe request\n");
+                                     "detected beacon loss from AP - probing\n");
 
         ieee80211_cqm_rssi_notify(&sdata->vif,
                 NL80211_CQM_RSSI_BEACON_LOSS_EVENT, GFP_KERNEL);
@@ -1834,11 +2060,9 @@ struct sk_buff *ieee80211_ap_probereq_get(struct ieee80211_hw *hw,
 }
 EXPORT_SYMBOL(ieee80211_ap_probereq_get);
 
-static void __ieee80211_disconnect(struct ieee80211_sub_if_data *sdata,
-                                   bool transmit_frame)
+static void __ieee80211_disconnect(struct ieee80211_sub_if_data *sdata)
 {
         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
-        struct ieee80211_local *local = sdata->local;
         u8 frame_buf[IEEE80211_DEAUTH_FRAME_LEN];
 
         mutex_lock(&ifmgd->mtx);
@@ -1849,8 +2073,10 @@ static void __ieee80211_disconnect(struct ieee80211_sub_if_data *sdata,
 
         ieee80211_set_disassoc(sdata, IEEE80211_STYPE_DEAUTH,
                                WLAN_REASON_DISASSOC_DUE_TO_INACTIVITY,
-                               transmit_frame, frame_buf);
+                               true, frame_buf);
         ifmgd->flags &= ~IEEE80211_STA_CSA_RECEIVED;
+        ieee80211_wake_queues_by_reason(&sdata->local->hw,
+                                        IEEE80211_QUEUE_STOP_REASON_CSA);
         mutex_unlock(&ifmgd->mtx);
 
         /*
@@ -1858,10 +2084,6 @@ static void __ieee80211_disconnect(struct ieee80211_sub_if_data *sdata,
          * but that's not a problem.
          */
         cfg80211_send_deauth(sdata->dev, frame_buf, IEEE80211_DEAUTH_FRAME_LEN);
-
-        mutex_lock(&local->mtx);
-        ieee80211_recalc_idle(local);
-        mutex_unlock(&local->mtx);
 }
 
 static void ieee80211_beacon_connection_loss_work(struct work_struct *work)
@@ -1880,10 +2102,10 @@ static void ieee80211_beacon_connection_loss_work(struct work_struct *work)
                 rcu_read_unlock();
         }
 
-        if (sdata->local->hw.flags & IEEE80211_HW_CONNECTION_MONITOR) {
+        if (ifmgd->connection_loss) {
                 sdata_info(sdata, "Connection to AP %pM lost\n",
                            ifmgd->bssid);
-                __ieee80211_disconnect(sdata, false);
+                __ieee80211_disconnect(sdata);
         } else {
                 ieee80211_mgd_probe_ap(sdata, true);
         }
@@ -1895,9 +2117,7 @@ static void ieee80211_csa_connection_drop_work(struct work_struct *work)
                 container_of(work, struct ieee80211_sub_if_data,
                              u.mgd.csa_connection_drop_work);
 
-        ieee80211_wake_queues_by_reason(&sdata->local->hw,
-                                        IEEE80211_QUEUE_STOP_REASON_CSA);
-        __ieee80211_disconnect(sdata, true);
+        __ieee80211_disconnect(sdata);
 }
 
 void ieee80211_beacon_loss(struct ieee80211_vif *vif)
@@ -1908,6 +2128,7 @@ void ieee80211_beacon_loss(struct ieee80211_vif *vif)
         trace_api_beacon_loss(sdata);
 
         WARN_ON(hw->flags & IEEE80211_HW_CONNECTION_MONITOR);
+        sdata->u.mgd.connection_loss = false;
         ieee80211_queue_work(hw, &sdata->u.mgd.beacon_connection_loss_work);
 }
 EXPORT_SYMBOL(ieee80211_beacon_loss);
@@ -1919,7 +2140,7 @@ void ieee80211_connection_loss(struct ieee80211_vif *vif)
 
         trace_api_connection_loss(sdata);
 
-        WARN_ON(!(hw->flags & IEEE80211_HW_CONNECTION_MONITOR));
+        sdata->u.mgd.connection_loss = true;
         ieee80211_queue_work(hw, &sdata->u.mgd.beacon_connection_loss_work);
 }
 EXPORT_SYMBOL(ieee80211_connection_loss);
@@ -1941,7 +2162,7 @@ static void ieee80211_destroy_auth_data(struct ieee80211_sub_if_data *sdata,
                 ieee80211_vif_release_channel(sdata);
         }
 
-        cfg80211_put_bss(auth_data->bss);
+        cfg80211_put_bss(sdata->local->hw.wiphy, auth_data->bss);
         kfree(auth_data);
         sdata->u.mgd.auth_data = NULL;
 }
@@ -1949,9 +2170,11 @@ static void ieee80211_destroy_auth_data(struct ieee80211_sub_if_data *sdata,
 static void ieee80211_auth_challenge(struct ieee80211_sub_if_data *sdata,
                                      struct ieee80211_mgmt *mgmt, size_t len)
 {
+        struct ieee80211_local *local = sdata->local;
         struct ieee80211_mgd_auth_data *auth_data = sdata->u.mgd.auth_data;
         u8 *pos;
         struct ieee802_11_elems elems;
+        u32 tx_flags = 0;
 
         pos = mgmt->u.auth.variable;
         ieee802_11_parse_elems(pos, len - (pos - (u8 *) mgmt), &elems);
@@ -1959,11 +2182,14 @@ static void ieee80211_auth_challenge(struct ieee80211_sub_if_data *sdata,
                 return;
         auth_data->expected_transaction = 4;
         drv_mgd_prepare_tx(sdata->local, sdata);
+        if (local->hw.flags & IEEE80211_HW_REPORTS_TX_ACK_STATUS)
+                tx_flags = IEEE80211_TX_CTL_REQ_TX_STATUS |
+                           IEEE80211_TX_INTFL_MLME_CONN_TX;
         ieee80211_send_auth(sdata, 3, auth_data->algorithm, 0,
                             elems.challenge - 2, elems.challenge_len + 2,
                             auth_data->bss->bssid, auth_data->bss->bssid,
                             auth_data->key, auth_data->key_len,
-                            auth_data->key_idx);
+                            auth_data->key_idx, tx_flags);
 }
 
 static enum rx_mgmt_action __must_check
@@ -2030,6 +2256,7 @@ ieee80211_rx_mgmt_auth(struct ieee80211_sub_if_data *sdata,
         sdata_info(sdata, "authenticated\n");
         ifmgd->auth_data->done = true;
         ifmgd->auth_data->timeout = jiffies + IEEE80211_AUTH_WAIT_ASSOC;
+        ifmgd->auth_data->timeout_started = true;
         run_again(ifmgd, ifmgd->auth_data->timeout);
 
         if (ifmgd->auth_data->algorithm == WLAN_AUTH_SAE &&
@@ -2088,10 +2315,6 @@ ieee80211_rx_mgmt_deauth(struct ieee80211_sub_if_data *sdata,
 
         ieee80211_set_disassoc(sdata, 0, 0, false, NULL);
 
-        mutex_lock(&sdata->local->mtx);
-        ieee80211_recalc_idle(sdata->local);
-        mutex_unlock(&sdata->local->mtx);
-
         return RX_MGMT_CFG80211_DEAUTH;
 }
 
@@ -2119,10 +2342,6 @@ ieee80211_rx_mgmt_disassoc(struct ieee80211_sub_if_data *sdata,
 
         ieee80211_set_disassoc(sdata, 0, 0, false, NULL);
 
-        mutex_lock(&sdata->local->mtx);
-        ieee80211_recalc_idle(sdata->local);
-        mutex_unlock(&sdata->local->mtx);
-
         return RX_MGMT_CFG80211_DISASSOC;
 }
 
@@ -2232,6 +2451,24 @@ static bool ieee80211_assoc_success(struct ieee80211_sub_if_data *sdata,
 
         ifmgd->aid = aid;
 
+        /*
+         * We previously checked these in the beacon/probe response, so
+         * they should be present here. This is just a safety net.
+         */
+        if (!(ifmgd->flags & IEEE80211_STA_DISABLE_HT) &&
+            (!elems.wmm_param || !elems.ht_cap_elem || !elems.ht_operation)) {
+                sdata_info(sdata,
+                           "HT AP is missing WMM params or HT capability/operation in AssocResp\n");
+                return false;
+        }
+
+        if (!(ifmgd->flags & IEEE80211_STA_DISABLE_VHT) &&
+            (!elems.vht_cap_elem || !elems.vht_operation)) {
+                sdata_info(sdata,
+                           "VHT AP is missing VHT capability/operation in AssocResp\n");
+                return false;
+        }
+
         mutex_lock(&sdata->local->sta_mtx);
         /*
          * station info was already allocated and inserted before
@@ -2245,17 +2482,36 @@ static bool ieee80211_assoc_success(struct ieee80211_sub_if_data *sdata,
 
         sband = local->hw.wiphy->bands[ieee80211_get_sdata_band(sdata)];
 
+        /* Set up internal HT/VHT capabilities */
         if (elems.ht_cap_elem && !(ifmgd->flags & IEEE80211_STA_DISABLE_HT))
                 ieee80211_ht_cap_ie_to_sta_ht_cap(sdata, sband,
-                                elems.ht_cap_elem, &sta->sta.ht_cap);
-
-        sta->supports_40mhz =
-                sta->sta.ht_cap.cap & IEEE80211_HT_CAP_SUP_WIDTH_20_40;
+                                                  elems.ht_cap_elem, sta);
 
         if (elems.vht_cap_elem && !(ifmgd->flags & IEEE80211_STA_DISABLE_VHT))
                 ieee80211_vht_cap_ie_to_sta_vht_cap(sdata, sband,
-                                                    elems.vht_cap_elem,
-                                                    &sta->sta.vht_cap);
+                                                    elems.vht_cap_elem, sta);
+
+        /*
+         * Some APs, e.g. Netgear WNDR3700, report invalid HT operation data
+         * in their association response, so ignore that data for our own
+         * configuration. If it changed since the last beacon, we'll get the
+         * next beacon and update then.
+         */
+
+        /*
+         * If an operating mode notification IE is present, override the
+         * NSS calculation (that would be done in rate_control_rate_init())
+         * and use the # of streams from that element.
+         */
+        if (elems.opmode_notif &&
+            !(*elems.opmode_notif & IEEE80211_OPMODE_NOTIF_RX_NSS_TYPE_BF)) {
+                u8 nss;
+
+                nss = *elems.opmode_notif & IEEE80211_OPMODE_NOTIF_RX_NSS_MASK;
+                nss >>= IEEE80211_OPMODE_NOTIF_RX_NSS_SHIFT;
+                nss += 1;
+                sta->sta.rx_nss = nss;
+        }
 
         rate_control_rate_init(sta);
 
@@ -2265,9 +2521,7 @@ static bool ieee80211_assoc_success(struct ieee80211_sub_if_data *sdata,
         if (elems.wmm_param)
                 set_sta_flag(sta, WLAN_STA_WME);
 
-        err = sta_info_move_state(sta, IEEE80211_STA_AUTH);
-        if (!err)
-                err = sta_info_move_state(sta, IEEE80211_STA_ASSOC);
+        err = sta_info_move_state(sta, IEEE80211_STA_ASSOC);
         if (!err && !(ifmgd->flags & IEEE80211_STA_CONTROL_PORT))
                 err = sta_info_move_state(sta, IEEE80211_STA_AUTHORIZED);
         if (err) {
@@ -2296,11 +2550,6 @@ static bool ieee80211_assoc_success(struct ieee80211_sub_if_data *sdata,
                 ieee80211_set_wmm_default(sdata, false);
         changed |= BSS_CHANGED_QOS;
 
-        if (elems.ht_operation && elems.wmm_param &&
-            !(ifmgd->flags & IEEE80211_STA_DISABLE_HT))
-                changed |= ieee80211_config_ht_tx(sdata, elems.ht_operation,
-                                                  cbss->bssid, false);
-
         /* set AID and assoc capability,
          * ieee80211_set_associated() will tell the driver */
         bss_conf->aid = aid;
@@ -2374,6 +2623,7 @@ ieee80211_rx_mgmt_assoc_resp(struct ieee80211_sub_if_data *sdata,
                            "%pM rejected association temporarily; comeback duration %u TU (%u ms)\n",
                            mgmt->sa, tu, ms);
                 assoc_data->timeout = jiffies + msecs_to_jiffies(ms);
+                assoc_data->timeout_started = true;
                 if (ms > IEEE80211_ASSOC_TIMEOUT)
                         run_again(ifmgd, assoc_data->timeout);
                 return RX_MGMT_NONE;
@@ -2389,7 +2639,7 @@ ieee80211_rx_mgmt_assoc_resp(struct ieee80211_sub_if_data *sdata,
                 if (!ieee80211_assoc_success(sdata, *bss, mgmt, len)) {
                         /* oops -- internal error -- send timeout for now */
                         ieee80211_destroy_assoc_data(sdata, false);
-                        cfg80211_put_bss(*bss);
+                        cfg80211_put_bss(sdata->local->hw.wiphy, *bss);
                         return RX_MGMT_CFG80211_ASSOC_TIMEOUT;
                 }
                 sdata_info(sdata, "associated\n");
@@ -2425,7 +2675,7 @@ static void ieee80211_rx_bss_info(struct ieee80211_sub_if_data *sdata,
                 need_ps = sdata->u.mgd.associated && !sdata->u.mgd.dtim_period;
 
                 if (elems->tim && !elems->parse_error) {
-                        struct ieee80211_tim_ie *tim_ie = elems->tim;
+                        const struct ieee80211_tim_ie *tim_ie = elems->tim;
                         sdata->u.mgd.dtim_period = tim_ie->dtim_period;
                 }
         }
@@ -2497,6 +2747,7 @@ static void ieee80211_rx_mgmt_probe_resp(struct ieee80211_sub_if_data *sdata,
                 sdata_info(sdata, "direct probe responded\n");
                 ifmgd->auth_data->tries = 0;
                 ifmgd->auth_data->timeout = jiffies;
+                ifmgd->auth_data->timeout_started = true;
                 run_again(ifmgd, ifmgd->auth_data->timeout);
         }
 }
@@ -2522,10 +2773,10 @@ static const u64 care_about_ies =
         (1ULL << WLAN_EID_HT_CAPABILITY) |
         (1ULL << WLAN_EID_HT_OPERATION);
 
-static void ieee80211_rx_mgmt_beacon(struct ieee80211_sub_if_data *sdata,
-                                     struct ieee80211_mgmt *mgmt,
-                                     size_t len,
-                                     struct ieee80211_rx_status *rx_status)
+static enum rx_mgmt_action
+ieee80211_rx_mgmt_beacon(struct ieee80211_sub_if_data *sdata,
+                         struct ieee80211_mgmt *mgmt, size_t len,
+                         u8 *deauth_buf, struct ieee80211_rx_status *rx_status)
 {
         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
         struct ieee80211_bss_conf *bss_conf = &sdata->vif.bss_conf;
@@ -2534,6 +2785,7 @@ static void ieee80211_rx_mgmt_beacon(struct ieee80211_sub_if_data *sdata,
         struct ieee80211_local *local = sdata->local;
         struct ieee80211_chanctx_conf *chanctx_conf;
         struct ieee80211_channel *chan;
+        struct sta_info *sta;
         u32 changed = 0;
         bool erp_valid;
         u8 erp_value = 0;
@@ -2545,39 +2797,51 @@ static void ieee80211_rx_mgmt_beacon(struct ieee80211_sub_if_data *sdata,
         /* Process beacon from the current BSS */
         baselen = (u8 *) mgmt->u.beacon.variable - (u8 *) mgmt;
         if (baselen > len)
-                return;
+                return RX_MGMT_NONE;
 
         rcu_read_lock();
         chanctx_conf = rcu_dereference(sdata->vif.chanctx_conf);
         if (!chanctx_conf) {
                 rcu_read_unlock();
-                return;
+                return RX_MGMT_NONE;
         }
 
         if (rx_status->freq != chanctx_conf->def.chan->center_freq) {
                 rcu_read_unlock();
-                return;
+                return RX_MGMT_NONE;
         }
         chan = chanctx_conf->def.chan;
         rcu_read_unlock();
 
-        if (ifmgd->assoc_data && !ifmgd->assoc_data->have_beacon &&
+        if (ifmgd->assoc_data && ifmgd->assoc_data->need_beacon &&
             ether_addr_equal(mgmt->bssid, ifmgd->assoc_data->bss->bssid)) {
                 ieee802_11_parse_elems(mgmt->u.beacon.variable,
                                        len - baselen, &elems);
 
                 ieee80211_rx_bss_info(sdata, mgmt, len, rx_status, &elems);
                 ifmgd->assoc_data->have_beacon = true;
-                ifmgd->assoc_data->sent_assoc = false;
+                ifmgd->assoc_data->need_beacon = false;
+                if (local->hw.flags & IEEE80211_HW_TIMING_BEACON_ONLY) {
+                        sdata->vif.bss_conf.sync_tsf =
+                                le64_to_cpu(mgmt->u.beacon.timestamp);
+                        sdata->vif.bss_conf.sync_device_ts =
+                                rx_status->device_timestamp;
+                        if (elems.tim)
+                                sdata->vif.bss_conf.sync_dtim_count =
+                                        elems.tim->dtim_count;
+                        else
+                                sdata->vif.bss_conf.sync_dtim_count = 0;
+                }
                 /* continue assoc process */
                 ifmgd->assoc_data->timeout = jiffies;
+                ifmgd->assoc_data->timeout_started = true;
                 run_again(ifmgd, ifmgd->assoc_data->timeout);
-                return;
+                return RX_MGMT_NONE;
         }
 
         if (!ifmgd->associated ||
             !ether_addr_equal(mgmt->bssid, ifmgd->associated->bssid))
-                return;
+                return RX_MGMT_NONE;
         bssid = ifmgd->associated->bssid;
 
         /* Track average RSSI from the Beacon frames of the current AP */
@@ -2608,12 +2872,12 @@ static void ieee80211_rx_mgmt_beacon(struct ieee80211_sub_if_data *sdata,
                 if (sig > ifmgd->rssi_max_thold &&
                     (last_sig <= ifmgd->rssi_min_thold || last_sig == 0)) {
                         ifmgd->last_ave_beacon_signal = sig;
-                        drv_rssi_callback(local, RSSI_EVENT_HIGH);
+                        drv_rssi_callback(local, sdata, RSSI_EVENT_HIGH);
                 } else if (sig < ifmgd->rssi_min_thold &&
                            (last_sig >= ifmgd->rssi_max_thold ||
                            last_sig == 0)) {
                         ifmgd->last_ave_beacon_signal = sig;
-                        drv_rssi_callback(local, RSSI_EVENT_LOW);
+                        drv_rssi_callback(local, sdata, RSSI_EVENT_LOW);
                 }
         }
 
@@ -2643,7 +2907,7 @@ static void ieee80211_rx_mgmt_beacon(struct ieee80211_sub_if_data *sdata,
 
         if (ifmgd->flags & IEEE80211_STA_BEACON_POLL) {
                 mlme_dbg_ratelimited(sdata,
-                                     "cancelling probereq poll due to a received beacon\n");
+                                     "cancelling AP probe due to a received beacon\n");
                 mutex_lock(&local->mtx);
                 ifmgd->flags &= ~IEEE80211_STA_BEACON_POLL;
                 ieee80211_run_deferred_scan(local);
@@ -2715,7 +2979,7 @@ static void ieee80211_rx_mgmt_beacon(struct ieee80211_sub_if_data *sdata,
         }
 
         if (ncrc == ifmgd->beacon_crc && ifmgd->beacon_crc_valid)
-                return;
+                return RX_MGMT_NONE;
         ifmgd->beacon_crc = ncrc;
         ifmgd->beacon_crc_valid = true;
 
@@ -2725,6 +2989,32 @@ static void ieee80211_rx_mgmt_beacon(struct ieee80211_sub_if_data *sdata,
                                      elems.wmm_param_len))
                 changed |= BSS_CHANGED_QOS;
 
+        /*
+         * If we haven't had a beacon before, tell the driver about the
+         * DTIM period (and beacon timing if desired) now.
+         */
+        if (!bss_conf->dtim_period) {
+                /* a few bogus AP send dtim_period = 0 or no TIM IE */
+                if (elems.tim)
+                        bss_conf->dtim_period = elems.tim->dtim_period ?: 1;
+                else
+                        bss_conf->dtim_period = 1;
+
+                if (local->hw.flags & IEEE80211_HW_TIMING_BEACON_ONLY) {
+                        sdata->vif.bss_conf.sync_tsf =
+                                le64_to_cpu(mgmt->u.beacon.timestamp);
+                        sdata->vif.bss_conf.sync_device_ts =
+                                rx_status->device_timestamp;
+                        if (elems.tim)
+                                sdata->vif.bss_conf.sync_dtim_count =
+                                        elems.tim->dtim_count;
+                        else
+                                sdata->vif.bss_conf.sync_dtim_count = 0;
+                }
+
+                changed |= BSS_CHANGED_DTIM_PERIOD;
+        }
+
         if (elems.erp_info && elems.erp_info_len >= 1) {
                 erp_valid = true;
                 erp_value = elems.erp_info[0];
@@ -2735,11 +3025,22 @@ static void ieee80211_rx_mgmt_beacon(struct ieee80211_sub_if_data *sdata,
                         le16_to_cpu(mgmt->u.beacon.capab_info),
                         erp_valid, erp_value);
 
+        mutex_lock(&local->sta_mtx);
+        sta = sta_info_get(sdata, bssid);
 
-        if (elems.ht_cap_elem && elems.ht_operation && elems.wmm_param &&
-            !(ifmgd->flags & IEEE80211_STA_DISABLE_HT))
-                changed |= ieee80211_config_ht_tx(sdata, elems.ht_operation,
-                                                  bssid, true);
+        if (ieee80211_config_bw(sdata, sta, elems.ht_operation,
+                                elems.vht_operation, bssid, &changed)) {
+                mutex_unlock(&local->sta_mtx);
+                ieee80211_set_disassoc(sdata, IEEE80211_STYPE_DEAUTH,
+                                       WLAN_REASON_DEAUTH_LEAVING,
+                                       true, deauth_buf);
+                return RX_MGMT_CFG80211_TX_DEAUTH;
+        }
+
+        if (sta && elems.opmode_notif)
+                ieee80211_vht_handle_opmode(sdata, sta, *elems.opmode_notif,
+                                            rx_status->band, true);
+        mutex_unlock(&local->sta_mtx);
 
         if (elems.country_elem && elems.pwr_constr_elem &&
             mgmt->u.probe_resp.capab_info &
@@ -2750,6 +3051,8 @@ static void ieee80211_rx_mgmt_beacon(struct ieee80211_sub_if_data *sdata,
                                                        elems.pwr_constr_elem);
 
         ieee80211_bss_info_change_notify(sdata, changed);
+
+        return RX_MGMT_NONE;
 }
 
 void ieee80211_sta_rx_queued_mgmt(struct ieee80211_sub_if_data *sdata,
@@ -2760,6 +3063,7 @@ void ieee80211_sta_rx_queued_mgmt(struct ieee80211_sub_if_data *sdata,
         struct ieee80211_mgmt *mgmt;
         struct cfg80211_bss *bss = NULL;
         enum rx_mgmt_action rma = RX_MGMT_NONE;
+        u8 deauth_buf[IEEE80211_DEAUTH_FRAME_LEN];
         u16 fc;
 
         rx_status = (struct ieee80211_rx_status *) skb->cb;
@@ -2770,7 +3074,8 @@ void ieee80211_sta_rx_queued_mgmt(struct ieee80211_sub_if_data *sdata,
 
         switch (fc & IEEE80211_FCTL_STYPE) {
         case IEEE80211_STYPE_BEACON:
-                ieee80211_rx_mgmt_beacon(sdata, mgmt, skb->len, rx_status);
+                rma = ieee80211_rx_mgmt_beacon(sdata, mgmt, skb->len,
+                                               deauth_buf, rx_status);
                 break;
         case IEEE80211_STYPE_PROBE_RESP:
                 ieee80211_rx_mgmt_probe_resp(sdata, skb);
@@ -2819,6 +3124,10 @@ void ieee80211_sta_rx_queued_mgmt(struct ieee80211_sub_if_data *sdata,
         case RX_MGMT_CFG80211_ASSOC_TIMEOUT:
                 cfg80211_send_assoc_timeout(sdata->dev, mgmt->bssid);
                 break;
+        case RX_MGMT_CFG80211_TX_DEAUTH:
+                cfg80211_send_deauth(sdata->dev, deauth_buf,
+                                     sizeof(deauth_buf));
+                break;
         default:
                 WARN(1, "unexpected: %d", rma);
         }
@@ -2840,14 +3149,13 @@ static void ieee80211_sta_timer(unsigned long data)
 }
 
 static void ieee80211_sta_connection_lost(struct ieee80211_sub_if_data *sdata,
-                                          u8 *bssid, u8 reason)
+                                          u8 *bssid, u8 reason, bool tx)
 {
-        struct ieee80211_local *local = sdata->local;
         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
         u8 frame_buf[IEEE80211_DEAUTH_FRAME_LEN];
 
         ieee80211_set_disassoc(sdata, IEEE80211_STYPE_DEAUTH, reason,
-                               false, frame_buf);
+                               tx, frame_buf);
         mutex_unlock(&ifmgd->mtx);
 
         /*
@@ -2856,10 +3164,6 @@ static void ieee80211_sta_connection_lost(struct ieee80211_sub_if_data *sdata,
          */
         cfg80211_send_deauth(sdata->dev, frame_buf, IEEE80211_DEAUTH_FRAME_LEN);
 
-        mutex_lock(&local->mtx);
-        ieee80211_recalc_idle(local);
-        mutex_unlock(&local->mtx);
-
         mutex_lock(&ifmgd->mtx);
 }
 
@@ -2868,12 +3172,17 @@ static int ieee80211_probe_auth(struct ieee80211_sub_if_data *sdata)
         struct ieee80211_local *local = sdata->local;
         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
         struct ieee80211_mgd_auth_data *auth_data = ifmgd->auth_data;
+        u32 tx_flags = 0;
 
         lockdep_assert_held(&ifmgd->mtx);
 
         if (WARN_ON_ONCE(!auth_data))
                 return -EINVAL;
 
+        if (local->hw.flags & IEEE80211_HW_REPORTS_TX_ACK_STATUS)
+                tx_flags = IEEE80211_TX_CTL_REQ_TX_STATUS |
+                           IEEE80211_TX_INTFL_MLME_CONN_TX;
+
         auth_data->tries++;
 
         if (auth_data->tries > IEEE80211_AUTH_MAX_TRIES) {
@@ -2910,7 +3219,8 @@ static int ieee80211_probe_auth(struct ieee80211_sub_if_data *sdata)
                 ieee80211_send_auth(sdata, trans, auth_data->algorithm, status,
                                     auth_data->data, auth_data->data_len,
                                     auth_data->bss->bssid,
-                                    auth_data->bss->bssid, NULL, 0, 0);
+                                    auth_data->bss->bssid, NULL, 0, 0,
+                                    tx_flags);
         } else {
                 const u8 *ssidie;
 
@@ -2929,13 +3239,18 @@ static int ieee80211_probe_auth(struct ieee80211_sub_if_data *sdata)
                  * will not answer to direct packet in unassociated state.
                  */
                 ieee80211_send_probe_req(sdata, NULL, ssidie + 2, ssidie[1],
-                                         NULL, 0, (u32) -1, true, false,
+                                         NULL, 0, (u32) -1, true, tx_flags,
                                          auth_data->bss->channel, false);
                 rcu_read_unlock();
         }
 
-        auth_data->timeout = jiffies + IEEE80211_AUTH_TIMEOUT;
-        run_again(ifmgd, auth_data->timeout);
+        if (!(local->hw.flags & IEEE80211_HW_REPORTS_TX_ACK_STATUS)) {
+                auth_data->timeout = jiffies + IEEE80211_AUTH_TIMEOUT;
+                ifmgd->auth_data->timeout_started = true;
+                run_again(ifmgd, auth_data->timeout);
+        } else {
+                auth_data->timeout_started = false;
+        }
 
         return 0;
 }
@@ -2966,12 +3281,29 @@ static int ieee80211_do_assoc(struct ieee80211_sub_if_data *sdata)
                    IEEE80211_ASSOC_MAX_TRIES);
         ieee80211_send_assoc(sdata);
 
-        assoc_data->timeout = jiffies + IEEE80211_ASSOC_TIMEOUT;
-        run_again(&sdata->u.mgd, assoc_data->timeout);
+        if (!(local->hw.flags & IEEE80211_HW_REPORTS_TX_ACK_STATUS)) {
+                assoc_data->timeout = jiffies + IEEE80211_ASSOC_TIMEOUT;
+                assoc_data->timeout_started = true;
+                run_again(&sdata->u.mgd, assoc_data->timeout);
+        } else {
+                assoc_data->timeout_started = false;
+        }
 
         return 0;
 }
 
+void ieee80211_mgd_conn_tx_status(struct ieee80211_sub_if_data *sdata,
+                                  __le16 fc, bool acked)
+{
+        struct ieee80211_local *local = sdata->local;
+
+        sdata->u.mgd.status_fc = fc;
+        sdata->u.mgd.status_acked = acked;
+        sdata->u.mgd.status_received = true;
+
+        ieee80211_queue_work(&local->hw, &sdata->work);
+}
+
 void ieee80211_sta_work(struct ieee80211_sub_if_data *sdata)
 {
         struct ieee80211_local *local = sdata->local;
@@ -2979,7 +3311,36 @@ void ieee80211_sta_work(struct ieee80211_sub_if_data *sdata)
 
         mutex_lock(&ifmgd->mtx);
 
-        if (ifmgd->auth_data &&
+        if (ifmgd->status_received) {
+                __le16 fc = ifmgd->status_fc;
+                bool status_acked = ifmgd->status_acked;
+
+                ifmgd->status_received = false;
+                if (ifmgd->auth_data &&
+                    (ieee80211_is_probe_req(fc) || ieee80211_is_auth(fc))) {
+                        if (status_acked) {
+                                ifmgd->auth_data->timeout =
+                                        jiffies + IEEE80211_AUTH_TIMEOUT_SHORT;
+                                run_again(ifmgd, ifmgd->auth_data->timeout);
+                        } else {
+                                ifmgd->auth_data->timeout = jiffies - 1;
+                        }
+                        ifmgd->auth_data->timeout_started = true;
+                } else if (ifmgd->assoc_data &&
+                           (ieee80211_is_assoc_req(fc) ||
+                            ieee80211_is_reassoc_req(fc))) {
+                        if (status_acked) {
+                                ifmgd->assoc_data->timeout =
+                                        jiffies + IEEE80211_ASSOC_TIMEOUT_SHORT;
+                                run_again(ifmgd, ifmgd->assoc_data->timeout);
+                        } else {
+                                ifmgd->assoc_data->timeout = jiffies - 1;
+                        }
+                        ifmgd->assoc_data->timeout_started = true;
+                }
+        }
+
+        if (ifmgd->auth_data && ifmgd->auth_data->timeout_started &&
             time_after(jiffies, ifmgd->auth_data->timeout)) {
                 if (ifmgd->auth_data->done) {
                         /*
@@ -2998,12 +3359,13 @@ void ieee80211_sta_work(struct ieee80211_sub_if_data *sdata)
                         cfg80211_send_auth_timeout(sdata->dev, bssid);
                         mutex_lock(&ifmgd->mtx);
                 }
-        } else if (ifmgd->auth_data)
+        } else if (ifmgd->auth_data && ifmgd->auth_data->timeout_started)
                 run_again(ifmgd, ifmgd->auth_data->timeout);
 
-        if (ifmgd->assoc_data &&
+        if (ifmgd->assoc_data && ifmgd->assoc_data->timeout_started &&
             time_after(jiffies, ifmgd->assoc_data->timeout)) {
-                if (!ifmgd->assoc_data->have_beacon ||
+                if ((ifmgd->assoc_data->need_beacon &&
+                     !ifmgd->assoc_data->have_beacon) ||
                     ieee80211_do_assoc(sdata)) {
                         u8 bssid[ETH_ALEN];
 
@@ -3015,7 +3377,7 @@ void ieee80211_sta_work(struct ieee80211_sub_if_data *sdata)
                         cfg80211_send_assoc_timeout(sdata->dev, bssid);
                         mutex_lock(&ifmgd->mtx);
                 }
-        } else if (ifmgd->assoc_data)
+        } else if (ifmgd->assoc_data && ifmgd->assoc_data->timeout_started)
                 run_again(ifmgd, ifmgd->assoc_data->timeout);
 
         if (ifmgd->flags & (IEEE80211_STA_BEACON_POLL |
@@ -3046,7 +3408,8 @@ void ieee80211_sta_work(struct ieee80211_sub_if_data *sdata)
                                          "No ack for nullfunc frame to AP %pM, disconnecting.\n",
                                          bssid);
                                 ieee80211_sta_connection_lost(sdata, bssid,
-                                        WLAN_REASON_DISASSOC_DUE_TO_INACTIVITY);
+                                        WLAN_REASON_DISASSOC_DUE_TO_INACTIVITY,
+                                        false);
                         }
                 } else if (time_is_after_jiffies(ifmgd->probe_timeout))
                         run_again(ifmgd, ifmgd->probe_timeout);
@@ -3055,7 +3418,7 @@ void ieee80211_sta_work(struct ieee80211_sub_if_data *sdata)
                                  "Failed to send nullfunc to AP %pM after %dms, disconnecting\n",
                                  bssid, probe_wait_ms);
                         ieee80211_sta_connection_lost(sdata, bssid,
-                                WLAN_REASON_DISASSOC_DUE_TO_INACTIVITY);
+                                WLAN_REASON_DISASSOC_DUE_TO_INACTIVITY, false);
                 } else if (ifmgd->probe_send_count < max_tries) {
                         mlme_dbg(sdata,
                                  "No probe response from AP %pM after %dms, try %d/%i\n",
@@ -3074,15 +3437,11 @@ void ieee80211_sta_work(struct ieee80211_sub_if_data *sdata)
                                     bssid, probe_wait_ms);
 
                         ieee80211_sta_connection_lost(sdata, bssid,
-                                WLAN_REASON_DISASSOC_DUE_TO_INACTIVITY);
+                                WLAN_REASON_DISASSOC_DUE_TO_INACTIVITY, false);
                 }
         }
 
         mutex_unlock(&ifmgd->mtx);
-
-        mutex_lock(&local->mtx);
-        ieee80211_recalc_idle(local);
-        mutex_unlock(&local->mtx);
 }
 
 static void ieee80211_sta_bcn_mon_timer(unsigned long data)
@@ -3094,6 +3453,7 @@ static void ieee80211_sta_bcn_mon_timer(unsigned long data)
         if (local->quiescing)
                 return;
 
+        sdata->u.mgd.connection_loss = false;
         ieee80211_queue_work(&sdata->local->hw,
                              &sdata->u.mgd.beacon_connection_loss_work);
 }
@@ -3169,23 +3529,23 @@ void ieee80211_sta_restart(struct ieee80211_sub_if_data *sdata)
 {
         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
 
-        if (!ifmgd->associated)
+        mutex_lock(&ifmgd->mtx);
+        if (!ifmgd->associated) {
+                mutex_unlock(&ifmgd->mtx);
                 return;
+        }
 
         if (sdata->flags & IEEE80211_SDATA_DISCONNECT_RESUME) {
                 sdata->flags &= ~IEEE80211_SDATA_DISCONNECT_RESUME;
-                mutex_lock(&ifmgd->mtx);
-                if (ifmgd->associated) {
-                        mlme_dbg(sdata,
-                                 "driver requested disconnect after resume\n");
-                        ieee80211_sta_connection_lost(sdata,
-                                ifmgd->associated->bssid,
-                                WLAN_REASON_UNSPECIFIED);
-                        mutex_unlock(&ifmgd->mtx);
-                        return;
-                }
+                mlme_dbg(sdata, "driver requested disconnect after resume\n");
+                ieee80211_sta_connection_lost(sdata,
+                                              ifmgd->associated->bssid,
+                                              WLAN_REASON_UNSPECIFIED,
+                                              true);
                 mutex_unlock(&ifmgd->mtx);
+                return;
         }
+        mutex_unlock(&ifmgd->mtx);
 
         if (test_and_clear_bit(TMR_RUNNING_TIMER, &ifmgd->timers_running))
                 add_timer(&ifmgd->timer);
@@ -3261,201 +3621,6 @@ int ieee80211_max_network_latency(struct notifier_block *nb,
         return 0;
 }
 
-static u32 chandef_downgrade(struct cfg80211_chan_def *c)
-{
-        u32 ret;
-        int tmp;
-
-        switch (c->width) {
-        case NL80211_CHAN_WIDTH_20:
-                c->width = NL80211_CHAN_WIDTH_20_NOHT;
-                ret = IEEE80211_STA_DISABLE_HT | IEEE80211_STA_DISABLE_VHT;
-                break;
-        case NL80211_CHAN_WIDTH_40:
-                c->width = NL80211_CHAN_WIDTH_20;
-                c->center_freq1 = c->chan->center_freq;
-                ret = IEEE80211_STA_DISABLE_40MHZ |
-                      IEEE80211_STA_DISABLE_VHT;
-                break;
-        case NL80211_CHAN_WIDTH_80:
-                tmp = (30 + c->chan->center_freq - c->center_freq1)/20;
-                /* n_P40 */
-                tmp /= 2;
-                /* freq_P40 */
-                c->center_freq1 = c->center_freq1 - 20 + 40 * tmp;
-                c->width = NL80211_CHAN_WIDTH_40;
-                ret = IEEE80211_STA_DISABLE_VHT;
-                break;
-        case NL80211_CHAN_WIDTH_80P80:
-                c->center_freq2 = 0;
-                c->width = NL80211_CHAN_WIDTH_80;
-                ret = IEEE80211_STA_DISABLE_80P80MHZ |
-                      IEEE80211_STA_DISABLE_160MHZ;
-                break;
-        case NL80211_CHAN_WIDTH_160:
-                /* n_P20 */
-                tmp = (70 + c->chan->center_freq - c->center_freq1)/20;
-                /* n_P80 */
-                tmp /= 4;
-                c->center_freq1 = c->center_freq1 - 40 + 80 * tmp;
-                c->width = NL80211_CHAN_WIDTH_80;
-                ret = IEEE80211_STA_DISABLE_80P80MHZ |
-                      IEEE80211_STA_DISABLE_160MHZ;
-                break;
-        default:
-        case NL80211_CHAN_WIDTH_20_NOHT:
-                WARN_ON_ONCE(1);
-                c->width = NL80211_CHAN_WIDTH_20_NOHT;
-                ret = IEEE80211_STA_DISABLE_HT | IEEE80211_STA_DISABLE_VHT;
-                break;
-        }
-
-        WARN_ON_ONCE(!cfg80211_chandef_valid(c));
-
-        return ret;
-}
-
-static u32
-ieee80211_determine_chantype(struct ieee80211_sub_if_data *sdata,
-                             struct ieee80211_supported_band *sband,
-                             struct ieee80211_channel *channel,
-                             const struct ieee80211_ht_operation *ht_oper,
-                             const struct ieee80211_vht_operation *vht_oper,
-                             struct cfg80211_chan_def *chandef)
-{
-        struct cfg80211_chan_def vht_chandef;
-        u32 ht_cfreq, ret;
-
-        chandef->chan = channel;
-        chandef->width = NL80211_CHAN_WIDTH_20_NOHT;
-        chandef->center_freq1 = channel->center_freq;
-        chandef->center_freq2 = 0;
-
-        if (!ht_oper || !sband->ht_cap.ht_supported) {
-                ret = IEEE80211_STA_DISABLE_HT | IEEE80211_STA_DISABLE_VHT;
-                goto out;
-        }
-
-        chandef->width = NL80211_CHAN_WIDTH_20;
-
-        ht_cfreq = ieee80211_channel_to_frequency(ht_oper->primary_chan,
-                                                  channel->band);
-        /* check that channel matches the right operating channel */
-        if (channel->center_freq != ht_cfreq) {
-                /*
-                 * It's possible that some APs are confused here;
-                 * Netgear WNDR3700 sometimes reports 4 higher than
-                 * the actual channel in association responses, but
-                 * since we look at probe response/beacon data here
-                 * it should be OK.
-                 */
-                sdata_info(sdata,
-                           "Wrong control channel: center-freq: %d ht-cfreq: %d ht->primary_chan: %d band: %d - Disabling HT\n",
-                           channel->center_freq, ht_cfreq,
-                           ht_oper->primary_chan, channel->band);
-                ret = IEEE80211_STA_DISABLE_HT | IEEE80211_STA_DISABLE_VHT;
-                goto out;
-        }
-
-        /* check 40 MHz support, if we have it */
-        if (sband->ht_cap.cap & IEEE80211_HT_CAP_SUP_WIDTH_20_40) {
-                switch (ht_oper->ht_param & IEEE80211_HT_PARAM_CHA_SEC_OFFSET) {
-                case IEEE80211_HT_PARAM_CHA_SEC_ABOVE:
-                        chandef->width = NL80211_CHAN_WIDTH_40;
-                        chandef->center_freq1 += 10;
-                        break;
-                case IEEE80211_HT_PARAM_CHA_SEC_BELOW:
-                        chandef->width = NL80211_CHAN_WIDTH_40;
-                        chandef->center_freq1 -= 10;
-                        break;
-                }
-        } else {
-                /* 40 MHz (and 80 MHz) must be supported for VHT */
-                ret = IEEE80211_STA_DISABLE_VHT;
-                goto out;
-        }
-
-        if (!vht_oper || !sband->vht_cap.vht_supported) {
-                ret = IEEE80211_STA_DISABLE_VHT;
-                goto out;
-        }
-
-        vht_chandef.chan = channel;
-        vht_chandef.center_freq1 =
-                ieee80211_channel_to_frequency(vht_oper->center_freq_seg1_idx,
-                                               channel->band);
-        vht_chandef.center_freq2 = 0;
-
-        if (vht_oper->center_freq_seg2_idx)
-                vht_chandef.center_freq2 =
-                        ieee80211_channel_to_frequency(
-                                vht_oper->center_freq_seg2_idx,
-                                channel->band);
-
-        switch (vht_oper->chan_width) {
-        case IEEE80211_VHT_CHANWIDTH_USE_HT:
-                vht_chandef.width = chandef->width;
-                break;
-        case IEEE80211_VHT_CHANWIDTH_80MHZ:
-                vht_chandef.width = NL80211_CHAN_WIDTH_80;
-                break;
-        case IEEE80211_VHT_CHANWIDTH_160MHZ:
-                vht_chandef.width = NL80211_CHAN_WIDTH_160;
-                break;
-        case IEEE80211_VHT_CHANWIDTH_80P80MHZ:
-                vht_chandef.width = NL80211_CHAN_WIDTH_80P80;
-                break;
-        default:
-                sdata_info(sdata,
-                           "AP VHT operation IE has invalid channel width (%d), disable VHT\n",
-                           vht_oper->chan_width);
-                ret = IEEE80211_STA_DISABLE_VHT;
-                goto out;
-        }
-
-        if (!cfg80211_chandef_valid(&vht_chandef)) {
-                sdata_info(sdata,
-                           "AP VHT information is invalid, disable VHT\n");
-                ret = IEEE80211_STA_DISABLE_VHT;
-                goto out;
-        }
-
-        if (cfg80211_chandef_identical(chandef, &vht_chandef)) {
-                ret = 0;
-                goto out;
-        }
-
-        if (!cfg80211_chandef_compatible(chandef, &vht_chandef)) {
-                sdata_info(sdata,
-                           "AP VHT information doesn't match HT, disable VHT\n");
-                ret = IEEE80211_STA_DISABLE_VHT;
-                goto out;
-        }
-
-        *chandef = vht_chandef;
-
-        ret = 0;
-
-        while (!cfg80211_chandef_usable(sdata->local->hw.wiphy, chandef,
-                                        IEEE80211_CHAN_DISABLED)) {
-                if (WARN_ON(chandef->width == NL80211_CHAN_WIDTH_20_NOHT)) {
-                        ret = IEEE80211_STA_DISABLE_HT |
-                              IEEE80211_STA_DISABLE_VHT;
-                        goto out;
-                }
-
-                ret = chandef_downgrade(chandef);
-        }
-
-        if (chandef->width != vht_chandef.width)
-                sdata_info(sdata,
-                           "local regulatory prevented using AP HT/VHT configuration, downgraded\n");
-
-out:
-        WARN_ON_ONCE(!cfg80211_chandef_valid(chandef));
-        return ret;
-}
-
 static u8 ieee80211_ht_vht_rx_chains(struct ieee80211_sub_if_data *sdata,
                                      struct cfg80211_bss *cbss)
 {
@@ -3521,16 +3686,22 @@ static int ieee80211_prep_channel(struct ieee80211_sub_if_data *sdata,
 
         if (!(ifmgd->flags & IEEE80211_STA_DISABLE_HT) &&
             sband->ht_cap.ht_supported) {
-                const u8 *ht_oper_ie;
+                const u8 *ht_oper_ie, *ht_cap;
 
                 ht_oper_ie = ieee80211_bss_get_ie(cbss, WLAN_EID_HT_OPERATION);
                 if (ht_oper_ie && ht_oper_ie[1] >= sizeof(*ht_oper))
                         ht_oper = (void *)(ht_oper_ie + 2);
+
+                ht_cap = ieee80211_bss_get_ie(cbss, WLAN_EID_HT_CAPABILITY);
+                if (!ht_cap || ht_cap[1] < sizeof(struct ieee80211_ht_cap)) {
+                        ifmgd->flags |= IEEE80211_STA_DISABLE_HT;
+                        ht_oper = NULL;
+                }
         }
 
         if (!(ifmgd->flags & IEEE80211_STA_DISABLE_VHT) &&
             sband->vht_cap.vht_supported) {
-                const u8 *vht_oper_ie;
+                const u8 *vht_oper_ie, *vht_cap;
 
                 vht_oper_ie = ieee80211_bss_get_ie(cbss,
                                                    WLAN_EID_VHT_OPERATION);
@@ -3540,15 +3711,21 @@ static int ieee80211_prep_channel(struct ieee80211_sub_if_data *sdata,
                         vht_oper = NULL;
                         sdata_info(sdata,
                                    "AP advertised VHT without HT, disabling both\n");
-                        sdata->flags |= IEEE80211_STA_DISABLE_HT;
-                        sdata->flags |= IEEE80211_STA_DISABLE_VHT;
+                        ifmgd->flags |= IEEE80211_STA_DISABLE_HT;
+                        ifmgd->flags |= IEEE80211_STA_DISABLE_VHT;
+                }
+
+                vht_cap = ieee80211_bss_get_ie(cbss, WLAN_EID_VHT_CAPABILITY);
+                if (!vht_cap || vht_cap[1] < sizeof(struct ieee80211_vht_cap)) {
+                        ifmgd->flags |= IEEE80211_STA_DISABLE_VHT;
+                        vht_oper = NULL;
                 }
         }
 
         ifmgd->flags |= ieee80211_determine_chantype(sdata, sband,
                                                      cbss->channel,
                                                      ht_oper, vht_oper,
-                                                     &chandef);
+                                                     &chandef, true);
 
         sdata->needed_rx_chains = min(ieee80211_ht_vht_rx_chains(sdata, cbss),
                                       local->rx_chains);
@@ -3565,8 +3742,11 @@ static int ieee80211_prep_channel(struct ieee80211_sub_if_data *sdata,
          */
         ret = ieee80211_vif_use_channel(sdata, &chandef,
                                         IEEE80211_CHANCTX_SHARED);
-        while (ret && chandef.width != NL80211_CHAN_WIDTH_20_NOHT)
+        while (ret && chandef.width != NL80211_CHAN_WIDTH_20_NOHT) {
                 ifmgd->flags |= chandef_downgrade(&chandef);
+                ret = ieee80211_vif_use_channel(sdata, &chandef,
+                                                IEEE80211_CHANCTX_SHARED);
+        }
         return ret;
 }
 
@@ -3595,15 +3775,12 @@ static int ieee80211_prep_connection(struct ieee80211_sub_if_data *sdata,
                         return -ENOMEM;
         }
 
-        mutex_lock(&local->mtx);
-        ieee80211_recalc_idle(sdata->local);
-        mutex_unlock(&local->mtx);
-
         if (new_sta) {
                 u32 rates = 0, basic_rates = 0;
                 bool have_higher_than_11mbit;
                 int min_rate = INT_MAX, min_rate_index = -1;
                 struct ieee80211_supported_band *sband;
+                const struct cfg80211_bss_ies *ies;
 
                 sband = local->hw.wiphy->bands[cbss->channel->band];
 
@@ -3647,8 +3824,34 @@ static int ieee80211_prep_connection(struct ieee80211_sub_if_data *sdata,
 
                 /* set timing information */
                 sdata->vif.bss_conf.beacon_int = cbss->beacon_interval;
-                sdata->vif.bss_conf.sync_tsf = cbss->tsf;
-                sdata->vif.bss_conf.sync_device_ts = bss->device_ts;
+                rcu_read_lock();
+                ies = rcu_dereference(cbss->beacon_ies);
+                if (ies) {
+                        const u8 *tim_ie;
+
+                        sdata->vif.bss_conf.sync_tsf = ies->tsf;
+                        sdata->vif.bss_conf.sync_device_ts =
+                                bss->device_ts_beacon;
+                        tim_ie = cfg80211_find_ie(WLAN_EID_TIM,
+                                                  ies->data, ies->len);
+                        if (tim_ie && tim_ie[1] >= 2)
+                                sdata->vif.bss_conf.sync_dtim_count = tim_ie[2];
+                        else
+                                sdata->vif.bss_conf.sync_dtim_count = 0;
+                } else if (!(local->hw.flags &
+                                        IEEE80211_HW_TIMING_BEACON_ONLY)) {
+                        ies = rcu_dereference(cbss->proberesp_ies);
+                        /* must be non-NULL since beacon IEs were NULL */
+                        sdata->vif.bss_conf.sync_tsf = ies->tsf;
+                        sdata->vif.bss_conf.sync_device_ts =
+                                bss->device_ts_presp;
+                        sdata->vif.bss_conf.sync_dtim_count = 0;
+                } else {
+                        sdata->vif.bss_conf.sync_tsf = 0;
+                        sdata->vif.bss_conf.sync_device_ts = 0;
+                        sdata->vif.bss_conf.sync_dtim_count = 0;
+                }
+                rcu_read_unlock();
 
                 /* tell driver about BSSID, basic rates and timing */
                 ieee80211_bss_info_change_notify(sdata,
@@ -3768,7 +3971,7 @@ int ieee80211_mgd_auth(struct ieee80211_sub_if_data *sdata,
         }
 
         /* hold our own reference */
-        cfg80211_ref_bss(auth_data->bss);
+        cfg80211_ref_bss(local->hw.wiphy, auth_data->bss);
         err = 0;
         goto out_unlock;
 
@@ -3791,6 +3994,7 @@ int ieee80211_mgd_assoc(struct ieee80211_sub_if_data *sdata,
         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
         struct ieee80211_bss *bss = (void *)req->bss->priv;
         struct ieee80211_mgd_assoc_data *assoc_data;
+        const struct cfg80211_bss_ies *beacon_ies;
         struct ieee80211_supported_band *sband;
         const u8 *ssidie, *ht_ie, *vht_ie;
         int i, err;
@@ -3956,40 +4160,48 @@ int ieee80211_mgd_assoc(struct ieee80211_sub_if_data *sdata,
         if (err)
                 goto err_clear;
 
-        if (sdata->local->hw.flags & IEEE80211_HW_NEED_DTIM_PERIOD) {
-                const struct cfg80211_bss_ies *beacon_ies;
+        rcu_read_lock();
+        beacon_ies = rcu_dereference(req->bss->beacon_ies);
 
-                rcu_read_lock();
-                beacon_ies = rcu_dereference(req->bss->beacon_ies);
-                if (!beacon_ies) {
-                        /*
-                         * Wait up to one beacon interval ...
-                         * should this be more if we miss one?
-                         */
-                        sdata_info(sdata, "waiting for beacon from %pM\n",
-                                   ifmgd->bssid);
-                        assoc_data->timeout =
-                                TU_TO_EXP_TIME(req->bss->beacon_interval);
-                } else {
-                        const u8 *tim_ie = cfg80211_find_ie(WLAN_EID_TIM,
-                                                            beacon_ies->data,
-                                                            beacon_ies->len);
-                        if (tim_ie && tim_ie[1] >=
-                                        sizeof(struct ieee80211_tim_ie)) {
-                                const struct ieee80211_tim_ie *tim;
-                                tim = (void *)(tim_ie + 2);
-                                ifmgd->dtim_period = tim->dtim_period;
-                        }
-                        assoc_data->have_beacon = true;
-                        assoc_data->sent_assoc = false;
-                        assoc_data->timeout = jiffies;
+        if (sdata->local->hw.flags & IEEE80211_HW_NEED_DTIM_BEFORE_ASSOC &&
+            !beacon_ies) {
+                /*
+                 * Wait up to one beacon interval ...
+                 * should this be more if we miss one?
+                 */
+                sdata_info(sdata, "waiting for beacon from %pM\n",
+                           ifmgd->bssid);
+                assoc_data->timeout = TU_TO_EXP_TIME(req->bss->beacon_interval);
+                assoc_data->timeout_started = true;
+                assoc_data->need_beacon = true;
+        } else if (beacon_ies) {
+                const u8 *tim_ie = cfg80211_find_ie(WLAN_EID_TIM,
+                                                    beacon_ies->data,
+                                                    beacon_ies->len);
+                u8 dtim_count = 0;
+
+                if (tim_ie && tim_ie[1] >= sizeof(struct ieee80211_tim_ie)) {
+                        const struct ieee80211_tim_ie *tim;
+                        tim = (void *)(tim_ie + 2);
+                        ifmgd->dtim_period = tim->dtim_period;
+                        dtim_count = tim->dtim_count;
                 }
-                rcu_read_unlock();
-        } else {
                 assoc_data->have_beacon = true;
-                assoc_data->sent_assoc = false;
                 assoc_data->timeout = jiffies;
+                assoc_data->timeout_started = true;
+
+                if (local->hw.flags & IEEE80211_HW_TIMING_BEACON_ONLY) {
+                        sdata->vif.bss_conf.sync_tsf = beacon_ies->tsf;
+                        sdata->vif.bss_conf.sync_device_ts =
+                                bss->device_ts_beacon;
+                        sdata->vif.bss_conf.sync_dtim_count = dtim_count;
+                }
+        } else {
+                assoc_data->timeout = jiffies;
+                assoc_data->timeout_started = true;
         }
+        rcu_read_unlock();
+
         run_again(ifmgd, assoc_data->timeout);
 
         if (bss->corrupt_data) {
@@ -4056,10 +4268,6 @@ int ieee80211_mgd_deauth(struct ieee80211_sub_if_data *sdata,
         mutex_unlock(&ifmgd->mtx);
 
  out:
-        mutex_lock(&sdata->local->mtx);
-        ieee80211_recalc_idle(sdata->local);
-        mutex_unlock(&sdata->local->mtx);
-
         if (sent_frame)
                 __cfg80211_send_deauth(sdata->dev, frame_buf,
                                        IEEE80211_DEAUTH_FRAME_LEN);
@@ -4100,10 +4308,6 @@ int ieee80211_mgd_disassoc(struct ieee80211_sub_if_data *sdata,
         __cfg80211_send_disassoc(sdata->dev, frame_buf,
                                  IEEE80211_DEAUTH_FRAME_LEN);
 
-        mutex_lock(&sdata->local->mtx);
-        ieee80211_recalc_idle(sdata->local);
-        mutex_unlock(&sdata->local->mtx);
-
         return 0;
 }
 
diff --git a/net/mac80211/offchannel.c b/net/mac80211/offchannel.c
index 82baf5b6ecf4..cc79b4a2e821 100644
--- a/net/mac80211/offchannel.c
+++ b/net/mac80211/offchannel.c
@@ -113,6 +113,15 @@ void ieee80211_offchannel_stop_vifs(struct ieee80211_local *local)
          * notify the AP about us leaving the channel and stop all
          * STA interfaces.
          */
+
+        /*
+         * Stop queues and transmit all frames queued by the driver
+         * before sending nullfunc to enable powersave at the AP.
+         */
+        ieee80211_stop_queues_by_reason(&local->hw,
+                                        IEEE80211_QUEUE_STOP_REASON_OFFCHANNEL);
+        drv_flush(local, false);
+
         mutex_lock(&local->iflist_mtx);
         list_for_each_entry(sdata, &local->interfaces, list) {
                 if (!ieee80211_sdata_running(sdata))
@@ -133,12 +142,9 @@ void ieee80211_offchannel_stop_vifs(struct ieee80211_local *local)
                                 sdata, BSS_CHANGED_BEACON_ENABLED);
                 }
 
-                if (sdata->vif.type != NL80211_IFTYPE_MONITOR) {
-                        netif_tx_stop_all_queues(sdata->dev);
-                        if (sdata->vif.type == NL80211_IFTYPE_STATION &&
-                            sdata->u.mgd.associated)
-                                ieee80211_offchannel_ps_enable(sdata);
-                }
+                if (sdata->vif.type == NL80211_IFTYPE_STATION &&
+                    sdata->u.mgd.associated)
+                        ieee80211_offchannel_ps_enable(sdata);
         }
         mutex_unlock(&local->iflist_mtx);
 }
@@ -166,20 +172,6 @@ void ieee80211_offchannel_return(struct ieee80211_local *local)
                     sdata->u.mgd.associated)
                         ieee80211_offchannel_ps_disable(sdata);
 
-                if (sdata->vif.type != NL80211_IFTYPE_MONITOR) {
-                        /*
-                         * This may wake up queues even though the driver
-                         * currently has them stopped. This is not very
-                         * likely, since the driver won't have gotten any
-                         * (or hardly any) new packets while we weren't
-                         * on the right channel, and even if it happens
-                         * it will at most lead to queueing up one more
-                         * packet per queue in mac80211 rather than on
-                         * the interface qdisc.
-                         */
-                        netif_tx_wake_all_queues(sdata->dev);
-                }
-
                 if (test_and_clear_bit(SDATA_STATE_OFFCHANNEL_BEACON_STOPPED,
                                        &sdata->state)) {
                         sdata->vif.bss_conf.enable_beacon = true;
@@ -188,6 +180,9 @@ void ieee80211_offchannel_return(struct ieee80211_local *local)
                 }
         }
         mutex_unlock(&local->iflist_mtx);
+
+        ieee80211_wake_queues_by_reason(&local->hw,
+                                        IEEE80211_QUEUE_STOP_REASON_OFFCHANNEL);
 }
 
 void ieee80211_handle_roc_started(struct ieee80211_roc_work *roc)
diff --git a/net/mac80211/pm.c b/net/mac80211/pm.c
index e45b83610e85..d0275f34bf70 100644
--- a/net/mac80211/pm.c
+++ b/net/mac80211/pm.c
@@ -38,6 +38,8 @@ int __ieee80211_suspend(struct ieee80211_hw *hw, struct cfg80211_wowlan *wowlan)
 
         ieee80211_scan_cancel(local);
 
+        ieee80211_dfs_cac_cancel(local);
+
         if (hw->flags & IEEE80211_HW_AMPDU_AGGREGATION) {
                 mutex_lock(&local->sta_mtx);
                 list_for_each_entry(sta, &local->sta_list, list) {
@@ -228,3 +230,13 @@ int __ieee80211_suspend(struct ieee80211_hw *hw, struct cfg80211_wowlan *wowlan)
  * ieee80211_reconfig(), which is also needed for hardware
  * hang/firmware failure/etc. recovery.
  */
+
+void ieee80211_report_wowlan_wakeup(struct ieee80211_vif *vif,
+                                    struct cfg80211_wowlan_wakeup *wakeup,
+                                    gfp_t gfp)
+{
+        struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
+
+        cfg80211_report_wowlan_wakeup(&sdata->wdev, wakeup, gfp);
+}
+EXPORT_SYMBOL(ieee80211_report_wowlan_wakeup);
diff --git a/net/mac80211/rate.h b/net/mac80211/rate.h
index 301386dabf88..d35a5dd3fb13 100644
--- a/net/mac80211/rate.h
+++ b/net/mac80211/rate.h
@@ -68,6 +68,8 @@ static inline void rate_control_rate_init(struct sta_info *sta)
         sband = local->hw.wiphy->bands[chanctx_conf->def.chan->band];
         rcu_read_unlock();
 
+        ieee80211_sta_set_rx_nss(sta);
+
         ref->ops->rate_init(ref->priv, sband, ista, priv_sta);
         set_sta_flag(sta, WLAN_STA_RATE_CONTROL);
 }
diff --git a/net/mac80211/rc80211_minstrel.c b/net/mac80211/rc80211_minstrel.c
index 8c5acdc06226..eea45a2c7c35 100644
--- a/net/mac80211/rc80211_minstrel.c
+++ b/net/mac80211/rc80211_minstrel.c
@@ -494,6 +494,33 @@ minstrel_free_sta(void *priv, struct ieee80211_sta *sta, void *priv_sta)
         kfree(mi);
 }
 
+static void
+minstrel_init_cck_rates(struct minstrel_priv *mp)
+{
+        static const int bitrates[4] = { 10, 20, 55, 110 };
+        struct ieee80211_supported_band *sband;
+        int i, j;
+
+        sband = mp->hw->wiphy->bands[IEEE80211_BAND_2GHZ];
+        if (!sband)
+                return;
+
+        for (i = 0, j = 0; i < sband->n_bitrates; i++) {
+                struct ieee80211_rate *rate = &sband->bitrates[i];
+
+                if (rate->flags & IEEE80211_RATE_ERP_G)
+                        continue;
+
+                for (j = 0; j < ARRAY_SIZE(bitrates); j++) {
+                        if (rate->bitrate != bitrates[j])
+                                continue;
+
+                        mp->cck_rates[j] = i;
+                        break;
+                }
+        }
+}
+
 static void *
 minstrel_alloc(struct ieee80211_hw *hw, struct dentry *debugfsdir)
 {
@@ -539,6 +566,8 @@ minstrel_alloc(struct ieee80211_hw *hw, struct dentry *debugfsdir)
                         S_IRUGO | S_IWUGO, debugfsdir, &mp->fixed_rate_idx);
 #endif
 
+        minstrel_init_cck_rates(mp);
+
         return mp;
 }
 
diff --git a/net/mac80211/rc80211_minstrel.h b/net/mac80211/rc80211_minstrel.h
index 5d278eccaef0..5ecf757817f2 100644
--- a/net/mac80211/rc80211_minstrel.h
+++ b/net/mac80211/rc80211_minstrel.h
@@ -79,6 +79,8 @@ struct minstrel_priv {
         unsigned int lookaround_rate;
         unsigned int lookaround_rate_mrr;
 
+        u8 cck_rates[4];
+
 #ifdef CONFIG_MAC80211_DEBUGFS
         /*
          * enable fixed rate processing per RC
diff --git a/net/mac80211/rc80211_minstrel_ht.c b/net/mac80211/rc80211_minstrel_ht.c
index 9f9c453bc45d..3af141c69712 100644
--- a/net/mac80211/rc80211_minstrel_ht.c
+++ b/net/mac80211/rc80211_minstrel_ht.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2010 Felix Fietkau <nbd@openwrt.org>
+ * Copyright (C) 2010-2013 Felix Fietkau <nbd@openwrt.org>
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 2 as
@@ -63,6 +63,30 @@
         }                                                               \
 }
 
+#define CCK_DURATION(_bitrate, _short, _len)            \
+        (10 /* SIFS */ +                                \
+         (_short ? 72 + 24 : 144 + 48 ) +               \
+         (8 * (_len + 4) * 10) / (_bitrate))
+
+#define CCK_ACK_DURATION(_bitrate, _short)                      \
+        (CCK_DURATION((_bitrate > 10 ? 20 : 10), false, 60) +   \
+         CCK_DURATION(_bitrate, _short, AVG_PKT_SIZE))
+
+#define CCK_DURATION_LIST(_short)                       \
+        CCK_ACK_DURATION(10, _short),                   \
+        CCK_ACK_DURATION(20, _short),                   \
+        CCK_ACK_DURATION(55, _short),                   \
+        CCK_ACK_DURATION(110, _short)
+
+#define CCK_GROUP                                               \
+        [MINSTREL_MAX_STREAMS * MINSTREL_STREAM_GROUPS] = {     \
+                .streams = 0,                                   \
+                .duration = {                                   \
+                        CCK_DURATION_LIST(false),               \
+                        CCK_DURATION_LIST(true)                 \
+                }                                               \
+        }
+
 /*
  * To enable sufficiently targeted rate sampling, MCS rates are divided into
  * groups, based on the number of streams and flags (HT40, SGI) that they
@@ -95,8 +119,13 @@ const struct mcs_group minstrel_mcs_groups[] = {
 #if MINSTREL_MAX_STREAMS >= 3
         MCS_GROUP(3, 1, 1),
 #endif
+
+        /* must be last */
+        CCK_GROUP
 };
 
+#define MINSTREL_CCK_GROUP      (ARRAY_SIZE(minstrel_mcs_groups) - 1)
+
 static u8 sample_table[SAMPLE_COLUMNS][MCS_GROUP_RATES];
 
 /*
@@ -119,6 +148,29 @@ minstrel_ht_get_group_idx(struct ieee80211_tx_rate *rate)
                          !!(rate->flags & IEEE80211_TX_RC_40_MHZ_WIDTH));
 }
 
+static struct minstrel_rate_stats *
+minstrel_ht_get_stats(struct minstrel_priv *mp, struct minstrel_ht_sta *mi,
+                      struct ieee80211_tx_rate *rate)
+{
+        int group, idx;
+
+        if (rate->flags & IEEE80211_TX_RC_MCS) {
+                group = minstrel_ht_get_group_idx(rate);
+                idx = rate->idx % MCS_GROUP_RATES;
+        } else {
+                group = MINSTREL_CCK_GROUP;
+
+                for (idx = 0; idx < ARRAY_SIZE(mp->cck_rates); idx++)
+                        if (rate->idx == mp->cck_rates[idx])
+                                break;
+
+                /* short preamble */
+                if (!(mi->groups[group].supported & BIT(idx)))
+                        idx += 4;
+        }
+        return &mi->groups[group].rates[idx];
+}
+
 static inline struct minstrel_rate_stats *
 minstrel_get_ratestats(struct minstrel_ht_sta *mi, int index)
 {
@@ -159,7 +211,7 @@ static void
 minstrel_ht_calc_tp(struct minstrel_ht_sta *mi, int group, int rate)
 {
         struct minstrel_rate_stats *mr;
-        unsigned int usecs;
+        unsigned int usecs = 0;
 
         mr = &mi->groups[group].rates[rate];
 
@@ -168,7 +220,9 @@ minstrel_ht_calc_tp(struct minstrel_ht_sta *mi, int group, int rate)
                 return;
         }
 
-        usecs = mi->overhead / MINSTREL_TRUNC(mi->avg_ampdu_len);
+        if (group != MINSTREL_CCK_GROUP)
+                usecs = mi->overhead / MINSTREL_TRUNC(mi->avg_ampdu_len);
+
         usecs += minstrel_mcs_groups[group].duration[rate];
         mr->cur_tp = MINSTREL_TRUNC((1000000 / usecs) * mr->probability);
 }
@@ -231,10 +285,6 @@ minstrel_ht_update_stats(struct minstrel_priv *mp, struct minstrel_ht_sta *mi)
                         if (!mr->cur_tp)
                                 continue;
 
-                        /* ignore the lowest rate of each single-stream group */
-                        if (!i && minstrel_mcs_groups[group].streams == 1)
-                                continue;
-
                         if ((mr->cur_tp > cur_prob_tp && mr->probability >
                              MINSTREL_FRAC(3, 4)) || mr->probability > cur_prob) {
                                 mg->max_prob_rate = index;
@@ -297,7 +347,7 @@ minstrel_ht_update_stats(struct minstrel_priv *mp, struct minstrel_ht_sta *mi)
 }
 
 static bool
-minstrel_ht_txstat_valid(struct ieee80211_tx_rate *rate)
+minstrel_ht_txstat_valid(struct minstrel_priv *mp, struct ieee80211_tx_rate *rate)
 {
         if (rate->idx < 0)
                 return false;
@@ -305,7 +355,13 @@ minstrel_ht_txstat_valid(struct ieee80211_tx_rate *rate)
         if (!rate->count)
                 return false;
 
-        return !!(rate->flags & IEEE80211_TX_RC_MCS);
+        if (rate->flags & IEEE80211_TX_RC_MCS)
+                return true;
+
+        return rate->idx == mp->cck_rates[0] ||
+               rate->idx == mp->cck_rates[1] ||
+               rate->idx == mp->cck_rates[2] ||
+               rate->idx == mp->cck_rates[3];
 }
 
 static void
@@ -390,7 +446,6 @@ minstrel_ht_tx_status(void *priv, struct ieee80211_supported_band *sband,
         struct minstrel_rate_stats *rate, *rate2;
         struct minstrel_priv *mp = priv;
         bool last;
-        int group;
         int i;
 
         if (!msp->is_ht)
@@ -419,13 +474,12 @@ minstrel_ht_tx_status(void *priv, struct ieee80211_supported_band *sband,
         if (info->flags & IEEE80211_TX_CTL_RATE_CTRL_PROBE)
                 mi->sample_packets += info->status.ampdu_len;
 
-        last = !minstrel_ht_txstat_valid(&ar[0]);
+        last = !minstrel_ht_txstat_valid(mp, &ar[0]);
         for (i = 0; !last; i++) {
                 last = (i == IEEE80211_TX_MAX_RATES - 1) ||
-                       !minstrel_ht_txstat_valid(&ar[i + 1]);
+                       !minstrel_ht_txstat_valid(mp, &ar[i + 1]);
 
-                group = minstrel_ht_get_group_idx(&ar[i]);
-                rate = &mi->groups[group].rates[ar[i].idx % 8];
+                rate = minstrel_ht_get_stats(mp, mi, &ar[i]);
 
                 if (last)
                         rate->success += info->status.ampdu_ack_len;
@@ -451,7 +505,8 @@ minstrel_ht_tx_status(void *priv, struct ieee80211_supported_band *sband,
 
         if (time_after(jiffies, mi->stats_update + (mp->update_interval / 2 * HZ) / 1000)) {
                 minstrel_ht_update_stats(mp, mi);
-                if (!(info->flags & IEEE80211_TX_CTL_AMPDU))
+                if (!(info->flags & IEEE80211_TX_CTL_AMPDU) &&
+                    mi->max_prob_rate / MCS_GROUP_RATES != MINSTREL_CCK_GROUP)
                         minstrel_aggr_check(sta, skb);
         }
 }
@@ -467,6 +522,7 @@ minstrel_calc_retransmit(struct minstrel_priv *mp, struct minstrel_ht_sta *mi,
         unsigned int ctime = 0;
         unsigned int t_slot = 9; /* FIXME */
         unsigned int ampdu_len = MINSTREL_TRUNC(mi->avg_ampdu_len);
+        unsigned int overhead = 0, overhead_rtscts = 0;
 
         mr = minstrel_get_ratestats(mi, index);
         if (mr->probability < MINSTREL_FRAC(1, 10)) {
@@ -488,9 +544,14 @@ minstrel_calc_retransmit(struct minstrel_priv *mp, struct minstrel_ht_sta *mi,
         ctime += (t_slot * cw) >> 1;
         cw = min((cw << 1) | 1, mp->cw_max);
 
+        if (index / MCS_GROUP_RATES != MINSTREL_CCK_GROUP) {
+                overhead = mi->overhead;
+                overhead_rtscts = mi->overhead_rtscts;
+        }
+
         /* Total TX time for data and Contention after first 2 tries */
-        tx_time = ctime + 2 * (mi->overhead + tx_time_data);
-        tx_time_rtscts = ctime + 2 * (mi->overhead_rtscts + tx_time_data);
+        tx_time = ctime + 2 * (overhead + tx_time_data);
+        tx_time_rtscts = ctime + 2 * (overhead_rtscts + tx_time_data);
 
         /* See how many more tries we can fit inside segment size */
         do {
@@ -499,8 +560,8 @@ minstrel_calc_retransmit(struct minstrel_priv *mp, struct minstrel_ht_sta *mi,
                 cw = min((cw << 1) | 1, mp->cw_max);
 
                 /* Total TX time after this try */
-                tx_time += ctime + mi->overhead + tx_time_data;
-                tx_time_rtscts += ctime + mi->overhead_rtscts + tx_time_data;
+                tx_time += ctime + overhead + tx_time_data;
+                tx_time_rtscts += ctime + overhead_rtscts + tx_time_data;
 
                 if (tx_time_rtscts < mp->segment_size)
                         mr->retry_count_rtscts++;
@@ -530,9 +591,16 @@ minstrel_ht_set_rate(struct minstrel_priv *mp, struct minstrel_ht_sta *mi,
         else
                 rate->count = mr->retry_count;
 
-        rate->flags = IEEE80211_TX_RC_MCS | group->flags;
+        rate->flags = 0;
         if (rtscts)
                 rate->flags |= IEEE80211_TX_RC_USE_RTS_CTS;
+
+        if (index / MCS_GROUP_RATES == MINSTREL_CCK_GROUP) {
+                rate->idx = mp->cck_rates[index % ARRAY_SIZE(mp->cck_rates)];
+                return;
+        }
+
+        rate->flags |= IEEE80211_TX_RC_MCS | group->flags;
         rate->idx = index % MCS_GROUP_RATES + (group->streams - 1) * MCS_GROUP_RATES;
 }
 
@@ -596,6 +664,22 @@ minstrel_get_sample_rate(struct minstrel_priv *mp, struct minstrel_ht_sta *mi)
 }
 
 static void
+minstrel_ht_check_cck_shortpreamble(struct minstrel_priv *mp,
+                                    struct minstrel_ht_sta *mi, bool val)
+{
+        u8 supported = mi->groups[MINSTREL_CCK_GROUP].supported;
+
+        if (!supported || !mi->cck_supported_short)
+                return;
+
+        if (supported & (mi->cck_supported_short << (val * 4)))
+                return;
+
+        supported ^= mi->cck_supported_short | (mi->cck_supported_short << 4);
+        mi->groups[MINSTREL_CCK_GROUP].supported = supported;
+}
+
+static void
 minstrel_ht_get_rate(void *priv, struct ieee80211_sta *sta, void *priv_sta,
                      struct ieee80211_tx_rate_control *txrc)
 {
@@ -614,6 +698,7 @@ minstrel_ht_get_rate(void *priv, struct ieee80211_sta *sta, void *priv_sta,
                 return mac80211_minstrel.get_rate(priv, sta, &msp->legacy, txrc);
 
         info->flags |= mi->tx_flags;
+        minstrel_ht_check_cck_shortpreamble(mp, mi, txrc->short_preamble);
 
         /* Don't use EAPOL frames for sampling on non-mrr hw */
         if (mp->hw->max_rates == 1 &&
@@ -687,6 +772,30 @@ minstrel_ht_get_rate(void *priv, struct ieee80211_sta *sta, void *priv_sta,
 }
 
 static void
+minstrel_ht_update_cck(struct minstrel_priv *mp, struct minstrel_ht_sta *mi,
+                       struct ieee80211_supported_band *sband,
+                       struct ieee80211_sta *sta)
+{
+        int i;
+
+        if (sband->band != IEEE80211_BAND_2GHZ)
+                return;
+
+        mi->cck_supported = 0;
+        mi->cck_supported_short = 0;
+        for (i = 0; i < 4; i++) {
+                if (!rate_supported(sta, sband->band, mp->cck_rates[i]))
+                        continue;
+
+                mi->cck_supported |= BIT(i);
+                if (sband->bitrates[i].flags & IEEE80211_RATE_SHORT_PREAMBLE)
+                        mi->cck_supported_short |= BIT(i);
+        }
+
+        mi->groups[MINSTREL_CCK_GROUP].supported = mi->cck_supported;
+}
+
+static void
 minstrel_ht_update_caps(void *priv, struct ieee80211_supported_band *sband,
                         struct ieee80211_sta *sta, void *priv_sta)
 {
@@ -699,14 +808,13 @@ minstrel_ht_update_caps(void *priv, struct ieee80211_supported_band *sband,
         int ack_dur;
         int stbc;
         int i;
-        unsigned int smps;
 
         /* fall back to the old minstrel for legacy stations */
         if (!sta->ht_cap.ht_supported)
                 goto use_legacy;
 
         BUILD_BUG_ON(ARRAY_SIZE(minstrel_mcs_groups) !=
-                MINSTREL_MAX_STREAMS * MINSTREL_STREAM_GROUPS);
+                MINSTREL_MAX_STREAMS * MINSTREL_STREAM_GROUPS + 1);
 
         msp->is_ht = true;
         memset(mi, 0, sizeof(*mi));
@@ -735,28 +843,29 @@ minstrel_ht_update_caps(void *priv, struct ieee80211_supported_band *sband,
         if (sta_cap & IEEE80211_HT_CAP_LDPC_CODING)
                 mi->tx_flags |= IEEE80211_TX_CTL_LDPC;
 
-        smps = (sta_cap & IEEE80211_HT_CAP_SM_PS) >>
-                IEEE80211_HT_CAP_SM_PS_SHIFT;
-
         for (i = 0; i < ARRAY_SIZE(mi->groups); i++) {
-                u16 req = 0;
-
                 mi->groups[i].supported = 0;
-                if (minstrel_mcs_groups[i].flags & IEEE80211_TX_RC_SHORT_GI) {
-                        if (minstrel_mcs_groups[i].flags & IEEE80211_TX_RC_40_MHZ_WIDTH)
-                                req |= IEEE80211_HT_CAP_SGI_40;
-                        else
-                                req |= IEEE80211_HT_CAP_SGI_20;
+                if (i == MINSTREL_CCK_GROUP) {
+                        minstrel_ht_update_cck(mp, mi, sband, sta);
+                        continue;
                 }
 
-                if (minstrel_mcs_groups[i].flags & IEEE80211_TX_RC_40_MHZ_WIDTH)
-                        req |= IEEE80211_HT_CAP_SUP_WIDTH_20_40;
+                if (minstrel_mcs_groups[i].flags & IEEE80211_TX_RC_SHORT_GI) {
+                        if (minstrel_mcs_groups[i].flags & IEEE80211_TX_RC_40_MHZ_WIDTH) {
+                                if (!(sta_cap & IEEE80211_HT_CAP_SGI_40))
+                                        continue;
+                        } else {
+                                if (!(sta_cap & IEEE80211_HT_CAP_SGI_20))
+                                        continue;
+                        }
+                }
 
-                if ((sta_cap & req) != req)
+                if (minstrel_mcs_groups[i].flags & IEEE80211_TX_RC_40_MHZ_WIDTH &&
+                    sta->bandwidth < IEEE80211_STA_RX_BW_40)
                         continue;
 
                 /* Mark MCS > 7 as unsupported if STA is in static SMPS mode */
-                if (smps == WLAN_HT_CAP_SM_PS_STATIC &&
+                if (sta->smps_mode == IEEE80211_SMPS_STATIC &&
                     minstrel_mcs_groups[i].streams > 1)
                         continue;
 
diff --git a/net/mac80211/rc80211_minstrel_ht.h b/net/mac80211/rc80211_minstrel_ht.h
index 462d2b227ed5..302dbd52180d 100644
--- a/net/mac80211/rc80211_minstrel_ht.h
+++ b/net/mac80211/rc80211_minstrel_ht.h
@@ -107,8 +107,11 @@ struct minstrel_ht_sta {
         /* current MCS group to be sampled */
         u8 sample_group;
 
+        u8 cck_supported;
+        u8 cck_supported_short;
+
         /* MCS rate group info and statistics */
-        struct minstrel_mcs_group_data groups[MINSTREL_MAX_STREAMS * MINSTREL_STREAM_GROUPS];
+        struct minstrel_mcs_group_data groups[MINSTREL_MAX_STREAMS * MINSTREL_STREAM_GROUPS + 1];
 };
 
 struct minstrel_ht_sta_priv {
diff --git a/net/mac80211/rc80211_minstrel_ht_debugfs.c b/net/mac80211/rc80211_minstrel_ht_debugfs.c
index e788f76a1dfe..df44a5ad8270 100644
--- a/net/mac80211/rc80211_minstrel_ht_debugfs.c
+++ b/net/mac80211/rc80211_minstrel_ht_debugfs.c
@@ -15,13 +15,76 @@
 #include "rc80211_minstrel.h"
 #include "rc80211_minstrel_ht.h"
 
+static char *
+minstrel_ht_stats_dump(struct minstrel_ht_sta *mi, int i, char *p)
+{
+        unsigned int max_mcs = MINSTREL_MAX_STREAMS * MINSTREL_STREAM_GROUPS;
+        const struct mcs_group *mg;
+        unsigned int j, tp, prob, eprob;
+        char htmode = '2';
+        char gimode = 'L';
+
+        if (!mi->groups[i].supported)
+                return p;
+
+        mg = &minstrel_mcs_groups[i];
+        if (mg->flags & IEEE80211_TX_RC_40_MHZ_WIDTH)
+                htmode = '4';
+        if (mg->flags & IEEE80211_TX_RC_SHORT_GI)
+                gimode = 'S';
+
+        for (j = 0; j < MCS_GROUP_RATES; j++) {
+                struct minstrel_rate_stats *mr = &mi->groups[i].rates[j];
+                static const int bitrates[4] = { 10, 20, 55, 110 };
+                int idx = i * MCS_GROUP_RATES + j;
+
+                if (!(mi->groups[i].supported & BIT(j)))
+                        continue;
+
+                if (i == max_mcs)
+                        p += sprintf(p, "CCK/%cP   ", j < 4 ? 'L' : 'S');
+                else
+                        p += sprintf(p, "HT%c0/%cGI ", htmode, gimode);
+
+                *(p++) = (idx == mi->max_tp_rate) ? 'T' : ' ';
+                *(p++) = (idx == mi->max_tp_rate2) ? 't' : ' ';
+                *(p++) = (idx == mi->max_prob_rate) ? 'P' : ' ';
+
+                if (i == max_mcs) {
+                        int r = bitrates[j % 4];
+                        p += sprintf(p, " %2u.%1uM", r / 10, r % 10);
+                } else {
+                        p += sprintf(p, " MCS%-2u", (mg->streams - 1) *
+                                         MCS_GROUP_RATES + j);
+                }
+
+                tp = mr->cur_tp / 10;
+                prob = MINSTREL_TRUNC(mr->cur_prob * 1000);
+                eprob = MINSTREL_TRUNC(mr->probability * 1000);
+
+                p += sprintf(p, "      %6u.%1u   %6u.%1u    %6u.%1u    "
+                                "%3u            %3u(%3u)  %8llu    %8llu\n",
+                                tp / 10, tp % 10,
+                                eprob / 10, eprob % 10,
+                                prob / 10, prob % 10,
+                                mr->retry_count,
+                                mr->last_success,
+                                mr->last_attempts,
+                                (unsigned long long)mr->succ_hist,
+                                (unsigned long long)mr->att_hist);
+        }
+
+        return p;
+}
+
 static int
 minstrel_ht_stats_open(struct inode *inode, struct file *file)
 {
         struct minstrel_ht_sta_priv *msp = inode->i_private;
         struct minstrel_ht_sta *mi = &msp->ht;
         struct minstrel_debugfs_info *ms;
-        unsigned int i, j, tp, prob, eprob;
+        unsigned int i;
+        unsigned int max_mcs = MINSTREL_MAX_STREAMS * MINSTREL_STREAM_GROUPS;
         char *p;
         int ret;
 
@@ -38,50 +101,13 @@ minstrel_ht_stats_open(struct inode *inode, struct file *file)
 
         file->private_data = ms;
         p = ms->buf;
-        p += sprintf(p, "type      rate     throughput  ewma prob   this prob  "
-                        "this succ/attempt   success    attempts\n");
-        for (i = 0; i < MINSTREL_MAX_STREAMS * MINSTREL_STREAM_GROUPS; i++) {
-                char htmode = '2';
-                char gimode = 'L';
-
-                if (!mi->groups[i].supported)
-                        continue;
-
-                if (minstrel_mcs_groups[i].flags & IEEE80211_TX_RC_40_MHZ_WIDTH)
-                        htmode = '4';
-                if (minstrel_mcs_groups[i].flags & IEEE80211_TX_RC_SHORT_GI)
-                        gimode = 'S';
+        p += sprintf(p, "type         rate     throughput  ewma prob   this prob  "
+                        "retry   this succ/attempt   success    attempts\n");
 
-                for (j = 0; j < MCS_GROUP_RATES; j++) {
-                        struct minstrel_rate_stats *mr = &mi->groups[i].rates[j];
-                        int idx = i * MCS_GROUP_RATES + j;
+        p = minstrel_ht_stats_dump(mi, max_mcs, p);
+        for (i = 0; i < max_mcs; i++)
+                p = minstrel_ht_stats_dump(mi, i, p);
 
-                        if (!(mi->groups[i].supported & BIT(j)))
-                                continue;
-
-                        p += sprintf(p, "HT%c0/%cGI ", htmode, gimode);
-
-                        *(p++) = (idx == mi->max_tp_rate) ? 'T' : ' ';
-                        *(p++) = (idx == mi->max_tp_rate2) ? 't' : ' ';
-                        *(p++) = (idx == mi->max_prob_rate) ? 'P' : ' ';
-                        p += sprintf(p, "MCS%-2u", (minstrel_mcs_groups[i].streams - 1) *
-                                        MCS_GROUP_RATES + j);
-
-                        tp = mr->cur_tp / 10;
-                        prob = MINSTREL_TRUNC(mr->cur_prob * 1000);
-                        eprob = MINSTREL_TRUNC(mr->probability * 1000);
-
-                        p += sprintf(p, "  %6u.%1u   %6u.%1u   %6u.%1u        "
-                                        "%3u(%3u)   %8llu    %8llu\n",
-                                        tp / 10, tp % 10,
-                                        eprob / 10, eprob % 10,
-                                        prob / 10, prob % 10,
-                                        mr->last_success,
-                                        mr->last_attempts,
-                                        (unsigned long long)mr->succ_hist,
-                                        (unsigned long long)mr->att_hist);
-                }
-        }
         p += sprintf(p, "\nTotal packet count::    ideal %d      "
                         "lookaround %d\n",
                         max(0, (int) mi->total_packets - (int) mi->sample_packets),
diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
index a19089565c4b..3acb70b73e22 100644
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -668,9 +668,9 @@ static inline u16 seq_sub(u16 sq1, u16 sq2)
 
 static void ieee80211_release_reorder_frame(struct ieee80211_sub_if_data *sdata,
                                             struct tid_ampdu_rx *tid_agg_rx,
-                                            int index)
+                                            int index,
+                                            struct sk_buff_head *frames)
 {
-        struct ieee80211_local *local = sdata->local;
         struct sk_buff *skb = tid_agg_rx->reorder_buf[index];
         struct ieee80211_rx_status *status;
 
@@ -684,7 +684,7 @@ static void ieee80211_release_reorder_frame(struct ieee80211_sub_if_data *sdata,
         tid_agg_rx->reorder_buf[index] = NULL;
         status = IEEE80211_SKB_RXCB(skb);
         status->rx_flags |= IEEE80211_RX_DEFERRED_RELEASE;
-        skb_queue_tail(&local->rx_skb_queue, skb);
+        __skb_queue_tail(frames, skb);
 
 no_frame:
         tid_agg_rx->head_seq_num = seq_inc(tid_agg_rx->head_seq_num);
@@ -692,7 +692,8 @@ no_frame:
 
 static void ieee80211_release_reorder_frames(struct ieee80211_sub_if_data *sdata,
                                              struct tid_ampdu_rx *tid_agg_rx,
-                                             u16 head_seq_num)
+                                             u16 head_seq_num,
+                                             struct sk_buff_head *frames)
 {
         int index;
 
@@ -701,7 +702,8 @@ static void ieee80211_release_reorder_frames(struct ieee80211_sub_if_data *sdata
         while (seq_less(tid_agg_rx->head_seq_num, head_seq_num)) {
                 index = seq_sub(tid_agg_rx->head_seq_num, tid_agg_rx->ssn) %
                                                         tid_agg_rx->buf_size;
-                ieee80211_release_reorder_frame(sdata, tid_agg_rx, index);
+                ieee80211_release_reorder_frame(sdata, tid_agg_rx, index,
+                                                frames);
         }
 }
 
@@ -717,7 +719,8 @@ static void ieee80211_release_reorder_frames(struct ieee80211_sub_if_data *sdata
 #define HT_RX_REORDER_BUF_TIMEOUT (HZ / 10)
 
 static void ieee80211_sta_reorder_release(struct ieee80211_sub_if_data *sdata,
-                                          struct tid_ampdu_rx *tid_agg_rx)
+                                          struct tid_ampdu_rx *tid_agg_rx,
+                                          struct sk_buff_head *frames)
 {
         int index, j;
 
@@ -746,7 +749,8 @@ static void ieee80211_sta_reorder_release(struct ieee80211_sub_if_data *sdata,
 
                         ht_dbg_ratelimited(sdata,
                                            "release an RX reorder frame due to timeout on earlier frames\n");
-                        ieee80211_release_reorder_frame(sdata, tid_agg_rx, j);
+                        ieee80211_release_reorder_frame(sdata, tid_agg_rx, j,
+                                                        frames);
 
                         /*
                          * Increment the head seq# also for the skipped slots.
@@ -756,7 +760,8 @@ static void ieee80211_sta_reorder_release(struct ieee80211_sub_if_data *sdata,
                         skipped = 0;
                 }
         } else while (tid_agg_rx->reorder_buf[index]) {
-                ieee80211_release_reorder_frame(sdata, tid_agg_rx, index);
+                ieee80211_release_reorder_frame(sdata, tid_agg_rx, index,
+                                                frames);
                 index = seq_sub(tid_agg_rx->head_seq_num, tid_agg_rx->ssn) %
                                                         tid_agg_rx->buf_size;
         }
@@ -788,7 +793,8 @@ static void ieee80211_sta_reorder_release(struct ieee80211_sub_if_data *sdata,
  */
 static bool ieee80211_sta_manage_reorder_buf(struct ieee80211_sub_if_data *sdata,
                                              struct tid_ampdu_rx *tid_agg_rx,
-                                             struct sk_buff *skb)
+                                             struct sk_buff *skb,
+                                             struct sk_buff_head *frames)
 {
         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
         u16 sc = le16_to_cpu(hdr->seq_ctrl);
@@ -816,7 +822,7 @@ static bool ieee80211_sta_manage_reorder_buf(struct ieee80211_sub_if_data *sdata
                 head_seq_num = seq_inc(seq_sub(mpdu_seq_num, buf_size));
                 /* release stored frames up to new head to stack */
                 ieee80211_release_reorder_frames(sdata, tid_agg_rx,
-                                                 head_seq_num);
+                                                 head_seq_num, frames);
         }
 
         /* Now the new frame is always in the range of the reordering buffer */
@@ -846,7 +852,7 @@ static bool ieee80211_sta_manage_reorder_buf(struct ieee80211_sub_if_data *sdata
         tid_agg_rx->reorder_buf[index] = skb;
         tid_agg_rx->reorder_time[index] = jiffies;
         tid_agg_rx->stored_mpdu_num++;
-        ieee80211_sta_reorder_release(sdata, tid_agg_rx);
+        ieee80211_sta_reorder_release(sdata, tid_agg_rx, frames);
 
  out:
         spin_unlock(&tid_agg_rx->reorder_lock);
@@ -857,7 +863,8 @@ static bool ieee80211_sta_manage_reorder_buf(struct ieee80211_sub_if_data *sdata
  * Reorder MPDUs from A-MPDUs, keeping them on a buffer. Returns
  * true if the MPDU was buffered, false if it should be processed.
  */
-static void ieee80211_rx_reorder_ampdu(struct ieee80211_rx_data *rx)
+static void ieee80211_rx_reorder_ampdu(struct ieee80211_rx_data *rx,
+                                       struct sk_buff_head *frames)
 {
         struct sk_buff *skb = rx->skb;
         struct ieee80211_local *local = rx->local;
@@ -922,11 +929,12 @@ static void ieee80211_rx_reorder_ampdu(struct ieee80211_rx_data *rx)
          * sure that we cannot get to it any more before doing
          * anything with it.
          */
-        if (ieee80211_sta_manage_reorder_buf(rx->sdata, tid_agg_rx, skb))
+        if (ieee80211_sta_manage_reorder_buf(rx->sdata, tid_agg_rx, skb,
+                                             frames))
                 return;
 
  dont_reorder:
-        skb_queue_tail(&local->rx_skb_queue, skb);
+        __skb_queue_tail(frames, skb);
 }
 
 static ieee80211_rx_result debug_noinline
@@ -1452,6 +1460,10 @@ ieee80211_rx_h_sta_process(struct ieee80211_rx_data *rx)
                 }
         }
 
+        /* mesh power save support */
+        if (ieee80211_vif_is_mesh(&rx->sdata->vif))
+                ieee80211_mps_rx_h_sta_process(sta, hdr);
+
         /*
          * Drop (qos-)data::nullfunc frames silently, since they
          * are used only to control station power saving mode.
@@ -2090,7 +2102,10 @@ ieee80211_rx_h_mesh_fwding(struct ieee80211_rx_data *rx)
         if (is_multicast_ether_addr(fwd_hdr->addr1)) {
                 IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, fwded_mcast);
                 memcpy(fwd_hdr->addr2, sdata->vif.addr, ETH_ALEN);
+                /* update power mode indication when forwarding */
+                ieee80211_mps_set_frame_flags(sdata, NULL, fwd_hdr);
         } else if (!mesh_nexthop_lookup(fwd_skb, sdata)) {
+                /* mesh power mode flags updated in mesh_nexthop_lookup */
                 IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, fwded_unicast);
         } else {
                 /* unable to resolve next hop */
@@ -2177,7 +2192,7 @@ ieee80211_rx_h_data(struct ieee80211_rx_data *rx)
 }
 
 static ieee80211_rx_result debug_noinline
-ieee80211_rx_h_ctrl(struct ieee80211_rx_data *rx)
+ieee80211_rx_h_ctrl(struct ieee80211_rx_data *rx, struct sk_buff_head *frames)
 {
         struct sk_buff *skb = rx->skb;
         struct ieee80211_bar *bar = (struct ieee80211_bar *)skb->data;
@@ -2216,7 +2231,7 @@ ieee80211_rx_h_ctrl(struct ieee80211_rx_data *rx)
                 spin_lock(&tid_agg_rx->reorder_lock);
                 /* release stored frames up to start of BAR */
                 ieee80211_release_reorder_frames(rx->sdata, tid_agg_rx,
-                                                 start_seq_num);
+                                                 start_seq_num, frames);
                 spin_unlock(&tid_agg_rx->reorder_lock);
 
                 kfree_skb(skb);
@@ -2360,31 +2375,27 @@ ieee80211_rx_h_action(struct ieee80211_rx_data *rx)
                 switch (mgmt->u.action.u.ht_smps.action) {
                 case WLAN_HT_ACTION_SMPS: {
                         struct ieee80211_supported_band *sband;
-                        u8 smps;
+                        enum ieee80211_smps_mode smps_mode;
 
                         /* convert to HT capability */
                         switch (mgmt->u.action.u.ht_smps.smps_control) {
                         case WLAN_HT_SMPS_CONTROL_DISABLED:
-                                smps = WLAN_HT_CAP_SM_PS_DISABLED;
+                                smps_mode = IEEE80211_SMPS_OFF;
                                 break;
                         case WLAN_HT_SMPS_CONTROL_STATIC:
-                                smps = WLAN_HT_CAP_SM_PS_STATIC;
+                                smps_mode = IEEE80211_SMPS_STATIC;
                                 break;
                         case WLAN_HT_SMPS_CONTROL_DYNAMIC:
-                                smps = WLAN_HT_CAP_SM_PS_DYNAMIC;
+                                smps_mode = IEEE80211_SMPS_DYNAMIC;
                                 break;
                         default:
                                 goto invalid;
                         }
-                        smps <<= IEEE80211_HT_CAP_SM_PS_SHIFT;
 
                         /* if no change do nothing */
-                        if ((rx->sta->sta.ht_cap.cap &
-                                        IEEE80211_HT_CAP_SM_PS) == smps)
+                        if (rx->sta->sta.smps_mode == smps_mode)
                                 goto handled;
-
-                        rx->sta->sta.ht_cap.cap &= ~IEEE80211_HT_CAP_SM_PS;
-                        rx->sta->sta.ht_cap.cap |= smps;
+                        rx->sta->sta.smps_mode = smps_mode;
 
                         sband = rx->local->hw.wiphy->bands[status->band];
 
@@ -2395,26 +2406,21 @@ ieee80211_rx_h_action(struct ieee80211_rx_data *rx)
                 case WLAN_HT_ACTION_NOTIFY_CHANWIDTH: {
                         struct ieee80211_supported_band *sband;
                         u8 chanwidth = mgmt->u.action.u.ht_notify_cw.chanwidth;
-                        bool old_40mhz, new_40mhz;
+                        enum ieee80211_sta_rx_bandwidth new_bw;
 
                         /* If it doesn't support 40 MHz it can't change ... */
-                        if (!rx->sta->supports_40mhz)
+                        if (!(rx->sta->sta.ht_cap.cap &
+                                        IEEE80211_HT_CAP_SUP_WIDTH_20_40))
                                 goto handled;
 
-                        old_40mhz = rx->sta->sta.ht_cap.cap &
-                                        IEEE80211_HT_CAP_SUP_WIDTH_20_40;
-                        new_40mhz = chanwidth == IEEE80211_HT_CHANWIDTH_ANY;
+                        if (chanwidth == IEEE80211_HT_CHANWIDTH_20MHZ)
+                                new_bw = IEEE80211_STA_RX_BW_20;
+                        else
+                                new_bw = ieee80211_sta_cur_vht_bw(rx->sta);
 
-                        if (old_40mhz == new_40mhz)
+                        if (rx->sta->sta.bandwidth == new_bw)
                                 goto handled;
 
-                        if (new_40mhz)
-                                rx->sta->sta.ht_cap.cap |=
-                                        IEEE80211_HT_CAP_SUP_WIDTH_20_40;
-                        else
-                                rx->sta->sta.ht_cap.cap &=
-                                        ~IEEE80211_HT_CAP_SUP_WIDTH_20_40;
-
                         sband = rx->local->hw.wiphy->bands[status->band];
 
                         rate_control_rate_update(local, sband, rx->sta,
@@ -2426,6 +2432,37 @@ ieee80211_rx_h_action(struct ieee80211_rx_data *rx)
                 }
 
                 break;
+        case WLAN_CATEGORY_VHT:
+                if (sdata->vif.type != NL80211_IFTYPE_STATION &&
+                    sdata->vif.type != NL80211_IFTYPE_MESH_POINT &&
+                    sdata->vif.type != NL80211_IFTYPE_AP_VLAN &&
+                    sdata->vif.type != NL80211_IFTYPE_AP &&
+                    sdata->vif.type != NL80211_IFTYPE_ADHOC)
+                        break;
+
+                /* verify action code is present */
+                if (len < IEEE80211_MIN_ACTION_SIZE + 1)
+                        goto invalid;
+
+                switch (mgmt->u.action.u.vht_opmode_notif.action_code) {
+                case WLAN_VHT_ACTION_OPMODE_NOTIF: {
+                        u8 opmode;
+
+                        /* verify opmode is present */
+                        if (len < IEEE80211_MIN_ACTION_SIZE + 2)
+                                goto invalid;
+
+                        opmode = mgmt->u.action.u.vht_opmode_notif.operating_mode;
+
+                        ieee80211_vht_handle_opmode(rx->sdata, rx->sta,
+                                                    opmode, status->band,
+                                                    false);
+                        goto handled;
+                }
+                default:
+                        break;
+                }
+                break;
         case WLAN_CATEGORY_BACK:
                 if (sdata->vif.type != NL80211_IFTYPE_STATION &&
                     sdata->vif.type != NL80211_IFTYPE_MESH_POINT &&
@@ -2677,8 +2714,9 @@ ieee80211_rx_h_mgmt(struct ieee80211_rx_data *rx)
                         return RX_DROP_MONITOR;
                 break;
         case cpu_to_le16(IEEE80211_STYPE_PROBE_REQ):
-                /* process only for ibss */
-                if (sdata->vif.type != NL80211_IFTYPE_ADHOC)
+                /* process only for ibss and mesh */
+                if (sdata->vif.type != NL80211_IFTYPE_ADHOC &&
+                    sdata->vif.type != NL80211_IFTYPE_MESH_POINT)
                         return RX_DROP_MONITOR;
                 break;
         default:
@@ -2801,7 +2839,8 @@ static void ieee80211_rx_handlers_result(struct ieee80211_rx_data *rx,
         }
 }
 
-static void ieee80211_rx_handlers(struct ieee80211_rx_data *rx)
+static void ieee80211_rx_handlers(struct ieee80211_rx_data *rx,
+                                  struct sk_buff_head *frames)
 {
         ieee80211_rx_result res = RX_DROP_MONITOR;
         struct sk_buff *skb;
@@ -2813,15 +2852,9 @@ static void ieee80211_rx_handlers(struct ieee80211_rx_data *rx)
                         goto rxh_next;  \
         } while (0);
 
-        spin_lock(&rx->local->rx_skb_queue.lock);
-        if (rx->local->running_rx_handler)
-                goto unlock;
-
-        rx->local->running_rx_handler = true;
-
-        while ((skb = __skb_dequeue(&rx->local->rx_skb_queue))) {
-                spin_unlock(&rx->local->rx_skb_queue.lock);
+        spin_lock_bh(&rx->local->rx_path_lock);
 
+        while ((skb = __skb_dequeue(frames))) {
                 /*
                  * all the other fields are valid across frames
                  * that belong to an aMPDU since they are on the
@@ -2842,7 +2875,12 @@ static void ieee80211_rx_handlers(struct ieee80211_rx_data *rx)
 #endif
                 CALL_RXH(ieee80211_rx_h_amsdu)
                 CALL_RXH(ieee80211_rx_h_data)
-                CALL_RXH(ieee80211_rx_h_ctrl);
+
+                /* special treatment -- needs the queue */
+                res = ieee80211_rx_h_ctrl(rx, frames);
+                if (res != RX_CONTINUE)
+                        goto rxh_next;
+
                 CALL_RXH(ieee80211_rx_h_mgmt_check)
                 CALL_RXH(ieee80211_rx_h_action)
                 CALL_RXH(ieee80211_rx_h_userspace_mgmt)
@@ -2851,20 +2889,20 @@ static void ieee80211_rx_handlers(struct ieee80211_rx_data *rx)
 
  rxh_next:
                 ieee80211_rx_handlers_result(rx, res);
-                spin_lock(&rx->local->rx_skb_queue.lock);
+
 #undef CALL_RXH
         }
 
-        rx->local->running_rx_handler = false;
-
- unlock:
-        spin_unlock(&rx->local->rx_skb_queue.lock);
+        spin_unlock_bh(&rx->local->rx_path_lock);
 }
 
 static void ieee80211_invoke_rx_handlers(struct ieee80211_rx_data *rx)
 {
+        struct sk_buff_head reorder_release;
         ieee80211_rx_result res = RX_DROP_MONITOR;
 
+        __skb_queue_head_init(&reorder_release);
+
 #define CALL_RXH(rxh)                   \
         do {                            \
                 res = rxh(rx);          \
@@ -2874,9 +2912,9 @@ static void ieee80211_invoke_rx_handlers(struct ieee80211_rx_data *rx)
 
         CALL_RXH(ieee80211_rx_h_check)
 
-        ieee80211_rx_reorder_ampdu(rx);
+        ieee80211_rx_reorder_ampdu(rx, &reorder_release);
 
-        ieee80211_rx_handlers(rx);
+        ieee80211_rx_handlers(rx, &reorder_release);
         return;
 
  rxh_next:
@@ -2891,6 +2929,7 @@ static void ieee80211_invoke_rx_handlers(struct ieee80211_rx_data *rx)
  */
 void ieee80211_release_reorder_timeout(struct sta_info *sta, int tid)
 {
+        struct sk_buff_head frames;
         struct ieee80211_rx_data rx = {
                 .sta = sta,
                 .sdata = sta->sdata,
@@ -2906,11 +2945,13 @@ void ieee80211_release_reorder_timeout(struct sta_info *sta, int tid)
         if (!tid_agg_rx)
                 return;
 
+        __skb_queue_head_init(&frames);
+
         spin_lock(&tid_agg_rx->reorder_lock);
-        ieee80211_sta_reorder_release(sta->sdata, tid_agg_rx);
+        ieee80211_sta_reorder_release(sta->sdata, tid_agg_rx, &frames);
         spin_unlock(&tid_agg_rx->reorder_lock);
 
-        ieee80211_rx_handlers(&rx);
+        ieee80211_rx_handlers(&rx, &frames);
 }
 
 /* main receive path */
diff --git a/net/mac80211/scan.c b/net/mac80211/scan.c
index 607684c47d55..43a45cf00e06 100644
--- a/net/mac80211/scan.c
+++ b/net/mac80211/scan.c
@@ -27,22 +27,15 @@
 
 #define IEEE80211_PROBE_DELAY (HZ / 33)
 #define IEEE80211_CHANNEL_TIME (HZ / 33)
-#define IEEE80211_PASSIVE_CHANNEL_TIME (HZ / 8)
-
-static void ieee80211_rx_bss_free(struct cfg80211_bss *cbss)
-{
-        struct ieee80211_bss *bss = (void *)cbss->priv;
-
-        kfree(bss_mesh_id(bss));
-        kfree(bss_mesh_cfg(bss));
-}
+#define IEEE80211_PASSIVE_CHANNEL_TIME (HZ / 9)
 
 void ieee80211_rx_bss_put(struct ieee80211_local *local,
                           struct ieee80211_bss *bss)
 {
         if (!bss)
                 return;
-        cfg80211_put_bss(container_of((void *)bss, struct cfg80211_bss, priv));
+        cfg80211_put_bss(local->hw.wiphy,
+                         container_of((void *)bss, struct cfg80211_bss, priv));
 }
 
 static bool is_uapsd_supported(struct ieee802_11_elems *elems)
@@ -85,10 +78,12 @@ ieee80211_bss_info_update(struct ieee80211_local *local,
         if (!cbss)
                 return NULL;
 
-        cbss->free_priv = ieee80211_rx_bss_free;
         bss = (void *)cbss->priv;
 
-        bss->device_ts = rx_status->device_timestamp;
+        if (beacon)
+                bss->device_ts_beacon = rx_status->device_timestamp;
+        else
+                bss->device_ts_presp = rx_status->device_timestamp;
 
         if (elems->parse_error) {
                 if (beacon)
@@ -146,9 +141,6 @@ ieee80211_bss_info_update(struct ieee80211_local *local,
                         bss->valid_data |= IEEE80211_BSS_VALID_WMM;
         }
 
-        if (!beacon)
-                bss->last_probe_resp = jiffies;
-
         return bss;
 }
 
@@ -342,6 +334,9 @@ static int ieee80211_start_sw_scan(struct ieee80211_local *local)
 
         ieee80211_offchannel_stop_vifs(local);
 
+        /* ensure nullfunc is transmitted before leaving operating channel */
+        drv_flush(local, false);
+
         ieee80211_configure_filter(local);
 
         /* We need to set power level at maximum rate for scanning. */
@@ -356,6 +351,9 @@ static int ieee80211_start_sw_scan(struct ieee80211_local *local)
 static bool ieee80211_can_scan(struct ieee80211_local *local,
                                struct ieee80211_sub_if_data *sdata)
 {
+        if (local->radar_detect_enabled)
+                return false;
+
         if (!list_empty(&local->roc_list))
                 return false;
 
@@ -390,6 +388,11 @@ static void ieee80211_scan_state_send_probe(struct ieee80211_local *local,
         int i;
         struct ieee80211_sub_if_data *sdata;
         enum ieee80211_band band = local->hw.conf.channel->band;
+        u32 tx_flags;
+
+        tx_flags = IEEE80211_TX_INTFL_OFFCHAN_TX_OK;
+        if (local->scan_req->no_cck)
+                tx_flags |= IEEE80211_TX_CTL_NO_CCK_RATE;
 
         sdata = rcu_dereference_protected(local->scan_sdata,
                                           lockdep_is_held(&local->mtx));
@@ -401,8 +404,7 @@ static void ieee80211_scan_state_send_probe(struct ieee80211_local *local,
                         local->scan_req->ssids[i].ssid_len,
                         local->scan_req->ie, local->scan_req->ie_len,
                         local->scan_req->rates[band], false,
-                        local->scan_req->no_cck,
-                        local->hw.conf.channel, true);
+                        tx_flags, local->hw.conf.channel, true);
 
         /*
          * After sending probe requests, wait for probe responses
@@ -546,8 +548,6 @@ static void ieee80211_scan_state_decision(struct ieee80211_local *local,
         bool associated = false;
         bool tx_empty = true;
         bool bad_latency;
-        bool listen_int_exceeded;
-        unsigned long min_beacon_int = 0;
         struct ieee80211_sub_if_data *sdata;
         struct ieee80211_channel *next_chan;
         enum mac80211_scan_state next_scan_state;
@@ -566,11 +566,6 @@ static void ieee80211_scan_state_decision(struct ieee80211_local *local,
                         if (sdata->u.mgd.associated) {
                                 associated = true;
 
-                                if (sdata->vif.bss_conf.beacon_int <
-                                    min_beacon_int || min_beacon_int == 0)
-                                        min_beacon_int =
-                                                sdata->vif.bss_conf.beacon_int;
-
                                 if (!qdisc_all_tx_empty(sdata->dev)) {
                                         tx_empty = false;
                                         break;
@@ -587,34 +582,19 @@ static void ieee80211_scan_state_decision(struct ieee80211_local *local,
          * see if we can scan another channel without interfering
          * with the current traffic situation.
          *
-         * Since we don't know if the AP has pending frames for us
-         * we can only check for our tx queues and use the current
-         * pm_qos requirements for rx. Hence, if no tx traffic occurs
-         * at all we will scan as many channels in a row as the pm_qos
-         * latency allows us to. Additionally we also check for the
-         * currently negotiated listen interval to prevent losing
-         * frames unnecessarily.
-         *
-         * Otherwise switch back to the operating channel.
+         * Keep good latency, do not stay off-channel more than 125 ms.
          */
 
         bad_latency = time_after(jiffies +
-                        ieee80211_scan_get_channel_time(next_chan),
-                        local->leave_oper_channel_time +
-                        usecs_to_jiffies(pm_qos_request(PM_QOS_NETWORK_LATENCY)));
-
-        listen_int_exceeded = time_after(jiffies +
-                        ieee80211_scan_get_channel_time(next_chan),
-                        local->leave_oper_channel_time +
-                        usecs_to_jiffies(min_beacon_int * 1024) *
-                        local->hw.conf.listen_interval);
+                                 ieee80211_scan_get_channel_time(next_chan),
+                                 local->leave_oper_channel_time + HZ / 8);
 
         if (associated && !tx_empty) {
                 if (local->scan_req->flags & NL80211_SCAN_FLAG_LOW_PRIORITY)
                         next_scan_state = SCAN_ABORT;
                 else
                         next_scan_state = SCAN_SUSPEND;
-        } else if (associated && (bad_latency || listen_int_exceeded)) {
+        } else if (associated && bad_latency) {
                 next_scan_state = SCAN_SUSPEND;
         } else {
                 next_scan_state = SCAN_SET_CHANNEL;
diff --git a/net/mac80211/sta_info.c b/net/mac80211/sta_info.c
index 9d864ed5f3da..a79ce820cb50 100644
--- a/net/mac80211/sta_info.c
+++ b/net/mac80211/sta_info.c
@@ -120,6 +120,8 @@ static void cleanup_single_sta(struct sta_info *sta)
                 if (sta->sdata->vif.type == NL80211_IFTYPE_AP ||
                     sta->sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
                         ps = &sdata->bss->ps;
+                else if (ieee80211_vif_is_mesh(&sdata->vif))
+                        ps = &sdata->u.mesh.ps;
                 else
                         return;
 
@@ -135,13 +137,8 @@ static void cleanup_single_sta(struct sta_info *sta)
                 ieee80211_purge_tx_queue(&local->hw, &sta->tx_filtered[ac]);
         }
 
-#ifdef CONFIG_MAC80211_MESH
-        if (ieee80211_vif_is_mesh(&sdata->vif)) {
-                mesh_accept_plinks_update(sdata);
-                mesh_plink_deactivate(sta);
-                del_timer_sync(&sta->plink_timer);
-        }
-#endif
+        if (ieee80211_vif_is_mesh(&sdata->vif))
+                mesh_sta_cleanup(sta);
 
         cancel_work_sync(&sta->drv_unblock_wk);
 
@@ -378,12 +375,9 @@ struct sta_info *sta_info_alloc(struct ieee80211_sub_if_data *sdata,
         for (i = 0; i < IEEE80211_NUM_TIDS; i++)
                 sta->last_seq_ctrl[i] = cpu_to_le16(USHRT_MAX);
 
-        sta_dbg(sdata, "Allocated STA %pM\n", sta->sta.addr);
+        sta->sta.smps_mode = IEEE80211_SMPS_OFF;
 
-#ifdef CONFIG_MAC80211_MESH
-        sta->plink_state = NL80211_PLINK_LISTEN;
-        init_timer(&sta->plink_timer);
-#endif
+        sta_dbg(sdata, "Allocated STA %pM\n", sta->sta.addr);
 
         return sta;
 }
@@ -579,7 +573,6 @@ void sta_info_recalc_tim(struct sta_info *sta)
 {
         struct ieee80211_local *local = sta->local;
         struct ps_data *ps;
-        unsigned long flags;
         bool indicate_tim = false;
         u8 ignore_for_tim = sta->sta.uapsd_queues;
         int ac;
@@ -592,6 +585,12 @@ void sta_info_recalc_tim(struct sta_info *sta)
 
                 ps = &sta->sdata->bss->ps;
                 id = sta->sta.aid;
+#ifdef CONFIG_MAC80211_MESH
+        } else if (ieee80211_vif_is_mesh(&sta->sdata->vif)) {
+                ps = &sta->sdata->u.mesh.ps;
+                /* TIM map only for PLID <= IEEE80211_MAX_AID */
+                id = le16_to_cpu(sta->plid) % IEEE80211_MAX_AID;
+#endif
         } else {
                 return;
         }
@@ -630,7 +629,7 @@ void sta_info_recalc_tim(struct sta_info *sta)
         }
 
  done:
-        spin_lock_irqsave(&local->tim_lock, flags);
+        spin_lock_bh(&local->tim_lock);
 
         if (indicate_tim)
                 __bss_tim_set(ps->tim, id);
@@ -643,7 +642,7 @@ void sta_info_recalc_tim(struct sta_info *sta)
                 local->tim_in_locked_section = false;
         }
 
-        spin_unlock_irqrestore(&local->tim_lock, flags);
+        spin_unlock_bh(&local->tim_lock);
 }
 
 static bool sta_info_buffer_expired(struct sta_info *sta, struct sk_buff *skb)
@@ -750,8 +749,9 @@ static bool sta_info_cleanup_expire_buffered(struct ieee80211_local *local,
         bool have_buffered = false;
         int ac;
 
-        /* This is only necessary for stations on BSS interfaces */
-        if (!sta->sdata->bss)
+        /* This is only necessary for stations on BSS/MBSS interfaces */
+        if (!sta->sdata->bss &&
+            !ieee80211_vif_is_mesh(&sta->sdata->vif))
                 return false;
 
         for (ac = 0; ac < IEEE80211_NUM_ACS; ac++)
@@ -939,6 +939,11 @@ void ieee80211_sta_expire(struct ieee80211_sub_if_data *sdata,
                 if (time_after(jiffies, sta->last_rx + exp_time)) {
                         sta_dbg(sta->sdata, "expiring inactive STA %pM\n",
                                 sta->sta.addr);
+
+                        if (ieee80211_vif_is_mesh(&sdata->vif) &&
+                            test_sta_flag(sta, WLAN_STA_PS_STA))
+                                atomic_dec(&sdata->u.mesh.ps.num_sta_ps);
+
                         WARN_ON(__sta_info_destroy(sta));
                 }
         }
@@ -997,6 +1002,8 @@ static void clear_sta_ps_flags(void *_sta)
         if (sdata->vif.type == NL80211_IFTYPE_AP ||
             sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
                 ps = &sdata->bss->ps;
+        else if (ieee80211_vif_is_mesh(&sdata->vif))
+                ps = &sdata->u.mesh.ps;
         else
                 return;
 
@@ -1114,6 +1121,8 @@ static void ieee80211_send_null_response(struct ieee80211_sub_if_data *sdata,
 
         drv_allow_buffered_frames(local, sta, BIT(tid), 1, reason, false);
 
+        skb->dev = sdata->dev;
+
         rcu_read_lock();
         chanctx_conf = rcu_dereference(sdata->vif.chanctx_conf);
         if (WARN_ON(!chanctx_conf)) {
diff --git a/net/mac80211/sta_info.h b/net/mac80211/sta_info.h
index af7d78aa5523..63dfdb5e91da 100644
--- a/net/mac80211/sta_info.h
+++ b/net/mac80211/sta_info.h
@@ -56,6 +56,8 @@
  * @WLAN_STA_INSERTED: This station is inserted into the hash table.
  * @WLAN_STA_RATE_CONTROL: rate control was initialized for this station.
  * @WLAN_STA_TOFFSET_KNOWN: toffset calculated for this station is valid.
+ * @WLAN_STA_MPSP_OWNER: local STA is owner of a mesh Peer Service Period.
+ * @WLAN_STA_MPSP_RECIPIENT: local STA is recipient of a MPSP.
  */
 enum ieee80211_sta_info_flags {
         WLAN_STA_AUTH,
@@ -78,6 +80,8 @@ enum ieee80211_sta_info_flags {
         WLAN_STA_INSERTED,
         WLAN_STA_RATE_CONTROL,
         WLAN_STA_TOFFSET_KNOWN,
+        WLAN_STA_MPSP_OWNER,
+        WLAN_STA_MPSP_RECIPIENT,
 };
 
 #define ADDBA_RESP_INTERVAL HZ
@@ -282,6 +286,9 @@ struct sta_ampdu_mlme {
  * @t_offset_setpoint: reference timing offset of this sta to be used when
  *      calculating clockdrift
  * @ch_width: peer's channel width
+ * @local_pm: local link-specific power save mode
+ * @peer_pm: peer-specific power save mode towards local STA
+ * @nonpeer_pm: STA power save mode towards non-peer neighbors
  * @debugfs: debug filesystem info
  * @dead: set to true when sta is unlinked
  * @uploaded: set to true when sta is uploaded to the driver
@@ -289,8 +296,9 @@ struct sta_ampdu_mlme {
  * @sta: station information we share with the driver
  * @sta_state: duplicates information about station state (for debug)
  * @beacon_loss_count: number of times beacon loss has triggered
- * @supports_40mhz: tracks whether the station advertised 40 MHz support
- *      as we overwrite its HT parameters with the currently used value
+ * @rcu_head: RCU head used for freeing this station struct
+ * @cur_max_bandwidth: maximum bandwidth to use for TX to the station,
+ *      taken from HT/VHT capabilities or VHT operating mode notification
  */
 struct sta_info {
         /* General information, mostly static */
@@ -379,6 +387,10 @@ struct sta_info {
         s64 t_offset;
         s64 t_offset_setpoint;
         enum nl80211_chan_width ch_width;
+        /* mesh power save */
+        enum nl80211_mesh_power_mode local_pm;
+        enum nl80211_mesh_power_mode peer_pm;
+        enum nl80211_mesh_power_mode nonpeer_pm;
 #endif
 
 #ifdef CONFIG_MAC80211_DEBUGFS
@@ -388,11 +400,11 @@ struct sta_info {
         } debugfs;
 #endif
 
+        enum ieee80211_sta_rx_bandwidth cur_max_bandwidth;
+
         unsigned int lost_packets;
         unsigned int beacon_loss_count;
 
-        bool supports_40mhz;
-
         /* keep last! */
         struct ieee80211_sta sta;
 };
diff --git a/net/mac80211/status.c b/net/mac80211/status.c
index 07d99578a2b1..43439203f4e4 100644
--- a/net/mac80211/status.c
+++ b/net/mac80211/status.c
@@ -335,7 +335,8 @@ static void ieee80211_report_used_skb(struct ieee80211_local *local,
         if (dropped)
                 acked = false;
 
-        if (info->flags & IEEE80211_TX_INTFL_NL80211_FRAME_TX) {
+        if (info->flags & (IEEE80211_TX_INTFL_NL80211_FRAME_TX |
+                           IEEE80211_TX_INTFL_MLME_CONN_TX)) {
                 struct ieee80211_sub_if_data *sdata = NULL;
                 struct ieee80211_sub_if_data *iter_sdata;
                 u64 cookie = (unsigned long)skb;
@@ -357,10 +358,13 @@ static void ieee80211_report_used_skb(struct ieee80211_local *local,
                         sdata = rcu_dereference(local->p2p_sdata);
                 }
 
-                if (!sdata)
+                if (!sdata) {
                         skb->dev = NULL;
-                else if (ieee80211_is_nullfunc(hdr->frame_control) ||
-                         ieee80211_is_qos_nullfunc(hdr->frame_control)) {
+                } else if (info->flags & IEEE80211_TX_INTFL_MLME_CONN_TX) {
+                        ieee80211_mgd_conn_tx_status(sdata, hdr->frame_control,
+                                                     acked);
+                } else if (ieee80211_is_nullfunc(hdr->frame_control) ||
+                           ieee80211_is_qos_nullfunc(hdr->frame_control)) {
                         cfg80211_probe_status(sdata->dev, hdr->addr1,
                                               cookie, acked, GFP_ATOMIC);
                 } else {
@@ -468,6 +472,13 @@ void ieee80211_tx_status(struct ieee80211_hw *hw, struct sk_buff *skb)
                         return;
                 }
 
+                /* mesh Peer Service Period support */
+                if (ieee80211_vif_is_mesh(&sta->sdata->vif) &&
+                    ieee80211_is_data_qos(fc))
+                        ieee80211_mpsp_trigger_process(
+                                        ieee80211_get_qos_ctl(hdr),
+                                        sta, true, acked);
+
                 if ((local->hw.flags & IEEE80211_HW_HAS_RATE_CONTROL) &&
                     (rates_idx != -1))
                         sta->last_tx_rate = info->status.rates[rates_idx];
@@ -502,11 +513,7 @@ void ieee80211_tx_status(struct ieee80211_hw *hw, struct sk_buff *skb)
                                        IEEE80211_BAR_CTRL_TID_INFO_MASK) >>
                                       IEEE80211_BAR_CTRL_TID_INFO_SHIFT;
 
-                                if (local->hw.flags &
-                                    IEEE80211_HW_TEARDOWN_AGGR_ON_BAR_FAIL)
-                                        ieee80211_stop_tx_ba_session(&sta->sta, tid);
-                                else
-                                        ieee80211_set_bar_pending(sta, tid, ssn);
+                                ieee80211_set_bar_pending(sta, tid, ssn);
                         }
                 }
 
diff --git a/net/mac80211/tkip.c b/net/mac80211/tkip.c
index 57e14d59e12f..3ed801d90f1e 100644
--- a/net/mac80211/tkip.c
+++ b/net/mac80211/tkip.c
@@ -177,12 +177,11 @@ void ieee80211_get_tkip_p1k_iv(struct ieee80211_key_conf *keyconf,
         struct ieee80211_key *key = (struct ieee80211_key *)
                         container_of(keyconf, struct ieee80211_key, conf);
         struct tkip_ctx *ctx = &key->u.tkip.tx;
-        unsigned long flags;
 
-        spin_lock_irqsave(&key->u.tkip.txlock, flags);
+        spin_lock_bh(&key->u.tkip.txlock);
         ieee80211_compute_tkip_p1k(key, iv32);
         memcpy(p1k, ctx->p1k, sizeof(ctx->p1k));
-        spin_unlock_irqrestore(&key->u.tkip.txlock, flags);
+        spin_unlock_bh(&key->u.tkip.txlock);
 }
 EXPORT_SYMBOL(ieee80211_get_tkip_p1k_iv);
 
@@ -208,12 +207,11 @@ void ieee80211_get_tkip_p2k(struct ieee80211_key_conf *keyconf,
         const u8 *data = (u8 *)hdr + ieee80211_hdrlen(hdr->frame_control);
         u32 iv32 = get_unaligned_le32(&data[4]);
         u16 iv16 = data[2] | (data[0] << 8);
-        unsigned long flags;
 
-        spin_lock_irqsave(&key->u.tkip.txlock, flags);
+        spin_lock_bh(&key->u.tkip.txlock);
         ieee80211_compute_tkip_p1k(key, iv32);
         tkip_mixing_phase2(tk, ctx, iv16, p2k);
-        spin_unlock_irqrestore(&key->u.tkip.txlock, flags);
+        spin_unlock_bh(&key->u.tkip.txlock);
 }
 EXPORT_SYMBOL(ieee80211_get_tkip_p2k);
 
diff --git a/net/mac80211/trace.h b/net/mac80211/trace.h
index 41861b91daa3..1183c4a4fee5 100644
--- a/net/mac80211/trace.h
+++ b/net/mac80211/trace.h
@@ -36,7 +36,7 @@
                         __entry->control_freq = (c)->chan->center_freq;         \
                         __entry->chan_width = (c)->width;                       \
                         __entry->center_freq1 = (c)->center_freq1;              \
-                        __entry->center_freq1 = (c)->center_freq2;
+                        __entry->center_freq2 = (c)->center_freq2;
 #define CHANDEF_PR_FMT  " control:%d MHz width:%d center: %d/%d MHz"
 #define CHANDEF_PR_ARG  __entry->control_freq, __entry->chan_width,             \
                         __entry->center_freq1, __entry->center_freq2
@@ -340,6 +340,7 @@ TRACE_EVENT(drv_bss_info_changed,
                 __field(u16, assoc_cap)
                 __field(u64, sync_tsf)
                 __field(u32, sync_device_ts)
+                __field(u8, sync_dtim_count)
                 __field(u32, basic_rates)
                 __array(int, mcast_rate, IEEE80211_NUM_BANDS)
                 __field(u16, ht_operation_mode)
@@ -347,8 +348,11 @@ TRACE_EVENT(drv_bss_info_changed,
                 __field(s32, cqm_rssi_hyst);
                 __field(u32, channel_width);
                 __field(u32, channel_cfreq1);
-                __dynamic_array(u32, arp_addr_list, info->arp_addr_cnt);
-                __field(bool, arp_filter_enabled);
+                __dynamic_array(u32, arp_addr_list,
+                                info->arp_addr_cnt > IEEE80211_BSS_ARP_ADDR_LIST_LEN ?
+                                        IEEE80211_BSS_ARP_ADDR_LIST_LEN :
+                                        info->arp_addr_cnt);
+                __field(int, arp_addr_cnt);
                 __field(bool, qos);
                 __field(bool, idle);
                 __field(bool, ps);
@@ -376,6 +380,7 @@ TRACE_EVENT(drv_bss_info_changed,
                 __entry->assoc_cap = info->assoc_capability;
                 __entry->sync_tsf = info->sync_tsf;
                 __entry->sync_device_ts = info->sync_device_ts;
+                __entry->sync_dtim_count = info->sync_dtim_count;
                 __entry->basic_rates = info->basic_rates;
                 memcpy(__entry->mcast_rate, info->mcast_rate,
                        sizeof(__entry->mcast_rate));
@@ -384,9 +389,11 @@ TRACE_EVENT(drv_bss_info_changed,
                 __entry->cqm_rssi_hyst = info->cqm_rssi_hyst;
                 __entry->channel_width = info->chandef.width;
                 __entry->channel_cfreq1 = info->chandef.center_freq1;
+                __entry->arp_addr_cnt = info->arp_addr_cnt;
                 memcpy(__get_dynamic_array(arp_addr_list), info->arp_addr_list,
-                       sizeof(u32) * info->arp_addr_cnt);
-                __entry->arp_filter_enabled = info->arp_filter_enabled;
+                       sizeof(u32) * (info->arp_addr_cnt > IEEE80211_BSS_ARP_ADDR_LIST_LEN ?
+                                        IEEE80211_BSS_ARP_ADDR_LIST_LEN :
+                                        info->arp_addr_cnt));
                 __entry->qos = info->qos;
                 __entry->idle = info->idle;
                 __entry->ps = info->ps;
@@ -1184,23 +1191,26 @@ TRACE_EVENT(drv_set_rekey_data,
 
 TRACE_EVENT(drv_rssi_callback,
         TP_PROTO(struct ieee80211_local *local,
+                 struct ieee80211_sub_if_data *sdata,
                  enum ieee80211_rssi_event rssi_event),
 
-        TP_ARGS(local, rssi_event),
+        TP_ARGS(local, sdata, rssi_event),
 
         TP_STRUCT__entry(
                 LOCAL_ENTRY
+                VIF_ENTRY
                 __field(u32, rssi_event)
         ),
 
         TP_fast_assign(
                 LOCAL_ASSIGN;
+                VIF_ASSIGN;
                 __entry->rssi_event = rssi_event;
         ),
 
         TP_printk(
-                LOCAL_PR_FMT " rssi_event:%d",
-                LOCAL_PR_ARG, __entry->rssi_event
+                LOCAL_PR_FMT VIF_PR_FMT " rssi_event:%d",
+                LOCAL_PR_ARG, VIF_PR_ARG, __entry->rssi_event
         )
 );
 
@@ -1432,6 +1442,14 @@ DEFINE_EVENT(local_only_evt, drv_restart_complete,
         TP_ARGS(local)
 );
 
+#if IS_ENABLED(CONFIG_IPV6)
+DEFINE_EVENT(local_sdata_evt, drv_ipv6_addr_change,
+        TP_PROTO(struct ieee80211_local *local,
+                 struct ieee80211_sub_if_data *sdata),
+        TP_ARGS(local, sdata)
+);
+#endif
+
 /*
  * Tracing for API calls that drivers call.
  */
@@ -1821,6 +1839,48 @@ TRACE_EVENT(stop_queue,
         )
 );
 
+TRACE_EVENT(drv_set_default_unicast_key,
+        TP_PROTO(struct ieee80211_local *local,
+                 struct ieee80211_sub_if_data *sdata,
+                 int key_idx),
+
+        TP_ARGS(local, sdata, key_idx),
+
+        TP_STRUCT__entry(
+                LOCAL_ENTRY
+                VIF_ENTRY
+                __field(int, key_idx)
+        ),
+
+        TP_fast_assign(
+                LOCAL_ASSIGN;
+                VIF_ASSIGN;
+                __entry->key_idx = key_idx;
+        ),
+
+        TP_printk(LOCAL_PR_FMT VIF_PR_FMT " key_idx:%d",
+                  LOCAL_PR_ARG, VIF_PR_ARG, __entry->key_idx)
+);
+
+TRACE_EVENT(api_radar_detected,
+        TP_PROTO(struct ieee80211_local *local),
+
+        TP_ARGS(local),
+
+        TP_STRUCT__entry(
+                LOCAL_ENTRY
+        ),
+
+        TP_fast_assign(
+                LOCAL_ASSIGN;
+        ),
+
+        TP_printk(
+                LOCAL_PR_FMT " radar detected",
+                LOCAL_PR_ARG
+        )
+);
+
 #ifdef CONFIG_MAC80211_MESSAGE_TRACING
 #undef TRACE_SYSTEM
 #define TRACE_SYSTEM mac80211_msg
diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
index f32d68186dbc..fe644f91ae05 100644
--- a/net/mac80211/tx.c
+++ b/net/mac80211/tx.c
@@ -329,6 +329,8 @@ static void purge_old_ps_buffers(struct ieee80211_local *local)
 
                 if (sdata->vif.type == NL80211_IFTYPE_AP)
                         ps = &sdata->u.ap.ps;
+                else if (ieee80211_vif_is_mesh(&sdata->vif))
+                        ps = &sdata->u.mesh.ps;
                 else
                         continue;
 
@@ -372,18 +374,20 @@ ieee80211_tx_h_multicast_ps_buf(struct ieee80211_tx_data *tx)
         /*
          * broadcast/multicast frame
          *
-         * If any of the associated stations is in power save mode,
+         * If any of the associated/peer stations is in power save mode,
          * the frame is buffered to be sent after DTIM beacon frame.
          * This is done either by the hardware or us.
          */
 
-        /* powersaving STAs currently only in AP/VLAN mode */
+        /* powersaving STAs currently only in AP/VLAN/mesh mode */
         if (tx->sdata->vif.type == NL80211_IFTYPE_AP ||
             tx->sdata->vif.type == NL80211_IFTYPE_AP_VLAN) {
                 if (!tx->sdata->bss)
                         return TX_CONTINUE;
 
                 ps = &tx->sdata->bss->ps;
+        } else if (ieee80211_vif_is_mesh(&tx->sdata->vif)) {
+                ps = &tx->sdata->u.mesh.ps;
         } else {
                 return TX_CONTINUE;
         }
@@ -594,7 +598,8 @@ ieee80211_tx_h_select_key(struct ieee80211_tx_data *tx)
                         break;
                 }
 
-                if (unlikely(tx->key && tx->key->flags & KEY_FLAG_TAINTED))
+                if (unlikely(tx->key && tx->key->flags & KEY_FLAG_TAINTED &&
+                             !ieee80211_is_deauth(hdr->frame_control)))
                         return TX_DROP;
 
                 if (!skip_hw && tx->key &&
@@ -1225,6 +1230,21 @@ static bool ieee80211_tx_frags(struct ieee80211_local *local,
                 spin_lock_irqsave(&local->queue_stop_reason_lock, flags);
                 if (local->queue_stop_reasons[q] ||
                     (!txpending && !skb_queue_empty(&local->pending[q]))) {
+                        if (unlikely(info->flags &
+                                        IEEE80211_TX_INTFL_OFFCHAN_TX_OK &&
+                                     local->queue_stop_reasons[q] &
+                                        ~BIT(IEEE80211_QUEUE_STOP_REASON_OFFCHANNEL))) {
+                                /*
+                                 * Drop off-channel frames if queues are stopped
+                                 * for any reason other than off-channel
+                                 * operation. Never queue them.
+                                 */
+                                spin_unlock_irqrestore(
+                                        &local->queue_stop_reason_lock, flags);
+                                ieee80211_purge_tx_queue(&local->hw, skbs);
+                                return true;
+                        }
+
                         /*
                          * Since queue is stopped, queue up frames for later
                          * transmission from the tx-pending tasklet when the
@@ -1472,12 +1492,14 @@ void ieee80211_xmit(struct ieee80211_sub_if_data *sdata, struct sk_buff *skb,
         hdr = (struct ieee80211_hdr *) skb->data;
         info->control.vif = &sdata->vif;
 
-        if (ieee80211_vif_is_mesh(&sdata->vif) &&
-            ieee80211_is_data(hdr->frame_control) &&
-            !is_multicast_ether_addr(hdr->addr1) &&
-            mesh_nexthop_resolve(skb, sdata)) {
-                /* skb queued: don't free */
-                return;
+        if (ieee80211_vif_is_mesh(&sdata->vif)) {
+                if (ieee80211_is_data(hdr->frame_control) &&
+                    is_unicast_ether_addr(hdr->addr1)) {
+                        if (mesh_nexthop_resolve(skb, sdata))
+                                return; /* skb queued: don't free */
+                } else {
+                        ieee80211_mps_set_frame_flags(sdata, NULL, hdr);
+                }
         }
 
         ieee80211_set_qos_hdr(sdata, skb);
@@ -1787,16 +1809,16 @@ netdev_tx_t ieee80211_subif_start_xmit(struct sk_buff *skb,
                         break;
                 /* fall through */
         case NL80211_IFTYPE_AP:
+                if (sdata->vif.type == NL80211_IFTYPE_AP)
+                        chanctx_conf = rcu_dereference(sdata->vif.chanctx_conf);
+                if (!chanctx_conf)
+                        goto fail_rcu;
                 fc |= cpu_to_le16(IEEE80211_FCTL_FROMDS);
                 /* DA BSSID SA */
                 memcpy(hdr.addr1, skb->data, ETH_ALEN);
                 memcpy(hdr.addr2, sdata->vif.addr, ETH_ALEN);
                 memcpy(hdr.addr3, skb->data + ETH_ALEN, ETH_ALEN);
                 hdrlen = 24;
-                if (sdata->vif.type == NL80211_IFTYPE_AP)
-                        chanctx_conf = rcu_dereference(sdata->vif.chanctx_conf);
-                if (!chanctx_conf)
-                        goto fail_rcu;
                 band = chanctx_conf->def.chan->band;
                 break;
         case NL80211_IFTYPE_WDS:
@@ -2342,11 +2364,9 @@ static int ieee80211_beacon_add_tim(struct ieee80211_sub_if_data *sdata,
         if (local->tim_in_locked_section) {
                 __ieee80211_beacon_add_tim(sdata, ps, skb);
         } else {
-                unsigned long flags;
-
-                spin_lock_irqsave(&local->tim_lock, flags);
+                spin_lock(&local->tim_lock);
                 __ieee80211_beacon_add_tim(sdata, ps, skb);
-                spin_unlock_irqrestore(&local->tim_lock, flags);
+                spin_unlock(&local->tim_lock);
         }
 
         return 0;
@@ -2424,66 +2444,26 @@ struct sk_buff *ieee80211_beacon_get_tim(struct ieee80211_hw *hw,
                 hdr->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
                                                  IEEE80211_STYPE_BEACON);
         } else if (ieee80211_vif_is_mesh(&sdata->vif)) {
-                struct ieee80211_mgmt *mgmt;
                 struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
-                u8 *pos;
-                int hdr_len = offsetof(struct ieee80211_mgmt, u.beacon) +
-                              sizeof(mgmt->u.beacon);
+                struct beacon_data *bcn = rcu_dereference(ifmsh->beacon);
 
-#ifdef CONFIG_MAC80211_MESH
-                if (!sdata->u.mesh.mesh_id_len)
+                if (!bcn)
                         goto out;
-#endif
 
                 if (ifmsh->sync_ops)
                         ifmsh->sync_ops->adjust_tbtt(
                                                 sdata);
 
                 skb = dev_alloc_skb(local->tx_headroom +
-                                    hdr_len +
-                                    2 + /* NULL SSID */
-                                    2 + 8 + /* supported rates */
-                                    2 + 3 + /* DS params */
-                                    2 + (IEEE80211_MAX_SUPP_RATES - 8) +
-                                    2 + sizeof(struct ieee80211_ht_cap) +
-                                    2 + sizeof(struct ieee80211_ht_operation) +
-                                    2 + sdata->u.mesh.mesh_id_len +
-                                    2 + sizeof(struct ieee80211_meshconf_ie) +
-                                    sdata->u.mesh.ie_len);
+                                    bcn->head_len +
+                                    256 + /* TIM IE */
+                                    bcn->tail_len);
                 if (!skb)
                         goto out;
-
-                skb_reserve(skb, local->hw.extra_tx_headroom);
-                mgmt = (struct ieee80211_mgmt *) skb_put(skb, hdr_len);
-                memset(mgmt, 0, hdr_len);
-                mgmt->frame_control =
-                    cpu_to_le16(IEEE80211_FTYPE_MGMT | IEEE80211_STYPE_BEACON);
-                eth_broadcast_addr(mgmt->da);
-                memcpy(mgmt->sa, sdata->vif.addr, ETH_ALEN);
-                memcpy(mgmt->bssid, sdata->vif.addr, ETH_ALEN);
-                mgmt->u.beacon.beacon_int =
-                        cpu_to_le16(sdata->vif.bss_conf.beacon_int);
-                mgmt->u.beacon.capab_info |= cpu_to_le16(
-                        sdata->u.mesh.security ? WLAN_CAPABILITY_PRIVACY : 0);
-
-                pos = skb_put(skb, 2);
-                *pos++ = WLAN_EID_SSID;
-                *pos++ = 0x0;
-
-                band = chanctx_conf->def.chan->band;
-
-                if (ieee80211_add_srates_ie(sdata, skb, true, band) ||
-                    mesh_add_ds_params_ie(skb, sdata) ||
-                    ieee80211_add_ext_srates_ie(sdata, skb, true, band) ||
-                    mesh_add_rsn_ie(skb, sdata) ||
-                    mesh_add_ht_cap_ie(skb, sdata) ||
-                    mesh_add_ht_oper_ie(skb, sdata) ||
-                    mesh_add_meshid_ie(skb, sdata) ||
-                    mesh_add_meshconf_ie(skb, sdata) ||
-                    mesh_add_vendor_ies(skb, sdata)) {
-                        pr_err("o11s: couldn't add ies!\n");
-                        goto out;
-                }
+                skb_reserve(skb, local->tx_headroom);
+                memcpy(skb_put(skb, bcn->head_len), bcn->head, bcn->head_len);
+                ieee80211_beacon_add_tim(sdata, &ifmsh->ps, skb);
+                memcpy(skb_put(skb, bcn->tail_len), bcn->tail, bcn->tail_len);
         } else {
                 WARN_ON(1);
                 goto out;
@@ -2733,6 +2713,8 @@ ieee80211_get_buffered_bc(struct ieee80211_hw *hw,
                         goto out;
 
                 ps = &sdata->u.ap.ps;
+        } else if (ieee80211_vif_is_mesh(&sdata->vif)) {
+                ps = &sdata->u.mesh.ps;
         } else {
                 goto out;
         }
@@ -2756,6 +2738,7 @@ ieee80211_get_buffered_bc(struct ieee80211_hw *hw,
                                 cpu_to_le16(IEEE80211_FCTL_MOREDATA);
                 }
 
+                sdata = IEEE80211_DEV_TO_SUB_IF(skb->dev);
                 if (!ieee80211_tx_prepare(sdata, &tx, skb))
                         break;
                 dev_kfree_skb_any(skb);
@@ -2788,6 +2771,8 @@ void __ieee80211_tx_skb_tid_band(struct ieee80211_sub_if_data *sdata,
         skb_set_queue_mapping(skb, ac);
         skb->priority = tid;
 
+        skb->dev = sdata->dev;
+
         /*
          * The other path calling ieee80211_xmit is from the tasklet,
          * and while we can handle concurrent transmissions locking
diff --git a/net/mac80211/util.c b/net/mac80211/util.c
index 7519018ff71a..0f38f43ac62e 100644
--- a/net/mac80211/util.c
+++ b/net/mac80211/util.c
@@ -739,11 +739,7 @@ u32 ieee802_11_parse_elems_crc(u8 *start, size_t len,
                                 if (calc_crc)
                                         crc = crc32_be(crc, pos - 2, elen + 2);
 
-                                if (pos[3] == 1) {
-                                        /* OUI Type 1 - WPA IE */
-                                        elems->wpa = pos;
-                                        elems->wpa_len = elen;
-                                } else if (elen >= 5 && pos[3] == 2) {
+                                if (elen >= 5 && pos[3] == 2) {
                                         /* OUI Type 2 - WMM IE */
                                         if (pos[4] == 0) {
                                                 elems->wmm_info = pos;
@@ -791,6 +787,12 @@ u32 ieee802_11_parse_elems_crc(u8 *start, size_t len,
                         else
                                 elem_parse_failed = true;
                         break;
+                case WLAN_EID_OPMODE_NOTIF:
+                        if (elen > 0)
+                                elems->opmode_notif = pos;
+                        else
+                                elem_parse_failed = true;
+                        break;
                 case WLAN_EID_MESH_ID:
                         elems->mesh_id = pos;
                         elems->mesh_id_len = elen;
@@ -805,6 +807,10 @@ u32 ieee802_11_parse_elems_crc(u8 *start, size_t len,
                         elems->peering = pos;
                         elems->peering_len = elen;
                         break;
+                case WLAN_EID_MESH_AWAKE_WINDOW:
+                        if (elen >= 2)
+                                elems->awake_window = (void *)pos;
+                        break;
                 case WLAN_EID_PREQ:
                         elems->preq = pos;
                         elems->preq_len = elen;
@@ -1029,8 +1035,9 @@ u32 ieee80211_mandatory_rates(struct ieee80211_local *local,
 
 void ieee80211_send_auth(struct ieee80211_sub_if_data *sdata,
                          u16 transaction, u16 auth_alg, u16 status,
-                         u8 *extra, size_t extra_len, const u8 *da,
-                         const u8 *bssid, const u8 *key, u8 key_len, u8 key_idx)
+                         const u8 *extra, size_t extra_len, const u8 *da,
+                         const u8 *bssid, const u8 *key, u8 key_len, u8 key_idx,
+                         u32 tx_flags)
 {
         struct ieee80211_local *local = sdata->local;
         struct sk_buff *skb;
@@ -1063,7 +1070,8 @@ void ieee80211_send_auth(struct ieee80211_sub_if_data *sdata,
                 WARN_ON(err);
         }
 
-        IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT;
+        IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT |
+                                        tx_flags;
         ieee80211_tx_skb(sdata, skb);
 }
 
@@ -1277,7 +1285,7 @@ struct sk_buff *ieee80211_build_probe_req(struct ieee80211_sub_if_data *sdata,
 void ieee80211_send_probe_req(struct ieee80211_sub_if_data *sdata, u8 *dst,
                               const u8 *ssid, size_t ssid_len,
                               const u8 *ie, size_t ie_len,
-                              u32 ratemask, bool directed, bool no_cck,
+                              u32 ratemask, bool directed, u32 tx_flags,
                               struct ieee80211_channel *channel, bool scan)
 {
         struct sk_buff *skb;
@@ -1286,9 +1294,7 @@ void ieee80211_send_probe_req(struct ieee80211_sub_if_data *sdata, u8 *dst,
                                         ssid, ssid_len,
                                         ie, ie_len, directed);
         if (skb) {
-                if (no_cck)
-                        IEEE80211_SKB_CB(skb)->flags |=
-                                IEEE80211_TX_CTL_NO_CCK_RATE;
+                IEEE80211_SKB_CB(skb)->flags |= tx_flags;
                 if (scan)
                         ieee80211_tx_skb_tid_band(sdata, skb, 7, channel->band);
                 else
@@ -1538,6 +1544,10 @@ int ieee80211_reconfig(struct ieee80211_local *local)
                         changed |= BSS_CHANGED_ASSOC |
                                    BSS_CHANGED_ARP_FILTER |
                                    BSS_CHANGED_PS;
+
+                        if (sdata->u.mgd.dtim_period)
+                                changed |= BSS_CHANGED_DTIM_PERIOD;
+
                         mutex_lock(&sdata->u.mgd.mtx);
                         ieee80211_bss_info_change_notify(sdata, changed);
                         mutex_unlock(&sdata->u.mgd.mtx);
@@ -1937,7 +1947,7 @@ u8 *ieee80211_ie_build_ht_oper(u8 *pos, struct ieee80211_sta_ht_cap *ht_cap,
 }
 
 void ieee80211_ht_oper_to_chandef(struct ieee80211_channel *control_chan,
-                                  struct ieee80211_ht_operation *ht_oper,
+                                  const struct ieee80211_ht_operation *ht_oper,
                                   struct cfg80211_chan_def *chandef)
 {
         enum nl80211_channel_type channel_type;
@@ -2125,3 +2135,49 @@ u64 ieee80211_calculate_rx_timestamp(struct ieee80211_local *local,
 
         return ts;
 }
+
+void ieee80211_dfs_cac_cancel(struct ieee80211_local *local)
+{
+        struct ieee80211_sub_if_data *sdata;
+
+        mutex_lock(&local->iflist_mtx);
+        list_for_each_entry(sdata, &local->interfaces, list) {
+                cancel_delayed_work_sync(&sdata->dfs_cac_timer_work);
+
+                if (sdata->wdev.cac_started) {
+                        ieee80211_vif_release_channel(sdata);
+                        cfg80211_cac_event(sdata->dev,
+                                           NL80211_RADAR_CAC_ABORTED,
+                                           GFP_KERNEL);
+                }
+        }
+        mutex_unlock(&local->iflist_mtx);
+}
+
+void ieee80211_dfs_radar_detected_work(struct work_struct *work)
+{
+        struct ieee80211_local *local =
+                container_of(work, struct ieee80211_local, radar_detected_work);
+        struct cfg80211_chan_def chandef;
+
+        ieee80211_dfs_cac_cancel(local);
+
+        if (local->use_chanctx)
+                /* currently not handled */
+                WARN_ON(1);
+        else {
+                cfg80211_chandef_create(&chandef, local->hw.conf.channel,
+                                        local->hw.conf.channel_type);
+                cfg80211_radar_event(local->hw.wiphy, &chandef, GFP_KERNEL);
+        }
+}
+
+void ieee80211_radar_detected(struct ieee80211_hw *hw)
+{
+        struct ieee80211_local *local = hw_to_local(hw);
+
+        trace_api_radar_detected(local);
+
+        ieee80211_queue_work(hw, &local->radar_detected_work);
+}
+EXPORT_SYMBOL(ieee80211_radar_detected);
diff --git a/net/mac80211/vht.c b/net/mac80211/vht.c
index f311388aeedf..a2c2258bc84e 100644
--- a/net/mac80211/vht.c
+++ b/net/mac80211/vht.c
@@ -10,21 +10,29 @@
 #include <linux/export.h>
 #include <net/mac80211.h>
 #include "ieee80211_i.h"
+#include "rate.h"
 
 
-void ieee80211_vht_cap_ie_to_sta_vht_cap(struct ieee80211_sub_if_data *sdata,
-                                         struct ieee80211_supported_band *sband,
-                                         struct ieee80211_vht_cap *vht_cap_ie,
-                                         struct ieee80211_sta_vht_cap *vht_cap)
+void
+ieee80211_vht_cap_ie_to_sta_vht_cap(struct ieee80211_sub_if_data *sdata,
+                                    struct ieee80211_supported_band *sband,
+                                    const struct ieee80211_vht_cap *vht_cap_ie,
+                                    struct sta_info *sta)
 {
-        if (WARN_ON_ONCE(!vht_cap))
-                return;
+        struct ieee80211_sta_vht_cap *vht_cap = &sta->sta.vht_cap;
 
         memset(vht_cap, 0, sizeof(*vht_cap));
 
+        if (!sta->sta.ht_cap.ht_supported)
+                return;
+
         if (!vht_cap_ie || !sband->vht_cap.vht_supported)
                 return;
 
+        /* A VHT STA must support 40 MHz */
+        if (!(sta->sta.ht_cap.cap & IEEE80211_HT_CAP_SUP_WIDTH_20_40))
+                return;
+
         vht_cap->vht_supported = true;
 
         vht_cap->cap = le32_to_cpu(vht_cap_ie->vht_cap_info);
@@ -32,4 +40,156 @@ void ieee80211_vht_cap_ie_to_sta_vht_cap(struct ieee80211_sub_if_data *sdata,
         /* Copy peer MCS info, the driver might need them. */
         memcpy(&vht_cap->vht_mcs, &vht_cap_ie->supp_mcs,
                sizeof(struct ieee80211_vht_mcs_info));
+
+        switch (vht_cap->cap & IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_MASK) {
+        case IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160MHZ:
+        case IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160_80PLUS80MHZ:
+                sta->cur_max_bandwidth = IEEE80211_STA_RX_BW_160;
+                break;
+        default:
+                sta->cur_max_bandwidth = IEEE80211_STA_RX_BW_80;
+        }
+
+        sta->sta.bandwidth = ieee80211_sta_cur_vht_bw(sta);
+}
+
+enum ieee80211_sta_rx_bandwidth ieee80211_sta_cur_vht_bw(struct sta_info *sta)
+{
+        struct ieee80211_sub_if_data *sdata = sta->sdata;
+        u32 cap = sta->sta.vht_cap.cap;
+        enum ieee80211_sta_rx_bandwidth bw;
+
+        if (!sta->sta.vht_cap.vht_supported) {
+                bw = sta->sta.ht_cap.cap & IEEE80211_HT_CAP_SUP_WIDTH_20_40 ?
+                                IEEE80211_STA_RX_BW_40 : IEEE80211_STA_RX_BW_20;
+                goto check_max;
+        }
+
+        switch (sdata->vif.bss_conf.chandef.width) {
+        default:
+                WARN_ON_ONCE(1);
+                /* fall through */
+        case NL80211_CHAN_WIDTH_20_NOHT:
+        case NL80211_CHAN_WIDTH_20:
+        case NL80211_CHAN_WIDTH_40:
+                bw = sta->sta.ht_cap.cap & IEEE80211_HT_CAP_SUP_WIDTH_20_40 ?
+                                IEEE80211_STA_RX_BW_40 : IEEE80211_STA_RX_BW_20;
+                break;
+        case NL80211_CHAN_WIDTH_160:
+                if ((cap & IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_MASK) ==
+                                IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160MHZ) {
+                        bw = IEEE80211_STA_RX_BW_160;
+                        break;
+                }
+                /* fall through */
+        case NL80211_CHAN_WIDTH_80P80:
+                if ((cap & IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_MASK) ==
+                                IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160_80PLUS80MHZ) {
+                        bw = IEEE80211_STA_RX_BW_160;
+                        break;
+                }
+                /* fall through */
+        case NL80211_CHAN_WIDTH_80:
+                bw = IEEE80211_STA_RX_BW_80;
+        }
+
+ check_max:
+        if (bw > sta->cur_max_bandwidth)
+                bw = sta->cur_max_bandwidth;
+        return bw;
+}
+
+void ieee80211_sta_set_rx_nss(struct sta_info *sta)
+{
+        u8 ht_rx_nss = 0, vht_rx_nss = 0;
+
+        /* if we received a notification already don't overwrite it */
+        if (sta->sta.rx_nss)
+                return;
+
+        if (sta->sta.ht_cap.ht_supported) {
+                if (sta->sta.ht_cap.mcs.rx_mask[0])
+                        ht_rx_nss++;
+                if (sta->sta.ht_cap.mcs.rx_mask[1])
+                        ht_rx_nss++;
+                if (sta->sta.ht_cap.mcs.rx_mask[2])
+                        ht_rx_nss++;
+                if (sta->sta.ht_cap.mcs.rx_mask[3])
+                        ht_rx_nss++;
+                /* FIXME: consider rx_highest? */
+        }
+
+        if (sta->sta.vht_cap.vht_supported) {
+                int i;
+                u16 rx_mcs_map;
+
+                rx_mcs_map = le16_to_cpu(sta->sta.vht_cap.vht_mcs.rx_mcs_map);
+
+                for (i = 7; i >= 0; i--) {
+                        u8 mcs = (rx_mcs_map >> (2 * i)) & 3;
+
+                        if (mcs != IEEE80211_VHT_MCS_NOT_SUPPORTED) {
+                                vht_rx_nss = i + 1;
+                                break;
+                        }
+                }
+                /* FIXME: consider rx_highest? */
+        }
+
+        ht_rx_nss = max(ht_rx_nss, vht_rx_nss);
+        sta->sta.rx_nss = max_t(u8, 1, ht_rx_nss);
+}
+
+void ieee80211_vht_handle_opmode(struct ieee80211_sub_if_data *sdata,
+                                 struct sta_info *sta, u8 opmode,
+                                 enum ieee80211_band band, bool nss_only)
+{
+        struct ieee80211_local *local = sdata->local;
+        struct ieee80211_supported_band *sband;
+        enum ieee80211_sta_rx_bandwidth new_bw;
+        u32 changed = 0;
+        u8 nss;
+
+        sband = local->hw.wiphy->bands[band];
+
+        /* ignore - no support for BF yet */
+        if (opmode & IEEE80211_OPMODE_NOTIF_RX_NSS_TYPE_BF)
+                return;
+
+        nss = opmode & IEEE80211_OPMODE_NOTIF_RX_NSS_MASK;
+        nss >>= IEEE80211_OPMODE_NOTIF_RX_NSS_SHIFT;
+        nss += 1;
+
+        if (sta->sta.rx_nss != nss) {
+                sta->sta.rx_nss = nss;
+                changed |= IEEE80211_RC_NSS_CHANGED;
+        }
+
+        if (nss_only)
+                goto change;
+
+        switch (opmode & IEEE80211_OPMODE_NOTIF_CHANWIDTH_MASK) {
+        case IEEE80211_OPMODE_NOTIF_CHANWIDTH_20MHZ:
+                sta->cur_max_bandwidth = IEEE80211_STA_RX_BW_20;
+                break;
+        case IEEE80211_OPMODE_NOTIF_CHANWIDTH_40MHZ:
+                sta->cur_max_bandwidth = IEEE80211_STA_RX_BW_40;
+                break;
+        case IEEE80211_OPMODE_NOTIF_CHANWIDTH_80MHZ:
+                sta->cur_max_bandwidth = IEEE80211_STA_RX_BW_80;
+                break;
+        case IEEE80211_OPMODE_NOTIF_CHANWIDTH_160MHZ:
+                sta->cur_max_bandwidth = IEEE80211_STA_RX_BW_160;
+                break;
+        }
+
+        new_bw = ieee80211_sta_cur_vht_bw(sta);
+        if (new_bw != sta->sta.bandwidth) {
+                sta->sta.bandwidth = new_bw;
+                changed |= IEEE80211_RC_NSS_CHANGED;
+        }
+
+ change:
+        if (changed)
+                rate_control_rate_update(local, sband, sta, changed);
 }
diff --git a/net/mac80211/wme.c b/net/mac80211/wme.c
index 906f00cd6d2f..afba19cb6f87 100644
--- a/net/mac80211/wme.c
+++ b/net/mac80211/wme.c
@@ -191,6 +191,15 @@ void ieee80211_set_qos_hdr(struct ieee80211_sub_if_data *sdata,
 
         /* qos header is 2 bytes */
         *p++ = ack_policy | tid;
-        *p = ieee80211_vif_is_mesh(&sdata->vif) ?
-                (IEEE80211_QOS_CTL_MESH_CONTROL_PRESENT >> 8) : 0;
+        if (ieee80211_vif_is_mesh(&sdata->vif)) {
+                /* preserve RSPI and Mesh PS Level bit */
+                *p &= ((IEEE80211_QOS_CTL_RSPI |
+                        IEEE80211_QOS_CTL_MESH_PS_LEVEL) >> 8);
+
+                /* Nulls don't have a mesh header (frame body) */
+                if (!ieee80211_is_qos_nullfunc(hdr->frame_control))
+                        *p |= (IEEE80211_QOS_CTL_MESH_CONTROL_PRESENT >> 8);
+        } else {
+                *p = 0;
+        }
 }
diff --git a/net/mac80211/wpa.c b/net/mac80211/wpa.c
index c175ee866ff4..c7c6d644486f 100644
--- a/net/mac80211/wpa.c
+++ b/net/mac80211/wpa.c
@@ -181,7 +181,6 @@ static int tkip_encrypt_skb(struct ieee80211_tx_data *tx, struct sk_buff *skb)
         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
         struct ieee80211_key *key = tx->key;
         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
-        unsigned long flags;
         unsigned int hdrlen;
         int len, tail;
         u8 *pos;
@@ -216,12 +215,12 @@ static int tkip_encrypt_skb(struct ieee80211_tx_data *tx, struct sk_buff *skb)
                 return 0;
 
         /* Increase IV for the frame */
-        spin_lock_irqsave(&key->u.tkip.txlock, flags);
+        spin_lock(&key->u.tkip.txlock);
         key->u.tkip.tx.iv16++;
         if (key->u.tkip.tx.iv16 == 0)
                 key->u.tkip.tx.iv32++;
         pos = ieee80211_tkip_add_iv(pos, key);
-        spin_unlock_irqrestore(&key->u.tkip.txlock, flags);
+        spin_unlock(&key->u.tkip.txlock);
 
         /* hwaccel - with software IV */
         if (info->control.hw_key)
diff --git a/net/mac802154/wpan.c b/net/mac802154/wpan.c
index 199b92261e94..d20c6d3c247d 100644
--- a/net/mac802154/wpan.c
+++ b/net/mac802154/wpan.c
@@ -41,7 +41,7 @@ static inline int mac802154_fetch_skb_u8(struct sk_buff *skb, u8 *val)
                 return -EINVAL;
 
         *val = skb->data[0];
-         skb_pull(skb, 1);
+        skb_pull(skb, 1);
 
         return 0;
 }
@@ -137,16 +137,12 @@ static int mac802154_header_create(struct sk_buff *skb,
         struct ieee802154_addr dev_addr;
         struct mac802154_sub_if_data *priv = netdev_priv(dev);
         int pos = 2;
-        u8 *head;
+        u8 head[MAC802154_FRAME_HARD_HEADER_LEN];
         u16 fc;
 
         if (!daddr)
                 return -EINVAL;
 
-        head = kzalloc(MAC802154_FRAME_HARD_HEADER_LEN, GFP_KERNEL);
-        if (head == NULL)
-                return -ENOMEM;
-
         head[pos++] = mac_cb(skb)->seq; /* DSN/BSN */
         fc = mac_cb_type(skb);
 
@@ -210,7 +206,6 @@ static int mac802154_header_create(struct sk_buff *skb,
         head[1] = fc >> 8;
 
         memcpy(skb_push(skb, pos), head, pos);
-        kfree(head);
 
         return pos;
 }
diff --git a/net/netfilter/ipvs/ip_vs_app.c b/net/netfilter/ipvs/ip_vs_app.c
index 9713e6e86d47..0b779d7df881 100644
--- a/net/netfilter/ipvs/ip_vs_app.c
+++ b/net/netfilter/ipvs/ip_vs_app.c
@@ -605,12 +605,12 @@ int __net_init ip_vs_app_net_init(struct net *net)
         struct netns_ipvs *ipvs = net_ipvs(net);
 
         INIT_LIST_HEAD(&ipvs->app_list);
-        proc_net_fops_create(net, "ip_vs_app", 0, &ip_vs_app_fops);
+        proc_create("ip_vs_app", 0, net->proc_net, &ip_vs_app_fops);
         return 0;
 }
 
 void __net_exit ip_vs_app_net_cleanup(struct net *net)
 {
         unregister_ip_vs_app(net, NULL /* all */);
-        proc_net_remove(net, "ip_vs_app");
+        remove_proc_entry("ip_vs_app", net->proc_net);
 }
diff --git a/net/netfilter/ipvs/ip_vs_conn.c b/net/netfilter/ipvs/ip_vs_conn.c
index 68e368a4beed..9f00db7e03f2 100644
--- a/net/netfilter/ipvs/ip_vs_conn.c
+++ b/net/netfilter/ipvs/ip_vs_conn.c
@@ -1291,8 +1291,8 @@ int __net_init ip_vs_conn_net_init(struct net *net)
 
         atomic_set(&ipvs->conn_count, 0);
 
-        proc_net_fops_create(net, "ip_vs_conn", 0, &ip_vs_conn_fops);
-        proc_net_fops_create(net, "ip_vs_conn_sync", 0, &ip_vs_conn_sync_fops);
+        proc_create("ip_vs_conn", 0, net->proc_net, &ip_vs_conn_fops);
+        proc_create("ip_vs_conn_sync", 0, net->proc_net, &ip_vs_conn_sync_fops);
         return 0;
 }
 
@@ -1300,8 +1300,8 @@ void __net_exit ip_vs_conn_net_cleanup(struct net *net)
 {
         /* flush all the connection entries first */
         ip_vs_conn_flush(net);
-        proc_net_remove(net, "ip_vs_conn");
-        proc_net_remove(net, "ip_vs_conn_sync");
+        remove_proc_entry("ip_vs_conn", net->proc_net);
+        remove_proc_entry("ip_vs_conn_sync", net->proc_net);
 }
 
 int __init ip_vs_conn_init(void)
diff --git a/net/netfilter/ipvs/ip_vs_ctl.c b/net/netfilter/ipvs/ip_vs_ctl.c
index ec664cbb119f..c68198bf9128 100644
--- a/net/netfilter/ipvs/ip_vs_ctl.c
+++ b/net/netfilter/ipvs/ip_vs_ctl.c
@@ -3800,10 +3800,10 @@ int __net_init ip_vs_control_net_init(struct net *net)
 
         spin_lock_init(&ipvs->tot_stats.lock);
 
-        proc_net_fops_create(net, "ip_vs", 0, &ip_vs_info_fops);
-        proc_net_fops_create(net, "ip_vs_stats", 0, &ip_vs_stats_fops);
-        proc_net_fops_create(net, "ip_vs_stats_percpu", 0,
-                             &ip_vs_stats_percpu_fops);
+        proc_create("ip_vs", 0, net->proc_net, &ip_vs_info_fops);
+        proc_create("ip_vs_stats", 0, net->proc_net, &ip_vs_stats_fops);
+        proc_create("ip_vs_stats_percpu", 0, net->proc_net,
+                    &ip_vs_stats_percpu_fops);
 
         if (ip_vs_control_net_init_sysctl(net))
                 goto err;
@@ -3822,9 +3822,9 @@ void __net_exit ip_vs_control_net_cleanup(struct net *net)
         ip_vs_trash_cleanup(net);
         ip_vs_stop_estimator(net, &ipvs->tot_stats);
         ip_vs_control_net_cleanup_sysctl(net);
-        proc_net_remove(net, "ip_vs_stats_percpu");
-        proc_net_remove(net, "ip_vs_stats");
-        proc_net_remove(net, "ip_vs");
+        remove_proc_entry("ip_vs_stats_percpu", net->proc_net);
+        remove_proc_entry("ip_vs_stats", net->proc_net);
+        remove_proc_entry("ip_vs", net->proc_net);
         free_percpu(ipvs->tot_stats.cpustats);
 }
 
diff --git a/net/netfilter/ipvs/ip_vs_proto_sctp.c b/net/netfilter/ipvs/ip_vs_proto_sctp.c
index 746048b13ef3..ae8ec6f27688 100644
--- a/net/netfilter/ipvs/ip_vs_proto_sctp.c
+++ b/net/netfilter/ipvs/ip_vs_proto_sctp.c
@@ -61,14 +61,27 @@ sctp_conn_schedule(int af, struct sk_buff *skb, struct ip_vs_proto_data *pd,
         return 1;
 }
 
+static void sctp_nat_csum(struct sk_buff *skb, sctp_sctphdr_t *sctph,
+                          unsigned int sctphoff)
+{
+        __u32 crc32;
+        struct sk_buff *iter;
+
+        crc32 = sctp_start_cksum((__u8 *)sctph, skb_headlen(skb) - sctphoff);
+        skb_walk_frags(skb, iter)
+                crc32 = sctp_update_cksum((u8 *) iter->data,
+                                          skb_headlen(iter), crc32);
+        sctph->checksum = sctp_end_cksum(crc32);
+
+        skb->ip_summed = CHECKSUM_UNNECESSARY;
+}
+
 static int
 sctp_snat_handler(struct sk_buff *skb, struct ip_vs_protocol *pp,
                   struct ip_vs_conn *cp, struct ip_vs_iphdr *iph)
 {
         sctp_sctphdr_t *sctph;
         unsigned int sctphoff = iph->len;
-        struct sk_buff *iter;
-        __be32 crc32;
 
 #ifdef CONFIG_IP_VS_IPV6
         if (cp->af == AF_INET6 && iph->fragoffs)
@@ -92,13 +105,7 @@ sctp_snat_handler(struct sk_buff *skb, struct ip_vs_protocol *pp,
         sctph = (void *) skb_network_header(skb) + sctphoff;
         sctph->source = cp->vport;
 
-        /* Calculate the checksum */
-        crc32 = sctp_start_cksum((u8 *) sctph, skb_headlen(skb) - sctphoff);
-        skb_walk_frags(skb, iter)
-                crc32 = sctp_update_cksum((u8 *) iter->data, skb_headlen(iter),
-                                          crc32);
-        crc32 = sctp_end_cksum(crc32);
-        sctph->checksum = crc32;
+        sctp_nat_csum(skb, sctph, sctphoff);
 
         return 1;
 }
@@ -109,8 +116,6 @@ sctp_dnat_handler(struct sk_buff *skb, struct ip_vs_protocol *pp,
 {
         sctp_sctphdr_t *sctph;
         unsigned int sctphoff = iph->len;
-        struct sk_buff *iter;
-        __be32 crc32;
 
 #ifdef CONFIG_IP_VS_IPV6
         if (cp->af == AF_INET6 && iph->fragoffs)
@@ -134,13 +139,7 @@ sctp_dnat_handler(struct sk_buff *skb, struct ip_vs_protocol *pp,
         sctph = (void *) skb_network_header(skb) + sctphoff;
         sctph->dest = cp->dport;
 
-        /* Calculate the checksum */
-        crc32 = sctp_start_cksum((u8 *) sctph, skb_headlen(skb) - sctphoff);
-        skb_walk_frags(skb, iter)
-                crc32 = sctp_update_cksum((u8 *) iter->data, skb_headlen(iter),
-                                          crc32);
-        crc32 = sctp_end_cksum(crc32);
-        sctph->checksum = crc32;
+        sctp_nat_csum(skb, sctph, sctphoff);
 
         return 1;
 }
diff --git a/net/netfilter/ipvs/ip_vs_sync.c b/net/netfilter/ipvs/ip_vs_sync.c
index effa10c9e4e3..44fd10c539ac 100644
--- a/net/netfilter/ipvs/ip_vs_sync.c
+++ b/net/netfilter/ipvs/ip_vs_sync.c
@@ -1795,6 +1795,8 @@ int start_sync_thread(struct net *net, int state, char *mcast_ifn, __u8 syncid)
                                              GFP_KERNEL);
                         if (!tinfo->buf)
                                 goto outtinfo;
+                } else {
+                        tinfo->buf = NULL;
                 }
                 tinfo->id = id;
 
diff --git a/net/netfilter/nf_conntrack_expect.c b/net/netfilter/nf_conntrack_expect.c
index bdd341899ed3..3921e5bc1235 100644
--- a/net/netfilter/nf_conntrack_expect.c
+++ b/net/netfilter/nf_conntrack_expect.c
@@ -571,7 +571,8 @@ static int exp_proc_init(struct net *net)
 #ifdef CONFIG_NF_CONNTRACK_PROCFS
         struct proc_dir_entry *proc;
 
-        proc = proc_net_fops_create(net, "nf_conntrack_expect", 0440, &exp_file_ops);
+        proc = proc_create("nf_conntrack_expect", 0440, net->proc_net,
+                           &exp_file_ops);
         if (!proc)
                 return -ENOMEM;
 #endif /* CONFIG_NF_CONNTRACK_PROCFS */
@@ -581,7 +582,7 @@ static int exp_proc_init(struct net *net)
 static void exp_proc_remove(struct net *net)
 {
 #ifdef CONFIG_NF_CONNTRACK_PROCFS
-        proc_net_remove(net, "nf_conntrack_expect");
+        remove_proc_entry("nf_conntrack_expect", net->proc_net);
 #endif /* CONFIG_NF_CONNTRACK_PROCFS */
 }
 
diff --git a/net/netfilter/nf_conntrack_helper.c b/net/netfilter/nf_conntrack_helper.c
index c08768da7936..013cdf69fe29 100644
--- a/net/netfilter/nf_conntrack_helper.c
+++ b/net/netfilter/nf_conntrack_helper.c
@@ -237,7 +237,9 @@ int __nf_ct_try_assign_helper(struct nf_conn *ct, struct nf_conn *tmpl,
                 /* We only allow helper re-assignment of the same sort since
                  * we cannot reallocate the helper extension area.
                  */
-                if (help->helper != helper) {
+                struct nf_conntrack_helper *tmp = rcu_dereference(help->helper);
+
+                if (tmp && tmp->help != helper->help) {
                         RCU_INIT_POINTER(help->helper, NULL);
                         goto out;
                 }
diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c
index d490a300ce2b..5d60e04f9679 100644
--- a/net/netfilter/nf_conntrack_netlink.c
+++ b/net/netfilter/nf_conntrack_netlink.c
@@ -1782,6 +1782,9 @@ ctnetlink_new_conntrack(struct sock *ctnl, struct sk_buff *skb,
                 if (nlh->nlmsg_flags & NLM_F_CREATE) {
                         enum ip_conntrack_events events;
 
+                        if (!cda[CTA_TUPLE_ORIG] || !cda[CTA_TUPLE_REPLY])
+                                return -EINVAL;
+
                         ct = ctnetlink_create_conntrack(net, zone, cda, &otuple,
                                                         &rtuple, u3);
                         if (IS_ERR(ct))
diff --git a/net/netfilter/nf_conntrack_standalone.c b/net/netfilter/nf_conntrack_standalone.c
index 7936bf7f90ba..6bcce401fd1c 100644
--- a/net/netfilter/nf_conntrack_standalone.c
+++ b/net/netfilter/nf_conntrack_standalone.c
@@ -366,7 +366,7 @@ static int nf_conntrack_standalone_init_proc(struct net *net)
 {
         struct proc_dir_entry *pde;
 
-        pde = proc_net_fops_create(net, "nf_conntrack", 0440, &ct_file_ops);
+        pde = proc_create("nf_conntrack", 0440, net->proc_net, &ct_file_ops);
         if (!pde)
                 goto out_nf_conntrack;
 
@@ -377,7 +377,7 @@ static int nf_conntrack_standalone_init_proc(struct net *net)
         return 0;
 
 out_stat_nf_conntrack:
-        proc_net_remove(net, "nf_conntrack");
+        remove_proc_entry("nf_conntrack", net->proc_net);
 out_nf_conntrack:
         return -ENOMEM;
 }
@@ -385,7 +385,7 @@ out_nf_conntrack:
 static void nf_conntrack_standalone_fini_proc(struct net *net)
 {
         remove_proc_entry("nf_conntrack", net->proc_net_stat);
-        proc_net_remove(net, "nf_conntrack");
+        remove_proc_entry("nf_conntrack", net->proc_net);
 }
 #else
 static int nf_conntrack_standalone_init_proc(struct net *net)
diff --git a/net/netfilter/x_tables.c b/net/netfilter/x_tables.c
index 7b3a9e5999c0..686c7715d777 100644
--- a/net/netfilter/x_tables.c
+++ b/net/netfilter/x_tables.c
@@ -1323,12 +1323,12 @@ int xt_proto_init(struct net *net, u_int8_t af)
 out_remove_matches:
         strlcpy(buf, xt_prefix[af], sizeof(buf));
         strlcat(buf, FORMAT_MATCHES, sizeof(buf));
-        proc_net_remove(net, buf);
+        remove_proc_entry(buf, net->proc_net);
 
 out_remove_tables:
         strlcpy(buf, xt_prefix[af], sizeof(buf));
         strlcat(buf, FORMAT_TABLES, sizeof(buf));
-        proc_net_remove(net, buf);
+        remove_proc_entry(buf, net->proc_net);
 out:
         return -1;
 #endif
@@ -1342,15 +1342,15 @@ void xt_proto_fini(struct net *net, u_int8_t af)
 
         strlcpy(buf, xt_prefix[af], sizeof(buf));
         strlcat(buf, FORMAT_TABLES, sizeof(buf));
-        proc_net_remove(net, buf);
+        remove_proc_entry(buf, net->proc_net);
 
         strlcpy(buf, xt_prefix[af], sizeof(buf));
         strlcat(buf, FORMAT_TARGETS, sizeof(buf));
-        proc_net_remove(net, buf);
+        remove_proc_entry(buf, net->proc_net);
 
         strlcpy(buf, xt_prefix[af], sizeof(buf));
         strlcat(buf, FORMAT_MATCHES, sizeof(buf));
-        proc_net_remove(net, buf);
+        remove_proc_entry(buf, net->proc_net);
 #endif /*CONFIG_PROC_FS*/
 }
 EXPORT_SYMBOL_GPL(xt_proto_fini);
diff --git a/net/netfilter/xt_hashlimit.c b/net/netfilter/xt_hashlimit.c
index a9d7af953ceb..98218c896d2e 100644
--- a/net/netfilter/xt_hashlimit.c
+++ b/net/netfilter/xt_hashlimit.c
@@ -867,7 +867,7 @@ static int __net_init hashlimit_proc_net_init(struct net *net)
 #if IS_ENABLED(CONFIG_IP6_NF_IPTABLES)
         hashlimit_net->ip6t_hashlimit = proc_mkdir("ip6t_hashlimit", net->proc_net);
         if (!hashlimit_net->ip6t_hashlimit) {
-                proc_net_remove(net, "ipt_hashlimit");
+                remove_proc_entry("ipt_hashlimit", net->proc_net);
                 return -ENOMEM;
         }
 #endif
@@ -897,9 +897,9 @@ static void __net_exit hashlimit_proc_net_exit(struct net *net)
         hashlimit_net->ip6t_hashlimit = NULL;
         mutex_unlock(&hashlimit_mutex);
 
-        proc_net_remove(net, "ipt_hashlimit");
+        remove_proc_entry("ipt_hashlimit", net->proc_net);
 #if IS_ENABLED(CONFIG_IP6_NF_IPTABLES)
-        proc_net_remove(net, "ip6t_hashlimit");
+        remove_proc_entry("ip6t_hashlimit", net->proc_net);
 #endif
 }
 
diff --git a/net/netfilter/xt_recent.c b/net/netfilter/xt_recent.c
index 978efc9b555a..31bf233dae97 100644
--- a/net/netfilter/xt_recent.c
+++ b/net/netfilter/xt_recent.c
@@ -643,7 +643,7 @@ static void __net_exit recent_proc_net_exit(struct net *net)
         recent_net->xt_recent = NULL;
         spin_unlock_bh(&recent_lock);
 
-        proc_net_remove(net, "xt_recent");
+        remove_proc_entry("xt_recent", net->proc_net);
 }
 #else
 static inline int recent_proc_net_init(struct net *net)
diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c
index 74827e3b26a1..3d55e0c713e2 100644
--- a/net/netlink/af_netlink.c
+++ b/net/netlink/af_netlink.c
@@ -2145,7 +2145,7 @@ static const struct net_proto_family netlink_family_ops = {
 static int __net_init netlink_net_init(struct net *net)
 {
 #ifdef CONFIG_PROC_FS
-        if (!proc_net_fops_create(net, "netlink", 0, &netlink_seq_fops))
+        if (!proc_create("netlink", 0, net->proc_net, &netlink_seq_fops))
                 return -ENOMEM;
 #endif
         return 0;
@@ -2154,7 +2154,7 @@ static int __net_init netlink_net_init(struct net *net)
 static void __net_exit netlink_net_exit(struct net *net)
 {
 #ifdef CONFIG_PROC_FS
-        proc_net_remove(net, "netlink");
+        remove_proc_entry("netlink", net->proc_net);
 #endif
 }
 
diff --git a/net/netrom/af_netrom.c b/net/netrom/af_netrom.c
index 7261eb81974f..297b07a029de 100644
--- a/net/netrom/af_netrom.c
+++ b/net/netrom/af_netrom.c
@@ -1452,9 +1452,9 @@ static int __init nr_proto_init(void)
 
         nr_loopback_init();
 
-        proc_net_fops_create(&init_net, "nr", S_IRUGO, &nr_info_fops);
-        proc_net_fops_create(&init_net, "nr_neigh", S_IRUGO, &nr_neigh_fops);
-        proc_net_fops_create(&init_net, "nr_nodes", S_IRUGO, &nr_nodes_fops);
+        proc_create("nr", S_IRUGO, init_net.proc_net, &nr_info_fops);
+        proc_create("nr_neigh", S_IRUGO, init_net.proc_net, &nr_neigh_fops);
+        proc_create("nr_nodes", S_IRUGO, init_net.proc_net, &nr_nodes_fops);
 out:
         return rc;
 fail:
@@ -1482,9 +1482,9 @@ static void __exit nr_exit(void)
 {
         int i;
 
-        proc_net_remove(&init_net, "nr");
-        proc_net_remove(&init_net, "nr_neigh");
-        proc_net_remove(&init_net, "nr_nodes");
+        remove_proc_entry("nr", init_net.proc_net);
+        remove_proc_entry("nr_neigh", init_net.proc_net);
+        remove_proc_entry("nr_nodes", init_net.proc_net);
         nr_loopback_clear();
 
         nr_rt_free();
diff --git a/net/nfc/llcp/llcp.c b/net/nfc/llcp/llcp.c
index 85bc75c38dea..746f5a2f9804 100644
--- a/net/nfc/llcp/llcp.c
+++ b/net/nfc/llcp/llcp.c
@@ -549,14 +549,13 @@ int nfc_llcp_set_remote_gb(struct nfc_dev *dev, u8 *gb, u8 gb_len)
                 pr_err("No LLCP device\n");
                 return -ENODEV;
         }
+        if (gb_len < 3)
+                return -EINVAL;
 
         memset(local->remote_gb, 0, NFC_MAX_GT_LEN);
         memcpy(local->remote_gb, gb, gb_len);
         local->remote_gb_len = gb_len;
 
-        if (local->remote_gb == NULL || local->remote_gb_len == 0)
-                return -ENODEV;
-
         if (memcmp(local->remote_gb, llcp_magic, 3)) {
                 pr_err("MAC does not support LLCP\n");
                 return -EINVAL;
diff --git a/net/openvswitch/datapath.c b/net/openvswitch/datapath.c
index d8c13a965459..9dc537df46c4 100644
--- a/net/openvswitch/datapath.c
+++ b/net/openvswitch/datapath.c
@@ -301,7 +301,7 @@ static int queue_gso_packets(struct net *net, int dp_ifindex,
         struct sk_buff *segs, *nskb;
         int err;
 
-        segs = skb_gso_segment(skb, NETIF_F_SG | NETIF_F_HW_CSUM);
+        segs = __skb_gso_segment(skb, NETIF_F_SG | NETIF_F_HW_CSUM, false);
         if (IS_ERR(segs))
                 return PTR_ERR(segs);
 
diff --git a/net/openvswitch/vport-netdev.c b/net/openvswitch/vport-netdev.c
index a9327e2e48ce..670cbc3518de 100644
--- a/net/openvswitch/vport-netdev.c
+++ b/net/openvswitch/vport-netdev.c
@@ -35,10 +35,11 @@
 /* Must be called with rcu_read_lock. */
 static void netdev_port_receive(struct vport *vport, struct sk_buff *skb)
 {
-        if (unlikely(!vport)) {
-                kfree_skb(skb);
-                return;
-        }
+        if (unlikely(!vport))
+                goto error;
+
+        if (unlikely(skb_warn_if_lro(skb)))
+                goto error;
 
         /* Make our own copy of the packet.  Otherwise we will mangle the
          * packet for anyone who came before us (e.g. tcpdump via AF_PACKET).
@@ -50,6 +51,10 @@ static void netdev_port_receive(struct vport *vport, struct sk_buff *skb)
 
         skb_push(skb, ETH_HLEN);
         ovs_vport_receive(vport, skb);
+        return;
+
+error:
+        kfree_skb(skb);
 }
 
 /* Called with rcu_read_lock and bottom-halves disabled. */
@@ -169,9 +174,6 @@ static int netdev_send(struct vport *vport, struct sk_buff *skb)
                 goto error;
         }
 
-        if (unlikely(skb_warn_if_lro(skb)))
-                goto error;
-
         skb->dev = netdev_vport->dev;
         len = skb->len;
         dev_queue_xmit(skb);
diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
index e639645e8fec..c7bfeff10767 100644
--- a/net/packet/af_packet.c
+++ b/net/packet/af_packet.c
@@ -2361,13 +2361,15 @@ static int packet_release(struct socket *sock)
 
         packet_flush_mclist(sk);
 
-        memset(&req_u, 0, sizeof(req_u));
-
-        if (po->rx_ring.pg_vec)
+        if (po->rx_ring.pg_vec) {
+                memset(&req_u, 0, sizeof(req_u));
                 packet_set_ring(sk, &req_u, 1, 0);
+        }
 
-        if (po->tx_ring.pg_vec)
+        if (po->tx_ring.pg_vec) {
+                memset(&req_u, 0, sizeof(req_u));
                 packet_set_ring(sk, &req_u, 1, 1);
+        }
 
         fanout_release(sk);
 
@@ -3826,7 +3828,7 @@ static int __net_init packet_net_init(struct net *net)
         mutex_init(&net->packet.sklist_lock);
         INIT_HLIST_HEAD(&net->packet.sklist);
 
-        if (!proc_net_fops_create(net, "packet", 0, &packet_seq_fops))
+        if (!proc_create("packet", 0, net->proc_net, &packet_seq_fops))
                 return -ENOMEM;
 
         return 0;
@@ -3834,7 +3836,7 @@ static int __net_init packet_net_init(struct net *net)
 
 static void __net_exit packet_net_exit(struct net *net)
 {
-        proc_net_remove(net, "packet");
+        remove_proc_entry("packet", net->proc_net);
 }
 
 static struct pernet_operations packet_net_ops = {
diff --git a/net/phonet/pn_dev.c b/net/phonet/pn_dev.c
index 5bf6341e2dd4..45a7df6575de 100644
--- a/net/phonet/pn_dev.c
+++ b/net/phonet/pn_dev.c
@@ -320,7 +320,7 @@ static int __net_init phonet_init_net(struct net *net)
 {
         struct phonet_net *pnn = phonet_pernet(net);
 
-        if (!proc_net_fops_create(net, "phonet", 0, &pn_sock_seq_fops))
+        if (!proc_create("phonet", 0, net->proc_net, &pn_sock_seq_fops))
                 return -ENOMEM;
 
         INIT_LIST_HEAD(&pnn->pndevs.list);
@@ -331,7 +331,7 @@ static int __net_init phonet_init_net(struct net *net)
 
 static void __net_exit phonet_exit_net(struct net *net)
 {
-        proc_net_remove(net, "phonet");
+        remove_proc_entry("phonet", net->proc_net);
 }
 
 static struct pernet_operations phonet_net_ops = {
@@ -348,7 +348,7 @@ int __init phonet_device_init(void)
         if (err)
                 return err;
 
-        proc_net_fops_create(&init_net, "pnresource", 0, &pn_res_seq_fops);
+        proc_create("pnresource", 0, init_net.proc_net, &pn_res_seq_fops);
         register_netdevice_notifier(&phonet_device_notifier);
         err = phonet_netlink_register();
         if (err)
@@ -361,7 +361,7 @@ void phonet_device_exit(void)
         rtnl_unregister_all(PF_PHONET);
         unregister_netdevice_notifier(&phonet_device_notifier);
         unregister_pernet_subsys(&phonet_net_ops);
-        proc_net_remove(&init_net, "pnresource");
+        remove_proc_entry("pnresource", init_net.proc_net);
 }
 
 int phonet_route_add(struct net_device *dev, u8 daddr)
diff --git a/net/rose/af_rose.c b/net/rose/af_rose.c
index c4719ce604c2..b768fe9d5e7a 100644
--- a/net/rose/af_rose.c
+++ b/net/rose/af_rose.c
@@ -1575,10 +1575,13 @@ static int __init rose_proto_init(void)
 
         rose_add_loopback_neigh();
 
-        proc_net_fops_create(&init_net, "rose", S_IRUGO, &rose_info_fops);
-        proc_net_fops_create(&init_net, "rose_neigh", S_IRUGO, &rose_neigh_fops);
-        proc_net_fops_create(&init_net, "rose_nodes", S_IRUGO, &rose_nodes_fops);
-        proc_net_fops_create(&init_net, "rose_routes", S_IRUGO, &rose_routes_fops);
+        proc_create("rose", S_IRUGO, init_net.proc_net, &rose_info_fops);
+        proc_create("rose_neigh", S_IRUGO, init_net.proc_net,
+                    &rose_neigh_fops);
+        proc_create("rose_nodes", S_IRUGO, init_net.proc_net,
+                    &rose_nodes_fops);
+        proc_create("rose_routes", S_IRUGO, init_net.proc_net,
+                    &rose_routes_fops);
 out:
         return rc;
 fail:
@@ -1605,10 +1608,10 @@ static void __exit rose_exit(void)
 {
         int i;
 
-        proc_net_remove(&init_net, "rose");
-        proc_net_remove(&init_net, "rose_neigh");
-        proc_net_remove(&init_net, "rose_nodes");
-        proc_net_remove(&init_net, "rose_routes");
+        remove_proc_entry("rose", init_net.proc_net);
+        remove_proc_entry("rose_neigh", init_net.proc_net);
+        remove_proc_entry("rose_nodes", init_net.proc_net);
+        remove_proc_entry("rose_routes", init_net.proc_net);
         rose_loopback_clear();
 
         rose_rt_free();
diff --git a/net/rxrpc/af_rxrpc.c b/net/rxrpc/af_rxrpc.c
index 5b0fd291babb..e61aa6001c65 100644
--- a/net/rxrpc/af_rxrpc.c
+++ b/net/rxrpc/af_rxrpc.c
@@ -839,8 +839,9 @@ static int __init af_rxrpc_init(void)
         }
 
 #ifdef CONFIG_PROC_FS
-        proc_net_fops_create(&init_net, "rxrpc_calls", 0, &rxrpc_call_seq_fops);
-        proc_net_fops_create(&init_net, "rxrpc_conns", 0, &rxrpc_connection_seq_fops);
+        proc_create("rxrpc_calls", 0, init_net.proc_net, &rxrpc_call_seq_fops);
+        proc_create("rxrpc_conns", 0, init_net.proc_net,
+                    &rxrpc_connection_seq_fops);
 #endif
         return 0;
 
@@ -878,8 +879,8 @@ static void __exit af_rxrpc_exit(void)
 
         _debug("flush scheduled work");
         flush_workqueue(rxrpc_workqueue);
-        proc_net_remove(&init_net, "rxrpc_conns");
-        proc_net_remove(&init_net, "rxrpc_calls");
+        remove_proc_entry("rxrpc_conns", init_net.proc_net);
+        remove_proc_entry("rxrpc_calls", init_net.proc_net);
         destroy_workqueue(rxrpc_workqueue);
         kmem_cache_destroy(rxrpc_call_jar);
         _leave("");
diff --git a/net/sched/act_ipt.c b/net/sched/act_ipt.c
index 0fb9e3f567e6..e0f6de64afec 100644
--- a/net/sched/act_ipt.c
+++ b/net/sched/act_ipt.c
@@ -207,10 +207,8 @@ static int tcf_ipt(struct sk_buff *skb, const struct tc_action *a,
         struct tcf_ipt *ipt = a->priv;
         struct xt_action_param par;
 
-        if (skb_cloned(skb)) {
-                if (pskb_expand_head(skb, 0, 0, GFP_ATOMIC))
-                        return TC_ACT_UNSPEC;
-        }
+        if (skb_unclone(skb, GFP_ATOMIC))
+                return TC_ACT_UNSPEC;
 
         spin_lock(&ipt->tcf_lock);
 
diff --git a/net/sched/act_pedit.c b/net/sched/act_pedit.c
index 0c3faddf3f2c..7ed78c9e505c 100644
--- a/net/sched/act_pedit.c
+++ b/net/sched/act_pedit.c
@@ -131,8 +131,7 @@ static int tcf_pedit(struct sk_buff *skb, const struct tc_action *a,
         int i, munged = 0;
         unsigned int off;
 
-        if (skb_cloned(skb) &&
-            pskb_expand_head(skb, 0, 0, GFP_ATOMIC))
+        if (skb_unclone(skb, GFP_ATOMIC))
                 return p->tcf_action;
 
         off = skb_network_offset(skb);
diff --git a/net/sched/act_police.c b/net/sched/act_police.c
index 8dbd695c160b..823463adbd21 100644
--- a/net/sched/act_police.c
+++ b/net/sched/act_police.c
@@ -22,8 +22,23 @@
 #include <net/act_api.h>
 #include <net/netlink.h>
 
-#define L2T(p, L)   qdisc_l2t((p)->tcfp_R_tab, L)
-#define L2T_P(p, L) qdisc_l2t((p)->tcfp_P_tab, L)
+struct tcf_police {
+        struct tcf_common       common;
+        int                     tcfp_result;
+        u32                     tcfp_ewma_rate;
+        s64                     tcfp_burst;
+        u32                     tcfp_mtu;
+        s64                     tcfp_toks;
+        s64                     tcfp_ptoks;
+        s64                     tcfp_mtu_ptoks;
+        s64                     tcfp_t_c;
+        struct psched_ratecfg   rate;
+        bool                    rate_present;
+        struct psched_ratecfg   peak;
+        bool                    peak_present;
+};
+#define to_police(pc)   \
+        container_of(pc, struct tcf_police, common)
 
 #define POL_TAB_MASK     15
 static struct tcf_common *tcf_police_ht[POL_TAB_MASK + 1];
@@ -108,10 +123,6 @@ static void tcf_police_destroy(struct tcf_police *p)
                         write_unlock_bh(&police_lock);
                         gen_kill_estimator(&p->tcf_bstats,
                                            &p->tcf_rate_est);
-                        if (p->tcfp_R_tab)
-                                qdisc_put_rtab(p->tcfp_R_tab);
-                        if (p->tcfp_P_tab)
-                                qdisc_put_rtab(p->tcfp_P_tab);
                         /*
                          * gen_estimator est_timer() might access p->tcf_lock
                          * or bstats, wait a RCU grace period before freeing p
@@ -212,26 +223,36 @@ override:
         }
 
         /* No failure allowed after this point */
-        if (R_tab != NULL) {
-                qdisc_put_rtab(police->tcfp_R_tab);
-                police->tcfp_R_tab = R_tab;
+        police->tcfp_mtu = parm->mtu;
+        if (police->tcfp_mtu == 0) {
+                police->tcfp_mtu = ~0;
+                if (R_tab)
+                        police->tcfp_mtu = 255 << R_tab->rate.cell_log;
+        }
+        if (R_tab) {
+                police->rate_present = true;
+                psched_ratecfg_precompute(&police->rate, R_tab->rate.rate);
+                qdisc_put_rtab(R_tab);
+        } else {
+                police->rate_present = false;
         }
-        if (P_tab != NULL) {
-                qdisc_put_rtab(police->tcfp_P_tab);
-                police->tcfp_P_tab = P_tab;
+        if (P_tab) {
+                police->peak_present = true;
+                psched_ratecfg_precompute(&police->peak, P_tab->rate.rate);
+                qdisc_put_rtab(P_tab);
+        } else {
+                police->peak_present = false;
         }
 
         if (tb[TCA_POLICE_RESULT])
                 police->tcfp_result = nla_get_u32(tb[TCA_POLICE_RESULT]);
-        police->tcfp_toks = police->tcfp_burst = parm->burst;
-        police->tcfp_mtu = parm->mtu;
-        if (police->tcfp_mtu == 0) {
-                police->tcfp_mtu = ~0;
-                if (police->tcfp_R_tab)
-                        police->tcfp_mtu = 255<<police->tcfp_R_tab->rate.cell_log;
+        police->tcfp_burst = PSCHED_TICKS2NS(parm->burst);
+        police->tcfp_toks = police->tcfp_burst;
+        if (police->peak_present) {
+                police->tcfp_mtu_ptoks = (s64) psched_l2t_ns(&police->peak,
+                                                             police->tcfp_mtu);
+                police->tcfp_ptoks = police->tcfp_mtu_ptoks;
         }
-        if (police->tcfp_P_tab)
-                police->tcfp_ptoks = L2T_P(police, police->tcfp_mtu);
         police->tcf_action = parm->action;
 
         if (tb[TCA_POLICE_AVRATE])
@@ -241,7 +262,7 @@ override:
         if (ret != ACT_P_CREATED)
                 return ret;
 
-        police->tcfp_t_c = psched_get_time();
+        police->tcfp_t_c = ktime_to_ns(ktime_get());
         police->tcf_index = parm->index ? parm->index :
                 tcf_hash_new_index(&police_idx_gen, &police_hash_info);
         h = tcf_hash(police->tcf_index, POL_TAB_MASK);
@@ -287,9 +308,9 @@ static int tcf_act_police(struct sk_buff *skb, const struct tc_action *a,
                           struct tcf_result *res)
 {
         struct tcf_police *police = a->priv;
-        psched_time_t now;
-        long toks;
-        long ptoks = 0;
+        s64 now;
+        s64 toks;
+        s64 ptoks = 0;
 
         spin_lock(&police->tcf_lock);
 
@@ -305,24 +326,25 @@ static int tcf_act_police(struct sk_buff *skb, const struct tc_action *a,
         }
 
         if (qdisc_pkt_len(skb) <= police->tcfp_mtu) {
-                if (police->tcfp_R_tab == NULL) {
+                if (!police->rate_present) {
                         spin_unlock(&police->tcf_lock);
                         return police->tcfp_result;
                 }
 
-                now = psched_get_time();
-                toks = psched_tdiff_bounded(now, police->tcfp_t_c,
-                                            police->tcfp_burst);
-                if (police->tcfp_P_tab) {
+                now = ktime_to_ns(ktime_get());
+                toks = min_t(s64, now - police->tcfp_t_c,
+                             police->tcfp_burst);
+                if (police->peak_present) {
                         ptoks = toks + police->tcfp_ptoks;
-                        if (ptoks > (long)L2T_P(police, police->tcfp_mtu))
-                                ptoks = (long)L2T_P(police, police->tcfp_mtu);
-                        ptoks -= L2T_P(police, qdisc_pkt_len(skb));
+                        if (ptoks > police->tcfp_mtu_ptoks)
+                                ptoks = police->tcfp_mtu_ptoks;
+                        ptoks -= (s64) psched_l2t_ns(&police->peak,
+                                                     qdisc_pkt_len(skb));
                 }
                 toks += police->tcfp_toks;
-                if (toks > (long)police->tcfp_burst)
+                if (toks > police->tcfp_burst)
                         toks = police->tcfp_burst;
-                toks -= L2T(police, qdisc_pkt_len(skb));
+                toks -= (s64) psched_l2t_ns(&police->rate, qdisc_pkt_len(skb));
                 if ((toks|ptoks) >= 0) {
                         police->tcfp_t_c = now;
                         police->tcfp_toks = toks;
@@ -348,15 +370,15 @@ tcf_act_police_dump(struct sk_buff *skb, struct tc_action *a, int bind, int ref)
                 .index = police->tcf_index,
                 .action = police->tcf_action,
                 .mtu = police->tcfp_mtu,
-                .burst = police->tcfp_burst,
+                .burst = PSCHED_NS2TICKS(police->tcfp_burst),
                 .refcnt = police->tcf_refcnt - ref,
                 .bindcnt = police->tcf_bindcnt - bind,
         };
 
-        if (police->tcfp_R_tab)
-                opt.rate = police->tcfp_R_tab->rate;
-        if (police->tcfp_P_tab)
-                opt.peakrate = police->tcfp_P_tab->rate;
+        if (police->rate_present)
+                opt.rate.rate = psched_ratecfg_getrate(&police->rate);
+        if (police->peak_present)
+                opt.peakrate.rate = psched_ratecfg_getrate(&police->peak);
         if (nla_put(skb, TCA_POLICE_TBF, sizeof(opt), &opt))
                 goto nla_put_failure;
         if (police->tcfp_result &&
diff --git a/net/sched/sch_api.c b/net/sched/sch_api.c
index d84f7e734cd7..a181b484812a 100644
--- a/net/sched/sch_api.c
+++ b/net/sched/sch_api.c
@@ -493,7 +493,7 @@ void qdisc_watchdog_init(struct qdisc_watchdog *wd, struct Qdisc *qdisc)
 }
 EXPORT_SYMBOL(qdisc_watchdog_init);
 
-void qdisc_watchdog_schedule(struct qdisc_watchdog *wd, psched_time_t expires)
+void qdisc_watchdog_schedule_ns(struct qdisc_watchdog *wd, u64 expires)
 {
         if (test_bit(__QDISC_STATE_DEACTIVATED,
                      &qdisc_root_sleeping(wd->qdisc)->state))
@@ -502,10 +502,10 @@ void qdisc_watchdog_schedule(struct qdisc_watchdog *wd, psched_time_t expires)
         qdisc_throttled(wd->qdisc);
 
         hrtimer_start(&wd->timer,
-                      ns_to_ktime(PSCHED_TICKS2NS(expires)),
+                      ns_to_ktime(expires),
                       HRTIMER_MODE_ABS);
 }
-EXPORT_SYMBOL(qdisc_watchdog_schedule);
+EXPORT_SYMBOL(qdisc_watchdog_schedule_ns);
 
 void qdisc_watchdog_cancel(struct qdisc_watchdog *wd)
 {
@@ -1768,7 +1768,7 @@ static int __net_init psched_net_init(struct net *net)
 {
         struct proc_dir_entry *e;
 
-        e = proc_net_fops_create(net, "psched", 0, &psched_fops);
+        e = proc_create("psched", 0, net->proc_net, &psched_fops);
         if (e == NULL)
                 return -ENOMEM;
 
@@ -1777,7 +1777,7 @@ static int __net_init psched_net_init(struct net *net)
 
 static void __net_exit psched_net_exit(struct net *net)
 {
-        proc_net_remove(net, "psched");
+        remove_proc_entry("psched", net->proc_net);
 }
 #else
 static int __net_init psched_net_init(struct net *net)
diff --git a/net/sched/sch_generic.c b/net/sched/sch_generic.c
index 5d81a4478514..ffad48109a22 100644
--- a/net/sched/sch_generic.c
+++ b/net/sched/sch_generic.c
@@ -25,6 +25,7 @@
 #include <linux/rcupdate.h>
 #include <linux/list.h>
 #include <linux/slab.h>
+#include <net/sch_generic.h>
 #include <net/pkt_sched.h>
 #include <net/dst.h>
 
@@ -896,3 +897,39 @@ void dev_shutdown(struct net_device *dev)
 
         WARN_ON(timer_pending(&dev->watchdog_timer));
 }
+
+void psched_ratecfg_precompute(struct psched_ratecfg *r, u32 rate)
+{
+        u64 factor;
+        u64 mult;
+        int shift;
+
+        r->rate_bps = rate << 3;
+        r->shift = 0;
+        r->mult = 1;
+        /*
+         * Calibrate mult, shift so that token counting is accurate
+         * for smallest packet size (64 bytes).  Token (time in ns) is
+         * computed as (bytes * 8) * NSEC_PER_SEC / rate_bps.  It will
+         * work as long as the smallest packet transfer time can be
+         * accurately represented in nanosec.
+         */
+        if (r->rate_bps > 0) {
+                /*
+                 * Higher shift gives better accuracy.  Find the largest
+                 * shift such that mult fits in 32 bits.
+                 */
+                for (shift = 0; shift < 16; shift++) {
+                        r->shift = shift;
+                        factor = 8LLU * NSEC_PER_SEC * (1 << r->shift);
+                        mult = div64_u64(factor, r->rate_bps);
+                        if (mult > UINT_MAX)
+                                break;
+                }
+
+                r->shift = shift - 1;
+                factor = 8LLU * NSEC_PER_SEC * (1 << r->shift);
+                r->mult = div64_u64(factor, r->rate_bps);
+        }
+}
+EXPORT_SYMBOL(psched_ratecfg_precompute);
diff --git a/net/sched/sch_htb.c b/net/sched/sch_htb.c
index 51561eafcb72..03c2692ca01e 100644
--- a/net/sched/sch_htb.c
+++ b/net/sched/sch_htb.c
@@ -38,6 +38,7 @@
 #include <linux/workqueue.h>
 #include <linux/slab.h>
 #include <net/netlink.h>
+#include <net/sch_generic.h>
 #include <net/pkt_sched.h>
 
 /* HTB algorithm.
@@ -71,12 +72,6 @@ enum htb_cmode {
         HTB_CAN_SEND            /* class can send */
 };
 
-struct htb_rate_cfg {
-        u64 rate_bps;
-        u32 mult;
-        u32 shift;
-};
-
 /* interior & leaf nodes; props specific to leaves are marked L: */
 struct htb_class {
         struct Qdisc_class_common common;
@@ -124,8 +119,8 @@ struct htb_class {
         int filter_cnt;
 
         /* token bucket parameters */
-        struct htb_rate_cfg rate;
-        struct htb_rate_cfg ceil;
+        struct psched_ratecfg rate;
+        struct psched_ratecfg ceil;
         s64 buffer, cbuffer;    /* token bucket depth/rate */
         psched_tdiff_t mbuffer; /* max wait time */
         s64 tokens, ctokens;    /* current number of tokens */
@@ -168,45 +163,6 @@ struct htb_sched {
         struct work_struct work;
 };
 
-static u64 l2t_ns(struct htb_rate_cfg *r, unsigned int len)
-{
-        return ((u64)len * r->mult) >> r->shift;
-}
-
-static void htb_precompute_ratedata(struct htb_rate_cfg *r)
-{
-        u64 factor;
-        u64 mult;
-        int shift;
-
-        r->shift = 0;
-        r->mult = 1;
-        /*
-         * Calibrate mult, shift so that token counting is accurate
-         * for smallest packet size (64 bytes).  Token (time in ns) is
-         * computed as (bytes * 8) * NSEC_PER_SEC / rate_bps.  It will
-         * work as long as the smallest packet transfer time can be
-         * accurately represented in nanosec.
-         */
-        if (r->rate_bps > 0) {
-                /*
-                 * Higher shift gives better accuracy.  Find the largest
-                 * shift such that mult fits in 32 bits.
-                 */
-                for (shift = 0; shift < 16; shift++) {
-                        r->shift = shift;
-                        factor = 8LLU * NSEC_PER_SEC * (1 << r->shift);
-                        mult = div64_u64(factor, r->rate_bps);
-                        if (mult > UINT_MAX)
-                                break;
-                }
-
-                r->shift = shift - 1;
-                factor = 8LLU * NSEC_PER_SEC * (1 << r->shift);
-                r->mult = div64_u64(factor, r->rate_bps);
-        }
-}
-
 /* find class in global hash table using given handle */
 static inline struct htb_class *htb_find(u32 handle, struct Qdisc *sch)
 {
@@ -632,7 +588,7 @@ static inline void htb_accnt_tokens(struct htb_class *cl, int bytes, s64 diff)
 
         if (toks > cl->buffer)
                 toks = cl->buffer;
-        toks -= (s64) l2t_ns(&cl->rate, bytes);
+        toks -= (s64) psched_l2t_ns(&cl->rate, bytes);
         if (toks <= -cl->mbuffer)
                 toks = 1 - cl->mbuffer;
 
@@ -645,7 +601,7 @@ static inline void htb_accnt_ctokens(struct htb_class *cl, int bytes, s64 diff)
 
         if (toks > cl->cbuffer)
                 toks = cl->cbuffer;
-        toks -= (s64) l2t_ns(&cl->ceil, bytes);
+        toks -= (s64) psched_l2t_ns(&cl->ceil, bytes);
         if (toks <= -cl->mbuffer)
                 toks = 1 - cl->mbuffer;
 
@@ -1134,10 +1090,10 @@ static int htb_dump_class(struct Qdisc *sch, unsigned long arg,
 
         memset(&opt, 0, sizeof(opt));
 
-        opt.rate.rate = cl->rate.rate_bps >> 3;
-        opt.buffer = cl->buffer;
-        opt.ceil.rate = cl->ceil.rate_bps >> 3;
-        opt.cbuffer = cl->cbuffer;
+        opt.rate.rate = psched_ratecfg_getrate(&cl->rate);
+        opt.buffer = PSCHED_NS2TICKS(cl->buffer);
+        opt.ceil.rate = psched_ratecfg_getrate(&cl->ceil);
+        opt.cbuffer = PSCHED_NS2TICKS(cl->cbuffer);
         opt.quantum = cl->quantum;
         opt.prio = cl->prio;
         opt.level = cl->level;
@@ -1459,8 +1415,8 @@ static int htb_change_class(struct Qdisc *sch, u32 classid,
                 cl->parent = parent;
 
                 /* set class to be in HTB_CAN_SEND state */
-                cl->tokens = hopt->buffer;
-                cl->ctokens = hopt->cbuffer;
+                cl->tokens = PSCHED_TICKS2NS(hopt->buffer);
+                cl->ctokens = PSCHED_TICKS2NS(hopt->cbuffer);
                 cl->mbuffer = 60 * PSCHED_TICKS_PER_SEC;        /* 1min */
                 cl->t_c = psched_get_time();
                 cl->cmode = HTB_CAN_SEND;
@@ -1503,17 +1459,11 @@ static int htb_change_class(struct Qdisc *sch, u32 classid,
                         cl->prio = TC_HTB_NUMPRIO - 1;
         }
 
-        cl->buffer = hopt->buffer;
-        cl->cbuffer = hopt->cbuffer;
-
-        cl->rate.rate_bps = (u64)hopt->rate.rate << 3;
-        cl->ceil.rate_bps = (u64)hopt->ceil.rate << 3;
-
-        htb_precompute_ratedata(&cl->rate);
-        htb_precompute_ratedata(&cl->ceil);
+        psched_ratecfg_precompute(&cl->rate, hopt->rate.rate);
+        psched_ratecfg_precompute(&cl->ceil, hopt->ceil.rate);
 
-        cl->buffer = hopt->buffer << PSCHED_SHIFT;
-        cl->cbuffer = hopt->buffer << PSCHED_SHIFT;
+        cl->buffer = PSCHED_TICKS2NS(hopt->buffer);
+        cl->cbuffer = PSCHED_TICKS2NS(hopt->buffer);
 
         sch_tree_unlock(sch);
 
diff --git a/net/sched/sch_netem.c b/net/sched/sch_netem.c
index 298c0ddfb57e..3d2acc7a9c80 100644
--- a/net/sched/sch_netem.c
+++ b/net/sched/sch_netem.c
@@ -438,18 +438,18 @@ static int netem_enqueue(struct sk_buff *skb, struct Qdisc *sch)
                 if (q->rate) {
                         struct sk_buff_head *list = &sch->q;
 
-                        delay += packet_len_2_sched_time(skb->len, q);
-
                         if (!skb_queue_empty(list)) {
                                 /*
-                                 * Last packet in queue is reference point (now).
-                                 * First packet in queue is already in flight,
-                                 * calculate this time bonus and substract
+                                 * Last packet in queue is reference point (now),
+                                 * calculate this time bonus and subtract
                                  * from delay.
                                  */
-                                delay -= now - netem_skb_cb(skb_peek(list))->time_to_send;
+                                delay -= netem_skb_cb(skb_peek_tail(list))->time_to_send - now;
+                                delay = max_t(psched_tdiff_t, 0, delay);
                                 now = netem_skb_cb(skb_peek_tail(list))->time_to_send;
                         }
+
+                        delay += packet_len_2_sched_time(skb->len, q);
                 }
 
                 cb->time_to_send = now + delay;
diff --git a/net/sched/sch_tbf.c b/net/sched/sch_tbf.c
index 4b056c15e90c..c8388f3c3426 100644
--- a/net/sched/sch_tbf.c
+++ b/net/sched/sch_tbf.c
@@ -19,6 +19,7 @@
 #include <linux/errno.h>
 #include <linux/skbuff.h>
 #include <net/netlink.h>
+#include <net/sch_generic.h>
 #include <net/pkt_sched.h>
 
 
@@ -100,23 +101,21 @@
 struct tbf_sched_data {
 /* Parameters */
         u32             limit;          /* Maximal length of backlog: bytes */
-        u32             buffer;         /* Token bucket depth/rate: MUST BE >= MTU/B */
-        u32             mtu;
+        s64             buffer;         /* Token bucket depth/rate: MUST BE >= MTU/B */
+        s64             mtu;
         u32             max_size;
-        struct qdisc_rate_table *R_tab;
-        struct qdisc_rate_table *P_tab;
+        struct psched_ratecfg rate;
+        struct psched_ratecfg peak;
+        bool peak_present;
 
 /* Variables */
-        long    tokens;                 /* Current number of B tokens */
-        long    ptokens;                /* Current number of P tokens */
-        psched_time_t   t_c;            /* Time check-point */
+        s64     tokens;                 /* Current number of B tokens */
+        s64     ptokens;                /* Current number of P tokens */
+        s64     t_c;                    /* Time check-point */
         struct Qdisc    *qdisc;         /* Inner qdisc, default - bfifo queue */
         struct qdisc_watchdog watchdog; /* Watchdog timer */
 };
 
-#define L2T(q, L)   qdisc_l2t((q)->R_tab, L)
-#define L2T_P(q, L) qdisc_l2t((q)->P_tab, L)
-
 static int tbf_enqueue(struct sk_buff *skb, struct Qdisc *sch)
 {
         struct tbf_sched_data *q = qdisc_priv(sch);
@@ -156,24 +155,24 @@ static struct sk_buff *tbf_dequeue(struct Qdisc *sch)
         skb = q->qdisc->ops->peek(q->qdisc);
 
         if (skb) {
-                psched_time_t now;
-                long toks;
-                long ptoks = 0;
+                s64 now;
+                s64 toks;
+                s64 ptoks = 0;
                 unsigned int len = qdisc_pkt_len(skb);
 
-                now = psched_get_time();
-                toks = psched_tdiff_bounded(now, q->t_c, q->buffer);
+                now = ktime_to_ns(ktime_get());
+                toks = min_t(s64, now - q->t_c, q->buffer);
 
-                if (q->P_tab) {
+                if (q->peak_present) {
                         ptoks = toks + q->ptokens;
-                        if (ptoks > (long)q->mtu)
+                        if (ptoks > q->mtu)
                                 ptoks = q->mtu;
-                        ptoks -= L2T_P(q, len);
+                        ptoks -= (s64) psched_l2t_ns(&q->peak, len);
                 }
                 toks += q->tokens;
-                if (toks > (long)q->buffer)
+                if (toks > q->buffer)
                         toks = q->buffer;
-                toks -= L2T(q, len);
+                toks -= (s64) psched_l2t_ns(&q->rate, len);
 
                 if ((toks|ptoks) >= 0) {
                         skb = qdisc_dequeue_peeked(q->qdisc);
@@ -189,8 +188,8 @@ static struct sk_buff *tbf_dequeue(struct Qdisc *sch)
                         return skb;
                 }
 
-                qdisc_watchdog_schedule(&q->watchdog,
-                                        now + max_t(long, -toks, -ptoks));
+                qdisc_watchdog_schedule_ns(&q->watchdog,
+                                           now + max_t(long, -toks, -ptoks));
 
                 /* Maybe we have a shorter packet in the queue,
                    which can be sent now. It sounds cool,
@@ -214,7 +213,7 @@ static void tbf_reset(struct Qdisc *sch)
 
         qdisc_reset(q->qdisc);
         sch->q.qlen = 0;
-        q->t_c = psched_get_time();
+        q->t_c = ktime_to_ns(ktime_get());
         q->tokens = q->buffer;
         q->ptokens = q->mtu;
         qdisc_watchdog_cancel(&q->watchdog);
@@ -293,14 +292,19 @@ static int tbf_change(struct Qdisc *sch, struct nlattr *opt)
                 q->qdisc = child;
         }
         q->limit = qopt->limit;
-        q->mtu = qopt->mtu;
+        q->mtu = PSCHED_TICKS2NS(qopt->mtu);
         q->max_size = max_size;
-        q->buffer = qopt->buffer;
+        q->buffer = PSCHED_TICKS2NS(qopt->buffer);
         q->tokens = q->buffer;
         q->ptokens = q->mtu;
 
-        swap(q->R_tab, rtab);
-        swap(q->P_tab, ptab);
+        psched_ratecfg_precompute(&q->rate, rtab->rate.rate);
+        if (ptab) {
+                psched_ratecfg_precompute(&q->peak, ptab->rate.rate);
+                q->peak_present = true;
+        } else {
+                q->peak_present = false;
+        }
 
         sch_tree_unlock(sch);
         err = 0;
@@ -319,7 +323,7 @@ static int tbf_init(struct Qdisc *sch, struct nlattr *opt)
         if (opt == NULL)
                 return -EINVAL;
 
-        q->t_c = psched_get_time();
+        q->t_c = ktime_to_ns(ktime_get());
         qdisc_watchdog_init(&q->watchdog, sch);
         q->qdisc = &noop_qdisc;
 
@@ -331,12 +335,6 @@ static void tbf_destroy(struct Qdisc *sch)
         struct tbf_sched_data *q = qdisc_priv(sch);
 
         qdisc_watchdog_cancel(&q->watchdog);
-
-        if (q->P_tab)
-                qdisc_put_rtab(q->P_tab);
-        if (q->R_tab)
-                qdisc_put_rtab(q->R_tab);
-
         qdisc_destroy(q->qdisc);
 }
 
@@ -352,13 +350,13 @@ static int tbf_dump(struct Qdisc *sch, struct sk_buff *skb)
                 goto nla_put_failure;
 
         opt.limit = q->limit;
-        opt.rate = q->R_tab->rate;
-        if (q->P_tab)
-                opt.peakrate = q->P_tab->rate;
+        opt.rate.rate = psched_ratecfg_getrate(&q->rate);
+        if (q->peak_present)
+                opt.peakrate.rate = psched_ratecfg_getrate(&q->peak);
         else
                 memset(&opt.peakrate, 0, sizeof(opt.peakrate));
-        opt.mtu = q->mtu;
-        opt.buffer = q->buffer;
+        opt.mtu = PSCHED_NS2TICKS(q->mtu);
+        opt.buffer = PSCHED_NS2TICKS(q->buffer);
         if (nla_put(skb, TCA_TBF_PARMS, sizeof(opt), &opt))
                 goto nla_put_failure;
 
diff --git a/net/sctp/Kconfig b/net/sctp/Kconfig
index 7521d944c0fb..cf4852814e0c 100644
--- a/net/sctp/Kconfig
+++ b/net/sctp/Kconfig
@@ -3,8 +3,8 @@
 #
 
 menuconfig IP_SCTP
-        tristate "The SCTP Protocol (EXPERIMENTAL)"
-        depends on INET && EXPERIMENTAL
+        tristate "The SCTP Protocol"
+        depends on INET
         depends on IPV6 || IPV6=n
         select CRYPTO
         select CRYPTO_HMAC
diff --git a/net/sctp/auth.c b/net/sctp/auth.c
index 159b9bc5d633..ba1dfc3f8def 100644
--- a/net/sctp/auth.c
+++ b/net/sctp/auth.c
@@ -71,7 +71,7 @@ void sctp_auth_key_put(struct sctp_auth_bytes *key)
                 return;
 
         if (atomic_dec_and_test(&key->refcnt)) {
-                kfree(key);
+                kzfree(key);
                 SCTP_DBG_OBJCNT_DEC(keys);
         }
 }
@@ -200,27 +200,28 @@ static struct sctp_auth_bytes *sctp_auth_make_key_vector(
         struct sctp_auth_bytes *new;
         __u32   len;
         __u32   offset = 0;
+        __u16   random_len, hmacs_len, chunks_len = 0;
 
-        len = ntohs(random->param_hdr.length) + ntohs(hmacs->param_hdr.length);
-        if (chunks)
-                len += ntohs(chunks->param_hdr.length);
+        random_len = ntohs(random->param_hdr.length);
+        hmacs_len = ntohs(hmacs->param_hdr.length);
+        if (chunks)
+                chunks_len = ntohs(chunks->param_hdr.length);
 
-        new = kmalloc(sizeof(struct sctp_auth_bytes) + len, gfp);
+        len = random_len + hmacs_len + chunks_len;
+
+        new = sctp_auth_create_key(len, gfp);
         if (!new)
                 return NULL;
 
-        new->len = len;
-
-        memcpy(new->data, random, ntohs(random->param_hdr.length));
-        offset += ntohs(random->param_hdr.length);
+        memcpy(new->data, random, random_len);
+        offset += random_len;
 
         if (chunks) {
-                memcpy(new->data + offset, chunks,
-                        ntohs(chunks->param_hdr.length));
-                offset += ntohs(chunks->param_hdr.length);
+                memcpy(new->data + offset, chunks, chunks_len);
+                offset += chunks_len;
         }
 
-        memcpy(new->data + offset, hmacs, ntohs(hmacs->param_hdr.length));
+        memcpy(new->data + offset, hmacs, hmacs_len);
 
         return new;
 }
@@ -350,8 +351,8 @@ static struct sctp_auth_bytes *sctp_auth_asoc_create_secret(
         secret = sctp_auth_asoc_set_secret(ep_key, first_vector, last_vector,
                                             gfp);
 out:
-        kfree(local_key_vector);
-        kfree(peer_key_vector);
+        sctp_auth_key_put(local_key_vector);
+        sctp_auth_key_put(peer_key_vector);
 
         return secret;
 }
diff --git a/net/sctp/endpointola.c b/net/sctp/endpointola.c
index 17a001bac2cc..73aad3d16a45 100644
--- a/net/sctp/endpointola.c
+++ b/net/sctp/endpointola.c
@@ -151,9 +151,7 @@ static struct sctp_endpoint *sctp_endpoint_init(struct sctp_endpoint *ep,
         ep->rcvbuf_policy = net->sctp.rcvbuf_policy;
 
         /* Initialize the secret key used with cookie. */
-        get_random_bytes(&ep->secret_key[0], SCTP_SECRET_SIZE);
-        ep->last_key = ep->current_key = 0;
-        ep->key_changed_at = jiffies;
+        get_random_bytes(ep->secret_key, sizeof(ep->secret_key));
 
         /* SCTP-AUTH extensions*/
         INIT_LIST_HEAD(&ep->endpoint_shared_keys);
@@ -271,6 +269,8 @@ static void sctp_endpoint_destroy(struct sctp_endpoint *ep)
         sctp_inq_free(&ep->base.inqueue);
         sctp_bind_addr_free(&ep->base.bind_addr);
 
+        memset(ep->secret_key, 0, sizeof(ep->secret_key));
+
         /* Remove and free the port */
         if (sctp_sk(ep->base.sk)->bind_hash)
                 sctp_put_port(ep->base.sk);
diff --git a/net/sctp/ipv6.c b/net/sctp/ipv6.c
index f3f0f4dc31dd..391a245d5203 100644
--- a/net/sctp/ipv6.c
+++ b/net/sctp/ipv6.c
@@ -326,9 +326,10 @@ static void sctp_v6_get_dst(struct sctp_transport *t, union sctp_addr *saddr,
          */
         rcu_read_lock();
         list_for_each_entry_rcu(laddr, &bp->address_list, list) {
-                if (!laddr->valid && laddr->state != SCTP_ADDR_SRC)
+                if (!laddr->valid)
                         continue;
-                if ((laddr->a.sa.sa_family == AF_INET6) &&
+                if ((laddr->state == SCTP_ADDR_SRC) &&
+                    (laddr->a.sa.sa_family == AF_INET6) &&
                     (scope <= sctp_scope(&laddr->a))) {
                         bmatchlen = sctp_v6_addr_match_len(daddr, &laddr->a);
                         if (!baddr || (matchlen < bmatchlen)) {
diff --git a/net/sctp/probe.c b/net/sctp/probe.c
index 5f7518de2fd1..ad0dba870341 100644
--- a/net/sctp/probe.c
+++ b/net/sctp/probe.c
@@ -122,12 +122,12 @@ static const struct file_operations sctpprobe_fops = {
         .llseek = noop_llseek,
 };
 
-sctp_disposition_t jsctp_sf_eat_sack(struct net *net,
-                                     const struct sctp_endpoint *ep,
-                                     const struct sctp_association *asoc,
-                                     const sctp_subtype_t type,
-                                     void *arg,
-                                     sctp_cmd_seq_t *commands)
+static sctp_disposition_t jsctp_sf_eat_sack(struct net *net,
+                                            const struct sctp_endpoint *ep,
+                                            const struct sctp_association *asoc,
+                                            const sctp_subtype_t type,
+                                            void *arg,
+                                            sctp_cmd_seq_t *commands)
 {
         struct sctp_transport *sp;
         static __u32 lcwnd = 0;
@@ -183,13 +183,20 @@ static __init int sctpprobe_init(void)
 {
         int ret = -ENOMEM;
 
+        /* Warning: if the function signature of sctp_sf_eat_sack_6_2,
+         * has been changed, you also have to change the signature of
+         * jsctp_sf_eat_sack, otherwise you end up right here!
+         */
+        BUILD_BUG_ON(__same_type(sctp_sf_eat_sack_6_2,
+                                 jsctp_sf_eat_sack) == 0);
+
         init_waitqueue_head(&sctpw.wait);
         spin_lock_init(&sctpw.lock);
         if (kfifo_alloc(&sctpw.fifo, bufsize, GFP_KERNEL))
                 return ret;
 
-        if (!proc_net_fops_create(&init_net, procname, S_IRUSR,
-                                  &sctpprobe_fops))
+        if (!proc_create(procname, S_IRUSR, init_net.proc_net,
+                         &sctpprobe_fops))
                 goto free_kfifo;
 
         ret = register_jprobe(&sctp_recv_probe);
@@ -201,7 +208,7 @@ static __init int sctpprobe_init(void)
         return 0;
 
 remove_proc:
-        proc_net_remove(&init_net, procname);
+        remove_proc_entry(procname, init_net.proc_net);
 free_kfifo:
         kfifo_free(&sctpw.fifo);
         return ret;
@@ -210,7 +217,7 @@ free_kfifo:
 static __exit void sctpprobe_exit(void)
 {
         kfifo_free(&sctpw.fifo);
-        proc_net_remove(&init_net, procname);
+        remove_proc_entry(procname, init_net.proc_net);
         unregister_jprobe(&sctp_recv_probe);
 }
 
diff --git a/net/sctp/sm_make_chunk.c b/net/sctp/sm_make_chunk.c
index e1c5fc2be6b8..a193f3bc8144 100644
--- a/net/sctp/sm_make_chunk.c
+++ b/net/sctp/sm_make_chunk.c
@@ -1589,8 +1589,6 @@ static sctp_cookie_param_t *sctp_pack_cookie(const struct sctp_endpoint *ep,
         struct sctp_signed_cookie *cookie;
         struct scatterlist sg;
         int headersize, bodysize;
-        unsigned int keylen;
-        char *key;
 
         /* Header size is static data prior to the actual cookie, including
          * any padding.
@@ -1650,12 +1648,11 @@ static sctp_cookie_param_t *sctp_pack_cookie(const struct sctp_endpoint *ep,
 
                 /* Sign the message.  */
                 sg_init_one(&sg, &cookie->c, bodysize);
-                keylen = SCTP_SECRET_SIZE;
-                key = (char *)ep->secret_key[ep->current_key];
                 desc.tfm = sctp_sk(ep->base.sk)->hmac;
                 desc.flags = 0;
 
-                if (crypto_hash_setkey(desc.tfm, key, keylen) ||
+                if (crypto_hash_setkey(desc.tfm, ep->secret_key,
+                                       sizeof(ep->secret_key)) ||
                     crypto_hash_digest(&desc, &sg, bodysize, cookie->signature))
                         goto free_cookie;
         }
@@ -1682,8 +1679,7 @@ struct sctp_association *sctp_unpack_cookie(
         int headersize, bodysize, fixed_size;
         __u8 *digest = ep->digest;
         struct scatterlist sg;
-        unsigned int keylen, len;
-        char *key;
+        unsigned int len;
         sctp_scope_t scope;
         struct sk_buff *skb = chunk->skb;
         struct timeval tv;
@@ -1718,34 +1714,21 @@ struct sctp_association *sctp_unpack_cookie(
                 goto no_hmac;
 
         /* Check the signature.  */
-        keylen = SCTP_SECRET_SIZE;
         sg_init_one(&sg, bear_cookie, bodysize);
-        key = (char *)ep->secret_key[ep->current_key];
         desc.tfm = sctp_sk(ep->base.sk)->hmac;
         desc.flags = 0;
 
         memset(digest, 0x00, SCTP_SIGNATURE_SIZE);
-        if (crypto_hash_setkey(desc.tfm, key, keylen) ||
+        if (crypto_hash_setkey(desc.tfm, ep->secret_key,
+                               sizeof(ep->secret_key)) ||
             crypto_hash_digest(&desc, &sg, bodysize, digest)) {
                 *error = -SCTP_IERROR_NOMEM;
                 goto fail;
         }
 
         if (memcmp(digest, cookie->signature, SCTP_SIGNATURE_SIZE)) {
-                /* Try the previous key. */
-                key = (char *)ep->secret_key[ep->last_key];
-                memset(digest, 0x00, SCTP_SIGNATURE_SIZE);
-                if (crypto_hash_setkey(desc.tfm, key, keylen) ||
-                    crypto_hash_digest(&desc, &sg, bodysize, digest)) {
-                        *error = -SCTP_IERROR_NOMEM;
-                        goto fail;
-                }
-
-                if (memcmp(digest, cookie->signature, SCTP_SIGNATURE_SIZE)) {
-                        /* Yikes!  Still bad signature! */
-                        *error = -SCTP_IERROR_BAD_SIG;
-                        goto fail;
-                }
+                *error = -SCTP_IERROR_BAD_SIG;
+                goto fail;
         }
 
 no_hmac:
diff --git a/net/sctp/socket.c b/net/sctp/socket.c
index 9e65758cb038..cedd9bf67b8c 100644
--- a/net/sctp/socket.c
+++ b/net/sctp/socket.c
@@ -3390,7 +3390,7 @@ static int sctp_setsockopt_auth_key(struct sock *sk,
 
         ret = sctp_auth_set_key(sctp_sk(sk)->ep, asoc, authkey);
 out:
-        kfree(authkey);
+        kzfree(authkey);
         return ret;
 }
 
diff --git a/net/socket.c b/net/socket.c
index 5c4d82c05293..ee0d029e5130 100644
--- a/net/socket.c
+++ b/net/socket.c
@@ -2837,7 +2837,7 @@ static int ethtool_ioctl(struct net *net, struct compat_ifreq __user *ifr32)
         }
 
         ifr = compat_alloc_user_space(buf_size);
-        rxnfc = (void *)ifr + ALIGN(sizeof(struct ifreq), 8);
+        rxnfc = (void __user *)ifr + ALIGN(sizeof(struct ifreq), 8);
 
         if (copy_in_user(&ifr->ifr_name, &ifr32->ifr_name, IFNAMSIZ))
                 return -EFAULT;
@@ -2861,12 +2861,12 @@ static int ethtool_ioctl(struct net *net, struct compat_ifreq __user *ifr32)
                         offsetof(struct ethtool_rxnfc, fs.ring_cookie));
 
                 if (copy_in_user(rxnfc, compat_rxnfc,
-                                 (void *)(&rxnfc->fs.m_ext + 1) -
-                                 (void *)rxnfc) ||
+                                 (void __user *)(&rxnfc->fs.m_ext + 1) -
+                                 (void __user *)rxnfc) ||
                     copy_in_user(&rxnfc->fs.ring_cookie,
                                  &compat_rxnfc->fs.ring_cookie,
-                                 (void *)(&rxnfc->fs.location + 1) -
-                                 (void *)&rxnfc->fs.ring_cookie) ||
+                                 (void __user *)(&rxnfc->fs.location + 1) -
+                                 (void __user *)&rxnfc->fs.ring_cookie) ||
                     copy_in_user(&rxnfc->rule_cnt, &compat_rxnfc->rule_cnt,
                                  sizeof(rxnfc->rule_cnt)))
                         return -EFAULT;
@@ -2878,12 +2878,12 @@ static int ethtool_ioctl(struct net *net, struct compat_ifreq __user *ifr32)
 
         if (convert_out) {
                 if (copy_in_user(compat_rxnfc, rxnfc,
-                                 (const void *)(&rxnfc->fs.m_ext + 1) -
-                                 (const void *)rxnfc) ||
+                                 (const void __user *)(&rxnfc->fs.m_ext + 1) -
+                                 (const void __user *)rxnfc) ||
                     copy_in_user(&compat_rxnfc->fs.ring_cookie,
                                  &rxnfc->fs.ring_cookie,
-                                 (const void *)(&rxnfc->fs.location + 1) -
-                                 (const void *)&rxnfc->fs.ring_cookie) ||
+                                 (const void __user *)(&rxnfc->fs.location + 1) -
+                                 (const void __user *)&rxnfc->fs.ring_cookie) ||
                     copy_in_user(&compat_rxnfc->rule_cnt, &rxnfc->rule_cnt,
                                  sizeof(rxnfc->rule_cnt)))
                         return -EFAULT;
diff --git a/net/sunrpc/sched.c b/net/sunrpc/sched.c
index bfa31714581f..fb20f25ddec9 100644
--- a/net/sunrpc/sched.c
+++ b/net/sunrpc/sched.c
@@ -98,9 +98,25 @@ __rpc_add_timer(struct rpc_wait_queue *queue, struct rpc_task *task)
         list_add(&task->u.tk_wait.timer_list, &queue->timer_list.list);
 }
 
+static void rpc_rotate_queue_owner(struct rpc_wait_queue *queue)
+{
+        struct list_head *q = &queue->tasks[queue->priority];
+        struct rpc_task *task;
+
+        if (!list_empty(q)) {
+                task = list_first_entry(q, struct rpc_task, u.tk_wait.list);
+                if (task->tk_owner == queue->owner)
+                        list_move_tail(&task->u.tk_wait.list, q);
+        }
+}
+
 static void rpc_set_waitqueue_priority(struct rpc_wait_queue *queue, int priority)
 {
-        queue->priority = priority;
+        if (queue->priority != priority) {
+                /* Fairness: rotate the list when changing priority */
+                rpc_rotate_queue_owner(queue);
+                queue->priority = priority;
+        }
 }
 
 static void rpc_set_waitqueue_owner(struct rpc_wait_queue *queue, pid_t pid)
diff --git a/net/sunrpc/svcsock.c b/net/sunrpc/svcsock.c
index 0a148c9d2a5c..0f679df7d072 100644
--- a/net/sunrpc/svcsock.c
+++ b/net/sunrpc/svcsock.c
@@ -465,7 +465,7 @@ static int svc_udp_get_dest_address4(struct svc_rqst *rqstp,
 }
 
 /*
- * See net/ipv6/datagram.c : datagram_recv_ctl
+ * See net/ipv6/datagram.c : ip6_datagram_recv_ctl
  */
 static int svc_udp_get_dest_address6(struct svc_rqst *rqstp,
                                      struct cmsghdr *cmh)
diff --git a/net/tipc/bcast.c b/net/tipc/bcast.c
index 54f89f90ac33..2655c9f4ecad 100644
--- a/net/tipc/bcast.c
+++ b/net/tipc/bcast.c
@@ -774,6 +774,7 @@ void tipc_bclink_init(void)
         bcl->owner = &bclink->node;
         bcl->max_pkt = MAX_PKT_DEFAULT_MCAST;
         tipc_link_set_queue_limits(bcl, BCLINK_WIN_DEFAULT);
+        spin_lock_init(&bcbearer->bearer.lock);
         bcl->b_ptr = &bcbearer->bearer;
         bcl->state = WORKING_WORKING;
         strlcpy(bcl->name, tipc_bclink_name, TIPC_MAX_LINK_NAME);
diff --git a/net/tipc/socket.c b/net/tipc/socket.c
index 9b4e4833a484..a9622b6cd916 100644
--- a/net/tipc/socket.c
+++ b/net/tipc/socket.c
@@ -43,7 +43,8 @@
 #define SS_LISTENING    -1      /* socket is listening */
 #define SS_READY        -2      /* socket is connectionless */
 
-#define OVERLOAD_LIMIT_BASE     10000
+#define CONN_OVERLOAD_LIMIT     ((TIPC_FLOW_CONTROL_WIN * 2 + 1) * \
+                                SKB_TRUESIZE(TIPC_MAX_USER_MSG_SIZE))
 #define CONN_TIMEOUT_DEFAULT    8000    /* default connect timeout = 8s */
 
 struct tipc_sock {
@@ -129,19 +130,6 @@ static void advance_rx_queue(struct sock *sk)
 }
 
 /**
- * discard_rx_queue - discard all buffers in socket receive queue
- *
- * Caller must hold socket lock
- */
-static void discard_rx_queue(struct sock *sk)
-{
-        struct sk_buff *buf;
-
-        while ((buf = __skb_dequeue(&sk->sk_receive_queue)))
-                kfree_skb(buf);
-}
-
-/**
  * reject_rx_queue - reject all buffers in socket receive queue
  *
  * Caller must hold socket lock
@@ -215,7 +203,6 @@ static int tipc_create(struct net *net, struct socket *sock, int protocol,
 
         sock_init_data(sock, sk);
         sk->sk_backlog_rcv = backlog_rcv;
-        sk->sk_rcvbuf = TIPC_FLOW_CONTROL_WIN * 2 * TIPC_MAX_USER_MSG_SIZE * 2;
         sk->sk_data_ready = tipc_data_ready;
         sk->sk_write_space = tipc_write_space;
         tipc_sk(sk)->p = tp_ptr;
@@ -292,7 +279,7 @@ static int release(struct socket *sock)
         res = tipc_deleteport(tport->ref);
 
         /* Discard any remaining (connection-based) messages in receive queue */
-        discard_rx_queue(sk);
+        __skb_queue_purge(&sk->sk_receive_queue);
 
         /* Reject any messages that accumulated in backlog queue */
         sock->state = SS_DISCONNECTING;
@@ -516,8 +503,7 @@ static int send_msg(struct kiocb *iocb, struct socket *sock,
         if (unlikely((m->msg_namelen < sizeof(*dest)) ||
                      (dest->family != AF_TIPC)))
                 return -EINVAL;
-        if ((total_len > TIPC_MAX_USER_MSG_SIZE) ||
-            (m->msg_iovlen > (unsigned int)INT_MAX))
+        if (total_len > TIPC_MAX_USER_MSG_SIZE)
                 return -EMSGSIZE;
 
         if (iocb)
@@ -625,8 +611,7 @@ static int send_packet(struct kiocb *iocb, struct socket *sock,
         if (unlikely(dest))
                 return send_msg(iocb, sock, m, total_len);
 
-        if ((total_len > TIPC_MAX_USER_MSG_SIZE) ||
-            (m->msg_iovlen > (unsigned int)INT_MAX))
+        if (total_len > TIPC_MAX_USER_MSG_SIZE)
                 return -EMSGSIZE;
 
         if (iocb)
@@ -711,8 +696,7 @@ static int send_stream(struct kiocb *iocb, struct socket *sock,
                 goto exit;
         }
 
-        if ((total_len > (unsigned int)INT_MAX) ||
-            (m->msg_iovlen > (unsigned int)INT_MAX)) {
+        if (total_len > (unsigned int)INT_MAX) {
                 res = -EMSGSIZE;
                 goto exit;
         }
@@ -1155,34 +1139,6 @@ static void tipc_data_ready(struct sock *sk, int len)
 }
 
 /**
- * rx_queue_full - determine if receive queue can accept another message
- * @msg: message to be added to queue
- * @queue_size: current size of queue
- * @base: nominal maximum size of queue
- *
- * Returns 1 if queue is unable to accept message, 0 otherwise
- */
-static int rx_queue_full(struct tipc_msg *msg, u32 queue_size, u32 base)
-{
-        u32 threshold;
-        u32 imp = msg_importance(msg);
-
-        if (imp == TIPC_LOW_IMPORTANCE)
-                threshold = base;
-        else if (imp == TIPC_MEDIUM_IMPORTANCE)
-                threshold = base * 2;
-        else if (imp == TIPC_HIGH_IMPORTANCE)
-                threshold = base * 100;
-        else
-                return 0;
-
-        if (msg_connected(msg))
-                threshold *= 4;
-
-        return queue_size >= threshold;
-}
-
-/**
  * filter_connect - Handle all incoming messages for a connection-based socket
  * @tsock: TIPC socket
  * @msg: message
@@ -1260,6 +1216,36 @@ static u32 filter_connect(struct tipc_sock *tsock, struct sk_buff **buf)
 }
 
 /**
+ * rcvbuf_limit - get proper overload limit of socket receive queue
+ * @sk: socket
+ * @buf: message
+ *
+ * For all connection oriented messages, irrespective of importance,
+ * the default overload value (i.e. 67MB) is set as limit.
+ *
+ * For all connectionless messages, by default new queue limits are
+ * as belows:
+ *
+ * TIPC_LOW_IMPORTANCE       (5MB)
+ * TIPC_MEDIUM_IMPORTANCE    (10MB)
+ * TIPC_HIGH_IMPORTANCE      (20MB)
+ * TIPC_CRITICAL_IMPORTANCE  (40MB)
+ *
+ * Returns overload limit according to corresponding message importance
+ */
+static unsigned int rcvbuf_limit(struct sock *sk, struct sk_buff *buf)
+{
+        struct tipc_msg *msg = buf_msg(buf);
+        unsigned int limit;
+
+        if (msg_connected(msg))
+                limit = CONN_OVERLOAD_LIMIT;
+        else
+                limit = sk->sk_rcvbuf << (msg_importance(msg) + 5);
+        return limit;
+}
+
+/**
  * filter_rcv - validate incoming message
  * @sk: socket
  * @buf: message
@@ -1275,7 +1261,7 @@ static u32 filter_rcv(struct sock *sk, struct sk_buff *buf)
 {
         struct socket *sock = sk->sk_socket;
         struct tipc_msg *msg = buf_msg(buf);
-        u32 recv_q_len;
+        unsigned int limit = rcvbuf_limit(sk, buf);
         u32 res = TIPC_OK;
 
         /* Reject message if it is wrong sort of message for socket */
@@ -1292,15 +1278,13 @@ static u32 filter_rcv(struct sock *sk, struct sk_buff *buf)
         }
 
         /* Reject message if there isn't room to queue it */
-        recv_q_len = skb_queue_len(&sk->sk_receive_queue);
-        if (unlikely(recv_q_len >= (OVERLOAD_LIMIT_BASE / 2))) {
-                if (rx_queue_full(msg, recv_q_len, OVERLOAD_LIMIT_BASE / 2))
-                        return TIPC_ERR_OVERLOAD;
-        }
+        if (sk_rmem_alloc_get(sk) + buf->truesize >= limit)
+                return TIPC_ERR_OVERLOAD;
 
-        /* Enqueue message (finally!) */
+        /* Enqueue message */
         TIPC_SKB_CB(buf)->handle = 0;
         __skb_queue_tail(&sk->sk_receive_queue, buf);
+        skb_set_owner_r(buf, sk);
 
         sk->sk_data_ready(sk, 0);
         return TIPC_OK;
@@ -1349,7 +1333,7 @@ static u32 dispatch(struct tipc_port *tport, struct sk_buff *buf)
         if (!sock_owned_by_user(sk)) {
                 res = filter_rcv(sk, buf);
         } else {
-                if (sk_add_backlog(sk, buf, sk->sk_rcvbuf))
+                if (sk_add_backlog(sk, buf, rcvbuf_limit(sk, buf)))
                         res = TIPC_ERR_OVERLOAD;
                 else
                         res = TIPC_OK;
@@ -1583,6 +1567,7 @@ static int accept(struct socket *sock, struct socket *new_sock, int flags)
         } else {
                 __skb_dequeue(&sk->sk_receive_queue);
                 __skb_queue_head(&new_sk->sk_receive_queue, buf);
+                skb_set_owner_r(buf, new_sk);
         }
         release_sock(new_sk);
 
@@ -1637,7 +1622,7 @@ restart:
         case SS_DISCONNECTING:
 
                 /* Discard any unreceived messages */
-                discard_rx_queue(sk);
+                __skb_queue_purge(&sk->sk_receive_queue);
 
                 /* Wake up anyone sleeping in poll */
                 sk->sk_state_change(sk);
diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
index 0c612361c153..87d284289012 100644
--- a/net/unix/af_unix.c
+++ b/net/unix/af_unix.c
@@ -2402,7 +2402,7 @@ static int __net_init unix_net_init(struct net *net)
                 goto out;
 
 #ifdef CONFIG_PROC_FS
-        if (!proc_net_fops_create(net, "unix", 0, &unix_seq_fops)) {
+        if (!proc_create("unix", 0, net->proc_net, &unix_seq_fops)) {
                 unix_sysctl_unregister(net);
                 goto out;
         }
@@ -2415,7 +2415,7 @@ out:
 static void __net_exit unix_net_exit(struct net *net)
 {
         unix_sysctl_unregister(net);
-        proc_net_remove(net, "unix");
+        remove_proc_entry("unix", net->proc_net);
 }
 
 static struct pernet_operations unix_net_ops = {
diff --git a/net/vmw_vsock/Kconfig b/net/vmw_vsock/Kconfig
new file mode 100644
index 000000000000..b5fa7e40cdcb
--- /dev/null
+++ b/net/vmw_vsock/Kconfig
@@ -0,0 +1,28 @@
+#
+# Vsock protocol
+#
+
+config VSOCKETS
+        tristate "Virtual Socket protocol"
+        help
+          Virtual Socket Protocol is a socket protocol similar to TCP/IP
+          allowing comunication between Virtual Machines and hypervisor
+          or host.
+
+          You should also select one or more hypervisor-specific transports
+          below.
+
+          To compile this driver as a module, choose M here: the module
+          will be called vsock. If unsure, say N.
+
+config VMWARE_VMCI_VSOCKETS
+        tristate "VMware VMCI transport for Virtual Sockets"
+        depends on VSOCKETS && VMWARE_VMCI
+        help
+          This module implements a VMCI transport for Virtual Sockets.
+
+          Enable this transport if your Virtual Machine runs on a VMware
+          hypervisor.
+
+          To compile this driver as a module, choose M here: the module
+          will be called vmw_vsock_vmci_transport. If unsure, say N.
diff --git a/net/vmw_vsock/Makefile b/net/vmw_vsock/Makefile
new file mode 100644
index 000000000000..2ce52d70f224
--- /dev/null
+++ b/net/vmw_vsock/Makefile
@@ -0,0 +1,7 @@
+obj-$(CONFIG_VSOCKETS) += vsock.o
+obj-$(CONFIG_VMWARE_VMCI_VSOCKETS) += vmw_vsock_vmci_transport.o
+
+vsock-y += af_vsock.o vsock_addr.o
+
+vmw_vsock_vmci_transport-y += vmci_transport.o vmci_transport_notify.o \
+        vmci_transport_notify_qstate.o
diff --git a/net/vmw_vsock/af_vsock.c b/net/vmw_vsock/af_vsock.c
new file mode 100644
index 000000000000..ca511c4f388a
--- /dev/null
+++ b/net/vmw_vsock/af_vsock.c
@@ -0,0 +1,2012 @@
+/*
+ * VMware vSockets Driver
+ *
+ * Copyright (C) 2007-2013 VMware, Inc. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the Free
+ * Software Foundation version 2 and no later version.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ */
+
+/* Implementation notes:
+ *
+ * - There are two kinds of sockets: those created by user action (such as
+ * calling socket(2)) and those created by incoming connection request packets.
+ *
+ * - There are two "global" tables, one for bound sockets (sockets that have
+ * specified an address that they are responsible for) and one for connected
+ * sockets (sockets that have established a connection with another socket).
+ * These tables are "global" in that all sockets on the system are placed
+ * within them. - Note, though, that the bound table contains an extra entry
+ * for a list of unbound sockets and SOCK_DGRAM sockets will always remain in
+ * that list. The bound table is used solely for lookup of sockets when packets
+ * are received and that's not necessary for SOCK_DGRAM sockets since we create
+ * a datagram handle for each and need not perform a lookup.  Keeping SOCK_DGRAM
+ * sockets out of the bound hash buckets will reduce the chance of collisions
+ * when looking for SOCK_STREAM sockets and prevents us from having to check the
+ * socket type in the hash table lookups.
+ *
+ * - Sockets created by user action will either be "client" sockets that
+ * initiate a connection or "server" sockets that listen for connections; we do
+ * not support simultaneous connects (two "client" sockets connecting).
+ *
+ * - "Server" sockets are referred to as listener sockets throughout this
+ * implementation because they are in the SS_LISTEN state.  When a connection
+ * request is received (the second kind of socket mentioned above), we create a
+ * new socket and refer to it as a pending socket.  These pending sockets are
+ * placed on the pending connection list of the listener socket.  When future
+ * packets are received for the address the listener socket is bound to, we
+ * check if the source of the packet is from one that has an existing pending
+ * connection.  If it does, we process the packet for the pending socket.  When
+ * that socket reaches the connected state, it is removed from the listener
+ * socket's pending list and enqueued in the listener socket's accept queue.
+ * Callers of accept(2) will accept connected sockets from the listener socket's
+ * accept queue.  If the socket cannot be accepted for some reason then it is
+ * marked rejected.  Once the connection is accepted, it is owned by the user
+ * process and the responsibility for cleanup falls with that user process.
+ *
+ * - It is possible that these pending sockets will never reach the connected
+ * state; in fact, we may never receive another packet after the connection
+ * request.  Because of this, we must schedule a cleanup function to run in the
+ * future, after some amount of time passes where a connection should have been
+ * established.  This function ensures that the socket is off all lists so it
+ * cannot be retrieved, then drops all references to the socket so it is cleaned
+ * up (sock_put() -> sk_free() -> our sk_destruct implementation).  Note this
+ * function will also cleanup rejected sockets, those that reach the connected
+ * state but leave it before they have been accepted.
+ *
+ * - Sockets created by user action will be cleaned up when the user process
+ * calls close(2), causing our release implementation to be called. Our release
+ * implementation will perform some cleanup then drop the last reference so our
+ * sk_destruct implementation is invoked.  Our sk_destruct implementation will
+ * perform additional cleanup that's common for both types of sockets.
+ *
+ * - A socket's reference count is what ensures that the structure won't be
+ * freed.  Each entry in a list (such as the "global" bound and connected tables
+ * and the listener socket's pending list and connected queue) ensures a
+ * reference.  When we defer work until process context and pass a socket as our
+ * argument, we must ensure the reference count is increased to ensure the
+ * socket isn't freed before the function is run; the deferred function will
+ * then drop the reference.
+ */
+
+#include <linux/types.h>
+#include <linux/bitops.h>
+#include <linux/cred.h>
+#include <linux/init.h>
+#include <linux/io.h>
+#include <linux/kernel.h>
+#include <linux/kmod.h>
+#include <linux/list.h>
+#include <linux/miscdevice.h>
+#include <linux/module.h>
+#include <linux/mutex.h>
+#include <linux/net.h>
+#include <linux/poll.h>
+#include <linux/skbuff.h>
+#include <linux/smp.h>
+#include <linux/socket.h>
+#include <linux/stddef.h>
+#include <linux/unistd.h>
+#include <linux/wait.h>
+#include <linux/workqueue.h>
+#include <net/sock.h>
+
+#include "af_vsock.h"
+
+static int __vsock_bind(struct sock *sk, struct sockaddr_vm *addr);
+static void vsock_sk_destruct(struct sock *sk);
+static int vsock_queue_rcv_skb(struct sock *sk, struct sk_buff *skb);
+
+/* Protocol family. */
+static struct proto vsock_proto = {
+        .name = "AF_VSOCK",
+        .owner = THIS_MODULE,
+        .obj_size = sizeof(struct vsock_sock),
+};
+
+/* The default peer timeout indicates how long we will wait for a peer response
+ * to a control message.
+ */
+#define VSOCK_DEFAULT_CONNECT_TIMEOUT (2 * HZ)
+
+#define SS_LISTEN 255
+
+static const struct vsock_transport *transport;
+static DEFINE_MUTEX(vsock_register_mutex);
+
+/**** EXPORTS ****/
+
+/* Get the ID of the local context.  This is transport dependent. */
+
+int vm_sockets_get_local_cid(void)
+{
+        return transport->get_local_cid();
+}
+EXPORT_SYMBOL_GPL(vm_sockets_get_local_cid);
+
+/**** UTILS ****/
+
+/* Each bound VSocket is stored in the bind hash table and each connected
+ * VSocket is stored in the connected hash table.
+ *
+ * Unbound sockets are all put on the same list attached to the end of the hash
+ * table (vsock_unbound_sockets).  Bound sockets are added to the hash table in
+ * the bucket that their local address hashes to (vsock_bound_sockets(addr)
+ * represents the list that addr hashes to).
+ *
+ * Specifically, we initialize the vsock_bind_table array to a size of
+ * VSOCK_HASH_SIZE + 1 so that vsock_bind_table[0] through
+ * vsock_bind_table[VSOCK_HASH_SIZE - 1] are for bound sockets and
+ * vsock_bind_table[VSOCK_HASH_SIZE] is for unbound sockets.  The hash function
+ * mods with VSOCK_HASH_SIZE - 1 to ensure this.
+ */
+#define VSOCK_HASH_SIZE         251
+#define MAX_PORT_RETRIES        24
+
+#define VSOCK_HASH(addr)        ((addr)->svm_port % (VSOCK_HASH_SIZE - 1))
+#define vsock_bound_sockets(addr) (&vsock_bind_table[VSOCK_HASH(addr)])
+#define vsock_unbound_sockets     (&vsock_bind_table[VSOCK_HASH_SIZE])
+
+/* XXX This can probably be implemented in a better way. */
+#define VSOCK_CONN_HASH(src, dst)                               \
+        (((src)->svm_cid ^ (dst)->svm_port) % (VSOCK_HASH_SIZE - 1))
+#define vsock_connected_sockets(src, dst)               \
+        (&vsock_connected_table[VSOCK_CONN_HASH(src, dst)])
+#define vsock_connected_sockets_vsk(vsk)                                \
+        vsock_connected_sockets(&(vsk)->remote_addr, &(vsk)->local_addr)
+
+static struct list_head vsock_bind_table[VSOCK_HASH_SIZE + 1];
+static struct list_head vsock_connected_table[VSOCK_HASH_SIZE];
+static DEFINE_SPINLOCK(vsock_table_lock);
+
+static __init void vsock_init_tables(void)
+{
+        int i;
+
+        for (i = 0; i < ARRAY_SIZE(vsock_bind_table); i++)
+                INIT_LIST_HEAD(&vsock_bind_table[i]);
+
+        for (i = 0; i < ARRAY_SIZE(vsock_connected_table); i++)
+                INIT_LIST_HEAD(&vsock_connected_table[i]);
+}
+
+static void __vsock_insert_bound(struct list_head *list,
+                                 struct vsock_sock *vsk)
+{
+        sock_hold(&vsk->sk);
+        list_add(&vsk->bound_table, list);
+}
+
+static void __vsock_insert_connected(struct list_head *list,
+                                     struct vsock_sock *vsk)
+{
+        sock_hold(&vsk->sk);
+        list_add(&vsk->connected_table, list);
+}
+
+static void __vsock_remove_bound(struct vsock_sock *vsk)
+{
+        list_del_init(&vsk->bound_table);
+        sock_put(&vsk->sk);
+}
+
+static void __vsock_remove_connected(struct vsock_sock *vsk)
+{
+        list_del_init(&vsk->connected_table);
+        sock_put(&vsk->sk);
+}
+
+static struct sock *__vsock_find_bound_socket(struct sockaddr_vm *addr)
+{
+        struct vsock_sock *vsk;
+
+        list_for_each_entry(vsk, vsock_bound_sockets(addr), bound_table)
+                if (vsock_addr_equals_addr_any(addr, &vsk->local_addr))
+                        return sk_vsock(vsk);
+
+        return NULL;
+}
+
+static struct sock *__vsock_find_connected_socket(struct sockaddr_vm *src,
+                                                  struct sockaddr_vm *dst)
+{
+        struct vsock_sock *vsk;
+
+        list_for_each_entry(vsk, vsock_connected_sockets(src, dst),
+                            connected_table) {
+                if (vsock_addr_equals_addr(src, &vsk->remote_addr)
+                    && vsock_addr_equals_addr(dst, &vsk->local_addr)) {
+                        return sk_vsock(vsk);
+                }
+        }
+
+        return NULL;
+}
+
+static bool __vsock_in_bound_table(struct vsock_sock *vsk)
+{
+        return !list_empty(&vsk->bound_table);
+}
+
+static bool __vsock_in_connected_table(struct vsock_sock *vsk)
+{
+        return !list_empty(&vsk->connected_table);
+}
+
+static void vsock_insert_unbound(struct vsock_sock *vsk)
+{
+        spin_lock_bh(&vsock_table_lock);
+        __vsock_insert_bound(vsock_unbound_sockets, vsk);
+        spin_unlock_bh(&vsock_table_lock);
+}
+
+void vsock_insert_connected(struct vsock_sock *vsk)
+{
+        struct list_head *list = vsock_connected_sockets(
+                &vsk->remote_addr, &vsk->local_addr);
+
+        spin_lock_bh(&vsock_table_lock);
+        __vsock_insert_connected(list, vsk);
+        spin_unlock_bh(&vsock_table_lock);
+}
+EXPORT_SYMBOL_GPL(vsock_insert_connected);
+
+void vsock_remove_bound(struct vsock_sock *vsk)
+{
+        spin_lock_bh(&vsock_table_lock);
+        __vsock_remove_bound(vsk);
+        spin_unlock_bh(&vsock_table_lock);
+}
+EXPORT_SYMBOL_GPL(vsock_remove_bound);
+
+void vsock_remove_connected(struct vsock_sock *vsk)
+{
+        spin_lock_bh(&vsock_table_lock);
+        __vsock_remove_connected(vsk);
+        spin_unlock_bh(&vsock_table_lock);
+}
+EXPORT_SYMBOL_GPL(vsock_remove_connected);
+
+struct sock *vsock_find_bound_socket(struct sockaddr_vm *addr)
+{
+        struct sock *sk;
+
+        spin_lock_bh(&vsock_table_lock);
+        sk = __vsock_find_bound_socket(addr);
+        if (sk)
+                sock_hold(sk);
+
+        spin_unlock_bh(&vsock_table_lock);
+
+        return sk;
+}
+EXPORT_SYMBOL_GPL(vsock_find_bound_socket);
+
+struct sock *vsock_find_connected_socket(struct sockaddr_vm *src,
+                                         struct sockaddr_vm *dst)
+{
+        struct sock *sk;
+
+        spin_lock_bh(&vsock_table_lock);
+        sk = __vsock_find_connected_socket(src, dst);
+        if (sk)
+                sock_hold(sk);
+
+        spin_unlock_bh(&vsock_table_lock);
+
+        return sk;
+}
+EXPORT_SYMBOL_GPL(vsock_find_connected_socket);
+
+static bool vsock_in_bound_table(struct vsock_sock *vsk)
+{
+        bool ret;
+
+        spin_lock_bh(&vsock_table_lock);
+        ret = __vsock_in_bound_table(vsk);
+        spin_unlock_bh(&vsock_table_lock);
+
+        return ret;
+}
+
+static bool vsock_in_connected_table(struct vsock_sock *vsk)
+{
+        bool ret;
+
+        spin_lock_bh(&vsock_table_lock);
+        ret = __vsock_in_connected_table(vsk);
+        spin_unlock_bh(&vsock_table_lock);
+
+        return ret;
+}
+
+void vsock_for_each_connected_socket(void (*fn)(struct sock *sk))
+{
+        int i;
+
+        spin_lock_bh(&vsock_table_lock);
+
+        for (i = 0; i < ARRAY_SIZE(vsock_connected_table); i++) {
+                struct vsock_sock *vsk;
+                list_for_each_entry(vsk, &vsock_connected_table[i],
+                                    connected_table);
+                        fn(sk_vsock(vsk));
+        }
+
+        spin_unlock_bh(&vsock_table_lock);
+}
+EXPORT_SYMBOL_GPL(vsock_for_each_connected_socket);
+
+void vsock_add_pending(struct sock *listener, struct sock *pending)
+{
+        struct vsock_sock *vlistener;
+        struct vsock_sock *vpending;
+
+        vlistener = vsock_sk(listener);
+        vpending = vsock_sk(pending);
+
+        sock_hold(pending);
+        sock_hold(listener);
+        list_add_tail(&vpending->pending_links, &vlistener->pending_links);
+}
+EXPORT_SYMBOL_GPL(vsock_add_pending);
+
+void vsock_remove_pending(struct sock *listener, struct sock *pending)
+{
+        struct vsock_sock *vpending = vsock_sk(pending);
+
+        list_del_init(&vpending->pending_links);
+        sock_put(listener);
+        sock_put(pending);
+}
+EXPORT_SYMBOL_GPL(vsock_remove_pending);
+
+void vsock_enqueue_accept(struct sock *listener, struct sock *connected)
+{
+        struct vsock_sock *vlistener;
+        struct vsock_sock *vconnected;
+
+        vlistener = vsock_sk(listener);
+        vconnected = vsock_sk(connected);
+
+        sock_hold(connected);
+        sock_hold(listener);
+        list_add_tail(&vconnected->accept_queue, &vlistener->accept_queue);
+}
+EXPORT_SYMBOL_GPL(vsock_enqueue_accept);
+
+static struct sock *vsock_dequeue_accept(struct sock *listener)
+{
+        struct vsock_sock *vlistener;
+        struct vsock_sock *vconnected;
+
+        vlistener = vsock_sk(listener);
+
+        if (list_empty(&vlistener->accept_queue))
+                return NULL;
+
+        vconnected = list_entry(vlistener->accept_queue.next,
+                                struct vsock_sock, accept_queue);
+
+        list_del_init(&vconnected->accept_queue);
+        sock_put(listener);
+        /* The caller will need a reference on the connected socket so we let
+         * it call sock_put().
+         */
+
+        return sk_vsock(vconnected);
+}
+
+static bool vsock_is_accept_queue_empty(struct sock *sk)
+{
+        struct vsock_sock *vsk = vsock_sk(sk);
+        return list_empty(&vsk->accept_queue);
+}
+
+static bool vsock_is_pending(struct sock *sk)
+{
+        struct vsock_sock *vsk = vsock_sk(sk);
+        return !list_empty(&vsk->pending_links);
+}
+
+static int vsock_send_shutdown(struct sock *sk, int mode)
+{
+        return transport->shutdown(vsock_sk(sk), mode);
+}
+
+void vsock_pending_work(struct work_struct *work)
+{
+        struct sock *sk;
+        struct sock *listener;
+        struct vsock_sock *vsk;
+        bool cleanup;
+
+        vsk = container_of(work, struct vsock_sock, dwork.work);
+        sk = sk_vsock(vsk);
+        listener = vsk->listener;
+        cleanup = true;
+
+        lock_sock(listener);
+        lock_sock(sk);
+
+        if (vsock_is_pending(sk)) {
+                vsock_remove_pending(listener, sk);
+        } else if (!vsk->rejected) {
+                /* We are not on the pending list and accept() did not reject
+                 * us, so we must have been accepted by our user process.  We
+                 * just need to drop our references to the sockets and be on
+                 * our way.
+                 */
+                cleanup = false;
+                goto out;
+        }
+
+        listener->sk_ack_backlog--;
+
+        /* We need to remove ourself from the global connected sockets list so
+         * incoming packets can't find this socket, and to reduce the reference
+         * count.
+         */
+        if (vsock_in_connected_table(vsk))
+                vsock_remove_connected(vsk);
+
+        sk->sk_state = SS_FREE;
+
+out:
+        release_sock(sk);
+        release_sock(listener);
+        if (cleanup)
+                sock_put(sk);
+
+        sock_put(sk);
+        sock_put(listener);
+}
+EXPORT_SYMBOL_GPL(vsock_pending_work);
+
+/**** SOCKET OPERATIONS ****/
+
+static int __vsock_bind_stream(struct vsock_sock *vsk,
+                               struct sockaddr_vm *addr)
+{
+        static u32 port = LAST_RESERVED_PORT + 1;
+        struct sockaddr_vm new_addr;
+
+        vsock_addr_init(&new_addr, addr->svm_cid, addr->svm_port);
+
+        if (addr->svm_port == VMADDR_PORT_ANY) {
+                bool found = false;
+                unsigned int i;
+
+                for (i = 0; i < MAX_PORT_RETRIES; i++) {
+                        if (port <= LAST_RESERVED_PORT)
+                                port = LAST_RESERVED_PORT + 1;
+
+                        new_addr.svm_port = port++;
+
+                        if (!__vsock_find_bound_socket(&new_addr)) {
+                                found = true;
+                                break;
+                        }
+                }
+
+                if (!found)
+                        return -EADDRNOTAVAIL;
+        } else {
+                /* If port is in reserved range, ensure caller
+                 * has necessary privileges.
+                 */
+                if (addr->svm_port <= LAST_RESERVED_PORT &&
+                    !capable(CAP_NET_BIND_SERVICE)) {
+                        return -EACCES;
+                }
+
+                if (__vsock_find_bound_socket(&new_addr))
+                        return -EADDRINUSE;
+        }
+
+        vsock_addr_init(&vsk->local_addr, new_addr.svm_cid, new_addr.svm_port);
+
+        /* Remove stream sockets from the unbound list and add them to the hash
+         * table for easy lookup by its address.  The unbound list is simply an
+         * extra entry at the end of the hash table, a trick used by AF_UNIX.
+         */
+        __vsock_remove_bound(vsk);
+        __vsock_insert_bound(vsock_bound_sockets(&vsk->local_addr), vsk);
+
+        return 0;
+}
+
+static int __vsock_bind_dgram(struct vsock_sock *vsk,
+                              struct sockaddr_vm *addr)
+{
+        return transport->dgram_bind(vsk, addr);
+}
+
+static int __vsock_bind(struct sock *sk, struct sockaddr_vm *addr)
+{
+        struct vsock_sock *vsk = vsock_sk(sk);
+        u32 cid;
+        int retval;
+
+        /* First ensure this socket isn't already bound. */
+        if (vsock_addr_bound(&vsk->local_addr))
+                return -EINVAL;
+
+        /* Now bind to the provided address or select appropriate values if
+         * none are provided (VMADDR_CID_ANY and VMADDR_PORT_ANY).  Note that
+         * like AF_INET prevents binding to a non-local IP address (in most
+         * cases), we only allow binding to the local CID.
+         */
+        cid = transport->get_local_cid();
+        if (addr->svm_cid != cid && addr->svm_cid != VMADDR_CID_ANY)
+                return -EADDRNOTAVAIL;
+
+        switch (sk->sk_socket->type) {
+        case SOCK_STREAM:
+                spin_lock_bh(&vsock_table_lock);
+                retval = __vsock_bind_stream(vsk, addr);
+                spin_unlock_bh(&vsock_table_lock);
+                break;
+
+        case SOCK_DGRAM:
+                retval = __vsock_bind_dgram(vsk, addr);
+                break;
+
+        default:
+                retval = -EINVAL;
+                break;
+        }
+
+        return retval;
+}
+
+struct sock *__vsock_create(struct net *net,
+                            struct socket *sock,
+                            struct sock *parent,
+                            gfp_t priority,
+                            unsigned short type)
+{
+        struct sock *sk;
+        struct vsock_sock *psk;
+        struct vsock_sock *vsk;
+
+        sk = sk_alloc(net, AF_VSOCK, priority, &vsock_proto);
+        if (!sk)
+                return NULL;
+
+        sock_init_data(sock, sk);
+
+        /* sk->sk_type is normally set in sock_init_data, but only if sock is
+         * non-NULL. We make sure that our sockets always have a type by
+         * setting it here if needed.
+         */
+        if (!sock)
+                sk->sk_type = type;
+
+        vsk = vsock_sk(sk);
+        vsock_addr_init(&vsk->local_addr, VMADDR_CID_ANY, VMADDR_PORT_ANY);
+        vsock_addr_init(&vsk->remote_addr, VMADDR_CID_ANY, VMADDR_PORT_ANY);
+
+        sk->sk_destruct = vsock_sk_destruct;
+        sk->sk_backlog_rcv = vsock_queue_rcv_skb;
+        sk->sk_state = 0;
+        sock_reset_flag(sk, SOCK_DONE);
+
+        INIT_LIST_HEAD(&vsk->bound_table);
+        INIT_LIST_HEAD(&vsk->connected_table);
+        vsk->listener = NULL;
+        INIT_LIST_HEAD(&vsk->pending_links);
+        INIT_LIST_HEAD(&vsk->accept_queue);
+        vsk->rejected = false;
+        vsk->sent_request = false;
+        vsk->ignore_connecting_rst = false;
+        vsk->peer_shutdown = 0;
+
+        psk = parent ? vsock_sk(parent) : NULL;
+        if (parent) {
+                vsk->trusted = psk->trusted;
+                vsk->owner = get_cred(psk->owner);
+                vsk->connect_timeout = psk->connect_timeout;
+        } else {
+                vsk->trusted = capable(CAP_NET_ADMIN);
+                vsk->owner = get_current_cred();
+                vsk->connect_timeout = VSOCK_DEFAULT_CONNECT_TIMEOUT;
+        }
+
+        if (transport->init(vsk, psk) < 0) {
+                sk_free(sk);
+                return NULL;
+        }
+
+        if (sock)
+                vsock_insert_unbound(vsk);
+
+        return sk;
+}
+EXPORT_SYMBOL_GPL(__vsock_create);
+
+static void __vsock_release(struct sock *sk)
+{
+        if (sk) {
+                struct sk_buff *skb;
+                struct sock *pending;
+                struct vsock_sock *vsk;
+
+                vsk = vsock_sk(sk);
+                pending = NULL; /* Compiler warning. */
+
+                if (vsock_in_bound_table(vsk))
+                        vsock_remove_bound(vsk);
+
+                if (vsock_in_connected_table(vsk))
+                        vsock_remove_connected(vsk);
+
+                transport->release(vsk);
+
+                lock_sock(sk);
+                sock_orphan(sk);
+                sk->sk_shutdown = SHUTDOWN_MASK;
+
+                while ((skb = skb_dequeue(&sk->sk_receive_queue)))
+                        kfree_skb(skb);
+
+                /* Clean up any sockets that never were accepted. */
+                while ((pending = vsock_dequeue_accept(sk)) != NULL) {
+                        __vsock_release(pending);
+                        sock_put(pending);
+                }
+
+                release_sock(sk);
+                sock_put(sk);
+        }
+}
+
+static void vsock_sk_destruct(struct sock *sk)
+{
+        struct vsock_sock *vsk = vsock_sk(sk);
+
+        transport->destruct(vsk);
+
+        /* When clearing these addresses, there's no need to set the family and
+         * possibly register the address family with the kernel.
+         */
+        vsock_addr_init(&vsk->local_addr, VMADDR_CID_ANY, VMADDR_PORT_ANY);
+        vsock_addr_init(&vsk->remote_addr, VMADDR_CID_ANY, VMADDR_PORT_ANY);
+
+        put_cred(vsk->owner);
+}
+
+static int vsock_queue_rcv_skb(struct sock *sk, struct sk_buff *skb)
+{
+        int err;
+
+        err = sock_queue_rcv_skb(sk, skb);
+        if (err)
+                kfree_skb(skb);
+
+        return err;
+}
+
+s64 vsock_stream_has_data(struct vsock_sock *vsk)
+{
+        return transport->stream_has_data(vsk);
+}
+EXPORT_SYMBOL_GPL(vsock_stream_has_data);
+
+s64 vsock_stream_has_space(struct vsock_sock *vsk)
+{
+        return transport->stream_has_space(vsk);
+}
+EXPORT_SYMBOL_GPL(vsock_stream_has_space);
+
+static int vsock_release(struct socket *sock)
+{
+        __vsock_release(sock->sk);
+        sock->sk = NULL;
+        sock->state = SS_FREE;
+
+        return 0;
+}
+
+static int
+vsock_bind(struct socket *sock, struct sockaddr *addr, int addr_len)
+{
+        int err;
+        struct sock *sk;
+        struct sockaddr_vm *vm_addr;
+
+        sk = sock->sk;
+
+        if (vsock_addr_cast(addr, addr_len, &vm_addr) != 0)
+                return -EINVAL;
+
+        lock_sock(sk);
+        err = __vsock_bind(sk, vm_addr);
+        release_sock(sk);
+
+        return err;
+}
+
+static int vsock_getname(struct socket *sock,
+                         struct sockaddr *addr, int *addr_len, int peer)
+{
+        int err;
+        struct sock *sk;
+        struct vsock_sock *vsk;
+        struct sockaddr_vm *vm_addr;
+
+        sk = sock->sk;
+        vsk = vsock_sk(sk);
+        err = 0;
+
+        lock_sock(sk);
+
+        if (peer) {
+                if (sock->state != SS_CONNECTED) {
+                        err = -ENOTCONN;
+                        goto out;
+                }
+                vm_addr = &vsk->remote_addr;
+        } else {
+                vm_addr = &vsk->local_addr;
+        }
+
+        if (!vm_addr) {
+                err = -EINVAL;
+                goto out;
+        }
+
+        /* sys_getsockname() and sys_getpeername() pass us a
+         * MAX_SOCK_ADDR-sized buffer and don't set addr_len.  Unfortunately
+         * that macro is defined in socket.c instead of .h, so we hardcode its
+         * value here.
+         */
+        BUILD_BUG_ON(sizeof(*vm_addr) > 128);
+        memcpy(addr, vm_addr, sizeof(*vm_addr));
+        *addr_len = sizeof(*vm_addr);
+
+out:
+        release_sock(sk);
+        return err;
+}
+
+static int vsock_shutdown(struct socket *sock, int mode)
+{
+        int err;
+        struct sock *sk;
+
+        /* User level uses SHUT_RD (0) and SHUT_WR (1), but the kernel uses
+         * RCV_SHUTDOWN (1) and SEND_SHUTDOWN (2), so we must increment mode
+         * here like the other address families do.  Note also that the
+         * increment makes SHUT_RDWR (2) into RCV_SHUTDOWN | SEND_SHUTDOWN (3),
+         * which is what we want.
+         */
+        mode++;
+
+        if ((mode & ~SHUTDOWN_MASK) || !mode)
+                return -EINVAL;
+
+        /* If this is a STREAM socket and it is not connected then bail out
+         * immediately.  If it is a DGRAM socket then we must first kick the
+         * socket so that it wakes up from any sleeping calls, for example
+         * recv(), and then afterwards return the error.
+         */
+
+        sk = sock->sk;
+        if (sock->state == SS_UNCONNECTED) {
+                err = -ENOTCONN;
+                if (sk->sk_type == SOCK_STREAM)
+                        return err;
+        } else {
+                sock->state = SS_DISCONNECTING;
+                err = 0;
+        }
+
+        /* Receive and send shutdowns are treated alike. */
+        mode = mode & (RCV_SHUTDOWN | SEND_SHUTDOWN);
+        if (mode) {
+                lock_sock(sk);
+                sk->sk_shutdown |= mode;
+                sk->sk_state_change(sk);
+                release_sock(sk);
+
+                if (sk->sk_type == SOCK_STREAM) {
+                        sock_reset_flag(sk, SOCK_DONE);
+                        vsock_send_shutdown(sk, mode);
+                }
+        }
+
+        return err;
+}
+
+static unsigned int vsock_poll(struct file *file, struct socket *sock,
+                               poll_table *wait)
+{
+        struct sock *sk;
+        unsigned int mask;
+        struct vsock_sock *vsk;
+
+        sk = sock->sk;
+        vsk = vsock_sk(sk);
+
+        poll_wait(file, sk_sleep(sk), wait);
+        mask = 0;
+
+        if (sk->sk_err)
+                /* Signify that there has been an error on this socket. */
+                mask |= POLLERR;
+
+        /* INET sockets treat local write shutdown and peer write shutdown as a
+         * case of POLLHUP set.
+         */
+        if ((sk->sk_shutdown == SHUTDOWN_MASK) ||
+            ((sk->sk_shutdown & SEND_SHUTDOWN) &&
+             (vsk->peer_shutdown & SEND_SHUTDOWN))) {
+                mask |= POLLHUP;
+        }
+
+        if (sk->sk_shutdown & RCV_SHUTDOWN ||
+            vsk->peer_shutdown & SEND_SHUTDOWN) {
+                mask |= POLLRDHUP;
+        }
+
+        if (sock->type == SOCK_DGRAM) {
+                /* For datagram sockets we can read if there is something in
+                 * the queue and write as long as the socket isn't shutdown for
+                 * sending.
+                 */
+                if (!skb_queue_empty(&sk->sk_receive_queue) ||
+                    (sk->sk_shutdown & RCV_SHUTDOWN)) {
+                        mask |= POLLIN | POLLRDNORM;
+                }
+
+                if (!(sk->sk_shutdown & SEND_SHUTDOWN))
+                        mask |= POLLOUT | POLLWRNORM | POLLWRBAND;
+
+        } else if (sock->type == SOCK_STREAM) {
+                lock_sock(sk);
+
+                /* Listening sockets that have connections in their accept
+                 * queue can be read.
+                 */
+                if (sk->sk_state == SS_LISTEN
+                    && !vsock_is_accept_queue_empty(sk))
+                        mask |= POLLIN | POLLRDNORM;
+
+                /* If there is something in the queue then we can read. */
+                if (transport->stream_is_active(vsk) &&
+                    !(sk->sk_shutdown & RCV_SHUTDOWN)) {
+                        bool data_ready_now = false;
+                        int ret = transport->notify_poll_in(
+                                        vsk, 1, &data_ready_now);
+                        if (ret < 0) {
+                                mask |= POLLERR;
+                        } else {
+                                if (data_ready_now)
+                                        mask |= POLLIN | POLLRDNORM;
+
+                        }
+                }
+
+                /* Sockets whose connections have been closed, reset, or
+                 * terminated should also be considered read, and we check the
+                 * shutdown flag for that.
+                 */
+                if (sk->sk_shutdown & RCV_SHUTDOWN ||
+                    vsk->peer_shutdown & SEND_SHUTDOWN) {
+                        mask |= POLLIN | POLLRDNORM;
+                }
+
+                /* Connected sockets that can produce data can be written. */
+                if (sk->sk_state == SS_CONNECTED) {
+                        if (!(sk->sk_shutdown & SEND_SHUTDOWN)) {
+                                bool space_avail_now = false;
+                                int ret = transport->notify_poll_out(
+                                                vsk, 1, &space_avail_now);
+                                if (ret < 0) {
+                                        mask |= POLLERR;
+                                } else {
+                                        if (space_avail_now)
+                                                /* Remove POLLWRBAND since INET
+                                                 * sockets are not setting it.
+                                                 */
+                                                mask |= POLLOUT | POLLWRNORM;
+
+                                }
+                        }
+                }
+
+                /* Simulate INET socket poll behaviors, which sets
+                 * POLLOUT|POLLWRNORM when peer is closed and nothing to read,
+                 * but local send is not shutdown.
+                 */
+                if (sk->sk_state == SS_UNCONNECTED) {
+                        if (!(sk->sk_shutdown & SEND_SHUTDOWN))
+                                mask |= POLLOUT | POLLWRNORM;
+
+                }
+
+                release_sock(sk);
+        }
+
+        return mask;
+}
+
+static int vsock_dgram_sendmsg(struct kiocb *kiocb, struct socket *sock,
+                               struct msghdr *msg, size_t len)
+{
+        int err;
+        struct sock *sk;
+        struct vsock_sock *vsk;
+        struct sockaddr_vm *remote_addr;
+
+        if (msg->msg_flags & MSG_OOB)
+                return -EOPNOTSUPP;
+
+        /* For now, MSG_DONTWAIT is always assumed... */
+        err = 0;
+        sk = sock->sk;
+        vsk = vsock_sk(sk);
+
+        lock_sock(sk);
+
+        if (!vsock_addr_bound(&vsk->local_addr)) {
+                struct sockaddr_vm local_addr;
+
+                vsock_addr_init(&local_addr, VMADDR_CID_ANY, VMADDR_PORT_ANY);
+                err = __vsock_bind(sk, &local_addr);
+                if (err != 0)
+                        goto out;
+
+        }
+
+        /* If the provided message contains an address, use that.  Otherwise
+         * fall back on the socket's remote handle (if it has been connected).
+         */
+        if (msg->msg_name &&
+            vsock_addr_cast(msg->msg_name, msg->msg_namelen,
+                            &remote_addr) == 0) {
+                /* Ensure this address is of the right type and is a valid
+                 * destination.
+                 */
+
+                if (remote_addr->svm_cid == VMADDR_CID_ANY)
+                        remote_addr->svm_cid = transport->get_local_cid();
+
+                if (!vsock_addr_bound(remote_addr)) {
+                        err = -EINVAL;
+                        goto out;
+                }
+        } else if (sock->state == SS_CONNECTED) {
+                remote_addr = &vsk->remote_addr;
+
+                if (remote_addr->svm_cid == VMADDR_CID_ANY)
+                        remote_addr->svm_cid = transport->get_local_cid();
+
+                /* XXX Should connect() or this function ensure remote_addr is
+                 * bound?
+                 */
+                if (!vsock_addr_bound(&vsk->remote_addr)) {
+                        err = -EINVAL;
+                        goto out;
+                }
+        } else {
+                err = -EINVAL;
+                goto out;
+        }
+
+        if (!transport->dgram_allow(remote_addr->svm_cid,
+                                    remote_addr->svm_port)) {
+                err = -EINVAL;
+                goto out;
+        }
+
+        err = transport->dgram_enqueue(vsk, remote_addr, msg->msg_iov, len);
+
+out:
+        release_sock(sk);
+        return err;
+}
+
+static int vsock_dgram_connect(struct socket *sock,
+                               struct sockaddr *addr, int addr_len, int flags)
+{
+        int err;
+        struct sock *sk;
+        struct vsock_sock *vsk;
+        struct sockaddr_vm *remote_addr;
+
+        sk = sock->sk;
+        vsk = vsock_sk(sk);
+
+        err = vsock_addr_cast(addr, addr_len, &remote_addr);
+        if (err == -EAFNOSUPPORT && remote_addr->svm_family == AF_UNSPEC) {
+                lock_sock(sk);
+                vsock_addr_init(&vsk->remote_addr, VMADDR_CID_ANY,
+                                VMADDR_PORT_ANY);
+                sock->state = SS_UNCONNECTED;
+                release_sock(sk);
+                return 0;
+        } else if (err != 0)
+                return -EINVAL;
+
+        lock_sock(sk);
+
+        if (!vsock_addr_bound(&vsk->local_addr)) {
+                struct sockaddr_vm local_addr;
+
+                vsock_addr_init(&local_addr, VMADDR_CID_ANY, VMADDR_PORT_ANY);
+                err = __vsock_bind(sk, &local_addr);
+                if (err != 0)
+                        goto out;
+
+        }
+
+        if (!transport->dgram_allow(remote_addr->svm_cid,
+                                    remote_addr->svm_port)) {
+                err = -EINVAL;
+                goto out;
+        }
+
+        memcpy(&vsk->remote_addr, remote_addr, sizeof(vsk->remote_addr));
+        sock->state = SS_CONNECTED;
+
+out:
+        release_sock(sk);
+        return err;
+}
+
+static int vsock_dgram_recvmsg(struct kiocb *kiocb, struct socket *sock,
+                               struct msghdr *msg, size_t len, int flags)
+{
+        return transport->dgram_dequeue(kiocb, vsock_sk(sock->sk), msg, len,
+                                        flags);
+}
+
+static const struct proto_ops vsock_dgram_ops = {
+        .family = PF_VSOCK,
+        .owner = THIS_MODULE,
+        .release = vsock_release,
+        .bind = vsock_bind,
+        .connect = vsock_dgram_connect,
+        .socketpair = sock_no_socketpair,
+        .accept = sock_no_accept,
+        .getname = vsock_getname,
+        .poll = vsock_poll,
+        .ioctl = sock_no_ioctl,
+        .listen = sock_no_listen,
+        .shutdown = vsock_shutdown,
+        .setsockopt = sock_no_setsockopt,
+        .getsockopt = sock_no_getsockopt,
+        .sendmsg = vsock_dgram_sendmsg,
+        .recvmsg = vsock_dgram_recvmsg,
+        .mmap = sock_no_mmap,
+        .sendpage = sock_no_sendpage,
+};
+
+static void vsock_connect_timeout(struct work_struct *work)
+{
+        struct sock *sk;
+        struct vsock_sock *vsk;
+
+        vsk = container_of(work, struct vsock_sock, dwork.work);
+        sk = sk_vsock(vsk);
+
+        lock_sock(sk);
+        if (sk->sk_state == SS_CONNECTING &&
+            (sk->sk_shutdown != SHUTDOWN_MASK)) {
+                sk->sk_state = SS_UNCONNECTED;
+                sk->sk_err = ETIMEDOUT;
+                sk->sk_error_report(sk);
+        }
+        release_sock(sk);
+
+        sock_put(sk);
+}
+
+static int vsock_stream_connect(struct socket *sock, struct sockaddr *addr,
+                                int addr_len, int flags)
+{
+        int err;
+        struct sock *sk;
+        struct vsock_sock *vsk;
+        struct sockaddr_vm *remote_addr;
+        long timeout;
+        DEFINE_WAIT(wait);
+
+        err = 0;
+        sk = sock->sk;
+        vsk = vsock_sk(sk);
+
+        lock_sock(sk);
+
+        /* XXX AF_UNSPEC should make us disconnect like AF_INET. */
+        switch (sock->state) {
+        case SS_CONNECTED:
+                err = -EISCONN;
+                goto out;
+        case SS_DISCONNECTING:
+                err = -EINVAL;
+                goto out;
+        case SS_CONNECTING:
+                /* This continues on so we can move sock into the SS_CONNECTED
+                 * state once the connection has completed (at which point err
+                 * will be set to zero also).  Otherwise, we will either wait
+                 * for the connection or return -EALREADY should this be a
+                 * non-blocking call.
+                 */
+                err = -EALREADY;
+                break;
+        default:
+                if ((sk->sk_state == SS_LISTEN) ||
+                    vsock_addr_cast(addr, addr_len, &remote_addr) != 0) {
+                        err = -EINVAL;
+                        goto out;
+                }
+
+                /* The hypervisor and well-known contexts do not have socket
+                 * endpoints.
+                 */
+                if (!transport->stream_allow(remote_addr->svm_cid,
+                                             remote_addr->svm_port)) {
+                        err = -ENETUNREACH;
+                        goto out;
+                }
+
+                /* Set the remote address that we are connecting to. */
+                memcpy(&vsk->remote_addr, remote_addr,
+                       sizeof(vsk->remote_addr));
+
+                /* Autobind this socket to the local address if necessary. */
+                if (!vsock_addr_bound(&vsk->local_addr)) {
+                        struct sockaddr_vm local_addr;
+
+                        vsock_addr_init(&local_addr, VMADDR_CID_ANY,
+                                        VMADDR_PORT_ANY);
+                        err = __vsock_bind(sk, &local_addr);
+                        if (err != 0)
+                                goto out;
+
+                }
+
+                sk->sk_state = SS_CONNECTING;
+
+                err = transport->connect(vsk);
+                if (err < 0)
+                        goto out;
+
+                /* Mark sock as connecting and set the error code to in
+                 * progress in case this is a non-blocking connect.
+                 */
+                sock->state = SS_CONNECTING;
+                err = -EINPROGRESS;
+        }
+
+        /* The receive path will handle all communication until we are able to
+         * enter the connected state.  Here we wait for the connection to be
+         * completed or a notification of an error.
+         */
+        timeout = vsk->connect_timeout;
+        prepare_to_wait(sk_sleep(sk), &wait, TASK_INTERRUPTIBLE);
+
+        while (sk->sk_state != SS_CONNECTED && sk->sk_err == 0) {
+                if (flags & O_NONBLOCK) {
+                        /* If we're not going to block, we schedule a timeout
+                         * function to generate a timeout on the connection
+                         * attempt, in case the peer doesn't respond in a
+                         * timely manner. We hold on to the socket until the
+                         * timeout fires.
+                         */
+                        sock_hold(sk);
+                        INIT_DELAYED_WORK(&vsk->dwork,
+                                          vsock_connect_timeout);
+                        schedule_delayed_work(&vsk->dwork, timeout);
+
+                        /* Skip ahead to preserve error code set above. */
+                        goto out_wait;
+                }
+
+                release_sock(sk);
+                timeout = schedule_timeout(timeout);
+                lock_sock(sk);
+
+                if (signal_pending(current)) {
+                        err = sock_intr_errno(timeout);
+                        goto out_wait_error;
+                } else if (timeout == 0) {
+                        err = -ETIMEDOUT;
+                        goto out_wait_error;
+                }
+
+                prepare_to_wait(sk_sleep(sk), &wait, TASK_INTERRUPTIBLE);
+        }
+
+        if (sk->sk_err) {
+                err = -sk->sk_err;
+                goto out_wait_error;
+        } else
+                err = 0;
+
+out_wait:
+        finish_wait(sk_sleep(sk), &wait);
+out:
+        release_sock(sk);
+        return err;
+
+out_wait_error:
+        sk->sk_state = SS_UNCONNECTED;
+        sock->state = SS_UNCONNECTED;
+        goto out_wait;
+}
+
+static int vsock_accept(struct socket *sock, struct socket *newsock, int flags)
+{
+        struct sock *listener;
+        int err;
+        struct sock *connected;
+        struct vsock_sock *vconnected;
+        long timeout;
+        DEFINE_WAIT(wait);
+
+        err = 0;
+        listener = sock->sk;
+
+        lock_sock(listener);
+
+        if (sock->type != SOCK_STREAM) {
+                err = -EOPNOTSUPP;
+                goto out;
+        }
+
+        if (listener->sk_state != SS_LISTEN) {
+                err = -EINVAL;
+                goto out;
+        }
+
+        /* Wait for children sockets to appear; these are the new sockets
+         * created upon connection establishment.
+         */
+        timeout = sock_sndtimeo(listener, flags & O_NONBLOCK);
+        prepare_to_wait(sk_sleep(listener), &wait, TASK_INTERRUPTIBLE);
+
+        while ((connected = vsock_dequeue_accept(listener)) == NULL &&
+               listener->sk_err == 0) {
+                release_sock(listener);
+                timeout = schedule_timeout(timeout);
+                lock_sock(listener);
+
+                if (signal_pending(current)) {
+                        err = sock_intr_errno(timeout);
+                        goto out_wait;
+                } else if (timeout == 0) {
+                        err = -EAGAIN;
+                        goto out_wait;
+                }
+
+                prepare_to_wait(sk_sleep(listener), &wait, TASK_INTERRUPTIBLE);
+        }
+
+        if (listener->sk_err)
+                err = -listener->sk_err;
+
+        if (connected) {
+                listener->sk_ack_backlog--;
+
+                lock_sock(connected);
+                vconnected = vsock_sk(connected);
+
+                /* If the listener socket has received an error, then we should
+                 * reject this socket and return.  Note that we simply mark the
+                 * socket rejected, drop our reference, and let the cleanup
+                 * function handle the cleanup; the fact that we found it in
+                 * the listener's accept queue guarantees that the cleanup
+                 * function hasn't run yet.
+                 */
+                if (err) {
+                        vconnected->rejected = true;
+                        release_sock(connected);
+                        sock_put(connected);
+                        goto out_wait;
+                }
+
+                newsock->state = SS_CONNECTED;
+                sock_graft(connected, newsock);
+                release_sock(connected);
+                sock_put(connected);
+        }
+
+out_wait:
+        finish_wait(sk_sleep(listener), &wait);
+out:
+        release_sock(listener);
+        return err;
+}
+
+static int vsock_listen(struct socket *sock, int backlog)
+{
+        int err;
+        struct sock *sk;
+        struct vsock_sock *vsk;
+
+        sk = sock->sk;
+
+        lock_sock(sk);
+
+        if (sock->type != SOCK_STREAM) {
+                err = -EOPNOTSUPP;
+                goto out;
+        }
+
+        if (sock->state != SS_UNCONNECTED) {
+                err = -EINVAL;
+                goto out;
+        }
+
+        vsk = vsock_sk(sk);
+
+        if (!vsock_addr_bound(&vsk->local_addr)) {
+                err = -EINVAL;
+                goto out;
+        }
+
+        sk->sk_max_ack_backlog = backlog;
+        sk->sk_state = SS_LISTEN;
+
+        err = 0;
+
+out:
+        release_sock(sk);
+        return err;
+}
+
+static int vsock_stream_setsockopt(struct socket *sock,
+                                   int level,
+                                   int optname,
+                                   char __user *optval,
+                                   unsigned int optlen)
+{
+        int err;
+        struct sock *sk;
+        struct vsock_sock *vsk;
+        u64 val;
+
+        if (level != AF_VSOCK)
+                return -ENOPROTOOPT;
+
+#define COPY_IN(_v)                                       \
+        do {                                              \
+                if (optlen < sizeof(_v)) {                \
+                        err = -EINVAL;                    \
+                        goto exit;                        \
+                }                                         \
+                if (copy_from_user(&_v, optval, sizeof(_v)) != 0) {     \
+                        err = -EFAULT;                                  \
+                        goto exit;                                      \
+                }                                                       \
+        } while (0)
+
+        err = 0;
+        sk = sock->sk;
+        vsk = vsock_sk(sk);
+
+        lock_sock(sk);
+
+        switch (optname) {
+        case SO_VM_SOCKETS_BUFFER_SIZE:
+                COPY_IN(val);
+                transport->set_buffer_size(vsk, val);
+                break;
+
+        case SO_VM_SOCKETS_BUFFER_MAX_SIZE:
+                COPY_IN(val);
+                transport->set_max_buffer_size(vsk, val);
+                break;
+
+        case SO_VM_SOCKETS_BUFFER_MIN_SIZE:
+                COPY_IN(val);
+                transport->set_min_buffer_size(vsk, val);
+                break;
+
+        case SO_VM_SOCKETS_CONNECT_TIMEOUT: {
+                struct timeval tv;
+                COPY_IN(tv);
+                if (tv.tv_sec >= 0 && tv.tv_usec < USEC_PER_SEC &&
+                    tv.tv_sec < (MAX_SCHEDULE_TIMEOUT / HZ - 1)) {
+                        vsk->connect_timeout = tv.tv_sec * HZ +
+                            DIV_ROUND_UP(tv.tv_usec, (1000000 / HZ));
+                        if (vsk->connect_timeout == 0)
+                                vsk->connect_timeout =
+                                    VSOCK_DEFAULT_CONNECT_TIMEOUT;
+
+                } else {
+                        err = -ERANGE;
+                }
+                break;
+        }
+
+        default:
+                err = -ENOPROTOOPT;
+                break;
+        }
+
+#undef COPY_IN
+
+exit:
+        release_sock(sk);
+        return err;
+}
+
+static int vsock_stream_getsockopt(struct socket *sock,
+                                   int level, int optname,
+                                   char __user *optval,
+                                   int __user *optlen)
+{
+        int err;
+        int len;
+        struct sock *sk;
+        struct vsock_sock *vsk;
+        u64 val;
+
+        if (level != AF_VSOCK)
+                return -ENOPROTOOPT;
+
+        err = get_user(len, optlen);
+        if (err != 0)
+                return err;
+
+#define COPY_OUT(_v)                            \
+        do {                                    \
+                if (len < sizeof(_v))           \
+                        return -EINVAL;         \
+                                                \
+                len = sizeof(_v);               \
+                if (copy_to_user(optval, &_v, len) != 0)        \
+                        return -EFAULT;                         \
+                                                                \
+        } while (0)
+
+        err = 0;
+        sk = sock->sk;
+        vsk = vsock_sk(sk);
+
+        switch (optname) {
+        case SO_VM_SOCKETS_BUFFER_SIZE:
+                val = transport->get_buffer_size(vsk);
+                COPY_OUT(val);
+                break;
+
+        case SO_VM_SOCKETS_BUFFER_MAX_SIZE:
+                val = transport->get_max_buffer_size(vsk);
+                COPY_OUT(val);
+                break;
+
+        case SO_VM_SOCKETS_BUFFER_MIN_SIZE:
+                val = transport->get_min_buffer_size(vsk);
+                COPY_OUT(val);
+                break;
+
+        case SO_VM_SOCKETS_CONNECT_TIMEOUT: {
+                struct timeval tv;
+                tv.tv_sec = vsk->connect_timeout / HZ;
+                tv.tv_usec =
+                    (vsk->connect_timeout -
+                     tv.tv_sec * HZ) * (1000000 / HZ);
+                COPY_OUT(tv);
+                break;
+        }
+        default:
+                return -ENOPROTOOPT;
+        }
+
+        err = put_user(len, optlen);
+        if (err != 0)
+                return -EFAULT;
+
+#undef COPY_OUT
+
+        return 0;
+}
+
+static int vsock_stream_sendmsg(struct kiocb *kiocb, struct socket *sock,
+                                struct msghdr *msg, size_t len)
+{
+        struct sock *sk;
+        struct vsock_sock *vsk;
+        ssize_t total_written;
+        long timeout;
+        int err;
+        struct vsock_transport_send_notify_data send_data;
+
+        DEFINE_WAIT(wait);
+
+        sk = sock->sk;
+        vsk = vsock_sk(sk);
+        total_written = 0;
+        err = 0;
+
+        if (msg->msg_flags & MSG_OOB)
+                return -EOPNOTSUPP;
+
+        lock_sock(sk);
+
+        /* Callers should not provide a destination with stream sockets. */
+        if (msg->msg_namelen) {
+                err = sk->sk_state == SS_CONNECTED ? -EISCONN : -EOPNOTSUPP;
+                goto out;
+        }
+
+        /* Send data only if both sides are not shutdown in the direction. */
+        if (sk->sk_shutdown & SEND_SHUTDOWN ||
+            vsk->peer_shutdown & RCV_SHUTDOWN) {
+                err = -EPIPE;
+                goto out;
+        }
+
+        if (sk->sk_state != SS_CONNECTED ||
+            !vsock_addr_bound(&vsk->local_addr)) {
+                err = -ENOTCONN;
+                goto out;
+        }
+
+        if (!vsock_addr_bound(&vsk->remote_addr)) {
+                err = -EDESTADDRREQ;
+                goto out;
+        }
+
+        /* Wait for room in the produce queue to enqueue our user's data. */
+        timeout = sock_sndtimeo(sk, msg->msg_flags & MSG_DONTWAIT);
+
+        err = transport->notify_send_init(vsk, &send_data);
+        if (err < 0)
+                goto out;
+
+        prepare_to_wait(sk_sleep(sk), &wait, TASK_INTERRUPTIBLE);
+
+        while (total_written < len) {
+                ssize_t written;
+
+                while (vsock_stream_has_space(vsk) == 0 &&
+                       sk->sk_err == 0 &&
+                       !(sk->sk_shutdown & SEND_SHUTDOWN) &&
+                       !(vsk->peer_shutdown & RCV_SHUTDOWN)) {
+
+                        /* Don't wait for non-blocking sockets. */
+                        if (timeout == 0) {
+                                err = -EAGAIN;
+                                goto out_wait;
+                        }
+
+                        err = transport->notify_send_pre_block(vsk, &send_data);
+                        if (err < 0)
+                                goto out_wait;
+
+                        release_sock(sk);
+                        timeout = schedule_timeout(timeout);
+                        lock_sock(sk);
+                        if (signal_pending(current)) {
+                                err = sock_intr_errno(timeout);
+                                goto out_wait;
+                        } else if (timeout == 0) {
+                                err = -EAGAIN;
+                                goto out_wait;
+                        }
+
+                        prepare_to_wait(sk_sleep(sk), &wait,
+                                        TASK_INTERRUPTIBLE);
+                }
+
+                /* These checks occur both as part of and after the loop
+                 * conditional since we need to check before and after
+                 * sleeping.
+                 */
+                if (sk->sk_err) {
+                        err = -sk->sk_err;
+                        goto out_wait;
+                } else if ((sk->sk_shutdown & SEND_SHUTDOWN) ||
+                           (vsk->peer_shutdown & RCV_SHUTDOWN)) {
+                        err = -EPIPE;
+                        goto out_wait;
+                }
+
+                err = transport->notify_send_pre_enqueue(vsk, &send_data);
+                if (err < 0)
+                        goto out_wait;
+
+                /* Note that enqueue will only write as many bytes as are free
+                 * in the produce queue, so we don't need to ensure len is
+                 * smaller than the queue size.  It is the caller's
+                 * responsibility to check how many bytes we were able to send.
+                 */
+
+                written = transport->stream_enqueue(
+                                vsk, msg->msg_iov,
+                                len - total_written);
+                if (written < 0) {
+                        err = -ENOMEM;
+                        goto out_wait;
+                }
+
+                total_written += written;
+
+                err = transport->notify_send_post_enqueue(
+                                vsk, written, &send_data);
+                if (err < 0)
+                        goto out_wait;
+
+        }
+
+out_wait:
+        if (total_written > 0)
+                err = total_written;
+        finish_wait(sk_sleep(sk), &wait);
+out:
+        release_sock(sk);
+        return err;
+}
+
+
+static int
+vsock_stream_recvmsg(struct kiocb *kiocb,
+                     struct socket *sock,
+                     struct msghdr *msg, size_t len, int flags)
+{
+        struct sock *sk;
+        struct vsock_sock *vsk;
+        int err;
+        size_t target;
+        ssize_t copied;
+        long timeout;
+        struct vsock_transport_recv_notify_data recv_data;
+
+        DEFINE_WAIT(wait);
+
+        sk = sock->sk;
+        vsk = vsock_sk(sk);
+        err = 0;
+
+        lock_sock(sk);
+
+        if (sk->sk_state != SS_CONNECTED) {
+                /* Recvmsg is supposed to return 0 if a peer performs an
+                 * orderly shutdown. Differentiate between that case and when a
+                 * peer has not connected or a local shutdown occured with the
+                 * SOCK_DONE flag.
+                 */
+                if (sock_flag(sk, SOCK_DONE))
+                        err = 0;
+                else
+                        err = -ENOTCONN;
+
+                goto out;
+        }
+
+        if (flags & MSG_OOB) {
+                err = -EOPNOTSUPP;
+                goto out;
+        }
+
+        /* We don't check peer_shutdown flag here since peer may actually shut
+         * down, but there can be data in the queue that a local socket can
+         * receive.
+         */
+        if (sk->sk_shutdown & RCV_SHUTDOWN) {
+                err = 0;
+                goto out;
+        }
+
+        /* It is valid on Linux to pass in a zero-length receive buffer.  This
+         * is not an error.  We may as well bail out now.
+         */
+        if (!len) {
+                err = 0;
+                goto out;
+        }
+
+        /* We must not copy less than target bytes into the user's buffer
+         * before returning successfully, so we wait for the consume queue to
+         * have that much data to consume before dequeueing.  Note that this
+         * makes it impossible to handle cases where target is greater than the
+         * queue size.
+         */
+        target = sock_rcvlowat(sk, flags & MSG_WAITALL, len);
+        if (target >= transport->stream_rcvhiwat(vsk)) {
+                err = -ENOMEM;
+                goto out;
+        }
+        timeout = sock_rcvtimeo(sk, flags & MSG_DONTWAIT);
+        copied = 0;
+
+        err = transport->notify_recv_init(vsk, target, &recv_data);
+        if (err < 0)
+                goto out;
+
+        prepare_to_wait(sk_sleep(sk), &wait, TASK_INTERRUPTIBLE);
+
+        while (1) {
+                s64 ready = vsock_stream_has_data(vsk);
+
+                if (ready < 0) {
+                        /* Invalid queue pair content. XXX This should be
+                         * changed to a connection reset in a later change.
+                         */
+
+                        err = -ENOMEM;
+                        goto out_wait;
+                } else if (ready > 0) {
+                        ssize_t read;
+
+                        err = transport->notify_recv_pre_dequeue(
+                                        vsk, target, &recv_data);
+                        if (err < 0)
+                                break;
+
+                        read = transport->stream_dequeue(
+                                        vsk, msg->msg_iov,
+                                        len - copied, flags);
+                        if (read < 0) {
+                                err = -ENOMEM;
+                                break;
+                        }
+
+                        copied += read;
+
+                        err = transport->notify_recv_post_dequeue(
+                                        vsk, target, read,
+                                        !(flags & MSG_PEEK), &recv_data);
+                        if (err < 0)
+                                goto out_wait;
+
+                        if (read >= target || flags & MSG_PEEK)
+                                break;
+
+                        target -= read;
+                } else {
+                        if (sk->sk_err != 0 || (sk->sk_shutdown & RCV_SHUTDOWN)
+                            || (vsk->peer_shutdown & SEND_SHUTDOWN)) {
+                                break;
+                        }
+                        /* Don't wait for non-blocking sockets. */
+                        if (timeout == 0) {
+                                err = -EAGAIN;
+                                break;
+                        }
+
+                        err = transport->notify_recv_pre_block(
+                                        vsk, target, &recv_data);
+                        if (err < 0)
+                                break;
+
+                        release_sock(sk);
+                        timeout = schedule_timeout(timeout);
+                        lock_sock(sk);
+
+                        if (signal_pending(current)) {
+                                err = sock_intr_errno(timeout);
+                                break;
+                        } else if (timeout == 0) {
+                                err = -EAGAIN;
+                                break;
+                        }
+
+                        prepare_to_wait(sk_sleep(sk), &wait,
+                                        TASK_INTERRUPTIBLE);
+                }
+        }
+
+        if (sk->sk_err)
+                err = -sk->sk_err;
+        else if (sk->sk_shutdown & RCV_SHUTDOWN)
+                err = 0;
+
+        if (copied > 0) {
+                /* We only do these additional bookkeeping/notification steps
+                 * if we actually copied something out of the queue pair
+                 * instead of just peeking ahead.
+                 */
+
+                if (!(flags & MSG_PEEK)) {
+                        /* If the other side has shutdown for sending and there
+                         * is nothing more to read, then modify the socket
+                         * state.
+                         */
+                        if (vsk->peer_shutdown & SEND_SHUTDOWN) {
+                                if (vsock_stream_has_data(vsk) <= 0) {
+                                        sk->sk_state = SS_UNCONNECTED;
+                                        sock_set_flag(sk, SOCK_DONE);
+                                        sk->sk_state_change(sk);
+                                }
+                        }
+                }
+                err = copied;
+        }
+
+out_wait:
+        finish_wait(sk_sleep(sk), &wait);
+out:
+        release_sock(sk);
+        return err;
+}
+
+static const struct proto_ops vsock_stream_ops = {
+        .family = PF_VSOCK,
+        .owner = THIS_MODULE,
+        .release = vsock_release,
+        .bind = vsock_bind,
+        .connect = vsock_stream_connect,
+        .socketpair = sock_no_socketpair,
+        .accept = vsock_accept,
+        .getname = vsock_getname,
+        .poll = vsock_poll,
+        .ioctl = sock_no_ioctl,
+        .listen = vsock_listen,
+        .shutdown = vsock_shutdown,
+        .setsockopt = vsock_stream_setsockopt,
+        .getsockopt = vsock_stream_getsockopt,
+        .sendmsg = vsock_stream_sendmsg,
+        .recvmsg = vsock_stream_recvmsg,
+        .mmap = sock_no_mmap,
+        .sendpage = sock_no_sendpage,
+};
+
+static int vsock_create(struct net *net, struct socket *sock,
+                        int protocol, int kern)
+{
+        if (!sock)
+                return -EINVAL;
+
+        if (protocol && protocol != PF_VSOCK)
+                return -EPROTONOSUPPORT;
+
+        switch (sock->type) {
+        case SOCK_DGRAM:
+                sock->ops = &vsock_dgram_ops;
+                break;
+        case SOCK_STREAM:
+                sock->ops = &vsock_stream_ops;
+                break;
+        default:
+                return -ESOCKTNOSUPPORT;
+        }
+
+        sock->state = SS_UNCONNECTED;
+
+        return __vsock_create(net, sock, NULL, GFP_KERNEL, 0) ? 0 : -ENOMEM;
+}
+
+static const struct net_proto_family vsock_family_ops = {
+        .family = AF_VSOCK,
+        .create = vsock_create,
+        .owner = THIS_MODULE,
+};
+
+static long vsock_dev_do_ioctl(struct file *filp,
+                               unsigned int cmd, void __user *ptr)
+{
+        u32 __user *p = ptr;
+        int retval = 0;
+
+        switch (cmd) {
+        case IOCTL_VM_SOCKETS_GET_LOCAL_CID:
+                if (put_user(transport->get_local_cid(), p) != 0)
+                        retval = -EFAULT;
+                break;
+
+        default:
+                pr_err("Unknown ioctl %d\n", cmd);
+                retval = -EINVAL;
+        }
+
+        return retval;
+}
+
+static long vsock_dev_ioctl(struct file *filp,
+                            unsigned int cmd, unsigned long arg)
+{
+        return vsock_dev_do_ioctl(filp, cmd, (void __user *)arg);
+}
+
+#ifdef CONFIG_COMPAT
+static long vsock_dev_compat_ioctl(struct file *filp,
+                                   unsigned int cmd, unsigned long arg)
+{
+        return vsock_dev_do_ioctl(filp, cmd, compat_ptr(arg));
+}
+#endif
+
+static const struct file_operations vsock_device_ops = {
+        .owner          = THIS_MODULE,
+        .unlocked_ioctl = vsock_dev_ioctl,
+#ifdef CONFIG_COMPAT
+        .compat_ioctl   = vsock_dev_compat_ioctl,
+#endif
+        .open           = nonseekable_open,
+};
+
+static struct miscdevice vsock_device = {
+        .name           = "vsock",
+        .minor          = MISC_DYNAMIC_MINOR,
+        .fops           = &vsock_device_ops,
+};
+
+static int __vsock_core_init(void)
+{
+        int err;
+
+        vsock_init_tables();
+
+        err = misc_register(&vsock_device);
+        if (err) {
+                pr_err("Failed to register misc device\n");
+                return -ENOENT;
+        }
+
+        err = proto_register(&vsock_proto, 1);  /* we want our slab */
+        if (err) {
+                pr_err("Cannot register vsock protocol\n");
+                goto err_misc_deregister;
+        }
+
+        err = sock_register(&vsock_family_ops);
+        if (err) {
+                pr_err("could not register af_vsock (%d) address family: %d\n",
+                       AF_VSOCK, err);
+                goto err_unregister_proto;
+        }
+
+        return 0;
+
+err_unregister_proto:
+        proto_unregister(&vsock_proto);
+err_misc_deregister:
+        misc_deregister(&vsock_device);
+        return err;
+}
+
+int vsock_core_init(const struct vsock_transport *t)
+{
+        int retval = mutex_lock_interruptible(&vsock_register_mutex);
+        if (retval)
+                return retval;
+
+        if (transport) {
+                retval = -EBUSY;
+                goto out;
+        }
+
+        transport = t;
+        retval = __vsock_core_init();
+        if (retval)
+                transport = NULL;
+
+out:
+        mutex_unlock(&vsock_register_mutex);
+        return retval;
+}
+EXPORT_SYMBOL_GPL(vsock_core_init);
+
+void vsock_core_exit(void)
+{
+        mutex_lock(&vsock_register_mutex);
+
+        misc_deregister(&vsock_device);
+        sock_unregister(AF_VSOCK);
+        proto_unregister(&vsock_proto);
+
+        /* We do not want the assignment below re-ordered. */
+        mb();
+        transport = NULL;
+
+        mutex_unlock(&vsock_register_mutex);
+}
+EXPORT_SYMBOL_GPL(vsock_core_exit);
+
+MODULE_AUTHOR("VMware, Inc.");
+MODULE_DESCRIPTION("VMware Virtual Socket Family");
+MODULE_VERSION("1.0.0.0-k");
+MODULE_LICENSE("GPL v2");
diff --git a/net/vmw_vsock/af_vsock.h b/net/vmw_vsock/af_vsock.h
new file mode 100644
index 000000000000..7d64d3609ec9
--- /dev/null
+++ b/net/vmw_vsock/af_vsock.h
@@ -0,0 +1,175 @@
+/*
+ * VMware vSockets Driver
+ *
+ * Copyright (C) 2007-2013 VMware, Inc. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the Free
+ * Software Foundation version 2 and no later version.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ */
+
+#ifndef __AF_VSOCK_H__
+#define __AF_VSOCK_H__
+
+#include <linux/kernel.h>
+#include <linux/workqueue.h>
+#include <linux/vm_sockets.h>
+
+#include "vsock_addr.h"
+
+#define LAST_RESERVED_PORT 1023
+
+#define vsock_sk(__sk)    ((struct vsock_sock *)__sk)
+#define sk_vsock(__vsk)   (&(__vsk)->sk)
+
+struct vsock_sock {
+        /* sk must be the first member. */
+        struct sock sk;
+        struct sockaddr_vm local_addr;
+        struct sockaddr_vm remote_addr;
+        /* Links for the global tables of bound and connected sockets. */
+        struct list_head bound_table;
+        struct list_head connected_table;
+        /* Accessed without the socket lock held. This means it can never be
+         * modified outsided of socket create or destruct.
+         */
+        bool trusted;
+        bool cached_peer_allow_dgram;   /* Dgram communication allowed to
+                                         * cached peer?
+                                         */
+        u32 cached_peer;  /* Context ID of last dgram destination check. */
+        const struct cred *owner;
+        /* Rest are SOCK_STREAM only. */
+        long connect_timeout;
+        /* Listening socket that this came from. */
+        struct sock *listener;
+        /* Used for pending list and accept queue during connection handshake.
+         * The listening socket is the head for both lists.  Sockets created
+         * for connection requests are placed in the pending list until they
+         * are connected, at which point they are put in the accept queue list
+         * so they can be accepted in accept().  If accept() cannot accept the
+         * connection, it is marked as rejected so the cleanup function knows
+         * to clean up the socket.
+         */
+        struct list_head pending_links;
+        struct list_head accept_queue;
+        bool rejected;
+        struct delayed_work dwork;
+        u32 peer_shutdown;
+        bool sent_request;
+        bool ignore_connecting_rst;
+
+        /* Private to transport. */
+        void *trans;
+};
+
+s64 vsock_stream_has_data(struct vsock_sock *vsk);
+s64 vsock_stream_has_space(struct vsock_sock *vsk);
+void vsock_pending_work(struct work_struct *work);
+struct sock *__vsock_create(struct net *net,
+                            struct socket *sock,
+                            struct sock *parent,
+                            gfp_t priority, unsigned short type);
+
+/**** TRANSPORT ****/
+
+struct vsock_transport_recv_notify_data {
+        u64 data1; /* Transport-defined. */
+        u64 data2; /* Transport-defined. */
+        bool notify_on_block;
+};
+
+struct vsock_transport_send_notify_data {
+        u64 data1; /* Transport-defined. */
+        u64 data2; /* Transport-defined. */
+};
+
+struct vsock_transport {
+        /* Initialize/tear-down socket. */
+        int (*init)(struct vsock_sock *, struct vsock_sock *);
+        void (*destruct)(struct vsock_sock *);
+        void (*release)(struct vsock_sock *);
+
+        /* Connections. */
+        int (*connect)(struct vsock_sock *);
+
+        /* DGRAM. */
+        int (*dgram_bind)(struct vsock_sock *, struct sockaddr_vm *);
+        int (*dgram_dequeue)(struct kiocb *kiocb, struct vsock_sock *vsk,
+                             struct msghdr *msg, size_t len, int flags);
+        int (*dgram_enqueue)(struct vsock_sock *, struct sockaddr_vm *,
+                             struct iovec *, size_t len);
+        bool (*dgram_allow)(u32 cid, u32 port);
+
+        /* STREAM. */
+        /* TODO: stream_bind() */
+        ssize_t (*stream_dequeue)(struct vsock_sock *, struct iovec *,
+                                  size_t len, int flags);
+        ssize_t (*stream_enqueue)(struct vsock_sock *, struct iovec *,
+                                  size_t len);
+        s64 (*stream_has_data)(struct vsock_sock *);
+        s64 (*stream_has_space)(struct vsock_sock *);
+        u64 (*stream_rcvhiwat)(struct vsock_sock *);
+        bool (*stream_is_active)(struct vsock_sock *);
+        bool (*stream_allow)(u32 cid, u32 port);
+
+        /* Notification. */
+        int (*notify_poll_in)(struct vsock_sock *, size_t, bool *);
+        int (*notify_poll_out)(struct vsock_sock *, size_t, bool *);
+        int (*notify_recv_init)(struct vsock_sock *, size_t,
+                struct vsock_transport_recv_notify_data *);
+        int (*notify_recv_pre_block)(struct vsock_sock *, size_t,
+                struct vsock_transport_recv_notify_data *);
+        int (*notify_recv_pre_dequeue)(struct vsock_sock *, size_t,
+                struct vsock_transport_recv_notify_data *);
+        int (*notify_recv_post_dequeue)(struct vsock_sock *, size_t,
+                ssize_t, bool, struct vsock_transport_recv_notify_data *);
+        int (*notify_send_init)(struct vsock_sock *,
+                struct vsock_transport_send_notify_data *);
+        int (*notify_send_pre_block)(struct vsock_sock *,
+                struct vsock_transport_send_notify_data *);
+        int (*notify_send_pre_enqueue)(struct vsock_sock *,
+                struct vsock_transport_send_notify_data *);
+        int (*notify_send_post_enqueue)(struct vsock_sock *, ssize_t,
+                struct vsock_transport_send_notify_data *);
+
+        /* Shutdown. */
+        int (*shutdown)(struct vsock_sock *, int);
+
+        /* Buffer sizes. */
+        void (*set_buffer_size)(struct vsock_sock *, u64);
+        void (*set_min_buffer_size)(struct vsock_sock *, u64);
+        void (*set_max_buffer_size)(struct vsock_sock *, u64);
+        u64 (*get_buffer_size)(struct vsock_sock *);
+        u64 (*get_min_buffer_size)(struct vsock_sock *);
+        u64 (*get_max_buffer_size)(struct vsock_sock *);
+
+        /* Addressing. */
+        u32 (*get_local_cid)(void);
+};
+
+/**** CORE ****/
+
+int vsock_core_init(const struct vsock_transport *t);
+void vsock_core_exit(void);
+
+/**** UTILS ****/
+
+void vsock_release_pending(struct sock *pending);
+void vsock_add_pending(struct sock *listener, struct sock *pending);
+void vsock_remove_pending(struct sock *listener, struct sock *pending);
+void vsock_enqueue_accept(struct sock *listener, struct sock *connected);
+void vsock_insert_connected(struct vsock_sock *vsk);
+void vsock_remove_bound(struct vsock_sock *vsk);
+void vsock_remove_connected(struct vsock_sock *vsk);
+struct sock *vsock_find_bound_socket(struct sockaddr_vm *addr);
+struct sock *vsock_find_connected_socket(struct sockaddr_vm *src,
+                                         struct sockaddr_vm *dst);
+void vsock_for_each_connected_socket(void (*fn)(struct sock *sk));
+
+#endif /* __AF_VSOCK_H__ */
diff --git a/net/vmw_vsock/vmci_transport.c b/net/vmw_vsock/vmci_transport.c
new file mode 100644
index 000000000000..a70ace83a153
--- /dev/null
+++ b/net/vmw_vsock/vmci_transport.c
@@ -0,0 +1,2155 @@
+/*
+ * VMware vSockets Driver
+ *
+ * Copyright (C) 2007-2013 VMware, Inc. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the Free
+ * Software Foundation version 2 and no later version.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ */
+
+#include <linux/types.h>
+#include <linux/bitops.h>
+#include <linux/cred.h>
+#include <linux/init.h>
+#include <linux/io.h>
+#include <linux/kernel.h>
+#include <linux/kmod.h>
+#include <linux/list.h>
+#include <linux/miscdevice.h>
+#include <linux/module.h>
+#include <linux/mutex.h>
+#include <linux/net.h>
+#include <linux/poll.h>
+#include <linux/skbuff.h>
+#include <linux/smp.h>
+#include <linux/socket.h>
+#include <linux/stddef.h>
+#include <linux/unistd.h>
+#include <linux/wait.h>
+#include <linux/workqueue.h>
+#include <net/sock.h>
+
+#include "af_vsock.h"
+#include "vmci_transport_notify.h"
+
+static int vmci_transport_recv_dgram_cb(void *data, struct vmci_datagram *dg);
+static int vmci_transport_recv_stream_cb(void *data, struct vmci_datagram *dg);
+static void vmci_transport_peer_attach_cb(u32 sub_id,
+                                          const struct vmci_event_data *ed,
+                                          void *client_data);
+static void vmci_transport_peer_detach_cb(u32 sub_id,
+                                          const struct vmci_event_data *ed,
+                                          void *client_data);
+static void vmci_transport_recv_pkt_work(struct work_struct *work);
+static int vmci_transport_recv_listen(struct sock *sk,
+                                      struct vmci_transport_packet *pkt);
+static int vmci_transport_recv_connecting_server(
+                                        struct sock *sk,
+                                        struct sock *pending,
+                                        struct vmci_transport_packet *pkt);
+static int vmci_transport_recv_connecting_client(
+                                        struct sock *sk,
+                                        struct vmci_transport_packet *pkt);
+static int vmci_transport_recv_connecting_client_negotiate(
+                                        struct sock *sk,
+                                        struct vmci_transport_packet *pkt);
+static int vmci_transport_recv_connecting_client_invalid(
+                                        struct sock *sk,
+                                        struct vmci_transport_packet *pkt);
+static int vmci_transport_recv_connected(struct sock *sk,
+                                         struct vmci_transport_packet *pkt);
+static bool vmci_transport_old_proto_override(bool *old_pkt_proto);
+static u16 vmci_transport_new_proto_supported_versions(void);
+static bool vmci_transport_proto_to_notify_struct(struct sock *sk, u16 *proto,
+                                                  bool old_pkt_proto);
+
+struct vmci_transport_recv_pkt_info {
+        struct work_struct work;
+        struct sock *sk;
+        struct vmci_transport_packet pkt;
+};
+
+static struct vmci_handle vmci_transport_stream_handle = { VMCI_INVALID_ID,
+                                                           VMCI_INVALID_ID };
+static u32 vmci_transport_qp_resumed_sub_id = VMCI_INVALID_ID;
+
+static int PROTOCOL_OVERRIDE = -1;
+
+#define VMCI_TRANSPORT_DEFAULT_QP_SIZE_MIN   128
+#define VMCI_TRANSPORT_DEFAULT_QP_SIZE       262144
+#define VMCI_TRANSPORT_DEFAULT_QP_SIZE_MAX   262144
+
+/* The default peer timeout indicates how long we will wait for a peer response
+ * to a control message.
+ */
+#define VSOCK_DEFAULT_CONNECT_TIMEOUT (2 * HZ)
+
+#define SS_LISTEN 255
+
+/* Helper function to convert from a VMCI error code to a VSock error code. */
+
+static s32 vmci_transport_error_to_vsock_error(s32 vmci_error)
+{
+        int err;
+
+        switch (vmci_error) {
+        case VMCI_ERROR_NO_MEM:
+                err = ENOMEM;
+                break;
+        case VMCI_ERROR_DUPLICATE_ENTRY:
+        case VMCI_ERROR_ALREADY_EXISTS:
+                err = EADDRINUSE;
+                break;
+        case VMCI_ERROR_NO_ACCESS:
+                err = EPERM;
+                break;
+        case VMCI_ERROR_NO_RESOURCES:
+                err = ENOBUFS;
+                break;
+        case VMCI_ERROR_INVALID_RESOURCE:
+                err = EHOSTUNREACH;
+                break;
+        case VMCI_ERROR_INVALID_ARGS:
+        default:
+                err = EINVAL;
+        }
+
+        return err > 0 ? -err : err;
+}
+
+static inline void
+vmci_transport_packet_init(struct vmci_transport_packet *pkt,
+                           struct sockaddr_vm *src,
+                           struct sockaddr_vm *dst,
+                           u8 type,
+                           u64 size,
+                           u64 mode,
+                           struct vmci_transport_waiting_info *wait,
+                           u16 proto,
+                           struct vmci_handle handle)
+{
+        /* We register the stream control handler as an any cid handle so we
+         * must always send from a source address of VMADDR_CID_ANY
+         */
+        pkt->dg.src = vmci_make_handle(VMADDR_CID_ANY,
+                                       VMCI_TRANSPORT_PACKET_RID);
+        pkt->dg.dst = vmci_make_handle(dst->svm_cid,
+                                       VMCI_TRANSPORT_PACKET_RID);
+        pkt->dg.payload_size = sizeof(*pkt) - sizeof(pkt->dg);
+        pkt->version = VMCI_TRANSPORT_PACKET_VERSION;
+        pkt->type = type;
+        pkt->src_port = src->svm_port;
+        pkt->dst_port = dst->svm_port;
+        memset(&pkt->proto, 0, sizeof(pkt->proto));
+        memset(&pkt->_reserved2, 0, sizeof(pkt->_reserved2));
+
+        switch (pkt->type) {
+        case VMCI_TRANSPORT_PACKET_TYPE_INVALID:
+                pkt->u.size = 0;
+                break;
+
+        case VMCI_TRANSPORT_PACKET_TYPE_REQUEST:
+        case VMCI_TRANSPORT_PACKET_TYPE_NEGOTIATE:
+                pkt->u.size = size;
+                break;
+
+        case VMCI_TRANSPORT_PACKET_TYPE_OFFER:
+        case VMCI_TRANSPORT_PACKET_TYPE_ATTACH:
+                pkt->u.handle = handle;
+                break;
+
+        case VMCI_TRANSPORT_PACKET_TYPE_WROTE:
+        case VMCI_TRANSPORT_PACKET_TYPE_READ:
+        case VMCI_TRANSPORT_PACKET_TYPE_RST:
+                pkt->u.size = 0;
+                break;
+
+        case VMCI_TRANSPORT_PACKET_TYPE_SHUTDOWN:
+                pkt->u.mode = mode;
+                break;
+
+        case VMCI_TRANSPORT_PACKET_TYPE_WAITING_READ:
+        case VMCI_TRANSPORT_PACKET_TYPE_WAITING_WRITE:
+                memcpy(&pkt->u.wait, wait, sizeof(pkt->u.wait));
+                break;
+
+        case VMCI_TRANSPORT_PACKET_TYPE_REQUEST2:
+        case VMCI_TRANSPORT_PACKET_TYPE_NEGOTIATE2:
+                pkt->u.size = size;
+                pkt->proto = proto;
+                break;
+        }
+}
+
+static inline void
+vmci_transport_packet_get_addresses(struct vmci_transport_packet *pkt,
+                                    struct sockaddr_vm *local,
+                                    struct sockaddr_vm *remote)
+{
+        vsock_addr_init(local, pkt->dg.dst.context, pkt->dst_port);
+        vsock_addr_init(remote, pkt->dg.src.context, pkt->src_port);
+}
+
+static int
+__vmci_transport_send_control_pkt(struct vmci_transport_packet *pkt,
+                                  struct sockaddr_vm *src,
+                                  struct sockaddr_vm *dst,
+                                  enum vmci_transport_packet_type type,
+                                  u64 size,
+                                  u64 mode,
+                                  struct vmci_transport_waiting_info *wait,
+                                  u16 proto,
+                                  struct vmci_handle handle,
+                                  bool convert_error)
+{
+        int err;
+
+        vmci_transport_packet_init(pkt, src, dst, type, size, mode, wait,
+                                   proto, handle);
+        err = vmci_datagram_send(&pkt->dg);
+        if (convert_error && (err < 0))
+                return vmci_transport_error_to_vsock_error(err);
+
+        return err;
+}
+
+static int
+vmci_transport_reply_control_pkt_fast(struct vmci_transport_packet *pkt,
+                                      enum vmci_transport_packet_type type,
+                                      u64 size,
+                                      u64 mode,
+                                      struct vmci_transport_waiting_info *wait,
+                                      struct vmci_handle handle)
+{
+        struct vmci_transport_packet reply;
+        struct sockaddr_vm src, dst;
+
+        if (pkt->type == VMCI_TRANSPORT_PACKET_TYPE_RST) {
+                return 0;
+        } else {
+                vmci_transport_packet_get_addresses(pkt, &src, &dst);
+                return __vmci_transport_send_control_pkt(&reply, &src, &dst,
+                                                         type,
+                                                         size, mode, wait,
+                                                         VSOCK_PROTO_INVALID,
+                                                         handle, true);
+        }
+}
+
+static int
+vmci_transport_send_control_pkt_bh(struct sockaddr_vm *src,
+                                   struct sockaddr_vm *dst,
+                                   enum vmci_transport_packet_type type,
+                                   u64 size,
+                                   u64 mode,
+                                   struct vmci_transport_waiting_info *wait,
+                                   struct vmci_handle handle)
+{
+        /* Note that it is safe to use a single packet across all CPUs since
+         * two tasklets of the same type are guaranteed to not ever run
+         * simultaneously. If that ever changes, or VMCI stops using tasklets,
+         * we can use per-cpu packets.
+         */
+        static struct vmci_transport_packet pkt;
+
+        return __vmci_transport_send_control_pkt(&pkt, src, dst, type,
+                                                 size, mode, wait,
+                                                 VSOCK_PROTO_INVALID, handle,
+                                                 false);
+}
+
+static int
+vmci_transport_send_control_pkt(struct sock *sk,
+                                enum vmci_transport_packet_type type,
+                                u64 size,
+                                u64 mode,
+                                struct vmci_transport_waiting_info *wait,
+                                u16 proto,
+                                struct vmci_handle handle)
+{
+        struct vmci_transport_packet *pkt;
+        struct vsock_sock *vsk;
+        int err;
+
+        vsk = vsock_sk(sk);
+
+        if (!vsock_addr_bound(&vsk->local_addr))
+                return -EINVAL;
+
+        if (!vsock_addr_bound(&vsk->remote_addr))
+                return -EINVAL;
+
+        pkt = kmalloc(sizeof(*pkt), GFP_KERNEL);
+        if (!pkt)
+                return -ENOMEM;
+
+        err = __vmci_transport_send_control_pkt(pkt, &vsk->local_addr,
+                                                &vsk->remote_addr, type, size,
+                                                mode, wait, proto, handle,
+                                                true);
+        kfree(pkt);
+
+        return err;
+}
+
+static int vmci_transport_send_reset_bh(struct sockaddr_vm *dst,
+                                        struct sockaddr_vm *src,
+                                        struct vmci_transport_packet *pkt)
+{
+        if (pkt->type == VMCI_TRANSPORT_PACKET_TYPE_RST)
+                return 0;
+        return vmci_transport_send_control_pkt_bh(
+                                        dst, src,
+                                        VMCI_TRANSPORT_PACKET_TYPE_RST, 0,
+                                        0, NULL, VMCI_INVALID_HANDLE);
+}
+
+static int vmci_transport_send_reset(struct sock *sk,
+                                     struct vmci_transport_packet *pkt)
+{
+        if (pkt->type == VMCI_TRANSPORT_PACKET_TYPE_RST)
+                return 0;
+        return vmci_transport_send_control_pkt(sk,
+                                        VMCI_TRANSPORT_PACKET_TYPE_RST,
+                                        0, 0, NULL, VSOCK_PROTO_INVALID,
+                                        VMCI_INVALID_HANDLE);
+}
+
+static int vmci_transport_send_negotiate(struct sock *sk, size_t size)
+{
+        return vmci_transport_send_control_pkt(
+                                        sk,
+                                        VMCI_TRANSPORT_PACKET_TYPE_NEGOTIATE,
+                                        size, 0, NULL,
+                                        VSOCK_PROTO_INVALID,
+                                        VMCI_INVALID_HANDLE);
+}
+
+static int vmci_transport_send_negotiate2(struct sock *sk, size_t size,
+                                          u16 version)
+{
+        return vmci_transport_send_control_pkt(
+                                        sk,
+                                        VMCI_TRANSPORT_PACKET_TYPE_NEGOTIATE2,
+                                        size, 0, NULL, version,
+                                        VMCI_INVALID_HANDLE);
+}
+
+static int vmci_transport_send_qp_offer(struct sock *sk,
+                                        struct vmci_handle handle)
+{
+        return vmci_transport_send_control_pkt(
+                                        sk, VMCI_TRANSPORT_PACKET_TYPE_OFFER, 0,
+                                        0, NULL,
+                                        VSOCK_PROTO_INVALID, handle);
+}
+
+static int vmci_transport_send_attach(struct sock *sk,
+                                      struct vmci_handle handle)
+{
+        return vmci_transport_send_control_pkt(
+                                        sk, VMCI_TRANSPORT_PACKET_TYPE_ATTACH,
+                                        0, 0, NULL, VSOCK_PROTO_INVALID,
+                                        handle);
+}
+
+static int vmci_transport_reply_reset(struct vmci_transport_packet *pkt)
+{
+        return vmci_transport_reply_control_pkt_fast(
+                                                pkt,
+                                                VMCI_TRANSPORT_PACKET_TYPE_RST,
+                                                0, 0, NULL,
+                                                VMCI_INVALID_HANDLE);
+}
+
+static int vmci_transport_send_invalid_bh(struct sockaddr_vm *dst,
+                                          struct sockaddr_vm *src)
+{
+        return vmci_transport_send_control_pkt_bh(
+                                        dst, src,
+                                        VMCI_TRANSPORT_PACKET_TYPE_INVALID,
+                                        0, 0, NULL, VMCI_INVALID_HANDLE);
+}
+
+int vmci_transport_send_wrote_bh(struct sockaddr_vm *dst,
+                                 struct sockaddr_vm *src)
+{
+        return vmci_transport_send_control_pkt_bh(
+                                        dst, src,
+                                        VMCI_TRANSPORT_PACKET_TYPE_WROTE, 0,
+                                        0, NULL, VMCI_INVALID_HANDLE);
+}
+
+int vmci_transport_send_read_bh(struct sockaddr_vm *dst,
+                                struct sockaddr_vm *src)
+{
+        return vmci_transport_send_control_pkt_bh(
+                                        dst, src,
+                                        VMCI_TRANSPORT_PACKET_TYPE_READ, 0,
+                                        0, NULL, VMCI_INVALID_HANDLE);
+}
+
+int vmci_transport_send_wrote(struct sock *sk)
+{
+        return vmci_transport_send_control_pkt(
+                                        sk, VMCI_TRANSPORT_PACKET_TYPE_WROTE, 0,
+                                        0, NULL, VSOCK_PROTO_INVALID,
+                                        VMCI_INVALID_HANDLE);
+}
+
+int vmci_transport_send_read(struct sock *sk)
+{
+        return vmci_transport_send_control_pkt(
+                                        sk, VMCI_TRANSPORT_PACKET_TYPE_READ, 0,
+                                        0, NULL, VSOCK_PROTO_INVALID,
+                                        VMCI_INVALID_HANDLE);
+}
+
+int vmci_transport_send_waiting_write(struct sock *sk,
+                                      struct vmci_transport_waiting_info *wait)
+{
+        return vmci_transport_send_control_pkt(
+                                sk, VMCI_TRANSPORT_PACKET_TYPE_WAITING_WRITE,
+                                0, 0, wait, VSOCK_PROTO_INVALID,
+                                VMCI_INVALID_HANDLE);
+}
+
+int vmci_transport_send_waiting_read(struct sock *sk,
+                                     struct vmci_transport_waiting_info *wait)
+{
+        return vmci_transport_send_control_pkt(
+                                sk, VMCI_TRANSPORT_PACKET_TYPE_WAITING_READ,
+                                0, 0, wait, VSOCK_PROTO_INVALID,
+                                VMCI_INVALID_HANDLE);
+}
+
+static int vmci_transport_shutdown(struct vsock_sock *vsk, int mode)
+{
+        return vmci_transport_send_control_pkt(
+                                        &vsk->sk,
+                                        VMCI_TRANSPORT_PACKET_TYPE_SHUTDOWN,
+                                        0, mode, NULL,
+                                        VSOCK_PROTO_INVALID,
+                                        VMCI_INVALID_HANDLE);
+}
+
+static int vmci_transport_send_conn_request(struct sock *sk, size_t size)
+{
+        return vmci_transport_send_control_pkt(sk,
+                                        VMCI_TRANSPORT_PACKET_TYPE_REQUEST,
+                                        size, 0, NULL,
+                                        VSOCK_PROTO_INVALID,
+                                        VMCI_INVALID_HANDLE);
+}
+
+static int vmci_transport_send_conn_request2(struct sock *sk, size_t size,
+                                             u16 version)
+{
+        return vmci_transport_send_control_pkt(
+                                        sk, VMCI_TRANSPORT_PACKET_TYPE_REQUEST2,
+                                        size, 0, NULL, version,
+                                        VMCI_INVALID_HANDLE);
+}
+
+static struct sock *vmci_transport_get_pending(
+                                        struct sock *listener,
+                                        struct vmci_transport_packet *pkt)
+{
+        struct vsock_sock *vlistener;
+        struct vsock_sock *vpending;
+        struct sock *pending;
+
+        vlistener = vsock_sk(listener);
+
+        list_for_each_entry(vpending, &vlistener->pending_links,
+                            pending_links) {
+                struct sockaddr_vm src;
+                struct sockaddr_vm dst;
+
+                vsock_addr_init(&src, pkt->dg.src.context, pkt->src_port);
+                vsock_addr_init(&dst, pkt->dg.dst.context, pkt->dst_port);
+
+                if (vsock_addr_equals_addr(&src, &vpending->remote_addr) &&
+                    vsock_addr_equals_addr(&dst, &vpending->local_addr)) {
+                        pending = sk_vsock(vpending);
+                        sock_hold(pending);
+                        goto found;
+                }
+        }
+
+        pending = NULL;
+found:
+        return pending;
+
+}
+
+static void vmci_transport_release_pending(struct sock *pending)
+{
+        sock_put(pending);
+}
+
+/* We allow two kinds of sockets to communicate with a restricted VM: 1)
+ * trusted sockets 2) sockets from applications running as the same user as the
+ * VM (this is only true for the host side and only when using hosted products)
+ */
+
+static bool vmci_transport_is_trusted(struct vsock_sock *vsock, u32 peer_cid)
+{
+        return vsock->trusted ||
+               vmci_is_context_owner(peer_cid, vsock->owner->uid);
+}
+
+/* We allow sending datagrams to and receiving datagrams from a restricted VM
+ * only if it is trusted as described in vmci_transport_is_trusted.
+ */
+
+static bool vmci_transport_allow_dgram(struct vsock_sock *vsock, u32 peer_cid)
+{
+        if (vsock->cached_peer != peer_cid) {
+                vsock->cached_peer = peer_cid;
+                if (!vmci_transport_is_trusted(vsock, peer_cid) &&
+                    (vmci_context_get_priv_flags(peer_cid) &
+                     VMCI_PRIVILEGE_FLAG_RESTRICTED)) {
+                        vsock->cached_peer_allow_dgram = false;
+                } else {
+                        vsock->cached_peer_allow_dgram = true;
+                }
+        }
+
+        return vsock->cached_peer_allow_dgram;
+}
+
+static int
+vmci_transport_queue_pair_alloc(struct vmci_qp **qpair,
+                                struct vmci_handle *handle,
+                                u64 produce_size,
+                                u64 consume_size,
+                                u32 peer, u32 flags, bool trusted)
+{
+        int err = 0;
+
+        if (trusted) {
+                /* Try to allocate our queue pair as trusted. This will only
+                 * work if vsock is running in the host.
+                 */
+
+                err = vmci_qpair_alloc(qpair, handle, produce_size,
+                                       consume_size,
+                                       peer, flags,
+                                       VMCI_PRIVILEGE_FLAG_TRUSTED);
+                if (err != VMCI_ERROR_NO_ACCESS)
+                        goto out;
+
+        }
+
+        err = vmci_qpair_alloc(qpair, handle, produce_size, consume_size,
+                               peer, flags, VMCI_NO_PRIVILEGE_FLAGS);
+out:
+        if (err < 0) {
+                pr_err("Could not attach to queue pair with %d\n",
+                       err);
+                err = vmci_transport_error_to_vsock_error(err);
+        }
+
+        return err;
+}
+
+static int
+vmci_transport_datagram_create_hnd(u32 resource_id,
+                                   u32 flags,
+                                   vmci_datagram_recv_cb recv_cb,
+                                   void *client_data,
+                                   struct vmci_handle *out_handle)
+{
+        int err = 0;
+
+        /* Try to allocate our datagram handler as trusted. This will only work
+         * if vsock is running in the host.
+         */
+
+        err = vmci_datagram_create_handle_priv(resource_id, flags,
+                                               VMCI_PRIVILEGE_FLAG_TRUSTED,
+                                               recv_cb,
+                                               client_data, out_handle);
+
+        if (err == VMCI_ERROR_NO_ACCESS)
+                err = vmci_datagram_create_handle(resource_id, flags,
+                                                  recv_cb, client_data,
+                                                  out_handle);
+
+        return err;
+}
+
+/* This is invoked as part of a tasklet that's scheduled when the VMCI
+ * interrupt fires.  This is run in bottom-half context and if it ever needs to
+ * sleep it should defer that work to a work queue.
+ */
+
+static int vmci_transport_recv_dgram_cb(void *data, struct vmci_datagram *dg)
+{
+        struct sock *sk;
+        size_t size;
+        struct sk_buff *skb;
+        struct vsock_sock *vsk;
+
+        sk = (struct sock *)data;
+
+        /* This handler is privileged when this module is running on the host.
+         * We will get datagrams from all endpoints (even VMs that are in a
+         * restricted context). If we get one from a restricted context then
+         * the destination socket must be trusted.
+         *
+         * NOTE: We access the socket struct without holding the lock here.
+         * This is ok because the field we are interested is never modified
+         * outside of the create and destruct socket functions.
+         */
+        vsk = vsock_sk(sk);
+        if (!vmci_transport_allow_dgram(vsk, dg->src.context))
+                return VMCI_ERROR_NO_ACCESS;
+
+        size = VMCI_DG_SIZE(dg);
+
+        /* Attach the packet to the socket's receive queue as an sk_buff. */
+        skb = alloc_skb(size, GFP_ATOMIC);
+        if (skb) {
+                /* sk_receive_skb() will do a sock_put(), so hold here. */
+                sock_hold(sk);
+                skb_put(skb, size);
+                memcpy(skb->data, dg, size);
+                sk_receive_skb(sk, skb, 0);
+        }
+
+        return VMCI_SUCCESS;
+}
+
+static bool vmci_transport_stream_allow(u32 cid, u32 port)
+{
+        static const u32 non_socket_contexts[] = {
+                VMADDR_CID_HYPERVISOR,
+                VMADDR_CID_RESERVED,
+        };
+        int i;
+
+        BUILD_BUG_ON(sizeof(cid) != sizeof(*non_socket_contexts));
+
+        for (i = 0; i < ARRAY_SIZE(non_socket_contexts); i++) {
+                if (cid == non_socket_contexts[i])
+                        return false;
+        }
+
+        return true;
+}
+
+/* This is invoked as part of a tasklet that's scheduled when the VMCI
+ * interrupt fires.  This is run in bottom-half context but it defers most of
+ * its work to the packet handling work queue.
+ */
+
+static int vmci_transport_recv_stream_cb(void *data, struct vmci_datagram *dg)
+{
+        struct sock *sk;
+        struct sockaddr_vm dst;
+        struct sockaddr_vm src;
+        struct vmci_transport_packet *pkt;
+        struct vsock_sock *vsk;
+        bool bh_process_pkt;
+        int err;
+
+        sk = NULL;
+        err = VMCI_SUCCESS;
+        bh_process_pkt = false;
+
+        /* Ignore incoming packets from contexts without sockets, or resources
+         * that aren't vsock implementations.
+         */
+
+        if (!vmci_transport_stream_allow(dg->src.context, -1)
+            || VMCI_TRANSPORT_PACKET_RID != dg->src.resource)
+                return VMCI_ERROR_NO_ACCESS;
+
+        if (VMCI_DG_SIZE(dg) < sizeof(*pkt))
+                /* Drop datagrams that do not contain full VSock packets. */
+                return VMCI_ERROR_INVALID_ARGS;
+
+        pkt = (struct vmci_transport_packet *)dg;
+
+        /* Find the socket that should handle this packet.  First we look for a
+         * connected socket and if there is none we look for a socket bound to
+         * the destintation address.
+         */
+        vsock_addr_init(&src, pkt->dg.src.context, pkt->src_port);
+        vsock_addr_init(&dst, pkt->dg.dst.context, pkt->dst_port);
+
+        sk = vsock_find_connected_socket(&src, &dst);
+        if (!sk) {
+                sk = vsock_find_bound_socket(&dst);
+                if (!sk) {
+                        /* We could not find a socket for this specified
+                         * address.  If this packet is a RST, we just drop it.
+                         * If it is another packet, we send a RST.  Note that
+                         * we do not send a RST reply to RSTs so that we do not
+                         * continually send RSTs between two endpoints.
+                         *
+                         * Note that since this is a reply, dst is src and src
+                         * is dst.
+                         */
+                        if (vmci_transport_send_reset_bh(&dst, &src, pkt) < 0)
+                                pr_err("unable to send reset\n");
+
+                        err = VMCI_ERROR_NOT_FOUND;
+                        goto out;
+                }
+        }
+
+        /* If the received packet type is beyond all types known to this
+         * implementation, reply with an invalid message.  Hopefully this will
+         * help when implementing backwards compatibility in the future.
+         */
+        if (pkt->type >= VMCI_TRANSPORT_PACKET_TYPE_MAX) {
+                vmci_transport_send_invalid_bh(&dst, &src);
+                err = VMCI_ERROR_INVALID_ARGS;
+                goto out;
+        }
+
+        /* This handler is privileged when this module is running on the host.
+         * We will get datagram connect requests from all endpoints (even VMs
+         * that are in a restricted context). If we get one from a restricted
+         * context then the destination socket must be trusted.
+         *
+         * NOTE: We access the socket struct without holding the lock here.
+         * This is ok because the field we are interested is never modified
+         * outside of the create and destruct socket functions.
+         */
+        vsk = vsock_sk(sk);
+        if (!vmci_transport_allow_dgram(vsk, pkt->dg.src.context)) {
+                err = VMCI_ERROR_NO_ACCESS;
+                goto out;
+        }
+
+        /* We do most everything in a work queue, but let's fast path the
+         * notification of reads and writes to help data transfer performance.
+         * We can only do this if there is no process context code executing
+         * for this socket since that may change the state.
+         */
+        bh_lock_sock(sk);
+
+        if (!sock_owned_by_user(sk) && sk->sk_state == SS_CONNECTED)
+                vmci_trans(vsk)->notify_ops->handle_notify_pkt(
+                                sk, pkt, true, &dst, &src,
+                                &bh_process_pkt);
+
+        bh_unlock_sock(sk);
+
+        if (!bh_process_pkt) {
+                struct vmci_transport_recv_pkt_info *recv_pkt_info;
+
+                recv_pkt_info = kmalloc(sizeof(*recv_pkt_info), GFP_ATOMIC);
+                if (!recv_pkt_info) {
+                        if (vmci_transport_send_reset_bh(&dst, &src, pkt) < 0)
+                                pr_err("unable to send reset\n");
+
+                        err = VMCI_ERROR_NO_MEM;
+                        goto out;
+                }
+
+                recv_pkt_info->sk = sk;
+                memcpy(&recv_pkt_info->pkt, pkt, sizeof(recv_pkt_info->pkt));
+                INIT_WORK(&recv_pkt_info->work, vmci_transport_recv_pkt_work);
+
+                schedule_work(&recv_pkt_info->work);
+                /* Clear sk so that the reference count incremented by one of
+                 * the Find functions above is not decremented below.  We need
+                 * that reference count for the packet handler we've scheduled
+                 * to run.
+                 */
+                sk = NULL;
+        }
+
+out:
+        if (sk)
+                sock_put(sk);
+
+        return err;
+}
+
+static void vmci_transport_peer_attach_cb(u32 sub_id,
+                                          const struct vmci_event_data *e_data,
+                                          void *client_data)
+{
+        struct sock *sk = client_data;
+        const struct vmci_event_payload_qp *e_payload;
+        struct vsock_sock *vsk;
+
+        e_payload = vmci_event_data_const_payload(e_data);
+
+        vsk = vsock_sk(sk);
+
+        /* We don't ask for delayed CBs when we subscribe to this event (we
+         * pass 0 as flags to vmci_event_subscribe()).  VMCI makes no
+         * guarantees in that case about what context we might be running in,
+         * so it could be BH or process, blockable or non-blockable.  So we
+         * need to account for all possible contexts here.
+         */
+        local_bh_disable();
+        bh_lock_sock(sk);
+
+        /* XXX This is lame, we should provide a way to lookup sockets by
+         * qp_handle.
+         */
+        if (vmci_handle_is_equal(vmci_trans(vsk)->qp_handle,
+                                 e_payload->handle)) {
+                /* XXX This doesn't do anything, but in the future we may want
+                 * to set a flag here to verify the attach really did occur and
+                 * we weren't just sent a datagram claiming it was.
+                 */
+                goto out;
+        }
+
+out:
+        bh_unlock_sock(sk);
+        local_bh_enable();
+}
+
+static void vmci_transport_handle_detach(struct sock *sk)
+{
+        struct vsock_sock *vsk;
+
+        vsk = vsock_sk(sk);
+        if (!vmci_handle_is_invalid(vmci_trans(vsk)->qp_handle)) {
+                sock_set_flag(sk, SOCK_DONE);
+
+                /* On a detach the peer will not be sending or receiving
+                 * anymore.
+                 */
+                vsk->peer_shutdown = SHUTDOWN_MASK;
+
+                /* We should not be sending anymore since the peer won't be
+                 * there to receive, but we can still receive if there is data
+                 * left in our consume queue.
+                 */
+                if (vsock_stream_has_data(vsk) <= 0) {
+                        if (sk->sk_state == SS_CONNECTING) {
+                                /* The peer may detach from a queue pair while
+                                 * we are still in the connecting state, i.e.,
+                                 * if the peer VM is killed after attaching to
+                                 * a queue pair, but before we complete the
+                                 * handshake. In that case, we treat the detach
+                                 * event like a reset.
+                                 */
+
+                                sk->sk_state = SS_UNCONNECTED;
+                                sk->sk_err = ECONNRESET;
+                                sk->sk_error_report(sk);
+                                return;
+                        }
+                        sk->sk_state = SS_UNCONNECTED;
+                }
+                sk->sk_state_change(sk);
+        }
+}
+
+static void vmci_transport_peer_detach_cb(u32 sub_id,
+                                          const struct vmci_event_data *e_data,
+                                          void *client_data)
+{
+        struct sock *sk = client_data;
+        const struct vmci_event_payload_qp *e_payload;
+        struct vsock_sock *vsk;
+
+        e_payload = vmci_event_data_const_payload(e_data);
+        vsk = vsock_sk(sk);
+        if (vmci_handle_is_invalid(e_payload->handle))
+                return;
+
+        /* Same rules for locking as for peer_attach_cb(). */
+        local_bh_disable();
+        bh_lock_sock(sk);
+
+        /* XXX This is lame, we should provide a way to lookup sockets by
+         * qp_handle.
+         */
+        if (vmci_handle_is_equal(vmci_trans(vsk)->qp_handle,
+                                 e_payload->handle))
+                vmci_transport_handle_detach(sk);
+
+        bh_unlock_sock(sk);
+        local_bh_enable();
+}
+
+static void vmci_transport_qp_resumed_cb(u32 sub_id,
+                                         const struct vmci_event_data *e_data,
+                                         void *client_data)
+{
+        vsock_for_each_connected_socket(vmci_transport_handle_detach);
+}
+
+static void vmci_transport_recv_pkt_work(struct work_struct *work)
+{
+        struct vmci_transport_recv_pkt_info *recv_pkt_info;
+        struct vmci_transport_packet *pkt;
+        struct sock *sk;
+
+        recv_pkt_info =
+                container_of(work, struct vmci_transport_recv_pkt_info, work);
+        sk = recv_pkt_info->sk;
+        pkt = &recv_pkt_info->pkt;
+
+        lock_sock(sk);
+
+        switch (sk->sk_state) {
+        case SS_LISTEN:
+                vmci_transport_recv_listen(sk, pkt);
+                break;
+        case SS_CONNECTING:
+                /* Processing of pending connections for servers goes through
+                 * the listening socket, so see vmci_transport_recv_listen()
+                 * for that path.
+                 */
+                vmci_transport_recv_connecting_client(sk, pkt);
+                break;
+        case SS_CONNECTED:
+                vmci_transport_recv_connected(sk, pkt);
+                break;
+        default:
+                /* Because this function does not run in the same context as
+                 * vmci_transport_recv_stream_cb it is possible that the
+                 * socket has closed. We need to let the other side know or it
+                 * could be sitting in a connect and hang forever. Send a
+                 * reset to prevent that.
+                 */
+                vmci_transport_send_reset(sk, pkt);
+                goto out;
+        }
+
+out:
+        release_sock(sk);
+        kfree(recv_pkt_info);
+        /* Release reference obtained in the stream callback when we fetched
+         * this socket out of the bound or connected list.
+         */
+        sock_put(sk);
+}
+
+static int vmci_transport_recv_listen(struct sock *sk,
+                                      struct vmci_transport_packet *pkt)
+{
+        struct sock *pending;
+        struct vsock_sock *vpending;
+        int err;
+        u64 qp_size;
+        bool old_request = false;
+        bool old_pkt_proto = false;
+
+        err = 0;
+
+        /* Because we are in the listen state, we could be receiving a packet
+         * for ourself or any previous connection requests that we received.
+         * If it's the latter, we try to find a socket in our list of pending
+         * connections and, if we do, call the appropriate handler for the
+         * state that that socket is in.  Otherwise we try to service the
+         * connection request.
+         */
+        pending = vmci_transport_get_pending(sk, pkt);
+        if (pending) {
+                lock_sock(pending);
+                switch (pending->sk_state) {
+                case SS_CONNECTING:
+                        err = vmci_transport_recv_connecting_server(sk,
+                                                                    pending,
+                                                                    pkt);
+                        break;
+                default:
+                        vmci_transport_send_reset(pending, pkt);
+                        err = -EINVAL;
+                }
+
+                if (err < 0)
+                        vsock_remove_pending(sk, pending);
+
+                release_sock(pending);
+                vmci_transport_release_pending(pending);
+
+                return err;
+        }
+
+        /* The listen state only accepts connection requests.  Reply with a
+         * reset unless we received a reset.
+         */
+
+        if (!(pkt->type == VMCI_TRANSPORT_PACKET_TYPE_REQUEST ||
+              pkt->type == VMCI_TRANSPORT_PACKET_TYPE_REQUEST2)) {
+                vmci_transport_reply_reset(pkt);
+                return -EINVAL;
+        }
+
+        if (pkt->u.size == 0) {
+                vmci_transport_reply_reset(pkt);
+                return -EINVAL;
+        }
+
+        /* If this socket can't accommodate this connection request, we send a
+         * reset.  Otherwise we create and initialize a child socket and reply
+         * with a connection negotiation.
+         */
+        if (sk->sk_ack_backlog >= sk->sk_max_ack_backlog) {
+                vmci_transport_reply_reset(pkt);
+                return -ECONNREFUSED;
+        }
+
+        pending = __vsock_create(sock_net(sk), NULL, sk, GFP_KERNEL,
+                                 sk->sk_type);
+        if (!pending) {
+                vmci_transport_send_reset(sk, pkt);
+                return -ENOMEM;
+        }
+
+        vpending = vsock_sk(pending);
+
+        vsock_addr_init(&vpending->local_addr, pkt->dg.dst.context,
+                        pkt->dst_port);
+        vsock_addr_init(&vpending->remote_addr, pkt->dg.src.context,
+                        pkt->src_port);
+
+        /* If the proposed size fits within our min/max, accept it. Otherwise
+         * propose our own size.
+         */
+        if (pkt->u.size >= vmci_trans(vpending)->queue_pair_min_size &&
+            pkt->u.size <= vmci_trans(vpending)->queue_pair_max_size) {
+                qp_size = pkt->u.size;
+        } else {
+                qp_size = vmci_trans(vpending)->queue_pair_size;
+        }
+
+        /* Figure out if we are using old or new requests based on the
+         * overrides pkt types sent by our peer.
+         */
+        if (vmci_transport_old_proto_override(&old_pkt_proto)) {
+                old_request = old_pkt_proto;
+        } else {
+                if (pkt->type == VMCI_TRANSPORT_PACKET_TYPE_REQUEST)
+                        old_request = true;
+                else if (pkt->type == VMCI_TRANSPORT_PACKET_TYPE_REQUEST2)
+                        old_request = false;
+
+        }
+
+        if (old_request) {
+                /* Handle a REQUEST (or override) */
+                u16 version = VSOCK_PROTO_INVALID;
+                if (vmci_transport_proto_to_notify_struct(
+                        pending, &version, true))
+                        err = vmci_transport_send_negotiate(pending, qp_size);
+                else
+                        err = -EINVAL;
+
+        } else {
+                /* Handle a REQUEST2 (or override) */
+                int proto_int = pkt->proto;
+                int pos;
+                u16 active_proto_version = 0;
+
+                /* The list of possible protocols is the intersection of all
+                 * protocols the client supports ... plus all the protocols we
+                 * support.
+                 */
+                proto_int &= vmci_transport_new_proto_supported_versions();
+
+                /* We choose the highest possible protocol version and use that
+                 * one.
+                 */
+                pos = fls(proto_int);
+                if (pos) {
+                        active_proto_version = (1 << (pos - 1));
+                        if (vmci_transport_proto_to_notify_struct(
+                                pending, &active_proto_version, false))
+                                err = vmci_transport_send_negotiate2(pending,
+                                                        qp_size,
+                                                        active_proto_version);
+                        else
+                                err = -EINVAL;
+
+                } else {
+                        err = -EINVAL;
+                }
+        }
+
+        if (err < 0) {
+                vmci_transport_send_reset(sk, pkt);
+                sock_put(pending);
+                err = vmci_transport_error_to_vsock_error(err);
+                goto out;
+        }
+
+        vsock_add_pending(sk, pending);
+        sk->sk_ack_backlog++;
+
+        pending->sk_state = SS_CONNECTING;
+        vmci_trans(vpending)->produce_size =
+                vmci_trans(vpending)->consume_size = qp_size;
+        vmci_trans(vpending)->queue_pair_size = qp_size;
+
+        vmci_trans(vpending)->notify_ops->process_request(pending);
+
+        /* We might never receive another message for this socket and it's not
+         * connected to any process, so we have to ensure it gets cleaned up
+         * ourself.  Our delayed work function will take care of that.  Note
+         * that we do not ever cancel this function since we have few
+         * guarantees about its state when calling cancel_delayed_work().
+         * Instead we hold a reference on the socket for that function and make
+         * it capable of handling cases where it needs to do nothing but
+         * release that reference.
+         */
+        vpending->listener = sk;
+        sock_hold(sk);
+        sock_hold(pending);
+        INIT_DELAYED_WORK(&vpending->dwork, vsock_pending_work);
+        schedule_delayed_work(&vpending->dwork, HZ);
+
+out:
+        return err;
+}
+
+static int
+vmci_transport_recv_connecting_server(struct sock *listener,
+                                      struct sock *pending,
+                                      struct vmci_transport_packet *pkt)
+{
+        struct vsock_sock *vpending;
+        struct vmci_handle handle;
+        struct vmci_qp *qpair;
+        bool is_local;
+        u32 flags;
+        u32 detach_sub_id;
+        int err;
+        int skerr;
+
+        vpending = vsock_sk(pending);
+        detach_sub_id = VMCI_INVALID_ID;
+
+        switch (pkt->type) {
+        case VMCI_TRANSPORT_PACKET_TYPE_OFFER:
+                if (vmci_handle_is_invalid(pkt->u.handle)) {
+                        vmci_transport_send_reset(pending, pkt);
+                        skerr = EPROTO;
+                        err = -EINVAL;
+                        goto destroy;
+                }
+                break;
+        default:
+                /* Close and cleanup the connection. */
+                vmci_transport_send_reset(pending, pkt);
+                skerr = EPROTO;
+                err = pkt->type == VMCI_TRANSPORT_PACKET_TYPE_RST ? 0 : -EINVAL;
+                goto destroy;
+        }
+
+        /* In order to complete the connection we need to attach to the offered
+         * queue pair and send an attach notification.  We also subscribe to the
+         * detach event so we know when our peer goes away, and we do that
+         * before attaching so we don't miss an event.  If all this succeeds,
+         * we update our state and wakeup anything waiting in accept() for a
+         * connection.
+         */
+
+        /* We don't care about attach since we ensure the other side has
+         * attached by specifying the ATTACH_ONLY flag below.
+         */
+        err = vmci_event_subscribe(VMCI_EVENT_QP_PEER_DETACH,
+                                   vmci_transport_peer_detach_cb,
+                                   pending, &detach_sub_id);
+        if (err < VMCI_SUCCESS) {
+                vmci_transport_send_reset(pending, pkt);
+                err = vmci_transport_error_to_vsock_error(err);
+                skerr = -err;
+                goto destroy;
+        }
+
+        vmci_trans(vpending)->detach_sub_id = detach_sub_id;
+
+        /* Now attach to the queue pair the client created. */
+        handle = pkt->u.handle;
+
+        /* vpending->local_addr always has a context id so we do not need to
+         * worry about VMADDR_CID_ANY in this case.
+         */
+        is_local =
+            vpending->remote_addr.svm_cid == vpending->local_addr.svm_cid;
+        flags = VMCI_QPFLAG_ATTACH_ONLY;
+        flags |= is_local ? VMCI_QPFLAG_LOCAL : 0;
+
+        err = vmci_transport_queue_pair_alloc(
+                                        &qpair,
+                                        &handle,
+                                        vmci_trans(vpending)->produce_size,
+                                        vmci_trans(vpending)->consume_size,
+                                        pkt->dg.src.context,
+                                        flags,
+                                        vmci_transport_is_trusted(
+                                                vpending,
+                                                vpending->remote_addr.svm_cid));
+        if (err < 0) {
+                vmci_transport_send_reset(pending, pkt);
+                skerr = -err;
+                goto destroy;
+        }
+
+        vmci_trans(vpending)->qp_handle = handle;
+        vmci_trans(vpending)->qpair = qpair;
+
+        /* When we send the attach message, we must be ready to handle incoming
+         * control messages on the newly connected socket. So we move the
+         * pending socket to the connected state before sending the attach
+         * message. Otherwise, an incoming packet triggered by the attach being
+         * received by the peer may be processed concurrently with what happens
+         * below after sending the attach message, and that incoming packet
+         * will find the listening socket instead of the (currently) pending
+         * socket. Note that enqueueing the socket increments the reference
+         * count, so even if a reset comes before the connection is accepted,
+         * the socket will be valid until it is removed from the queue.
+         *
+         * If we fail sending the attach below, we remove the socket from the
+         * connected list and move the socket to SS_UNCONNECTED before
+         * releasing the lock, so a pending slow path processing of an incoming
+         * packet will not see the socket in the connected state in that case.
+         */
+        pending->sk_state = SS_CONNECTED;
+
+        vsock_insert_connected(vpending);
+
+        /* Notify our peer of our attach. */
+        err = vmci_transport_send_attach(pending, handle);
+        if (err < 0) {
+                vsock_remove_connected(vpending);
+                pr_err("Could not send attach\n");
+                vmci_transport_send_reset(pending, pkt);
+                err = vmci_transport_error_to_vsock_error(err);
+                skerr = -err;
+                goto destroy;
+        }
+
+        /* We have a connection. Move the now connected socket from the
+         * listener's pending list to the accept queue so callers of accept()
+         * can find it.
+         */
+        vsock_remove_pending(listener, pending);
+        vsock_enqueue_accept(listener, pending);
+
+        /* Callers of accept() will be be waiting on the listening socket, not
+         * the pending socket.
+         */
+        listener->sk_state_change(listener);
+
+        return 0;
+
+destroy:
+        pending->sk_err = skerr;
+        pending->sk_state = SS_UNCONNECTED;
+        /* As long as we drop our reference, all necessary cleanup will handle
+         * when the cleanup function drops its reference and our destruct
+         * implementation is called.  Note that since the listen handler will
+         * remove pending from the pending list upon our failure, the cleanup
+         * function won't drop the additional reference, which is why we do it
+         * here.
+         */
+        sock_put(pending);
+
+        return err;
+}
+
+static int
+vmci_transport_recv_connecting_client(struct sock *sk,
+                                      struct vmci_transport_packet *pkt)
+{
+        struct vsock_sock *vsk;
+        int err;
+        int skerr;
+
+        vsk = vsock_sk(sk);
+
+        switch (pkt->type) {
+        case VMCI_TRANSPORT_PACKET_TYPE_ATTACH:
+                if (vmci_handle_is_invalid(pkt->u.handle) ||
+                    !vmci_handle_is_equal(pkt->u.handle,
+                                          vmci_trans(vsk)->qp_handle)) {
+                        skerr = EPROTO;
+                        err = -EINVAL;
+                        goto destroy;
+                }
+
+                /* Signify the socket is connected and wakeup the waiter in
+                 * connect(). Also place the socket in the connected table for
+                 * accounting (it can already be found since it's in the bound
+                 * table).
+                 */
+                sk->sk_state = SS_CONNECTED;
+                sk->sk_socket->state = SS_CONNECTED;
+                vsock_insert_connected(vsk);
+                sk->sk_state_change(sk);
+
+                break;
+        case VMCI_TRANSPORT_PACKET_TYPE_NEGOTIATE:
+        case VMCI_TRANSPORT_PACKET_TYPE_NEGOTIATE2:
+                if (pkt->u.size == 0
+                    || pkt->dg.src.context != vsk->remote_addr.svm_cid
+                    || pkt->src_port != vsk->remote_addr.svm_port
+                    || !vmci_handle_is_invalid(vmci_trans(vsk)->qp_handle)
+                    || vmci_trans(vsk)->qpair
+                    || vmci_trans(vsk)->produce_size != 0
+                    || vmci_trans(vsk)->consume_size != 0
+                    || vmci_trans(vsk)->attach_sub_id != VMCI_INVALID_ID
+                    || vmci_trans(vsk)->detach_sub_id != VMCI_INVALID_ID) {
+                        skerr = EPROTO;
+                        err = -EINVAL;
+
+                        goto destroy;
+                }
+
+                err = vmci_transport_recv_connecting_client_negotiate(sk, pkt);
+                if (err) {
+                        skerr = -err;
+                        goto destroy;
+                }
+
+                break;
+        case VMCI_TRANSPORT_PACKET_TYPE_INVALID:
+                err = vmci_transport_recv_connecting_client_invalid(sk, pkt);
+                if (err) {
+                        skerr = -err;
+                        goto destroy;
+                }
+
+                break;
+        case VMCI_TRANSPORT_PACKET_TYPE_RST:
+                /* Older versions of the linux code (WS 6.5 / ESX 4.0) used to
+                 * continue processing here after they sent an INVALID packet.
+                 * This meant that we got a RST after the INVALID. We ignore a
+                 * RST after an INVALID. The common code doesn't send the RST
+                 * ... so we can hang if an old version of the common code
+                 * fails between getting a REQUEST and sending an OFFER back.
+                 * Not much we can do about it... except hope that it doesn't
+                 * happen.
+                 */
+                if (vsk->ignore_connecting_rst) {
+                        vsk->ignore_connecting_rst = false;
+                } else {
+                        skerr = ECONNRESET;
+                        err = 0;
+                        goto destroy;
+                }
+
+                break;
+        default:
+                /* Close and cleanup the connection. */
+                skerr = EPROTO;
+                err = -EINVAL;
+                goto destroy;
+        }
+
+        return 0;
+
+destroy:
+        vmci_transport_send_reset(sk, pkt);
+
+        sk->sk_state = SS_UNCONNECTED;
+        sk->sk_err = skerr;
+        sk->sk_error_report(sk);
+        return err;
+}
+
+static int vmci_transport_recv_connecting_client_negotiate(
+                                        struct sock *sk,
+                                        struct vmci_transport_packet *pkt)
+{
+        int err;
+        struct vsock_sock *vsk;
+        struct vmci_handle handle;
+        struct vmci_qp *qpair;
+        u32 attach_sub_id;
+        u32 detach_sub_id;
+        bool is_local;
+        u32 flags;
+        bool old_proto = true;
+        bool old_pkt_proto;
+        u16 version;
+
+        vsk = vsock_sk(sk);
+        handle = VMCI_INVALID_HANDLE;
+        attach_sub_id = VMCI_INVALID_ID;
+        detach_sub_id = VMCI_INVALID_ID;
+
+        /* If we have gotten here then we should be past the point where old
+         * linux vsock could have sent the bogus rst.
+         */
+        vsk->sent_request = false;
+        vsk->ignore_connecting_rst = false;
+
+        /* Verify that we're OK with the proposed queue pair size */
+        if (pkt->u.size < vmci_trans(vsk)->queue_pair_min_size ||
+            pkt->u.size > vmci_trans(vsk)->queue_pair_max_size) {
+                err = -EINVAL;
+                goto destroy;
+        }
+
+        /* At this point we know the CID the peer is using to talk to us. */
+
+        if (vsk->local_addr.svm_cid == VMADDR_CID_ANY)
+                vsk->local_addr.svm_cid = pkt->dg.dst.context;
+
+        /* Setup the notify ops to be the highest supported version that both
+         * the server and the client support.
+         */
+
+        if (vmci_transport_old_proto_override(&old_pkt_proto)) {
+                old_proto = old_pkt_proto;
+        } else {
+                if (pkt->type == VMCI_TRANSPORT_PACKET_TYPE_NEGOTIATE)
+                        old_proto = true;
+                else if (pkt->type == VMCI_TRANSPORT_PACKET_TYPE_NEGOTIATE2)
+                        old_proto = false;
+
+        }
+
+        if (old_proto)
+                version = VSOCK_PROTO_INVALID;
+        else
+                version = pkt->proto;
+
+        if (!vmci_transport_proto_to_notify_struct(sk, &version, old_proto)) {
+                err = -EINVAL;
+                goto destroy;
+        }
+
+        /* Subscribe to attach and detach events first.
+         *
+         * XXX We attach once for each queue pair created for now so it is easy
+         * to find the socket (it's provided), but later we should only
+         * subscribe once and add a way to lookup sockets by queue pair handle.
+         */
+        err = vmci_event_subscribe(VMCI_EVENT_QP_PEER_ATTACH,
+                                   vmci_transport_peer_attach_cb,
+                                   sk, &attach_sub_id);
+        if (err < VMCI_SUCCESS) {
+                err = vmci_transport_error_to_vsock_error(err);
+                goto destroy;
+        }
+
+        err = vmci_event_subscribe(VMCI_EVENT_QP_PEER_DETACH,
+                                   vmci_transport_peer_detach_cb,
+                                   sk, &detach_sub_id);
+        if (err < VMCI_SUCCESS) {
+                err = vmci_transport_error_to_vsock_error(err);
+                goto destroy;
+        }
+
+        /* Make VMCI select the handle for us. */
+        handle = VMCI_INVALID_HANDLE;
+        is_local = vsk->remote_addr.svm_cid == vsk->local_addr.svm_cid;
+        flags = is_local ? VMCI_QPFLAG_LOCAL : 0;
+
+        err = vmci_transport_queue_pair_alloc(&qpair,
+                                              &handle,
+                                              pkt->u.size,
+                                              pkt->u.size,
+                                              vsk->remote_addr.svm_cid,
+                                              flags,
+                                              vmci_transport_is_trusted(
+                                                  vsk,
+                                                  vsk->
+                                                  remote_addr.svm_cid));
+        if (err < 0)
+                goto destroy;
+
+        err = vmci_transport_send_qp_offer(sk, handle);
+        if (err < 0) {
+                err = vmci_transport_error_to_vsock_error(err);
+                goto destroy;
+        }
+
+        vmci_trans(vsk)->qp_handle = handle;
+        vmci_trans(vsk)->qpair = qpair;
+
+        vmci_trans(vsk)->produce_size = vmci_trans(vsk)->consume_size =
+                pkt->u.size;
+
+        vmci_trans(vsk)->attach_sub_id = attach_sub_id;
+        vmci_trans(vsk)->detach_sub_id = detach_sub_id;
+
+        vmci_trans(vsk)->notify_ops->process_negotiate(sk);
+
+        return 0;
+
+destroy:
+        if (attach_sub_id != VMCI_INVALID_ID)
+                vmci_event_unsubscribe(attach_sub_id);
+
+        if (detach_sub_id != VMCI_INVALID_ID)
+                vmci_event_unsubscribe(detach_sub_id);
+
+        if (!vmci_handle_is_invalid(handle))
+                vmci_qpair_detach(&qpair);
+
+        return err;
+}
+
+static int
+vmci_transport_recv_connecting_client_invalid(struct sock *sk,
+                                              struct vmci_transport_packet *pkt)
+{
+        int err = 0;
+        struct vsock_sock *vsk = vsock_sk(sk);
+
+        if (vsk->sent_request) {
+                vsk->sent_request = false;
+                vsk->ignore_connecting_rst = true;
+
+                err = vmci_transport_send_conn_request(
+                        sk, vmci_trans(vsk)->queue_pair_size);
+                if (err < 0)
+                        err = vmci_transport_error_to_vsock_error(err);
+                else
+                        err = 0;
+
+        }
+
+        return err;
+}
+
+static int vmci_transport_recv_connected(struct sock *sk,
+                                         struct vmci_transport_packet *pkt)
+{
+        struct vsock_sock *vsk;
+        bool pkt_processed = false;
+
+        /* In cases where we are closing the connection, it's sufficient to
+         * mark the state change (and maybe error) and wake up any waiting
+         * threads. Since this is a connected socket, it's owned by a user
+         * process and will be cleaned up when the failure is passed back on
+         * the current or next system call.  Our system call implementations
+         * must therefore check for error and state changes on entry and when
+         * being awoken.
+         */
+        switch (pkt->type) {
+        case VMCI_TRANSPORT_PACKET_TYPE_SHUTDOWN:
+                if (pkt->u.mode) {
+                        vsk = vsock_sk(sk);
+
+                        vsk->peer_shutdown |= pkt->u.mode;
+                        sk->sk_state_change(sk);
+                }
+                break;
+
+        case VMCI_TRANSPORT_PACKET_TYPE_RST:
+                vsk = vsock_sk(sk);
+                /* It is possible that we sent our peer a message (e.g a
+                 * WAITING_READ) right before we got notified that the peer had
+                 * detached. If that happens then we can get a RST pkt back
+                 * from our peer even though there is data available for us to
+                 * read. In that case, don't shutdown the socket completely but
+                 * instead allow the local client to finish reading data off
+                 * the queuepair. Always treat a RST pkt in connected mode like
+                 * a clean shutdown.
+                 */
+                sock_set_flag(sk, SOCK_DONE);
+                vsk->peer_shutdown = SHUTDOWN_MASK;
+                if (vsock_stream_has_data(vsk) <= 0)
+                        sk->sk_state = SS_DISCONNECTING;
+
+                sk->sk_state_change(sk);
+                break;
+
+        default:
+                vsk = vsock_sk(sk);
+                vmci_trans(vsk)->notify_ops->handle_notify_pkt(
+                                sk, pkt, false, NULL, NULL,
+                                &pkt_processed);
+                if (!pkt_processed)
+                        return -EINVAL;
+
+                break;
+        }
+
+        return 0;
+}
+
+static int vmci_transport_socket_init(struct vsock_sock *vsk,
+                                      struct vsock_sock *psk)
+{
+        vsk->trans = kmalloc(sizeof(struct vmci_transport), GFP_KERNEL);
+        if (!vsk->trans)
+                return -ENOMEM;
+
+        vmci_trans(vsk)->dg_handle = VMCI_INVALID_HANDLE;
+        vmci_trans(vsk)->qp_handle = VMCI_INVALID_HANDLE;
+        vmci_trans(vsk)->qpair = NULL;
+        vmci_trans(vsk)->produce_size = vmci_trans(vsk)->consume_size = 0;
+        vmci_trans(vsk)->attach_sub_id = vmci_trans(vsk)->detach_sub_id =
+                VMCI_INVALID_ID;
+        vmci_trans(vsk)->notify_ops = NULL;
+        if (psk) {
+                vmci_trans(vsk)->queue_pair_size =
+                        vmci_trans(psk)->queue_pair_size;
+                vmci_trans(vsk)->queue_pair_min_size =
+                        vmci_trans(psk)->queue_pair_min_size;
+                vmci_trans(vsk)->queue_pair_max_size =
+                        vmci_trans(psk)->queue_pair_max_size;
+        } else {
+                vmci_trans(vsk)->queue_pair_size =
+                        VMCI_TRANSPORT_DEFAULT_QP_SIZE;
+                vmci_trans(vsk)->queue_pair_min_size =
+                         VMCI_TRANSPORT_DEFAULT_QP_SIZE_MIN;
+                vmci_trans(vsk)->queue_pair_max_size =
+                        VMCI_TRANSPORT_DEFAULT_QP_SIZE_MAX;
+        }
+
+        return 0;
+}
+
+static void vmci_transport_destruct(struct vsock_sock *vsk)
+{
+        if (vmci_trans(vsk)->attach_sub_id != VMCI_INVALID_ID) {
+                vmci_event_unsubscribe(vmci_trans(vsk)->attach_sub_id);
+                vmci_trans(vsk)->attach_sub_id = VMCI_INVALID_ID;
+        }
+
+        if (vmci_trans(vsk)->detach_sub_id != VMCI_INVALID_ID) {
+                vmci_event_unsubscribe(vmci_trans(vsk)->detach_sub_id);
+                vmci_trans(vsk)->detach_sub_id = VMCI_INVALID_ID;
+        }
+
+        if (!vmci_handle_is_invalid(vmci_trans(vsk)->qp_handle)) {
+                vmci_qpair_detach(&vmci_trans(vsk)->qpair);
+                vmci_trans(vsk)->qp_handle = VMCI_INVALID_HANDLE;
+                vmci_trans(vsk)->produce_size = 0;
+                vmci_trans(vsk)->consume_size = 0;
+        }
+
+        if (vmci_trans(vsk)->notify_ops)
+                vmci_trans(vsk)->notify_ops->socket_destruct(vsk);
+
+        kfree(vsk->trans);
+        vsk->trans = NULL;
+}
+
+static void vmci_transport_release(struct vsock_sock *vsk)
+{
+        if (!vmci_handle_is_invalid(vmci_trans(vsk)->dg_handle)) {
+                vmci_datagram_destroy_handle(vmci_trans(vsk)->dg_handle);
+                vmci_trans(vsk)->dg_handle = VMCI_INVALID_HANDLE;
+        }
+}
+
+static int vmci_transport_dgram_bind(struct vsock_sock *vsk,
+                                     struct sockaddr_vm *addr)
+{
+        u32 port;
+        u32 flags;
+        int err;
+
+        /* VMCI will select a resource ID for us if we provide
+         * VMCI_INVALID_ID.
+         */
+        port = addr->svm_port == VMADDR_PORT_ANY ?
+                        VMCI_INVALID_ID : addr->svm_port;
+
+        if (port <= LAST_RESERVED_PORT && !capable(CAP_NET_BIND_SERVICE))
+                return -EACCES;
+
+        flags = addr->svm_cid == VMADDR_CID_ANY ?
+                                VMCI_FLAG_ANYCID_DG_HND : 0;
+
+        err = vmci_transport_datagram_create_hnd(port, flags,
+                                                 vmci_transport_recv_dgram_cb,
+                                                 &vsk->sk,
+                                                 &vmci_trans(vsk)->dg_handle);
+        if (err < VMCI_SUCCESS)
+                return vmci_transport_error_to_vsock_error(err);
+        vsock_addr_init(&vsk->local_addr, addr->svm_cid,
+                        vmci_trans(vsk)->dg_handle.resource);
+
+        return 0;
+}
+
+static int vmci_transport_dgram_enqueue(
+        struct vsock_sock *vsk,
+        struct sockaddr_vm *remote_addr,
+        struct iovec *iov,
+        size_t len)
+{
+        int err;
+        struct vmci_datagram *dg;
+
+        if (len > VMCI_MAX_DG_PAYLOAD_SIZE)
+                return -EMSGSIZE;
+
+        if (!vmci_transport_allow_dgram(vsk, remote_addr->svm_cid))
+                return -EPERM;
+
+        /* Allocate a buffer for the user's message and our packet header. */
+        dg = kmalloc(len + sizeof(*dg), GFP_KERNEL);
+        if (!dg)
+                return -ENOMEM;
+
+        memcpy_fromiovec(VMCI_DG_PAYLOAD(dg), iov, len);
+
+        dg->dst = vmci_make_handle(remote_addr->svm_cid,
+                                   remote_addr->svm_port);
+        dg->src = vmci_make_handle(vsk->local_addr.svm_cid,
+                                   vsk->local_addr.svm_port);
+        dg->payload_size = len;
+
+        err = vmci_datagram_send(dg);
+        kfree(dg);
+        if (err < 0)
+                return vmci_transport_error_to_vsock_error(err);
+
+        return err - sizeof(*dg);
+}
+
+static int vmci_transport_dgram_dequeue(struct kiocb *kiocb,
+                                        struct vsock_sock *vsk,
+                                        struct msghdr *msg, size_t len,
+                                        int flags)
+{
+        int err;
+        int noblock;
+        struct vmci_datagram *dg;
+        size_t payload_len;
+        struct sk_buff *skb;
+
+        noblock = flags & MSG_DONTWAIT;
+
+        if (flags & MSG_OOB || flags & MSG_ERRQUEUE)
+                return -EOPNOTSUPP;
+
+        /* Retrieve the head sk_buff from the socket's receive queue. */
+        err = 0;
+        skb = skb_recv_datagram(&vsk->sk, flags, noblock, &err);
+        if (err)
+                return err;
+
+        if (!skb)
+                return -EAGAIN;
+
+        dg = (struct vmci_datagram *)skb->data;
+        if (!dg)
+                /* err is 0, meaning we read zero bytes. */
+                goto out;
+
+        payload_len = dg->payload_size;
+        /* Ensure the sk_buff matches the payload size claimed in the packet. */
+        if (payload_len != skb->len - sizeof(*dg)) {
+                err = -EINVAL;
+                goto out;
+        }
+
+        if (payload_len > len) {
+                payload_len = len;
+                msg->msg_flags |= MSG_TRUNC;
+        }
+
+        /* Place the datagram payload in the user's iovec. */
+        err = skb_copy_datagram_iovec(skb, sizeof(*dg), msg->msg_iov,
+                payload_len);
+        if (err)
+                goto out;
+
+        msg->msg_namelen = 0;
+        if (msg->msg_name) {
+                struct sockaddr_vm *vm_addr;
+
+                /* Provide the address of the sender. */
+                vm_addr = (struct sockaddr_vm *)msg->msg_name;
+                vsock_addr_init(vm_addr, dg->src.context, dg->src.resource);
+                msg->msg_namelen = sizeof(*vm_addr);
+        }
+        err = payload_len;
+
+out:
+        skb_free_datagram(&vsk->sk, skb);
+        return err;
+}
+
+static bool vmci_transport_dgram_allow(u32 cid, u32 port)
+{
+        if (cid == VMADDR_CID_HYPERVISOR) {
+                /* Registrations of PBRPC Servers do not modify VMX/Hypervisor
+                 * state and are allowed.
+                 */
+                return port == VMCI_UNITY_PBRPC_REGISTER;
+        }
+
+        return true;
+}
+
+static int vmci_transport_connect(struct vsock_sock *vsk)
+{
+        int err;
+        bool old_pkt_proto = false;
+        struct sock *sk = &vsk->sk;
+
+        if (vmci_transport_old_proto_override(&old_pkt_proto) &&
+                old_pkt_proto) {
+                err = vmci_transport_send_conn_request(
+                        sk, vmci_trans(vsk)->queue_pair_size);
+                if (err < 0) {
+                        sk->sk_state = SS_UNCONNECTED;
+                        return err;
+                }
+        } else {
+                int supported_proto_versions =
+                        vmci_transport_new_proto_supported_versions();
+                err = vmci_transport_send_conn_request2(
+                                sk, vmci_trans(vsk)->queue_pair_size,
+                                supported_proto_versions);
+                if (err < 0) {
+                        sk->sk_state = SS_UNCONNECTED;
+                        return err;
+                }
+
+                vsk->sent_request = true;
+        }
+
+        return err;
+}
+
+static ssize_t vmci_transport_stream_dequeue(
+        struct vsock_sock *vsk,
+        struct iovec *iov,
+        size_t len,
+        int flags)
+{
+        if (flags & MSG_PEEK)
+                return vmci_qpair_peekv(vmci_trans(vsk)->qpair, iov, len, 0);
+        else
+                return vmci_qpair_dequev(vmci_trans(vsk)->qpair, iov, len, 0);
+}
+
+static ssize_t vmci_transport_stream_enqueue(
+        struct vsock_sock *vsk,
+        struct iovec *iov,
+        size_t len)
+{
+        return vmci_qpair_enquev(vmci_trans(vsk)->qpair, iov, len, 0);
+}
+
+static s64 vmci_transport_stream_has_data(struct vsock_sock *vsk)
+{
+        return vmci_qpair_consume_buf_ready(vmci_trans(vsk)->qpair);
+}
+
+static s64 vmci_transport_stream_has_space(struct vsock_sock *vsk)
+{
+        return vmci_qpair_produce_free_space(vmci_trans(vsk)->qpair);
+}
+
+static u64 vmci_transport_stream_rcvhiwat(struct vsock_sock *vsk)
+{
+        return vmci_trans(vsk)->consume_size;
+}
+
+static bool vmci_transport_stream_is_active(struct vsock_sock *vsk)
+{
+        return !vmci_handle_is_invalid(vmci_trans(vsk)->qp_handle);
+}
+
+static u64 vmci_transport_get_buffer_size(struct vsock_sock *vsk)
+{
+        return vmci_trans(vsk)->queue_pair_size;
+}
+
+static u64 vmci_transport_get_min_buffer_size(struct vsock_sock *vsk)
+{
+        return vmci_trans(vsk)->queue_pair_min_size;
+}
+
+static u64 vmci_transport_get_max_buffer_size(struct vsock_sock *vsk)
+{
+        return vmci_trans(vsk)->queue_pair_max_size;
+}
+
+static void vmci_transport_set_buffer_size(struct vsock_sock *vsk, u64 val)
+{
+        if (val < vmci_trans(vsk)->queue_pair_min_size)
+                vmci_trans(vsk)->queue_pair_min_size = val;
+        if (val > vmci_trans(vsk)->queue_pair_max_size)
+                vmci_trans(vsk)->queue_pair_max_size = val;
+        vmci_trans(vsk)->queue_pair_size = val;
+}
+
+static void vmci_transport_set_min_buffer_size(struct vsock_sock *vsk,
+                                               u64 val)
+{
+        if (val > vmci_trans(vsk)->queue_pair_size)
+                vmci_trans(vsk)->queue_pair_size = val;
+        vmci_trans(vsk)->queue_pair_min_size = val;
+}
+
+static void vmci_transport_set_max_buffer_size(struct vsock_sock *vsk,
+                                               u64 val)
+{
+        if (val < vmci_trans(vsk)->queue_pair_size)
+                vmci_trans(vsk)->queue_pair_size = val;
+        vmci_trans(vsk)->queue_pair_max_size = val;
+}
+
+static int vmci_transport_notify_poll_in(
+        struct vsock_sock *vsk,
+        size_t target,
+        bool *data_ready_now)
+{
+        return vmci_trans(vsk)->notify_ops->poll_in(
+                        &vsk->sk, target, data_ready_now);
+}
+
+static int vmci_transport_notify_poll_out(
+        struct vsock_sock *vsk,
+        size_t target,
+        bool *space_available_now)
+{
+        return vmci_trans(vsk)->notify_ops->poll_out(
+                        &vsk->sk, target, space_available_now);
+}
+
+static int vmci_transport_notify_recv_init(
+        struct vsock_sock *vsk,
+        size_t target,
+        struct vsock_transport_recv_notify_data *data)
+{
+        return vmci_trans(vsk)->notify_ops->recv_init(
+                        &vsk->sk, target,
+                        (struct vmci_transport_recv_notify_data *)data);
+}
+
+static int vmci_transport_notify_recv_pre_block(
+        struct vsock_sock *vsk,
+        size_t target,
+        struct vsock_transport_recv_notify_data *data)
+{
+        return vmci_trans(vsk)->notify_ops->recv_pre_block(
+                        &vsk->sk, target,
+                        (struct vmci_transport_recv_notify_data *)data);
+}
+
+static int vmci_transport_notify_recv_pre_dequeue(
+        struct vsock_sock *vsk,
+        size_t target,
+        struct vsock_transport_recv_notify_data *data)
+{
+        return vmci_trans(vsk)->notify_ops->recv_pre_dequeue(
+                        &vsk->sk, target,
+                        (struct vmci_transport_recv_notify_data *)data);
+}
+
+static int vmci_transport_notify_recv_post_dequeue(
+        struct vsock_sock *vsk,
+        size_t target,
+        ssize_t copied,
+        bool data_read,
+        struct vsock_transport_recv_notify_data *data)
+{
+        return vmci_trans(vsk)->notify_ops->recv_post_dequeue(
+                        &vsk->sk, target, copied, data_read,
+                        (struct vmci_transport_recv_notify_data *)data);
+}
+
+static int vmci_transport_notify_send_init(
+        struct vsock_sock *vsk,
+        struct vsock_transport_send_notify_data *data)
+{
+        return vmci_trans(vsk)->notify_ops->send_init(
+                        &vsk->sk,
+                        (struct vmci_transport_send_notify_data *)data);
+}
+
+static int vmci_transport_notify_send_pre_block(
+        struct vsock_sock *vsk,
+        struct vsock_transport_send_notify_data *data)
+{
+        return vmci_trans(vsk)->notify_ops->send_pre_block(
+                        &vsk->sk,
+                        (struct vmci_transport_send_notify_data *)data);
+}
+
+static int vmci_transport_notify_send_pre_enqueue(
+        struct vsock_sock *vsk,
+        struct vsock_transport_send_notify_data *data)
+{
+        return vmci_trans(vsk)->notify_ops->send_pre_enqueue(
+                        &vsk->sk,
+                        (struct vmci_transport_send_notify_data *)data);
+}
+
+static int vmci_transport_notify_send_post_enqueue(
+        struct vsock_sock *vsk,
+        ssize_t written,
+        struct vsock_transport_send_notify_data *data)
+{
+        return vmci_trans(vsk)->notify_ops->send_post_enqueue(
+                        &vsk->sk, written,
+                        (struct vmci_transport_send_notify_data *)data);
+}
+
+static bool vmci_transport_old_proto_override(bool *old_pkt_proto)
+{
+        if (PROTOCOL_OVERRIDE != -1) {
+                if (PROTOCOL_OVERRIDE == 0)
+                        *old_pkt_proto = true;
+                else
+                        *old_pkt_proto = false;
+
+                pr_info("Proto override in use\n");
+                return true;
+        }
+
+        return false;
+}
+
+static bool vmci_transport_proto_to_notify_struct(struct sock *sk,
+                                                  u16 *proto,
+                                                  bool old_pkt_proto)
+{
+        struct vsock_sock *vsk = vsock_sk(sk);
+
+        if (old_pkt_proto) {
+                if (*proto != VSOCK_PROTO_INVALID) {
+                        pr_err("Can't set both an old and new protocol\n");
+                        return false;
+                }
+                vmci_trans(vsk)->notify_ops = &vmci_transport_notify_pkt_ops;
+                goto exit;
+        }
+
+        switch (*proto) {
+        case VSOCK_PROTO_PKT_ON_NOTIFY:
+                vmci_trans(vsk)->notify_ops =
+                        &vmci_transport_notify_pkt_q_state_ops;
+                break;
+        default:
+                pr_err("Unknown notify protocol version\n");
+                return false;
+        }
+
+exit:
+        vmci_trans(vsk)->notify_ops->socket_init(sk);
+        return true;
+}
+
+static u16 vmci_transport_new_proto_supported_versions(void)
+{
+        if (PROTOCOL_OVERRIDE != -1)
+                return PROTOCOL_OVERRIDE;
+
+        return VSOCK_PROTO_ALL_SUPPORTED;
+}
+
+static u32 vmci_transport_get_local_cid(void)
+{
+        return vmci_get_context_id();
+}
+
+static struct vsock_transport vmci_transport = {
+        .init = vmci_transport_socket_init,
+        .destruct = vmci_transport_destruct,
+        .release = vmci_transport_release,
+        .connect = vmci_transport_connect,
+        .dgram_bind = vmci_transport_dgram_bind,
+        .dgram_dequeue = vmci_transport_dgram_dequeue,
+        .dgram_enqueue = vmci_transport_dgram_enqueue,
+        .dgram_allow = vmci_transport_dgram_allow,
+        .stream_dequeue = vmci_transport_stream_dequeue,
+        .stream_enqueue = vmci_transport_stream_enqueue,
+        .stream_has_data = vmci_transport_stream_has_data,
+        .stream_has_space = vmci_transport_stream_has_space,
+        .stream_rcvhiwat = vmci_transport_stream_rcvhiwat,
+        .stream_is_active = vmci_transport_stream_is_active,
+        .stream_allow = vmci_transport_stream_allow,
+        .notify_poll_in = vmci_transport_notify_poll_in,
+        .notify_poll_out = vmci_transport_notify_poll_out,
+        .notify_recv_init = vmci_transport_notify_recv_init,
+        .notify_recv_pre_block = vmci_transport_notify_recv_pre_block,
+        .notify_recv_pre_dequeue = vmci_transport_notify_recv_pre_dequeue,
+        .notify_recv_post_dequeue = vmci_transport_notify_recv_post_dequeue,
+        .notify_send_init = vmci_transport_notify_send_init,
+        .notify_send_pre_block = vmci_transport_notify_send_pre_block,
+        .notify_send_pre_enqueue = vmci_transport_notify_send_pre_enqueue,
+        .notify_send_post_enqueue = vmci_transport_notify_send_post_enqueue,
+        .shutdown = vmci_transport_shutdown,
+        .set_buffer_size = vmci_transport_set_buffer_size,
+        .set_min_buffer_size = vmci_transport_set_min_buffer_size,
+        .set_max_buffer_size = vmci_transport_set_max_buffer_size,
+        .get_buffer_size = vmci_transport_get_buffer_size,
+        .get_min_buffer_size = vmci_transport_get_min_buffer_size,
+        .get_max_buffer_size = vmci_transport_get_max_buffer_size,
+        .get_local_cid = vmci_transport_get_local_cid,
+};
+
+static int __init vmci_transport_init(void)
+{
+        int err;
+
+        /* Create the datagram handle that we will use to send and receive all
+         * VSocket control messages for this context.
+         */
+        err = vmci_transport_datagram_create_hnd(VMCI_TRANSPORT_PACKET_RID,
+                                                 VMCI_FLAG_ANYCID_DG_HND,
+                                                 vmci_transport_recv_stream_cb,
+                                                 NULL,
+                                                 &vmci_transport_stream_handle);
+        if (err < VMCI_SUCCESS) {
+                pr_err("Unable to create datagram handle. (%d)\n", err);
+                return vmci_transport_error_to_vsock_error(err);
+        }
+
+        err = vmci_event_subscribe(VMCI_EVENT_QP_RESUMED,
+                                   vmci_transport_qp_resumed_cb,
+                                   NULL, &vmci_transport_qp_resumed_sub_id);
+        if (err < VMCI_SUCCESS) {
+                pr_err("Unable to subscribe to resumed event. (%d)\n", err);
+                err = vmci_transport_error_to_vsock_error(err);
+                vmci_transport_qp_resumed_sub_id = VMCI_INVALID_ID;
+                goto err_destroy_stream_handle;
+        }
+
+        err = vsock_core_init(&vmci_transport);
+        if (err < 0)
+                goto err_unsubscribe;
+
+        return 0;
+
+err_unsubscribe:
+        vmci_event_unsubscribe(vmci_transport_qp_resumed_sub_id);
+err_destroy_stream_handle:
+        vmci_datagram_destroy_handle(vmci_transport_stream_handle);
+        return err;
+}
+module_init(vmci_transport_init);
+
+static void __exit vmci_transport_exit(void)
+{
+        if (!vmci_handle_is_invalid(vmci_transport_stream_handle)) {
+                if (vmci_datagram_destroy_handle(
+                        vmci_transport_stream_handle) != VMCI_SUCCESS)
+                        pr_err("Couldn't destroy datagram handle\n");
+                vmci_transport_stream_handle = VMCI_INVALID_HANDLE;
+        }
+
+        if (vmci_transport_qp_resumed_sub_id != VMCI_INVALID_ID) {
+                vmci_event_unsubscribe(vmci_transport_qp_resumed_sub_id);
+                vmci_transport_qp_resumed_sub_id = VMCI_INVALID_ID;
+        }
+
+        vsock_core_exit();
+}
+module_exit(vmci_transport_exit);
+
+MODULE_AUTHOR("VMware, Inc.");
+MODULE_DESCRIPTION("VMCI transport for Virtual Sockets");
+MODULE_LICENSE("GPL v2");
+MODULE_ALIAS("vmware_vsock");
+MODULE_ALIAS_NETPROTO(PF_VSOCK);
diff --git a/net/vmw_vsock/vmci_transport.h b/net/vmw_vsock/vmci_transport.h
new file mode 100644
index 000000000000..1bf991803ec0
--- /dev/null
+++ b/net/vmw_vsock/vmci_transport.h
@@ -0,0 +1,139 @@
+/*
+ * VMware vSockets Driver
+ *
+ * Copyright (C) 2013 VMware, Inc. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the Free
+ * Software Foundation version 2 and no later version.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ */
+
+#ifndef _VMCI_TRANSPORT_H_
+#define _VMCI_TRANSPORT_H_
+
+#include <linux/vmw_vmci_defs.h>
+#include <linux/vmw_vmci_api.h>
+
+#include "vsock_addr.h"
+#include "af_vsock.h"
+
+/* If the packet format changes in a release then this should change too. */
+#define VMCI_TRANSPORT_PACKET_VERSION 1
+
+/* The resource ID on which control packets are sent. */
+#define VMCI_TRANSPORT_PACKET_RID 1
+
+#define VSOCK_PROTO_INVALID        0
+#define VSOCK_PROTO_PKT_ON_NOTIFY (1 << 0)
+#define VSOCK_PROTO_ALL_SUPPORTED (VSOCK_PROTO_PKT_ON_NOTIFY)
+
+#define vmci_trans(_vsk) ((struct vmci_transport *)((_vsk)->trans))
+
+enum vmci_transport_packet_type {
+        VMCI_TRANSPORT_PACKET_TYPE_INVALID = 0,
+        VMCI_TRANSPORT_PACKET_TYPE_REQUEST,
+        VMCI_TRANSPORT_PACKET_TYPE_NEGOTIATE,
+        VMCI_TRANSPORT_PACKET_TYPE_OFFER,
+        VMCI_TRANSPORT_PACKET_TYPE_ATTACH,
+        VMCI_TRANSPORT_PACKET_TYPE_WROTE,
+        VMCI_TRANSPORT_PACKET_TYPE_READ,
+        VMCI_TRANSPORT_PACKET_TYPE_RST,
+        VMCI_TRANSPORT_PACKET_TYPE_SHUTDOWN,
+        VMCI_TRANSPORT_PACKET_TYPE_WAITING_WRITE,
+        VMCI_TRANSPORT_PACKET_TYPE_WAITING_READ,
+        VMCI_TRANSPORT_PACKET_TYPE_REQUEST2,
+        VMCI_TRANSPORT_PACKET_TYPE_NEGOTIATE2,
+        VMCI_TRANSPORT_PACKET_TYPE_MAX
+};
+
+struct vmci_transport_waiting_info {
+        u64 generation;
+        u64 offset;
+};
+
+/* Control packet type for STREAM sockets.  DGRAMs have no control packets nor
+ * special packet header for data packets, they are just raw VMCI DGRAM
+ * messages.  For STREAMs, control packets are sent over the control channel
+ * while data is written and read directly from queue pairs with no packet
+ * format.
+ */
+struct vmci_transport_packet {
+        struct vmci_datagram dg;
+        u8 version;
+        u8 type;
+        u16 proto;
+        u32 src_port;
+        u32 dst_port;
+        u32 _reserved2;
+        union {
+                u64 size;
+                u64 mode;
+                struct vmci_handle handle;
+                struct vmci_transport_waiting_info wait;
+        } u;
+};
+
+struct vmci_transport_notify_pkt {
+        u64 write_notify_window;
+        u64 write_notify_min_window;
+        bool peer_waiting_read;
+        bool peer_waiting_write;
+        bool peer_waiting_write_detected;
+        bool sent_waiting_read;
+        bool sent_waiting_write;
+        struct vmci_transport_waiting_info peer_waiting_read_info;
+        struct vmci_transport_waiting_info peer_waiting_write_info;
+        u64 produce_q_generation;
+        u64 consume_q_generation;
+};
+
+struct vmci_transport_notify_pkt_q_state {
+        u64 write_notify_window;
+        u64 write_notify_min_window;
+        bool peer_waiting_write;
+        bool peer_waiting_write_detected;
+};
+
+union vmci_transport_notify {
+        struct vmci_transport_notify_pkt pkt;
+        struct vmci_transport_notify_pkt_q_state pkt_q_state;
+};
+
+/* Our transport-specific data. */
+struct vmci_transport {
+        /* For DGRAMs. */
+        struct vmci_handle dg_handle;
+        /* For STREAMs. */
+        struct vmci_handle qp_handle;
+        struct vmci_qp *qpair;
+        u64 produce_size;
+        u64 consume_size;
+        u64 queue_pair_size;
+        u64 queue_pair_min_size;
+        u64 queue_pair_max_size;
+        u32 attach_sub_id;
+        u32 detach_sub_id;
+        union vmci_transport_notify notify;
+        struct vmci_transport_notify_ops *notify_ops;
+};
+
+int vmci_transport_register(void);
+void vmci_transport_unregister(void);
+
+int vmci_transport_send_wrote_bh(struct sockaddr_vm *dst,
+                                 struct sockaddr_vm *src);
+int vmci_transport_send_read_bh(struct sockaddr_vm *dst,
+                                struct sockaddr_vm *src);
+int vmci_transport_send_wrote(struct sock *sk);
+int vmci_transport_send_read(struct sock *sk);
+int vmci_transport_send_waiting_write(struct sock *sk,
+                                      struct vmci_transport_waiting_info *wait);
+int vmci_transport_send_waiting_read(struct sock *sk,
+                                     struct vmci_transport_waiting_info *wait);
+
+#endif
diff --git a/net/vmw_vsock/vmci_transport_notify.c b/net/vmw_vsock/vmci_transport_notify.c
new file mode 100644
index 000000000000..9a730744e7bc
--- /dev/null
+++ b/net/vmw_vsock/vmci_transport_notify.c
@@ -0,0 +1,680 @@
+/*
+ * VMware vSockets Driver
+ *
+ * Copyright (C) 2009-2013 VMware, Inc. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the Free
+ * Software Foundation version 2 and no later version.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ */
+
+#include <linux/types.h>
+#include <linux/socket.h>
+#include <linux/stddef.h>
+#include <net/sock.h>
+
+#include "vmci_transport_notify.h"
+
+#define PKT_FIELD(vsk, field_name) (vmci_trans(vsk)->notify.pkt.field_name)
+
+static bool vmci_transport_notify_waiting_write(struct vsock_sock *vsk)
+{
+#if defined(VSOCK_OPTIMIZATION_WAITING_NOTIFY)
+        bool retval;
+        u64 notify_limit;
+
+        if (!PKT_FIELD(vsk, peer_waiting_write))
+                return false;
+
+#ifdef VSOCK_OPTIMIZATION_FLOW_CONTROL
+        /* When the sender blocks, we take that as a sign that the sender is
+         * faster than the receiver. To reduce the transmit rate of the sender,
+         * we delay the sending of the read notification by decreasing the
+         * write_notify_window. The notification is delayed until the number of
+         * bytes used in the queue drops below the write_notify_window.
+         */
+
+        if (!PKT_FIELD(vsk, peer_waiting_write_detected)) {
+                PKT_FIELD(vsk, peer_waiting_write_detected) = true;
+                if (PKT_FIELD(vsk, write_notify_window) < PAGE_SIZE) {
+                        PKT_FIELD(vsk, write_notify_window) =
+                            PKT_FIELD(vsk, write_notify_min_window);
+                } else {
+                        PKT_FIELD(vsk, write_notify_window) -= PAGE_SIZE;
+                        if (PKT_FIELD(vsk, write_notify_window) <
+                            PKT_FIELD(vsk, write_notify_min_window))
+                                PKT_FIELD(vsk, write_notify_window) =
+                                    PKT_FIELD(vsk, write_notify_min_window);
+
+                }
+        }
+        notify_limit = vmci_trans(vsk)->consume_size -
+                PKT_FIELD(vsk, write_notify_window);
+#else
+        notify_limit = 0;
+#endif
+
+        /* For now we ignore the wait information and just see if the free
+         * space exceeds the notify limit.  Note that improving this function
+         * to be more intelligent will not require a protocol change and will
+         * retain compatibility between endpoints with mixed versions of this
+         * function.
+         *
+         * The notify_limit is used to delay notifications in the case where
+         * flow control is enabled. Below the test is expressed in terms of
+         * free space in the queue: if free_space > ConsumeSize -
+         * write_notify_window then notify An alternate way of expressing this
+         * is to rewrite the expression to use the data ready in the receive
+         * queue: if write_notify_window > bufferReady then notify as
+         * free_space == ConsumeSize - bufferReady.
+         */
+        retval = vmci_qpair_consume_free_space(vmci_trans(vsk)->qpair) >
+                notify_limit;
+#ifdef VSOCK_OPTIMIZATION_FLOW_CONTROL
+        if (retval) {
+                /*
+                 * Once we notify the peer, we reset the detected flag so the
+                 * next wait will again cause a decrease in the window size.
+                 */
+
+                PKT_FIELD(vsk, peer_waiting_write_detected) = false;
+        }
+#endif
+        return retval;
+#else
+        return true;
+#endif
+}
+
+static bool vmci_transport_notify_waiting_read(struct vsock_sock *vsk)
+{
+#if defined(VSOCK_OPTIMIZATION_WAITING_NOTIFY)
+        if (!PKT_FIELD(vsk, peer_waiting_read))
+                return false;
+
+        /* For now we ignore the wait information and just see if there is any
+         * data for our peer to read.  Note that improving this function to be
+         * more intelligent will not require a protocol change and will retain
+         * compatibility between endpoints with mixed versions of this
+         * function.
+         */
+        return vmci_qpair_produce_buf_ready(vmci_trans(vsk)->qpair) > 0;
+#else
+        return true;
+#endif
+}
+
+static void
+vmci_transport_handle_waiting_read(struct sock *sk,
+                                   struct vmci_transport_packet *pkt,
+                                   bool bottom_half,
+                                   struct sockaddr_vm *dst,
+                                   struct sockaddr_vm *src)
+{
+#if defined(VSOCK_OPTIMIZATION_WAITING_NOTIFY)
+        struct vsock_sock *vsk;
+
+        vsk = vsock_sk(sk);
+
+        PKT_FIELD(vsk, peer_waiting_read) = true;
+        memcpy(&PKT_FIELD(vsk, peer_waiting_read_info), &pkt->u.wait,
+               sizeof(PKT_FIELD(vsk, peer_waiting_read_info)));
+
+        if (vmci_transport_notify_waiting_read(vsk)) {
+                bool sent;
+
+                if (bottom_half)
+                        sent = vmci_transport_send_wrote_bh(dst, src) > 0;
+                else
+                        sent = vmci_transport_send_wrote(sk) > 0;
+
+                if (sent)
+                        PKT_FIELD(vsk, peer_waiting_read) = false;
+        }
+#endif
+}
+
+static void
+vmci_transport_handle_waiting_write(struct sock *sk,
+                                    struct vmci_transport_packet *pkt,
+                                    bool bottom_half,
+                                    struct sockaddr_vm *dst,
+                                    struct sockaddr_vm *src)
+{
+#if defined(VSOCK_OPTIMIZATION_WAITING_NOTIFY)
+        struct vsock_sock *vsk;
+
+        vsk = vsock_sk(sk);
+
+        PKT_FIELD(vsk, peer_waiting_write) = true;
+        memcpy(&PKT_FIELD(vsk, peer_waiting_write_info), &pkt->u.wait,
+               sizeof(PKT_FIELD(vsk, peer_waiting_write_info)));
+
+        if (vmci_transport_notify_waiting_write(vsk)) {
+                bool sent;
+
+                if (bottom_half)
+                        sent = vmci_transport_send_read_bh(dst, src) > 0;
+                else
+                        sent = vmci_transport_send_read(sk) > 0;
+
+                if (sent)
+                        PKT_FIELD(vsk, peer_waiting_write) = false;
+        }
+#endif
+}
+
+static void
+vmci_transport_handle_read(struct sock *sk,
+                           struct vmci_transport_packet *pkt,
+                           bool bottom_half,
+                           struct sockaddr_vm *dst, struct sockaddr_vm *src)
+{
+#if defined(VSOCK_OPTIMIZATION_WAITING_NOTIFY)
+        struct vsock_sock *vsk;
+
+        vsk = vsock_sk(sk);
+        PKT_FIELD(vsk, sent_waiting_write) = false;
+#endif
+
+        sk->sk_write_space(sk);
+}
+
+static bool send_waiting_read(struct sock *sk, u64 room_needed)
+{
+#if defined(VSOCK_OPTIMIZATION_WAITING_NOTIFY)
+        struct vsock_sock *vsk;
+        struct vmci_transport_waiting_info waiting_info;
+        u64 tail;
+        u64 head;
+        u64 room_left;
+        bool ret;
+
+        vsk = vsock_sk(sk);
+
+        if (PKT_FIELD(vsk, sent_waiting_read))
+                return true;
+
+        if (PKT_FIELD(vsk, write_notify_window) <
+                        vmci_trans(vsk)->consume_size)
+                PKT_FIELD(vsk, write_notify_window) =
+                    min(PKT_FIELD(vsk, write_notify_window) + PAGE_SIZE,
+                        vmci_trans(vsk)->consume_size);
+
+        vmci_qpair_get_consume_indexes(vmci_trans(vsk)->qpair, &tail, &head);
+        room_left = vmci_trans(vsk)->consume_size - head;
+        if (room_needed >= room_left) {
+                waiting_info.offset = room_needed - room_left;
+                waiting_info.generation =
+                    PKT_FIELD(vsk, consume_q_generation) + 1;
+        } else {
+                waiting_info.offset = head + room_needed;
+                waiting_info.generation = PKT_FIELD(vsk, consume_q_generation);
+        }
+
+        ret = vmci_transport_send_waiting_read(sk, &waiting_info) > 0;
+        if (ret)
+                PKT_FIELD(vsk, sent_waiting_read) = true;
+
+        return ret;
+#else
+        return true;
+#endif
+}
+
+static bool send_waiting_write(struct sock *sk, u64 room_needed)
+{
+#if defined(VSOCK_OPTIMIZATION_WAITING_NOTIFY)
+        struct vsock_sock *vsk;
+        struct vmci_transport_waiting_info waiting_info;
+        u64 tail;
+        u64 head;
+        u64 room_left;
+        bool ret;
+
+        vsk = vsock_sk(sk);
+
+        if (PKT_FIELD(vsk, sent_waiting_write))
+                return true;
+
+        vmci_qpair_get_produce_indexes(vmci_trans(vsk)->qpair, &tail, &head);
+        room_left = vmci_trans(vsk)->produce_size - tail;
+        if (room_needed + 1 >= room_left) {
+                /* Wraps around to current generation. */
+                waiting_info.offset = room_needed + 1 - room_left;
+                waiting_info.generation = PKT_FIELD(vsk, produce_q_generation);
+        } else {
+                waiting_info.offset = tail + room_needed + 1;
+                waiting_info.generation =
+                    PKT_FIELD(vsk, produce_q_generation) - 1;
+        }
+
+        ret = vmci_transport_send_waiting_write(sk, &waiting_info) > 0;
+        if (ret)
+                PKT_FIELD(vsk, sent_waiting_write) = true;
+
+        return ret;
+#else
+        return true;
+#endif
+}
+
+static int vmci_transport_send_read_notification(struct sock *sk)
+{
+        struct vsock_sock *vsk;
+        bool sent_read;
+        unsigned int retries;
+        int err;
+
+        vsk = vsock_sk(sk);
+        sent_read = false;
+        retries = 0;
+        err = 0;
+
+        if (vmci_transport_notify_waiting_write(vsk)) {
+                /* Notify the peer that we have read, retrying the send on
+                 * failure up to our maximum value.  XXX For now we just log
+                 * the failure, but later we should schedule a work item to
+                 * handle the resend until it succeeds.  That would require
+                 * keeping track of work items in the vsk and cleaning them up
+                 * upon socket close.
+                 */
+                while (!(vsk->peer_shutdown & RCV_SHUTDOWN) &&
+                       !sent_read &&
+                       retries < VMCI_TRANSPORT_MAX_DGRAM_RESENDS) {
+                        err = vmci_transport_send_read(sk);
+                        if (err >= 0)
+                                sent_read = true;
+
+                        retries++;
+                }
+
+                if (retries >= VMCI_TRANSPORT_MAX_DGRAM_RESENDS)
+                        pr_err("%p unable to send read notify to peer\n", sk);
+                else
+#if defined(VSOCK_OPTIMIZATION_WAITING_NOTIFY)
+                        PKT_FIELD(vsk, peer_waiting_write) = false;
+#endif
+
+        }
+        return err;
+}
+
+static void
+vmci_transport_handle_wrote(struct sock *sk,
+                            struct vmci_transport_packet *pkt,
+                            bool bottom_half,
+                            struct sockaddr_vm *dst, struct sockaddr_vm *src)
+{
+#if defined(VSOCK_OPTIMIZATION_WAITING_NOTIFY)
+        struct vsock_sock *vsk = vsock_sk(sk);
+        PKT_FIELD(vsk, sent_waiting_read) = false;
+#endif
+        sk->sk_data_ready(sk, 0);
+}
+
+static void vmci_transport_notify_pkt_socket_init(struct sock *sk)
+{
+        struct vsock_sock *vsk = vsock_sk(sk);
+
+        PKT_FIELD(vsk, write_notify_window) = PAGE_SIZE;
+        PKT_FIELD(vsk, write_notify_min_window) = PAGE_SIZE;
+        PKT_FIELD(vsk, peer_waiting_read) = false;
+        PKT_FIELD(vsk, peer_waiting_write) = false;
+        PKT_FIELD(vsk, peer_waiting_write_detected) = false;
+        PKT_FIELD(vsk, sent_waiting_read) = false;
+        PKT_FIELD(vsk, sent_waiting_write) = false;
+        PKT_FIELD(vsk, produce_q_generation) = 0;
+        PKT_FIELD(vsk, consume_q_generation) = 0;
+
+        memset(&PKT_FIELD(vsk, peer_waiting_read_info), 0,
+               sizeof(PKT_FIELD(vsk, peer_waiting_read_info)));
+        memset(&PKT_FIELD(vsk, peer_waiting_write_info), 0,
+               sizeof(PKT_FIELD(vsk, peer_waiting_write_info)));
+}
+
+static void vmci_transport_notify_pkt_socket_destruct(struct vsock_sock *vsk)
+{
+}
+
+static int
+vmci_transport_notify_pkt_poll_in(struct sock *sk,
+                                  size_t target, bool *data_ready_now)
+{
+        struct vsock_sock *vsk = vsock_sk(sk);
+
+        if (vsock_stream_has_data(vsk)) {
+                *data_ready_now = true;
+        } else {
+                /* We can't read right now because there is nothing in the
+                 * queue. Ask for notifications when there is something to
+                 * read.
+                 */
+                if (sk->sk_state == SS_CONNECTED) {
+                        if (!send_waiting_read(sk, 1))
+                                return -1;
+
+                }
+                *data_ready_now = false;
+        }
+
+        return 0;
+}
+
+static int
+vmci_transport_notify_pkt_poll_out(struct sock *sk,
+                                   size_t target, bool *space_avail_now)
+{
+        s64 produce_q_free_space;
+        struct vsock_sock *vsk = vsock_sk(sk);
+
+        produce_q_free_space = vsock_stream_has_space(vsk);
+        if (produce_q_free_space > 0) {
+                *space_avail_now = true;
+                return 0;
+        } else if (produce_q_free_space == 0) {
+                /* This is a connected socket but we can't currently send data.
+                 * Notify the peer that we are waiting if the queue is full. We
+                 * only send a waiting write if the queue is full because
+                 * otherwise we end up in an infinite WAITING_WRITE, READ,
+                 * WAITING_WRITE, READ, etc. loop. Treat failing to send the
+                 * notification as a socket error, passing that back through
+                 * the mask.
+                 */
+                if (!send_waiting_write(sk, 1))
+                        return -1;
+
+                *space_avail_now = false;
+        }
+
+        return 0;
+}
+
+static int
+vmci_transport_notify_pkt_recv_init(
+                        struct sock *sk,
+                        size_t target,
+                        struct vmci_transport_recv_notify_data *data)
+{
+        struct vsock_sock *vsk = vsock_sk(sk);
+
+#ifdef VSOCK_OPTIMIZATION_WAITING_NOTIFY
+        data->consume_head = 0;
+        data->produce_tail = 0;
+#ifdef VSOCK_OPTIMIZATION_FLOW_CONTROL
+        data->notify_on_block = false;
+
+        if (PKT_FIELD(vsk, write_notify_min_window) < target + 1) {
+                PKT_FIELD(vsk, write_notify_min_window) = target + 1;
+                if (PKT_FIELD(vsk, write_notify_window) <
+                    PKT_FIELD(vsk, write_notify_min_window)) {
+                        /* If the current window is smaller than the new
+                         * minimal window size, we need to reevaluate whether
+                         * we need to notify the sender. If the number of ready
+                         * bytes are smaller than the new window, we need to
+                         * send a notification to the sender before we block.
+                         */
+
+                        PKT_FIELD(vsk, write_notify_window) =
+                            PKT_FIELD(vsk, write_notify_min_window);
+                        data->notify_on_block = true;
+                }
+        }
+#endif
+#endif
+
+        return 0;
+}
+
+static int
+vmci_transport_notify_pkt_recv_pre_block(
+                                struct sock *sk,
+                                size_t target,
+                                struct vmci_transport_recv_notify_data *data)
+{
+        int err = 0;
+
+        /* Notify our peer that we are waiting for data to read. */
+        if (!send_waiting_read(sk, target)) {
+                err = -EHOSTUNREACH;
+                return err;
+        }
+#ifdef VSOCK_OPTIMIZATION_FLOW_CONTROL
+        if (data->notify_on_block) {
+                err = vmci_transport_send_read_notification(sk);
+                if (err < 0)
+                        return err;
+
+                data->notify_on_block = false;
+        }
+#endif
+
+        return err;
+}
+
+static int
+vmci_transport_notify_pkt_recv_pre_dequeue(
+                                struct sock *sk,
+                                size_t target,
+                                struct vmci_transport_recv_notify_data *data)
+{
+        struct vsock_sock *vsk = vsock_sk(sk);
+
+        /* Now consume up to len bytes from the queue.  Note that since we have
+         * the socket locked we should copy at least ready bytes.
+         */
+#if defined(VSOCK_OPTIMIZATION_WAITING_NOTIFY)
+        vmci_qpair_get_consume_indexes(vmci_trans(vsk)->qpair,
+                                       &data->produce_tail,
+                                       &data->consume_head);
+#endif
+
+        return 0;
+}
+
+static int
+vmci_transport_notify_pkt_recv_post_dequeue(
+                                struct sock *sk,
+                                size_t target,
+                                ssize_t copied,
+                                bool data_read,
+                                struct vmci_transport_recv_notify_data *data)
+{
+        struct vsock_sock *vsk;
+        int err;
+
+        vsk = vsock_sk(sk);
+        err = 0;
+
+        if (data_read) {
+#if defined(VSOCK_OPTIMIZATION_WAITING_NOTIFY)
+                /* Detect a wrap-around to maintain queue generation.  Note
+                 * that this is safe since we hold the socket lock across the
+                 * two queue pair operations.
+                 */
+                if (copied >=
+                        vmci_trans(vsk)->consume_size - data->consume_head)
+                        PKT_FIELD(vsk, consume_q_generation)++;
+#endif
+
+                err = vmci_transport_send_read_notification(sk);
+                if (err < 0)
+                        return err;
+
+        }
+        return err;
+}
+
+static int
+vmci_transport_notify_pkt_send_init(
+                        struct sock *sk,
+                        struct vmci_transport_send_notify_data *data)
+{
+#ifdef VSOCK_OPTIMIZATION_WAITING_NOTIFY
+        data->consume_head = 0;
+        data->produce_tail = 0;
+#endif
+
+        return 0;
+}
+
+static int
+vmci_transport_notify_pkt_send_pre_block(
+                                struct sock *sk,
+                                struct vmci_transport_send_notify_data *data)
+{
+        /* Notify our peer that we are waiting for room to write. */
+        if (!send_waiting_write(sk, 1))
+                return -EHOSTUNREACH;
+
+        return 0;
+}
+
+static int
+vmci_transport_notify_pkt_send_pre_enqueue(
+                                struct sock *sk,
+                                struct vmci_transport_send_notify_data *data)
+{
+        struct vsock_sock *vsk = vsock_sk(sk);
+
+#if defined(VSOCK_OPTIMIZATION_WAITING_NOTIFY)
+        vmci_qpair_get_produce_indexes(vmci_trans(vsk)->qpair,
+                                       &data->produce_tail,
+                                       &data->consume_head);
+#endif
+
+        return 0;
+}
+
+static int
+vmci_transport_notify_pkt_send_post_enqueue(
+                                struct sock *sk,
+                                ssize_t written,
+                                struct vmci_transport_send_notify_data *data)
+{
+        int err = 0;
+        struct vsock_sock *vsk;
+        bool sent_wrote = false;
+        int retries = 0;
+
+        vsk = vsock_sk(sk);
+
+#if defined(VSOCK_OPTIMIZATION_WAITING_NOTIFY)
+        /* Detect a wrap-around to maintain queue generation.  Note that this
+         * is safe since we hold the socket lock across the two queue pair
+         * operations.
+         */
+        if (written >= vmci_trans(vsk)->produce_size - data->produce_tail)
+                PKT_FIELD(vsk, produce_q_generation)++;
+
+#endif
+
+        if (vmci_transport_notify_waiting_read(vsk)) {
+                /* Notify the peer that we have written, retrying the send on
+                 * failure up to our maximum value. See the XXX comment for the
+                 * corresponding piece of code in StreamRecvmsg() for potential
+                 * improvements.
+                 */
+                while (!(vsk->peer_shutdown & RCV_SHUTDOWN) &&
+                       !sent_wrote &&
+                       retries < VMCI_TRANSPORT_MAX_DGRAM_RESENDS) {
+                        err = vmci_transport_send_wrote(sk);
+                        if (err >= 0)
+                                sent_wrote = true;
+
+                        retries++;
+                }
+
+                if (retries >= VMCI_TRANSPORT_MAX_DGRAM_RESENDS) {
+                        pr_err("%p unable to send wrote notify to peer\n", sk);
+                        return err;
+                } else {
+#if defined(VSOCK_OPTIMIZATION_WAITING_NOTIFY)
+                        PKT_FIELD(vsk, peer_waiting_read) = false;
+#endif
+                }
+        }
+        return err;
+}
+
+static void
+vmci_transport_notify_pkt_handle_pkt(
+                        struct sock *sk,
+                        struct vmci_transport_packet *pkt,
+                        bool bottom_half,
+                        struct sockaddr_vm *dst,
+                        struct sockaddr_vm *src, bool *pkt_processed)
+{
+        bool processed = false;
+
+        switch (pkt->type) {
+        case VMCI_TRANSPORT_PACKET_TYPE_WROTE:
+                vmci_transport_handle_wrote(sk, pkt, bottom_half, dst, src);
+                processed = true;
+                break;
+        case VMCI_TRANSPORT_PACKET_TYPE_READ:
+                vmci_transport_handle_read(sk, pkt, bottom_half, dst, src);
+                processed = true;
+                break;
+        case VMCI_TRANSPORT_PACKET_TYPE_WAITING_WRITE:
+                vmci_transport_handle_waiting_write(sk, pkt, bottom_half,
+                                                    dst, src);
+                processed = true;
+                break;
+
+        case VMCI_TRANSPORT_PACKET_TYPE_WAITING_READ:
+                vmci_transport_handle_waiting_read(sk, pkt, bottom_half,
+                                                   dst, src);
+                processed = true;
+                break;
+        }
+
+        if (pkt_processed)
+                *pkt_processed = processed;
+}
+
+static void vmci_transport_notify_pkt_process_request(struct sock *sk)
+{
+        struct vsock_sock *vsk = vsock_sk(sk);
+
+        PKT_FIELD(vsk, write_notify_window) = vmci_trans(vsk)->consume_size;
+        if (vmci_trans(vsk)->consume_size <
+                PKT_FIELD(vsk, write_notify_min_window))
+                PKT_FIELD(vsk, write_notify_min_window) =
+                        vmci_trans(vsk)->consume_size;
+}
+
+static void vmci_transport_notify_pkt_process_negotiate(struct sock *sk)
+{
+        struct vsock_sock *vsk = vsock_sk(sk);
+
+        PKT_FIELD(vsk, write_notify_window) = vmci_trans(vsk)->consume_size;
+        if (vmci_trans(vsk)->consume_size <
+                PKT_FIELD(vsk, write_notify_min_window))
+                PKT_FIELD(vsk, write_notify_min_window) =
+                        vmci_trans(vsk)->consume_size;
+}
+
+/* Socket control packet based operations. */
+struct vmci_transport_notify_ops vmci_transport_notify_pkt_ops = {
+        vmci_transport_notify_pkt_socket_init,
+        vmci_transport_notify_pkt_socket_destruct,
+        vmci_transport_notify_pkt_poll_in,
+        vmci_transport_notify_pkt_poll_out,
+        vmci_transport_notify_pkt_handle_pkt,
+        vmci_transport_notify_pkt_recv_init,
+        vmci_transport_notify_pkt_recv_pre_block,
+        vmci_transport_notify_pkt_recv_pre_dequeue,
+        vmci_transport_notify_pkt_recv_post_dequeue,
+        vmci_transport_notify_pkt_send_init,
+        vmci_transport_notify_pkt_send_pre_block,
+        vmci_transport_notify_pkt_send_pre_enqueue,
+        vmci_transport_notify_pkt_send_post_enqueue,
+        vmci_transport_notify_pkt_process_request,
+        vmci_transport_notify_pkt_process_negotiate,
+};
diff --git a/net/vmw_vsock/vmci_transport_notify.h b/net/vmw_vsock/vmci_transport_notify.h
new file mode 100644
index 000000000000..7df793249b6c
--- /dev/null
+++ b/net/vmw_vsock/vmci_transport_notify.h
@@ -0,0 +1,83 @@
+/*
+ * VMware vSockets Driver
+ *
+ * Copyright (C) 2009-2013 VMware, Inc. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the Free
+ * Software Foundation version 2 and no later version.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ */
+
+#ifndef __VMCI_TRANSPORT_NOTIFY_H__
+#define __VMCI_TRANSPORT_NOTIFY_H__
+
+#include <linux/types.h>
+#include <linux/vmw_vmci_defs.h>
+#include <linux/vmw_vmci_api.h>
+#include <linux/vm_sockets.h>
+
+#include "vmci_transport.h"
+
+/* Comment this out to compare with old protocol. */
+#define VSOCK_OPTIMIZATION_WAITING_NOTIFY 1
+#if defined(VSOCK_OPTIMIZATION_WAITING_NOTIFY)
+/* Comment this out to remove flow control for "new" protocol */
+#define VSOCK_OPTIMIZATION_FLOW_CONTROL 1
+#endif
+
+#define VMCI_TRANSPORT_MAX_DGRAM_RESENDS       10
+
+struct vmci_transport_recv_notify_data {
+        u64 consume_head;
+        u64 produce_tail;
+        bool notify_on_block;
+};
+
+struct vmci_transport_send_notify_data {
+        u64 consume_head;
+        u64 produce_tail;
+};
+
+/* Socket notification callbacks. */
+struct vmci_transport_notify_ops {
+        void (*socket_init) (struct sock *sk);
+        void (*socket_destruct) (struct vsock_sock *vsk);
+        int (*poll_in) (struct sock *sk, size_t target,
+                          bool *data_ready_now);
+        int (*poll_out) (struct sock *sk, size_t target,
+                           bool *space_avail_now);
+        void (*handle_notify_pkt) (struct sock *sk,
+                                   struct vmci_transport_packet *pkt,
+                                   bool bottom_half, struct sockaddr_vm *dst,
+                                   struct sockaddr_vm *src,
+                                   bool *pkt_processed);
+        int (*recv_init) (struct sock *sk, size_t target,
+                          struct vmci_transport_recv_notify_data *data);
+        int (*recv_pre_block) (struct sock *sk, size_t target,
+                               struct vmci_transport_recv_notify_data *data);
+        int (*recv_pre_dequeue) (struct sock *sk, size_t target,
+                                 struct vmci_transport_recv_notify_data *data);
+        int (*recv_post_dequeue) (struct sock *sk, size_t target,
+                                  ssize_t copied, bool data_read,
+                                  struct vmci_transport_recv_notify_data *data);
+        int (*send_init) (struct sock *sk,
+                          struct vmci_transport_send_notify_data *data);
+        int (*send_pre_block) (struct sock *sk,
+                               struct vmci_transport_send_notify_data *data);
+        int (*send_pre_enqueue) (struct sock *sk,
+                                 struct vmci_transport_send_notify_data *data);
+        int (*send_post_enqueue) (struct sock *sk, ssize_t written,
+                                  struct vmci_transport_send_notify_data *data);
+        void (*process_request) (struct sock *sk);
+        void (*process_negotiate) (struct sock *sk);
+};
+
+extern struct vmci_transport_notify_ops vmci_transport_notify_pkt_ops;
+extern struct vmci_transport_notify_ops vmci_transport_notify_pkt_q_state_ops;
+
+#endif /* __VMCI_TRANSPORT_NOTIFY_H__ */
diff --git a/net/vmw_vsock/vmci_transport_notify_qstate.c b/net/vmw_vsock/vmci_transport_notify_qstate.c
new file mode 100644
index 000000000000..622bd7aa1016
--- /dev/null
+++ b/net/vmw_vsock/vmci_transport_notify_qstate.c
@@ -0,0 +1,438 @@
+/*
+ * VMware vSockets Driver
+ *
+ * Copyright (C) 2009-2013 VMware, Inc. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the Free
+ * Software Foundation version 2 and no later version.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ */
+
+#include <linux/types.h>
+#include <linux/socket.h>
+#include <linux/stddef.h>
+#include <net/sock.h>
+
+#include "vmci_transport_notify.h"
+
+#define PKT_FIELD(vsk, field_name) \
+        (vmci_trans(vsk)->notify.pkt_q_state.field_name)
+
+static bool vmci_transport_notify_waiting_write(struct vsock_sock *vsk)
+{
+        bool retval;
+        u64 notify_limit;
+
+        if (!PKT_FIELD(vsk, peer_waiting_write))
+                return false;
+
+        /* When the sender blocks, we take that as a sign that the sender is
+         * faster than the receiver. To reduce the transmit rate of the sender,
+         * we delay the sending of the read notification by decreasing the
+         * write_notify_window. The notification is delayed until the number of
+         * bytes used in the queue drops below the write_notify_window.
+         */
+
+        if (!PKT_FIELD(vsk, peer_waiting_write_detected)) {
+                PKT_FIELD(vsk, peer_waiting_write_detected) = true;
+                if (PKT_FIELD(vsk, write_notify_window) < PAGE_SIZE) {
+                        PKT_FIELD(vsk, write_notify_window) =
+                            PKT_FIELD(vsk, write_notify_min_window);
+                } else {
+                        PKT_FIELD(vsk, write_notify_window) -= PAGE_SIZE;
+                        if (PKT_FIELD(vsk, write_notify_window) <
+                            PKT_FIELD(vsk, write_notify_min_window))
+                                PKT_FIELD(vsk, write_notify_window) =
+                                    PKT_FIELD(vsk, write_notify_min_window);
+
+                }
+        }
+        notify_limit = vmci_trans(vsk)->consume_size -
+                PKT_FIELD(vsk, write_notify_window);
+
+        /* The notify_limit is used to delay notifications in the case where
+         * flow control is enabled. Below the test is expressed in terms of
+         * free space in the queue: if free_space > ConsumeSize -
+         * write_notify_window then notify An alternate way of expressing this
+         * is to rewrite the expression to use the data ready in the receive
+         * queue: if write_notify_window > bufferReady then notify as
+         * free_space == ConsumeSize - bufferReady.
+         */
+
+        retval = vmci_qpair_consume_free_space(vmci_trans(vsk)->qpair) >
+                notify_limit;
+
+        if (retval) {
+                /* Once we notify the peer, we reset the detected flag so the
+                 * next wait will again cause a decrease in the window size.
+                 */
+
+                PKT_FIELD(vsk, peer_waiting_write_detected) = false;
+        }
+        return retval;
+}
+
+static void
+vmci_transport_handle_read(struct sock *sk,
+                           struct vmci_transport_packet *pkt,
+                           bool bottom_half,
+                           struct sockaddr_vm *dst, struct sockaddr_vm *src)
+{
+        sk->sk_write_space(sk);
+}
+
+static void
+vmci_transport_handle_wrote(struct sock *sk,
+                            struct vmci_transport_packet *pkt,
+                            bool bottom_half,
+                            struct sockaddr_vm *dst, struct sockaddr_vm *src)
+{
+        sk->sk_data_ready(sk, 0);
+}
+
+static void vsock_block_update_write_window(struct sock *sk)
+{
+        struct vsock_sock *vsk = vsock_sk(sk);
+
+        if (PKT_FIELD(vsk, write_notify_window) < vmci_trans(vsk)->consume_size)
+                PKT_FIELD(vsk, write_notify_window) =
+                    min(PKT_FIELD(vsk, write_notify_window) + PAGE_SIZE,
+                        vmci_trans(vsk)->consume_size);
+}
+
+static int vmci_transport_send_read_notification(struct sock *sk)
+{
+        struct vsock_sock *vsk;
+        bool sent_read;
+        unsigned int retries;
+        int err;
+
+        vsk = vsock_sk(sk);
+        sent_read = false;
+        retries = 0;
+        err = 0;
+
+        if (vmci_transport_notify_waiting_write(vsk)) {
+                /* Notify the peer that we have read, retrying the send on
+                 * failure up to our maximum value.  XXX For now we just log
+                 * the failure, but later we should schedule a work item to
+                 * handle the resend until it succeeds.  That would require
+                 * keeping track of work items in the vsk and cleaning them up
+                 * upon socket close.
+                 */
+                while (!(vsk->peer_shutdown & RCV_SHUTDOWN) &&
+                       !sent_read &&
+                       retries < VMCI_TRANSPORT_MAX_DGRAM_RESENDS) {
+                        err = vmci_transport_send_read(sk);
+                        if (err >= 0)
+                                sent_read = true;
+
+                        retries++;
+                }
+
+                if (retries >= VMCI_TRANSPORT_MAX_DGRAM_RESENDS && !sent_read)
+                        pr_err("%p unable to send read notification to peer\n",
+                               sk);
+                else
+                        PKT_FIELD(vsk, peer_waiting_write) = false;
+
+        }
+        return err;
+}
+
+static void vmci_transport_notify_pkt_socket_init(struct sock *sk)
+{
+        struct vsock_sock *vsk = vsock_sk(sk);
+
+        PKT_FIELD(vsk, write_notify_window) = PAGE_SIZE;
+        PKT_FIELD(vsk, write_notify_min_window) = PAGE_SIZE;
+        PKT_FIELD(vsk, peer_waiting_write) = false;
+        PKT_FIELD(vsk, peer_waiting_write_detected) = false;
+}
+
+static void vmci_transport_notify_pkt_socket_destruct(struct vsock_sock *vsk)
+{
+        PKT_FIELD(vsk, write_notify_window) = PAGE_SIZE;
+        PKT_FIELD(vsk, write_notify_min_window) = PAGE_SIZE;
+        PKT_FIELD(vsk, peer_waiting_write) = false;
+        PKT_FIELD(vsk, peer_waiting_write_detected) = false;
+}
+
+static int
+vmci_transport_notify_pkt_poll_in(struct sock *sk,
+                                  size_t target, bool *data_ready_now)
+{
+        struct vsock_sock *vsk = vsock_sk(sk);
+
+        if (vsock_stream_has_data(vsk)) {
+                *data_ready_now = true;
+        } else {
+                /* We can't read right now because there is nothing in the
+                 * queue. Ask for notifications when there is something to
+                 * read.
+                 */
+                if (sk->sk_state == SS_CONNECTED)
+                        vsock_block_update_write_window(sk);
+                *data_ready_now = false;
+        }
+
+        return 0;
+}
+
+static int
+vmci_transport_notify_pkt_poll_out(struct sock *sk,
+                                   size_t target, bool *space_avail_now)
+{
+        s64 produce_q_free_space;
+        struct vsock_sock *vsk = vsock_sk(sk);
+
+        produce_q_free_space = vsock_stream_has_space(vsk);
+        if (produce_q_free_space > 0) {
+                *space_avail_now = true;
+                return 0;
+        } else if (produce_q_free_space == 0) {
+                /* This is a connected socket but we can't currently send data.
+                 * Nothing else to do.
+                 */
+                *space_avail_now = false;
+        }
+
+        return 0;
+}
+
+static int
+vmci_transport_notify_pkt_recv_init(
+                                struct sock *sk,
+                                size_t target,
+                                struct vmci_transport_recv_notify_data *data)
+{
+        struct vsock_sock *vsk = vsock_sk(sk);
+
+        data->consume_head = 0;
+        data->produce_tail = 0;
+        data->notify_on_block = false;
+
+        if (PKT_FIELD(vsk, write_notify_min_window) < target + 1) {
+                PKT_FIELD(vsk, write_notify_min_window) = target + 1;
+                if (PKT_FIELD(vsk, write_notify_window) <
+                    PKT_FIELD(vsk, write_notify_min_window)) {
+                        /* If the current window is smaller than the new
+                         * minimal window size, we need to reevaluate whether
+                         * we need to notify the sender. If the number of ready
+                         * bytes are smaller than the new window, we need to
+                         * send a notification to the sender before we block.
+                         */
+
+                        PKT_FIELD(vsk, write_notify_window) =
+                            PKT_FIELD(vsk, write_notify_min_window);
+                        data->notify_on_block = true;
+                }
+        }
+
+        return 0;
+}
+
+static int
+vmci_transport_notify_pkt_recv_pre_block(
+                                struct sock *sk,
+                                size_t target,
+                                struct vmci_transport_recv_notify_data *data)
+{
+        int err = 0;
+
+        vsock_block_update_write_window(sk);
+
+        if (data->notify_on_block) {
+                err = vmci_transport_send_read_notification(sk);
+                if (err < 0)
+                        return err;
+                data->notify_on_block = false;
+        }
+
+        return err;
+}
+
+static int
+vmci_transport_notify_pkt_recv_post_dequeue(
+                                struct sock *sk,
+                                size_t target,
+                                ssize_t copied,
+                                bool data_read,
+                                struct vmci_transport_recv_notify_data *data)
+{
+        struct vsock_sock *vsk;
+        int err;
+        bool was_full = false;
+        u64 free_space;
+
+        vsk = vsock_sk(sk);
+        err = 0;
+
+        if (data_read) {
+                smp_mb();
+
+                free_space =
+                        vmci_qpair_consume_free_space(vmci_trans(vsk)->qpair);
+                was_full = free_space == copied;
+
+                if (was_full)
+                        PKT_FIELD(vsk, peer_waiting_write) = true;
+
+                err = vmci_transport_send_read_notification(sk);
+                if (err < 0)
+                        return err;
+
+                /* See the comment in
+                 * vmci_transport_notify_pkt_send_post_enqueue().
+                 */
+                sk->sk_data_ready(sk, 0);
+        }
+
+        return err;
+}
+
+static int
+vmci_transport_notify_pkt_send_init(
+                                struct sock *sk,
+                                struct vmci_transport_send_notify_data *data)
+{
+        data->consume_head = 0;
+        data->produce_tail = 0;
+
+        return 0;
+}
+
+static int
+vmci_transport_notify_pkt_send_post_enqueue(
+                                struct sock *sk,
+                                ssize_t written,
+                                struct vmci_transport_send_notify_data *data)
+{
+        int err = 0;
+        struct vsock_sock *vsk;
+        bool sent_wrote = false;
+        bool was_empty;
+        int retries = 0;
+
+        vsk = vsock_sk(sk);
+
+        smp_mb();
+
+        was_empty =
+                vmci_qpair_produce_buf_ready(vmci_trans(vsk)->qpair) == written;
+        if (was_empty) {
+                while (!(vsk->peer_shutdown & RCV_SHUTDOWN) &&
+                       !sent_wrote &&
+                       retries < VMCI_TRANSPORT_MAX_DGRAM_RESENDS) {
+                        err = vmci_transport_send_wrote(sk);
+                        if (err >= 0)
+                                sent_wrote = true;
+
+                        retries++;
+                }
+        }
+
+        if (retries >= VMCI_TRANSPORT_MAX_DGRAM_RESENDS && !sent_wrote) {
+                pr_err("%p unable to send wrote notification to peer\n",
+                       sk);
+                return err;
+        }
+
+        return err;
+}
+
+static void
+vmci_transport_notify_pkt_handle_pkt(
+                                struct sock *sk,
+                                struct vmci_transport_packet *pkt,
+                                bool bottom_half,
+                                struct sockaddr_vm *dst,
+                                struct sockaddr_vm *src, bool *pkt_processed)
+{
+        bool processed = false;
+
+        switch (pkt->type) {
+        case VMCI_TRANSPORT_PACKET_TYPE_WROTE:
+                vmci_transport_handle_wrote(sk, pkt, bottom_half, dst, src);
+                processed = true;
+                break;
+        case VMCI_TRANSPORT_PACKET_TYPE_READ:
+                vmci_transport_handle_read(sk, pkt, bottom_half, dst, src);
+                processed = true;
+                break;
+        }
+
+        if (pkt_processed)
+                *pkt_processed = processed;
+}
+
+static void vmci_transport_notify_pkt_process_request(struct sock *sk)
+{
+        struct vsock_sock *vsk = vsock_sk(sk);
+
+        PKT_FIELD(vsk, write_notify_window) = vmci_trans(vsk)->consume_size;
+        if (vmci_trans(vsk)->consume_size <
+                PKT_FIELD(vsk, write_notify_min_window))
+                PKT_FIELD(vsk, write_notify_min_window) =
+                        vmci_trans(vsk)->consume_size;
+}
+
+static void vmci_transport_notify_pkt_process_negotiate(struct sock *sk)
+{
+        struct vsock_sock *vsk = vsock_sk(sk);
+
+        PKT_FIELD(vsk, write_notify_window) = vmci_trans(vsk)->consume_size;
+        if (vmci_trans(vsk)->consume_size <
+                PKT_FIELD(vsk, write_notify_min_window))
+                PKT_FIELD(vsk, write_notify_min_window) =
+                        vmci_trans(vsk)->consume_size;
+}
+
+static int
+vmci_transport_notify_pkt_recv_pre_dequeue(
+                                struct sock *sk,
+                                size_t target,
+                                struct vmci_transport_recv_notify_data *data)
+{
+        return 0; /* NOP for QState. */
+}
+
+static int
+vmci_transport_notify_pkt_send_pre_block(
+                                struct sock *sk,
+                                struct vmci_transport_send_notify_data *data)
+{
+        return 0; /* NOP for QState. */
+}
+
+static int
+vmci_transport_notify_pkt_send_pre_enqueue(
+                                struct sock *sk,
+                                struct vmci_transport_send_notify_data *data)
+{
+        return 0; /* NOP for QState. */
+}
+
+/* Socket always on control packet based operations. */
+struct vmci_transport_notify_ops vmci_transport_notify_pkt_q_state_ops = {
+        vmci_transport_notify_pkt_socket_init,
+        vmci_transport_notify_pkt_socket_destruct,
+        vmci_transport_notify_pkt_poll_in,
+        vmci_transport_notify_pkt_poll_out,
+        vmci_transport_notify_pkt_handle_pkt,
+        vmci_transport_notify_pkt_recv_init,
+        vmci_transport_notify_pkt_recv_pre_block,
+        vmci_transport_notify_pkt_recv_pre_dequeue,
+        vmci_transport_notify_pkt_recv_post_dequeue,
+        vmci_transport_notify_pkt_send_init,
+        vmci_transport_notify_pkt_send_pre_block,
+        vmci_transport_notify_pkt_send_pre_enqueue,
+        vmci_transport_notify_pkt_send_post_enqueue,
+        vmci_transport_notify_pkt_process_request,
+        vmci_transport_notify_pkt_process_negotiate,
+};
diff --git a/net/vmw_vsock/vsock_addr.c b/net/vmw_vsock/vsock_addr.c
new file mode 100644
index 000000000000..b7df1aea7c59
--- /dev/null
+++ b/net/vmw_vsock/vsock_addr.c
@@ -0,0 +1,86 @@
+/*
+ * VMware vSockets Driver
+ *
+ * Copyright (C) 2007-2012 VMware, Inc. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the Free
+ * Software Foundation version 2 and no later version.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ */
+
+#include <linux/types.h>
+#include <linux/socket.h>
+#include <linux/stddef.h>
+#include <net/sock.h>
+
+#include "vsock_addr.h"
+
+void vsock_addr_init(struct sockaddr_vm *addr, u32 cid, u32 port)
+{
+        memset(addr, 0, sizeof(*addr));
+        addr->svm_family = AF_VSOCK;
+        addr->svm_cid = cid;
+        addr->svm_port = port;
+}
+EXPORT_SYMBOL_GPL(vsock_addr_init);
+
+int vsock_addr_validate(const struct sockaddr_vm *addr)
+{
+        if (!addr)
+                return -EFAULT;
+
+        if (addr->svm_family != AF_VSOCK)
+                return -EAFNOSUPPORT;
+
+        if (addr->svm_zero[0] != 0)
+                return -EINVAL;
+
+        return 0;
+}
+EXPORT_SYMBOL_GPL(vsock_addr_validate);
+
+bool vsock_addr_bound(const struct sockaddr_vm *addr)
+{
+        return addr->svm_port != VMADDR_PORT_ANY;
+}
+EXPORT_SYMBOL_GPL(vsock_addr_bound);
+
+void vsock_addr_unbind(struct sockaddr_vm *addr)
+{
+        vsock_addr_init(addr, VMADDR_CID_ANY, VMADDR_PORT_ANY);
+}
+EXPORT_SYMBOL_GPL(vsock_addr_unbind);
+
+bool vsock_addr_equals_addr(const struct sockaddr_vm *addr,
+                            const struct sockaddr_vm *other)
+{
+        return addr->svm_cid == other->svm_cid &&
+                addr->svm_port == other->svm_port;
+}
+EXPORT_SYMBOL_GPL(vsock_addr_equals_addr);
+
+bool vsock_addr_equals_addr_any(const struct sockaddr_vm *addr,
+                                const struct sockaddr_vm *other)
+{
+        return (addr->svm_cid == VMADDR_CID_ANY ||
+                other->svm_cid == VMADDR_CID_ANY ||
+                addr->svm_cid == other->svm_cid) &&
+               addr->svm_port == other->svm_port;
+}
+EXPORT_SYMBOL_GPL(vsock_addr_equals_addr_any);
+
+int vsock_addr_cast(const struct sockaddr *addr,
+                    size_t len, struct sockaddr_vm **out_addr)
+{
+        if (len < sizeof(**out_addr))
+                return -EFAULT;
+
+        *out_addr = (struct sockaddr_vm *)addr;
+        return vsock_addr_validate(*out_addr);
+}
+EXPORT_SYMBOL_GPL(vsock_addr_cast);
diff --git a/net/vmw_vsock/vsock_addr.h b/net/vmw_vsock/vsock_addr.h
new file mode 100644
index 000000000000..cdfbcefdf843
--- /dev/null
+++ b/net/vmw_vsock/vsock_addr.h
@@ -0,0 +1,32 @@
+/*
+ * VMware vSockets Driver
+ *
+ * Copyright (C) 2007-2013 VMware, Inc. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the Free
+ * Software Foundation version 2 and no later version.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ */
+
+#ifndef _VSOCK_ADDR_H_
+#define _VSOCK_ADDR_H_
+
+#include <linux/vm_sockets.h>
+
+void vsock_addr_init(struct sockaddr_vm *addr, u32 cid, u32 port);
+int vsock_addr_validate(const struct sockaddr_vm *addr);
+bool vsock_addr_bound(const struct sockaddr_vm *addr);
+void vsock_addr_unbind(struct sockaddr_vm *addr);
+bool vsock_addr_equals_addr(const struct sockaddr_vm *addr,
+                            const struct sockaddr_vm *other);
+bool vsock_addr_equals_addr_any(const struct sockaddr_vm *addr,
+                                const struct sockaddr_vm *other);
+int vsock_addr_cast(const struct sockaddr *addr, size_t len,
+                    struct sockaddr_vm **out_addr);
+
+#endif
diff --git a/net/wireless/chan.c b/net/wireless/chan.c
index 396373f3ec26..fd556ac05fdb 100644
--- a/net/wireless/chan.c
+++ b/net/wireless/chan.c
@@ -147,6 +147,32 @@ static void chandef_primary_freqs(const struct cfg80211_chan_def *c,
         }
 }
 
+static int cfg80211_chandef_get_width(const struct cfg80211_chan_def *c)
+{
+        int width;
+
+        switch (c->width) {
+        case NL80211_CHAN_WIDTH_20:
+        case NL80211_CHAN_WIDTH_20_NOHT:
+                width = 20;
+                break;
+        case NL80211_CHAN_WIDTH_40:
+                width = 40;
+                break;
+        case NL80211_CHAN_WIDTH_80P80:
+        case NL80211_CHAN_WIDTH_80:
+                width = 80;
+                break;
+        case NL80211_CHAN_WIDTH_160:
+                width = 160;
+                break;
+        default:
+                WARN_ON_ONCE(1);
+                return -1;
+        }
+        return width;
+}
+
 const struct cfg80211_chan_def *
 cfg80211_chandef_compatible(const struct cfg80211_chan_def *c1,
                             const struct cfg80211_chan_def *c2)
@@ -192,6 +218,93 @@ cfg80211_chandef_compatible(const struct cfg80211_chan_def *c1,
 }
 EXPORT_SYMBOL(cfg80211_chandef_compatible);
 
+static void cfg80211_set_chans_dfs_state(struct wiphy *wiphy, u32 center_freq,
+                                         u32 bandwidth,
+                                         enum nl80211_dfs_state dfs_state)
+{
+        struct ieee80211_channel *c;
+        u32 freq;
+
+        for (freq = center_freq - bandwidth/2 + 10;
+             freq <= center_freq + bandwidth/2 - 10;
+             freq += 20) {
+                c = ieee80211_get_channel(wiphy, freq);
+                if (!c || !(c->flags & IEEE80211_CHAN_RADAR))
+                        continue;
+
+                c->dfs_state = dfs_state;
+                c->dfs_state_entered = jiffies;
+        }
+}
+
+void cfg80211_set_dfs_state(struct wiphy *wiphy,
+                            const struct cfg80211_chan_def *chandef,
+                            enum nl80211_dfs_state dfs_state)
+{
+        int width;
+
+        if (WARN_ON(!cfg80211_chandef_valid(chandef)))
+                return;
+
+        width = cfg80211_chandef_get_width(chandef);
+        if (width < 0)
+                return;
+
+        cfg80211_set_chans_dfs_state(wiphy, chandef->center_freq1,
+                                     width, dfs_state);
+
+        if (!chandef->center_freq2)
+                return;
+        cfg80211_set_chans_dfs_state(wiphy, chandef->center_freq2,
+                                     width, dfs_state);
+}
+
+static int cfg80211_get_chans_dfs_required(struct wiphy *wiphy,
+                                            u32 center_freq,
+                                            u32 bandwidth)
+{
+        struct ieee80211_channel *c;
+        u32 freq;
+
+        for (freq = center_freq - bandwidth/2 + 10;
+             freq <= center_freq + bandwidth/2 - 10;
+             freq += 20) {
+                c = ieee80211_get_channel(wiphy, freq);
+                if (!c)
+                        return -EINVAL;
+
+                if (c->flags & IEEE80211_CHAN_RADAR)
+                        return 1;
+        }
+        return 0;
+}
+
+
+int cfg80211_chandef_dfs_required(struct wiphy *wiphy,
+                                  const struct cfg80211_chan_def *chandef)
+{
+        int width;
+        int r;
+
+        if (WARN_ON(!cfg80211_chandef_valid(chandef)))
+                return -EINVAL;
+
+        width = cfg80211_chandef_get_width(chandef);
+        if (width < 0)
+                return -EINVAL;
+
+        r = cfg80211_get_chans_dfs_required(wiphy, chandef->center_freq1,
+                                            width);
+        if (r)
+                return r;
+
+        if (!chandef->center_freq2)
+                return 0;
+
+        return cfg80211_get_chans_dfs_required(wiphy, chandef->center_freq2,
+                                               width);
+}
+
 static bool cfg80211_secondary_chans_ok(struct wiphy *wiphy,
                                         u32 center_freq, u32 bandwidth,
                                         u32 prohibited_flags)
@@ -203,7 +316,16 @@ static bool cfg80211_secondary_chans_ok(struct wiphy *wiphy,
              freq <= center_freq + bandwidth/2 - 10;
              freq += 20) {
                 c = ieee80211_get_channel(wiphy, freq);
-                if (!c || c->flags & prohibited_flags)
+                if (!c)
+                        return false;
+
+                /* check for radar flags */
+                if ((prohibited_flags & c->flags & IEEE80211_CHAN_RADAR) &&
+                    (c->dfs_state != NL80211_DFS_AVAILABLE))
+                        return false;
+
+                /* check for the other flags */
+                if (c->flags & prohibited_flags & ~IEEE80211_CHAN_RADAR)
                         return false;
         }
 
@@ -253,6 +375,7 @@ bool cfg80211_chandef_usable(struct wiphy *wiphy,
         case NL80211_CHAN_WIDTH_80:
                 if (!vht_cap->vht_supported)
                         return false;
+                prohibited_flags |= IEEE80211_CHAN_NO_80MHZ;
                 width = 80;
                 break;
         case NL80211_CHAN_WIDTH_160:
@@ -260,6 +383,7 @@ bool cfg80211_chandef_usable(struct wiphy *wiphy,
                         return false;
                 if (!(vht_cap->cap & IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160MHZ))
                         return false;
+                prohibited_flags |= IEEE80211_CHAN_NO_160MHZ;
                 width = 160;
                 break;
         default:
@@ -267,7 +391,16 @@ bool cfg80211_chandef_usable(struct wiphy *wiphy,
                 return false;
         }
 
-        /* TODO: missing regulatory check on 80/160 bandwidth */
+        /*
+         * TODO: What if there are only certain 80/160/80+80 MHz channels
+         *       allowed by the driver, or only certain combinations?
+         *       For 40 MHz the driver can set the NO_HT40 flags, but for
+         *       80/160 MHz and in particular 80+80 MHz this isn't really
+         *       feasible and we only have NO_80MHZ/NO_160MHZ so far but
+         *       no way to cover 80+80 MHz or more complex restrictions.
+         *       Note that such restrictions also need to be advertised to
+         *       userspace, for example for P2P channel selection.
+         */
 
         if (width > 20)
                 prohibited_flags |= IEEE80211_CHAN_NO_OFDM;
@@ -344,7 +477,10 @@ cfg80211_get_chan_state(struct wireless_dev *wdev,
                 break;
         case NL80211_IFTYPE_AP:
         case NL80211_IFTYPE_P2P_GO:
-                if (wdev->beacon_interval) {
+                if (wdev->cac_started) {
+                        *chan = wdev->channel;
+                        *chanmode = CHAN_MODE_SHARED;
+                } else if (wdev->beacon_interval) {
                         *chan = wdev->channel;
                         *chanmode = CHAN_MODE_SHARED;
                 }
diff --git a/net/wireless/core.c b/net/wireless/core.c
index 9245729694d2..5ffff039b017 100644
--- a/net/wireless/core.c
+++ b/net/wireless/core.c
@@ -324,6 +324,8 @@ struct wiphy *wiphy_new(const struct cfg80211_ops *ops, int sizeof_priv)
         INIT_LIST_HEAD(&rdev->bss_list);
         INIT_WORK(&rdev->scan_done_wk, __cfg80211_scan_done);
         INIT_WORK(&rdev->sched_scan_results_wk, __cfg80211_sched_scan_results);
+        INIT_DELAYED_WORK(&rdev->dfs_update_channels_wk,
+                          cfg80211_dfs_channels_update_work);
 #ifdef CONFIG_CFG80211_WEXT
         rdev->wiphy.wext = &cfg80211_wext_handler;
 #endif
@@ -365,7 +367,8 @@ struct wiphy *wiphy_new(const struct cfg80211_ops *ops, int sizeof_priv)
         rdev->wiphy.rts_threshold = (u32) -1;
         rdev->wiphy.coverage_class = 0;
 
-        rdev->wiphy.features = NL80211_FEATURE_SCAN_FLUSH;
+        rdev->wiphy.features = NL80211_FEATURE_SCAN_FLUSH |
+                               NL80211_FEATURE_ADVERTISE_CHAN_LIMITS;
 
         return &rdev->wiphy;
 }
@@ -478,6 +481,11 @@ int wiphy_register(struct wiphy *wiphy)
                            ETH_ALEN)))
                 return -EINVAL;
 
+        if (WARN_ON(wiphy->max_acl_mac_addrs &&
+                    (!(wiphy->flags & WIPHY_FLAG_HAVE_AP_SME) ||
+                     !rdev->ops->set_mac_acl)))
+                return -EINVAL;
+
         if (wiphy->addresses)
                 memcpy(wiphy->perm_addr, wiphy->addresses[0].addr, ETH_ALEN);
 
@@ -690,6 +698,7 @@ void wiphy_unregister(struct wiphy *wiphy)
         flush_work(&rdev->scan_done_wk);
         cancel_work_sync(&rdev->conn_work);
         flush_work(&rdev->event_work);
+        cancel_delayed_work_sync(&rdev->dfs_update_channels_wk);
 
         if (rdev->wowlan && rdev->ops->set_wakeup)
                 rdev_set_wakeup(rdev, false);
@@ -710,7 +719,7 @@ void cfg80211_dev_free(struct cfg80211_registered_device *rdev)
                 kfree(reg);
         }
         list_for_each_entry_safe(scan, tmp, &rdev->bss_list, list)
-                cfg80211_put_bss(&scan->pub);
+                cfg80211_put_bss(&rdev->wiphy, &scan->pub);
         kfree(rdev);
 }
 
diff --git a/net/wireless/core.h b/net/wireless/core.h
index 8396f7671c8d..3aec0e429d8a 100644
--- a/net/wireless/core.h
+++ b/net/wireless/core.h
@@ -8,7 +8,6 @@
 #include <linux/mutex.h>
 #include <linux/list.h>
 #include <linux/netdevice.h>
-#include <linux/kref.h>
 #include <linux/rbtree.h>
 #include <linux/debugfs.h>
 #include <linux/rfkill.h>
@@ -87,6 +86,8 @@ struct cfg80211_registered_device {
 
         struct cfg80211_wowlan *wowlan;
 
+        struct delayed_work dfs_update_channels_wk;
+
         /* must be last because of the way we do wiphy_priv(),
          * and it should at least be aligned to NETDEV_ALIGN */
         struct wiphy wiphy __aligned(NETDEV_ALIGN);
@@ -109,6 +110,9 @@ cfg80211_rdev_free_wowlan(struct cfg80211_registered_device *rdev)
         for (i = 0; i < rdev->wowlan->n_patterns; i++)
                 kfree(rdev->wowlan->patterns[i].mask);
         kfree(rdev->wowlan->patterns);
+        if (rdev->wowlan->tcp && rdev->wowlan->tcp->sock)
+                sock_release(rdev->wowlan->tcp->sock);
+        kfree(rdev->wowlan->tcp);
         kfree(rdev->wowlan);
 }
 
@@ -124,9 +128,10 @@ static inline void assert_cfg80211_lock(void)
 
 struct cfg80211_internal_bss {
         struct list_head list;
+        struct list_head hidden_list;
         struct rb_node rbn;
         unsigned long ts;
-        struct kref ref;
+        unsigned long refcount;
         atomic_t hold;
 
         /* must be last because of priv member */
@@ -428,6 +433,22 @@ int cfg80211_can_use_iftype_chan(struct cfg80211_registered_device *rdev,
                                  enum cfg80211_chan_mode chanmode,
                                  u8 radar_detect);
 
+/**
+ * cfg80211_chandef_dfs_required - checks if radar detection is required
+ * @wiphy: the wiphy to validate against
+ * @chandef: the channel definition to check
+ * Return: 1 if radar detection is required, 0 if it is not, < 0 on error
+ */
+int cfg80211_chandef_dfs_required(struct wiphy *wiphy,
+                                  const struct cfg80211_chan_def *c);
+
+void cfg80211_set_dfs_state(struct wiphy *wiphy,
+                            const struct cfg80211_chan_def *chandef,
+                            enum nl80211_dfs_state dfs_state);
+
+void cfg80211_dfs_channels_update_work(struct work_struct *work);
+
+
 static inline int
 cfg80211_can_change_interface(struct cfg80211_registered_device *rdev,
                               struct wireless_dev *wdev,
@@ -454,6 +475,16 @@ cfg80211_can_use_chan(struct cfg80211_registered_device *rdev,
                                             chan, chanmode, 0);
 }
 
+static inline unsigned int elapsed_jiffies_msecs(unsigned long start)
+{
+        unsigned long end = jiffies;
+
+        if (end >= start)
+                return jiffies_to_msecs(end - start);
+
+        return jiffies_to_msecs(end + (MAX_JIFFY_OFFSET - start) + 1);
+}
+
 void
 cfg80211_get_chan_state(struct wireless_dev *wdev,
                         struct ieee80211_channel **chan,
diff --git a/net/wireless/ibss.c b/net/wireless/ibss.c
index 9b9551e4a6f9..d80e47194d49 100644
--- a/net/wireless/ibss.c
+++ b/net/wireless/ibss.c
@@ -37,7 +37,7 @@ void __cfg80211_ibss_joined(struct net_device *dev, const u8 *bssid)
 
         if (wdev->current_bss) {
                 cfg80211_unhold_bss(wdev->current_bss);
-                cfg80211_put_bss(&wdev->current_bss->pub);
+                cfg80211_put_bss(wdev->wiphy, &wdev->current_bss->pub);
         }
 
         cfg80211_hold_bss(bss_from_pub(bss));
@@ -182,7 +182,7 @@ static void __cfg80211_clear_ibss(struct net_device *dev, bool nowext)
 
         if (wdev->current_bss) {
                 cfg80211_unhold_bss(wdev->current_bss);
-                cfg80211_put_bss(&wdev->current_bss->pub);
+                cfg80211_put_bss(wdev->wiphy, &wdev->current_bss->pub);
         }
 
         wdev->current_bss = NULL;
diff --git a/net/wireless/mlme.c b/net/wireless/mlme.c
index 461e692cdfec..caddca35d686 100644
--- a/net/wireless/mlme.c
+++ b/net/wireless/mlme.c
@@ -58,7 +58,7 @@ void cfg80211_send_rx_assoc(struct net_device *dev, struct cfg80211_bss *bss,
          */
         if (status_code != WLAN_STATUS_SUCCESS && wdev->conn &&
             cfg80211_sme_failed_reassoc(wdev)) {
-                cfg80211_put_bss(bss);
+                cfg80211_put_bss(wiphy, bss);
                 goto out;
         }
 
@@ -70,7 +70,7 @@ void cfg80211_send_rx_assoc(struct net_device *dev, struct cfg80211_bss *bss,
                  * do not call connect_result() now because the
                  * sme will schedule work that does it later.
                  */
-                cfg80211_put_bss(bss);
+                cfg80211_put_bss(wiphy, bss);
                 goto out;
         }
 
@@ -108,7 +108,7 @@ void __cfg80211_send_deauth(struct net_device *dev,
         if (wdev->current_bss &&
             ether_addr_equal(wdev->current_bss->pub.bssid, bssid)) {
                 cfg80211_unhold_bss(wdev->current_bss);
-                cfg80211_put_bss(&wdev->current_bss->pub);
+                cfg80211_put_bss(wiphy, &wdev->current_bss->pub);
                 wdev->current_bss = NULL;
                 was_current = true;
         }
@@ -164,7 +164,7 @@ void __cfg80211_send_disassoc(struct net_device *dev,
             ether_addr_equal(wdev->current_bss->pub.bssid, bssid)) {
                 cfg80211_sme_disassoc(dev, wdev->current_bss);
                 cfg80211_unhold_bss(wdev->current_bss);
-                cfg80211_put_bss(&wdev->current_bss->pub);
+                cfg80211_put_bss(wiphy, &wdev->current_bss->pub);
                 wdev->current_bss = NULL;
         } else
                 WARN_ON(1);
@@ -324,7 +324,7 @@ int __cfg80211_mlme_auth(struct cfg80211_registered_device *rdev,
         err = rdev_auth(rdev, dev, &req);
 
 out:
-        cfg80211_put_bss(req.bss);
+        cfg80211_put_bss(&rdev->wiphy, req.bss);
         return err;
 }
 
@@ -432,7 +432,7 @@ out:
         if (err) {
                 if (was_connected)
                         wdev->sme_state = CFG80211_SME_CONNECTED;
-                cfg80211_put_bss(req.bss);
+                cfg80211_put_bss(&rdev->wiphy, req.bss);
         }
 
         return err;
@@ -514,7 +514,7 @@ static int __cfg80211_mlme_disassoc(struct cfg80211_registered_device *rdev,
         if (wdev->sme_state != CFG80211_SME_CONNECTED)
                 return -ENOTCONN;
 
-        if (WARN_ON(!wdev->current_bss))
+        if (WARN(!wdev->current_bss, "sme_state=%d\n", wdev->sme_state))
                 return -ENOTCONN;
 
         memset(&req, 0, sizeof(req));
@@ -572,7 +572,7 @@ void cfg80211_mlme_down(struct cfg80211_registered_device *rdev,
 
         if (wdev->current_bss) {
                 cfg80211_unhold_bss(wdev->current_bss);
-                cfg80211_put_bss(&wdev->current_bss->pub);
+                cfg80211_put_bss(&rdev->wiphy, &wdev->current_bss->pub);
                 wdev->current_bss = NULL;
         }
 }
@@ -987,3 +987,123 @@ void cfg80211_pmksa_candidate_notify(struct net_device *dev, int index,
         nl80211_pmksa_candidate_notify(rdev, dev, index, bssid, preauth, gfp);
 }
 EXPORT_SYMBOL(cfg80211_pmksa_candidate_notify);
+
+void cfg80211_dfs_channels_update_work(struct work_struct *work)
+{
+        struct delayed_work *delayed_work;
+        struct cfg80211_registered_device *rdev;
+        struct cfg80211_chan_def chandef;
+        struct ieee80211_supported_band *sband;
+        struct ieee80211_channel *c;
+        struct wiphy *wiphy;
+        bool check_again = false;
+        unsigned long timeout, next_time = 0;
+        int bandid, i;
+
+        delayed_work = container_of(work, struct delayed_work, work);
+        rdev = container_of(delayed_work, struct cfg80211_registered_device,
+                            dfs_update_channels_wk);
+        wiphy = &rdev->wiphy;
+
+        mutex_lock(&cfg80211_mutex);
+        for (bandid = 0; bandid < IEEE80211_NUM_BANDS; bandid++) {
+                sband = wiphy->bands[bandid];
+                if (!sband)
+                        continue;
+
+                for (i = 0; i < sband->n_channels; i++) {
+                        c = &sband->channels[i];
+
+                        if (c->dfs_state != NL80211_DFS_UNAVAILABLE)
+                                continue;
+
+                        timeout = c->dfs_state_entered +
+                                  IEEE80211_DFS_MIN_NOP_TIME_MS;
+
+                        if (time_after_eq(jiffies, timeout)) {
+                                c->dfs_state = NL80211_DFS_USABLE;
+                                cfg80211_chandef_create(&chandef, c,
+                                                        NL80211_CHAN_NO_HT);
+
+                                nl80211_radar_notify(rdev, &chandef,
+                                                     NL80211_RADAR_NOP_FINISHED,
+                                                     NULL, GFP_ATOMIC);
+                                continue;
+                        }
+
+                        if (!check_again)
+                                next_time = timeout - jiffies;
+                        else
+                                next_time = min(next_time, timeout - jiffies);
+                        check_again = true;
+                }
+        }
+        mutex_unlock(&cfg80211_mutex);
+
+        /* reschedule if there are other channels waiting to be cleared again */
+        if (check_again)
+                queue_delayed_work(cfg80211_wq, &rdev->dfs_update_channels_wk,
+                                   next_time);
+}
+
+
+void cfg80211_radar_event(struct wiphy *wiphy,
+                          struct cfg80211_chan_def *chandef,
+                          gfp_t gfp)
+{
+        struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
+        unsigned long timeout;
+
+        trace_cfg80211_radar_event(wiphy, chandef);
+
+        /* only set the chandef supplied channel to unavailable, in
+         * case the radar is detected on only one of multiple channels
+         * spanned by the chandef.
+         */
+        cfg80211_set_dfs_state(wiphy, chandef, NL80211_DFS_UNAVAILABLE);
+
+        timeout = msecs_to_jiffies(IEEE80211_DFS_MIN_NOP_TIME_MS);
+        queue_delayed_work(cfg80211_wq, &rdev->dfs_update_channels_wk,
+                           timeout);
+
+        nl80211_radar_notify(rdev, chandef, NL80211_RADAR_DETECTED, NULL, gfp);
+}
+EXPORT_SYMBOL(cfg80211_radar_event);
+
+void cfg80211_cac_event(struct net_device *netdev,
+                        enum nl80211_radar_event event, gfp_t gfp)
+{
+        struct wireless_dev *wdev = netdev->ieee80211_ptr;
+        struct wiphy *wiphy = wdev->wiphy;
+        struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
+        struct cfg80211_chan_def chandef;
+        unsigned long timeout;
+
+        trace_cfg80211_cac_event(netdev, event);
+
+        if (WARN_ON(!wdev->cac_started))
+                return;
+
+        if (WARN_ON(!wdev->channel))
+                return;
+
+        cfg80211_chandef_create(&chandef, wdev->channel, NL80211_CHAN_NO_HT);
+
+        switch (event) {
+        case NL80211_RADAR_CAC_FINISHED:
+                timeout = wdev->cac_start_time +
+                          msecs_to_jiffies(IEEE80211_DFS_MIN_CAC_TIME_MS);
+                WARN_ON(!time_after_eq(jiffies, timeout));
+                cfg80211_set_dfs_state(wiphy, &chandef, NL80211_DFS_AVAILABLE);
+                break;
+        case NL80211_RADAR_CAC_ABORTED:
+                break;
+        default:
+                WARN_ON(1);
+                return;
+        }
+        wdev->cac_started = false;
+
+        nl80211_radar_notify(rdev, &chandef, event, netdev, gfp);
+}
+EXPORT_SYMBOL(cfg80211_cac_event);
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index 33de80364c5c..580ffeaef3d5 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -19,6 +19,7 @@
 #include <net/genetlink.h>
 #include <net/cfg80211.h>
 #include <net/sock.h>
+#include <net/inet_connection_sock.h>
 #include "core.h"
 #include "nl80211.h"
 #include "reg.h"
@@ -365,6 +366,10 @@ static const struct nla_policy nl80211_policy[NL80211_ATTR_MAX+1] = {
         [NL80211_ATTR_SCAN_FLAGS] = { .type = NLA_U32 },
         [NL80211_ATTR_P2P_CTWINDOW] = { .type = NLA_U8 },
         [NL80211_ATTR_P2P_OPPPS] = { .type = NLA_U8 },
+        [NL80211_ATTR_ACL_POLICY] = {. type = NLA_U32 },
+        [NL80211_ATTR_MAC_ADDRS] = { .type = NLA_NESTED },
+        [NL80211_ATTR_STA_CAPABILITY] = { .type = NLA_U16 },
+        [NL80211_ATTR_STA_EXT_CAPABILITY] = { .type = NLA_BINARY, },
 };
 
 /* policy for the key attributes */
@@ -397,6 +402,26 @@ nl80211_wowlan_policy[NUM_NL80211_WOWLAN_TRIG] = {
         [NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST] = { .type = NLA_FLAG },
         [NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE] = { .type = NLA_FLAG },
         [NL80211_WOWLAN_TRIG_RFKILL_RELEASE] = { .type = NLA_FLAG },
+        [NL80211_WOWLAN_TRIG_TCP_CONNECTION] = { .type = NLA_NESTED },
+};
+
+static const struct nla_policy
+nl80211_wowlan_tcp_policy[NUM_NL80211_WOWLAN_TCP] = {
+        [NL80211_WOWLAN_TCP_SRC_IPV4] = { .type = NLA_U32 },
+        [NL80211_WOWLAN_TCP_DST_IPV4] = { .type = NLA_U32 },
+        [NL80211_WOWLAN_TCP_DST_MAC] = { .len = ETH_ALEN },
+        [NL80211_WOWLAN_TCP_SRC_PORT] = { .type = NLA_U16 },
+        [NL80211_WOWLAN_TCP_DST_PORT] = { .type = NLA_U16 },
+        [NL80211_WOWLAN_TCP_DATA_PAYLOAD] = { .len = 1 },
+        [NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ] = {
+                .len = sizeof(struct nl80211_wowlan_tcp_data_seq)
+        },
+        [NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN] = {
+                .len = sizeof(struct nl80211_wowlan_tcp_data_token)
+        },
+        [NL80211_WOWLAN_TCP_DATA_INTERVAL] = { .type = NLA_U32 },
+        [NL80211_WOWLAN_TCP_WAKE_PAYLOAD] = { .len = 1 },
+        [NL80211_WOWLAN_TCP_WAKE_MASK] = { .len = 1 },
 };
 
 /* policy for GTK rekey offload attributes */
@@ -529,8 +554,27 @@ static int nl80211_msg_put_channel(struct sk_buff *msg,
         if ((chan->flags & IEEE80211_CHAN_NO_IBSS) &&
             nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_IBSS))
                 goto nla_put_failure;
-        if ((chan->flags & IEEE80211_CHAN_RADAR) &&
-            nla_put_flag(msg, NL80211_FREQUENCY_ATTR_RADAR))
+        if (chan->flags & IEEE80211_CHAN_RADAR) {
+                u32 time = elapsed_jiffies_msecs(chan->dfs_state_entered);
+                if (nla_put_flag(msg, NL80211_FREQUENCY_ATTR_RADAR))
+                        goto nla_put_failure;
+                if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_DFS_STATE,
+                                chan->dfs_state))
+                        goto nla_put_failure;
+                if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_DFS_TIME, time))
+                        goto nla_put_failure;
+        }
+        if ((chan->flags & IEEE80211_CHAN_NO_HT40MINUS) &&
+            nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_HT40_MINUS))
+                goto nla_put_failure;
+        if ((chan->flags & IEEE80211_CHAN_NO_HT40PLUS) &&
+            nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_HT40_PLUS))
+                goto nla_put_failure;
+        if ((chan->flags & IEEE80211_CHAN_NO_80MHZ) &&
+            nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_80MHZ))
+                goto nla_put_failure;
+        if ((chan->flags & IEEE80211_CHAN_NO_160MHZ) &&
+            nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_160MHZ))
                 goto nla_put_failure;
 
         if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_MAX_TX_POWER,
@@ -870,6 +914,48 @@ nla_put_failure:
         return -ENOBUFS;
 }
 
+#ifdef CONFIG_PM
+static int nl80211_send_wowlan_tcp_caps(struct cfg80211_registered_device *rdev,
+                                        struct sk_buff *msg)
+{
+        const struct wiphy_wowlan_tcp_support *tcp = rdev->wiphy.wowlan.tcp;
+        struct nlattr *nl_tcp;
+
+        if (!tcp)
+                return 0;
+
+        nl_tcp = nla_nest_start(msg, NL80211_WOWLAN_TRIG_TCP_CONNECTION);
+        if (!nl_tcp)
+                return -ENOBUFS;
+
+        if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD,
+                        tcp->data_payload_max))
+                return -ENOBUFS;
+
+        if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD,
+                        tcp->data_payload_max))
+                return -ENOBUFS;
+
+        if (tcp->seq && nla_put_flag(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ))
+                return -ENOBUFS;
+
+        if (tcp->tok && nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN,
+                                sizeof(*tcp->tok), tcp->tok))
+                return -ENOBUFS;
+
+        if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_INTERVAL,
+                        tcp->data_interval_max))
+                return -ENOBUFS;
+
+        if (nla_put_u32(msg, NL80211_WOWLAN_TCP_WAKE_PAYLOAD,
+                        tcp->wake_payload_max))
+                return -ENOBUFS;
+
+        nla_nest_end(msg, nl_tcp);
+        return 0;
+}
+#endif
+
 static int nl80211_send_wiphy(struct sk_buff *msg, u32 portid, u32 seq, int flags,
                               struct cfg80211_registered_device *dev)
 {
@@ -1236,12 +1322,17 @@ static int nl80211_send_wiphy(struct sk_buff *msg, u32 portid, u32 seq, int flag
                                         dev->wiphy.wowlan.pattern_min_len,
                                 .max_pattern_len =
                                         dev->wiphy.wowlan.pattern_max_len,
+                                .max_pkt_offset =
+                                        dev->wiphy.wowlan.max_pkt_offset,
                         };
                         if (nla_put(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN,
                                     sizeof(pat), &pat))
                                 goto nla_put_failure;
                 }
 
+                if (nl80211_send_wowlan_tcp_caps(dev, msg))
+                        goto nla_put_failure;
+
                 nla_nest_end(msg, nl_wowlan);
         }
 #endif
@@ -1268,6 +1359,21 @@ static int nl80211_send_wiphy(struct sk_buff *msg, u32 portid, u32 seq, int flag
                     dev->wiphy.ht_capa_mod_mask))
                 goto nla_put_failure;
 
+        if (dev->wiphy.flags & WIPHY_FLAG_HAVE_AP_SME &&
+            dev->wiphy.max_acl_mac_addrs &&
+            nla_put_u32(msg, NL80211_ATTR_MAC_ACL_MAX,
+                        dev->wiphy.max_acl_mac_addrs))
+                goto nla_put_failure;
+
+        if (dev->wiphy.extended_capabilities &&
+            (nla_put(msg, NL80211_ATTR_EXT_CAPA,
+                     dev->wiphy.extended_capabilities_len,
+                     dev->wiphy.extended_capabilities) ||
+             nla_put(msg, NL80211_ATTR_EXT_CAPA_MASK,
+                     dev->wiphy.extended_capabilities_len,
+                     dev->wiphy.extended_capabilities_mask)))
+                goto nla_put_failure;
+
         return genlmsg_end(msg, hdr);
 
  nla_put_failure:
@@ -2491,6 +2597,97 @@ static int nl80211_del_key(struct sk_buff *skb, struct genl_info *info)
         return err;
 }
 
+/* This function returns an error or the number of nested attributes */
+static int validate_acl_mac_addrs(struct nlattr *nl_attr)
+{
+        struct nlattr *attr;
+        int n_entries = 0, tmp;
+
+        nla_for_each_nested(attr, nl_attr, tmp) {
+                if (nla_len(attr) != ETH_ALEN)
+                        return -EINVAL;
+
+                n_entries++;
+        }
+
+        return n_entries;
+}
+
+/*
+ * This function parses ACL information and allocates memory for ACL data.
+ * On successful return, the calling function is responsible to free the
+ * ACL buffer returned by this function.
+ */
+static struct cfg80211_acl_data *parse_acl_data(struct wiphy *wiphy,
+                                                struct genl_info *info)
+{
+        enum nl80211_acl_policy acl_policy;
+        struct nlattr *attr;
+        struct cfg80211_acl_data *acl;
+        int i = 0, n_entries, tmp;
+
+        if (!wiphy->max_acl_mac_addrs)
+                return ERR_PTR(-EOPNOTSUPP);
+
+        if (!info->attrs[NL80211_ATTR_ACL_POLICY])
+                return ERR_PTR(-EINVAL);
+
+        acl_policy = nla_get_u32(info->attrs[NL80211_ATTR_ACL_POLICY]);
+        if (acl_policy != NL80211_ACL_POLICY_ACCEPT_UNLESS_LISTED &&
+            acl_policy != NL80211_ACL_POLICY_DENY_UNLESS_LISTED)
+                return ERR_PTR(-EINVAL);
+
+        if (!info->attrs[NL80211_ATTR_MAC_ADDRS])
+                return ERR_PTR(-EINVAL);
+
+        n_entries = validate_acl_mac_addrs(info->attrs[NL80211_ATTR_MAC_ADDRS]);
+        if (n_entries < 0)
+                return ERR_PTR(n_entries);
+
+        if (n_entries > wiphy->max_acl_mac_addrs)
+                return ERR_PTR(-ENOTSUPP);
+
+        acl = kzalloc(sizeof(*acl) + (sizeof(struct mac_address) * n_entries),
+                      GFP_KERNEL);
+        if (!acl)
+                return ERR_PTR(-ENOMEM);
+
+        nla_for_each_nested(attr, info->attrs[NL80211_ATTR_MAC_ADDRS], tmp) {
+                memcpy(acl->mac_addrs[i].addr, nla_data(attr), ETH_ALEN);
+                i++;
+        }
+
+        acl->n_acl_entries = n_entries;
+        acl->acl_policy = acl_policy;
+
+        return acl;
+}
+
+static int nl80211_set_mac_acl(struct sk_buff *skb, struct genl_info *info)
+{
+        struct cfg80211_registered_device *rdev = info->user_ptr[0];
+        struct net_device *dev = info->user_ptr[1];
+        struct cfg80211_acl_data *acl;
+        int err;
+
+        if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
+            dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
+                return -EOPNOTSUPP;
+
+        if (!dev->ieee80211_ptr->beacon_interval)
+                return -EINVAL;
+
+        acl = parse_acl_data(&rdev->wiphy, info);
+        if (IS_ERR(acl))
+                return PTR_ERR(acl);
+
+        err = rdev_set_mac_acl(rdev, dev, acl);
+
+        kfree(acl);
+
+        return err;
+}
+
 static int nl80211_parse_beacon(struct genl_info *info,
                                 struct cfg80211_beacon_data *bcn)
 {
@@ -2608,6 +2805,7 @@ static int nl80211_start_ap(struct sk_buff *skb, struct genl_info *info)
         struct wireless_dev *wdev = dev->ieee80211_ptr;
         struct cfg80211_ap_settings params;
         int err;
+        u8 radar_detect_width = 0;
 
         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
@@ -2726,14 +2924,30 @@ static int nl80211_start_ap(struct sk_buff *skb, struct genl_info *info)
         if (!cfg80211_reg_can_beacon(&rdev->wiphy, &params.chandef))
                 return -EINVAL;
 
+        err = cfg80211_chandef_dfs_required(wdev->wiphy, &params.chandef);
+        if (err < 0)
+                return err;
+        if (err) {
+                radar_detect_width = BIT(params.chandef.width);
+                params.radar_required = true;
+        }
+
         mutex_lock(&rdev->devlist_mtx);
-        err = cfg80211_can_use_chan(rdev, wdev, params.chandef.chan,
-                                    CHAN_MODE_SHARED);
+        err = cfg80211_can_use_iftype_chan(rdev, wdev, wdev->iftype,
+                                           params.chandef.chan,
+                                           CHAN_MODE_SHARED,
+                                           radar_detect_width);
         mutex_unlock(&rdev->devlist_mtx);
 
         if (err)
                 return err;
 
+        if (info->attrs[NL80211_ATTR_ACL_POLICY]) {
+                params.acl = parse_acl_data(&rdev->wiphy, info);
+                if (IS_ERR(params.acl))
+                        return PTR_ERR(params.acl);
+        }
+
         err = rdev_start_ap(rdev, dev, &params);
         if (!err) {
                 wdev->preset_chandef = params.chandef;
@@ -2742,6 +2956,9 @@ static int nl80211_start_ap(struct sk_buff *skb, struct genl_info *info)
                 wdev->ssid_len = params.ssid_len;
                 memcpy(wdev->ssid, params.ssid, wdev->ssid_len);
         }
+
+        kfree(params.acl);
+
         return err;
 }
 
@@ -2949,12 +3166,22 @@ static int nl80211_send_station(struct sk_buff *msg, u32 portid, u32 seq,
             nla_put_u32(msg, NL80211_STA_INFO_INACTIVE_TIME,
                         sinfo->inactive_time))
                 goto nla_put_failure;
-        if ((sinfo->filled & STATION_INFO_RX_BYTES) &&
+        if ((sinfo->filled & (STATION_INFO_RX_BYTES |
+                              STATION_INFO_RX_BYTES64)) &&
             nla_put_u32(msg, NL80211_STA_INFO_RX_BYTES,
-                        sinfo->rx_bytes))
+                        (u32)sinfo->rx_bytes))
                 goto nla_put_failure;
-        if ((sinfo->filled & STATION_INFO_TX_BYTES) &&
+        if ((sinfo->filled & (STATION_INFO_TX_BYTES |
+                              NL80211_STA_INFO_TX_BYTES64)) &&
             nla_put_u32(msg, NL80211_STA_INFO_TX_BYTES,
+                        (u32)sinfo->tx_bytes))
+                goto nla_put_failure;
+        if ((sinfo->filled & STATION_INFO_RX_BYTES64) &&
+            nla_put_u64(msg, NL80211_STA_INFO_RX_BYTES64,
+                        sinfo->rx_bytes))
+                goto nla_put_failure;
+        if ((sinfo->filled & STATION_INFO_TX_BYTES64) &&
+            nla_put_u64(msg, NL80211_STA_INFO_TX_BYTES64,
                         sinfo->tx_bytes))
                 goto nla_put_failure;
         if ((sinfo->filled & STATION_INFO_LLID) &&
@@ -3182,6 +3409,63 @@ static struct net_device *get_vlan(struct genl_info *info,
         return ERR_PTR(ret);
 }
 
+static struct nla_policy
+nl80211_sta_wme_policy[NL80211_STA_WME_MAX + 1] __read_mostly = {
+        [NL80211_STA_WME_UAPSD_QUEUES] = { .type = NLA_U8 },
+        [NL80211_STA_WME_MAX_SP] = { .type = NLA_U8 },
+};
+
+static int nl80211_set_station_tdls(struct genl_info *info,
+                                    struct station_parameters *params)
+{
+        struct cfg80211_registered_device *rdev = info->user_ptr[0];
+        struct nlattr *tb[NL80211_STA_WME_MAX + 1];
+        struct nlattr *nla;
+        int err;
+
+        /* Can only set if TDLS ... */
+        if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS))
+                return -EOPNOTSUPP;
+
+        /* ... with external setup is supported */
+        if (!(rdev->wiphy.flags & WIPHY_FLAG_TDLS_EXTERNAL_SETUP))
+                return -EOPNOTSUPP;
+
+        /* Dummy STA entry gets updated once the peer capabilities are known */
+        if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
+                params->ht_capa =
+                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
+        if (info->attrs[NL80211_ATTR_VHT_CAPABILITY])
+                params->vht_capa =
+                        nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]);
+
+        /* parse WME attributes if present */
+        if (!info->attrs[NL80211_ATTR_STA_WME])
+                return 0;
+
+        nla = info->attrs[NL80211_ATTR_STA_WME];
+        err = nla_parse_nested(tb, NL80211_STA_WME_MAX, nla,
+                               nl80211_sta_wme_policy);
+        if (err)
+                return err;
+
+        if (tb[NL80211_STA_WME_UAPSD_QUEUES])
+                params->uapsd_queues = nla_get_u8(
+                        tb[NL80211_STA_WME_UAPSD_QUEUES]);
+        if (params->uapsd_queues & ~IEEE80211_WMM_IE_STA_QOSINFO_AC_MASK)
+                return -EINVAL;
+
+        if (tb[NL80211_STA_WME_MAX_SP])
+                params->max_sp = nla_get_u8(tb[NL80211_STA_WME_MAX_SP]);
+
+        if (params->max_sp & ~IEEE80211_WMM_IE_STA_QOSINFO_SP_MASK)
+                return -EINVAL;
+
+        params->sta_modify_mask |= STATION_PARAM_APPLY_UAPSD;
+
+        return 0;
+}
+
 static int nl80211_set_station(struct sk_buff *skb, struct genl_info *info)
 {
         struct cfg80211_registered_device *rdev = info->user_ptr[0];
@@ -3210,8 +3494,20 @@ static int nl80211_set_station(struct sk_buff *skb, struct genl_info *info)
                         nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
         }
 
-        if (info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL] ||
-            info->attrs[NL80211_ATTR_HT_CAPABILITY])
+        if (info->attrs[NL80211_ATTR_STA_CAPABILITY]) {
+                params.capability =
+                        nla_get_u16(info->attrs[NL80211_ATTR_STA_CAPABILITY]);
+                params.sta_modify_mask |= STATION_PARAM_APPLY_CAPABILITY;
+        }
+
+        if (info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]) {
+                params.ext_capab =
+                        nla_data(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
+                params.ext_capab_len =
+                        nla_len(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
+        }
+
+        if (info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
                 return -EINVAL;
 
         if (!rdev->ops->change_station)
@@ -3280,6 +3576,13 @@ static int nl80211_set_station(struct sk_buff *skb, struct genl_info *info)
                 /* reject other things that can't change */
                 if (params.supported_rates)
                         return -EINVAL;
+                if (info->attrs[NL80211_ATTR_STA_CAPABILITY])
+                        return -EINVAL;
+                if (info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY])
+                        return -EINVAL;
+                if (info->attrs[NL80211_ATTR_HT_CAPABILITY] ||
+                    info->attrs[NL80211_ATTR_VHT_CAPABILITY])
+                        return -EINVAL;
 
                 /* must be last in here for error handling */
                 params.vlan = get_vlan(info, rdev);
@@ -3295,13 +3598,29 @@ static int nl80211_set_station(struct sk_buff *skb, struct genl_info *info)
                  * to change the flag.
                  */
                 params.sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
-                /* fall through */
+                /* Include parameters for TDLS peer (driver will check) */
+                err = nl80211_set_station_tdls(info, &params);
+                if (err)
+                        return err;
+                /* disallow things sta doesn't support */
+                if (params.plink_action)
+                        return -EINVAL;
+                if (params.local_pm)
+                        return -EINVAL;
+                /* reject any changes other than AUTHORIZED or WME (for TDLS) */
+                if (params.sta_flags_mask & ~(BIT(NL80211_STA_FLAG_AUTHORIZED) |
+                                              BIT(NL80211_STA_FLAG_WME)))
+                        return -EINVAL;
+                break;
         case NL80211_IFTYPE_ADHOC:
                 /* disallow things sta doesn't support */
                 if (params.plink_action)
                         return -EINVAL;
                 if (params.local_pm)
                         return -EINVAL;
+                if (info->attrs[NL80211_ATTR_HT_CAPABILITY] ||
+                    info->attrs[NL80211_ATTR_VHT_CAPABILITY])
+                        return -EINVAL;
                 /* reject any changes other than AUTHORIZED */
                 if (params.sta_flags_mask & ~BIT(NL80211_STA_FLAG_AUTHORIZED))
                         return -EINVAL;
@@ -3312,6 +3631,13 @@ static int nl80211_set_station(struct sk_buff *skb, struct genl_info *info)
                         return -EINVAL;
                 if (params.supported_rates)
                         return -EINVAL;
+                if (info->attrs[NL80211_ATTR_STA_CAPABILITY])
+                        return -EINVAL;
+                if (info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY])
+                        return -EINVAL;
+                if (info->attrs[NL80211_ATTR_HT_CAPABILITY] ||
+                    info->attrs[NL80211_ATTR_VHT_CAPABILITY])
+                        return -EINVAL;
                 /*
                  * No special handling for TDLS here -- the userspace
                  * mesh code doesn't have this bug.
@@ -3336,12 +3662,6 @@ static int nl80211_set_station(struct sk_buff *skb, struct genl_info *info)
         return err;
 }
 
-static struct nla_policy
-nl80211_sta_wme_policy[NL80211_STA_WME_MAX + 1] __read_mostly = {
-        [NL80211_STA_WME_UAPSD_QUEUES] = { .type = NLA_U8 },
-        [NL80211_STA_WME_MAX_SP] = { .type = NLA_U8 },
-};
-
 static int nl80211_new_station(struct sk_buff *skb, struct genl_info *info)
 {
         struct cfg80211_registered_device *rdev = info->user_ptr[0];
@@ -3376,6 +3696,19 @@ static int nl80211_new_station(struct sk_buff *skb, struct genl_info *info)
         if (!params.aid || params.aid > IEEE80211_MAX_AID)
                 return -EINVAL;
 
+        if (info->attrs[NL80211_ATTR_STA_CAPABILITY]) {
+                params.capability =
+                        nla_get_u16(info->attrs[NL80211_ATTR_STA_CAPABILITY]);
+                params.sta_modify_mask |= STATION_PARAM_APPLY_CAPABILITY;
+        }
+
+        if (info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]) {
+                params.ext_capab =
+                        nla_data(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
+                params.ext_capab_len =
+                        nla_len(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
+        }
+
         if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
                 params.ht_capa =
                         nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
@@ -4869,6 +5202,54 @@ static int nl80211_stop_sched_scan(struct sk_buff *skb,
         return err;
 }
 
+static int nl80211_start_radar_detection(struct sk_buff *skb,
+                                         struct genl_info *info)
+{
+        struct cfg80211_registered_device *rdev = info->user_ptr[0];
+        struct net_device *dev = info->user_ptr[1];
+        struct wireless_dev *wdev = dev->ieee80211_ptr;
+        struct cfg80211_chan_def chandef;
+        int err;
+
+        err = nl80211_parse_chandef(rdev, info, &chandef);
+        if (err)
+                return err;
+
+        if (wdev->cac_started)
+                return -EBUSY;
+
+        err = cfg80211_chandef_dfs_required(wdev->wiphy, &chandef);
+        if (err < 0)
+                return err;
+
+        if (err == 0)
+                return -EINVAL;
+
+        if (chandef.chan->dfs_state != NL80211_DFS_USABLE)
+                return -EINVAL;
+
+        if (!rdev->ops->start_radar_detection)
+                return -EOPNOTSUPP;
+
+        mutex_lock(&rdev->devlist_mtx);
+        err = cfg80211_can_use_iftype_chan(rdev, wdev, wdev->iftype,
+                                           chandef.chan, CHAN_MODE_SHARED,
+                                           BIT(chandef.width));
+        if (err)
+                goto err_locked;
+
+        err = rdev->ops->start_radar_detection(&rdev->wiphy, dev, &chandef);
+        if (!err) {
+                wdev->channel = chandef.chan;
+                wdev->cac_started = true;
+                wdev->cac_start_time = jiffies;
+        }
+err_locked:
+        mutex_unlock(&rdev->devlist_mtx);
+
+        return err;
+}
+
 static int nl80211_send_bss(struct sk_buff *msg, struct netlink_callback *cb,
                             u32 seq, int flags,
                             struct cfg80211_registered_device *rdev,
@@ -4879,6 +5260,7 @@ static int nl80211_send_bss(struct sk_buff *msg, struct netlink_callback *cb,
         const struct cfg80211_bss_ies *ies;
         void *hdr;
         struct nlattr *bss;
+        bool tsf = false;
 
         ASSERT_WDEV_LOCK(wdev);
 
@@ -4902,22 +5284,24 @@ static int nl80211_send_bss(struct sk_buff *msg, struct netlink_callback *cb,
 
         rcu_read_lock();
         ies = rcu_dereference(res->ies);
-        if (ies && ies->len && nla_put(msg, NL80211_BSS_INFORMATION_ELEMENTS,
-                                       ies->len, ies->data)) {
-                rcu_read_unlock();
-                goto nla_put_failure;
+        if (ies) {
+                if (nla_put_u64(msg, NL80211_BSS_TSF, ies->tsf))
+                        goto fail_unlock_rcu;
+                tsf = true;
+                if (ies->len && nla_put(msg, NL80211_BSS_INFORMATION_ELEMENTS,
+                                        ies->len, ies->data))
+                        goto fail_unlock_rcu;
         }
         ies = rcu_dereference(res->beacon_ies);
-        if (ies && ies->len && nla_put(msg, NL80211_BSS_BEACON_IES,
-                                       ies->len, ies->data)) {
-                rcu_read_unlock();
-                goto nla_put_failure;
+        if (ies) {
+                if (!tsf && nla_put_u64(msg, NL80211_BSS_TSF, ies->tsf))
+                        goto fail_unlock_rcu;
+                if (ies->len && nla_put(msg, NL80211_BSS_BEACON_IES,
+                                        ies->len, ies->data))
+                        goto fail_unlock_rcu;
         }
         rcu_read_unlock();
 
-        if (res->tsf &&
-            nla_put_u64(msg, NL80211_BSS_TSF, res->tsf))
-                goto nla_put_failure;
         if (res->beacon_interval &&
             nla_put_u16(msg, NL80211_BSS_BEACON_INTERVAL, res->beacon_interval))
                 goto nla_put_failure;
@@ -4962,6 +5346,8 @@ static int nl80211_send_bss(struct sk_buff *msg, struct netlink_callback *cb,
 
         return genlmsg_end(msg, hdr);
 
+ fail_unlock_rcu:
+        rcu_read_unlock();
  nla_put_failure:
         genlmsg_cancel(msg, hdr);
         return -EMSGSIZE;
@@ -6772,16 +7158,100 @@ static int nl80211_leave_mesh(struct sk_buff *skb, struct genl_info *info)
 }
 
 #ifdef CONFIG_PM
+static int nl80211_send_wowlan_patterns(struct sk_buff *msg,
+                                        struct cfg80211_registered_device *rdev)
+{
+        struct nlattr *nl_pats, *nl_pat;
+        int i, pat_len;
+
+        if (!rdev->wowlan->n_patterns)
+                return 0;
+
+        nl_pats = nla_nest_start(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN);
+        if (!nl_pats)
+                return -ENOBUFS;
+
+        for (i = 0; i < rdev->wowlan->n_patterns; i++) {
+                nl_pat = nla_nest_start(msg, i + 1);
+                if (!nl_pat)
+                        return -ENOBUFS;
+                pat_len = rdev->wowlan->patterns[i].pattern_len;
+                if (nla_put(msg, NL80211_WOWLAN_PKTPAT_MASK,
+                            DIV_ROUND_UP(pat_len, 8),
+                            rdev->wowlan->patterns[i].mask) ||
+                    nla_put(msg, NL80211_WOWLAN_PKTPAT_PATTERN,
+                            pat_len, rdev->wowlan->patterns[i].pattern) ||
+                    nla_put_u32(msg, NL80211_WOWLAN_PKTPAT_OFFSET,
+                                rdev->wowlan->patterns[i].pkt_offset))
+                        return -ENOBUFS;
+                nla_nest_end(msg, nl_pat);
+        }
+        nla_nest_end(msg, nl_pats);
+
+        return 0;
+}
+
+static int nl80211_send_wowlan_tcp(struct sk_buff *msg,
+                                   struct cfg80211_wowlan_tcp *tcp)
+{
+        struct nlattr *nl_tcp;
+
+        if (!tcp)
+                return 0;
+
+        nl_tcp = nla_nest_start(msg, NL80211_WOWLAN_TRIG_TCP_CONNECTION);
+        if (!nl_tcp)
+                return -ENOBUFS;
+
+        if (nla_put_be32(msg, NL80211_WOWLAN_TCP_SRC_IPV4, tcp->src) ||
+            nla_put_be32(msg, NL80211_WOWLAN_TCP_DST_IPV4, tcp->dst) ||
+            nla_put(msg, NL80211_WOWLAN_TCP_DST_MAC, ETH_ALEN, tcp->dst_mac) ||
+            nla_put_u16(msg, NL80211_WOWLAN_TCP_SRC_PORT, tcp->src_port) ||
+            nla_put_u16(msg, NL80211_WOWLAN_TCP_DST_PORT, tcp->dst_port) ||
+            nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD,
+                    tcp->payload_len, tcp->payload) ||
+            nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_INTERVAL,
+                        tcp->data_interval) ||
+            nla_put(msg, NL80211_WOWLAN_TCP_WAKE_PAYLOAD,
+                    tcp->wake_len, tcp->wake_data) ||
+            nla_put(msg, NL80211_WOWLAN_TCP_WAKE_MASK,
+                    DIV_ROUND_UP(tcp->wake_len, 8), tcp->wake_mask))
+                return -ENOBUFS;
+
+        if (tcp->payload_seq.len &&
+            nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ,
+                    sizeof(tcp->payload_seq), &tcp->payload_seq))
+                return -ENOBUFS;
+
+        if (tcp->payload_tok.len &&
+            nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN,
+                    sizeof(tcp->payload_tok) + tcp->tokens_size,
+                    &tcp->payload_tok))
+                return -ENOBUFS;
+
+        return 0;
+}
+
 static int nl80211_get_wowlan(struct sk_buff *skb, struct genl_info *info)
 {
         struct cfg80211_registered_device *rdev = info->user_ptr[0];
         struct sk_buff *msg;
         void *hdr;
+        u32 size = NLMSG_DEFAULT_SIZE;
 
-        if (!rdev->wiphy.wowlan.flags && !rdev->wiphy.wowlan.n_patterns)
+        if (!rdev->wiphy.wowlan.flags && !rdev->wiphy.wowlan.n_patterns &&
+            !rdev->wiphy.wowlan.tcp)
                 return -EOPNOTSUPP;
 
-        msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
+        if (rdev->wowlan && rdev->wowlan->tcp) {
+                /* adjust size to have room for all the data */
+                size += rdev->wowlan->tcp->tokens_size +
+                        rdev->wowlan->tcp->payload_len +
+                        rdev->wowlan->tcp->wake_len +
+                        rdev->wowlan->tcp->wake_len / 8;
+        }
+
+        msg = nlmsg_new(size, GFP_KERNEL);
         if (!msg)
                 return -ENOMEM;
 
@@ -6812,31 +7282,12 @@ static int nl80211_get_wowlan(struct sk_buff *skb, struct genl_info *info)
                     (rdev->wowlan->rfkill_release &&
                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE)))
                         goto nla_put_failure;
-                if (rdev->wowlan->n_patterns) {
-                        struct nlattr *nl_pats, *nl_pat;
-                        int i, pat_len;
 
-                        nl_pats = nla_nest_start(msg,
-                                        NL80211_WOWLAN_TRIG_PKT_PATTERN);
-                        if (!nl_pats)
-                                goto nla_put_failure;
+                if (nl80211_send_wowlan_patterns(msg, rdev))
+                        goto nla_put_failure;
 
-                        for (i = 0; i < rdev->wowlan->n_patterns; i++) {
-                                nl_pat = nla_nest_start(msg, i + 1);
-                                if (!nl_pat)
-                                        goto nla_put_failure;
-                                pat_len = rdev->wowlan->patterns[i].pattern_len;
-                                if (nla_put(msg, NL80211_WOWLAN_PKTPAT_MASK,
-                                            DIV_ROUND_UP(pat_len, 8),
-                                            rdev->wowlan->patterns[i].mask) ||
-                                    nla_put(msg, NL80211_WOWLAN_PKTPAT_PATTERN,
-                                            pat_len,
-                                            rdev->wowlan->patterns[i].pattern))
-                                        goto nla_put_failure;
-                                nla_nest_end(msg, nl_pat);
-                        }
-                        nla_nest_end(msg, nl_pats);
-                }
+                if (nl80211_send_wowlan_tcp(msg, rdev->wowlan->tcp))
+                        goto nla_put_failure;
 
                 nla_nest_end(msg, nl_wowlan);
         }
@@ -6849,6 +7300,150 @@ nla_put_failure:
         return -ENOBUFS;
 }
 
+static int nl80211_parse_wowlan_tcp(struct cfg80211_registered_device *rdev,
+                                    struct nlattr *attr,
+                                    struct cfg80211_wowlan *trig)
+{
+        struct nlattr *tb[NUM_NL80211_WOWLAN_TCP];
+        struct cfg80211_wowlan_tcp *cfg;
+        struct nl80211_wowlan_tcp_data_token *tok = NULL;
+        struct nl80211_wowlan_tcp_data_seq *seq = NULL;
+        u32 size;
+        u32 data_size, wake_size, tokens_size = 0, wake_mask_size;
+        int err, port;
+
+        if (!rdev->wiphy.wowlan.tcp)
+                return -EINVAL;
+
+        err = nla_parse(tb, MAX_NL80211_WOWLAN_TCP,
+                        nla_data(attr), nla_len(attr),
+                        nl80211_wowlan_tcp_policy);
+        if (err)
+                return err;
+
+        if (!tb[NL80211_WOWLAN_TCP_SRC_IPV4] ||
+            !tb[NL80211_WOWLAN_TCP_DST_IPV4] ||
+            !tb[NL80211_WOWLAN_TCP_DST_MAC] ||
+            !tb[NL80211_WOWLAN_TCP_DST_PORT] ||
+            !tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD] ||
+            !tb[NL80211_WOWLAN_TCP_DATA_INTERVAL] ||
+            !tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD] ||
+            !tb[NL80211_WOWLAN_TCP_WAKE_MASK])
+                return -EINVAL;
+
+        data_size = nla_len(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD]);
+        if (data_size > rdev->wiphy.wowlan.tcp->data_payload_max)
+                return -EINVAL;
+
+        if (nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]) >
+                        rdev->wiphy.wowlan.tcp->data_interval_max)
+                return -EINVAL;
+
+        wake_size = nla_len(tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD]);
+        if (wake_size > rdev->wiphy.wowlan.tcp->wake_payload_max)
+                return -EINVAL;
+
+        wake_mask_size = nla_len(tb[NL80211_WOWLAN_TCP_WAKE_MASK]);
+        if (wake_mask_size != DIV_ROUND_UP(wake_size, 8))
+                return -EINVAL;
+
+        if (tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]) {
+                u32 tokln = nla_len(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]);
+
+                tok = nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]);
+                tokens_size = tokln - sizeof(*tok);
+
+                if (!tok->len || tokens_size % tok->len)
+                        return -EINVAL;
+                if (!rdev->wiphy.wowlan.tcp->tok)
+                        return -EINVAL;
+                if (tok->len > rdev->wiphy.wowlan.tcp->tok->max_len)
+                        return -EINVAL;
+                if (tok->len < rdev->wiphy.wowlan.tcp->tok->min_len)
+                        return -EINVAL;
+                if (tokens_size > rdev->wiphy.wowlan.tcp->tok->bufsize)
+                        return -EINVAL;
+                if (tok->offset + tok->len > data_size)
+                        return -EINVAL;
+        }
+
+        if (tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ]) {
+                seq = nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ]);
+                if (!rdev->wiphy.wowlan.tcp->seq)
+                        return -EINVAL;
+                if (seq->len == 0 || seq->len > 4)
+                        return -EINVAL;
+                if (seq->len + seq->offset > data_size)
+                        return -EINVAL;
+        }
+
+        size = sizeof(*cfg);
+        size += data_size;
+        size += wake_size + wake_mask_size;
+        size += tokens_size;
+
+        cfg = kzalloc(size, GFP_KERNEL);
+        if (!cfg)
+                return -ENOMEM;
+        cfg->src = nla_get_be32(tb[NL80211_WOWLAN_TCP_SRC_IPV4]);
+        cfg->dst = nla_get_be32(tb[NL80211_WOWLAN_TCP_DST_IPV4]);
+        memcpy(cfg->dst_mac, nla_data(tb[NL80211_WOWLAN_TCP_DST_MAC]),
+               ETH_ALEN);
+        if (tb[NL80211_WOWLAN_TCP_SRC_PORT])
+                port = nla_get_u16(tb[NL80211_WOWLAN_TCP_SRC_PORT]);
+        else
+                port = 0;
+#ifdef CONFIG_INET
+        /* allocate a socket and port for it and use it */
+        err = __sock_create(wiphy_net(&rdev->wiphy), PF_INET, SOCK_STREAM,
+                            IPPROTO_TCP, &cfg->sock, 1);
+        if (err) {
+                kfree(cfg);
+                return err;
+        }
+        if (inet_csk_get_port(cfg->sock->sk, port)) {
+                sock_release(cfg->sock);
+                kfree(cfg);
+                return -EADDRINUSE;
+        }
+        cfg->src_port = inet_sk(cfg->sock->sk)->inet_num;
+#else
+        if (!port) {
+                kfree(cfg);
+                return -EINVAL;
+        }
+        cfg->src_port = port;
+#endif
+
+        cfg->dst_port = nla_get_u16(tb[NL80211_WOWLAN_TCP_DST_PORT]);
+        cfg->payload_len = data_size;
+        cfg->payload = (u8 *)cfg + sizeof(*cfg) + tokens_size;
+        memcpy((void *)cfg->payload,
+               nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD]),
+               data_size);
+        if (seq)
+                cfg->payload_seq = *seq;
+        cfg->data_interval = nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]);
+        cfg->wake_len = wake_size;
+        cfg->wake_data = (u8 *)cfg + sizeof(*cfg) + tokens_size + data_size;
+        memcpy((void *)cfg->wake_data,
+               nla_data(tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD]),
+               wake_size);
+        cfg->wake_mask = (u8 *)cfg + sizeof(*cfg) + tokens_size +
+                         data_size + wake_size;
+        memcpy((void *)cfg->wake_mask,
+               nla_data(tb[NL80211_WOWLAN_TCP_WAKE_MASK]),
+               wake_mask_size);
+        if (tok) {
+                cfg->tokens_size = tokens_size;
+                memcpy(&cfg->payload_tok, tok, sizeof(*tok) + tokens_size);
+        }
+
+        trig->tcp = cfg;
+
+        return 0;
+}
+
 static int nl80211_set_wowlan(struct sk_buff *skb, struct genl_info *info)
 {
         struct cfg80211_registered_device *rdev = info->user_ptr[0];
@@ -6859,7 +7454,8 @@ static int nl80211_set_wowlan(struct sk_buff *skb, struct genl_info *info)
         int err, i;
         bool prev_enabled = rdev->wowlan;
 
-        if (!rdev->wiphy.wowlan.flags && !rdev->wiphy.wowlan.n_patterns)
+        if (!rdev->wiphy.wowlan.flags && !rdev->wiphy.wowlan.n_patterns &&
+            !rdev->wiphy.wowlan.tcp)
                 return -EOPNOTSUPP;
 
         if (!info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS]) {
@@ -6923,7 +7519,7 @@ static int nl80211_set_wowlan(struct sk_buff *skb, struct genl_info *info)
         if (tb[NL80211_WOWLAN_TRIG_PKT_PATTERN]) {
                 struct nlattr *pat;
                 int n_patterns = 0;
-                int rem, pat_len, mask_len;
+                int rem, pat_len, mask_len, pkt_offset;
                 struct nlattr *pat_tb[NUM_NL80211_WOWLAN_PKTPAT];
 
                 nla_for_each_nested(pat, tb[NL80211_WOWLAN_TRIG_PKT_PATTERN],
@@ -6958,6 +7554,15 @@ static int nl80211_set_wowlan(struct sk_buff *skb, struct genl_info *info)
                             pat_len < wowlan->pattern_min_len)
                                 goto error;
 
+                        if (!pat_tb[NL80211_WOWLAN_PKTPAT_OFFSET])
+                                pkt_offset = 0;
+                        else
+                                pkt_offset = nla_get_u32(
+                                        pat_tb[NL80211_WOWLAN_PKTPAT_OFFSET]);
+                        if (pkt_offset > wowlan->max_pkt_offset)
+                                goto error;
+                        new_triggers.patterns[i].pkt_offset = pkt_offset;
+
                         new_triggers.patterns[i].mask =
                                 kmalloc(mask_len + pat_len, GFP_KERNEL);
                         if (!new_triggers.patterns[i].mask) {
@@ -6977,6 +7582,14 @@ static int nl80211_set_wowlan(struct sk_buff *skb, struct genl_info *info)
                 }
         }
 
+        if (tb[NL80211_WOWLAN_TRIG_TCP_CONNECTION]) {
+                err = nl80211_parse_wowlan_tcp(
+                        rdev, tb[NL80211_WOWLAN_TRIG_TCP_CONNECTION],
+                        &new_triggers);
+                if (err)
+                        goto error;
+        }
+
         ntrig = kmemdup(&new_triggers, sizeof(new_triggers), GFP_KERNEL);
         if (!ntrig) {
                 err = -ENOMEM;
@@ -6994,6 +7607,9 @@ static int nl80211_set_wowlan(struct sk_buff *skb, struct genl_info *info)
         for (i = 0; i < new_triggers.n_patterns; i++)
                 kfree(new_triggers.patterns[i].mask);
         kfree(new_triggers.patterns);
+        if (new_triggers.tcp && new_triggers.tcp->sock)
+                sock_release(new_triggers.tcp->sock);
+        kfree(new_triggers.tcp);
         return err;
 }
 #endif
@@ -7876,6 +8492,22 @@ static struct genl_ops nl80211_ops[] = {
                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
                                   NL80211_FLAG_NEED_RTNL,
         },
+        {
+                .cmd = NL80211_CMD_SET_MAC_ACL,
+                .doit = nl80211_set_mac_acl,
+                .policy = nl80211_policy,
+                .flags = GENL_ADMIN_PERM,
+                .internal_flags = NL80211_FLAG_NEED_NETDEV |
+                                  NL80211_FLAG_NEED_RTNL,
+        },
+        {
+                .cmd = NL80211_CMD_RADAR_DETECT,
+                .doit = nl80211_start_radar_detection,
+                .policy = nl80211_policy,
+                .flags = GENL_ADMIN_PERM,
+                .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
+                                  NL80211_FLAG_NEED_RTNL,
+        },
 };
 
 static struct genl_multicast_group nl80211_mlme_mcgrp = {
@@ -9073,6 +9705,57 @@ nl80211_send_cqm_txe_notify(struct cfg80211_registered_device *rdev,
 }
 
 void
+nl80211_radar_notify(struct cfg80211_registered_device *rdev,
+                     struct cfg80211_chan_def *chandef,
+                     enum nl80211_radar_event event,
+                     struct net_device *netdev, gfp_t gfp)
+{
+        struct sk_buff *msg;
+        void *hdr;
+
+        msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
+        if (!msg)
+                return;
+
+        hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_RADAR_DETECT);
+        if (!hdr) {
+                nlmsg_free(msg);
+                return;
+        }
+
+        if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx))
+                goto nla_put_failure;
+
+        /* NOP and radar events don't need a netdev parameter */
+        if (netdev) {
+                struct wireless_dev *wdev = netdev->ieee80211_ptr;
+
+                if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
+                    nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)))
+                        goto nla_put_failure;
+        }
+
+        if (nla_put_u32(msg, NL80211_ATTR_RADAR_EVENT, event))
+                goto nla_put_failure;
+
+        if (nl80211_send_chandef(msg, chandef))
+                goto nla_put_failure;
+
+        if (genlmsg_end(msg, hdr) < 0) {
+                nlmsg_free(msg);
+                return;
+        }
+
+        genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
+                                nl80211_mlme_mcgrp.id, gfp);
+        return;
+
+ nla_put_failure:
+        genlmsg_cancel(msg, hdr);
+        nlmsg_free(msg);
+}
+
+void
 nl80211_send_cqm_pktloss_notify(struct cfg80211_registered_device *rdev,
                                 struct net_device *netdev, const u8 *peer,
                                 u32 num_packets, gfp_t gfp)
@@ -9207,6 +9890,114 @@ void cfg80211_report_obss_beacon(struct wiphy *wiphy,
 }
 EXPORT_SYMBOL(cfg80211_report_obss_beacon);
 
+#ifdef CONFIG_PM
+void cfg80211_report_wowlan_wakeup(struct wireless_dev *wdev,
+                                   struct cfg80211_wowlan_wakeup *wakeup,
+                                   gfp_t gfp)
+{
+        struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
+        struct sk_buff *msg;
+        void *hdr;
+        int err, size = 200;
+
+        trace_cfg80211_report_wowlan_wakeup(wdev->wiphy, wdev, wakeup);
+
+        if (wakeup)
+                size += wakeup->packet_present_len;
+
+        msg = nlmsg_new(size, gfp);
+        if (!msg)
+                return;
+
+        hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_SET_WOWLAN);
+        if (!hdr)
+                goto free_msg;
+
+        if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
+            nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)))
+                goto free_msg;
+
+        if (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
+                                        wdev->netdev->ifindex))
+                goto free_msg;
+
+        if (wakeup) {
+                struct nlattr *reasons;
+
+                reasons = nla_nest_start(msg, NL80211_ATTR_WOWLAN_TRIGGERS);
+
+                if (wakeup->disconnect &&
+                    nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT))
+                        goto free_msg;
+                if (wakeup->magic_pkt &&
+                    nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT))
+                        goto free_msg;
+                if (wakeup->gtk_rekey_failure &&
+                    nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE))
+                        goto free_msg;
+                if (wakeup->eap_identity_req &&
+                    nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST))
+                        goto free_msg;
+                if (wakeup->four_way_handshake &&
+                    nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE))
+                        goto free_msg;
+                if (wakeup->rfkill_release &&
+                    nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE))
+                        goto free_msg;
+
+                if (wakeup->pattern_idx >= 0 &&
+                    nla_put_u32(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN,
+                                wakeup->pattern_idx))
+                        goto free_msg;
+
+                if (wakeup->tcp_match)
+                        nla_put_flag(msg, NL80211_WOWLAN_TRIG_WAKEUP_TCP_MATCH);
+
+                if (wakeup->tcp_connlost)
+                        nla_put_flag(msg,
+                                     NL80211_WOWLAN_TRIG_WAKEUP_TCP_CONNLOST);
+
+                if (wakeup->tcp_nomoretokens)
+                        nla_put_flag(msg,
+                                NL80211_WOWLAN_TRIG_WAKEUP_TCP_NOMORETOKENS);
+
+                if (wakeup->packet) {
+                        u32 pkt_attr = NL80211_WOWLAN_TRIG_WAKEUP_PKT_80211;
+                        u32 len_attr = NL80211_WOWLAN_TRIG_WAKEUP_PKT_80211_LEN;
+
+                        if (!wakeup->packet_80211) {
+                                pkt_attr =
+                                        NL80211_WOWLAN_TRIG_WAKEUP_PKT_8023;
+                                len_attr =
+                                        NL80211_WOWLAN_TRIG_WAKEUP_PKT_8023_LEN;
+                        }
+
+                        if (wakeup->packet_len &&
+                            nla_put_u32(msg, len_attr, wakeup->packet_len))
+                                goto free_msg;
+
+                        if (nla_put(msg, pkt_attr, wakeup->packet_present_len,
+                                    wakeup->packet))
+                                goto free_msg;
+                }
+
+                nla_nest_end(msg, reasons);
+        }
+
+        err = genlmsg_end(msg, hdr);
+        if (err < 0)
+                goto free_msg;
+
+        genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
+                                nl80211_mlme_mcgrp.id, gfp);
+        return;
+
+ free_msg:
+        nlmsg_free(msg);
+}
+EXPORT_SYMBOL(cfg80211_report_wowlan_wakeup);
+#endif
+
 void cfg80211_tdls_oper_request(struct net_device *dev, const u8 *peer,
                                 enum nl80211_tdls_operation oper,
                                 u16 reason_code, gfp_t gfp)
diff --git a/net/wireless/nl80211.h b/net/wireless/nl80211.h
index 2acba8477e9d..b061da4919e1 100644
--- a/net/wireless/nl80211.h
+++ b/net/wireless/nl80211.h
@@ -108,6 +108,13 @@ nl80211_send_cqm_rssi_notify(struct cfg80211_registered_device *rdev,
                              struct net_device *netdev,
                              enum nl80211_cqm_rssi_threshold_event rssi_event,
                              gfp_t gfp);
+
+void
+nl80211_radar_notify(struct cfg80211_registered_device *rdev,
+                     struct cfg80211_chan_def *chandef,
+                     enum nl80211_radar_event event,
+                     struct net_device *netdev, gfp_t gfp);
+
 void
 nl80211_send_cqm_pktloss_notify(struct cfg80211_registered_device *rdev,
                                 struct net_device *netdev, const u8 *peer,
diff --git a/net/wireless/rdev-ops.h b/net/wireless/rdev-ops.h
index 6c0c8191f837..422d38291d66 100644
--- a/net/wireless/rdev-ops.h
+++ b/net/wireless/rdev-ops.h
@@ -875,4 +875,16 @@ static inline void rdev_stop_p2p_device(struct cfg80211_registered_device *rdev,
         rdev->ops->stop_p2p_device(&rdev->wiphy, wdev);
         trace_rdev_return_void(&rdev->wiphy);
 }                                       
+
+static inline int rdev_set_mac_acl(struct cfg80211_registered_device *rdev,
+                                   struct net_device *dev,
+                                   struct cfg80211_acl_data *params)
+{
+        int ret;
+
+        trace_rdev_set_mac_acl(&rdev->wiphy, dev, params);
+        ret = rdev->ops->set_mac_acl(&rdev->wiphy, dev, params);
+        trace_rdev_return_int(&rdev->wiphy, ret);
+        return ret;
+}
 #endif /* __CFG80211_RDEV_OPS */
diff --git a/net/wireless/reg.c b/net/wireless/reg.c
index de02d633c212..98532c00242d 100644
--- a/net/wireless/reg.c
+++ b/net/wireless/reg.c
@@ -866,6 +866,10 @@ static void handle_channel(struct wiphy *wiphy,
 
         if (freq_range->max_bandwidth_khz < MHZ_TO_KHZ(40))
                 bw_flags = IEEE80211_CHAN_NO_HT40;
+        if (freq_range->max_bandwidth_khz < MHZ_TO_KHZ(80))
+                bw_flags |= IEEE80211_CHAN_NO_80MHZ;
+        if (freq_range->max_bandwidth_khz < MHZ_TO_KHZ(160))
+                bw_flags |= IEEE80211_CHAN_NO_160MHZ;
 
         if (lr->initiator == NL80211_REGDOM_SET_BY_DRIVER &&
             request_wiphy && request_wiphy == wiphy &&
@@ -884,6 +888,9 @@ static void handle_channel(struct wiphy *wiphy,
                 return;
         }
 
+        chan->dfs_state = NL80211_DFS_USABLE;
+        chan->dfs_state_entered = jiffies;
+
         chan->beacon_found = false;
         chan->flags = flags | bw_flags | map_regdom_flags(reg_rule->flags);
         chan->max_antenna_gain =
@@ -1261,6 +1268,10 @@ static void handle_channel_custom(struct wiphy *wiphy,
 
         if (freq_range->max_bandwidth_khz < MHZ_TO_KHZ(40))
                 bw_flags = IEEE80211_CHAN_NO_HT40;
+        if (freq_range->max_bandwidth_khz < MHZ_TO_KHZ(80))
+                bw_flags |= IEEE80211_CHAN_NO_80MHZ;
+        if (freq_range->max_bandwidth_khz < MHZ_TO_KHZ(160))
+                bw_flags |= IEEE80211_CHAN_NO_160MHZ;
 
         chan->flags |= map_regdom_flags(reg_rule->flags) | bw_flags;
         chan->max_antenna_gain = (int) MBI_TO_DBI(power_rule->max_antenna_gain);
@@ -2189,10 +2200,15 @@ static int __set_regdom(const struct ieee80211_regdomain *rd)
                  * However if a driver requested this specific regulatory
                  * domain we keep it for its private use
                  */
-                if (lr->initiator == NL80211_REGDOM_SET_BY_DRIVER)
+                if (lr->initiator == NL80211_REGDOM_SET_BY_DRIVER) {
+                        const struct ieee80211_regdomain *tmp;
+
+                        tmp = get_wiphy_regdom(request_wiphy);
                         rcu_assign_pointer(request_wiphy->regd, rd);
-                else
+                        rcu_free_regdom(tmp);
+                } else {
                         kfree(rd);
+                }
 
                 rd = NULL;
 
diff --git a/net/wireless/scan.c b/net/wireless/scan.c
index 01592d7d4789..674aadca0079 100644
--- a/net/wireless/scan.c
+++ b/net/wireless/scan.c
@@ -19,55 +19,142 @@
 #include "wext-compat.h"
 #include "rdev-ops.h"
 
+/**
+ * DOC: BSS tree/list structure
+ *
+ * At the top level, the BSS list is kept in both a list in each
+ * registered device (@bss_list) as well as an RB-tree for faster
+ * lookup. In the RB-tree, entries can be looked up using their
+ * channel, MESHID, MESHCONF (for MBSSes) or channel, BSSID, SSID
+ * for other BSSes.
+ *
+ * Due to the possibility of hidden SSIDs, there's a second level
+ * structure, the "hidden_list" and "hidden_beacon_bss" pointer.
+ * The hidden_list connects all BSSes belonging to a single AP
+ * that has a hidden SSID, and connects beacon and probe response
+ * entries. For a probe response entry for a hidden SSID, the
+ * hidden_beacon_bss pointer points to the BSS struct holding the
+ * beacon's information.
+ *
+ * Reference counting is done for all these references except for
+ * the hidden_list, so that a beacon BSS struct that is otherwise
+ * not referenced has one reference for being on the bss_list and
+ * one for each probe response entry that points to it using the
+ * hidden_beacon_bss pointer. When a BSS struct that has such a
+ * pointer is get/put, the refcount update is also propagated to
+ * the referenced struct, this ensure that it cannot get removed
+ * while somebody is using the probe response version.
+ *
+ * Note that the hidden_beacon_bss pointer never changes, due to
+ * the reference counting. Therefore, no locking is needed for
+ * it.
+ *
+ * Also note that the hidden_beacon_bss pointer is only relevant
+ * if the driver uses something other than the IEs, e.g. private
+ * data stored stored in the BSS struct, since the beacon IEs are
+ * also linked into the probe response struct.
+ */
+
 #define IEEE80211_SCAN_RESULT_EXPIRE    (30 * HZ)
 
-static void bss_release(struct kref *ref)
+static void bss_free(struct cfg80211_internal_bss *bss)
 {
         struct cfg80211_bss_ies *ies;
-        struct cfg80211_internal_bss *bss;
-
-        bss = container_of(ref, struct cfg80211_internal_bss, ref);
 
         if (WARN_ON(atomic_read(&bss->hold)))
                 return;
 
-        if (bss->pub.free_priv)
-                bss->pub.free_priv(&bss->pub);
-
         ies = (void *)rcu_access_pointer(bss->pub.beacon_ies);
-        if (ies)
+        if (ies && !bss->pub.hidden_beacon_bss)
                 kfree_rcu(ies, rcu_head);
         ies = (void *)rcu_access_pointer(bss->pub.proberesp_ies);
         if (ies)
                 kfree_rcu(ies, rcu_head);
 
+        /*
+         * This happens when the module is removed, it doesn't
+         * really matter any more save for completeness
+         */
+        if (!list_empty(&bss->hidden_list))
+                list_del(&bss->hidden_list);
+
         kfree(bss);
 }
 
-/* must hold dev->bss_lock! */
-static void __cfg80211_unlink_bss(struct cfg80211_registered_device *dev,
+static inline void bss_ref_get(struct cfg80211_registered_device *dev,
+                               struct cfg80211_internal_bss *bss)
+{
+        lockdep_assert_held(&dev->bss_lock);
+
+        bss->refcount++;
+        if (bss->pub.hidden_beacon_bss) {
+                bss = container_of(bss->pub.hidden_beacon_bss,
+                                   struct cfg80211_internal_bss,
+                                   pub);
+                bss->refcount++;
+        }
+}
+
+static inline void bss_ref_put(struct cfg80211_registered_device *dev,
+                               struct cfg80211_internal_bss *bss)
+{
+        lockdep_assert_held(&dev->bss_lock);
+
+        if (bss->pub.hidden_beacon_bss) {
+                struct cfg80211_internal_bss *hbss;
+                hbss = container_of(bss->pub.hidden_beacon_bss,
+                                    struct cfg80211_internal_bss,
+                                    pub);
+                hbss->refcount--;
+                if (hbss->refcount == 0)
+                        bss_free(hbss);
+        }
+        bss->refcount--;
+        if (bss->refcount == 0)
+                bss_free(bss);
+}
+
+static bool __cfg80211_unlink_bss(struct cfg80211_registered_device *dev,
                                   struct cfg80211_internal_bss *bss)
 {
+        lockdep_assert_held(&dev->bss_lock);
+
+        if (!list_empty(&bss->hidden_list)) {
+                /*
+                 * don't remove the beacon entry if it has
+                 * probe responses associated with it
+                 */
+                if (!bss->pub.hidden_beacon_bss)
+                        return false;
+                /*
+                 * if it's a probe response entry break its
+                 * link to the other entries in the group
+                 */
+                list_del_init(&bss->hidden_list);
+        }
+
         list_del_init(&bss->list);
         rb_erase(&bss->rbn, &dev->bss_tree);
-        kref_put(&bss->ref, bss_release);
+        bss_ref_put(dev, bss);
+        return true;
 }
 
-/* must hold dev->bss_lock! */
 static void __cfg80211_bss_expire(struct cfg80211_registered_device *dev,
                                   unsigned long expire_time)
 {
         struct cfg80211_internal_bss *bss, *tmp;
         bool expired = false;
 
+        lockdep_assert_held(&dev->bss_lock);
+
         list_for_each_entry_safe(bss, tmp, &dev->bss_list, list) {
                 if (atomic_read(&bss->hold))
                         continue;
                 if (!time_after(expire_time, bss->ts))
                         continue;
 
-                __cfg80211_unlink_bss(dev, bss);
-                expired = true;
+                if (__cfg80211_unlink_bss(dev, bss))
+                        expired = true;
         }
 
         if (expired)
@@ -234,15 +321,16 @@ int __cfg80211_stop_sched_scan(struct cfg80211_registered_device *rdev,
         return 0;
 }
 
-/* must hold dev->bss_lock! */
 void cfg80211_bss_age(struct cfg80211_registered_device *dev,
                       unsigned long age_secs)
 {
         struct cfg80211_internal_bss *bss;
         unsigned long age_jiffies = msecs_to_jiffies(age_secs * MSEC_PER_SEC);
 
+        spin_lock_bh(&dev->bss_lock);
         list_for_each_entry(bss, &dev->bss_list, list)
                 bss->ts -= age_jiffies;
+        spin_unlock_bh(&dev->bss_lock);
 }
 
 void cfg80211_bss_expire(struct cfg80211_registered_device *dev)
@@ -277,40 +365,24 @@ const u8 *cfg80211_find_vendor_ie(unsigned int oui, u8 oui_type,
                 if (!pos)
                         return NULL;
 
-                if (end - pos < sizeof(*ie))
-                        return NULL;
-
                 ie = (struct ieee80211_vendor_ie *)pos;
+
+                /* make sure we can access ie->len */
+                BUILD_BUG_ON(offsetof(struct ieee80211_vendor_ie, len) != 1);
+
+                if (ie->len < sizeof(*ie))
+                        goto cont;
+
                 ie_oui = ie->oui[0] << 16 | ie->oui[1] << 8 | ie->oui[2];
                 if (ie_oui == oui && ie->oui_type == oui_type)
                         return pos;
-
+cont:
                 pos += 2 + ie->len;
         }
         return NULL;
 }
 EXPORT_SYMBOL(cfg80211_find_vendor_ie);
 
-static int cmp_ies(u8 num, const u8 *ies1, int len1, const u8 *ies2, int len2)
-{
-        const u8 *ie1 = cfg80211_find_ie(num, ies1, len1);
-        const u8 *ie2 = cfg80211_find_ie(num, ies2, len2);
-
-        /* equal if both missing */
-        if (!ie1 && !ie2)
-                return 0;
-        /* sort missing IE before (left of) present IE */
-        if (!ie1)
-                return -1;
-        if (!ie2)
-                return 1;
-
-        /* sort by length first, then by contents */
-        if (ie1[1] != ie2[1])
-                return ie2[1] - ie1[1];
-        return memcmp(ie1 + 2, ie2 + 2, ie1[1]);
-}
-
 static bool is_bss(struct cfg80211_bss *a, const u8 *bssid,
                    const u8 *ssid, size_t ssid_len)
 {
@@ -334,109 +406,30 @@ static bool is_bss(struct cfg80211_bss *a, const u8 *bssid,
         return memcmp(ssidie + 2, ssid, ssid_len) == 0;
 }
 
-static bool is_mesh_bss(struct cfg80211_bss *a)
-{
-        const struct cfg80211_bss_ies *ies;
-        const u8 *ie;
-
-        if (!WLAN_CAPABILITY_IS_STA_BSS(a->capability))
-                return false;
-
-        ies = rcu_access_pointer(a->ies);
-        if (!ies)
-                return false;
-
-        ie = cfg80211_find_ie(WLAN_EID_MESH_ID, ies->data, ies->len);
-        if (!ie)
-                return false;
-
-        ie = cfg80211_find_ie(WLAN_EID_MESH_CONFIG, ies->data, ies->len);
-        if (!ie)
-                return false;
-
-        return true;
-}
-
-static bool is_mesh(struct cfg80211_bss *a,
-                    const u8 *meshid, size_t meshidlen,
-                    const u8 *meshcfg)
-{
-        const struct cfg80211_bss_ies *ies;
-        const u8 *ie;
-
-        if (!WLAN_CAPABILITY_IS_STA_BSS(a->capability))
-                return false;
-
-        ies = rcu_access_pointer(a->ies);
-        if (!ies)
-                return false;
-
-        ie = cfg80211_find_ie(WLAN_EID_MESH_ID, ies->data, ies->len);
-        if (!ie)
-                return false;
-        if (ie[1] != meshidlen)
-                return false;
-        if (memcmp(ie + 2, meshid, meshidlen))
-                return false;
-
-        ie = cfg80211_find_ie(WLAN_EID_MESH_CONFIG, ies->data, ies->len);
-        if (!ie)
-                return false;
-        if (ie[1] != sizeof(struct ieee80211_meshconf_ie))
-                return false;
-
-        /*
-         * Ignore mesh capability (last two bytes of the IE) when
-         * comparing since that may differ between stations taking
-         * part in the same mesh.
-         */
-        return memcmp(ie + 2, meshcfg,
-                      sizeof(struct ieee80211_meshconf_ie) - 2) == 0;
-}
+/**
+ * enum bss_compare_mode - BSS compare mode
+ * @BSS_CMP_REGULAR: regular compare mode (for insertion and normal find)
+ * @BSS_CMP_HIDE_ZLEN: find hidden SSID with zero-length mode
+ * @BSS_CMP_HIDE_NUL: find hidden SSID with NUL-ed out mode
+ */
+enum bss_compare_mode {
+        BSS_CMP_REGULAR,
+        BSS_CMP_HIDE_ZLEN,
+        BSS_CMP_HIDE_NUL,
+};
 
-static int cmp_bss_core(struct cfg80211_bss *a, struct cfg80211_bss *b)
+static int cmp_bss(struct cfg80211_bss *a,
+                   struct cfg80211_bss *b,
+                   enum bss_compare_mode mode)
 {
         const struct cfg80211_bss_ies *a_ies, *b_ies;
-        int r;
+        const u8 *ie1 = NULL;
+        const u8 *ie2 = NULL;
+        int i, r;
 
         if (a->channel != b->channel)
                 return b->channel->center_freq - a->channel->center_freq;
 
-        if (is_mesh_bss(a) && is_mesh_bss(b)) {
-                a_ies = rcu_access_pointer(a->ies);
-                if (!a_ies)
-                        return -1;
-                b_ies = rcu_access_pointer(b->ies);
-                if (!b_ies)
-                        return 1;
-
-                r = cmp_ies(WLAN_EID_MESH_ID,
-                            a_ies->data, a_ies->len,
-                            b_ies->data, b_ies->len);
-                if (r)
-                        return r;
-                return cmp_ies(WLAN_EID_MESH_CONFIG,
-                               a_ies->data, a_ies->len,
-                               b_ies->data, b_ies->len);
-        }
-
-        /*
-         * we can't use compare_ether_addr here since we need a < > operator.
-         * The binary return value of compare_ether_addr isn't enough
-         */
-        return memcmp(a->bssid, b->bssid, sizeof(a->bssid));
-}
-
-static int cmp_bss(struct cfg80211_bss *a,
-                   struct cfg80211_bss *b)
-{
-        const struct cfg80211_bss_ies *a_ies, *b_ies;
-        int r;
-
-        r = cmp_bss_core(a, b);
-        if (r)
-                return r;
-
         a_ies = rcu_access_pointer(a->ies);
         if (!a_ies)
                 return -1;
@@ -444,42 +437,51 @@ static int cmp_bss(struct cfg80211_bss *a,
         if (!b_ies)
                 return 1;
 
-        return cmp_ies(WLAN_EID_SSID,
-                       a_ies->data, a_ies->len,
-                       b_ies->data, b_ies->len);
-}
-
-static int cmp_hidden_bss(struct cfg80211_bss *a, struct cfg80211_bss *b)
-{
-        const struct cfg80211_bss_ies *a_ies, *b_ies;
-        const u8 *ie1;
-        const u8 *ie2;
-        int i;
-        int r;
+        if (WLAN_CAPABILITY_IS_STA_BSS(a->capability))
+                ie1 = cfg80211_find_ie(WLAN_EID_MESH_ID,
+                                       a_ies->data, a_ies->len);
+        if (WLAN_CAPABILITY_IS_STA_BSS(b->capability))
+                ie2 = cfg80211_find_ie(WLAN_EID_MESH_ID,
+                                       b_ies->data, b_ies->len);
+        if (ie1 && ie2) {
+                int mesh_id_cmp;
+
+                if (ie1[1] == ie2[1])
+                        mesh_id_cmp = memcmp(ie1 + 2, ie2 + 2, ie1[1]);
+                else
+                        mesh_id_cmp = ie2[1] - ie1[1];
+
+                ie1 = cfg80211_find_ie(WLAN_EID_MESH_CONFIG,
+                                       a_ies->data, a_ies->len);
+                ie2 = cfg80211_find_ie(WLAN_EID_MESH_CONFIG,
+                                       b_ies->data, b_ies->len);
+                if (ie1 && ie2) {
+                        if (mesh_id_cmp)
+                                return mesh_id_cmp;
+                        if (ie1[1] != ie2[1])
+                                return ie2[1] - ie1[1];
+                        return memcmp(ie1 + 2, ie2 + 2, ie1[1]);
+                }
+        }
 
-        r = cmp_bss_core(a, b);
+        /*
+         * we can't use compare_ether_addr here since we need a < > operator.
+         * The binary return value of compare_ether_addr isn't enough
+         */
+        r = memcmp(a->bssid, b->bssid, sizeof(a->bssid));
         if (r)
                 return r;
 
-        a_ies = rcu_access_pointer(a->ies);
-        if (!a_ies)
-                return -1;
-        b_ies = rcu_access_pointer(b->ies);
-        if (!b_ies)
-                return 1;
-
         ie1 = cfg80211_find_ie(WLAN_EID_SSID, a_ies->data, a_ies->len);
         ie2 = cfg80211_find_ie(WLAN_EID_SSID, b_ies->data, b_ies->len);
 
+        if (!ie1 && !ie2)
+                return 0;
+
         /*
-         * Key comparator must use same algorithm in any rb-tree
-         * search function (order is important), otherwise ordering
-         * of items in the tree is broken and search gives incorrect
-         * results. This code uses same order as cmp_ies() does.
-         *
-         * Note that due to the differring behaviour with hidden SSIDs
-         * this function only works when "b" is the tree element and
-         * "a" is the key we're looking for.
+         * Note that with "hide_ssid", the function returns a match if
+         * the already-present BSS ("b") is a hidden SSID beacon for
+         * the new BSS ("a").
          */
 
         /* sort missing IE before (left of) present IE */
@@ -488,24 +490,36 @@ static int cmp_hidden_bss(struct cfg80211_bss *a, struct cfg80211_bss *b)
         if (!ie2)
                 return 1;
 
-        /* zero-size SSID is used as an indication of the hidden bss */
-        if (!ie2[1])
+        switch (mode) {
+        case BSS_CMP_HIDE_ZLEN:
+                /*
+                 * In ZLEN mode we assume the BSS entry we're
+                 * looking for has a zero-length SSID. So if
+                 * the one we're looking at right now has that,
+                 * return 0. Otherwise, return the difference
+                 * in length, but since we're looking for the
+                 * 0-length it's really equivalent to returning
+                 * the length of the one we're looking at.
+                 *
+                 * No content comparison is needed as we assume
+                 * the content length is zero.
+                 */
+                return ie2[1];
+        case BSS_CMP_REGULAR:
+        default:
+                /* sort by length first, then by contents */
+                if (ie1[1] != ie2[1])
+                        return ie2[1] - ie1[1];
+                return memcmp(ie1 + 2, ie2 + 2, ie1[1]);
+        case BSS_CMP_HIDE_NUL:
+                if (ie1[1] != ie2[1])
+                        return ie2[1] - ie1[1];
+                /* this is equivalent to memcmp(zeroes, ie2 + 2, len) */
+                for (i = 0; i < ie2[1]; i++)
+                        if (ie2[i + 2])
+                                return -1;
                 return 0;
-
-        /* sort by length first, then by contents */
-        if (ie1[1] != ie2[1])
-                return ie2[1] - ie1[1];
-
-        /*
-         * zeroed SSID ie is another indication of a hidden bss;
-         * if it isn't zeroed just return the regular sort value
-         * to find the next candidate
-         */
-        for (i = 0; i < ie2[1]; i++)
-                if (ie2[i + 2])
-                        return memcmp(ie1 + 2, ie2 + 2, ie1[1]);
-
-        return 0;
+        }
 }
 
 struct cfg80211_bss *cfg80211_get_bss(struct wiphy *wiphy,
@@ -534,7 +548,7 @@ struct cfg80211_bss *cfg80211_get_bss(struct wiphy *wiphy,
                         continue;
                 if (is_bss(&bss->pub, bssid, ssid, ssid_len)) {
                         res = bss;
-                        kref_get(&res->ref);
+                        bss_ref_get(dev, res);
                         break;
                 }
         }
@@ -547,34 +561,6 @@ struct cfg80211_bss *cfg80211_get_bss(struct wiphy *wiphy,
 }
 EXPORT_SYMBOL(cfg80211_get_bss);
 
-struct cfg80211_bss *cfg80211_get_mesh(struct wiphy *wiphy,
-                                       struct ieee80211_channel *channel,
-                                       const u8 *meshid, size_t meshidlen,
-                                       const u8 *meshcfg)
-{
-        struct cfg80211_registered_device *dev = wiphy_to_dev(wiphy);
-        struct cfg80211_internal_bss *bss, *res = NULL;
-
-        spin_lock_bh(&dev->bss_lock);
-
-        list_for_each_entry(bss, &dev->bss_list, list) {
-                if (channel && bss->pub.channel != channel)
-                        continue;
-                if (is_mesh(&bss->pub, meshid, meshidlen, meshcfg)) {
-                        res = bss;
-                        kref_get(&res->ref);
-                        break;
-                }
-        }
-
-        spin_unlock_bh(&dev->bss_lock);
-        if (!res)
-                return NULL;
-        return &res->pub;
-}
-EXPORT_SYMBOL(cfg80211_get_mesh);
-
-
 static void rb_insert_bss(struct cfg80211_registered_device *dev,
                           struct cfg80211_internal_bss *bss)
 {
@@ -587,7 +573,7 @@ static void rb_insert_bss(struct cfg80211_registered_device *dev,
                 parent = *p;
                 tbss = rb_entry(parent, struct cfg80211_internal_bss, rbn);
 
-                cmp = cmp_bss(&bss->pub, &tbss->pub);
+                cmp = cmp_bss(&bss->pub, &tbss->pub, BSS_CMP_REGULAR);
 
                 if (WARN_ON(!cmp)) {
                         /* will sort of leak this BSS */
@@ -606,7 +592,8 @@ static void rb_insert_bss(struct cfg80211_registered_device *dev,
 
 static struct cfg80211_internal_bss *
 rb_find_bss(struct cfg80211_registered_device *dev,
-            struct cfg80211_internal_bss *res)
+            struct cfg80211_internal_bss *res,
+            enum bss_compare_mode mode)
 {
         struct rb_node *n = dev->bss_tree.rb_node;
         struct cfg80211_internal_bss *bss;
@@ -614,7 +601,7 @@ rb_find_bss(struct cfg80211_registered_device *dev,
 
         while (n) {
                 bss = rb_entry(n, struct cfg80211_internal_bss, rbn);
-                r = cmp_bss(&res->pub, &bss->pub);
+                r = cmp_bss(&res->pub, &bss->pub, mode);
 
                 if (r == 0)
                         return bss;
@@ -627,46 +614,67 @@ rb_find_bss(struct cfg80211_registered_device *dev,
         return NULL;
 }
 
-static struct cfg80211_internal_bss *
-rb_find_hidden_bss(struct cfg80211_registered_device *dev,
-                   struct cfg80211_internal_bss *res)
+static bool cfg80211_combine_bsses(struct cfg80211_registered_device *dev,
+                                   struct cfg80211_internal_bss *new)
 {
-        struct rb_node *n = dev->bss_tree.rb_node;
+        const struct cfg80211_bss_ies *ies;
         struct cfg80211_internal_bss *bss;
-        int r;
+        const u8 *ie;
+        int i, ssidlen;
+        u8 fold = 0;
 
-        while (n) {
-                bss = rb_entry(n, struct cfg80211_internal_bss, rbn);
-                r = cmp_hidden_bss(&res->pub, &bss->pub);
+        ies = rcu_access_pointer(new->pub.beacon_ies);
+        if (WARN_ON(!ies))
+                return false;
 
-                if (r == 0)
-                        return bss;
-                else if (r < 0)
-                        n = n->rb_left;
-                else
-                        n = n->rb_right;
+        ie = cfg80211_find_ie(WLAN_EID_SSID, ies->data, ies->len);
+        if (!ie) {
+                /* nothing to do */
+                return true;
         }
 
-        return NULL;
-}
+        ssidlen = ie[1];
+        for (i = 0; i < ssidlen; i++)
+                fold |= ie[2 + i];
 
-static void
-copy_hidden_ies(struct cfg80211_internal_bss *res,
-                struct cfg80211_internal_bss *hidden)
-{
-        const struct cfg80211_bss_ies *ies;
+        if (fold) {
+                /* not a hidden SSID */
+                return true;
+        }
 
-        if (rcu_access_pointer(res->pub.beacon_ies))
-                return;
+        /* This is the bad part ... */
 
-        ies = rcu_access_pointer(hidden->pub.beacon_ies);
-        if (WARN_ON(!ies))
-                return;
+        list_for_each_entry(bss, &dev->bss_list, list) {
+                if (!ether_addr_equal(bss->pub.bssid, new->pub.bssid))
+                        continue;
+                if (bss->pub.channel != new->pub.channel)
+                        continue;
+                if (rcu_access_pointer(bss->pub.beacon_ies))
+                        continue;
+                ies = rcu_access_pointer(bss->pub.ies);
+                if (!ies)
+                        continue;
+                ie = cfg80211_find_ie(WLAN_EID_SSID, ies->data, ies->len);
+                if (!ie)
+                        continue;
+                if (ssidlen && ie[1] != ssidlen)
+                        continue;
+                /* that would be odd ... */
+                if (bss->pub.beacon_ies)
+                        continue;
+                if (WARN_ON_ONCE(bss->pub.hidden_beacon_bss))
+                        continue;
+                if (WARN_ON_ONCE(!list_empty(&bss->hidden_list)))
+                        list_del(&bss->hidden_list);
+                /* combine them */
+                list_add(&bss->hidden_list, &new->hidden_list);
+                bss->pub.hidden_beacon_bss = &new->pub;
+                new->refcount += bss->refcount;
+                rcu_assign_pointer(bss->pub.beacon_ies,
+                                   new->pub.beacon_ies);
+        }
 
-        ies = kmemdup(ies, sizeof(*ies) + ies->len, GFP_ATOMIC);
-        if (unlikely(!ies))
-                return;
-        rcu_assign_pointer(res->pub.beacon_ies, ies);
+        return true;
 }
 
 static struct cfg80211_internal_bss *
@@ -687,11 +695,10 @@ cfg80211_bss_update(struct cfg80211_registered_device *dev,
                 return NULL;
         }
 
-        found = rb_find_bss(dev, tmp);
+        found = rb_find_bss(dev, tmp, BSS_CMP_REGULAR);
 
         if (found) {
                 found->pub.beacon_interval = tmp->pub.beacon_interval;
-                found->pub.tsf = tmp->pub.tsf;
                 found->pub.signal = tmp->pub.signal;
                 found->pub.capability = tmp->pub.capability;
                 found->ts = tmp->ts;
@@ -711,19 +718,45 @@ cfg80211_bss_update(struct cfg80211_registered_device *dev,
                                 kfree_rcu((struct cfg80211_bss_ies *)old,
                                           rcu_head);
                 } else if (rcu_access_pointer(tmp->pub.beacon_ies)) {
-                        const struct cfg80211_bss_ies *old, *ies;
+                        const struct cfg80211_bss_ies *old;
+                        struct cfg80211_internal_bss *bss;
+
+                        if (found->pub.hidden_beacon_bss &&
+                            !list_empty(&found->hidden_list)) {
+                                /*
+                                 * The found BSS struct is one of the probe
+                                 * response members of a group, but we're
+                                 * receiving a beacon (beacon_ies in the tmp
+                                 * bss is used). This can only mean that the
+                                 * AP changed its beacon from not having an
+                                 * SSID to showing it, which is confusing so
+                                 * drop this information.
+                                 */
+                                goto drop;
+                        }
 
                         old = rcu_access_pointer(found->pub.beacon_ies);
-                        ies = rcu_access_pointer(found->pub.ies);
 
                         rcu_assign_pointer(found->pub.beacon_ies,
                                            tmp->pub.beacon_ies);
 
                         /* Override IEs if they were from a beacon before */
-                        if (old == ies)
+                        if (old == rcu_access_pointer(found->pub.ies))
                                 rcu_assign_pointer(found->pub.ies,
                                                    tmp->pub.beacon_ies);
 
+                        /* Assign beacon IEs to all sub entries */
+                        list_for_each_entry(bss, &found->hidden_list,
+                                            hidden_list) {
+                                const struct cfg80211_bss_ies *ies;
+
+                                ies = rcu_access_pointer(bss->pub.beacon_ies);
+                                WARN_ON(ies != old);
+
+                                rcu_assign_pointer(bss->pub.beacon_ies,
+                                                   tmp->pub.beacon_ies);
+                        }
+
                         if (old)
                                 kfree_rcu((struct cfg80211_bss_ies *)old,
                                           rcu_head);
@@ -733,19 +766,6 @@ cfg80211_bss_update(struct cfg80211_registered_device *dev,
                 struct cfg80211_internal_bss *hidden;
                 struct cfg80211_bss_ies *ies;
 
-                /* First check if the beacon is a probe response from
-                 * a hidden bss. If so, copy beacon ies (with nullified
-                 * ssid) into the probe response bss entry (with real ssid).
-                 * It is required basically for PSM implementation
-                 * (probe responses do not contain tim ie) */
-
-                /* TODO: The code is not trying to update existing probe
-                 * response bss entries when beacon ies are
-                 * getting changed. */
-                hidden = rb_find_hidden_bss(dev, tmp);
-                if (hidden)
-                        copy_hidden_ies(tmp, hidden);
-
                 /*
                  * create a copy -- the "res" variable that is passed in
                  * is allocated on the stack since it's not needed in the
@@ -760,21 +780,51 @@ cfg80211_bss_update(struct cfg80211_registered_device *dev,
                         ies = (void *)rcu_dereference(tmp->pub.proberesp_ies);
                         if (ies)
                                 kfree_rcu(ies, rcu_head);
-                        spin_unlock_bh(&dev->bss_lock);
-                        return NULL;
+                        goto drop;
                 }
                 memcpy(new, tmp, sizeof(*new));
-                kref_init(&new->ref);
+                new->refcount = 1;
+                INIT_LIST_HEAD(&new->hidden_list);
+
+                if (rcu_access_pointer(tmp->pub.proberesp_ies)) {
+                        hidden = rb_find_bss(dev, tmp, BSS_CMP_HIDE_ZLEN);
+                        if (!hidden)
+                                hidden = rb_find_bss(dev, tmp,
+                                                     BSS_CMP_HIDE_NUL);
+                        if (hidden) {
+                                new->pub.hidden_beacon_bss = &hidden->pub;
+                                list_add(&new->hidden_list,
+                                         &hidden->hidden_list);
+                                hidden->refcount++;
+                                rcu_assign_pointer(new->pub.beacon_ies,
+                                                   hidden->pub.beacon_ies);
+                        }
+                } else {
+                        /*
+                         * Ok so we found a beacon, and don't have an entry. If
+                         * it's a beacon with hidden SSID, we might be in for an
+                         * expensive search for any probe responses that should
+                         * be grouped with this beacon for updates ...
+                         */
+                        if (!cfg80211_combine_bsses(dev, new)) {
+                                kfree(new);
+                                goto drop;
+                        }
+                }
+
                 list_add_tail(&new->list, &dev->bss_list);
                 rb_insert_bss(dev, new);
                 found = new;
         }
 
         dev->bss_generation++;
+        bss_ref_get(dev, found);
         spin_unlock_bh(&dev->bss_lock);
 
-        kref_get(&found->ref);
         return found;
+ drop:
+        spin_unlock_bh(&dev->bss_lock);
+        return NULL;
 }
 
 static struct ieee80211_channel *
@@ -833,7 +883,6 @@ cfg80211_inform_bss(struct wiphy *wiphy,
         memcpy(tmp.pub.bssid, bssid, ETH_ALEN);
         tmp.pub.channel = channel;
         tmp.pub.signal = signal;
-        tmp.pub.tsf = tsf;
         tmp.pub.beacon_interval = beacon_interval;
         tmp.pub.capability = capability;
         /*
@@ -841,16 +890,14 @@ cfg80211_inform_bss(struct wiphy *wiphy,
          * Response frame, we need to pick one of the options and only use it
          * with the driver that does not provide the full Beacon/Probe Response
          * frame. Use Beacon frame pointer to avoid indicating that this should
-         * override the iies pointer should we have received an earlier
+         * override the IEs pointer should we have received an earlier
          * indication of Probe Response data.
-         *
-         * The initial buffer for the IEs is allocated with the BSS entry and
-         * is located after the private area.
          */
         ies = kmalloc(sizeof(*ies) + ielen, gfp);
         if (!ies)
                 return NULL;
         ies->len = ielen;
+        ies->tsf = tsf;
         memcpy(ies->data, ie, ielen);
 
         rcu_assign_pointer(tmp.pub.beacon_ies, ies);
@@ -907,6 +954,7 @@ cfg80211_inform_bss_frame(struct wiphy *wiphy,
         if (!ies)
                 return NULL;
         ies->len = ielen;
+        ies->tsf = le64_to_cpu(mgmt->u.probe_resp.timestamp);
         memcpy(ies->data, mgmt->u.probe_resp.variable, ielen);
 
         if (ieee80211_is_probe_resp(mgmt->frame_control))
@@ -918,7 +966,6 @@ cfg80211_inform_bss_frame(struct wiphy *wiphy,
         memcpy(tmp.pub.bssid, mgmt->bssid, ETH_ALEN);
         tmp.pub.channel = channel;
         tmp.pub.signal = signal;
-        tmp.pub.tsf = le64_to_cpu(mgmt->u.probe_resp.timestamp);
         tmp.pub.beacon_interval = le16_to_cpu(mgmt->u.probe_resp.beacon_int);
         tmp.pub.capability = le16_to_cpu(mgmt->u.probe_resp.capab_info);
 
@@ -935,27 +982,35 @@ cfg80211_inform_bss_frame(struct wiphy *wiphy,
 }
 EXPORT_SYMBOL(cfg80211_inform_bss_frame);
 
-void cfg80211_ref_bss(struct cfg80211_bss *pub)
+void cfg80211_ref_bss(struct wiphy *wiphy, struct cfg80211_bss *pub)
 {
+        struct cfg80211_registered_device *dev = wiphy_to_dev(wiphy);
         struct cfg80211_internal_bss *bss;
 
         if (!pub)
                 return;
 
         bss = container_of(pub, struct cfg80211_internal_bss, pub);
-        kref_get(&bss->ref);
+
+        spin_lock_bh(&dev->bss_lock);
+        bss_ref_get(dev, bss);
+        spin_unlock_bh(&dev->bss_lock);
 }
 EXPORT_SYMBOL(cfg80211_ref_bss);
 
-void cfg80211_put_bss(struct cfg80211_bss *pub)
+void cfg80211_put_bss(struct wiphy *wiphy, struct cfg80211_bss *pub)
 {
+        struct cfg80211_registered_device *dev = wiphy_to_dev(wiphy);
         struct cfg80211_internal_bss *bss;
 
         if (!pub)
                 return;
 
         bss = container_of(pub, struct cfg80211_internal_bss, pub);
-        kref_put(&bss->ref, bss_release);
+
+        spin_lock_bh(&dev->bss_lock);
+        bss_ref_put(dev, bss);
+        spin_unlock_bh(&dev->bss_lock);
 }
 EXPORT_SYMBOL(cfg80211_put_bss);
 
@@ -971,8 +1026,8 @@ void cfg80211_unlink_bss(struct wiphy *wiphy, struct cfg80211_bss *pub)
 
         spin_lock_bh(&dev->bss_lock);
         if (!list_empty(&bss->list)) {
-                __cfg80211_unlink_bss(dev, bss);
-                dev->bss_generation++;
+                if (__cfg80211_unlink_bss(dev, bss))
+                        dev->bss_generation++;
         }
         spin_unlock_bh(&dev->bss_lock);
 }
@@ -1155,16 +1210,6 @@ static void ieee80211_scan_add_ies(struct iw_request_info *info,
         }
 }
 
-static inline unsigned int elapsed_jiffies_msecs(unsigned long start)
-{
-        unsigned long end = jiffies;
-
-        if (end >= start)
-                return jiffies_to_msecs(end - start);
-
-        return jiffies_to_msecs(end + (MAX_JIFFY_OFFSET - start) + 1);
-}
-
 static char *
 ieee80211_bss(struct wiphy *wiphy, struct iw_request_info *info,
               struct cfg80211_internal_bss *bss, char *current_ev,
@@ -1241,15 +1286,10 @@ ieee80211_bss(struct wiphy *wiphy, struct iw_request_info *info,
 
         rcu_read_lock();
         ies = rcu_dereference(bss->pub.ies);
-        if (ies) {
-                rem = ies->len;
-                ie = ies->data;
-        } else {
-                rem = 0;
-                ie = NULL;
-        }
+        rem = ies->len;
+        ie = ies->data;
 
-        while (ies && rem >= 2) {
+        while (rem >= 2) {
                 /* invalid data */
                 if (ie[1] > rem - 2)
                         break;
@@ -1358,11 +1398,11 @@ ieee80211_bss(struct wiphy *wiphy, struct iw_request_info *info,
                                                   &iwe, IW_EV_UINT_LEN);
         }
 
-        buf = kmalloc(30, GFP_ATOMIC);
+        buf = kmalloc(31, GFP_ATOMIC);
         if (buf) {
                 memset(&iwe, 0, sizeof(iwe));
                 iwe.cmd = IWEVCUSTOM;
-                sprintf(buf, "tsf=%016llx", (unsigned long long)(bss->pub.tsf));
+                sprintf(buf, "tsf=%016llx", (unsigned long long)(ies->tsf));
                 iwe.u.data.length = strlen(buf);
                 current_ev = iwe_stream_add_point(info, current_ev, end_buf,
                                                   &iwe, buf);
diff --git a/net/wireless/sme.c b/net/wireless/sme.c
index a825dfe12cf7..f432bd3755b1 100644
--- a/net/wireless/sme.c
+++ b/net/wireless/sme.c
@@ -301,7 +301,7 @@ static void __cfg80211_sme_scan_done(struct net_device *dev)
 
         bss = cfg80211_get_conn_bss(wdev);
         if (bss) {
-                cfg80211_put_bss(bss);
+                cfg80211_put_bss(&rdev->wiphy, bss);
         } else {
                 /* not found */
                 if (wdev->conn->state == CFG80211_CONN_SCAN_AGAIN)
@@ -464,7 +464,7 @@ void __cfg80211_connect_result(struct net_device *dev, const u8 *bssid,
 
         if (wdev->current_bss) {
                 cfg80211_unhold_bss(wdev->current_bss);
-                cfg80211_put_bss(&wdev->current_bss->pub);
+                cfg80211_put_bss(wdev->wiphy, &wdev->current_bss->pub);
                 wdev->current_bss = NULL;
         }
 
@@ -480,7 +480,7 @@ void __cfg80211_connect_result(struct net_device *dev, const u8 *bssid,
                 kfree(wdev->connect_keys);
                 wdev->connect_keys = NULL;
                 wdev->ssid_len = 0;
-                cfg80211_put_bss(bss);
+                cfg80211_put_bss(wdev->wiphy, bss);
                 return;
         }
 
@@ -586,7 +586,7 @@ void __cfg80211_roamed(struct wireless_dev *wdev,
         }
 
         cfg80211_unhold_bss(wdev->current_bss);
-        cfg80211_put_bss(&wdev->current_bss->pub);
+        cfg80211_put_bss(wdev->wiphy, &wdev->current_bss->pub);
         wdev->current_bss = NULL;
 
         cfg80211_hold_bss(bss_from_pub(bss));
@@ -621,7 +621,7 @@ void __cfg80211_roamed(struct wireless_dev *wdev,
 
         return;
 out:
-        cfg80211_put_bss(bss);
+        cfg80211_put_bss(wdev->wiphy, bss);
 }
 
 void cfg80211_roamed(struct net_device *dev,
@@ -663,7 +663,7 @@ void cfg80211_roamed_bss(struct net_device *dev,
 
         ev = kzalloc(sizeof(*ev) + req_ie_len + resp_ie_len, gfp);
         if (!ev) {
-                cfg80211_put_bss(bss);
+                cfg80211_put_bss(wdev->wiphy, bss);
                 return;
         }
 
@@ -704,7 +704,7 @@ void __cfg80211_disconnected(struct net_device *dev, const u8 *ie,
 
         if (wdev->current_bss) {
                 cfg80211_unhold_bss(wdev->current_bss);
-                cfg80211_put_bss(&wdev->current_bss->pub);
+                cfg80211_put_bss(wdev->wiphy, &wdev->current_bss->pub);
         }
 
         wdev->current_bss = NULL;
@@ -875,7 +875,7 @@ int __cfg80211_connect(struct cfg80211_registered_device *rdev,
                 if (bss) {
                         wdev->conn->state = CFG80211_CONN_AUTHENTICATE_NEXT;
                         err = cfg80211_conn_do_work(wdev);
-                        cfg80211_put_bss(bss);
+                        cfg80211_put_bss(wdev->wiphy, bss);
                 } else {
                         /* otherwise we'll need to scan for the AP first */
                         err = cfg80211_conn_scan(wdev);
diff --git a/net/wireless/sysfs.c b/net/wireless/sysfs.c
index 1f6f01e2dc4c..238ee49b3868 100644
--- a/net/wireless/sysfs.c
+++ b/net/wireless/sysfs.c
@@ -106,9 +106,7 @@ static int wiphy_resume(struct device *dev)
         int ret = 0;
 
         /* Age scan results with time spent in suspend */
-        spin_lock_bh(&rdev->bss_lock);
         cfg80211_bss_age(rdev, get_seconds() - rdev->suspend_at);
-        spin_unlock_bh(&rdev->bss_lock);
 
         if (rdev->ops->resume) {
                 rtnl_lock();
diff --git a/net/wireless/trace.h b/net/wireless/trace.h
index 2134576f426e..b7a531380e19 100644
--- a/net/wireless/trace.h
+++ b/net/wireless/trace.h
@@ -1767,6 +1767,24 @@ DEFINE_EVENT(wiphy_wdev_evt, rdev_stop_p2p_device,
         TP_ARGS(wiphy, wdev)
 );
 
+TRACE_EVENT(rdev_set_mac_acl,
+        TP_PROTO(struct wiphy *wiphy, struct net_device *netdev,
+                 struct cfg80211_acl_data *params),
+        TP_ARGS(wiphy, netdev, params),
+        TP_STRUCT__entry(
+                WIPHY_ENTRY
+                NETDEV_ENTRY
+                __field(u32, acl_policy)
+        ),
+        TP_fast_assign(
+                WIPHY_ASSIGN;
+                WIPHY_ASSIGN;
+                __entry->acl_policy = params->acl_policy;
+        ),
+        TP_printk(WIPHY_PR_FMT ", " NETDEV_PR_FMT ", acl policy: %d",
+                  WIPHY_PR_ARG, NETDEV_PR_ARG, __entry->acl_policy)
+);
+
 /*************************************************************
  *           cfg80211 exported functions traces              *
  *************************************************************/
@@ -2033,6 +2051,21 @@ TRACE_EVENT(cfg80211_reg_can_beacon,
                   WIPHY_PR_ARG, CHAN_DEF_PR_ARG)
 );
 
+TRACE_EVENT(cfg80211_chandef_dfs_required,
+        TP_PROTO(struct wiphy *wiphy, struct cfg80211_chan_def *chandef),
+        TP_ARGS(wiphy, chandef),
+        TP_STRUCT__entry(
+                WIPHY_ENTRY
+                CHAN_DEF_ENTRY
+        ),
+        TP_fast_assign(
+                WIPHY_ASSIGN;
+                CHAN_DEF_ASSIGN(chandef);
+        ),
+        TP_printk(WIPHY_PR_FMT ", " CHAN_DEF_PR_FMT,
+                  WIPHY_PR_ARG, CHAN_DEF_PR_ARG)
+);
+
 TRACE_EVENT(cfg80211_ch_switch_notify,
         TP_PROTO(struct net_device *netdev,
                  struct cfg80211_chan_def *chandef),
@@ -2049,6 +2082,36 @@ TRACE_EVENT(cfg80211_ch_switch_notify,
                   NETDEV_PR_ARG, CHAN_DEF_PR_ARG)
 );
 
+TRACE_EVENT(cfg80211_radar_event,
+        TP_PROTO(struct wiphy *wiphy, struct cfg80211_chan_def *chandef),
+        TP_ARGS(wiphy, chandef),
+        TP_STRUCT__entry(
+                WIPHY_ENTRY
+                CHAN_DEF_ENTRY
+        ),
+        TP_fast_assign(
+                WIPHY_ASSIGN;
+                CHAN_DEF_ASSIGN(chandef);
+        ),
+        TP_printk(WIPHY_PR_FMT ", " CHAN_DEF_PR_FMT,
+                  WIPHY_PR_ARG, CHAN_DEF_PR_ARG)
+);
+
+TRACE_EVENT(cfg80211_cac_event,
+        TP_PROTO(struct net_device *netdev, enum nl80211_radar_event evt),
+        TP_ARGS(netdev, evt),
+        TP_STRUCT__entry(
+                NETDEV_ENTRY
+                __field(enum nl80211_radar_event, evt)
+        ),
+        TP_fast_assign(
+                NETDEV_ASSIGN;
+                __entry->evt = evt;
+        ),
+        TP_printk(NETDEV_PR_FMT ",  event: %d",
+                  NETDEV_PR_ARG, __entry->evt)
+);
+
 DECLARE_EVENT_CLASS(cfg80211_rx_evt,
         TP_PROTO(struct net_device *netdev, const u8 *addr),
         TP_ARGS(netdev, addr),
@@ -2315,6 +2378,41 @@ TRACE_EVENT(cfg80211_return_u32,
         TP_printk("ret: %u", __entry->ret)
 );
 
+TRACE_EVENT(cfg80211_report_wowlan_wakeup,
+        TP_PROTO(struct wiphy *wiphy, struct wireless_dev *wdev,
+                 struct cfg80211_wowlan_wakeup *wakeup),
+        TP_ARGS(wiphy, wdev, wakeup),
+        TP_STRUCT__entry(
+                WIPHY_ENTRY
+                WDEV_ENTRY
+                __field(bool, disconnect)
+                __field(bool, magic_pkt)
+                __field(bool, gtk_rekey_failure)
+                __field(bool, eap_identity_req)
+                __field(bool, four_way_handshake)
+                __field(bool, rfkill_release)
+                __field(s32, pattern_idx)
+                __field(u32, packet_len)
+                __dynamic_array(u8, packet, wakeup->packet_present_len)
+        ),
+        TP_fast_assign(
+                WIPHY_ASSIGN;
+                WDEV_ASSIGN;
+                __entry->disconnect = wakeup->disconnect;
+                __entry->magic_pkt = wakeup->magic_pkt;
+                __entry->gtk_rekey_failure = wakeup->gtk_rekey_failure;
+                __entry->eap_identity_req = wakeup->eap_identity_req;
+                __entry->four_way_handshake = wakeup->four_way_handshake;
+                __entry->rfkill_release = wakeup->rfkill_release;
+                __entry->pattern_idx = wakeup->pattern_idx;
+                __entry->packet_len = wakeup->packet_len;
+                if (wakeup->packet && wakeup->packet_present_len)
+                        memcpy(__get_dynamic_array(packet), wakeup->packet,
+                               wakeup->packet_present_len);
+        ),
+        TP_printk(WIPHY_PR_FMT ", " WDEV_PR_FMT, WIPHY_PR_ARG, WDEV_PR_ARG)
+);
+
 #endif /* !__RDEV_OPS_TRACE || TRACE_HEADER_MULTI_READ */
 
 #undef TRACE_INCLUDE_PATH
diff --git a/net/wireless/util.c b/net/wireless/util.c
index 1c2795d52db0..37a56ee1e1ed 100644
--- a/net/wireless/util.c
+++ b/net/wireless/util.c
@@ -1212,14 +1212,15 @@ int cfg80211_can_use_iftype_chan(struct cfg80211_registered_device *rdev,
         case NL80211_IFTYPE_MESH_POINT:
         case NL80211_IFTYPE_P2P_GO:
         case NL80211_IFTYPE_WDS:
-                radar_required = !!(chan->flags & IEEE80211_CHAN_RADAR);
+                radar_required = !!(chan &&
+                                    (chan->flags & IEEE80211_CHAN_RADAR));
                 break;
         case NL80211_IFTYPE_P2P_CLIENT:
         case NL80211_IFTYPE_STATION:
+        case NL80211_IFTYPE_P2P_DEVICE:
         case NL80211_IFTYPE_MONITOR:
                 radar_required = false;
                 break;
-        case NL80211_IFTYPE_P2P_DEVICE:
         case NUM_NL80211_IFTYPES:
         case NL80211_IFTYPE_UNSPECIFIED:
         default:
diff --git a/net/wireless/wext-proc.c b/net/wireless/wext-proc.c
index 8bafa31fa9f8..e98a01c1034f 100644
--- a/net/wireless/wext-proc.c
+++ b/net/wireless/wext-proc.c
@@ -143,7 +143,8 @@ static const struct file_operations wireless_seq_fops = {
 int __net_init wext_proc_init(struct net *net)
 {
         /* Create /proc/net/wireless entry */
-        if (!proc_net_fops_create(net, "wireless", S_IRUGO, &wireless_seq_fops))
+        if (!proc_create("wireless", S_IRUGO, net->proc_net,
+                         &wireless_seq_fops))
                 return -ENOMEM;
 
         return 0;
@@ -151,5 +152,5 @@ int __net_init wext_proc_init(struct net *net)
 
 void __net_exit wext_proc_exit(struct net *net)
 {
-        proc_net_remove(net, "wireless");
+        remove_proc_entry("wireless", net->proc_net);
 }
diff --git a/net/xfrm/xfrm_algo.c b/net/xfrm/xfrm_algo.c
index f9a549554740..6fb9d00a75dc 100644
--- a/net/xfrm/xfrm_algo.c
+++ b/net/xfrm/xfrm_algo.c
@@ -35,6 +35,8 @@ static struct xfrm_algo_desc aead_list[] = {
                 }
         },
 
+        .pfkey_supported = 1,
+
         .desc = {
                 .sadb_alg_id = SADB_X_EALG_AES_GCM_ICV8,
                 .sadb_alg_ivlen = 8,
@@ -51,6 +53,8 @@ static struct xfrm_algo_desc aead_list[] = {
                 }
         },
 
+        .pfkey_supported = 1,
+
         .desc = {
                 .sadb_alg_id = SADB_X_EALG_AES_GCM_ICV12,
                 .sadb_alg_ivlen = 8,
@@ -67,6 +71,8 @@ static struct xfrm_algo_desc aead_list[] = {
                 }
         },
 
+        .pfkey_supported = 1,
+
         .desc = {
                 .sadb_alg_id = SADB_X_EALG_AES_GCM_ICV16,
                 .sadb_alg_ivlen = 8,
@@ -83,6 +89,8 @@ static struct xfrm_algo_desc aead_list[] = {
                 }
         },
 
+        .pfkey_supported = 1,
+
         .desc = {
                 .sadb_alg_id = SADB_X_EALG_AES_CCM_ICV8,
                 .sadb_alg_ivlen = 8,
@@ -99,6 +107,8 @@ static struct xfrm_algo_desc aead_list[] = {
                 }
         },
 
+        .pfkey_supported = 1,
+
         .desc = {
                 .sadb_alg_id = SADB_X_EALG_AES_CCM_ICV12,
                 .sadb_alg_ivlen = 8,
@@ -115,6 +125,8 @@ static struct xfrm_algo_desc aead_list[] = {
                 }
         },
 
+        .pfkey_supported = 1,
+
         .desc = {
                 .sadb_alg_id = SADB_X_EALG_AES_CCM_ICV16,
                 .sadb_alg_ivlen = 8,
@@ -131,6 +143,8 @@ static struct xfrm_algo_desc aead_list[] = {
                 }
         },
 
+        .pfkey_supported = 1,
+
         .desc = {
                 .sadb_alg_id = SADB_X_EALG_NULL_AES_GMAC,
                 .sadb_alg_ivlen = 8,
@@ -151,6 +165,8 @@ static struct xfrm_algo_desc aalg_list[] = {
                 }
         },
 
+        .pfkey_supported = 1,
+
         .desc = {
                 .sadb_alg_id = SADB_X_AALG_NULL,
                 .sadb_alg_ivlen = 0,
@@ -169,6 +185,8 @@ static struct xfrm_algo_desc aalg_list[] = {
                 }
         },
 
+        .pfkey_supported = 1,
+
         .desc = {
                 .sadb_alg_id = SADB_AALG_MD5HMAC,
                 .sadb_alg_ivlen = 0,
@@ -187,6 +205,8 @@ static struct xfrm_algo_desc aalg_list[] = {
                 }
         },
 
+        .pfkey_supported = 1,
+
         .desc = {
                 .sadb_alg_id = SADB_AALG_SHA1HMAC,
                 .sadb_alg_ivlen = 0,
@@ -205,6 +225,8 @@ static struct xfrm_algo_desc aalg_list[] = {
                 }
         },
 
+        .pfkey_supported = 1,
+
         .desc = {
                 .sadb_alg_id = SADB_X_AALG_SHA2_256HMAC,
                 .sadb_alg_ivlen = 0,
@@ -222,6 +244,8 @@ static struct xfrm_algo_desc aalg_list[] = {
                 }
         },
 
+        .pfkey_supported = 1,
+
         .desc = {
                 .sadb_alg_id = SADB_X_AALG_SHA2_384HMAC,
                 .sadb_alg_ivlen = 0,
@@ -239,6 +263,8 @@ static struct xfrm_algo_desc aalg_list[] = {
                 }
         },
 
+        .pfkey_supported = 1,
+
         .desc = {
                 .sadb_alg_id = SADB_X_AALG_SHA2_512HMAC,
                 .sadb_alg_ivlen = 0,
@@ -257,6 +283,8 @@ static struct xfrm_algo_desc aalg_list[] = {
                 }
         },
 
+        .pfkey_supported = 1,
+
         .desc = {
                 .sadb_alg_id = SADB_X_AALG_RIPEMD160HMAC,
                 .sadb_alg_ivlen = 0,
@@ -274,6 +302,8 @@ static struct xfrm_algo_desc aalg_list[] = {
                 }
         },
 
+        .pfkey_supported = 1,
+
         .desc = {
                 .sadb_alg_id = SADB_X_AALG_AES_XCBC_MAC,
                 .sadb_alg_ivlen = 0,
@@ -295,6 +325,8 @@ static struct xfrm_algo_desc ealg_list[] = {
                 }
         },
 
+        .pfkey_supported = 1,
+
         .desc = {
                 .sadb_alg_id =  SADB_EALG_NULL,
                 .sadb_alg_ivlen = 0,
@@ -313,6 +345,8 @@ static struct xfrm_algo_desc ealg_list[] = {
                 }
         },
 
+        .pfkey_supported = 1,
+
         .desc = {
                 .sadb_alg_id = SADB_EALG_DESCBC,
                 .sadb_alg_ivlen = 8,
@@ -331,6 +365,8 @@ static struct xfrm_algo_desc ealg_list[] = {
                 }
         },
 
+        .pfkey_supported = 1,
+
         .desc = {
                 .sadb_alg_id = SADB_EALG_3DESCBC,
                 .sadb_alg_ivlen = 8,
@@ -349,6 +385,8 @@ static struct xfrm_algo_desc ealg_list[] = {
                 }
         },
 
+        .pfkey_supported = 1,
+
         .desc = {
                 .sadb_alg_id = SADB_X_EALG_CASTCBC,
                 .sadb_alg_ivlen = 8,
@@ -367,6 +405,8 @@ static struct xfrm_algo_desc ealg_list[] = {
                 }
         },
 
+        .pfkey_supported = 1,
+
         .desc = {
                 .sadb_alg_id = SADB_X_EALG_BLOWFISHCBC,
                 .sadb_alg_ivlen = 8,
@@ -385,6 +425,8 @@ static struct xfrm_algo_desc ealg_list[] = {
                 }
         },
 
+        .pfkey_supported = 1,
+
         .desc = {
                 .sadb_alg_id = SADB_X_EALG_AESCBC,
                 .sadb_alg_ivlen = 8,
@@ -403,6 +445,8 @@ static struct xfrm_algo_desc ealg_list[] = {
                 }
         },
 
+        .pfkey_supported = 1,
+
         .desc = {
                 .sadb_alg_id = SADB_X_EALG_SERPENTCBC,
                 .sadb_alg_ivlen = 8,
@@ -421,6 +465,8 @@ static struct xfrm_algo_desc ealg_list[] = {
                 }
         },
 
+        .pfkey_supported = 1,
+
         .desc = {
                 .sadb_alg_id = SADB_X_EALG_CAMELLIACBC,
                 .sadb_alg_ivlen = 8,
@@ -439,6 +485,8 @@ static struct xfrm_algo_desc ealg_list[] = {
                 }
         },
 
+        .pfkey_supported = 1,
+
         .desc = {
                 .sadb_alg_id = SADB_X_EALG_TWOFISHCBC,
                 .sadb_alg_ivlen = 8,
@@ -456,6 +504,8 @@ static struct xfrm_algo_desc ealg_list[] = {
                 }
         },
 
+        .pfkey_supported = 1,
+
         .desc = {
                 .sadb_alg_id = SADB_X_EALG_AESCTR,
                 .sadb_alg_ivlen = 8,
@@ -473,6 +523,7 @@ static struct xfrm_algo_desc calg_list[] = {
                         .threshold = 90,
                 }
         },
+        .pfkey_supported = 1,
         .desc = { .sadb_alg_id = SADB_X_CALG_DEFLATE }
 },
 {
@@ -482,6 +533,7 @@ static struct xfrm_algo_desc calg_list[] = {
                         .threshold = 90,
                 }
         },
+        .pfkey_supported = 1,
         .desc = { .sadb_alg_id = SADB_X_CALG_LZS }
 },
 {
@@ -491,6 +543,7 @@ static struct xfrm_algo_desc calg_list[] = {
                         .threshold = 50,
                 }
         },
+        .pfkey_supported = 1,
         .desc = { .sadb_alg_id = SADB_X_CALG_LZJH }
 },
 };
@@ -714,27 +767,27 @@ void xfrm_probe_algs(void)
 }
 EXPORT_SYMBOL_GPL(xfrm_probe_algs);
 
-int xfrm_count_auth_supported(void)
+int xfrm_count_pfkey_auth_supported(void)
 {
         int i, n;
 
         for (i = 0, n = 0; i < aalg_entries(); i++)
-                if (aalg_list[i].available)
+                if (aalg_list[i].available && aalg_list[i].pfkey_supported)
                         n++;
         return n;
 }
-EXPORT_SYMBOL_GPL(xfrm_count_auth_supported);
+EXPORT_SYMBOL_GPL(xfrm_count_pfkey_auth_supported);
 
-int xfrm_count_enc_supported(void)
+int xfrm_count_pfkey_enc_supported(void)
 {
         int i, n;
 
         for (i = 0, n = 0; i < ealg_entries(); i++)
-                if (ealg_list[i].available)
+                if (ealg_list[i].available && ealg_list[i].pfkey_supported)
                         n++;
         return n;
 }
-EXPORT_SYMBOL_GPL(xfrm_count_enc_supported);
+EXPORT_SYMBOL_GPL(xfrm_count_pfkey_enc_supported);
 
 #if defined(CONFIG_INET_ESP) || defined(CONFIG_INET_ESP_MODULE) || defined(CONFIG_INET6_ESP) || defined(CONFIG_INET6_ESP_MODULE)
 
diff --git a/net/xfrm/xfrm_output.c b/net/xfrm/xfrm_output.c
index 3670526e70b9..bcfda8921b5b 100644
--- a/net/xfrm/xfrm_output.c
+++ b/net/xfrm/xfrm_output.c
@@ -64,7 +64,7 @@ static int xfrm_output_one(struct sk_buff *skb, int err)
 
                 if (unlikely(x->km.state != XFRM_STATE_VALID)) {
                         XFRM_INC_STATS(net, LINUX_MIB_XFRMOUTSTATEINVALID);
-                        goto error_nolock;
+                        goto error;
                 }
 
                 err = xfrm_state_check_expire(x);
diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c
index 6c9aa642a2ba..5b47180986f8 100644
--- a/net/xfrm/xfrm_policy.c
+++ b/net/xfrm/xfrm_policy.c
@@ -35,6 +35,10 @@
 
 #include "xfrm_hash.h"
 
+#define XFRM_QUEUE_TMO_MIN ((unsigned)(HZ/10))
+#define XFRM_QUEUE_TMO_MAX ((unsigned)(60*HZ))
+#define XFRM_MAX_QUEUE_LEN      100
+
 DEFINE_MUTEX(xfrm_cfg_mutex);
 EXPORT_SYMBOL(xfrm_cfg_mutex);
 
@@ -51,7 +55,7 @@ static struct kmem_cache *xfrm_dst_cache __read_mostly;
 static void xfrm_init_pmtu(struct dst_entry *dst);
 static int stale_bundle(struct dst_entry *dst);
 static int xfrm_bundle_ok(struct xfrm_dst *xdst);
-
+static void xfrm_policy_queue_process(unsigned long arg);
 
 static struct xfrm_policy *__xfrm_policy_unlink(struct xfrm_policy *pol,
                                                 int dir);
@@ -287,8 +291,11 @@ struct xfrm_policy *xfrm_policy_alloc(struct net *net, gfp_t gfp)
                 INIT_HLIST_NODE(&policy->byidx);
                 rwlock_init(&policy->lock);
                 atomic_set(&policy->refcnt, 1);
+                skb_queue_head_init(&policy->polq.hold_queue);
                 setup_timer(&policy->timer, xfrm_policy_timer,
                                 (unsigned long)policy);
+                setup_timer(&policy->polq.hold_timer, xfrm_policy_queue_process,
+                            (unsigned long)policy);
                 policy->flo.ops = &xfrm_policy_fc_ops;
         }
         return policy;
@@ -309,6 +316,16 @@ void xfrm_policy_destroy(struct xfrm_policy *policy)
 }
 EXPORT_SYMBOL(xfrm_policy_destroy);
 
+static void xfrm_queue_purge(struct sk_buff_head *list)
+{
+        struct sk_buff *skb;
+
+        while ((skb = skb_dequeue(list)) != NULL) {
+                dev_put(skb->dev);
+                kfree_skb(skb);
+        }
+}
+
 /* Rule must be locked. Release descentant resources, announce
  * entry dead. The rule must be unlinked from lists to the moment.
  */
@@ -319,6 +336,9 @@ static void xfrm_policy_kill(struct xfrm_policy *policy)
 
         atomic_inc(&policy->genid);
 
+        del_timer(&policy->polq.hold_timer);
+        xfrm_queue_purge(&policy->polq.hold_queue);
+
         if (del_timer(&policy->timer))
                 xfrm_pol_put(policy);
 
@@ -562,6 +582,46 @@ static inline int selector_cmp(struct xfrm_selector *s1, struct xfrm_selector *s
         return 0;
 }
 
+static void xfrm_policy_requeue(struct xfrm_policy *old,
+                                struct xfrm_policy *new)
+{
+        struct xfrm_policy_queue *pq = &old->polq;
+        struct sk_buff_head list;
+
+        __skb_queue_head_init(&list);
+
+        spin_lock_bh(&pq->hold_queue.lock);
+        skb_queue_splice_init(&pq->hold_queue, &list);
+        del_timer(&pq->hold_timer);
+        spin_unlock_bh(&pq->hold_queue.lock);
+
+        if (skb_queue_empty(&list))
+                return;
+
+        pq = &new->polq;
+
+        spin_lock_bh(&pq->hold_queue.lock);
+        skb_queue_splice(&list, &pq->hold_queue);
+        pq->timeout = XFRM_QUEUE_TMO_MIN;
+        mod_timer(&pq->hold_timer, jiffies);
+        spin_unlock_bh(&pq->hold_queue.lock);
+}
+
+static bool xfrm_policy_mark_match(struct xfrm_policy *policy,
+                                   struct xfrm_policy *pol)
+{
+        u32 mark = policy->mark.v & policy->mark.m;
+
+        if (policy->mark.v == pol->mark.v && policy->mark.m == pol->mark.m)
+                return true;
+
+        if ((mark & pol->mark.m) == pol->mark.v &&
+            policy->priority == pol->priority)
+                return true;
+
+        return false;
+}
+
 int xfrm_policy_insert(int dir, struct xfrm_policy *policy, int excl)
 {
         struct net *net = xp_net(policy);
@@ -569,7 +629,6 @@ int xfrm_policy_insert(int dir, struct xfrm_policy *policy, int excl)
         struct xfrm_policy *delpol;
         struct hlist_head *chain;
         struct hlist_node *entry, *newpos;
-        u32 mark = policy->mark.v & policy->mark.m;
 
         write_lock_bh(&xfrm_policy_lock);
         chain = policy_hash_bysel(net, &policy->selector, policy->family, dir);
@@ -578,7 +637,7 @@ int xfrm_policy_insert(int dir, struct xfrm_policy *policy, int excl)
         hlist_for_each_entry(pol, entry, chain, bydst) {
                 if (pol->type == policy->type &&
                     !selector_cmp(&pol->selector, &policy->selector) &&
-                    (mark & pol->mark.m) == pol->mark.v &&
+                    xfrm_policy_mark_match(policy, pol) &&
                     xfrm_sec_ctx_match(pol->security, policy->security) &&
                     !WARN_ON(delpol)) {
                         if (excl) {
@@ -603,8 +662,10 @@ int xfrm_policy_insert(int dir, struct xfrm_policy *policy, int excl)
         net->xfrm.policy_count[dir]++;
         atomic_inc(&flow_cache_genid);
         rt_genid_bump(net);
-        if (delpol)
+        if (delpol) {
+                xfrm_policy_requeue(delpol, policy);
                 __xfrm_policy_unlink(delpol, dir);
+        }
         policy->index = delpol ? delpol->index : xfrm_gen_index(net, dir);
         hlist_add_head(&policy->byidx, net->xfrm.policy_byidx+idx_hash(net, policy->index));
         policy->curlft.add_time = get_seconds();
@@ -1115,11 +1176,15 @@ int xfrm_sk_policy_insert(struct sock *sk, int dir, struct xfrm_policy *pol)
                 pol->index = xfrm_gen_index(net, XFRM_POLICY_MAX+dir);
                 __xfrm_policy_link(pol, XFRM_POLICY_MAX+dir);
         }
-        if (old_pol)
+        if (old_pol) {
+                if (pol)
+                        xfrm_policy_requeue(old_pol, pol);
+
                 /* Unlinking succeeds always. This is the only function
                  * allowed to delete or replace socket policy.
                  */
                 __xfrm_policy_unlink(old_pol, XFRM_POLICY_MAX+dir);
+        }
         write_unlock_bh(&xfrm_policy_lock);
 
         if (old_pol) {
@@ -1310,6 +1375,8 @@ static struct flow_cache_object *xfrm_bundle_flo_get(struct flow_cache_object *f
                  * It means we need to try again resolving. */
                 if (xdst->num_xfrms > 0)
                         return NULL;
+        } else if (dst->flags & DST_XFRM_QUEUE) {
+                return NULL;
         } else {
                 /* Real bundle */
                 if (stale_bundle(dst))
@@ -1673,6 +1740,171 @@ xfrm_resolve_and_create_bundle(struct xfrm_policy **pols, int num_pols,
         return xdst;
 }
 
+static void xfrm_policy_queue_process(unsigned long arg)
+{
+        int err = 0;
+        struct sk_buff *skb;
+        struct sock *sk;
+        struct dst_entry *dst;
+        struct net_device *dev;
+        struct xfrm_policy *pol = (struct xfrm_policy *)arg;
+        struct xfrm_policy_queue *pq = &pol->polq;
+        struct flowi fl;
+        struct sk_buff_head list;
+
+        spin_lock(&pq->hold_queue.lock);
+        skb = skb_peek(&pq->hold_queue);
+        dst = skb_dst(skb);
+        sk = skb->sk;
+        xfrm_decode_session(skb, &fl, dst->ops->family);
+        spin_unlock(&pq->hold_queue.lock);
+
+        dst_hold(dst->path);
+        dst = xfrm_lookup(xp_net(pol), dst->path, &fl,
+                          sk, 0);
+        if (IS_ERR(dst))
+                goto purge_queue;
+
+        if (dst->flags & DST_XFRM_QUEUE) {
+                dst_release(dst);
+
+                if (pq->timeout >= XFRM_QUEUE_TMO_MAX)
+                        goto purge_queue;
+
+                pq->timeout = pq->timeout << 1;
+                mod_timer(&pq->hold_timer, jiffies + pq->timeout);
+                return;
+        }
+
+        dst_release(dst);
+
+        __skb_queue_head_init(&list);
+
+        spin_lock(&pq->hold_queue.lock);
+        pq->timeout = 0;
+        skb_queue_splice_init(&pq->hold_queue, &list);
+        spin_unlock(&pq->hold_queue.lock);
+
+        while (!skb_queue_empty(&list)) {
+                skb = __skb_dequeue(&list);
+
+                xfrm_decode_session(skb, &fl, skb_dst(skb)->ops->family);
+                dst_hold(skb_dst(skb)->path);
+                dst = xfrm_lookup(xp_net(pol), skb_dst(skb)->path,
+                                  &fl, skb->sk, 0);
+                if (IS_ERR(dst)) {
+                        dev_put(skb->dev);
+                        kfree_skb(skb);
+                        continue;
+                }
+
+                nf_reset(skb);
+                skb_dst_drop(skb);
+                skb_dst_set(skb, dst);
+
+                dev = skb->dev;
+                err = dst_output(skb);
+                dev_put(dev);
+        }
+
+        return;
+
+purge_queue:
+        pq->timeout = 0;
+        xfrm_queue_purge(&pq->hold_queue);
+}
+
+static int xdst_queue_output(struct sk_buff *skb)
+{
+        unsigned long sched_next;
+        struct dst_entry *dst = skb_dst(skb);
+        struct xfrm_dst *xdst = (struct xfrm_dst *) dst;
+        struct xfrm_policy_queue *pq = &xdst->pols[0]->polq;
+
+        if (pq->hold_queue.qlen > XFRM_MAX_QUEUE_LEN) {
+                kfree_skb(skb);
+                return -EAGAIN;
+        }
+
+        skb_dst_force(skb);
+        dev_hold(skb->dev);
+
+        spin_lock_bh(&pq->hold_queue.lock);
+
+        if (!pq->timeout)
+                pq->timeout = XFRM_QUEUE_TMO_MIN;
+
+        sched_next = jiffies + pq->timeout;
+
+        if (del_timer(&pq->hold_timer)) {
+                if (time_before(pq->hold_timer.expires, sched_next))
+                        sched_next = pq->hold_timer.expires;
+        }
+
+        __skb_queue_tail(&pq->hold_queue, skb);
+        mod_timer(&pq->hold_timer, sched_next);
+
+        spin_unlock_bh(&pq->hold_queue.lock);
+
+        return 0;
+}
+
+static struct xfrm_dst *xfrm_create_dummy_bundle(struct net *net,
+                                                 struct dst_entry *dst,
+                                                 const struct flowi *fl,
+                                                 int num_xfrms,
+                                                 u16 family)
+{
+        int err;
+        struct net_device *dev;
+        struct dst_entry *dst1;
+        struct xfrm_dst *xdst;
+
+        xdst = xfrm_alloc_dst(net, family);
+        if (IS_ERR(xdst))
+                return xdst;
+
+        if (net->xfrm.sysctl_larval_drop || num_xfrms <= 0 ||
+            (fl->flowi_flags & FLOWI_FLAG_CAN_SLEEP))
+                return xdst;
+
+        dst1 = &xdst->u.dst;
+        dst_hold(dst);
+        xdst->route = dst;
+
+        dst_copy_metrics(dst1, dst);
+
+        dst1->obsolete = DST_OBSOLETE_FORCE_CHK;
+        dst1->flags |= DST_HOST | DST_XFRM_QUEUE;
+        dst1->lastuse = jiffies;
+
+        dst1->input = dst_discard;
+        dst1->output = xdst_queue_output;
+
+        dst_hold(dst);
+        dst1->child = dst;
+        dst1->path = dst;
+
+        xfrm_init_path((struct xfrm_dst *)dst1, dst, 0);
+
+        err = -ENODEV;
+        dev = dst->dev;
+        if (!dev)
+                goto free_dst;
+
+        err = xfrm_fill_dst(xdst, dev, fl);
+        if (err)
+                goto free_dst;
+
+out:
+        return xdst;
+
+free_dst:
+        dst_release(dst1);
+        xdst = ERR_PTR(err);
+        goto out;
+}
+
 static struct flow_cache_object *
 xfrm_bundle_lookup(struct net *net, const struct flowi *fl, u16 family, u8 dir,
                    struct flow_cache_object *oldflo, void *ctx)
@@ -1751,7 +1983,7 @@ make_dummy_bundle:
         /* We found policies, but there's no bundles to instantiate:
          * either because the policy blocks, has no transformations or
          * we could not build template (no xfrm_states).*/
-        xdst = xfrm_alloc_dst(net, family);
+        xdst = xfrm_create_dummy_bundle(net, dst_orig, fl, num_xfrms, family);
         if (IS_ERR(xdst)) {
                 xfrm_pols_put(pols, num_pols);
                 return ERR_CAST(xdst);
@@ -2359,6 +2591,9 @@ static int xfrm_bundle_ok(struct xfrm_dst *first)
             (dst->dev && !netif_running(dst->dev)))
                 return 0;
 
+        if (dst->flags & DST_XFRM_QUEUE)
+                return 1;
+
         last = NULL;
 
         do {
diff --git a/net/xfrm/xfrm_proc.c b/net/xfrm/xfrm_proc.c
index 603903853e89..c721b0d9ab8b 100644
--- a/net/xfrm/xfrm_proc.c
+++ b/net/xfrm/xfrm_proc.c
@@ -74,13 +74,13 @@ static const struct file_operations xfrm_statistics_seq_fops = {
 
 int __net_init xfrm_proc_init(struct net *net)
 {
-        if (!proc_net_fops_create(net, "xfrm_stat", S_IRUGO,
-                                  &xfrm_statistics_seq_fops))
+        if (!proc_create("xfrm_stat", S_IRUGO, net->proc_net,
+                         &xfrm_statistics_seq_fops))
                 return -ENOMEM;
         return 0;
 }
 
 void xfrm_proc_fini(struct net *net)
 {
-        proc_net_remove(net, "xfrm_stat");
+        remove_proc_entry("xfrm_stat", net->proc_net);
 }