540 files changed, 24942 insertions, 14110 deletions

diff --git a/net/802/mrp.c b/net/802/mrp.c
index 1eb05d80b07b..3ed616215870 100644
--- a/net/802/mrp.c
+++ b/net/802/mrp.c
@@ -24,6 +24,11 @@
 static unsigned int mrp_join_time __read_mostly = 200;
 module_param(mrp_join_time, uint, 0644);
 MODULE_PARM_DESC(mrp_join_time, "Join time in ms (default 200ms)");
+
+static unsigned int mrp_periodic_time __read_mostly = 1000;
+module_param(mrp_periodic_time, uint, 0644);
+MODULE_PARM_DESC(mrp_periodic_time, "Periodic time in ms (default 1s)");
+
 MODULE_LICENSE("GPL");
 
 static const u8
@@ -595,6 +600,24 @@ static void mrp_join_timer(unsigned long data)
         mrp_join_timer_arm(app);
 }
 
+static void mrp_periodic_timer_arm(struct mrp_applicant *app)
+{
+        mod_timer(&app->periodic_timer,
+                  jiffies + msecs_to_jiffies(mrp_periodic_time));
+}
+
+static void mrp_periodic_timer(unsigned long data)
+{
+        struct mrp_applicant *app = (struct mrp_applicant *)data;
+
+        spin_lock(&app->lock);
+        mrp_mad_event(app, MRP_EVENT_PERIODIC);
+        mrp_pdu_queue(app);
+        spin_unlock(&app->lock);
+
+        mrp_periodic_timer_arm(app);
+}
+
 static int mrp_pdu_parse_end_mark(struct sk_buff *skb, int *offset)
 {
         __be16 endmark;
@@ -845,6 +868,9 @@ int mrp_init_applicant(struct net_device *dev, struct mrp_application *appl)
         rcu_assign_pointer(dev->mrp_port->applicants[appl->type], app);
         setup_timer(&app->join_timer, mrp_join_timer, (unsigned long)app);
         mrp_join_timer_arm(app);
+        setup_timer(&app->periodic_timer, mrp_periodic_timer,
+                    (unsigned long)app);
+        mrp_periodic_timer_arm(app);
         return 0;
 
 err3:
@@ -870,6 +896,7 @@ void mrp_uninit_applicant(struct net_device *dev, struct mrp_application *appl)
          * all pending messages before the applicant is gone.
          */
         del_timer_sync(&app->join_timer);
+        del_timer_sync(&app->periodic_timer);
 
         spin_lock_bh(&app->lock);
         mrp_mad_event(app, MRP_EVENT_TX);
diff --git a/net/8021q/vlan.c b/net/8021q/vlan.c
index 9424f3718ea7..61fc573f1142 100644
--- a/net/8021q/vlan.c
+++ b/net/8021q/vlan.c
@@ -210,6 +210,7 @@ out_vid_del:
 static int register_vlan_device(struct net_device *real_dev, u16 vlan_id)
 {
         struct net_device *new_dev;
+        struct vlan_dev_priv *vlan;
         struct net *net = dev_net(real_dev);
         struct vlan_net *vn = net_generic(net, vlan_net_id);
         char name[IFNAMSIZ];
@@ -260,11 +261,12 @@ static int register_vlan_device(struct net_device *real_dev, u16 vlan_id)
         new_dev->mtu = real_dev->mtu;
         new_dev->priv_flags |= (real_dev->priv_flags & IFF_UNICAST_FLT);
 
-        vlan_dev_priv(new_dev)->vlan_proto = htons(ETH_P_8021Q);
-        vlan_dev_priv(new_dev)->vlan_id = vlan_id;
-        vlan_dev_priv(new_dev)->real_dev = real_dev;
-        vlan_dev_priv(new_dev)->dent = NULL;
-        vlan_dev_priv(new_dev)->flags = VLAN_FLAG_REORDER_HDR;
+        vlan = vlan_dev_priv(new_dev);
+        vlan->vlan_proto = htons(ETH_P_8021Q);
+        vlan->vlan_id = vlan_id;
+        vlan->real_dev = real_dev;
+        vlan->dent = NULL;
+        vlan->flags = VLAN_FLAG_REORDER_HDR;
 
         new_dev->rtnl_link_ops = &vlan_link_ops;
         err = register_vlan_dev(new_dev);
@@ -341,7 +343,7 @@ static void __vlan_device_event(struct net_device *dev, unsigned long event)
 static int vlan_device_event(struct notifier_block *unused, unsigned long event,
                              void *ptr)
 {
-        struct net_device *dev = ptr;
+        struct net_device *dev = netdev_notifier_info_to_dev(ptr);
         struct vlan_group *grp;
         struct vlan_info *vlan_info;
         int i, flgs;
@@ -459,6 +461,7 @@ static int vlan_device_event(struct notifier_block *unused, unsigned long event,
 
         case NETDEV_NOTIFY_PEERS:
         case NETDEV_BONDING_FAILOVER:
+        case NETDEV_RESEND_IGMP:
                 /* Propagate to vlan devices */
                 vlan_group_for_each_dev(grp, i, vlandev)
                         call_netdevice_notifiers(event, vlandev);
diff --git a/net/8021q/vlan_core.c b/net/8021q/vlan_core.c
index 8a15eaadc4bd..6ee48aac776f 100644
--- a/net/8021q/vlan_core.c
+++ b/net/8021q/vlan_core.c
@@ -9,7 +9,7 @@ bool vlan_do_receive(struct sk_buff **skbp)
 {
         struct sk_buff *skb = *skbp;
         __be16 vlan_proto = skb->vlan_proto;
-        u16 vlan_id = skb->vlan_tci & VLAN_VID_MASK;
+        u16 vlan_id = vlan_tx_tag_get_id(skb);
         struct net_device *vlan_dev;
         struct vlan_pcpu_stats *rx_stats;
 
@@ -91,7 +91,12 @@ EXPORT_SYMBOL(__vlan_find_dev_deep);
 
 struct net_device *vlan_dev_real_dev(const struct net_device *dev)
 {
-        return vlan_dev_priv(dev)->real_dev;
+        struct net_device *ret = vlan_dev_priv(dev)->real_dev;
+
+        while (is_vlan_dev(ret))
+                ret = vlan_dev_priv(ret)->real_dev;
+
+        return ret;
 }
 EXPORT_SYMBOL(vlan_dev_real_dev);
 
diff --git a/net/8021q/vlan_dev.c b/net/8021q/vlan_dev.c
index 3a8c8fd63c88..09bf1c38805b 100644
--- a/net/8021q/vlan_dev.c
+++ b/net/8021q/vlan_dev.c
@@ -73,6 +73,8 @@ vlan_dev_get_egress_qos_mask(struct net_device *dev, struct sk_buff *skb)
 {
         struct vlan_priority_tci_mapping *mp;
 
+        smp_rmb(); /* coupled with smp_wmb() in vlan_dev_set_egress_priority() */
+
         mp = vlan_dev_priv(dev)->egress_priority_map[(skb->priority & 0xF)];
         while (mp) {
                 if (mp->priority == skb->priority) {
@@ -105,10 +107,10 @@ static int vlan_dev_hard_header(struct sk_buff *skb, struct net_device *dev,
         u16 vlan_tci = 0;
         int rc;
 
-        if (!(vlan_dev_priv(dev)->flags & VLAN_FLAG_REORDER_HDR)) {
+        if (!(vlan->flags & VLAN_FLAG_REORDER_HDR)) {
                 vhdr = (struct vlan_hdr *) skb_push(skb, VLAN_HLEN);
 
-                vlan_tci = vlan_dev_priv(dev)->vlan_id;
+                vlan_tci = vlan->vlan_id;
                 vlan_tci |= vlan_dev_get_egress_qos_mask(dev, skb);
                 vhdr->h_vlan_TCI = htons(vlan_tci);
 
@@ -131,7 +133,7 @@ static int vlan_dev_hard_header(struct sk_buff *skb, struct net_device *dev,
                 saddr = dev->dev_addr;
 
         /* Now make the underlying real hard header */
-        dev = vlan_dev_priv(dev)->real_dev;
+        dev = vlan->real_dev;
         rc = dev_hard_header(skb, dev, type, daddr, saddr, len + vhdrlen);
         if (rc > 0)
                 rc += vhdrlen;
@@ -249,6 +251,11 @@ int vlan_dev_set_egress_priority(const struct net_device *dev,
         np->next = mp;
         np->priority = skb_prio;
         np->vlan_qos = vlan_qos;
+        /* Before inserting this element in hash table, make sure all its fields
+         * are committed to memory.
+         * coupled with smp_rmb() in vlan_dev_get_egress_qos_mask()
+         */
+        smp_wmb();
         vlan->egress_priority_map[skb_prio & 0xF] = np;
         if (vlan_qos)
                 vlan->nr_egress_mappings++;
@@ -575,7 +582,7 @@ static int vlan_dev_init(struct net_device *dev)
         dev->dev_id = real_dev->dev_id;
 
         if (is_zero_ether_addr(dev->dev_addr))
-                memcpy(dev->dev_addr, real_dev->dev_addr, dev->addr_len);
+                eth_hw_addr_inherit(dev, real_dev);
         if (is_zero_ether_addr(dev->broadcast))
                 memcpy(dev->broadcast, real_dev->broadcast, dev->addr_len);
 
diff --git a/net/9p/client.c b/net/9p/client.c
index 8eb75425e6e6..ee8fd6bd4035 100644
--- a/net/9p/client.c
+++ b/net/9p/client.c
@@ -127,7 +127,7 @@ static int parse_opts(char *opts, struct p9_client *clnt)
         char *s;
         int ret = 0;
 
-        clnt->proto_version = p9_proto_2000u;
+        clnt->proto_version = p9_proto_2000L;
         clnt->msize = 8192;
 
         if (!opts)
@@ -204,6 +204,17 @@ free_and_return:
         return ret;
 }
 
+struct p9_fcall *p9_fcall_alloc(int alloc_msize)
+{
+        struct p9_fcall *fc;
+        fc = kmalloc(sizeof(struct p9_fcall) + alloc_msize, GFP_NOFS);
+        if (!fc)
+                return NULL;
+        fc->capacity = alloc_msize;
+        fc->sdata = (char *) fc + sizeof(struct p9_fcall);
+        return fc;
+}
+
 /**
  * p9_tag_alloc - lookup/allocate a request by tag
  * @c: client session to lookup tag within
@@ -256,39 +267,36 @@ p9_tag_alloc(struct p9_client *c, u16 tag, unsigned int max_size)
         col = tag % P9_ROW_MAXTAG;
 
         req = &c->reqs[row][col];
-        if (!req->tc) {
+        if (!req->wq) {
                 req->wq = kmalloc(sizeof(wait_queue_head_t), GFP_NOFS);
-                if (!req->wq) {
-                        pr_err("Couldn't grow tag array\n");
-                        return ERR_PTR(-ENOMEM);
-                }
+                if (!req->wq)
+                        goto grow_failed;
                 init_waitqueue_head(req->wq);
-                req->tc = kmalloc(sizeof(struct p9_fcall) + alloc_msize,
-                                  GFP_NOFS);
-                req->rc = kmalloc(sizeof(struct p9_fcall) + alloc_msize,
-                                  GFP_NOFS);
-                if ((!req->tc) || (!req->rc)) {
-                        pr_err("Couldn't grow tag array\n");
-                        kfree(req->tc);
-                        kfree(req->rc);
-                        kfree(req->wq);
-                        req->tc = req->rc = NULL;
-                        req->wq = NULL;
-                        return ERR_PTR(-ENOMEM);
-                }
-                req->tc->capacity = alloc_msize;
-                req->rc->capacity = alloc_msize;
-                req->tc->sdata = (char *) req->tc + sizeof(struct p9_fcall);
-                req->rc->sdata = (char *) req->rc + sizeof(struct p9_fcall);
         }
 
+        if (!req->tc)
+                req->tc = p9_fcall_alloc(alloc_msize);
+        if (!req->rc)
+                req->rc = p9_fcall_alloc(alloc_msize);
+        if (!req->tc || !req->rc)
+                goto grow_failed;
+
         p9pdu_reset(req->tc);
         p9pdu_reset(req->rc);
 
         req->tc->tag = tag-1;
         req->status = REQ_STATUS_ALLOC;
 
-        return &c->reqs[row][col];
+        return req;
+
+grow_failed:
+        pr_err("Couldn't grow tag array\n");
+        kfree(req->tc);
+        kfree(req->rc);
+        kfree(req->wq);
+        req->tc = req->rc = NULL;
+        req->wq = NULL;
+        return ERR_PTR(-ENOMEM);
 }
 
 /**
@@ -562,36 +570,19 @@ static int p9_check_zc_errors(struct p9_client *c, struct p9_req_t *req,
 
         if (!p9_is_proto_dotl(c)) {
                 /* Error is reported in string format */
-                uint16_t len;
-                /* 7 = header size for RERROR, 2 is the size of string len; */
-                int inline_len = in_hdrlen - (7 + 2);
+                int len;
+                /* 7 = header size for RERROR; */
+                int inline_len = in_hdrlen - 7;
 
-                /* Read the size of error string */
-                err = p9pdu_readf(req->rc, c->proto_version, "w", &len);
-                if (err)
-                        goto out_err;
-
-                ename = kmalloc(len + 1, GFP_NOFS);
-                if (!ename) {
-                        err = -ENOMEM;
+                len =  req->rc->size - req->rc->offset;
+                if (len > (P9_ZC_HDR_SZ - 7)) {
+                        err = -EFAULT;
                         goto out_err;
                 }
-                if (len <= inline_len) {
-                        /* We have error in protocol buffer itself */
-                        if (pdu_read(req->rc, ename, len)) {
-                                err = -EFAULT;
-                                goto out_free;
-
-                        }
-                } else {
-                        /*
-                         *  Part of the data is in user space buffer.
-                         */
-                        if (pdu_read(req->rc, ename, inline_len)) {
-                                err = -EFAULT;
-                                goto out_free;
 
-                        }
+                ename = &req->rc->sdata[req->rc->offset];
+                if (len > inline_len) {
+                        /* We have error in external buffer */
                         if (kern_buf) {
                                 memcpy(ename + inline_len, uidata,
                                        len - inline_len);
@@ -600,19 +591,19 @@ static int p9_check_zc_errors(struct p9_client *c, struct p9_req_t *req,
                                                      uidata, len - inline_len);
                                 if (err) {
                                         err = -EFAULT;
-                                        goto out_free;
+                                        goto out_err;
                                 }
                         }
                 }
-                ename[len] = 0;
-                if (p9_is_proto_dotu(c)) {
-                        /* For dotu we also have error code */
-                        err = p9pdu_readf(req->rc,
-                                          c->proto_version, "d", &ecode);
-                        if (err)
-                                goto out_free;
+                ename = NULL;
+                err = p9pdu_readf(req->rc, c->proto_version, "s?d",
+                                  &ename, &ecode);
+                if (err)
+                        goto out_err;
+
+                if (p9_is_proto_dotu(c))
                         err = -ecode;
-                }
+
                 if (!err || !IS_ERR_VALUE(err)) {
                         err = p9_errstr2errno(ename, strlen(ename));
 
@@ -628,8 +619,6 @@ static int p9_check_zc_errors(struct p9_client *c, struct p9_req_t *req,
         }
         return err;
 
-out_free:
-        kfree(ename);
 out_err:
         p9_debug(P9_DEBUG_ERROR, "couldn't parse error%d\n", err);
         return err;
@@ -667,12 +656,15 @@ static int p9_client_flush(struct p9_client *c, struct p9_req_t *oldreq)
                 return PTR_ERR(req);
 
 
-        /* if we haven't received a response for oldreq,
-           remove it from the list. */
-        spin_lock(&c->lock);
-        if (oldreq->status == REQ_STATUS_FLSH)
+        /*
+         * if we haven't received a response for oldreq,
+         * remove it from the list
+         */
+        if (oldreq->status == REQ_STATUS_FLSH) {
+                spin_lock(&c->lock);
                 list_del(&oldreq->req_list);
-        spin_unlock(&c->lock);
+                spin_unlock(&c->lock);
+        }
 
         p9_free_req(c, req);
         return 0;
@@ -995,6 +987,7 @@ struct p9_client *p9_client_create(const char *dev_name, char *options)
 {
         int err;
         struct p9_client *clnt;
+        char *client_id;
 
         err = 0;
         clnt = kmalloc(sizeof(struct p9_client), GFP_KERNEL);
@@ -1003,6 +996,10 @@ struct p9_client *p9_client_create(const char *dev_name, char *options)
 
         clnt->trans_mod = NULL;
         clnt->trans = NULL;
+
+        client_id = utsname()->nodename;
+        memcpy(clnt->name, client_id, strlen(client_id) + 1);
+
         spin_lock_init(&clnt->lock);
         INIT_LIST_HEAD(&clnt->fidlist);
 
@@ -1015,6 +1012,9 @@ struct p9_client *p9_client_create(const char *dev_name, char *options)
                 goto destroy_tagpool;
 
         if (!clnt->trans_mod)
+                clnt->trans_mod = v9fs_get_trans_by_name("virtio");
+
+        if (!clnt->trans_mod)
                 clnt->trans_mod = v9fs_get_default_trans();
 
         if (clnt->trans_mod == NULL) {
diff --git a/net/9p/trans_common.c b/net/9p/trans_common.c
index de8df957867d..2ee3879161b1 100644
--- a/net/9p/trans_common.c
+++ b/net/9p/trans_common.c
@@ -24,11 +24,11 @@
  */
 void p9_release_pages(struct page **pages, int nr_pages)
 {
-        int i = 0;
-        while (pages[i] && nr_pages--) {
-                put_page(pages[i]);
-                i++;
-        }
+        int i;
+
+        for (i = 0; i < nr_pages; i++)
+                if (pages[i])
+                        put_page(pages[i]);
 }
 EXPORT_SYMBOL(p9_release_pages);
 
diff --git a/net/9p/trans_fd.c b/net/9p/trans_fd.c
index 02efb25c2957..3ffda1b3799b 100644
--- a/net/9p/trans_fd.c
+++ b/net/9p/trans_fd.c
@@ -63,6 +63,7 @@ struct p9_fd_opts {
         int rfd;
         int wfd;
         u16 port;
+        int privport;
 };
 
 /**
@@ -87,12 +88,15 @@ struct p9_trans_fd {
 enum {
         /* Options that take integer arguments */
         Opt_port, Opt_rfdno, Opt_wfdno, Opt_err,
+        /* Options that take no arguments */
+        Opt_privport,
 };
 
 static const match_table_t tokens = {
         {Opt_port, "port=%u"},
         {Opt_rfdno, "rfdno=%u"},
         {Opt_wfdno, "wfdno=%u"},
+        {Opt_privport, "privport"},
         {Opt_err, NULL},
 };
 
@@ -161,6 +165,9 @@ static DEFINE_SPINLOCK(p9_poll_lock);
 static LIST_HEAD(p9_poll_pending_list);
 static DECLARE_WORK(p9_poll_work, p9_poll_workfn);
 
+static unsigned int p9_ipport_resv_min = P9_DEF_MIN_RESVPORT;
+static unsigned int p9_ipport_resv_max = P9_DEF_MAX_RESVPORT;
+
 static void p9_mux_poll_stop(struct p9_conn *m)
 {
         unsigned long flags;
@@ -741,7 +748,7 @@ static int parse_opts(char *params, struct p9_fd_opts *opts)
                 if (!*p)
                         continue;
                 token = match_token(p, tokens, args);
-                if (token != Opt_err) {
+                if ((token != Opt_err) && (token != Opt_privport)) {
                         r = match_int(&args[0], &option);
                         if (r < 0) {
                                 p9_debug(P9_DEBUG_ERROR,
@@ -759,6 +766,9 @@ static int parse_opts(char *params, struct p9_fd_opts *opts)
                 case Opt_wfdno:
                         opts->wfd = option;
                         break;
+                case Opt_privport:
+                        opts->privport = 1;
+                        break;
                 default:
                         continue;
                 }
@@ -898,6 +908,24 @@ static inline int valid_ipaddr4(const char *buf)
         return 0;
 }
 
+static int p9_bind_privport(struct socket *sock)
+{
+        struct sockaddr_in cl;
+        int port, err = -EINVAL;
+
+        memset(&cl, 0, sizeof(cl));
+        cl.sin_family = AF_INET;
+        cl.sin_addr.s_addr = INADDR_ANY;
+        for (port = p9_ipport_resv_max; port >= p9_ipport_resv_min; port--) {
+                cl.sin_port = htons((ushort)port);
+                err = kernel_bind(sock, (struct sockaddr *)&cl, sizeof(cl));
+                if (err != -EADDRINUSE)
+                        break;
+        }
+        return err;
+}
+
+
 static int
 p9_fd_create_tcp(struct p9_client *client, const char *addr, char *args)
 {
@@ -926,6 +954,16 @@ p9_fd_create_tcp(struct p9_client *client, const char *addr, char *args)
                 return err;
         }
 
+        if (opts.privport) {
+                err = p9_bind_privport(csocket);
+                if (err < 0) {
+                        pr_err("%s (%d): problem binding to privport\n",
+                               __func__, task_pid_nr(current));
+                        sock_release(csocket);
+                        return err;
+                }
+        }
+
         err = csocket->ops->connect(csocket,
                                     (struct sockaddr *)&sin_server,
                                     sizeof(struct sockaddr_in), 0);
diff --git a/net/9p/trans_rdma.c b/net/9p/trans_rdma.c
index 2c69ddd691a1..8f68df5d2973 100644
--- a/net/9p/trans_rdma.c
+++ b/net/9p/trans_rdma.c
@@ -57,9 +57,7 @@
 #define P9_RDMA_IRD             0
 #define P9_RDMA_ORD             0
 #define P9_RDMA_TIMEOUT         30000           /* 30 seconds */
-#define P9_RDMA_MAXSIZE         (4*4096)        /* Min SGE is 4, so we can
-                                                 * safely advertise a maxsize
-                                                 * of 64k */
+#define P9_RDMA_MAXSIZE         (1024*1024)     /* 1MB */
 
 /**
  * struct p9_trans_rdma - RDMA transport instance
@@ -75,7 +73,9 @@
  * @sq_depth: The depth of the Send Queue
  * @sq_sem: Semaphore for the SQ
  * @rq_depth: The depth of the Receive Queue.
- * @rq_count: Count of requests in the Receive Queue.
+ * @rq_sem: Semaphore for the RQ
+ * @excess_rc : Amount of posted Receive Contexts without a pending request.
+ *              See rdma_request()
  * @addr: The remote peer's address
  * @req_lock: Protects the active request list
  * @cm_done: Completion event for connection management tracking
@@ -100,7 +100,8 @@ struct p9_trans_rdma {
         int sq_depth;
         struct semaphore sq_sem;
         int rq_depth;
-        atomic_t rq_count;
+        struct semaphore rq_sem;
+        atomic_t excess_rc;
         struct sockaddr_in addr;
         spinlock_t req_lock;
 
@@ -296,6 +297,13 @@ handle_recv(struct p9_client *client, struct p9_trans_rdma *rdma,
         if (!req)
                 goto err_out;
 
+        /* Check that we have not yet received a reply for this request.
+         */
+        if (unlikely(req->rc)) {
+                pr_err("Duplicate reply for request %d", tag);
+                goto err_out;
+        }
+
         req->rc = c->rc;
         req->status = REQ_STATUS_RCVD;
         p9_client_cb(client, req);
@@ -336,8 +344,8 @@ static void cq_comp_handler(struct ib_cq *cq, void *cq_context)
 
                 switch (c->wc_op) {
                 case IB_WC_RECV:
-                        atomic_dec(&rdma->rq_count);
                         handle_recv(client, rdma, c, wc.status, wc.byte_len);
+                        up(&rdma->rq_sem);
                         break;
 
                 case IB_WC_SEND:
@@ -421,32 +429,33 @@ static int rdma_request(struct p9_client *client, struct p9_req_t *req)
         struct p9_rdma_context *c = NULL;
         struct p9_rdma_context *rpl_context = NULL;
 
+        /* When an error occurs between posting the recv and the send,
+         * there will be a receive context posted without a pending request.
+         * Since there is no way to "un-post" it, we remember it and skip
+         * post_recv() for the next request.
+         * So here,
+         * see if we are this `next request' and need to absorb an excess rc.
+         * If yes, then drop and free our own, and do not recv_post().
+         **/
+        if (unlikely(atomic_read(&rdma->excess_rc) > 0)) {
+                if ((atomic_sub_return(1, &rdma->excess_rc) >= 0)) {
+                        /* Got one ! */
+                        kfree(req->rc);
+                        req->rc = NULL;
+                        goto dont_need_post_recv;
+                } else {
+                        /* We raced and lost. */
+                        atomic_inc(&rdma->excess_rc);
+                }
+        }
+
         /* Allocate an fcall for the reply */
         rpl_context = kmalloc(sizeof *rpl_context, GFP_NOFS);
         if (!rpl_context) {
                 err = -ENOMEM;
-                goto err_close;
-        }
-
-        /*
-         * If the request has a buffer, steal it, otherwise
-         * allocate a new one.  Typically, requests should already
-         * have receive buffers allocated and just swap them around
-         */
-        if (!req->rc) {
-                req->rc = kmalloc(sizeof(struct p9_fcall)+client->msize,
-                                  GFP_NOFS);
-                if (req->rc) {
-                        req->rc->sdata = (char *) req->rc +
-                                                sizeof(struct p9_fcall);
-                        req->rc->capacity = client->msize;
-                }
+                goto recv_error;
         }
         rpl_context->rc = req->rc;
-        if (!rpl_context->rc) {
-                err = -ENOMEM;
-                goto err_free2;
-        }
 
         /*
          * Post a receive buffer for this request. We need to ensure
@@ -455,29 +464,35 @@ static int rdma_request(struct p9_client *client, struct p9_req_t *req)
          * outstanding request, so we must keep a count to avoid
          * overflowing the RQ.
          */
-        if (atomic_inc_return(&rdma->rq_count) <= rdma->rq_depth) {
-                err = post_recv(client, rpl_context);
-                if (err)
-                        goto err_free1;
-        } else
-                atomic_dec(&rdma->rq_count);
+        if (down_interruptible(&rdma->rq_sem)) {
+                err = -EINTR;
+                goto recv_error;
+        }
 
+        err = post_recv(client, rpl_context);
+        if (err) {
+                p9_debug(P9_DEBUG_FCALL, "POST RECV failed\n");
+                goto recv_error;
+        }
         /* remove posted receive buffer from request structure */
         req->rc = NULL;
 
+dont_need_post_recv:
         /* Post the request */
         c = kmalloc(sizeof *c, GFP_NOFS);
         if (!c) {
                 err = -ENOMEM;
-                goto err_free1;
+                goto send_error;
         }
         c->req = req;
 
         c->busa = ib_dma_map_single(rdma->cm_id->device,
                                     c->req->tc->sdata, c->req->tc->size,
                                     DMA_TO_DEVICE);
-        if (ib_dma_mapping_error(rdma->cm_id->device, c->busa))
-                goto error;
+        if (ib_dma_mapping_error(rdma->cm_id->device, c->busa)) {
+                err = -EIO;
+                goto send_error;
+        }
 
         sge.addr = c->busa;
         sge.length = c->req->tc->size;
@@ -491,22 +506,32 @@ static int rdma_request(struct p9_client *client, struct p9_req_t *req)
         wr.sg_list = &sge;
         wr.num_sge = 1;
 
-        if (down_interruptible(&rdma->sq_sem))
-                goto error;
+        if (down_interruptible(&rdma->sq_sem)) {
+                err = -EINTR;
+                goto send_error;
+        }
 
-        return ib_post_send(rdma->qp, &wr, &bad_wr);
+        err = ib_post_send(rdma->qp, &wr, &bad_wr);
+        if (err)
+                goto send_error;
 
- error:
+        /* Success */
+        return 0;
+
+ /* Handle errors that happened during or while preparing the send: */
+ send_error:
         kfree(c);
-        kfree(rpl_context->rc);
-        kfree(rpl_context);
-        p9_debug(P9_DEBUG_ERROR, "EIO\n");
-        return -EIO;
- err_free1:
-        kfree(rpl_context->rc);
- err_free2:
+        p9_debug(P9_DEBUG_ERROR, "Error %d in rdma_request()\n", err);
+
+        /* Ach.
+         *  We did recv_post(), but not send. We have one recv_post in excess.
+         */
+        atomic_inc(&rdma->excess_rc);
+        return err;
+
+ /* Handle errors that happened during or while preparing post_recv(): */
+ recv_error:
         kfree(rpl_context);
- err_close:
         spin_lock_irqsave(&rdma->req_lock, flags);
         if (rdma->state < P9_RDMA_CLOSING) {
                 rdma->state = P9_RDMA_CLOSING;
@@ -551,7 +576,8 @@ static struct p9_trans_rdma *alloc_rdma(struct p9_rdma_opts *opts)
         spin_lock_init(&rdma->req_lock);
         init_completion(&rdma->cm_done);
         sema_init(&rdma->sq_sem, rdma->sq_depth);
-        atomic_set(&rdma->rq_count, 0);
+        sema_init(&rdma->rq_sem, rdma->rq_depth);
+        atomic_set(&rdma->excess_rc, 0);
 
         return rdma;
 }
diff --git a/net/9p/trans_virtio.c b/net/9p/trans_virtio.c
index e1c26b101830..990afab2be1b 100644
--- a/net/9p/trans_virtio.c
+++ b/net/9p/trans_virtio.c
@@ -577,6 +577,10 @@ static int p9_virtio_probe(struct virtio_device *vdev)
         mutex_lock(&virtio_9p_lock);
         list_add_tail(&chan->chan_list, &virtio_chan_list);
         mutex_unlock(&virtio_9p_lock);
+
+        /* Let udev rules use the new mount_tag attribute. */
+        kobject_uevent(&(vdev->dev.kobj), KOBJ_CHANGE);
+
         return 0;
 
 out_free_tag:
@@ -654,6 +658,7 @@ static void p9_virtio_remove(struct virtio_device *vdev)
         list_del(&chan->chan_list);
         mutex_unlock(&virtio_9p_lock);
         sysfs_remove_file(&(vdev->dev.kobj), &dev_attr_mount_tag.attr);
+        kobject_uevent(&(vdev->dev.kobj), KOBJ_CHANGE);
         kfree(chan->tag);
         kfree(chan->vc_wq);
         kfree(chan);
diff --git a/net/Kconfig b/net/Kconfig
index 2ddc9046868e..b50dacc072f0 100644
--- a/net/Kconfig
+++ b/net/Kconfig
@@ -5,6 +5,7 @@
 menuconfig NET
         bool "Networking support"
         select NLATTR
+        select GENERIC_NET_UTILS
         ---help---
           Unless you really know what you are doing, you should say Y here.
           The reason is that some programs need kernel networking support even
@@ -218,6 +219,7 @@ source "net/batman-adv/Kconfig"
 source "net/openvswitch/Kconfig"
 source "net/vmw_vsock/Kconfig"
 source "net/netlink/Kconfig"
+source "net/mpls/Kconfig"
 
 config RPS
         boolean
@@ -226,7 +228,7 @@ config RPS
 
 config RFS_ACCEL
         boolean
-        depends on RPS && GENERIC_HARDIRQS
+        depends on RPS
         select CPU_RMAP
         default y
 
@@ -242,6 +244,10 @@ config NETPRIO_CGROUP
           Cgroup subsystem for use in assigning processes to network priorities on
           a per-interface basis
 
+config NET_RX_BUSY_POLL
+        boolean
+        default y
+
 config BQL
         boolean
         depends on SYSFS
@@ -259,11 +265,23 @@ config BPF_JIT
           packet sniffing (libpcap/tcpdump). Note : Admin should enable
           this feature changing /proc/sys/net/core/bpf_jit_enable
 
+config NET_FLOW_LIMIT
+        boolean
+        depends on RPS
+        default y
+        ---help---
+          The network stack has to drop packets when a receive processing CPU's
+          backlog reaches netdev_max_backlog. If a few out of many active flows
+          generate the vast majority of load, drop their traffic earlier to
+          maintain capacity for the other flows. This feature provides servers
+          with many clients some protection against DoS by a single (spoofed)
+          flow that greatly exceeds average workload.
+
 menu "Network testing"
 
 config NET_PKTGEN
         tristate "Packet Generator (USE WITH CAUTION)"
-        depends on PROC_FS
+        depends on INET && PROC_FS
         ---help---
           This module will inject preconfigured packets, at a configurable
           rate, out of a given interface.  It is used for network interface
diff --git a/net/Makefile b/net/Makefile
index 091e7b04f301..9492e8cb64e9 100644
--- a/net/Makefile
+++ b/net/Makefile
@@ -70,3 +70,4 @@ obj-$(CONFIG_BATMAN_ADV)	+= batman-adv/
 obj-$(CONFIG_NFC)               += nfc/
 obj-$(CONFIG_OPENVSWITCH)       += openvswitch/
 obj-$(CONFIG_VSOCKETS)  += vmw_vsock/
+obj-$(CONFIG_NET_MPLS_GSO)      += mpls/
diff --git a/net/appletalk/aarp.c b/net/appletalk/aarp.c
index 173a2e82f486..690356fa52b9 100644
--- a/net/appletalk/aarp.c
+++ b/net/appletalk/aarp.c
@@ -332,7 +332,7 @@ static void aarp_expire_timeout(unsigned long unused)
 static int aarp_device_event(struct notifier_block *this, unsigned long event,
                              void *ptr)
 {
-        struct net_device *dev = ptr;
+        struct net_device *dev = netdev_notifier_info_to_dev(ptr);
         int ct;
 
         if (!net_eq(dev_net(dev), &init_net))
diff --git a/net/appletalk/atalk_proc.c b/net/appletalk/atalk_proc.c
index c30f3a0717fb..af46bc49e1e9 100644
--- a/net/appletalk/atalk_proc.c
+++ b/net/appletalk/atalk_proc.c
@@ -178,7 +178,7 @@ static int atalk_seq_socket_show(struct seq_file *seq, void *v)
         at = at_sk(s);
 
         seq_printf(seq, "%02X   %04X:%02X:%02X  %04X:%02X:%02X  %08X:%08X "
-                        "%02X %d\n",
+                        "%02X %u\n",
                    s->sk_type, ntohs(at->src_net), at->src_node, at->src_port,
                    ntohs(at->dest_net), at->dest_node, at->dest_port,
                    sk_wmem_alloc_get(s),
diff --git a/net/appletalk/ddp.c b/net/appletalk/ddp.c
index ef12839a7cfe..7fee50d637f9 100644
--- a/net/appletalk/ddp.c
+++ b/net/appletalk/ddp.c
@@ -644,7 +644,7 @@ static inline void atalk_dev_down(struct net_device *dev)
 static int ddp_device_event(struct notifier_block *this, unsigned long event,
                             void *ptr)
 {
-        struct net_device *dev = ptr;
+        struct net_device *dev = netdev_notifier_info_to_dev(ptr);
 
         if (!net_eq(dev_net(dev), &init_net))
                 return NOTIFY_DONE;
diff --git a/net/atm/clip.c b/net/atm/clip.c
index 8ae3a7879335..8215f7cb170b 100644
--- a/net/atm/clip.c
+++ b/net/atm/clip.c
@@ -539,9 +539,9 @@ static int clip_create(int number)
 }
 
 static int clip_device_event(struct notifier_block *this, unsigned long event,
-                             void *arg)
+                             void *ptr)
 {
-        struct net_device *dev = arg;
+        struct net_device *dev = netdev_notifier_info_to_dev(ptr);
 
         if (!net_eq(dev_net(dev), &init_net))
                 return NOTIFY_DONE;
@@ -575,6 +575,7 @@ static int clip_inet_event(struct notifier_block *this, unsigned long event,
                            void *ifa)
 {
         struct in_device *in_dev;
+        struct netdev_notifier_info info;
 
         in_dev = ((struct in_ifaddr *)ifa)->ifa_dev;
         /*
@@ -583,7 +584,8 @@ static int clip_inet_event(struct notifier_block *this, unsigned long event,
          */
         if (event != NETDEV_UP)
                 return NOTIFY_DONE;
-        return clip_device_event(this, NETDEV_CHANGE, in_dev->dev);
+        netdev_notifier_info_init(&info, in_dev->dev);
+        return clip_device_event(this, NETDEV_CHANGE, &info);
 }
 
 static struct notifier_block clip_dev_notifier = {
diff --git a/net/atm/mpc.c b/net/atm/mpc.c
index d4cc1be5c364..3af12755cd04 100644
--- a/net/atm/mpc.c
+++ b/net/atm/mpc.c
@@ -998,14 +998,12 @@ int msg_to_mpoad(struct k_message *mesg, struct mpoa_client *mpc)
 }
 
 static int mpoa_event_listener(struct notifier_block *mpoa_notifier,
-                               unsigned long event, void *dev_ptr)
+                               unsigned long event, void *ptr)
 {
-        struct net_device *dev;
+        struct net_device *dev = netdev_notifier_info_to_dev(ptr);
         struct mpoa_client *mpc;
         struct lec_priv *priv;
 
-        dev = dev_ptr;
-
         if (!net_eq(dev_net(dev), &init_net))
                 return NOTIFY_DONE;
 
diff --git a/net/ax25/af_ax25.c b/net/ax25/af_ax25.c
index e277e38f736b..4b4d2b779ec1 100644
--- a/net/ax25/af_ax25.c
+++ b/net/ax25/af_ax25.c
@@ -111,9 +111,9 @@ again:
  *      Handle device status changes.
  */
 static int ax25_device_event(struct notifier_block *this, unsigned long event,
-        void *ptr)
+                             void *ptr)
 {
-        struct net_device *dev = (struct net_device *)ptr;
+        struct net_device *dev = netdev_notifier_info_to_dev(ptr);
 
         if (!net_eq(dev_net(dev), &init_net))
                 return NOTIFY_DONE;
@@ -1974,7 +1974,7 @@ static struct packet_type ax25_packet_type __read_mostly = {
 };
 
 static struct notifier_block ax25_dev_notifier = {
-        .notifier_call =ax25_device_event,
+        .notifier_call = ax25_device_event,
 };
 
 static int __init ax25_init(void)
diff --git a/net/ax25/sysctl_net_ax25.c b/net/ax25/sysctl_net_ax25.c
index d5744b752511..919a5ce47515 100644
--- a/net/ax25/sysctl_net_ax25.c
+++ b/net/ax25/sysctl_net_ax25.c
@@ -29,7 +29,7 @@ static int min_proto[1],		max_proto[] = { AX25_PROTO_MAX };
 static int min_ds_timeout[1],           max_ds_timeout[] = {65535000};
 #endif
 
-static const ctl_table ax25_param_table[] = {
+static const struct ctl_table ax25_param_table[] = {
         {
                 .procname       = "ip_default_mode",
                 .maxlen         = sizeof(int),
diff --git a/net/batman-adv/Makefile b/net/batman-adv/Makefile
index acbac2a9c62f..489bb36f1b94 100644
--- a/net/batman-adv/Makefile
+++ b/net/batman-adv/Makefile
@@ -32,7 +32,6 @@ batman-adv-y += icmp_socket.o
 batman-adv-y += main.o
 batman-adv-$(CONFIG_BATMAN_ADV_NC) += network-coding.o
 batman-adv-y += originator.o
-batman-adv-y += ring_buffer.o
 batman-adv-y += routing.o
 batman-adv-y += send.o
 batman-adv-y += soft-interface.o
diff --git a/net/batman-adv/bat_iv_ogm.c b/net/batman-adv/bat_iv_ogm.c
index 071f288b77a8..0a8a80cd4bf1 100644
--- a/net/batman-adv/bat_iv_ogm.c
+++ b/net/batman-adv/bat_iv_ogm.c
@@ -19,7 +19,6 @@
 
 #include "main.h"
 #include "translation-table.h"
-#include "ring_buffer.h"
 #include "originator.h"
 #include "routing.h"
 #include "gateway_common.h"
@@ -29,16 +28,74 @@
 #include "bat_algo.h"
 #include "network-coding.h"
 
+
+/**
+ * batadv_dup_status - duplicate status
+ * @BATADV_NO_DUP: the packet is a duplicate
+ * @BATADV_ORIG_DUP: OGM is a duplicate in the originator (but not for the
+ *  neighbor)
+ * @BATADV_NEIGH_DUP: OGM is a duplicate for the neighbor
+ * @BATADV_PROTECTED: originator is currently protected (after reboot)
+ */
+enum batadv_dup_status {
+        BATADV_NO_DUP = 0,
+        BATADV_ORIG_DUP,
+        BATADV_NEIGH_DUP,
+        BATADV_PROTECTED,
+};
+
+/**
+ * batadv_ring_buffer_set - update the ring buffer with the given value
+ * @lq_recv: pointer to the ring buffer
+ * @lq_index: index to store the value at
+ * @value: value to store in the ring buffer
+ */
+static void batadv_ring_buffer_set(uint8_t lq_recv[], uint8_t *lq_index,
+                                   uint8_t value)
+{
+        lq_recv[*lq_index] = value;
+        *lq_index = (*lq_index + 1) % BATADV_TQ_GLOBAL_WINDOW_SIZE;
+}
+
+/**
+ * batadv_ring_buffer_set - compute the average of all non-zero values stored
+ * in the given ring buffer
+ * @lq_recv: pointer to the ring buffer
+ *
+ * Returns computed average value.
+ */
+static uint8_t batadv_ring_buffer_avg(const uint8_t lq_recv[])
+{
+        const uint8_t *ptr;
+        uint16_t count = 0, i = 0, sum = 0;
+
+        ptr = lq_recv;
+
+        while (i < BATADV_TQ_GLOBAL_WINDOW_SIZE) {
+                if (*ptr != 0) {
+                        count++;
+                        sum += *ptr;
+                }
+
+                i++;
+                ptr++;
+        }
+
+        if (count == 0)
+                return 0;
+
+        return (uint8_t)(sum / count);
+}
+
 static struct batadv_neigh_node *
 batadv_iv_ogm_neigh_new(struct batadv_hard_iface *hard_iface,
                         const uint8_t *neigh_addr,
                         struct batadv_orig_node *orig_node,
-                        struct batadv_orig_node *orig_neigh, __be32 seqno)
+                        struct batadv_orig_node *orig_neigh)
 {
         struct batadv_neigh_node *neigh_node;
 
-        neigh_node = batadv_neigh_node_new(hard_iface, neigh_addr,
-                                           ntohl(seqno));
+        neigh_node = batadv_neigh_node_new(hard_iface, neigh_addr);
         if (!neigh_node)
                 goto out;
 
@@ -413,18 +470,17 @@ static void batadv_iv_ogm_aggregate_new(const unsigned char *packet_buff,
         else
                 skb_size = packet_len;
 
-        skb_size += ETH_HLEN + NET_IP_ALIGN;
+        skb_size += ETH_HLEN;
 
-        forw_packet_aggr->skb = dev_alloc_skb(skb_size);
+        forw_packet_aggr->skb = netdev_alloc_skb_ip_align(NULL, skb_size);
         if (!forw_packet_aggr->skb) {
                 if (!own_packet)
                         atomic_inc(&bat_priv->batman_queue_left);
                 kfree(forw_packet_aggr);
                 goto out;
         }
-        skb_reserve(forw_packet_aggr->skb, ETH_HLEN + NET_IP_ALIGN);
-
-        INIT_HLIST_NODE(&forw_packet_aggr->list);
+        forw_packet_aggr->skb->priority = TC_PRIO_CONTROL;
+        skb_reserve(forw_packet_aggr->skb, ETH_HLEN);
 
         skb_buff = skb_put(forw_packet_aggr->skb, packet_len);
         forw_packet_aggr->packet_len = packet_len;
@@ -590,6 +646,41 @@ static void batadv_iv_ogm_forward(struct batadv_orig_node *orig_node,
                                 if_incoming, 0, batadv_iv_ogm_fwd_send_time());
 }
 
+/**
+ * batadv_iv_ogm_slide_own_bcast_window - bitshift own OGM broadcast windows for
+ * the given interface
+ * @hard_iface: the interface for which the windows have to be shifted
+ */
+static void
+batadv_iv_ogm_slide_own_bcast_window(struct batadv_hard_iface *hard_iface)
+{
+        struct batadv_priv *bat_priv = netdev_priv(hard_iface->soft_iface);
+        struct batadv_hashtable *hash = bat_priv->orig_hash;
+        struct hlist_head *head;
+        struct batadv_orig_node *orig_node;
+        unsigned long *word;
+        uint32_t i;
+        size_t word_index;
+        uint8_t *w;
+
+        for (i = 0; i < hash->size; i++) {
+                head = &hash->table[i];
+
+                rcu_read_lock();
+                hlist_for_each_entry_rcu(orig_node, head, hash_entry) {
+                        spin_lock_bh(&orig_node->ogm_cnt_lock);
+                        word_index = hard_iface->if_num * BATADV_NUM_WORDS;
+                        word = &(orig_node->bcast_own[word_index]);
+
+                        batadv_bit_get_packet(bat_priv, word, 1, 0);
+                        w = &orig_node->bcast_own_sum[hard_iface->if_num];
+                        *w = bitmap_weight(word, BATADV_TQ_LOCAL_WINDOW_SIZE);
+                        spin_unlock_bh(&orig_node->ogm_cnt_lock);
+                }
+                rcu_read_unlock();
+        }
+}
+
 static void batadv_iv_ogm_schedule(struct batadv_hard_iface *hard_iface)
 {
         struct batadv_priv *bat_priv = netdev_priv(hard_iface->soft_iface);
@@ -634,7 +725,7 @@ static void batadv_iv_ogm_schedule(struct batadv_hard_iface *hard_iface)
                 batadv_ogm_packet->gw_flags = BATADV_NO_FLAGS;
         }
 
-        batadv_slide_own_bcast_window(hard_iface);
+        batadv_iv_ogm_slide_own_bcast_window(hard_iface);
         batadv_iv_ogm_queue_add(bat_priv, hard_iface->bat_iv.ogm_buff,
                                 hard_iface->bat_iv.ogm_buff_len, hard_iface, 1,
                                 batadv_iv_ogm_emit_send_time(bat_priv));
@@ -650,7 +741,7 @@ batadv_iv_ogm_orig_update(struct batadv_priv *bat_priv,
                           const struct batadv_ogm_packet *batadv_ogm_packet,
                           struct batadv_hard_iface *if_incoming,
                           const unsigned char *tt_buff,
-                          int is_duplicate)
+                          enum batadv_dup_status dup_status)
 {
         struct batadv_neigh_node *neigh_node = NULL, *tmp_neigh_node = NULL;
         struct batadv_neigh_node *router = NULL;
@@ -670,13 +761,13 @@ batadv_iv_ogm_orig_update(struct batadv_priv *bat_priv,
                 if (batadv_compare_eth(neigh_addr, ethhdr->h_source) &&
                     tmp_neigh_node->if_incoming == if_incoming &&
                     atomic_inc_not_zero(&tmp_neigh_node->refcount)) {
-                        if (neigh_node)
+                        if (WARN(neigh_node, "too many matching neigh_nodes"))
                                 batadv_neigh_node_free_ref(neigh_node);
                         neigh_node = tmp_neigh_node;
                         continue;
                 }
 
-                if (is_duplicate)
+                if (dup_status != BATADV_NO_DUP)
                         continue;
 
                 spin_lock_bh(&tmp_neigh_node->lq_update_lock);
@@ -696,8 +787,7 @@ batadv_iv_ogm_orig_update(struct batadv_priv *bat_priv,
 
                 neigh_node = batadv_iv_ogm_neigh_new(if_incoming,
                                                      ethhdr->h_source,
-                                                     orig_node, orig_tmp,
-                                                     batadv_ogm_packet->seqno);
+                                                     orig_node, orig_tmp);
 
                 batadv_orig_node_free_ref(orig_tmp);
                 if (!neigh_node)
@@ -718,7 +808,7 @@ batadv_iv_ogm_orig_update(struct batadv_priv *bat_priv,
         neigh_node->tq_avg = batadv_ring_buffer_avg(neigh_node->tq_recv);
         spin_unlock_bh(&neigh_node->lq_update_lock);
 
-        if (!is_duplicate) {
+        if (dup_status == BATADV_NO_DUP) {
                 orig_node->last_ttl = batadv_ogm_packet->header.ttl;
                 neigh_node->last_ttl = batadv_ogm_packet->header.ttl;
         }
@@ -829,8 +919,7 @@ static int batadv_iv_ogm_calc_tq(struct batadv_orig_node *orig_node,
                 neigh_node = batadv_iv_ogm_neigh_new(if_incoming,
                                                      orig_neigh_node->orig,
                                                      orig_neigh_node,
-                                                     orig_neigh_node,
-                                                     batadv_ogm_packet->seqno);
+                                                     orig_neigh_node);
 
         if (!neigh_node)
                 goto out;
@@ -902,15 +991,16 @@ out:
         return ret;
 }
 
-/* processes a batman packet for all interfaces, adjusts the sequence number and
- * finds out whether it is a duplicate.
- * returns:
- *   1 the packet is a duplicate
- *   0 the packet has not yet been received
- *  -1 the packet is old and has been received while the seqno window
- *     was protected. Caller should drop it.
+/**
+ * batadv_iv_ogm_update_seqnos -  process a batman packet for all interfaces,
+ *  adjust the sequence number and find out whether it is a duplicate
+ * @ethhdr: ethernet header of the packet
+ * @batadv_ogm_packet: OGM packet to be considered
+ * @if_incoming: interface on which the OGM packet was received
+ *
+ * Returns duplicate status as enum batadv_dup_status
  */
-static int
+static enum batadv_dup_status
 batadv_iv_ogm_update_seqnos(const struct ethhdr *ethhdr,
                             const struct batadv_ogm_packet *batadv_ogm_packet,
                             const struct batadv_hard_iface *if_incoming)
@@ -918,17 +1008,18 @@ batadv_iv_ogm_update_seqnos(const struct ethhdr *ethhdr,
         struct batadv_priv *bat_priv = netdev_priv(if_incoming->soft_iface);
         struct batadv_orig_node *orig_node;
         struct batadv_neigh_node *tmp_neigh_node;
-        int is_duplicate = 0;
+        int is_dup;
         int32_t seq_diff;
         int need_update = 0;
-        int set_mark, ret = -1;
+        int set_mark;
+        enum batadv_dup_status ret = BATADV_NO_DUP;
         uint32_t seqno = ntohl(batadv_ogm_packet->seqno);
         uint8_t *neigh_addr;
         uint8_t packet_count;
 
         orig_node = batadv_get_orig_node(bat_priv, batadv_ogm_packet->orig);
         if (!orig_node)
-                return 0;
+                return BATADV_NO_DUP;
 
         spin_lock_bh(&orig_node->ogm_cnt_lock);
         seq_diff = seqno - orig_node->last_real_seqno;
@@ -936,22 +1027,29 @@ batadv_iv_ogm_update_seqnos(const struct ethhdr *ethhdr,
         /* signalize caller that the packet is to be dropped. */
         if (!hlist_empty(&orig_node->neigh_list) &&
             batadv_window_protected(bat_priv, seq_diff,
-                                    &orig_node->batman_seqno_reset))
+                                    &orig_node->batman_seqno_reset)) {
+                ret = BATADV_PROTECTED;
                 goto out;
+        }
 
         rcu_read_lock();
         hlist_for_each_entry_rcu(tmp_neigh_node,
                                  &orig_node->neigh_list, list) {
-                is_duplicate |= batadv_test_bit(tmp_neigh_node->real_bits,
-                                                orig_node->last_real_seqno,
-                                                seqno);
-
                 neigh_addr = tmp_neigh_node->addr;
+                is_dup = batadv_test_bit(tmp_neigh_node->real_bits,
+                                         orig_node->last_real_seqno,
+                                         seqno);
+
                 if (batadv_compare_eth(neigh_addr, ethhdr->h_source) &&
-                    tmp_neigh_node->if_incoming == if_incoming)
+                    tmp_neigh_node->if_incoming == if_incoming) {
                         set_mark = 1;
-                else
+                        if (is_dup)
+                                ret = BATADV_NEIGH_DUP;
+                } else {
                         set_mark = 0;
+                        if (is_dup && (ret != BATADV_NEIGH_DUP))
+                                ret = BATADV_ORIG_DUP;
+                }
 
                 /* if the window moved, set the update flag. */
                 need_update |= batadv_bit_get_packet(bat_priv,
@@ -971,8 +1069,6 @@ batadv_iv_ogm_update_seqnos(const struct ethhdr *ethhdr,
                 orig_node->last_real_seqno = seqno;
         }
 
-        ret = is_duplicate;
-
 out:
         spin_unlock_bh(&orig_node->ogm_cnt_lock);
         batadv_orig_node_free_ref(orig_node);
@@ -991,10 +1087,11 @@ static void batadv_iv_ogm_process(const struct ethhdr *ethhdr,
         struct batadv_neigh_node *orig_neigh_router = NULL;
         int has_directlink_flag;
         int is_my_addr = 0, is_my_orig = 0, is_my_oldorig = 0;
-        int is_broadcast = 0, is_bidirect;
+        int is_bidirect;
         bool is_single_hop_neigh = false;
         bool is_from_best_next_hop = false;
-        int is_duplicate, sameseq, simlar_ttl;
+        int sameseq, similar_ttl;
+        enum batadv_dup_status dup_status;
         uint32_t if_incoming_seqno;
         uint8_t *prev_sender;
 
@@ -1054,19 +1151,9 @@ static void batadv_iv_ogm_process(const struct ethhdr *ethhdr,
                 if (batadv_compare_eth(batadv_ogm_packet->prev_sender,
                                        hard_iface->net_dev->dev_addr))
                         is_my_oldorig = 1;
-
-                if (is_broadcast_ether_addr(ethhdr->h_source))
-                        is_broadcast = 1;
         }
         rcu_read_unlock();
 
-        if (batadv_ogm_packet->header.version != BATADV_COMPAT_VERSION) {
-                batadv_dbg(BATADV_DBG_BATMAN, bat_priv,
-                           "Drop packet: incompatible batman version (%i)\n",
-                           batadv_ogm_packet->header.version);
-                return;
-        }
-
         if (is_my_addr) {
                 batadv_dbg(BATADV_DBG_BATMAN, bat_priv,
                            "Drop packet: received my own broadcast (sender: %pM)\n",
@@ -1074,13 +1161,6 @@ static void batadv_iv_ogm_process(const struct ethhdr *ethhdr,
                 return;
         }
 
-        if (is_broadcast) {
-                batadv_dbg(BATADV_DBG_BATMAN, bat_priv,
-                           "Drop packet: ignoring all packets with broadcast source addr (sender: %pM)\n",
-                           ethhdr->h_source);
-                return;
-        }
-
         if (is_my_orig) {
                 unsigned long *word;
                 int offset;
@@ -1138,10 +1218,10 @@ static void batadv_iv_ogm_process(const struct ethhdr *ethhdr,
         if (!orig_node)
                 return;
 
-        is_duplicate = batadv_iv_ogm_update_seqnos(ethhdr, batadv_ogm_packet,
-                                                   if_incoming);
+        dup_status = batadv_iv_ogm_update_seqnos(ethhdr, batadv_ogm_packet,
+                                                 if_incoming);
 
-        if (is_duplicate == -1) {
+        if (dup_status == BATADV_PROTECTED) {
                 batadv_dbg(BATADV_DBG_BATMAN, bat_priv,
                            "Drop packet: packet within seqno protection time (sender: %pM)\n",
                            ethhdr->h_source);
@@ -1211,11 +1291,12 @@ static void batadv_iv_ogm_process(const struct ethhdr *ethhdr,
          * seqno and similar ttl as the non-duplicate
          */
         sameseq = orig_node->last_real_seqno == ntohl(batadv_ogm_packet->seqno);
-        simlar_ttl = orig_node->last_ttl - 3 <= batadv_ogm_packet->header.ttl;
-        if (is_bidirect && (!is_duplicate || (sameseq && simlar_ttl)))
+        similar_ttl = orig_node->last_ttl - 3 <= batadv_ogm_packet->header.ttl;
+        if (is_bidirect && ((dup_status == BATADV_NO_DUP) ||
+                            (sameseq && similar_ttl)))
                 batadv_iv_ogm_orig_update(bat_priv, orig_node, ethhdr,
                                           batadv_ogm_packet, if_incoming,
-                                          tt_buff, is_duplicate);
+                                          tt_buff, dup_status);
 
         /* is single hop (direct) neighbor */
         if (is_single_hop_neigh) {
@@ -1236,7 +1317,7 @@ static void batadv_iv_ogm_process(const struct ethhdr *ethhdr,
                 goto out_neigh;
         }
 
-        if (is_duplicate) {
+        if (dup_status == BATADV_NEIGH_DUP) {
                 batadv_dbg(BATADV_DBG_BATMAN, bat_priv,
                            "Drop packet: duplicate packet received\n");
                 goto out_neigh;
@@ -1288,7 +1369,7 @@ static int batadv_iv_ogm_receive(struct sk_buff *skb,
                            skb->len + ETH_HLEN);
 
         packet_len = skb_headlen(skb);
-        ethhdr = (struct ethhdr *)skb_mac_header(skb);
+        ethhdr = eth_hdr(skb);
         packet_buff = skb->data;
         batadv_ogm_packet = (struct batadv_ogm_packet *)packet_buff;
 
diff --git a/net/batman-adv/bridge_loop_avoidance.c b/net/batman-adv/bridge_loop_avoidance.c
index 379061c72549..264de88db320 100644
--- a/net/batman-adv/bridge_loop_avoidance.c
+++ b/net/batman-adv/bridge_loop_avoidance.c
@@ -180,7 +180,7 @@ static struct batadv_bla_claim
  */
 static struct batadv_bla_backbone_gw *
 batadv_backbone_hash_find(struct batadv_priv *bat_priv,
-                          uint8_t *addr, short vid)
+                          uint8_t *addr, unsigned short vid)
 {
         struct batadv_hashtable *hash = bat_priv->bla.backbone_hash;
         struct hlist_head *head;
@@ -257,7 +257,7 @@ batadv_bla_del_backbone_claims(struct batadv_bla_backbone_gw *backbone_gw)
  * @claimtype: the type of the claim (CLAIM, UNCLAIM, ANNOUNCE, ...)
  */
 static void batadv_bla_send_claim(struct batadv_priv *bat_priv, uint8_t *mac,
-                                  short vid, int claimtype)
+                                  unsigned short vid, int claimtype)
 {
         struct sk_buff *skb;
         struct ethhdr *ethhdr;
@@ -307,7 +307,8 @@ static void batadv_bla_send_claim(struct batadv_priv *bat_priv, uint8_t *mac,
                  */
                 memcpy(ethhdr->h_source, mac, ETH_ALEN);
                 batadv_dbg(BATADV_DBG_BLA, bat_priv,
-                           "bla_send_claim(): CLAIM %pM on vid %d\n", mac, vid);
+                           "bla_send_claim(): CLAIM %pM on vid %d\n", mac,
+                           BATADV_PRINT_VID(vid));
                 break;
         case BATADV_CLAIM_TYPE_UNCLAIM:
                 /* unclaim frame
@@ -316,7 +317,7 @@ static void batadv_bla_send_claim(struct batadv_priv *bat_priv, uint8_t *mac,
                 memcpy(hw_src, mac, ETH_ALEN);
                 batadv_dbg(BATADV_DBG_BLA, bat_priv,
                            "bla_send_claim(): UNCLAIM %pM on vid %d\n", mac,
-                           vid);
+                           BATADV_PRINT_VID(vid));
                 break;
         case BATADV_CLAIM_TYPE_ANNOUNCE:
                 /* announcement frame
@@ -325,7 +326,7 @@ static void batadv_bla_send_claim(struct batadv_priv *bat_priv, uint8_t *mac,
                 memcpy(hw_src, mac, ETH_ALEN);
                 batadv_dbg(BATADV_DBG_BLA, bat_priv,
                            "bla_send_claim(): ANNOUNCE of %pM on vid %d\n",
-                           ethhdr->h_source, vid);
+                           ethhdr->h_source, BATADV_PRINT_VID(vid));
                 break;
         case BATADV_CLAIM_TYPE_REQUEST:
                 /* request frame
@@ -335,13 +336,15 @@ static void batadv_bla_send_claim(struct batadv_priv *bat_priv, uint8_t *mac,
                 memcpy(hw_src, mac, ETH_ALEN);
                 memcpy(ethhdr->h_dest, mac, ETH_ALEN);
                 batadv_dbg(BATADV_DBG_BLA, bat_priv,
-                           "bla_send_claim(): REQUEST of %pM to %pMon vid %d\n",
-                           ethhdr->h_source, ethhdr->h_dest, vid);
+                           "bla_send_claim(): REQUEST of %pM to %pM on vid %d\n",
+                           ethhdr->h_source, ethhdr->h_dest,
+                           BATADV_PRINT_VID(vid));
                 break;
         }
 
-        if (vid != -1)
-                skb = vlan_insert_tag(skb, htons(ETH_P_8021Q), vid);
+        if (vid & BATADV_VLAN_HAS_TAG)
+                skb = vlan_insert_tag(skb, htons(ETH_P_8021Q),
+                                      vid & VLAN_VID_MASK);
 
         skb_reset_mac_header(skb);
         skb->protocol = eth_type_trans(skb, soft_iface);
@@ -367,7 +370,7 @@ out:
  */
 static struct batadv_bla_backbone_gw *
 batadv_bla_get_backbone_gw(struct batadv_priv *bat_priv, uint8_t *orig,
-                           short vid, bool own_backbone)
+                           unsigned short vid, bool own_backbone)
 {
         struct batadv_bla_backbone_gw *entry;
         struct batadv_orig_node *orig_node;
@@ -380,7 +383,7 @@ batadv_bla_get_backbone_gw(struct batadv_priv *bat_priv, uint8_t *orig,
 
         batadv_dbg(BATADV_DBG_BLA, bat_priv,
                    "bla_get_backbone_gw(): not found (%pM, %d), creating new entry\n",
-                   orig, vid);
+                   orig, BATADV_PRINT_VID(vid));
 
         entry = kzalloc(sizeof(*entry), GFP_ATOMIC);
         if (!entry)
@@ -434,7 +437,7 @@ batadv_bla_get_backbone_gw(struct batadv_priv *bat_priv, uint8_t *orig,
 static void
 batadv_bla_update_own_backbone_gw(struct batadv_priv *bat_priv,
                                   struct batadv_hard_iface *primary_if,
-                                  short vid)
+                                  unsigned short vid)
 {
         struct batadv_bla_backbone_gw *backbone_gw;
 
@@ -456,7 +459,7 @@ batadv_bla_update_own_backbone_gw(struct batadv_priv *bat_priv,
  */
 static void batadv_bla_answer_request(struct batadv_priv *bat_priv,
                                       struct batadv_hard_iface *primary_if,
-                                      short vid)
+                                      unsigned short vid)
 {
         struct hlist_head *head;
         struct batadv_hashtable *hash;
@@ -547,7 +550,7 @@ static void batadv_bla_send_announce(struct batadv_priv *bat_priv,
  * @backbone_gw: the backbone gateway which claims it
  */
 static void batadv_bla_add_claim(struct batadv_priv *bat_priv,
-                                 const uint8_t *mac, const short vid,
+                                 const uint8_t *mac, const unsigned short vid,
                                  struct batadv_bla_backbone_gw *backbone_gw)
 {
         struct batadv_bla_claim *claim;
@@ -572,7 +575,7 @@ static void batadv_bla_add_claim(struct batadv_priv *bat_priv,
                 atomic_set(&claim->refcount, 2);
                 batadv_dbg(BATADV_DBG_BLA, bat_priv,
                            "bla_add_claim(): adding new entry %pM, vid %d to hash ...\n",
-                           mac, vid);
+                           mac, BATADV_PRINT_VID(vid));
                 hash_added = batadv_hash_add(bat_priv->bla.claim_hash,
                                              batadv_compare_claim,
                                              batadv_choose_claim, claim,
@@ -591,7 +594,7 @@ static void batadv_bla_add_claim(struct batadv_priv *bat_priv,
 
                 batadv_dbg(BATADV_DBG_BLA, bat_priv,
                            "bla_add_claim(): changing ownership for %pM, vid %d\n",
-                           mac, vid);
+                           mac, BATADV_PRINT_VID(vid));
 
                 claim->backbone_gw->crc ^= crc16(0, claim->addr, ETH_ALEN);
                 batadv_backbone_gw_free_ref(claim->backbone_gw);
@@ -611,7 +614,7 @@ claim_free_ref:
  * given mac address and vid.
  */
 static void batadv_bla_del_claim(struct batadv_priv *bat_priv,
-                                 const uint8_t *mac, const short vid)
+                                 const uint8_t *mac, const unsigned short vid)
 {
         struct batadv_bla_claim search_claim, *claim;
 
@@ -622,7 +625,7 @@ static void batadv_bla_del_claim(struct batadv_priv *bat_priv,
                 return;
 
         batadv_dbg(BATADV_DBG_BLA, bat_priv, "bla_del_claim(): %pM, vid %d\n",
-                   mac, vid);
+                   mac, BATADV_PRINT_VID(vid));
 
         batadv_hash_remove(bat_priv->bla.claim_hash, batadv_compare_claim,
                            batadv_choose_claim, claim);
@@ -637,7 +640,7 @@ static void batadv_bla_del_claim(struct batadv_priv *bat_priv,
 /* check for ANNOUNCE frame, return 1 if handled */
 static int batadv_handle_announce(struct batadv_priv *bat_priv,
                                   uint8_t *an_addr, uint8_t *backbone_addr,
-                                  short vid)
+                                  unsigned short vid)
 {
         struct batadv_bla_backbone_gw *backbone_gw;
         uint16_t crc;
@@ -658,12 +661,13 @@ static int batadv_handle_announce(struct batadv_priv *bat_priv,
 
         batadv_dbg(BATADV_DBG_BLA, bat_priv,
                    "handle_announce(): ANNOUNCE vid %d (sent by %pM)... CRC = %#.4x\n",
-                   vid, backbone_gw->orig, crc);
+                   BATADV_PRINT_VID(vid), backbone_gw->orig, crc);
 
         if (backbone_gw->crc != crc) {
                 batadv_dbg(BATADV_DBG_BLA, backbone_gw->bat_priv,
                            "handle_announce(): CRC FAILED for %pM/%d (my = %#.4x, sent = %#.4x)\n",
-                           backbone_gw->orig, backbone_gw->vid,
+                           backbone_gw->orig,
+                           BATADV_PRINT_VID(backbone_gw->vid),
                            backbone_gw->crc, crc);
 
                 batadv_bla_send_request(backbone_gw);
@@ -685,7 +689,7 @@ static int batadv_handle_announce(struct batadv_priv *bat_priv,
 static int batadv_handle_request(struct batadv_priv *bat_priv,
                                  struct batadv_hard_iface *primary_if,
                                  uint8_t *backbone_addr,
-                                 struct ethhdr *ethhdr, short vid)
+                                 struct ethhdr *ethhdr, unsigned short vid)
 {
         /* check for REQUEST frame */
         if (!batadv_compare_eth(backbone_addr, ethhdr->h_dest))
@@ -699,7 +703,7 @@ static int batadv_handle_request(struct batadv_priv *bat_priv,
 
         batadv_dbg(BATADV_DBG_BLA, bat_priv,
                    "handle_request(): REQUEST vid %d (sent by %pM)...\n",
-                   vid, ethhdr->h_source);
+                   BATADV_PRINT_VID(vid), ethhdr->h_source);
 
         batadv_bla_answer_request(bat_priv, primary_if, vid);
         return 1;
@@ -709,7 +713,7 @@ static int batadv_handle_request(struct batadv_priv *bat_priv,
 static int batadv_handle_unclaim(struct batadv_priv *bat_priv,
                                  struct batadv_hard_iface *primary_if,
                                  uint8_t *backbone_addr,
-                                 uint8_t *claim_addr, short vid)
+                                 uint8_t *claim_addr, unsigned short vid)
 {
         struct batadv_bla_backbone_gw *backbone_gw;
 
@@ -727,7 +731,7 @@ static int batadv_handle_unclaim(struct batadv_priv *bat_priv,
         /* this must be an UNCLAIM frame */
         batadv_dbg(BATADV_DBG_BLA, bat_priv,
                    "handle_unclaim(): UNCLAIM %pM on vid %d (sent by %pM)...\n",
-                   claim_addr, vid, backbone_gw->orig);
+                   claim_addr, BATADV_PRINT_VID(vid), backbone_gw->orig);
 
         batadv_bla_del_claim(bat_priv, claim_addr, vid);
         batadv_backbone_gw_free_ref(backbone_gw);
@@ -738,7 +742,7 @@ static int batadv_handle_unclaim(struct batadv_priv *bat_priv,
 static int batadv_handle_claim(struct batadv_priv *bat_priv,
                                struct batadv_hard_iface *primary_if,
                                uint8_t *backbone_addr, uint8_t *claim_addr,
-                               short vid)
+                               unsigned short vid)
 {
         struct batadv_bla_backbone_gw *backbone_gw;
 
@@ -861,14 +865,15 @@ static int batadv_bla_process_claim(struct batadv_priv *bat_priv,
         struct batadv_bla_claim_dst *bla_dst;
         uint16_t proto;
         int headlen;
-        short vid = -1;
+        unsigned short vid = BATADV_NO_FLAGS;
         int ret;
 
-        ethhdr = (struct ethhdr *)skb_mac_header(skb);
+        ethhdr = eth_hdr(skb);
 
         if (ntohs(ethhdr->h_proto) == ETH_P_8021Q) {
                 vhdr = (struct vlan_ethhdr *)ethhdr;
                 vid = ntohs(vhdr->h_vlan_TCI) & VLAN_VID_MASK;
+                vid |= BATADV_VLAN_HAS_TAG;
                 proto = ntohs(vhdr->h_vlan_encapsulated_proto);
                 headlen = sizeof(*vhdr);
         } else {
@@ -885,7 +890,7 @@ static int batadv_bla_process_claim(struct batadv_priv *bat_priv,
                 return 0;
 
         /* pskb_may_pull() may have modified the pointers, get ethhdr again */
-        ethhdr = (struct ethhdr *)skb_mac_header(skb);
+        ethhdr = eth_hdr(skb);
         arphdr = (struct arphdr *)((uint8_t *)ethhdr + headlen);
 
         /* Check whether the ARP frame carries a valid
@@ -910,7 +915,8 @@ static int batadv_bla_process_claim(struct batadv_priv *bat_priv,
         if (ret == 1)
                 batadv_dbg(BATADV_DBG_BLA, bat_priv,
                            "bla_process_claim(): received a claim frame from another group. From: %pM on vid %d ...(hw_src %pM, hw_dst %pM)\n",
-                           ethhdr->h_source, vid, hw_src, hw_dst);
+                           ethhdr->h_source, BATADV_PRINT_VID(vid), hw_src,
+                           hw_dst);
 
         if (ret < 2)
                 return ret;
@@ -945,7 +951,7 @@ static int batadv_bla_process_claim(struct batadv_priv *bat_priv,
 
         batadv_dbg(BATADV_DBG_BLA, bat_priv,
                    "bla_process_claim(): ERROR - this looks like a claim frame, but is useless. eth src %pM on vid %d ...(hw_src %pM, hw_dst %pM)\n",
-                   ethhdr->h_source, vid, hw_src, hw_dst);
+                   ethhdr->h_source, BATADV_PRINT_VID(vid), hw_src, hw_dst);
         return 1;
 }
 
@@ -1067,6 +1073,10 @@ void batadv_bla_update_orig_address(struct batadv_priv *bat_priv,
         group = htons(crc16(0, primary_if->net_dev->dev_addr, ETH_ALEN));
         bat_priv->bla.claim_dest.group = group;
 
+        /* purge everything when bridge loop avoidance is turned off */
+        if (!atomic_read(&bat_priv->bridge_loop_avoidance))
+                oldif = NULL;
+
         if (!oldif) {
                 batadv_bla_purge_claims(bat_priv, NULL, 1);
                 batadv_bla_purge_backbone_gw(bat_priv, 1);
@@ -1358,7 +1368,7 @@ int batadv_bla_is_backbone_gw(struct sk_buff *skb,
         struct ethhdr *ethhdr;
         struct vlan_ethhdr *vhdr;
         struct batadv_bla_backbone_gw *backbone_gw;
-        short vid = -1;
+        unsigned short vid = BATADV_NO_FLAGS;
 
         if (!atomic_read(&orig_node->bat_priv->bridge_loop_avoidance))
                 return 0;
@@ -1375,6 +1385,7 @@ int batadv_bla_is_backbone_gw(struct sk_buff *skb,
 
                 vhdr = (struct vlan_ethhdr *)(skb->data + hdr_size);
                 vid = ntohs(vhdr->h_vlan_TCI) & VLAN_VID_MASK;
+                vid |= BATADV_VLAN_HAS_TAG;
         }
 
         /* see if this originator is a backbone gw for this VLAN */
@@ -1424,15 +1435,15 @@ void batadv_bla_free(struct batadv_priv *bat_priv)
  * returns 1, otherwise it returns 0 and the caller shall further
  * process the skb.
  */
-int batadv_bla_rx(struct batadv_priv *bat_priv, struct sk_buff *skb, short vid,
-                  bool is_bcast)
+int batadv_bla_rx(struct batadv_priv *bat_priv, struct sk_buff *skb,
+                  unsigned short vid, bool is_bcast)
 {
         struct ethhdr *ethhdr;
         struct batadv_bla_claim search_claim, *claim = NULL;
         struct batadv_hard_iface *primary_if;
         int ret;
 
-        ethhdr = (struct ethhdr *)skb_mac_header(skb);
+        ethhdr = eth_hdr(skb);
 
         primary_if = batadv_primary_if_get_selected(bat_priv);
         if (!primary_if)
@@ -1518,8 +1529,11 @@ out:
  * in these cases, the skb is further handled by this function and
  * returns 1, otherwise it returns 0 and the caller shall further
  * process the skb.
+ *
+ * This call might reallocate skb data.
  */
-int batadv_bla_tx(struct batadv_priv *bat_priv, struct sk_buff *skb, short vid)
+int batadv_bla_tx(struct batadv_priv *bat_priv, struct sk_buff *skb,
+                  unsigned short vid)
 {
         struct ethhdr *ethhdr;
         struct batadv_bla_claim search_claim, *claim = NULL;
@@ -1539,7 +1553,7 @@ int batadv_bla_tx(struct batadv_priv *bat_priv, struct sk_buff *skb, short vid)
         if (batadv_bla_process_claim(bat_priv, primary_if, skb))
                 goto handled;
 
-        ethhdr = (struct ethhdr *)skb_mac_header(skb);
+        ethhdr = eth_hdr(skb);
 
         if (unlikely(atomic_read(&bat_priv->bla.num_requests)))
                 /* don't allow broadcasts while requests are in flight */
@@ -1623,8 +1637,8 @@ int batadv_bla_claim_table_seq_print_text(struct seq_file *seq, void *offset)
                 hlist_for_each_entry_rcu(claim, head, hash_entry) {
                         is_own = batadv_compare_eth(claim->backbone_gw->orig,
                                                     primary_addr);
-                        seq_printf(seq, " * %pM on % 5d by %pM [%c] (%#.4x)\n",
-                                   claim->addr, claim->vid,
+                        seq_printf(seq, " * %pM on %5d by %pM [%c] (%#.4x)\n",
+                                   claim->addr, BATADV_PRINT_VID(claim->vid),
                                    claim->backbone_gw->orig,
                                    (is_own ? 'x' : ' '),
                                    claim->backbone_gw->crc);
@@ -1676,10 +1690,10 @@ int batadv_bla_backbone_table_seq_print_text(struct seq_file *seq, void *offset)
                         if (is_own)
                                 continue;
 
-                        seq_printf(seq,
-                                   " * %pM on % 5d % 4i.%03is (%#.4x)\n",
-                                   backbone_gw->orig, backbone_gw->vid,
-                                   secs, msecs, backbone_gw->crc);
+                        seq_printf(seq, " * %pM on %5d %4i.%03is (%#.4x)\n",
+                                   backbone_gw->orig,
+                                   BATADV_PRINT_VID(backbone_gw->vid), secs,
+                                   msecs, backbone_gw->crc);
                 }
                 rcu_read_unlock();
         }
diff --git a/net/batman-adv/bridge_loop_avoidance.h b/net/batman-adv/bridge_loop_avoidance.h
index dea2fbc5d98d..4b102e71e5bd 100644
--- a/net/batman-adv/bridge_loop_avoidance.h
+++ b/net/batman-adv/bridge_loop_avoidance.h
@@ -21,9 +21,10 @@
 #define _NET_BATMAN_ADV_BLA_H_
 
 #ifdef CONFIG_BATMAN_ADV_BLA
-int batadv_bla_rx(struct batadv_priv *bat_priv, struct sk_buff *skb, short vid,
-                  bool is_bcast);
-int batadv_bla_tx(struct batadv_priv *bat_priv, struct sk_buff *skb, short vid);
+int batadv_bla_rx(struct batadv_priv *bat_priv, struct sk_buff *skb,
+                  unsigned short vid, bool is_bcast);
+int batadv_bla_tx(struct batadv_priv *bat_priv, struct sk_buff *skb,
+                  unsigned short vid);
 int batadv_bla_is_backbone_gw(struct sk_buff *skb,
                               struct batadv_orig_node *orig_node, int hdr_size);
 int batadv_bla_claim_table_seq_print_text(struct seq_file *seq, void *offset);
@@ -42,13 +43,14 @@ void batadv_bla_free(struct batadv_priv *bat_priv);
 #else /* ifdef CONFIG_BATMAN_ADV_BLA */
 
 static inline int batadv_bla_rx(struct batadv_priv *bat_priv,
-                                struct sk_buff *skb, short vid, bool is_bcast)
+                                struct sk_buff *skb, unsigned short vid,
+                                bool is_bcast)
 {
         return 0;
 }
 
 static inline int batadv_bla_tx(struct batadv_priv *bat_priv,
-                                struct sk_buff *skb, short vid)
+                                struct sk_buff *skb, unsigned short vid)
 {
         return 0;
 }
diff --git a/net/batman-adv/distributed-arp-table.c b/net/batman-adv/distributed-arp-table.c
index 239992021b1d..06345d401588 100644
--- a/net/batman-adv/distributed-arp-table.c
+++ b/net/batman-adv/distributed-arp-table.c
@@ -45,9 +45,9 @@ static void batadv_dat_start_timer(struct batadv_priv *bat_priv)
 }
 
 /**
- * batadv_dat_entry_free_ref - decrements the dat_entry refcounter and possibly
+ * batadv_dat_entry_free_ref - decrement the dat_entry refcounter and possibly
  * free it
- * @dat_entry: the oentry to free
+ * @dat_entry: the entry to free
  */
 static void batadv_dat_entry_free_ref(struct batadv_dat_entry *dat_entry)
 {
@@ -56,10 +56,10 @@ static void batadv_dat_entry_free_ref(struct batadv_dat_entry *dat_entry)
 }
 
 /**
- * batadv_dat_to_purge - checks whether a dat_entry has to be purged or not
+ * batadv_dat_to_purge - check whether a dat_entry has to be purged or not
  * @dat_entry: the entry to check
  *
- * Returns true if the entry has to be purged now, false otherwise
+ * Returns true if the entry has to be purged now, false otherwise.
  */
 static bool batadv_dat_to_purge(struct batadv_dat_entry *dat_entry)
 {
@@ -75,8 +75,8 @@ static bool batadv_dat_to_purge(struct batadv_dat_entry *dat_entry)
  *            returns a boolean value: true is the entry has to be deleted,
  *            false otherwise
  *
- * Loops over each entry in the DAT local storage and delete it if and only if
- * the to_purge function passed as argument returns true
+ * Loops over each entry in the DAT local storage and deletes it if and only if
+ * the to_purge function passed as argument returns true.
  */
 static void __batadv_dat_purge(struct batadv_priv *bat_priv,
                                bool (*to_purge)(struct batadv_dat_entry *))
@@ -97,7 +97,7 @@ static void __batadv_dat_purge(struct batadv_priv *bat_priv,
                 spin_lock_bh(list_lock);
                 hlist_for_each_entry_safe(dat_entry, node_tmp, head,
                                           hash_entry) {
-                        /* if an helper function has been passed as parameter,
+                        /* if a helper function has been passed as parameter,
                          * ask it if the entry has to be purged or not
                          */
                         if (to_purge && !to_purge(dat_entry))
@@ -134,7 +134,7 @@ static void batadv_dat_purge(struct work_struct *work)
  * @node: node in the local table
  * @data2: second object to compare the node to
  *
- * Returns 1 if the two entry are the same, 0 otherwise
+ * Returns 1 if the two entries are the same, 0 otherwise.
  */
 static int batadv_compare_dat(const struct hlist_node *node, const void *data2)
 {
@@ -149,7 +149,7 @@ static int batadv_compare_dat(const struct hlist_node *node, const void *data2)
  * @skb: ARP packet
  * @hdr_size: size of the possible header before the ARP packet
  *
- * Returns the value of the hw_src field in the ARP packet
+ * Returns the value of the hw_src field in the ARP packet.
  */
 static uint8_t *batadv_arp_hw_src(struct sk_buff *skb, int hdr_size)
 {
@@ -166,7 +166,7 @@ static uint8_t *batadv_arp_hw_src(struct sk_buff *skb, int hdr_size)
  * @skb: ARP packet
  * @hdr_size: size of the possible header before the ARP packet
  *
- * Returns the value of the ip_src field in the ARP packet
+ * Returns the value of the ip_src field in the ARP packet.
  */
 static __be32 batadv_arp_ip_src(struct sk_buff *skb, int hdr_size)
 {
@@ -178,7 +178,7 @@ static __be32 batadv_arp_ip_src(struct sk_buff *skb, int hdr_size)
  * @skb: ARP packet
  * @hdr_size: size of the possible header before the ARP packet
  *
- * Returns the value of the hw_dst field in the ARP packet
+ * Returns the value of the hw_dst field in the ARP packet.
  */
 static uint8_t *batadv_arp_hw_dst(struct sk_buff *skb, int hdr_size)
 {
@@ -190,7 +190,7 @@ static uint8_t *batadv_arp_hw_dst(struct sk_buff *skb, int hdr_size)
  * @skb: ARP packet
  * @hdr_size: size of the possible header before the ARP packet
  *
- * Returns the value of the ip_dst field in the ARP packet
+ * Returns the value of the ip_dst field in the ARP packet.
  */
 static __be32 batadv_arp_ip_dst(struct sk_buff *skb, int hdr_size)
 {
@@ -202,7 +202,7 @@ static __be32 batadv_arp_ip_dst(struct sk_buff *skb, int hdr_size)
  * @data: data to hash
  * @size: size of the hash table
  *
- * Returns the selected index in the hash table for the given data
+ * Returns the selected index in the hash table for the given data.
  */
 static uint32_t batadv_hash_dat(const void *data, uint32_t size)
 {
@@ -224,12 +224,12 @@ static uint32_t batadv_hash_dat(const void *data, uint32_t size)
 }
 
 /**
- * batadv_dat_entry_hash_find - looks for a given dat_entry in the local hash
+ * batadv_dat_entry_hash_find - look for a given dat_entry in the local hash
  * table
  * @bat_priv: the bat priv with all the soft interface information
  * @ip: search key
  *
- * Returns the dat_entry if found, NULL otherwise
+ * Returns the dat_entry if found, NULL otherwise.
  */
 static struct batadv_dat_entry *
 batadv_dat_entry_hash_find(struct batadv_priv *bat_priv, __be32 ip)
@@ -343,9 +343,6 @@ static void batadv_dbg_arp(struct batadv_priv *bat_priv, struct sk_buff *skb,
         if (hdr_size == 0)
                 return;
 
-        /* if the ARP packet is encapsulated in a batman packet, let's print
-         * some debug messages
-         */
         unicast_4addr_packet = (struct batadv_unicast_4addr_packet *)skb->data;
 
         switch (unicast_4addr_packet->u.header.packet_type) {
@@ -409,7 +406,8 @@ static void batadv_dbg_arp(struct batadv_priv *bat_priv, struct sk_buff *skb,
  * @candidate: orig_node under evaluation
  * @max_orig_node: last selected candidate
  *
- * Returns true if the node has been elected as next candidate or false othrwise
+ * Returns true if the node has been elected as next candidate or false
+ * otherwise.
  */
 static bool batadv_is_orig_node_eligible(struct batadv_dat_candidate *res,
                                          int select, batadv_dat_addr_t tmp_max,
@@ -472,7 +470,7 @@ static void batadv_choose_next_candidate(struct batadv_priv *bat_priv,
          */
         cands[select].type = BATADV_DAT_CANDIDATE_NOT_FOUND;
 
-        /* iterate over the originator list and find the node with closest
+        /* iterate over the originator list and find the node with the closest
          * dat_address which has not been selected yet
          */
         for (i = 0; i < hash->size; i++) {
@@ -480,7 +478,7 @@ static void batadv_choose_next_candidate(struct batadv_priv *bat_priv,
 
                 rcu_read_lock();
                 hlist_for_each_entry_rcu(orig_node, head, hash_entry) {
-                        /* the dht space is a ring and addresses are unsigned */
+                        /* the dht space is a ring using unsigned addresses */
                         tmp_max = BATADV_DAT_ADDR_MAX - orig_node->dat_addr +
                                   ip_key;
 
@@ -512,7 +510,7 @@ static void batadv_choose_next_candidate(struct batadv_priv *bat_priv,
 }
 
 /**
- * batadv_dat_select_candidates - selects the nodes which the DHT message has to
+ * batadv_dat_select_candidates - select the nodes which the DHT message has to
  * be sent to
  * @bat_priv: the bat priv with all the soft interface information
  * @ip_dst: ipv4 to look up in the DHT
@@ -521,7 +519,7 @@ static void batadv_choose_next_candidate(struct batadv_priv *bat_priv,
  * closest values (from the LEFT, with wrap around if needed) then the hash
  * value of the key. ip_dst is the key.
  *
- * Returns the candidate array of size BATADV_DAT_CANDIDATE_NUM
+ * Returns the candidate array of size BATADV_DAT_CANDIDATE_NUM.
  */
 static struct batadv_dat_candidate *
 batadv_dat_select_candidates(struct batadv_priv *bat_priv, __be32 ip_dst)
@@ -558,10 +556,11 @@ batadv_dat_select_candidates(struct batadv_priv *bat_priv, __be32 ip_dst)
  * @ip: the DHT key
  * @packet_subtype: unicast4addr packet subtype to use
  *
- * In this function the skb is copied by means of pskb_copy() and is sent as
- * unicast packet to each of the selected candidates
+ * This function copies the skb with pskb_copy() and is sent as unicast packet
+ * to each of the selected candidates.
  *
- * Returns true if the packet is sent to at least one candidate, false otherwise
+ * Returns true if the packet is sent to at least one candidate, false
+ * otherwise.
  */
 static bool batadv_dat_send_data(struct batadv_priv *bat_priv,
                                  struct sk_buff *skb, __be32 ip,
@@ -727,7 +726,7 @@ out:
  * @skb: packet to analyse
  * @hdr_size: size of the possible header before the ARP packet in the skb
  *
- * Returns the ARP type if the skb contains a valid ARP packet, 0 otherwise
+ * Returns the ARP type if the skb contains a valid ARP packet, 0 otherwise.
  */
 static uint16_t batadv_arp_get_type(struct batadv_priv *bat_priv,
                                     struct sk_buff *skb, int hdr_size)
@@ -754,9 +753,7 @@ static uint16_t batadv_arp_get_type(struct batadv_priv *bat_priv,
 
         arphdr = (struct arphdr *)(skb->data + hdr_size + ETH_HLEN);
 
-        /* Check whether the ARP packet carries a valid
-         * IP information
-         */
+        /* check whether the ARP packet carries a valid IP information */
         if (arphdr->ar_hrd != htons(ARPHRD_ETHER))
                 goto out;
 
@@ -784,7 +781,7 @@ static uint16_t batadv_arp_get_type(struct batadv_priv *bat_priv,
         if (is_zero_ether_addr(hw_src) || is_multicast_ether_addr(hw_src))
                 goto out;
 
-        /* we don't care about the destination MAC address in ARP requests */
+        /* don't care about the destination MAC address in ARP requests */
         if (arphdr->ar_op != htons(ARPOP_REQUEST)) {
                 hw_dst = batadv_arp_hw_dst(skb, hdr_size);
                 if (is_zero_ether_addr(hw_dst) ||
@@ -804,8 +801,8 @@ out:
  * @skb: packet to check
  *
  * Returns true if the message has been sent to the dht candidates, false
- * otherwise. In case of true the message has to be enqueued to permit the
- * fallback
+ * otherwise. In case of a positive return value the message has to be enqueued
+ * to permit the fallback.
  */
 bool batadv_dat_snoop_outgoing_arp_request(struct batadv_priv *bat_priv,
                                            struct sk_buff *skb)
@@ -867,7 +864,7 @@ bool batadv_dat_snoop_outgoing_arp_request(struct batadv_priv *bat_priv,
                 batadv_dbg(BATADV_DBG_DAT, bat_priv, "ARP request replied locally\n");
                 ret = true;
         } else {
-                /* Send the request on the DHT */
+                /* Send the request to the DHT */
                 ret = batadv_dat_send_data(bat_priv, skb, ip_dst,
                                            BATADV_P_DAT_DHT_GET);
         }
@@ -884,7 +881,7 @@ out:
  * @skb: packet to check
  * @hdr_size: size of the encapsulation header
  *
- * Returns true if the request has been answered, false otherwise
+ * Returns true if the request has been answered, false otherwise.
  */
 bool batadv_dat_snoop_incoming_arp_request(struct batadv_priv *bat_priv,
                                            struct sk_buff *skb, int hdr_size)
@@ -924,10 +921,9 @@ bool batadv_dat_snoop_incoming_arp_request(struct batadv_priv *bat_priv,
         if (!skb_new)
                 goto out;
 
-        /* to preserve backwards compatibility, here the node has to answer
-         * using the same packet type it received for the request. This is due
-         * to that if a node is not using the 4addr packet format it may not
-         * support it.
+        /* To preserve backwards compatibility, the node has choose the outgoing
+         * format based on the incoming request packet type. The assumption is
+         * that a node not using the 4addr packet format doesn't support it.
          */
         if (hdr_size == sizeof(struct batadv_unicast_4addr_packet))
                 err = batadv_unicast_4addr_send_skb(bat_priv, skb_new,
@@ -977,7 +973,7 @@ void batadv_dat_snoop_outgoing_arp_reply(struct batadv_priv *bat_priv,
         batadv_dat_entry_add(bat_priv, ip_dst, hw_dst);
 
         /* Send the ARP reply to the candidates for both the IP addresses that
-         * the node got within the ARP reply
+         * the node obtained from the ARP reply
          */
         batadv_dat_send_data(bat_priv, skb, ip_src, BATADV_P_DAT_DHT_PUT);
         batadv_dat_send_data(bat_priv, skb, ip_dst, BATADV_P_DAT_DHT_PUT);
@@ -987,7 +983,7 @@ void batadv_dat_snoop_outgoing_arp_reply(struct batadv_priv *bat_priv,
  * DAT storage only
  * @bat_priv: the bat priv with all the soft interface information
  * @skb: packet to check
- * @hdr_size: siaze of the encapsulation header
+ * @hdr_size: size of the encapsulation header
  */
 bool batadv_dat_snoop_incoming_arp_reply(struct batadv_priv *bat_priv,
                                          struct sk_buff *skb, int hdr_size)
@@ -1031,11 +1027,11 @@ out:
 
 /**
  * batadv_dat_drop_broadcast_packet - check if an ARP request has to be dropped
- * (because the node has already got the reply via DAT) or not
+ * (because the node has already obtained the reply via DAT) or not
  * @bat_priv: the bat priv with all the soft interface information
  * @forw_packet: the broadcast packet
  *
- * Returns true if the node can drop the packet, false otherwise
+ * Returns true if the node can drop the packet, false otherwise.
  */
 bool batadv_dat_drop_broadcast_packet(struct batadv_priv *bat_priv,
                                       struct batadv_forw_packet *forw_packet)
diff --git a/net/batman-adv/gateway_client.c b/net/batman-adv/gateway_client.c
index f105219f4a4b..1ce4b8763ef2 100644
--- a/net/batman-adv/gateway_client.c
+++ b/net/batman-adv/gateway_client.c
@@ -190,6 +190,33 @@ next:
         return curr_gw;
 }
 
+/**
+ * batadv_gw_check_client_stop - check if client mode has been switched off
+ * @bat_priv: the bat priv with all the soft interface information
+ *
+ * This function assumes the caller has checked that the gw state *is actually
+ * changing*. This function is not supposed to be called when there is no state
+ * change.
+ */
+void batadv_gw_check_client_stop(struct batadv_priv *bat_priv)
+{
+        struct batadv_gw_node *curr_gw;
+
+        if (atomic_read(&bat_priv->gw_mode) != BATADV_GW_MODE_CLIENT)
+                return;
+
+        curr_gw = batadv_gw_get_selected_gw_node(bat_priv);
+        if (!curr_gw)
+                return;
+
+        /* if batman-adv is switching the gw client mode off and a gateway was
+         * already selected, send a DEL uevent
+         */
+        batadv_throw_uevent(bat_priv, BATADV_UEV_GW, BATADV_UEV_DEL, NULL);
+
+        batadv_gw_node_free_ref(curr_gw);
+}
+
 void batadv_gw_election(struct batadv_priv *bat_priv)
 {
         struct batadv_gw_node *curr_gw = NULL, *next_gw = NULL;
@@ -508,6 +535,7 @@ out:
         return 0;
 }
 
+/* this call might reallocate skb data */
 static bool batadv_is_type_dhcprequest(struct sk_buff *skb, int header_len)
 {
         int ret = false;
@@ -568,6 +596,7 @@ out:
         return ret;
 }
 
+/* this call might reallocate skb data */
 bool batadv_gw_is_dhcp_target(struct sk_buff *skb, unsigned int *header_len)
 {
         struct ethhdr *ethhdr;
@@ -619,6 +648,12 @@ bool batadv_gw_is_dhcp_target(struct sk_buff *skb, unsigned int *header_len)
 
         if (!pskb_may_pull(skb, *header_len + sizeof(*udphdr)))
                 return false;
+
+        /* skb->data might have been reallocated by pskb_may_pull() */
+        ethhdr = (struct ethhdr *)skb->data;
+        if (ntohs(ethhdr->h_proto) == ETH_P_8021Q)
+                ethhdr = (struct ethhdr *)(skb->data + VLAN_HLEN);
+
         udphdr = (struct udphdr *)(skb->data + *header_len);
         *header_len += sizeof(*udphdr);
 
@@ -634,12 +669,14 @@ bool batadv_gw_is_dhcp_target(struct sk_buff *skb, unsigned int *header_len)
         return true;
 }
 
+/* this call might reallocate skb data */
 bool batadv_gw_out_of_range(struct batadv_priv *bat_priv,
-                            struct sk_buff *skb, struct ethhdr *ethhdr)
+                            struct sk_buff *skb)
 {
         struct batadv_neigh_node *neigh_curr = NULL, *neigh_old = NULL;
         struct batadv_orig_node *orig_dst_node = NULL;
         struct batadv_gw_node *curr_gw = NULL;
+        struct ethhdr *ethhdr;
         bool ret, out_of_range = false;
         unsigned int header_len = 0;
         uint8_t curr_tq_avg;
@@ -648,6 +685,7 @@ bool batadv_gw_out_of_range(struct batadv_priv *bat_priv,
         if (!ret)
                 goto out;
 
+        ethhdr = (struct ethhdr *)skb->data;
         orig_dst_node = batadv_transtable_search(bat_priv, ethhdr->h_source,
                                                  ethhdr->h_dest);
         if (!orig_dst_node)
diff --git a/net/batman-adv/gateway_client.h b/net/batman-adv/gateway_client.h
index 039902dca4a6..ceef4ebe8bcd 100644
--- a/net/batman-adv/gateway_client.h
+++ b/net/batman-adv/gateway_client.h
@@ -20,6 +20,7 @@
 #ifndef _NET_BATMAN_ADV_GATEWAY_CLIENT_H_
 #define _NET_BATMAN_ADV_GATEWAY_CLIENT_H_
 
+void batadv_gw_check_client_stop(struct batadv_priv *bat_priv);
 void batadv_gw_deselect(struct batadv_priv *bat_priv);
 void batadv_gw_election(struct batadv_priv *bat_priv);
 struct batadv_orig_node *
@@ -34,7 +35,6 @@ void batadv_gw_node_delete(struct batadv_priv *bat_priv,
 void batadv_gw_node_purge(struct batadv_priv *bat_priv);
 int batadv_gw_client_seq_print_text(struct seq_file *seq, void *offset);
 bool batadv_gw_is_dhcp_target(struct sk_buff *skb, unsigned int *header_len);
-bool batadv_gw_out_of_range(struct batadv_priv *bat_priv,
-                            struct sk_buff *skb, struct ethhdr *ethhdr);
+bool batadv_gw_out_of_range(struct batadv_priv *bat_priv, struct sk_buff *skb);
 
 #endif /* _NET_BATMAN_ADV_GATEWAY_CLIENT_H_ */
diff --git a/net/batman-adv/hard-interface.c b/net/batman-adv/hard-interface.c
index 522243aff2f3..c478e6bcf89b 100644
--- a/net/batman-adv/hard-interface.c
+++ b/net/batman-adv/hard-interface.c
@@ -117,6 +117,58 @@ static int batadv_is_valid_iface(const struct net_device *net_dev)
         return 1;
 }
 
+/**
+ * batadv_is_wifi_netdev - check if the given net_device struct is a wifi
+ *  interface
+ * @net_device: the device to check
+ *
+ * Returns true if the net device is a 802.11 wireless device, false otherwise.
+ */
+static bool batadv_is_wifi_netdev(struct net_device *net_device)
+{
+#ifdef CONFIG_WIRELESS_EXT
+        /* pre-cfg80211 drivers have to implement WEXT, so it is possible to
+         * check for wireless_handlers != NULL
+         */
+        if (net_device->wireless_handlers)
+                return true;
+#endif
+
+        /* cfg80211 drivers have to set ieee80211_ptr */
+        if (net_device->ieee80211_ptr)
+                return true;
+
+        return false;
+}
+
+/**
+ * batadv_is_wifi_iface - check if the given interface represented by ifindex
+ *  is a wifi interface
+ * @ifindex: interface index to check
+ *
+ * Returns true if the interface represented by ifindex is a 802.11 wireless
+ * device, false otherwise.
+ */
+bool batadv_is_wifi_iface(int ifindex)
+{
+        struct net_device *net_device = NULL;
+        bool ret = false;
+
+        if (ifindex == BATADV_NULL_IFINDEX)
+                goto out;
+
+        net_device = dev_get_by_index(&init_net, ifindex);
+        if (!net_device)
+                goto out;
+
+        ret = batadv_is_wifi_netdev(net_device);
+
+out:
+        if (net_device)
+                dev_put(net_device);
+        return ret;
+}
+
 static struct batadv_hard_iface *
 batadv_hardif_get_active(const struct net_device *soft_iface)
 {
@@ -525,7 +577,7 @@ batadv_hardif_add_interface(struct net_device *net_dev)
 
         dev_hold(net_dev);
 
-        hard_iface = kmalloc(sizeof(*hard_iface), GFP_ATOMIC);
+        hard_iface = kzalloc(sizeof(*hard_iface), GFP_ATOMIC);
         if (!hard_iface)
                 goto release_dev;
 
@@ -541,18 +593,16 @@ batadv_hardif_add_interface(struct net_device *net_dev)
         INIT_WORK(&hard_iface->cleanup_work,
                   batadv_hardif_remove_interface_finish);
 
+        hard_iface->num_bcasts = BATADV_NUM_BCASTS_DEFAULT;
+        if (batadv_is_wifi_netdev(net_dev))
+                hard_iface->num_bcasts = BATADV_NUM_BCASTS_WIRELESS;
+
         /* extra reference for return */
         atomic_set(&hard_iface->refcount, 2);
 
         batadv_check_known_mac_addr(hard_iface->net_dev);
         list_add_tail_rcu(&hard_iface->list, &batadv_hardif_list);
 
-        /* This can't be called via a bat_priv callback because
-         * we have no bat_priv yet.
-         */
-        atomic_set(&hard_iface->bat_iv.ogm_seqno, 1);
-        hard_iface->bat_iv.ogm_buff = NULL;
-
         return hard_iface;
 
 free_if:
@@ -595,7 +645,7 @@ void batadv_hardif_remove_interfaces(void)
 static int batadv_hard_if_event(struct notifier_block *this,
                                 unsigned long event, void *ptr)
 {
-        struct net_device *net_dev = ptr;
+        struct net_device *net_dev = netdev_notifier_info_to_dev(ptr);
         struct batadv_hard_iface *hard_iface;
         struct batadv_hard_iface *primary_if = NULL;
         struct batadv_priv *bat_priv;
@@ -657,38 +707,6 @@ out:
         return NOTIFY_DONE;
 }
 
-/* This function returns true if the interface represented by ifindex is a
- * 802.11 wireless device
- */
-bool batadv_is_wifi_iface(int ifindex)
-{
-        struct net_device *net_device = NULL;
-        bool ret = false;
-
-        if (ifindex == BATADV_NULL_IFINDEX)
-                goto out;
-
-        net_device = dev_get_by_index(&init_net, ifindex);
-        if (!net_device)
-                goto out;
-
-#ifdef CONFIG_WIRELESS_EXT
-        /* pre-cfg80211 drivers have to implement WEXT, so it is possible to
-         * check for wireless_handlers != NULL
-         */
-        if (net_device->wireless_handlers)
-                ret = true;
-        else
-#endif
-                /* cfg80211 drivers have to set ieee80211_ptr */
-                if (net_device->ieee80211_ptr)
-                        ret = true;
-out:
-        if (net_device)
-                dev_put(net_device);
-        return ret;
-}
-
 struct notifier_block batadv_hard_if_notifier = {
         .notifier_call = batadv_hard_if_event,
 };
diff --git a/net/batman-adv/icmp_socket.c b/net/batman-adv/icmp_socket.c
index 0ba6c899b2d3..5a99bb4b6b82 100644
--- a/net/batman-adv/icmp_socket.c
+++ b/net/batman-adv/icmp_socket.c
@@ -177,13 +177,14 @@ static ssize_t batadv_socket_write(struct file *file, const char __user *buff,
         if (len >= sizeof(struct batadv_icmp_packet_rr))
                 packet_len = sizeof(struct batadv_icmp_packet_rr);
 
-        skb = dev_alloc_skb(packet_len + ETH_HLEN + NET_IP_ALIGN);
+        skb = netdev_alloc_skb_ip_align(NULL, packet_len + ETH_HLEN);
         if (!skb) {
                 len = -ENOMEM;
                 goto out;
         }
 
-        skb_reserve(skb, ETH_HLEN + NET_IP_ALIGN);
+        skb->priority = TC_PRIO_CONTROL;
+        skb_reserve(skb, ETH_HLEN);
         icmp_packet = (struct batadv_icmp_packet_rr *)skb_put(skb, packet_len);
 
         if (copy_from_user(icmp_packet, buff, packet_len)) {
diff --git a/net/batman-adv/main.c b/net/batman-adv/main.c
index 51aafd669cbb..c72d1bcdcf49 100644
--- a/net/batman-adv/main.c
+++ b/net/batman-adv/main.c
@@ -19,6 +19,10 @@
 
 #include <linux/crc32c.h>
 #include <linux/highmem.h>
+#include <linux/if_vlan.h>
+#include <net/ip.h>
+#include <net/ipv6.h>
+#include <net/dsfield.h>
 #include "main.h"
 #include "sysfs.h"
 #include "debugfs.h"
@@ -249,6 +253,60 @@ out:
         return primary_if;
 }
 
+/**
+ * batadv_skb_set_priority - sets skb priority according to packet content
+ * @skb: the packet to be sent
+ * @offset: offset to the packet content
+ *
+ * This function sets a value between 256 and 263 (802.1d priority), which
+ * can be interpreted by the cfg80211 or other drivers.
+ */
+void batadv_skb_set_priority(struct sk_buff *skb, int offset)
+{
+        struct iphdr ip_hdr_tmp, *ip_hdr;
+        struct ipv6hdr ip6_hdr_tmp, *ip6_hdr;
+        struct ethhdr ethhdr_tmp, *ethhdr;
+        struct vlan_ethhdr *vhdr, vhdr_tmp;
+        u32 prio;
+
+        /* already set, do nothing */
+        if (skb->priority >= 256 && skb->priority <= 263)
+                return;
+
+        ethhdr = skb_header_pointer(skb, offset, sizeof(*ethhdr), &ethhdr_tmp);
+        if (!ethhdr)
+                return;
+
+        switch (ethhdr->h_proto) {
+        case htons(ETH_P_8021Q):
+                vhdr = skb_header_pointer(skb, offset + sizeof(*vhdr),
+                                          sizeof(*vhdr), &vhdr_tmp);
+                if (!vhdr)
+                        return;
+                prio = ntohs(vhdr->h_vlan_TCI) & VLAN_PRIO_MASK;
+                prio = prio >> VLAN_PRIO_SHIFT;
+                break;
+        case htons(ETH_P_IP):
+                ip_hdr = skb_header_pointer(skb, offset + sizeof(*ethhdr),
+                                            sizeof(*ip_hdr), &ip_hdr_tmp);
+                if (!ip_hdr)
+                        return;
+                prio = (ipv4_get_dsfield(ip_hdr) & 0xfc) >> 5;
+                break;
+        case htons(ETH_P_IPV6):
+                ip6_hdr = skb_header_pointer(skb, offset + sizeof(*ethhdr),
+                                             sizeof(*ip6_hdr), &ip6_hdr_tmp);
+                if (!ip6_hdr)
+                        return;
+                prio = (ipv6_get_dsfield(ip6_hdr) & 0xfc) >> 5;
+                break;
+        default:
+                return;
+        }
+
+        skb->priority = prio + 256;
+}
+
 static int batadv_recv_unhandled_packet(struct sk_buff *skb,
                                         struct batadv_hard_iface *recv_if)
 {
@@ -473,7 +531,6 @@ __be32 batadv_skb_crc32(struct sk_buff *skb, u8 *payload_ptr)
                 crc = crc32c(crc, data, len);
                 consumed += len;
         }
-        skb_abort_seq_read(&st);
 
         return htonl(crc);
 }
diff --git a/net/batman-adv/main.h b/net/batman-adv/main.h
index 59a0d6af15c8..24675523930f 100644
--- a/net/batman-adv/main.h
+++ b/net/batman-adv/main.h
@@ -26,7 +26,7 @@
 #define BATADV_DRIVER_DEVICE "batman-adv"
 
 #ifndef BATADV_SOURCE_VERSION
-#define BATADV_SOURCE_VERSION "2013.2.0"
+#define BATADV_SOURCE_VERSION "2013.4.0"
 #endif
 
 /* B.A.T.M.A.N. parameters */
@@ -76,6 +76,11 @@
 
 #define BATADV_LOG_BUF_LEN 8192   /* has to be a power of 2 */
 
+/* number of packets to send for broadcasts on different interface types */
+#define BATADV_NUM_BCASTS_DEFAULT 1
+#define BATADV_NUM_BCASTS_WIRELESS 3
+#define BATADV_NUM_BCASTS_MAX 3
+
 /* msecs after which an ARP_REQUEST is sent in broadcast as fallback */
 #define ARP_REQ_DELAY 250
 /* numbers of originator to contact for any PUT/GET DHT operation */
@@ -157,6 +162,17 @@ enum batadv_uev_type {
 #include <linux/seq_file.h>
 #include "types.h"
 
+/**
+ * batadv_vlan_flags - flags for the four MSB of any vlan ID field
+ * @BATADV_VLAN_HAS_TAG: whether the field contains a valid vlan tag or not
+ */
+enum batadv_vlan_flags {
+        BATADV_VLAN_HAS_TAG     = BIT(15),
+};
+
+#define BATADV_PRINT_VID(vid) (vid & BATADV_VLAN_HAS_TAG ? \
+                               (int)(vid & VLAN_VID_MASK) : -1)
+
 extern char batadv_routing_algo[];
 extern struct list_head batadv_hardif_list;
 
@@ -168,6 +184,7 @@ void batadv_mesh_free(struct net_device *soft_iface);
 int batadv_is_my_mac(struct batadv_priv *bat_priv, const uint8_t *addr);
 struct batadv_hard_iface *
 batadv_seq_print_text_primary_if_get(struct seq_file *seq);
+void batadv_skb_set_priority(struct sk_buff *skb, int offset);
 int batadv_batman_skb_recv(struct sk_buff *skb, struct net_device *dev,
                            struct packet_type *ptype,
                            struct net_device *orig_dev);
@@ -237,7 +254,7 @@ static inline void batadv_dbg(int type __always_unused,
 
 /* returns 1 if they are the same ethernet addr
  *
- * note: can't use compare_ether_addr() as it requires aligned memory
+ * note: can't use ether_addr_equal() as it requires aligned memory
  */
 static inline int batadv_compare_eth(const void *data1, const void *data2)
 {
diff --git a/net/batman-adv/network-coding.c b/net/batman-adv/network-coding.c
index e84629ece9b7..a487d46e0aec 100644
--- a/net/batman-adv/network-coding.c
+++ b/net/batman-adv/network-coding.c
@@ -1245,7 +1245,7 @@ static void batadv_nc_skb_store_before_coding(struct batadv_priv *bat_priv,
                 return;
 
         /* Set the mac header as if we actually sent the packet uncoded */
-        ethhdr = (struct ethhdr *)skb_mac_header(skb);
+        ethhdr = eth_hdr(skb);
         memcpy(ethhdr->h_source, ethhdr->h_dest, ETH_ALEN);
         memcpy(ethhdr->h_dest, eth_dst_new, ETH_ALEN);
 
@@ -1359,18 +1359,17 @@ static bool batadv_nc_skb_add_to_path(struct sk_buff *skb,
  *  buffer
  * @skb: data skb to forward
  * @neigh_node: next hop to forward packet to
- * @ethhdr: pointer to the ethernet header inside the skb
  *
  * Returns true if the skb was consumed (encoded packet sent) or false otherwise
  */
 bool batadv_nc_skb_forward(struct sk_buff *skb,
-                           struct batadv_neigh_node *neigh_node,
-                           struct ethhdr *ethhdr)
+                           struct batadv_neigh_node *neigh_node)
 {
         const struct net_device *netdev = neigh_node->if_incoming->soft_iface;
         struct batadv_priv *bat_priv = netdev_priv(netdev);
         struct batadv_unicast_packet *packet;
         struct batadv_nc_path *nc_path;
+        struct ethhdr *ethhdr = eth_hdr(skb);
         __be32 packet_id;
         u8 *payload;
 
@@ -1423,7 +1422,7 @@ void batadv_nc_skb_store_for_decoding(struct batadv_priv *bat_priv,
 {
         struct batadv_unicast_packet *packet;
         struct batadv_nc_path *nc_path;
-        struct ethhdr *ethhdr = (struct ethhdr *)skb_mac_header(skb);
+        struct ethhdr *ethhdr = eth_hdr(skb);
         __be32 packet_id;
         u8 *payload;
 
@@ -1482,7 +1481,7 @@ out:
 void batadv_nc_skb_store_sniffed_unicast(struct batadv_priv *bat_priv,
                                          struct sk_buff *skb)
 {
-        struct ethhdr *ethhdr = (struct ethhdr *)skb_mac_header(skb);
+        struct ethhdr *ethhdr = eth_hdr(skb);
 
         if (batadv_is_my_mac(bat_priv, ethhdr->h_dest))
                 return;
@@ -1533,7 +1532,7 @@ batadv_nc_skb_decode_packet(struct batadv_priv *bat_priv, struct sk_buff *skb,
         skb_reset_network_header(skb);
 
         /* Reconstruct original mac header */
-        ethhdr = (struct ethhdr *)skb_mac_header(skb);
+        ethhdr = eth_hdr(skb);
         memcpy(ethhdr, &ethhdr_tmp, sizeof(*ethhdr));
 
         /* Select the correct unicast header information based on the location
@@ -1677,7 +1676,7 @@ static int batadv_nc_recv_coded_packet(struct sk_buff *skb,
                 return NET_RX_DROP;
 
         coded_packet = (struct batadv_coded_packet *)skb->data;
-        ethhdr = (struct ethhdr *)skb_mac_header(skb);
+        ethhdr = eth_hdr(skb);
 
         /* Verify frame is destined for us */
         if (!batadv_is_my_mac(bat_priv, ethhdr->h_dest) &&
@@ -1763,6 +1762,13 @@ int batadv_nc_nodes_seq_print_text(struct seq_file *seq, void *offset)
                 /* For each orig_node in this bin */
                 rcu_read_lock();
                 hlist_for_each_entry_rcu(orig_node, head, hash_entry) {
+                        /* no need to print the orig node if it does not have
+                         * network coding neighbors
+                         */
+                        if (list_empty(&orig_node->in_coding_list) &&
+                            list_empty(&orig_node->out_coding_list))
+                                continue;
+
                         seq_printf(seq, "Node:      %pM\n", orig_node->orig);
 
                         seq_puts(seq, " Ingoing:  ");
diff --git a/net/batman-adv/network-coding.h b/net/batman-adv/network-coding.h
index 4fa6d0caddbd..85a4ec81ad50 100644
--- a/net/batman-adv/network-coding.h
+++ b/net/batman-adv/network-coding.h
@@ -36,8 +36,7 @@ void batadv_nc_purge_orig(struct batadv_priv *bat_priv,
 void batadv_nc_init_bat_priv(struct batadv_priv *bat_priv);
 void batadv_nc_init_orig(struct batadv_orig_node *orig_node);
 bool batadv_nc_skb_forward(struct sk_buff *skb,
-                           struct batadv_neigh_node *neigh_node,
-                           struct ethhdr *ethhdr);
+                           struct batadv_neigh_node *neigh_node);
 void batadv_nc_skb_store_for_decoding(struct batadv_priv *bat_priv,
                                       struct sk_buff *skb);
 void batadv_nc_skb_store_sniffed_unicast(struct batadv_priv *bat_priv,
@@ -87,8 +86,7 @@ static inline void batadv_nc_init_orig(struct batadv_orig_node *orig_node)
 }
 
 static inline bool batadv_nc_skb_forward(struct sk_buff *skb,
-                                         struct batadv_neigh_node *neigh_node,
-                                         struct ethhdr *ethhdr)
+                                         struct batadv_neigh_node *neigh_node)
 {
         return false;
 }
diff --git a/net/batman-adv/originator.c b/net/batman-adv/originator.c
index fad1a2093e15..f50553a7de62 100644
--- a/net/batman-adv/originator.c
+++ b/net/batman-adv/originator.c
@@ -92,7 +92,7 @@ batadv_orig_node_get_router(struct batadv_orig_node *orig_node)
 
 struct batadv_neigh_node *
 batadv_neigh_node_new(struct batadv_hard_iface *hard_iface,
-                      const uint8_t *neigh_addr, uint32_t seqno)
+                      const uint8_t *neigh_addr)
 {
         struct batadv_priv *bat_priv = netdev_priv(hard_iface->soft_iface);
         struct batadv_neigh_node *neigh_node;
@@ -110,8 +110,8 @@ batadv_neigh_node_new(struct batadv_hard_iface *hard_iface,
         atomic_set(&neigh_node->refcount, 2);
 
         batadv_dbg(BATADV_DBG_BATMAN, bat_priv,
-                   "Creating new neighbor %pM, initial seqno %d\n",
-                   neigh_addr, seqno);
+                   "Creating new neighbor %pM on interface %s\n", neigh_addr,
+                   hard_iface->net_dev->name);
 
 out:
         return neigh_node;
diff --git a/net/batman-adv/originator.h b/net/batman-adv/originator.h
index 734e5a3d8a5b..7887b84a9af4 100644
--- a/net/batman-adv/originator.h
+++ b/net/batman-adv/originator.h
@@ -31,7 +31,7 @@ struct batadv_orig_node *batadv_get_orig_node(struct batadv_priv *bat_priv,
                                               const uint8_t *addr);
 struct batadv_neigh_node *
 batadv_neigh_node_new(struct batadv_hard_iface *hard_iface,
-                      const uint8_t *neigh_addr, uint32_t seqno);
+                      const uint8_t *neigh_addr);
 void batadv_neigh_node_free_ref(struct batadv_neigh_node *neigh_node);
 struct batadv_neigh_node *
 batadv_orig_node_get_router(struct batadv_orig_node *orig_node);
diff --git a/net/batman-adv/ring_buffer.c b/net/batman-adv/ring_buffer.c
deleted file mode 100644
index ccab0bbdbb59..000000000000
--- a/net/batman-adv/ring_buffer.c
+++ /dev/null
@@ -1,51 +0,0 @@
-/* Copyright (C) 2007-2013 B.A.T.M.A.N. contributors:
- *
- * Marek Lindner
- *
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of version 2 of the GNU General Public
- * License as published by the Free Software Foundation.
- *
- * This program is distributed in the hope that it will be useful, but
- * WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
- * General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
- * 02110-1301, USA
- */
-
-#include "main.h"
-#include "ring_buffer.h"
-
-void batadv_ring_buffer_set(uint8_t lq_recv[], uint8_t *lq_index,
-                            uint8_t value)
-{
-        lq_recv[*lq_index] = value;
-        *lq_index = (*lq_index + 1) % BATADV_TQ_GLOBAL_WINDOW_SIZE;
-}
-
-uint8_t batadv_ring_buffer_avg(const uint8_t lq_recv[])
-{
-        const uint8_t *ptr;
-        uint16_t count = 0, i = 0, sum = 0;
-
-        ptr = lq_recv;
-
-        while (i < BATADV_TQ_GLOBAL_WINDOW_SIZE) {
-                if (*ptr != 0) {
-                        count++;
-                        sum += *ptr;
-                }
-
-                i++;
-                ptr++;
-        }
-
-        if (count == 0)
-                return 0;
-
-        return (uint8_t)(sum / count);
-}
diff --git a/net/batman-adv/ring_buffer.h b/net/batman-adv/ring_buffer.h
deleted file mode 100644
index 3f92ae248e83..000000000000
--- a/net/batman-adv/ring_buffer.h
+++ /dev/null
@@ -1,27 +0,0 @@
-/* Copyright (C) 2007-2013 B.A.T.M.A.N. contributors:
- *
- * Marek Lindner
- *
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of version 2 of the GNU General Public
- * License as published by the Free Software Foundation.
- *
- * This program is distributed in the hope that it will be useful, but
- * WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
- * General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
- * 02110-1301, USA
- */
-
-#ifndef _NET_BATMAN_ADV_RING_BUFFER_H_
-#define _NET_BATMAN_ADV_RING_BUFFER_H_
-
-void batadv_ring_buffer_set(uint8_t lq_recv[], uint8_t *lq_index,
-                            uint8_t value);
-uint8_t batadv_ring_buffer_avg(const uint8_t lq_recv[]);
-
-#endif /* _NET_BATMAN_ADV_RING_BUFFER_H_ */
diff --git a/net/batman-adv/routing.c b/net/batman-adv/routing.c
index b27a4d792d15..0439395d7ba5 100644
--- a/net/batman-adv/routing.c
+++ b/net/batman-adv/routing.c
@@ -34,35 +34,6 @@
 static int batadv_route_unicast_packet(struct sk_buff *skb,
                                        struct batadv_hard_iface *recv_if);
 
-void batadv_slide_own_bcast_window(struct batadv_hard_iface *hard_iface)
-{
-        struct batadv_priv *bat_priv = netdev_priv(hard_iface->soft_iface);
-        struct batadv_hashtable *hash = bat_priv->orig_hash;
-        struct hlist_head *head;
-        struct batadv_orig_node *orig_node;
-        unsigned long *word;
-        uint32_t i;
-        size_t word_index;
-        uint8_t *w;
-
-        for (i = 0; i < hash->size; i++) {
-                head = &hash->table[i];
-
-                rcu_read_lock();
-                hlist_for_each_entry_rcu(orig_node, head, hash_entry) {
-                        spin_lock_bh(&orig_node->ogm_cnt_lock);
-                        word_index = hard_iface->if_num * BATADV_NUM_WORDS;
-                        word = &(orig_node->bcast_own[word_index]);
-
-                        batadv_bit_get_packet(bat_priv, word, 1, 0);
-                        w = &orig_node->bcast_own_sum[hard_iface->if_num];
-                        *w = bitmap_weight(word, BATADV_TQ_LOCAL_WINDOW_SIZE);
-                        spin_unlock_bh(&orig_node->ogm_cnt_lock);
-                }
-                rcu_read_unlock();
-        }
-}
-
 static void _batadv_update_route(struct batadv_priv *bat_priv,
                                  struct batadv_orig_node *orig_node,
                                  struct batadv_neigh_node *neigh_node)
@@ -256,7 +227,7 @@ bool batadv_check_management_packet(struct sk_buff *skb,
         if (unlikely(!pskb_may_pull(skb, header_len)))
                 return false;
 
-        ethhdr = (struct ethhdr *)skb_mac_header(skb);
+        ethhdr = eth_hdr(skb);
 
         /* packet with broadcast indication but unicast recipient */
         if (!is_broadcast_ether_addr(ethhdr->h_dest))
@@ -314,7 +285,7 @@ static int batadv_recv_my_icmp_packet(struct batadv_priv *bat_priv,
         icmp_packet->msg_type = BATADV_ECHO_REPLY;
         icmp_packet->header.ttl = BATADV_TTL;
 
-        if (batadv_send_skb_to_orig(skb, orig_node, NULL))
+        if (batadv_send_skb_to_orig(skb, orig_node, NULL) != NET_XMIT_DROP)
                 ret = NET_RX_SUCCESS;
 
 out:
@@ -362,7 +333,7 @@ static int batadv_recv_icmp_ttl_exceeded(struct batadv_priv *bat_priv,
         icmp_packet->msg_type = BATADV_TTL_EXCEEDED;
         icmp_packet->header.ttl = BATADV_TTL;
 
-        if (batadv_send_skb_to_orig(skb, orig_node, NULL))
+        if (batadv_send_skb_to_orig(skb, orig_node, NULL) != NET_XMIT_DROP)
                 ret = NET_RX_SUCCESS;
 
 out:
@@ -392,7 +363,7 @@ int batadv_recv_icmp_packet(struct sk_buff *skb,
         if (unlikely(!pskb_may_pull(skb, hdr_size)))
                 goto out;
 
-        ethhdr = (struct ethhdr *)skb_mac_header(skb);
+        ethhdr = eth_hdr(skb);
 
         /* packet with unicast indication but broadcast recipient */
         if (is_broadcast_ether_addr(ethhdr->h_dest))
@@ -439,7 +410,7 @@ int batadv_recv_icmp_packet(struct sk_buff *skb,
         icmp_packet->header.ttl--;
 
         /* route it */
-        if (batadv_send_skb_to_orig(skb, orig_node, recv_if))
+        if (batadv_send_skb_to_orig(skb, orig_node, recv_if) != NET_XMIT_DROP)
                 ret = NET_RX_SUCCESS;
 
 out:
@@ -569,7 +540,7 @@ static int batadv_check_unicast_packet(struct batadv_priv *bat_priv,
         if (unlikely(!pskb_may_pull(skb, hdr_size)))
                 return -ENODATA;
 
-        ethhdr = (struct ethhdr *)skb_mac_header(skb);
+        ethhdr = eth_hdr(skb);
 
         /* packet with unicast indication but broadcast recipient */
         if (is_broadcast_ether_addr(ethhdr->h_dest))
@@ -803,8 +774,8 @@ static int batadv_route_unicast_packet(struct sk_buff *skb,
         struct batadv_orig_node *orig_node = NULL;
         struct batadv_neigh_node *neigh_node = NULL;
         struct batadv_unicast_packet *unicast_packet;
-        struct ethhdr *ethhdr = (struct ethhdr *)skb_mac_header(skb);
-        int ret = NET_RX_DROP;
+        struct ethhdr *ethhdr = eth_hdr(skb);
+        int res, hdr_len, ret = NET_RX_DROP;
         struct sk_buff *new_skb;
 
         unicast_packet = (struct batadv_unicast_packet *)skb->data;
@@ -864,16 +835,35 @@ static int batadv_route_unicast_packet(struct sk_buff *skb,
         /* decrement ttl */
         unicast_packet->header.ttl--;
 
-        /* network code packet if possible */
-        if (batadv_nc_skb_forward(skb, neigh_node, ethhdr)) {
-                ret = NET_RX_SUCCESS;
-        } else if (batadv_send_skb_to_orig(skb, orig_node, recv_if)) {
-                ret = NET_RX_SUCCESS;
+        switch (unicast_packet->header.packet_type) {
+        case BATADV_UNICAST_4ADDR:
+                hdr_len = sizeof(struct batadv_unicast_4addr_packet);
+                break;
+        case BATADV_UNICAST:
+                hdr_len = sizeof(struct batadv_unicast_packet);
+                break;
+        default:
+                /* other packet types not supported - yet */
+                hdr_len = -1;
+                break;
+        }
+
+        if (hdr_len > 0)
+                batadv_skb_set_priority(skb, hdr_len);
+
+        res = batadv_send_skb_to_orig(skb, orig_node, recv_if);
 
-                /* Update stats counter */
+        /* translate transmit result into receive result */
+        if (res == NET_XMIT_SUCCESS) {
+                /* skb was transmitted and consumed */
                 batadv_inc_counter(bat_priv, BATADV_CNT_FORWARD);
                 batadv_add_counter(bat_priv, BATADV_CNT_FORWARD_BYTES,
                                    skb->len + ETH_HLEN);
+
+                ret = NET_RX_SUCCESS;
+        } else if (res == NET_XMIT_POLICED) {
+                /* skb was buffered and consumed */
+                ret = NET_RX_SUCCESS;
         }
 
 out:
@@ -1165,7 +1155,7 @@ int batadv_recv_bcast_packet(struct sk_buff *skb,
         if (unlikely(!pskb_may_pull(skb, hdr_size)))
                 goto out;
 
-        ethhdr = (struct ethhdr *)skb_mac_header(skb);
+        ethhdr = eth_hdr(skb);
 
         /* packet with broadcast indication but unicast recipient */
         if (!is_broadcast_ether_addr(ethhdr->h_dest))
@@ -1219,6 +1209,8 @@ int batadv_recv_bcast_packet(struct sk_buff *skb,
         if (batadv_bla_check_bcast_duplist(bat_priv, skb))
                 goto out;
 
+        batadv_skb_set_priority(skb, sizeof(struct batadv_bcast_packet));
+
         /* rebroadcast packet */
         batadv_add_bcast_packet_to_list(bat_priv, skb, 1);
 
@@ -1265,7 +1257,7 @@ int batadv_recv_vis_packet(struct sk_buff *skb,
                 return NET_RX_DROP;
 
         vis_packet = (struct batadv_vis_packet *)skb->data;
-        ethhdr = (struct ethhdr *)skb_mac_header(skb);
+        ethhdr = eth_hdr(skb);
 
         /* not for me */
         if (!batadv_is_my_mac(bat_priv, ethhdr->h_dest))
diff --git a/net/batman-adv/routing.h b/net/batman-adv/routing.h
index 99eeafaba407..72a29bde2010 100644
--- a/net/batman-adv/routing.h
+++ b/net/batman-adv/routing.h
@@ -20,7 +20,6 @@
 #ifndef _NET_BATMAN_ADV_ROUTING_H_
 #define _NET_BATMAN_ADV_ROUTING_H_
 
-void batadv_slide_own_bcast_window(struct batadv_hard_iface *hard_iface);
 bool batadv_check_management_packet(struct sk_buff *skb,
                                     struct batadv_hard_iface *hard_iface,
                                     int header_len);
diff --git a/net/batman-adv/send.c b/net/batman-adv/send.c
index 263cfd1ccee7..0266edd0fa7f 100644
--- a/net/batman-adv/send.c
+++ b/net/batman-adv/send.c
@@ -61,13 +61,12 @@ int batadv_send_skb_packet(struct sk_buff *skb,
 
         skb_reset_mac_header(skb);
 
-        ethhdr = (struct ethhdr *)skb_mac_header(skb);
+        ethhdr = eth_hdr(skb);
         memcpy(ethhdr->h_source, hard_iface->net_dev->dev_addr, ETH_ALEN);
         memcpy(ethhdr->h_dest, dst_addr, ETH_ALEN);
         ethhdr->h_proto = __constant_htons(ETH_P_BATMAN);
 
         skb_set_network_header(skb, ETH_HLEN);
-        skb->priority = TC_PRIO_CONTROL;
         skb->protocol = __constant_htons(ETH_P_BATMAN);
 
         skb->dev = hard_iface->net_dev;
@@ -96,26 +95,37 @@ send_skb_err:
  * host, NULL can be passed as recv_if and no interface alternating is
  * attempted.
  *
- * Returns TRUE on success; FALSE otherwise.
+ * Returns NET_XMIT_SUCCESS on success, NET_XMIT_DROP on failure, or
+ * NET_XMIT_POLICED if the skb is buffered for later transmit.
  */
-bool batadv_send_skb_to_orig(struct sk_buff *skb,
-                             struct batadv_orig_node *orig_node,
-                             struct batadv_hard_iface *recv_if)
+int batadv_send_skb_to_orig(struct sk_buff *skb,
+                            struct batadv_orig_node *orig_node,
+                            struct batadv_hard_iface *recv_if)
 {
         struct batadv_priv *bat_priv = orig_node->bat_priv;
         struct batadv_neigh_node *neigh_node;
+        int ret = NET_XMIT_DROP;
 
         /* batadv_find_router() increases neigh_nodes refcount if found. */
         neigh_node = batadv_find_router(bat_priv, orig_node, recv_if);
         if (!neigh_node)
-                return false;
+                return ret;
 
-        /* route it */
-        batadv_send_skb_packet(skb, neigh_node->if_incoming, neigh_node->addr);
+        /* try to network code the packet, if it is received on an interface
+         * (i.e. being forwarded). If the packet originates from this node or if
+         * network coding fails, then send the packet as usual.
+         */
+        if (recv_if && batadv_nc_skb_forward(skb, neigh_node)) {
+                ret = NET_XMIT_POLICED;
+        } else {
+                batadv_send_skb_packet(skb, neigh_node->if_incoming,
+                                       neigh_node->addr);
+                ret = NET_XMIT_SUCCESS;
+        }
 
         batadv_neigh_node_free_ref(neigh_node);
 
-        return true;
+        return ret;
 }
 
 void batadv_schedule_bat_ogm(struct batadv_hard_iface *hard_iface)
@@ -152,8 +162,6 @@ _batadv_add_bcast_packet_to_list(struct batadv_priv *bat_priv,
                                  struct batadv_forw_packet *forw_packet,
                                  unsigned long send_time)
 {
-        INIT_HLIST_NODE(&forw_packet->list);
-
         /* add new packet to packet list */
         spin_lock_bh(&bat_priv->forw_bcast_list_lock);
         hlist_add_head(&forw_packet->list, &bat_priv->forw_bcast_list);
@@ -260,6 +268,9 @@ static void batadv_send_outstanding_bcast_packet(struct work_struct *work)
                 if (hard_iface->soft_iface != soft_iface)
                         continue;
 
+                if (forw_packet->num_packets >= hard_iface->num_bcasts)
+                        continue;
+
                 /* send a copy of the saved skb */
                 skb1 = skb_clone(forw_packet->skb, GFP_ATOMIC);
                 if (skb1)
@@ -271,7 +282,7 @@ static void batadv_send_outstanding_bcast_packet(struct work_struct *work)
         forw_packet->num_packets++;
 
         /* if we still have some more bcasts to send */
-        if (forw_packet->num_packets < 3) {
+        if (forw_packet->num_packets < BATADV_NUM_BCASTS_MAX) {
                 _batadv_add_bcast_packet_to_list(bat_priv, forw_packet,
                                                  msecs_to_jiffies(5));
                 return;
diff --git a/net/batman-adv/send.h b/net/batman-adv/send.h
index 38e662f619ac..e7b17880fca4 100644
--- a/net/batman-adv/send.h
+++ b/net/batman-adv/send.h
@@ -23,9 +23,9 @@
 int batadv_send_skb_packet(struct sk_buff *skb,
                            struct batadv_hard_iface *hard_iface,
                            const uint8_t *dst_addr);
-bool batadv_send_skb_to_orig(struct sk_buff *skb,
-                             struct batadv_orig_node *orig_node,
-                             struct batadv_hard_iface *recv_if);
+int batadv_send_skb_to_orig(struct sk_buff *skb,
+                            struct batadv_orig_node *orig_node,
+                            struct batadv_hard_iface *recv_if);
 void batadv_schedule_bat_ogm(struct batadv_hard_iface *hard_iface);
 int batadv_add_bcast_packet_to_list(struct batadv_priv *bat_priv,
                                     const struct sk_buff *skb,
diff --git a/net/batman-adv/soft-interface.c b/net/batman-adv/soft-interface.c
index 819dfb006cdf..813db4e64602 100644
--- a/net/batman-adv/soft-interface.c
+++ b/net/batman-adv/soft-interface.c
@@ -154,7 +154,7 @@ static int batadv_interface_tx(struct sk_buff *skb,
                                                     0x00, 0x00};
         unsigned int header_len = 0;
         int data_len = skb->len, ret;
-        short vid __maybe_unused = -1;
+        unsigned short vid __maybe_unused = BATADV_NO_FLAGS;
         bool do_bcast = false;
         uint32_t seqno;
         unsigned long brd_delay = 1;
@@ -168,6 +168,7 @@ static int batadv_interface_tx(struct sk_buff *skb,
         case ETH_P_8021Q:
                 vhdr = (struct vlan_ethhdr *)skb->data;
                 vid = ntohs(vhdr->h_vlan_TCI) & VLAN_VID_MASK;
+                vid |= BATADV_VLAN_HAS_TAG;
 
                 if (vhdr->h_vlan_encapsulated_proto != ethertype)
                         break;
@@ -180,6 +181,9 @@ static int batadv_interface_tx(struct sk_buff *skb,
         if (batadv_bla_tx(bat_priv, skb, vid))
                 goto dropped;
 
+        /* skb->data might have been reallocated by batadv_bla_tx() */
+        ethhdr = (struct ethhdr *)skb->data;
+
         /* Register the client MAC in the transtable */
         if (!is_multicast_ether_addr(ethhdr->h_source))
                 batadv_tt_local_add(soft_iface, ethhdr->h_source, skb->skb_iif);
@@ -220,8 +224,14 @@ static int batadv_interface_tx(struct sk_buff *skb,
                 default:
                         break;
                 }
+
+                /* reminder: ethhdr might have become unusable from here on
+                 * (batadv_gw_is_dhcp_target() might have reallocated skb data)
+                 */
         }
 
+        batadv_skb_set_priority(skb, 0);
+
         /* ethernet packet should be broadcasted */
         if (do_bcast) {
                 primary_if = batadv_primary_if_get_selected(bat_priv);
@@ -266,7 +276,7 @@ static int batadv_interface_tx(struct sk_buff *skb,
         /* unicast packet */
         } else {
                 if (atomic_read(&bat_priv->gw_mode) != BATADV_GW_MODE_OFF) {
-                        ret = batadv_gw_out_of_range(bat_priv, skb, ethhdr);
+                        ret = batadv_gw_out_of_range(bat_priv, skb);
                         if (ret)
                                 goto dropped;
                 }
@@ -303,7 +313,7 @@ void batadv_interface_rx(struct net_device *soft_iface,
         struct ethhdr *ethhdr;
         struct vlan_ethhdr *vhdr;
         struct batadv_header *batadv_header = (struct batadv_header *)skb->data;
-        short vid __maybe_unused = -1;
+        unsigned short vid __maybe_unused = BATADV_NO_FLAGS;
         __be16 ethertype = __constant_htons(ETH_P_BATMAN);
         bool is_bcast;
 
@@ -316,12 +326,13 @@ void batadv_interface_rx(struct net_device *soft_iface,
         skb_pull_rcsum(skb, hdr_size);
         skb_reset_mac_header(skb);
 
-        ethhdr = (struct ethhdr *)skb_mac_header(skb);
+        ethhdr = eth_hdr(skb);
 
         switch (ntohs(ethhdr->h_proto)) {
         case ETH_P_8021Q:
                 vhdr = (struct vlan_ethhdr *)skb->data;
                 vid = ntohs(vhdr->h_vlan_TCI) & VLAN_VID_MASK;
+                vid |= BATADV_VLAN_HAS_TAG;
 
                 if (vhdr->h_vlan_encapsulated_proto != ethertype)
                         break;
diff --git a/net/batman-adv/sysfs.c b/net/batman-adv/sysfs.c
index 15a22efa9a67..4114b961bc2c 100644
--- a/net/batman-adv/sysfs.c
+++ b/net/batman-adv/sysfs.c
@@ -385,6 +385,10 @@ static ssize_t batadv_store_gw_mode(struct kobject *kobj,
                     curr_gw_mode_str, buff);
 
         batadv_gw_deselect(bat_priv);
+        /* always call batadv_gw_check_client_stop() before changing the gateway
+         * state
+         */
+        batadv_gw_check_client_stop(bat_priv);
         atomic_set(&bat_priv->gw_mode, (unsigned int)gw_mode_tmp);
         return count;
 }
@@ -582,10 +586,7 @@ static ssize_t batadv_store_mesh_iface(struct kobject *kobj,
             (strncmp(hard_iface->soft_iface->name, buff, IFNAMSIZ) == 0))
                 goto out;
 
-        if (!rtnl_trylock()) {
-                ret = -ERESTARTSYS;
-                goto out;
-        }
+        rtnl_lock();
 
         if (status_tmp == BATADV_IF_NOT_IN_USE) {
                 batadv_hardif_disable_interface(hard_iface,
diff --git a/net/batman-adv/translation-table.c b/net/batman-adv/translation-table.c
index 9e8748575845..34510f38708f 100644
--- a/net/batman-adv/translation-table.c
+++ b/net/batman-adv/translation-table.c
@@ -163,10 +163,19 @@ batadv_tt_orig_list_entry_free_ref(struct batadv_tt_orig_list_entry *orig_entry)
         call_rcu(&orig_entry->rcu, batadv_tt_orig_list_entry_free_rcu);
 }
 
+/**
+ * batadv_tt_local_event - store a local TT event (ADD/DEL)
+ * @bat_priv: the bat priv with all the soft interface information
+ * @tt_local_entry: the TT entry involved in the event
+ * @event_flags: flags to store in the event structure
+ */
 static void batadv_tt_local_event(struct batadv_priv *bat_priv,
-                                  const uint8_t *addr, uint8_t flags)
+                                  struct batadv_tt_local_entry *tt_local_entry,
+                                  uint8_t event_flags)
 {
         struct batadv_tt_change_node *tt_change_node, *entry, *safe;
+        struct batadv_tt_common_entry *common = &tt_local_entry->common;
+        uint8_t flags = common->flags | event_flags;
         bool event_removed = false;
         bool del_op_requested, del_op_entry;
 
@@ -176,7 +185,7 @@ static void batadv_tt_local_event(struct batadv_priv *bat_priv,
                 return;
 
         tt_change_node->change.flags = flags;
-        memcpy(tt_change_node->change.addr, addr, ETH_ALEN);
+        memcpy(tt_change_node->change.addr, common->addr, ETH_ALEN);
 
         del_op_requested = flags & BATADV_TT_CLIENT_DEL;
 
@@ -184,7 +193,7 @@ static void batadv_tt_local_event(struct batadv_priv *bat_priv,
         spin_lock_bh(&bat_priv->tt.changes_list_lock);
         list_for_each_entry_safe(entry, safe, &bat_priv->tt.changes_list,
                                  list) {
-                if (!batadv_compare_eth(entry->change.addr, addr))
+                if (!batadv_compare_eth(entry->change.addr, common->addr))
                         continue;
 
                 /* DEL+ADD in the same orig interval have no effect and can be
@@ -332,7 +341,7 @@ void batadv_tt_local_add(struct net_device *soft_iface, const uint8_t *addr,
         }
 
 add_event:
-        batadv_tt_local_event(bat_priv, addr, tt_local->common.flags);
+        batadv_tt_local_event(bat_priv, tt_local, BATADV_NO_FLAGS);
 
 check_roaming:
         /* Check whether it is a roaming, but don't do anything if the roaming
@@ -529,8 +538,7 @@ batadv_tt_local_set_pending(struct batadv_priv *bat_priv,
                             struct batadv_tt_local_entry *tt_local_entry,
                             uint16_t flags, const char *message)
 {
-        batadv_tt_local_event(bat_priv, tt_local_entry->common.addr,
-                              tt_local_entry->common.flags | flags);
+        batadv_tt_local_event(bat_priv, tt_local_entry, flags);
 
         /* The local client has to be marked as "pending to be removed" but has
          * to be kept in the table in order to send it in a full table
@@ -584,8 +592,7 @@ uint16_t batadv_tt_local_remove(struct batadv_priv *bat_priv,
         /* if this client has been added right now, it is possible to
          * immediately purge it
          */
-        batadv_tt_local_event(bat_priv, tt_local_entry->common.addr,
-                              curr_flags | BATADV_TT_CLIENT_DEL);
+        batadv_tt_local_event(bat_priv, tt_local_entry, BATADV_TT_CLIENT_DEL);
         hlist_del_rcu(&tt_local_entry->common.hash_entry);
         batadv_tt_local_entry_free_ref(tt_local_entry);
 
@@ -791,10 +798,25 @@ out:
                 batadv_tt_orig_list_entry_free_ref(orig_entry);
 }
 
-/* caller must hold orig_node refcount */
+/**
+ * batadv_tt_global_add - add a new TT global entry or update an existing one
+ * @bat_priv: the bat priv with all the soft interface information
+ * @orig_node: the originator announcing the client
+ * @tt_addr: the mac address of the non-mesh client
+ * @flags: TT flags that have to be set for this non-mesh client
+ * @ttvn: the tt version number ever announcing this non-mesh client
+ *
+ * Add a new TT global entry for the given originator. If the entry already
+ * exists add a new reference to the given originator (a global entry can have
+ * references to multiple originators) and adjust the flags attribute to reflect
+ * the function argument.
+ * If a TT local entry exists for this non-mesh client remove it.
+ *
+ * The caller must hold orig_node refcount.
+ */
 int batadv_tt_global_add(struct batadv_priv *bat_priv,
                          struct batadv_orig_node *orig_node,
-                         const unsigned char *tt_addr, uint8_t flags,
+                         const unsigned char *tt_addr, uint16_t flags,
                          uint8_t ttvn)
 {
         struct batadv_tt_global_entry *tt_global_entry;
@@ -1600,11 +1622,12 @@ batadv_tt_response_fill_table(uint16_t tt_len, uint8_t ttvn,
         tt_tot = tt_len / sizeof(struct batadv_tt_change);
 
         len = tt_query_size + tt_len;
-        skb = dev_alloc_skb(len + ETH_HLEN + NET_IP_ALIGN);
+        skb = netdev_alloc_skb_ip_align(NULL, len + ETH_HLEN);
         if (!skb)
                 goto out;
 
-        skb_reserve(skb, ETH_HLEN + NET_IP_ALIGN);
+        skb->priority = TC_PRIO_CONTROL;
+        skb_reserve(skb, ETH_HLEN);
         tt_response = (struct batadv_tt_query_packet *)skb_put(skb, len);
         tt_response->ttvn = ttvn;
 
@@ -1665,11 +1688,12 @@ static int batadv_send_tt_request(struct batadv_priv *bat_priv,
         if (!tt_req_node)
                 goto out;
 
-        skb = dev_alloc_skb(sizeof(*tt_request) + ETH_HLEN + NET_IP_ALIGN);
+        skb = netdev_alloc_skb_ip_align(NULL, sizeof(*tt_request) + ETH_HLEN);
         if (!skb)
                 goto out;
 
-        skb_reserve(skb, ETH_HLEN + NET_IP_ALIGN);
+        skb->priority = TC_PRIO_CONTROL;
+        skb_reserve(skb, ETH_HLEN);
 
         tt_req_len = sizeof(*tt_request);
         tt_request = (struct batadv_tt_query_packet *)skb_put(skb, tt_req_len);
@@ -1691,7 +1715,7 @@ static int batadv_send_tt_request(struct batadv_priv *bat_priv,
 
         batadv_inc_counter(bat_priv, BATADV_CNT_TT_REQUEST_TX);
 
-        if (batadv_send_skb_to_orig(skb, dst_orig_node, NULL))
+        if (batadv_send_skb_to_orig(skb, dst_orig_node, NULL) != NET_XMIT_DROP)
                 ret = 0;
 
 out:
@@ -1715,7 +1739,7 @@ batadv_send_other_tt_response(struct batadv_priv *bat_priv,
         struct batadv_orig_node *req_dst_orig_node;
         struct batadv_orig_node *res_dst_orig_node = NULL;
         uint8_t orig_ttvn, req_ttvn, ttvn;
-        int ret = false;
+        int res, ret = false;
         unsigned char *tt_buff;
         bool full_table;
         uint16_t tt_len, tt_tot;
@@ -1762,11 +1786,12 @@ batadv_send_other_tt_response(struct batadv_priv *bat_priv,
                 tt_tot = tt_len / sizeof(struct batadv_tt_change);
 
                 len = sizeof(*tt_response) + tt_len;
-                skb = dev_alloc_skb(len + ETH_HLEN + NET_IP_ALIGN);
+                skb = netdev_alloc_skb_ip_align(NULL, len + ETH_HLEN);
                 if (!skb)
                         goto unlock;
 
-                skb_reserve(skb, ETH_HLEN + NET_IP_ALIGN);
+                skb->priority = TC_PRIO_CONTROL;
+                skb_reserve(skb, ETH_HLEN);
                 packet_pos = skb_put(skb, len);
                 tt_response = (struct batadv_tt_query_packet *)packet_pos;
                 tt_response->ttvn = req_ttvn;
@@ -1810,8 +1835,10 @@ batadv_send_other_tt_response(struct batadv_priv *bat_priv,
 
         batadv_inc_counter(bat_priv, BATADV_CNT_TT_RESPONSE_TX);
 
-        if (batadv_send_skb_to_orig(skb, res_dst_orig_node, NULL))
+        res = batadv_send_skb_to_orig(skb, res_dst_orig_node, NULL);
+        if (res != NET_XMIT_DROP)
                 ret = true;
+
         goto out;
 
 unlock:
@@ -1878,11 +1905,12 @@ batadv_send_my_tt_response(struct batadv_priv *bat_priv,
                 tt_tot = tt_len / sizeof(struct batadv_tt_change);
 
                 len = sizeof(*tt_response) + tt_len;
-                skb = dev_alloc_skb(len + ETH_HLEN + NET_IP_ALIGN);
+                skb = netdev_alloc_skb_ip_align(NULL, len + ETH_HLEN);
                 if (!skb)
                         goto unlock;
 
-                skb_reserve(skb, ETH_HLEN + NET_IP_ALIGN);
+                skb->priority = TC_PRIO_CONTROL;
+                skb_reserve(skb, ETH_HLEN);
                 packet_pos = skb_put(skb, len);
                 tt_response = (struct batadv_tt_query_packet *)packet_pos;
                 tt_response->ttvn = req_ttvn;
@@ -1925,7 +1953,7 @@ batadv_send_my_tt_response(struct batadv_priv *bat_priv,
 
         batadv_inc_counter(bat_priv, BATADV_CNT_TT_RESPONSE_TX);
 
-        if (batadv_send_skb_to_orig(skb, orig_node, NULL))
+        if (batadv_send_skb_to_orig(skb, orig_node, NULL) != NET_XMIT_DROP)
                 ret = true;
         goto out;
 
@@ -2212,11 +2240,12 @@ static void batadv_send_roam_adv(struct batadv_priv *bat_priv, uint8_t *client,
         if (!batadv_tt_check_roam_count(bat_priv, client))
                 goto out;
 
-        skb = dev_alloc_skb(sizeof(*roam_adv_packet) + ETH_HLEN + NET_IP_ALIGN);
+        skb = netdev_alloc_skb_ip_align(NULL, len + ETH_HLEN);
         if (!skb)
                 goto out;
 
-        skb_reserve(skb, ETH_HLEN + NET_IP_ALIGN);
+        skb->priority = TC_PRIO_CONTROL;
+        skb_reserve(skb, ETH_HLEN);
 
         roam_adv_packet = (struct batadv_roam_adv_packet *)skb_put(skb, len);
 
@@ -2238,7 +2267,7 @@ static void batadv_send_roam_adv(struct batadv_priv *bat_priv, uint8_t *client,
 
         batadv_inc_counter(bat_priv, BATADV_CNT_TT_ROAM_ADV_TX);
 
-        if (batadv_send_skb_to_orig(skb, orig_node, NULL))
+        if (batadv_send_skb_to_orig(skb, orig_node, NULL) != NET_XMIT_DROP)
                 ret = 0;
 
 out:
diff --git a/net/batman-adv/translation-table.h b/net/batman-adv/translation-table.h
index ab8e683b402f..659a3bb759ce 100644
--- a/net/batman-adv/translation-table.h
+++ b/net/batman-adv/translation-table.h
@@ -33,7 +33,7 @@ void batadv_tt_global_add_orig(struct batadv_priv *bat_priv,
                                const unsigned char *tt_buff, int tt_buff_len);
 int batadv_tt_global_add(struct batadv_priv *bat_priv,
                          struct batadv_orig_node *orig_node,
-                         const unsigned char *addr, uint8_t flags,
+                         const unsigned char *addr, uint16_t flags,
                          uint8_t ttvn);
 int batadv_tt_global_seq_print_text(struct seq_file *seq, void *offset);
 void batadv_tt_global_del_orig(struct batadv_priv *bat_priv,
diff --git a/net/batman-adv/types.h b/net/batman-adv/types.h
index aba8364c3689..b2c94e139319 100644
--- a/net/batman-adv/types.h
+++ b/net/batman-adv/types.h
@@ -61,6 +61,7 @@ struct batadv_hard_iface_bat_iv {
  * @if_status: status of the interface for batman-adv
  * @net_dev: pointer to the net_device
  * @frag_seqno: last fragment sequence number sent by this interface
+ * @num_bcasts: number of payload re-broadcasts on this interface (ARQ)
  * @hardif_obj: kobject of the per interface sysfs "mesh" directory
  * @refcount: number of contexts the object is used
  * @batman_adv_ptype: packet type describing packets that should be processed by
@@ -76,6 +77,7 @@ struct batadv_hard_iface {
         char if_status;
         struct net_device *net_dev;
         atomic_t frag_seqno;
+        uint8_t num_bcasts;
         struct kobject *hardif_obj;
         atomic_t refcount;
         struct packet_type batman_adv_ptype;
@@ -640,7 +642,7 @@ struct batadv_socket_packet {
 #ifdef CONFIG_BATMAN_ADV_BLA
 struct batadv_bla_backbone_gw {
         uint8_t orig[ETH_ALEN];
-        short vid;
+        unsigned short vid;
         struct hlist_node hash_entry;
         struct batadv_priv *bat_priv;
         unsigned long lasttime;
@@ -663,7 +665,7 @@ struct batadv_bla_backbone_gw {
  */
 struct batadv_bla_claim {
         uint8_t addr[ETH_ALEN];
-        short vid;
+        unsigned short vid;
         struct batadv_bla_backbone_gw *backbone_gw;
         unsigned long lasttime;
         struct hlist_node hash_entry;
diff --git a/net/batman-adv/unicast.c b/net/batman-adv/unicast.c
index 0bb3b5982f94..48b31d33ce6b 100644
--- a/net/batman-adv/unicast.c
+++ b/net/batman-adv/unicast.c
@@ -242,6 +242,8 @@ int batadv_frag_send_skb(struct sk_buff *skb, struct batadv_priv *bat_priv,
         frag_skb = dev_alloc_skb(data_len - (data_len / 2) + ucf_hdr_len);
         if (!frag_skb)
                 goto dropped;
+
+        skb->priority = TC_PRIO_CONTROL;
         skb_reserve(frag_skb, ucf_hdr_len);
 
         unicast_packet = (struct batadv_unicast_packet *)skb->data;
@@ -326,7 +328,9 @@ static bool batadv_unicast_push_and_fill_skb(struct sk_buff *skb, int hdr_size,
  * @skb: the skb containing the payload to encapsulate
  * @orig_node: the destination node
  *
- * Returns false if the payload could not be encapsulated or true otherwise
+ * Returns false if the payload could not be encapsulated or true otherwise.
+ *
+ * This call might reallocate skb data.
  */
 static bool batadv_unicast_prepare_skb(struct sk_buff *skb,
                                        struct batadv_orig_node *orig_node)
@@ -343,7 +347,9 @@ static bool batadv_unicast_prepare_skb(struct sk_buff *skb,
  * @orig_node: the destination node
  * @packet_subtype: the batman 4addr packet subtype to use
  *
- * Returns false if the payload could not be encapsulated or true otherwise
+ * Returns false if the payload could not be encapsulated or true otherwise.
+ *
+ * This call might reallocate skb data.
  */
 bool batadv_unicast_4addr_prepare_skb(struct batadv_priv *bat_priv,
                                       struct sk_buff *skb,
@@ -401,7 +407,7 @@ int batadv_unicast_generic_send_skb(struct batadv_priv *bat_priv,
         struct batadv_neigh_node *neigh_node;
         int data_len = skb->len;
         int ret = NET_RX_DROP;
-        unsigned int dev_mtu;
+        unsigned int dev_mtu, header_len;
 
         /* get routing information */
         if (is_multicast_ether_addr(ethhdr->h_dest)) {
@@ -428,11 +434,17 @@ find_router:
 
         switch (packet_type) {
         case BATADV_UNICAST:
-                batadv_unicast_prepare_skb(skb, orig_node);
+                if (!batadv_unicast_prepare_skb(skb, orig_node))
+                        goto out;
+
+                header_len = sizeof(struct batadv_unicast_packet);
                 break;
         case BATADV_UNICAST_4ADDR:
-                batadv_unicast_4addr_prepare_skb(bat_priv, skb, orig_node,
-                                                 packet_subtype);
+                if (!batadv_unicast_4addr_prepare_skb(bat_priv, skb, orig_node,
+                                                      packet_subtype))
+                        goto out;
+
+                header_len = sizeof(struct batadv_unicast_4addr_packet);
                 break;
         default:
                 /* this function supports UNICAST and UNICAST_4ADDR only. It
@@ -441,6 +453,7 @@ find_router:
                 goto out;
         }
 
+        ethhdr = (struct ethhdr *)(skb->data + header_len);
         unicast_packet = (struct batadv_unicast_packet *)skb->data;
 
         /* inform the destination node that we are still missing a correct route
@@ -464,7 +477,7 @@ find_router:
                 goto out;
         }
 
-        if (batadv_send_skb_to_orig(skb, orig_node, NULL))
+        if (batadv_send_skb_to_orig(skb, orig_node, NULL) != NET_XMIT_DROP)
                 ret = 0;
 
 out:
diff --git a/net/batman-adv/vis.c b/net/batman-adv/vis.c
index 1625e5793a89..d8ea31a58457 100644
--- a/net/batman-adv/vis.c
+++ b/net/batman-adv/vis.c
@@ -392,12 +392,13 @@ batadv_add_packet(struct batadv_priv *bat_priv,
                 return NULL;
 
         len = sizeof(*packet) + vis_info_len;
-        info->skb_packet = dev_alloc_skb(len + ETH_HLEN + NET_IP_ALIGN);
+        info->skb_packet = netdev_alloc_skb_ip_align(NULL, len + ETH_HLEN);
         if (!info->skb_packet) {
                 kfree(info);
                 return NULL;
         }
-        skb_reserve(info->skb_packet, ETH_HLEN + NET_IP_ALIGN);
+        info->skb_packet->priority = TC_PRIO_CONTROL;
+        skb_reserve(info->skb_packet, ETH_HLEN);
         packet = (struct batadv_vis_packet *)skb_put(info->skb_packet, len);
 
         kref_init(&info->refcount);
@@ -697,7 +698,7 @@ static void batadv_broadcast_vis_packet(struct batadv_priv *bat_priv,
         struct batadv_orig_node *orig_node;
         struct batadv_vis_packet *packet;
         struct sk_buff *skb;
-        uint32_t i;
+        uint32_t i, res;
 
 
         packet = (struct batadv_vis_packet *)info->skb_packet->data;
@@ -724,7 +725,8 @@ static void batadv_broadcast_vis_packet(struct batadv_priv *bat_priv,
                         if (!skb)
                                 continue;
 
-                        if (!batadv_send_skb_to_orig(skb, orig_node, NULL))
+                        res = batadv_send_skb_to_orig(skb, orig_node, NULL);
+                        if (res == NET_XMIT_DROP)
                                 kfree_skb(skb);
                 }
                 rcu_read_unlock();
@@ -748,7 +750,7 @@ static void batadv_unicast_vis_packet(struct batadv_priv *bat_priv,
         if (!skb)
                 goto out;
 
-        if (!batadv_send_skb_to_orig(skb, orig_node, NULL))
+        if (batadv_send_skb_to_orig(skb, orig_node, NULL) == NET_XMIT_DROP)
                 kfree_skb(skb);
 
 out:
@@ -854,13 +856,14 @@ int batadv_vis_init(struct batadv_priv *bat_priv)
         if (!bat_priv->vis.my_info)
                 goto err;
 
-        len = sizeof(*packet) + BATADV_MAX_VIS_PACKET_SIZE;
-        len += ETH_HLEN + NET_IP_ALIGN;
-        bat_priv->vis.my_info->skb_packet = dev_alloc_skb(len);
+        len = sizeof(*packet) + BATADV_MAX_VIS_PACKET_SIZE + ETH_HLEN;
+        bat_priv->vis.my_info->skb_packet = netdev_alloc_skb_ip_align(NULL,
+                                                                      len);
         if (!bat_priv->vis.my_info->skb_packet)
                 goto free_info;
 
-        skb_reserve(bat_priv->vis.my_info->skb_packet, ETH_HLEN + NET_IP_ALIGN);
+        bat_priv->vis.my_info->skb_packet->priority = TC_PRIO_CONTROL;
+        skb_reserve(bat_priv->vis.my_info->skb_packet, ETH_HLEN);
         tmp_skb = bat_priv->vis.my_info->skb_packet;
         packet = (struct batadv_vis_packet *)skb_put(tmp_skb, sizeof(*packet));
 
diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c
index 6c7f36379722..f0817121ec5e 100644
--- a/net/bluetooth/hci_conn.c
+++ b/net/bluetooth/hci_conn.c
@@ -31,6 +31,24 @@
 #include <net/bluetooth/a2mp.h>
 #include <net/bluetooth/smp.h>
 
+struct sco_param {
+        u16 pkt_type;
+        u16 max_latency;
+};
+
+static const struct sco_param sco_param_cvsd[] = {
+        { EDR_ESCO_MASK & ~ESCO_2EV3, 0x000a }, /* S3 */
+        { EDR_ESCO_MASK & ~ESCO_2EV3, 0x0007 }, /* S2 */
+        { EDR_ESCO_MASK | ESCO_EV3,   0x0007 }, /* S1 */
+        { EDR_ESCO_MASK | ESCO_HV3,   0xffff }, /* D1 */
+        { EDR_ESCO_MASK | ESCO_HV1,   0xffff }, /* D0 */
+};
+
+static const struct sco_param sco_param_wideband[] = {
+        { EDR_ESCO_MASK & ~ESCO_2EV3, 0x000d }, /* T2 */
+        { EDR_ESCO_MASK | ESCO_EV3,   0x0008 }, /* T1 */
+};
+
 static void hci_le_create_connection(struct hci_conn *conn)
 {
         struct hci_dev *hdev = conn->hdev;
@@ -172,10 +190,11 @@ static void hci_add_sco(struct hci_conn *conn, __u16 handle)
         hci_send_cmd(hdev, HCI_OP_ADD_SCO, sizeof(cp), &cp);
 }
 
-void hci_setup_sync(struct hci_conn *conn, __u16 handle)
+bool hci_setup_sync(struct hci_conn *conn, __u16 handle)
 {
         struct hci_dev *hdev = conn->hdev;
         struct hci_cp_setup_sync_conn cp;
+        const struct sco_param *param;
 
         BT_DBG("hcon %p", conn);
 
@@ -185,15 +204,35 @@ void hci_setup_sync(struct hci_conn *conn, __u16 handle)
         conn->attempt++;
 
         cp.handle   = cpu_to_le16(handle);
-        cp.pkt_type = cpu_to_le16(conn->pkt_type);
 
         cp.tx_bandwidth   = __constant_cpu_to_le32(0x00001f40);
         cp.rx_bandwidth   = __constant_cpu_to_le32(0x00001f40);
-        cp.max_latency    = __constant_cpu_to_le16(0xffff);
-        cp.voice_setting  = cpu_to_le16(hdev->voice_setting);
-        cp.retrans_effort = 0xff;
+        cp.voice_setting  = cpu_to_le16(conn->setting);
+
+        switch (conn->setting & SCO_AIRMODE_MASK) {
+        case SCO_AIRMODE_TRANSP:
+                if (conn->attempt > ARRAY_SIZE(sco_param_wideband))
+                        return false;
+                cp.retrans_effort = 0x02;
+                param = &sco_param_wideband[conn->attempt - 1];
+                break;
+        case SCO_AIRMODE_CVSD:
+                if (conn->attempt > ARRAY_SIZE(sco_param_cvsd))
+                        return false;
+                cp.retrans_effort = 0x01;
+                param = &sco_param_cvsd[conn->attempt - 1];
+                break;
+        default:
+                return false;
+        }
 
-        hci_send_cmd(hdev, HCI_OP_SETUP_SYNC_CONN, sizeof(cp), &cp);
+        cp.pkt_type = __cpu_to_le16(param->pkt_type);
+        cp.max_latency = __cpu_to_le16(param->max_latency);
+
+        if (hci_send_cmd(hdev, HCI_OP_SETUP_SYNC_CONN, sizeof(cp), &cp) < 0)
+                return false;
+
+        return true;
 }
 
 void hci_le_conn_update(struct hci_conn *conn, u16 min, u16 max,
@@ -560,13 +599,13 @@ static struct hci_conn *hci_connect_acl(struct hci_dev *hdev, bdaddr_t *dst,
         return acl;
 }
 
-static struct hci_conn *hci_connect_sco(struct hci_dev *hdev, int type,
-                                bdaddr_t *dst, u8 sec_level, u8 auth_type)
+struct hci_conn *hci_connect_sco(struct hci_dev *hdev, int type, bdaddr_t *dst,
+                                 __u16 setting)
 {
         struct hci_conn *acl;
         struct hci_conn *sco;
 
-        acl = hci_connect_acl(hdev, dst, sec_level, auth_type);
+        acl = hci_connect_acl(hdev, dst, BT_SECURITY_LOW, HCI_AT_NO_BONDING);
         if (IS_ERR(acl))
                 return acl;
 
@@ -584,6 +623,8 @@ static struct hci_conn *hci_connect_sco(struct hci_dev *hdev, int type,
 
         hci_conn_hold(sco);
 
+        sco->setting = setting;
+
         if (acl->state == BT_CONNECTED &&
             (sco->state == BT_OPEN || sco->state == BT_CLOSED)) {
                 set_bit(HCI_CONN_POWER_SAVE, &acl->flags);
@@ -612,9 +653,6 @@ struct hci_conn *hci_connect(struct hci_dev *hdev, int type, bdaddr_t *dst,
                 return hci_connect_le(hdev, dst, dst_type, sec_level, auth_type);
         case ACL_LINK:
                 return hci_connect_acl(hdev, dst, sec_level, auth_type);
-        case SCO_LINK:
-        case ESCO_LINK:
-                return hci_connect_sco(hdev, type, dst, sec_level, auth_type);
         }
 
         return ERR_PTR(-EINVAL);
diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c
index 33843c5c4939..fb7356fcfe51 100644
--- a/net/bluetooth/hci_core.c
+++ b/net/bluetooth/hci_core.c
@@ -341,7 +341,6 @@ static void hci_init1_req(struct hci_request *req, unsigned long opt)
 
 static void bredr_setup(struct hci_request *req)
 {
-        struct hci_cp_delete_stored_link_key cp;
         __le16 param;
         __u8 flt_type;
 
@@ -365,10 +364,6 @@ static void bredr_setup(struct hci_request *req)
         param = __constant_cpu_to_le16(0x7d00);
         hci_req_add(req, HCI_OP_WRITE_CA_TIMEOUT, 2, &param);
 
-        bacpy(&cp.bdaddr, BDADDR_ANY);
-        cp.delete_all = 0x01;
-        hci_req_add(req, HCI_OP_DELETE_STORED_LINK_KEY, sizeof(cp), &cp);
-
         /* Read page scan parameters */
         if (req->hdev->hci_ver > BLUETOOTH_VER_1_1) {
                 hci_req_add(req, HCI_OP_READ_PAGE_SCAN_ACTIVITY, 0, NULL);
@@ -459,6 +454,18 @@ static void hci_setup_event_mask(struct hci_request *req)
                 events[4] |= 0x04; /* Read Remote Extended Features Complete */
                 events[5] |= 0x08; /* Synchronous Connection Complete */
                 events[5] |= 0x10; /* Synchronous Connection Changed */
+        } else {
+                /* Use a different default for LE-only devices */
+                memset(events, 0, sizeof(events));
+                events[0] |= 0x10; /* Disconnection Complete */
+                events[0] |= 0x80; /* Encryption Change */
+                events[1] |= 0x08; /* Read Remote Version Information Complete */
+                events[1] |= 0x20; /* Command Complete */
+                events[1] |= 0x40; /* Command Status */
+                events[1] |= 0x80; /* Hardware Error */
+                events[2] |= 0x04; /* Number of Completed Packets */
+                events[3] |= 0x02; /* Data Buffer Overflow */
+                events[5] |= 0x80; /* Encryption Key Refresh Complete */
         }
 
         if (lmp_inq_rssi_capable(hdev))
@@ -518,7 +525,10 @@ static void hci_init2_req(struct hci_request *req, unsigned long opt)
 
         hci_setup_event_mask(req);
 
-        if (hdev->hci_ver > BLUETOOTH_VER_1_1)
+        /* AVM Berlin (31), aka "BlueFRITZ!", doesn't support the read
+         * local supported commands HCI command.
+         */
+        if (hdev->manufacturer != 31 && hdev->hci_ver > BLUETOOTH_VER_1_1)
                 hci_req_add(req, HCI_OP_READ_LOCAL_COMMANDS, 0, NULL);
 
         if (lmp_ssp_capable(hdev)) {
@@ -602,6 +612,24 @@ static void hci_init3_req(struct hci_request *req, unsigned long opt)
         struct hci_dev *hdev = req->hdev;
         u8 p;
 
+        /* Some Broadcom based Bluetooth controllers do not support the
+         * Delete Stored Link Key command. They are clearly indicating its
+         * absence in the bit mask of supported commands.
+         *
+         * Check the supported commands and only if the the command is marked
+         * as supported send it. If not supported assume that the controller
+         * does not have actual support for stored link keys which makes this
+         * command redundant anyway.
+         */
+        if (hdev->commands[6] & 0x80) {
+                struct hci_cp_delete_stored_link_key cp;
+
+                bacpy(&cp.bdaddr, BDADDR_ANY);
+                cp.delete_all = 0x01;
+                hci_req_add(req, HCI_OP_DELETE_STORED_LINK_KEY,
+                            sizeof(cp), &cp);
+        }
+
         if (hdev->commands[5] & 0x10)
                 hci_setup_link_policy(req);
 
@@ -746,7 +774,7 @@ void hci_discovery_set_state(struct hci_dev *hdev, int state)
         hdev->discovery.state = state;
 }
 
-static void inquiry_cache_flush(struct hci_dev *hdev)
+void hci_inquiry_cache_flush(struct hci_dev *hdev)
 {
         struct discovery_state *cache = &hdev->discovery;
         struct inquiry_entry *p, *n;
@@ -959,7 +987,7 @@ int hci_inquiry(void __user *arg)
         hci_dev_lock(hdev);
         if (inquiry_cache_age(hdev) > INQUIRY_CACHE_AGE_MAX ||
             inquiry_cache_empty(hdev) || ir.flags & IREQ_CACHE_FLUSH) {
-                inquiry_cache_flush(hdev);
+                hci_inquiry_cache_flush(hdev);
                 do_inquiry = 1;
         }
         hci_dev_unlock(hdev);
@@ -1118,7 +1146,11 @@ int hci_dev_open(__u16 dev)
                 goto done;
         }
 
-        if (hdev->rfkill && rfkill_blocked(hdev->rfkill)) {
+        /* Check for rfkill but allow the HCI setup stage to proceed
+         * (which in itself doesn't cause any RF activity).
+         */
+        if (test_bit(HCI_RFKILLED, &hdev->dev_flags) &&
+            !test_bit(HCI_SETUP, &hdev->dev_flags)) {
                 ret = -ERFKILL;
                 goto done;
         }
@@ -1196,8 +1228,6 @@ static int hci_dev_do_close(struct hci_dev *hdev)
 {
         BT_DBG("%s %p", hdev->name, hdev);
 
-        cancel_work_sync(&hdev->le_scan);
-
         cancel_delayed_work(&hdev->power_off);
 
         hci_req_cancel(hdev, ENODEV);
@@ -1225,7 +1255,7 @@ static int hci_dev_do_close(struct hci_dev *hdev)
         cancel_delayed_work_sync(&hdev->le_scan_disable);
 
         hci_dev_lock(hdev);
-        inquiry_cache_flush(hdev);
+        hci_inquiry_cache_flush(hdev);
         hci_conn_hash_flush(hdev);
         hci_dev_unlock(hdev);
 
@@ -1326,7 +1356,7 @@ int hci_dev_reset(__u16 dev)
         skb_queue_purge(&hdev->cmd_q);
 
         hci_dev_lock(hdev);
-        inquiry_cache_flush(hdev);
+        hci_inquiry_cache_flush(hdev);
         hci_conn_hash_flush(hdev);
         hci_dev_unlock(hdev);
 
@@ -1540,10 +1570,13 @@ static int hci_rfkill_set_block(void *data, bool blocked)
 
         BT_DBG("%p name %s blocked %d", hdev, hdev->name, blocked);
 
-        if (!blocked)
-                return 0;
-
-        hci_dev_do_close(hdev);
+        if (blocked) {
+                set_bit(HCI_RFKILLED, &hdev->dev_flags);
+                if (!test_bit(HCI_SETUP, &hdev->dev_flags))
+                        hci_dev_do_close(hdev);
+        } else {
+                clear_bit(HCI_RFKILLED, &hdev->dev_flags);
+        }
 
         return 0;
 }
@@ -1555,15 +1588,23 @@ static const struct rfkill_ops hci_rfkill_ops = {
 static void hci_power_on(struct work_struct *work)
 {
         struct hci_dev *hdev = container_of(work, struct hci_dev, power_on);
+        int err;
 
         BT_DBG("%s", hdev->name);
 
-        if (hci_dev_open(hdev->id) < 0)
+        err = hci_dev_open(hdev->id);
+        if (err < 0) {
+                mgmt_set_powered_failed(hdev, err);
                 return;
+        }
 
-        if (test_bit(HCI_AUTO_OFF, &hdev->dev_flags))
+        if (test_bit(HCI_RFKILLED, &hdev->dev_flags)) {
+                clear_bit(HCI_AUTO_OFF, &hdev->dev_flags);
+                hci_dev_do_close(hdev);
+        } else if (test_bit(HCI_AUTO_OFF, &hdev->dev_flags)) {
                 queue_delayed_work(hdev->req_workqueue, &hdev->power_off,
                                    HCI_AUTO_OFF_TIMEOUT);
+        }
 
         if (test_and_clear_bit(HCI_SETUP, &hdev->dev_flags))
                 mgmt_index_added(hdev);
@@ -1982,80 +2023,59 @@ int hci_blacklist_del(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type)
         return mgmt_device_unblocked(hdev, bdaddr, type);
 }
 
-static void le_scan_param_req(struct hci_request *req, unsigned long opt)
+static void inquiry_complete(struct hci_dev *hdev, u8 status)
 {
-        struct le_scan_params *param =  (struct le_scan_params *) opt;
-        struct hci_cp_le_set_scan_param cp;
-
-        memset(&cp, 0, sizeof(cp));
-        cp.type = param->type;
-        cp.interval = cpu_to_le16(param->interval);
-        cp.window = cpu_to_le16(param->window);
-
-        hci_req_add(req, HCI_OP_LE_SET_SCAN_PARAM, sizeof(cp), &cp);
-}
-
-static void le_scan_enable_req(struct hci_request *req, unsigned long opt)
-{
-        struct hci_cp_le_set_scan_enable cp;
-
-        memset(&cp, 0, sizeof(cp));
-        cp.enable = LE_SCAN_ENABLE;
-        cp.filter_dup = LE_SCAN_FILTER_DUP_ENABLE;
+        if (status) {
+                BT_ERR("Failed to start inquiry: status %d", status);
 
-        hci_req_add(req, HCI_OP_LE_SET_SCAN_ENABLE, sizeof(cp), &cp);
+                hci_dev_lock(hdev);
+                hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
+                hci_dev_unlock(hdev);
+                return;
+        }
 }
 
-static int hci_do_le_scan(struct hci_dev *hdev, u8 type, u16 interval,
-                          u16 window, int timeout)
+static void le_scan_disable_work_complete(struct hci_dev *hdev, u8 status)
 {
-        long timeo = msecs_to_jiffies(3000);
-        struct le_scan_params param;
+        /* General inquiry access code (GIAC) */
+        u8 lap[3] = { 0x33, 0x8b, 0x9e };
+        struct hci_request req;
+        struct hci_cp_inquiry cp;
         int err;
 
-        BT_DBG("%s", hdev->name);
-
-        if (test_bit(HCI_LE_SCAN, &hdev->dev_flags))
-                return -EINPROGRESS;
-
-        param.type = type;
-        param.interval = interval;
-        param.window = window;
-
-        hci_req_lock(hdev);
-
-        err = __hci_req_sync(hdev, le_scan_param_req, (unsigned long) &param,
-                             timeo);
-        if (!err)
-                err = __hci_req_sync(hdev, le_scan_enable_req, 0, timeo);
-
-        hci_req_unlock(hdev);
+        if (status) {
+                BT_ERR("Failed to disable LE scanning: status %d", status);
+                return;
+        }
 
-        if (err < 0)
-                return err;
+        switch (hdev->discovery.type) {
+        case DISCOV_TYPE_LE:
+                hci_dev_lock(hdev);
+                hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
+                hci_dev_unlock(hdev);
+                break;
 
-        queue_delayed_work(hdev->workqueue, &hdev->le_scan_disable,
-                           timeout);
+        case DISCOV_TYPE_INTERLEAVED:
+                hci_req_init(&req, hdev);
 
-        return 0;
-}
+                memset(&cp, 0, sizeof(cp));
+                memcpy(&cp.lap, lap, sizeof(cp.lap));
+                cp.length = DISCOV_INTERLEAVED_INQUIRY_LEN;
+                hci_req_add(&req, HCI_OP_INQUIRY, sizeof(cp), &cp);
 
-int hci_cancel_le_scan(struct hci_dev *hdev)
-{
-        BT_DBG("%s", hdev->name);
+                hci_dev_lock(hdev);
 
-        if (!test_bit(HCI_LE_SCAN, &hdev->dev_flags))
-                return -EALREADY;
+                hci_inquiry_cache_flush(hdev);
 
-        if (cancel_delayed_work(&hdev->le_scan_disable)) {
-                struct hci_cp_le_set_scan_enable cp;
+                err = hci_req_run(&req, inquiry_complete);
+                if (err) {
+                        BT_ERR("Inquiry request failed: err %d", err);
+                        hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
+                }
 
-                /* Send HCI command to disable LE Scan */
-                memset(&cp, 0, sizeof(cp));
-                hci_send_cmd(hdev, HCI_OP_LE_SET_SCAN_ENABLE, sizeof(cp), &cp);
+                hci_dev_unlock(hdev);
+                break;
         }
-
-        return 0;
 }
 
 static void le_scan_disable_work(struct work_struct *work)
@@ -2063,46 +2083,20 @@ static void le_scan_disable_work(struct work_struct *work)
         struct hci_dev *hdev = container_of(work, struct hci_dev,
                                             le_scan_disable.work);
         struct hci_cp_le_set_scan_enable cp;
+        struct hci_request req;
+        int err;
 
         BT_DBG("%s", hdev->name);
 
-        memset(&cp, 0, sizeof(cp));
-
-        hci_send_cmd(hdev, HCI_OP_LE_SET_SCAN_ENABLE, sizeof(cp), &cp);
-}
-
-static void le_scan_work(struct work_struct *work)
-{
-        struct hci_dev *hdev = container_of(work, struct hci_dev, le_scan);
-        struct le_scan_params *param = &hdev->le_scan_params;
-
-        BT_DBG("%s", hdev->name);
-
-        hci_do_le_scan(hdev, param->type, param->interval, param->window,
-                       param->timeout);
-}
-
-int hci_le_scan(struct hci_dev *hdev, u8 type, u16 interval, u16 window,
-                int timeout)
-{
-        struct le_scan_params *param = &hdev->le_scan_params;
-
-        BT_DBG("%s", hdev->name);
-
-        if (test_bit(HCI_LE_PERIPHERAL, &hdev->dev_flags))
-                return -ENOTSUPP;
-
-        if (work_busy(&hdev->le_scan))
-                return -EINPROGRESS;
-
-        param->type = type;
-        param->interval = interval;
-        param->window = window;
-        param->timeout = timeout;
+        hci_req_init(&req, hdev);
 
-        queue_work(system_long_wq, &hdev->le_scan);
+        memset(&cp, 0, sizeof(cp));
+        cp.enable = LE_SCAN_DISABLE;
+        hci_req_add(&req, HCI_OP_LE_SET_SCAN_ENABLE, sizeof(cp), &cp);
 
-        return 0;
+        err = hci_req_run(&req, le_scan_disable_work_complete);
+        if (err)
+                BT_ERR("Disable LE scanning request failed: err %d", err);
 }
 
 /* Alloc HCI device */
@@ -2139,7 +2133,6 @@ struct hci_dev *hci_alloc_dev(void)
         INIT_WORK(&hdev->cmd_work, hci_cmd_work);
         INIT_WORK(&hdev->tx_work, hci_tx_work);
         INIT_WORK(&hdev->power_on, hci_power_on);
-        INIT_WORK(&hdev->le_scan, le_scan_work);
 
         INIT_DELAYED_WORK(&hdev->power_off, hci_power_off);
         INIT_DELAYED_WORK(&hdev->discov_off, hci_discov_off);
@@ -2198,20 +2191,15 @@ int hci_register_dev(struct hci_dev *hdev)
 
         BT_DBG("%p name %s bus %d", hdev, hdev->name, hdev->bus);
 
-        write_lock(&hci_dev_list_lock);
-        list_add(&hdev->list, &hci_dev_list);
-        write_unlock(&hci_dev_list_lock);
-
-        hdev->workqueue = alloc_workqueue(hdev->name, WQ_HIGHPRI | WQ_UNBOUND |
-                                          WQ_MEM_RECLAIM, 1);
+        hdev->workqueue = alloc_workqueue("%s", WQ_HIGHPRI | WQ_UNBOUND |
+                                          WQ_MEM_RECLAIM, 1, hdev->name);
         if (!hdev->workqueue) {
                 error = -ENOMEM;
                 goto err;
         }
 
-        hdev->req_workqueue = alloc_workqueue(hdev->name,
-                                              WQ_HIGHPRI | WQ_UNBOUND |
-                                              WQ_MEM_RECLAIM, 1);
+        hdev->req_workqueue = alloc_workqueue("%s", WQ_HIGHPRI | WQ_UNBOUND |
+                                              WQ_MEM_RECLAIM, 1, hdev->name);
         if (!hdev->req_workqueue) {
                 destroy_workqueue(hdev->workqueue);
                 error = -ENOMEM;
@@ -2232,11 +2220,18 @@ int hci_register_dev(struct hci_dev *hdev)
                 }
         }
 
+        if (hdev->rfkill && rfkill_blocked(hdev->rfkill))
+                set_bit(HCI_RFKILLED, &hdev->dev_flags);
+
         set_bit(HCI_SETUP, &hdev->dev_flags);
 
         if (hdev->dev_type != HCI_AMP)
                 set_bit(HCI_AUTO_OFF, &hdev->dev_flags);
 
+        write_lock(&hci_dev_list_lock);
+        list_add(&hdev->list, &hci_dev_list);
+        write_unlock(&hci_dev_list_lock);
+
         hci_notify(hdev, HCI_DEV_REG);
         hci_dev_hold(hdev);
 
@@ -2249,9 +2244,6 @@ err_wqueue:
         destroy_workqueue(hdev->req_workqueue);
 err:
         ida_simple_remove(&hci_index_ida, hdev->id);
-        write_lock(&hci_dev_list_lock);
-        list_del(&hdev->list);
-        write_unlock(&hci_dev_list_lock);
 
         return error;
 }
@@ -3433,8 +3425,16 @@ void hci_req_cmd_complete(struct hci_dev *hdev, u16 opcode, u8 status)
          */
         if (hdev->sent_cmd) {
                 req_complete = bt_cb(hdev->sent_cmd)->req.complete;
-                if (req_complete)
+
+                if (req_complete) {
+                        /* We must set the complete callback to NULL to
+                         * avoid calling the callback more than once if
+                         * this function gets called again.
+                         */
+                        bt_cb(hdev->sent_cmd)->req.complete = NULL;
+
                         goto call_complete;
+                }
         }
 
         /* Remove all pending commands belonging to this request */
@@ -3542,36 +3542,6 @@ static void hci_cmd_work(struct work_struct *work)
         }
 }
 
-int hci_do_inquiry(struct hci_dev *hdev, u8 length)
-{
-        /* General inquiry access code (GIAC) */
-        u8 lap[3] = { 0x33, 0x8b, 0x9e };
-        struct hci_cp_inquiry cp;
-
-        BT_DBG("%s", hdev->name);
-
-        if (test_bit(HCI_INQUIRY, &hdev->flags))
-                return -EINPROGRESS;
-
-        inquiry_cache_flush(hdev);
-
-        memset(&cp, 0, sizeof(cp));
-        memcpy(&cp.lap, lap, sizeof(cp.lap));
-        cp.length  = length;
-
-        return hci_send_cmd(hdev, HCI_OP_INQUIRY, sizeof(cp), &cp);
-}
-
-int hci_cancel_inquiry(struct hci_dev *hdev)
-{
-        BT_DBG("%s", hdev->name);
-
-        if (!test_bit(HCI_INQUIRY, &hdev->flags))
-                return -EALREADY;
-
-        return hci_send_cmd(hdev, HCI_OP_INQUIRY_CANCEL, 0, NULL);
-}
-
 u8 bdaddr_to_le(u8 bdaddr_type)
 {
         switch (bdaddr_type) {
diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c
index b93cd2eb5d58..8db3e89fae35 100644
--- a/net/bluetooth/hci_event.c
+++ b/net/bluetooth/hci_event.c
@@ -40,21 +40,13 @@ static void hci_cc_inquiry_cancel(struct hci_dev *hdev, struct sk_buff *skb)
 
         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 
-        if (status) {
-                hci_dev_lock(hdev);
-                mgmt_stop_discovery_failed(hdev, status);
-                hci_dev_unlock(hdev);
+        if (status)
                 return;
-        }
 
         clear_bit(HCI_INQUIRY, &hdev->flags);
         smp_mb__after_clear_bit(); /* wake_up_bit advises about this barrier */
         wake_up_bit(&hdev->flags, HCI_INQUIRY);
 
-        hci_dev_lock(hdev);
-        hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
-        hci_dev_unlock(hdev);
-
         hci_conn_check_pending(hdev);
 }
 
@@ -937,20 +929,6 @@ static void hci_cc_le_set_adv_enable(struct hci_dev *hdev, struct sk_buff *skb)
         hci_dev_unlock(hdev);
 }
 
-static void hci_cc_le_set_scan_param(struct hci_dev *hdev, struct sk_buff *skb)
-{
-        __u8 status = *((__u8 *) skb->data);
-
-        BT_DBG("%s status 0x%2.2x", hdev->name, status);
-
-        if (status) {
-                hci_dev_lock(hdev);
-                mgmt_start_discovery_failed(hdev, status);
-                hci_dev_unlock(hdev);
-                return;
-        }
-}
-
 static void hci_cc_le_set_scan_enable(struct hci_dev *hdev,
                                       struct sk_buff *skb)
 {
@@ -963,41 +941,16 @@ static void hci_cc_le_set_scan_enable(struct hci_dev *hdev,
         if (!cp)
                 return;
 
+        if (status)
+                return;
+
         switch (cp->enable) {
         case LE_SCAN_ENABLE:
-                if (status) {
-                        hci_dev_lock(hdev);
-                        mgmt_start_discovery_failed(hdev, status);
-                        hci_dev_unlock(hdev);
-                        return;
-                }
-
                 set_bit(HCI_LE_SCAN, &hdev->dev_flags);
-
-                hci_dev_lock(hdev);
-                hci_discovery_set_state(hdev, DISCOVERY_FINDING);
-                hci_dev_unlock(hdev);
                 break;
 
         case LE_SCAN_DISABLE:
-                if (status) {
-                        hci_dev_lock(hdev);
-                        mgmt_stop_discovery_failed(hdev, status);
-                        hci_dev_unlock(hdev);
-                        return;
-                }
-
                 clear_bit(HCI_LE_SCAN, &hdev->dev_flags);
-
-                if (hdev->discovery.type == DISCOV_TYPE_INTERLEAVED &&
-                    hdev->discovery.state == DISCOVERY_FINDING) {
-                        mgmt_interleaved_discovery(hdev);
-                } else {
-                        hci_dev_lock(hdev);
-                        hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
-                        hci_dev_unlock(hdev);
-                }
-
                 break;
 
         default:
@@ -1077,18 +1030,10 @@ static void hci_cs_inquiry(struct hci_dev *hdev, __u8 status)
 
         if (status) {
                 hci_conn_check_pending(hdev);
-                hci_dev_lock(hdev);
-                if (test_bit(HCI_MGMT, &hdev->dev_flags))
-                        mgmt_start_discovery_failed(hdev, status);
-                hci_dev_unlock(hdev);
                 return;
         }
 
         set_bit(HCI_INQUIRY, &hdev->flags);
-
-        hci_dev_lock(hdev);
-        hci_discovery_set_state(hdev, DISCOVERY_FINDING);
-        hci_dev_unlock(hdev);
 }
 
 static void hci_cs_create_conn(struct hci_dev *hdev, __u8 status)
@@ -2298,10 +2243,6 @@ static void hci_cmd_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
                 hci_cc_user_passkey_neg_reply(hdev, skb);
                 break;
 
-        case HCI_OP_LE_SET_SCAN_PARAM:
-                hci_cc_le_set_scan_param(hdev, skb);
-                break;
-
         case HCI_OP_LE_SET_ADV_ENABLE:
                 hci_cc_le_set_adv_enable(hdev, skb);
                 break;
@@ -2670,7 +2611,7 @@ static void hci_link_key_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
 
         BT_DBG("%s", hdev->name);
 
-        if (!test_bit(HCI_LINK_KEYS, &hdev->dev_flags))
+        if (!test_bit(HCI_MGMT, &hdev->dev_flags))
                 return;
 
         hci_dev_lock(hdev);
@@ -2746,7 +2687,7 @@ static void hci_link_key_notify_evt(struct hci_dev *hdev, struct sk_buff *skb)
                 hci_conn_drop(conn);
         }
 
-        if (test_bit(HCI_LINK_KEYS, &hdev->dev_flags))
+        if (test_bit(HCI_MGMT, &hdev->dev_flags))
                 hci_add_link_key(hdev, conn, 1, &ev->bdaddr, ev->link_key,
                                  ev->key_type, pin_len);
 
@@ -2963,15 +2904,16 @@ static void hci_sync_conn_complete_evt(struct hci_dev *hdev,
                 hci_conn_add_sysfs(conn);
                 break;
 
+        case 0x0d:      /* Connection Rejected due to Limited Resources */
         case 0x11:      /* Unsupported Feature or Parameter Value */
         case 0x1c:      /* SCO interval rejected */
         case 0x1a:      /* Unsupported Remote Feature */
         case 0x1f:      /* Unspecified error */
-                if (conn->out && conn->attempt < 2) {
+                if (conn->out) {
                         conn->pkt_type = (hdev->esco_type & SCO_ESCO_MASK) |
                                         (hdev->esco_type & EDR_ESCO_MASK);
-                        hci_setup_sync(conn, conn->link->handle);
-                        goto unlock;
+                        if (hci_setup_sync(conn, conn->link->handle))
+                                goto unlock;
                 }
                 /* fall through */
 
@@ -3083,17 +3025,20 @@ unlock:
 static u8 hci_get_auth_req(struct hci_conn *conn)
 {
         /* If remote requests dedicated bonding follow that lead */
-        if (conn->remote_auth == 0x02 || conn->remote_auth == 0x03) {
+        if (conn->remote_auth == HCI_AT_DEDICATED_BONDING ||
+            conn->remote_auth == HCI_AT_DEDICATED_BONDING_MITM) {
                 /* If both remote and local IO capabilities allow MITM
                  * protection then require it, otherwise don't */
-                if (conn->remote_cap == 0x03 || conn->io_capability == 0x03)
-                        return 0x02;
+                if (conn->remote_cap == HCI_IO_NO_INPUT_OUTPUT ||
+                    conn->io_capability == HCI_IO_NO_INPUT_OUTPUT)
+                        return HCI_AT_DEDICATED_BONDING;
                 else
-                        return 0x03;
+                        return HCI_AT_DEDICATED_BONDING_MITM;
         }
 
         /* If remote requests no-bonding follow that lead */
-        if (conn->remote_auth == 0x00 || conn->remote_auth == 0x01)
+        if (conn->remote_auth == HCI_AT_NO_BONDING ||
+            conn->remote_auth == HCI_AT_NO_BONDING_MITM)
                 return conn->remote_auth | (conn->auth_type & 0x01);
 
         return conn->auth_type;
@@ -3125,7 +3070,7 @@ static void hci_io_capa_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
                 /* Change the IO capability from KeyboardDisplay
                  * to DisplayYesNo as it is not supported by BT spec. */
                 cp.capability = (conn->io_capability == 0x04) ?
-                                                0x01 : conn->io_capability;
+                                HCI_IO_DISPLAY_YESNO : conn->io_capability;
                 conn->auth_type = hci_get_auth_req(conn);
                 cp.authentication = conn->auth_type;
 
@@ -3199,7 +3144,8 @@ static void hci_user_confirm_request_evt(struct hci_dev *hdev,
          * request. The only exception is when we're dedicated bonding
          * initiators (connect_cfm_cb set) since then we always have the MITM
          * bit set. */
-        if (!conn->connect_cfm_cb && loc_mitm && conn->remote_cap == 0x03) {
+        if (!conn->connect_cfm_cb && loc_mitm &&
+            conn->remote_cap == HCI_IO_NO_INPUT_OUTPUT) {
                 BT_DBG("Rejecting request: remote device can't provide MITM");
                 hci_send_cmd(hdev, HCI_OP_USER_CONFIRM_NEG_REPLY,
                              sizeof(ev->bdaddr), &ev->bdaddr);
@@ -3207,8 +3153,8 @@ static void hci_user_confirm_request_evt(struct hci_dev *hdev,
         }
 
         /* If no side requires MITM protection; auto-accept */
-        if ((!loc_mitm || conn->remote_cap == 0x03) &&
-            (!rem_mitm || conn->io_capability == 0x03)) {
+        if ((!loc_mitm || conn->remote_cap == HCI_IO_NO_INPUT_OUTPUT) &&
+            (!rem_mitm || conn->io_capability == HCI_IO_NO_INPUT_OUTPUT)) {
 
                 /* If we're not the initiators request authorization to
                  * proceed from user space (mgmt_user_confirm with
@@ -3611,7 +3557,11 @@ static void hci_le_ltk_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
         cp.handle = cpu_to_le16(conn->handle);
 
         if (ltk->authenticated)
-                conn->sec_level = BT_SECURITY_HIGH;
+                conn->pending_sec_level = BT_SECURITY_HIGH;
+        else
+                conn->pending_sec_level = BT_SECURITY_MEDIUM;
+
+        conn->enc_key_size = ltk->enc_size;
 
         hci_send_cmd(hdev, HCI_OP_LE_LTK_REPLY, sizeof(cp), &cp);
 
diff --git a/net/bluetooth/hci_sysfs.c b/net/bluetooth/hci_sysfs.c
index 7ad6ecf36f20..edf623a29043 100644
--- a/net/bluetooth/hci_sysfs.c
+++ b/net/bluetooth/hci_sysfs.c
@@ -590,7 +590,7 @@ int __init bt_sysfs_init(void)
 
         bt_class = class_create(THIS_MODULE, "bluetooth");
 
-        return PTR_RET(bt_class);
+        return PTR_ERR_OR_ZERO(bt_class);
 }
 
 void bt_sysfs_cleanup(void)
diff --git a/net/bluetooth/hidp/core.c b/net/bluetooth/hidp/core.c
index 940f5acb6694..bdc35a7a7fee 100644
--- a/net/bluetooth/hidp/core.c
+++ b/net/bluetooth/hidp/core.c
@@ -76,25 +76,19 @@ static void hidp_copy_session(struct hidp_session *session, struct hidp_conninfo
         ci->flags = session->flags;
         ci->state = BT_CONNECTED;
 
-        ci->vendor  = 0x0000;
-        ci->product = 0x0000;
-        ci->version = 0x0000;
-
         if (session->input) {
                 ci->vendor  = session->input->id.vendor;
                 ci->product = session->input->id.product;
                 ci->version = session->input->id.version;
                 if (session->input->name)
-                        strncpy(ci->name, session->input->name, 128);
+                        strlcpy(ci->name, session->input->name, 128);
                 else
-                        strncpy(ci->name, "HID Boot Device", 128);
-        }
-
-        if (session->hid) {
+                        strlcpy(ci->name, "HID Boot Device", 128);
+        } else if (session->hid) {
                 ci->vendor  = session->hid->vendor;
                 ci->product = session->hid->product;
                 ci->version = session->hid->version;
-                strncpy(ci->name, session->hid->name, 128);
+                strlcpy(ci->name, session->hid->name, 128);
         }
 }
 
@@ -231,17 +225,47 @@ static void hidp_input_report(struct hidp_session *session, struct sk_buff *skb)
 
 static int hidp_send_report(struct hidp_session *session, struct hid_report *report)
 {
-        unsigned char buf[32], hdr;
-        int rsize;
+        unsigned char hdr;
+        u8 *buf;
+        int rsize, ret;
 
-        rsize = ((report->size - 1) >> 3) + 1 + (report->id > 0);
-        if (rsize > sizeof(buf))
+        buf = hid_alloc_report_buf(report, GFP_ATOMIC);
+        if (!buf)
                 return -EIO;
 
         hid_output_report(report, buf);
         hdr = HIDP_TRANS_DATA | HIDP_DATA_RTYPE_OUPUT;
 
-        return hidp_send_intr_message(session, hdr, buf, rsize);
+        rsize = ((report->size - 1) >> 3) + 1 + (report->id > 0);
+        ret = hidp_send_intr_message(session, hdr, buf, rsize);
+
+        kfree(buf);
+        return ret;
+}
+
+static int hidp_hidinput_event(struct input_dev *dev, unsigned int type,
+                               unsigned int code, int value)
+{
+        struct hid_device *hid = input_get_drvdata(dev);
+        struct hidp_session *session = hid->driver_data;
+        struct hid_field *field;
+        int offset;
+
+        BT_DBG("session %p type %d code %d value %d",
+               session, type, code, value);
+
+        if (type != EV_LED)
+                return -1;
+
+        offset = hidinput_find_field(hid, type, code, &field);
+        if (offset == -1) {
+                hid_warn(dev, "event field not found\n");
+                return -1;
+        }
+
+        hid_set_field(field, offset, value);
+
+        return hidp_send_report(session, field->report);
 }
 
 static int hidp_get_raw_report(struct hid_device *hid,
@@ -684,20 +708,6 @@ static int hidp_parse(struct hid_device *hid)
 
 static int hidp_start(struct hid_device *hid)
 {
-        struct hidp_session *session = hid->driver_data;
-        struct hid_report *report;
-
-        if (hid->quirks & HID_QUIRK_NO_INIT_REPORTS)
-                return 0;
-
-        list_for_each_entry(report, &hid->report_enum[HID_INPUT_REPORT].
-                        report_list, list)
-                hidp_send_report(session, report);
-
-        list_for_each_entry(report, &hid->report_enum[HID_FEATURE_REPORT].
-                        report_list, list)
-                hidp_send_report(session, report);
-
         return 0;
 }
 
@@ -717,6 +727,7 @@ static struct hid_ll_driver hidp_hid_driver = {
         .stop = hidp_stop,
         .open  = hidp_open,
         .close = hidp_close,
+        .hidinput_input_event = hidp_hidinput_event,
 };
 
 /* This function sets up the hid device. It does not add it
@@ -851,6 +862,29 @@ static void hidp_session_dev_del(struct hidp_session *session)
 }
 
 /*
+ * Asynchronous device registration
+ * HID device drivers might want to perform I/O during initialization to
+ * detect device types. Therefore, call device registration in a separate
+ * worker so the HIDP thread can schedule I/O operations.
+ * Note that this must be called after the worker thread was initialized
+ * successfully. This will then add the devices and increase session state
+ * on success, otherwise it will terminate the session thread.
+ */
+static void hidp_session_dev_work(struct work_struct *work)
+{
+        struct hidp_session *session = container_of(work,
+                                                    struct hidp_session,
+                                                    dev_init);
+        int ret;
+
+        ret = hidp_session_dev_add(session);
+        if (!ret)
+                atomic_inc(&session->state);
+        else
+                hidp_session_terminate(session);
+}
+
+/*
  * Create new session object
  * Allocate session object, initialize static fields, copy input data into the
  * object and take a reference to all sub-objects.
@@ -897,6 +931,7 @@ static int hidp_session_new(struct hidp_session **out, const bdaddr_t *bdaddr,
         session->idle_to = req->idle_to;
 
         /* device management */
+        INIT_WORK(&session->dev_init, hidp_session_dev_work);
         setup_timer(&session->timer, hidp_idle_timeout,
                     (unsigned long)session);
 
@@ -1035,8 +1070,8 @@ static void hidp_session_terminate(struct hidp_session *session)
  * Probe HIDP session
  * This is called from the l2cap_conn core when our l2cap_user object is bound
  * to the hci-connection. We get the session via the \user object and can now
- * start the session thread, register the HID/input devices and link it into
- * the global session list.
+ * start the session thread, link it into the global session list and
+ * schedule HID/input device registration.
  * The global session-list owns its own reference to the session object so you
  * can drop your own reference after registering the l2cap_user object.
  */
@@ -1058,21 +1093,30 @@ static int hidp_session_probe(struct l2cap_conn *conn,
                 goto out_unlock;
         }
 
+        if (session->input) {
+                ret = hidp_session_dev_add(session);
+                if (ret)
+                        goto out_unlock;
+        }
+
         ret = hidp_session_start_sync(session);
         if (ret)
-                goto out_unlock;
+                goto out_del;
 
-        ret = hidp_session_dev_add(session);
-        if (ret)
-                goto out_stop;
+        /* HID device registration is async to allow I/O during probe */
+        if (session->input)
+                atomic_inc(&session->state);
+        else
+                schedule_work(&session->dev_init);
 
         hidp_session_get(session);
         list_add(&session->list, &hidp_session_list);
         ret = 0;
         goto out_unlock;
 
-out_stop:
-        hidp_session_terminate(session);
+out_del:
+        if (session->input)
+                hidp_session_dev_del(session);
 out_unlock:
         up_write(&hidp_session_sem);
         return ret;
@@ -1102,7 +1146,12 @@ static void hidp_session_remove(struct l2cap_conn *conn,
         down_write(&hidp_session_sem);
 
         hidp_session_terminate(session);
-        hidp_session_dev_del(session);
+
+        cancel_work_sync(&session->dev_init);
+        if (session->input ||
+            atomic_read(&session->state) > HIDP_SESSION_PREPARING)
+                hidp_session_dev_del(session);
+
         list_del(&session->list);
 
         up_write(&hidp_session_sem);
diff --git a/net/bluetooth/hidp/hidp.h b/net/bluetooth/hidp/hidp.h
index 6162ce8606ac..9e6cc3553105 100644
--- a/net/bluetooth/hidp/hidp.h
+++ b/net/bluetooth/hidp/hidp.h
@@ -128,6 +128,7 @@ int hidp_get_conninfo(struct hidp_conninfo *ci);
 
 enum hidp_session_state {
         HIDP_SESSION_IDLING,
+        HIDP_SESSION_PREPARING,
         HIDP_SESSION_RUNNING,
 };
 
@@ -156,6 +157,7 @@ struct hidp_session {
         unsigned long idle_to;
 
         /* device management */
+        struct work_struct dev_init;
         struct input_dev *input;
         struct hid_device *hid;
         struct timer_list timer;
diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
index a76d1ac0321b..63fa11109a1c 100644
--- a/net/bluetooth/l2cap_core.c
+++ b/net/bluetooth/l2cap_core.c
@@ -504,8 +504,10 @@ void __l2cap_chan_add(struct l2cap_conn *conn, struct l2cap_chan *chan)
                 if (conn->hcon->type == LE_LINK) {
                         /* LE connection */
                         chan->omtu = L2CAP_DEFAULT_MTU;
-                        chan->scid = L2CAP_CID_LE_DATA;
-                        chan->dcid = L2CAP_CID_LE_DATA;
+                        if (chan->dcid == L2CAP_CID_ATT)
+                                chan->scid = L2CAP_CID_ATT;
+                        else
+                                chan->scid = l2cap_alloc_cid(conn);
                 } else {
                         /* Alloc CID for connection-oriented socket */
                         chan->scid = l2cap_alloc_cid(conn);
@@ -543,6 +545,8 @@ void __l2cap_chan_add(struct l2cap_conn *conn, struct l2cap_chan *chan)
 
         l2cap_chan_hold(chan);
 
+        hci_conn_hold(conn->hcon);
+
         list_add(&chan->list, &conn->chan_l);
 }
 
@@ -1338,17 +1342,21 @@ static struct l2cap_chan *l2cap_global_chan_by_scid(int state, u16 cid,
 
 static void l2cap_le_conn_ready(struct l2cap_conn *conn)
 {
-        struct sock *parent, *sk;
+        struct sock *parent;
         struct l2cap_chan *chan, *pchan;
 
         BT_DBG("");
 
         /* Check if we have socket listening on cid */
-        pchan = l2cap_global_chan_by_scid(BT_LISTEN, L2CAP_CID_LE_DATA,
+        pchan = l2cap_global_chan_by_scid(BT_LISTEN, L2CAP_CID_ATT,
                                           conn->src, conn->dst);
         if (!pchan)
                 return;
 
+        /* Client ATT sockets should override the server one */
+        if (__l2cap_get_chan_by_dcid(conn, L2CAP_CID_ATT))
+                return;
+
         parent = pchan->sk;
 
         lock_sock(parent);
@@ -1357,17 +1365,12 @@ static void l2cap_le_conn_ready(struct l2cap_conn *conn)
         if (!chan)
                 goto clean;
 
-        sk = chan->sk;
-
-        hci_conn_hold(conn->hcon);
-        conn->hcon->disc_timeout = HCI_DISCONN_TIMEOUT;
+        chan->dcid = L2CAP_CID_ATT;
 
-        bacpy(&bt_sk(sk)->src, conn->src);
-        bacpy(&bt_sk(sk)->dst, conn->dst);
+        bacpy(&bt_sk(chan->sk)->src, conn->src);
+        bacpy(&bt_sk(chan->sk)->dst, conn->dst);
 
-        l2cap_chan_add(conn, chan);
-
-        l2cap_chan_ready(chan);
+        __l2cap_chan_add(conn, chan);
 
 clean:
         release_sock(parent);
@@ -1380,14 +1383,17 @@ static void l2cap_conn_ready(struct l2cap_conn *conn)
 
         BT_DBG("conn %p", conn);
 
-        if (!hcon->out && hcon->type == LE_LINK)
-                l2cap_le_conn_ready(conn);
-
+        /* For outgoing pairing which doesn't necessarily have an
+         * associated socket (e.g. mgmt_pair_device).
+         */
         if (hcon->out && hcon->type == LE_LINK)
                 smp_conn_security(hcon, hcon->pending_sec_level);
 
         mutex_lock(&conn->chan_lock);
 
+        if (hcon->type == LE_LINK)
+                l2cap_le_conn_ready(conn);
+
         list_for_each_entry(chan, &conn->chan_l, list) {
 
                 l2cap_chan_lock(chan);
@@ -1409,8 +1415,9 @@ static void l2cap_conn_ready(struct l2cap_conn *conn)
                         sk->sk_state_change(sk);
                         release_sock(sk);
 
-                } else if (chan->state == BT_CONNECT)
+                } else if (chan->state == BT_CONNECT) {
                         l2cap_do_start(chan);
+                }
 
                 l2cap_chan_unlock(chan);
         }
@@ -1792,7 +1799,7 @@ int l2cap_chan_connect(struct l2cap_chan *chan, __le16 psm, u16 cid,
 
         auth_type = l2cap_get_auth_type(chan);
 
-        if (chan->dcid == L2CAP_CID_LE_DATA)
+        if (bdaddr_type_is_le(dst_type))
                 hcon = hci_connect(hdev, LE_LINK, dst, dst_type,
                                    chan->sec_level, auth_type);
         else
@@ -1811,16 +1818,10 @@ int l2cap_chan_connect(struct l2cap_chan *chan, __le16 psm, u16 cid,
                 goto done;
         }
 
-        if (hcon->type == LE_LINK) {
-                err = 0;
-
-                if (!list_empty(&conn->chan_l)) {
-                        err = -EBUSY;
-                        hci_conn_drop(hcon);
-                }
-
-                if (err)
-                        goto done;
+        if (cid && __l2cap_get_chan_by_dcid(conn, cid)) {
+                hci_conn_drop(hcon);
+                err = -EBUSY;
+                goto done;
         }
 
         /* Update source addr of the socket */
@@ -1830,6 +1831,9 @@ int l2cap_chan_connect(struct l2cap_chan *chan, __le16 psm, u16 cid,
         l2cap_chan_add(conn, chan);
         l2cap_chan_lock(chan);
 
+        /* l2cap_chan_add takes its own ref so we can drop this one */
+        hci_conn_drop(hcon);
+
         l2cap_state_change(chan, BT_CONNECT);
         __set_chan_timer(chan, sk->sk_sndtimeo);
 
@@ -2852,6 +2856,9 @@ static struct sk_buff *l2cap_build_cmd(struct l2cap_conn *conn, u8 code,
         BT_DBG("conn %p, code 0x%2.2x, ident 0x%2.2x, len %u",
                conn, code, ident, dlen);
 
+        if (conn->mtu < L2CAP_HDR_SIZE + L2CAP_CMD_HDR_SIZE)
+                return NULL;
+
         len = L2CAP_HDR_SIZE + L2CAP_CMD_HDR_SIZE + dlen;
         count = min_t(unsigned int, conn->mtu, len);
 
@@ -3677,10 +3684,14 @@ static void l2cap_conf_rfc_get(struct l2cap_chan *chan, void *rsp, int len)
 }
 
 static inline int l2cap_command_rej(struct l2cap_conn *conn,
-                                    struct l2cap_cmd_hdr *cmd, u8 *data)
+                                    struct l2cap_cmd_hdr *cmd, u16 cmd_len,
+                                    u8 *data)
 {
         struct l2cap_cmd_rej_unk *rej = (struct l2cap_cmd_rej_unk *) data;
 
+        if (cmd_len < sizeof(*rej))
+                return -EPROTO;
+
         if (rej->reason != L2CAP_REJ_NOT_UNDERSTOOD)
                 return 0;
 
@@ -3744,7 +3755,12 @@ static struct l2cap_chan *l2cap_connect(struct l2cap_conn *conn,
 
         sk = chan->sk;
 
-        hci_conn_hold(conn->hcon);
+        /* For certain devices (ex: HID mouse), support for authentication,
+         * pairing and bonding is optional. For such devices, inorder to avoid
+         * the ACL alive for too long after L2CAP disconnection, reset the ACL
+         * disc_timeout back to HCI_DISCONN_TIMEOUT during L2CAP connect.
+         */
+        conn->hcon->disc_timeout = HCI_DISCONN_TIMEOUT;
 
         bacpy(&bt_sk(sk)->src, conn->src);
         bacpy(&bt_sk(sk)->dst, conn->dst);
@@ -3829,11 +3845,14 @@ sendresp:
 }
 
 static int l2cap_connect_req(struct l2cap_conn *conn,
-                             struct l2cap_cmd_hdr *cmd, u8 *data)
+                             struct l2cap_cmd_hdr *cmd, u16 cmd_len, u8 *data)
 {
         struct hci_dev *hdev = conn->hcon->hdev;
         struct hci_conn *hcon = conn->hcon;
 
+        if (cmd_len < sizeof(struct l2cap_conn_req))
+                return -EPROTO;
+
         hci_dev_lock(hdev);
         if (test_bit(HCI_MGMT, &hdev->dev_flags) &&
             !test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &hcon->flags))
@@ -3847,7 +3866,8 @@ static int l2cap_connect_req(struct l2cap_conn *conn,
 }
 
 static int l2cap_connect_create_rsp(struct l2cap_conn *conn,
-                                    struct l2cap_cmd_hdr *cmd, u8 *data)
+                                    struct l2cap_cmd_hdr *cmd, u16 cmd_len,
+                                    u8 *data)
 {
         struct l2cap_conn_rsp *rsp = (struct l2cap_conn_rsp *) data;
         u16 scid, dcid, result, status;
@@ -3855,6 +3875,9 @@ static int l2cap_connect_create_rsp(struct l2cap_conn *conn,
         u8 req[128];
         int err;
 
+        if (cmd_len < sizeof(*rsp))
+                return -EPROTO;
+
         scid   = __le16_to_cpu(rsp->scid);
         dcid   = __le16_to_cpu(rsp->dcid);
         result = __le16_to_cpu(rsp->result);
@@ -3952,6 +3975,9 @@ static inline int l2cap_config_req(struct l2cap_conn *conn,
         struct l2cap_chan *chan;
         int len, err = 0;
 
+        if (cmd_len < sizeof(*req))
+                return -EPROTO;
+
         dcid  = __le16_to_cpu(req->dcid);
         flags = __le16_to_cpu(req->flags);
 
@@ -3975,7 +4001,7 @@ static inline int l2cap_config_req(struct l2cap_conn *conn,
 
         /* Reject if config buffer is too small. */
         len = cmd_len - sizeof(*req);
-        if (len < 0 || chan->conf_len + len > sizeof(chan->conf_req)) {
+        if (chan->conf_len + len > sizeof(chan->conf_req)) {
                 l2cap_send_cmd(conn, cmd->ident, L2CAP_CONF_RSP,
                                l2cap_build_conf_rsp(chan, rsp,
                                L2CAP_CONF_REJECT, flags), rsp);
@@ -4053,14 +4079,18 @@ unlock:
 }
 
 static inline int l2cap_config_rsp(struct l2cap_conn *conn,
-                                   struct l2cap_cmd_hdr *cmd, u8 *data)
+                                   struct l2cap_cmd_hdr *cmd, u16 cmd_len,
+                                   u8 *data)
 {
         struct l2cap_conf_rsp *rsp = (struct l2cap_conf_rsp *)data;
         u16 scid, flags, result;
         struct l2cap_chan *chan;
-        int len = le16_to_cpu(cmd->len) - sizeof(*rsp);
+        int len = cmd_len - sizeof(*rsp);
         int err = 0;
 
+        if (cmd_len < sizeof(*rsp))
+                return -EPROTO;
+
         scid   = __le16_to_cpu(rsp->scid);
         flags  = __le16_to_cpu(rsp->flags);
         result = __le16_to_cpu(rsp->result);
@@ -4161,7 +4191,8 @@ done:
 }
 
 static inline int l2cap_disconnect_req(struct l2cap_conn *conn,
-                                       struct l2cap_cmd_hdr *cmd, u8 *data)
+                                       struct l2cap_cmd_hdr *cmd, u16 cmd_len,
+                                       u8 *data)
 {
         struct l2cap_disconn_req *req = (struct l2cap_disconn_req *) data;
         struct l2cap_disconn_rsp rsp;
@@ -4169,6 +4200,9 @@ static inline int l2cap_disconnect_req(struct l2cap_conn *conn,
         struct l2cap_chan *chan;
         struct sock *sk;
 
+        if (cmd_len != sizeof(*req))
+                return -EPROTO;
+
         scid = __le16_to_cpu(req->scid);
         dcid = __le16_to_cpu(req->dcid);
 
@@ -4208,12 +4242,16 @@ static inline int l2cap_disconnect_req(struct l2cap_conn *conn,
 }
 
 static inline int l2cap_disconnect_rsp(struct l2cap_conn *conn,
-                                       struct l2cap_cmd_hdr *cmd, u8 *data)
+                                       struct l2cap_cmd_hdr *cmd, u16 cmd_len,
+                                       u8 *data)
 {
         struct l2cap_disconn_rsp *rsp = (struct l2cap_disconn_rsp *) data;
         u16 dcid, scid;
         struct l2cap_chan *chan;
 
+        if (cmd_len != sizeof(*rsp))
+                return -EPROTO;
+
         scid = __le16_to_cpu(rsp->scid);
         dcid = __le16_to_cpu(rsp->dcid);
 
@@ -4243,11 +4281,15 @@ static inline int l2cap_disconnect_rsp(struct l2cap_conn *conn,
 }
 
 static inline int l2cap_information_req(struct l2cap_conn *conn,
-                                        struct l2cap_cmd_hdr *cmd, u8 *data)
+                                        struct l2cap_cmd_hdr *cmd, u16 cmd_len,
+                                        u8 *data)
 {
         struct l2cap_info_req *req = (struct l2cap_info_req *) data;
         u16 type;
 
+        if (cmd_len != sizeof(*req))
+                return -EPROTO;
+
         type = __le16_to_cpu(req->type);
 
         BT_DBG("type 0x%4.4x", type);
@@ -4294,11 +4336,15 @@ static inline int l2cap_information_req(struct l2cap_conn *conn,
 }
 
 static inline int l2cap_information_rsp(struct l2cap_conn *conn,
-                                        struct l2cap_cmd_hdr *cmd, u8 *data)
+                                        struct l2cap_cmd_hdr *cmd, u16 cmd_len,
+                                        u8 *data)
 {
         struct l2cap_info_rsp *rsp = (struct l2cap_info_rsp *) data;
         u16 type, result;
 
+        if (cmd_len < sizeof(*rsp))
+                return -EPROTO;
+
         type   = __le16_to_cpu(rsp->type);
         result = __le16_to_cpu(rsp->result);
 
@@ -5164,16 +5210,16 @@ static inline int l2cap_bredr_sig_cmd(struct l2cap_conn *conn,
 
         switch (cmd->code) {
         case L2CAP_COMMAND_REJ:
-                l2cap_command_rej(conn, cmd, data);
+                l2cap_command_rej(conn, cmd, cmd_len, data);
                 break;
 
         case L2CAP_CONN_REQ:
-                err = l2cap_connect_req(conn, cmd, data);
+                err = l2cap_connect_req(conn, cmd, cmd_len, data);
                 break;
 
         case L2CAP_CONN_RSP:
         case L2CAP_CREATE_CHAN_RSP:
-                err = l2cap_connect_create_rsp(conn, cmd, data);
+                err = l2cap_connect_create_rsp(conn, cmd, cmd_len, data);
                 break;
 
         case L2CAP_CONF_REQ:
@@ -5181,15 +5227,15 @@ static inline int l2cap_bredr_sig_cmd(struct l2cap_conn *conn,
                 break;
 
         case L2CAP_CONF_RSP:
-                err = l2cap_config_rsp(conn, cmd, data);
+                err = l2cap_config_rsp(conn, cmd, cmd_len, data);
                 break;
 
         case L2CAP_DISCONN_REQ:
-                err = l2cap_disconnect_req(conn, cmd, data);
+                err = l2cap_disconnect_req(conn, cmd, cmd_len, data);
                 break;
 
         case L2CAP_DISCONN_RSP:
-                err = l2cap_disconnect_rsp(conn, cmd, data);
+                err = l2cap_disconnect_rsp(conn, cmd, cmd_len, data);
                 break;
 
         case L2CAP_ECHO_REQ:
@@ -5200,11 +5246,11 @@ static inline int l2cap_bredr_sig_cmd(struct l2cap_conn *conn,
                 break;
 
         case L2CAP_INFO_REQ:
-                err = l2cap_information_req(conn, cmd, data);
+                err = l2cap_information_req(conn, cmd, cmd_len, data);
                 break;
 
         case L2CAP_INFO_RSP:
-                err = l2cap_information_rsp(conn, cmd, data);
+                err = l2cap_information_rsp(conn, cmd, cmd_len, data);
                 break;
 
         case L2CAP_CREATE_CHAN_REQ:
@@ -5255,6 +5301,51 @@ static inline int l2cap_le_sig_cmd(struct l2cap_conn *conn,
         }
 }
 
+static inline void l2cap_le_sig_channel(struct l2cap_conn *conn,
+                                        struct sk_buff *skb)
+{
+        u8 *data = skb->data;
+        int len = skb->len;
+        struct l2cap_cmd_hdr cmd;
+        int err;
+
+        l2cap_raw_recv(conn, skb);
+
+        while (len >= L2CAP_CMD_HDR_SIZE) {
+                u16 cmd_len;
+                memcpy(&cmd, data, L2CAP_CMD_HDR_SIZE);
+                data += L2CAP_CMD_HDR_SIZE;
+                len  -= L2CAP_CMD_HDR_SIZE;
+
+                cmd_len = le16_to_cpu(cmd.len);
+
+                BT_DBG("code 0x%2.2x len %d id 0x%2.2x", cmd.code, cmd_len,
+                       cmd.ident);
+
+                if (cmd_len > len || !cmd.ident) {
+                        BT_DBG("corrupted command");
+                        break;
+                }
+
+                err = l2cap_le_sig_cmd(conn, &cmd, data);
+                if (err) {
+                        struct l2cap_cmd_rej_unk rej;
+
+                        BT_ERR("Wrong link type (%d)", err);
+
+                        /* FIXME: Map err to a valid reason */
+                        rej.reason = __constant_cpu_to_le16(L2CAP_REJ_NOT_UNDERSTOOD);
+                        l2cap_send_cmd(conn, cmd.ident, L2CAP_COMMAND_REJ,
+                                       sizeof(rej), &rej);
+                }
+
+                data += cmd_len;
+                len  -= cmd_len;
+        }
+
+        kfree_skb(skb);
+}
+
 static inline void l2cap_sig_channel(struct l2cap_conn *conn,
                                      struct sk_buff *skb)
 {
@@ -5281,11 +5372,7 @@ static inline void l2cap_sig_channel(struct l2cap_conn *conn,
                         break;
                 }
 
-                if (conn->hcon->type == LE_LINK)
-                        err = l2cap_le_sig_cmd(conn, &cmd, data);
-                else
-                        err = l2cap_bredr_sig_cmd(conn, &cmd, cmd_len, data);
-
+                err = l2cap_bredr_sig_cmd(conn, &cmd, cmd_len, data);
                 if (err) {
                         struct l2cap_cmd_rej_unk rej;
 
@@ -6319,16 +6406,13 @@ static void l2cap_att_channel(struct l2cap_conn *conn,
 {
         struct l2cap_chan *chan;
 
-        chan = l2cap_global_chan_by_scid(0, L2CAP_CID_LE_DATA,
+        chan = l2cap_global_chan_by_scid(BT_CONNECTED, L2CAP_CID_ATT,
                                          conn->src, conn->dst);
         if (!chan)
                 goto drop;
 
         BT_DBG("chan %p, len %d", chan, skb->len);
 
-        if (chan->state != BT_BOUND && chan->state != BT_CONNECTED)
-                goto drop;
-
         if (chan->imtu < skb->len)
                 goto drop;
 
@@ -6358,6 +6442,8 @@ static void l2cap_recv_frame(struct l2cap_conn *conn, struct sk_buff *skb)
 
         switch (cid) {
         case L2CAP_CID_LE_SIGNALING:
+                l2cap_le_sig_channel(conn, skb);
+                break;
         case L2CAP_CID_SIGNALING:
                 l2cap_sig_channel(conn, skb);
                 break;
@@ -6368,7 +6454,7 @@ static void l2cap_recv_frame(struct l2cap_conn *conn, struct sk_buff *skb)
                 l2cap_conless_channel(conn, psm, skb);
                 break;
 
-        case L2CAP_CID_LE_DATA:
+        case L2CAP_CID_ATT:
                 l2cap_att_channel(conn, skb);
                 break;
 
@@ -6494,7 +6580,7 @@ int l2cap_security_cfm(struct hci_conn *hcon, u8 status, u8 encrypt)
                         continue;
                 }
 
-                if (chan->scid == L2CAP_CID_LE_DATA) {
+                if (chan->scid == L2CAP_CID_ATT) {
                         if (!status && encrypt) {
                                 chan->sec_level = hcon->sec_level;
                                 l2cap_chan_ready(chan);
diff --git a/net/bluetooth/l2cap_sock.c b/net/bluetooth/l2cap_sock.c
index 36fed40c162c..0098af80b213 100644
--- a/net/bluetooth/l2cap_sock.c
+++ b/net/bluetooth/l2cap_sock.c
@@ -466,7 +466,7 @@ static int l2cap_sock_getsockopt(struct socket *sock, int level, int optname,
 static bool l2cap_valid_mtu(struct l2cap_chan *chan, u16 mtu)
 {
         switch (chan->scid) {
-        case L2CAP_CID_LE_DATA:
+        case L2CAP_CID_ATT:
                 if (mtu < L2CAP_LE_MIN_MTU)
                         return false;
                 break;
@@ -630,7 +630,7 @@ static int l2cap_sock_setsockopt(struct socket *sock, int level, int optname,
                 conn = chan->conn;
 
                 /*change security for LE channels */
-                if (chan->scid == L2CAP_CID_LE_DATA) {
+                if (chan->scid == L2CAP_CID_ATT) {
                         if (!conn->hcon->out) {
                                 err = -EINVAL;
                                 break;
diff --git a/net/bluetooth/mgmt.c b/net/bluetooth/mgmt.c
index 35fef22703e9..fedc5399d465 100644
--- a/net/bluetooth/mgmt.c
+++ b/net/bluetooth/mgmt.c
@@ -102,18 +102,6 @@ static const u16 mgmt_events[] = {
         MGMT_EV_PASSKEY_NOTIFY,
 };
 
-/*
- * These LE scan and inquiry parameters were chosen according to LE General
- * Discovery Procedure specification.
- */
-#define LE_SCAN_WIN                     0x12
-#define LE_SCAN_INT                     0x12
-#define LE_SCAN_TIMEOUT_LE_ONLY         msecs_to_jiffies(10240)
-#define LE_SCAN_TIMEOUT_BREDR_LE        msecs_to_jiffies(5120)
-
-#define INQUIRY_LEN_BREDR               0x08    /* TGAP(100) */
-#define INQUIRY_LEN_BREDR_LE            0x04    /* TGAP(100)/2 */
-
 #define CACHE_TIMEOUT   msecs_to_jiffies(2 * 1000)
 
 #define hdev_is_powered(hdev) (test_bit(HCI_UP, &hdev->flags) && \
@@ -1748,8 +1736,6 @@ static int load_link_keys(struct sock *sk, struct hci_dev *hdev, void *data,
 
         hci_link_keys_clear(hdev);
 
-        set_bit(HCI_LINK_KEYS, &hdev->dev_flags);
-
         if (cp->debug_keys)
                 set_bit(HCI_DEBUG_KEYS, &hdev->dev_flags);
         else
@@ -2633,28 +2619,72 @@ static int remove_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
         return err;
 }
 
-int mgmt_interleaved_discovery(struct hci_dev *hdev)
+static int mgmt_start_discovery_failed(struct hci_dev *hdev, u8 status)
 {
+        struct pending_cmd *cmd;
+        u8 type;
         int err;
 
-        BT_DBG("%s", hdev->name);
+        hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
 
-        hci_dev_lock(hdev);
+        cmd = mgmt_pending_find(MGMT_OP_START_DISCOVERY, hdev);
+        if (!cmd)
+                return -ENOENT;
 
-        err = hci_do_inquiry(hdev, INQUIRY_LEN_BREDR_LE);
-        if (err < 0)
-                hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
+        type = hdev->discovery.type;
 
-        hci_dev_unlock(hdev);
+        err = cmd_complete(cmd->sk, hdev->id, cmd->opcode, mgmt_status(status),
+                           &type, sizeof(type));
+        mgmt_pending_remove(cmd);
 
         return err;
 }
 
+static void start_discovery_complete(struct hci_dev *hdev, u8 status)
+{
+        BT_DBG("status %d", status);
+
+        if (status) {
+                hci_dev_lock(hdev);
+                mgmt_start_discovery_failed(hdev, status);
+                hci_dev_unlock(hdev);
+                return;
+        }
+
+        hci_dev_lock(hdev);
+        hci_discovery_set_state(hdev, DISCOVERY_FINDING);
+        hci_dev_unlock(hdev);
+
+        switch (hdev->discovery.type) {
+        case DISCOV_TYPE_LE:
+                queue_delayed_work(hdev->workqueue, &hdev->le_scan_disable,
+                                   DISCOV_LE_TIMEOUT);
+                break;
+
+        case DISCOV_TYPE_INTERLEAVED:
+                queue_delayed_work(hdev->workqueue, &hdev->le_scan_disable,
+                                   DISCOV_INTERLEAVED_TIMEOUT);
+                break;
+
+        case DISCOV_TYPE_BREDR:
+                break;
+
+        default:
+                BT_ERR("Invalid discovery type %d", hdev->discovery.type);
+        }
+}
+
 static int start_discovery(struct sock *sk, struct hci_dev *hdev,
                            void *data, u16 len)
 {
         struct mgmt_cp_start_discovery *cp = data;
         struct pending_cmd *cmd;
+        struct hci_cp_le_set_scan_param param_cp;
+        struct hci_cp_le_set_scan_enable enable_cp;
+        struct hci_cp_inquiry inq_cp;
+        struct hci_request req;
+        /* General inquiry access code (GIAC) */
+        u8 lap[3] = { 0x33, 0x8b, 0x9e };
         int err;
 
         BT_DBG("%s", hdev->name);
@@ -2687,6 +2717,8 @@ static int start_discovery(struct sock *sk, struct hci_dev *hdev,
 
         hdev->discovery.type = cp->type;
 
+        hci_req_init(&req, hdev);
+
         switch (hdev->discovery.type) {
         case DISCOV_TYPE_BREDR:
                 if (!lmp_bredr_capable(hdev)) {
@@ -2696,31 +2728,64 @@ static int start_discovery(struct sock *sk, struct hci_dev *hdev,
                         goto failed;
                 }
 
-                err = hci_do_inquiry(hdev, INQUIRY_LEN_BREDR);
+                if (test_bit(HCI_INQUIRY, &hdev->flags)) {
+                        err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
+                                         MGMT_STATUS_BUSY);
+                        mgmt_pending_remove(cmd);
+                        goto failed;
+                }
+
+                hci_inquiry_cache_flush(hdev);
+
+                memset(&inq_cp, 0, sizeof(inq_cp));
+                memcpy(&inq_cp.lap, lap, sizeof(inq_cp.lap));
+                inq_cp.length = DISCOV_BREDR_INQUIRY_LEN;
+                hci_req_add(&req, HCI_OP_INQUIRY, sizeof(inq_cp), &inq_cp);
                 break;
 
         case DISCOV_TYPE_LE:
-                if (!lmp_host_le_capable(hdev)) {
+        case DISCOV_TYPE_INTERLEAVED:
+                if (!test_bit(HCI_LE_ENABLED, &hdev->dev_flags)) {
                         err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
                                          MGMT_STATUS_NOT_SUPPORTED);
                         mgmt_pending_remove(cmd);
                         goto failed;
                 }
 
-                err = hci_le_scan(hdev, LE_SCAN_ACTIVE, LE_SCAN_INT,
-                                  LE_SCAN_WIN, LE_SCAN_TIMEOUT_LE_ONLY);
-                break;
-
-        case DISCOV_TYPE_INTERLEAVED:
-                if (!lmp_host_le_capable(hdev) || !lmp_bredr_capable(hdev)) {
+                if (hdev->discovery.type == DISCOV_TYPE_INTERLEAVED &&
+                    !lmp_bredr_capable(hdev)) {
                         err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
                                          MGMT_STATUS_NOT_SUPPORTED);
                         mgmt_pending_remove(cmd);
                         goto failed;
                 }
 
-                err = hci_le_scan(hdev, LE_SCAN_ACTIVE, LE_SCAN_INT,
-                                  LE_SCAN_WIN, LE_SCAN_TIMEOUT_BREDR_LE);
+                if (test_bit(HCI_LE_PERIPHERAL, &hdev->dev_flags)) {
+                        err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
+                                         MGMT_STATUS_REJECTED);
+                        mgmt_pending_remove(cmd);
+                        goto failed;
+                }
+
+                if (test_bit(HCI_LE_SCAN, &hdev->dev_flags)) {
+                        err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
+                                         MGMT_STATUS_BUSY);
+                        mgmt_pending_remove(cmd);
+                        goto failed;
+                }
+
+                memset(&param_cp, 0, sizeof(param_cp));
+                param_cp.type = LE_SCAN_ACTIVE;
+                param_cp.interval = cpu_to_le16(DISCOV_LE_SCAN_INT);
+                param_cp.window = cpu_to_le16(DISCOV_LE_SCAN_WIN);
+                hci_req_add(&req, HCI_OP_LE_SET_SCAN_PARAM, sizeof(param_cp),
+                            &param_cp);
+
+                memset(&enable_cp, 0, sizeof(enable_cp));
+                enable_cp.enable = LE_SCAN_ENABLE;
+                enable_cp.filter_dup = LE_SCAN_FILTER_DUP_ENABLE;
+                hci_req_add(&req, HCI_OP_LE_SET_SCAN_ENABLE, sizeof(enable_cp),
+                            &enable_cp);
                 break;
 
         default:
@@ -2730,6 +2795,7 @@ static int start_discovery(struct sock *sk, struct hci_dev *hdev,
                 goto failed;
         }
 
+        err = hci_req_run(&req, start_discovery_complete);
         if (err < 0)
                 mgmt_pending_remove(cmd);
         else
@@ -2740,6 +2806,39 @@ failed:
         return err;
 }
 
+static int mgmt_stop_discovery_failed(struct hci_dev *hdev, u8 status)
+{
+        struct pending_cmd *cmd;
+        int err;
+
+        cmd = mgmt_pending_find(MGMT_OP_STOP_DISCOVERY, hdev);
+        if (!cmd)
+                return -ENOENT;
+
+        err = cmd_complete(cmd->sk, hdev->id, cmd->opcode, mgmt_status(status),
+                           &hdev->discovery.type, sizeof(hdev->discovery.type));
+        mgmt_pending_remove(cmd);
+
+        return err;
+}
+
+static void stop_discovery_complete(struct hci_dev *hdev, u8 status)
+{
+        BT_DBG("status %d", status);
+
+        hci_dev_lock(hdev);
+
+        if (status) {
+                mgmt_stop_discovery_failed(hdev, status);
+                goto unlock;
+        }
+
+        hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
+
+unlock:
+        hci_dev_unlock(hdev);
+}
+
 static int stop_discovery(struct sock *sk, struct hci_dev *hdev, void *data,
                           u16 len)
 {
@@ -2747,6 +2846,8 @@ static int stop_discovery(struct sock *sk, struct hci_dev *hdev, void *data,
         struct pending_cmd *cmd;
         struct hci_cp_remote_name_req_cancel cp;
         struct inquiry_entry *e;
+        struct hci_request req;
+        struct hci_cp_le_set_scan_enable enable_cp;
         int err;
 
         BT_DBG("%s", hdev->name);
@@ -2773,12 +2874,20 @@ static int stop_discovery(struct sock *sk, struct hci_dev *hdev, void *data,
                 goto unlock;
         }
 
+        hci_req_init(&req, hdev);
+
         switch (hdev->discovery.state) {
         case DISCOVERY_FINDING:
-                if (test_bit(HCI_INQUIRY, &hdev->flags))
-                        err = hci_cancel_inquiry(hdev);
-                else
-                        err = hci_cancel_le_scan(hdev);
+                if (test_bit(HCI_INQUIRY, &hdev->flags)) {
+                        hci_req_add(&req, HCI_OP_INQUIRY_CANCEL, 0, NULL);
+                } else {
+                        cancel_delayed_work(&hdev->le_scan_disable);
+
+                        memset(&enable_cp, 0, sizeof(enable_cp));
+                        enable_cp.enable = LE_SCAN_DISABLE;
+                        hci_req_add(&req, HCI_OP_LE_SET_SCAN_ENABLE,
+                                    sizeof(enable_cp), &enable_cp);
+                }
 
                 break;
 
@@ -2796,16 +2905,22 @@ static int stop_discovery(struct sock *sk, struct hci_dev *hdev, void *data,
                 }
 
                 bacpy(&cp.bdaddr, &e->data.bdaddr);
-                err = hci_send_cmd(hdev, HCI_OP_REMOTE_NAME_REQ_CANCEL,
-                                   sizeof(cp), &cp);
+                hci_req_add(&req, HCI_OP_REMOTE_NAME_REQ_CANCEL, sizeof(cp),
+                            &cp);
 
                 break;
 
         default:
                 BT_DBG("unknown discovery state %u", hdev->discovery.state);
-                err = -EFAULT;
+
+                mgmt_pending_remove(cmd);
+                err = cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
+                                   MGMT_STATUS_FAILED, &mgmt_cp->type,
+                                   sizeof(mgmt_cp->type));
+                goto unlock;
         }
 
+        err = hci_req_run(&req, stop_discovery_complete);
         if (err < 0)
                 mgmt_pending_remove(cmd);
         else
@@ -3418,6 +3533,27 @@ new_settings:
         return err;
 }
 
+int mgmt_set_powered_failed(struct hci_dev *hdev, int err)
+{
+        struct pending_cmd *cmd;
+        u8 status;
+
+        cmd = mgmt_pending_find(MGMT_OP_SET_POWERED, hdev);
+        if (!cmd)
+                return -ENOENT;
+
+        if (err == -ERFKILL)
+                status = MGMT_STATUS_RFKILLED;
+        else
+                status = MGMT_STATUS_FAILED;
+
+        err = cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_POWERED, status);
+
+        mgmt_pending_remove(cmd);
+
+        return err;
+}
+
 int mgmt_discoverable(struct hci_dev *hdev, u8 discoverable)
 {
         struct cmd_lookup match = { NULL, hdev };
@@ -4042,6 +4178,9 @@ int mgmt_device_found(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
         struct mgmt_ev_device_found *ev = (void *) buf;
         size_t ev_size;
 
+        if (!hci_discovery_active(hdev))
+                return -EPERM;
+
         /* Leave 5 bytes for a potential CoD field */
         if (sizeof(*ev) + eir_len + 5 > sizeof(buf))
                 return -EINVAL;
@@ -4093,43 +4232,6 @@ int mgmt_remote_name(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
                           sizeof(*ev) + eir_len, NULL);
 }
 
-int mgmt_start_discovery_failed(struct hci_dev *hdev, u8 status)
-{
-        struct pending_cmd *cmd;
-        u8 type;
-        int err;
-
-        hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
-
-        cmd = mgmt_pending_find(MGMT_OP_START_DISCOVERY, hdev);
-        if (!cmd)
-                return -ENOENT;
-
-        type = hdev->discovery.type;
-
-        err = cmd_complete(cmd->sk, hdev->id, cmd->opcode, mgmt_status(status),
-                           &type, sizeof(type));
-        mgmt_pending_remove(cmd);
-
-        return err;
-}
-
-int mgmt_stop_discovery_failed(struct hci_dev *hdev, u8 status)
-{
-        struct pending_cmd *cmd;
-        int err;
-
-        cmd = mgmt_pending_find(MGMT_OP_STOP_DISCOVERY, hdev);
-        if (!cmd)
-                return -ENOENT;
-
-        err = cmd_complete(cmd->sk, hdev->id, cmd->opcode, mgmt_status(status),
-                           &hdev->discovery.type, sizeof(hdev->discovery.type));
-        mgmt_pending_remove(cmd);
-
-        return err;
-}
-
 int mgmt_discovering(struct hci_dev *hdev, u8 discovering)
 {
         struct mgmt_ev_discovering ev;
diff --git a/net/bluetooth/rfcomm/tty.c b/net/bluetooth/rfcomm/tty.c
index b6e44ad6cca6..84fcf9fff3ea 100644
--- a/net/bluetooth/rfcomm/tty.c
+++ b/net/bluetooth/rfcomm/tty.c
@@ -58,7 +58,6 @@ struct rfcomm_dev {
         uint                    modem_status;
 
         struct rfcomm_dlc       *dlc;
-        wait_queue_head_t       wait;
 
         struct device           *tty_dev;
 
@@ -76,13 +75,6 @@ static void rfcomm_dev_modem_status(struct rfcomm_dlc *dlc, u8 v24_sig);
 
 /* ---- Device functions ---- */
 
-/*
- * The reason this isn't actually a race, as you no doubt have a little voice
- * screaming at you in your head, is that the refcount should never actually
- * reach zero unless the device has already been taken off the list, in
- * rfcomm_dev_del(). And if that's not true, we'll hit the BUG() in
- * rfcomm_dev_destruct() anyway.
- */
 static void rfcomm_dev_destruct(struct tty_port *port)
 {
         struct rfcomm_dev *dev = container_of(port, struct rfcomm_dev, port);
@@ -90,10 +82,9 @@ static void rfcomm_dev_destruct(struct tty_port *port)
 
         BT_DBG("dev %p dlc %p", dev, dlc);
 
-        /* Refcount should only hit zero when called from rfcomm_dev_del()
-           which will have taken us off the list. Everything else are
-           refcounting bugs. */
-        BUG_ON(!list_empty(&dev->list));
+        spin_lock(&rfcomm_dev_lock);
+        list_del(&dev->list);
+        spin_unlock(&rfcomm_dev_lock);
 
         rfcomm_dlc_lock(dlc);
         /* Detach DLC if it's owned by this dev */
@@ -112,8 +103,39 @@ static void rfcomm_dev_destruct(struct tty_port *port)
         module_put(THIS_MODULE);
 }
 
+/* device-specific initialization: open the dlc */
+static int rfcomm_dev_activate(struct tty_port *port, struct tty_struct *tty)
+{
+        struct rfcomm_dev *dev = container_of(port, struct rfcomm_dev, port);
+
+        return rfcomm_dlc_open(dev->dlc, &dev->src, &dev->dst, dev->channel);
+}
+
+/* we block the open until the dlc->state becomes BT_CONNECTED */
+static int rfcomm_dev_carrier_raised(struct tty_port *port)
+{
+        struct rfcomm_dev *dev = container_of(port, struct rfcomm_dev, port);
+
+        return (dev->dlc->state == BT_CONNECTED);
+}
+
+/* device-specific cleanup: close the dlc */
+static void rfcomm_dev_shutdown(struct tty_port *port)
+{
+        struct rfcomm_dev *dev = container_of(port, struct rfcomm_dev, port);
+
+        if (dev->tty_dev->parent)
+                device_move(dev->tty_dev, NULL, DPM_ORDER_DEV_LAST);
+
+        /* close the dlc */
+        rfcomm_dlc_close(dev->dlc, 0);
+}
+
 static const struct tty_port_operations rfcomm_port_ops = {
         .destruct = rfcomm_dev_destruct,
+        .activate = rfcomm_dev_activate,
+        .shutdown = rfcomm_dev_shutdown,
+        .carrier_raised = rfcomm_dev_carrier_raised,
 };
 
 static struct rfcomm_dev *__rfcomm_dev_get(int id)
@@ -236,7 +258,6 @@ static int rfcomm_dev_add(struct rfcomm_dev_req *req, struct rfcomm_dlc *dlc)
 
         tty_port_init(&dev->port);
         dev->port.ops = &rfcomm_port_ops;
-        init_waitqueue_head(&dev->wait);
 
         skb_queue_head_init(&dev->pending);
 
@@ -282,7 +303,9 @@ out:
                         dev->id, NULL);
         if (IS_ERR(dev->tty_dev)) {
                 err = PTR_ERR(dev->tty_dev);
+                spin_lock(&rfcomm_dev_lock);
                 list_del(&dev->list);
+                spin_unlock(&rfcomm_dev_lock);
                 goto free;
         }
 
@@ -301,27 +324,6 @@ free:
         return err;
 }
 
-static void rfcomm_dev_del(struct rfcomm_dev *dev)
-{
-        unsigned long flags;
-        BT_DBG("dev %p", dev);
-
-        BUG_ON(test_and_set_bit(RFCOMM_TTY_RELEASED, &dev->flags));
-
-        spin_lock_irqsave(&dev->port.lock, flags);
-        if (dev->port.count > 0) {
-                spin_unlock_irqrestore(&dev->port.lock, flags);
-                return;
-        }
-        spin_unlock_irqrestore(&dev->port.lock, flags);
-
-        spin_lock(&rfcomm_dev_lock);
-        list_del_init(&dev->list);
-        spin_unlock(&rfcomm_dev_lock);
-
-        tty_port_put(&dev->port);
-}
-
 /* ---- Send buffer ---- */
 static inline unsigned int rfcomm_room(struct rfcomm_dlc *dlc)
 {
@@ -333,10 +335,9 @@ static inline unsigned int rfcomm_room(struct rfcomm_dlc *dlc)
 static void rfcomm_wfree(struct sk_buff *skb)
 {
         struct rfcomm_dev *dev = (void *) skb->sk;
-        struct tty_struct *tty = dev->port.tty;
         atomic_sub(skb->truesize, &dev->wmem_alloc);
-        if (test_bit(RFCOMM_TTY_ATTACHED, &dev->flags) && tty)
-                tty_wakeup(tty);
+        if (test_bit(RFCOMM_TTY_ATTACHED, &dev->flags))
+                tty_port_tty_wakeup(&dev->port);
         tty_port_put(&dev->port);
 }
 
@@ -410,6 +411,7 @@ static int rfcomm_release_dev(void __user *arg)
 {
         struct rfcomm_dev_req req;
         struct rfcomm_dev *dev;
+        struct tty_struct *tty;
 
         if (copy_from_user(&req, arg, sizeof(req)))
                 return -EFAULT;
@@ -429,11 +431,15 @@ static int rfcomm_release_dev(void __user *arg)
                 rfcomm_dlc_close(dev->dlc, 0);
 
         /* Shut down TTY synchronously before freeing rfcomm_dev */
-        if (dev->port.tty)
-                tty_vhangup(dev->port.tty);
+        tty = tty_port_tty_get(&dev->port);
+        if (tty) {
+                tty_vhangup(tty);
+                tty_kref_put(tty);
+        }
+
+        if (!test_and_set_bit(RFCOMM_TTY_RELEASED, &dev->flags))
+                tty_port_put(&dev->port);
 
-        if (!test_bit(RFCOMM_RELEASE_ONHUP, &dev->flags))
-                rfcomm_dev_del(dev);
         tty_port_put(&dev->port);
         return 0;
 }
@@ -569,31 +575,13 @@ static void rfcomm_dev_state_change(struct rfcomm_dlc *dlc, int err)
         BT_DBG("dlc %p dev %p err %d", dlc, dev, err);
 
         dev->err = err;
-        wake_up_interruptible(&dev->wait);
-
-        if (dlc->state == BT_CLOSED) {
-                if (!dev->port.tty) {
-                        if (test_bit(RFCOMM_RELEASE_ONHUP, &dev->flags)) {
-                                /* Drop DLC lock here to avoid deadlock
-                                 * 1. rfcomm_dev_get will take rfcomm_dev_lock
-                                 *    but in rfcomm_dev_add there's lock order:
-                                 *    rfcomm_dev_lock -> dlc lock
-                                 * 2. tty_port_put will deadlock if it's
-                                 *    the last reference
-                                 */
-                                rfcomm_dlc_unlock(dlc);
-                                if (rfcomm_dev_get(dev->id) == NULL) {
-                                        rfcomm_dlc_lock(dlc);
-                                        return;
-                                }
-
-                                rfcomm_dev_del(dev);
-                                tty_port_put(&dev->port);
-                                rfcomm_dlc_lock(dlc);
-                        }
-                } else
-                        tty_hangup(dev->port.tty);
-        }
+        if (dlc->state == BT_CONNECTED) {
+                device_move(dev->tty_dev, rfcomm_get_device(dev),
+                            DPM_ORDER_DEV_AFTER_PARENT);
+
+                wake_up_interruptible(&dev->port.open_wait);
+        } else if (dlc->state == BT_CLOSED)
+                tty_port_tty_hangup(&dev->port, false);
 }
 
 static void rfcomm_dev_modem_status(struct rfcomm_dlc *dlc, u8 v24_sig)
@@ -604,10 +592,8 @@ static void rfcomm_dev_modem_status(struct rfcomm_dlc *dlc, u8 v24_sig)
 
         BT_DBG("dlc %p dev %p v24_sig 0x%02x", dlc, dev, v24_sig);
 
-        if ((dev->modem_status & TIOCM_CD) && !(v24_sig & RFCOMM_V24_DV)) {
-                if (dev->port.tty && !C_CLOCAL(dev->port.tty))
-                        tty_hangup(dev->port.tty);
-        }
+        if ((dev->modem_status & TIOCM_CD) && !(v24_sig & RFCOMM_V24_DV))
+                tty_port_tty_hangup(&dev->port, true);
 
         dev->modem_status =
                 ((v24_sig & RFCOMM_V24_RTC) ? (TIOCM_DSR | TIOCM_DTR) : 0) |
@@ -638,124 +624,92 @@ static void rfcomm_tty_copy_pending(struct rfcomm_dev *dev)
                 tty_flip_buffer_push(&dev->port);
 }
 
-static int rfcomm_tty_open(struct tty_struct *tty, struct file *filp)
+/* do the reverse of install, clearing the tty fields and releasing the
+ * reference to tty_port
+ */
+static void rfcomm_tty_cleanup(struct tty_struct *tty)
 {
-        DECLARE_WAITQUEUE(wait, current);
-        struct rfcomm_dev *dev;
-        struct rfcomm_dlc *dlc;
-        unsigned long flags;
-        int err, id;
+        struct rfcomm_dev *dev = tty->driver_data;
 
-        id = tty->index;
+        clear_bit(RFCOMM_TTY_ATTACHED, &dev->flags);
 
-        BT_DBG("tty %p id %d", tty, id);
+        rfcomm_dlc_lock(dev->dlc);
+        tty->driver_data = NULL;
+        rfcomm_dlc_unlock(dev->dlc);
 
-        /* We don't leak this refcount. For reasons which are not entirely
-           clear, the TTY layer will call our ->close() method even if the
-           open fails. We decrease the refcount there, and decreasing it
-           here too would cause breakage. */
-        dev = rfcomm_dev_get(id);
-        if (!dev)
-                return -ENODEV;
+        /*
+         * purge the dlc->tx_queue to avoid circular dependencies
+         * between dev and dlc
+         */
+        skb_queue_purge(&dev->dlc->tx_queue);
 
-        BT_DBG("dev %p dst %pMR channel %d opened %d", dev, &dev->dst,
-               dev->channel, dev->port.count);
+        tty_port_put(&dev->port);
+}
 
-        spin_lock_irqsave(&dev->port.lock, flags);
-        if (++dev->port.count > 1) {
-                spin_unlock_irqrestore(&dev->port.lock, flags);
-                return 0;
-        }
-        spin_unlock_irqrestore(&dev->port.lock, flags);
+/* we acquire the tty_port reference since it's here the tty is first used
+ * by setting the termios. We also populate the driver_data field and install
+ * the tty port
+ */
+static int rfcomm_tty_install(struct tty_driver *driver, struct tty_struct *tty)
+{
+        struct rfcomm_dev *dev;
+        struct rfcomm_dlc *dlc;
+        int err;
+
+        dev = rfcomm_dev_get(tty->index);
+        if (!dev)
+                return -ENODEV;
 
         dlc = dev->dlc;
 
         /* Attach TTY and open DLC */
-
         rfcomm_dlc_lock(dlc);
         tty->driver_data = dev;
-        dev->port.tty = tty;
         rfcomm_dlc_unlock(dlc);
         set_bit(RFCOMM_TTY_ATTACHED, &dev->flags);
 
-        err = rfcomm_dlc_open(dlc, &dev->src, &dev->dst, dev->channel);
-        if (err < 0)
-                return err;
-
-        /* Wait for DLC to connect */
-        add_wait_queue(&dev->wait, &wait);
-        while (1) {
-                set_current_state(TASK_INTERRUPTIBLE);
+        /* install the tty_port */
+        err = tty_port_install(&dev->port, driver, tty);
+        if (err)
+                rfcomm_tty_cleanup(tty);
 
-                if (dlc->state == BT_CLOSED) {
-                        err = -dev->err;
-                        break;
-                }
+        return err;
+}
 
-                if (dlc->state == BT_CONNECTED)
-                        break;
+static int rfcomm_tty_open(struct tty_struct *tty, struct file *filp)
+{
+        struct rfcomm_dev *dev = tty->driver_data;
+        int err;
 
-                if (signal_pending(current)) {
-                        err = -EINTR;
-                        break;
-                }
+        BT_DBG("tty %p id %d", tty, tty->index);
 
-                tty_unlock(tty);
-                schedule();
-                tty_lock(tty);
-        }
-        set_current_state(TASK_RUNNING);
-        remove_wait_queue(&dev->wait, &wait);
+        BT_DBG("dev %p dst %pMR channel %d opened %d", dev, &dev->dst,
+               dev->channel, dev->port.count);
 
-        if (err == 0)
-                device_move(dev->tty_dev, rfcomm_get_device(dev),
-                            DPM_ORDER_DEV_AFTER_PARENT);
+        err = tty_port_open(&dev->port, tty, filp);
+        if (err)
+                return err;
 
+        /*
+         * FIXME: rfcomm should use proper flow control for
+         * received data. This hack will be unnecessary and can
+         * be removed when that's implemented
+         */
         rfcomm_tty_copy_pending(dev);
 
         rfcomm_dlc_unthrottle(dev->dlc);
 
-        return err;
+        return 0;
 }
 
 static void rfcomm_tty_close(struct tty_struct *tty, struct file *filp)
 {
         struct rfcomm_dev *dev = (struct rfcomm_dev *) tty->driver_data;
-        unsigned long flags;
-
-        if (!dev)
-                return;
 
         BT_DBG("tty %p dev %p dlc %p opened %d", tty, dev, dev->dlc,
                                                 dev->port.count);
 
-        spin_lock_irqsave(&dev->port.lock, flags);
-        if (!--dev->port.count) {
-                spin_unlock_irqrestore(&dev->port.lock, flags);
-                if (dev->tty_dev->parent)
-                        device_move(dev->tty_dev, NULL, DPM_ORDER_DEV_LAST);
-
-                /* Close DLC and dettach TTY */
-                rfcomm_dlc_close(dev->dlc, 0);
-
-                clear_bit(RFCOMM_TTY_ATTACHED, &dev->flags);
-
-                rfcomm_dlc_lock(dev->dlc);
-                tty->driver_data = NULL;
-                dev->port.tty = NULL;
-                rfcomm_dlc_unlock(dev->dlc);
-
-                if (test_bit(RFCOMM_TTY_RELEASED, &dev->flags)) {
-                        spin_lock(&rfcomm_dev_lock);
-                        list_del_init(&dev->list);
-                        spin_unlock(&rfcomm_dev_lock);
-
-                        tty_port_put(&dev->port);
-                }
-        } else
-                spin_unlock_irqrestore(&dev->port.lock, flags);
-
-        tty_port_put(&dev->port);
+        tty_port_close(&dev->port, tty, filp);
 }
 
 static int rfcomm_tty_write(struct tty_struct *tty, const unsigned char *buf, int count)
@@ -1055,17 +1009,11 @@ static void rfcomm_tty_hangup(struct tty_struct *tty)
 
         BT_DBG("tty %p dev %p", tty, dev);
 
-        if (!dev)
-                return;
-
-        rfcomm_tty_flush_buffer(tty);
+        tty_port_hangup(&dev->port);
 
-        if (test_bit(RFCOMM_RELEASE_ONHUP, &dev->flags)) {
-                if (rfcomm_dev_get(dev->id) == NULL)
-                        return;
-                rfcomm_dev_del(dev);
+        if (test_bit(RFCOMM_RELEASE_ONHUP, &dev->flags) &&
+            !test_and_set_bit(RFCOMM_TTY_RELEASED, &dev->flags))
                 tty_port_put(&dev->port);
-        }
 }
 
 static int rfcomm_tty_tiocmget(struct tty_struct *tty)
@@ -1128,6 +1076,8 @@ static const struct tty_operations rfcomm_ops = {
         .wait_until_sent        = rfcomm_tty_wait_until_sent,
         .tiocmget               = rfcomm_tty_tiocmget,
         .tiocmset               = rfcomm_tty_tiocmset,
+        .install                = rfcomm_tty_install,
+        .cleanup                = rfcomm_tty_cleanup,
 };
 
 int __init rfcomm_init_ttys(void)
@@ -1146,7 +1096,7 @@ int __init rfcomm_init_ttys(void)
         rfcomm_tty_driver->subtype      = SERIAL_TYPE_NORMAL;
         rfcomm_tty_driver->flags        = TTY_DRIVER_REAL_RAW | TTY_DRIVER_DYNAMIC_DEV;
         rfcomm_tty_driver->init_termios = tty_std_termios;
-        rfcomm_tty_driver->init_termios.c_cflag = B9600 | CS8 | CREAD | HUPCL | CLOCAL;
+        rfcomm_tty_driver->init_termios.c_cflag = B9600 | CS8 | CREAD | HUPCL;
         rfcomm_tty_driver->init_termios.c_lflag &= ~ICANON;
         tty_set_operations(rfcomm_tty_driver, &rfcomm_ops);
 
diff --git a/net/bluetooth/sco.c b/net/bluetooth/sco.c
index e7bd4eea575c..96bd388d93a4 100644
--- a/net/bluetooth/sco.c
+++ b/net/bluetooth/sco.c
@@ -176,8 +176,13 @@ static int sco_connect(struct sock *sk)
         else
                 type = SCO_LINK;
 
-        hcon = hci_connect(hdev, type, dst, BDADDR_BREDR, BT_SECURITY_LOW,
-                           HCI_AT_NO_BONDING);
+        if (sco_pi(sk)->setting == BT_VOICE_TRANSPARENT &&
+            (!lmp_transp_capable(hdev) || !lmp_esco_capable(hdev))) {
+                err = -EOPNOTSUPP;
+                goto done;
+        }
+
+        hcon = hci_connect_sco(hdev, type, dst, sco_pi(sk)->setting);
         if (IS_ERR(hcon)) {
                 err = PTR_ERR(hcon);
                 goto done;
@@ -417,6 +422,8 @@ static struct sock *sco_sock_alloc(struct net *net, struct socket *sock, int pro
         sk->sk_protocol = proto;
         sk->sk_state    = BT_OPEN;
 
+        sco_pi(sk)->setting = BT_VOICE_CVSD_16BIT;
+
         setup_timer(&sk->sk_timer, sco_sock_timeout, (unsigned long)sk);
 
         bt_sock_link(&sco_sk_list, sk);
@@ -652,7 +659,7 @@ static int sco_sock_sendmsg(struct kiocb *iocb, struct socket *sock,
         return err;
 }
 
-static void sco_conn_defer_accept(struct hci_conn *conn, int mask)
+static void sco_conn_defer_accept(struct hci_conn *conn, u16 setting)
 {
         struct hci_dev *hdev = conn->hdev;
 
@@ -664,11 +671,7 @@ static void sco_conn_defer_accept(struct hci_conn *conn, int mask)
                 struct hci_cp_accept_conn_req cp;
 
                 bacpy(&cp.bdaddr, &conn->dst);
-
-                if (lmp_rswitch_capable(hdev) && (mask & HCI_LM_MASTER))
-                        cp.role = 0x00; /* Become master */
-                else
-                        cp.role = 0x01; /* Remain slave */
+                cp.role = 0x00; /* Ignored */
 
                 hci_send_cmd(hdev, HCI_OP_ACCEPT_CONN_REQ, sizeof(cp), &cp);
         } else {
@@ -679,9 +682,21 @@ static void sco_conn_defer_accept(struct hci_conn *conn, int mask)
 
                 cp.tx_bandwidth   = __constant_cpu_to_le32(0x00001f40);
                 cp.rx_bandwidth   = __constant_cpu_to_le32(0x00001f40);
-                cp.max_latency    = __constant_cpu_to_le16(0xffff);
-                cp.content_format = cpu_to_le16(hdev->voice_setting);
-                cp.retrans_effort = 0xff;
+                cp.content_format = cpu_to_le16(setting);
+
+                switch (setting & SCO_AIRMODE_MASK) {
+                case SCO_AIRMODE_TRANSP:
+                        if (conn->pkt_type & ESCO_2EV3)
+                                cp.max_latency = __constant_cpu_to_le16(0x0008);
+                        else
+                                cp.max_latency = __constant_cpu_to_le16(0x000D);
+                        cp.retrans_effort = 0x02;
+                        break;
+                case SCO_AIRMODE_CVSD:
+                        cp.max_latency = __constant_cpu_to_le16(0xffff);
+                        cp.retrans_effort = 0xff;
+                        break;
+                }
 
                 hci_send_cmd(hdev, HCI_OP_ACCEPT_SYNC_CONN_REQ,
                              sizeof(cp), &cp);
@@ -698,7 +713,7 @@ static int sco_sock_recvmsg(struct kiocb *iocb, struct socket *sock,
 
         if (sk->sk_state == BT_CONNECT2 &&
             test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags)) {
-                sco_conn_defer_accept(pi->conn->hcon, 0);
+                sco_conn_defer_accept(pi->conn->hcon, pi->setting);
                 sk->sk_state = BT_CONFIG;
                 msg->msg_namelen = 0;
 
@@ -714,7 +729,8 @@ static int sco_sock_recvmsg(struct kiocb *iocb, struct socket *sock,
 static int sco_sock_setsockopt(struct socket *sock, int level, int optname, char __user *optval, unsigned int optlen)
 {
         struct sock *sk = sock->sk;
-        int err = 0;
+        int len, err = 0;
+        struct bt_voice voice;
         u32 opt;
 
         BT_DBG("sk %p", sk);
@@ -740,6 +756,31 @@ static int sco_sock_setsockopt(struct socket *sock, int level, int optname, char
                         clear_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags);
                 break;
 
+        case BT_VOICE:
+                if (sk->sk_state != BT_OPEN && sk->sk_state != BT_BOUND &&
+                    sk->sk_state != BT_CONNECT2) {
+                        err = -EINVAL;
+                        break;
+                }
+
+                voice.setting = sco_pi(sk)->setting;
+
+                len = min_t(unsigned int, sizeof(voice), optlen);
+                if (copy_from_user((char *) &voice, optval, len)) {
+                        err = -EFAULT;
+                        break;
+                }
+
+                /* Explicitly check for these values */
+                if (voice.setting != BT_VOICE_TRANSPARENT &&
+                    voice.setting != BT_VOICE_CVSD_16BIT) {
+                        err = -EINVAL;
+                        break;
+                }
+
+                sco_pi(sk)->setting = voice.setting;
+                break;
+
         default:
                 err = -ENOPROTOOPT;
                 break;
@@ -765,7 +806,9 @@ static int sco_sock_getsockopt_old(struct socket *sock, int optname, char __user
 
         switch (optname) {
         case SCO_OPTIONS:
-                if (sk->sk_state != BT_CONNECTED) {
+                if (sk->sk_state != BT_CONNECTED &&
+                    !(sk->sk_state == BT_CONNECT2 &&
+                      test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags))) {
                         err = -ENOTCONN;
                         break;
                 }
@@ -781,7 +824,9 @@ static int sco_sock_getsockopt_old(struct socket *sock, int optname, char __user
                 break;
 
         case SCO_CONNINFO:
-                if (sk->sk_state != BT_CONNECTED) {
+                if (sk->sk_state != BT_CONNECTED &&
+                    !(sk->sk_state == BT_CONNECT2 &&
+                      test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags))) {
                         err = -ENOTCONN;
                         break;
                 }
@@ -809,6 +854,7 @@ static int sco_sock_getsockopt(struct socket *sock, int level, int optname, char
 {
         struct sock *sk = sock->sk;
         int len, err = 0;
+        struct bt_voice voice;
 
         BT_DBG("sk %p", sk);
 
@@ -834,6 +880,15 @@ static int sco_sock_getsockopt(struct socket *sock, int level, int optname, char
 
                 break;
 
+        case BT_VOICE:
+                voice.setting = sco_pi(sk)->setting;
+
+                len = min_t(unsigned int, len, sizeof(voice));
+                if (copy_to_user(optval, (char *)&voice, len))
+                        err = -EFAULT;
+
+                break;
+
         default:
                 err = -ENOPROTOOPT;
                 break;
diff --git a/net/bluetooth/smp.c b/net/bluetooth/smp.c
index b2296d3857a0..b5562abdd6e0 100644
--- a/net/bluetooth/smp.c
+++ b/net/bluetooth/smp.c
@@ -770,7 +770,7 @@ int smp_conn_security(struct hci_conn *hcon, __u8 sec_level)
 
         BT_DBG("conn %p hcon %p level 0x%2.2x", conn, hcon, sec_level);
 
-        if (!lmp_host_le_capable(hcon->hdev))
+        if (!test_bit(HCI_LE_ENABLED, &hcon->hdev->dev_flags))
                 return 1;
 
         if (sec_level == BT_SECURITY_LOW)
@@ -851,7 +851,7 @@ int smp_sig_channel(struct l2cap_conn *conn, struct sk_buff *skb)
         __u8 reason;
         int err = 0;
 
-        if (!lmp_host_le_capable(conn->hcon->hdev)) {
+        if (!test_bit(HCI_LE_ENABLED, &conn->hcon->hdev->dev_flags)) {
                 err = -ENOTSUPP;
                 reason = SMP_PAIRING_NOTSUPP;
                 goto done;
diff --git a/net/bridge/br_device.c b/net/bridge/br_device.c
index 967312803e41..ca04163635da 100644
--- a/net/bridge/br_device.c
+++ b/net/bridge/br_device.c
@@ -22,6 +22,9 @@
 #include <asm/uaccess.h>
 #include "br_private.h"
 
+#define COMMON_FEATURES (NETIF_F_SG | NETIF_F_FRAGLIST | NETIF_F_HIGHDMA | \
+                         NETIF_F_GSO_MASK | NETIF_F_HW_CSUM)
+
 /* net device transmit always called with BH disabled */
 netdev_tx_t br_dev_xmit(struct sk_buff *skb, struct net_device *dev)
 {
@@ -55,10 +58,10 @@ netdev_tx_t br_dev_xmit(struct sk_buff *skb, struct net_device *dev)
         skb_pull(skb, ETH_HLEN);
 
         if (is_broadcast_ether_addr(dest))
-                br_flood_deliver(br, skb);
+                br_flood_deliver(br, skb, false);
         else if (is_multicast_ether_addr(dest)) {
                 if (unlikely(netpoll_tx_running(dev))) {
-                        br_flood_deliver(br, skb);
+                        br_flood_deliver(br, skb, false);
                         goto out;
                 }
                 if (br_multicast_rcv(br, NULL, skb)) {
@@ -67,14 +70,15 @@ netdev_tx_t br_dev_xmit(struct sk_buff *skb, struct net_device *dev)
                 }
 
                 mdst = br_mdb_get(br, skb, vid);
-                if (mdst || BR_INPUT_SKB_CB_MROUTERS_ONLY(skb))
+                if ((mdst || BR_INPUT_SKB_CB_MROUTERS_ONLY(skb)) &&
+                    br_multicast_querier_exists(br, eth_hdr(skb)))
                         br_multicast_deliver(mdst, skb);
                 else
-                        br_flood_deliver(br, skb);
+                        br_flood_deliver(br, skb, false);
         } else if ((dst = __br_fdb_get(br, dest, vid)) != NULL)
                 br_deliver(dst->dst, skb);
         else
-                br_flood_deliver(br, skb);
+                br_flood_deliver(br, skb, true);
 
 out:
         rcu_read_unlock();
@@ -241,22 +245,22 @@ fail:
 int br_netpoll_enable(struct net_bridge_port *p, gfp_t gfp)
 {
         struct netpoll *np;
-        int err = 0;
+        int err;
+
+        if (!p->br->dev->npinfo)
+                return 0;
 
         np = kzalloc(sizeof(*p->np), gfp);
-        err = -ENOMEM;
         if (!np)
-                goto out;
+                return -ENOMEM;
 
         err = __netpoll_setup(np, p->dev, gfp);
         if (err) {
                 kfree(np);
-                goto out;
+                return err;
         }
 
         p->np = np;
-
-out:
         return err;
 }
 
@@ -346,12 +350,10 @@ void br_dev_setup(struct net_device *dev)
         dev->tx_queue_len = 0;
         dev->priv_flags = IFF_EBRIDGE;
 
-        dev->features = NETIF_F_SG | NETIF_F_FRAGLIST | NETIF_F_HIGHDMA |
-                        NETIF_F_GSO_MASK | NETIF_F_HW_CSUM | NETIF_F_LLTX |
-                        NETIF_F_NETNS_LOCAL | NETIF_F_HW_VLAN_CTAG_TX;
-        dev->hw_features = NETIF_F_SG | NETIF_F_FRAGLIST | NETIF_F_HIGHDMA |
-                           NETIF_F_GSO_MASK | NETIF_F_HW_CSUM |
-                           NETIF_F_HW_VLAN_CTAG_TX;
+        dev->features = COMMON_FEATURES | NETIF_F_LLTX | NETIF_F_NETNS_LOCAL |
+                        NETIF_F_HW_VLAN_CTAG_TX;
+        dev->hw_features = COMMON_FEATURES | NETIF_F_HW_VLAN_CTAG_TX;
+        dev->vlan_features = COMMON_FEATURES;
 
         br->dev = dev;
         spin_lock_init(&br->lock);
diff --git a/net/bridge/br_fdb.c b/net/bridge/br_fdb.c
index ebfa4443c69b..ffd5874f2592 100644
--- a/net/bridge/br_fdb.c
+++ b/net/bridge/br_fdb.c
@@ -161,7 +161,7 @@ void br_fdb_change_mac_address(struct net_bridge *br, const u8 *newaddr)
         if (!pv)
                 return;
 
-        for_each_set_bit_from(vid, pv->vlan_bitmap, BR_VLAN_BITMAP_LEN) {
+        for_each_set_bit_from(vid, pv->vlan_bitmap, VLAN_N_VID) {
                 f = __br_fdb_get(br, br->dev->dev_addr, vid);
                 if (f && f->is_local && !f->dst)
                         fdb_delete(br, f);
@@ -707,6 +707,11 @@ int br_fdb_add(struct ndmsg *ndm, struct nlattr *tb[],
                 }
         }
 
+        if (is_zero_ether_addr(addr)) {
+                pr_info("bridge: RTM_NEWNEIGH with invalid ether address\n");
+                return -EINVAL;
+        }
+
         p = br_port_get_rtnl(dev);
         if (p == NULL) {
                 pr_info("bridge: RTM_NEWNEIGH %s not a bridge port\n",
@@ -725,7 +730,7 @@ int br_fdb_add(struct ndmsg *ndm, struct nlattr *tb[],
                 /* VID was specified, so use it. */
                 err = __br_fdb_add(ndm, p, addr, nlh_flags, vid);
         } else {
-                if (!pv || bitmap_empty(pv->vlan_bitmap, BR_VLAN_BITMAP_LEN)) {
+                if (!pv || bitmap_empty(pv->vlan_bitmap, VLAN_N_VID)) {
                         err = __br_fdb_add(ndm, p, addr, nlh_flags, 0);
                         goto out;
                 }
@@ -734,7 +739,7 @@ int br_fdb_add(struct ndmsg *ndm, struct nlattr *tb[],
                  * specify a VLAN.  To be nice, add/update entry for every
                  * vlan on this port.
                  */
-                for_each_set_bit(vid, pv->vlan_bitmap, BR_VLAN_BITMAP_LEN) {
+                for_each_set_bit(vid, pv->vlan_bitmap, VLAN_N_VID) {
                         err = __br_fdb_add(ndm, p, addr, nlh_flags, vid);
                         if (err)
                                 goto out;
@@ -812,7 +817,7 @@ int br_fdb_delete(struct ndmsg *ndm, struct nlattr *tb[],
 
                 err = __br_fdb_delete(p, addr, vid);
         } else {
-                if (!pv || bitmap_empty(pv->vlan_bitmap, BR_VLAN_BITMAP_LEN)) {
+                if (!pv || bitmap_empty(pv->vlan_bitmap, VLAN_N_VID)) {
                         err = __br_fdb_delete(p, addr, 0);
                         goto out;
                 }
@@ -822,7 +827,7 @@ int br_fdb_delete(struct ndmsg *ndm, struct nlattr *tb[],
                  * vlan on this port.
                  */
                 err = -ENOENT;
-                for_each_set_bit(vid, pv->vlan_bitmap, BR_VLAN_BITMAP_LEN) {
+                for_each_set_bit(vid, pv->vlan_bitmap, VLAN_N_VID) {
                         err &= __br_fdb_delete(p, addr, vid);
                 }
         }
diff --git a/net/bridge/br_forward.c b/net/bridge/br_forward.c
index 092b20e4ee4c..4b81b1471789 100644
--- a/net/bridge/br_forward.c
+++ b/net/bridge/br_forward.c
@@ -174,7 +174,8 @@ out:
 static void br_flood(struct net_bridge *br, struct sk_buff *skb,
                      struct sk_buff *skb0,
                      void (*__packet_hook)(const struct net_bridge_port *p,
-                                           struct sk_buff *skb))
+                                           struct sk_buff *skb),
+                     bool unicast)
 {
         struct net_bridge_port *p;
         struct net_bridge_port *prev;
@@ -182,6 +183,9 @@ static void br_flood(struct net_bridge *br, struct sk_buff *skb,
         prev = NULL;
 
         list_for_each_entry_rcu(p, &br->port_list, list) {
+                /* Do not flood unicast traffic to ports that turn it off */
+                if (unicast && !(p->flags & BR_FLOOD))
+                        continue;
                 prev = maybe_deliver(prev, p, skb, __packet_hook);
                 if (IS_ERR(prev))
                         goto out;
@@ -203,16 +207,16 @@ out:
 
 
 /* called with rcu_read_lock */
-void br_flood_deliver(struct net_bridge *br, struct sk_buff *skb)
+void br_flood_deliver(struct net_bridge *br, struct sk_buff *skb, bool unicast)
 {
-        br_flood(br, skb, NULL, __br_deliver);
+        br_flood(br, skb, NULL, __br_deliver, unicast);
 }
 
 /* called under bridge lock */
 void br_flood_forward(struct net_bridge *br, struct sk_buff *skb,
-                      struct sk_buff *skb2)
+                      struct sk_buff *skb2, bool unicast)
 {
-        br_flood(br, skb, skb2, __br_forward);
+        br_flood(br, skb, skb2, __br_forward, unicast);
 }
 
 #ifdef CONFIG_BRIDGE_IGMP_SNOOPING
diff --git a/net/bridge/br_if.c b/net/bridge/br_if.c
index 4cdba60926ff..c41d5fbb91d0 100644
--- a/net/bridge/br_if.c
+++ b/net/bridge/br_if.c
@@ -221,7 +221,7 @@ static struct net_bridge_port *new_nbp(struct net_bridge *br,
         p->path_cost = port_cost(dev);
         p->priority = 0x8000 >> BR_PORT_BITS;
         p->port_no = index;
-        p->flags = 0;
+        p->flags = BR_LEARNING | BR_FLOOD;
         br_init_port(p);
         p->state = BR_STATE_DISABLED;
         br_stp_port_timer_init(p);
@@ -363,7 +363,8 @@ int br_add_if(struct net_bridge *br, struct net_device *dev)
         if (err)
                 goto err2;
 
-        if (br_netpoll_info(br) && ((err = br_netpoll_enable(p, GFP_KERNEL))))
+        err = br_netpoll_enable(p, GFP_KERNEL);
+        if (err)
                 goto err3;
 
         err = netdev_master_upper_dev_link(dev, br->dev);
@@ -382,6 +383,9 @@ int br_add_if(struct net_bridge *br, struct net_device *dev)
 
         netdev_update_features(br->dev);
 
+        if (br->dev->needed_headroom < dev->needed_headroom)
+                br->dev->needed_headroom = dev->needed_headroom;
+
         spin_lock_bh(&br->lock);
         changed_addr = br_stp_recalculate_bridge_id(br);
 
diff --git a/net/bridge/br_input.c b/net/bridge/br_input.c
index 828e2bcc1f52..a2fd37ec35f7 100644
--- a/net/bridge/br_input.c
+++ b/net/bridge/br_input.c
@@ -65,6 +65,7 @@ int br_handle_frame_finish(struct sk_buff *skb)
         struct net_bridge_fdb_entry *dst;
         struct net_bridge_mdb_entry *mdst;
         struct sk_buff *skb2;
+        bool unicast = true;
         u16 vid = 0;
 
         if (!p || p->state == BR_STATE_DISABLED)
@@ -75,7 +76,8 @@ int br_handle_frame_finish(struct sk_buff *skb)
 
         /* insert into forwarding database after filtering to avoid spoofing */
         br = p->br;
-        br_fdb_update(br, p, eth_hdr(skb)->h_source, vid);
+        if (p->flags & BR_LEARNING)
+                br_fdb_update(br, p, eth_hdr(skb)->h_source, vid);
 
         if (!is_broadcast_ether_addr(dest) && is_multicast_ether_addr(dest) &&
             br_multicast_rcv(br, p, skb))
@@ -94,11 +96,13 @@ int br_handle_frame_finish(struct sk_buff *skb)
 
         dst = NULL;
 
-        if (is_broadcast_ether_addr(dest))
+        if (is_broadcast_ether_addr(dest)) {
                 skb2 = skb;
-        else if (is_multicast_ether_addr(dest)) {
+                unicast = false;
+        } else if (is_multicast_ether_addr(dest)) {
                 mdst = br_mdb_get(br, skb, vid);
-                if (mdst || BR_INPUT_SKB_CB_MROUTERS_ONLY(skb)) {
+                if ((mdst || BR_INPUT_SKB_CB_MROUTERS_ONLY(skb)) &&
+                    br_multicast_querier_exists(br, eth_hdr(skb))) {
                         if ((mdst && mdst->mglist) ||
                             br_multicast_is_router(br))
                                 skb2 = skb;
@@ -109,6 +113,7 @@ int br_handle_frame_finish(struct sk_buff *skb)
                 } else
                         skb2 = skb;
 
+                unicast = false;
                 br->dev->stats.multicast++;
         } else if ((dst = __br_fdb_get(br, dest, vid)) &&
                         dst->is_local) {
@@ -122,7 +127,7 @@ int br_handle_frame_finish(struct sk_buff *skb)
                         dst->used = jiffies;
                         br_forward(dst->dst, skb, skb2);
                 } else
-                        br_flood_forward(br, skb, skb2);
+                        br_flood_forward(br, skb, skb2, unicast);
         }
 
         if (skb2)
@@ -142,7 +147,8 @@ static int br_handle_local_finish(struct sk_buff *skb)
         u16 vid = 0;
 
         br_vlan_get_tag(skb, &vid);
-        br_fdb_update(p->br, p, eth_hdr(skb)->h_source, vid);
+        if (p->flags & BR_LEARNING)
+                br_fdb_update(p->br, p, eth_hdr(skb)->h_source, vid);
         return 0;        /* process further */
 }
 
diff --git a/net/bridge/br_mdb.c b/net/bridge/br_mdb.c
index 19942e38fd2d..85a09bb5ca51 100644
--- a/net/bridge/br_mdb.c
+++ b/net/bridge/br_mdb.c
@@ -9,6 +9,7 @@
 #include <net/netlink.h>
 #if IS_ENABLED(CONFIG_IPV6)
 #include <net/ipv6.h>
+#include <net/addrconf.h>
 #endif
 
 #include "br_private.h"
@@ -61,7 +62,8 @@ static int br_mdb_fill_info(struct sk_buff *skb, struct netlink_callback *cb,
 
         for (i = 0; i < mdb->max; i++) {
                 struct net_bridge_mdb_entry *mp;
-                struct net_bridge_port_group *p, **pp;
+                struct net_bridge_port_group *p;
+                struct net_bridge_port_group __rcu **pp;
                 struct net_bridge_port *port;
 
                 hlist_for_each_entry_rcu(mp, &mdb->mhash[i], hlist[mdb->ver]) {
@@ -253,7 +255,7 @@ static bool is_valid_mdb_entry(struct br_mdb_entry *entry)
                         return false;
 #if IS_ENABLED(CONFIG_IPV6)
         } else if (entry->addr.proto == htons(ETH_P_IPV6)) {
-                if (!ipv6_is_transient_multicast(&entry->addr.u.ip6))
+                if (ipv6_addr_is_ll_all_nodes(&entry->addr.u.ip6))
                         return false;
 #endif
         } else
@@ -414,16 +416,20 @@ static int __br_mdb_del(struct net_bridge *br, struct br_mdb_entry *entry)
         if (!netif_running(br->dev) || br->multicast_disabled)
                 return -EINVAL;
 
-        if (timer_pending(&br->multicast_querier_timer))
-                return -EBUSY;
-
         ip.proto = entry->addr.proto;
-        if (ip.proto == htons(ETH_P_IP))
+        if (ip.proto == htons(ETH_P_IP)) {
+                if (timer_pending(&br->ip4_querier.timer))
+                        return -EBUSY;
+
                 ip.u.ip4 = entry->addr.u.ip4;
 #if IS_ENABLED(CONFIG_IPV6)
-        else
+        } else {
+                if (timer_pending(&br->ip6_querier.timer))
+                        return -EBUSY;
+
                 ip.u.ip6 = entry->addr.u.ip6;
 #endif
+        }
 
         spin_lock_bh(&br->multicast_lock);
         mdb = mlock_dereference(br->mdb, br);
@@ -447,7 +453,7 @@ static int __br_mdb_del(struct net_bridge *br, struct br_mdb_entry *entry)
                 call_rcu_bh(&p->rcu, br_multicast_free_pg);
                 err = 0;
 
-                if (!mp->ports && !mp->mglist &&
+                if (!mp->ports && !mp->mglist && mp->timer_armed &&
                     netif_running(br->dev))
                         mod_timer(&mp->timer, jiffies);
                 break;
diff --git a/net/bridge/br_multicast.c b/net/bridge/br_multicast.c
index 81f2389f78eb..d1c578630678 100644
--- a/net/bridge/br_multicast.c
+++ b/net/bridge/br_multicast.c
@@ -23,16 +23,19 @@
 #include <linux/skbuff.h>
 #include <linux/slab.h>
 #include <linux/timer.h>
+#include <linux/inetdevice.h>
 #include <net/ip.h>
 #if IS_ENABLED(CONFIG_IPV6)
 #include <net/ipv6.h>
 #include <net/mld.h>
 #include <net/ip6_checksum.h>
+#include <net/addrconf.h>
 #endif
 
 #include "br_private.h"
 
-static void br_multicast_start_querier(struct net_bridge *br);
+static void br_multicast_start_querier(struct net_bridge *br,
+                                       struct bridge_mcast_query *query);
 unsigned int br_mdb_rehash_seq;
 
 static inline int br_ip_equal(const struct br_ip *a, const struct br_ip *b)
@@ -269,7 +272,7 @@ static void br_multicast_del_pg(struct net_bridge *br,
                 del_timer(&p->timer);
                 call_rcu_bh(&p->rcu, br_multicast_free_pg);
 
-                if (!mp->ports && !mp->mglist &&
+                if (!mp->ports && !mp->mglist && mp->timer_armed &&
                     netif_running(br->dev))
                         mod_timer(&mp->timer, jiffies);
 
@@ -381,7 +384,8 @@ static struct sk_buff *br_ip4_multicast_alloc_query(struct net_bridge *br,
         iph->frag_off = htons(IP_DF);
         iph->ttl = 1;
         iph->protocol = IPPROTO_IGMP;
-        iph->saddr = 0;
+        iph->saddr = br->multicast_query_use_ifaddr ?
+                     inet_select_addr(br->dev, 0, RT_SCOPE_LINK) : 0;
         iph->daddr = htonl(INADDR_ALLHOSTS_GROUP);
         ((u8 *)&iph[1])[0] = IPOPT_RA;
         ((u8 *)&iph[1])[1] = 4;
@@ -465,8 +469,9 @@ static struct sk_buff *br_ip6_multicast_alloc_query(struct net_bridge *br,
         skb_set_transport_header(skb, skb->len);
         mldq = (struct mld_msg *) icmp6_hdr(skb);
 
-        interval = ipv6_addr_any(group) ? br->multicast_last_member_interval :
-                                          br->multicast_query_response_interval;
+        interval = ipv6_addr_any(group) ?
+                        br->multicast_query_response_interval :
+                        br->multicast_last_member_interval;
 
         mldq->mld_type = ICMPV6_MGM_QUERY;
         mldq->mld_code = 0;
@@ -615,6 +620,7 @@ rehash:
 
         mp->br = br;
         mp->addr = *group;
+
         setup_timer(&mp->timer, br_multicast_group_expired,
                     (unsigned long)mp);
 
@@ -654,7 +660,6 @@ static int br_multicast_add_group(struct net_bridge *br,
         struct net_bridge_mdb_entry *mp;
         struct net_bridge_port_group *p;
         struct net_bridge_port_group __rcu **pp;
-        unsigned long now = jiffies;
         int err;
 
         spin_lock(&br->multicast_lock);
@@ -669,7 +674,6 @@ static int br_multicast_add_group(struct net_bridge *br,
 
         if (!port) {
                 mp->mglist = true;
-                mod_timer(&mp->timer, now + br->multicast_membership_interval);
                 goto out;
         }
 
@@ -677,7 +681,7 @@ static int br_multicast_add_group(struct net_bridge *br,
              (p = mlock_dereference(*pp, br)) != NULL;
              pp = &p->next) {
                 if (p->port == port)
-                        goto found;
+                        goto out;
                 if ((unsigned long)p->port < (unsigned long)port)
                         break;
         }
@@ -688,8 +692,6 @@ static int br_multicast_add_group(struct net_bridge *br,
         rcu_assign_pointer(*pp, p);
         br_mdb_notify(br->dev, port, group, RTM_NEWMDB);
 
-found:
-        mod_timer(&p->timer, now + br->multicast_membership_interval);
 out:
         err = 0;
 
@@ -723,7 +725,7 @@ static int br_ip6_multicast_add_group(struct net_bridge *br,
 {
         struct br_ip br_group;
 
-        if (!ipv6_is_transient_multicast(group))
+        if (ipv6_addr_is_ll_all_nodes(group))
                 return 0;
 
         br_group.u.ip6 = *group;
@@ -755,20 +757,35 @@ static void br_multicast_local_router_expired(unsigned long data)
 {
 }
 
-static void br_multicast_querier_expired(unsigned long data)
+static void br_multicast_querier_expired(struct net_bridge *br,
+                                         struct bridge_mcast_query *query)
 {
-        struct net_bridge *br = (void *)data;
-
         spin_lock(&br->multicast_lock);
         if (!netif_running(br->dev) || br->multicast_disabled)
                 goto out;
 
-        br_multicast_start_querier(br);
+        br_multicast_start_querier(br, query);
 
 out:
         spin_unlock(&br->multicast_lock);
 }
 
+static void br_ip4_multicast_querier_expired(unsigned long data)
+{
+        struct net_bridge *br = (void *)data;
+
+        br_multicast_querier_expired(br, &br->ip4_query);
+}
+
+#if IS_ENABLED(CONFIG_IPV6)
+static void br_ip6_multicast_querier_expired(unsigned long data)
+{
+        struct net_bridge *br = (void *)data;
+
+        br_multicast_querier_expired(br, &br->ip6_query);
+}
+#endif
+
 static void __br_multicast_send_query(struct net_bridge *br,
                                       struct net_bridge_port *port,
                                       struct br_ip *ip)
@@ -789,37 +806,45 @@ static void __br_multicast_send_query(struct net_bridge *br,
 }
 
 static void br_multicast_send_query(struct net_bridge *br,
-                                    struct net_bridge_port *port, u32 sent)
+                                    struct net_bridge_port *port,
+                                    struct bridge_mcast_query *query)
 {
         unsigned long time;
         struct br_ip br_group;
+        struct bridge_mcast_querier *querier = NULL;
 
         if (!netif_running(br->dev) || br->multicast_disabled ||
-            !br->multicast_querier ||
-            timer_pending(&br->multicast_querier_timer))
+            !br->multicast_querier)
                 return;
 
         memset(&br_group.u, 0, sizeof(br_group.u));
 
-        br_group.proto = htons(ETH_P_IP);
-        __br_multicast_send_query(br, port, &br_group);
-
+        if (port ? (query == &port->ip4_query) :
+                   (query == &br->ip4_query)) {
+                querier = &br->ip4_querier;
+                br_group.proto = htons(ETH_P_IP);
 #if IS_ENABLED(CONFIG_IPV6)
-        br_group.proto = htons(ETH_P_IPV6);
-        __br_multicast_send_query(br, port, &br_group);
+        } else {
+                querier = &br->ip6_querier;
+                br_group.proto = htons(ETH_P_IPV6);
 #endif
+        }
+
+        if (!querier || timer_pending(&querier->timer))
+                return;
+
+        __br_multicast_send_query(br, port, &br_group);
 
         time = jiffies;
-        time += sent < br->multicast_startup_query_count ?
+        time += query->startup_sent < br->multicast_startup_query_count ?
                 br->multicast_startup_query_interval :
                 br->multicast_query_interval;
-        mod_timer(port ? &port->multicast_query_timer :
-                         &br->multicast_query_timer, time);
+        mod_timer(&query->timer, time);
 }
 
-static void br_multicast_port_query_expired(unsigned long data)
+static void br_multicast_port_query_expired(struct net_bridge_port *port,
+                                            struct bridge_mcast_query *query)
 {
-        struct net_bridge_port *port = (void *)data;
         struct net_bridge *br = port->br;
 
         spin_lock(&br->multicast_lock);
@@ -827,25 +852,43 @@ static void br_multicast_port_query_expired(unsigned long data)
             port->state == BR_STATE_BLOCKING)
                 goto out;
 
-        if (port->multicast_startup_queries_sent <
-            br->multicast_startup_query_count)
-                port->multicast_startup_queries_sent++;
+        if (query->startup_sent < br->multicast_startup_query_count)
+                query->startup_sent++;
 
-        br_multicast_send_query(port->br, port,
-                                port->multicast_startup_queries_sent);
+        br_multicast_send_query(port->br, port, query);
 
 out:
         spin_unlock(&br->multicast_lock);
 }
 
+static void br_ip4_multicast_port_query_expired(unsigned long data)
+{
+        struct net_bridge_port *port = (void *)data;
+
+        br_multicast_port_query_expired(port, &port->ip4_query);
+}
+
+#if IS_ENABLED(CONFIG_IPV6)
+static void br_ip6_multicast_port_query_expired(unsigned long data)
+{
+        struct net_bridge_port *port = (void *)data;
+
+        br_multicast_port_query_expired(port, &port->ip6_query);
+}
+#endif
+
 void br_multicast_add_port(struct net_bridge_port *port)
 {
         port->multicast_router = 1;
 
         setup_timer(&port->multicast_router_timer, br_multicast_router_expired,
                     (unsigned long)port);
-        setup_timer(&port->multicast_query_timer,
-                    br_multicast_port_query_expired, (unsigned long)port);
+        setup_timer(&port->ip4_query.timer, br_ip4_multicast_port_query_expired,
+                    (unsigned long)port);
+#if IS_ENABLED(CONFIG_IPV6)
+        setup_timer(&port->ip6_query.timer, br_ip6_multicast_port_query_expired,
+                    (unsigned long)port);
+#endif
 }
 
 void br_multicast_del_port(struct net_bridge_port *port)
@@ -853,13 +896,13 @@ void br_multicast_del_port(struct net_bridge_port *port)
         del_timer_sync(&port->multicast_router_timer);
 }
 
-static void __br_multicast_enable_port(struct net_bridge_port *port)
+static void br_multicast_enable(struct bridge_mcast_query *query)
 {
-        port->multicast_startup_queries_sent = 0;
+        query->startup_sent = 0;
 
-        if (try_to_del_timer_sync(&port->multicast_query_timer) >= 0 ||
-            del_timer(&port->multicast_query_timer))
-                mod_timer(&port->multicast_query_timer, jiffies);
+        if (try_to_del_timer_sync(&query->timer) >= 0 ||
+            del_timer(&query->timer))
+                mod_timer(&query->timer, jiffies);
 }
 
 void br_multicast_enable_port(struct net_bridge_port *port)
@@ -870,7 +913,10 @@ void br_multicast_enable_port(struct net_bridge_port *port)
         if (br->multicast_disabled || !netif_running(br->dev))
                 goto out;
 
-        __br_multicast_enable_port(port);
+        br_multicast_enable(&port->ip4_query);
+#if IS_ENABLED(CONFIG_IPV6)
+        br_multicast_enable(&port->ip6_query);
+#endif
 
 out:
         spin_unlock(&br->multicast_lock);
@@ -889,7 +935,10 @@ void br_multicast_disable_port(struct net_bridge_port *port)
         if (!hlist_unhashed(&port->rlist))
                 hlist_del_init_rcu(&port->rlist);
         del_timer(&port->multicast_router_timer);
-        del_timer(&port->multicast_query_timer);
+        del_timer(&port->ip4_query.timer);
+#if IS_ENABLED(CONFIG_IPV6)
+        del_timer(&port->ip6_query.timer);
+#endif
         spin_unlock(&br->multicast_lock);
 }
 
@@ -1014,8 +1063,19 @@ static int br_ip6_multicast_mld2_report(struct net_bridge *br,
 }
 #endif
 
+static void
+br_multicast_update_querier_timer(struct net_bridge *br,
+                                  struct bridge_mcast_querier *querier,
+                                  unsigned long max_delay)
+{
+        if (!timer_pending(&querier->timer))
+                querier->delay_time = jiffies + max_delay;
+
+        mod_timer(&querier->timer, jiffies + br->multicast_querier_interval);
+}
+
 /*
- * Add port to rotuer_list
+ * Add port to router_list
  *  list is maintained ordered by pointer value
  *  and locked by br->multicast_lock and RCU
  */
@@ -1064,12 +1124,13 @@ timer:
 
 static void br_multicast_query_received(struct net_bridge *br,
                                         struct net_bridge_port *port,
-                                        int saddr)
+                                        struct bridge_mcast_querier *querier,
+                                        int saddr,
+                                        unsigned long max_delay)
 {
         if (saddr)
-                mod_timer(&br->multicast_querier_timer,
-                          jiffies + br->multicast_querier_interval);
-        else if (timer_pending(&br->multicast_querier_timer))
+                br_multicast_update_querier_timer(br, querier, max_delay);
+        else if (timer_pending(&querier->timer))
                 return;
 
         br_multicast_mark_router(br, port);
@@ -1096,8 +1157,6 @@ static int br_ip4_multicast_query(struct net_bridge *br,
             (port && port->state == BR_STATE_DISABLED))
                 goto out;
 
-        br_multicast_query_received(br, port, !!iph->saddr);
-
         group = ih->group;
 
         if (skb->len == sizeof(*ih)) {
@@ -1121,6 +1180,9 @@ static int br_ip4_multicast_query(struct net_bridge *br,
                             IGMPV3_MRC(ih3->code) * (HZ / IGMP_TIMER_SCALE) : 1;
         }
 
+        br_multicast_query_received(br, port, &br->ip4_querier, !!iph->saddr,
+                                    max_delay);
+
         if (!group)
                 goto out;
 
@@ -1129,6 +1191,9 @@ static int br_ip4_multicast_query(struct net_bridge *br,
         if (!mp)
                 goto out;
 
+        mod_timer(&mp->timer, now + br->multicast_membership_interval);
+        mp->timer_armed = true;
+
         max_delay *= br->multicast_last_member_count;
 
         if (mp->mglist &&
@@ -1173,8 +1238,6 @@ static int br_ip6_multicast_query(struct net_bridge *br,
             (port && port->state == BR_STATE_DISABLED))
                 goto out;
 
-        br_multicast_query_received(br, port, !ipv6_addr_any(&ip6h->saddr));
-
         if (skb->len == sizeof(*mld)) {
                 if (!pskb_may_pull(skb, sizeof(*mld))) {
                         err = -EINVAL;
@@ -1184,7 +1247,7 @@ static int br_ip6_multicast_query(struct net_bridge *br,
                 max_delay = msecs_to_jiffies(ntohs(mld->mld_maxdelay));
                 if (max_delay)
                         group = &mld->mld_mca;
-        } else if (skb->len >= sizeof(*mld2q)) {
+        } else {
                 if (!pskb_may_pull(skb, sizeof(*mld2q))) {
                         err = -EINVAL;
                         goto out;
@@ -1192,9 +1255,13 @@ static int br_ip6_multicast_query(struct net_bridge *br,
                 mld2q = (struct mld2_query *)icmp6_hdr(skb);
                 if (!mld2q->mld2q_nsrcs)
                         group = &mld2q->mld2q_mca;
-                max_delay = mld2q->mld2q_mrc ? MLDV2_MRC(ntohs(mld2q->mld2q_mrc)) : 1;
+
+                max_delay = max(msecs_to_jiffies(mldv2_mrc(mld2q)), 1UL);
         }
 
+        br_multicast_query_received(br, port, &br->ip6_querier,
+                                    !ipv6_addr_any(&ip6h->saddr), max_delay);
+
         if (!group)
                 goto out;
 
@@ -1203,6 +1270,9 @@ static int br_ip6_multicast_query(struct net_bridge *br,
         if (!mp)
                 goto out;
 
+        mod_timer(&mp->timer, now + br->multicast_membership_interval);
+        mp->timer_armed = true;
+
         max_delay *= br->multicast_last_member_count;
         if (mp->mglist &&
             (timer_pending(&mp->timer) ?
@@ -1227,7 +1297,9 @@ out:
 
 static void br_multicast_leave_group(struct net_bridge *br,
                                      struct net_bridge_port *port,
-                                     struct br_ip *group)
+                                     struct br_ip *group,
+                                     struct bridge_mcast_querier *querier,
+                                     struct bridge_mcast_query *query)
 {
         struct net_bridge_mdb_htable *mdb;
         struct net_bridge_mdb_entry *mp;
@@ -1238,7 +1310,7 @@ static void br_multicast_leave_group(struct net_bridge *br,
         spin_lock(&br->multicast_lock);
         if (!netif_running(br->dev) ||
             (port && port->state == BR_STATE_DISABLED) ||
-            timer_pending(&br->multicast_querier_timer))
+            timer_pending(&querier->timer))
                 goto out;
 
         mdb = mlock_dereference(br->mdb, br);
@@ -1246,6 +1318,31 @@ static void br_multicast_leave_group(struct net_bridge *br,
         if (!mp)
                 goto out;
 
+        if (br->multicast_querier) {
+                __br_multicast_send_query(br, port, &mp->addr);
+
+                time = jiffies + br->multicast_last_member_count *
+                                 br->multicast_last_member_interval;
+
+                mod_timer(&query->timer, time);
+
+                for (p = mlock_dereference(mp->ports, br);
+                     p != NULL;
+                     p = mlock_dereference(p->next, br)) {
+                        if (p->port != port)
+                                continue;
+
+                        if (!hlist_unhashed(&p->mglist) &&
+                            (timer_pending(&p->timer) ?
+                             time_after(p->timer.expires, time) :
+                             try_to_del_timer_sync(&p->timer) >= 0)) {
+                                mod_timer(&p->timer, time);
+                        }
+
+                        break;
+                }
+        }
+
         if (port && (port->flags & BR_MULTICAST_FAST_LEAVE)) {
                 struct net_bridge_port_group __rcu **pp;
 
@@ -1261,7 +1358,7 @@ static void br_multicast_leave_group(struct net_bridge *br,
                         call_rcu_bh(&p->rcu, br_multicast_free_pg);
                         br_mdb_notify(br->dev, port, group, RTM_DELMDB);
 
-                        if (!mp->ports && !mp->mglist &&
+                        if (!mp->ports && !mp->mglist && mp->timer_armed &&
                             netif_running(br->dev))
                                 mod_timer(&mp->timer, jiffies);
                 }
@@ -1273,32 +1370,13 @@ static void br_multicast_leave_group(struct net_bridge *br,
                      br->multicast_last_member_interval;
 
         if (!port) {
-                if (mp->mglist &&
+                if (mp->mglist && mp->timer_armed &&
                     (timer_pending(&mp->timer) ?
                      time_after(mp->timer.expires, time) :
                      try_to_del_timer_sync(&mp->timer) >= 0)) {
                         mod_timer(&mp->timer, time);
                 }
-
-                goto out;
         }
-
-        for (p = mlock_dereference(mp->ports, br);
-             p != NULL;
-             p = mlock_dereference(p->next, br)) {
-                if (p->port != port)
-                        continue;
-
-                if (!hlist_unhashed(&p->mglist) &&
-                    (timer_pending(&p->timer) ?
-                     time_after(p->timer.expires, time) :
-                     try_to_del_timer_sync(&p->timer) >= 0)) {
-                        mod_timer(&p->timer, time);
-                }
-
-                break;
-        }
-
 out:
         spin_unlock(&br->multicast_lock);
 }
@@ -1309,6 +1387,8 @@ static void br_ip4_multicast_leave_group(struct net_bridge *br,
                                          __u16 vid)
 {
         struct br_ip br_group;
+        struct bridge_mcast_query *query = port ? &port->ip4_query :
+                                                  &br->ip4_query;
 
         if (ipv4_is_local_multicast(group))
                 return;
@@ -1317,7 +1397,7 @@ static void br_ip4_multicast_leave_group(struct net_bridge *br,
         br_group.proto = htons(ETH_P_IP);
         br_group.vid = vid;
 
-        br_multicast_leave_group(br, port, &br_group);
+        br_multicast_leave_group(br, port, &br_group, &br->ip4_querier, query);
 }
 
 #if IS_ENABLED(CONFIG_IPV6)
@@ -1327,15 +1407,18 @@ static void br_ip6_multicast_leave_group(struct net_bridge *br,
                                          __u16 vid)
 {
         struct br_ip br_group;
+        struct bridge_mcast_query *query = port ? &port->ip6_query :
+                                                  &br->ip6_query;
+
 
-        if (!ipv6_is_transient_multicast(group))
+        if (ipv6_addr_is_ll_all_nodes(group))
                 return;
 
         br_group.u.ip6 = *group;
         br_group.proto = htons(ETH_P_IPV6);
         br_group.vid = vid;
 
-        br_multicast_leave_group(br, port, &br_group);
+        br_multicast_leave_group(br, port, &br_group, &br->ip6_querier, query);
 }
 #endif
 
@@ -1465,8 +1548,14 @@ static int br_multicast_ipv6_rcv(struct net_bridge *br,
          *  - MLD has always Router Alert hop-by-hop option
          *  - But we do not support jumbrograms.
          */
-        if (ip6h->version != 6 ||
-            ip6h->nexthdr != IPPROTO_HOPOPTS ||
+        if (ip6h->version != 6)
+                return 0;
+
+        /* Prevent flooding this packet if there is no listener present */
+        if (!ipv6_addr_is_ll_all_nodes(&ip6h->daddr))
+                BR_INPUT_SKB_CB(skb)->mrouters_only = 1;
+
+        if (ip6h->nexthdr != IPPROTO_HOPOPTS ||
             ip6h->payload_len == 0)
                 return 0;
 
@@ -1597,19 +1686,32 @@ int br_multicast_rcv(struct net_bridge *br, struct net_bridge_port *port,
         return 0;
 }
 
-static void br_multicast_query_expired(unsigned long data)
+static void br_multicast_query_expired(struct net_bridge *br,
+                                       struct bridge_mcast_query *query)
+{
+        spin_lock(&br->multicast_lock);
+        if (query->startup_sent < br->multicast_startup_query_count)
+                query->startup_sent++;
+
+        br_multicast_send_query(br, NULL, query);
+        spin_unlock(&br->multicast_lock);
+}
+
+static void br_ip4_multicast_query_expired(unsigned long data)
 {
         struct net_bridge *br = (void *)data;
 
-        spin_lock(&br->multicast_lock);
-        if (br->multicast_startup_queries_sent <
-            br->multicast_startup_query_count)
-                br->multicast_startup_queries_sent++;
+        br_multicast_query_expired(br, &br->ip4_query);
+}
 
-        br_multicast_send_query(br, NULL, br->multicast_startup_queries_sent);
+#if IS_ENABLED(CONFIG_IPV6)
+static void br_ip6_multicast_query_expired(unsigned long data)
+{
+        struct net_bridge *br = (void *)data;
 
-        spin_unlock(&br->multicast_lock);
+        br_multicast_query_expired(br, &br->ip6_query);
 }
+#endif
 
 void br_multicast_init(struct net_bridge *br)
 {
@@ -1618,6 +1720,7 @@ void br_multicast_init(struct net_bridge *br)
 
         br->multicast_router = 1;
         br->multicast_querier = 0;
+        br->multicast_query_use_ifaddr = 0;
         br->multicast_last_member_count = 2;
         br->multicast_startup_query_count = 2;
 
@@ -1628,23 +1731,43 @@ void br_multicast_init(struct net_bridge *br)
         br->multicast_querier_interval = 255 * HZ;
         br->multicast_membership_interval = 260 * HZ;
 
+        br->ip4_querier.delay_time = 0;
+#if IS_ENABLED(CONFIG_IPV6)
+        br->ip6_querier.delay_time = 0;
+#endif
+
         spin_lock_init(&br->multicast_lock);
         setup_timer(&br->multicast_router_timer,
                     br_multicast_local_router_expired, 0);
-        setup_timer(&br->multicast_querier_timer,
-                    br_multicast_querier_expired, (unsigned long)br);
-        setup_timer(&br->multicast_query_timer, br_multicast_query_expired,
+        setup_timer(&br->ip4_querier.timer, br_ip4_multicast_querier_expired,
+                    (unsigned long)br);
+        setup_timer(&br->ip4_query.timer, br_ip4_multicast_query_expired,
+                    (unsigned long)br);
+#if IS_ENABLED(CONFIG_IPV6)
+        setup_timer(&br->ip6_querier.timer, br_ip6_multicast_querier_expired,
+                    (unsigned long)br);
+        setup_timer(&br->ip6_query.timer, br_ip6_multicast_query_expired,
                     (unsigned long)br);
+#endif
 }
 
-void br_multicast_open(struct net_bridge *br)
+static void __br_multicast_open(struct net_bridge *br,
+                                struct bridge_mcast_query *query)
 {
-        br->multicast_startup_queries_sent = 0;
+        query->startup_sent = 0;
 
         if (br->multicast_disabled)
                 return;
 
-        mod_timer(&br->multicast_query_timer, jiffies);
+        mod_timer(&query->timer, jiffies);
+}
+
+void br_multicast_open(struct net_bridge *br)
+{
+        __br_multicast_open(br, &br->ip4_query);
+#if IS_ENABLED(CONFIG_IPV6)
+        __br_multicast_open(br, &br->ip6_query);
+#endif
 }
 
 void br_multicast_stop(struct net_bridge *br)
@@ -1656,8 +1779,12 @@ void br_multicast_stop(struct net_bridge *br)
         int i;
 
         del_timer_sync(&br->multicast_router_timer);
-        del_timer_sync(&br->multicast_querier_timer);
-        del_timer_sync(&br->multicast_query_timer);
+        del_timer_sync(&br->ip4_querier.timer);
+        del_timer_sync(&br->ip4_query.timer);
+#if IS_ENABLED(CONFIG_IPV6)
+        del_timer_sync(&br->ip6_querier.timer);
+        del_timer_sync(&br->ip6_query.timer);
+#endif
 
         spin_lock_bh(&br->multicast_lock);
         mdb = mlock_dereference(br->mdb, br);
@@ -1671,6 +1798,7 @@ void br_multicast_stop(struct net_bridge *br)
                 hlist_for_each_entry_safe(mp, n, &mdb->mhash[i],
                                           hlist[ver]) {
                         del_timer(&mp->timer);
+                        mp->timer_armed = false;
                         call_rcu_bh(&mp->rcu, br_multicast_free_group);
                 }
         }
@@ -1759,18 +1887,24 @@ unlock:
         return err;
 }
 
-static void br_multicast_start_querier(struct net_bridge *br)
+static void br_multicast_start_querier(struct net_bridge *br,
+                                       struct bridge_mcast_query *query)
 {
         struct net_bridge_port *port;
 
-        br_multicast_open(br);
+        __br_multicast_open(br, query);
 
         list_for_each_entry(port, &br->port_list, list) {
                 if (port->state == BR_STATE_DISABLED ||
                     port->state == BR_STATE_BLOCKING)
                         continue;
 
-                __br_multicast_enable_port(port);
+                if (query == &br->ip4_query)
+                        br_multicast_enable(&port->ip4_query);
+#if IS_ENABLED(CONFIG_IPV6)
+                else
+                        br_multicast_enable(&port->ip6_query);
+#endif
         }
 }
 
@@ -1805,7 +1939,10 @@ rollback:
                         goto rollback;
         }
 
-        br_multicast_start_querier(br);
+        br_multicast_start_querier(br, &br->ip4_query);
+#if IS_ENABLED(CONFIG_IPV6)
+        br_multicast_start_querier(br, &br->ip6_query);
+#endif
 
 unlock:
         spin_unlock_bh(&br->multicast_lock);
@@ -1815,6 +1952,8 @@ unlock:
 
 int br_multicast_set_querier(struct net_bridge *br, unsigned long val)
 {
+        unsigned long max_delay;
+
         val = !!val;
 
         spin_lock_bh(&br->multicast_lock);
@@ -1822,8 +1961,22 @@ int br_multicast_set_querier(struct net_bridge *br, unsigned long val)
                 goto unlock;
 
         br->multicast_querier = val;
-        if (val)
-                br_multicast_start_querier(br);
+        if (!val)
+                goto unlock;
+
+        max_delay = br->multicast_query_response_interval;
+
+        if (!timer_pending(&br->ip4_querier.timer))
+                br->ip4_querier.delay_time = jiffies + max_delay;
+
+        br_multicast_start_querier(br, &br->ip4_query);
+
+#if IS_ENABLED(CONFIG_IPV6)
+        if (!timer_pending(&br->ip6_querier.timer))
+                br->ip6_querier.delay_time = jiffies + max_delay;
+
+        br_multicast_start_querier(br, &br->ip6_query);
+#endif
 
 unlock:
         spin_unlock_bh(&br->multicast_lock);
diff --git a/net/bridge/br_netfilter.c b/net/bridge/br_netfilter.c
index 1ed75bfd8d1d..f87736270eaa 100644
--- a/net/bridge/br_netfilter.c
+++ b/net/bridge/br_netfilter.c
@@ -992,7 +992,7 @@ static struct nf_hook_ops br_nf_ops[] __read_mostly = {
 
 #ifdef CONFIG_SYSCTL
 static
-int brnf_sysctl_call_tables(ctl_table * ctl, int write,
+int brnf_sysctl_call_tables(struct ctl_table *ctl, int write,
                             void __user * buffer, size_t * lenp, loff_t * ppos)
 {
         int ret;
@@ -1004,7 +1004,7 @@ int brnf_sysctl_call_tables(ctl_table * ctl, int write,
         return ret;
 }
 
-static ctl_table brnf_table[] = {
+static struct ctl_table brnf_table[] = {
         {
                 .procname       = "bridge-nf-call-arptables",
                 .data           = &brnf_call_arptables,
diff --git a/net/bridge/br_netlink.c b/net/bridge/br_netlink.c
index 8e3abf564798..e74ddc1c29a8 100644
--- a/net/bridge/br_netlink.c
+++ b/net/bridge/br_netlink.c
@@ -30,6 +30,8 @@ static inline size_t br_port_info_size(void)
                 + nla_total_size(1)     /* IFLA_BRPORT_GUARD */
                 + nla_total_size(1)     /* IFLA_BRPORT_PROTECT */
                 + nla_total_size(1)     /* IFLA_BRPORT_FAST_LEAVE */
+                + nla_total_size(1)     /* IFLA_BRPORT_LEARNING */
+                + nla_total_size(1)     /* IFLA_BRPORT_UNICAST_FLOOD */
                 + 0;
 }
 
@@ -56,7 +58,9 @@ static int br_port_fill_attrs(struct sk_buff *skb,
             nla_put_u8(skb, IFLA_BRPORT_MODE, mode) ||
             nla_put_u8(skb, IFLA_BRPORT_GUARD, !!(p->flags & BR_BPDU_GUARD)) ||
             nla_put_u8(skb, IFLA_BRPORT_PROTECT, !!(p->flags & BR_ROOT_BLOCK)) ||
-            nla_put_u8(skb, IFLA_BRPORT_FAST_LEAVE, !!(p->flags & BR_MULTICAST_FAST_LEAVE)))
+            nla_put_u8(skb, IFLA_BRPORT_FAST_LEAVE, !!(p->flags & BR_MULTICAST_FAST_LEAVE)) ||
+            nla_put_u8(skb, IFLA_BRPORT_LEARNING, !!(p->flags & BR_LEARNING)) ||
+            nla_put_u8(skb, IFLA_BRPORT_UNICAST_FLOOD, !!(p->flags & BR_FLOOD)))
                 return -EMSGSIZE;
 
         return 0;
@@ -128,7 +132,7 @@ static int br_fill_ifinfo(struct sk_buff *skb,
                 else
                         pv = br_get_vlan_info(br);
 
-                if (!pv || bitmap_empty(pv->vlan_bitmap, BR_VLAN_BITMAP_LEN))
+                if (!pv || bitmap_empty(pv->vlan_bitmap, VLAN_N_VID))
                         goto done;
 
                 af = nla_nest_start(skb, IFLA_AF_SPEC);
@@ -136,7 +140,7 @@ static int br_fill_ifinfo(struct sk_buff *skb,
                         goto nla_put_failure;
 
                 pvid = br_get_pvid(pv);
-                for_each_set_bit(vid, pv->vlan_bitmap, BR_VLAN_BITMAP_LEN) {
+                for_each_set_bit(vid, pv->vlan_bitmap, VLAN_N_VID) {
                         vinfo.vid = vid;
                         vinfo.flags = 0;
                         if (vid == pvid)
@@ -203,7 +207,7 @@ int br_getlink(struct sk_buff *skb, u32 pid, u32 seq,
                struct net_device *dev, u32 filter_mask)
 {
         int err = 0;
-        struct net_bridge_port *port = br_port_get_rcu(dev);
+        struct net_bridge_port *port = br_port_get_rtnl(dev);
 
         /* not a bridge port and  */
         if (!port && !(filter_mask & RTEXT_FILTER_BRVLAN))
@@ -281,6 +285,8 @@ static const struct nla_policy ifla_brport_policy[IFLA_BRPORT_MAX + 1] = {
         [IFLA_BRPORT_MODE]      = { .type = NLA_U8 },
         [IFLA_BRPORT_GUARD]     = { .type = NLA_U8 },
         [IFLA_BRPORT_PROTECT]   = { .type = NLA_U8 },
+        [IFLA_BRPORT_LEARNING]  = { .type = NLA_U8 },
+        [IFLA_BRPORT_UNICAST_FLOOD] = { .type = NLA_U8 },
 };
 
 /* Change the state of the port and notify spanning tree */
@@ -328,6 +334,8 @@ static int br_setport(struct net_bridge_port *p, struct nlattr *tb[])
         br_set_port_flag(p, tb, IFLA_BRPORT_GUARD, BR_BPDU_GUARD);
         br_set_port_flag(p, tb, IFLA_BRPORT_FAST_LEAVE, BR_MULTICAST_FAST_LEAVE);
         br_set_port_flag(p, tb, IFLA_BRPORT_PROTECT, BR_ROOT_BLOCK);
+        br_set_port_flag(p, tb, IFLA_BRPORT_LEARNING, BR_LEARNING);
+        br_set_port_flag(p, tb, IFLA_BRPORT_UNICAST_FLOOD, BR_FLOOD);
 
         if (tb[IFLA_BRPORT_COST]) {
                 err = br_stp_set_path_cost(p, nla_get_u32(tb[IFLA_BRPORT_COST]));
@@ -443,7 +451,7 @@ static size_t br_get_link_af_size(const struct net_device *dev)
         struct net_port_vlans *pv;
 
         if (br_port_exists(dev))
-                pv = nbp_get_vlan_info(br_port_get_rcu(dev));
+                pv = nbp_get_vlan_info(br_port_get_rtnl(dev));
         else if (dev->priv_flags & IFF_EBRIDGE)
                 pv = br_get_vlan_info((struct net_bridge *)netdev_priv(dev));
         else
diff --git a/net/bridge/br_notify.c b/net/bridge/br_notify.c
index 1644b3e1f947..2998dd1769a0 100644
--- a/net/bridge/br_notify.c
+++ b/net/bridge/br_notify.c
@@ -31,7 +31,7 @@ struct notifier_block br_device_notifier = {
  */
 static int br_device_event(struct notifier_block *unused, unsigned long event, void *ptr)
 {
-        struct net_device *dev = ptr;
+        struct net_device *dev = netdev_notifier_info_to_dev(ptr);
         struct net_bridge_port *p;
         struct net_bridge *br;
         bool changed_addr;
@@ -102,6 +102,11 @@ static int br_device_event(struct notifier_block *unused, unsigned long event, v
         case NETDEV_PRE_TYPE_CHANGE:
                 /* Forbid underlaying device to change its type. */
                 return NOTIFY_BAD;
+
+        case NETDEV_RESEND_IGMP:
+                /* Propagate to master device */
+                call_netdevice_notifiers(event, br->dev);
+                break;
         }
 
         /* Events that may cause spanning tree to refresh */
diff --git a/net/bridge/br_private.h b/net/bridge/br_private.h
index d2c043a857b6..efb57d911569 100644
--- a/net/bridge/br_private.h
+++ b/net/bridge/br_private.h
@@ -66,6 +66,20 @@ struct br_ip
         __u16           vid;
 };
 
+#ifdef CONFIG_BRIDGE_IGMP_SNOOPING
+/* our own querier */
+struct bridge_mcast_query {
+        struct timer_list       timer;
+        u32                     startup_sent;
+};
+
+/* other querier */
+struct bridge_mcast_querier {
+        struct timer_list               timer;
+        unsigned long                   delay_time;
+};
+#endif
+
 struct net_port_vlans {
         u16                             port_idx;
         u16                             pvid;
@@ -112,6 +126,7 @@ struct net_bridge_mdb_entry
         struct timer_list               timer;
         struct br_ip                    addr;
         bool                            mglist;
+        bool                            timer_armed;
 };
 
 struct net_bridge_mdb_htable
@@ -157,12 +172,16 @@ struct net_bridge_port
 #define BR_ROOT_BLOCK           0x00000004
 #define BR_MULTICAST_FAST_LEAVE 0x00000008
 #define BR_ADMIN_COST           0x00000010
+#define BR_LEARNING             0x00000020
+#define BR_FLOOD                0x00000040
 
 #ifdef CONFIG_BRIDGE_IGMP_SNOOPING
-        u32                             multicast_startup_queries_sent;
+        struct bridge_mcast_query       ip4_query;
+#if IS_ENABLED(CONFIG_IPV6)
+        struct bridge_mcast_query       ip6_query;
+#endif /* IS_ENABLED(CONFIG_IPV6) */
         unsigned char                   multicast_router;
         struct timer_list               multicast_router_timer;
-        struct timer_list               multicast_query_timer;
         struct hlist_head               mglist;
         struct hlist_node               rlist;
 #endif
@@ -183,13 +202,10 @@ struct net_bridge_port
 
 static inline struct net_bridge_port *br_port_get_rcu(const struct net_device *dev)
 {
-        struct net_bridge_port *port =
-                        rcu_dereference_rtnl(dev->rx_handler_data);
-
-        return br_port_exists(dev) ? port : NULL;
+        return rcu_dereference(dev->rx_handler_data);
 }
 
-static inline struct net_bridge_port *br_port_get_rtnl(struct net_device *dev)
+static inline struct net_bridge_port *br_port_get_rtnl(const struct net_device *dev)
 {
         return br_port_exists(dev) ?
                 rtnl_dereference(dev->rx_handler_data) : NULL;
@@ -249,12 +265,12 @@ struct net_bridge
 
         u8                              multicast_disabled:1;
         u8                              multicast_querier:1;
+        u8                              multicast_query_use_ifaddr:1;
 
         u32                             hash_elasticity;
         u32                             hash_max;
 
         u32                             multicast_last_member_count;
-        u32                             multicast_startup_queries_sent;
         u32                             multicast_startup_query_count;
 
         unsigned long                   multicast_last_member_interval;
@@ -269,8 +285,12 @@ struct net_bridge
         struct hlist_head               router_list;
 
         struct timer_list               multicast_router_timer;
-        struct timer_list               multicast_querier_timer;
-        struct timer_list               multicast_query_timer;
+        struct bridge_mcast_querier     ip4_querier;
+        struct bridge_mcast_query       ip4_query;
+#if IS_ENABLED(CONFIG_IPV6)
+        struct bridge_mcast_querier     ip6_querier;
+        struct bridge_mcast_query       ip6_query;
+#endif /* IS_ENABLED(CONFIG_IPV6) */
 #endif
 
         struct timer_list               hello_timer;
@@ -329,11 +349,6 @@ extern void br_dev_delete(struct net_device *dev, struct list_head *list);
 extern netdev_tx_t br_dev_xmit(struct sk_buff *skb,
                                struct net_device *dev);
 #ifdef CONFIG_NET_POLL_CONTROLLER
-static inline struct netpoll_info *br_netpoll_info(struct net_bridge *br)
-{
-        return br->dev->npinfo;
-}
-
 static inline void br_netpoll_send_skb(const struct net_bridge_port *p,
                                        struct sk_buff *skb)
 {
@@ -346,11 +361,6 @@ static inline void br_netpoll_send_skb(const struct net_bridge_port *p,
 extern int br_netpoll_enable(struct net_bridge_port *p, gfp_t gfp);
 extern void br_netpoll_disable(struct net_bridge_port *p);
 #else
-static inline struct netpoll_info *br_netpoll_info(struct net_bridge *br)
-{
-        return NULL;
-}
-
 static inline void br_netpoll_send_skb(const struct net_bridge_port *p,
                                        struct sk_buff *skb)
 {
@@ -411,9 +421,10 @@ extern int br_dev_queue_push_xmit(struct sk_buff *skb);
 extern void br_forward(const struct net_bridge_port *to,
                 struct sk_buff *skb, struct sk_buff *skb0);
 extern int br_forward_finish(struct sk_buff *skb);
-extern void br_flood_deliver(struct net_bridge *br, struct sk_buff *skb);
+extern void br_flood_deliver(struct net_bridge *br, struct sk_buff *skb,
+                             bool unicast);
 extern void br_flood_forward(struct net_bridge *br, struct sk_buff *skb,
-                             struct sk_buff *skb2);
+                             struct sk_buff *skb2, bool unicast);
 
 /* br_if.c */
 extern void br_port_carrier_check(struct net_bridge_port *p);
@@ -470,7 +481,7 @@ extern void br_multicast_free_pg(struct rcu_head *head);
 extern struct net_bridge_port_group *br_multicast_new_port_group(
                                 struct net_bridge_port *port,
                                 struct br_ip *group,
-                                struct net_bridge_port_group *next,
+                                struct net_bridge_port_group __rcu *next,
                                 unsigned char state);
 extern void br_mdb_init(void);
 extern void br_mdb_uninit(void);
@@ -480,22 +491,35 @@ extern void br_mdb_notify(struct net_device *dev, struct net_bridge_port *port,
 #define mlock_dereference(X, br) \
         rcu_dereference_protected(X, lockdep_is_held(&br->multicast_lock))
 
-#if IS_ENABLED(CONFIG_IPV6)
-#include <net/addrconf.h>
-static inline int ipv6_is_transient_multicast(const struct in6_addr *addr)
-{
-        if (ipv6_addr_is_multicast(addr) && IPV6_ADDR_MC_FLAG_TRANSIENT(addr))
-                return 1;
-        return 0;
-}
-#endif
-
 static inline bool br_multicast_is_router(struct net_bridge *br)
 {
         return br->multicast_router == 2 ||
                (br->multicast_router == 1 &&
                 timer_pending(&br->multicast_router_timer));
 }
+
+static inline bool
+__br_multicast_querier_exists(struct net_bridge *br,
+                              struct bridge_mcast_querier *querier)
+{
+        return time_is_before_jiffies(querier->delay_time) &&
+               (br->multicast_querier || timer_pending(&querier->timer));
+}
+
+static inline bool br_multicast_querier_exists(struct net_bridge *br,
+                                               struct ethhdr *eth)
+{
+        switch (eth->h_proto) {
+        case (htons(ETH_P_IP)):
+                return __br_multicast_querier_exists(br, &br->ip4_querier);
+#if IS_ENABLED(CONFIG_IPV6)
+        case (htons(ETH_P_IPV6)):
+                return __br_multicast_querier_exists(br, &br->ip6_querier);
+#endif
+        default:
+                return false;
+        }
+}
 #else
 static inline int br_multicast_rcv(struct net_bridge *br,
                                    struct net_bridge_port *port,
@@ -552,6 +576,11 @@ static inline bool br_multicast_is_router(struct net_bridge *br)
 {
         return 0;
 }
+static inline bool br_multicast_querier_exists(struct net_bridge *br,
+                                               struct ethhdr *eth)
+{
+        return false;
+}
 static inline void br_mdb_init(void)
 {
 }
@@ -714,6 +743,7 @@ extern struct net_bridge_port *br_get_port(struct net_bridge *br,
 extern void br_init_port(struct net_bridge_port *p);
 extern void br_become_designated_port(struct net_bridge_port *p);
 
+extern void __br_set_forward_delay(struct net_bridge *br, unsigned long t);
 extern int br_set_forward_delay(struct net_bridge *br, unsigned long x);
 extern int br_set_hello_time(struct net_bridge *br, unsigned long x);
 extern int br_set_max_age(struct net_bridge *br, unsigned long x);
diff --git a/net/bridge/br_stp.c b/net/bridge/br_stp.c
index 1c0a50f13229..3c86f0538cbb 100644
--- a/net/bridge/br_stp.c
+++ b/net/bridge/br_stp.c
@@ -209,7 +209,7 @@ static void br_record_config_information(struct net_bridge_port *p,
         p->designated_age = jiffies - bpdu->message_age;
 
         mod_timer(&p->message_age_timer, jiffies
-                  + (p->br->max_age - bpdu->message_age));
+                  + (bpdu->max_age - bpdu->message_age));
 }
 
 /* called under bridge lock */
@@ -544,18 +544,27 @@ int br_set_max_age(struct net_bridge *br, unsigned long val)
 
 }
 
+void __br_set_forward_delay(struct net_bridge *br, unsigned long t)
+{
+        br->bridge_forward_delay = t;
+        if (br_is_root_bridge(br))
+                br->forward_delay = br->bridge_forward_delay;
+}
+
 int br_set_forward_delay(struct net_bridge *br, unsigned long val)
 {
         unsigned long t = clock_t_to_jiffies(val);
+        int err = -ERANGE;
 
+        spin_lock_bh(&br->lock);
         if (br->stp_enabled != BR_NO_STP &&
             (t < BR_MIN_FORWARD_DELAY || t > BR_MAX_FORWARD_DELAY))
-                return -ERANGE;
+                goto unlock;
 
-        spin_lock_bh(&br->lock);
-        br->bridge_forward_delay = t;
-        if (br_is_root_bridge(br))
-                br->forward_delay = br->bridge_forward_delay;
+        __br_set_forward_delay(br, t);
+        err = 0;
+
+unlock:
         spin_unlock_bh(&br->lock);
-        return 0;
+        return err;
 }
diff --git a/net/bridge/br_stp_if.c b/net/bridge/br_stp_if.c
index d45e760141bb..108084a04671 100644
--- a/net/bridge/br_stp_if.c
+++ b/net/bridge/br_stp_if.c
@@ -129,6 +129,14 @@ static void br_stp_start(struct net_bridge *br)
         char *envp[] = { NULL };
 
         r = call_usermodehelper(BR_STP_PROG, argv, envp, UMH_WAIT_PROC);
+
+        spin_lock_bh(&br->lock);
+
+        if (br->bridge_forward_delay < BR_MIN_FORWARD_DELAY)
+                __br_set_forward_delay(br, BR_MIN_FORWARD_DELAY);
+        else if (br->bridge_forward_delay < BR_MAX_FORWARD_DELAY)
+                __br_set_forward_delay(br, BR_MAX_FORWARD_DELAY);
+
         if (r == 0) {
                 br->stp_enabled = BR_USER_STP;
                 br_debug(br, "userspace STP started\n");
@@ -137,10 +145,10 @@ static void br_stp_start(struct net_bridge *br)
                 br_debug(br, "using kernel STP\n");
 
                 /* To start timers on any ports left in blocking */
-                spin_lock_bh(&br->lock);
                 br_port_state_selection(br);
-                spin_unlock_bh(&br->lock);
         }
+
+        spin_unlock_bh(&br->lock);
 }
 
 static void br_stp_stop(struct net_bridge *br)
diff --git a/net/bridge/br_sysfs_br.c b/net/bridge/br_sysfs_br.c
index 8baa9c08e1a4..3b9637fb7939 100644
--- a/net/bridge/br_sysfs_br.c
+++ b/net/bridge/br_sysfs_br.c
@@ -1,5 +1,5 @@
 /*
- *      Sysfs attributes of bridge ports
+ *      Sysfs attributes of bridge
  *      Linux ethernet bridge
  *
  *      Authors:
@@ -375,6 +375,31 @@ static ssize_t store_multicast_snooping(struct device *d,
 static DEVICE_ATTR(multicast_snooping, S_IRUGO | S_IWUSR,
                    show_multicast_snooping, store_multicast_snooping);
 
+static ssize_t show_multicast_query_use_ifaddr(struct device *d,
+                                      struct device_attribute *attr,
+                                      char *buf)
+{
+        struct net_bridge *br = to_bridge(d);
+        return sprintf(buf, "%d\n", br->multicast_query_use_ifaddr);
+}
+
+static int set_query_use_ifaddr(struct net_bridge *br, unsigned long val)
+{
+        br->multicast_query_use_ifaddr = !!val;
+        return 0;
+}
+
+static ssize_t
+store_multicast_query_use_ifaddr(struct device *d,
+                                 struct device_attribute *attr,
+                                 const char *buf, size_t len)
+{
+        return store_bridge_parm(d, buf, len, set_query_use_ifaddr);
+}
+static DEVICE_ATTR(multicast_query_use_ifaddr, S_IRUGO | S_IWUSR,
+                   show_multicast_query_use_ifaddr,
+                   store_multicast_query_use_ifaddr);
+
 static ssize_t show_multicast_querier(struct device *d,
                                       struct device_attribute *attr,
                                       char *buf)
@@ -734,6 +759,7 @@ static struct attribute *bridge_attrs[] = {
         &dev_attr_multicast_router.attr,
         &dev_attr_multicast_snooping.attr,
         &dev_attr_multicast_querier.attr,
+        &dev_attr_multicast_query_use_ifaddr.attr,
         &dev_attr_hash_elasticity.attr,
         &dev_attr_hash_max.attr,
         &dev_attr_multicast_last_member_count.attr,
diff --git a/net/bridge/br_sysfs_if.c b/net/bridge/br_sysfs_if.c
index a1ef1b6e14dc..2a2cdb756d51 100644
--- a/net/bridge/br_sysfs_if.c
+++ b/net/bridge/br_sysfs_if.c
@@ -158,6 +158,8 @@ static BRPORT_ATTR(flush, S_IWUSR, NULL, store_flush);
 BRPORT_ATTR_FLAG(hairpin_mode, BR_HAIRPIN_MODE);
 BRPORT_ATTR_FLAG(bpdu_guard, BR_BPDU_GUARD);
 BRPORT_ATTR_FLAG(root_block, BR_ROOT_BLOCK);
+BRPORT_ATTR_FLAG(learning, BR_LEARNING);
+BRPORT_ATTR_FLAG(unicast_flood, BR_FLOOD);
 
 #ifdef CONFIG_BRIDGE_IGMP_SNOOPING
 static ssize_t show_multicast_router(struct net_bridge_port *p, char *buf)
@@ -195,6 +197,8 @@ static const struct brport_attribute *brport_attrs[] = {
         &brport_attr_hairpin_mode,
         &brport_attr_bpdu_guard,
         &brport_attr_root_block,
+        &brport_attr_learning,
+        &brport_attr_unicast_flood,
 #ifdef CONFIG_BRIDGE_IGMP_SNOOPING
         &brport_attr_multicast_router,
         &brport_attr_multicast_fast_leave,
diff --git a/net/bridge/br_vlan.c b/net/bridge/br_vlan.c
index bd58b45f5f90..9a9ffe7e4019 100644
--- a/net/bridge/br_vlan.c
+++ b/net/bridge/br_vlan.c
@@ -108,7 +108,7 @@ static int __vlan_del(struct net_port_vlans *v, u16 vid)
 
         clear_bit(vid, v->vlan_bitmap);
         v->num_vlans--;
-        if (bitmap_empty(v->vlan_bitmap, BR_VLAN_BITMAP_LEN)) {
+        if (bitmap_empty(v->vlan_bitmap, VLAN_N_VID)) {
                 if (v->port_idx)
                         rcu_assign_pointer(v->parent.port->vlan_info, NULL);
                 else
@@ -122,7 +122,7 @@ static void __vlan_flush(struct net_port_vlans *v)
 {
         smp_wmb();
         v->pvid = 0;
-        bitmap_zero(v->vlan_bitmap, BR_VLAN_BITMAP_LEN);
+        bitmap_zero(v->vlan_bitmap, VLAN_N_VID);
         if (v->port_idx)
                 rcu_assign_pointer(v->parent.port->vlan_info, NULL);
         else
diff --git a/net/bridge/netfilter/ebt_ulog.c b/net/bridge/netfilter/ebt_ulog.c
index df0364aa12d5..518093802d1d 100644
--- a/net/bridge/netfilter/ebt_ulog.c
+++ b/net/bridge/netfilter/ebt_ulog.c
@@ -271,6 +271,12 @@ static int ebt_ulog_tg_check(const struct xt_tgchk_param *par)
 {
         struct ebt_ulog_info *uloginfo = par->targinfo;
 
+        if (!par->net->xt.ebt_ulog_warn_deprecated) {
+                pr_info("ebt_ulog is deprecated and it will be removed soon, "
+                        "use ebt_nflog instead\n");
+                par->net->xt.ebt_ulog_warn_deprecated = true;
+        }
+
         if (uloginfo->nlgroup > 31)
                 return -EINVAL;
 
diff --git a/net/bridge/netfilter/ebtable_broute.c b/net/bridge/netfilter/ebtable_broute.c
index 70f656ce0f4a..dbd1c783431b 100644
--- a/net/bridge/netfilter/ebtable_broute.c
+++ b/net/bridge/netfilter/ebtable_broute.c
@@ -64,7 +64,7 @@ static int ebt_broute(struct sk_buff *skb)
 static int __net_init broute_net_init(struct net *net)
 {
         net->xt.broute_table = ebt_register_table(net, &broute_table);
-        return PTR_RET(net->xt.broute_table);
+        return PTR_ERR_OR_ZERO(net->xt.broute_table);
 }
 
 static void __net_exit broute_net_exit(struct net *net)
diff --git a/net/bridge/netfilter/ebtable_filter.c b/net/bridge/netfilter/ebtable_filter.c
index 3c2e9dced9e0..94b2b700cff8 100644
--- a/net/bridge/netfilter/ebtable_filter.c
+++ b/net/bridge/netfilter/ebtable_filter.c
@@ -100,7 +100,7 @@ static struct nf_hook_ops ebt_ops_filter[] __read_mostly = {
 static int __net_init frame_filter_net_init(struct net *net)
 {
         net->xt.frame_filter = ebt_register_table(net, &frame_filter);
-        return PTR_RET(net->xt.frame_filter);
+        return PTR_ERR_OR_ZERO(net->xt.frame_filter);
 }
 
 static void __net_exit frame_filter_net_exit(struct net *net)
diff --git a/net/bridge/netfilter/ebtable_nat.c b/net/bridge/netfilter/ebtable_nat.c
index 10871bc77908..322555acdd40 100644
--- a/net/bridge/netfilter/ebtable_nat.c
+++ b/net/bridge/netfilter/ebtable_nat.c
@@ -100,7 +100,7 @@ static struct nf_hook_ops ebt_ops_nat[] __read_mostly = {
 static int __net_init frame_nat_net_init(struct net *net)
 {
         net->xt.frame_nat = ebt_register_table(net, &frame_nat);
-        return PTR_RET(net->xt.frame_nat);
+        return PTR_ERR_OR_ZERO(net->xt.frame_nat);
 }
 
 static void __net_exit frame_nat_net_exit(struct net *net)
diff --git a/net/bridge/netfilter/ebtables.c b/net/bridge/netfilter/ebtables.c
index 3d110c4fc787..ac7802428384 100644
--- a/net/bridge/netfilter/ebtables.c
+++ b/net/bridge/netfilter/ebtables.c
@@ -1339,7 +1339,7 @@ static inline int ebt_make_matchname(const struct ebt_entry_match *m,
 
         /* ebtables expects 32 bytes long names but xt_match names are 29 bytes
            long. Copy 29 bytes and fill remaining bytes with zeroes. */
-        strncpy(name, m->u.match->name, sizeof(name));
+        strlcpy(name, m->u.match->name, sizeof(name));
         if (copy_to_user(hlp, name, EBT_FUNCTION_MAXNAMELEN))
                 return -EFAULT;
         return 0;
@@ -1351,7 +1351,7 @@ static inline int ebt_make_watchername(const struct ebt_entry_watcher *w,
         char __user *hlp = ubase + ((char *)w - base);
         char name[EBT_FUNCTION_MAXNAMELEN] = {};
 
-        strncpy(name, w->u.watcher->name, sizeof(name));
+        strlcpy(name, w->u.watcher->name, sizeof(name));
         if (copy_to_user(hlp , name, EBT_FUNCTION_MAXNAMELEN))
                 return -EFAULT;
         return 0;
@@ -1377,7 +1377,7 @@ ebt_make_names(struct ebt_entry *e, const char *base, char __user *ubase)
         ret = EBT_WATCHER_ITERATE(e, ebt_make_watchername, base, ubase);
         if (ret != 0)
                 return ret;
-        strncpy(name, t->u.target->name, sizeof(name));
+        strlcpy(name, t->u.target->name, sizeof(name));
         if (copy_to_user(hlp, name, EBT_FUNCTION_MAXNAMELEN))
                 return -EFAULT;
         return 0;
diff --git a/net/caif/caif_dev.c b/net/caif/caif_dev.c
index 1f9ece1a9c34..4dca159435cf 100644
--- a/net/caif/caif_dev.c
+++ b/net/caif/caif_dev.c
@@ -352,9 +352,9 @@ EXPORT_SYMBOL(caif_enroll_dev);
 
 /* notify Caif of device events */
 static int caif_device_notify(struct notifier_block *me, unsigned long what,
-                              void *arg)
+                              void *ptr)
 {
-        struct net_device *dev = arg;
+        struct net_device *dev = netdev_notifier_info_to_dev(ptr);
         struct caif_device_entry *caifd = NULL;
         struct caif_dev_common *caifdev;
         struct cfcnfg *cfg;
diff --git a/net/caif/caif_usb.c b/net/caif/caif_usb.c
index 942e00a425fd..75ed04b78fa4 100644
--- a/net/caif/caif_usb.c
+++ b/net/caif/caif_usb.c
@@ -121,9 +121,9 @@ static struct packet_type caif_usb_type __read_mostly = {
 };
 
 static int cfusbl_device_notify(struct notifier_block *me, unsigned long what,
-                                void *arg)
+                                void *ptr)
 {
-        struct net_device *dev = arg;
+        struct net_device *dev = netdev_notifier_info_to_dev(ptr);
         struct caif_dev_common common;
         struct cflayer *layer, *link_support;
         struct usbnet *usbnet;
diff --git a/net/caif/cfctrl.c b/net/caif/cfctrl.c
index 2bd4b58f4372..0f455227da83 100644
--- a/net/caif/cfctrl.c
+++ b/net/caif/cfctrl.c
@@ -293,9 +293,10 @@ int cfctrl_linkup_request(struct cflayer *layer,
 
                 count = cfctrl_cancel_req(&cfctrl->serv.layer,
                                                 user_layer);
-                if (count != 1)
+                if (count != 1) {
                         pr_err("Could not remove request (%d)", count);
                         return -ENODEV;
+                }
         }
         return 0;
 }
diff --git a/net/can/af_can.c b/net/can/af_can.c
index c4e50852c9f4..3ab8dd2e1282 100644
--- a/net/can/af_can.c
+++ b/net/can/af_can.c
@@ -794,9 +794,9 @@ EXPORT_SYMBOL(can_proto_unregister);
  * af_can notifier to create/remove CAN netdevice specific structs
  */
 static int can_notifier(struct notifier_block *nb, unsigned long msg,
-                        void *data)
+                        void *ptr)
 {
-        struct net_device *dev = (struct net_device *)data;
+        struct net_device *dev = netdev_notifier_info_to_dev(ptr);
         struct dev_rcv_lists *d;
 
         if (!net_eq(dev_net(dev), &init_net))
diff --git a/net/can/bcm.c b/net/can/bcm.c
index 8f113e6ff327..46f20bfafc0e 100644
--- a/net/can/bcm.c
+++ b/net/can/bcm.c
@@ -1350,9 +1350,9 @@ static int bcm_sendmsg(struct kiocb *iocb, struct socket *sock,
  * notification handler for netdevice status changes
  */
 static int bcm_notifier(struct notifier_block *nb, unsigned long msg,
-                        void *data)
+                        void *ptr)
 {
-        struct net_device *dev = (struct net_device *)data;
+        struct net_device *dev = netdev_notifier_info_to_dev(ptr);
         struct bcm_sock *bo = container_of(nb, struct bcm_sock, notifier);
         struct sock *sk = &bo->sk;
         struct bcm_op *op;
diff --git a/net/can/gw.c b/net/can/gw.c
index 3ee690e8c7d3..3f9b0f3a2818 100644
--- a/net/can/gw.c
+++ b/net/can/gw.c
@@ -146,6 +146,7 @@ struct cgw_job {
                 /* tbc */
         };
         u8 gwtype;
+        u8 limit_hops;
         u16 flags;
 };
 
@@ -402,6 +403,11 @@ static void can_can_gw_rcv(struct sk_buff *skb, void *data)
 
         /* put the incremented hop counter in the cloned skb */
         cgw_hops(nskb) = cgw_hops(skb) + 1;
+
+        /* first processing of this CAN frame -> adjust to private hop limit */
+        if (gwj->limit_hops && cgw_hops(nskb) == 1)
+                cgw_hops(nskb) = max_hops - gwj->limit_hops + 1;
+
         nskb->dev = gwj->dst.dev;
 
         /* pointer to modifiable CAN frame */
@@ -445,9 +451,9 @@ static inline void cgw_unregister_filter(struct cgw_job *gwj)
 }
 
 static int cgw_notifier(struct notifier_block *nb,
-                        unsigned long msg, void *data)
+                        unsigned long msg, void *ptr)
 {
-        struct net_device *dev = (struct net_device *)data;
+        struct net_device *dev = netdev_notifier_info_to_dev(ptr);
 
         if (!net_eq(dev_net(dev), &init_net))
                 return NOTIFY_DONE;
@@ -509,6 +515,11 @@ static int cgw_put_job(struct sk_buff *skb, struct cgw_job *gwj, int type,
 
         /* check non default settings of attributes */
 
+        if (gwj->limit_hops) {
+                if (nla_put_u8(skb, CGW_LIM_HOPS, gwj->limit_hops) < 0)
+                        goto cancel;
+        }
+
         if (gwj->mod.modtype.and) {
                 memcpy(&mb.cf, &gwj->mod.modframe.and, sizeof(mb.cf));
                 mb.modtype = gwj->mod.modtype.and;
@@ -606,11 +617,12 @@ static const struct nla_policy cgw_policy[CGW_MAX+1] = {
         [CGW_SRC_IF]    = { .type = NLA_U32 },
         [CGW_DST_IF]    = { .type = NLA_U32 },
         [CGW_FILTER]    = { .len = sizeof(struct can_filter) },
+        [CGW_LIM_HOPS]  = { .type = NLA_U8 },
 };
 
 /* check for common and gwtype specific attributes */
 static int cgw_parse_attr(struct nlmsghdr *nlh, struct cf_mod *mod,
-                          u8 gwtype, void *gwtypeattr)
+                          u8 gwtype, void *gwtypeattr, u8 *limhops)
 {
         struct nlattr *tb[CGW_MAX+1];
         struct cgw_frame_mod mb;
@@ -625,6 +637,13 @@ static int cgw_parse_attr(struct nlmsghdr *nlh, struct cf_mod *mod,
         if (err < 0)
                 return err;
 
+        if (tb[CGW_LIM_HOPS]) {
+                *limhops = nla_get_u8(tb[CGW_LIM_HOPS]);
+
+                if (*limhops < 1 || *limhops > max_hops)
+                        return -EINVAL;
+        }
+
         /* check for AND/OR/XOR/SET modifications */
 
         if (tb[CGW_MOD_AND]) {
@@ -782,6 +801,7 @@ static int cgw_create_job(struct sk_buff *skb,  struct nlmsghdr *nlh)
 {
         struct rtcanmsg *r;
         struct cgw_job *gwj;
+        u8 limhops = 0;
         int err = 0;
 
         if (!capable(CAP_NET_ADMIN))
@@ -808,7 +828,8 @@ static int cgw_create_job(struct sk_buff *skb,  struct nlmsghdr *nlh)
         gwj->flags = r->flags;
         gwj->gwtype = r->gwtype;
 
-        err = cgw_parse_attr(nlh, &gwj->mod, CGW_TYPE_CAN_CAN, &gwj->ccgw);
+        err = cgw_parse_attr(nlh, &gwj->mod, CGW_TYPE_CAN_CAN, &gwj->ccgw,
+                             &limhops);
         if (err < 0)
                 goto out;
 
@@ -836,6 +857,8 @@ static int cgw_create_job(struct sk_buff *skb,  struct nlmsghdr *nlh)
         if (gwj->dst.dev->type != ARPHRD_CAN || gwj->dst.dev->header_ops)
                 goto put_src_dst_out;
 
+        gwj->limit_hops = limhops;
+
         ASSERT_RTNL();
 
         err = cgw_register_filter(gwj);
@@ -867,13 +890,14 @@ static void cgw_remove_all_jobs(void)
         }
 }
 
-static int cgw_remove_job(struct sk_buff *skb,  struct nlmsghdr *nlh)
+static int cgw_remove_job(struct sk_buff *skb, struct nlmsghdr *nlh)
 {
         struct cgw_job *gwj = NULL;
         struct hlist_node *nx;
         struct rtcanmsg *r;
         struct cf_mod mod;
         struct can_can_gw ccgw;
+        u8 limhops = 0;
         int err = 0;
 
         if (!capable(CAP_NET_ADMIN))
@@ -890,7 +914,7 @@ static int cgw_remove_job(struct sk_buff *skb,  struct nlmsghdr *nlh)
         if (r->gwtype != CGW_TYPE_CAN_CAN)
                 return -EINVAL;
 
-        err = cgw_parse_attr(nlh, &mod, CGW_TYPE_CAN_CAN, &ccgw);
+        err = cgw_parse_attr(nlh, &mod, CGW_TYPE_CAN_CAN, &ccgw, &limhops);
         if (err < 0)
                 return err;
 
@@ -910,6 +934,9 @@ static int cgw_remove_job(struct sk_buff *skb,  struct nlmsghdr *nlh)
                 if (gwj->flags != r->flags)
                         continue;
 
+                if (gwj->limit_hops != limhops)
+                        continue;
+
                 if (memcmp(&gwj->mod, &mod, sizeof(mod)))
                         continue;
 
diff --git a/net/can/raw.c b/net/can/raw.c
index 1085e65f848e..641e1c895123 100644
--- a/net/can/raw.c
+++ b/net/can/raw.c
@@ -239,9 +239,9 @@ static int raw_enable_allfilters(struct net_device *dev, struct sock *sk)
 }
 
 static int raw_notifier(struct notifier_block *nb,
-                        unsigned long msg, void *data)
+                        unsigned long msg, void *ptr)
 {
-        struct net_device *dev = (struct net_device *)data;
+        struct net_device *dev = netdev_notifier_info_to_dev(ptr);
         struct raw_sock *ro = container_of(nb, struct raw_sock, notifier);
         struct sock *sk = &ro->sk;
 
diff --git a/net/ceph/auth_none.c b/net/ceph/auth_none.c
index 925ca583c09c..8c93fa8d81bc 100644
--- a/net/ceph/auth_none.c
+++ b/net/ceph/auth_none.c
@@ -39,6 +39,11 @@ static int should_authenticate(struct ceph_auth_client *ac)
         return xi->starting;
 }
 
+static int build_request(struct ceph_auth_client *ac, void *buf, void *end)
+{
+        return 0;
+}
+
 /*
  * the generic auth code decode the global_id, and we carry no actual
  * authenticate state, so nothing happens here.
@@ -106,6 +111,7 @@ static const struct ceph_auth_client_ops ceph_auth_none_ops = {
         .destroy = destroy,
         .is_authenticated = is_authenticated,
         .should_authenticate = should_authenticate,
+        .build_request = build_request,
         .handle_reply = handle_reply,
         .create_authorizer = ceph_auth_none_create_authorizer,
         .destroy_authorizer = ceph_auth_none_destroy_authorizer,
diff --git a/net/ceph/messenger.c b/net/ceph/messenger.c
index eb0a46a49bd4..4a5df7b1cc9f 100644
--- a/net/ceph/messenger.c
+++ b/net/ceph/messenger.c
@@ -290,7 +290,7 @@ int ceph_msgr_init(void)
         if (ceph_msgr_slab_init())
                 return -ENOMEM;
 
-        ceph_msgr_wq = alloc_workqueue("ceph-msgr", WQ_NON_REENTRANT, 0);
+        ceph_msgr_wq = alloc_workqueue("ceph-msgr", 0, 0);
         if (ceph_msgr_wq)
                 return 0;
 
@@ -409,7 +409,7 @@ static void ceph_sock_write_space(struct sock *sk)
          * and net/core/stream.c:sk_stream_write_space().
          */
         if (con_flag_test(con, CON_FLAG_WRITE_PENDING)) {
-                if (sk_stream_wspace(sk) >= sk_stream_min_wspace(sk)) {
+                if (sk_stream_is_writeable(sk)) {
                         dout("%s %p queueing write work\n", __func__, con);
                         clear_bit(SOCK_NOSPACE, &sk->sk_socket->flags);
                         queue_con(con);
diff --git a/net/ceph/osd_client.c b/net/ceph/osd_client.c
index d5953b87918c..2b4b32aaa893 100644
--- a/net/ceph/osd_client.c
+++ b/net/ceph/osd_client.c
@@ -503,7 +503,9 @@ void osd_req_op_extent_init(struct ceph_osd_request *osd_req,
         struct ceph_osd_req_op *op = _osd_req_op_init(osd_req, which, opcode);
         size_t payload_len = 0;
 
-        BUG_ON(opcode != CEPH_OSD_OP_READ && opcode != CEPH_OSD_OP_WRITE);
+        BUG_ON(opcode != CEPH_OSD_OP_READ && opcode != CEPH_OSD_OP_WRITE &&
+               opcode != CEPH_OSD_OP_DELETE && opcode != CEPH_OSD_OP_ZERO &&
+               opcode != CEPH_OSD_OP_TRUNCATE);
 
         op->extent.offset = offset;
         op->extent.length = length;
@@ -631,6 +633,9 @@ static u64 osd_req_encode_op(struct ceph_osd_request *req,
                 break;
         case CEPH_OSD_OP_READ:
         case CEPH_OSD_OP_WRITE:
+        case CEPH_OSD_OP_ZERO:
+        case CEPH_OSD_OP_DELETE:
+        case CEPH_OSD_OP_TRUNCATE:
                 if (src->op == CEPH_OSD_OP_WRITE)
                         request_data_len = src->extent.length;
                 dst->extent.offset = cpu_to_le64(src->extent.offset);
@@ -715,7 +720,9 @@ struct ceph_osd_request *ceph_osdc_new_request(struct ceph_osd_client *osdc,
         u64 object_base;
         int r;
 
-        BUG_ON(opcode != CEPH_OSD_OP_READ && opcode != CEPH_OSD_OP_WRITE);
+        BUG_ON(opcode != CEPH_OSD_OP_READ && opcode != CEPH_OSD_OP_WRITE &&
+               opcode != CEPH_OSD_OP_DELETE && opcode != CEPH_OSD_OP_ZERO &&
+               opcode != CEPH_OSD_OP_TRUNCATE);
 
         req = ceph_osdc_alloc_request(osdc, snapc, num_ops, use_mempool,
                                         GFP_NOFS);
@@ -733,12 +740,14 @@ struct ceph_osd_request *ceph_osdc_new_request(struct ceph_osd_client *osdc,
 
         object_size = le32_to_cpu(layout->fl_object_size);
         object_base = off - objoff;
-        if (truncate_size <= object_base) {
-                truncate_size = 0;
-        } else {
-                truncate_size -= object_base;
-                if (truncate_size > object_size)
-                        truncate_size = object_size;
+        if (!(truncate_seq == 1 && truncate_size == -1ULL)) {
+                if (truncate_size <= object_base) {
+                        truncate_size = 0;
+                } else {
+                        truncate_size -= object_base;
+                        if (truncate_size > object_size)
+                                truncate_size = object_size;
+                }
         }
 
         osd_req_op_extent_init(req, 0, opcode, objoff, objlen,
@@ -1174,6 +1183,7 @@ static void __register_linger_request(struct ceph_osd_client *osdc,
                                     struct ceph_osd_request *req)
 {
         dout("__register_linger_request %p\n", req);
+        ceph_osdc_get_request(req);
         list_add_tail(&req->r_linger_item, &osdc->req_linger);
         if (req->r_osd)
                 list_add_tail(&req->r_linger_osd,
@@ -1196,6 +1206,7 @@ static void __unregister_linger_request(struct ceph_osd_client *osdc,
                 if (list_empty(&req->r_osd_item))
                         req->r_osd = NULL;
         }
+        ceph_osdc_put_request(req);
 }
 
 void ceph_osdc_unregister_linger_request(struct ceph_osd_client *osdc,
@@ -1203,9 +1214,8 @@ void ceph_osdc_unregister_linger_request(struct ceph_osd_client *osdc,
 {
         mutex_lock(&osdc->request_mutex);
         if (req->r_linger) {
-                __unregister_linger_request(osdc, req);
                 req->r_linger = 0;
-                ceph_osdc_put_request(req);
+                __unregister_linger_request(osdc, req);
         }
         mutex_unlock(&osdc->request_mutex);
 }
@@ -1217,11 +1227,6 @@ void ceph_osdc_set_request_linger(struct ceph_osd_client *osdc,
         if (!req->r_linger) {
                 dout("set_request_linger %p\n", req);
                 req->r_linger = 1;
-                /*
-                 * caller is now responsible for calling
-                 * unregister_linger_request
-                 */
-                ceph_osdc_get_request(req);
         }
 }
 EXPORT_SYMBOL(ceph_osdc_set_request_linger);
@@ -1339,10 +1344,6 @@ static void __send_request(struct ceph_osd_client *osdc,
 
         ceph_msg_get(req->r_request); /* send consumes a ref */
 
-        /* Mark the request unsafe if this is the first timet's being sent. */
-
-        if (!req->r_sent && req->r_unsafe_callback)
-                req->r_unsafe_callback(req, true);
         req->r_sent = req->r_osd->o_incarnation;
 
         ceph_con_send(&req->r_osd->o_con, req->r_request);
@@ -1433,8 +1434,6 @@ static void handle_osds_timeout(struct work_struct *work)
 
 static void complete_request(struct ceph_osd_request *req)
 {
-        if (req->r_unsafe_callback)
-                req->r_unsafe_callback(req, false);
         complete_all(&req->r_safe_completion);  /* fsync waiter */
 }
 
@@ -1496,14 +1495,14 @@ static void handle_reply(struct ceph_osd_client *osdc, struct ceph_msg *msg,
         dout("handle_reply %p tid %llu req %p result %d\n", msg, tid,
              req, result);
 
-        ceph_decode_need(&p, end, 4, bad);
+        ceph_decode_need(&p, end, 4, bad_put);
         numops = ceph_decode_32(&p);
         if (numops > CEPH_OSD_MAX_OP)
                 goto bad_put;
         if (numops != req->r_num_ops)
                 goto bad_put;
         payload_len = 0;
-        ceph_decode_need(&p, end, numops * sizeof(struct ceph_osd_op), bad);
+        ceph_decode_need(&p, end, numops * sizeof(struct ceph_osd_op), bad_put);
         for (i = 0; i < numops; i++) {
                 struct ceph_osd_op *op = p;
                 int len;
@@ -1521,11 +1520,13 @@ static void handle_reply(struct ceph_osd_client *osdc, struct ceph_msg *msg,
                 goto bad_put;
         }
 
-        ceph_decode_need(&p, end, 4 + numops * 4, bad);
+        ceph_decode_need(&p, end, 4 + numops * 4, bad_put);
         retry_attempt = ceph_decode_32(&p);
         for (i = 0; i < numops; i++)
                 req->r_reply_op_result[i] = ceph_decode_32(&p);
 
+        already_completed = req->r_got_reply;
+
         if (!req->r_got_reply) {
 
                 req->r_result = result;
@@ -1556,19 +1557,23 @@ static void handle_reply(struct ceph_osd_client *osdc, struct ceph_msg *msg,
             ((flags & CEPH_OSD_FLAG_WRITE) == 0))
                 __unregister_request(osdc, req);
 
-        already_completed = req->r_completed;
-        req->r_completed = 1;
         mutex_unlock(&osdc->request_mutex);
-        if (already_completed)
-                goto done;
 
-        if (req->r_callback)
-                req->r_callback(req, msg);
-        else
-                complete_all(&req->r_completion);
+        if (!already_completed) {
+                if (req->r_unsafe_callback &&
+                    result >= 0 && !(flags & CEPH_OSD_FLAG_ONDISK))
+                        req->r_unsafe_callback(req, true);
+                if (req->r_callback)
+                        req->r_callback(req, msg);
+                else
+                        complete_all(&req->r_completion);
+        }
 
-        if (flags & CEPH_OSD_FLAG_ONDISK)
+        if (flags & CEPH_OSD_FLAG_ONDISK) {
+                if (req->r_unsafe_callback && already_completed)
+                        req->r_unsafe_callback(req, false);
                 complete_request(req);
+        }
 
 done:
         dout("req=%p req->r_linger=%d\n", req, req->r_linger);
@@ -1633,8 +1638,10 @@ static void kick_requests(struct ceph_osd_client *osdc, int force_resend)
                         dout("%p tid %llu restart on osd%d\n",
                              req, req->r_tid,
                              req->r_osd ? req->r_osd->o_osd : -1);
+                        ceph_osdc_get_request(req);
                         __unregister_request(osdc, req);
                         __register_linger_request(osdc, req);
+                        ceph_osdc_put_request(req);
                         continue;
                 }
 
@@ -1675,13 +1682,13 @@ static void kick_requests(struct ceph_osd_client *osdc, int force_resend)
                 __register_request(osdc, req);
                 __unregister_linger_request(osdc, req);
         }
+        reset_changed_osds(osdc);
         mutex_unlock(&osdc->request_mutex);
 
         if (needmap) {
                 dout("%d requests for down osds, need new map\n", needmap);
                 ceph_monc_request_next_osdmap(&osdc->client->monc);
         }
-        reset_changed_osds(osdc);
 }
 
 
@@ -1786,6 +1793,8 @@ void ceph_osdc_handle_map(struct ceph_osd_client *osdc, struct ceph_msg *msg)
                 nr_maps--;
         }
 
+        if (!osdc->osdmap)
+                goto bad;
 done:
         downgrade_write(&osdc->map_sem);
         ceph_monc_got_osdmap(&osdc->client->monc, osdc->osdmap->epoch);
@@ -2123,13 +2132,14 @@ int ceph_osdc_start_request(struct ceph_osd_client *osdc,
         __register_request(osdc, req);
         req->r_sent = 0;
         req->r_got_reply = 0;
-        req->r_completed = 0;
         rc = __map_request(osdc, req, 0);
         if (rc < 0) {
                 if (nofail) {
                         dout("osdc_start_request failed map, "
                                 " will retry %lld\n", req->r_tid);
                         rc = 0;
+                } else {
+                        __unregister_request(osdc, req);
                 }
                 goto out_unlock;
         }
@@ -2206,6 +2216,17 @@ void ceph_osdc_sync(struct ceph_osd_client *osdc)
 EXPORT_SYMBOL(ceph_osdc_sync);
 
 /*
+ * Call all pending notify callbacks - for use after a watch is
+ * unregistered, to make sure no more callbacks for it will be invoked
+ */
+extern void ceph_osdc_flush_notifies(struct ceph_osd_client *osdc)
+{
+        flush_workqueue(osdc->notify_wq);
+}
+EXPORT_SYMBOL(ceph_osdc_flush_notifies);
+
+
+/*
  * init, shutdown
  */
 int ceph_osdc_init(struct ceph_osd_client *osdc, struct ceph_client *client)
@@ -2254,12 +2275,10 @@ int ceph_osdc_init(struct ceph_osd_client *osdc, struct ceph_client *client)
         if (err < 0)
                 goto out_msgpool;
 
+        err = -ENOMEM;
         osdc->notify_wq = create_singlethread_workqueue("ceph-watch-notify");
-        if (IS_ERR(osdc->notify_wq)) {
-                err = PTR_ERR(osdc->notify_wq);
-                osdc->notify_wq = NULL;
+        if (!osdc->notify_wq)
                 goto out_msgpool;
-        }
         return 0;
 
 out_msgpool:
@@ -2456,8 +2475,10 @@ static struct ceph_msg *get_reply(struct ceph_connection *con,
         ceph_msg_revoke_incoming(req->r_reply);
 
         if (front > req->r_reply->front.iov_len) {
-                pr_warning("get_reply front %d > preallocated %d\n",
-                           front, (int)req->r_reply->front.iov_len);
+                pr_warning("get_reply front %d > preallocated %d (%u#%llu)\n",
+                           front, (int)req->r_reply->front.iov_len,
+                           (unsigned int)con->peer_name.type,
+                           le64_to_cpu(con->peer_name.num));
                 m = ceph_msg_new(CEPH_MSG_OSD_OPREPLY, front, GFP_NOFS, false);
                 if (!m)
                         goto out;
diff --git a/net/ceph/osdmap.c b/net/ceph/osdmap.c
index 603ddd92db19..dbd9a4792427 100644
--- a/net/ceph/osdmap.c
+++ b/net/ceph/osdmap.c
@@ -1129,7 +1129,7 @@ static int *calc_pg_raw(struct ceph_osdmap *osdmap, struct ceph_pg pgid,
 
         /* pg_temp? */
         pgid.seed = ceph_stable_mod(pgid.seed, pool->pg_num,
-                                    pool->pgp_num_mask);
+                                    pool->pg_num_mask);
         pg = __lookup_pg_mapping(&osdmap->pg_temp, pgid);
         if (pg) {
                 *num = pg->len;
diff --git a/net/core/datagram.c b/net/core/datagram.c
index b71423db7785..af814e764206 100644
--- a/net/core/datagram.c
+++ b/net/core/datagram.c
@@ -48,6 +48,7 @@
 #include <linux/highmem.h>
 #include <linux/spinlock.h>
 #include <linux/slab.h>
+#include <linux/pagemap.h>
 
 #include <net/protocol.h>
 #include <linux/skbuff.h>
@@ -56,6 +57,7 @@
 #include <net/sock.h>
 #include <net/tcp_states.h>
 #include <trace/events/skb.h>
+#include <net/busy_poll.h>
 
 /*
  *      Is a socket 'connection oriented' ?
@@ -207,6 +209,10 @@ struct sk_buff *__skb_recv_datagram(struct sock *sk, unsigned int flags,
                 }
                 spin_unlock_irqrestore(&queue->lock, cpu_flags);
 
+                if (sk_can_busy_loop(sk) &&
+                    sk_busy_loop(sk, flags & MSG_DONTWAIT))
+                        continue;
+
                 /* User doesn't want to wait */
                 error = -EAGAIN;
                 if (!timeo)
@@ -568,6 +574,77 @@ fault:
 }
 EXPORT_SYMBOL(skb_copy_datagram_from_iovec);
 
+/**
+ *      zerocopy_sg_from_iovec - Build a zerocopy datagram from an iovec
+ *      @skb: buffer to copy
+ *      @from: io vector to copy to
+ *      @offset: offset in the io vector to start copying from
+ *      @count: amount of vectors to copy to buffer from
+ *
+ *      The function will first copy up to headlen, and then pin the userspace
+ *      pages and build frags through them.
+ *
+ *      Returns 0, -EFAULT or -EMSGSIZE.
+ *      Note: the iovec is not modified during the copy
+ */
+int zerocopy_sg_from_iovec(struct sk_buff *skb, const struct iovec *from,
+                                  int offset, size_t count)
+{
+        int len = iov_length(from, count) - offset;
+        int copy = min_t(int, skb_headlen(skb), len);
+        int size;
+        int i = 0;
+
+        /* copy up to skb headlen */
+        if (skb_copy_datagram_from_iovec(skb, 0, from, offset, copy))
+                return -EFAULT;
+
+        if (len == copy)
+                return 0;
+
+        offset += copy;
+        while (count--) {
+                struct page *page[MAX_SKB_FRAGS];
+                int num_pages;
+                unsigned long base;
+                unsigned long truesize;
+
+                /* Skip over from offset and copied */
+                if (offset >= from->iov_len) {
+                        offset -= from->iov_len;
+                        ++from;
+                        continue;
+                }
+                len = from->iov_len - offset;
+                base = (unsigned long)from->iov_base + offset;
+                size = ((base & ~PAGE_MASK) + len + ~PAGE_MASK) >> PAGE_SHIFT;
+                if (i + size > MAX_SKB_FRAGS)
+                        return -EMSGSIZE;
+                num_pages = get_user_pages_fast(base, size, 0, &page[i]);
+                if (num_pages != size) {
+                        release_pages(&page[i], num_pages, 0);
+                        return -EFAULT;
+                }
+                truesize = size * PAGE_SIZE;
+                skb->data_len += len;
+                skb->len += len;
+                skb->truesize += truesize;
+                atomic_add(truesize, &skb->sk->sk_wmem_alloc);
+                while (len) {
+                        int off = base & ~PAGE_MASK;
+                        int size = min_t(int, len, PAGE_SIZE - off);
+                        skb_fill_page_desc(skb, i, page[i], off, size);
+                        base += size;
+                        len -= size;
+                        i++;
+                }
+                offset = 0;
+                ++from;
+        }
+        return 0;
+}
+EXPORT_SYMBOL(zerocopy_sg_from_iovec);
+
 static int skb_copy_and_csum_datagram(const struct sk_buff *skb, int offset,
                                       u8 __user *to, int len,
                                       __wsum *csump)
diff --git a/net/core/dev.c b/net/core/dev.c
index fc1e289397f5..65f829cfd928 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -129,6 +129,8 @@
 #include <linux/inetdevice.h>
 #include <linux/cpu_rmap.h>
 #include <linux/static_key.h>
+#include <linux/hashtable.h>
+#include <linux/vmalloc.h>
 
 #include "net-sysfs.h"
 
@@ -166,7 +168,13 @@ static struct list_head offload_base __read_mostly;
 DEFINE_RWLOCK(dev_base_lock);
 EXPORT_SYMBOL(dev_base_lock);
 
-seqcount_t devnet_rename_seq;
+/* protects napi_hash addition/deletion and napi_gen_id */
+static DEFINE_SPINLOCK(napi_hash_lock);
+
+static unsigned int napi_gen_id;
+static DEFINE_HASHTABLE(napi_hash, 8);
+
+static seqcount_t devnet_rename_seq;
 
 static inline void dev_base_seq_inc(struct net *net)
 {
@@ -792,6 +800,40 @@ struct net_device *dev_get_by_index(struct net *net, int ifindex)
 EXPORT_SYMBOL(dev_get_by_index);
 
 /**
+ *      netdev_get_name - get a netdevice name, knowing its ifindex.
+ *      @net: network namespace
+ *      @name: a pointer to the buffer where the name will be stored.
+ *      @ifindex: the ifindex of the interface to get the name from.
+ *
+ *      The use of raw_seqcount_begin() and cond_resched() before
+ *      retrying is required as we want to give the writers a chance
+ *      to complete when CONFIG_PREEMPT is not set.
+ */
+int netdev_get_name(struct net *net, char *name, int ifindex)
+{
+        struct net_device *dev;
+        unsigned int seq;
+
+retry:
+        seq = raw_seqcount_begin(&devnet_rename_seq);
+        rcu_read_lock();
+        dev = dev_get_by_index_rcu(net, ifindex);
+        if (!dev) {
+                rcu_read_unlock();
+                return -ENODEV;
+        }
+
+        strcpy(name, dev->name);
+        rcu_read_unlock();
+        if (read_seqcount_retry(&devnet_rename_seq, seq)) {
+                cond_resched();
+                goto retry;
+        }
+
+        return 0;
+}
+
+/**
  *      dev_getbyhwaddr_rcu - find a device by its hardware address
  *      @net: the applicable net namespace
  *      @type: media type of device
@@ -1198,9 +1240,7 @@ static int __dev_open(struct net_device *dev)
          * If we don't do this there is a chance ndo_poll_controller
          * or ndo_poll may be running while we open the device
          */
-        ret = netpoll_rx_disable(dev);
-        if (ret)
-                return ret;
+        netpoll_rx_disable(dev);
 
         ret = call_netdevice_notifiers(NETDEV_PRE_UP, dev);
         ret = notifier_to_errno(ret);
@@ -1309,9 +1349,7 @@ static int __dev_close(struct net_device *dev)
         LIST_HEAD(single);
 
         /* Temporarily disable netpoll until the interface is down */
-        retval = netpoll_rx_disable(dev);
-        if (retval)
-                return retval;
+        netpoll_rx_disable(dev);
 
         list_add(&dev->unreg_list, &single);
         retval = __dev_close_many(&single);
@@ -1353,14 +1391,11 @@ static int dev_close_many(struct list_head *head)
  */
 int dev_close(struct net_device *dev)
 {
-        int ret = 0;
         if (dev->flags & IFF_UP) {
                 LIST_HEAD(single);
 
                 /* Block netpoll rx while the interface is going down */
-                ret = netpoll_rx_disable(dev);
-                if (ret)
-                        return ret;
+                netpoll_rx_disable(dev);
 
                 list_add(&dev->unreg_list, &single);
                 dev_close_many(&single);
@@ -1368,7 +1403,7 @@ int dev_close(struct net_device *dev)
 
                 netpoll_rx_enable(dev);
         }
-        return ret;
+        return 0;
 }
 EXPORT_SYMBOL(dev_close);
 
@@ -1398,6 +1433,14 @@ void dev_disable_lro(struct net_device *dev)
 }
 EXPORT_SYMBOL(dev_disable_lro);
 
+static int call_netdevice_notifier(struct notifier_block *nb, unsigned long val,
+                                   struct net_device *dev)
+{
+        struct netdev_notifier_info info;
+
+        netdev_notifier_info_init(&info, dev);
+        return nb->notifier_call(nb, val, &info);
+}
 
 static int dev_boot_phase = 1;
 
@@ -1430,7 +1473,7 @@ int register_netdevice_notifier(struct notifier_block *nb)
                 goto unlock;
         for_each_net(net) {
                 for_each_netdev(net, dev) {
-                        err = nb->notifier_call(nb, NETDEV_REGISTER, dev);
+                        err = call_netdevice_notifier(nb, NETDEV_REGISTER, dev);
                         err = notifier_to_errno(err);
                         if (err)
                                 goto rollback;
@@ -1438,7 +1481,7 @@ int register_netdevice_notifier(struct notifier_block *nb)
                         if (!(dev->flags & IFF_UP))
                                 continue;
 
-                        nb->notifier_call(nb, NETDEV_UP, dev);
+                        call_netdevice_notifier(nb, NETDEV_UP, dev);
                 }
         }
 
@@ -1454,10 +1497,11 @@ rollback:
                                 goto outroll;
 
                         if (dev->flags & IFF_UP) {
-                                nb->notifier_call(nb, NETDEV_GOING_DOWN, dev);
-                                nb->notifier_call(nb, NETDEV_DOWN, dev);
+                                call_netdevice_notifier(nb, NETDEV_GOING_DOWN,
+                                                        dev);
+                                call_netdevice_notifier(nb, NETDEV_DOWN, dev);
                         }
-                        nb->notifier_call(nb, NETDEV_UNREGISTER, dev);
+                        call_netdevice_notifier(nb, NETDEV_UNREGISTER, dev);
                 }
         }
 
@@ -1495,10 +1539,11 @@ int unregister_netdevice_notifier(struct notifier_block *nb)
         for_each_net(net) {
                 for_each_netdev(net, dev) {
                         if (dev->flags & IFF_UP) {
-                                nb->notifier_call(nb, NETDEV_GOING_DOWN, dev);
-                                nb->notifier_call(nb, NETDEV_DOWN, dev);
+                                call_netdevice_notifier(nb, NETDEV_GOING_DOWN,
+                                                        dev);
+                                call_netdevice_notifier(nb, NETDEV_DOWN, dev);
                         }
-                        nb->notifier_call(nb, NETDEV_UNREGISTER, dev);
+                        call_netdevice_notifier(nb, NETDEV_UNREGISTER, dev);
                 }
         }
 unlock:
@@ -1508,6 +1553,25 @@ unlock:
 EXPORT_SYMBOL(unregister_netdevice_notifier);
 
 /**
+ *      call_netdevice_notifiers_info - call all network notifier blocks
+ *      @val: value passed unmodified to notifier function
+ *      @dev: net_device pointer passed unmodified to notifier function
+ *      @info: notifier information data
+ *
+ *      Call all network notifier blocks.  Parameters and return value
+ *      are as for raw_notifier_call_chain().
+ */
+
+int call_netdevice_notifiers_info(unsigned long val, struct net_device *dev,
+                                  struct netdev_notifier_info *info)
+{
+        ASSERT_RTNL();
+        netdev_notifier_info_init(info, dev);
+        return raw_notifier_call_chain(&netdev_chain, val, info);
+}
+EXPORT_SYMBOL(call_netdevice_notifiers_info);
+
+/**
  *      call_netdevice_notifiers - call all network notifier blocks
  *      @val: value passed unmodified to notifier function
  *      @dev: net_device pointer passed unmodified to notifier function
@@ -1518,8 +1582,9 @@ EXPORT_SYMBOL(unregister_netdevice_notifier);
 
 int call_netdevice_notifiers(unsigned long val, struct net_device *dev)
 {
-        ASSERT_RTNL();
-        return raw_notifier_call_chain(&netdev_chain, val, dev);
+        struct netdev_notifier_info info;
+
+        return call_netdevice_notifiers_info(val, dev, &info);
 }
 EXPORT_SYMBOL(call_netdevice_notifiers);
 
@@ -1621,23 +1686,19 @@ int dev_forward_skb(struct net_device *dev, struct sk_buff *skb)
                 }
         }
 
-        skb_orphan(skb);
-
         if (unlikely(!is_skb_forwardable(dev, skb))) {
                 atomic_long_inc(&dev->rx_dropped);
                 kfree_skb(skb);
                 return NET_RX_DROP;
         }
-        skb->skb_iif = 0;
-        skb->dev = dev;
-        skb_dst_drop(skb);
-        skb->tstamp.tv64 = 0;
-        skb->pkt_type = PACKET_HOST;
         skb->protocol = eth_type_trans(skb, dev);
-        skb->mark = 0;
-        secpath_reset(skb);
-        nf_reset(skb);
-        nf_reset_trace(skb);
+
+        /* eth_type_trans() can set pkt_type.
+         * call skb_scrub_packet() after it to clear pkt_type _after_ calling
+         * eth_type_trans().
+         */
+        skb_scrub_packet(skb, true);
+
         return netif_rx(skb);
 }
 EXPORT_SYMBOL_GPL(dev_forward_skb);
@@ -1702,7 +1763,7 @@ static void dev_queue_xmit_nit(struct sk_buff *skb, struct net_device *dev)
                         skb_reset_mac_header(skb2);
 
                         if (skb_network_header(skb2) < skb2->data ||
-                            skb2->network_header > skb2->tail) {
+                            skb_network_header(skb2) > skb_tail_pointer(skb2)) {
                                 net_crit_ratelimited("protocol %04x is buggy, dev %s\n",
                                                      ntohs(skb2->protocol),
                                                      dev->name);
@@ -2420,10 +2481,10 @@ static int dev_gso_segment(struct sk_buff *skb, netdev_features_t features)
 }
 
 static netdev_features_t harmonize_features(struct sk_buff *skb,
-        __be16 protocol, netdev_features_t features)
+        netdev_features_t features)
 {
         if (skb->ip_summed != CHECKSUM_NONE &&
-            !can_checksum_protocol(features, protocol)) {
+            !can_checksum_protocol(features, skb_network_protocol(skb))) {
                 features &= ~NETIF_F_ALL_CSUM;
         } else if (illegal_highdma(skb->dev, skb)) {
                 features &= ~NETIF_F_SG;
@@ -2444,20 +2505,18 @@ netdev_features_t netif_skb_features(struct sk_buff *skb)
                 struct vlan_ethhdr *veh = (struct vlan_ethhdr *)skb->data;
                 protocol = veh->h_vlan_encapsulated_proto;
         } else if (!vlan_tx_tag_present(skb)) {
-                return harmonize_features(skb, protocol, features);
+                return harmonize_features(skb, features);
         }
 
         features &= (skb->dev->vlan_features | NETIF_F_HW_VLAN_CTAG_TX |
                                                NETIF_F_HW_VLAN_STAG_TX);
 
-        if (protocol != htons(ETH_P_8021Q) && protocol != htons(ETH_P_8021AD)) {
-                return harmonize_features(skb, protocol, features);
-        } else {
+        if (protocol == htons(ETH_P_8021Q) || protocol == htons(ETH_P_8021AD))
                 features &= NETIF_F_SG | NETIF_F_HIGHDMA | NETIF_F_FRAGLIST |
                                 NETIF_F_GEN_CSUM | NETIF_F_HW_VLAN_CTAG_TX |
                                 NETIF_F_HW_VLAN_STAG_TX;
-                return harmonize_features(skb, protocol, features);
-        }
+
+        return harmonize_features(skb, features);
 }
 EXPORT_SYMBOL(netif_skb_features);
 
@@ -3065,6 +3124,46 @@ static int rps_ipi_queued(struct softnet_data *sd)
         return 0;
 }
 
+#ifdef CONFIG_NET_FLOW_LIMIT
+int netdev_flow_limit_table_len __read_mostly = (1 << 12);
+#endif
+
+static bool skb_flow_limit(struct sk_buff *skb, unsigned int qlen)
+{
+#ifdef CONFIG_NET_FLOW_LIMIT
+        struct sd_flow_limit *fl;
+        struct softnet_data *sd;
+        unsigned int old_flow, new_flow;
+
+        if (qlen < (netdev_max_backlog >> 1))
+                return false;
+
+        sd = &__get_cpu_var(softnet_data);
+
+        rcu_read_lock();
+        fl = rcu_dereference(sd->flow_limit);
+        if (fl) {
+                new_flow = skb_get_rxhash(skb) & (fl->num_buckets - 1);
+                old_flow = fl->history[fl->history_head];
+                fl->history[fl->history_head] = new_flow;
+
+                fl->history_head++;
+                fl->history_head &= FLOW_LIMIT_HISTORY - 1;
+
+                if (likely(fl->buckets[old_flow]))
+                        fl->buckets[old_flow]--;
+
+                if (++fl->buckets[new_flow] > (FLOW_LIMIT_HISTORY >> 1)) {
+                        fl->count++;
+                        rcu_read_unlock();
+                        return true;
+                }
+        }
+        rcu_read_unlock();
+#endif
+        return false;
+}
+
 /*
  * enqueue_to_backlog is called to queue an skb to a per CPU backlog
  * queue (may be a remote CPU queue).
@@ -3074,13 +3173,15 @@ static int enqueue_to_backlog(struct sk_buff *skb, int cpu,
 {
         struct softnet_data *sd;
         unsigned long flags;
+        unsigned int qlen;
 
         sd = &per_cpu(softnet_data, cpu);
 
         local_irq_save(flags);
 
         rps_lock(sd);
-        if (skb_queue_len(&sd->input_pkt_queue) <= netdev_max_backlog) {
+        qlen = skb_queue_len(&sd->input_pkt_queue);
+        if (qlen <= netdev_max_backlog && !skb_flow_limit(skb, qlen)) {
                 if (skb_queue_len(&sd->input_pkt_queue)) {
 enqueue:
                         __skb_queue_tail(&sd->input_pkt_queue, skb);
@@ -3479,8 +3580,15 @@ ncls:
                 }
         }
 
-        if (vlan_tx_nonzero_tag_present(skb))
-                skb->pkt_type = PACKET_OTHERHOST;
+        if (unlikely(vlan_tx_tag_present(skb))) {
+                if (vlan_tx_tag_get_id(skb))
+                        skb->pkt_type = PACKET_OTHERHOST;
+                /* Note: we might in the future use prio bits
+                 * and set skb->priority like in vlan_do_receive()
+                 * For the time being, just ignore Priority Code Point
+                 */
+                skb->vlan_tci = 0;
+        }
 
         /* deliver only exact match when indicated */
         null_or_dev = deliver_exact ? skb->dev : NULL;
@@ -3828,7 +3936,7 @@ static void skb_gro_reset_offset(struct sk_buff *skb)
         NAPI_GRO_CB(skb)->frag0 = NULL;
         NAPI_GRO_CB(skb)->frag0_len = 0;
 
-        if (skb->mac_header == skb->tail &&
+        if (skb_mac_header(skb) == skb_tail_pointer(skb) &&
             pinfo->nr_frags &&
             !PageHighMem(skb_frag_page(frag0))) {
                 NAPI_GRO_CB(skb)->frag0 = skb_frag_address(frag0);
@@ -4072,6 +4180,58 @@ void napi_complete(struct napi_struct *n)
 }
 EXPORT_SYMBOL(napi_complete);
 
+/* must be called under rcu_read_lock(), as we dont take a reference */
+struct napi_struct *napi_by_id(unsigned int napi_id)
+{
+        unsigned int hash = napi_id % HASH_SIZE(napi_hash);
+        struct napi_struct *napi;
+
+        hlist_for_each_entry_rcu(napi, &napi_hash[hash], napi_hash_node)
+                if (napi->napi_id == napi_id)
+                        return napi;
+
+        return NULL;
+}
+EXPORT_SYMBOL_GPL(napi_by_id);
+
+void napi_hash_add(struct napi_struct *napi)
+{
+        if (!test_and_set_bit(NAPI_STATE_HASHED, &napi->state)) {
+
+                spin_lock(&napi_hash_lock);
+
+                /* 0 is not a valid id, we also skip an id that is taken
+                 * we expect both events to be extremely rare
+                 */
+                napi->napi_id = 0;
+                while (!napi->napi_id) {
+                        napi->napi_id = ++napi_gen_id;
+                        if (napi_by_id(napi->napi_id))
+                                napi->napi_id = 0;
+                }
+
+                hlist_add_head_rcu(&napi->napi_hash_node,
+                        &napi_hash[napi->napi_id % HASH_SIZE(napi_hash)]);
+
+                spin_unlock(&napi_hash_lock);
+        }
+}
+EXPORT_SYMBOL_GPL(napi_hash_add);
+
+/* Warning : caller is responsible to make sure rcu grace period
+ * is respected before freeing memory containing @napi
+ */
+void napi_hash_del(struct napi_struct *napi)
+{
+        spin_lock(&napi_hash_lock);
+
+        if (test_and_clear_bit(NAPI_STATE_HASHED, &napi->state))
+                hlist_del_rcu(&napi->napi_hash_node);
+
+        spin_unlock(&napi_hash_lock);
+}
+EXPORT_SYMBOL_GPL(napi_hash_del);
+
 void netif_napi_add(struct net_device *dev, struct napi_struct *napi,
                     int (*poll)(struct napi_struct *, int), int weight)
 {
@@ -4207,57 +4367,48 @@ softnet_break:
         goto out;
 }
 
-struct netdev_upper {
+struct netdev_adjacent {
         struct net_device *dev;
+
+        /* upper master flag, there can only be one master device per list */
         bool master;
+
+        /* indicates that this dev is our first-level lower/upper device */
+        bool neighbour;
+
+        /* counter for the number of times this device was added to us */
+        u16 ref_nr;
+
         struct list_head list;
         struct rcu_head rcu;
-        struct list_head search_list;
 };
 
-static void __append_search_uppers(struct list_head *search_list,
-                                   struct net_device *dev)
+static struct netdev_adjacent *__netdev_find_adj(struct net_device *dev,
+                                                 struct net_device *adj_dev,
+                                                 bool upper)
 {
-        struct netdev_upper *upper;
+        struct netdev_adjacent *adj;
+        struct list_head *dev_list;
 
-        list_for_each_entry(upper, &dev->upper_dev_list, list) {
-                /* check if this upper is not already in search list */
-                if (list_empty(&upper->search_list))
-                        list_add_tail(&upper->search_list, search_list);
+        dev_list = upper ? &dev->upper_dev_list : &dev->lower_dev_list;
+
+        list_for_each_entry(adj, dev_list, list) {
+                if (adj->dev == adj_dev)
+                        return adj;
         }
+        return NULL;
 }
 
-static bool __netdev_search_upper_dev(struct net_device *dev,
-                                      struct net_device *upper_dev)
+static inline struct netdev_adjacent *__netdev_find_upper(struct net_device *dev,
+                                                          struct net_device *udev)
 {
-        LIST_HEAD(search_list);
-        struct netdev_upper *upper;
-        struct netdev_upper *tmp;
-        bool ret = false;
-
-        __append_search_uppers(&search_list, dev);
-        list_for_each_entry(upper, &search_list, search_list) {
-                if (upper->dev == upper_dev) {
-                        ret = true;
-                        break;
-                }
-                __append_search_uppers(&search_list, upper->dev);
-        }
-        list_for_each_entry_safe(upper, tmp, &search_list, search_list)
-                INIT_LIST_HEAD(&upper->search_list);
-        return ret;
+        return __netdev_find_adj(dev, udev, true);
 }
 
-static struct netdev_upper *__netdev_find_upper(struct net_device *dev,
-                                                struct net_device *upper_dev)
+static inline struct netdev_adjacent *__netdev_find_lower(struct net_device *dev,
+                                                          struct net_device *ldev)
 {
-        struct netdev_upper *upper;
-
-        list_for_each_entry(upper, &dev->upper_dev_list, list) {
-                if (upper->dev == upper_dev)
-                        return upper;
-        }
-        return NULL;
+        return __netdev_find_adj(dev, ldev, false);
 }
 
 /**
@@ -4302,7 +4453,7 @@ EXPORT_SYMBOL(netdev_has_any_upper_dev);
  */
 struct net_device *netdev_master_upper_dev_get(struct net_device *dev)
 {
-        struct netdev_upper *upper;
+        struct netdev_adjacent *upper;
 
         ASSERT_RTNL();
 
@@ -4310,13 +4461,38 @@ struct net_device *netdev_master_upper_dev_get(struct net_device *dev)
                 return NULL;
 
         upper = list_first_entry(&dev->upper_dev_list,
-                                 struct netdev_upper, list);
+                                 struct netdev_adjacent, list);
         if (likely(upper->master))
                 return upper->dev;
         return NULL;
 }
 EXPORT_SYMBOL(netdev_master_upper_dev_get);
 
+/* netdev_upper_get_next_dev_rcu - Get the next dev from upper list
+ * @dev: device
+ * @iter: list_head ** of the current position
+ *
+ * Gets the next device from the dev's upper list, starting from iter
+ * position. The caller must hold RCU read lock.
+ */
+struct net_device *netdev_upper_get_next_dev_rcu(struct net_device *dev,
+                                                 struct list_head **iter)
+{
+        struct netdev_adjacent *upper;
+
+        WARN_ON_ONCE(!rcu_read_lock_held());
+
+        upper = list_entry_rcu((*iter)->next, struct netdev_adjacent, list);
+
+        if (&upper->list == &dev->upper_dev_list)
+                return NULL;
+
+        *iter = &upper->list;
+
+        return upper->dev;
+}
+EXPORT_SYMBOL(netdev_upper_get_next_dev_rcu);
+
 /**
  * netdev_master_upper_dev_get_rcu - Get master upper device
  * @dev: device
@@ -4326,20 +4502,158 @@ EXPORT_SYMBOL(netdev_master_upper_dev_get);
  */
 struct net_device *netdev_master_upper_dev_get_rcu(struct net_device *dev)
 {
-        struct netdev_upper *upper;
+        struct netdev_adjacent *upper;
 
         upper = list_first_or_null_rcu(&dev->upper_dev_list,
-                                       struct netdev_upper, list);
+                                       struct netdev_adjacent, list);
         if (upper && likely(upper->master))
                 return upper->dev;
         return NULL;
 }
 EXPORT_SYMBOL(netdev_master_upper_dev_get_rcu);
 
+static int __netdev_adjacent_dev_insert(struct net_device *dev,
+                                        struct net_device *adj_dev,
+                                        bool neighbour, bool master,
+                                        bool upper)
+{
+        struct netdev_adjacent *adj;
+
+        adj = __netdev_find_adj(dev, adj_dev, upper);
+
+        if (adj) {
+                BUG_ON(neighbour);
+                adj->ref_nr++;
+                return 0;
+        }
+
+        adj = kmalloc(sizeof(*adj), GFP_KERNEL);
+        if (!adj)
+                return -ENOMEM;
+
+        adj->dev = adj_dev;
+        adj->master = master;
+        adj->neighbour = neighbour;
+        adj->ref_nr = 1;
+
+        dev_hold(adj_dev);
+        pr_debug("dev_hold for %s, because of %s link added from %s to %s\n",
+                 adj_dev->name, upper ? "upper" : "lower", dev->name,
+                 adj_dev->name);
+
+        if (!upper) {
+                list_add_tail_rcu(&adj->list, &dev->lower_dev_list);
+                return 0;
+        }
+
+        /* Ensure that master upper link is always the first item in list. */
+        if (master)
+                list_add_rcu(&adj->list, &dev->upper_dev_list);
+        else
+                list_add_tail_rcu(&adj->list, &dev->upper_dev_list);
+
+        return 0;
+}
+
+static inline int __netdev_upper_dev_insert(struct net_device *dev,
+                                            struct net_device *udev,
+                                            bool master, bool neighbour)
+{
+        return __netdev_adjacent_dev_insert(dev, udev, neighbour, master,
+                                            true);
+}
+
+static inline int __netdev_lower_dev_insert(struct net_device *dev,
+                                            struct net_device *ldev,
+                                            bool neighbour)
+{
+        return __netdev_adjacent_dev_insert(dev, ldev, neighbour, false,
+                                            false);
+}
+
+void __netdev_adjacent_dev_remove(struct net_device *dev,
+                                  struct net_device *adj_dev, bool upper)
+{
+        struct netdev_adjacent *adj;
+
+        if (upper)
+                adj = __netdev_find_upper(dev, adj_dev);
+        else
+                adj = __netdev_find_lower(dev, adj_dev);
+
+        if (!adj)
+                BUG();
+
+        if (adj->ref_nr > 1) {
+                adj->ref_nr--;
+                return;
+        }
+
+        list_del_rcu(&adj->list);
+        pr_debug("dev_put for %s, because of %s link removed from %s to %s\n",
+                 adj_dev->name, upper ? "upper" : "lower", dev->name,
+                 adj_dev->name);
+        dev_put(adj_dev);
+        kfree_rcu(adj, rcu);
+}
+
+static inline void __netdev_upper_dev_remove(struct net_device *dev,
+                                             struct net_device *udev)
+{
+        return __netdev_adjacent_dev_remove(dev, udev, true);
+}
+
+static inline void __netdev_lower_dev_remove(struct net_device *dev,
+                                             struct net_device *ldev)
+{
+        return __netdev_adjacent_dev_remove(dev, ldev, false);
+}
+
+int __netdev_adjacent_dev_insert_link(struct net_device *dev,
+                                      struct net_device *upper_dev,
+                                      bool master, bool neighbour)
+{
+        int ret;
+
+        ret = __netdev_upper_dev_insert(dev, upper_dev, master, neighbour);
+        if (ret)
+                return ret;
+
+        ret = __netdev_lower_dev_insert(upper_dev, dev, neighbour);
+        if (ret) {
+                __netdev_upper_dev_remove(dev, upper_dev);
+                return ret;
+        }
+
+        return 0;
+}
+
+static inline int __netdev_adjacent_dev_link(struct net_device *dev,
+                                             struct net_device *udev)
+{
+        return __netdev_adjacent_dev_insert_link(dev, udev, false, false);
+}
+
+static inline int __netdev_adjacent_dev_link_neighbour(struct net_device *dev,
+                                                       struct net_device *udev,
+                                                       bool master)
+{
+        return __netdev_adjacent_dev_insert_link(dev, udev, master, true);
+}
+
+void __netdev_adjacent_dev_unlink(struct net_device *dev,
+                                  struct net_device *upper_dev)
+{
+        __netdev_upper_dev_remove(dev, upper_dev);
+        __netdev_lower_dev_remove(upper_dev, dev);
+}
+
+
 static int __netdev_upper_dev_link(struct net_device *dev,
                                    struct net_device *upper_dev, bool master)
 {
-        struct netdev_upper *upper;
+        struct netdev_adjacent *i, *j, *to_i, *to_j;
+        int ret = 0;
 
         ASSERT_RTNL();
 
@@ -4347,7 +4661,7 @@ static int __netdev_upper_dev_link(struct net_device *dev,
                 return -EBUSY;
 
         /* To prevent loops, check if dev is not upper device to upper_dev. */
-        if (__netdev_search_upper_dev(upper_dev, dev))
+        if (__netdev_find_upper(upper_dev, dev))
                 return -EBUSY;
 
         if (__netdev_find_upper(dev, upper_dev))
@@ -4356,22 +4670,76 @@ static int __netdev_upper_dev_link(struct net_device *dev,
         if (master && netdev_master_upper_dev_get(dev))
                 return -EBUSY;
 
-        upper = kmalloc(sizeof(*upper), GFP_KERNEL);
-        if (!upper)
-                return -ENOMEM;
+        ret = __netdev_adjacent_dev_link_neighbour(dev, upper_dev, master);
+        if (ret)
+                return ret;
 
-        upper->dev = upper_dev;
-        upper->master = master;
-        INIT_LIST_HEAD(&upper->search_list);
+        /* Now that we linked these devs, make all the upper_dev's
+         * upper_dev_list visible to every dev's lower_dev_list and vice
+         * versa, and don't forget the devices itself. All of these
+         * links are non-neighbours.
+         */
+        list_for_each_entry(i, &dev->lower_dev_list, list) {
+                list_for_each_entry(j, &upper_dev->upper_dev_list, list) {
+                        ret = __netdev_adjacent_dev_link(i->dev, j->dev);
+                        if (ret)
+                                goto rollback_mesh;
+                }
+        }
 
-        /* Ensure that master upper link is always the first item in list. */
-        if (master)
-                list_add_rcu(&upper->list, &dev->upper_dev_list);
-        else
-                list_add_tail_rcu(&upper->list, &dev->upper_dev_list);
-        dev_hold(upper_dev);
+        /* add dev to every upper_dev's upper device */
+        list_for_each_entry(i, &upper_dev->upper_dev_list, list) {
+                ret = __netdev_adjacent_dev_link(dev, i->dev);
+                if (ret)
+                        goto rollback_upper_mesh;
+        }
 
+        /* add upper_dev to every dev's lower device */
+        list_for_each_entry(i, &dev->lower_dev_list, list) {
+                ret = __netdev_adjacent_dev_link(i->dev, upper_dev);
+                if (ret)
+                        goto rollback_lower_mesh;
+        }
+
+        call_netdevice_notifiers(NETDEV_CHANGEUPPER, dev);
         return 0;
+
+rollback_lower_mesh:
+        to_i = i;
+        list_for_each_entry(i, &dev->lower_dev_list, list) {
+                if (i == to_i)
+                        break;
+                __netdev_adjacent_dev_unlink(i->dev, upper_dev);
+        }
+
+        i = NULL;
+
+rollback_upper_mesh:
+        to_i = i;
+        list_for_each_entry(i, &upper_dev->upper_dev_list, list) {
+                if (i == to_i)
+                        break;
+                __netdev_adjacent_dev_unlink(dev, i->dev);
+        }
+
+        i = j = NULL;
+
+rollback_mesh:
+        to_i = i;
+        to_j = j;
+        list_for_each_entry(i, &dev->lower_dev_list, list) {
+                list_for_each_entry(j, &upper_dev->upper_dev_list, list) {
+                        if (i == to_i && j == to_j)
+                                break;
+                        __netdev_adjacent_dev_unlink(i->dev, j->dev);
+                }
+                if (i == to_i)
+                        break;
+        }
+
+        __netdev_adjacent_dev_unlink(dev, upper_dev);
+
+        return ret;
 }
 
 /**
@@ -4420,16 +4788,29 @@ EXPORT_SYMBOL(netdev_master_upper_dev_link);
 void netdev_upper_dev_unlink(struct net_device *dev,
                              struct net_device *upper_dev)
 {
-        struct netdev_upper *upper;
-
+        struct netdev_adjacent *i, *j;
         ASSERT_RTNL();
 
-        upper = __netdev_find_upper(dev, upper_dev);
-        if (!upper)
-                return;
-        list_del_rcu(&upper->list);
-        dev_put(upper_dev);
-        kfree_rcu(upper, rcu);
+        __netdev_adjacent_dev_unlink(dev, upper_dev);
+
+        /* Here is the tricky part. We must remove all dev's lower
+         * devices from all upper_dev's upper devices and vice
+         * versa, to maintain the graph relationship.
+         */
+        list_for_each_entry(i, &dev->lower_dev_list, list)
+                list_for_each_entry(j, &upper_dev->upper_dev_list, list)
+                        __netdev_adjacent_dev_unlink(i->dev, j->dev);
+
+        /* remove also the devices itself from lower/upper device
+         * list
+         */
+        list_for_each_entry(i, &dev->lower_dev_list, list)
+                __netdev_adjacent_dev_unlink(i->dev, upper_dev);
+
+        list_for_each_entry(i, &upper_dev->upper_dev_list, list)
+                __netdev_adjacent_dev_unlink(dev, i->dev);
+
+        call_netdevice_notifiers(NETDEV_CHANGEUPPER, dev);
 }
 EXPORT_SYMBOL(netdev_upper_dev_unlink);
 
@@ -4700,8 +5081,13 @@ void __dev_notify_flags(struct net_device *dev, unsigned int old_flags)
         }
 
         if (dev->flags & IFF_UP &&
-            (changes & ~(IFF_UP | IFF_PROMISC | IFF_ALLMULTI | IFF_VOLATILE)))
-                call_netdevice_notifiers(NETDEV_CHANGE, dev);
+            (changes & ~(IFF_UP | IFF_PROMISC | IFF_ALLMULTI | IFF_VOLATILE))) {
+                struct netdev_notifier_change_info change_info;
+
+                change_info.flags_changed = changes;
+                call_netdevice_notifiers_info(NETDEV_CHANGE, dev,
+                                              &change_info.info);
+        }
 }
 
 /**
@@ -4823,6 +5209,24 @@ int dev_change_carrier(struct net_device *dev, bool new_carrier)
 EXPORT_SYMBOL(dev_change_carrier);
 
 /**
+ *      dev_get_phys_port_id - Get device physical port ID
+ *      @dev: device
+ *      @ppid: port ID
+ *
+ *      Get device physical port ID
+ */
+int dev_get_phys_port_id(struct net_device *dev,
+                         struct netdev_phys_port_id *ppid)
+{
+        const struct net_device_ops *ops = dev->netdev_ops;
+
+        if (!ops->ndo_get_phys_port_id)
+                return -EOPNOTSUPP;
+        return ops->ndo_get_phys_port_id(dev, ppid);
+}
+EXPORT_SYMBOL(dev_get_phys_port_id);
+
+/**
  *      dev_new_index   -       allocate an ifindex
  *      @net: the applicable net namespace
  *
@@ -4843,10 +5247,12 @@ static int dev_new_index(struct net *net)
 
 /* Delayed registration/unregisteration */
 static LIST_HEAD(net_todo_list);
+static DECLARE_WAIT_QUEUE_HEAD(netdev_unregistering_wq);
 
 static void net_set_todo(struct net_device *dev)
 {
         list_add_tail(&dev->todo_list, &net_todo_list);
+        dev_net(dev)->dev_unreg_count++;
 }
 
 static void rollback_registered_many(struct list_head *head)
@@ -5124,17 +5530,28 @@ static void netdev_init_one_queue(struct net_device *dev,
 #endif
 }
 
+static void netif_free_tx_queues(struct net_device *dev)
+{
+        if (is_vmalloc_addr(dev->_tx))
+                vfree(dev->_tx);
+        else
+                kfree(dev->_tx);
+}
+
 static int netif_alloc_netdev_queues(struct net_device *dev)
 {
         unsigned int count = dev->num_tx_queues;
         struct netdev_queue *tx;
+        size_t sz = count * sizeof(*tx);
 
-        BUG_ON(count < 1);
-
-        tx = kcalloc(count, sizeof(struct netdev_queue), GFP_KERNEL);
-        if (!tx)
-                return -ENOMEM;
+        BUG_ON(count < 1 || count > 0xffff);
 
+        tx = kzalloc(sz, GFP_KERNEL | __GFP_NOWARN | __GFP_REPEAT);
+        if (!tx) {
+                tx = vzalloc(sz);
+                if (!tx)
+                        return -ENOMEM;
+        }
         dev->_tx = tx;
 
         netdev_for_each_tx_queue(dev, netdev_init_one_queue, NULL);
@@ -5235,6 +5652,10 @@ int register_netdevice(struct net_device *dev)
          */
         dev->hw_enc_features |= NETIF_F_SG;
 
+        /* Make NETIF_F_SG inheritable to MPLS.
+         */
+        dev->mpls_features |= NETIF_F_SG;
+
         ret = call_netdevice_notifiers(NETDEV_POST_INIT, dev);
         ret = notifier_to_errno(ret);
         if (ret)
@@ -5499,6 +5920,12 @@ void netdev_run_todo(void)
                 if (dev->destructor)
                         dev->destructor(dev);
 
+                /* Report a network device has been unregistered */
+                rtnl_lock();
+                dev_net(dev)->dev_unreg_count--;
+                __rtnl_unlock();
+                wake_up(&netdev_unregistering_wq);
+
                 /* Free network device */
                 kobject_put(&dev->dev.kobj);
         }
@@ -5651,6 +6078,7 @@ struct net_device *alloc_netdev_mqs(int sizeof_priv, const char *name,
         INIT_LIST_HEAD(&dev->unreg_list);
         INIT_LIST_HEAD(&dev->link_watch_list);
         INIT_LIST_HEAD(&dev->upper_dev_list);
+        INIT_LIST_HEAD(&dev->lower_dev_list);
         dev->priv_flags = IFF_XMIT_DST_RELEASE;
         setup(dev);
 
@@ -5678,7 +6106,7 @@ free_all:
 
 free_pcpu:
         free_percpu(dev->pcpu_refcnt);
-        kfree(dev->_tx);
+        netif_free_tx_queues(dev);
 #ifdef CONFIG_RPS
         kfree(dev->_rx);
 #endif
@@ -5703,7 +6131,7 @@ void free_netdev(struct net_device *dev)
 
         release_net(dev_net(dev));
 
-        kfree(dev->_tx);
+        netif_free_tx_queues(dev);
 #ifdef CONFIG_RPS
         kfree(dev->_rx);
 #endif
@@ -6014,7 +6442,7 @@ netdev_features_t netdev_increment_features(netdev_features_t all,
 }
 EXPORT_SYMBOL(netdev_increment_features);
 
-static struct hlist_head *netdev_create_hash(void)
+static struct hlist_head * __net_init netdev_create_hash(void)
 {
         int i;
         struct hlist_head *hash;
@@ -6183,6 +6611,34 @@ static void __net_exit default_device_exit(struct net *net)
         rtnl_unlock();
 }
 
+static void __net_exit rtnl_lock_unregistering(struct list_head *net_list)
+{
+        /* Return with the rtnl_lock held when there are no network
+         * devices unregistering in any network namespace in net_list.
+         */
+        struct net *net;
+        bool unregistering;
+        DEFINE_WAIT(wait);
+
+        for (;;) {
+                prepare_to_wait(&netdev_unregistering_wq, &wait,
+                                TASK_UNINTERRUPTIBLE);
+                unregistering = false;
+                rtnl_lock();
+                list_for_each_entry(net, net_list, exit_list) {
+                        if (net->dev_unreg_count > 0) {
+                                unregistering = true;
+                                break;
+                        }
+                }
+                if (!unregistering)
+                        break;
+                __rtnl_unlock();
+                schedule();
+        }
+        finish_wait(&netdev_unregistering_wq, &wait);
+}
+
 static void __net_exit default_device_exit_batch(struct list_head *net_list)
 {
         /* At exit all network devices most be removed from a network
@@ -6194,7 +6650,18 @@ static void __net_exit default_device_exit_batch(struct list_head *net_list)
         struct net *net;
         LIST_HEAD(dev_kill_list);
 
-        rtnl_lock();
+        /* To prevent network device cleanup code from dereferencing
+         * loopback devices or network devices that have been freed
+         * wait here for all pending unregistrations to complete,
+         * before unregistring the loopback device and allowing the
+         * network namespace be freed.
+         *
+         * The netdev todo list containing all network devices
+         * unregistrations that happen in default_device_exit_batch
+         * will run in the rtnl_unlock() at the end of
+         * default_device_exit_batch.
+         */
+        rtnl_lock_unregistering(net_list);
         list_for_each_entry(net, net_list, exit_list) {
                 for_each_netdev_reverse(net, dev) {
                         if (dev->rtnl_link_ops)
@@ -6270,6 +6737,10 @@ static int __init net_dev_init(void)
                 sd->backlog.weight = weight_p;
                 sd->backlog.gro_list = NULL;
                 sd->backlog.gro_count = 0;
+
+#ifdef CONFIG_NET_FLOW_LIMIT
+                sd->flow_limit = NULL;
+#endif
         }
 
         dev_boot_phase = 0;
diff --git a/net/core/dev_ioctl.c b/net/core/dev_ioctl.c
index 6cc0481faade..5b7d0e1d0664 100644
--- a/net/core/dev_ioctl.c
+++ b/net/core/dev_ioctl.c
@@ -19,9 +19,8 @@
 
 static int dev_ifname(struct net *net, struct ifreq __user *arg)
 {
-        struct net_device *dev;
         struct ifreq ifr;
-        unsigned seq;
+        int error;
 
         /*
          *      Fetch the caller's info block.
@@ -30,19 +29,9 @@ static int dev_ifname(struct net *net, struct ifreq __user *arg)
         if (copy_from_user(&ifr, arg, sizeof(struct ifreq)))
                 return -EFAULT;
 
-retry:
-        seq = read_seqcount_begin(&devnet_rename_seq);
-        rcu_read_lock();
-        dev = dev_get_by_index_rcu(net, ifr.ifr_ifindex);
-        if (!dev) {
-                rcu_read_unlock();
-                return -ENODEV;
-        }
-
-        strcpy(ifr.ifr_name, dev->name);
-        rcu_read_unlock();
-        if (read_seqcount_retry(&devnet_rename_seq, seq))
-                goto retry;
+        error = netdev_get_name(net, ifr.ifr_name, ifr.ifr_ifindex);
+        if (error)
+                return error;
 
         if (copy_to_user(arg, &ifr, sizeof(struct ifreq)))
                 return -EFAULT;
diff --git a/net/core/drop_monitor.c b/net/core/drop_monitor.c
index d23b6682f4e9..5e78d44333b9 100644
--- a/net/core/drop_monitor.c
+++ b/net/core/drop_monitor.c
@@ -295,9 +295,9 @@ static int net_dm_cmd_trace(struct sk_buff *skb,
 }
 
 static int dropmon_net_event(struct notifier_block *ev_block,
-                        unsigned long event, void *ptr)
+                             unsigned long event, void *ptr)
 {
-        struct net_device *dev = ptr;
+        struct net_device *dev = netdev_notifier_info_to_dev(ptr);
         struct dm_hw_stat_delta *new_stat = NULL;
         struct dm_hw_stat_delta *tmp;
 
diff --git a/net/core/dst.c b/net/core/dst.c
index df9cc810ec8e..ca4231ec7347 100644
--- a/net/core/dst.c
+++ b/net/core/dst.c
@@ -372,7 +372,7 @@ static void dst_ifdown(struct dst_entry *dst, struct net_device *dev,
 static int dst_dev_event(struct notifier_block *this, unsigned long event,
                          void *ptr)
 {
-        struct net_device *dev = ptr;
+        struct net_device *dev = netdev_notifier_info_to_dev(ptr);
         struct dst_entry *dst, *last = NULL;
 
         switch (event) {
diff --git a/net/core/ethtool.c b/net/core/ethtool.c
index 22efdaa76ebf..78e9d9223e40 100644
--- a/net/core/ethtool.c
+++ b/net/core/ethtool.c
@@ -60,10 +60,10 @@ static const char netdev_features_strings[NETDEV_FEATURE_COUNT][ETH_GSTRING_LEN]
         [NETIF_F_IPV6_CSUM_BIT] =        "tx-checksum-ipv6",
         [NETIF_F_HIGHDMA_BIT] =          "highdma",
         [NETIF_F_FRAGLIST_BIT] =         "tx-scatter-gather-fraglist",
-        [NETIF_F_HW_VLAN_CTAG_TX_BIT] =  "tx-vlan-ctag-hw-insert",
+        [NETIF_F_HW_VLAN_CTAG_TX_BIT] =  "tx-vlan-hw-insert",
 
-        [NETIF_F_HW_VLAN_CTAG_RX_BIT] =  "rx-vlan-ctag-hw-parse",
-        [NETIF_F_HW_VLAN_CTAG_FILTER_BIT] = "rx-vlan-ctag-filter",
+        [NETIF_F_HW_VLAN_CTAG_RX_BIT] =  "rx-vlan-hw-parse",
+        [NETIF_F_HW_VLAN_CTAG_FILTER_BIT] = "rx-vlan-filter",
         [NETIF_F_HW_VLAN_STAG_TX_BIT] =  "tx-vlan-stag-hw-insert",
         [NETIF_F_HW_VLAN_STAG_RX_BIT] =  "rx-vlan-stag-hw-parse",
         [NETIF_F_HW_VLAN_STAG_FILTER_BIT] = "rx-vlan-stag-filter",
@@ -82,6 +82,7 @@ static const char netdev_features_strings[NETDEV_FEATURE_COUNT][ETH_GSTRING_LEN]
         [NETIF_F_FSO_BIT] =              "tx-fcoe-segmentation",
         [NETIF_F_GSO_GRE_BIT] =          "tx-gre-segmentation",
         [NETIF_F_GSO_UDP_TUNNEL_BIT] =   "tx-udp_tnl-segmentation",
+        [NETIF_F_GSO_MPLS_BIT] =         "tx-mpls-segmentation",
 
         [NETIF_F_FCOE_CRC_BIT] =         "tx-checksum-fcoe-crc",
         [NETIF_F_SCTP_CSUM_BIT] =        "tx-checksum-sctp",
@@ -278,11 +279,16 @@ static u32 __ethtool_get_flags(struct net_device *dev)
 {
         u32 flags = 0;
 
-        if (dev->features & NETIF_F_LRO)             flags |= ETH_FLAG_LRO;
-        if (dev->features & NETIF_F_HW_VLAN_CTAG_RX) flags |= ETH_FLAG_RXVLAN;
-        if (dev->features & NETIF_F_HW_VLAN_CTAG_TX) flags |= ETH_FLAG_TXVLAN;
-        if (dev->features & NETIF_F_NTUPLE)          flags |= ETH_FLAG_NTUPLE;
-        if (dev->features & NETIF_F_RXHASH)          flags |= ETH_FLAG_RXHASH;
+        if (dev->features & NETIF_F_LRO)
+                flags |= ETH_FLAG_LRO;
+        if (dev->features & NETIF_F_HW_VLAN_CTAG_RX)
+                flags |= ETH_FLAG_RXVLAN;
+        if (dev->features & NETIF_F_HW_VLAN_CTAG_TX)
+                flags |= ETH_FLAG_TXVLAN;
+        if (dev->features & NETIF_F_NTUPLE)
+                flags |= ETH_FLAG_NTUPLE;
+        if (dev->features & NETIF_F_RXHASH)
+                flags |= ETH_FLAG_RXHASH;
 
         return flags;
 }
@@ -294,11 +300,16 @@ static int __ethtool_set_flags(struct net_device *dev, u32 data)
         if (data & ~ETH_ALL_FLAGS)
                 return -EINVAL;
 
-        if (data & ETH_FLAG_LRO)        features |= NETIF_F_LRO;
-        if (data & ETH_FLAG_RXVLAN)     features |= NETIF_F_HW_VLAN_CTAG_RX;
-        if (data & ETH_FLAG_TXVLAN)     features |= NETIF_F_HW_VLAN_CTAG_TX;
-        if (data & ETH_FLAG_NTUPLE)     features |= NETIF_F_NTUPLE;
-        if (data & ETH_FLAG_RXHASH)     features |= NETIF_F_RXHASH;
+        if (data & ETH_FLAG_LRO)
+                features |= NETIF_F_LRO;
+        if (data & ETH_FLAG_RXVLAN)
+                features |= NETIF_F_HW_VLAN_CTAG_RX;
+        if (data & ETH_FLAG_TXVLAN)
+                features |= NETIF_F_HW_VLAN_CTAG_TX;
+        if (data & ETH_FLAG_NTUPLE)
+                features |= NETIF_F_NTUPLE;
+        if (data & ETH_FLAG_RXHASH)
+                features |= NETIF_F_RXHASH;
 
         /* allow changing only bits set in hw_features */
         changed = (features ^ dev->features) & ETH_ALL_FEATURES;
@@ -1319,10 +1330,19 @@ static int ethtool_get_dump_data(struct net_device *dev,
         if (ret)
                 return ret;
 
-        len = (tmp.len > dump.len) ? dump.len : tmp.len;
+        len = min(tmp.len, dump.len);
         if (!len)
                 return -EFAULT;
 
+        /* Don't ever let the driver think there's more space available
+         * than it requested with .get_dump_flag().
+         */
+        dump.len = len;
+
+        /* Always allocate enough space to hold the whole thing so that the
+         * driver does not need to check the length and bother with partial
+         * dumping.
+         */
         data = vzalloc(tmp.len);
         if (!data)
                 return -ENOMEM;
@@ -1330,6 +1350,16 @@ static int ethtool_get_dump_data(struct net_device *dev,
         if (ret)
                 goto out;
 
+        /* There are two sane possibilities:
+         * 1. The driver's .get_dump_data() does not touch dump.len.
+         * 2. Or it may set dump.len to how much it really writes, which
+         *    should be tmp.len (or len if it can do a partial dump).
+         * In any case respond to userspace with the actual length of data
+         * it's receiving.
+         */
+        WARN_ON(dump.len != len && dump.len != tmp.len);
+        dump.len = len;
+
         if (copy_to_user(useraddr, &dump, sizeof(dump))) {
                 ret = -EFAULT;
                 goto out;
@@ -1413,7 +1443,7 @@ static int ethtool_get_module_eeprom(struct net_device *dev,
                                       modinfo.eeprom_len);
 }
 
-/* The main entry point in this file.  Called from net/core/dev.c */
+/* The main entry point in this file.  Called from net/core/dev_ioctl.c */
 
 int dev_ethtool(struct net *net, struct ifreq *ifr)
 {
diff --git a/net/core/fib_rules.c b/net/core/fib_rules.c
index d5a9f8ead0d8..2e654138433c 100644
--- a/net/core/fib_rules.c
+++ b/net/core/fib_rules.c
@@ -33,6 +33,9 @@ int fib_default_rule_add(struct fib_rules_ops *ops,
         r->flags = flags;
         r->fr_net = hold_net(ops->fro_net);
 
+        r->suppress_prefixlen = -1;
+        r->suppress_ifgroup = -1;
+
         /* The lock is not required here, the list in unreacheable
          * at the moment this function is called */
         list_add_tail(&r->list, &ops->rules_list);
@@ -226,6 +229,9 @@ jumped:
                 else
                         err = ops->action(rule, fl, flags, arg);
 
+                if (!err && ops->suppress && ops->suppress(rule, arg))
+                        continue;
+
                 if (err != -EAGAIN) {
                         if ((arg->flags & FIB_LOOKUP_NOREF) ||
                             likely(atomic_inc_not_zero(&rule->refcnt))) {
@@ -337,6 +343,15 @@ static int fib_nl_newrule(struct sk_buff *skb, struct nlmsghdr* nlh)
         rule->action = frh->action;
         rule->flags = frh->flags;
         rule->table = frh_get_table(frh, tb);
+        if (tb[FRA_SUPPRESS_PREFIXLEN])
+                rule->suppress_prefixlen = nla_get_u32(tb[FRA_SUPPRESS_PREFIXLEN]);
+        else
+                rule->suppress_prefixlen = -1;
+
+        if (tb[FRA_SUPPRESS_IFGROUP])
+                rule->suppress_ifgroup = nla_get_u32(tb[FRA_SUPPRESS_IFGROUP]);
+        else
+                rule->suppress_ifgroup = -1;
 
         if (!tb[FRA_PRIORITY] && ops->default_pref)
                 rule->pref = ops->default_pref(ops);
@@ -523,6 +538,8 @@ static inline size_t fib_rule_nlmsg_size(struct fib_rules_ops *ops,
                          + nla_total_size(IFNAMSIZ) /* FRA_OIFNAME */
                          + nla_total_size(4) /* FRA_PRIORITY */
                          + nla_total_size(4) /* FRA_TABLE */
+                         + nla_total_size(4) /* FRA_SUPPRESS_PREFIXLEN */
+                         + nla_total_size(4) /* FRA_SUPPRESS_IFGROUP */
                          + nla_total_size(4) /* FRA_FWMARK */
                          + nla_total_size(4); /* FRA_FWMASK */
 
@@ -548,6 +565,8 @@ static int fib_nl_fill_rule(struct sk_buff *skb, struct fib_rule *rule,
         frh->table = rule->table;
         if (nla_put_u32(skb, FRA_TABLE, rule->table))
                 goto nla_put_failure;
+        if (nla_put_u32(skb, FRA_SUPPRESS_PREFIXLEN, rule->suppress_prefixlen))
+                goto nla_put_failure;
         frh->res1 = 0;
         frh->res2 = 0;
         frh->action = rule->action;
@@ -580,6 +599,12 @@ static int fib_nl_fill_rule(struct sk_buff *skb, struct fib_rule *rule,
             (rule->target &&
              nla_put_u32(skb, FRA_GOTO, rule->target)))
                 goto nla_put_failure;
+
+        if (rule->suppress_ifgroup != -1) {
+                if (nla_put_u32(skb, FRA_SUPPRESS_IFGROUP, rule->suppress_ifgroup))
+                        goto nla_put_failure;
+        }
+
         if (ops->fill(rule, skb, frh) < 0)
                 goto nla_put_failure;
 
@@ -705,9 +730,9 @@ static void detach_rules(struct list_head *rules, struct net_device *dev)
 
 
 static int fib_rules_event(struct notifier_block *this, unsigned long event,
-                            void *ptr)
+                           void *ptr)
 {
-        struct net_device *dev = ptr;
+        struct net_device *dev = netdev_notifier_info_to_dev(ptr);
         struct net *net = dev_net(dev);
         struct fib_rules_ops *ops;
 
diff --git a/net/core/filter.c b/net/core/filter.c
index dad2a178f9f8..6438f29ff266 100644
--- a/net/core/filter.c
+++ b/net/core/filter.c
@@ -778,7 +778,7 @@ int sk_detach_filter(struct sock *sk)
 }
 EXPORT_SYMBOL_GPL(sk_detach_filter);
 
-static void sk_decode_filter(struct sock_filter *filt, struct sock_filter *to)
+void sk_decode_filter(struct sock_filter *filt, struct sock_filter *to)
 {
         static const u16 decodes[] = {
                 [BPF_S_ALU_ADD_K]       = BPF_ALU|BPF_ADD|BPF_K,
diff --git a/net/core/flow.c b/net/core/flow.c
index 7102f166482d..dfa602ceb8cd 100644
--- a/net/core/flow.c
+++ b/net/core/flow.c
@@ -403,7 +403,7 @@ void flow_cache_flush_deferred(void)
         schedule_work(&flow_cache_flush_work);
 }
 
-static int __cpuinit flow_cache_cpu_prepare(struct flow_cache *fc, int cpu)
+static int flow_cache_cpu_prepare(struct flow_cache *fc, int cpu)
 {
         struct flow_cache_percpu *fcp = per_cpu_ptr(fc->percpu, cpu);
         size_t sz = sizeof(struct hlist_head) * flow_cache_hash_size(fc);
@@ -421,7 +421,7 @@ static int __cpuinit flow_cache_cpu_prepare(struct flow_cache *fc, int cpu)
         return 0;
 }
 
-static int __cpuinit flow_cache_cpu(struct notifier_block *nfb,
+static int flow_cache_cpu(struct notifier_block *nfb,
                           unsigned long action,
                           void *hcpu)
 {
diff --git a/net/core/flow_dissector.c b/net/core/flow_dissector.c
index 00ee068efc1c..8d7d0dd72db2 100644
--- a/net/core/flow_dissector.c
+++ b/net/core/flow_dissector.c
@@ -65,6 +65,7 @@ ipv6:
                 nhoff += sizeof(struct ipv6hdr);
                 break;
         }
+        case __constant_htons(ETH_P_8021AD):
         case __constant_htons(ETH_P_8021Q): {
                 const struct vlan_hdr *vlan;
                 struct vlan_hdr _vlan;
@@ -139,7 +140,11 @@ ipv6:
                 break;
         }
         case IPPROTO_IPIP:
-                goto again;
+                proto = htons(ETH_P_IP);
+                goto ip;
+        case IPPROTO_IPV6:
+                proto = htons(ETH_P_IPV6);
+                goto ipv6;
         default:
                 break;
         }
@@ -149,8 +154,8 @@ ipv6:
         if (poff >= 0) {
                 __be32 *ports, _ports;
 
-                nhoff += poff;
-                ports = skb_header_pointer(skb, nhoff, sizeof(_ports), &_ports);
+                ports = skb_header_pointer(skb, nhoff + poff,
+                                           sizeof(_ports), &_ports);
                 if (ports)
                         flow->ports = *ports;
         }
@@ -345,14 +350,9 @@ u16 __netdev_pick_tx(struct net_device *dev, struct sk_buff *skb)
                 if (new_index < 0)
                         new_index = skb_tx_hash(dev, skb);
 
-                if (queue_index != new_index && sk) {
-                        struct dst_entry *dst =
-                                    rcu_dereference_check(sk->sk_dst_cache, 1);
-
-                        if (dst && skb_dst(skb) == dst)
-                                sk_tx_queue_set(sk, queue_index);
-
-                }
+                if (queue_index != new_index && sk &&
+                    rcu_access_pointer(sk->sk_dst_cache))
+                        sk_tx_queue_set(sk, new_index);
 
                 queue_index = new_index;
         }
diff --git a/net/core/gen_estimator.c b/net/core/gen_estimator.c
index d9d198aa9fed..6b5b6e7013ca 100644
--- a/net/core/gen_estimator.c
+++ b/net/core/gen_estimator.c
@@ -82,7 +82,7 @@ struct gen_estimator
 {
         struct list_head        list;
         struct gnet_stats_basic_packed  *bstats;
-        struct gnet_stats_rate_est      *rate_est;
+        struct gnet_stats_rate_est64    *rate_est;
         spinlock_t              *stats_lock;
         int                     ewma_log;
         u64                     last_bytes;
@@ -167,7 +167,7 @@ static void gen_add_node(struct gen_estimator *est)
 
 static
 struct gen_estimator *gen_find_node(const struct gnet_stats_basic_packed *bstats,
-                                    const struct gnet_stats_rate_est *rate_est)
+                                    const struct gnet_stats_rate_est64 *rate_est)
 {
         struct rb_node *p = est_root.rb_node;
 
@@ -203,7 +203,7 @@ struct gen_estimator *gen_find_node(const struct gnet_stats_basic_packed *bstats
  *
  */
 int gen_new_estimator(struct gnet_stats_basic_packed *bstats,
-                      struct gnet_stats_rate_est *rate_est,
+                      struct gnet_stats_rate_est64 *rate_est,
                       spinlock_t *stats_lock,
                       struct nlattr *opt)
 {
@@ -258,7 +258,7 @@ EXPORT_SYMBOL(gen_new_estimator);
  * Note : Caller should respect an RCU grace period before freeing stats_lock
  */
 void gen_kill_estimator(struct gnet_stats_basic_packed *bstats,
-                        struct gnet_stats_rate_est *rate_est)
+                        struct gnet_stats_rate_est64 *rate_est)
 {
         struct gen_estimator *e;
 
@@ -290,7 +290,7 @@ EXPORT_SYMBOL(gen_kill_estimator);
  * Returns 0 on success or a negative error code.
  */
 int gen_replace_estimator(struct gnet_stats_basic_packed *bstats,
-                          struct gnet_stats_rate_est *rate_est,
+                          struct gnet_stats_rate_est64 *rate_est,
                           spinlock_t *stats_lock, struct nlattr *opt)
 {
         gen_kill_estimator(bstats, rate_est);
@@ -306,7 +306,7 @@ EXPORT_SYMBOL(gen_replace_estimator);
  * Returns true if estimator is active, and false if not.
  */
 bool gen_estimator_active(const struct gnet_stats_basic_packed *bstats,
-                          const struct gnet_stats_rate_est *rate_est)
+                          const struct gnet_stats_rate_est64 *rate_est)
 {
         bool res;
 
diff --git a/net/core/gen_stats.c b/net/core/gen_stats.c
index ddedf211e588..9d3d9e78397b 100644
--- a/net/core/gen_stats.c
+++ b/net/core/gen_stats.c
@@ -143,18 +143,30 @@ EXPORT_SYMBOL(gnet_stats_copy_basic);
 int
 gnet_stats_copy_rate_est(struct gnet_dump *d,
                          const struct gnet_stats_basic_packed *b,
-                         struct gnet_stats_rate_est *r)
+                         struct gnet_stats_rate_est64 *r)
 {
+        struct gnet_stats_rate_est est;
+        int res;
+
         if (b && !gen_estimator_active(b, r))
                 return 0;
 
+        est.bps = min_t(u64, UINT_MAX, r->bps);
+        /* we have some time before reaching 2^32 packets per second */
+        est.pps = r->pps;
+
         if (d->compat_tc_stats) {
-                d->tc_stats.bps = r->bps;
-                d->tc_stats.pps = r->pps;
+                d->tc_stats.bps = est.bps;
+                d->tc_stats.pps = est.pps;
         }
 
-        if (d->tail)
-                return gnet_stats_copy(d, TCA_STATS_RATE_EST, r, sizeof(*r));
+        if (d->tail) {
+                res = gnet_stats_copy(d, TCA_STATS_RATE_EST, &est, sizeof(est));
+                if (res < 0 || est.bps == r->bps)
+                        return res;
+                /* emit 64bit stats only if needed */
+                return gnet_stats_copy(d, TCA_STATS_RATE_EST64, r, sizeof(*r));
+        }
 
         return 0;
 }
diff --git a/net/core/iovec.c b/net/core/iovec.c
index de178e462682..b77eeecc0011 100644
--- a/net/core/iovec.c
+++ b/net/core/iovec.c
@@ -212,3 +212,27 @@ out_fault:
         goto out;
 }
 EXPORT_SYMBOL(csum_partial_copy_fromiovecend);
+
+unsigned long iov_pages(const struct iovec *iov, int offset,
+                        unsigned long nr_segs)
+{
+        unsigned long seg, base;
+        int pages = 0, len, size;
+
+        while (nr_segs && (offset >= iov->iov_len)) {
+                offset -= iov->iov_len;
+                ++iov;
+                --nr_segs;
+        }
+
+        for (seg = 0; seg < nr_segs; seg++) {
+                base = (unsigned long)iov[seg].iov_base + offset;
+                len = iov[seg].iov_len - offset;
+                size = ((base & ~PAGE_MASK) + len + ~PAGE_MASK) >> PAGE_SHIFT;
+                pages += size;
+                offset = 0;
+        }
+
+        return pages;
+}
+EXPORT_SYMBOL(iov_pages);
diff --git a/net/core/link_watch.c b/net/core/link_watch.c
index 8f82a5cc3851..9c3a839322ba 100644
--- a/net/core/link_watch.c
+++ b/net/core/link_watch.c
@@ -92,6 +92,9 @@ static bool linkwatch_urgent_event(struct net_device *dev)
         if (dev->ifindex != dev->iflink)
                 return true;
 
+        if (dev->priv_flags & IFF_TEAM_PORT)
+                return true;
+
         return netif_carrier_ok(dev) && qdisc_tx_changing(dev);
 }
 
diff --git a/net/core/neighbour.c b/net/core/neighbour.c
index 5c56b217b999..6072610a8672 100644
--- a/net/core/neighbour.c
+++ b/net/core/neighbour.c
@@ -231,7 +231,7 @@ static void neigh_flush_dev(struct neigh_table *tbl, struct net_device *dev)
                                    we must kill timers etc. and move
                                    it to safe state.
                                  */
-                                skb_queue_purge(&n->arp_queue);
+                                __skb_queue_purge(&n->arp_queue);
                                 n->arp_queue_len_bytes = 0;
                                 n->output = neigh_blackhole;
                                 if (n->nud_state & NUD_VALID)
@@ -286,7 +286,7 @@ static struct neighbour *neigh_alloc(struct neigh_table *tbl, struct net_device
         if (!n)
                 goto out_entries;
 
-        skb_queue_head_init(&n->arp_queue);
+        __skb_queue_head_init(&n->arp_queue);
         rwlock_init(&n->lock);
         seqlock_init(&n->ha_lock);
         n->updated        = n->used = now;
@@ -708,7 +708,9 @@ void neigh_destroy(struct neighbour *neigh)
         if (neigh_del_timer(neigh))
                 pr_warn("Impossible event\n");
 
-        skb_queue_purge(&neigh->arp_queue);
+        write_lock_bh(&neigh->lock);
+        __skb_queue_purge(&neigh->arp_queue);
+        write_unlock_bh(&neigh->lock);
         neigh->arp_queue_len_bytes = 0;
 
         if (dev->netdev_ops->ndo_neigh_destroy)
@@ -858,7 +860,7 @@ static void neigh_invalidate(struct neighbour *neigh)
                 neigh->ops->error_report(neigh, skb);
                 write_lock(&neigh->lock);
         }
-        skb_queue_purge(&neigh->arp_queue);
+        __skb_queue_purge(&neigh->arp_queue);
         neigh->arp_queue_len_bytes = 0;
 }
 
@@ -1210,7 +1212,7 @@ int neigh_update(struct neighbour *neigh, const u8 *lladdr, u8 new,
 
                         write_lock_bh(&neigh->lock);
                 }
-                skb_queue_purge(&neigh->arp_queue);
+                __skb_queue_purge(&neigh->arp_queue);
                 neigh->arp_queue_len_bytes = 0;
         }
 out:
@@ -1419,7 +1421,7 @@ static inline struct neigh_parms *lookup_neigh_parms(struct neigh_table *tbl,
 
         for (p = &tbl->parms; p; p = p->next) {
                 if ((p->dev && p->dev->ifindex == ifindex && net_eq(neigh_parms_net(p), net)) ||
-                    (!p->dev && !ifindex))
+                    (!p->dev && !ifindex && net_eq(net, &init_net)))
                         return p;
         }
 
@@ -1429,30 +1431,28 @@ static inline struct neigh_parms *lookup_neigh_parms(struct neigh_table *tbl,
 struct neigh_parms *neigh_parms_alloc(struct net_device *dev,
                                       struct neigh_table *tbl)
 {
-        struct neigh_parms *p, *ref;
+        struct neigh_parms *p;
         struct net *net = dev_net(dev);
         const struct net_device_ops *ops = dev->netdev_ops;
 
-        ref = lookup_neigh_parms(tbl, net, 0);
-        if (!ref)
-                return NULL;
-
-        p = kmemdup(ref, sizeof(*p), GFP_KERNEL);
+        p = kmemdup(&tbl->parms, sizeof(*p), GFP_KERNEL);
         if (p) {
                 p->tbl            = tbl;
                 atomic_set(&p->refcnt, 1);
                 p->reachable_time =
                                 neigh_rand_reach_time(p->base_reachable_time);
+                dev_hold(dev);
+                p->dev = dev;
+                write_pnet(&p->net, hold_net(net));
+                p->sysctl_table = NULL;
 
                 if (ops->ndo_neigh_setup && ops->ndo_neigh_setup(dev, p)) {
+                        release_net(net);
+                        dev_put(dev);
                         kfree(p);
                         return NULL;
                 }
 
-                dev_hold(dev);
-                p->dev = dev;
-                write_pnet(&p->net, hold_net(net));
-                p->sysctl_table = NULL;
                 write_lock_bh(&tbl->lock);
                 p->next         = tbl->parms.next;
                 tbl->parms.next = p;
@@ -2053,6 +2053,12 @@ static int neightbl_set(struct sk_buff *skb, struct nlmsghdr *nlh)
                 }
         }
 
+        err = -ENOENT;
+        if ((tb[NDTA_THRESH1] || tb[NDTA_THRESH2] ||
+             tb[NDTA_THRESH3] || tb[NDTA_GC_INTERVAL]) &&
+            !net_eq(net, &init_net))
+                goto errout_tbl_lock;
+
         if (tb[NDTA_THRESH1])
                 tbl->gc_thresh1 = nla_get_u32(tb[NDTA_THRESH1]);
 
@@ -2753,23 +2759,22 @@ errout:
                 rtnl_set_sk_err(net, RTNLGRP_NEIGH, err);
 }
 
-#ifdef CONFIG_ARPD
 void neigh_app_ns(struct neighbour *n)
 {
         __neigh_notify(n, RTM_GETNEIGH, NLM_F_REQUEST);
 }
 EXPORT_SYMBOL(neigh_app_ns);
-#endif /* CONFIG_ARPD */
 
 #ifdef CONFIG_SYSCTL
 static int zero;
+static int int_max = INT_MAX;
 static int unres_qlen_max = INT_MAX / SKB_TRUESIZE(ETH_FRAME_LEN);
 
-static int proc_unres_qlen(ctl_table *ctl, int write, void __user *buffer,
-                           size_t *lenp, loff_t *ppos)
+static int proc_unres_qlen(struct ctl_table *ctl, int write,
+                           void __user *buffer, size_t *lenp, loff_t *ppos)
 {
         int size, ret;
-        ctl_table tmp = *ctl;
+        struct ctl_table tmp = *ctl;
 
         tmp.extra1 = &zero;
         tmp.extra2 = &unres_qlen_max;
@@ -2815,19 +2820,25 @@ static struct neigh_sysctl_table {
                         .procname       = "mcast_solicit",
                         .maxlen         = sizeof(int),
                         .mode           = 0644,
-                        .proc_handler   = proc_dointvec,
+                        .extra1         = &zero,
+                        .extra2         = &int_max,
+                        .proc_handler   = proc_dointvec_minmax,
                 },
                 [NEIGH_VAR_UCAST_PROBE] = {
                         .procname       = "ucast_solicit",
                         .maxlen         = sizeof(int),
                         .mode           = 0644,
-                        .proc_handler   = proc_dointvec,
+                        .extra1         = &zero,
+                        .extra2         = &int_max,
+                        .proc_handler   = proc_dointvec_minmax,
                 },
                 [NEIGH_VAR_APP_PROBE] = {
                         .procname       = "app_solicit",
                         .maxlen         = sizeof(int),
                         .mode           = 0644,
-                        .proc_handler   = proc_dointvec,
+                        .extra1         = &zero,
+                        .extra2         = &int_max,
+                        .proc_handler   = proc_dointvec_minmax,
                 },
                 [NEIGH_VAR_RETRANS_TIME] = {
                         .procname       = "retrans_time",
@@ -2870,7 +2881,9 @@ static struct neigh_sysctl_table {
                         .procname       = "proxy_qlen",
                         .maxlen         = sizeof(int),
                         .mode           = 0644,
-                        .proc_handler   = proc_dointvec,
+                        .extra1         = &zero,
+                        .extra2         = &int_max,
+                        .proc_handler   = proc_dointvec_minmax,
                 },
                 [NEIGH_VAR_ANYCAST_DELAY] = {
                         .procname       = "anycast_delay",
@@ -2912,19 +2925,25 @@ static struct neigh_sysctl_table {
                         .procname       = "gc_thresh1",
                         .maxlen         = sizeof(int),
                         .mode           = 0644,
-                        .proc_handler   = proc_dointvec,
+                        .extra1         = &zero,
+                        .extra2         = &int_max,
+                        .proc_handler   = proc_dointvec_minmax,
                 },
                 [NEIGH_VAR_GC_THRESH2] = {
                         .procname       = "gc_thresh2",
                         .maxlen         = sizeof(int),
                         .mode           = 0644,
-                        .proc_handler   = proc_dointvec,
+                        .extra1         = &zero,
+                        .extra2         = &int_max,
+                        .proc_handler   = proc_dointvec_minmax,
                 },
                 [NEIGH_VAR_GC_THRESH3] = {
                         .procname       = "gc_thresh3",
                         .maxlen         = sizeof(int),
                         .mode           = 0644,
-                        .proc_handler   = proc_dointvec,
+                        .extra1         = &zero,
+                        .extra2         = &int_max,
+                        .proc_handler   = proc_dointvec_minmax,
                 },
                 {},
         },
diff --git a/net/core/net-procfs.c b/net/core/net-procfs.c
index 569d355fec3e..2bf83299600a 100644
--- a/net/core/net-procfs.c
+++ b/net/core/net-procfs.c
@@ -146,11 +146,23 @@ static void softnet_seq_stop(struct seq_file *seq, void *v)
 static int softnet_seq_show(struct seq_file *seq, void *v)
 {
         struct softnet_data *sd = v;
+        unsigned int flow_limit_count = 0;
 
-        seq_printf(seq, "%08x %08x %08x %08x %08x %08x %08x %08x %08x %08x\n",
+#ifdef CONFIG_NET_FLOW_LIMIT
+        struct sd_flow_limit *fl;
+
+        rcu_read_lock();
+        fl = rcu_dereference(sd->flow_limit);
+        if (fl)
+                flow_limit_count = fl->count;
+        rcu_read_unlock();
+#endif
+
+        seq_printf(seq,
+                   "%08x %08x %08x %08x %08x %08x %08x %08x %08x %08x %08x\n",
                    sd->processed, sd->dropped, sd->time_squeeze, 0,
                    0, 0, 0, 0, /* was fastroute */
-                   sd->cpu_collision, sd->received_rps);
+                   sd->cpu_collision, sd->received_rps, flow_limit_count);
         return 0;
 }
 
diff --git a/net/core/net-sysfs.c b/net/core/net-sysfs.c
index 981fed397d1d..d954b56b4e47 100644
--- a/net/core/net-sysfs.c
+++ b/net/core/net-sysfs.c
@@ -60,12 +60,19 @@ static ssize_t format_##field(const struct net_device *net, char *buf)	\
 {                                                                       \
         return sprintf(buf, format_string, net->field);                 \
 }                                                                       \
-static ssize_t show_##field(struct device *dev,                         \
+static ssize_t field##_show(struct device *dev,                         \
                             struct device_attribute *attr, char *buf)   \
 {                                                                       \
         return netdev_show(dev, attr, buf, format_##field);             \
-}
+}                                                                       \
+
+#define NETDEVICE_SHOW_RO(field, format_string)                         \
+NETDEVICE_SHOW(field, format_string);                                   \
+static DEVICE_ATTR_RO(field)
 
+#define NETDEVICE_SHOW_RW(field, format_string)                         \
+NETDEVICE_SHOW(field, format_string);                                   \
+static DEVICE_ATTR_RW(field)
 
 /* use same locking and permission rules as SIF* ioctl's */
 static ssize_t netdev_store(struct device *dev, struct device_attribute *attr,
@@ -96,16 +103,16 @@ static ssize_t netdev_store(struct device *dev, struct device_attribute *attr,
         return ret;
 }
 
-NETDEVICE_SHOW(dev_id, fmt_hex);
-NETDEVICE_SHOW(addr_assign_type, fmt_dec);
-NETDEVICE_SHOW(addr_len, fmt_dec);
-NETDEVICE_SHOW(iflink, fmt_dec);
-NETDEVICE_SHOW(ifindex, fmt_dec);
-NETDEVICE_SHOW(type, fmt_dec);
-NETDEVICE_SHOW(link_mode, fmt_dec);
+NETDEVICE_SHOW_RO(dev_id, fmt_hex);
+NETDEVICE_SHOW_RO(addr_assign_type, fmt_dec);
+NETDEVICE_SHOW_RO(addr_len, fmt_dec);
+NETDEVICE_SHOW_RO(iflink, fmt_dec);
+NETDEVICE_SHOW_RO(ifindex, fmt_dec);
+NETDEVICE_SHOW_RO(type, fmt_dec);
+NETDEVICE_SHOW_RO(link_mode, fmt_dec);
 
 /* use same locking rules as GIFHWADDR ioctl's */
-static ssize_t show_address(struct device *dev, struct device_attribute *attr,
+static ssize_t address_show(struct device *dev, struct device_attribute *attr,
                             char *buf)
 {
         struct net_device *net = to_net_dev(dev);
@@ -117,15 +124,17 @@ static ssize_t show_address(struct device *dev, struct device_attribute *attr,
         read_unlock(&dev_base_lock);
         return ret;
 }
+static DEVICE_ATTR_RO(address);
 
-static ssize_t show_broadcast(struct device *dev,
-                            struct device_attribute *attr, char *buf)
+static ssize_t broadcast_show(struct device *dev,
+                              struct device_attribute *attr, char *buf)
 {
         struct net_device *net = to_net_dev(dev);
         if (dev_isalive(net))
                 return sysfs_format_mac(buf, net->broadcast, net->addr_len);
         return -EINVAL;
 }
+static DEVICE_ATTR_RO(broadcast);
 
 static int change_carrier(struct net_device *net, unsigned long new_carrier)
 {
@@ -134,13 +143,13 @@ static int change_carrier(struct net_device *net, unsigned long new_carrier)
         return dev_change_carrier(net, (bool) new_carrier);
 }
 
-static ssize_t store_carrier(struct device *dev, struct device_attribute *attr,
-                         const char *buf, size_t len)
+static ssize_t carrier_store(struct device *dev, struct device_attribute *attr,
+                             const char *buf, size_t len)
 {
         return netdev_store(dev, attr, buf, len, change_carrier);
 }
 
-static ssize_t show_carrier(struct device *dev,
+static ssize_t carrier_show(struct device *dev,
                             struct device_attribute *attr, char *buf)
 {
         struct net_device *netdev = to_net_dev(dev);
@@ -149,8 +158,9 @@ static ssize_t show_carrier(struct device *dev,
         }
         return -EINVAL;
 }
+static DEVICE_ATTR_RW(carrier);
 
-static ssize_t show_speed(struct device *dev,
+static ssize_t speed_show(struct device *dev,
                           struct device_attribute *attr, char *buf)
 {
         struct net_device *netdev = to_net_dev(dev);
@@ -167,8 +177,9 @@ static ssize_t show_speed(struct device *dev,
         rtnl_unlock();
         return ret;
 }
+static DEVICE_ATTR_RO(speed);
 
-static ssize_t show_duplex(struct device *dev,
+static ssize_t duplex_show(struct device *dev,
                            struct device_attribute *attr, char *buf)
 {
         struct net_device *netdev = to_net_dev(dev);
@@ -198,8 +209,9 @@ static ssize_t show_duplex(struct device *dev,
         rtnl_unlock();
         return ret;
 }
+static DEVICE_ATTR_RO(duplex);
 
-static ssize_t show_dormant(struct device *dev,
+static ssize_t dormant_show(struct device *dev,
                             struct device_attribute *attr, char *buf)
 {
         struct net_device *netdev = to_net_dev(dev);
@@ -209,6 +221,7 @@ static ssize_t show_dormant(struct device *dev,
 
         return -EINVAL;
 }
+static DEVICE_ATTR_RO(dormant);
 
 static const char *const operstates[] = {
         "unknown",
@@ -220,7 +233,7 @@ static const char *const operstates[] = {
         "up"
 };
 
-static ssize_t show_operstate(struct device *dev,
+static ssize_t operstate_show(struct device *dev,
                               struct device_attribute *attr, char *buf)
 {
         const struct net_device *netdev = to_net_dev(dev);
@@ -237,35 +250,33 @@ static ssize_t show_operstate(struct device *dev,
 
         return sprintf(buf, "%s\n", operstates[operstate]);
 }
+static DEVICE_ATTR_RO(operstate);
 
 /* read-write attributes */
-NETDEVICE_SHOW(mtu, fmt_dec);
 
 static int change_mtu(struct net_device *net, unsigned long new_mtu)
 {
         return dev_set_mtu(net, (int) new_mtu);
 }
 
-static ssize_t store_mtu(struct device *dev, struct device_attribute *attr,
+static ssize_t mtu_store(struct device *dev, struct device_attribute *attr,
                          const char *buf, size_t len)
 {
         return netdev_store(dev, attr, buf, len, change_mtu);
 }
-
-NETDEVICE_SHOW(flags, fmt_hex);
+NETDEVICE_SHOW_RW(mtu, fmt_dec);
 
 static int change_flags(struct net_device *net, unsigned long new_flags)
 {
         return dev_change_flags(net, (unsigned int) new_flags);
 }
 
-static ssize_t store_flags(struct device *dev, struct device_attribute *attr,
+static ssize_t flags_store(struct device *dev, struct device_attribute *attr,
                            const char *buf, size_t len)
 {
         return netdev_store(dev, attr, buf, len, change_flags);
 }
-
-NETDEVICE_SHOW(tx_queue_len, fmt_ulong);
+NETDEVICE_SHOW_RW(flags, fmt_hex);
 
 static int change_tx_queue_len(struct net_device *net, unsigned long new_len)
 {
@@ -273,7 +284,7 @@ static int change_tx_queue_len(struct net_device *net, unsigned long new_len)
         return 0;
 }
 
-static ssize_t store_tx_queue_len(struct device *dev,
+static ssize_t tx_queue_len_store(struct device *dev,
                                   struct device_attribute *attr,
                                   const char *buf, size_t len)
 {
@@ -282,8 +293,9 @@ static ssize_t store_tx_queue_len(struct device *dev,
 
         return netdev_store(dev, attr, buf, len, change_tx_queue_len);
 }
+NETDEVICE_SHOW_RW(tx_queue_len, fmt_ulong);
 
-static ssize_t store_ifalias(struct device *dev, struct device_attribute *attr,
+static ssize_t ifalias_store(struct device *dev, struct device_attribute *attr,
                              const char *buf, size_t len)
 {
         struct net_device *netdev = to_net_dev(dev);
@@ -306,7 +318,7 @@ static ssize_t store_ifalias(struct device *dev, struct device_attribute *attr,
         return ret < 0 ? ret : len;
 }
 
-static ssize_t show_ifalias(struct device *dev,
+static ssize_t ifalias_show(struct device *dev,
                             struct device_attribute *attr, char *buf)
 {
         const struct net_device *netdev = to_net_dev(dev);
@@ -319,8 +331,7 @@ static ssize_t show_ifalias(struct device *dev,
         rtnl_unlock();
         return ret;
 }
-
-NETDEVICE_SHOW(group, fmt_dec);
+static DEVICE_ATTR_RW(ifalias);
 
 static int change_group(struct net_device *net, unsigned long new_group)
 {
@@ -328,35 +339,60 @@ static int change_group(struct net_device *net, unsigned long new_group)
         return 0;
 }
 
-static ssize_t store_group(struct device *dev, struct device_attribute *attr,
-                         const char *buf, size_t len)
+static ssize_t group_store(struct device *dev, struct device_attribute *attr,
+                           const char *buf, size_t len)
 {
         return netdev_store(dev, attr, buf, len, change_group);
 }
+NETDEVICE_SHOW(group, fmt_dec);
+static DEVICE_ATTR(netdev_group, S_IRUGO | S_IWUSR, group_show, group_store);
+
+static ssize_t phys_port_id_show(struct device *dev,
+                                 struct device_attribute *attr, char *buf)
+{
+        struct net_device *netdev = to_net_dev(dev);
+        ssize_t ret = -EINVAL;
 
-static struct device_attribute net_class_attributes[] = {
-        __ATTR(addr_assign_type, S_IRUGO, show_addr_assign_type, NULL),
-        __ATTR(addr_len, S_IRUGO, show_addr_len, NULL),
-        __ATTR(dev_id, S_IRUGO, show_dev_id, NULL),
-        __ATTR(ifalias, S_IRUGO | S_IWUSR, show_ifalias, store_ifalias),
-        __ATTR(iflink, S_IRUGO, show_iflink, NULL),
-        __ATTR(ifindex, S_IRUGO, show_ifindex, NULL),
-        __ATTR(type, S_IRUGO, show_type, NULL),
-        __ATTR(link_mode, S_IRUGO, show_link_mode, NULL),
-        __ATTR(address, S_IRUGO, show_address, NULL),
-        __ATTR(broadcast, S_IRUGO, show_broadcast, NULL),
-        __ATTR(carrier, S_IRUGO | S_IWUSR, show_carrier, store_carrier),
-        __ATTR(speed, S_IRUGO, show_speed, NULL),
-        __ATTR(duplex, S_IRUGO, show_duplex, NULL),
-        __ATTR(dormant, S_IRUGO, show_dormant, NULL),
-        __ATTR(operstate, S_IRUGO, show_operstate, NULL),
-        __ATTR(mtu, S_IRUGO | S_IWUSR, show_mtu, store_mtu),
-        __ATTR(flags, S_IRUGO | S_IWUSR, show_flags, store_flags),
-        __ATTR(tx_queue_len, S_IRUGO | S_IWUSR, show_tx_queue_len,
-               store_tx_queue_len),
-        __ATTR(netdev_group, S_IRUGO | S_IWUSR, show_group, store_group),
-        {}
+        if (!rtnl_trylock())
+                return restart_syscall();
+
+        if (dev_isalive(netdev)) {
+                struct netdev_phys_port_id ppid;
+
+                ret = dev_get_phys_port_id(netdev, &ppid);
+                if (!ret)
+                        ret = sprintf(buf, "%*phN\n", ppid.id_len, ppid.id);
+        }
+        rtnl_unlock();
+
+        return ret;
+}
+static DEVICE_ATTR_RO(phys_port_id);
+
+static struct attribute *net_class_attrs[] = {
+        &dev_attr_netdev_group.attr,
+        &dev_attr_type.attr,
+        &dev_attr_dev_id.attr,
+        &dev_attr_iflink.attr,
+        &dev_attr_ifindex.attr,
+        &dev_attr_addr_assign_type.attr,
+        &dev_attr_addr_len.attr,
+        &dev_attr_link_mode.attr,
+        &dev_attr_address.attr,
+        &dev_attr_broadcast.attr,
+        &dev_attr_speed.attr,
+        &dev_attr_duplex.attr,
+        &dev_attr_dormant.attr,
+        &dev_attr_operstate.attr,
+        &dev_attr_ifalias.attr,
+        &dev_attr_carrier.attr,
+        &dev_attr_mtu.attr,
+        &dev_attr_flags.attr,
+        &dev_attr_tx_queue_len.attr,
+        &dev_attr_phys_port_id.attr,
+        NULL,
 };
+ATTRIBUTE_GROUPS(net_class);
 
 /* Show a given an attribute in the statistics group */
 static ssize_t netstat_show(const struct device *d,
@@ -382,13 +418,13 @@ static ssize_t netstat_show(const struct device *d,
 
 /* generate a read-only statistics attribute */
 #define NETSTAT_ENTRY(name)                                             \
-static ssize_t show_##name(struct device *d,                            \
+static ssize_t name##_show(struct device *d,                            \
                            struct device_attribute *attr, char *buf)    \
 {                                                                       \
         return netstat_show(d, attr, buf,                               \
                             offsetof(struct rtnl_link_stats64, name));  \
 }                                                                       \
-static DEVICE_ATTR(name, S_IRUGO, show_##name, NULL)
+static DEVICE_ATTR_RO(name)
 
 NETSTAT_ENTRY(rx_packets);
 NETSTAT_ENTRY(tx_packets);
@@ -457,6 +493,9 @@ static struct attribute_group wireless_group = {
         .attrs = wireless_attrs,
 };
 #endif
+
+#else /* CONFIG_SYSFS */
+#define net_class_groups        NULL
 #endif /* CONFIG_SYSFS */
 
 #ifdef CONFIG_RPS
@@ -1157,6 +1196,13 @@ static void remove_queue_kobjects(struct net_device *net)
 #endif
 }
 
+static bool net_current_may_mount(void)
+{
+        struct net *net = current->nsproxy->net_ns;
+
+        return ns_capable(net->user_ns, CAP_SYS_ADMIN);
+}
+
 static void *net_grab_current_ns(void)
 {
         struct net *ns = current->nsproxy->net_ns;
@@ -1179,6 +1225,7 @@ static const void *net_netlink_ns(struct sock *sk)
 
 struct kobj_ns_type_operations net_ns_type_operations = {
         .type = KOBJ_NS_TYPE_NET,
+        .current_may_mount = net_current_may_mount,
         .grab_current_ns = net_grab_current_ns,
         .netlink_ns = net_netlink_ns,
         .initial_ns = net_initial_ns,
@@ -1229,9 +1276,7 @@ static const void *net_namespace(struct device *d)
 static struct class net_class = {
         .name = "net",
         .dev_release = netdev_release,
-#ifdef CONFIG_SYSFS
-        .dev_attrs = net_class_attributes,
-#endif /* CONFIG_SYSFS */
+        .dev_groups = net_class_groups,
         .dev_uevent = netdev_uevent,
         .ns_type = &net_ns_type_operations,
         .namespace = net_namespace,
diff --git a/net/core/net_namespace.c b/net/core/net_namespace.c
index f97652036754..81d3a9a08453 100644
--- a/net/core/net_namespace.c
+++ b/net/core/net_namespace.c
@@ -651,7 +651,7 @@ static int netns_install(struct nsproxy *nsproxy, void *ns)
         struct net *net = ns;
 
         if (!ns_capable(net->user_ns, CAP_SYS_ADMIN) ||
-            !nsown_capable(CAP_SYS_ADMIN))
+            !ns_capable(current_user_ns(), CAP_SYS_ADMIN))
                 return -EPERM;
 
         put_net(nsproxy->net_ns);
diff --git a/net/core/netpoll.c b/net/core/netpoll.c
index cec074be8c43..fc75c9e461b8 100644
--- a/net/core/netpoll.c
+++ b/net/core/netpoll.c
@@ -12,6 +12,7 @@
 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
 
 #include <linux/moduleparam.h>
+#include <linux/kernel.h>
 #include <linux/netdevice.h>
 #include <linux/etherdevice.h>
 #include <linux/string.h>
@@ -247,7 +248,7 @@ static void netpoll_poll_dev(struct net_device *dev)
         zap_completion_queue();
 }
 
-int netpoll_rx_disable(struct net_device *dev)
+void netpoll_rx_disable(struct net_device *dev)
 {
         struct netpoll_info *ni;
         int idx;
@@ -257,7 +258,6 @@ int netpoll_rx_disable(struct net_device *dev)
         if (ni)
                 down(&ni->dev_lock);
         srcu_read_unlock(&netpoll_srcu, idx);
-        return 0;
 }
 EXPORT_SYMBOL(netpoll_rx_disable);
 
@@ -550,7 +550,7 @@ static void netpoll_neigh_reply(struct sk_buff *skb, struct netpoll_info *npinfo
                 return;
 
         proto = ntohs(eth_hdr(skb)->h_proto);
-        if (proto == ETH_P_IP) {
+        if (proto == ETH_P_ARP) {
                 struct arphdr *arp;
                 unsigned char *arp_ptr;
                 /* No arp on this interface */
@@ -690,25 +690,20 @@ static void netpoll_neigh_reply(struct sk_buff *skb, struct netpoll_info *npinfo
                         send_skb->dev = skb->dev;
 
                         skb_reset_network_header(send_skb);
-                        skb_put(send_skb, sizeof(struct ipv6hdr));
-                        hdr = ipv6_hdr(send_skb);
-
+                        hdr = (struct ipv6hdr *) skb_put(send_skb, sizeof(struct ipv6hdr));
                         *(__be32*)hdr = htonl(0x60000000);
-
                         hdr->payload_len = htons(size);
                         hdr->nexthdr = IPPROTO_ICMPV6;
                         hdr->hop_limit = 255;
                         hdr->saddr = *saddr;
                         hdr->daddr = *daddr;
 
-                        send_skb->transport_header = send_skb->tail;
-                        skb_put(send_skb, size);
-
-                        icmp6h = (struct icmp6hdr *)skb_transport_header(skb);
+                        icmp6h = (struct icmp6hdr *) skb_put(send_skb, sizeof(struct icmp6hdr));
                         icmp6h->icmp6_type = NDISC_NEIGHBOUR_ADVERTISEMENT;
                         icmp6h->icmp6_router = 0;
                         icmp6h->icmp6_solicited = 1;
-                        target = (struct in6_addr *)(skb_transport_header(send_skb) + sizeof(struct icmp6hdr));
+
+                        target = (struct in6_addr *) skb_put(send_skb, sizeof(struct in6_addr));
                         *target = msg->target;
                         icmp6h->icmp6_cksum = csum_ipv6_magic(saddr, daddr, size,
                                                               IPPROTO_ICMPV6,
@@ -1289,15 +1284,14 @@ EXPORT_SYMBOL_GPL(__netpoll_free_async);
 
 void netpoll_cleanup(struct netpoll *np)
 {
-        if (!np->dev)
-                return;
-
         rtnl_lock();
+        if (!np->dev)
+                goto out;
         __netpoll_cleanup(np);
-        rtnl_unlock();
-
         dev_put(np->dev);
         np->dev = NULL;
+out:
+        rtnl_unlock();
 }
 EXPORT_SYMBOL(netpoll_cleanup);
 
diff --git a/net/core/netprio_cgroup.c b/net/core/netprio_cgroup.c
index 0777d0aa18c3..d9cd627e6a16 100644
--- a/net/core/netprio_cgroup.c
+++ b/net/core/netprio_cgroup.c
@@ -29,12 +29,6 @@
 
 #define PRIOMAP_MIN_SZ          128
 
-static inline struct cgroup_netprio_state *cgrp_netprio_state(struct cgroup *cgrp)
-{
-        return container_of(cgroup_subsys_state(cgrp, net_prio_subsys_id),
-                            struct cgroup_netprio_state, css);
-}
-
 /*
  * Extend @dev->priomap so that it's large enough to accomodate
  * @target_idx.  @dev->priomap.priomap_len > @target_idx after successful
@@ -87,67 +81,70 @@ static int extend_netdev_table(struct net_device *dev, u32 target_idx)
 
 /**
  * netprio_prio - return the effective netprio of a cgroup-net_device pair
- * @cgrp: cgroup part of the target pair
+ * @css: css part of the target pair
  * @dev: net_device part of the target pair
  *
  * Should be called under RCU read or rtnl lock.
  */
-static u32 netprio_prio(struct cgroup *cgrp, struct net_device *dev)
+static u32 netprio_prio(struct cgroup_subsys_state *css, struct net_device *dev)
 {
         struct netprio_map *map = rcu_dereference_rtnl(dev->priomap);
+        int id = css->cgroup->id;
 
-        if (map && cgrp->id < map->priomap_len)
-                return map->priomap[cgrp->id];
+        if (map && id < map->priomap_len)
+                return map->priomap[id];
         return 0;
 }
 
 /**
  * netprio_set_prio - set netprio on a cgroup-net_device pair
- * @cgrp: cgroup part of the target pair
+ * @css: css part of the target pair
  * @dev: net_device part of the target pair
  * @prio: prio to set
  *
- * Set netprio to @prio on @cgrp-@dev pair.  Should be called under rtnl
+ * Set netprio to @prio on @css-@dev pair.  Should be called under rtnl
  * lock and may fail under memory pressure for non-zero @prio.
  */
-static int netprio_set_prio(struct cgroup *cgrp, struct net_device *dev,
-                            u32 prio)
+static int netprio_set_prio(struct cgroup_subsys_state *css,
+                            struct net_device *dev, u32 prio)
 {
         struct netprio_map *map;
+        int id = css->cgroup->id;
         int ret;
 
         /* avoid extending priomap for zero writes */
         map = rtnl_dereference(dev->priomap);
-        if (!prio && (!map || map->priomap_len <= cgrp->id))
+        if (!prio && (!map || map->priomap_len <= id))
                 return 0;
 
-        ret = extend_netdev_table(dev, cgrp->id);
+        ret = extend_netdev_table(dev, id);
         if (ret)
                 return ret;
 
         map = rtnl_dereference(dev->priomap);
-        map->priomap[cgrp->id] = prio;
+        map->priomap[id] = prio;
         return 0;
 }
 
-static struct cgroup_subsys_state *cgrp_css_alloc(struct cgroup *cgrp)
+static struct cgroup_subsys_state *
+cgrp_css_alloc(struct cgroup_subsys_state *parent_css)
 {
-        struct cgroup_netprio_state *cs;
+        struct cgroup_subsys_state *css;
 
-        cs = kzalloc(sizeof(*cs), GFP_KERNEL);
-        if (!cs)
+        css = kzalloc(sizeof(*css), GFP_KERNEL);
+        if (!css)
                 return ERR_PTR(-ENOMEM);
 
-        return &cs->css;
+        return css;
 }
 
-static int cgrp_css_online(struct cgroup *cgrp)
+static int cgrp_css_online(struct cgroup_subsys_state *css)
 {
-        struct cgroup *parent = cgrp->parent;
+        struct cgroup_subsys_state *parent_css = css_parent(css);
         struct net_device *dev;
         int ret = 0;
 
-        if (!parent)
+        if (!parent_css)
                 return 0;
 
         rtnl_lock();
@@ -156,9 +153,9 @@ static int cgrp_css_online(struct cgroup *cgrp)
          * onlining, there is no need to clear them on offline.
          */
         for_each_netdev(&init_net, dev) {
-                u32 prio = netprio_prio(parent, dev);
+                u32 prio = netprio_prio(parent_css, dev);
 
-                ret = netprio_set_prio(cgrp, dev, prio);
+                ret = netprio_set_prio(css, dev, prio);
                 if (ret)
                         break;
         }
@@ -166,29 +163,29 @@ static int cgrp_css_online(struct cgroup *cgrp)
         return ret;
 }
 
-static void cgrp_css_free(struct cgroup *cgrp)
+static void cgrp_css_free(struct cgroup_subsys_state *css)
 {
-        kfree(cgrp_netprio_state(cgrp));
+        kfree(css);
 }
 
-static u64 read_prioidx(struct cgroup *cgrp, struct cftype *cft)
+static u64 read_prioidx(struct cgroup_subsys_state *css, struct cftype *cft)
 {
-        return cgrp->id;
+        return css->cgroup->id;
 }
 
-static int read_priomap(struct cgroup *cont, struct cftype *cft,
+static int read_priomap(struct cgroup_subsys_state *css, struct cftype *cft,
                         struct cgroup_map_cb *cb)
 {
         struct net_device *dev;
 
         rcu_read_lock();
         for_each_netdev_rcu(&init_net, dev)
-                cb->fill(cb, dev->name, netprio_prio(cont, dev));
+                cb->fill(cb, dev->name, netprio_prio(css, dev));
         rcu_read_unlock();
         return 0;
 }
 
-static int write_priomap(struct cgroup *cgrp, struct cftype *cft,
+static int write_priomap(struct cgroup_subsys_state *css, struct cftype *cft,
                          const char *buffer)
 {
         char devname[IFNAMSIZ + 1];
@@ -205,7 +202,7 @@ static int write_priomap(struct cgroup *cgrp, struct cftype *cft,
 
         rtnl_lock();
 
-        ret = netprio_set_prio(cgrp, dev, prio);
+        ret = netprio_set_prio(css, dev, prio);
 
         rtnl_unlock();
         dev_put(dev);
@@ -221,12 +218,13 @@ static int update_netprio(const void *v, struct file *file, unsigned n)
         return 0;
 }
 
-static void net_prio_attach(struct cgroup *cgrp, struct cgroup_taskset *tset)
+static void net_prio_attach(struct cgroup_subsys_state *css,
+                            struct cgroup_taskset *tset)
 {
         struct task_struct *p;
         void *v;
 
-        cgroup_taskset_for_each(p, cgrp, tset) {
+        cgroup_taskset_for_each(p, css, tset) {
                 task_lock(p);
                 v = (void *)(unsigned long)task_netprioidx(p);
                 iterate_fd(p->files, 0, update_netprio, v);
@@ -261,7 +259,7 @@ struct cgroup_subsys net_prio_subsys = {
 static int netprio_device_event(struct notifier_block *unused,
                                 unsigned long event, void *ptr)
 {
-        struct net_device *dev = ptr;
+        struct net_device *dev = netdev_notifier_info_to_dev(ptr);
         struct netprio_map *old;
 
         /*
diff --git a/net/core/pktgen.c b/net/core/pktgen.c
index 11f2704c3810..261357a66300 100644
--- a/net/core/pktgen.c
+++ b/net/core/pktgen.c
@@ -160,6 +160,8 @@
 #include <net/net_namespace.h>
 #include <net/checksum.h>
 #include <net/ipv6.h>
+#include <net/udp.h>
+#include <net/ip6_checksum.h>
 #include <net/addrconf.h>
 #ifdef CONFIG_XFRM
 #include <net/xfrm.h>
@@ -198,6 +200,7 @@
 #define F_QUEUE_MAP_RND (1<<13) /* queue map Random */
 #define F_QUEUE_MAP_CPU (1<<14) /* queue map mirrors smp_processor_id() */
 #define F_NODE          (1<<15) /* Node memory alloc*/
+#define F_UDPCSUM       (1<<16) /* Include UDP checksum */
 
 /* Thread control flag bits */
 #define T_STOP        (1<<0)    /* Stop run */
@@ -631,6 +634,9 @@ static int pktgen_if_show(struct seq_file *seq, void *v)
         if (pkt_dev->flags & F_UDPDST_RND)
                 seq_printf(seq, "UDPDST_RND  ");
 
+        if (pkt_dev->flags & F_UDPCSUM)
+                seq_printf(seq, "UDPCSUM  ");
+
         if (pkt_dev->flags & F_MPLS_RND)
                 seq_printf(seq,  "MPLS_RND  ");
 
@@ -1228,6 +1234,12 @@ static ssize_t pktgen_if_write(struct file *file,
                 else if (strcmp(f, "!NODE_ALLOC") == 0)
                         pkt_dev->flags &= ~F_NODE;
 
+                else if (strcmp(f, "UDPCSUM") == 0)
+                        pkt_dev->flags |= F_UDPCSUM;
+
+                else if (strcmp(f, "!UDPCSUM") == 0)
+                        pkt_dev->flags &= ~F_UDPCSUM;
+
                 else {
                         sprintf(pg_result,
                                 "Flag -:%s:- unknown\nAvailable flags, (prepend ! to un-set flag):\n%s",
@@ -1921,7 +1933,7 @@ static void pktgen_change_name(const struct pktgen_net *pn, struct net_device *d
 static int pktgen_device_event(struct notifier_block *unused,
                                unsigned long event, void *ptr)
 {
-        struct net_device *dev = ptr;
+        struct net_device *dev = netdev_notifier_info_to_dev(ptr);
         struct pktgen_net *pn = net_generic(dev_net(dev), pg_net_id);
 
         if (pn->pktgen_exiting)
@@ -2627,6 +2639,29 @@ static void pktgen_finalize_skb(struct pktgen_dev *pkt_dev, struct sk_buff *skb,
         pgh->tv_usec = htonl(timestamp.tv_usec);
 }
 
+static struct sk_buff *pktgen_alloc_skb(struct net_device *dev,
+                                        struct pktgen_dev *pkt_dev,
+                                        unsigned int extralen)
+{
+        struct sk_buff *skb = NULL;
+        unsigned int size = pkt_dev->cur_pkt_size + 64 + extralen +
+                            pkt_dev->pkt_overhead;
+
+        if (pkt_dev->flags & F_NODE) {
+                int node = pkt_dev->node >= 0 ? pkt_dev->node : numa_node_id();
+
+                skb = __alloc_skb(NET_SKB_PAD + size, GFP_NOWAIT, 0, node);
+                if (likely(skb)) {
+                        skb_reserve(skb, NET_SKB_PAD);
+                        skb->dev = dev;
+                }
+        } else {
+                 skb = __netdev_alloc_skb(dev, size, GFP_NOWAIT);
+        }
+
+        return skb;
+}
+
 static struct sk_buff *fill_packet_ipv4(struct net_device *odev,
                                         struct pktgen_dev *pkt_dev)
 {
@@ -2657,32 +2692,13 @@ static struct sk_buff *fill_packet_ipv4(struct net_device *odev,
 
         datalen = (odev->hard_header_len + 16) & ~0xf;
 
-        if (pkt_dev->flags & F_NODE) {
-                int node;
-
-                if (pkt_dev->node >= 0)
-                        node = pkt_dev->node;
-                else
-                        node =  numa_node_id();
-
-                skb = __alloc_skb(NET_SKB_PAD + pkt_dev->cur_pkt_size + 64
-                                  + datalen + pkt_dev->pkt_overhead, GFP_NOWAIT, 0, node);
-                if (likely(skb)) {
-                        skb_reserve(skb, NET_SKB_PAD);
-                        skb->dev = odev;
-                }
-        }
-        else
-          skb = __netdev_alloc_skb(odev,
-                                   pkt_dev->cur_pkt_size + 64
-                                   + datalen + pkt_dev->pkt_overhead, GFP_NOWAIT);
-
+        skb = pktgen_alloc_skb(odev, pkt_dev, datalen);
         if (!skb) {
                 sprintf(pkt_dev->result, "No memory");
                 return NULL;
         }
-        prefetchw(skb->data);
 
+        prefetchw(skb->data);
         skb_reserve(skb, datalen);
 
         /*  Reserve for ethernet and IP header  */
@@ -2708,15 +2724,15 @@ static struct sk_buff *fill_packet_ipv4(struct net_device *odev,
                 *vlan_encapsulated_proto = htons(ETH_P_IP);
         }
 
-        skb->network_header = skb->tail;
-        skb->transport_header = skb->network_header + sizeof(struct iphdr);
-        skb_put(skb, sizeof(struct iphdr) + sizeof(struct udphdr));
+        skb_set_mac_header(skb, 0);
+        skb_set_network_header(skb, skb->len);
+        iph = (struct iphdr *) skb_put(skb, sizeof(struct iphdr));
+
+        skb_set_transport_header(skb, skb->len);
+        udph = (struct udphdr *) skb_put(skb, sizeof(struct udphdr));
         skb_set_queue_mapping(skb, queue_map);
         skb->priority = pkt_dev->skb_priority;
 
-        iph = ip_hdr(skb);
-        udph = udp_hdr(skb);
-
         memcpy(eth, pkt_dev->hh, 12);
         *(__be16 *) & eth[12] = protocol;
 
@@ -2729,7 +2745,7 @@ static struct sk_buff *fill_packet_ipv4(struct net_device *odev,
         udph->source = htons(pkt_dev->cur_udp_src);
         udph->dest = htons(pkt_dev->cur_udp_dst);
         udph->len = htons(datalen + 8); /* DATA + udphdr */
-        udph->check = 0;        /* No checksum */
+        udph->check = 0;
 
         iph->ihl = 5;
         iph->version = 4;
@@ -2743,13 +2759,28 @@ static struct sk_buff *fill_packet_ipv4(struct net_device *odev,
         iph->frag_off = 0;
         iplen = 20 + 8 + datalen;
         iph->tot_len = htons(iplen);
-        iph->check = 0;
-        iph->check = ip_fast_csum((void *)iph, iph->ihl);
+        ip_send_check(iph);
         skb->protocol = protocol;
-        skb->mac_header = (skb->network_header - ETH_HLEN -
-                           pkt_dev->pkt_overhead);
         skb->dev = odev;
         skb->pkt_type = PACKET_HOST;
+
+        if (!(pkt_dev->flags & F_UDPCSUM)) {
+                skb->ip_summed = CHECKSUM_NONE;
+        } else if (odev->features & NETIF_F_V4_CSUM) {
+                skb->ip_summed = CHECKSUM_PARTIAL;
+                skb->csum = 0;
+                udp4_hwcsum(skb, udph->source, udph->dest);
+        } else {
+                __wsum csum = udp_csum(skb);
+
+                /* add protocol-dependent pseudo-header */
+                udph->check = csum_tcpudp_magic(udph->source, udph->dest,
+                                                datalen + 8, IPPROTO_UDP, csum);
+
+                if (udph->check == 0)
+                        udph->check = CSUM_MANGLED_0;
+        }
+
         pktgen_finalize_skb(pkt_dev, skb, datalen);
 
 #ifdef CONFIG_XFRM
@@ -2766,7 +2797,7 @@ static struct sk_buff *fill_packet_ipv6(struct net_device *odev,
         struct sk_buff *skb = NULL;
         __u8 *eth;
         struct udphdr *udph;
-        int datalen;
+        int datalen, udplen;
         struct ipv6hdr *iph;
         __be16 protocol = htons(ETH_P_IPV6);
         __be32 *mpls;
@@ -2788,15 +2819,13 @@ static struct sk_buff *fill_packet_ipv6(struct net_device *odev,
         mod_cur_headers(pkt_dev);
         queue_map = pkt_dev->cur_queue_map;
 
-        skb = __netdev_alloc_skb(odev,
-                                 pkt_dev->cur_pkt_size + 64
-                                 + 16 + pkt_dev->pkt_overhead, GFP_NOWAIT);
+        skb = pktgen_alloc_skb(odev, pkt_dev, 16);
         if (!skb) {
                 sprintf(pkt_dev->result, "No memory");
                 return NULL;
         }
-        prefetchw(skb->data);
 
+        prefetchw(skb->data);
         skb_reserve(skb, 16);
 
         /*  Reserve for ethernet and IP header  */
@@ -2822,13 +2851,14 @@ static struct sk_buff *fill_packet_ipv6(struct net_device *odev,
                 *vlan_encapsulated_proto = htons(ETH_P_IPV6);
         }
 
-        skb->network_header = skb->tail;
-        skb->transport_header = skb->network_header + sizeof(struct ipv6hdr);
-        skb_put(skb, sizeof(struct ipv6hdr) + sizeof(struct udphdr));
+        skb_set_mac_header(skb, 0);
+        skb_set_network_header(skb, skb->len);
+        iph = (struct ipv6hdr *) skb_put(skb, sizeof(struct ipv6hdr));
+
+        skb_set_transport_header(skb, skb->len);
+        udph = (struct udphdr *) skb_put(skb, sizeof(struct udphdr));
         skb_set_queue_mapping(skb, queue_map);
         skb->priority = pkt_dev->skb_priority;
-        iph = ipv6_hdr(skb);
-        udph = udp_hdr(skb);
 
         memcpy(eth, pkt_dev->hh, 12);
         *(__be16 *) &eth[12] = protocol;
@@ -2843,10 +2873,11 @@ static struct sk_buff *fill_packet_ipv6(struct net_device *odev,
                 net_info_ratelimited("increased datalen to %d\n", datalen);
         }
 
+        udplen = datalen + sizeof(struct udphdr);
         udph->source = htons(pkt_dev->cur_udp_src);
         udph->dest = htons(pkt_dev->cur_udp_dst);
-        udph->len = htons(datalen + sizeof(struct udphdr));
-        udph->check = 0;        /* No checksum */
+        udph->len = htons(udplen);
+        udph->check = 0;
 
         *(__be32 *) iph = htonl(0x60000000);    /* Version + flow */
 
@@ -2857,18 +2888,33 @@ static struct sk_buff *fill_packet_ipv6(struct net_device *odev,
 
         iph->hop_limit = 32;
 
-        iph->payload_len = htons(sizeof(struct udphdr) + datalen);
+        iph->payload_len = htons(udplen);
         iph->nexthdr = IPPROTO_UDP;
 
         iph->daddr = pkt_dev->cur_in6_daddr;
         iph->saddr = pkt_dev->cur_in6_saddr;
 
-        skb->mac_header = (skb->network_header - ETH_HLEN -
-                           pkt_dev->pkt_overhead);
         skb->protocol = protocol;
         skb->dev = odev;
         skb->pkt_type = PACKET_HOST;
 
+        if (!(pkt_dev->flags & F_UDPCSUM)) {
+                skb->ip_summed = CHECKSUM_NONE;
+        } else if (odev->features & NETIF_F_V6_CSUM) {
+                skb->ip_summed = CHECKSUM_PARTIAL;
+                skb->csum_start = skb_transport_header(skb) - skb->head;
+                skb->csum_offset = offsetof(struct udphdr, check);
+                udph->check = ~csum_ipv6_magic(&iph->saddr, &iph->daddr, udplen, IPPROTO_UDP, 0);
+        } else {
+                __wsum csum = udp_csum(skb);
+
+                /* add protocol-dependent pseudo-header */
+                udph->check = csum_ipv6_magic(&iph->saddr, &iph->daddr, udplen, IPPROTO_UDP, csum);
+
+                if (udph->check == 0)
+                        udph->check = CSUM_MANGLED_0;
+        }
+
         pktgen_finalize_skb(pkt_dev, skb, datalen);
 
         return skb;
diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
index a08bd2b7fe3f..2a0e21de3060 100644
--- a/net/core/rtnetlink.c
+++ b/net/core/rtnetlink.c
@@ -767,7 +767,8 @@ static noinline size_t if_nlmsg_size(const struct net_device *dev,
                + rtnl_vfinfo_size(dev, ext_filter_mask) /* IFLA_VFINFO_LIST */
                + rtnl_port_size(dev) /* IFLA_VF_PORTS + IFLA_PORT_SELF */
                + rtnl_link_get_size(dev) /* IFLA_LINKINFO */
-               + rtnl_link_get_af_size(dev); /* IFLA_AF_SPEC */
+               + rtnl_link_get_af_size(dev) /* IFLA_AF_SPEC */
+               + nla_total_size(MAX_PHYS_PORT_ID_LEN); /* IFLA_PHYS_PORT_ID */
 }
 
 static int rtnl_vf_ports_fill(struct sk_buff *skb, struct net_device *dev)
@@ -846,6 +847,24 @@ static int rtnl_port_fill(struct sk_buff *skb, struct net_device *dev)
         return 0;
 }
 
+static int rtnl_phys_port_id_fill(struct sk_buff *skb, struct net_device *dev)
+{
+        int err;
+        struct netdev_phys_port_id ppid;
+
+        err = dev_get_phys_port_id(dev, &ppid);
+        if (err) {
+                if (err == -EOPNOTSUPP)
+                        return 0;
+                return err;
+        }
+
+        if (nla_put(skb, IFLA_PHYS_PORT_ID, ppid.id_len, ppid.id))
+                return -EMSGSIZE;
+
+        return 0;
+}
+
 static int rtnl_fill_ifinfo(struct sk_buff *skb, struct net_device *dev,
                             int type, u32 pid, u32 seq, u32 change,
                             unsigned int flags, u32 ext_filter_mask)
@@ -913,6 +932,9 @@ static int rtnl_fill_ifinfo(struct sk_buff *skb, struct net_device *dev,
                         goto nla_put_failure;
         }
 
+        if (rtnl_phys_port_id_fill(skb, dev))
+                goto nla_put_failure;
+
         attr = nla_reserve(skb, IFLA_STATS,
                         sizeof(struct rtnl_link_stats));
         if (attr == NULL)
@@ -947,6 +969,7 @@ static int rtnl_fill_ifinfo(struct sk_buff *skb, struct net_device *dev,
                         struct ifla_vf_vlan vf_vlan;
                         struct ifla_vf_tx_rate vf_tx_rate;
                         struct ifla_vf_spoofchk vf_spoofchk;
+                        struct ifla_vf_link_state vf_linkstate;
 
                         /*
                          * Not all SR-IOV capable drivers support the
@@ -956,18 +979,24 @@ static int rtnl_fill_ifinfo(struct sk_buff *skb, struct net_device *dev,
                          */
                         ivi.spoofchk = -1;
                         memset(ivi.mac, 0, sizeof(ivi.mac));
+                        /* The default value for VF link state is "auto"
+                         * IFLA_VF_LINK_STATE_AUTO which equals zero
+                         */
+                        ivi.linkstate = 0;
                         if (dev->netdev_ops->ndo_get_vf_config(dev, i, &ivi))
                                 break;
                         vf_mac.vf =
                                 vf_vlan.vf =
                                 vf_tx_rate.vf =
-                                vf_spoofchk.vf = ivi.vf;
+                                vf_spoofchk.vf =
+                                vf_linkstate.vf = ivi.vf;
 
                         memcpy(vf_mac.mac, ivi.mac, sizeof(ivi.mac));
                         vf_vlan.vlan = ivi.vlan;
                         vf_vlan.qos = ivi.qos;
                         vf_tx_rate.rate = ivi.tx_rate;
                         vf_spoofchk.setting = ivi.spoofchk;
+                        vf_linkstate.link_state = ivi.linkstate;
                         vf = nla_nest_start(skb, IFLA_VF_INFO);
                         if (!vf) {
                                 nla_nest_cancel(skb, vfinfo);
@@ -978,7 +1007,9 @@ static int rtnl_fill_ifinfo(struct sk_buff *skb, struct net_device *dev,
                             nla_put(skb, IFLA_VF_TX_RATE, sizeof(vf_tx_rate),
                                     &vf_tx_rate) ||
                             nla_put(skb, IFLA_VF_SPOOFCHK, sizeof(vf_spoofchk),
-                                    &vf_spoofchk))
+                                    &vf_spoofchk) ||
+                            nla_put(skb, IFLA_VF_LINK_STATE, sizeof(vf_linkstate),
+                                    &vf_linkstate))
                                 goto nla_put_failure;
                         nla_nest_end(skb, vf);
                 }
@@ -1104,6 +1135,7 @@ const struct nla_policy ifla_policy[IFLA_MAX+1] = {
         [IFLA_PROMISCUITY]      = { .type = NLA_U32 },
         [IFLA_NUM_TX_QUEUES]    = { .type = NLA_U32 },
         [IFLA_NUM_RX_QUEUES]    = { .type = NLA_U32 },
+        [IFLA_PHYS_PORT_ID]     = { .type = NLA_BINARY, .len = MAX_PHYS_PORT_ID_LEN },
 };
 EXPORT_SYMBOL(ifla_policy);
 
@@ -1238,6 +1270,15 @@ static int do_setvfinfo(struct net_device *dev, struct nlattr *attr)
                                                                ivs->setting);
                         break;
                 }
+                case IFLA_VF_LINK_STATE: {
+                        struct ifla_vf_link_state *ivl;
+                        ivl = nla_data(vf);
+                        err = -EOPNOTSUPP;
+                        if (ops->ndo_set_vf_link_state)
+                                err = ops->ndo_set_vf_link_state(dev, ivl->vf,
+                                                                 ivl->link_state);
+                        break;
+                }
                 default:
                         err = -EINVAL;
                         break;
@@ -1826,10 +1867,10 @@ replay:
                 else
                         err = register_netdevice(dev);
 
-                if (err < 0 && !IS_ERR(dev))
+                if (err < 0) {
                         free_netdev(dev);
-                if (err < 0)
                         goto out;
+                }
 
                 err = rtnl_configure_link(dev, ifm);
                 if (err < 0)
@@ -2091,10 +2132,6 @@ static int rtnl_fdb_add(struct sk_buff *skb, struct nlmsghdr *nlh)
         }
 
         addr = nla_data(tb[NDA_LLADDR]);
-        if (is_zero_ether_addr(addr)) {
-                pr_info("PF_BRIDGE: RTM_NEWNEIGH with invalid ether address\n");
-                return -EINVAL;
-        }
 
         err = -EOPNOTSUPP;
 
@@ -2142,7 +2179,7 @@ int ndo_dflt_fdb_del(struct ndmsg *ndm,
         /* If aging addresses are supported device will need to
          * implement its own handler for this.
          */
-        if (ndm->ndm_state & NUD_PERMANENT) {
+        if (!(ndm->ndm_state & NUD_PERMANENT)) {
                 pr_info("%s: FDB only supports static addresses\n", dev->name);
                 return -EINVAL;
         }
@@ -2192,10 +2229,6 @@ static int rtnl_fdb_del(struct sk_buff *skb, struct nlmsghdr *nlh)
         }
 
         addr = nla_data(tb[NDA_LLADDR]);
-        if (is_zero_ether_addr(addr)) {
-                pr_info("PF_BRIDGE: RTM_DELNEIGH with invalid ether address\n");
-                return -EINVAL;
-        }
 
         err = -EOPNOTSUPP;
 
@@ -2374,7 +2407,7 @@ static int rtnl_bridge_getlink(struct sk_buff *skb, struct netlink_callback *cb)
         struct nlattr *extfilt;
         u32 filter_mask = 0;
 
-        extfilt = nlmsg_find_attr(cb->nlh, sizeof(struct rtgenmsg),
+        extfilt = nlmsg_find_attr(cb->nlh, sizeof(struct ifinfomsg),
                                   IFLA_EXT_MASK);
         if (extfilt)
                 filter_mask = nla_get_u32(extfilt);
@@ -2667,7 +2700,7 @@ static void rtnetlink_rcv(struct sk_buff *skb)
 
 static int rtnetlink_event(struct notifier_block *this, unsigned long event, void *ptr)
 {
-        struct net_device *dev = ptr;
+        struct net_device *dev = netdev_notifier_info_to_dev(ptr);
 
         switch (event) {
         case NETDEV_UP:
diff --git a/net/core/scm.c b/net/core/scm.c
index 03795d0147f2..b442e7e25e60 100644
--- a/net/core/scm.c
+++ b/net/core/scm.c
@@ -54,11 +54,11 @@ static __inline__ int scm_check_creds(struct ucred *creds)
                 return -EINVAL;
 
         if ((creds->pid == task_tgid_vnr(current) ||
-             ns_capable(current->nsproxy->pid_ns->user_ns, CAP_SYS_ADMIN)) &&
+             ns_capable(task_active_pid_ns(current)->user_ns, CAP_SYS_ADMIN)) &&
             ((uid_eq(uid, cred->uid)   || uid_eq(uid, cred->euid) ||
-              uid_eq(uid, cred->suid)) || nsown_capable(CAP_SETUID)) &&
+              uid_eq(uid, cred->suid)) || ns_capable(cred->user_ns, CAP_SETUID)) &&
             ((gid_eq(gid, cred->gid)   || gid_eq(gid, cred->egid) ||
-              gid_eq(gid, cred->sgid)) || nsown_capable(CAP_SETGID))) {
+              gid_eq(gid, cred->sgid)) || ns_capable(cred->user_ns, CAP_SETGID))) {
                return 0;
         }
         return -EPERM;
diff --git a/net/core/secure_seq.c b/net/core/secure_seq.c
index 6a2f13cee86a..3f1ec1586ae1 100644
--- a/net/core/secure_seq.c
+++ b/net/core/secure_seq.c
@@ -10,11 +10,24 @@
 
 #include <net/secure_seq.h>
 
-static u32 net_secret[MD5_MESSAGE_BYTES / 4] ____cacheline_aligned;
+#define NET_SECRET_SIZE (MD5_MESSAGE_BYTES / 4)
 
-void net_secret_init(void)
+static u32 net_secret[NET_SECRET_SIZE] ____cacheline_aligned;
+
+static void net_secret_init(void)
 {
-        get_random_bytes(net_secret, sizeof(net_secret));
+        u32 tmp;
+        int i;
+
+        if (likely(net_secret[0]))
+                return;
+
+        for (i = NET_SECRET_SIZE; i > 0;) {
+                do {
+                        get_random_bytes(&tmp, sizeof(tmp));
+                } while (!tmp);
+                cmpxchg(&net_secret[--i], 0, tmp);
+        }
 }
 
 #ifdef CONFIG_INET
@@ -42,6 +55,7 @@ __u32 secure_tcpv6_sequence_number(const __be32 *saddr, const __be32 *daddr,
         u32 hash[MD5_DIGEST_WORDS];
         u32 i;
 
+        net_secret_init();
         memcpy(hash, saddr, 16);
         for (i = 0; i < 4; i++)
                 secret[i] = net_secret[i] + (__force u32)daddr[i];
@@ -63,6 +77,7 @@ u32 secure_ipv6_port_ephemeral(const __be32 *saddr, const __be32 *daddr,
         u32 hash[MD5_DIGEST_WORDS];
         u32 i;
 
+        net_secret_init();
         memcpy(hash, saddr, 16);
         for (i = 0; i < 4; i++)
                 secret[i] = net_secret[i] + (__force u32) daddr[i];
@@ -82,6 +97,7 @@ __u32 secure_ip_id(__be32 daddr)
 {
         u32 hash[MD5_DIGEST_WORDS];
 
+        net_secret_init();
         hash[0] = (__force __u32) daddr;
         hash[1] = net_secret[13];
         hash[2] = net_secret[14];
@@ -96,6 +112,7 @@ __u32 secure_ipv6_id(const __be32 daddr[4])
 {
         __u32 hash[4];
 
+        net_secret_init();
         memcpy(hash, daddr, 16);
         md5_transform(hash, net_secret);
 
@@ -107,6 +124,7 @@ __u32 secure_tcp_sequence_number(__be32 saddr, __be32 daddr,
 {
         u32 hash[MD5_DIGEST_WORDS];
 
+        net_secret_init();
         hash[0] = (__force u32)saddr;
         hash[1] = (__force u32)daddr;
         hash[2] = ((__force u16)sport << 16) + (__force u16)dport;
@@ -121,6 +139,7 @@ u32 secure_ipv4_port_ephemeral(__be32 saddr, __be32 daddr, __be16 dport)
 {
         u32 hash[MD5_DIGEST_WORDS];
 
+        net_secret_init();
         hash[0] = (__force u32)saddr;
         hash[1] = (__force u32)daddr;
         hash[2] = (__force u32)dport ^ net_secret[14];
@@ -140,6 +159,7 @@ u64 secure_dccp_sequence_number(__be32 saddr, __be32 daddr,
         u32 hash[MD5_DIGEST_WORDS];
         u64 seq;
 
+        net_secret_init();
         hash[0] = (__force u32)saddr;
         hash[1] = (__force u32)daddr;
         hash[2] = ((__force u16)sport << 16) + (__force u16)dport;
@@ -164,6 +184,7 @@ u64 secure_dccpv6_sequence_number(__be32 *saddr, __be32 *daddr,
         u64 seq;
         u32 i;
 
+        net_secret_init();
         memcpy(hash, saddr, 16);
         for (i = 0; i < 4; i++)
                 secret[i] = net_secret[i] + daddr[i];
diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index cfd777bd6bd0..d81cff119f73 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -199,9 +199,7 @@ struct sk_buff *__alloc_skb_head(gfp_t gfp_mask, int node)
         skb->truesize = sizeof(struct sk_buff);
         atomic_set(&skb->users, 1);
 
-#ifdef NET_SKBUFF_DATA_USES_OFFSET
-        skb->mac_header = ~0U;
-#endif
+        skb->mac_header = (typeof(skb->mac_header))~0U;
 out:
         return skb;
 }
@@ -275,10 +273,8 @@ struct sk_buff *__alloc_skb(unsigned int size, gfp_t gfp_mask,
         skb->data = data;
         skb_reset_tail_pointer(skb);
         skb->end = skb->tail + size;
-#ifdef NET_SKBUFF_DATA_USES_OFFSET
-        skb->mac_header = ~0U;
-        skb->transport_header = ~0U;
-#endif
+        skb->mac_header = (typeof(skb->mac_header))~0U;
+        skb->transport_header = (typeof(skb->transport_header))~0U;
 
         /* make sure we initialize shinfo sequentially */
         shinfo = skb_shinfo(skb);
@@ -313,7 +309,8 @@ EXPORT_SYMBOL(__alloc_skb);
  * @frag_size: size of fragment, or 0 if head was kmalloced
  *
  * Allocate a new &sk_buff. Caller provides space holding head and
- * skb_shared_info. @data must have been allocated by kmalloc()
+ * skb_shared_info. @data must have been allocated by kmalloc() only if
+ * @frag_size is 0, otherwise data should come from the page allocator.
  * The return is the new skb buffer.
  * On a failure the return is %NULL, and @data is not freed.
  * Notes :
@@ -344,10 +341,8 @@ struct sk_buff *build_skb(void *data, unsigned int frag_size)
         skb->data = data;
         skb_reset_tail_pointer(skb);
         skb->end = skb->tail + size;
-#ifdef NET_SKBUFF_DATA_USES_OFFSET
-        skb->mac_header = ~0U;
-        skb->transport_header = ~0U;
-#endif
+        skb->mac_header = (typeof(skb->mac_header))~0U;
+        skb->transport_header = (typeof(skb->transport_header))~0U;
 
         /* make sure we initialize shinfo sequentially */
         shinfo = skb_shinfo(skb);
@@ -483,15 +478,8 @@ EXPORT_SYMBOL(skb_add_rx_frag);
 
 static void skb_drop_list(struct sk_buff **listp)
 {
-        struct sk_buff *list = *listp;
-
+        kfree_skb_list(*listp);
         *listp = NULL;
-
-        do {
-                struct sk_buff *this = list;
-                list = list->next;
-                kfree_skb(this);
-        } while (list);
 }
 
 static inline void skb_drop_fraglist(struct sk_buff *skb)
@@ -651,6 +639,17 @@ void kfree_skb(struct sk_buff *skb)
 }
 EXPORT_SYMBOL(kfree_skb);
 
+void kfree_skb_list(struct sk_buff *segs)
+{
+        while (segs) {
+                struct sk_buff *next = segs->next;
+
+                kfree_skb(segs);
+                segs = next;
+        }
+}
+EXPORT_SYMBOL(kfree_skb_list);
+
 /**
  *      skb_tx_error - report an sk_buff xmit error
  *      @skb: buffer that triggered an error
@@ -699,6 +698,7 @@ static void __copy_skb_header(struct sk_buff *new, const struct sk_buff *old)
         new->transport_header   = old->transport_header;
         new->network_header     = old->network_header;
         new->mac_header         = old->mac_header;
+        new->inner_protocol     = old->inner_protocol;
         new->inner_transport_header = old->inner_transport_header;
         new->inner_network_header = old->inner_network_header;
         new->inner_mac_header = old->inner_mac_header;
@@ -739,6 +739,10 @@ static void __copy_skb_header(struct sk_buff *new, const struct sk_buff *old)
         new->vlan_tci           = old->vlan_tci;
 
         skb_copy_secmark(new, old);
+
+#ifdef CONFIG_NET_RX_BUSY_POLL
+        new->napi_id    = old->napi_id;
+#endif
 }
 
 /*
@@ -821,7 +825,7 @@ int skb_copy_ubufs(struct sk_buff *skb, gfp_t gfp_mask)
                 page = alloc_page(gfp_mask);
                 if (!page) {
                         while (head) {
-                                struct page *next = (struct page *)head->private;
+                                struct page *next = (struct page *)page_private(head);
                                 put_page(head);
                                 head = next;
                         }
@@ -831,7 +835,7 @@ int skb_copy_ubufs(struct sk_buff *skb, gfp_t gfp_mask)
                 memcpy(page_address(page),
                        vaddr + f->page_offset, skb_frag_size(f));
                 kunmap_atomic(vaddr);
-                page->private = (unsigned long)head;
+                set_page_private(page, (unsigned long)head);
                 head = page;
         }
 
@@ -845,7 +849,7 @@ int skb_copy_ubufs(struct sk_buff *skb, gfp_t gfp_mask)
         for (i = num_frags - 1; i >= 0; i--) {
                 __skb_fill_page_desc(skb, i, head, 0,
                                      skb_shinfo(skb)->frags[i].size);
-                head = (struct page *)head->private;
+                head = (struct page *)page_private(head);
         }
 
         skb_shinfo(skb)->tx_flags &= ~SKBTX_DEV_ZEROCOPY;
@@ -911,18 +915,8 @@ static void skb_headers_offset_update(struct sk_buff *skb, int off)
 
 static void copy_skb_header(struct sk_buff *new, const struct sk_buff *old)
 {
-#ifndef NET_SKBUFF_DATA_USES_OFFSET
-        /*
-         *      Shift between the two data areas in bytes
-         */
-        unsigned long offset = new->data - old->data;
-#endif
-
         __copy_skb_header(new, old);
 
-#ifndef NET_SKBUFF_DATA_USES_OFFSET
-        skb_headers_offset_update(new, offset);
-#endif
         skb_shinfo(new)->gso_size = skb_shinfo(old)->gso_size;
         skb_shinfo(new)->gso_segs = skb_shinfo(old)->gso_segs;
         skb_shinfo(new)->gso_type = skb_shinfo(old)->gso_type;
@@ -1114,7 +1108,7 @@ int pskb_expand_head(struct sk_buff *skb, int nhead, int ntail,
         skb->end      = skb->head + size;
 #endif
         skb->tail             += off;
-        skb_headers_offset_update(skb, off);
+        skb_headers_offset_update(skb, nhead);
         /* Only adjust this if it actually is csum_start rather than csum */
         if (skb->ip_summed == CHECKSUM_PARTIAL)
                 skb->csum_start += nhead;
@@ -1209,9 +1203,8 @@ struct sk_buff *skb_copy_expand(const struct sk_buff *skb,
         off                  = newheadroom - oldheadroom;
         if (n->ip_summed == CHECKSUM_PARTIAL)
                 n->csum_start += off;
-#ifdef NET_SKBUFF_DATA_USES_OFFSET
+
         skb_headers_offset_update(n, off);
-#endif
 
         return n;
 }
@@ -2554,8 +2547,13 @@ unsigned int skb_seq_read(unsigned int consumed, const u8 **data,
         unsigned int block_limit, abs_offset = consumed + st->lower_offset;
         skb_frag_t *frag;
 
-        if (unlikely(abs_offset >= st->upper_offset))
+        if (unlikely(abs_offset >= st->upper_offset)) {
+                if (st->frag_data) {
+                        kunmap_atomic(st->frag_data);
+                        st->frag_data = NULL;
+                }
                 return 0;
+        }
 
 next_skb:
         block_limit = skb_headlen(st->cur_skb) + st->stepped_offset;
@@ -2853,7 +2851,7 @@ struct sk_buff *skb_segment(struct sk_buff *skb, netdev_features_t features)
                                                  doffset + tnl_hlen);
 
                 if (fskb != skb_shinfo(skb)->frag_list)
-                        continue;
+                        goto perform_csum_check;
 
                 if (!sg) {
                         nskb->ip_summed = CHECKSUM_NONE;
@@ -2917,6 +2915,7 @@ skip_fraglist:
                 nskb->len += nskb->data_len;
                 nskb->truesize += nskb->data_len;
 
+perform_csum_check:
                 if (!csum) {
                         nskb->csum = skb_checksum(nskb, doffset,
                                                   nskb->len - doffset, 0);
@@ -3499,3 +3498,31 @@ bool skb_try_coalesce(struct sk_buff *to, struct sk_buff *from,
         return true;
 }
 EXPORT_SYMBOL(skb_try_coalesce);
+
+/**
+ * skb_scrub_packet - scrub an skb
+ *
+ * @skb: buffer to clean
+ * @xnet: packet is crossing netns
+ *
+ * skb_scrub_packet can be used after encapsulating or decapsulting a packet
+ * into/from a tunnel. Some information have to be cleared during these
+ * operations.
+ * skb_scrub_packet can also be used to clean a skb before injecting it in
+ * another namespace (@xnet == true). We have to clear all information in the
+ * skb that could impact namespace isolation.
+ */
+void skb_scrub_packet(struct sk_buff *skb, bool xnet)
+{
+        if (xnet)
+                skb_orphan(skb);
+        skb->tstamp.tv64 = 0;
+        skb->pkt_type = PACKET_HOST;
+        skb->skb_iif = 0;
+        skb_dst_drop(skb);
+        skb->mark = 0;
+        secpath_reset(skb);
+        nf_reset(skb);
+        nf_reset_trace(skb);
+}
+EXPORT_SYMBOL_GPL(skb_scrub_packet);
diff --git a/net/core/sock.c b/net/core/sock.c
index 88868a9d21da..5b6beba494a3 100644
--- a/net/core/sock.c
+++ b/net/core/sock.c
@@ -93,6 +93,7 @@
 
 #include <linux/capability.h>
 #include <linux/errno.h>
+#include <linux/errqueue.h>
 #include <linux/types.h>
 #include <linux/socket.h>
 #include <linux/in.h>
@@ -139,6 +140,8 @@
 #include <net/tcp.h>
 #endif
 
+#include <net/busy_poll.h>
+
 static DEFINE_MUTEX(proto_list_mutex);
 static LIST_HEAD(proto_list);
 
@@ -571,9 +574,7 @@ static int sock_getbindtodevice(struct sock *sk, char __user *optval,
         int ret = -ENOPROTOOPT;
 #ifdef CONFIG_NETDEVICES
         struct net *net = sock_net(sk);
-        struct net_device *dev;
         char devname[IFNAMSIZ];
-        unsigned seq;
 
         if (sk->sk_bound_dev_if == 0) {
                 len = 0;
@@ -584,20 +585,9 @@ static int sock_getbindtodevice(struct sock *sk, char __user *optval,
         if (len < IFNAMSIZ)
                 goto out;
 
-retry:
-        seq = read_seqcount_begin(&devnet_rename_seq);
-        rcu_read_lock();
-        dev = dev_get_by_index_rcu(net, sk->sk_bound_dev_if);
-        ret = -ENODEV;
-        if (!dev) {
-                rcu_read_unlock();
+        ret = netdev_get_name(net, devname, sk->sk_bound_dev_if);
+        if (ret)
                 goto out;
-        }
-
-        strcpy(devname, dev->name);
-        rcu_read_unlock();
-        if (read_seqcount_retry(&devnet_rename_seq, seq))
-                goto retry;
 
         len = strlen(devname) + 1;
 
@@ -911,6 +901,19 @@ set_rcvbuf:
                 sock_valbool_flag(sk, SOCK_SELECT_ERR_QUEUE, valbool);
                 break;
 
+#ifdef CONFIG_NET_RX_BUSY_POLL
+        case SO_BUSY_POLL:
+                /* allow unprivileged users to decrease the value */
+                if ((val > sk->sk_ll_usec) && !capable(CAP_NET_ADMIN))
+                        ret = -EPERM;
+                else {
+                        if (val < 0)
+                                ret = -EINVAL;
+                        else
+                                sk->sk_ll_usec = val;
+                }
+                break;
+#endif
         default:
                 ret = -ENOPROTOOPT;
                 break;
@@ -1168,6 +1171,12 @@ int sock_getsockopt(struct socket *sock, int level, int optname,
                 v.val = sock_flag(sk, SOCK_SELECT_ERR_QUEUE);
                 break;
 
+#ifdef CONFIG_NET_RX_BUSY_POLL
+        case SO_BUSY_POLL:
+                v.val = sk->sk_ll_usec;
+                break;
+#endif
+
         default:
                 return -ENOPROTOOPT;
         }
@@ -1567,6 +1576,25 @@ void sock_wfree(struct sk_buff *skb)
 }
 EXPORT_SYMBOL(sock_wfree);
 
+void skb_orphan_partial(struct sk_buff *skb)
+{
+        /* TCP stack sets skb->ooo_okay based on sk_wmem_alloc,
+         * so we do not completely orphan skb, but transfert all
+         * accounted bytes but one, to avoid unexpected reorders.
+         */
+        if (skb->destructor == sock_wfree
+#ifdef CONFIG_INET
+            || skb->destructor == tcp_wfree
+#endif
+                ) {
+                atomic_sub(skb->truesize - 1, &skb->sk->sk_wmem_alloc);
+                skb->truesize = 1;
+        } else {
+                skb_orphan(skb);
+        }
+}
+EXPORT_SYMBOL(skb_orphan_partial);
+
 /*
  * Read buffer destructor automatically called from kfree_skb.
  */
@@ -1713,24 +1741,23 @@ static long sock_wait_for_wmem(struct sock *sk, long timeo)
 
 struct sk_buff *sock_alloc_send_pskb(struct sock *sk, unsigned long header_len,
                                      unsigned long data_len, int noblock,
-                                     int *errcode)
+                                     int *errcode, int max_page_order)
 {
-        struct sk_buff *skb;
+        struct sk_buff *skb = NULL;
+        unsigned long chunk;
         gfp_t gfp_mask;
         long timeo;
         int err;
         int npages = (data_len + (PAGE_SIZE - 1)) >> PAGE_SHIFT;
+        struct page *page;
+        int i;
 
         err = -EMSGSIZE;
         if (npages > MAX_SKB_FRAGS)
                 goto failure;
 
-        gfp_mask = sk->sk_allocation;
-        if (gfp_mask & __GFP_WAIT)
-                gfp_mask |= __GFP_REPEAT;
-
         timeo = sock_sndtimeo(sk, noblock);
-        while (1) {
+        while (!skb) {
                 err = sock_error(sk);
                 if (err != 0)
                         goto failure;
@@ -1739,50 +1766,52 @@ struct sk_buff *sock_alloc_send_pskb(struct sock *sk, unsigned long header_len,
                 if (sk->sk_shutdown & SEND_SHUTDOWN)
                         goto failure;
 
-                if (atomic_read(&sk->sk_wmem_alloc) < sk->sk_sndbuf) {
-                        skb = alloc_skb(header_len, gfp_mask);
-                        if (skb) {
-                                int i;
-
-                                /* No pages, we're done... */
-                                if (!data_len)
-                                        break;
-
-                                skb->truesize += data_len;
-                                skb_shinfo(skb)->nr_frags = npages;
-                                for (i = 0; i < npages; i++) {
-                                        struct page *page;
-
-                                        page = alloc_pages(sk->sk_allocation, 0);
-                                        if (!page) {
-                                                err = -ENOBUFS;
-                                                skb_shinfo(skb)->nr_frags = i;
-                                                kfree_skb(skb);
-                                                goto failure;
-                                        }
-
-                                        __skb_fill_page_desc(skb, i,
-                                                        page, 0,
-                                                        (data_len >= PAGE_SIZE ?
-                                                         PAGE_SIZE :
-                                                         data_len));
-                                        data_len -= PAGE_SIZE;
-                                }
+                if (atomic_read(&sk->sk_wmem_alloc) >= sk->sk_sndbuf) {
+                        set_bit(SOCK_ASYNC_NOSPACE, &sk->sk_socket->flags);
+                        set_bit(SOCK_NOSPACE, &sk->sk_socket->flags);
+                        err = -EAGAIN;
+                        if (!timeo)
+                                goto failure;
+                        if (signal_pending(current))
+                                goto interrupted;
+                        timeo = sock_wait_for_wmem(sk, timeo);
+                        continue;
+                }
 
-                                /* Full success... */
-                                break;
-                        }
-                        err = -ENOBUFS;
+                err = -ENOBUFS;
+                gfp_mask = sk->sk_allocation;
+                if (gfp_mask & __GFP_WAIT)
+                        gfp_mask |= __GFP_REPEAT;
+
+                skb = alloc_skb(header_len, gfp_mask);
+                if (!skb)
                         goto failure;
+
+                skb->truesize += data_len;
+
+                for (i = 0; npages > 0; i++) {
+                        int order = max_page_order;
+
+                        while (order) {
+                                if (npages >= 1 << order) {
+                                        page = alloc_pages(sk->sk_allocation |
+                                                           __GFP_COMP | __GFP_NOWARN,
+                                                           order);
+                                        if (page)
+                                                goto fill_page;
+                                }
+                                order--;
+                        }
+                        page = alloc_page(sk->sk_allocation);
+                        if (!page)
+                                goto failure;
+fill_page:
+                        chunk = min_t(unsigned long, data_len,
+                                      PAGE_SIZE << order);
+                        skb_fill_page_desc(skb, i, page, 0, chunk);
+                        data_len -= chunk;
+                        npages -= 1 << order;
                 }
-                set_bit(SOCK_ASYNC_NOSPACE, &sk->sk_socket->flags);
-                set_bit(SOCK_NOSPACE, &sk->sk_socket->flags);
-                err = -EAGAIN;
-                if (!timeo)
-                        goto failure;
-                if (signal_pending(current))
-                        goto interrupted;
-                timeo = sock_wait_for_wmem(sk, timeo);
         }
 
         skb_set_owner_w(skb, sk);
@@ -1791,6 +1820,7 @@ struct sk_buff *sock_alloc_send_pskb(struct sock *sk, unsigned long header_len,
 interrupted:
         err = sock_intr_errno(timeo);
 failure:
+        kfree_skb(skb);
         *errcode = err;
         return NULL;
 }
@@ -1799,7 +1829,7 @@ EXPORT_SYMBOL(sock_alloc_send_pskb);
 struct sk_buff *sock_alloc_send_skb(struct sock *sk, unsigned long size,
                                     int noblock, int *errcode)
 {
-        return sock_alloc_send_pskb(sk, size, 0, noblock, errcode);
+        return sock_alloc_send_pskb(sk, size, 0, noblock, errcode, 0);
 }
 EXPORT_SYMBOL(sock_alloc_send_skb);
 
@@ -2284,6 +2314,11 @@ void sock_init_data(struct socket *sock, struct sock *sk)
 
         sk->sk_stamp = ktime_set(-1L, 0);
 
+#ifdef CONFIG_NET_RX_BUSY_POLL
+        sk->sk_napi_id          =       0;
+        sk->sk_ll_usec          =       sysctl_net_busy_read;
+#endif
+
         /*
          * Before updating sk_refcnt, we must commit prior changes to memory
          * (Documentation/RCU/rculist_nulls.txt for details)
@@ -2412,6 +2447,52 @@ void sock_enable_timestamp(struct sock *sk, int flag)
         }
 }
 
+int sock_recv_errqueue(struct sock *sk, struct msghdr *msg, int len,
+                       int level, int type)
+{
+        struct sock_exterr_skb *serr;
+        struct sk_buff *skb, *skb2;
+        int copied, err;
+
+        err = -EAGAIN;
+        skb = skb_dequeue(&sk->sk_error_queue);
+        if (skb == NULL)
+                goto out;
+
+        copied = skb->len;
+        if (copied > len) {
+                msg->msg_flags |= MSG_TRUNC;
+                copied = len;
+        }
+        err = skb_copy_datagram_iovec(skb, 0, msg->msg_iov, copied);
+        if (err)
+                goto out_free_skb;
+
+        sock_recv_timestamp(msg, sk, skb);
+
+        serr = SKB_EXT_ERR(skb);
+        put_cmsg(msg, level, type, sizeof(serr->ee), &serr->ee);
+
+        msg->msg_flags |= MSG_ERRQUEUE;
+        err = copied;
+
+        /* Reset and regenerate socket error */
+        spin_lock_bh(&sk->sk_error_queue.lock);
+        sk->sk_err = 0;
+        if ((skb2 = skb_peek(&sk->sk_error_queue)) != NULL) {
+                sk->sk_err = SKB_EXT_ERR(skb2)->ee.ee_errno;
+                spin_unlock_bh(&sk->sk_error_queue.lock);
+                sk->sk_error_report(sk);
+        } else
+                spin_unlock_bh(&sk->sk_error_queue.lock);
+
+out_free_skb:
+        kfree_skb(skb);
+out:
+        return err;
+}
+EXPORT_SYMBOL(sock_recv_errqueue);
+
 /*
  *      Get a socket option on an socket.
  *
diff --git a/net/core/sock_diag.c b/net/core/sock_diag.c
index d5bef0b0f639..a0e9cf6379de 100644
--- a/net/core/sock_diag.c
+++ b/net/core/sock_diag.c
@@ -73,8 +73,13 @@ int sock_diag_put_filterinfo(struct user_namespace *user_ns, struct sock *sk,
                 goto out;
         }
 
-        if (filter)
-                memcpy(nla_data(attr), filter->insns, len);
+        if (filter) {
+                struct sock_filter *fb = (struct sock_filter *)nla_data(attr);
+                int i;
+
+                for (i = 0; i < filter->len; i++, fb++)
+                        sk_decode_filter(&filter->insns[i], fb);
+        }
 
 out:
         rcu_read_unlock();
diff --git a/net/core/stream.c b/net/core/stream.c
index f5df85dcd20b..512f0a24269b 100644
--- a/net/core/stream.c
+++ b/net/core/stream.c
@@ -30,7 +30,7 @@ void sk_stream_write_space(struct sock *sk)
         struct socket *sock = sk->sk_socket;
         struct socket_wq *wq;
 
-        if (sk_stream_wspace(sk) >= sk_stream_min_wspace(sk) && sock) {
+        if (sk_stream_is_writeable(sk) && sock) {
                 clear_bit(SOCK_NOSPACE, &sock->flags);
 
                 rcu_read_lock();
diff --git a/net/core/sysctl_net_core.c b/net/core/sysctl_net_core.c
index cfdb46ab3a7f..cca444190907 100644
--- a/net/core/sysctl_net_core.c
+++ b/net/core/sysctl_net_core.c
@@ -19,16 +19,20 @@
 #include <net/ip.h>
 #include <net/sock.h>
 #include <net/net_ratelimit.h>
+#include <net/busy_poll.h>
+#include <net/pkt_sched.h>
 
+static int zero = 0;
 static int one = 1;
+static int ushort_max = USHRT_MAX;
 
 #ifdef CONFIG_RPS
-static int rps_sock_flow_sysctl(ctl_table *table, int write,
+static int rps_sock_flow_sysctl(struct ctl_table *table, int write,
                                 void __user *buffer, size_t *lenp, loff_t *ppos)
 {
         unsigned int orig_size, size;
         int ret, i;
-        ctl_table tmp = {
+        struct ctl_table tmp = {
                 .data = &size,
                 .maxlen = sizeof(size),
                 .mode = table->mode
@@ -87,6 +91,129 @@ static int rps_sock_flow_sysctl(ctl_table *table, int write,
 }
 #endif /* CONFIG_RPS */
 
+#ifdef CONFIG_NET_FLOW_LIMIT
+static DEFINE_MUTEX(flow_limit_update_mutex);
+
+static int flow_limit_cpu_sysctl(struct ctl_table *table, int write,
+                                 void __user *buffer, size_t *lenp,
+                                 loff_t *ppos)
+{
+        struct sd_flow_limit *cur;
+        struct softnet_data *sd;
+        cpumask_var_t mask;
+        int i, len, ret = 0;
+
+        if (!alloc_cpumask_var(&mask, GFP_KERNEL))
+                return -ENOMEM;
+
+        if (write) {
+                ret = cpumask_parse_user(buffer, *lenp, mask);
+                if (ret)
+                        goto done;
+
+                mutex_lock(&flow_limit_update_mutex);
+                len = sizeof(*cur) + netdev_flow_limit_table_len;
+                for_each_possible_cpu(i) {
+                        sd = &per_cpu(softnet_data, i);
+                        cur = rcu_dereference_protected(sd->flow_limit,
+                                     lockdep_is_held(&flow_limit_update_mutex));
+                        if (cur && !cpumask_test_cpu(i, mask)) {
+                                RCU_INIT_POINTER(sd->flow_limit, NULL);
+                                synchronize_rcu();
+                                kfree(cur);
+                        } else if (!cur && cpumask_test_cpu(i, mask)) {
+                                cur = kzalloc(len, GFP_KERNEL);
+                                if (!cur) {
+                                        /* not unwinding previous changes */
+                                        ret = -ENOMEM;
+                                        goto write_unlock;
+                                }
+                                cur->num_buckets = netdev_flow_limit_table_len;
+                                rcu_assign_pointer(sd->flow_limit, cur);
+                        }
+                }
+write_unlock:
+                mutex_unlock(&flow_limit_update_mutex);
+        } else {
+                char kbuf[128];
+
+                if (*ppos || !*lenp) {
+                        *lenp = 0;
+                        goto done;
+                }
+
+                cpumask_clear(mask);
+                rcu_read_lock();
+                for_each_possible_cpu(i) {
+                        sd = &per_cpu(softnet_data, i);
+                        if (rcu_dereference(sd->flow_limit))
+                                cpumask_set_cpu(i, mask);
+                }
+                rcu_read_unlock();
+
+                len = min(sizeof(kbuf) - 1, *lenp);
+                len = cpumask_scnprintf(kbuf, len, mask);
+                if (!len) {
+                        *lenp = 0;
+                        goto done;
+                }
+                if (len < *lenp)
+                        kbuf[len++] = '\n';
+                if (copy_to_user(buffer, kbuf, len)) {
+                        ret = -EFAULT;
+                        goto done;
+                }
+                *lenp = len;
+                *ppos += len;
+        }
+
+done:
+        free_cpumask_var(mask);
+        return ret;
+}
+
+static int flow_limit_table_len_sysctl(struct ctl_table *table, int write,
+                                       void __user *buffer, size_t *lenp,
+                                       loff_t *ppos)
+{
+        unsigned int old, *ptr;
+        int ret;
+
+        mutex_lock(&flow_limit_update_mutex);
+
+        ptr = table->data;
+        old = *ptr;
+        ret = proc_dointvec(table, write, buffer, lenp, ppos);
+        if (!ret && write && !is_power_of_2(*ptr)) {
+                *ptr = old;
+                ret = -EINVAL;
+        }
+
+        mutex_unlock(&flow_limit_update_mutex);
+        return ret;
+}
+#endif /* CONFIG_NET_FLOW_LIMIT */
+
+#ifdef CONFIG_NET_SCHED
+static int set_default_qdisc(struct ctl_table *table, int write,
+                             void __user *buffer, size_t *lenp, loff_t *ppos)
+{
+        char id[IFNAMSIZ];
+        struct ctl_table tbl = {
+                .data = id,
+                .maxlen = IFNAMSIZ,
+        };
+        int ret;
+
+        qdisc_get_default(id, IFNAMSIZ);
+
+        ret = proc_dostring(&tbl, write, buffer, lenp, ppos);
+        if (write && ret == 0)
+                ret = qdisc_set_default(id);
+        return ret;
+}
+#endif
+
 static struct ctl_table net_core_table[] = {
 #ifdef CONFIG_NET
         {
@@ -180,6 +307,44 @@ static struct ctl_table net_core_table[] = {
                 .proc_handler   = rps_sock_flow_sysctl
         },
 #endif
+#ifdef CONFIG_NET_FLOW_LIMIT
+        {
+                .procname       = "flow_limit_cpu_bitmap",
+                .mode           = 0644,
+                .proc_handler   = flow_limit_cpu_sysctl
+        },
+        {
+                .procname       = "flow_limit_table_len",
+                .data           = &netdev_flow_limit_table_len,
+                .maxlen         = sizeof(int),
+                .mode           = 0644,
+                .proc_handler   = flow_limit_table_len_sysctl
+        },
+#endif /* CONFIG_NET_FLOW_LIMIT */
+#ifdef CONFIG_NET_RX_BUSY_POLL
+        {
+                .procname       = "busy_poll",
+                .data           = &sysctl_net_busy_poll,
+                .maxlen         = sizeof(unsigned int),
+                .mode           = 0644,
+                .proc_handler   = proc_dointvec
+        },
+        {
+                .procname       = "busy_read",
+                .data           = &sysctl_net_busy_read,
+                .maxlen         = sizeof(unsigned int),
+                .mode           = 0644,
+                .proc_handler   = proc_dointvec
+        },
+#endif
+#ifdef CONFIG_NET_SCHED
+        {
+                .procname       = "default_qdisc",
+                .mode           = 0644,
+                .maxlen         = IFNAMSIZ,
+                .proc_handler   = set_default_qdisc
+        },
+#endif
 #endif /* CONFIG_NET */
         {
                 .procname       = "netdev_budget",
@@ -204,7 +369,9 @@ static struct ctl_table netns_core_table[] = {
                 .data           = &init_net.core.sysctl_somaxconn,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
-                .proc_handler   = proc_dointvec
+                .extra1         = &zero,
+                .extra2         = &ushort_max,
+                .proc_handler   = proc_dointvec_minmax
         },
         { }
 };
diff --git a/net/core/utils.c b/net/core/utils.c
index 3c7f5b51b979..aa88e23fc87a 100644
--- a/net/core/utils.c
+++ b/net/core/utils.c
@@ -338,25 +338,3 @@ void inet_proto_csum_replace16(__sum16 *sum, struct sk_buff *skb,
                                   csum_unfold(*sum)));
 }
 EXPORT_SYMBOL(inet_proto_csum_replace16);
-
-int mac_pton(const char *s, u8 *mac)
-{
-        int i;
-
-        /* XX:XX:XX:XX:XX:XX */
-        if (strlen(s) < 3 * ETH_ALEN - 1)
-                return 0;
-
-        /* Don't dirty result unless string is valid MAC. */
-        for (i = 0; i < ETH_ALEN; i++) {
-                if (!isxdigit(s[i * 3]) || !isxdigit(s[i * 3 + 1]))
-                        return 0;
-                if (i != ETH_ALEN - 1 && s[i * 3 + 2] != ':')
-                        return 0;
-        }
-        for (i = 0; i < ETH_ALEN; i++) {
-                mac[i] = (hex_to_bin(s[i * 3]) << 4) | hex_to_bin(s[i * 3 + 1]);
-        }
-        return 1;
-}
-EXPORT_SYMBOL(mac_pton);
diff --git a/net/dccp/ipv6.c b/net/dccp/ipv6.c
index 9c61f9c02fdb..6cf9f7782ad4 100644
--- a/net/dccp/ipv6.c
+++ b/net/dccp/ipv6.c
@@ -135,6 +135,7 @@ static void dccp_v6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
 
                 if (dst)
                         dst->ops->redirect(dst, sk, skb);
+                goto out;
         }
 
         if (type == ICMPV6_PKT_TOOBIG) {
diff --git a/net/dccp/proto.c b/net/dccp/proto.c
index 6c7c78b83940..ba64750f0387 100644
--- a/net/dccp/proto.c
+++ b/net/dccp/proto.c
@@ -336,7 +336,7 @@ unsigned int dccp_poll(struct file *file, struct socket *sock,
                         mask |= POLLIN | POLLRDNORM;
 
                 if (!(sk->sk_shutdown & SEND_SHUTDOWN)) {
-                        if (sk_stream_wspace(sk) >= sk_stream_min_wspace(sk)) {
+                        if (sk_stream_is_writeable(sk)) {
                                 mask |= POLLOUT | POLLWRNORM;
                         } else {  /* send SIGIO later */
                                 set_bit(SOCK_ASYNC_NOSPACE,
@@ -347,7 +347,7 @@ unsigned int dccp_poll(struct file *file, struct socket *sock,
                                  * wspace test but before the flags are set,
                                  * IO signal will be lost.
                                  */
-                                if (sk_stream_wspace(sk) >= sk_stream_min_wspace(sk))
+                                if (sk_stream_is_writeable(sk))
                                         mask |= POLLOUT | POLLWRNORM;
                         }
                 }
diff --git a/net/decnet/af_decnet.c b/net/decnet/af_decnet.c
index c21f200eed93..dd4d506ef923 100644
--- a/net/decnet/af_decnet.c
+++ b/net/decnet/af_decnet.c
@@ -2078,9 +2078,9 @@ out_err:
 }
 
 static int dn_device_event(struct notifier_block *this, unsigned long event,
-                        void *ptr)
+                           void *ptr)
 {
-        struct net_device *dev = (struct net_device *)ptr;
+        struct net_device *dev = netdev_notifier_info_to_dev(ptr);
 
         if (!net_eq(dev_net(dev), &init_net))
                 return NOTIFY_DONE;
diff --git a/net/decnet/dn_dev.c b/net/decnet/dn_dev.c
index 7d9197063ebb..dd0dfb25f4b1 100644
--- a/net/decnet/dn_dev.c
+++ b/net/decnet/dn_dev.c
@@ -158,11 +158,11 @@ static int max_t3[] = { 8191 }; /* Must fit in 16 bits when multiplied by BCT3MU
 static int min_priority[1];
 static int max_priority[] = { 127 }; /* From DECnet spec */
 
-static int dn_forwarding_proc(ctl_table *, int,
+static int dn_forwarding_proc(struct ctl_table *, int,
                         void __user *, size_t *, loff_t *);
 static struct dn_dev_sysctl_table {
         struct ctl_table_header *sysctl_header;
-        ctl_table dn_dev_vars[5];
+        struct ctl_table dn_dev_vars[5];
 } dn_dev_sysctl = {
         NULL,
         {
@@ -242,7 +242,7 @@ static void dn_dev_sysctl_unregister(struct dn_dev_parms *parms)
         }
 }
 
-static int dn_forwarding_proc(ctl_table *table, int write,
+static int dn_forwarding_proc(struct ctl_table *table, int write,
                                 void __user *buffer,
                                 size_t *lenp, loff_t *ppos)
 {
diff --git a/net/decnet/sysctl_net_decnet.c b/net/decnet/sysctl_net_decnet.c
index a55eeccaa72f..5325b541c526 100644
--- a/net/decnet/sysctl_net_decnet.c
+++ b/net/decnet/sysctl_net_decnet.c
@@ -132,7 +132,7 @@ static int parse_addr(__le16 *addr, char *str)
         return 0;
 }
 
-static int dn_node_address_handler(ctl_table *table, int write,
+static int dn_node_address_handler(struct ctl_table *table, int write,
                                 void __user *buffer,
                                 size_t *lenp, loff_t *ppos)
 {
@@ -183,7 +183,7 @@ static int dn_node_address_handler(ctl_table *table, int write,
         return 0;
 }
 
-static int dn_def_dev_handler(ctl_table *table, int write,
+static int dn_def_dev_handler(struct ctl_table *table, int write,
                                 void __user *buffer,
                                 size_t *lenp, loff_t *ppos)
 {
@@ -246,7 +246,7 @@ static int dn_def_dev_handler(ctl_table *table, int write,
         return 0;
 }
 
-static ctl_table dn_table[] = {
+static struct ctl_table dn_table[] = {
         {
                 .procname = "node_address",
                 .maxlen = 7,
diff --git a/net/dns_resolver/dns_key.c b/net/dns_resolver/dns_key.c
index 0a69d0757795..f347a2ca7d7e 100644
--- a/net/dns_resolver/dns_key.c
+++ b/net/dns_resolver/dns_key.c
@@ -118,7 +118,7 @@ dns_resolver_instantiate(struct key *key, struct key_preparsed_payload *prep)
                                 if (opt_vlen <= 0)
                                         goto bad_option_value;
 
-                                ret = strict_strtoul(eq, 10, &derrno);
+                                ret = kstrtoul(eq, 10, &derrno);
                                 if (ret < 0)
                                         goto bad_option_value;
 
diff --git a/net/dsa/slave.c b/net/dsa/slave.c
index 6ebd8fbd9285..29d684ebca6a 100644
--- a/net/dsa/slave.c
+++ b/net/dsa/slave.c
@@ -347,7 +347,7 @@ dsa_slave_create(struct dsa_switch *ds, struct device *parent,
 
         slave_dev->features = master->vlan_features;
         SET_ETHTOOL_OPS(slave_dev, &dsa_slave_ethtool_ops);
-        memcpy(slave_dev->dev_addr, master->dev_addr, ETH_ALEN);
+        eth_hw_addr_inherit(slave_dev, master);
         slave_dev->tx_queue_len = 0;
 
         switch (ds->dst->tag_protocol) {
diff --git a/net/ethernet/eth.c b/net/ethernet/eth.c
index 5359560926bc..be1f64d35358 100644
--- a/net/ethernet/eth.c
+++ b/net/ethernet/eth.c
@@ -401,27 +401,8 @@ struct net_device *alloc_etherdev_mqs(int sizeof_priv, unsigned int txqs,
 }
 EXPORT_SYMBOL(alloc_etherdev_mqs);
 
-static size_t _format_mac_addr(char *buf, int buflen,
-                               const unsigned char *addr, int len)
-{
-        int i;
-        char *cp = buf;
-
-        for (i = 0; i < len; i++) {
-                cp += scnprintf(cp, buflen - (cp - buf), "%02x", addr[i]);
-                if (i == len - 1)
-                        break;
-                cp += scnprintf(cp, buflen - (cp - buf), ":");
-        }
-        return cp - buf;
-}
-
 ssize_t sysfs_format_mac(char *buf, const unsigned char *addr, int len)
 {
-        size_t l;
-
-        l = _format_mac_addr(buf, PAGE_SIZE, addr, len);
-        l += scnprintf(buf + l, PAGE_SIZE - l, "\n");
-        return (ssize_t)l;
+        return scnprintf(buf, PAGE_SIZE, "%*phC\n", len, addr);
 }
 EXPORT_SYMBOL(sysfs_format_mac);
diff --git a/net/ieee802154/6lowpan.c b/net/ieee802154/6lowpan.c
index 55e1fd5b3e56..c85e71e0c7ff 100644
--- a/net/ieee802154/6lowpan.c
+++ b/net/ieee802154/6lowpan.c
@@ -67,39 +67,6 @@ static const u8 lowpan_ttl_values[] = {0, 1, 64, 255};
 
 static LIST_HEAD(lowpan_devices);
 
-/*
- * Uncompression of linklocal:
- *   0 -> 16 bytes from packet
- *   1 -> 2  bytes from prefix - bunch of zeroes and 8 from packet
- *   2 -> 2  bytes from prefix - zeroes + 2 from packet
- *   3 -> 2  bytes from prefix - infer 8 bytes from lladdr
- *
- *  NOTE: => the uncompress function does change 0xf to 0x10
- *  NOTE: 0x00 => no-autoconfig => unspecified
- */
-static const u8 lowpan_unc_llconf[] = {0x0f, 0x28, 0x22, 0x20};
-
-/*
- * Uncompression of ctx-based:
- *   0 -> 0 bits  from packet [unspecified / reserved]
- *   1 -> 8 bytes from prefix - bunch of zeroes and 8 from packet
- *   2 -> 8 bytes from prefix - zeroes + 2 from packet
- *   3 -> 8 bytes from prefix - infer 8 bytes from lladdr
- */
-static const u8 lowpan_unc_ctxconf[] = {0x00, 0x88, 0x82, 0x80};
-
-/*
- * Uncompression of ctx-base
- *   0 -> 0 bits from packet
- *   1 -> 2 bytes from prefix - bunch of zeroes 5 from packet
- *   2 -> 2 bytes from prefix - zeroes + 3 from packet
- *   3 -> 2 bytes from prefix - infer 1 bytes from lladdr
- */
-static const u8 lowpan_unc_mxconf[] = {0x0f, 0x25, 0x23, 0x21};
-
-/* Link local prefix */
-static const u8 lowpan_llprefix[] = {0xfe, 0x80};
-
 /* private device info */
 struct lowpan_dev_info {
         struct net_device       *real_dev; /* real WPAN device ptr */
@@ -191,55 +158,177 @@ lowpan_compress_addr_64(u8 **hc06_ptr, u8 shift, const struct in6_addr *ipaddr,
         return rol8(val, shift);
 }
 
-static void
-lowpan_uip_ds6_set_addr_iid(struct in6_addr *ipaddr, unsigned char *lladdr)
+/*
+ * Uncompress address function for source and
+ * destination address(non-multicast).
+ *
+ * address_mode is sam value or dam value.
+ */
+static int
+lowpan_uncompress_addr(struct sk_buff *skb,
+                struct in6_addr *ipaddr,
+                const u8 address_mode,
+                const struct ieee802154_addr *lladdr)
 {
-        memcpy(&ipaddr->s6_addr[8], lladdr, IEEE802154_ADDR_LEN);
-        /* second bit-flip (Universe/Local) is done according RFC2464 */
-        ipaddr->s6_addr[8] ^= 0x02;
+        bool fail;
+
+        switch (address_mode) {
+        case LOWPAN_IPHC_ADDR_00:
+                /* for global link addresses */
+                fail = lowpan_fetch_skb(skb, ipaddr->s6_addr, 16);
+                break;
+        case LOWPAN_IPHC_ADDR_01:
+                /* fe:80::XXXX:XXXX:XXXX:XXXX */
+                ipaddr->s6_addr[0] = 0xFE;
+                ipaddr->s6_addr[1] = 0x80;
+                fail = lowpan_fetch_skb(skb, &ipaddr->s6_addr[8], 8);
+                break;
+        case LOWPAN_IPHC_ADDR_02:
+                /* fe:80::ff:fe00:XXXX */
+                ipaddr->s6_addr[0] = 0xFE;
+                ipaddr->s6_addr[1] = 0x80;
+                ipaddr->s6_addr[11] = 0xFF;
+                ipaddr->s6_addr[12] = 0xFE;
+                fail = lowpan_fetch_skb(skb, &ipaddr->s6_addr[14], 2);
+                break;
+        case LOWPAN_IPHC_ADDR_03:
+                fail = false;
+                switch (lladdr->addr_type) {
+                case IEEE802154_ADDR_LONG:
+                        /* fe:80::XXXX:XXXX:XXXX:XXXX
+                         *        \_________________/
+                         *              hwaddr
+                         */
+                        ipaddr->s6_addr[0] = 0xFE;
+                        ipaddr->s6_addr[1] = 0x80;
+                        memcpy(&ipaddr->s6_addr[8], lladdr->hwaddr,
+                                        IEEE802154_ADDR_LEN);
+                        /* second bit-flip (Universe/Local)
+                         * is done according RFC2464
+                         */
+                        ipaddr->s6_addr[8] ^= 0x02;
+                        break;
+                case IEEE802154_ADDR_SHORT:
+                        /* fe:80::ff:fe00:XXXX
+                         *                \__/
+                         *             short_addr
+                         *
+                         * Universe/Local bit is zero.
+                         */
+                        ipaddr->s6_addr[0] = 0xFE;
+                        ipaddr->s6_addr[1] = 0x80;
+                        ipaddr->s6_addr[11] = 0xFF;
+                        ipaddr->s6_addr[12] = 0xFE;
+                        ipaddr->s6_addr16[7] = htons(lladdr->short_addr);
+                        break;
+                default:
+                        pr_debug("Invalid addr_type set\n");
+                        return -EINVAL;
+                }
+                break;
+        default:
+                pr_debug("Invalid address mode value: 0x%x\n", address_mode);
+                return -EINVAL;
+        }
+
+        if (fail) {
+                pr_debug("Failed to fetch skb data\n");
+                return -EIO;
+        }
+
+        lowpan_raw_dump_inline(NULL, "Reconstructed ipv6 addr is:\n",
+                        ipaddr->s6_addr, 16);
+
+        return 0;
 }
 
-/*
- * Uncompress addresses based on a prefix and a postfix with zeroes in
- * between. If the postfix is zero in length it will use the link address
- * to configure the IP address (autoconf style).
- * pref_post_count takes a byte where the first nibble specify prefix count
- * and the second postfix count (NOTE: 15/0xf => 16 bytes copy).
+/* Uncompress address function for source context
+ * based address(non-multicast).
  */
 static int
-lowpan_uncompress_addr(struct sk_buff *skb, struct in6_addr *ipaddr,
-        u8 const *prefix, u8 pref_post_count, unsigned char *lladdr)
+lowpan_uncompress_context_based_src_addr(struct sk_buff *skb,
+                struct in6_addr *ipaddr,
+                const u8 sam)
 {
-        u8 prefcount = pref_post_count >> 4;
-        u8 postcount = pref_post_count & 0x0f;
-
-        /* full nibble 15 => 16 */
-        prefcount = (prefcount == 15 ? 16 : prefcount);
-        postcount = (postcount == 15 ? 16 : postcount);
-
-        if (lladdr)
-                lowpan_raw_dump_inline(__func__, "linklocal address",
-                                                lladdr, IEEE802154_ADDR_LEN);
-        if (prefcount > 0)
-                memcpy(ipaddr, prefix, prefcount);
-
-        if (prefcount + postcount < 16)
-                memset(&ipaddr->s6_addr[prefcount], 0,
-                                        16 - (prefcount + postcount));
-
-        if (postcount > 0) {
-                memcpy(&ipaddr->s6_addr[16 - postcount], skb->data, postcount);
-                skb_pull(skb, postcount);
-        } else if (prefcount > 0) {
-                if (lladdr == NULL)
-                        return -EINVAL;
+        switch (sam) {
+        case LOWPAN_IPHC_ADDR_00:
+                /* unspec address ::
+                 * Do nothing, address is already ::
+                 */
+                break;
+        case LOWPAN_IPHC_ADDR_01:
+                /* TODO */
+        case LOWPAN_IPHC_ADDR_02:
+                /* TODO */
+        case LOWPAN_IPHC_ADDR_03:
+                /* TODO */
+                netdev_warn(skb->dev, "SAM value 0x%x not supported\n", sam);
+                return -EINVAL;
+        default:
+                pr_debug("Invalid sam value: 0x%x\n", sam);
+                return -EINVAL;
+        }
+
+        lowpan_raw_dump_inline(NULL,
+                        "Reconstructed context based ipv6 src addr is:\n",
+                        ipaddr->s6_addr, 16);
+
+        return 0;
+}
 
-                /* no IID based configuration if no prefix and no data */
-                lowpan_uip_ds6_set_addr_iid(ipaddr, lladdr);
+/* Uncompress function for multicast destination address,
+ * when M bit is set.
+ */
+static int
+lowpan_uncompress_multicast_daddr(struct sk_buff *skb,
+                struct in6_addr *ipaddr,
+                const u8 dam)
+{
+        bool fail;
+
+        switch (dam) {
+        case LOWPAN_IPHC_DAM_00:
+                /* 00:  128 bits.  The full address
+                 * is carried in-line.
+                 */
+                fail = lowpan_fetch_skb(skb, ipaddr->s6_addr, 16);
+                break;
+        case LOWPAN_IPHC_DAM_01:
+                /* 01:  48 bits.  The address takes
+                 * the form ffXX::00XX:XXXX:XXXX.
+                 */
+                ipaddr->s6_addr[0] = 0xFF;
+                fail = lowpan_fetch_skb(skb, &ipaddr->s6_addr[1], 1);
+                fail |= lowpan_fetch_skb(skb, &ipaddr->s6_addr[11], 5);
+                break;
+        case LOWPAN_IPHC_DAM_10:
+                /* 10:  32 bits.  The address takes
+                 * the form ffXX::00XX:XXXX.
+                 */
+                ipaddr->s6_addr[0] = 0xFF;
+                fail = lowpan_fetch_skb(skb, &ipaddr->s6_addr[1], 1);
+                fail |= lowpan_fetch_skb(skb, &ipaddr->s6_addr[13], 3);
+                break;
+        case LOWPAN_IPHC_DAM_11:
+                /* 11:  8 bits.  The address takes
+                 * the form ff02::00XX.
+                 */
+                ipaddr->s6_addr[0] = 0xFF;
+                ipaddr->s6_addr[1] = 0x02;
+                fail = lowpan_fetch_skb(skb, &ipaddr->s6_addr[15], 1);
+                break;
+        default:
+                pr_debug("DAM value has a wrong value: 0x%x\n", dam);
+                return -EINVAL;
+        }
+
+        if (fail) {
+                pr_debug("Failed to fetch skb data\n");
+                return -EIO;
         }
 
-        pr_debug("uncompressing %d + %d => ", prefcount, postcount);
-        lowpan_raw_dump_inline(NULL, NULL, ipaddr->s6_addr, 16);
+        lowpan_raw_dump_inline(NULL, "Reconstructed ipv6 multicast addr is:\n",
+                        ipaddr->s6_addr, 16);
 
         return 0;
 }
@@ -702,6 +791,12 @@ lowpan_alloc_new_frame(struct sk_buff *skb, u16 len, u16 tag)
         skb_reserve(frame->skb, sizeof(struct ipv6hdr));
         skb_put(frame->skb, frame->length);
 
+        /* copy the first control block to keep a
+         * trace of the link-layer addresses in case
+         * of a link-local compressed address
+         */
+        memcpy(frame->skb->cb, skb->cb, sizeof(skb->cb));
+
         init_timer(&frame->timer);
         /* time out is the same as for ipv6 - 60 sec */
         frame->timer.expires = jiffies + LOWPAN_FRAG_TIMEOUT;
@@ -723,9 +818,9 @@ frame_err:
 static int
 lowpan_process_data(struct sk_buff *skb)
 {
-        struct ipv6hdr hdr;
+        struct ipv6hdr hdr = {};
         u8 tmp, iphc0, iphc1, num_context = 0;
-        u8 *_saddr, *_daddr;
+        const struct ieee802154_addr *_saddr, *_daddr;
         int err;
 
         lowpan_raw_dump_table(__func__, "raw skb data dump", skb->data,
@@ -828,8 +923,8 @@ lowpan_process_data(struct sk_buff *skb)
         if (lowpan_fetch_skb_u8(skb, &iphc1))
                 goto drop;
 
-        _saddr = mac_cb(skb)->sa.hwaddr;
-        _daddr = mac_cb(skb)->da.hwaddr;
+        _saddr = &mac_cb(skb)->sa;
+        _daddr = &mac_cb(skb)->da;
 
         pr_debug("iphc0 = %02x, iphc1 = %02x\n", iphc0, iphc1);
 
@@ -868,8 +963,6 @@ lowpan_process_data(struct sk_buff *skb)
 
                 hdr.priority = ((tmp >> 2) & 0x0f);
                 hdr.flow_lbl[0] = ((tmp << 6) & 0xC0) | ((tmp >> 2) & 0x30);
-                hdr.flow_lbl[1] = 0;
-                hdr.flow_lbl[2] = 0;
                 break;
         /*
          * Flow Label carried in-line
@@ -885,10 +978,6 @@ lowpan_process_data(struct sk_buff *skb)
                 break;
         /* Traffic Class and Flow Label are elided */
         case 3: /* 11b */
-                hdr.priority = 0;
-                hdr.flow_lbl[0] = 0;
-                hdr.flow_lbl[1] = 0;
-                hdr.flow_lbl[2] = 0;
                 break;
         default:
                 break;
@@ -915,10 +1004,18 @@ lowpan_process_data(struct sk_buff *skb)
         /* Extract SAM to the tmp variable */
         tmp = ((iphc1 & LOWPAN_IPHC_SAM) >> LOWPAN_IPHC_SAM_BIT) & 0x03;
 
-        /* Source address uncompression */
-        pr_debug("source address stateless compression\n");
-        err = lowpan_uncompress_addr(skb, &hdr.saddr, lowpan_llprefix,
-                                lowpan_unc_llconf[tmp], skb->data);
+        if (iphc1 & LOWPAN_IPHC_SAC) {
+                /* Source address context based uncompression */
+                pr_debug("SAC bit is set. Handle context based source address.\n");
+                err = lowpan_uncompress_context_based_src_addr(
+                                skb, &hdr.saddr, tmp);
+        } else {
+                /* Source address uncompression */
+                pr_debug("source address stateless compression\n");
+                err = lowpan_uncompress_addr(skb, &hdr.saddr, tmp, _saddr);
+        }
+
+        /* Check on error of previous branch */
         if (err)
                 goto drop;
 
@@ -931,23 +1028,14 @@ lowpan_process_data(struct sk_buff *skb)
                         pr_debug("dest: context-based mcast compression\n");
                         /* TODO: implement this */
                 } else {
-                        u8 prefix[] = {0xff, 0x02};
-
-                        pr_debug("dest: non context-based mcast compression\n");
-                        if (0 < tmp && tmp < 3) {
-                                if (lowpan_fetch_skb_u8(skb, &prefix[1]))
-                                        goto drop;
-                        }
-
-                        err = lowpan_uncompress_addr(skb, &hdr.daddr, prefix,
-                                        lowpan_unc_mxconf[tmp], NULL);
+                        err = lowpan_uncompress_multicast_daddr(
+                                        skb, &hdr.daddr, tmp);
                         if (err)
                                 goto drop;
                 }
         } else {
                 pr_debug("dest: stateless compression\n");
-                err = lowpan_uncompress_addr(skb, &hdr.daddr, lowpan_llprefix,
-                                lowpan_unc_llconf[tmp], skb->data);
+                err = lowpan_uncompress_addr(skb, &hdr.daddr, tmp, _daddr);
                 if (err)
                         goto drop;
         }
@@ -1352,10 +1440,9 @@ static inline void lowpan_netlink_fini(void)
 }
 
 static int lowpan_device_event(struct notifier_block *unused,
-                                unsigned long event,
-                                void *ptr)
+                               unsigned long event, void *ptr)
 {
-        struct net_device *dev = ptr;
+        struct net_device *dev = netdev_notifier_info_to_dev(ptr);
         LIST_HEAD(del_list);
         struct lowpan_dev_record *entry, *tmp;
 
diff --git a/net/ieee802154/6lowpan.h b/net/ieee802154/6lowpan.h
index 4b8f917658b5..2869c0526dad 100644
--- a/net/ieee802154/6lowpan.h
+++ b/net/ieee802154/6lowpan.h
@@ -193,10 +193,12 @@
 /* Values of fields within the IPHC encoding second byte */
 #define LOWPAN_IPHC_CID         0x80
 
+#define LOWPAN_IPHC_ADDR_00     0x00
+#define LOWPAN_IPHC_ADDR_01     0x01
+#define LOWPAN_IPHC_ADDR_02     0x02
+#define LOWPAN_IPHC_ADDR_03     0x03
+
 #define LOWPAN_IPHC_SAC         0x40
-#define LOWPAN_IPHC_SAM_00      0x00
-#define LOWPAN_IPHC_SAM_01      0x10
-#define LOWPAN_IPHC_SAM_10      0x20
 #define LOWPAN_IPHC_SAM         0x30
 
 #define LOWPAN_IPHC_SAM_BIT     4
@@ -230,4 +232,16 @@
                                         dest = 16 bit inline */
 #define LOWPAN_NHC_UDP_CS_P_11  0xF3 /* source & dest = 0xF0B + 4bit inline */
 
+static inline bool lowpan_fetch_skb(struct sk_buff *skb,
+                void *data, const unsigned int len)
+{
+        if (unlikely(!pskb_may_pull(skb, len)))
+                return true;
+
+        skb_copy_from_linear_data(skb, data, len);
+        skb_pull(skb, len);
+
+        return false;
+}
+
 #endif /* __6LOWPAN_H__ */
diff --git a/net/ieee802154/wpan-class.c b/net/ieee802154/wpan-class.c
index 13571eae6bae..ef56ab5b35fe 100644
--- a/net/ieee802154/wpan-class.c
+++ b/net/ieee802154/wpan-class.c
@@ -36,7 +36,8 @@ static ssize_t name ## _show(struct device *dev,			\
         ret = snprintf(buf, PAGE_SIZE, format_string "\n", args);       \
         mutex_unlock(&phy->pib_lock);                                   \
         return ret;                                                     \
-}
+}                                                                       \
+static DEVICE_ATTR_RO(name);
 
 #define MASTER_SHOW(field, format_string)                               \
         MASTER_SHOW_COMPLEX(field, format_string, phy->field)
@@ -66,15 +67,17 @@ static ssize_t channels_supported_show(struct device *dev,
         mutex_unlock(&phy->pib_lock);
         return len;
 }
-
-static struct device_attribute pmib_attrs[] = {
-        __ATTR_RO(current_channel),
-        __ATTR_RO(current_page),
-        __ATTR_RO(channels_supported),
-        __ATTR_RO(transmit_power),
-        __ATTR_RO(cca_mode),
-        {},
+static DEVICE_ATTR_RO(channels_supported);
+
+static struct attribute *pmib_attrs[] = {
+        &dev_attr_current_channel.attr,
+        &dev_attr_current_page.attr,
+        &dev_attr_channels_supported.attr,
+        &dev_attr_transmit_power.attr,
+        &dev_attr_cca_mode.attr,
+        NULL,
 };
+ATTRIBUTE_GROUPS(pmib);
 
 static void wpan_phy_release(struct device *d)
 {
@@ -85,7 +88,7 @@ static void wpan_phy_release(struct device *d)
 static struct class wpan_phy_class = {
         .name = "ieee802154",
         .dev_release = wpan_phy_release,
-        .dev_attrs = pmib_attrs,
+        .dev_groups = pmib_groups,
 };
 
 static DEFINE_MUTEX(wpan_phy_mutex);
diff --git a/net/ipv4/Kconfig b/net/ipv4/Kconfig
index 8603ca827104..05c57f0fcabe 100644
--- a/net/ipv4/Kconfig
+++ b/net/ipv4/Kconfig
@@ -9,10 +9,7 @@ config IP_MULTICAST
           intend to participate in the MBONE, a high bandwidth network on top
           of the Internet which carries audio and video broadcasts. More
           information about the MBONE is on the WWW at
-          <http://www.savetz.com/mbone/>. Information about the multicast
-          capabilities of the various network cards is contained in
-          <file:Documentation/networking/multicast.txt>. For most people, it's
-          safe to say N.
+          <http://www.savetz.com/mbone/>. For most people, it's safe to say N.
 
 config IP_ADVANCED_ROUTER
         bool "IP: advanced router"
@@ -223,10 +220,8 @@ config IP_MROUTE
           packets that have several destination addresses. It is needed on the
           MBONE, a high bandwidth network on top of the Internet which carries
           audio and video broadcasts. In order to do that, you would most
-          likely run the program mrouted. Information about the multicast
-          capabilities of the various network cards is contained in
-          <file:Documentation/networking/multicast.txt>. If you haven't heard
-          about it, you don't need it.
+          likely run the program mrouted. If you haven't heard about it, you
+          don't need it.
 
 config IP_MROUTE_MULTIPLE_TABLES
         bool "IP: multicast policy routing"
@@ -264,22 +259,6 @@ config IP_PIMSM_V2
           gated-5). This routing protocol is not used widely, so say N unless
           you want to play with it.
 
-config ARPD
-        bool "IP: ARP daemon support"
-        ---help---
-          The kernel maintains an internal cache which maps IP addresses to
-          hardware addresses on the local network, so that Ethernet
-          frames are sent to the proper address on the physical networking
-          layer. Normally, kernel uses the ARP protocol to resolve these
-          mappings.
-
-          Saying Y here adds support to have an user space daemon to do this
-          resolution instead. This is useful for implementing an alternate
-          address resolution protocol (e.g. NHRP on mGRE tunnels) and also for
-          testing purposes.
-
-          If unsure, say N.
-
 config SYN_COOKIES
         bool "IP: TCP syncookie support"
         ---help---
diff --git a/net/ipv4/Makefile b/net/ipv4/Makefile
index 089cb9f36387..4b81e91c80fe 100644
--- a/net/ipv4/Makefile
+++ b/net/ipv4/Makefile
@@ -8,10 +8,10 @@ obj-y     := route.o inetpeer.o protocol.o \
              inet_timewait_sock.o inet_connection_sock.o \
              tcp.o tcp_input.o tcp_output.o tcp_timer.o tcp_ipv4.o \
              tcp_minisocks.o tcp_cong.o tcp_metrics.o tcp_fastopen.o \
-             datagram.o raw.o udp.o udplite.o \
-             arp.o icmp.o devinet.o af_inet.o  igmp.o \
+             tcp_offload.o datagram.o raw.o udp.o udplite.o \
+             udp_offload.o arp.o icmp.o devinet.o af_inet.o igmp.o \
              fib_frontend.o fib_semantics.o fib_trie.o \
-             inet_fragment.o ping.o
+             inet_fragment.o ping.o ip_tunnel_core.o
 
 obj-$(CONFIG_NET_IP_TUNNEL) += ip_tunnel.o
 obj-$(CONFIG_SYSCTL) += sysctl_net_ipv4.o
@@ -19,6 +19,7 @@ obj-$(CONFIG_PROC_FS) += proc.o
 obj-$(CONFIG_IP_MULTIPLE_TABLES) += fib_rules.o
 obj-$(CONFIG_IP_MROUTE) += ipmr.o
 obj-$(CONFIG_NET_IPIP) += ipip.o
+gre-y := gre_demux.o gre_offload.o
 obj-$(CONFIG_NET_IPGRE_DEMUX) += gre.o
 obj-$(CONFIG_NET_IPGRE) += ip_gre.o
 obj-$(CONFIG_NET_IPVTI) += ip_vti.o
diff --git a/net/ipv4/af_inet.c b/net/ipv4/af_inet.c
index d01be2a3ae53..cfeb85cff4f0 100644
--- a/net/ipv4/af_inet.c
+++ b/net/ipv4/af_inet.c
@@ -263,10 +263,8 @@ void build_ehash_secret(void)
                 get_random_bytes(&rnd, sizeof(rnd));
         } while (rnd == 0);
 
-        if (cmpxchg(&inet_ehash_secret, 0, rnd) == 0) {
+        if (cmpxchg(&inet_ehash_secret, 0, rnd) == 0)
                 get_random_bytes(&ipv6_hash_secret, sizeof(ipv6_hash_secret));
-                net_secret_init();
-        }
 }
 EXPORT_SYMBOL(build_ehash_secret);
 
@@ -1295,6 +1293,7 @@ static struct sk_buff *inet_gso_segment(struct sk_buff *skb,
                        SKB_GSO_GRE |
                        SKB_GSO_TCPV6 |
                        SKB_GSO_UDP_TUNNEL |
+                       SKB_GSO_MPLS |
                        0)))
                 goto out;
 
@@ -1384,7 +1383,7 @@ static struct sk_buff **inet_gro_receive(struct sk_buff **head,
                 goto out_unlock;
 
         id = ntohl(*(__be32 *)&iph->id);
-        flush = (u16)((ntohl(*(__be32 *)iph) ^ skb_gro_len(skb)) | (id ^ IP_DF));
+        flush = (u16)((ntohl(*(__be32 *)iph) ^ skb_gro_len(skb)) | (id & ~IP_DF));
         id >>= 16;
 
         for (p = *head; p; p = p->next) {
@@ -1406,6 +1405,7 @@ static struct sk_buff **inet_gro_receive(struct sk_buff **head,
                 NAPI_GRO_CB(p)->flush |=
                         (iph->ttl ^ iph2->ttl) |
                         (iph->tos ^ iph2->tos) |
+                        (__force int)((iph->frag_off ^ iph2->frag_off) & htons(IP_DF)) |
                         ((u16)(ntohs(iph2->id) + NAPI_GRO_CB(p)->count) ^ id);
 
                 NAPI_GRO_CB(p)->flush |= flush;
@@ -1530,18 +1530,6 @@ int snmp_mib_init(void __percpu *ptr[2], size_t mibsize, size_t align)
 }
 EXPORT_SYMBOL_GPL(snmp_mib_init);
 
-void snmp_mib_free(void __percpu *ptr[SNMP_ARRAY_SZ])
-{
-        int i;
-
-        BUG_ON(ptr == NULL);
-        for (i = 0; i < SNMP_ARRAY_SZ; i++) {
-                free_percpu(ptr[i]);
-                ptr[i] = NULL;
-        }
-}
-EXPORT_SYMBOL_GPL(snmp_mib_free);
-
 #ifdef CONFIG_IP_MULTICAST
 static const struct net_protocol igmp_protocol = {
         .handler =      igmp_rcv,
@@ -1557,15 +1545,6 @@ static const struct net_protocol tcp_protocol = {
         .netns_ok       =       1,
 };
 
-static const struct net_offload tcp_offload = {
-        .callbacks = {
-                .gso_send_check =       tcp_v4_gso_send_check,
-                .gso_segment    =       tcp_tso_segment,
-                .gro_receive    =       tcp4_gro_receive,
-                .gro_complete   =       tcp4_gro_complete,
-        },
-};
-
 static const struct net_protocol udp_protocol = {
         .handler =      udp_rcv,
         .err_handler =  udp_err,
@@ -1573,13 +1552,6 @@ static const struct net_protocol udp_protocol = {
         .netns_ok =     1,
 };
 
-static const struct net_offload udp_offload = {
-        .callbacks = {
-                .gso_send_check = udp4_ufo_send_check,
-                .gso_segment = udp4_ufo_fragment,
-        },
-};
-
 static const struct net_protocol icmp_protocol = {
         .handler =      icmp_rcv,
         .err_handler =  icmp_err,
@@ -1679,10 +1651,10 @@ static int __init ipv4_offload_init(void)
         /*
          * Add offloads
          */
-        if (inet_add_offload(&udp_offload, IPPROTO_UDP) < 0)
+        if (udpv4_offload_init() < 0)
                 pr_crit("%s: Cannot add UDP protocol offload\n", __func__);
-        if (inet_add_offload(&tcp_offload, IPPROTO_TCP) < 0)
-                pr_crit("%s: Cannot add TCP protocol offlaod\n", __func__);
+        if (tcpv4_offload_init() < 0)
+                pr_crit("%s: Cannot add TCP protocol offload\n", __func__);
 
         dev_add_offload(&ip_packet_offload);
         return 0;
diff --git a/net/ipv4/ah4.c b/net/ipv4/ah4.c
index 2e7f1948216f..717902669d2f 100644
--- a/net/ipv4/ah4.c
+++ b/net/ipv4/ah4.c
@@ -419,12 +419,9 @@ static void ah4_err(struct sk_buff *skb, u32 info)
         if (!x)
                 return;
 
-        if (icmp_hdr(skb)->type == ICMP_DEST_UNREACH) {
-                atomic_inc(&flow_cache_genid);
-                rt_genid_bump(net);
-
+        if (icmp_hdr(skb)->type == ICMP_DEST_UNREACH)
                 ipv4_update_pmtu(skb, net, info, 0, 0, IPPROTO_AH, 0);
-        } else
+        else
                 ipv4_redirect(skb, net, 0, 0, IPPROTO_AH, 0);
         xfrm_state_put(x);
 }
diff --git a/net/ipv4/arp.c b/net/ipv4/arp.c
index 247ec1951c35..7808093cede6 100644
--- a/net/ipv4/arp.c
+++ b/net/ipv4/arp.c
@@ -368,9 +368,7 @@ static void arp_solicit(struct neighbour *neigh, struct sk_buff *skb)
         } else {
                 probes -= neigh->parms->app_probes;
                 if (probes < 0) {
-#ifdef CONFIG_ARPD
                         neigh_app_ns(neigh);
-#endif
                         return;
                 }
         }
@@ -1234,13 +1232,19 @@ out:
 static int arp_netdev_event(struct notifier_block *this, unsigned long event,
                             void *ptr)
 {
-        struct net_device *dev = ptr;
+        struct net_device *dev = netdev_notifier_info_to_dev(ptr);
+        struct netdev_notifier_change_info *change_info;
 
         switch (event) {
         case NETDEV_CHANGEADDR:
                 neigh_changeaddr(&arp_tbl, dev);
                 rt_cache_flush(dev_net(dev));
                 break;
+        case NETDEV_CHANGE:
+                change_info = ptr;
+                if (change_info->flags_changed & IFF_NOARP)
+                        neigh_changeaddr(&arp_tbl, dev);
+                break;
         default:
                 break;
         }
diff --git a/net/ipv4/devinet.c b/net/ipv4/devinet.c
index dfc39d4d48b7..a1b5bcbd04ae 100644
--- a/net/ipv4/devinet.c
+++ b/net/ipv4/devinet.c
@@ -73,6 +73,8 @@ static struct ipv4_devconf ipv4_devconf = {
                 [IPV4_DEVCONF_SEND_REDIRECTS - 1] = 1,
                 [IPV4_DEVCONF_SECURE_REDIRECTS - 1] = 1,
                 [IPV4_DEVCONF_SHARED_MEDIA - 1] = 1,
+                [IPV4_DEVCONF_IGMPV2_UNSOLICITED_REPORT_INTERVAL - 1] = 10000 /*ms*/,
+                [IPV4_DEVCONF_IGMPV3_UNSOLICITED_REPORT_INTERVAL - 1] =  1000 /*ms*/,
         },
 };
 
@@ -83,6 +85,8 @@ static struct ipv4_devconf ipv4_devconf_dflt = {
                 [IPV4_DEVCONF_SECURE_REDIRECTS - 1] = 1,
                 [IPV4_DEVCONF_SHARED_MEDIA - 1] = 1,
                 [IPV4_DEVCONF_ACCEPT_SOURCE_ROUTE - 1] = 1,
+                [IPV4_DEVCONF_IGMPV2_UNSOLICITED_REPORT_INTERVAL - 1] = 10000 /*ms*/,
+                [IPV4_DEVCONF_IGMPV3_UNSOLICITED_REPORT_INTERVAL - 1] =  1000 /*ms*/,
         },
 };
 
@@ -215,6 +219,7 @@ void in_dev_finish_destroy(struct in_device *idev)
 
         WARN_ON(idev->ifa_list);
         WARN_ON(idev->mc_list);
+        kfree(rcu_dereference_protected(idev->mc_hash, 1));
 #ifdef NET_REFCNT_DEBUG
         pr_debug("%s: %p=%s\n", __func__, idev, dev ? dev->name : "NIL");
 #endif
@@ -771,7 +776,7 @@ static struct in_ifaddr *rtm_to_ifaddr(struct net *net, struct nlmsghdr *nlh,
                 ci = nla_data(tb[IFA_CACHEINFO]);
                 if (!ci->ifa_valid || ci->ifa_prefered > ci->ifa_valid) {
                         err = -EINVAL;
-                        goto errout;
+                        goto errout_free;
                 }
                 *pvalid_lft = ci->ifa_valid;
                 *pprefered_lft = ci->ifa_prefered;
@@ -779,6 +784,8 @@ static struct in_ifaddr *rtm_to_ifaddr(struct net *net, struct nlmsghdr *nlh,
 
         return ifa;
 
+errout_free:
+        inet_free_ifa(ifa);
 errout:
         return ERR_PTR(err);
 }
@@ -1123,10 +1130,7 @@ static int inet_gifconf(struct net_device *dev, char __user *buf, int len)
                 if (len < (int) sizeof(ifr))
                         break;
                 memset(&ifr, 0, sizeof(struct ifreq));
-                if (ifa->ifa_label)
-                        strcpy(ifr.ifr_name, ifa->ifa_label);
-                else
-                        strcpy(ifr.ifr_name, dev->name);
+                strcpy(ifr.ifr_name, ifa->ifa_label);
 
                 (*(struct sockaddr_in *)&ifr.ifr_addr).sin_family = AF_INET;
                 (*(struct sockaddr_in *)&ifr.ifr_addr).sin_addr.s_addr =
@@ -1333,7 +1337,7 @@ static void inetdev_send_gratuitous_arp(struct net_device *dev,
 static int inetdev_event(struct notifier_block *this, unsigned long event,
                          void *ptr)
 {
-        struct net_device *dev = ptr;
+        struct net_device *dev = netdev_notifier_info_to_dev(ptr);
         struct in_device *in_dev = __in_dev_get_rtnl(dev);
 
         ASSERT_RTNL();
@@ -1941,7 +1945,7 @@ static void inet_forward_change(struct net *net)
         }
 }
 
-static int devinet_conf_proc(ctl_table *ctl, int write,
+static int devinet_conf_proc(struct ctl_table *ctl, int write,
                              void __user *buffer,
                              size_t *lenp, loff_t *ppos)
 {
@@ -1984,7 +1988,7 @@ static int devinet_conf_proc(ctl_table *ctl, int write,
         return ret;
 }
 
-static int devinet_sysctl_forward(ctl_table *ctl, int write,
+static int devinet_sysctl_forward(struct ctl_table *ctl, int write,
                                   void __user *buffer,
                                   size_t *lenp, loff_t *ppos)
 {
@@ -2027,7 +2031,7 @@ static int devinet_sysctl_forward(ctl_table *ctl, int write,
         return ret;
 }
 
-static int ipv4_doint_and_flush(ctl_table *ctl, int write,
+static int ipv4_doint_and_flush(struct ctl_table *ctl, int write,
                                 void __user *buffer,
                                 size_t *lenp, loff_t *ppos)
 {
@@ -2094,11 +2098,15 @@ static struct devinet_sysctl_table {
                 DEVINET_SYSCTL_RW_ENTRY(ARP_ACCEPT, "arp_accept"),
                 DEVINET_SYSCTL_RW_ENTRY(ARP_NOTIFY, "arp_notify"),
                 DEVINET_SYSCTL_RW_ENTRY(PROXY_ARP_PVLAN, "proxy_arp_pvlan"),
+                DEVINET_SYSCTL_RW_ENTRY(FORCE_IGMP_VERSION,
+                                        "force_igmp_version"),
+                DEVINET_SYSCTL_RW_ENTRY(IGMPV2_UNSOLICITED_REPORT_INTERVAL,
+                                        "igmpv2_unsolicited_report_interval"),
+                DEVINET_SYSCTL_RW_ENTRY(IGMPV3_UNSOLICITED_REPORT_INTERVAL,
+                                        "igmpv3_unsolicited_report_interval"),
 
                 DEVINET_SYSCTL_FLUSHING_ENTRY(NOXFRM, "disable_xfrm"),
                 DEVINET_SYSCTL_FLUSHING_ENTRY(NOPOLICY, "disable_policy"),
-                DEVINET_SYSCTL_FLUSHING_ENTRY(FORCE_IGMP_VERSION,
-                                              "force_igmp_version"),
                 DEVINET_SYSCTL_FLUSHING_ENTRY(PROMOTE_SECONDARIES,
                                               "promote_secondaries"),
                 DEVINET_SYSCTL_FLUSHING_ENTRY(ROUTE_LOCALNET,
diff --git a/net/ipv4/esp4.c b/net/ipv4/esp4.c
index 4cfe34d4cc96..109ee89f123e 100644
--- a/net/ipv4/esp4.c
+++ b/net/ipv4/esp4.c
@@ -477,7 +477,7 @@ static u32 esp4_get_mtu(struct xfrm_state *x, int mtu)
         }
 
         return ((mtu - x->props.header_len - crypto_aead_authsize(esp->aead) -
-                 net_adj) & ~(align - 1)) + (net_adj - 2);
+                 net_adj) & ~(align - 1)) + net_adj - 2;
 }
 
 static void esp4_err(struct sk_buff *skb, u32 info)
@@ -502,12 +502,9 @@ static void esp4_err(struct sk_buff *skb, u32 info)
         if (!x)
                 return;
 
-        if (icmp_hdr(skb)->type == ICMP_DEST_UNREACH) {
-                atomic_inc(&flow_cache_genid);
-                rt_genid_bump(net);
-
+        if (icmp_hdr(skb)->type == ICMP_DEST_UNREACH)
                 ipv4_update_pmtu(skb, net, info, 0, 0, IPPROTO_ESP, 0);
-        } else
+        else
                 ipv4_redirect(skb, net, 0, 0, IPPROTO_ESP, 0);
         xfrm_state_put(x);
 }
diff --git a/net/ipv4/fib_frontend.c b/net/ipv4/fib_frontend.c
index c7629a209f9d..b3f627ac4ed8 100644
--- a/net/ipv4/fib_frontend.c
+++ b/net/ipv4/fib_frontend.c
@@ -961,7 +961,7 @@ static void nl_fib_input(struct sk_buff *skb)
             nlmsg_len(nlh) < sizeof(*frn))
                 return;
 
-        skb = skb_clone(skb, GFP_KERNEL);
+        skb = netlink_skb_clone(skb, GFP_KERNEL);
         if (skb == NULL)
                 return;
         nlh = nlmsg_hdr(skb);
@@ -1038,7 +1038,7 @@ static int fib_inetaddr_event(struct notifier_block *this, unsigned long event,
 
 static int fib_netdev_event(struct notifier_block *this, unsigned long event, void *ptr)
 {
-        struct net_device *dev = ptr;
+        struct net_device *dev = netdev_notifier_info_to_dev(ptr);
         struct in_device *in_dev;
         struct net *net = dev_net(dev);
 
diff --git a/net/ipv4/fib_rules.c b/net/ipv4/fib_rules.c
index 26aa65d1fce4..523be38e37de 100644
--- a/net/ipv4/fib_rules.c
+++ b/net/ipv4/fib_rules.c
@@ -101,6 +101,30 @@ errout:
         return err;
 }
 
+static bool fib4_rule_suppress(struct fib_rule *rule, struct fib_lookup_arg *arg)
+{
+        struct fib_result *result = (struct fib_result *) arg->result;
+        struct net_device *dev = result->fi->fib_dev;
+
+        /* do not accept result if the route does
+         * not meet the required prefix length
+         */
+        if (result->prefixlen <= rule->suppress_prefixlen)
+                goto suppress_route;
+
+        /* do not accept result if the route uses a device
+         * belonging to a forbidden interface group
+         */
+        if (rule->suppress_ifgroup != -1 && dev && dev->group == rule->suppress_ifgroup)
+                goto suppress_route;
+
+        return false;
+
+suppress_route:
+        if (!(arg->flags & FIB_LOOKUP_NOREF))
+                fib_info_put(result->fi);
+        return true;
+}
 
 static int fib4_rule_match(struct fib_rule *rule, struct flowi *fl, int flags)
 {
@@ -267,6 +291,7 @@ static const struct fib_rules_ops __net_initconst fib4_rules_ops_template = {
         .rule_size      = sizeof(struct fib4_rule),
         .addr_size      = sizeof(u32),
         .action         = fib4_rule_action,
+        .suppress       = fib4_rule_suppress,
         .match          = fib4_rule_match,
         .configure      = fib4_rule_configure,
         .delete         = fib4_rule_delete,
diff --git a/net/ipv4/fib_semantics.c b/net/ipv4/fib_semantics.c
index 8f6cb7a87cd6..d5dbca5ecf62 100644
--- a/net/ipv4/fib_semantics.c
+++ b/net/ipv4/fib_semantics.c
@@ -169,7 +169,8 @@ static void free_nh_exceptions(struct fib_nh *nh)
                         
                         next = rcu_dereference_protected(fnhe->fnhe_next, 1);
 
-                        rt_fibinfo_free(&fnhe->fnhe_rth);
+                        rt_fibinfo_free(&fnhe->fnhe_rth_input);
+                        rt_fibinfo_free(&fnhe->fnhe_rth_output);
 
                         kfree(fnhe);
 
diff --git a/net/ipv4/fib_trie.c b/net/ipv4/fib_trie.c
index 49616fed9340..3df6d3edb2a1 100644
--- a/net/ipv4/fib_trie.c
+++ b/net/ipv4/fib_trie.c
@@ -71,7 +71,6 @@
 #include <linux/init.h>
 #include <linux/list.h>
 #include <linux/slab.h>
-#include <linux/prefetch.h>
 #include <linux/export.h>
 #include <net/net_namespace.h>
 #include <net/ip.h>
@@ -1761,10 +1760,8 @@ static struct leaf *leaf_walk_rcu(struct tnode *p, struct rt_trie_node *c)
                         if (!c)
                                 continue;
 
-                        if (IS_LEAF(c)) {
-                                prefetch(rcu_dereference_rtnl(p->child[idx]));
+                        if (IS_LEAF(c))
                                 return (struct leaf *) c;
-                        }
 
                         /* Rescan start scanning in new node */
                         p = (struct tnode *) c;
@@ -2133,7 +2130,7 @@ static void trie_show_stats(struct seq_file *seq, struct trie_stat *stat)
                 max--;
 
         pointers = 0;
-        for (i = 1; i <= max; i++)
+        for (i = 1; i < max; i++)
                 if (stat->nodesizes[i] != 0) {
                         seq_printf(seq, "  %u: %u",  i, stat->nodesizes[i]);
                         pointers += (1<<i) * stat->nodesizes[i];
diff --git a/net/ipv4/gre.c b/net/ipv4/gre.c
deleted file mode 100644
index b2e805af9b87..000000000000
--- a/net/ipv4/gre.c
+++ /dev/null
@@ -1,253 +0,0 @@
-/*
- *      GRE over IPv4 demultiplexer driver
- *
- *      Authors: Dmitry Kozlov (xeb@mail.ru)
- *
- *      This program is free software; you can redistribute it and/or
- *      modify it under the terms of the GNU General Public License
- *      as published by the Free Software Foundation; either version
- *      2 of the License, or (at your option) any later version.
- *
- */
-
-#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
-
-#include <linux/module.h>
-#include <linux/kernel.h>
-#include <linux/kmod.h>
-#include <linux/skbuff.h>
-#include <linux/in.h>
-#include <linux/ip.h>
-#include <linux/netdevice.h>
-#include <linux/if_tunnel.h>
-#include <linux/spinlock.h>
-#include <net/protocol.h>
-#include <net/gre.h>
-
-
-static const struct gre_protocol __rcu *gre_proto[GREPROTO_MAX] __read_mostly;
-static DEFINE_SPINLOCK(gre_proto_lock);
-
-int gre_add_protocol(const struct gre_protocol *proto, u8 version)
-{
-        if (version >= GREPROTO_MAX)
-                goto err_out;
-
-        spin_lock(&gre_proto_lock);
-        if (gre_proto[version])
-                goto err_out_unlock;
-
-        RCU_INIT_POINTER(gre_proto[version], proto);
-        spin_unlock(&gre_proto_lock);
-        return 0;
-
-err_out_unlock:
-        spin_unlock(&gre_proto_lock);
-err_out:
-        return -1;
-}
-EXPORT_SYMBOL_GPL(gre_add_protocol);
-
-int gre_del_protocol(const struct gre_protocol *proto, u8 version)
-{
-        if (version >= GREPROTO_MAX)
-                goto err_out;
-
-        spin_lock(&gre_proto_lock);
-        if (rcu_dereference_protected(gre_proto[version],
-                        lockdep_is_held(&gre_proto_lock)) != proto)
-                goto err_out_unlock;
-        RCU_INIT_POINTER(gre_proto[version], NULL);
-        spin_unlock(&gre_proto_lock);
-        synchronize_rcu();
-        return 0;
-
-err_out_unlock:
-        spin_unlock(&gre_proto_lock);
-err_out:
-        return -1;
-}
-EXPORT_SYMBOL_GPL(gre_del_protocol);
-
-static int gre_rcv(struct sk_buff *skb)
-{
-        const struct gre_protocol *proto;
-        u8 ver;
-        int ret;
-
-        if (!pskb_may_pull(skb, 12))
-                goto drop;
-
-        ver = skb->data[1]&0x7f;
-        if (ver >= GREPROTO_MAX)
-                goto drop;
-
-        rcu_read_lock();
-        proto = rcu_dereference(gre_proto[ver]);
-        if (!proto || !proto->handler)
-                goto drop_unlock;
-        ret = proto->handler(skb);
-        rcu_read_unlock();
-        return ret;
-
-drop_unlock:
-        rcu_read_unlock();
-drop:
-        kfree_skb(skb);
-        return NET_RX_DROP;
-}
-
-static void gre_err(struct sk_buff *skb, u32 info)
-{
-        const struct gre_protocol *proto;
-        const struct iphdr *iph = (const struct iphdr *)skb->data;
-        u8 ver = skb->data[(iph->ihl<<2) + 1]&0x7f;
-
-        if (ver >= GREPROTO_MAX)
-                return;
-
-        rcu_read_lock();
-        proto = rcu_dereference(gre_proto[ver]);
-        if (proto && proto->err_handler)
-                proto->err_handler(skb, info);
-        rcu_read_unlock();
-}
-
-static struct sk_buff *gre_gso_segment(struct sk_buff *skb,
-                                       netdev_features_t features)
-{
-        struct sk_buff *segs = ERR_PTR(-EINVAL);
-        netdev_features_t enc_features;
-        int ghl = GRE_HEADER_SECTION;
-        struct gre_base_hdr *greh;
-        int mac_len = skb->mac_len;
-        __be16 protocol = skb->protocol;
-        int tnl_hlen;
-        bool csum;
-
-        if (unlikely(skb_shinfo(skb)->gso_type &
-                                ~(SKB_GSO_TCPV4 |
-                                  SKB_GSO_TCPV6 |
-                                  SKB_GSO_UDP |
-                                  SKB_GSO_DODGY |
-                                  SKB_GSO_TCP_ECN |
-                                  SKB_GSO_GRE)))
-                goto out;
-
-        if (unlikely(!pskb_may_pull(skb, sizeof(*greh))))
-                goto out;
-
-        greh = (struct gre_base_hdr *)skb_transport_header(skb);
-
-        if (greh->flags & GRE_KEY)
-                ghl += GRE_HEADER_SECTION;
-        if (greh->flags & GRE_SEQ)
-                ghl += GRE_HEADER_SECTION;
-        if (greh->flags & GRE_CSUM) {
-                ghl += GRE_HEADER_SECTION;
-                csum = true;
-        } else
-                csum = false;
-
-        /* setup inner skb. */
-        skb->protocol = greh->protocol;
-        skb->encapsulation = 0;
-
-        if (unlikely(!pskb_may_pull(skb, ghl)))
-                goto out;
-        __skb_pull(skb, ghl);
-        skb_reset_mac_header(skb);
-        skb_set_network_header(skb, skb_inner_network_offset(skb));
-        skb->mac_len = skb_inner_network_offset(skb);
-
-        /* segment inner packet. */
-        enc_features = skb->dev->hw_enc_features & netif_skb_features(skb);
-        segs = skb_mac_gso_segment(skb, enc_features);
-        if (!segs || IS_ERR(segs))
-                goto out;
-
-        skb = segs;
-        tnl_hlen = skb_tnl_header_len(skb);
-        do {
-                __skb_push(skb, ghl);
-                if (csum) {
-                        __be32 *pcsum;
-
-                        if (skb_has_shared_frag(skb)) {
-                                int err;
-
-                                err = __skb_linearize(skb);
-                                if (err) {
-                                        kfree_skb(segs);
-                                        segs = ERR_PTR(err);
-                                        goto out;
-                                }
-                        }
-
-                        greh = (struct gre_base_hdr *)(skb->data);
-                        pcsum = (__be32 *)(greh + 1);
-                        *pcsum = 0;
-                        *(__sum16 *)pcsum = csum_fold(skb_checksum(skb, 0, skb->len, 0));
-                }
-                __skb_push(skb, tnl_hlen - ghl);
-
-                skb_reset_mac_header(skb);
-                skb_set_network_header(skb, mac_len);
-                skb->mac_len = mac_len;
-                skb->protocol = protocol;
-        } while ((skb = skb->next));
-out:
-        return segs;
-}
-
-static int gre_gso_send_check(struct sk_buff *skb)
-{
-        if (!skb->encapsulation)
-                return -EINVAL;
-        return 0;
-}
-
-static const struct net_protocol net_gre_protocol = {
-        .handler     = gre_rcv,
-        .err_handler = gre_err,
-        .netns_ok    = 1,
-};
-
-static const struct net_offload gre_offload = {
-        .callbacks = {
-                .gso_send_check =       gre_gso_send_check,
-                .gso_segment    =       gre_gso_segment,
-        },
-};
-
-static int __init gre_init(void)
-{
-        pr_info("GRE over IPv4 demultiplexor driver\n");
-
-        if (inet_add_protocol(&net_gre_protocol, IPPROTO_GRE) < 0) {
-                pr_err("can't add protocol\n");
-                return -EAGAIN;
-        }
-
-        if (inet_add_offload(&gre_offload, IPPROTO_GRE)) {
-                pr_err("can't add protocol offload\n");
-                inet_del_protocol(&net_gre_protocol, IPPROTO_GRE);
-                return -EAGAIN;
-        }
-
-        return 0;
-}
-
-static void __exit gre_exit(void)
-{
-        inet_del_offload(&gre_offload, IPPROTO_GRE);
-        inet_del_protocol(&net_gre_protocol, IPPROTO_GRE);
-}
-
-module_init(gre_init);
-module_exit(gre_exit);
-
-MODULE_DESCRIPTION("GRE over IPv4 demultiplexer driver");
-MODULE_AUTHOR("D. Kozlov (xeb@mail.ru)");
-MODULE_LICENSE("GPL");
-
diff --git a/net/ipv4/gre_demux.c b/net/ipv4/gre_demux.c
new file mode 100644
index 000000000000..736c9fc3ef93
--- /dev/null
+++ b/net/ipv4/gre_demux.c
@@ -0,0 +1,414 @@
+/*
+ *      GRE over IPv4 demultiplexer driver
+ *
+ *      Authors: Dmitry Kozlov (xeb@mail.ru)
+ *
+ *      This program is free software; you can redistribute it and/or
+ *      modify it under the terms of the GNU General Public License
+ *      as published by the Free Software Foundation; either version
+ *      2 of the License, or (at your option) any later version.
+ *
+ */
+
+#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
+
+#include <linux/module.h>
+#include <linux/if.h>
+#include <linux/icmp.h>
+#include <linux/kernel.h>
+#include <linux/kmod.h>
+#include <linux/skbuff.h>
+#include <linux/in.h>
+#include <linux/ip.h>
+#include <linux/netdevice.h>
+#include <linux/if_tunnel.h>
+#include <linux/spinlock.h>
+#include <net/protocol.h>
+#include <net/gre.h>
+
+#include <net/icmp.h>
+#include <net/route.h>
+#include <net/xfrm.h>
+
+static const struct gre_protocol __rcu *gre_proto[GREPROTO_MAX] __read_mostly;
+static struct gre_cisco_protocol __rcu *gre_cisco_proto_list[GRE_IP_PROTO_MAX];
+
+int gre_add_protocol(const struct gre_protocol *proto, u8 version)
+{
+        if (version >= GREPROTO_MAX)
+                return -EINVAL;
+
+        return (cmpxchg((const struct gre_protocol **)&gre_proto[version], NULL, proto) == NULL) ?
+                0 : -EBUSY;
+}
+EXPORT_SYMBOL_GPL(gre_add_protocol);
+
+int gre_del_protocol(const struct gre_protocol *proto, u8 version)
+{
+        int ret;
+
+        if (version >= GREPROTO_MAX)
+                return -EINVAL;
+
+        ret = (cmpxchg((const struct gre_protocol **)&gre_proto[version], proto, NULL) == proto) ?
+                0 : -EBUSY;
+
+        if (ret)
+                return ret;
+
+        synchronize_rcu();
+        return 0;
+}
+EXPORT_SYMBOL_GPL(gre_del_protocol);
+
+void gre_build_header(struct sk_buff *skb, const struct tnl_ptk_info *tpi,
+                      int hdr_len)
+{
+        struct gre_base_hdr *greh;
+
+        skb_push(skb, hdr_len);
+
+        greh = (struct gre_base_hdr *)skb->data;
+        greh->flags = tnl_flags_to_gre_flags(tpi->flags);
+        greh->protocol = tpi->proto;
+
+        if (tpi->flags&(TUNNEL_KEY|TUNNEL_CSUM|TUNNEL_SEQ)) {
+                __be32 *ptr = (__be32 *)(((u8 *)greh) + hdr_len - 4);
+
+                if (tpi->flags&TUNNEL_SEQ) {
+                        *ptr = tpi->seq;
+                        ptr--;
+                }
+                if (tpi->flags&TUNNEL_KEY) {
+                        *ptr = tpi->key;
+                        ptr--;
+                }
+                if (tpi->flags&TUNNEL_CSUM &&
+                    !(skb_shinfo(skb)->gso_type & SKB_GSO_GRE)) {
+                        *ptr = 0;
+                        *(__sum16 *)ptr = csum_fold(skb_checksum(skb, 0,
+                                                                 skb->len, 0));
+                }
+        }
+}
+EXPORT_SYMBOL_GPL(gre_build_header);
+
+struct sk_buff *gre_handle_offloads(struct sk_buff *skb, bool gre_csum)
+{
+        int err;
+
+        if (likely(!skb->encapsulation)) {
+                skb_reset_inner_headers(skb);
+                skb->encapsulation = 1;
+        }
+
+        if (skb_is_gso(skb)) {
+                err = skb_unclone(skb, GFP_ATOMIC);
+                if (unlikely(err))
+                        goto error;
+                skb_shinfo(skb)->gso_type |= SKB_GSO_GRE;
+                return skb;
+        } else if (skb->ip_summed == CHECKSUM_PARTIAL && gre_csum) {
+                err = skb_checksum_help(skb);
+                if (unlikely(err))
+                        goto error;
+        } else if (skb->ip_summed != CHECKSUM_PARTIAL)
+                skb->ip_summed = CHECKSUM_NONE;
+
+        return skb;
+error:
+        kfree_skb(skb);
+        return ERR_PTR(err);
+}
+EXPORT_SYMBOL_GPL(gre_handle_offloads);
+
+static __sum16 check_checksum(struct sk_buff *skb)
+{
+        __sum16 csum = 0;
+
+        switch (skb->ip_summed) {
+        case CHECKSUM_COMPLETE:
+                csum = csum_fold(skb->csum);
+
+                if (!csum)
+                        break;
+                /* Fall through. */
+
+        case CHECKSUM_NONE:
+                skb->csum = 0;
+                csum = __skb_checksum_complete(skb);
+                skb->ip_summed = CHECKSUM_COMPLETE;
+                break;
+        }
+
+        return csum;
+}
+
+static int parse_gre_header(struct sk_buff *skb, struct tnl_ptk_info *tpi,
+                            bool *csum_err)
+{
+        unsigned int ip_hlen = ip_hdrlen(skb);
+        const struct gre_base_hdr *greh;
+        __be32 *options;
+        int hdr_len;
+
+        if (unlikely(!pskb_may_pull(skb, sizeof(struct gre_base_hdr))))
+                return -EINVAL;
+
+        greh = (struct gre_base_hdr *)(skb_network_header(skb) + ip_hlen);
+        if (unlikely(greh->flags & (GRE_VERSION | GRE_ROUTING)))
+                return -EINVAL;
+
+        tpi->flags = gre_flags_to_tnl_flags(greh->flags);
+        hdr_len = ip_gre_calc_hlen(tpi->flags);
+
+        if (!pskb_may_pull(skb, hdr_len))
+                return -EINVAL;
+
+        greh = (struct gre_base_hdr *)(skb_network_header(skb) + ip_hlen);
+        tpi->proto = greh->protocol;
+
+        options = (__be32 *)(greh + 1);
+        if (greh->flags & GRE_CSUM) {
+                if (check_checksum(skb)) {
+                        *csum_err = true;
+                        return -EINVAL;
+                }
+                options++;
+        }
+
+        if (greh->flags & GRE_KEY) {
+                tpi->key = *options;
+                options++;
+        } else
+                tpi->key = 0;
+
+        if (unlikely(greh->flags & GRE_SEQ)) {
+                tpi->seq = *options;
+                options++;
+        } else
+                tpi->seq = 0;
+
+        /* WCCP version 1 and 2 protocol decoding.
+         * - Change protocol to IP
+         * - When dealing with WCCPv2, Skip extra 4 bytes in GRE header
+         */
+        if (greh->flags == 0 && tpi->proto == htons(ETH_P_WCCP)) {
+                tpi->proto = htons(ETH_P_IP);
+                if ((*(u8 *)options & 0xF0) != 0x40) {
+                        hdr_len += 4;
+                        if (!pskb_may_pull(skb, hdr_len))
+                                return -EINVAL;
+                }
+        }
+
+        return iptunnel_pull_header(skb, hdr_len, tpi->proto);
+}
+
+static int gre_cisco_rcv(struct sk_buff *skb)
+{
+        struct tnl_ptk_info tpi;
+        int i;
+        bool csum_err = false;
+
+        if (parse_gre_header(skb, &tpi, &csum_err) < 0)
+                goto drop;
+
+        rcu_read_lock();
+        for (i = 0; i < GRE_IP_PROTO_MAX; i++) {
+                struct gre_cisco_protocol *proto;
+                int ret;
+
+                proto = rcu_dereference(gre_cisco_proto_list[i]);
+                if (!proto)
+                        continue;
+                ret = proto->handler(skb, &tpi);
+                if (ret == PACKET_RCVD) {
+                        rcu_read_unlock();
+                        return 0;
+                }
+        }
+        rcu_read_unlock();
+
+        icmp_send(skb, ICMP_DEST_UNREACH, ICMP_PORT_UNREACH, 0);
+drop:
+        kfree_skb(skb);
+        return 0;
+}
+
+static void gre_cisco_err(struct sk_buff *skb, u32 info)
+{
+        /* All the routers (except for Linux) return only
+         * 8 bytes of packet payload. It means, that precise relaying of
+         * ICMP in the real Internet is absolutely infeasible.
+         *
+         * Moreover, Cisco "wise men" put GRE key to the third word
+         * in GRE header. It makes impossible maintaining even soft
+         * state for keyed
+         * GRE tunnels with enabled checksum. Tell them "thank you".
+         *
+         * Well, I wonder, rfc1812 was written by Cisco employee,
+         * what the hell these idiots break standards established
+         * by themselves???
+         */
+
+        const int type = icmp_hdr(skb)->type;
+        const int code = icmp_hdr(skb)->code;
+        struct tnl_ptk_info tpi;
+        bool csum_err = false;
+        int i;
+
+        if (parse_gre_header(skb, &tpi, &csum_err)) {
+                if (!csum_err)          /* ignore csum errors. */
+                        return;
+        }
+
+        if (type == ICMP_DEST_UNREACH && code == ICMP_FRAG_NEEDED) {
+                ipv4_update_pmtu(skb, dev_net(skb->dev), info,
+                                skb->dev->ifindex, 0, IPPROTO_GRE, 0);
+                return;
+        }
+        if (type == ICMP_REDIRECT) {
+                ipv4_redirect(skb, dev_net(skb->dev), skb->dev->ifindex, 0,
+                                IPPROTO_GRE, 0);
+                return;
+        }
+
+        rcu_read_lock();
+        for (i = 0; i < GRE_IP_PROTO_MAX; i++) {
+                struct gre_cisco_protocol *proto;
+
+                proto = rcu_dereference(gre_cisco_proto_list[i]);
+                if (!proto)
+                        continue;
+
+                if (proto->err_handler(skb, info, &tpi) == PACKET_RCVD)
+                        goto out;
+
+        }
+out:
+        rcu_read_unlock();
+}
+
+static int gre_rcv(struct sk_buff *skb)
+{
+        const struct gre_protocol *proto;
+        u8 ver;
+        int ret;
+
+        if (!pskb_may_pull(skb, 12))
+                goto drop;
+
+        ver = skb->data[1]&0x7f;
+        if (ver >= GREPROTO_MAX)
+                goto drop;
+
+        rcu_read_lock();
+        proto = rcu_dereference(gre_proto[ver]);
+        if (!proto || !proto->handler)
+                goto drop_unlock;
+        ret = proto->handler(skb);
+        rcu_read_unlock();
+        return ret;
+
+drop_unlock:
+        rcu_read_unlock();
+drop:
+        kfree_skb(skb);
+        return NET_RX_DROP;
+}
+
+static void gre_err(struct sk_buff *skb, u32 info)
+{
+        const struct gre_protocol *proto;
+        const struct iphdr *iph = (const struct iphdr *)skb->data;
+        u8 ver = skb->data[(iph->ihl<<2) + 1]&0x7f;
+
+        if (ver >= GREPROTO_MAX)
+                return;
+
+        rcu_read_lock();
+        proto = rcu_dereference(gre_proto[ver]);
+        if (proto && proto->err_handler)
+                proto->err_handler(skb, info);
+        rcu_read_unlock();
+}
+
+static const struct net_protocol net_gre_protocol = {
+        .handler     = gre_rcv,
+        .err_handler = gre_err,
+        .netns_ok    = 1,
+};
+
+static const struct gre_protocol ipgre_protocol = {
+        .handler     = gre_cisco_rcv,
+        .err_handler = gre_cisco_err,
+};
+
+int gre_cisco_register(struct gre_cisco_protocol *newp)
+{
+        struct gre_cisco_protocol **proto = (struct gre_cisco_protocol **)
+                                            &gre_cisco_proto_list[newp->priority];
+
+        return (cmpxchg(proto, NULL, newp) == NULL) ? 0 : -EBUSY;
+}
+EXPORT_SYMBOL_GPL(gre_cisco_register);
+
+int gre_cisco_unregister(struct gre_cisco_protocol *del_proto)
+{
+        struct gre_cisco_protocol **proto = (struct gre_cisco_protocol **)
+                                            &gre_cisco_proto_list[del_proto->priority];
+        int ret;
+
+        ret = (cmpxchg(proto, del_proto, NULL) == del_proto) ? 0 : -EINVAL;
+
+        if (ret)
+                return ret;
+
+        synchronize_net();
+        return 0;
+}
+EXPORT_SYMBOL_GPL(gre_cisco_unregister);
+
+static int __init gre_init(void)
+{
+        pr_info("GRE over IPv4 demultiplexor driver\n");
+
+        if (inet_add_protocol(&net_gre_protocol, IPPROTO_GRE) < 0) {
+                pr_err("can't add protocol\n");
+                goto err;
+        }
+
+        if (gre_add_protocol(&ipgre_protocol, GREPROTO_CISCO) < 0) {
+                pr_info("%s: can't add ipgre handler\n", __func__);
+                goto err_gre;
+        }
+
+        if (gre_offload_init()) {
+                pr_err("can't add protocol offload\n");
+                goto err_gso;
+        }
+
+        return 0;
+err_gso:
+        gre_del_protocol(&ipgre_protocol, GREPROTO_CISCO);
+err_gre:
+        inet_del_protocol(&net_gre_protocol, IPPROTO_GRE);
+err:
+        return -EAGAIN;
+}
+
+static void __exit gre_exit(void)
+{
+        gre_offload_exit();
+
+        gre_del_protocol(&ipgre_protocol, GREPROTO_CISCO);
+        inet_del_protocol(&net_gre_protocol, IPPROTO_GRE);
+}
+
+module_init(gre_init);
+module_exit(gre_exit);
+
+MODULE_DESCRIPTION("GRE over IPv4 demultiplexer driver");
+MODULE_AUTHOR("D. Kozlov (xeb@mail.ru)");
+MODULE_LICENSE("GPL");
diff --git a/net/ipv4/gre_offload.c b/net/ipv4/gre_offload.c
new file mode 100644
index 000000000000..55e6bfb3a289
--- /dev/null
+++ b/net/ipv4/gre_offload.c
@@ -0,0 +1,130 @@
+/*
+ *      IPV4 GSO/GRO offload support
+ *      Linux INET implementation
+ *
+ *      This program is free software; you can redistribute it and/or
+ *      modify it under the terms of the GNU General Public License
+ *      as published by the Free Software Foundation; either version
+ *      2 of the License, or (at your option) any later version.
+ *
+ *      GRE GSO support
+ */
+
+#include <linux/skbuff.h>
+#include <net/protocol.h>
+#include <net/gre.h>
+
+static int gre_gso_send_check(struct sk_buff *skb)
+{
+        if (!skb->encapsulation)
+                return -EINVAL;
+        return 0;
+}
+
+static struct sk_buff *gre_gso_segment(struct sk_buff *skb,
+                                       netdev_features_t features)
+{
+        struct sk_buff *segs = ERR_PTR(-EINVAL);
+        netdev_features_t enc_features;
+        int ghl = GRE_HEADER_SECTION;
+        struct gre_base_hdr *greh;
+        int mac_len = skb->mac_len;
+        __be16 protocol = skb->protocol;
+        int tnl_hlen;
+        bool csum;
+
+        if (unlikely(skb_shinfo(skb)->gso_type &
+                                ~(SKB_GSO_TCPV4 |
+                                  SKB_GSO_TCPV6 |
+                                  SKB_GSO_UDP |
+                                  SKB_GSO_DODGY |
+                                  SKB_GSO_TCP_ECN |
+                                  SKB_GSO_GRE)))
+                goto out;
+
+        if (unlikely(!pskb_may_pull(skb, sizeof(*greh))))
+                goto out;
+
+        greh = (struct gre_base_hdr *)skb_transport_header(skb);
+
+        if (greh->flags & GRE_KEY)
+                ghl += GRE_HEADER_SECTION;
+        if (greh->flags & GRE_SEQ)
+                ghl += GRE_HEADER_SECTION;
+        if (greh->flags & GRE_CSUM) {
+                ghl += GRE_HEADER_SECTION;
+                csum = true;
+        } else
+                csum = false;
+
+        /* setup inner skb. */
+        skb->protocol = greh->protocol;
+        skb->encapsulation = 0;
+
+        if (unlikely(!pskb_may_pull(skb, ghl)))
+                goto out;
+
+        __skb_pull(skb, ghl);
+        skb_reset_mac_header(skb);
+        skb_set_network_header(skb, skb_inner_network_offset(skb));
+        skb->mac_len = skb_inner_network_offset(skb);
+
+        /* segment inner packet. */
+        enc_features = skb->dev->hw_enc_features & netif_skb_features(skb);
+        segs = skb_mac_gso_segment(skb, enc_features);
+        if (!segs || IS_ERR(segs))
+                goto out;
+
+        skb = segs;
+        tnl_hlen = skb_tnl_header_len(skb);
+        do {
+                __skb_push(skb, ghl);
+                if (csum) {
+                        __be32 *pcsum;
+
+                        if (skb_has_shared_frag(skb)) {
+                                int err;
+
+                                err = __skb_linearize(skb);
+                                if (err) {
+                                        kfree_skb_list(segs);
+                                        segs = ERR_PTR(err);
+                                        goto out;
+                                }
+                        }
+
+                        greh = (struct gre_base_hdr *)(skb->data);
+                        pcsum = (__be32 *)(greh + 1);
+                        *pcsum = 0;
+                        *(__sum16 *)pcsum = csum_fold(skb_checksum(skb, 0, skb->len, 0));
+                }
+                __skb_push(skb, tnl_hlen - ghl);
+
+                skb_reset_inner_headers(skb);
+                skb->encapsulation = 1;
+
+                skb_reset_mac_header(skb);
+                skb_set_network_header(skb, mac_len);
+                skb->mac_len = mac_len;
+                skb->protocol = protocol;
+        } while ((skb = skb->next));
+out:
+        return segs;
+}
+
+static const struct net_offload gre_offload = {
+        .callbacks = {
+                .gso_send_check = gre_gso_send_check,
+                .gso_segment = gre_gso_segment,
+        },
+};
+
+int __init gre_offload_init(void)
+{
+        return inet_add_offload(&gre_offload, IPPROTO_GRE);
+}
+
+void __exit gre_offload_exit(void)
+{
+        inet_del_offload(&gre_offload, IPPROTO_GRE);
+}
diff --git a/net/ipv4/icmp.c b/net/ipv4/icmp.c
index 76e10b47e053..5f7d11a45871 100644
--- a/net/ipv4/icmp.c
+++ b/net/ipv4/icmp.c
@@ -482,7 +482,7 @@ void icmp_send(struct sk_buff *skb_in, int type, int code, __be32 info)
 {
         struct iphdr *iph;
         int room;
-        struct icmp_bxm icmp_param;
+        struct icmp_bxm *icmp_param;
         struct rtable *rt = skb_rtable(skb_in);
         struct ipcm_cookie ipc;
         struct flowi4 fl4;
@@ -503,7 +503,8 @@ void icmp_send(struct sk_buff *skb_in, int type, int code, __be32 info)
         iph = ip_hdr(skb_in);
 
         if ((u8 *)iph < skb_in->head ||
-            (skb_in->network_header + sizeof(*iph)) > skb_in->tail)
+            (skb_network_header(skb_in) + sizeof(*iph)) >
+            skb_tail_pointer(skb_in))
                 goto out;
 
         /*
@@ -557,9 +558,13 @@ void icmp_send(struct sk_buff *skb_in, int type, int code, __be32 info)
                 }
         }
 
+        icmp_param = kmalloc(sizeof(*icmp_param), GFP_ATOMIC);
+        if (!icmp_param)
+                return;
+
         sk = icmp_xmit_lock(net);
         if (sk == NULL)
-                return;
+                goto out_free;
 
         /*
          *      Construct source address and options.
@@ -585,7 +590,7 @@ void icmp_send(struct sk_buff *skb_in, int type, int code, __be32 info)
                                            IPTOS_PREC_INTERNETCONTROL) :
                                           iph->tos;
 
-        if (ip_options_echo(&icmp_param.replyopts.opt.opt, skb_in))
+        if (ip_options_echo(&icmp_param->replyopts.opt.opt, skb_in))
                 goto out_unlock;
 
 
@@ -593,19 +598,19 @@ void icmp_send(struct sk_buff *skb_in, int type, int code, __be32 info)
          *      Prepare data for ICMP header.
          */
 
-        icmp_param.data.icmph.type       = type;
-        icmp_param.data.icmph.code       = code;
-        icmp_param.data.icmph.un.gateway = info;
-        icmp_param.data.icmph.checksum   = 0;
-        icmp_param.skb    = skb_in;
-        icmp_param.offset = skb_network_offset(skb_in);
+        icmp_param->data.icmph.type      = type;
+        icmp_param->data.icmph.code      = code;
+        icmp_param->data.icmph.un.gateway = info;
+        icmp_param->data.icmph.checksum  = 0;
+        icmp_param->skb   = skb_in;
+        icmp_param->offset = skb_network_offset(skb_in);
         inet_sk(sk)->tos = tos;
         ipc.addr = iph->saddr;
-        ipc.opt = &icmp_param.replyopts.opt;
+        ipc.opt = &icmp_param->replyopts.opt;
         ipc.tx_flags = 0;
 
         rt = icmp_route_lookup(net, &fl4, skb_in, iph, saddr, tos,
-                               type, code, &icmp_param);
+                               type, code, icmp_param);
         if (IS_ERR(rt))
                 goto out_unlock;
 
@@ -617,19 +622,21 @@ void icmp_send(struct sk_buff *skb_in, int type, int code, __be32 info)
         room = dst_mtu(&rt->dst);
         if (room > 576)
                 room = 576;
-        room -= sizeof(struct iphdr) + icmp_param.replyopts.opt.opt.optlen;
+        room -= sizeof(struct iphdr) + icmp_param->replyopts.opt.opt.optlen;
         room -= sizeof(struct icmphdr);
 
-        icmp_param.data_len = skb_in->len - icmp_param.offset;
-        if (icmp_param.data_len > room)
-                icmp_param.data_len = room;
-        icmp_param.head_len = sizeof(struct icmphdr);
+        icmp_param->data_len = skb_in->len - icmp_param->offset;
+        if (icmp_param->data_len > room)
+                icmp_param->data_len = room;
+        icmp_param->head_len = sizeof(struct icmphdr);
 
-        icmp_push_reply(&icmp_param, &fl4, &ipc, &rt);
+        icmp_push_reply(icmp_param, &fl4, &ipc, &rt);
 ende:
         ip_rt_put(rt);
 out_unlock:
         icmp_xmit_unlock(sk);
+out_free:
+        kfree(icmp_param);
 out:;
 }
 EXPORT_SYMBOL(icmp_send);
@@ -657,7 +664,8 @@ static void icmp_socket_deliver(struct sk_buff *skb, u32 info)
 }
 
 /*
- *      Handle ICMP_DEST_UNREACH, ICMP_TIME_EXCEED, and ICMP_QUENCH.
+ *      Handle ICMP_DEST_UNREACH, ICMP_TIME_EXCEED, ICMP_QUENCH, and
+ *      ICMP_PARAMETERPROB.
  */
 
 static void icmp_unreach(struct sk_buff *skb)
@@ -939,7 +947,8 @@ error:
 void icmp_err(struct sk_buff *skb, u32 info)
 {
         struct iphdr *iph = (struct iphdr *)skb->data;
-        struct icmphdr *icmph = (struct icmphdr *)(skb->data+(iph->ihl<<2));
+        int offset = iph->ihl<<2;
+        struct icmphdr *icmph = (struct icmphdr *)(skb->data + offset);
         int type = icmp_hdr(skb)->type;
         int code = icmp_hdr(skb)->code;
         struct net *net = dev_net(skb->dev);
@@ -949,7 +958,7 @@ void icmp_err(struct sk_buff *skb, u32 info)
          * triggered by ICMP_ECHOREPLY which sent from kernel.
          */
         if (icmph->type != ICMP_ECHOREPLY) {
-                ping_err(skb, info);
+                ping_err(skb, offset, info);
                 return;
         }
 
diff --git a/net/ipv4/igmp.c b/net/ipv4/igmp.c
index d8c232794bcb..7defdc9ba167 100644
--- a/net/ipv4/igmp.c
+++ b/net/ipv4/igmp.c
@@ -88,6 +88,7 @@
 #include <linux/if_arp.h>
 #include <linux/rtnetlink.h>
 #include <linux/times.h>
+#include <linux/pkt_sched.h>
 
 #include <net/net_namespace.h>
 #include <net/arp.h>
@@ -113,7 +114,8 @@
 
 #define IGMP_V1_Router_Present_Timeout          (400*HZ)
 #define IGMP_V2_Router_Present_Timeout          (400*HZ)
-#define IGMP_Unsolicited_Report_Interval        (10*HZ)
+#define IGMP_V2_Unsolicited_Report_Interval     (10*HZ)
+#define IGMP_V3_Unsolicited_Report_Interval     (1*HZ)
 #define IGMP_Query_Response_Interval            (10*HZ)
 #define IGMP_Unsolicited_Report_Count           2
 
@@ -138,6 +140,29 @@
          ((in_dev)->mr_v2_seen && \
           time_before(jiffies, (in_dev)->mr_v2_seen)))
 
+static int unsolicited_report_interval(struct in_device *in_dev)
+{
+        int interval_ms, interval_jiffies;
+
+        if (IGMP_V1_SEEN(in_dev) || IGMP_V2_SEEN(in_dev))
+                interval_ms = IN_DEV_CONF_GET(
+                        in_dev,
+                        IGMPV2_UNSOLICITED_REPORT_INTERVAL);
+        else /* v3 */
+                interval_ms = IN_DEV_CONF_GET(
+                        in_dev,
+                        IGMPV3_UNSOLICITED_REPORT_INTERVAL);
+
+        interval_jiffies = msecs_to_jiffies(interval_ms);
+
+        /* _timer functions can't handle a delay of 0 jiffies so ensure
+         *  we always return a positive value.
+         */
+        if (interval_jiffies <= 0)
+                interval_jiffies = 1;
+        return interval_jiffies;
+}
+
 static void igmpv3_add_delrec(struct in_device *in_dev, struct ip_mc_list *im);
 static void igmpv3_del_delrec(struct in_device *in_dev, __be32 multiaddr);
 static void igmpv3_clear_delrec(struct in_device *in_dev);
@@ -315,6 +340,7 @@ static struct sk_buff *igmpv3_newpack(struct net_device *dev, int size)
                 if (size < 256)
                         return NULL;
         }
+        skb->priority = TC_PRIO_CONTROL;
         igmp_skb_size(skb) = size;
 
         rt = ip_route_output_ports(net, &fl4, NULL, IGMPV3_ALL_MCR, 0,
@@ -343,7 +369,7 @@ static struct sk_buff *igmpv3_newpack(struct net_device *dev, int size)
         pip->saddr    = fl4.saddr;
         pip->protocol = IPPROTO_IGMP;
         pip->tot_len  = 0;      /* filled in later */
-        ip_select_ident(pip, &rt->dst, NULL);
+        ip_select_ident(skb, &rt->dst, NULL);
         ((u8 *)&pip[1])[0] = IPOPT_RA;
         ((u8 *)&pip[1])[1] = 4;
         ((u8 *)&pip[1])[2] = 0;
@@ -363,7 +389,7 @@ static struct sk_buff *igmpv3_newpack(struct net_device *dev, int size)
 static int igmpv3_sendpack(struct sk_buff *skb)
 {
         struct igmphdr *pig = igmp_hdr(skb);
-        const int igmplen = skb->tail - skb->transport_header;
+        const int igmplen = skb_tail_pointer(skb) - skb_transport_header(skb);
 
         pig->csum = ip_compute_csum(igmp_hdr(skb), igmplen);
 
@@ -670,6 +696,7 @@ static int igmp_send_report(struct in_device *in_dev, struct ip_mc_list *pmc,
                 ip_rt_put(rt);
                 return -1;
         }
+        skb->priority = TC_PRIO_CONTROL;
 
         skb_dst_set(skb, &rt->dst);
 
@@ -687,7 +714,7 @@ static int igmp_send_report(struct in_device *in_dev, struct ip_mc_list *pmc,
         iph->daddr    = dst;
         iph->saddr    = fl4.saddr;
         iph->protocol = IPPROTO_IGMP;
-        ip_select_ident(iph, &rt->dst, NULL);
+        ip_select_ident(skb, &rt->dst, NULL);
         ((u8 *)&iph[1])[0] = IPOPT_RA;
         ((u8 *)&iph[1])[1] = 4;
         ((u8 *)&iph[1])[2] = 0;
@@ -709,7 +736,7 @@ static void igmp_gq_timer_expire(unsigned long data)
 
         in_dev->mr_gq_running = 0;
         igmpv3_send_report(in_dev, NULL);
-        __in_dev_put(in_dev);
+        in_dev_put(in_dev);
 }
 
 static void igmp_ifc_timer_expire(unsigned long data)
@@ -719,9 +746,10 @@ static void igmp_ifc_timer_expire(unsigned long data)
         igmpv3_send_cr(in_dev);
         if (in_dev->mr_ifc_count) {
                 in_dev->mr_ifc_count--;
-                igmp_ifc_start_timer(in_dev, IGMP_Unsolicited_Report_Interval);
+                igmp_ifc_start_timer(in_dev,
+                                     unsolicited_report_interval(in_dev));
         }
-        __in_dev_put(in_dev);
+        in_dev_put(in_dev);
 }
 
 static void igmp_ifc_event(struct in_device *in_dev)
@@ -744,7 +772,7 @@ static void igmp_timer_expire(unsigned long data)
 
         if (im->unsolicit_count) {
                 im->unsolicit_count--;
-                igmp_start_timer(im, IGMP_Unsolicited_Report_Interval);
+                igmp_start_timer(im, unsolicited_report_interval(in_dev));
         }
         im->reporter = 1;
         spin_unlock(&im->lock);
@@ -1217,6 +1245,57 @@ static void igmp_group_added(struct ip_mc_list *im)
  *      Multicast list managers
  */
 
+static u32 ip_mc_hash(const struct ip_mc_list *im)
+{
+        return hash_32((__force u32)im->multiaddr, MC_HASH_SZ_LOG);
+}
+
+static void ip_mc_hash_add(struct in_device *in_dev,
+                           struct ip_mc_list *im)
+{
+        struct ip_mc_list __rcu **mc_hash;
+        u32 hash;
+
+        mc_hash = rtnl_dereference(in_dev->mc_hash);
+        if (mc_hash) {
+                hash = ip_mc_hash(im);
+                im->next_hash = mc_hash[hash];
+                rcu_assign_pointer(mc_hash[hash], im);
+                return;
+        }
+
+        /* do not use a hash table for small number of items */
+        if (in_dev->mc_count < 4)
+                return;
+
+        mc_hash = kzalloc(sizeof(struct ip_mc_list *) << MC_HASH_SZ_LOG,
+                          GFP_KERNEL);
+        if (!mc_hash)
+                return;
+
+        for_each_pmc_rtnl(in_dev, im) {
+                hash = ip_mc_hash(im);
+                im->next_hash = mc_hash[hash];
+                RCU_INIT_POINTER(mc_hash[hash], im);
+        }
+
+        rcu_assign_pointer(in_dev->mc_hash, mc_hash);
+}
+
+static void ip_mc_hash_remove(struct in_device *in_dev,
+                              struct ip_mc_list *im)
+{
+        struct ip_mc_list __rcu **mc_hash = rtnl_dereference(in_dev->mc_hash);
+        struct ip_mc_list *aux;
+
+        if (!mc_hash)
+                return;
+        mc_hash += ip_mc_hash(im);
+        while ((aux = rtnl_dereference(*mc_hash)) != im)
+                mc_hash = &aux->next_hash;
+        *mc_hash = im->next_hash;
+}
+
 
 /*
  *      A socket has joined a multicast group on device dev.
@@ -1258,6 +1337,8 @@ void ip_mc_inc_group(struct in_device *in_dev, __be32 addr)
         in_dev->mc_count++;
         rcu_assign_pointer(in_dev->mc_list, im);
 
+        ip_mc_hash_add(in_dev, im);
+
 #ifdef CONFIG_IP_MULTICAST
         igmpv3_del_delrec(in_dev, im->multiaddr);
 #endif
@@ -1270,16 +1351,17 @@ out:
 EXPORT_SYMBOL(ip_mc_inc_group);
 
 /*
- *      Resend IGMP JOIN report; used for bonding.
- *      Called with rcu_read_lock()
+ *      Resend IGMP JOIN report; used by netdev notifier.
  */
-void ip_mc_rejoin_groups(struct in_device *in_dev)
+static void ip_mc_rejoin_groups(struct in_device *in_dev)
 {
 #ifdef CONFIG_IP_MULTICAST
         struct ip_mc_list *im;
         int type;
 
-        for_each_pmc_rcu(in_dev, im) {
+        ASSERT_RTNL();
+
+        for_each_pmc_rtnl(in_dev, im) {
                 if (im->multiaddr == IGMP_ALL_HOSTS)
                         continue;
 
@@ -1296,7 +1378,6 @@ void ip_mc_rejoin_groups(struct in_device *in_dev)
         }
 #endif
 }
-EXPORT_SYMBOL(ip_mc_rejoin_groups);
 
 /*
  *      A socket has left a multicast group on device dev
@@ -1314,6 +1395,7 @@ void ip_mc_dec_group(struct in_device *in_dev, __be32 addr)
              ip = &i->next_rcu) {
                 if (i->multiaddr == addr) {
                         if (--i->users == 0) {
+                                ip_mc_hash_remove(in_dev, i);
                                 *ip = i->next_rcu;
                                 in_dev->mc_count--;
                                 igmp_group_dropped(i);
@@ -1381,13 +1463,9 @@ void ip_mc_init_dev(struct in_device *in_dev)
 {
         ASSERT_RTNL();
 
-        in_dev->mc_tomb = NULL;
 #ifdef CONFIG_IP_MULTICAST
-        in_dev->mr_gq_running = 0;
         setup_timer(&in_dev->mr_gq_timer, igmp_gq_timer_expire,
                         (unsigned long)in_dev);
-        in_dev->mr_ifc_count = 0;
-        in_dev->mc_count     = 0;
         setup_timer(&in_dev->mr_ifc_timer, igmp_ifc_timer_expire,
                         (unsigned long)in_dev);
         in_dev->mr_qrv = IGMP_Unsolicited_Report_Count;
@@ -2321,12 +2399,25 @@ void ip_mc_drop_socket(struct sock *sk)
 int ip_check_mc_rcu(struct in_device *in_dev, __be32 mc_addr, __be32 src_addr, u16 proto)
 {
         struct ip_mc_list *im;
+        struct ip_mc_list __rcu **mc_hash;
         struct ip_sf_list *psf;
         int rv = 0;
 
-        for_each_pmc_rcu(in_dev, im) {
-                if (im->multiaddr == mc_addr)
-                        break;
+        mc_hash = rcu_dereference(in_dev->mc_hash);
+        if (mc_hash) {
+                u32 hash = hash_32((__force u32)mc_addr, MC_HASH_SZ_LOG);
+
+                for (im = rcu_dereference(mc_hash[hash]);
+                     im != NULL;
+                     im = rcu_dereference(im->next_hash)) {
+                        if (im->multiaddr == mc_addr)
+                                break;
+                }
+        } else {
+                for_each_pmc_rcu(in_dev, im) {
+                        if (im->multiaddr == mc_addr)
+                                break;
+                }
         }
         if (im && proto == IPPROTO_IGMP) {
                 rv = 1;
@@ -2672,8 +2763,42 @@ static struct pernet_operations igmp_net_ops = {
         .exit = igmp_net_exit,
 };
 
+static int igmp_netdev_event(struct notifier_block *this,
+                             unsigned long event, void *ptr)
+{
+        struct net_device *dev = netdev_notifier_info_to_dev(ptr);
+        struct in_device *in_dev;
+
+        switch (event) {
+        case NETDEV_RESEND_IGMP:
+                in_dev = __in_dev_get_rtnl(dev);
+                if (in_dev)
+                        ip_mc_rejoin_groups(in_dev);
+                break;
+        default:
+                break;
+        }
+        return NOTIFY_DONE;
+}
+
+static struct notifier_block igmp_notifier = {
+        .notifier_call = igmp_netdev_event,
+};
+
 int __init igmp_mc_proc_init(void)
 {
-        return register_pernet_subsys(&igmp_net_ops);
+        int err;
+
+        err = register_pernet_subsys(&igmp_net_ops);
+        if (err)
+                return err;
+        err = register_netdevice_notifier(&igmp_notifier);
+        if (err)
+                goto reg_notif_fail;
+        return 0;
+
+reg_notif_fail:
+        unregister_pernet_subsys(&igmp_net_ops);
+        return err;
 }
 #endif
diff --git a/net/ipv4/inet_fragment.c b/net/ipv4/inet_fragment.c
index 7e06641e36ae..c5313a9c019b 100644
--- a/net/ipv4/inet_fragment.c
+++ b/net/ipv4/inet_fragment.c
@@ -93,7 +93,7 @@ void inet_frags_init(struct inet_frags *f)
         }
         rwlock_init(&f->lock);
 
-        f->rnd = (u32) ((num_physpages ^ (num_physpages>>7)) ^
+        f->rnd = (u32) ((totalram_pages ^ (totalram_pages >> 7)) ^
                                    (jiffies ^ (jiffies >> 6)));
 
         setup_timer(&f->secret_timer, inet_frag_secret_rebuild,
@@ -247,8 +247,6 @@ static struct inet_frag_queue *inet_frag_intern(struct netns_frags *nf,
 {
         struct inet_frag_bucket *hb;
         struct inet_frag_queue *qp;
-#ifdef CONFIG_SMP
-#endif
         unsigned int hash;
 
         read_lock(&f->lock); /* Protects against hash rebuild */
diff --git a/net/ipv4/inet_hashtables.c b/net/ipv4/inet_hashtables.c
index 6af375afeeef..7bd8983dbfcf 100644
--- a/net/ipv4/inet_hashtables.c
+++ b/net/ipv4/inet_hashtables.c
@@ -467,7 +467,7 @@ void inet_unhash(struct sock *sk)
                 lock = inet_ehash_lockp(hashinfo, sk->sk_hash);
 
         spin_lock_bh(lock);
-        done =__sk_nulls_del_node_init_rcu(sk);
+        done = __sk_nulls_del_node_init_rcu(sk);
         if (done)
                 sock_prot_inuse_add(sock_net(sk), sk->sk_prot, -1);
         spin_unlock_bh(lock);
diff --git a/net/ipv4/inetpeer.c b/net/ipv4/inetpeer.c
index 000e3d239d64..33d5537881ed 100644
--- a/net/ipv4/inetpeer.c
+++ b/net/ipv4/inetpeer.c
@@ -32,8 +32,8 @@
  *  At the moment of writing this notes identifier of IP packets is generated
  *  to be unpredictable using this code only for packets subjected
  *  (actually or potentially) to defragmentation.  I.e. DF packets less than
- *  PMTU in size uses a constant ID and do not use this code (see
- *  ip_select_ident() in include/net/ip.h).
+ *  PMTU in size when local fragmentation is disabled use a constant ID and do
+ *  not use this code (see ip_select_ident() in include/net/ip.h).
  *
  *  Route cache entries hold references to our nodes.
  *  New cache entries get references via lookup by destination IP address in
diff --git a/net/ipv4/ip_gre.c b/net/ipv4/ip_gre.c
index 2a83591492dd..d7aea4c5b940 100644
--- a/net/ipv4/ip_gre.c
+++ b/net/ipv4/ip_gre.c
@@ -121,103 +121,8 @@ static int ipgre_tunnel_init(struct net_device *dev);
 static int ipgre_net_id __read_mostly;
 static int gre_tap_net_id __read_mostly;
 
-static __sum16 check_checksum(struct sk_buff *skb)
-{
-        __sum16 csum = 0;
-
-        switch (skb->ip_summed) {
-        case CHECKSUM_COMPLETE:
-                csum = csum_fold(skb->csum);
-
-                if (!csum)
-                        break;
-                /* Fall through. */
-
-        case CHECKSUM_NONE:
-                skb->csum = 0;
-                csum = __skb_checksum_complete(skb);
-                skb->ip_summed = CHECKSUM_COMPLETE;
-                break;
-        }
-
-        return csum;
-}
-
-static int ip_gre_calc_hlen(__be16 o_flags)
-{
-        int addend = 4;
-
-        if (o_flags&TUNNEL_CSUM)
-                addend += 4;
-        if (o_flags&TUNNEL_KEY)
-                addend += 4;
-        if (o_flags&TUNNEL_SEQ)
-                addend += 4;
-        return addend;
-}
-
-static int parse_gre_header(struct sk_buff *skb, struct tnl_ptk_info *tpi,
-                            bool *csum_err, int *hdr_len)
-{
-        unsigned int ip_hlen = ip_hdrlen(skb);
-        const struct gre_base_hdr *greh;
-        __be32 *options;
-
-        if (unlikely(!pskb_may_pull(skb, sizeof(struct gre_base_hdr))))
-                return -EINVAL;
-
-        greh = (struct gre_base_hdr *)(skb_network_header(skb) + ip_hlen);
-        if (unlikely(greh->flags & (GRE_VERSION | GRE_ROUTING)))
-                return -EINVAL;
-
-        tpi->flags = gre_flags_to_tnl_flags(greh->flags);
-        *hdr_len = ip_gre_calc_hlen(tpi->flags);
-
-        if (!pskb_may_pull(skb, *hdr_len))
-                return -EINVAL;
-
-        greh = (struct gre_base_hdr *)(skb_network_header(skb) + ip_hlen);
-
-        tpi->proto = greh->protocol;
-
-        options = (__be32 *)(greh + 1);
-        if (greh->flags & GRE_CSUM) {
-                if (check_checksum(skb)) {
-                        *csum_err = true;
-                        return -EINVAL;
-                }
-                options++;
-        }
-
-        if (greh->flags & GRE_KEY) {
-                tpi->key = *options;
-                options++;
-        } else
-                tpi->key = 0;
-
-        if (unlikely(greh->flags & GRE_SEQ)) {
-                tpi->seq = *options;
-                options++;
-        } else
-                tpi->seq = 0;
-
-        /* WCCP version 1 and 2 protocol decoding.
-         * - Change protocol to IP
-         * - When dealing with WCCPv2, Skip extra 4 bytes in GRE header
-         */
-        if (greh->flags == 0 && tpi->proto == htons(ETH_P_WCCP)) {
-                tpi->proto = htons(ETH_P_IP);
-                if ((*(u8 *)options & 0xF0) != 0x40) {
-                        *hdr_len += 4;
-                        if (!pskb_may_pull(skb, *hdr_len))
-                                return -EINVAL;
-                }
-        }
-
-        return 0;
-}
-
-static void ipgre_err(struct sk_buff *skb, u32 info)
+static int ipgre_err(struct sk_buff *skb, u32 info,
+                     const struct tnl_ptk_info *tpi)
 {
 
         /* All the routers (except for Linux) return only
@@ -239,26 +144,18 @@ static void ipgre_err(struct sk_buff *skb, u32 info)
         const int type = icmp_hdr(skb)->type;
         const int code = icmp_hdr(skb)->code;
         struct ip_tunnel *t;
-        struct tnl_ptk_info tpi;
-        int hdr_len;
-        bool csum_err = false;
-
-        if (parse_gre_header(skb, &tpi, &csum_err, &hdr_len)) {
-                if (!csum_err)          /* ignore csum errors. */
-                        return;
-        }
 
         switch (type) {
         default:
         case ICMP_PARAMETERPROB:
-                return;
+                return PACKET_RCVD;
 
         case ICMP_DEST_UNREACH:
                 switch (code) {
                 case ICMP_SR_FAILED:
                 case ICMP_PORT_UNREACH:
                         /* Impossible event. */
-                        return;
+                        return PACKET_RCVD;
                 default:
                         /* All others are translated to HOST_UNREACH.
                            rfc2003 contains "deep thoughts" about NET_UNREACH,
@@ -269,138 +166,61 @@ static void ipgre_err(struct sk_buff *skb, u32 info)
                 break;
         case ICMP_TIME_EXCEEDED:
                 if (code != ICMP_EXC_TTL)
-                        return;
+                        return PACKET_RCVD;
                 break;
 
         case ICMP_REDIRECT:
                 break;
         }
 
-        if (tpi.proto == htons(ETH_P_TEB))
+        if (tpi->proto == htons(ETH_P_TEB))
                 itn = net_generic(net, gre_tap_net_id);
         else
                 itn = net_generic(net, ipgre_net_id);
 
         iph = (const struct iphdr *)skb->data;
-        t = ip_tunnel_lookup(itn, skb->dev->ifindex, tpi.flags,
-                             iph->daddr, iph->saddr, tpi.key);
+        t = ip_tunnel_lookup(itn, skb->dev->ifindex, tpi->flags,
+                             iph->daddr, iph->saddr, tpi->key);
 
         if (t == NULL)
-                return;
+                return PACKET_REJECT;
 
-        if (type == ICMP_DEST_UNREACH && code == ICMP_FRAG_NEEDED) {
-                ipv4_update_pmtu(skb, dev_net(skb->dev), info,
-                                 t->parms.link, 0, IPPROTO_GRE, 0);
-                return;
-        }
-        if (type == ICMP_REDIRECT) {
-                ipv4_redirect(skb, dev_net(skb->dev), t->parms.link, 0,
-                              IPPROTO_GRE, 0);
-                return;
-        }
         if (t->parms.iph.daddr == 0 ||
             ipv4_is_multicast(t->parms.iph.daddr))
-                return;
+                return PACKET_RCVD;
 
         if (t->parms.iph.ttl == 0 && type == ICMP_TIME_EXCEEDED)
-                return;
+                return PACKET_RCVD;
 
         if (time_before(jiffies, t->err_time + IPTUNNEL_ERR_TIMEO))
                 t->err_count++;
         else
                 t->err_count = 1;
         t->err_time = jiffies;
+        return PACKET_RCVD;
 }
 
-static int ipgre_rcv(struct sk_buff *skb)
+static int ipgre_rcv(struct sk_buff *skb, const struct tnl_ptk_info *tpi)
 {
         struct net *net = dev_net(skb->dev);
         struct ip_tunnel_net *itn;
         const struct iphdr *iph;
         struct ip_tunnel *tunnel;
-        struct tnl_ptk_info tpi;
-        int hdr_len;
-        bool csum_err = false;
-
-        if (parse_gre_header(skb, &tpi, &csum_err, &hdr_len) < 0)
-                goto drop;
 
-        if (tpi.proto == htons(ETH_P_TEB))
+        if (tpi->proto == htons(ETH_P_TEB))
                 itn = net_generic(net, gre_tap_net_id);
         else
                 itn = net_generic(net, ipgre_net_id);
 
         iph = ip_hdr(skb);
-        tunnel = ip_tunnel_lookup(itn, skb->dev->ifindex, tpi.flags,
-                                  iph->saddr, iph->daddr, tpi.key);
+        tunnel = ip_tunnel_lookup(itn, skb->dev->ifindex, tpi->flags,
+                                  iph->saddr, iph->daddr, tpi->key);
 
         if (tunnel) {
-                ip_tunnel_rcv(tunnel, skb, &tpi, log_ecn_error);
-                return 0;
-        }
-        icmp_send(skb, ICMP_DEST_UNREACH, ICMP_PORT_UNREACH, 0);
-drop:
-        kfree_skb(skb);
-        return 0;
-}
-
-static struct sk_buff *handle_offloads(struct ip_tunnel *tunnel, struct sk_buff *skb)
-{
-        int err;
-
-        if (skb_is_gso(skb)) {
-                err = skb_unclone(skb, GFP_ATOMIC);
-                if (unlikely(err))
-                        goto error;
-                skb_shinfo(skb)->gso_type |= SKB_GSO_GRE;
-                return skb;
-        } else if (skb->ip_summed == CHECKSUM_PARTIAL &&
-                   tunnel->parms.o_flags&TUNNEL_CSUM) {
-                err = skb_checksum_help(skb);
-                if (unlikely(err))
-                        goto error;
-        } else if (skb->ip_summed != CHECKSUM_PARTIAL)
-                skb->ip_summed = CHECKSUM_NONE;
-
-        return skb;
-
-error:
-        kfree_skb(skb);
-        return ERR_PTR(err);
-}
-
-static struct sk_buff *gre_build_header(struct sk_buff *skb,
-                                        const struct tnl_ptk_info *tpi,
-                                        int hdr_len)
-{
-        struct gre_base_hdr *greh;
-
-        skb_push(skb, hdr_len);
-
-        greh = (struct gre_base_hdr *)skb->data;
-        greh->flags = tnl_flags_to_gre_flags(tpi->flags);
-        greh->protocol = tpi->proto;
-
-        if (tpi->flags&(TUNNEL_KEY|TUNNEL_CSUM|TUNNEL_SEQ)) {
-                __be32 *ptr = (__be32 *)(((u8 *)greh) + hdr_len - 4);
-
-                if (tpi->flags&TUNNEL_SEQ) {
-                        *ptr = tpi->seq;
-                        ptr--;
-                }
-                if (tpi->flags&TUNNEL_KEY) {
-                        *ptr = tpi->key;
-                        ptr--;
-                }
-                if (tpi->flags&TUNNEL_CSUM &&
-                    !(skb_shinfo(skb)->gso_type & SKB_GSO_GRE)) {
-                        *(__sum16 *)ptr = 0;
-                        *(__sum16 *)ptr = csum_fold(skb_checksum(skb, 0,
-                                                                 skb->len, 0));
-                }
+                ip_tunnel_rcv(tunnel, skb, tpi, log_ecn_error);
+                return PACKET_RCVD;
         }
-
-        return skb;
+        return PACKET_REJECT;
 }
 
 static void __gre_xmit(struct sk_buff *skb, struct net_device *dev,
@@ -410,11 +230,6 @@ static void __gre_xmit(struct sk_buff *skb, struct net_device *dev,
         struct ip_tunnel *tunnel = netdev_priv(dev);
         struct tnl_ptk_info tpi;
 
-        if (likely(!skb->encapsulation)) {
-                skb_reset_inner_headers(skb);
-                skb->encapsulation = 1;
-        }
-
         tpi.flags = tunnel->parms.o_flags;
         tpi.proto = proto;
         tpi.key = tunnel->parms.o_key;
@@ -423,13 +238,9 @@ static void __gre_xmit(struct sk_buff *skb, struct net_device *dev,
         tpi.seq = htonl(tunnel->o_seqno);
 
         /* Push GRE header. */
-        skb = gre_build_header(skb, &tpi, tunnel->hlen);
-        if (unlikely(!skb)) {
-                dev->stats.tx_dropped++;
-                return;
-        }
+        gre_build_header(skb, &tpi, tunnel->hlen);
 
-        ip_tunnel_xmit(skb, dev, tnl_params);
+        ip_tunnel_xmit(skb, dev, tnl_params, tnl_params->protocol);
 }
 
 static netdev_tx_t ipgre_xmit(struct sk_buff *skb,
@@ -438,7 +249,7 @@ static netdev_tx_t ipgre_xmit(struct sk_buff *skb,
         struct ip_tunnel *tunnel = netdev_priv(dev);
         const struct iphdr *tnl_params;
 
-        skb = handle_offloads(tunnel, skb);
+        skb = gre_handle_offloads(skb, !!(tunnel->parms.o_flags&TUNNEL_CSUM));
         if (IS_ERR(skb))
                 goto out;
 
@@ -477,7 +288,7 @@ static netdev_tx_t gre_tap_xmit(struct sk_buff *skb,
 {
         struct ip_tunnel *tunnel = netdev_priv(dev);
 
-        skb = handle_offloads(tunnel, skb);
+        skb = gre_handle_offloads(skb, !!(tunnel->parms.o_flags&TUNNEL_CSUM));
         if (IS_ERR(skb))
                 goto out;
 
@@ -503,10 +314,11 @@ static int ipgre_tunnel_ioctl(struct net_device *dev,
 
         if (copy_from_user(&p, ifr->ifr_ifru.ifru_data, sizeof(p)))
                 return -EFAULT;
-        if (p.iph.version != 4 || p.iph.protocol != IPPROTO_GRE ||
-            p.iph.ihl != 5 || (p.iph.frag_off&htons(~IP_DF)) ||
-            ((p.i_flags|p.o_flags)&(GRE_VERSION|GRE_ROUTING))) {
-                return -EINVAL;
+        if (cmd == SIOCADDTUNNEL || cmd == SIOCCHGTUNNEL) {
+                if (p.iph.version != 4 || p.iph.protocol != IPPROTO_GRE ||
+                    p.iph.ihl != 5 || (p.iph.frag_off&htons(~IP_DF)) ||
+                    ((p.i_flags|p.o_flags)&(GRE_VERSION|GRE_ROUTING)))
+                        return -EINVAL;
         }
         p.i_flags = gre_flags_to_tnl_flags(p.i_flags);
         p.o_flags = gre_flags_to_tnl_flags(p.o_flags);
@@ -571,7 +383,7 @@ static int ipgre_header(struct sk_buff *skb, struct net_device *dev,
         if (daddr)
                 memcpy(&iph->daddr, daddr, 4);
         if (iph->daddr)
-                return t->hlen;
+                return t->hlen + sizeof(*iph);
 
         return -(t->hlen + sizeof(*iph));
 }
@@ -708,9 +520,10 @@ static int ipgre_tunnel_init(struct net_device *dev)
         return ip_tunnel_init(dev);
 }
 
-static const struct gre_protocol ipgre_protocol = {
-        .handler     = ipgre_rcv,
-        .err_handler = ipgre_err,
+static struct gre_cisco_protocol ipgre_protocol = {
+        .handler        = ipgre_rcv,
+        .err_handler    = ipgre_err,
+        .priority       = 0,
 };
 
 static int __net_init ipgre_init_net(struct net *net)
@@ -721,7 +534,7 @@ static int __net_init ipgre_init_net(struct net *net)
 static void __net_exit ipgre_exit_net(struct net *net)
 {
         struct ip_tunnel_net *itn = net_generic(net, ipgre_net_id);
-        ip_tunnel_delete_net(itn);
+        ip_tunnel_delete_net(itn, &ipgre_link_ops);
 }
 
 static struct pernet_operations ipgre_net_ops = {
@@ -954,7 +767,7 @@ static int __net_init ipgre_tap_init_net(struct net *net)
 static void __net_exit ipgre_tap_exit_net(struct net *net)
 {
         struct ip_tunnel_net *itn = net_generic(net, gre_tap_net_id);
-        ip_tunnel_delete_net(itn);
+        ip_tunnel_delete_net(itn, &ipgre_tap_ops);
 }
 
 static struct pernet_operations ipgre_tap_net_ops = {
@@ -978,7 +791,7 @@ static int __init ipgre_init(void)
         if (err < 0)
                 goto pnet_tap_faied;
 
-        err = gre_add_protocol(&ipgre_protocol, GREPROTO_CISCO);
+        err = gre_cisco_register(&ipgre_protocol);
         if (err < 0) {
                 pr_info("%s: can't add protocol\n", __func__);
                 goto add_proto_failed;
@@ -997,7 +810,7 @@ static int __init ipgre_init(void)
 tap_ops_failed:
         rtnl_link_unregister(&ipgre_link_ops);
 rtnl_link_failed:
-        gre_del_protocol(&ipgre_protocol, GREPROTO_CISCO);
+        gre_cisco_unregister(&ipgre_protocol);
 add_proto_failed:
         unregister_pernet_device(&ipgre_tap_net_ops);
 pnet_tap_faied:
@@ -1009,8 +822,7 @@ static void __exit ipgre_fini(void)
 {
         rtnl_link_unregister(&ipgre_tap_ops);
         rtnl_link_unregister(&ipgre_link_ops);
-        if (gre_del_protocol(&ipgre_protocol, GREPROTO_CISCO) < 0)
-                pr_info("%s: can't remove protocol\n", __func__);
+        gre_cisco_unregister(&ipgre_protocol);
         unregister_pernet_device(&ipgre_tap_net_ops);
         unregister_pernet_device(&ipgre_net_ops);
 }
diff --git a/net/ipv4/ip_input.c b/net/ipv4/ip_input.c
index 3da817b89e9b..054a3e97d822 100644
--- a/net/ipv4/ip_input.c
+++ b/net/ipv4/ip_input.c
@@ -141,6 +141,7 @@
 #include <net/icmp.h>
 #include <net/raw.h>
 #include <net/checksum.h>
+#include <net/inet_ecn.h>
 #include <linux/netfilter_ipv4.h>
 #include <net/xfrm.h>
 #include <linux/mroute.h>
@@ -190,10 +191,7 @@ static int ip_local_deliver_finish(struct sk_buff *skb)
 {
         struct net *net = dev_net(skb->dev);
 
-        __skb_pull(skb, ip_hdrlen(skb));
-
-        /* Point into the IP datagram, just past the header. */
-        skb_reset_transport_header(skb);
+        __skb_pull(skb, skb_network_header_len(skb));
 
         rcu_read_lock();
         {
@@ -413,6 +411,13 @@ int ip_rcv(struct sk_buff *skb, struct net_device *dev, struct packet_type *pt,
         if (iph->ihl < 5 || iph->version != 4)
                 goto inhdr_error;
 
+        BUILD_BUG_ON(IPSTATS_MIB_ECT1PKTS != IPSTATS_MIB_NOECTPKTS + INET_ECN_ECT_1);
+        BUILD_BUG_ON(IPSTATS_MIB_ECT0PKTS != IPSTATS_MIB_NOECTPKTS + INET_ECN_ECT_0);
+        BUILD_BUG_ON(IPSTATS_MIB_CEPKTS != IPSTATS_MIB_NOECTPKTS + INET_ECN_CE);
+        IP_ADD_STATS_BH(dev_net(dev),
+                        IPSTATS_MIB_NOECTPKTS + (iph->tos & INET_ECN_MASK),
+                        max_t(unsigned short, 1, skb_shinfo(skb)->gso_segs));
+
         if (!pskb_may_pull(skb, iph->ihl*4))
                 goto inhdr_error;
 
@@ -437,6 +442,8 @@ int ip_rcv(struct sk_buff *skb, struct net_device *dev, struct packet_type *pt,
                 goto drop;
         }
 
+        skb->transport_header = skb->network_header + iph->ihl*4;
+
         /* Remove any debris in the socket control block */
         memset(IPCB(skb), 0, sizeof(struct inet_skb_parm));
 
diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c
index 4bcabf3ab4ca..a04d872c54f9 100644
--- a/net/ipv4/ip_output.c
+++ b/net/ipv4/ip_output.c
@@ -148,7 +148,7 @@ int ip_build_and_send_pkt(struct sk_buff *skb, struct sock *sk,
         iph->daddr    = (opt && opt->opt.srr ? opt->opt.faddr : daddr);
         iph->saddr    = saddr;
         iph->protocol = sk->sk_protocol;
-        ip_select_ident(iph, &rt->dst, sk);
+        ip_select_ident(skb, &rt->dst, sk);
 
         if (opt && opt->opt.optlen) {
                 iph->ihl += opt->opt.optlen>>2;
@@ -211,14 +211,6 @@ static inline int ip_finish_output2(struct sk_buff *skb)
         return -EINVAL;
 }
 
-static inline int ip_skb_dst_mtu(struct sk_buff *skb)
-{
-        struct inet_sock *inet = skb->sk ? inet_sk(skb->sk) : NULL;
-
-        return (inet && inet->pmtudisc == IP_PMTUDISC_PROBE) ?
-               skb_dst(skb)->dev->mtu : dst_mtu(skb_dst(skb));
-}
-
 static int ip_finish_output(struct sk_buff *skb)
 {
 #if defined(CONFIG_NETFILTER) && defined(CONFIG_XFRM)
@@ -394,7 +386,7 @@ packet_routed:
                 ip_options_build(skb, &inet_opt->opt, inet->inet_daddr, rt, 0);
         }
 
-        ip_select_ident_more(iph, &rt->dst, sk,
+        ip_select_ident_more(skb, &rt->dst, sk,
                              (skb_shinfo(skb)->gso_segs ?: 1) - 1);
 
         skb->priority = sk->sk_priority;
@@ -1324,7 +1316,7 @@ struct sk_buff *__ip_make_skb(struct sock *sk,
         else
                 ttl = ip_select_ttl(inet, &rt->dst);
 
-        iph = (struct iphdr *)skb->data;
+        iph = ip_hdr(skb);
         iph->version = 4;
         iph->ihl = 5;
         iph->tos = inet->tos;
@@ -1332,7 +1324,7 @@ struct sk_buff *__ip_make_skb(struct sock *sk,
         iph->ttl = ttl;
         iph->protocol = sk->sk_protocol;
         ip_copy_addrs(iph, fl4);
-        ip_select_ident(iph, &rt->dst, sk);
+        ip_select_ident(skb, &rt->dst, sk);
 
         if (opt) {
                 iph->ihl += opt->optlen>>2;
diff --git a/net/ipv4/ip_tunnel.c b/net/ipv4/ip_tunnel.c
index be2f8da0ae8e..63a6d6d6b875 100644
--- a/net/ipv4/ip_tunnel.c
+++ b/net/ipv4/ip_tunnel.c
@@ -304,6 +304,7 @@ static struct net_device *__ip_tunnel_create(struct net *net,
 
         tunnel = netdev_priv(dev);
         tunnel->parms = *parms;
+        tunnel->net = net;
 
         err = register_netdevice(dev);
         if (err)
@@ -349,7 +350,7 @@ static int ip_tunnel_bind_dev(struct net_device *dev)
                 struct flowi4 fl4;
                 struct rtable *rt;
 
-                rt = ip_route_output_tunnel(dev_net(dev), &fl4,
+                rt = ip_route_output_tunnel(tunnel->net, &fl4,
                                             tunnel->parms.iph.protocol,
                                             iph->daddr, iph->saddr,
                                             tunnel->parms.o_key,
@@ -364,7 +365,7 @@ static int ip_tunnel_bind_dev(struct net_device *dev)
         }
 
         if (!tdev && tunnel->parms.link)
-                tdev = __dev_get_by_index(dev_net(dev), tunnel->parms.link);
+                tdev = __dev_get_by_index(tunnel->net, tunnel->parms.link);
 
         if (tdev) {
                 hlen = tdev->hard_header_len + tdev->needed_headroom;
@@ -408,13 +409,6 @@ int ip_tunnel_rcv(struct ip_tunnel *tunnel, struct sk_buff *skb,
         const struct iphdr *iph = ip_hdr(skb);
         int err;
 
-        secpath_reset(skb);
-
-        skb->protocol = tpi->proto;
-
-        skb->mac_header = skb->network_header;
-        __pskb_pull(skb, tunnel->hlen);
-        skb_postpull_rcsum(skb, skb_transport_header(skb), tunnel->hlen);
 #ifdef CONFIG_NET_IPGRE_BROADCAST
         if (ipv4_is_multicast(iph->daddr)) {
                 /* Looped back packet, drop it! */
@@ -442,23 +436,6 @@ int ip_tunnel_rcv(struct ip_tunnel *tunnel, struct sk_buff *skb,
                 tunnel->i_seqno = ntohl(tpi->seq) + 1;
         }
 
-        /* Warning: All skb pointers will be invalidated! */
-        if (tunnel->dev->type == ARPHRD_ETHER) {
-                if (!pskb_may_pull(skb, ETH_HLEN)) {
-                        tunnel->dev->stats.rx_length_errors++;
-                        tunnel->dev->stats.rx_errors++;
-                        goto drop;
-                }
-
-                iph = ip_hdr(skb);
-                skb->protocol = eth_type_trans(skb, tunnel->dev);
-                skb_postpull_rcsum(skb, eth_hdr(skb), ETH_HLEN);
-        }
-
-        skb->pkt_type = PACKET_HOST;
-        __skb_tunnel_rx(skb, tunnel->dev);
-
-        skb_reset_network_header(skb);
         err = IP_ECN_decapsulate(iph, skb);
         if (unlikely(err)) {
                 if (log_ecn_error)
@@ -477,6 +454,15 @@ int ip_tunnel_rcv(struct ip_tunnel *tunnel, struct sk_buff *skb,
         tstats->rx_bytes += skb->len;
         u64_stats_update_end(&tstats->syncp);
 
+        if (tunnel->dev->type == ARPHRD_ETHER) {
+                skb->protocol = eth_type_trans(skb, tunnel->dev);
+                skb_postpull_rcsum(skb, eth_hdr(skb), ETH_HLEN);
+        } else {
+                skb->dev = tunnel->dev;
+        }
+
+        skb_scrub_packet(skb, !net_eq(tunnel->net, dev_net(tunnel->dev)));
+
         gro_cells_receive(&tunnel->gro_cells, skb);
         return 0;
 
@@ -486,24 +472,69 @@ drop:
 }
 EXPORT_SYMBOL_GPL(ip_tunnel_rcv);
 
+static int tnl_update_pmtu(struct net_device *dev, struct sk_buff *skb,
+                            struct rtable *rt, __be16 df)
+{
+        struct ip_tunnel *tunnel = netdev_priv(dev);
+        int pkt_size = skb->len - tunnel->hlen - dev->hard_header_len;
+        int mtu;
+
+        if (df)
+                mtu = dst_mtu(&rt->dst) - dev->hard_header_len
+                                        - sizeof(struct iphdr) - tunnel->hlen;
+        else
+                mtu = skb_dst(skb) ? dst_mtu(skb_dst(skb)) : dev->mtu;
+
+        if (skb_dst(skb))
+                skb_dst(skb)->ops->update_pmtu(skb_dst(skb), NULL, skb, mtu);
+
+        if (skb->protocol == htons(ETH_P_IP)) {
+                if (!skb_is_gso(skb) &&
+                    (df & htons(IP_DF)) && mtu < pkt_size) {
+                        memset(IPCB(skb), 0, sizeof(*IPCB(skb)));
+                        icmp_send(skb, ICMP_DEST_UNREACH, ICMP_FRAG_NEEDED, htonl(mtu));
+                        return -E2BIG;
+                }
+        }
+#if IS_ENABLED(CONFIG_IPV6)
+        else if (skb->protocol == htons(ETH_P_IPV6)) {
+                struct rt6_info *rt6 = (struct rt6_info *)skb_dst(skb);
+
+                if (rt6 && mtu < dst_mtu(skb_dst(skb)) &&
+                           mtu >= IPV6_MIN_MTU) {
+                        if ((tunnel->parms.iph.daddr &&
+                            !ipv4_is_multicast(tunnel->parms.iph.daddr)) ||
+                            rt6->rt6i_dst.plen == 128) {
+                                rt6->rt6i_flags |= RTF_MODIFIED;
+                                dst_metric_set(skb_dst(skb), RTAX_MTU, mtu);
+                        }
+                }
+
+                if (!skb_is_gso(skb) && mtu >= IPV6_MIN_MTU &&
+                                        mtu < pkt_size) {
+                        icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu);
+                        return -E2BIG;
+                }
+        }
+#endif
+        return 0;
+}
+
 void ip_tunnel_xmit(struct sk_buff *skb, struct net_device *dev,
-                    const struct iphdr *tnl_params)
+                    const struct iphdr *tnl_params, const u8 protocol)
 {
         struct ip_tunnel *tunnel = netdev_priv(dev);
         const struct iphdr *inner_iph;
-        struct iphdr *iph;
         struct flowi4 fl4;
         u8     tos, ttl;
         __be16 df;
         struct rtable *rt;              /* Route to the other host */
-        struct net_device *tdev;        /* Device to other host */
         unsigned int max_headroom;      /* The extra header space needed */
         __be32 dst;
-        int mtu;
+        int err;
 
         inner_iph = (const struct iphdr *)skb_inner_network_header(skb);
 
-        memset(IPCB(skb), 0, sizeof(*IPCB(skb)));
         dst = tnl_params->daddr;
         if (dst == 0) {
                 /* NBMA tunnel */
@@ -561,8 +592,8 @@ void ip_tunnel_xmit(struct sk_buff *skb, struct net_device *dev,
                         tos = ipv6_get_dsfield((const struct ipv6hdr *)inner_iph);
         }
 
-        rt = ip_route_output_tunnel(dev_net(dev), &fl4,
-                                    tunnel->parms.iph.protocol,
+        rt = ip_route_output_tunnel(tunnel->net, &fl4,
+                                    protocol,
                                     dst, tnl_params->saddr,
                                     tunnel->parms.o_key,
                                     RT_TOS(tos),
@@ -571,58 +602,16 @@ void ip_tunnel_xmit(struct sk_buff *skb, struct net_device *dev,
                 dev->stats.tx_carrier_errors++;
                 goto tx_error;
         }
-        tdev = rt->dst.dev;
-
-        if (tdev == dev) {
+        if (rt->dst.dev == dev) {
                 ip_rt_put(rt);
                 dev->stats.collisions++;
                 goto tx_error;
         }
 
-        df = tnl_params->frag_off;
-
-        if (df)
-                mtu = dst_mtu(&rt->dst) - dev->hard_header_len
-                                        - sizeof(struct iphdr);
-        else
-                mtu = skb_dst(skb) ? dst_mtu(skb_dst(skb)) : dev->mtu;
-
-        if (skb_dst(skb))
-                skb_dst(skb)->ops->update_pmtu(skb_dst(skb), NULL, skb, mtu);
-
-        if (skb->protocol == htons(ETH_P_IP)) {
-                df |= (inner_iph->frag_off&htons(IP_DF));
-
-                if (!skb_is_gso(skb) &&
-                    (inner_iph->frag_off&htons(IP_DF)) &&
-                     mtu < ntohs(inner_iph->tot_len)) {
-                        icmp_send(skb, ICMP_DEST_UNREACH, ICMP_FRAG_NEEDED, htonl(mtu));
-                        ip_rt_put(rt);
-                        goto tx_error;
-                }
-        }
-#if IS_ENABLED(CONFIG_IPV6)
-        else if (skb->protocol == htons(ETH_P_IPV6)) {
-                struct rt6_info *rt6 = (struct rt6_info *)skb_dst(skb);
-
-                if (rt6 && mtu < dst_mtu(skb_dst(skb)) &&
-                    mtu >= IPV6_MIN_MTU) {
-                        if ((tunnel->parms.iph.daddr &&
-                            !ipv4_is_multicast(tunnel->parms.iph.daddr)) ||
-                            rt6->rt6i_dst.plen == 128) {
-                                rt6->rt6i_flags |= RTF_MODIFIED;
-                                dst_metric_set(skb_dst(skb), RTAX_MTU, mtu);
-                        }
-                }
-
-                if (!skb_is_gso(skb) && mtu >= IPV6_MIN_MTU &&
-                    mtu < skb->len) {
-                        icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu);
-                        ip_rt_put(rt);
-                        goto tx_error;
-                }
+        if (tnl_update_pmtu(dev, skb, rt, tnl_params->frag_off)) {
+                ip_rt_put(rt);
+                goto tx_error;
         }
-#endif
 
         if (tunnel->err_count > 0) {
                 if (time_before(jiffies,
@@ -634,6 +623,7 @@ void ip_tunnel_xmit(struct sk_buff *skb, struct net_device *dev,
                         tunnel->err_count = 0;
         }
 
+        tos = ip_tunnel_ecn_encap(tos, inner_iph, skb);
         ttl = tnl_params->ttl;
         if (ttl == 0) {
                 if (skb->protocol == htons(ETH_P_IP))
@@ -646,38 +636,25 @@ void ip_tunnel_xmit(struct sk_buff *skb, struct net_device *dev,
                         ttl = ip4_dst_hoplimit(&rt->dst);
         }
 
-        max_headroom = LL_RESERVED_SPACE(tdev) + sizeof(struct iphdr)
-                                               + rt->dst.header_len;
-        if (max_headroom > dev->needed_headroom) {
-                dev->needed_headroom = max_headroom;
-                if (skb_cow_head(skb, dev->needed_headroom)) {
-                        dev->stats.tx_dropped++;
-                        dev_kfree_skb(skb);
-                        return;
-                }
-        }
+        df = tnl_params->frag_off;
+        if (skb->protocol == htons(ETH_P_IP))
+                df |= (inner_iph->frag_off&htons(IP_DF));
 
-        skb_dst_drop(skb);
-        skb_dst_set(skb, &rt->dst);
+        max_headroom = LL_RESERVED_SPACE(rt->dst.dev) + sizeof(struct iphdr)
+                        + rt->dst.header_len;
+        if (max_headroom > dev->needed_headroom)
+                dev->needed_headroom = max_headroom;
 
-        /* Push down and install the IP header. */
-        skb_push(skb, sizeof(struct iphdr));
-        skb_reset_network_header(skb);
+        if (skb_cow_head(skb, dev->needed_headroom)) {
+                dev->stats.tx_dropped++;
+                dev_kfree_skb(skb);
+                return;
+        }
 
-        iph = ip_hdr(skb);
-        inner_iph = (const struct iphdr *)skb_inner_network_header(skb);
+        err = iptunnel_xmit(rt, skb, fl4.saddr, fl4.daddr, protocol,
+                            tos, ttl, df, !net_eq(tunnel->net, dev_net(dev)));
+        iptunnel_xmit_stats(err, &dev->stats, dev->tstats);
 
-        iph->version    =       4;
-        iph->ihl        =       sizeof(struct iphdr) >> 2;
-        iph->frag_off   =       df;
-        iph->protocol   =       tnl_params->protocol;
-        iph->tos        =       ip_tunnel_ecn_encap(tos, inner_iph, skb);
-        iph->daddr      =       fl4.daddr;
-        iph->saddr      =       fl4.saddr;
-        iph->ttl        =       ttl;
-        tunnel_ip_select_ident(skb, inner_iph, &rt->dst);
-
-        iptunnel_xmit(skb, dev);
         return;
 
 #if IS_ENABLED(CONFIG_IPV6)
@@ -840,11 +817,10 @@ static void ip_tunnel_dev_free(struct net_device *dev)
 
 void ip_tunnel_dellink(struct net_device *dev, struct list_head *head)
 {
-        struct net *net = dev_net(dev);
         struct ip_tunnel *tunnel = netdev_priv(dev);
         struct ip_tunnel_net *itn;
 
-        itn = net_generic(net, tunnel->ip_tnl_net_id);
+        itn = net_generic(tunnel->net, tunnel->ip_tnl_net_id);
 
         if (itn->fb_tunnel_dev != dev) {
                 ip_tunnel_del(netdev_priv(dev));
@@ -853,61 +829,73 @@ void ip_tunnel_dellink(struct net_device *dev, struct list_head *head)
 }
 EXPORT_SYMBOL_GPL(ip_tunnel_dellink);
 
-int __net_init ip_tunnel_init_net(struct net *net, int ip_tnl_net_id,
+int ip_tunnel_init_net(struct net *net, int ip_tnl_net_id,
                                   struct rtnl_link_ops *ops, char *devname)
 {
         struct ip_tunnel_net *itn = net_generic(net, ip_tnl_net_id);
         struct ip_tunnel_parm parms;
+        unsigned int i;
 
-        itn->tunnels = kzalloc(IP_TNL_HASH_SIZE * sizeof(struct hlist_head), GFP_KERNEL);
-        if (!itn->tunnels)
-                return -ENOMEM;
+        for (i = 0; i < IP_TNL_HASH_SIZE; i++)
+                INIT_HLIST_HEAD(&itn->tunnels[i]);
 
         if (!ops) {
                 itn->fb_tunnel_dev = NULL;
                 return 0;
         }
+
         memset(&parms, 0, sizeof(parms));
         if (devname)
                 strlcpy(parms.name, devname, IFNAMSIZ);
 
         rtnl_lock();
         itn->fb_tunnel_dev = __ip_tunnel_create(net, ops, &parms);
-        rtnl_unlock();
-        if (IS_ERR(itn->fb_tunnel_dev)) {
-                kfree(itn->tunnels);
-                return PTR_ERR(itn->fb_tunnel_dev);
+        /* FB netdevice is special: we have one, and only one per netns.
+         * Allowing to move it to another netns is clearly unsafe.
+         */
+        if (!IS_ERR(itn->fb_tunnel_dev)) {
+                itn->fb_tunnel_dev->features |= NETIF_F_NETNS_LOCAL;
+                ip_tunnel_add(itn, netdev_priv(itn->fb_tunnel_dev));
         }
+        rtnl_unlock();
 
-        return 0;
+        return PTR_RET(itn->fb_tunnel_dev);
 }
 EXPORT_SYMBOL_GPL(ip_tunnel_init_net);
 
-static void ip_tunnel_destroy(struct ip_tunnel_net *itn, struct list_head *head)
+static void ip_tunnel_destroy(struct ip_tunnel_net *itn, struct list_head *head,
+                              struct rtnl_link_ops *ops)
 {
+        struct net *net = dev_net(itn->fb_tunnel_dev);
+        struct net_device *dev, *aux;
         int h;
 
+        for_each_netdev_safe(net, dev, aux)
+                if (dev->rtnl_link_ops == ops)
+                        unregister_netdevice_queue(dev, head);
+
         for (h = 0; h < IP_TNL_HASH_SIZE; h++) {
                 struct ip_tunnel *t;
                 struct hlist_node *n;
                 struct hlist_head *thead = &itn->tunnels[h];
 
                 hlist_for_each_entry_safe(t, n, thead, hash_node)
-                        unregister_netdevice_queue(t->dev, head);
+                        /* If dev is in the same netns, it has already
+                         * been added to the list by the previous loop.
+                         */
+                        if (!net_eq(dev_net(t->dev), net))
+                                unregister_netdevice_queue(t->dev, head);
         }
-        if (itn->fb_tunnel_dev)
-                unregister_netdevice_queue(itn->fb_tunnel_dev, head);
 }
 
-void __net_exit ip_tunnel_delete_net(struct ip_tunnel_net *itn)
+void ip_tunnel_delete_net(struct ip_tunnel_net *itn, struct rtnl_link_ops *ops)
 {
         LIST_HEAD(list);
 
         rtnl_lock();
-        ip_tunnel_destroy(itn, &list);
+        ip_tunnel_destroy(itn, &list, ops);
         unregister_netdevice_many(&list);
         rtnl_unlock();
-        kfree(itn->tunnels);
 }
 EXPORT_SYMBOL_GPL(ip_tunnel_delete_net);
 
@@ -926,6 +914,7 @@ int ip_tunnel_newlink(struct net_device *dev, struct nlattr *tb[],
         if (ip_tunnel_find(itn, p, dev->type))
                 return -EEXIST;
 
+        nt->net = net;
         nt->parms = *p;
         err = register_netdevice(dev);
         if (err)
@@ -948,23 +937,21 @@ EXPORT_SYMBOL_GPL(ip_tunnel_newlink);
 int ip_tunnel_changelink(struct net_device *dev, struct nlattr *tb[],
                          struct ip_tunnel_parm *p)
 {
-        struct ip_tunnel *t, *nt;
-        struct net *net = dev_net(dev);
+        struct ip_tunnel *t;
         struct ip_tunnel *tunnel = netdev_priv(dev);
+        struct net *net = tunnel->net;
         struct ip_tunnel_net *itn = net_generic(net, tunnel->ip_tnl_net_id);
 
         if (dev == itn->fb_tunnel_dev)
                 return -EINVAL;
 
-        nt = netdev_priv(dev);
-
         t = ip_tunnel_find(itn, p, dev->type);
 
         if (t) {
                 if (t->dev != dev)
                         return -EEXIST;
         } else {
-                t = nt;
+                t = tunnel;
 
                 if (dev->type != ARPHRD_ETHER) {
                         unsigned int nflags = 0;
@@ -1003,6 +990,7 @@ int ip_tunnel_init(struct net_device *dev)
         }
 
         tunnel->dev = dev;
+        tunnel->net = dev_net(dev);
         strcpy(tunnel->parms.name, dev->name);
         iph->version            = 4;
         iph->ihl                = 5;
@@ -1013,8 +1001,8 @@ EXPORT_SYMBOL_GPL(ip_tunnel_init);
 
 void ip_tunnel_uninit(struct net_device *dev)
 {
-        struct net *net = dev_net(dev);
         struct ip_tunnel *tunnel = netdev_priv(dev);
+        struct net *net = tunnel->net;
         struct ip_tunnel_net *itn;
 
         itn = net_generic(net, tunnel->ip_tnl_net_id);
diff --git a/net/ipv4/ip_tunnel_core.c b/net/ipv4/ip_tunnel_core.c
new file mode 100644
index 000000000000..c31e3ad98ef2
--- /dev/null
+++ b/net/ipv4/ip_tunnel_core.c
@@ -0,0 +1,118 @@
+/*
+ * Copyright (c) 2013 Nicira, Inc.
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of version 2 of the GNU General Public
+ * License as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
+ * 02110-1301, USA
+ */
+
+#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
+
+#include <linux/types.h>
+#include <linux/kernel.h>
+#include <linux/skbuff.h>
+#include <linux/netdevice.h>
+#include <linux/in.h>
+#include <linux/if_arp.h>
+#include <linux/mroute.h>
+#include <linux/init.h>
+#include <linux/in6.h>
+#include <linux/inetdevice.h>
+#include <linux/netfilter_ipv4.h>
+#include <linux/etherdevice.h>
+#include <linux/if_ether.h>
+#include <linux/if_vlan.h>
+
+#include <net/ip.h>
+#include <net/icmp.h>
+#include <net/protocol.h>
+#include <net/ip_tunnels.h>
+#include <net/arp.h>
+#include <net/checksum.h>
+#include <net/dsfield.h>
+#include <net/inet_ecn.h>
+#include <net/xfrm.h>
+#include <net/net_namespace.h>
+#include <net/netns/generic.h>
+#include <net/rtnetlink.h>
+
+int iptunnel_xmit(struct rtable *rt, struct sk_buff *skb,
+                  __be32 src, __be32 dst, __u8 proto,
+                  __u8 tos, __u8 ttl, __be16 df, bool xnet)
+{
+        int pkt_len = skb->len;
+        struct iphdr *iph;
+        int err;
+
+        skb_scrub_packet(skb, xnet);
+
+        skb->rxhash = 0;
+        skb_dst_set(skb, &rt->dst);
+        memset(IPCB(skb), 0, sizeof(*IPCB(skb)));
+
+        /* Push down and install the IP header. */
+        skb_push(skb, sizeof(struct iphdr));
+        skb_reset_network_header(skb);
+
+        iph = ip_hdr(skb);
+
+        iph->version    =       4;
+        iph->ihl        =       sizeof(struct iphdr) >> 2;
+        iph->frag_off   =       df;
+        iph->protocol   =       proto;
+        iph->tos        =       tos;
+        iph->daddr      =       dst;
+        iph->saddr      =       src;
+        iph->ttl        =       ttl;
+        __ip_select_ident(iph, &rt->dst, (skb_shinfo(skb)->gso_segs ?: 1) - 1);
+
+        err = ip_local_out(skb);
+        if (unlikely(net_xmit_eval(err)))
+                pkt_len = 0;
+        return pkt_len;
+}
+EXPORT_SYMBOL_GPL(iptunnel_xmit);
+
+int iptunnel_pull_header(struct sk_buff *skb, int hdr_len, __be16 inner_proto)
+{
+        if (unlikely(!pskb_may_pull(skb, hdr_len)))
+                return -ENOMEM;
+
+        skb_pull_rcsum(skb, hdr_len);
+
+        if (inner_proto == htons(ETH_P_TEB)) {
+                struct ethhdr *eh = (struct ethhdr *)skb->data;
+
+                if (unlikely(!pskb_may_pull(skb, ETH_HLEN)))
+                        return -ENOMEM;
+
+                if (likely(ntohs(eh->h_proto) >= ETH_P_802_3_MIN))
+                        skb->protocol = eh->h_proto;
+                else
+                        skb->protocol = htons(ETH_P_802_2);
+
+        } else {
+                skb->protocol = inner_proto;
+        }
+
+        nf_reset(skb);
+        secpath_reset(skb);
+        if (!skb->l4_rxhash)
+                skb->rxhash = 0;
+        skb_dst_drop(skb);
+        skb->vlan_tci = 0;
+        skb_set_queue_mapping(skb, 0);
+        skb->pkt_type = PACKET_HOST;
+        return 0;
+}
+EXPORT_SYMBOL_GPL(iptunnel_pull_header);
diff --git a/net/ipv4/ip_vti.c b/net/ipv4/ip_vti.c
index 9d2bdb2c1d3f..e805e7b3030e 100644
--- a/net/ipv4/ip_vti.c
+++ b/net/ipv4/ip_vti.c
@@ -44,176 +44,10 @@
 #include <net/net_namespace.h>
 #include <net/netns/generic.h>
 
-#define HASH_SIZE  16
-#define HASH(addr) (((__force u32)addr^((__force u32)addr>>4))&(HASH_SIZE-1))
-
 static struct rtnl_link_ops vti_link_ops __read_mostly;
 
 static int vti_net_id __read_mostly;
-struct vti_net {
-        struct ip_tunnel __rcu *tunnels_r_l[HASH_SIZE];
-        struct ip_tunnel __rcu *tunnels_r[HASH_SIZE];
-        struct ip_tunnel __rcu *tunnels_l[HASH_SIZE];
-        struct ip_tunnel __rcu *tunnels_wc[1];
-        struct ip_tunnel __rcu **tunnels[4];
-
-        struct net_device *fb_tunnel_dev;
-};
-
-static int vti_fb_tunnel_init(struct net_device *dev);
 static int vti_tunnel_init(struct net_device *dev);
-static void vti_tunnel_setup(struct net_device *dev);
-static void vti_dev_free(struct net_device *dev);
-static int vti_tunnel_bind_dev(struct net_device *dev);
-
-#define VTI_XMIT(stats1, stats2) do {                           \
-        int err;                                                \
-        int pkt_len = skb->len;                                 \
-        err = dst_output(skb);                                  \
-        if (net_xmit_eval(err) == 0) {                          \
-                u64_stats_update_begin(&(stats1)->syncp);       \
-                (stats1)->tx_bytes += pkt_len;                  \
-                (stats1)->tx_packets++;                         \
-                u64_stats_update_end(&(stats1)->syncp);         \
-        } else {                                                \
-                (stats2)->tx_errors++;                          \
-                (stats2)->tx_aborted_errors++;                  \
-        }                                                       \
-} while (0)
-
-
-static struct ip_tunnel *vti_tunnel_lookup(struct net *net,
-                                           __be32 remote, __be32 local)
-{
-        unsigned h0 = HASH(remote);
-        unsigned h1 = HASH(local);
-        struct ip_tunnel *t;
-        struct vti_net *ipn = net_generic(net, vti_net_id);
-
-        for_each_ip_tunnel_rcu(t, ipn->tunnels_r_l[h0 ^ h1])
-                if (local == t->parms.iph.saddr &&
-                    remote == t->parms.iph.daddr && (t->dev->flags&IFF_UP))
-                        return t;
-        for_each_ip_tunnel_rcu(t, ipn->tunnels_r[h0])
-                if (remote == t->parms.iph.daddr && (t->dev->flags&IFF_UP))
-                        return t;
-
-        for_each_ip_tunnel_rcu(t, ipn->tunnels_l[h1])
-                if (local == t->parms.iph.saddr && (t->dev->flags&IFF_UP))
-                        return t;
-
-        for_each_ip_tunnel_rcu(t, ipn->tunnels_wc[0])
-                if (t && (t->dev->flags&IFF_UP))
-                        return t;
-        return NULL;
-}
-
-static struct ip_tunnel __rcu **__vti_bucket(struct vti_net *ipn,
-                                             struct ip_tunnel_parm *parms)
-{
-        __be32 remote = parms->iph.daddr;
-        __be32 local = parms->iph.saddr;
-        unsigned h = 0;
-        int prio = 0;
-
-        if (remote) {
-                prio |= 2;
-                h ^= HASH(remote);
-        }
-        if (local) {
-                prio |= 1;
-                h ^= HASH(local);
-        }
-        return &ipn->tunnels[prio][h];
-}
-
-static inline struct ip_tunnel __rcu **vti_bucket(struct vti_net *ipn,
-                                                  struct ip_tunnel *t)
-{
-        return __vti_bucket(ipn, &t->parms);
-}
-
-static void vti_tunnel_unlink(struct vti_net *ipn, struct ip_tunnel *t)
-{
-        struct ip_tunnel __rcu **tp;
-        struct ip_tunnel *iter;
-
-        for (tp = vti_bucket(ipn, t);
-             (iter = rtnl_dereference(*tp)) != NULL;
-             tp = &iter->next) {
-                if (t == iter) {
-                        rcu_assign_pointer(*tp, t->next);
-                        break;
-                }
-        }
-}
-
-static void vti_tunnel_link(struct vti_net *ipn, struct ip_tunnel *t)
-{
-        struct ip_tunnel __rcu **tp = vti_bucket(ipn, t);
-
-        rcu_assign_pointer(t->next, rtnl_dereference(*tp));
-        rcu_assign_pointer(*tp, t);
-}
-
-static struct ip_tunnel *vti_tunnel_locate(struct net *net,
-                                           struct ip_tunnel_parm *parms,
-                                           int create)
-{
-        __be32 remote = parms->iph.daddr;
-        __be32 local = parms->iph.saddr;
-        struct ip_tunnel *t, *nt;
-        struct ip_tunnel __rcu **tp;
-        struct net_device *dev;
-        char name[IFNAMSIZ];
-        struct vti_net *ipn = net_generic(net, vti_net_id);
-
-        for (tp = __vti_bucket(ipn, parms);
-             (t = rtnl_dereference(*tp)) != NULL;
-             tp = &t->next) {
-                if (local == t->parms.iph.saddr && remote == t->parms.iph.daddr)
-                        return t;
-        }
-        if (!create)
-                return NULL;
-
-        if (parms->name[0])
-                strlcpy(name, parms->name, IFNAMSIZ);
-        else
-                strcpy(name, "vti%d");
-
-        dev = alloc_netdev(sizeof(*t), name, vti_tunnel_setup);
-        if (dev == NULL)
-                return NULL;
-
-        dev_net_set(dev, net);
-
-        nt = netdev_priv(dev);
-        nt->parms = *parms;
-        dev->rtnl_link_ops = &vti_link_ops;
-
-        vti_tunnel_bind_dev(dev);
-
-        if (register_netdevice(dev) < 0)
-                goto failed_free;
-
-        dev_hold(dev);
-        vti_tunnel_link(ipn, nt);
-        return nt;
-
-failed_free:
-        free_netdev(dev);
-        return NULL;
-}
-
-static void vti_tunnel_uninit(struct net_device *dev)
-{
-        struct net *net = dev_net(dev);
-        struct vti_net *ipn = net_generic(net, vti_net_id);
-
-        vti_tunnel_unlink(ipn, netdev_priv(dev));
-        dev_put(dev);
-}
 
 static int vti_err(struct sk_buff *skb, u32 info)
 {
@@ -222,6 +56,8 @@ static int vti_err(struct sk_buff *skb, u32 info)
          * 8 bytes of packet payload. It means, that precise relaying of
          * ICMP in the real Internet is absolutely infeasible.
          */
+        struct net *net = dev_net(skb->dev);
+        struct ip_tunnel_net *itn = net_generic(net, vti_net_id);
         struct iphdr *iph = (struct iphdr *)skb->data;
         const int type = icmp_hdr(skb)->type;
         const int code = icmp_hdr(skb)->code;
@@ -252,7 +88,8 @@ static int vti_err(struct sk_buff *skb, u32 info)
 
         err = -ENOENT;
 
-        t = vti_tunnel_lookup(dev_net(skb->dev), iph->daddr, iph->saddr);
+        t = ip_tunnel_lookup(itn, skb->dev->ifindex, TUNNEL_NO_KEY,
+                             iph->daddr, iph->saddr, 0);
         if (t == NULL)
                 goto out;
 
@@ -281,8 +118,11 @@ static int vti_rcv(struct sk_buff *skb)
 {
         struct ip_tunnel *tunnel;
         const struct iphdr *iph = ip_hdr(skb);
+        struct net *net = dev_net(skb->dev);
+        struct ip_tunnel_net *itn = net_generic(net, vti_net_id);
 
-        tunnel = vti_tunnel_lookup(dev_net(skb->dev), iph->saddr, iph->daddr);
+        tunnel = ip_tunnel_lookup(itn, skb->dev->ifindex, TUNNEL_NO_KEY,
+                                  iph->saddr, iph->daddr, 0);
         if (tunnel != NULL) {
                 struct pcpu_tstats *tstats;
 
@@ -311,7 +151,6 @@ static int vti_rcv(struct sk_buff *skb)
 static netdev_tx_t vti_tunnel_xmit(struct sk_buff *skb, struct net_device *dev)
 {
         struct ip_tunnel *tunnel = netdev_priv(dev);
-        struct pcpu_tstats *tstats;
         struct iphdr  *tiph = &tunnel->parms.iph;
         u8     tos;
         struct rtable *rt;              /* Route to the other host */
@@ -319,6 +158,7 @@ static netdev_tx_t vti_tunnel_xmit(struct sk_buff *skb, struct net_device *dev)
         struct iphdr  *old_iph = ip_hdr(skb);
         __be32 dst = tiph->daddr;
         struct flowi4 fl4;
+        int err;
 
         if (skb->protocol != htons(ETH_P_IP))
                 goto tx_error;
@@ -361,15 +201,16 @@ static netdev_tx_t vti_tunnel_xmit(struct sk_buff *skb, struct net_device *dev)
                         tunnel->err_count = 0;
         }
 
-        IPCB(skb)->flags &= ~(IPSKB_XFRM_TUNNEL_SIZE | IPSKB_XFRM_TRANSFORMED |
-                              IPSKB_REROUTED);
+        memset(IPCB(skb), 0, sizeof(*IPCB(skb)));
         skb_dst_drop(skb);
         skb_dst_set(skb, &rt->dst);
         nf_reset(skb);
         skb->dev = skb_dst(skb)->dev;
 
-        tstats = this_cpu_ptr(dev->tstats);
-        VTI_XMIT(tstats, &dev->stats);
+        err = dst_output(skb);
+        if (net_xmit_eval(err) == 0)
+                err = skb->len;
+        iptunnel_xmit_stats(err, &dev->stats, dev->tstats);
         return NETDEV_TX_OK;
 
 tx_error_icmp:
@@ -380,198 +221,57 @@ tx_error:
         return NETDEV_TX_OK;
 }
 
-static int vti_tunnel_bind_dev(struct net_device *dev)
-{
-        struct net_device *tdev = NULL;
-        struct ip_tunnel *tunnel;
-        struct iphdr *iph;
-
-        tunnel = netdev_priv(dev);
-        iph = &tunnel->parms.iph;
-
-        if (iph->daddr) {
-                struct rtable *rt;
-                struct flowi4 fl4;
-                memset(&fl4, 0, sizeof(fl4));
-                flowi4_init_output(&fl4, tunnel->parms.link,
-                                   be32_to_cpu(tunnel->parms.i_key),
-                                   RT_TOS(iph->tos), RT_SCOPE_UNIVERSE,
-                                   IPPROTO_IPIP, 0,
-                                   iph->daddr, iph->saddr, 0, 0);
-                rt = ip_route_output_key(dev_net(dev), &fl4);
-                if (!IS_ERR(rt)) {
-                        tdev = rt->dst.dev;
-                        ip_rt_put(rt);
-                }
-                dev->flags |= IFF_POINTOPOINT;
-        }
-
-        if (!tdev && tunnel->parms.link)
-                tdev = __dev_get_by_index(dev_net(dev), tunnel->parms.link);
-
-        if (tdev) {
-                dev->hard_header_len = tdev->hard_header_len +
-                                       sizeof(struct iphdr);
-                dev->mtu = tdev->mtu;
-        }
-        dev->iflink = tunnel->parms.link;
-        return dev->mtu;
-}
-
 static int
 vti_tunnel_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
 {
         int err = 0;
         struct ip_tunnel_parm p;
-        struct ip_tunnel *t;
-        struct net *net = dev_net(dev);
-        struct vti_net *ipn = net_generic(net, vti_net_id);
-
-        switch (cmd) {
-        case SIOCGETTUNNEL:
-                t = NULL;
-                if (dev == ipn->fb_tunnel_dev) {
-                        if (copy_from_user(&p, ifr->ifr_ifru.ifru_data,
-                                           sizeof(p))) {
-                                err = -EFAULT;
-                                break;
-                        }
-                        t = vti_tunnel_locate(net, &p, 0);
-                }
-                if (t == NULL)
-                        t = netdev_priv(dev);
-                memcpy(&p, &t->parms, sizeof(p));
-                p.i_flags |= GRE_KEY | VTI_ISVTI;
-                p.o_flags |= GRE_KEY;
-                if (copy_to_user(ifr->ifr_ifru.ifru_data, &p, sizeof(p)))
-                        err = -EFAULT;
-                break;
 
-        case SIOCADDTUNNEL:
-        case SIOCCHGTUNNEL:
-                err = -EPERM;
-                if (!ns_capable(net->user_ns, CAP_NET_ADMIN))
-                        goto done;
+        if (copy_from_user(&p, ifr->ifr_ifru.ifru_data, sizeof(p)))
+                return -EFAULT;
 
-                err = -EFAULT;
-                if (copy_from_user(&p, ifr->ifr_ifru.ifru_data, sizeof(p)))
-                        goto done;
-
-                err = -EINVAL;
+        if (cmd == SIOCADDTUNNEL || cmd == SIOCCHGTUNNEL) {
                 if (p.iph.version != 4 || p.iph.protocol != IPPROTO_IPIP ||
                     p.iph.ihl != 5)
-                        goto done;
-
-                t = vti_tunnel_locate(net, &p, cmd == SIOCADDTUNNEL);
-
-                if (dev != ipn->fb_tunnel_dev && cmd == SIOCCHGTUNNEL) {
-                        if (t != NULL) {
-                                if (t->dev != dev) {
-                                        err = -EEXIST;
-                                        break;
-                                }
-                        } else {
-                                if (((dev->flags&IFF_POINTOPOINT) &&
-                                    !p.iph.daddr) ||
-                                    (!(dev->flags&IFF_POINTOPOINT) &&
-                                    p.iph.daddr)) {
-                                        err = -EINVAL;
-                                        break;
-                                }
-                                t = netdev_priv(dev);
-                                vti_tunnel_unlink(ipn, t);
-                                synchronize_net();
-                                t->parms.iph.saddr = p.iph.saddr;
-                                t->parms.iph.daddr = p.iph.daddr;
-                                t->parms.i_key = p.i_key;
-                                t->parms.o_key = p.o_key;
-                                t->parms.iph.protocol = IPPROTO_IPIP;
-                                memcpy(dev->dev_addr, &p.iph.saddr, 4);
-                                memcpy(dev->broadcast, &p.iph.daddr, 4);
-                                vti_tunnel_link(ipn, t);
-                                netdev_state_change(dev);
-                        }
-                }
-
-                if (t) {
-                        err = 0;
-                        if (cmd == SIOCCHGTUNNEL) {
-                                t->parms.i_key = p.i_key;
-                                t->parms.o_key = p.o_key;
-                                if (t->parms.link != p.link) {
-                                        t->parms.link = p.link;
-                                        vti_tunnel_bind_dev(dev);
-                                        netdev_state_change(dev);
-                                }
-                        }
-                        p.i_flags |= GRE_KEY | VTI_ISVTI;
-                        p.o_flags |= GRE_KEY;
-                        if (copy_to_user(ifr->ifr_ifru.ifru_data, &t->parms,
-                                         sizeof(p)))
-                                err = -EFAULT;
-                } else
-                        err = (cmd == SIOCADDTUNNEL ? -ENOBUFS : -ENOENT);
-                break;
+                        return -EINVAL;
+        }
 
-        case SIOCDELTUNNEL:
-                err = -EPERM;
-                if (!ns_capable(net->user_ns, CAP_NET_ADMIN))
-                        goto done;
-
-                if (dev == ipn->fb_tunnel_dev) {
-                        err = -EFAULT;
-                        if (copy_from_user(&p, ifr->ifr_ifru.ifru_data,
-                                           sizeof(p)))
-                                goto done;
-                        err = -ENOENT;
-
-                        t = vti_tunnel_locate(net, &p, 0);
-                        if (t == NULL)
-                                goto done;
-                        err = -EPERM;
-                        if (t->dev == ipn->fb_tunnel_dev)
-                                goto done;
-                        dev = t->dev;
-                }
-                unregister_netdevice(dev);
-                err = 0;
-                break;
+        err = ip_tunnel_ioctl(dev, &p, cmd);
+        if (err)
+                return err;
 
-        default:
-                err = -EINVAL;
+        if (cmd != SIOCDELTUNNEL) {
+                p.i_flags |= GRE_KEY | VTI_ISVTI;
+                p.o_flags |= GRE_KEY;
         }
 
-done:
-        return err;
-}
-
-static int vti_tunnel_change_mtu(struct net_device *dev, int new_mtu)
-{
-        if (new_mtu < 68 || new_mtu > 0xFFF8)
-                return -EINVAL;
-        dev->mtu = new_mtu;
+        if (copy_to_user(ifr->ifr_ifru.ifru_data, &p, sizeof(p)))
+                return -EFAULT;
         return 0;
 }
 
 static const struct net_device_ops vti_netdev_ops = {
         .ndo_init       = vti_tunnel_init,
-        .ndo_uninit     = vti_tunnel_uninit,
+        .ndo_uninit     = ip_tunnel_uninit,
         .ndo_start_xmit = vti_tunnel_xmit,
         .ndo_do_ioctl   = vti_tunnel_ioctl,
-        .ndo_change_mtu = vti_tunnel_change_mtu,
+        .ndo_change_mtu = ip_tunnel_change_mtu,
         .ndo_get_stats64 = ip_tunnel_get_stats64,
 };
 
-static void vti_dev_free(struct net_device *dev)
+static void vti_tunnel_setup(struct net_device *dev)
 {
-        free_percpu(dev->tstats);
-        free_netdev(dev);
+        dev->netdev_ops         = &vti_netdev_ops;
+        ip_tunnel_setup(dev, vti_net_id);
 }
 
-static void vti_tunnel_setup(struct net_device *dev)
+static int vti_tunnel_init(struct net_device *dev)
 {
-        dev->netdev_ops         = &vti_netdev_ops;
-        dev->destructor         = vti_dev_free;
+        struct ip_tunnel *tunnel = netdev_priv(dev);
+        struct iphdr *iph = &tunnel->parms.iph;
+
+        memcpy(dev->dev_addr, &iph->saddr, 4);
+        memcpy(dev->broadcast, &iph->daddr, 4);
 
         dev->type               = ARPHRD_TUNNEL;
         dev->hard_header_len    = LL_MAX_HEADER + sizeof(struct iphdr);
@@ -582,45 +282,18 @@ static void vti_tunnel_setup(struct net_device *dev)
         dev->features           |= NETIF_F_NETNS_LOCAL;
         dev->features           |= NETIF_F_LLTX;
         dev->priv_flags         &= ~IFF_XMIT_DST_RELEASE;
-}
-
-static int vti_tunnel_init(struct net_device *dev)
-{
-        struct ip_tunnel *tunnel = netdev_priv(dev);
 
-        tunnel->dev = dev;
-        strcpy(tunnel->parms.name, dev->name);
-
-        memcpy(dev->dev_addr, &tunnel->parms.iph.saddr, 4);
-        memcpy(dev->broadcast, &tunnel->parms.iph.daddr, 4);
-
-        dev->tstats = alloc_percpu(struct pcpu_tstats);
-        if (!dev->tstats)
-                return -ENOMEM;
-
-        return 0;
+        return ip_tunnel_init(dev);
 }
 
-static int __net_init vti_fb_tunnel_init(struct net_device *dev)
+static void __net_init vti_fb_tunnel_init(struct net_device *dev)
 {
         struct ip_tunnel *tunnel = netdev_priv(dev);
         struct iphdr *iph = &tunnel->parms.iph;
-        struct vti_net *ipn = net_generic(dev_net(dev), vti_net_id);
-
-        tunnel->dev = dev;
-        strcpy(tunnel->parms.name, dev->name);
 
         iph->version            = 4;
         iph->protocol           = IPPROTO_IPIP;
         iph->ihl                = 5;
-
-        dev->tstats = alloc_percpu(struct pcpu_tstats);
-        if (!dev->tstats)
-                return -ENOMEM;
-
-        dev_hold(dev);
-        rcu_assign_pointer(ipn->tunnels_wc[0], tunnel);
-        return 0;
 }
 
 static struct xfrm_tunnel vti_handler __read_mostly = {
@@ -629,76 +302,30 @@ static struct xfrm_tunnel vti_handler __read_mostly = {
         .priority       =       1,
 };
 
-static void vti_destroy_tunnels(struct vti_net *ipn, struct list_head *head)
-{
-        int prio;
-
-        for (prio = 1; prio < 4; prio++) {
-                int h;
-                for (h = 0; h < HASH_SIZE; h++) {
-                        struct ip_tunnel *t;
-
-                        t = rtnl_dereference(ipn->tunnels[prio][h]);
-                        while (t != NULL) {
-                                unregister_netdevice_queue(t->dev, head);
-                                t = rtnl_dereference(t->next);
-                        }
-                }
-        }
-}
-
 static int __net_init vti_init_net(struct net *net)
 {
         int err;
-        struct vti_net *ipn = net_generic(net, vti_net_id);
-
-        ipn->tunnels[0] = ipn->tunnels_wc;
-        ipn->tunnels[1] = ipn->tunnels_l;
-        ipn->tunnels[2] = ipn->tunnels_r;
-        ipn->tunnels[3] = ipn->tunnels_r_l;
-
-        ipn->fb_tunnel_dev = alloc_netdev(sizeof(struct ip_tunnel),
-                                          "ip_vti0",
-                                          vti_tunnel_setup);
-        if (!ipn->fb_tunnel_dev) {
-                err = -ENOMEM;
-                goto err_alloc_dev;
-        }
-        dev_net_set(ipn->fb_tunnel_dev, net);
-
-        err = vti_fb_tunnel_init(ipn->fb_tunnel_dev);
-        if (err)
-                goto err_reg_dev;
-        ipn->fb_tunnel_dev->rtnl_link_ops = &vti_link_ops;
+        struct ip_tunnel_net *itn;
 
-        err = register_netdev(ipn->fb_tunnel_dev);
+        err = ip_tunnel_init_net(net, vti_net_id, &vti_link_ops, "ip_vti0");
         if (err)
-                goto err_reg_dev;
+                return err;
+        itn = net_generic(net, vti_net_id);
+        vti_fb_tunnel_init(itn->fb_tunnel_dev);
         return 0;
-
-err_reg_dev:
-        vti_dev_free(ipn->fb_tunnel_dev);
-err_alloc_dev:
-        /* nothing */
-        return err;
 }
 
 static void __net_exit vti_exit_net(struct net *net)
 {
-        struct vti_net *ipn = net_generic(net, vti_net_id);
-        LIST_HEAD(list);
-
-        rtnl_lock();
-        vti_destroy_tunnels(ipn, &list);
-        unregister_netdevice_many(&list);
-        rtnl_unlock();
+        struct ip_tunnel_net *itn = net_generic(net, vti_net_id);
+        ip_tunnel_delete_net(itn, &vti_link_ops);
 }
 
 static struct pernet_operations vti_net_ops = {
         .init = vti_init_net,
         .exit = vti_exit_net,
         .id   = &vti_net_id,
-        .size = sizeof(struct vti_net),
+        .size = sizeof(struct ip_tunnel_net),
 };
 
 static int vti_tunnel_validate(struct nlattr *tb[], struct nlattr *data[])
@@ -736,78 +363,19 @@ static void vti_netlink_parms(struct nlattr *data[],
 static int vti_newlink(struct net *src_net, struct net_device *dev,
                        struct nlattr *tb[], struct nlattr *data[])
 {
-        struct ip_tunnel *nt;
-        struct net *net = dev_net(dev);
-        struct vti_net *ipn = net_generic(net, vti_net_id);
-        int mtu;
-        int err;
-
-        nt = netdev_priv(dev);
-        vti_netlink_parms(data, &nt->parms);
-
-        if (vti_tunnel_locate(net, &nt->parms, 0))
-                return -EEXIST;
+        struct ip_tunnel_parm parms;
 
-        mtu = vti_tunnel_bind_dev(dev);
-        if (!tb[IFLA_MTU])
-                dev->mtu = mtu;
-
-        err = register_netdevice(dev);
-        if (err)
-                goto out;
-
-        dev_hold(dev);
-        vti_tunnel_link(ipn, nt);
-
-out:
-        return err;
+        vti_netlink_parms(data, &parms);
+        return ip_tunnel_newlink(dev, tb, &parms);
 }
 
 static int vti_changelink(struct net_device *dev, struct nlattr *tb[],
                           struct nlattr *data[])
 {
-        struct ip_tunnel *t, *nt;
-        struct net *net = dev_net(dev);
-        struct vti_net *ipn = net_generic(net, vti_net_id);
         struct ip_tunnel_parm p;
-        int mtu;
-
-        if (dev == ipn->fb_tunnel_dev)
-                return -EINVAL;
 
-        nt = netdev_priv(dev);
         vti_netlink_parms(data, &p);
-
-        t = vti_tunnel_locate(net, &p, 0);
-
-        if (t) {
-                if (t->dev != dev)
-                        return -EEXIST;
-        } else {
-                t = nt;
-
-                vti_tunnel_unlink(ipn, t);
-                t->parms.iph.saddr = p.iph.saddr;
-                t->parms.iph.daddr = p.iph.daddr;
-                t->parms.i_key = p.i_key;
-                t->parms.o_key = p.o_key;
-                if (dev->type != ARPHRD_ETHER) {
-                        memcpy(dev->dev_addr, &p.iph.saddr, 4);
-                        memcpy(dev->broadcast, &p.iph.daddr, 4);
-                }
-                vti_tunnel_link(ipn, t);
-                netdev_state_change(dev);
-        }
-
-        if (t->parms.link != p.link) {
-                t->parms.link = p.link;
-                mtu = vti_tunnel_bind_dev(dev);
-                if (!tb[IFLA_MTU])
-                        dev->mtu = mtu;
-                netdev_state_change(dev);
-        }
-
-        return 0;
+        return ip_tunnel_changelink(dev, tb, &p);
 }
 
 static size_t vti_get_size(const struct net_device *dev)
@@ -873,7 +441,7 @@ static int __init vti_init(void)
         err = xfrm4_mode_tunnel_input_register(&vti_handler);
         if (err < 0) {
                 unregister_pernet_device(&vti_net_ops);
-                pr_info(KERN_INFO "vti init: can't register tunnel\n");
+                pr_info("vti init: can't register tunnel\n");
         }
 
         err = rtnl_link_register(&vti_link_ops);
diff --git a/net/ipv4/ipcomp.c b/net/ipv4/ipcomp.c
index 59cb8c769056..826be4cb482a 100644
--- a/net/ipv4/ipcomp.c
+++ b/net/ipv4/ipcomp.c
@@ -47,12 +47,9 @@ static void ipcomp4_err(struct sk_buff *skb, u32 info)
         if (!x)
                 return;
 
-        if (icmp_hdr(skb)->type == ICMP_DEST_UNREACH) {
-                atomic_inc(&flow_cache_genid);
-                rt_genid_bump(net);
-
+        if (icmp_hdr(skb)->type == ICMP_DEST_UNREACH)
                 ipv4_update_pmtu(skb, net, info, 0, 0, IPPROTO_COMP, 0);
-        } else
+        else
                 ipv4_redirect(skb, net, 0, 0, IPPROTO_COMP, 0);
         xfrm_state_put(x);
 }
diff --git a/net/ipv4/ipip.c b/net/ipv4/ipip.c
index 77bfcce64fe5..7f80fb4b82d3 100644
--- a/net/ipv4/ipip.c
+++ b/net/ipv4/ipip.c
@@ -188,13 +188,16 @@ static int ipip_rcv(struct sk_buff *skb)
         struct net *net = dev_net(skb->dev);
         struct ip_tunnel_net *itn = net_generic(net, ipip_net_id);
         struct ip_tunnel *tunnel;
-        const struct iphdr *iph = ip_hdr(skb);
+        const struct iphdr *iph;
 
+        iph = ip_hdr(skb);
         tunnel = ip_tunnel_lookup(itn, skb->dev->ifindex, TUNNEL_NO_KEY,
                         iph->saddr, iph->daddr, 0);
         if (tunnel) {
                 if (!xfrm4_policy_check(NULL, XFRM_POLICY_IN, skb))
                         goto drop;
+                if (iptunnel_pull_header(skb, 0, tpi.proto))
+                        goto drop;
                 return ip_tunnel_rcv(tunnel, skb, &tpi, log_ecn_error);
         }
 
@@ -222,7 +225,7 @@ static netdev_tx_t ipip_tunnel_xmit(struct sk_buff *skb, struct net_device *dev)
                 skb->encapsulation = 1;
         }
 
-        ip_tunnel_xmit(skb, dev, tiph);
+        ip_tunnel_xmit(skb, dev, tiph, tiph->protocol);
         return NETDEV_TX_OK;
 
 tx_error:
@@ -240,11 +243,13 @@ ipip_tunnel_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
         if (copy_from_user(&p, ifr->ifr_ifru.ifru_data, sizeof(p)))
                 return -EFAULT;
 
-        if (p.iph.version != 4 || p.iph.protocol != IPPROTO_IPIP ||
-                        p.iph.ihl != 5 || (p.iph.frag_off&htons(~IP_DF)))
-                return -EINVAL;
-        if (p.i_key || p.o_key || p.i_flags || p.o_flags)
-                return -EINVAL;
+        if (cmd == SIOCADDTUNNEL || cmd == SIOCCHGTUNNEL) {
+                if (p.iph.version != 4 || p.iph.protocol != IPPROTO_IPIP ||
+                    p.iph.ihl != 5 || (p.iph.frag_off&htons(~IP_DF)))
+                        return -EINVAL;
+        }
+
+        p.i_key = p.o_key = p.i_flags = p.o_flags = 0;
         if (p.iph.ttl)
                 p.iph.frag_off |= htons(IP_DF);
 
@@ -280,7 +285,6 @@ static void ipip_tunnel_setup(struct net_device *dev)
         dev->flags              = IFF_NOARP;
         dev->iflink             = 0;
         dev->addr_len           = 4;
-        dev->features           |= NETIF_F_NETNS_LOCAL;
         dev->features           |= NETIF_F_LLTX;
         dev->priv_flags         &= ~IFF_XMIT_DST_RELEASE;
 
@@ -431,7 +435,7 @@ static int __net_init ipip_init_net(struct net *net)
 static void __net_exit ipip_exit_net(struct net *net)
 {
         struct ip_tunnel_net *itn = net_generic(net, ipip_net_id);
-        ip_tunnel_delete_net(itn);
+        ip_tunnel_delete_net(itn, &ipip_link_ops);
 }
 
 static struct pernet_operations ipip_net_ops = {
diff --git a/net/ipv4/ipmr.c b/net/ipv4/ipmr.c
index 9d9610ae7855..62212c772a4b 100644
--- a/net/ipv4/ipmr.c
+++ b/net/ipv4/ipmr.c
@@ -127,9 +127,9 @@ static struct kmem_cache *mrt_cachep __read_mostly;
 static struct mr_table *ipmr_new_table(struct net *net, u32 id);
 static void ipmr_free_table(struct mr_table *mrt);
 
-static int ip_mr_forward(struct net *net, struct mr_table *mrt,
-                         struct sk_buff *skb, struct mfc_cache *cache,
-                         int local);
+static void ip_mr_forward(struct net *net, struct mr_table *mrt,
+                          struct sk_buff *skb, struct mfc_cache *cache,
+                          int local);
 static int ipmr_cache_report(struct mr_table *mrt,
                              struct sk_buff *pkt, vifi_t vifi, int assert);
 static int __ipmr_fill_mroute(struct mr_table *mrt, struct sk_buff *skb,
@@ -980,7 +980,7 @@ static int ipmr_cache_report(struct mr_table *mrt,
 
         /* Copy the IP header */
 
-        skb->network_header = skb->tail;
+        skb_set_network_header(skb, skb->len);
         skb_put(skb, ihl);
         skb_copy_to_linear_data(skb, pkt->data, ihl);
         ip_hdr(skb)->protocol = 0;      /* Flag to the kernel this is a route add */
@@ -1609,7 +1609,7 @@ int ipmr_compat_ioctl(struct sock *sk, unsigned int cmd, void __user *arg)
 
 static int ipmr_device_event(struct notifier_block *this, unsigned long event, void *ptr)
 {
-        struct net_device *dev = ptr;
+        struct net_device *dev = netdev_notifier_info_to_dev(ptr);
         struct net *net = dev_net(dev);
         struct mr_table *mrt;
         struct vif_device *v;
@@ -1658,7 +1658,7 @@ static void ip_encap(struct sk_buff *skb, __be32 saddr, __be32 daddr)
         iph->protocol   =       IPPROTO_IPIP;
         iph->ihl        =       5;
         iph->tot_len    =       htons(skb->len);
-        ip_select_ident(iph, skb_dst(skb), NULL);
+        ip_select_ident(skb, skb_dst(skb), NULL);
         ip_send_check(iph);
 
         memset(&(IPCB(skb)->opt), 0, sizeof(IPCB(skb)->opt));
@@ -1795,9 +1795,9 @@ static int ipmr_find_vif(struct mr_table *mrt, struct net_device *dev)
 
 /* "local" means that we should preserve one skb (for local delivery) */
 
-static int ip_mr_forward(struct net *net, struct mr_table *mrt,
-                         struct sk_buff *skb, struct mfc_cache *cache,
-                         int local)
+static void ip_mr_forward(struct net *net, struct mr_table *mrt,
+                          struct sk_buff *skb, struct mfc_cache *cache,
+                          int local)
 {
         int psend = -1;
         int vif, ct;
@@ -1903,14 +1903,13 @@ last_forward:
                                 ipmr_queue_xmit(net, mrt, skb2, cache, psend);
                 } else {
                         ipmr_queue_xmit(net, mrt, skb, cache, psend);
-                        return 0;
+                        return;
                 }
         }
 
 dont_forward:
         if (!local)
                 kfree_skb(skb);
-        return 0;
 }
 
 static struct mr_table *ipmr_rt_fib_lookup(struct net *net, struct sk_buff *skb)
@@ -2068,9 +2067,8 @@ static int __pim_rcv(struct mr_table *mrt, struct sk_buff *skb,
         skb_reset_network_header(skb);
         skb->protocol = htons(ETH_P_IP);
         skb->ip_summed = CHECKSUM_NONE;
-        skb->pkt_type = PACKET_HOST;
 
-        skb_tunnel_rx(skb, reg_dev);
+        skb_tunnel_rx(skb, reg_dev, dev_net(reg_dev));
 
         netif_rx(skb);
 
diff --git a/net/ipv4/netfilter/Kconfig b/net/ipv4/netfilter/Kconfig
index e7916c193932..1657e39b291f 100644
--- a/net/ipv4/netfilter/Kconfig
+++ b/net/ipv4/netfilter/Kconfig
@@ -110,8 +110,21 @@ config IP_NF_TARGET_REJECT
 
           To compile it as a module, choose M here.  If unsure, say N.
 
+config IP_NF_TARGET_SYNPROXY
+        tristate "SYNPROXY target support"
+        depends on NF_CONNTRACK && NETFILTER_ADVANCED
+        select NETFILTER_SYNPROXY
+        select SYN_COOKIES
+        help
+          The SYNPROXY target allows you to intercept TCP connections and
+          establish them using syncookies before they are passed on to the
+          server. This allows to avoid conntrack and server resource usage
+          during SYN-flood attacks.
+
+          To compile it as a module, choose M here. If unsure, say N.
+
 config IP_NF_TARGET_ULOG
-        tristate "ULOG target support"
+        tristate "ULOG target support (obsolete)"
         default m if NETFILTER_ADVANCED=n
         ---help---
 
diff --git a/net/ipv4/netfilter/Makefile b/net/ipv4/netfilter/Makefile
index 007b128eecc9..3622b248b6dd 100644
--- a/net/ipv4/netfilter/Makefile
+++ b/net/ipv4/netfilter/Makefile
@@ -46,6 +46,7 @@ obj-$(CONFIG_IP_NF_TARGET_CLUSTERIP) += ipt_CLUSTERIP.o
 obj-$(CONFIG_IP_NF_TARGET_ECN) += ipt_ECN.o
 obj-$(CONFIG_IP_NF_TARGET_MASQUERADE) += ipt_MASQUERADE.o
 obj-$(CONFIG_IP_NF_TARGET_REJECT) += ipt_REJECT.o
+obj-$(CONFIG_IP_NF_TARGET_SYNPROXY) += ipt_SYNPROXY.o
 obj-$(CONFIG_IP_NF_TARGET_ULOG) += ipt_ULOG.o
 
 # generic ARP tables
diff --git a/net/ipv4/netfilter/arptable_filter.c b/net/ipv4/netfilter/arptable_filter.c
index eadab1ed6500..a865f6f94013 100644
--- a/net/ipv4/netfilter/arptable_filter.c
+++ b/net/ipv4/netfilter/arptable_filter.c
@@ -48,7 +48,7 @@ static int __net_init arptable_filter_net_init(struct net *net)
         net->ipv4.arptable_filter =
                 arpt_register_table(net, &packet_filter, repl);
         kfree(repl);
-        return PTR_RET(net->ipv4.arptable_filter);
+        return PTR_ERR_OR_ZERO(net->ipv4.arptable_filter);
 }
 
 static void __net_exit arptable_filter_net_exit(struct net *net)
diff --git a/net/ipv4/netfilter/ipt_MASQUERADE.c b/net/ipv4/netfilter/ipt_MASQUERADE.c
index 5d5d4d1be9c2..00352ce0f0de 100644
--- a/net/ipv4/netfilter/ipt_MASQUERADE.c
+++ b/net/ipv4/netfilter/ipt_MASQUERADE.c
@@ -108,7 +108,7 @@ static int masq_device_event(struct notifier_block *this,
                              unsigned long event,
                              void *ptr)
 {
-        const struct net_device *dev = ptr;
+        const struct net_device *dev = netdev_notifier_info_to_dev(ptr);
         struct net *net = dev_net(dev);
 
         if (event == NETDEV_DOWN) {
@@ -118,7 +118,7 @@ static int masq_device_event(struct notifier_block *this,
                 NF_CT_ASSERT(dev->ifindex != 0);
 
                 nf_ct_iterate_cleanup(net, device_cmp,
-                                      (void *)(long)dev->ifindex);
+                                      (void *)(long)dev->ifindex, 0, 0);
         }
 
         return NOTIFY_DONE;
@@ -129,7 +129,10 @@ static int masq_inet_event(struct notifier_block *this,
                            void *ptr)
 {
         struct net_device *dev = ((struct in_ifaddr *)ptr)->ifa_dev->dev;
-        return masq_device_event(this, event, dev);
+        struct netdev_notifier_info info;
+
+        netdev_notifier_info_init(&info, dev);
+        return masq_device_event(this, event, &info);
 }
 
 static struct notifier_block masq_dev_notifier = {
diff --git a/net/ipv4/netfilter/ipt_REJECT.c b/net/ipv4/netfilter/ipt_REJECT.c
index 04b18c1ac345..b969131ad1c1 100644
--- a/net/ipv4/netfilter/ipt_REJECT.c
+++ b/net/ipv4/netfilter/ipt_REJECT.c
@@ -119,7 +119,26 @@ static void send_reset(struct sk_buff *oldskb, int hook)
 
         nf_ct_attach(nskb, oldskb);
 
-        ip_local_out(nskb);
+#ifdef CONFIG_BRIDGE_NETFILTER
+        /* If we use ip_local_out for bridged traffic, the MAC source on
+         * the RST will be ours, instead of the destination's.  This confuses
+         * some routers/firewalls, and they drop the packet.  So we need to
+         * build the eth header using the original destination's MAC as the
+         * source, and send the RST packet directly.
+         */
+        if (oldskb->nf_bridge) {
+                struct ethhdr *oeth = eth_hdr(oldskb);
+                nskb->dev = oldskb->nf_bridge->physindev;
+                niph->tot_len = htons(nskb->len);
+                ip_send_check(niph);
+                if (dev_hard_header(nskb, nskb->dev, ntohs(nskb->protocol),
+                                    oeth->h_source, oeth->h_dest, nskb->len) < 0)
+                        goto free_nskb;
+                dev_queue_xmit(nskb);
+        } else
+#endif
+                ip_local_out(nskb);
+
         return;
 
  free_nskb:
diff --git a/net/ipv4/netfilter/ipt_SYNPROXY.c b/net/ipv4/netfilter/ipt_SYNPROXY.c
new file mode 100644
index 000000000000..b6346bf2fde3
--- /dev/null
+++ b/net/ipv4/netfilter/ipt_SYNPROXY.c
@@ -0,0 +1,480 @@
+/*
+ * Copyright (c) 2013 Patrick McHardy <kaber@trash.net>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+
+#include <linux/module.h>
+#include <linux/skbuff.h>
+#include <net/tcp.h>
+
+#include <linux/netfilter_ipv4/ip_tables.h>
+#include <linux/netfilter/x_tables.h>
+#include <linux/netfilter/xt_SYNPROXY.h>
+#include <net/netfilter/nf_conntrack.h>
+#include <net/netfilter/nf_conntrack_seqadj.h>
+#include <net/netfilter/nf_conntrack_synproxy.h>
+
+static struct iphdr *
+synproxy_build_ip(struct sk_buff *skb, u32 saddr, u32 daddr)
+{
+        struct iphdr *iph;
+
+        skb_reset_network_header(skb);
+        iph = (struct iphdr *)skb_put(skb, sizeof(*iph));
+        iph->version    = 4;
+        iph->ihl        = sizeof(*iph) / 4;
+        iph->tos        = 0;
+        iph->id         = 0;
+        iph->frag_off   = htons(IP_DF);
+        iph->ttl        = sysctl_ip_default_ttl;
+        iph->protocol   = IPPROTO_TCP;
+        iph->check      = 0;
+        iph->saddr      = saddr;
+        iph->daddr      = daddr;
+
+        return iph;
+}
+
+static void
+synproxy_send_tcp(const struct sk_buff *skb, struct sk_buff *nskb,
+                  struct nf_conntrack *nfct, enum ip_conntrack_info ctinfo,
+                  struct iphdr *niph, struct tcphdr *nth,
+                  unsigned int tcp_hdr_size)
+{
+        nth->check = ~tcp_v4_check(tcp_hdr_size, niph->saddr, niph->daddr, 0);
+        nskb->ip_summed   = CHECKSUM_PARTIAL;
+        nskb->csum_start  = (unsigned char *)nth - nskb->head;
+        nskb->csum_offset = offsetof(struct tcphdr, check);
+
+        skb_dst_set_noref(nskb, skb_dst(skb));
+        nskb->protocol = htons(ETH_P_IP);
+        if (ip_route_me_harder(nskb, RTN_UNSPEC))
+                goto free_nskb;
+
+        if (nfct) {
+                nskb->nfct = nfct;
+                nskb->nfctinfo = ctinfo;
+                nf_conntrack_get(nfct);
+        }
+
+        ip_local_out(nskb);
+        return;
+
+free_nskb:
+        kfree_skb(nskb);
+}
+
+static void
+synproxy_send_client_synack(const struct sk_buff *skb, const struct tcphdr *th,
+                            const struct synproxy_options *opts)
+{
+        struct sk_buff *nskb;
+        struct iphdr *iph, *niph;
+        struct tcphdr *nth;
+        unsigned int tcp_hdr_size;
+        u16 mss = opts->mss;
+
+        iph = ip_hdr(skb);
+
+        tcp_hdr_size = sizeof(*nth) + synproxy_options_size(opts);
+        nskb = alloc_skb(sizeof(*niph) + tcp_hdr_size + MAX_TCP_HEADER,
+                         GFP_ATOMIC);
+        if (nskb == NULL)
+                return;
+        skb_reserve(nskb, MAX_TCP_HEADER);
+
+        niph = synproxy_build_ip(nskb, iph->daddr, iph->saddr);
+
+        skb_reset_transport_header(nskb);
+        nth = (struct tcphdr *)skb_put(nskb, tcp_hdr_size);
+        nth->source     = th->dest;
+        nth->dest       = th->source;
+        nth->seq        = htonl(__cookie_v4_init_sequence(iph, th, &mss));
+        nth->ack_seq    = htonl(ntohl(th->seq) + 1);
+        tcp_flag_word(nth) = TCP_FLAG_SYN | TCP_FLAG_ACK;
+        if (opts->options & XT_SYNPROXY_OPT_ECN)
+                tcp_flag_word(nth) |= TCP_FLAG_ECE;
+        nth->doff       = tcp_hdr_size / 4;
+        nth->window     = 0;
+        nth->check      = 0;
+        nth->urg_ptr    = 0;
+
+        synproxy_build_options(nth, opts);
+
+        synproxy_send_tcp(skb, nskb, skb->nfct, IP_CT_ESTABLISHED_REPLY,
+                          niph, nth, tcp_hdr_size);
+}
+
+static void
+synproxy_send_server_syn(const struct synproxy_net *snet,
+                         const struct sk_buff *skb, const struct tcphdr *th,
+                         const struct synproxy_options *opts, u32 recv_seq)
+{
+        struct sk_buff *nskb;
+        struct iphdr *iph, *niph;
+        struct tcphdr *nth;
+        unsigned int tcp_hdr_size;
+
+        iph = ip_hdr(skb);
+
+        tcp_hdr_size = sizeof(*nth) + synproxy_options_size(opts);
+        nskb = alloc_skb(sizeof(*niph) + tcp_hdr_size + MAX_TCP_HEADER,
+                         GFP_ATOMIC);
+        if (nskb == NULL)
+                return;
+        skb_reserve(nskb, MAX_TCP_HEADER);
+
+        niph = synproxy_build_ip(nskb, iph->saddr, iph->daddr);
+
+        skb_reset_transport_header(nskb);
+        nth = (struct tcphdr *)skb_put(nskb, tcp_hdr_size);
+        nth->source     = th->source;
+        nth->dest       = th->dest;
+        nth->seq        = htonl(recv_seq - 1);
+        /* ack_seq is used to relay our ISN to the synproxy hook to initialize
+         * sequence number translation once a connection tracking entry exists.
+         */
+        nth->ack_seq    = htonl(ntohl(th->ack_seq) - 1);
+        tcp_flag_word(nth) = TCP_FLAG_SYN;
+        if (opts->options & XT_SYNPROXY_OPT_ECN)
+                tcp_flag_word(nth) |= TCP_FLAG_ECE | TCP_FLAG_CWR;
+        nth->doff       = tcp_hdr_size / 4;
+        nth->window     = th->window;
+        nth->check      = 0;
+        nth->urg_ptr    = 0;
+
+        synproxy_build_options(nth, opts);
+
+        synproxy_send_tcp(skb, nskb, &snet->tmpl->ct_general, IP_CT_NEW,
+                          niph, nth, tcp_hdr_size);
+}
+
+static void
+synproxy_send_server_ack(const struct synproxy_net *snet,
+                         const struct ip_ct_tcp *state,
+                         const struct sk_buff *skb, const struct tcphdr *th,
+                         const struct synproxy_options *opts)
+{
+        struct sk_buff *nskb;
+        struct iphdr *iph, *niph;
+        struct tcphdr *nth;
+        unsigned int tcp_hdr_size;
+
+        iph = ip_hdr(skb);
+
+        tcp_hdr_size = sizeof(*nth) + synproxy_options_size(opts);
+        nskb = alloc_skb(sizeof(*niph) + tcp_hdr_size + MAX_TCP_HEADER,
+                         GFP_ATOMIC);
+        if (nskb == NULL)
+                return;
+        skb_reserve(nskb, MAX_TCP_HEADER);
+
+        niph = synproxy_build_ip(nskb, iph->daddr, iph->saddr);
+
+        skb_reset_transport_header(nskb);
+        nth = (struct tcphdr *)skb_put(nskb, tcp_hdr_size);
+        nth->source     = th->dest;
+        nth->dest       = th->source;
+        nth->seq        = htonl(ntohl(th->ack_seq));
+        nth->ack_seq    = htonl(ntohl(th->seq) + 1);
+        tcp_flag_word(nth) = TCP_FLAG_ACK;
+        nth->doff       = tcp_hdr_size / 4;
+        nth->window     = htons(state->seen[IP_CT_DIR_ORIGINAL].td_maxwin);
+        nth->check      = 0;
+        nth->urg_ptr    = 0;
+
+        synproxy_build_options(nth, opts);
+
+        synproxy_send_tcp(skb, nskb, NULL, 0, niph, nth, tcp_hdr_size);
+}
+
+static void
+synproxy_send_client_ack(const struct synproxy_net *snet,
+                         const struct sk_buff *skb, const struct tcphdr *th,
+                         const struct synproxy_options *opts)
+{
+        struct sk_buff *nskb;
+        struct iphdr *iph, *niph;
+        struct tcphdr *nth;
+        unsigned int tcp_hdr_size;
+
+        iph = ip_hdr(skb);
+
+        tcp_hdr_size = sizeof(*nth) + synproxy_options_size(opts);
+        nskb = alloc_skb(sizeof(*niph) + tcp_hdr_size + MAX_TCP_HEADER,
+                         GFP_ATOMIC);
+        if (nskb == NULL)
+                return;
+        skb_reserve(nskb, MAX_TCP_HEADER);
+
+        niph = synproxy_build_ip(nskb, iph->saddr, iph->daddr);
+
+        skb_reset_transport_header(nskb);
+        nth = (struct tcphdr *)skb_put(nskb, tcp_hdr_size);
+        nth->source     = th->source;
+        nth->dest       = th->dest;
+        nth->seq        = htonl(ntohl(th->seq) + 1);
+        nth->ack_seq    = th->ack_seq;
+        tcp_flag_word(nth) = TCP_FLAG_ACK;
+        nth->doff       = tcp_hdr_size / 4;
+        nth->window     = ntohs(htons(th->window) >> opts->wscale);
+        nth->check      = 0;
+        nth->urg_ptr    = 0;
+
+        synproxy_build_options(nth, opts);
+
+        synproxy_send_tcp(skb, nskb, NULL, 0, niph, nth, tcp_hdr_size);
+}
+
+static bool
+synproxy_recv_client_ack(const struct synproxy_net *snet,
+                         const struct sk_buff *skb, const struct tcphdr *th,
+                         struct synproxy_options *opts, u32 recv_seq)
+{
+        int mss;
+
+        mss = __cookie_v4_check(ip_hdr(skb), th, ntohl(th->ack_seq) - 1);
+        if (mss == 0) {
+                this_cpu_inc(snet->stats->cookie_invalid);
+                return false;
+        }
+
+        this_cpu_inc(snet->stats->cookie_valid);
+        opts->mss = mss;
+
+        if (opts->options & XT_SYNPROXY_OPT_TIMESTAMP)
+                synproxy_check_timestamp_cookie(opts);
+
+        synproxy_send_server_syn(snet, skb, th, opts, recv_seq);
+        return true;
+}
+
+static unsigned int
+synproxy_tg4(struct sk_buff *skb, const struct xt_action_param *par)
+{
+        const struct xt_synproxy_info *info = par->targinfo;
+        struct synproxy_net *snet = synproxy_pernet(dev_net(par->in));
+        struct synproxy_options opts = {};
+        struct tcphdr *th, _th;
+
+        if (nf_ip_checksum(skb, par->hooknum, par->thoff, IPPROTO_TCP))
+                return NF_DROP;
+
+        th = skb_header_pointer(skb, par->thoff, sizeof(_th), &_th);
+        if (th == NULL)
+                return NF_DROP;
+
+        if (!synproxy_parse_options(skb, par->thoff, th, &opts))
+                return NF_DROP;
+
+        if (th->syn && !(th->ack || th->fin || th->rst)) {
+                /* Initial SYN from client */
+                this_cpu_inc(snet->stats->syn_received);
+
+                if (th->ece && th->cwr)
+                        opts.options |= XT_SYNPROXY_OPT_ECN;
+
+                opts.options &= info->options;
+                if (opts.options & XT_SYNPROXY_OPT_TIMESTAMP)
+                        synproxy_init_timestamp_cookie(info, &opts);
+                else
+                        opts.options &= ~(XT_SYNPROXY_OPT_WSCALE |
+                                          XT_SYNPROXY_OPT_SACK_PERM |
+                                          XT_SYNPROXY_OPT_ECN);
+
+                synproxy_send_client_synack(skb, th, &opts);
+                return NF_DROP;
+
+        } else if (th->ack && !(th->fin || th->rst || th->syn)) {
+                /* ACK from client */
+                synproxy_recv_client_ack(snet, skb, th, &opts, ntohl(th->seq));
+                return NF_DROP;
+        }
+
+        return XT_CONTINUE;
+}
+
+static unsigned int ipv4_synproxy_hook(unsigned int hooknum,
+                                       struct sk_buff *skb,
+                                       const struct net_device *in,
+                                       const struct net_device *out,
+                                       int (*okfn)(struct sk_buff *))
+{
+        struct synproxy_net *snet = synproxy_pernet(dev_net(in ? : out));
+        enum ip_conntrack_info ctinfo;
+        struct nf_conn *ct;
+        struct nf_conn_synproxy *synproxy;
+        struct synproxy_options opts = {};
+        const struct ip_ct_tcp *state;
+        struct tcphdr *th, _th;
+        unsigned int thoff;
+
+        ct = nf_ct_get(skb, &ctinfo);
+        if (ct == NULL)
+                return NF_ACCEPT;
+
+        synproxy = nfct_synproxy(ct);
+        if (synproxy == NULL)
+                return NF_ACCEPT;
+
+        if (nf_is_loopback_packet(skb))
+                return NF_ACCEPT;
+
+        thoff = ip_hdrlen(skb);
+        th = skb_header_pointer(skb, thoff, sizeof(_th), &_th);
+        if (th == NULL)
+                return NF_DROP;
+
+        state = &ct->proto.tcp;
+        switch (state->state) {
+        case TCP_CONNTRACK_CLOSE:
+                if (th->rst && !test_bit(IPS_SEEN_REPLY_BIT, &ct->status)) {
+                        nf_ct_seqadj_init(ct, ctinfo, synproxy->isn -
+                                                      ntohl(th->seq) + 1);
+                        break;
+                }
+
+                if (!th->syn || th->ack ||
+                    CTINFO2DIR(ctinfo) != IP_CT_DIR_ORIGINAL)
+                        break;
+
+                /* Reopened connection - reset the sequence number and timestamp
+                 * adjustments, they will get initialized once the connection is
+                 * reestablished.
+                 */
+                nf_ct_seqadj_init(ct, ctinfo, 0);
+                synproxy->tsoff = 0;
+                this_cpu_inc(snet->stats->conn_reopened);
+
+                /* fall through */
+        case TCP_CONNTRACK_SYN_SENT:
+                if (!synproxy_parse_options(skb, thoff, th, &opts))
+                        return NF_DROP;
+
+                if (!th->syn && th->ack &&
+                    CTINFO2DIR(ctinfo) == IP_CT_DIR_ORIGINAL) {
+                        /* Keep-Alives are sent with SEG.SEQ = SND.NXT-1,
+                         * therefore we need to add 1 to make the SYN sequence
+                         * number match the one of first SYN.
+                         */
+                        if (synproxy_recv_client_ack(snet, skb, th, &opts,
+                                                     ntohl(th->seq) + 1))
+                                this_cpu_inc(snet->stats->cookie_retrans);
+
+                        return NF_DROP;
+                }
+
+                synproxy->isn = ntohl(th->ack_seq);
+                if (opts.options & XT_SYNPROXY_OPT_TIMESTAMP)
+                        synproxy->its = opts.tsecr;
+                break;
+        case TCP_CONNTRACK_SYN_RECV:
+                if (!th->syn || !th->ack)
+                        break;
+
+                if (!synproxy_parse_options(skb, thoff, th, &opts))
+                        return NF_DROP;
+
+                if (opts.options & XT_SYNPROXY_OPT_TIMESTAMP)
+                        synproxy->tsoff = opts.tsval - synproxy->its;
+
+                opts.options &= ~(XT_SYNPROXY_OPT_MSS |
+                                  XT_SYNPROXY_OPT_WSCALE |
+                                  XT_SYNPROXY_OPT_SACK_PERM);
+
+                swap(opts.tsval, opts.tsecr);
+                synproxy_send_server_ack(snet, state, skb, th, &opts);
+
+                nf_ct_seqadj_init(ct, ctinfo, synproxy->isn - ntohl(th->seq));
+
+                swap(opts.tsval, opts.tsecr);
+                synproxy_send_client_ack(snet, skb, th, &opts);
+
+                consume_skb(skb);
+                return NF_STOLEN;
+        default:
+                break;
+        }
+
+        synproxy_tstamp_adjust(skb, thoff, th, ct, ctinfo, synproxy);
+        return NF_ACCEPT;
+}
+
+static int synproxy_tg4_check(const struct xt_tgchk_param *par)
+{
+        const struct ipt_entry *e = par->entryinfo;
+
+        if (e->ip.proto != IPPROTO_TCP ||
+            e->ip.invflags & XT_INV_PROTO)
+                return -EINVAL;
+
+        return nf_ct_l3proto_try_module_get(par->family);
+}
+
+static void synproxy_tg4_destroy(const struct xt_tgdtor_param *par)
+{
+        nf_ct_l3proto_module_put(par->family);
+}
+
+static struct xt_target synproxy_tg4_reg __read_mostly = {
+        .name           = "SYNPROXY",
+        .family         = NFPROTO_IPV4,
+        .target         = synproxy_tg4,
+        .targetsize     = sizeof(struct xt_synproxy_info),
+        .checkentry     = synproxy_tg4_check,
+        .destroy        = synproxy_tg4_destroy,
+        .me             = THIS_MODULE,
+};
+
+static struct nf_hook_ops ipv4_synproxy_ops[] __read_mostly = {
+        {
+                .hook           = ipv4_synproxy_hook,
+                .owner          = THIS_MODULE,
+                .pf             = NFPROTO_IPV4,
+                .hooknum        = NF_INET_LOCAL_IN,
+                .priority       = NF_IP_PRI_CONNTRACK_CONFIRM - 1,
+        },
+        {
+                .hook           = ipv4_synproxy_hook,
+                .owner          = THIS_MODULE,
+                .pf             = NFPROTO_IPV4,
+                .hooknum        = NF_INET_POST_ROUTING,
+                .priority       = NF_IP_PRI_CONNTRACK_CONFIRM - 1,
+        },
+};
+
+static int __init synproxy_tg4_init(void)
+{
+        int err;
+
+        err = nf_register_hooks(ipv4_synproxy_ops,
+                                ARRAY_SIZE(ipv4_synproxy_ops));
+        if (err < 0)
+                goto err1;
+
+        err = xt_register_target(&synproxy_tg4_reg);
+        if (err < 0)
+                goto err2;
+
+        return 0;
+
+err2:
+        nf_unregister_hooks(ipv4_synproxy_ops, ARRAY_SIZE(ipv4_synproxy_ops));
+err1:
+        return err;
+}
+
+static void __exit synproxy_tg4_exit(void)
+{
+        xt_unregister_target(&synproxy_tg4_reg);
+        nf_unregister_hooks(ipv4_synproxy_ops, ARRAY_SIZE(ipv4_synproxy_ops));
+}
+
+module_init(synproxy_tg4_init);
+module_exit(synproxy_tg4_exit);
+
+MODULE_LICENSE("GPL");
+MODULE_AUTHOR("Patrick McHardy <kaber@trash.net>");
diff --git a/net/ipv4/netfilter/ipt_ULOG.c b/net/ipv4/netfilter/ipt_ULOG.c
index ff4b781b1056..cbc22158af49 100644
--- a/net/ipv4/netfilter/ipt_ULOG.c
+++ b/net/ipv4/netfilter/ipt_ULOG.c
@@ -125,15 +125,16 @@ static void ulog_send(struct ulog_net *ulog, unsigned int nlgroupnum)
 /* timer function to flush queue in flushtimeout time */
 static void ulog_timer(unsigned long data)
 {
+        unsigned int groupnum = *((unsigned int *)data);
         struct ulog_net *ulog = container_of((void *)data,
                                              struct ulog_net,
-                                             nlgroup[*(unsigned int *)data]);
+                                             nlgroup[groupnum]);
         pr_debug("timer function called, calling ulog_send\n");
 
         /* lock to protect against somebody modifying our structure
          * from ipt_ulog_target at the same time */
         spin_lock_bh(&ulog->lock);
-        ulog_send(ulog, data);
+        ulog_send(ulog, groupnum);
         spin_unlock_bh(&ulog->lock);
 }
 
@@ -330,6 +331,12 @@ static int ulog_tg_check(const struct xt_tgchk_param *par)
 {
         const struct ipt_ulog_info *loginfo = par->targinfo;
 
+        if (!par->net->xt.ulog_warn_deprecated) {
+                pr_info("ULOG is deprecated and it will be removed soon, "
+                        "use NFLOG instead\n");
+                par->net->xt.ulog_warn_deprecated = true;
+        }
+
         if (loginfo->prefix[sizeof(loginfo->prefix) - 1] != '\0') {
                 pr_debug("prefix not null-terminated\n");
                 return -EINVAL;
@@ -407,8 +414,11 @@ static int __net_init ulog_tg_net_init(struct net *net)
 
         spin_lock_init(&ulog->lock);
         /* initialize ulog_buffers */
-        for (i = 0; i < ULOG_MAXNLGROUPS; i++)
-                setup_timer(&ulog->ulog_buffers[i].timer, ulog_timer, i);
+        for (i = 0; i < ULOG_MAXNLGROUPS; i++) {
+                ulog->nlgroup[i] = i;
+                setup_timer(&ulog->ulog_buffers[i].timer, ulog_timer,
+                            (unsigned long)&ulog->nlgroup[i]);
+        }
 
         ulog->nflognl = netlink_kernel_create(net, NETLINK_NFLOG, &cfg);
         if (!ulog->nflognl)
diff --git a/net/ipv4/netfilter/iptable_filter.c b/net/ipv4/netfilter/iptable_filter.c
index 6b3da5cf54e9..50af5b45c050 100644
--- a/net/ipv4/netfilter/iptable_filter.c
+++ b/net/ipv4/netfilter/iptable_filter.c
@@ -69,7 +69,7 @@ static int __net_init iptable_filter_net_init(struct net *net)
         net->ipv4.iptable_filter =
                 ipt_register_table(net, &packet_filter, repl);
         kfree(repl);
-        return PTR_RET(net->ipv4.iptable_filter);
+        return PTR_ERR_OR_ZERO(net->ipv4.iptable_filter);
 }
 
 static void __net_exit iptable_filter_net_exit(struct net *net)
diff --git a/net/ipv4/netfilter/iptable_mangle.c b/net/ipv4/netfilter/iptable_mangle.c
index cba5658ec82c..0d8cd82e0fad 100644
--- a/net/ipv4/netfilter/iptable_mangle.c
+++ b/net/ipv4/netfilter/iptable_mangle.c
@@ -107,7 +107,7 @@ static int __net_init iptable_mangle_net_init(struct net *net)
         net->ipv4.iptable_mangle =
                 ipt_register_table(net, &packet_mangler, repl);
         kfree(repl);
-        return PTR_RET(net->ipv4.iptable_mangle);
+        return PTR_ERR_OR_ZERO(net->ipv4.iptable_mangle);
 }
 
 static void __net_exit iptable_mangle_net_exit(struct net *net)
diff --git a/net/ipv4/netfilter/iptable_nat.c b/net/ipv4/netfilter/iptable_nat.c
index 6383273d54e1..683bfaffed65 100644
--- a/net/ipv4/netfilter/iptable_nat.c
+++ b/net/ipv4/netfilter/iptable_nat.c
@@ -292,7 +292,7 @@ static int __net_init iptable_nat_net_init(struct net *net)
                 return -ENOMEM;
         net->ipv4.nat_table = ipt_register_table(net, &nf_nat_ipv4_table, repl);
         kfree(repl);
-        return PTR_RET(net->ipv4.nat_table);
+        return PTR_ERR_OR_ZERO(net->ipv4.nat_table);
 }
 
 static void __net_exit iptable_nat_net_exit(struct net *net)
diff --git a/net/ipv4/netfilter/iptable_raw.c b/net/ipv4/netfilter/iptable_raw.c
index 03d9696d3c6e..1f82aea11df6 100644
--- a/net/ipv4/netfilter/iptable_raw.c
+++ b/net/ipv4/netfilter/iptable_raw.c
@@ -48,7 +48,7 @@ static int __net_init iptable_raw_net_init(struct net *net)
         net->ipv4.iptable_raw =
                 ipt_register_table(net, &packet_raw, repl);
         kfree(repl);
-        return PTR_RET(net->ipv4.iptable_raw);
+        return PTR_ERR_OR_ZERO(net->ipv4.iptable_raw);
 }
 
 static void __net_exit iptable_raw_net_exit(struct net *net)
diff --git a/net/ipv4/netfilter/iptable_security.c b/net/ipv4/netfilter/iptable_security.c
index b283d8e2601a..f867a8d38bf7 100644
--- a/net/ipv4/netfilter/iptable_security.c
+++ b/net/ipv4/netfilter/iptable_security.c
@@ -66,7 +66,7 @@ static int __net_init iptable_security_net_init(struct net *net)
         net->ipv4.iptable_security =
                 ipt_register_table(net, &security_table, repl);
         kfree(repl);
-        return PTR_RET(net->ipv4.iptable_security);
+        return PTR_ERR_OR_ZERO(net->ipv4.iptable_security);
 }
 
 static void __net_exit iptable_security_net_exit(struct net *net)
diff --git a/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c b/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c
index 567d84168bd2..86f5b34a4ed1 100644
--- a/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c
+++ b/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c
@@ -25,6 +25,7 @@
 #include <net/netfilter/nf_conntrack_l3proto.h>
 #include <net/netfilter/nf_conntrack_zones.h>
 #include <net/netfilter/nf_conntrack_core.h>
+#include <net/netfilter/nf_conntrack_seqadj.h>
 #include <net/netfilter/ipv4/nf_conntrack_ipv4.h>
 #include <net/netfilter/nf_nat_helper.h>
 #include <net/netfilter/ipv4/nf_defrag_ipv4.h>
@@ -136,11 +137,7 @@ static unsigned int ipv4_confirm(unsigned int hooknum,
         /* adjust seqs for loopback traffic only in outgoing direction */
         if (test_bit(IPS_SEQ_ADJUST_BIT, &ct->status) &&
             !nf_is_loopback_packet(skb)) {
-                typeof(nf_nat_seq_adjust_hook) seq_adjust;
-
-                seq_adjust = rcu_dereference(nf_nat_seq_adjust_hook);
-                if (!seq_adjust ||
-                    !seq_adjust(skb, ct, ctinfo, ip_hdrlen(skb))) {
+                if (!nf_ct_seq_adjust(skb, ct, ctinfo, ip_hdrlen(skb))) {
                         NF_CT_STAT_INC_ATOMIC(nf_ct_net(ct), drop);
                         return NF_DROP;
                 }
@@ -223,7 +220,7 @@ static struct nf_hook_ops ipv4_conntrack_ops[] __read_mostly = {
 static int log_invalid_proto_min = 0;
 static int log_invalid_proto_max = 255;
 
-static ctl_table ip_ct_sysctl_table[] = {
+static struct ctl_table ip_ct_sysctl_table[] = {
         {
                 .procname       = "ip_conntrack_max",
                 .maxlen         = sizeof(int),
diff --git a/net/ipv4/ping.c b/net/ipv4/ping.c
index 7d93d62cd5fd..d7d9882d4cae 100644
--- a/net/ipv4/ping.c
+++ b/net/ipv4/ping.c
@@ -33,7 +33,6 @@
 #include <linux/netdevice.h>
 #include <net/snmp.h>
 #include <net/ip.h>
-#include <net/ipv6.h>
 #include <net/icmp.h>
 #include <net/protocol.h>
 #include <linux/skbuff.h>
@@ -46,8 +45,18 @@
 #include <net/inet_common.h>
 #include <net/checksum.h>
 
+#if IS_ENABLED(CONFIG_IPV6)
+#include <linux/in6.h>
+#include <linux/icmpv6.h>
+#include <net/addrconf.h>
+#include <net/ipv6.h>
+#include <net/transp_v6.h>
+#endif
 
-static struct ping_table ping_table;
+
+struct ping_table ping_table;
+struct pingv6_ops pingv6_ops;
+EXPORT_SYMBOL_GPL(pingv6_ops);
 
 static u16 ping_port_rover;
 
@@ -58,6 +67,7 @@ static inline int ping_hashfn(struct net *net, unsigned int num, unsigned int ma
         pr_debug("hash(%d) = %d\n", num, res);
         return res;
 }
+EXPORT_SYMBOL_GPL(ping_hash);
 
 static inline struct hlist_nulls_head *ping_hashslot(struct ping_table *table,
                                              struct net *net, unsigned int num)
@@ -65,7 +75,7 @@ static inline struct hlist_nulls_head *ping_hashslot(struct ping_table *table,
         return &table->hash[ping_hashfn(net, num, PING_HTABLE_MASK)];
 }
 
-static int ping_v4_get_port(struct sock *sk, unsigned short ident)
+int ping_get_port(struct sock *sk, unsigned short ident)
 {
         struct hlist_nulls_node *node;
         struct hlist_nulls_head *hlist;
@@ -103,6 +113,10 @@ next_port:
                 ping_portaddr_for_each_entry(sk2, node, hlist) {
                         isk2 = inet_sk(sk2);
 
+                        /* BUG? Why is this reuse and not reuseaddr? ping.c
+                         * doesn't turn off SO_REUSEADDR, and it doesn't expect
+                         * that other ping processes can steal its packets.
+                         */
                         if ((isk2->inet_num == ident) &&
                             (sk2 != sk) &&
                             (!sk2->sk_reuse || !sk->sk_reuse))
@@ -125,17 +139,18 @@ fail:
         write_unlock_bh(&ping_table.lock);
         return 1;
 }
+EXPORT_SYMBOL_GPL(ping_get_port);
 
-static void ping_v4_hash(struct sock *sk)
+void ping_hash(struct sock *sk)
 {
-        pr_debug("ping_v4_hash(sk->port=%u)\n", inet_sk(sk)->inet_num);
+        pr_debug("ping_hash(sk->port=%u)\n", inet_sk(sk)->inet_num);
         BUG(); /* "Please do not press this button again." */
 }
 
-static void ping_v4_unhash(struct sock *sk)
+void ping_unhash(struct sock *sk)
 {
         struct inet_sock *isk = inet_sk(sk);
-        pr_debug("ping_v4_unhash(isk=%p,isk->num=%u)\n", isk, isk->inet_num);
+        pr_debug("ping_unhash(isk=%p,isk->num=%u)\n", isk, isk->inet_num);
         if (sk_hashed(sk)) {
                 write_lock_bh(&ping_table.lock);
                 hlist_nulls_del(&sk->sk_nulls_node);
@@ -146,31 +161,61 @@ static void ping_v4_unhash(struct sock *sk)
                 write_unlock_bh(&ping_table.lock);
         }
 }
+EXPORT_SYMBOL_GPL(ping_unhash);
 
-static struct sock *ping_v4_lookup(struct net *net, __be32 saddr, __be32 daddr,
-                                   u16 ident, int dif)
+static struct sock *ping_lookup(struct net *net, struct sk_buff *skb, u16 ident)
 {
         struct hlist_nulls_head *hslot = ping_hashslot(&ping_table, net, ident);
         struct sock *sk = NULL;
         struct inet_sock *isk;
         struct hlist_nulls_node *hnode;
+        int dif = skb->dev->ifindex;
+
+        if (skb->protocol == htons(ETH_P_IP)) {
+                pr_debug("try to find: num = %d, daddr = %pI4, dif = %d\n",
+                         (int)ident, &ip_hdr(skb)->daddr, dif);
+#if IS_ENABLED(CONFIG_IPV6)
+        } else if (skb->protocol == htons(ETH_P_IPV6)) {
+                pr_debug("try to find: num = %d, daddr = %pI6c, dif = %d\n",
+                         (int)ident, &ipv6_hdr(skb)->daddr, dif);
+#endif
+        }
 
-        pr_debug("try to find: num = %d, daddr = %pI4, dif = %d\n",
-                 (int)ident, &daddr, dif);
         read_lock_bh(&ping_table.lock);
 
         ping_portaddr_for_each_entry(sk, hnode, hslot) {
                 isk = inet_sk(sk);
 
-                pr_debug("found: %p: num = %d, daddr = %pI4, dif = %d\n", sk,
-                         (int)isk->inet_num, &isk->inet_rcv_saddr,
-                         sk->sk_bound_dev_if);
-
                 pr_debug("iterate\n");
                 if (isk->inet_num != ident)
                         continue;
-                if (isk->inet_rcv_saddr && isk->inet_rcv_saddr != daddr)
-                        continue;
+
+                if (skb->protocol == htons(ETH_P_IP) &&
+                    sk->sk_family == AF_INET) {
+                        pr_debug("found: %p: num=%d, daddr=%pI4, dif=%d\n", sk,
+                                 (int) isk->inet_num, &isk->inet_rcv_saddr,
+                                 sk->sk_bound_dev_if);
+
+                        if (isk->inet_rcv_saddr &&
+                            isk->inet_rcv_saddr != ip_hdr(skb)->daddr)
+                                continue;
+#if IS_ENABLED(CONFIG_IPV6)
+                } else if (skb->protocol == htons(ETH_P_IPV6) &&
+                           sk->sk_family == AF_INET6) {
+                        struct ipv6_pinfo *np = inet6_sk(sk);
+
+                        pr_debug("found: %p: num=%d, daddr=%pI6c, dif=%d\n", sk,
+                                 (int) isk->inet_num,
+                                 &inet6_sk(sk)->rcv_saddr,
+                                 sk->sk_bound_dev_if);
+
+                        if (!ipv6_addr_any(&np->rcv_saddr) &&
+                            !ipv6_addr_equal(&np->rcv_saddr,
+                                             &ipv6_hdr(skb)->daddr))
+                                continue;
+#endif
+                }
+
                 if (sk->sk_bound_dev_if && sk->sk_bound_dev_if != dif)
                         continue;
 
@@ -200,7 +245,7 @@ static void inet_get_ping_group_range_net(struct net *net, kgid_t *low,
 }
 
 
-static int ping_init_sock(struct sock *sk)
+int ping_init_sock(struct sock *sk)
 {
         struct net *net = sock_net(sk);
         kgid_t group = current_egid();
@@ -225,8 +270,9 @@ static int ping_init_sock(struct sock *sk)
 
         return -EACCES;
 }
+EXPORT_SYMBOL_GPL(ping_init_sock);
 
-static void ping_close(struct sock *sk, long timeout)
+void ping_close(struct sock *sk, long timeout)
 {
         pr_debug("ping_close(sk=%p,sk->num=%u)\n",
                  inet_sk(sk), inet_sk(sk)->inet_num);
@@ -234,36 +280,122 @@ static void ping_close(struct sock *sk, long timeout)
 
         sk_common_release(sk);
 }
+EXPORT_SYMBOL_GPL(ping_close);
+
+/* Checks the bind address and possibly modifies sk->sk_bound_dev_if. */
+static int ping_check_bind_addr(struct sock *sk, struct inet_sock *isk,
+                                struct sockaddr *uaddr, int addr_len) {
+        struct net *net = sock_net(sk);
+        if (sk->sk_family == AF_INET) {
+                struct sockaddr_in *addr = (struct sockaddr_in *) uaddr;
+                int chk_addr_ret;
+
+                if (addr_len < sizeof(*addr))
+                        return -EINVAL;
+
+                pr_debug("ping_check_bind_addr(sk=%p,addr=%pI4,port=%d)\n",
+                         sk, &addr->sin_addr.s_addr, ntohs(addr->sin_port));
+
+                chk_addr_ret = inet_addr_type(net, addr->sin_addr.s_addr);
+
+                if (addr->sin_addr.s_addr == htonl(INADDR_ANY))
+                        chk_addr_ret = RTN_LOCAL;
+
+                if ((sysctl_ip_nonlocal_bind == 0 &&
+                    isk->freebind == 0 && isk->transparent == 0 &&
+                     chk_addr_ret != RTN_LOCAL) ||
+                    chk_addr_ret == RTN_MULTICAST ||
+                    chk_addr_ret == RTN_BROADCAST)
+                        return -EADDRNOTAVAIL;
+
+#if IS_ENABLED(CONFIG_IPV6)
+        } else if (sk->sk_family == AF_INET6) {
+                struct sockaddr_in6 *addr = (struct sockaddr_in6 *) uaddr;
+                int addr_type, scoped, has_addr;
+                struct net_device *dev = NULL;
+
+                if (addr_len < sizeof(*addr))
+                        return -EINVAL;
+
+                pr_debug("ping_check_bind_addr(sk=%p,addr=%pI6c,port=%d)\n",
+                         sk, addr->sin6_addr.s6_addr, ntohs(addr->sin6_port));
+
+                addr_type = ipv6_addr_type(&addr->sin6_addr);
+                scoped = __ipv6_addr_needs_scope_id(addr_type);
+                if ((addr_type != IPV6_ADDR_ANY &&
+                     !(addr_type & IPV6_ADDR_UNICAST)) ||
+                    (scoped && !addr->sin6_scope_id))
+                        return -EINVAL;
+
+                rcu_read_lock();
+                if (addr->sin6_scope_id) {
+                        dev = dev_get_by_index_rcu(net, addr->sin6_scope_id);
+                        if (!dev) {
+                                rcu_read_unlock();
+                                return -ENODEV;
+                        }
+                }
+                has_addr = pingv6_ops.ipv6_chk_addr(net, &addr->sin6_addr, dev,
+                                                    scoped);
+                rcu_read_unlock();
+
+                if (!(isk->freebind || isk->transparent || has_addr ||
+                      addr_type == IPV6_ADDR_ANY))
+                        return -EADDRNOTAVAIL;
+
+                if (scoped)
+                        sk->sk_bound_dev_if = addr->sin6_scope_id;
+#endif
+        } else {
+                return -EAFNOSUPPORT;
+        }
+        return 0;
+}
+
+static void ping_set_saddr(struct sock *sk, struct sockaddr *saddr)
+{
+        if (saddr->sa_family == AF_INET) {
+                struct inet_sock *isk = inet_sk(sk);
+                struct sockaddr_in *addr = (struct sockaddr_in *) saddr;
+                isk->inet_rcv_saddr = isk->inet_saddr = addr->sin_addr.s_addr;
+#if IS_ENABLED(CONFIG_IPV6)
+        } else if (saddr->sa_family == AF_INET6) {
+                struct sockaddr_in6 *addr = (struct sockaddr_in6 *) saddr;
+                struct ipv6_pinfo *np = inet6_sk(sk);
+                np->rcv_saddr = np->saddr = addr->sin6_addr;
+#endif
+        }
+}
 
+static void ping_clear_saddr(struct sock *sk, int dif)
+{
+        sk->sk_bound_dev_if = dif;
+        if (sk->sk_family == AF_INET) {
+                struct inet_sock *isk = inet_sk(sk);
+                isk->inet_rcv_saddr = isk->inet_saddr = 0;
+#if IS_ENABLED(CONFIG_IPV6)
+        } else if (sk->sk_family == AF_INET6) {
+                struct ipv6_pinfo *np = inet6_sk(sk);
+                memset(&np->rcv_saddr, 0, sizeof(np->rcv_saddr));
+                memset(&np->saddr, 0, sizeof(np->saddr));
+#endif
+        }
+}
 /*
  * We need our own bind because there are no privileged id's == local ports.
  * Moreover, we don't allow binding to multi- and broadcast addresses.
  */
 
-static int ping_bind(struct sock *sk, struct sockaddr *uaddr, int addr_len)
+int ping_bind(struct sock *sk, struct sockaddr *uaddr, int addr_len)
 {
-        struct sockaddr_in *addr = (struct sockaddr_in *)uaddr;
         struct inet_sock *isk = inet_sk(sk);
         unsigned short snum;
-        int chk_addr_ret;
         int err;
+        int dif = sk->sk_bound_dev_if;
 
-        if (addr_len < sizeof(struct sockaddr_in))
-                return -EINVAL;
-
-        pr_debug("ping_v4_bind(sk=%p,sa_addr=%08x,sa_port=%d)\n",
-                 sk, addr->sin_addr.s_addr, ntohs(addr->sin_port));
-
-        chk_addr_ret = inet_addr_type(sock_net(sk), addr->sin_addr.s_addr);
-        if (addr->sin_addr.s_addr == htonl(INADDR_ANY))
-                chk_addr_ret = RTN_LOCAL;
-
-        if ((sysctl_ip_nonlocal_bind == 0 &&
-            isk->freebind == 0 && isk->transparent == 0 &&
-             chk_addr_ret != RTN_LOCAL) ||
-            chk_addr_ret == RTN_MULTICAST ||
-            chk_addr_ret == RTN_BROADCAST)
-                return -EADDRNOTAVAIL;
+        err = ping_check_bind_addr(sk, isk, uaddr, addr_len);
+        if (err)
+                return err;
 
         lock_sock(sk);
 
@@ -272,42 +404,50 @@ static int ping_bind(struct sock *sk, struct sockaddr *uaddr, int addr_len)
                 goto out;
 
         err = -EADDRINUSE;
-        isk->inet_rcv_saddr = isk->inet_saddr = addr->sin_addr.s_addr;
-        snum = ntohs(addr->sin_port);
-        if (ping_v4_get_port(sk, snum) != 0) {
-                isk->inet_saddr = isk->inet_rcv_saddr = 0;
+        ping_set_saddr(sk, uaddr);
+        snum = ntohs(((struct sockaddr_in *)uaddr)->sin_port);
+        if (ping_get_port(sk, snum) != 0) {
+                ping_clear_saddr(sk, dif);
                 goto out;
         }
 
-        pr_debug("after bind(): num = %d, daddr = %pI4, dif = %d\n",
+        pr_debug("after bind(): num = %d, dif = %d\n",
                  (int)isk->inet_num,
-                 &isk->inet_rcv_saddr,
                  (int)sk->sk_bound_dev_if);
 
         err = 0;
-        if (isk->inet_rcv_saddr)
+        if ((sk->sk_family == AF_INET && isk->inet_rcv_saddr) ||
+            (sk->sk_family == AF_INET6 &&
+             !ipv6_addr_any(&inet6_sk(sk)->rcv_saddr)))
                 sk->sk_userlocks |= SOCK_BINDADDR_LOCK;
+
         if (snum)
                 sk->sk_userlocks |= SOCK_BINDPORT_LOCK;
         isk->inet_sport = htons(isk->inet_num);
         isk->inet_daddr = 0;
         isk->inet_dport = 0;
+
+#if IS_ENABLED(CONFIG_IPV6)
+        if (sk->sk_family == AF_INET6)
+                memset(&inet6_sk(sk)->daddr, 0, sizeof(inet6_sk(sk)->daddr));
+#endif
+
         sk_dst_reset(sk);
 out:
         release_sock(sk);
         pr_debug("ping_v4_bind -> %d\n", err);
         return err;
 }
+EXPORT_SYMBOL_GPL(ping_bind);
 
 /*
  * Is this a supported type of ICMP message?
  */
 
-static inline int ping_supported(int type, int code)
+static inline int ping_supported(int family, int type, int code)
 {
-        if (type == ICMP_ECHO && code == 0)
-                return 1;
-        return 0;
+        return (family == AF_INET && type == ICMP_ECHO && code == 0) ||
+               (family == AF_INET6 && type == ICMPV6_ECHO_REQUEST && code == 0);
 }
 
 /*
@@ -315,30 +455,42 @@ static inline int ping_supported(int type, int code)
  * sort of error condition.
  */
 
-static int ping_queue_rcv_skb(struct sock *sk, struct sk_buff *skb);
-
-void ping_err(struct sk_buff *skb, u32 info)
+void ping_err(struct sk_buff *skb, int offset, u32 info)
 {
-        struct iphdr *iph = (struct iphdr *)skb->data;
-        struct icmphdr *icmph = (struct icmphdr *)(skb->data+(iph->ihl<<2));
+        int family;
+        struct icmphdr *icmph;
         struct inet_sock *inet_sock;
-        int type = icmp_hdr(skb)->type;
-        int code = icmp_hdr(skb)->code;
+        int type;
+        int code;
         struct net *net = dev_net(skb->dev);
         struct sock *sk;
         int harderr;
         int err;
 
+        if (skb->protocol == htons(ETH_P_IP)) {
+                family = AF_INET;
+                type = icmp_hdr(skb)->type;
+                code = icmp_hdr(skb)->code;
+                icmph = (struct icmphdr *)(skb->data + offset);
+        } else if (skb->protocol == htons(ETH_P_IPV6)) {
+                family = AF_INET6;
+                type = icmp6_hdr(skb)->icmp6_type;
+                code = icmp6_hdr(skb)->icmp6_code;
+                icmph = (struct icmphdr *) (skb->data + offset);
+        } else {
+                BUG();
+        }
+
         /* We assume the packet has already been checked by icmp_unreach */
 
-        if (!ping_supported(icmph->type, icmph->code))
+        if (!ping_supported(family, icmph->type, icmph->code))
                 return;
 
-        pr_debug("ping_err(type=%04x,code=%04x,id=%04x,seq=%04x)\n", type,
-                 code, ntohs(icmph->un.echo.id), ntohs(icmph->un.echo.sequence));
+        pr_debug("ping_err(proto=0x%x,type=%d,code=%d,id=%04x,seq=%04x)\n",
+                 skb->protocol, type, code, ntohs(icmph->un.echo.id),
+                 ntohs(icmph->un.echo.sequence));
 
-        sk = ping_v4_lookup(net, iph->daddr, iph->saddr,
-                            ntohs(icmph->un.echo.id), skb->dev->ifindex);
+        sk = ping_lookup(net, skb, ntohs(icmph->un.echo.id));
         if (sk == NULL) {
                 pr_debug("no socket, dropping\n");
                 return; /* No socket for error */
@@ -349,72 +501,83 @@ void ping_err(struct sk_buff *skb, u32 info)
         harderr = 0;
         inet_sock = inet_sk(sk);
 
-        switch (type) {
-        default:
-        case ICMP_TIME_EXCEEDED:
-                err = EHOSTUNREACH;
-                break;
-        case ICMP_SOURCE_QUENCH:
-                /* This is not a real error but ping wants to see it.
-                 * Report it with some fake errno. */
-                err = EREMOTEIO;
-                break;
-        case ICMP_PARAMETERPROB:
-                err = EPROTO;
-                harderr = 1;
-                break;
-        case ICMP_DEST_UNREACH:
-                if (code == ICMP_FRAG_NEEDED) { /* Path MTU discovery */
-                        ipv4_sk_update_pmtu(skb, sk, info);
-                        if (inet_sock->pmtudisc != IP_PMTUDISC_DONT) {
-                                err = EMSGSIZE;
-                                harderr = 1;
-                                break;
+        if (skb->protocol == htons(ETH_P_IP)) {
+                switch (type) {
+                default:
+                case ICMP_TIME_EXCEEDED:
+                        err = EHOSTUNREACH;
+                        break;
+                case ICMP_SOURCE_QUENCH:
+                        /* This is not a real error but ping wants to see it.
+                         * Report it with some fake errno.
+                         */
+                        err = EREMOTEIO;
+                        break;
+                case ICMP_PARAMETERPROB:
+                        err = EPROTO;
+                        harderr = 1;
+                        break;
+                case ICMP_DEST_UNREACH:
+                        if (code == ICMP_FRAG_NEEDED) { /* Path MTU discovery */
+                                ipv4_sk_update_pmtu(skb, sk, info);
+                                if (inet_sock->pmtudisc != IP_PMTUDISC_DONT) {
+                                        err = EMSGSIZE;
+                                        harderr = 1;
+                                        break;
+                                }
+                                goto out;
                         }
-                        goto out;
-                }
-                err = EHOSTUNREACH;
-                if (code <= NR_ICMP_UNREACH) {
-                        harderr = icmp_err_convert[code].fatal;
-                        err = icmp_err_convert[code].errno;
+                        err = EHOSTUNREACH;
+                        if (code <= NR_ICMP_UNREACH) {
+                                harderr = icmp_err_convert[code].fatal;
+                                err = icmp_err_convert[code].errno;
+                        }
+                        break;
+                case ICMP_REDIRECT:
+                        /* See ICMP_SOURCE_QUENCH */
+                        ipv4_sk_redirect(skb, sk);
+                        err = EREMOTEIO;
+                        break;
                 }
-                break;
-        case ICMP_REDIRECT:
-                /* See ICMP_SOURCE_QUENCH */
-                ipv4_sk_redirect(skb, sk);
-                err = EREMOTEIO;
-                break;
+#if IS_ENABLED(CONFIG_IPV6)
+        } else if (skb->protocol == htons(ETH_P_IPV6)) {
+                harderr = pingv6_ops.icmpv6_err_convert(type, code, &err);
+#endif
         }
 
         /*
          *      RFC1122: OK.  Passes ICMP errors back to application, as per
          *      4.1.3.3.
          */
-        if (!inet_sock->recverr) {
+        if ((family == AF_INET && !inet_sock->recverr) ||
+            (family == AF_INET6 && !inet6_sk(sk)->recverr)) {
                 if (!harderr || sk->sk_state != TCP_ESTABLISHED)
                         goto out;
         } else {
-                ip_icmp_error(sk, skb, err, 0 /* no remote port */,
-                         info, (u8 *)icmph);
+                if (family == AF_INET) {
+                        ip_icmp_error(sk, skb, err, 0 /* no remote port */,
+                                      info, (u8 *)icmph);
+#if IS_ENABLED(CONFIG_IPV6)
+                } else if (family == AF_INET6) {
+                        pingv6_ops.ipv6_icmp_error(sk, skb, err, 0,
+                                                   info, (u8 *)icmph);
+#endif
+                }
         }
         sk->sk_err = err;
         sk->sk_error_report(sk);
 out:
         sock_put(sk);
 }
+EXPORT_SYMBOL_GPL(ping_err);
 
 /*
- *      Copy and checksum an ICMP Echo packet from user space into a buffer.
+ *      Copy and checksum an ICMP Echo packet from user space into a buffer
+ *      starting from the payload.
  */
 
-struct pingfakehdr {
-        struct icmphdr icmph;
-        struct iovec *iov;
-        __wsum wcheck;
-};
-
-static int ping_getfrag(void *from, char *to,
-                        int offset, int fraglen, int odd, struct sk_buff *skb)
+int ping_getfrag(void *from, char *to,
+                 int offset, int fraglen, int odd, struct sk_buff *skb)
 {
         struct pingfakehdr *pfh = (struct pingfakehdr *)from;
 
@@ -425,20 +588,33 @@ static int ping_getfrag(void *from, char *to,
                             pfh->iov, 0, fraglen - sizeof(struct icmphdr),
                             &pfh->wcheck))
                         return -EFAULT;
+        } else if (offset < sizeof(struct icmphdr)) {
+                        BUG();
+        } else {
+                if (csum_partial_copy_fromiovecend
+                                (to, pfh->iov, offset - sizeof(struct icmphdr),
+                                 fraglen, &pfh->wcheck))
+                        return -EFAULT;
+        }
 
-                return 0;
+#if IS_ENABLED(CONFIG_IPV6)
+        /* For IPv6, checksum each skb as we go along, as expected by
+         * icmpv6_push_pending_frames. For IPv4, accumulate the checksum in
+         * wcheck, it will be finalized in ping_v4_push_pending_frames.
+         */
+        if (pfh->family == AF_INET6) {
+                skb->csum = pfh->wcheck;
+                skb->ip_summed = CHECKSUM_NONE;
+                pfh->wcheck = 0;
         }
-        if (offset < sizeof(struct icmphdr))
-                BUG();
-        if (csum_partial_copy_fromiovecend
-                        (to, pfh->iov, offset - sizeof(struct icmphdr),
-                         fraglen, &pfh->wcheck))
-                return -EFAULT;
+#endif
+
         return 0;
 }
+EXPORT_SYMBOL_GPL(ping_getfrag);
 
-static int ping_push_pending_frames(struct sock *sk, struct pingfakehdr *pfh,
-                                    struct flowi4 *fl4)
+static int ping_v4_push_pending_frames(struct sock *sk, struct pingfakehdr *pfh,
+                                       struct flowi4 *fl4)
 {
         struct sk_buff *skb = skb_peek(&sk->sk_write_queue);
 
@@ -450,24 +626,9 @@ static int ping_push_pending_frames(struct sock *sk, struct pingfakehdr *pfh,
         return ip_push_pending_frames(sk, fl4);
 }
 
-static int ping_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
-                        size_t len)
-{
-        struct net *net = sock_net(sk);
-        struct flowi4 fl4;
-        struct inet_sock *inet = inet_sk(sk);
-        struct ipcm_cookie ipc;
-        struct icmphdr user_icmph;
-        struct pingfakehdr pfh;
-        struct rtable *rt = NULL;
-        struct ip_options_data opt_copy;
-        int free = 0;
-        __be32 saddr, daddr, faddr;
-        u8  tos;
-        int err;
-
-        pr_debug("ping_sendmsg(sk=%p,sk->num=%u)\n", inet, inet->inet_num);
-
+int ping_common_sendmsg(int family, struct msghdr *msg, size_t len,
+                        void *user_icmph, size_t icmph_len) {
+        u8 type, code;
 
         if (len > 0xFFFF)
                 return -EMSGSIZE;
@@ -482,15 +643,53 @@ static int ping_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
 
         /*
          *      Fetch the ICMP header provided by the userland.
-         *      iovec is modified!
+         *      iovec is modified! The ICMP header is consumed.
          */
-
-        if (memcpy_fromiovec((u8 *)&user_icmph, msg->msg_iov,
-                             sizeof(struct icmphdr)))
+        if (memcpy_fromiovec(user_icmph, msg->msg_iov, icmph_len))
                 return -EFAULT;
-        if (!ping_supported(user_icmph.type, user_icmph.code))
+
+        if (family == AF_INET) {
+                type = ((struct icmphdr *) user_icmph)->type;
+                code = ((struct icmphdr *) user_icmph)->code;
+#if IS_ENABLED(CONFIG_IPV6)
+        } else if (family == AF_INET6) {
+                type = ((struct icmp6hdr *) user_icmph)->icmp6_type;
+                code = ((struct icmp6hdr *) user_icmph)->icmp6_code;
+#endif
+        } else {
+                BUG();
+        }
+
+        if (!ping_supported(family, type, code))
                 return -EINVAL;
 
+        return 0;
+}
+EXPORT_SYMBOL_GPL(ping_common_sendmsg);
+
+int ping_v4_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
+                    size_t len)
+{
+        struct net *net = sock_net(sk);
+        struct flowi4 fl4;
+        struct inet_sock *inet = inet_sk(sk);
+        struct ipcm_cookie ipc;
+        struct icmphdr user_icmph;
+        struct pingfakehdr pfh;
+        struct rtable *rt = NULL;
+        struct ip_options_data opt_copy;
+        int free = 0;
+        __be32 saddr, daddr, faddr;
+        u8  tos;
+        int err;
+
+        pr_debug("ping_v4_sendmsg(sk=%p,sk->num=%u)\n", inet, inet->inet_num);
+
+        err = ping_common_sendmsg(AF_INET, msg, len, &user_icmph,
+                                  sizeof(user_icmph));
+        if (err)
+                return err;
+
         /*
          *      Get and verify the address.
          */
@@ -595,13 +794,14 @@ back_from_confirm:
         pfh.icmph.un.echo.sequence = user_icmph.un.echo.sequence;
         pfh.iov = msg->msg_iov;
         pfh.wcheck = 0;
+        pfh.family = AF_INET;
 
         err = ip_append_data(sk, &fl4, ping_getfrag, &pfh, len,
                         0, &ipc, &rt, msg->msg_flags);
         if (err)
                 ip_flush_pending_frames(sk);
         else
-                err = ping_push_pending_frames(sk, &pfh, &fl4);
+                err = ping_v4_push_pending_frames(sk, &pfh, &fl4);
         release_sock(sk);
 
 out:
@@ -622,11 +822,13 @@ do_confirm:
         goto out;
 }
 
-static int ping_recvmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
-                        size_t len, int noblock, int flags, int *addr_len)
+int ping_recvmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
+                 size_t len, int noblock, int flags, int *addr_len)
 {
         struct inet_sock *isk = inet_sk(sk);
-        struct sockaddr_in *sin = (struct sockaddr_in *)msg->msg_name;
+        int family = sk->sk_family;
+        struct sockaddr_in *sin;
+        struct sockaddr_in6 *sin6;
         struct sk_buff *skb;
         int copied, err;
 
@@ -636,11 +838,22 @@ static int ping_recvmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
         if (flags & MSG_OOB)
                 goto out;
 
-        if (addr_len)
-                *addr_len = sizeof(*sin);
+        if (addr_len) {
+                if (family == AF_INET)
+                        *addr_len = sizeof(*sin);
+                else if (family == AF_INET6 && addr_len)
+                        *addr_len = sizeof(*sin6);
+        }
 
-        if (flags & MSG_ERRQUEUE)
-                return ip_recv_error(sk, msg, len);
+        if (flags & MSG_ERRQUEUE) {
+                if (family == AF_INET) {
+                        return ip_recv_error(sk, msg, len);
+#if IS_ENABLED(CONFIG_IPV6)
+                } else if (family == AF_INET6) {
+                        return pingv6_ops.ipv6_recv_error(sk, msg, len);
+#endif
+                }
+        }
 
         skb = skb_recv_datagram(sk, flags, noblock, &err);
         if (!skb)
@@ -659,15 +872,40 @@ static int ping_recvmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
 
         sock_recv_timestamp(msg, sk, skb);
 
-        /* Copy the address. */
-        if (sin) {
+        /* Copy the address and add cmsg data. */
+        if (family == AF_INET) {
+                sin = (struct sockaddr_in *) msg->msg_name;
                 sin->sin_family = AF_INET;
                 sin->sin_port = 0 /* skb->h.uh->source */;
                 sin->sin_addr.s_addr = ip_hdr(skb)->saddr;
                 memset(sin->sin_zero, 0, sizeof(sin->sin_zero));
+
+                if (isk->cmsg_flags)
+                        ip_cmsg_recv(msg, skb);
+
+#if IS_ENABLED(CONFIG_IPV6)
+        } else if (family == AF_INET6) {
+                struct ipv6_pinfo *np = inet6_sk(sk);
+                struct ipv6hdr *ip6 = ipv6_hdr(skb);
+                sin6 = (struct sockaddr_in6 *) msg->msg_name;
+                sin6->sin6_family = AF_INET6;
+                sin6->sin6_port = 0;
+                sin6->sin6_addr = ip6->saddr;
+
+                sin6->sin6_flowinfo = 0;
+                if (np->sndflow)
+                        sin6->sin6_flowinfo = ip6_flowinfo(ip6);
+
+                sin6->sin6_scope_id = ipv6_iface_scope_id(&sin6->sin6_addr,
+                                                          IP6CB(skb)->iif);
+
+                if (inet6_sk(sk)->rxopt.all)
+                        pingv6_ops.ip6_datagram_recv_ctl(sk, msg, skb);
+#endif
+        } else {
+                BUG();
         }
-        if (isk->cmsg_flags)
-                ip_cmsg_recv(msg, skb);
+
         err = copied;
 
 done:
@@ -676,8 +914,9 @@ out:
         pr_debug("ping_recvmsg -> %d\n", err);
         return err;
 }
+EXPORT_SYMBOL_GPL(ping_recvmsg);
 
-static int ping_queue_rcv_skb(struct sock *sk, struct sk_buff *skb)
+int ping_queue_rcv_skb(struct sock *sk, struct sk_buff *skb)
 {
         pr_debug("ping_queue_rcv_skb(sk=%p,sk->num=%d,skb=%p)\n",
                  inet_sk(sk), inet_sk(sk)->inet_num, skb);
@@ -688,6 +927,7 @@ static int ping_queue_rcv_skb(struct sock *sk, struct sk_buff *skb)
         }
         return 0;
 }
+EXPORT_SYMBOL_GPL(ping_queue_rcv_skb);
 
 
 /*
@@ -698,10 +938,7 @@ void ping_rcv(struct sk_buff *skb)
 {
         struct sock *sk;
         struct net *net = dev_net(skb->dev);
-        struct iphdr *iph = ip_hdr(skb);
         struct icmphdr *icmph = icmp_hdr(skb);
-        __be32 saddr = iph->saddr;
-        __be32 daddr = iph->daddr;
 
         /* We assume the packet has already been checked by icmp_rcv */
 
@@ -711,8 +948,7 @@ void ping_rcv(struct sk_buff *skb)
         /* Push ICMP header back */
         skb_push(skb, skb->data - (u8 *)icmph);
 
-        sk = ping_v4_lookup(net, saddr, daddr, ntohs(icmph->un.echo.id),
-                            skb->dev->ifindex);
+        sk = ping_lookup(net, skb, ntohs(icmph->un.echo.id));
         if (sk != NULL) {
                 pr_debug("rcv on socket %p\n", sk);
                 ping_queue_rcv_skb(sk, skb_get(skb));
@@ -723,6 +959,7 @@ void ping_rcv(struct sk_buff *skb)
 
         /* We're called from icmp_rcv(). kfree_skb() is done there. */
 }
+EXPORT_SYMBOL_GPL(ping_rcv);
 
 struct proto ping_prot = {
         .name =         "PING",
@@ -733,14 +970,14 @@ struct proto ping_prot = {
         .disconnect =   udp_disconnect,
         .setsockopt =   ip_setsockopt,
         .getsockopt =   ip_getsockopt,
-        .sendmsg =      ping_sendmsg,
+        .sendmsg =      ping_v4_sendmsg,
         .recvmsg =      ping_recvmsg,
         .bind =         ping_bind,
         .backlog_rcv =  ping_queue_rcv_skb,
         .release_cb =   ip4_datagram_release_cb,
-        .hash =         ping_v4_hash,
-        .unhash =       ping_v4_unhash,
-        .get_port =     ping_v4_get_port,
+        .hash =         ping_hash,
+        .unhash =       ping_unhash,
+        .get_port =     ping_get_port,
         .obj_size =     sizeof(struct inet_sock),
 };
 EXPORT_SYMBOL(ping_prot);
@@ -764,7 +1001,8 @@ static struct sock *ping_get_first(struct seq_file *seq, int start)
                         continue;
 
                 sk_nulls_for_each(sk, node, hslot) {
-                        if (net_eq(sock_net(sk), net))
+                        if (net_eq(sock_net(sk), net) &&
+                            sk->sk_family == state->family)
                                 goto found;
                 }
         }
@@ -797,17 +1035,24 @@ static struct sock *ping_get_idx(struct seq_file *seq, loff_t pos)
         return pos ? NULL : sk;
 }
 
-static void *ping_seq_start(struct seq_file *seq, loff_t *pos)
+void *ping_seq_start(struct seq_file *seq, loff_t *pos, sa_family_t family)
 {
         struct ping_iter_state *state = seq->private;
         state->bucket = 0;
+        state->family = family;
 
         read_lock_bh(&ping_table.lock);
 
         return *pos ? ping_get_idx(seq, *pos-1) : SEQ_START_TOKEN;
 }
+EXPORT_SYMBOL_GPL(ping_seq_start);
+
+static void *ping_v4_seq_start(struct seq_file *seq, loff_t *pos)
+{
+        return ping_seq_start(seq, pos, AF_INET);
+}
 
-static void *ping_seq_next(struct seq_file *seq, void *v, loff_t *pos)
+void *ping_seq_next(struct seq_file *seq, void *v, loff_t *pos)
 {
         struct sock *sk;
 
@@ -819,13 +1064,15 @@ static void *ping_seq_next(struct seq_file *seq, void *v, loff_t *pos)
         ++*pos;
         return sk;
 }
+EXPORT_SYMBOL_GPL(ping_seq_next);
 
-static void ping_seq_stop(struct seq_file *seq, void *v)
+void ping_seq_stop(struct seq_file *seq, void *v)
 {
         read_unlock_bh(&ping_table.lock);
 }
+EXPORT_SYMBOL_GPL(ping_seq_stop);
 
-static void ping_format_sock(struct sock *sp, struct seq_file *f,
+static void ping_v4_format_sock(struct sock *sp, struct seq_file *f,
                 int bucket, int *len)
 {
         struct inet_sock *inet = inet_sk(sp);
@@ -835,7 +1082,7 @@ static void ping_format_sock(struct sock *sp, struct seq_file *f,
         __u16 srcp = ntohs(inet->inet_sport);
 
         seq_printf(f, "%5d: %08X:%04X %08X:%04X"
-                " %02X %08X:%08X %02X:%08lX %08X %5d %8d %lu %d %pK %d%n",
+                " %02X %08X:%08X %02X:%08lX %08X %5u %8d %lu %d %pK %d%n",
                 bucket, src, srcp, dest, destp, sp->sk_state,
                 sk_wmem_alloc_get(sp),
                 sk_rmem_alloc_get(sp),
@@ -846,7 +1093,7 @@ static void ping_format_sock(struct sock *sp, struct seq_file *f,
                 atomic_read(&sp->sk_drops), len);
 }
 
-static int ping_seq_show(struct seq_file *seq, void *v)
+static int ping_v4_seq_show(struct seq_file *seq, void *v)
 {
         if (v == SEQ_START_TOKEN)
                 seq_printf(seq, "%-127s\n",
@@ -857,72 +1104,86 @@ static int ping_seq_show(struct seq_file *seq, void *v)
                 struct ping_iter_state *state = seq->private;
                 int len;
 
-                ping_format_sock(v, seq, state->bucket, &len);
+                ping_v4_format_sock(v, seq, state->bucket, &len);
                 seq_printf(seq, "%*s\n", 127 - len, "");
         }
         return 0;
 }
 
-static const struct seq_operations ping_seq_ops = {
-        .show           = ping_seq_show,
-        .start          = ping_seq_start,
+static const struct seq_operations ping_v4_seq_ops = {
+        .show           = ping_v4_seq_show,
+        .start          = ping_v4_seq_start,
         .next           = ping_seq_next,
         .stop           = ping_seq_stop,
 };
 
 static int ping_seq_open(struct inode *inode, struct file *file)
 {
-        return seq_open_net(inode, file, &ping_seq_ops,
+        struct ping_seq_afinfo *afinfo = PDE_DATA(inode);
+        return seq_open_net(inode, file, &afinfo->seq_ops,
                            sizeof(struct ping_iter_state));
 }
 
-static const struct file_operations ping_seq_fops = {
+const struct file_operations ping_seq_fops = {
         .open           = ping_seq_open,
         .read           = seq_read,
         .llseek         = seq_lseek,
         .release        = seq_release_net,
 };
+EXPORT_SYMBOL_GPL(ping_seq_fops);
+
+static struct ping_seq_afinfo ping_v4_seq_afinfo = {
+        .name           = "icmp",
+        .family         = AF_INET,
+        .seq_fops       = &ping_seq_fops,
+        .seq_ops        = {
+                .start          = ping_v4_seq_start,
+                .show           = ping_v4_seq_show,
+                .next           = ping_seq_next,
+                .stop           = ping_seq_stop,
+        },
+};
 
-static int ping_proc_register(struct net *net)
+int ping_proc_register(struct net *net, struct ping_seq_afinfo *afinfo)
 {
         struct proc_dir_entry *p;
-        int rc = 0;
-
-        p = proc_create("icmp", S_IRUGO, net->proc_net, &ping_seq_fops);
+        p = proc_create_data(afinfo->name, S_IRUGO, net->proc_net,
+                             afinfo->seq_fops, afinfo);
         if (!p)
-                rc = -ENOMEM;
-        return rc;
+                return -ENOMEM;
+        return 0;
 }
+EXPORT_SYMBOL_GPL(ping_proc_register);
 
-static void ping_proc_unregister(struct net *net)
+void ping_proc_unregister(struct net *net, struct ping_seq_afinfo *afinfo)
 {
-        remove_proc_entry("icmp", net->proc_net);
+        remove_proc_entry(afinfo->name, net->proc_net);
 }
+EXPORT_SYMBOL_GPL(ping_proc_unregister);
 
-
-static int __net_init ping_proc_init_net(struct net *net)
+static int __net_init ping_v4_proc_init_net(struct net *net)
 {
-        return ping_proc_register(net);
+        return ping_proc_register(net, &ping_v4_seq_afinfo);
 }
 
-static void __net_exit ping_proc_exit_net(struct net *net)
+static void __net_exit ping_v4_proc_exit_net(struct net *net)
 {
-        ping_proc_unregister(net);
+        ping_proc_unregister(net, &ping_v4_seq_afinfo);
 }
 
-static struct pernet_operations ping_net_ops = {
-        .init = ping_proc_init_net,
-        .exit = ping_proc_exit_net,
+static struct pernet_operations ping_v4_net_ops = {
+        .init = ping_v4_proc_init_net,
+        .exit = ping_v4_proc_exit_net,
 };
 
 int __init ping_proc_init(void)
 {
-        return register_pernet_subsys(&ping_net_ops);
+        return register_pernet_subsys(&ping_v4_net_ops);
 }
 
 void ping_proc_exit(void)
 {
-        unregister_pernet_subsys(&ping_net_ops);
+        unregister_pernet_subsys(&ping_v4_net_ops);
 }
 
 #endif
diff --git a/net/ipv4/proc.c b/net/ipv4/proc.c
index 2a5bf86d2415..4a0335854b89 100644
--- a/net/ipv4/proc.c
+++ b/net/ipv4/proc.c
@@ -111,7 +111,7 @@ static const struct snmp_mib snmp4_ipstats_list[] = {
         SNMP_MIB_SENTINEL
 };
 
-/* Following RFC4293 items are displayed in /proc/net/netstat */
+/* Following items are displayed in /proc/net/netstat */
 static const struct snmp_mib snmp4_ipextstats_list[] = {
         SNMP_MIB_ITEM("InNoRoutes", IPSTATS_MIB_INNOROUTES),
         SNMP_MIB_ITEM("InTruncatedPkts", IPSTATS_MIB_INTRUNCATEDPKTS),
@@ -125,7 +125,12 @@ static const struct snmp_mib snmp4_ipextstats_list[] = {
         SNMP_MIB_ITEM("OutMcastOctets", IPSTATS_MIB_OUTMCASTOCTETS),
         SNMP_MIB_ITEM("InBcastOctets", IPSTATS_MIB_INBCASTOCTETS),
         SNMP_MIB_ITEM("OutBcastOctets", IPSTATS_MIB_OUTBCASTOCTETS),
+        /* Non RFC4293 fields */
         SNMP_MIB_ITEM("InCsumErrors", IPSTATS_MIB_CSUMERRORS),
+        SNMP_MIB_ITEM("InNoECTPkts", IPSTATS_MIB_NOECTPKTS),
+        SNMP_MIB_ITEM("InECT1Pkts", IPSTATS_MIB_ECT1PKTS),
+        SNMP_MIB_ITEM("InECT0Pkts", IPSTATS_MIB_ECT0PKTS),
+        SNMP_MIB_ITEM("InCEPkts", IPSTATS_MIB_CEPKTS),
         SNMP_MIB_SENTINEL
 };
 
@@ -273,6 +278,7 @@ static const struct snmp_mib snmp4_net_list[] = {
         SNMP_MIB_ITEM("TCPFastOpenListenOverflow", LINUX_MIB_TCPFASTOPENLISTENOVERFLOW),
         SNMP_MIB_ITEM("TCPFastOpenCookieReqd", LINUX_MIB_TCPFASTOPENCOOKIEREQD),
         SNMP_MIB_ITEM("TCPSpuriousRtxHostQueues", LINUX_MIB_TCPSPURIOUS_RTX_HOSTQUEUES),
+        SNMP_MIB_ITEM("BusyPollRxPackets", LINUX_MIB_BUSYPOLLRXPACKETS),
         SNMP_MIB_SENTINEL
 };
 
diff --git a/net/ipv4/raw.c b/net/ipv4/raw.c
index dd44e0ab600c..193db03540ad 100644
--- a/net/ipv4/raw.c
+++ b/net/ipv4/raw.c
@@ -218,8 +218,10 @@ static void raw_err(struct sock *sk, struct sk_buff *skb, u32 info)
 
         if (type == ICMP_DEST_UNREACH && code == ICMP_FRAG_NEEDED)
                 ipv4_sk_update_pmtu(skb, sk, info);
-        else if (type == ICMP_REDIRECT)
+        else if (type == ICMP_REDIRECT) {
                 ipv4_sk_redirect(skb, sk);
+                return;
+        }
 
         /* Report error on raw socket, if:
            1. User requested ip_recverr.
@@ -387,7 +389,7 @@ static int raw_send_hdrinc(struct sock *sk, struct flowi4 *fl4,
                 iph->check   = 0;
                 iph->tot_len = htons(length);
                 if (!iph->id)
-                        ip_select_ident(iph, &rt->dst, NULL);
+                        ip_select_ident(skb, &rt->dst, NULL);
 
                 iph->check = ip_fast_csum((unsigned char *)iph, iph->ihl);
         }
@@ -571,7 +573,8 @@ static int raw_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
         flowi4_init_output(&fl4, ipc.oif, sk->sk_mark, tos,
                            RT_SCOPE_UNIVERSE,
                            inet->hdrincl ? IPPROTO_RAW : sk->sk_protocol,
-                           inet_sk_flowi_flags(sk) | FLOWI_FLAG_CAN_SLEEP,
+                           inet_sk_flowi_flags(sk) | FLOWI_FLAG_CAN_SLEEP |
+                            (inet->hdrincl ? FLOWI_FLAG_KNOWN_NH : 0),
                            daddr, saddr, 0, 0);
 
         if (!inet->hdrincl) {
@@ -987,7 +990,7 @@ static void raw_sock_seq_show(struct seq_file *seq, struct sock *sp, int i)
               srcp  = inet->inet_num;
 
         seq_printf(seq, "%4d: %08X:%04X %08X:%04X"
-                " %02X %08X:%08X %02X:%08lX %08X %5d %8d %lu %d %pK %d\n",
+                " %02X %08X:%08X %02X:%08lX %08X %5u %8d %lu %d %pK %d\n",
                 i, src, srcp, dest, destp, sp->sk_state,
                 sk_wmem_alloc_get(sp),
                 sk_rmem_alloc_get(sp),
diff --git a/net/ipv4/route.c b/net/ipv4/route.c
index d35bbf0cf404..727f4365bcdf 100644
--- a/net/ipv4/route.c
+++ b/net/ipv4/route.c
@@ -112,7 +112,8 @@
 #define RT_FL_TOS(oldflp4) \
         ((oldflp4)->flowi4_tos & (IPTOS_RT_MASK | RTO_ONLINK))
 
-#define IP_MAX_MTU      0xFFF0
+/* IPv4 datagram length is stored into 16bit field (tot_len) */
+#define IP_MAX_MTU      0xFFFF
 
 #define RT_GC_TIMEOUT (300*HZ)
 
@@ -435,12 +436,12 @@ static inline int ip_rt_proc_init(void)
 
 static inline bool rt_is_expired(const struct rtable *rth)
 {
-        return rth->rt_genid != rt_genid(dev_net(rth->dst.dev));
+        return rth->rt_genid != rt_genid_ipv4(dev_net(rth->dst.dev));
 }
 
 void rt_cache_flush(struct net *net)
 {
-        rt_genid_bump(net);
+        rt_genid_bump_ipv4(net);
 }
 
 static struct neighbour *ipv4_neigh_lookup(const struct dst_entry *dst,
@@ -565,10 +566,25 @@ static inline void rt_free(struct rtable *rt)
 
 static DEFINE_SPINLOCK(fnhe_lock);
 
+static void fnhe_flush_routes(struct fib_nh_exception *fnhe)
+{
+        struct rtable *rt;
+
+        rt = rcu_dereference(fnhe->fnhe_rth_input);
+        if (rt) {
+                RCU_INIT_POINTER(fnhe->fnhe_rth_input, NULL);
+                rt_free(rt);
+        }
+        rt = rcu_dereference(fnhe->fnhe_rth_output);
+        if (rt) {
+                RCU_INIT_POINTER(fnhe->fnhe_rth_output, NULL);
+                rt_free(rt);
+        }
+}
+
 static struct fib_nh_exception *fnhe_oldest(struct fnhe_hash_bucket *hash)
 {
         struct fib_nh_exception *fnhe, *oldest;
-        struct rtable *orig;
 
         oldest = rcu_dereference(hash->chain);
         for (fnhe = rcu_dereference(oldest->fnhe_next); fnhe;
@@ -576,11 +592,7 @@ static struct fib_nh_exception *fnhe_oldest(struct fnhe_hash_bucket *hash)
                 if (time_before(fnhe->fnhe_stamp, oldest->fnhe_stamp))
                         oldest = fnhe;
         }
-        orig = rcu_dereference(oldest->fnhe_rth);
-        if (orig) {
-                RCU_INIT_POINTER(oldest->fnhe_rth, NULL);
-                rt_free(orig);
-        }
+        fnhe_flush_routes(oldest);
         return oldest;
 }
 
@@ -594,11 +606,25 @@ static inline u32 fnhe_hashfun(__be32 daddr)
         return hval & (FNHE_HASH_SIZE - 1);
 }
 
+static void fill_route_from_fnhe(struct rtable *rt, struct fib_nh_exception *fnhe)
+{
+        rt->rt_pmtu = fnhe->fnhe_pmtu;
+        rt->dst.expires = fnhe->fnhe_expires;
+
+        if (fnhe->fnhe_gw) {
+                rt->rt_flags |= RTCF_REDIRECTED;
+                rt->rt_gateway = fnhe->fnhe_gw;
+                rt->rt_uses_gateway = 1;
+        }
+}
+
 static void update_or_create_fnhe(struct fib_nh *nh, __be32 daddr, __be32 gw,
                                   u32 pmtu, unsigned long expires)
 {
         struct fnhe_hash_bucket *hash;
         struct fib_nh_exception *fnhe;
+        struct rtable *rt;
+        unsigned int i;
         int depth;
         u32 hval = fnhe_hashfun(daddr);
 
@@ -627,8 +653,15 @@ static void update_or_create_fnhe(struct fib_nh *nh, __be32 daddr, __be32 gw,
                         fnhe->fnhe_gw = gw;
                 if (pmtu) {
                         fnhe->fnhe_pmtu = pmtu;
-                        fnhe->fnhe_expires = expires;
+                        fnhe->fnhe_expires = max(1UL, expires);
                 }
+                /* Update all cached dsts too */
+                rt = rcu_dereference(fnhe->fnhe_rth_input);
+                if (rt)
+                        fill_route_from_fnhe(rt, fnhe);
+                rt = rcu_dereference(fnhe->fnhe_rth_output);
+                if (rt)
+                        fill_route_from_fnhe(rt, fnhe);
         } else {
                 if (depth > FNHE_RECLAIM_DEPTH)
                         fnhe = fnhe_oldest(hash);
@@ -640,10 +673,27 @@ static void update_or_create_fnhe(struct fib_nh *nh, __be32 daddr, __be32 gw,
                         fnhe->fnhe_next = hash->chain;
                         rcu_assign_pointer(hash->chain, fnhe);
                 }
+                fnhe->fnhe_genid = fnhe_genid(dev_net(nh->nh_dev));
                 fnhe->fnhe_daddr = daddr;
                 fnhe->fnhe_gw = gw;
                 fnhe->fnhe_pmtu = pmtu;
                 fnhe->fnhe_expires = expires;
+
+                /* Exception created; mark the cached routes for the nexthop
+                 * stale, so anyone caching it rechecks if this exception
+                 * applies to them.
+                 */
+                rt = rcu_dereference(nh->nh_rth_input);
+                if (rt)
+                        rt->dst.obsolete = DST_OBSOLETE_KILL;
+
+                for_each_possible_cpu(i) {
+                        struct rtable __rcu **prt;
+                        prt = per_cpu_ptr(nh->nh_pcpu_rth_output, i);
+                        rt = rcu_dereference(*prt);
+                        if (rt)
+                                rt->dst.obsolete = DST_OBSOLETE_KILL;
+                }
         }
 
         fnhe->fnhe_stamp = jiffies;
@@ -922,12 +972,9 @@ static void __ip_rt_update_pmtu(struct rtable *rt, struct flowi4 *fl4, u32 mtu)
         if (mtu < ip_rt_min_pmtu)
                 mtu = ip_rt_min_pmtu;
 
-        if (!rt->rt_pmtu) {
-                dst->obsolete = DST_OBSOLETE_KILL;
-        } else {
-                rt->rt_pmtu = mtu;
-                dst->expires = max(1UL, jiffies + ip_rt_mtu_expires);
-        }
+        if (rt->rt_pmtu == mtu &&
+            time_before(jiffies, dst->expires - ip_rt_mtu_expires / 2))
+                return;
 
         rcu_read_lock();
         if (fib_lookup(dev_net(dst->dev), fl4, &res) == 0) {
@@ -1068,11 +1115,11 @@ static struct dst_entry *ipv4_dst_check(struct dst_entry *dst, u32 cookie)
          * DST_OBSOLETE_FORCE_CHK which forces validation calls down
          * into this function always.
          *
-         * When a PMTU/redirect information update invalidates a
-         * route, this is indicated by setting obsolete to
-         * DST_OBSOLETE_KILL.
+         * When a PMTU/redirect information update invalidates a route,
+         * this is indicated by setting obsolete to DST_OBSOLETE_KILL or
+         * DST_OBSOLETE_DEAD by dst_free().
          */
-        if (dst->obsolete == DST_OBSOLETE_KILL || rt_is_expired(rt))
+        if (dst->obsolete != DST_OBSOLETE_FORCE_CHK || rt_is_expired(rt))
                 return NULL;
         return dst;
 }
@@ -1181,10 +1228,7 @@ static unsigned int ipv4_mtu(const struct dst_entry *dst)
                         mtu = 576;
         }
 
-        if (mtu > IP_MAX_MTU)
-                mtu = IP_MAX_MTU;
-
-        return mtu;
+        return min_t(unsigned int, mtu, IP_MAX_MTU);
 }
 
 static struct fib_nh_exception *find_exception(struct fib_nh *nh, __be32 daddr)
@@ -1214,34 +1258,36 @@ static bool rt_bind_exception(struct rtable *rt, struct fib_nh_exception *fnhe,
         spin_lock_bh(&fnhe_lock);
 
         if (daddr == fnhe->fnhe_daddr) {
-                struct rtable *orig = rcu_dereference(fnhe->fnhe_rth);
-                if (orig && rt_is_expired(orig)) {
+                struct rtable __rcu **porig;
+                struct rtable *orig;
+                int genid = fnhe_genid(dev_net(rt->dst.dev));
+
+                if (rt_is_input_route(rt))
+                        porig = &fnhe->fnhe_rth_input;
+                else
+                        porig = &fnhe->fnhe_rth_output;
+                orig = rcu_dereference(*porig);
+
+                if (fnhe->fnhe_genid != genid) {
+                        fnhe->fnhe_genid = genid;
                         fnhe->fnhe_gw = 0;
                         fnhe->fnhe_pmtu = 0;
                         fnhe->fnhe_expires = 0;
+                        fnhe_flush_routes(fnhe);
+                        orig = NULL;
                 }
-                if (fnhe->fnhe_pmtu) {
-                        unsigned long expires = fnhe->fnhe_expires;
-                        unsigned long diff = expires - jiffies;
-
-                        if (time_before(jiffies, expires)) {
-                                rt->rt_pmtu = fnhe->fnhe_pmtu;
-                                dst_set_expires(&rt->dst, diff);
-                        }
-                }
-                if (fnhe->fnhe_gw) {
-                        rt->rt_flags |= RTCF_REDIRECTED;
-                        rt->rt_gateway = fnhe->fnhe_gw;
-                        rt->rt_uses_gateway = 1;
-                } else if (!rt->rt_gateway)
+                fill_route_from_fnhe(rt, fnhe);
+                if (!rt->rt_gateway)
                         rt->rt_gateway = daddr;
 
-                rcu_assign_pointer(fnhe->fnhe_rth, rt);
-                if (orig)
-                        rt_free(orig);
+                if (!(rt->dst.flags & DST_NOCACHE)) {
+                        rcu_assign_pointer(*porig, rt);
+                        if (orig)
+                                rt_free(orig);
+                        ret = true;
+                }
 
                 fnhe->fnhe_stamp = jiffies;
-                ret = true;
         }
         spin_unlock_bh(&fnhe_lock);
 
@@ -1410,7 +1456,7 @@ static int ip_route_input_mc(struct sk_buff *skb, __be32 daddr, __be32 saddr,
 #endif
         rth->dst.output = ip_rt_bug;
 
-        rth->rt_genid   = rt_genid(dev_net(dev));
+        rth->rt_genid   = rt_genid_ipv4(dev_net(dev));
         rth->rt_flags   = RTCF_MULTICAST;
         rth->rt_type    = RTN_MULTICAST;
         rth->rt_is_input= 1;
@@ -1473,6 +1519,7 @@ static int __mkroute_input(struct sk_buff *skb,
                            struct in_device *in_dev,
                            __be32 daddr, __be32 saddr, u32 tos)
 {
+        struct fib_nh_exception *fnhe;
         struct rtable *rth;
         int err;
         struct in_device *out_dev;
@@ -1519,8 +1566,13 @@ static int __mkroute_input(struct sk_buff *skb,
                 }
         }
 
+        fnhe = find_exception(&FIB_RES_NH(*res), daddr);
         if (do_cache) {
-                rth = rcu_dereference(FIB_RES_NH(*res).nh_rth_input);
+                if (fnhe != NULL)
+                        rth = rcu_dereference(fnhe->fnhe_rth_input);
+                else
+                        rth = rcu_dereference(FIB_RES_NH(*res).nh_rth_input);
+
                 if (rt_cache_valid(rth)) {
                         skb_dst_set_noref(skb, &rth->dst);
                         goto out;
@@ -1535,7 +1587,7 @@ static int __mkroute_input(struct sk_buff *skb,
                 goto cleanup;
         }
 
-        rth->rt_genid = rt_genid(dev_net(rth->dst.dev));
+        rth->rt_genid = rt_genid_ipv4(dev_net(rth->dst.dev));
         rth->rt_flags = flags;
         rth->rt_type = res->type;
         rth->rt_is_input = 1;
@@ -1548,7 +1600,7 @@ static int __mkroute_input(struct sk_buff *skb,
         rth->dst.input = ip_forward;
         rth->dst.output = ip_output;
 
-        rt_set_nexthop(rth, daddr, res, NULL, res->fi, res->type, itag);
+        rt_set_nexthop(rth, daddr, res, fnhe, res->fi, res->type, itag);
         skb_dst_set(skb, &rth->dst);
 out:
         err = 0;
@@ -1706,7 +1758,7 @@ local_input:
         rth->dst.tclassid = itag;
 #endif
 
-        rth->rt_genid = rt_genid(net);
+        rth->rt_genid = rt_genid_ipv4(net);
         rth->rt_flags   = flags|RTCF_LOCAL;
         rth->rt_type    = res.type;
         rth->rt_is_input = 1;
@@ -1863,7 +1915,7 @@ static struct rtable *__mkroute_output(const struct fib_result *res,
 
                 fnhe = find_exception(nh, fl4->daddr);
                 if (fnhe)
-                        prth = &fnhe->fnhe_rth;
+                        prth = &fnhe->fnhe_rth_output;
                 else {
                         if (unlikely(fl4->flowi4_flags &
                                      FLOWI_FLAG_KNOWN_NH &&
@@ -1891,7 +1943,7 @@ add:
 
         rth->dst.output = ip_output;
 
-        rth->rt_genid = rt_genid(dev_net(dev_out));
+        rth->rt_genid = rt_genid_ipv4(dev_net(dev_out));
         rth->rt_flags   = flags;
         rth->rt_type    = type;
         rth->rt_is_input = 0;
@@ -2173,7 +2225,7 @@ struct dst_entry *ipv4_blackhole_route(struct net *net, struct dst_entry *dst_or
                 rt->rt_iif = ort->rt_iif;
                 rt->rt_pmtu = ort->rt_pmtu;
 
-                rt->rt_genid = rt_genid(net);
+                rt->rt_genid = rt_genid_ipv4(net);
                 rt->rt_flags = ort->rt_flags;
                 rt->rt_type = ort->rt_type;
                 rt->rt_gateway = ort->rt_gateway;
@@ -2429,19 +2481,22 @@ static int ip_rt_gc_interval __read_mostly  = 60 * HZ;
 static int ip_rt_gc_min_interval __read_mostly  = HZ / 2;
 static int ip_rt_gc_elasticity __read_mostly    = 8;
 
-static int ipv4_sysctl_rtcache_flush(ctl_table *__ctl, int write,
+static int ipv4_sysctl_rtcache_flush(struct ctl_table *__ctl, int write,
                                         void __user *buffer,
                                         size_t *lenp, loff_t *ppos)
 {
+        struct net *net = (struct net *)__ctl->extra1;
+
         if (write) {
-                rt_cache_flush((struct net *)__ctl->extra1);
+                rt_cache_flush(net);
+                fnhe_genid_bump(net);
                 return 0;
         }
 
         return -EINVAL;
 }
 
-static ctl_table ipv4_route_table[] = {
+static struct ctl_table ipv4_route_table[] = {
         {
                 .procname       = "gc_thresh",
                 .data           = &ipv4_dst_ops.gc_thresh,
@@ -2608,7 +2663,8 @@ static __net_initdata struct pernet_operations sysctl_route_ops = {
 
 static __net_init int rt_genid_init(struct net *net)
 {
-        atomic_set(&net->rt_genid, 0);
+        atomic_set(&net->ipv4.rt_genid, 0);
+        atomic_set(&net->fnhe_genid, 0);
         get_random_bytes(&net->ipv4.dev_addr_genid,
                          sizeof(net->ipv4.dev_addr_genid));
         return 0;
diff --git a/net/ipv4/syncookies.c b/net/ipv4/syncookies.c
index b05c96e7af8b..14a15c49129d 100644
--- a/net/ipv4/syncookies.c
+++ b/net/ipv4/syncookies.c
@@ -160,26 +160,33 @@ static __u16 const msstab[] = {
  * Generate a syncookie.  mssp points to the mss, which is returned
  * rounded down to the value encoded in the cookie.
  */
-__u32 cookie_v4_init_sequence(struct sock *sk, struct sk_buff *skb, __u16 *mssp)
+u32 __cookie_v4_init_sequence(const struct iphdr *iph, const struct tcphdr *th,
+                              u16 *mssp)
 {
-        const struct iphdr *iph = ip_hdr(skb);
-        const struct tcphdr *th = tcp_hdr(skb);
         int mssind;
         const __u16 mss = *mssp;
 
-        tcp_synq_overflow(sk);
-
         for (mssind = ARRAY_SIZE(msstab) - 1; mssind ; mssind--)
                 if (mss >= msstab[mssind])
                         break;
         *mssp = msstab[mssind];
 
-        NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_SYNCOOKIESSENT);
-
         return secure_tcp_syn_cookie(iph->saddr, iph->daddr,
                                      th->source, th->dest, ntohl(th->seq),
                                      jiffies / (HZ * 60), mssind);
 }
+EXPORT_SYMBOL_GPL(__cookie_v4_init_sequence);
+
+__u32 cookie_v4_init_sequence(struct sock *sk, struct sk_buff *skb, __u16 *mssp)
+{
+        const struct iphdr *iph = ip_hdr(skb);
+        const struct tcphdr *th = tcp_hdr(skb);
+
+        tcp_synq_overflow(sk);
+        NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_SYNCOOKIESSENT);
+
+        return __cookie_v4_init_sequence(iph, th, mssp);
+}
 
 /*
  * This (misnamed) value is the age of syncookie which is permitted.
@@ -192,10 +199,9 @@ __u32 cookie_v4_init_sequence(struct sock *sk, struct sk_buff *skb, __u16 *mssp)
  * Check if a ack sequence number is a valid syncookie.
  * Return the decoded mss if it is, or 0 if not.
  */
-static inline int cookie_check(struct sk_buff *skb, __u32 cookie)
+int __cookie_v4_check(const struct iphdr *iph, const struct tcphdr *th,
+                      u32 cookie)
 {
-        const struct iphdr *iph = ip_hdr(skb);
-        const struct tcphdr *th = tcp_hdr(skb);
         __u32 seq = ntohl(th->seq) - 1;
         __u32 mssind = check_tcp_syn_cookie(cookie, iph->saddr, iph->daddr,
                                             th->source, th->dest, seq,
@@ -204,6 +210,7 @@ static inline int cookie_check(struct sk_buff *skb, __u32 cookie)
 
         return mssind < ARRAY_SIZE(msstab) ? msstab[mssind] : 0;
 }
+EXPORT_SYMBOL_GPL(__cookie_v4_check);
 
 static inline struct sock *get_cookie_sock(struct sock *sk, struct sk_buff *skb,
                                            struct request_sock *req,
@@ -284,7 +291,7 @@ struct sock *cookie_v4_check(struct sock *sk, struct sk_buff *skb,
                 goto out;
 
         if (tcp_synq_no_recent_overflow(sk) ||
-            (mss = cookie_check(skb, cookie)) == 0) {
+            (mss = __cookie_v4_check(ip_hdr(skb), th, cookie)) == 0) {
                 NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_SYNCOOKIESFAILED);
                 goto out;
         }
diff --git a/net/ipv4/sysctl_net_ipv4.c b/net/ipv4/sysctl_net_ipv4.c
index fa2f63fc453b..540279f4c531 100644
--- a/net/ipv4/sysctl_net_ipv4.c
+++ b/net/ipv4/sysctl_net_ipv4.c
@@ -29,6 +29,7 @@
 static int zero;
 static int one = 1;
 static int four = 4;
+static int gso_max_segs = GSO_MAX_SEGS;
 static int tcp_retr1_max = 255;
 static int ip_local_port_range_min[] = { 1, 1 };
 static int ip_local_port_range_max[] = { 65535, 65535 };
@@ -36,6 +37,8 @@ static int tcp_adv_win_scale_min = -31;
 static int tcp_adv_win_scale_max = 31;
 static int ip_ttl_min = 1;
 static int ip_ttl_max = 255;
+static int tcp_syn_retries_min = 1;
+static int tcp_syn_retries_max = MAX_TCP_SYNCNT;
 static int ip_ping_group_range_min[] = { 0, 0 };
 static int ip_ping_group_range_max[] = { GID_T_MAX, GID_T_MAX };
 
@@ -49,13 +52,13 @@ static void set_local_port_range(int range[2])
 }
 
 /* Validate changes from /proc interface. */
-static int ipv4_local_port_range(ctl_table *table, int write,
+static int ipv4_local_port_range(struct ctl_table *table, int write,
                                  void __user *buffer,
                                  size_t *lenp, loff_t *ppos)
 {
         int ret;
         int range[2];
-        ctl_table tmp = {
+        struct ctl_table tmp = {
                 .data = &range,
                 .maxlen = sizeof(range),
                 .mode = table->mode,
@@ -100,7 +103,7 @@ static void set_ping_group_range(struct ctl_table *table, kgid_t low, kgid_t hig
 }
 
 /* Validate changes from /proc interface. */
-static int ipv4_ping_group_range(ctl_table *table, int write,
+static int ipv4_ping_group_range(struct ctl_table *table, int write,
                                  void __user *buffer,
                                  size_t *lenp, loff_t *ppos)
 {
@@ -108,7 +111,7 @@ static int ipv4_ping_group_range(ctl_table *table, int write,
         int ret;
         gid_t urange[2];
         kgid_t low, high;
-        ctl_table tmp = {
+        struct ctl_table tmp = {
                 .data = &urange,
                 .maxlen = sizeof(urange),
                 .mode = table->mode,
@@ -135,11 +138,11 @@ static int ipv4_ping_group_range(ctl_table *table, int write,
         return ret;
 }
 
-static int proc_tcp_congestion_control(ctl_table *ctl, int write,
+static int proc_tcp_congestion_control(struct ctl_table *ctl, int write,
                                        void __user *buffer, size_t *lenp, loff_t *ppos)
 {
         char val[TCP_CA_NAME_MAX];
-        ctl_table tbl = {
+        struct ctl_table tbl = {
                 .data = val,
                 .maxlen = TCP_CA_NAME_MAX,
         };
@@ -153,12 +156,12 @@ static int proc_tcp_congestion_control(ctl_table *ctl, int write,
         return ret;
 }
 
-static int proc_tcp_available_congestion_control(ctl_table *ctl,
+static int proc_tcp_available_congestion_control(struct ctl_table *ctl,
                                                  int write,
                                                  void __user *buffer, size_t *lenp,
                                                  loff_t *ppos)
 {
-        ctl_table tbl = { .maxlen = TCP_CA_BUF_MAX, };
+        struct ctl_table tbl = { .maxlen = TCP_CA_BUF_MAX, };
         int ret;
 
         tbl.data = kmalloc(tbl.maxlen, GFP_USER);
@@ -170,12 +173,12 @@ static int proc_tcp_available_congestion_control(ctl_table *ctl,
         return ret;
 }
 
-static int proc_allowed_congestion_control(ctl_table *ctl,
+static int proc_allowed_congestion_control(struct ctl_table *ctl,
                                            int write,
                                            void __user *buffer, size_t *lenp,
                                            loff_t *ppos)
 {
-        ctl_table tbl = { .maxlen = TCP_CA_BUF_MAX };
+        struct ctl_table tbl = { .maxlen = TCP_CA_BUF_MAX };
         int ret;
 
         tbl.data = kmalloc(tbl.maxlen, GFP_USER);
@@ -190,7 +193,7 @@ static int proc_allowed_congestion_control(ctl_table *ctl,
         return ret;
 }
 
-static int ipv4_tcp_mem(ctl_table *ctl, int write,
+static int ipv4_tcp_mem(struct ctl_table *ctl, int write,
                            void __user *buffer, size_t *lenp,
                            loff_t *ppos)
 {
@@ -201,7 +204,7 @@ static int ipv4_tcp_mem(ctl_table *ctl, int write,
         struct mem_cgroup *memcg;
 #endif
 
-        ctl_table tmp = {
+        struct ctl_table tmp = {
                 .data = &vec,
                 .maxlen = sizeof(vec),
                 .mode = ctl->mode,
@@ -233,10 +236,11 @@ static int ipv4_tcp_mem(ctl_table *ctl, int write,
         return 0;
 }
 
-static int proc_tcp_fastopen_key(ctl_table *ctl, int write, void __user *buffer,
-                                 size_t *lenp, loff_t *ppos)
+static int proc_tcp_fastopen_key(struct ctl_table *ctl, int write,
+                                 void __user *buffer, size_t *lenp,
+                                 loff_t *ppos)
 {
-        ctl_table tbl = { .maxlen = (TCP_FASTOPEN_KEY_LENGTH * 2 + 10) };
+        struct ctl_table tbl = { .maxlen = (TCP_FASTOPEN_KEY_LENGTH * 2 + 10) };
         struct tcp_fastopen_context *ctxt;
         int ret;
         u32  user_key[4]; /* 16 bytes, matching TCP_FASTOPEN_KEY_LENGTH */
@@ -331,7 +335,9 @@ static struct ctl_table ipv4_table[] = {
                 .data           = &sysctl_tcp_syn_retries,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
-                .proc_handler   = proc_dointvec
+                .proc_handler   = proc_dointvec_minmax,
+                .extra1         = &tcp_syn_retries_min,
+                .extra2         = &tcp_syn_retries_max
         },
         {
                 .procname       = "tcp_synack_retries",
@@ -554,6 +560,13 @@ static struct ctl_table ipv4_table[] = {
                 .extra1         = &one,
         },
         {
+                .procname       = "tcp_notsent_lowat",
+                .data           = &sysctl_tcp_notsent_lowat,
+                .maxlen         = sizeof(sysctl_tcp_notsent_lowat),
+                .mode           = 0644,
+                .proc_handler   = proc_dointvec,
+        },
+        {
                 .procname       = "tcp_rmem",
                 .data           = &sysctl_tcp_rmem,
                 .maxlen         = sizeof(sysctl_tcp_rmem),
@@ -749,6 +762,15 @@ static struct ctl_table ipv4_table[] = {
                 .extra2         = &four,
         },
         {
+                .procname       = "tcp_min_tso_segs",
+                .data           = &sysctl_tcp_min_tso_segs,
+                .maxlen         = sizeof(int),
+                .mode           = 0644,
+                .proc_handler   = proc_dointvec_minmax,
+                .extra1         = &zero,
+                .extra2         = &gso_max_segs,
+        },
+        {
                 .procname       = "udp_mem",
                 .data           = &sysctl_udp_mem,
                 .maxlen         = sizeof(sysctl_udp_mem),
diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
index ab450c099aa4..6e5617b9f9db 100644
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -279,9 +279,12 @@
 
 #include <asm/uaccess.h>
 #include <asm/ioctls.h>
+#include <net/busy_poll.h>
 
 int sysctl_tcp_fin_timeout __read_mostly = TCP_FIN_TIMEOUT;
 
+int sysctl_tcp_min_tso_segs __read_mostly = 2;
+
 struct percpu_counter tcp_orphan_count;
 EXPORT_SYMBOL_GPL(tcp_orphan_count);
 
@@ -409,10 +412,6 @@ void tcp_init_sock(struct sock *sk)
 
         icsk->icsk_sync_mss = tcp_sync_mss;
 
-        /* Presumed zeroed, in order of appearance:
-         *      cookie_in_always, cookie_out_never,
-         *      s_data_constant, s_data_in, s_data_out
-         */
         sk->sk_sndbuf = sysctl_tcp_wmem[1];
         sk->sk_rcvbuf = sysctl_tcp_rmem[1];
 
@@ -436,6 +435,8 @@ unsigned int tcp_poll(struct file *file, struct socket *sock, poll_table *wait)
         struct sock *sk = sock->sk;
         const struct tcp_sock *tp = tcp_sk(sk);
 
+        sock_rps_record_flow(sk);
+
         sock_poll_wait(file, sk_sleep(sk), wait);
         if (sk->sk_state == TCP_LISTEN)
                 return inet_csk_listen_poll(sk);
@@ -496,7 +497,7 @@ unsigned int tcp_poll(struct file *file, struct socket *sock, poll_table *wait)
                         mask |= POLLIN | POLLRDNORM;
 
                 if (!(sk->sk_shutdown & SEND_SHUTDOWN)) {
-                        if (sk_stream_wspace(sk) >= sk_stream_min_wspace(sk)) {
+                        if (sk_stream_is_writeable(sk)) {
                                 mask |= POLLOUT | POLLWRNORM;
                         } else {  /* send SIGIO later */
                                 set_bit(SOCK_ASYNC_NOSPACE,
@@ -507,7 +508,7 @@ unsigned int tcp_poll(struct file *file, struct socket *sock, poll_table *wait)
                                  * wspace test but before the flags are set,
                                  * IO signal will be lost.
                                  */
-                                if (sk_stream_wspace(sk) >= sk_stream_min_wspace(sk))
+                                if (sk_stream_is_writeable(sk))
                                         mask |= POLLOUT | POLLWRNORM;
                         }
                 } else
@@ -786,12 +787,28 @@ static unsigned int tcp_xmit_size_goal(struct sock *sk, u32 mss_now,
         xmit_size_goal = mss_now;
 
         if (large_allowed && sk_can_gso(sk)) {
-                xmit_size_goal = ((sk->sk_gso_max_size - 1) -
-                                  inet_csk(sk)->icsk_af_ops->net_header_len -
-                                  inet_csk(sk)->icsk_ext_hdr_len -
-                                  tp->tcp_header_len);
+                u32 gso_size, hlen;
+
+                /* Maybe we should/could use sk->sk_prot->max_header here ? */
+                hlen = inet_csk(sk)->icsk_af_ops->net_header_len +
+                       inet_csk(sk)->icsk_ext_hdr_len +
+                       tp->tcp_header_len;
+
+                /* Goal is to send at least one packet per ms,
+                 * not one big TSO packet every 100 ms.
+                 * This preserves ACK clocking and is consistent
+                 * with tcp_tso_should_defer() heuristic.
+                 */
+                gso_size = sk->sk_pacing_rate / (2 * MSEC_PER_SEC);
+                gso_size = max_t(u32, gso_size,
+                                 sysctl_tcp_min_tso_segs * mss_now);
+
+                xmit_size_goal = min_t(u32, gso_size,
+                                       sk->sk_gso_max_size - 1 - hlen);
 
-                /* TSQ : try to have two TSO segments in flight */
+                /* TSQ : try to have at least two segments in flight
+                 * (one in NIC TX ring, another in Qdisc)
+                 */
                 xmit_size_goal = min_t(u32, xmit_size_goal,
                                        sysctl_tcp_limit_output_bytes >> 1);
 
@@ -1118,6 +1135,13 @@ new_segment:
                                         goto wait_for_memory;
 
                                 /*
+                                 * All packets are restored as if they have
+                                 * already been sent.
+                                 */
+                                if (tp->repair)
+                                        TCP_SKB_CB(skb)->when = tcp_time_stamp;
+
+                                /*
                                  * Check whether we can use HW checksum.
                                  */
                                 if (sk->sk_route_caps & NETIF_F_ALL_CSUM)
@@ -1551,6 +1575,10 @@ int tcp_recvmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
         struct sk_buff *skb;
         u32 urg_hole = 0;
 
+        if (sk_can_busy_loop(sk) && skb_queue_empty(&sk->sk_receive_queue) &&
+            (sk->sk_state == TCP_ESTABLISHED))
+                sk_busy_loop(sk, nonblock);
+
         lock_sock(sk);
 
         err = -ENOTCONN;
@@ -2440,10 +2468,11 @@ static int do_tcp_setsockopt(struct sock *sk, int level,
         case TCP_THIN_DUPACK:
                 if (val < 0 || val > 1)
                         err = -EINVAL;
-                else
+                else {
                         tp->thin_dupack = val;
                         if (tp->thin_dupack)
                                 tcp_disable_early_retrans(tp);
+                }
                 break;
 
         case TCP_REPAIR:
@@ -2624,6 +2653,10 @@ static int do_tcp_setsockopt(struct sock *sk, int level,
                 else
                         tp->tsoffset = val - tcp_time_stamp;
                 break;
+        case TCP_NOTSENT_LOWAT:
+                tp->notsent_lowat = val;
+                sk->sk_write_space(sk);
+                break;
         default:
                 err = -ENOPROTOOPT;
                 break;
@@ -2840,6 +2873,9 @@ static int do_tcp_getsockopt(struct sock *sk, int level,
         case TCP_TIMESTAMP:
                 val = tcp_time_stamp + tp->tsoffset;
                 break;
+        case TCP_NOTSENT_LOWAT:
+                val = tp->notsent_lowat;
+                break;
         default:
                 return -ENOPROTOOPT;
         }
@@ -2875,249 +2911,9 @@ int compat_tcp_getsockopt(struct sock *sk, int level, int optname,
 EXPORT_SYMBOL(compat_tcp_getsockopt);
 #endif
 
-struct sk_buff *tcp_tso_segment(struct sk_buff *skb,
-        netdev_features_t features)
-{
-        struct sk_buff *segs = ERR_PTR(-EINVAL);
-        struct tcphdr *th;
-        unsigned int thlen;
-        unsigned int seq;
-        __be32 delta;
-        unsigned int oldlen;
-        unsigned int mss;
-        struct sk_buff *gso_skb = skb;
-        __sum16 newcheck;
-        bool ooo_okay, copy_destructor;
-
-        if (!pskb_may_pull(skb, sizeof(*th)))
-                goto out;
-
-        th = tcp_hdr(skb);
-        thlen = th->doff * 4;
-        if (thlen < sizeof(*th))
-                goto out;
-
-        if (!pskb_may_pull(skb, thlen))
-                goto out;
-
-        oldlen = (u16)~skb->len;
-        __skb_pull(skb, thlen);
-
-        mss = skb_shinfo(skb)->gso_size;
-        if (unlikely(skb->len <= mss))
-                goto out;
-
-        if (skb_gso_ok(skb, features | NETIF_F_GSO_ROBUST)) {
-                /* Packet is from an untrusted source, reset gso_segs. */
-                int type = skb_shinfo(skb)->gso_type;
-
-                if (unlikely(type &
-                             ~(SKB_GSO_TCPV4 |
-                               SKB_GSO_DODGY |
-                               SKB_GSO_TCP_ECN |
-                               SKB_GSO_TCPV6 |
-                               SKB_GSO_GRE |
-                               SKB_GSO_UDP_TUNNEL |
-                               0) ||
-                             !(type & (SKB_GSO_TCPV4 | SKB_GSO_TCPV6))))
-                        goto out;
-
-                skb_shinfo(skb)->gso_segs = DIV_ROUND_UP(skb->len, mss);
-
-                segs = NULL;
-                goto out;
-        }
-
-        copy_destructor = gso_skb->destructor == tcp_wfree;
-        ooo_okay = gso_skb->ooo_okay;
-        /* All segments but the first should have ooo_okay cleared */
-        skb->ooo_okay = 0;
-
-        segs = skb_segment(skb, features);
-        if (IS_ERR(segs))
-                goto out;
-
-        /* Only first segment might have ooo_okay set */
-        segs->ooo_okay = ooo_okay;
-
-        delta = htonl(oldlen + (thlen + mss));
-
-        skb = segs;
-        th = tcp_hdr(skb);
-        seq = ntohl(th->seq);
-
-        newcheck = ~csum_fold((__force __wsum)((__force u32)th->check +
-                                               (__force u32)delta));
-
-        do {
-                th->fin = th->psh = 0;
-                th->check = newcheck;
-
-                if (skb->ip_summed != CHECKSUM_PARTIAL)
-                        th->check =
-                             csum_fold(csum_partial(skb_transport_header(skb),
-                                                    thlen, skb->csum));
-
-                seq += mss;
-                if (copy_destructor) {
-                        skb->destructor = gso_skb->destructor;
-                        skb->sk = gso_skb->sk;
-                        /* {tcp|sock}_wfree() use exact truesize accounting :
-                         * sum(skb->truesize) MUST be exactly be gso_skb->truesize
-                         * So we account mss bytes of 'true size' for each segment.
-                         * The last segment will contain the remaining.
-                         */
-                        skb->truesize = mss;
-                        gso_skb->truesize -= mss;
-                }
-                skb = skb->next;
-                th = tcp_hdr(skb);
-
-                th->seq = htonl(seq);
-                th->cwr = 0;
-        } while (skb->next);
-
-        /* Following permits TCP Small Queues to work well with GSO :
-         * The callback to TCP stack will be called at the time last frag
-         * is freed at TX completion, and not right now when gso_skb
-         * is freed by GSO engine
-         */
-        if (copy_destructor) {
-                swap(gso_skb->sk, skb->sk);
-                swap(gso_skb->destructor, skb->destructor);
-                swap(gso_skb->truesize, skb->truesize);
-        }
-
-        delta = htonl(oldlen + (skb->tail - skb->transport_header) +
-                      skb->data_len);
-        th->check = ~csum_fold((__force __wsum)((__force u32)th->check +
-                                (__force u32)delta));
-        if (skb->ip_summed != CHECKSUM_PARTIAL)
-                th->check = csum_fold(csum_partial(skb_transport_header(skb),
-                                                   thlen, skb->csum));
-
-out:
-        return segs;
-}
-EXPORT_SYMBOL(tcp_tso_segment);
-
-struct sk_buff **tcp_gro_receive(struct sk_buff **head, struct sk_buff *skb)
-{
-        struct sk_buff **pp = NULL;
-        struct sk_buff *p;
-        struct tcphdr *th;
-        struct tcphdr *th2;
-        unsigned int len;
-        unsigned int thlen;
-        __be32 flags;
-        unsigned int mss = 1;
-        unsigned int hlen;
-        unsigned int off;
-        int flush = 1;
-        int i;
-
-        off = skb_gro_offset(skb);
-        hlen = off + sizeof(*th);
-        th = skb_gro_header_fast(skb, off);
-        if (skb_gro_header_hard(skb, hlen)) {
-                th = skb_gro_header_slow(skb, hlen, off);
-                if (unlikely(!th))
-                        goto out;
-        }
-
-        thlen = th->doff * 4;
-        if (thlen < sizeof(*th))
-                goto out;
-
-        hlen = off + thlen;
-        if (skb_gro_header_hard(skb, hlen)) {
-                th = skb_gro_header_slow(skb, hlen, off);
-                if (unlikely(!th))
-                        goto out;
-        }
-
-        skb_gro_pull(skb, thlen);
-
-        len = skb_gro_len(skb);
-        flags = tcp_flag_word(th);
-
-        for (; (p = *head); head = &p->next) {
-                if (!NAPI_GRO_CB(p)->same_flow)
-                        continue;
-
-                th2 = tcp_hdr(p);
-
-                if (*(u32 *)&th->source ^ *(u32 *)&th2->source) {
-                        NAPI_GRO_CB(p)->same_flow = 0;
-                        continue;
-                }
-
-                goto found;
-        }
-
-        goto out_check_final;
-
-found:
-        flush = NAPI_GRO_CB(p)->flush;
-        flush |= (__force int)(flags & TCP_FLAG_CWR);
-        flush |= (__force int)((flags ^ tcp_flag_word(th2)) &
-                  ~(TCP_FLAG_CWR | TCP_FLAG_FIN | TCP_FLAG_PSH));
-        flush |= (__force int)(th->ack_seq ^ th2->ack_seq);
-        for (i = sizeof(*th); i < thlen; i += 4)
-                flush |= *(u32 *)((u8 *)th + i) ^
-                         *(u32 *)((u8 *)th2 + i);
-
-        mss = skb_shinfo(p)->gso_size;
-
-        flush |= (len - 1) >= mss;
-        flush |= (ntohl(th2->seq) + skb_gro_len(p)) ^ ntohl(th->seq);
-
-        if (flush || skb_gro_receive(head, skb)) {
-                mss = 1;
-                goto out_check_final;
-        }
-
-        p = *head;
-        th2 = tcp_hdr(p);
-        tcp_flag_word(th2) |= flags & (TCP_FLAG_FIN | TCP_FLAG_PSH);
-
-out_check_final:
-        flush = len < mss;
-        flush |= (__force int)(flags & (TCP_FLAG_URG | TCP_FLAG_PSH |
-                                        TCP_FLAG_RST | TCP_FLAG_SYN |
-                                        TCP_FLAG_FIN));
-
-        if (p && (!NAPI_GRO_CB(skb)->same_flow || flush))
-                pp = head;
-
-out:
-        NAPI_GRO_CB(skb)->flush |= flush;
-
-        return pp;
-}
-EXPORT_SYMBOL(tcp_gro_receive);
-
-int tcp_gro_complete(struct sk_buff *skb)
-{
-        struct tcphdr *th = tcp_hdr(skb);
-
-        skb->csum_start = skb_transport_header(skb) - skb->head;
-        skb->csum_offset = offsetof(struct tcphdr, check);
-        skb->ip_summed = CHECKSUM_PARTIAL;
-
-        skb_shinfo(skb)->gso_segs = NAPI_GRO_CB(skb)->count;
-
-        if (th->cwr)
-                skb_shinfo(skb)->gso_type |= SKB_GSO_TCP_ECN;
-
-        return 0;
-}
-EXPORT_SYMBOL(tcp_gro_complete);
-
 #ifdef CONFIG_TCP_MD5SIG
-static unsigned long tcp_md5sig_users;
-static struct tcp_md5sig_pool __percpu *tcp_md5sig_pool;
-static DEFINE_SPINLOCK(tcp_md5sig_pool_lock);
+static struct tcp_md5sig_pool __percpu *tcp_md5sig_pool __read_mostly;
+static DEFINE_MUTEX(tcp_md5sig_mutex);
 
 static void __tcp_free_md5sig_pool(struct tcp_md5sig_pool __percpu *pool)
 {
@@ -3132,30 +2928,14 @@ static void __tcp_free_md5sig_pool(struct tcp_md5sig_pool __percpu *pool)
         free_percpu(pool);
 }
 
-void tcp_free_md5sig_pool(void)
-{
-        struct tcp_md5sig_pool __percpu *pool = NULL;
-
-        spin_lock_bh(&tcp_md5sig_pool_lock);
-        if (--tcp_md5sig_users == 0) {
-                pool = tcp_md5sig_pool;
-                tcp_md5sig_pool = NULL;
-        }
-        spin_unlock_bh(&tcp_md5sig_pool_lock);
-        if (pool)
-                __tcp_free_md5sig_pool(pool);
-}
-EXPORT_SYMBOL(tcp_free_md5sig_pool);
-
-static struct tcp_md5sig_pool __percpu *
-__tcp_alloc_md5sig_pool(struct sock *sk)
+static void __tcp_alloc_md5sig_pool(void)
 {
         int cpu;
         struct tcp_md5sig_pool __percpu *pool;
 
         pool = alloc_percpu(struct tcp_md5sig_pool);
         if (!pool)
-                return NULL;
+                return;
 
         for_each_possible_cpu(cpu) {
                 struct crypto_hash *hash;
@@ -3166,53 +2946,27 @@ __tcp_alloc_md5sig_pool(struct sock *sk)
 
                 per_cpu_ptr(pool, cpu)->md5_desc.tfm = hash;
         }
-        return pool;
+        /* before setting tcp_md5sig_pool, we must commit all writes
+         * to memory. See ACCESS_ONCE() in tcp_get_md5sig_pool()
+         */
+        smp_wmb();
+        tcp_md5sig_pool = pool;
+        return;
 out_free:
         __tcp_free_md5sig_pool(pool);
-        return NULL;
 }
 
-struct tcp_md5sig_pool __percpu *tcp_alloc_md5sig_pool(struct sock *sk)
+bool tcp_alloc_md5sig_pool(void)
 {
-        struct tcp_md5sig_pool __percpu *pool;
-        bool alloc = false;
-
-retry:
-        spin_lock_bh(&tcp_md5sig_pool_lock);
-        pool = tcp_md5sig_pool;
-        if (tcp_md5sig_users++ == 0) {
-                alloc = true;
-                spin_unlock_bh(&tcp_md5sig_pool_lock);
-        } else if (!pool) {
-                tcp_md5sig_users--;
-                spin_unlock_bh(&tcp_md5sig_pool_lock);
-                cpu_relax();
-                goto retry;
-        } else
-                spin_unlock_bh(&tcp_md5sig_pool_lock);
-
-        if (alloc) {
-                /* we cannot hold spinlock here because this may sleep. */
-                struct tcp_md5sig_pool __percpu *p;
-
-                p = __tcp_alloc_md5sig_pool(sk);
-                spin_lock_bh(&tcp_md5sig_pool_lock);
-                if (!p) {
-                        tcp_md5sig_users--;
-                        spin_unlock_bh(&tcp_md5sig_pool_lock);
-                        return NULL;
-                }
-                pool = tcp_md5sig_pool;
-                if (pool) {
-                        /* oops, it has already been assigned. */
-                        spin_unlock_bh(&tcp_md5sig_pool_lock);
-                        __tcp_free_md5sig_pool(p);
-                } else {
-                        tcp_md5sig_pool = pool = p;
-                        spin_unlock_bh(&tcp_md5sig_pool_lock);
-                }
+        if (unlikely(!tcp_md5sig_pool)) {
+                mutex_lock(&tcp_md5sig_mutex);
+
+                if (!tcp_md5sig_pool)
+                        __tcp_alloc_md5sig_pool();
+
+                mutex_unlock(&tcp_md5sig_mutex);
         }
-        return pool;
+        return tcp_md5sig_pool != NULL;
 }
 EXPORT_SYMBOL(tcp_alloc_md5sig_pool);
 
@@ -3229,28 +2983,15 @@ struct tcp_md5sig_pool *tcp_get_md5sig_pool(void)
         struct tcp_md5sig_pool __percpu *p;
 
         local_bh_disable();
-
-        spin_lock(&tcp_md5sig_pool_lock);
-        p = tcp_md5sig_pool;
-        if (p)
-                tcp_md5sig_users++;
-        spin_unlock(&tcp_md5sig_pool_lock);
-
+        p = ACCESS_ONCE(tcp_md5sig_pool);
         if (p)
-                return this_cpu_ptr(p);
+                return __this_cpu_ptr(p);
 
         local_bh_enable();
         return NULL;
 }
 EXPORT_SYMBOL(tcp_get_md5sig_pool);
 
-void tcp_put_md5sig_pool(void)
-{
-        local_bh_enable();
-        tcp_free_md5sig_pool();
-}
-EXPORT_SYMBOL(tcp_put_md5sig_pool);
-
 int tcp_md5_hash_header(struct tcp_md5sig_pool *hp,
                         const struct tcphdr *th)
 {
diff --git a/net/ipv4/tcp_cubic.c b/net/ipv4/tcp_cubic.c
index a9077f441cb2..b6ae92a51f58 100644
--- a/net/ipv4/tcp_cubic.c
+++ b/net/ipv4/tcp_cubic.c
@@ -206,8 +206,8 @@ static u32 cubic_root(u64 a)
  */
 static inline void bictcp_update(struct bictcp *ca, u32 cwnd)
 {
-        u64 offs;
-        u32 delta, t, bic_target, max_cnt;
+        u32 delta, bic_target, max_cnt;
+        u64 offs, t;
 
         ca->ack_cnt++;  /* count the number of ACKs */
 
@@ -250,9 +250,11 @@ static inline void bictcp_update(struct bictcp *ca, u32 cwnd)
          * if the cwnd < 1 million packets !!!
          */
 
+        t = (s32)(tcp_time_stamp - ca->epoch_start);
+        t += msecs_to_jiffies(ca->delay_min >> 3);
         /* change the unit from HZ to bictcp_HZ */
-        t = ((tcp_time_stamp + msecs_to_jiffies(ca->delay_min>>3)
-              - ca->epoch_start) << BICTCP_HZ) / HZ;
+        t <<= BICTCP_HZ;
+        do_div(t, HZ);
 
         if (t < ca->bic_K)              /* t - K */
                 offs = ca->bic_K - t;
@@ -414,7 +416,7 @@ static void bictcp_acked(struct sock *sk, u32 cnt, s32 rtt_us)
                 return;
 
         /* Discard delay samples right after fast recovery */
-        if ((s32)(tcp_time_stamp - ca->epoch_start) < HZ)
+        if (ca->epoch_start && (s32)(tcp_time_stamp - ca->epoch_start) < HZ)
                 return;
 
         delay = (rtt_us << 3) / USEC_PER_MSEC;
diff --git a/net/ipv4/tcp_fastopen.c b/net/ipv4/tcp_fastopen.c
index 8f7ef0ad80e5..ab7bd35bb312 100644
--- a/net/ipv4/tcp_fastopen.c
+++ b/net/ipv4/tcp_fastopen.c
@@ -58,23 +58,22 @@ error:		kfree(ctx);
         return err;
 }
 
-/* Computes the fastopen cookie for the peer.
- * The peer address is a 128 bits long (pad with zeros for IPv4).
+/* Computes the fastopen cookie for the IP path.
+ * The path is a 128 bits long (pad with zeros for IPv4).
  *
  * The caller must check foc->len to determine if a valid cookie
  * has been generated successfully.
 */
-void tcp_fastopen_cookie_gen(__be32 addr, struct tcp_fastopen_cookie *foc)
+void tcp_fastopen_cookie_gen(__be32 src, __be32 dst,
+                             struct tcp_fastopen_cookie *foc)
 {
-        __be32 peer_addr[4] = { addr, 0, 0, 0 };
+        __be32 path[4] = { src, dst, 0, 0 };
         struct tcp_fastopen_context *ctx;
 
         rcu_read_lock();
         ctx = rcu_dereference(tcp_fastopen_ctx);
         if (ctx) {
-                crypto_cipher_encrypt_one(ctx->tfm,
-                                          foc->val,
-                                          (__u8 *)peer_addr);
+                crypto_cipher_encrypt_one(ctx->tfm, foc->val, (__u8 *)path);
                 foc->len = TCP_FASTOPEN_COOKIE_SIZE;
         }
         rcu_read_unlock();
diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index 9c6225780bd5..25a89eaa669d 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -347,24 +347,13 @@ static void tcp_grow_window(struct sock *sk, const struct sk_buff *skb)
 }
 
 /* 3. Tuning rcvbuf, when connection enters established state. */
-
 static void tcp_fixup_rcvbuf(struct sock *sk)
 {
         u32 mss = tcp_sk(sk)->advmss;
-        u32 icwnd = TCP_DEFAULT_INIT_RCVWND;
         int rcvmem;
 
-        /* Limit to 10 segments if mss <= 1460,
-         * or 14600/mss segments, with a minimum of two segments.
-         */
-        if (mss > 1460)
-                icwnd = max_t(u32, (1460 * TCP_DEFAULT_INIT_RCVWND) / mss, 2);
-
-        rcvmem = SKB_TRUESIZE(mss + MAX_TCP_HEADER);
-        while (tcp_win_from_space(rcvmem) < mss)
-                rcvmem += 128;
-
-        rcvmem *= icwnd;
+        rcvmem = 2 * SKB_TRUESIZE(mss + MAX_TCP_HEADER) *
+                 tcp_default_init_rwnd(mss);
 
         if (sk->sk_rcvbuf < rcvmem)
                 sk->sk_rcvbuf = min(rcvmem, sysctl_tcp_rmem[2]);
@@ -699,6 +688,34 @@ static void tcp_rtt_estimator(struct sock *sk, const __u32 mrtt)
         }
 }
 
+/* Set the sk_pacing_rate to allow proper sizing of TSO packets.
+ * Note: TCP stack does not yet implement pacing.
+ * FQ packet scheduler can be used to implement cheap but effective
+ * TCP pacing, to smooth the burst on large writes when packets
+ * in flight is significantly lower than cwnd (or rwin)
+ */
+static void tcp_update_pacing_rate(struct sock *sk)
+{
+        const struct tcp_sock *tp = tcp_sk(sk);
+        u64 rate;
+
+        /* set sk_pacing_rate to 200 % of current rate (mss * cwnd / srtt) */
+        rate = (u64)tp->mss_cache * 2 * (HZ << 3);
+
+        rate *= max(tp->snd_cwnd, tp->packets_out);
+
+        /* Correction for small srtt : minimum srtt being 8 (1 jiffy << 3),
+         * be conservative and assume srtt = 1 (125 us instead of 1.25 ms)
+         * We probably need usec resolution in the future.
+         * Note: This also takes care of possible srtt=0 case,
+         * when tcp_rtt_estimator() was not yet called.
+         */
+        if (tp->srtt > 8 + 2)
+                do_div(rate, tp->srtt);
+
+        sk->sk_pacing_rate = min_t(u64, rate, ~0U);
+}
+
 /* Calculate rto without backoff.  This is the second half of Van Jacobson's
  * routine referred to above.
  */
@@ -1059,6 +1076,7 @@ struct tcp_sacktag_state {
         int reord;
         int fack_count;
         int flag;
+        s32 rtt; /* RTT measured by SACKing never-retransmitted data */
 };
 
 /* Check if skb is fully within the SACK block. In presence of GSO skbs,
@@ -1119,7 +1137,7 @@ static int tcp_match_skb_to_sack(struct sock *sk, struct sk_buff *skb,
 static u8 tcp_sacktag_one(struct sock *sk,
                           struct tcp_sacktag_state *state, u8 sacked,
                           u32 start_seq, u32 end_seq,
-                          bool dup_sack, int pcount)
+                          int dup_sack, int pcount, u32 xmit_time)
 {
         struct tcp_sock *tp = tcp_sk(sk);
         int fack_count = state->fack_count;
@@ -1159,6 +1177,9 @@ static u8 tcp_sacktag_one(struct sock *sk,
                                                            state->reord);
                                 if (!after(end_seq, tp->high_seq))
                                         state->flag |= FLAG_ORIG_SACK_ACKED;
+                                /* Pick the earliest sequence sacked for RTT */
+                                if (state->rtt < 0)
+                                        state->rtt = tcp_time_stamp - xmit_time;
                         }
 
                         if (sacked & TCPCB_LOST) {
@@ -1216,7 +1237,8 @@ static bool tcp_shifted_skb(struct sock *sk, struct sk_buff *skb,
          * tcp_highest_sack_seq() when skb is highest_sack.
          */
         tcp_sacktag_one(sk, state, TCP_SKB_CB(skb)->sacked,
-                        start_seq, end_seq, dup_sack, pcount);
+                        start_seq, end_seq, dup_sack, pcount,
+                        TCP_SKB_CB(skb)->when);
 
         if (skb == tp->lost_skb_hint)
                 tp->lost_cnt_hint += pcount;
@@ -1257,8 +1279,6 @@ static bool tcp_shifted_skb(struct sock *sk, struct sk_buff *skb,
 
         if (skb == tp->retransmit_skb_hint)
                 tp->retransmit_skb_hint = prev;
-        if (skb == tp->scoreboard_skb_hint)
-                tp->scoreboard_skb_hint = prev;
         if (skb == tp->lost_skb_hint) {
                 tp->lost_skb_hint = prev;
                 tp->lost_cnt_hint -= tcp_skb_pcount(prev);
@@ -1492,7 +1512,8 @@ static struct sk_buff *tcp_sacktag_walk(struct sk_buff *skb, struct sock *sk,
                                                 TCP_SKB_CB(skb)->seq,
                                                 TCP_SKB_CB(skb)->end_seq,
                                                 dup_sack,
-                                                tcp_skb_pcount(skb));
+                                                tcp_skb_pcount(skb),
+                                                TCP_SKB_CB(skb)->when);
 
                         if (!before(TCP_SKB_CB(skb)->seq,
                                     tcp_highest_sack_seq(tp)))
@@ -1549,7 +1570,7 @@ static int tcp_sack_cache_ok(const struct tcp_sock *tp, const struct tcp_sack_bl
 
 static int
 tcp_sacktag_write_queue(struct sock *sk, const struct sk_buff *ack_skb,
-                        u32 prior_snd_una)
+                        u32 prior_snd_una, s32 *sack_rtt)
 {
         struct tcp_sock *tp = tcp_sk(sk);
         const unsigned char *ptr = (skb_transport_header(ack_skb) +
@@ -1567,6 +1588,7 @@ tcp_sacktag_write_queue(struct sock *sk, const struct sk_buff *ack_skb,
 
         state.flag = 0;
         state.reord = tp->packets_out;
+        state.rtt = -1;
 
         if (!tp->sacked_out) {
                 if (WARN_ON(tp->fackets_out))
@@ -1750,6 +1772,7 @@ out:
         WARN_ON((int)tp->retrans_out < 0);
         WARN_ON((int)tcp_packets_in_flight(tp) < 0);
 #endif
+        *sack_rtt = state.rtt;
         return state.flag;
 }
 
@@ -1882,8 +1905,13 @@ void tcp_enter_loss(struct sock *sk, int how)
         }
         tcp_verify_left_out(tp);
 
-        tp->reordering = min_t(unsigned int, tp->reordering,
-                               sysctl_tcp_reordering);
+        /* Timeout in disordered state after receiving substantial DUPACKs
+         * suggests that the degree of reordering is over-estimated.
+         */
+        if (icsk->icsk_ca_state <= TCP_CA_Disorder &&
+            tp->sacked_out >= sysctl_tcp_reordering)
+                tp->reordering = min_t(unsigned int, tp->reordering,
+                                       sysctl_tcp_reordering);
         tcp_set_ca_state(sk, TCP_CA_Loss);
         tp->high_seq = tp->snd_nxt;
         TCP_ECN_queue_cwr(tp);
@@ -1966,20 +1994,6 @@ static bool tcp_pause_early_retransmit(struct sock *sk, int flag)
         return true;
 }
 
-static inline int tcp_skb_timedout(const struct sock *sk,
-                                   const struct sk_buff *skb)
-{
-        return tcp_time_stamp - TCP_SKB_CB(skb)->when > inet_csk(sk)->icsk_rto;
-}
-
-static inline int tcp_head_timedout(const struct sock *sk)
-{
-        const struct tcp_sock *tp = tcp_sk(sk);
-
-        return tp->packets_out &&
-               tcp_skb_timedout(sk, tcp_write_queue_head(sk));
-}
-
 /* Linux NewReno/SACK/FACK/ECN state machine.
  * --------------------------------------
  *
@@ -2086,12 +2100,6 @@ static bool tcp_time_to_recover(struct sock *sk, int flag)
         if (tcp_dupack_heuristics(tp) > tp->reordering)
                 return true;
 
-        /* Trick#3 : when we use RFC2988 timer restart, fast
-         * retransmit can be triggered by timeout of queue head.
-         */
-        if (tcp_is_fack(tp) && tcp_head_timedout(sk))
-                return true;
-
         /* Trick#4: It is still not OK... But will it be useful to delay
          * recovery more?
          */
@@ -2128,44 +2136,6 @@ static bool tcp_time_to_recover(struct sock *sk, int flag)
         return false;
 }
 
-/* New heuristics: it is possible only after we switched to restart timer
- * each time when something is ACKed. Hence, we can detect timed out packets
- * during fast retransmit without falling to slow start.
- *
- * Usefulness of this as is very questionable, since we should know which of
- * the segments is the next to timeout which is relatively expensive to find
- * in general case unless we add some data structure just for that. The
- * current approach certainly won't find the right one too often and when it
- * finally does find _something_ it usually marks large part of the window
- * right away (because a retransmission with a larger timestamp blocks the
- * loop from advancing). -ij
- */
-static void tcp_timeout_skbs(struct sock *sk)
-{
-        struct tcp_sock *tp = tcp_sk(sk);
-        struct sk_buff *skb;
-
-        if (!tcp_is_fack(tp) || !tcp_head_timedout(sk))
-                return;
-
-        skb = tp->scoreboard_skb_hint;
-        if (tp->scoreboard_skb_hint == NULL)
-                skb = tcp_write_queue_head(sk);
-
-        tcp_for_write_queue_from(skb, sk) {
-                if (skb == tcp_send_head(sk))
-                        break;
-                if (!tcp_skb_timedout(sk, skb))
-                        break;
-
-                tcp_skb_mark_lost(tp, skb);
-        }
-
-        tp->scoreboard_skb_hint = skb;
-
-        tcp_verify_left_out(tp);
-}
-
 /* Detect loss in event "A" above by marking head of queue up as lost.
  * For FACK or non-SACK(Reno) senders, the first "packets" number of segments
  * are considered lost. For RFC3517 SACK, a segment is considered lost if it
@@ -2251,8 +2221,6 @@ static void tcp_update_scoreboard(struct sock *sk, int fast_rexmit)
                 else if (fast_rexmit)
                         tcp_mark_head_lost(sk, 1, 1);
         }
-
-        tcp_timeout_skbs(sk);
 }
 
 /* CWND moderation, preventing bursts due to too big ACKs
@@ -2307,10 +2275,22 @@ static void DBGUNDO(struct sock *sk, const char *msg)
 #define DBGUNDO(x...) do { } while (0)
 #endif
 
-static void tcp_undo_cwr(struct sock *sk, const bool undo_ssthresh)
+static void tcp_undo_cwnd_reduction(struct sock *sk, bool unmark_loss)
 {
         struct tcp_sock *tp = tcp_sk(sk);
 
+        if (unmark_loss) {
+                struct sk_buff *skb;
+
+                tcp_for_write_queue(skb, sk) {
+                        if (skb == tcp_send_head(sk))
+                                break;
+                        TCP_SKB_CB(skb)->sacked &= ~TCPCB_LOST;
+                }
+                tp->lost_out = 0;
+                tcp_clear_all_retrans_hints(tp);
+        }
+
         if (tp->prior_ssthresh) {
                 const struct inet_connection_sock *icsk = inet_csk(sk);
 
@@ -2319,7 +2299,7 @@ static void tcp_undo_cwr(struct sock *sk, const bool undo_ssthresh)
                 else
                         tp->snd_cwnd = max(tp->snd_cwnd, tp->snd_ssthresh << 1);
 
-                if (undo_ssthresh && tp->prior_ssthresh > tp->snd_ssthresh) {
+                if (tp->prior_ssthresh > tp->snd_ssthresh) {
                         tp->snd_ssthresh = tp->prior_ssthresh;
                         TCP_ECN_withdraw_cwr(tp);
                 }
@@ -2327,6 +2307,7 @@ static void tcp_undo_cwr(struct sock *sk, const bool undo_ssthresh)
                 tp->snd_cwnd = max(tp->snd_cwnd, tp->snd_ssthresh);
         }
         tp->snd_cwnd_stamp = tcp_time_stamp;
+        tp->undo_marker = 0;
 }
 
 static inline bool tcp_may_undo(const struct tcp_sock *tp)
@@ -2346,14 +2327,13 @@ static bool tcp_try_undo_recovery(struct sock *sk)
                  * or our original transmission succeeded.
                  */
                 DBGUNDO(sk, inet_csk(sk)->icsk_ca_state == TCP_CA_Loss ? "loss" : "retrans");
-                tcp_undo_cwr(sk, true);
+                tcp_undo_cwnd_reduction(sk, false);
                 if (inet_csk(sk)->icsk_ca_state == TCP_CA_Loss)
                         mib_idx = LINUX_MIB_TCPLOSSUNDO;
                 else
                         mib_idx = LINUX_MIB_TCPFULLUNDO;
 
                 NET_INC_STATS_BH(sock_net(sk), mib_idx);
-                tp->undo_marker = 0;
         }
         if (tp->snd_una == tp->high_seq && tcp_is_reno(tp)) {
                 /* Hold old state until something *above* high_seq
@@ -2367,16 +2347,17 @@ static bool tcp_try_undo_recovery(struct sock *sk)
 }
 
 /* Try to undo cwnd reduction, because D-SACKs acked all retransmitted data */
-static void tcp_try_undo_dsack(struct sock *sk)
+static bool tcp_try_undo_dsack(struct sock *sk)
 {
         struct tcp_sock *tp = tcp_sk(sk);
 
         if (tp->undo_marker && !tp->undo_retrans) {
                 DBGUNDO(sk, "D-SACK");
-                tcp_undo_cwr(sk, true);
-                tp->undo_marker = 0;
+                tcp_undo_cwnd_reduction(sk, false);
                 NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_TCPDSACKUNDO);
+                return true;
         }
+        return false;
 }
 
 /* We can clear retrans_stamp when there are no retransmissions in the
@@ -2408,60 +2389,20 @@ static bool tcp_any_retrans_done(const struct sock *sk)
         return false;
 }
 
-/* Undo during fast recovery after partial ACK. */
-
-static int tcp_try_undo_partial(struct sock *sk, int acked)
-{
-        struct tcp_sock *tp = tcp_sk(sk);
-        /* Partial ACK arrived. Force Hoe's retransmit. */
-        int failed = tcp_is_reno(tp) || (tcp_fackets_out(tp) > tp->reordering);
-
-        if (tcp_may_undo(tp)) {
-                /* Plain luck! Hole if filled with delayed
-                 * packet, rather than with a retransmit.
-                 */
-                if (!tcp_any_retrans_done(sk))
-                        tp->retrans_stamp = 0;
-
-                tcp_update_reordering(sk, tcp_fackets_out(tp) + acked, 1);
-
-                DBGUNDO(sk, "Hoe");
-                tcp_undo_cwr(sk, false);
-                NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_TCPPARTIALUNDO);
-
-                /* So... Do not make Hoe's retransmit yet.
-                 * If the first packet was delayed, the rest
-                 * ones are most probably delayed as well.
-                 */
-                failed = 0;
-        }
-        return failed;
-}
-
 /* Undo during loss recovery after partial ACK or using F-RTO. */
 static bool tcp_try_undo_loss(struct sock *sk, bool frto_undo)
 {
         struct tcp_sock *tp = tcp_sk(sk);
 
         if (frto_undo || tcp_may_undo(tp)) {
-                struct sk_buff *skb;
-                tcp_for_write_queue(skb, sk) {
-                        if (skb == tcp_send_head(sk))
-                                break;
-                        TCP_SKB_CB(skb)->sacked &= ~TCPCB_LOST;
-                }
-
-                tcp_clear_all_retrans_hints(tp);
+                tcp_undo_cwnd_reduction(sk, true);
 
                 DBGUNDO(sk, "partial loss");
-                tp->lost_out = 0;
-                tcp_undo_cwr(sk, true);
                 NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_TCPLOSSUNDO);
                 if (frto_undo)
                         NET_INC_STATS_BH(sock_net(sk),
                                          LINUX_MIB_TCPSPURIOUSRTOS);
                 inet_csk(sk)->icsk_retransmits = 0;
-                tp->undo_marker = 0;
                 if (frto_undo || tcp_is_sack(tp))
                         tcp_set_ca_state(sk, TCP_CA_Open);
                 return true;
@@ -2494,12 +2435,14 @@ static void tcp_init_cwnd_reduction(struct sock *sk, const bool set_ssthresh)
         TCP_ECN_queue_cwr(tp);
 }
 
-static void tcp_cwnd_reduction(struct sock *sk, int newly_acked_sacked,
+static void tcp_cwnd_reduction(struct sock *sk, const int prior_unsacked,
                                int fast_rexmit)
 {
         struct tcp_sock *tp = tcp_sk(sk);
         int sndcnt = 0;
         int delta = tp->snd_ssthresh - tcp_packets_in_flight(tp);
+        int newly_acked_sacked = prior_unsacked -
+                                 (tp->packets_out - tp->sacked_out);
 
         tp->prr_delivered += newly_acked_sacked;
         if (tcp_packets_in_flight(tp) > tp->snd_ssthresh) {
@@ -2556,7 +2499,7 @@ static void tcp_try_keep_open(struct sock *sk)
         }
 }
 
-static void tcp_try_to_open(struct sock *sk, int flag, int newly_acked_sacked)
+static void tcp_try_to_open(struct sock *sk, int flag, const int prior_unsacked)
 {
         struct tcp_sock *tp = tcp_sk(sk);
 
@@ -2570,10 +2513,8 @@ static void tcp_try_to_open(struct sock *sk, int flag, int newly_acked_sacked)
 
         if (inet_csk(sk)->icsk_ca_state != TCP_CA_CWR) {
                 tcp_try_keep_open(sk);
-                if (inet_csk(sk)->icsk_ca_state != TCP_CA_Open)
-                        tcp_moderate_cwnd(tp);
         } else {
-                tcp_cwnd_reduction(sk, newly_acked_sacked, 0);
+                tcp_cwnd_reduction(sk, prior_unsacked, 0);
         }
 }
 
@@ -2731,6 +2672,40 @@ static void tcp_process_loss(struct sock *sk, int flag, bool is_dupack)
         tcp_xmit_retransmit_queue(sk);
 }
 
+/* Undo during fast recovery after partial ACK. */
+static bool tcp_try_undo_partial(struct sock *sk, const int acked,
+                                 const int prior_unsacked)
+{
+        struct tcp_sock *tp = tcp_sk(sk);
+
+        if (tp->undo_marker && tcp_packet_delayed(tp)) {
+                /* Plain luck! Hole if filled with delayed
+                 * packet, rather than with a retransmit.
+                 */
+                tcp_update_reordering(sk, tcp_fackets_out(tp) + acked, 1);
+
+                /* We are getting evidence that the reordering degree is higher
+                 * than we realized. If there are no retransmits out then we
+                 * can undo. Otherwise we clock out new packets but do not
+                 * mark more packets lost or retransmit more.
+                 */
+                if (tp->retrans_out) {
+                        tcp_cwnd_reduction(sk, prior_unsacked, 0);
+                        return true;
+                }
+
+                if (!tcp_any_retrans_done(sk))
+                        tp->retrans_stamp = 0;
+
+                DBGUNDO(sk, "partial recovery");
+                tcp_undo_cwnd_reduction(sk, true);
+                NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_TCPPARTIALUNDO);
+                tcp_try_keep_open(sk);
+                return true;
+        }
+        return false;
+}
+
 /* Process an event, which can update packets-in-flight not trivially.
  * Main goal of this function is to calculate new estimate for left_out,
  * taking into account both packets sitting in receiver's buffer and
@@ -2742,15 +2717,14 @@ static void tcp_process_loss(struct sock *sk, int flag, bool is_dupack)
  * It does _not_ decide what to send, it is made in function
  * tcp_xmit_retransmit_queue().
  */
-static void tcp_fastretrans_alert(struct sock *sk, int pkts_acked,
-                                  int prior_sacked, int prior_packets,
+static void tcp_fastretrans_alert(struct sock *sk, const int acked,
+                                  const int prior_unsacked,
                                   bool is_dupack, int flag)
 {
         struct inet_connection_sock *icsk = inet_csk(sk);
         struct tcp_sock *tp = tcp_sk(sk);
-        int do_lost = is_dupack || ((flag & FLAG_DATA_SACKED) &&
+        bool do_lost = is_dupack || ((flag & FLAG_DATA_SACKED) &&
                                     (tcp_fackets_out(tp) > tp->reordering));
-        int newly_acked_sacked = 0;
         int fast_rexmit = 0;
 
         if (WARN_ON(!tp->packets_out && tp->sacked_out))
@@ -2802,10 +2776,17 @@ static void tcp_fastretrans_alert(struct sock *sk, int pkts_acked,
                 if (!(flag & FLAG_SND_UNA_ADVANCED)) {
                         if (tcp_is_reno(tp) && is_dupack)
                                 tcp_add_reno_sack(sk);
-                } else
-                        do_lost = tcp_try_undo_partial(sk, pkts_acked);
-                newly_acked_sacked = prior_packets - tp->packets_out +
-                                     tp->sacked_out - prior_sacked;
+                } else {
+                        if (tcp_try_undo_partial(sk, acked, prior_unsacked))
+                                return;
+                        /* Partial ACK arrived. Force fast retransmit. */
+                        do_lost = tcp_is_reno(tp) ||
+                                  tcp_fackets_out(tp) > tp->reordering;
+                }
+                if (tcp_try_undo_dsack(sk)) {
+                        tcp_try_keep_open(sk);
+                        return;
+                }
                 break;
         case TCP_CA_Loss:
                 tcp_process_loss(sk, flag, is_dupack);
@@ -2819,14 +2800,12 @@ static void tcp_fastretrans_alert(struct sock *sk, int pkts_acked,
                         if (is_dupack)
                                 tcp_add_reno_sack(sk);
                 }
-                newly_acked_sacked = prior_packets - tp->packets_out +
-                                     tp->sacked_out - prior_sacked;
 
                 if (icsk->icsk_ca_state <= TCP_CA_Disorder)
                         tcp_try_undo_dsack(sk);
 
                 if (!tcp_time_to_recover(sk, flag)) {
-                        tcp_try_to_open(sk, flag, newly_acked_sacked);
+                        tcp_try_to_open(sk, flag, prior_unsacked);
                         return;
                 }
 
@@ -2846,71 +2825,57 @@ static void tcp_fastretrans_alert(struct sock *sk, int pkts_acked,
                 fast_rexmit = 1;
         }
 
-        if (do_lost || (tcp_is_fack(tp) && tcp_head_timedout(sk)))
+        if (do_lost)
                 tcp_update_scoreboard(sk, fast_rexmit);
-        tcp_cwnd_reduction(sk, newly_acked_sacked, fast_rexmit);
+        tcp_cwnd_reduction(sk, prior_unsacked, fast_rexmit);
         tcp_xmit_retransmit_queue(sk);
 }
 
-void tcp_valid_rtt_meas(struct sock *sk, u32 seq_rtt)
+static inline bool tcp_ack_update_rtt(struct sock *sk, const int flag,
+                                      s32 seq_rtt, s32 sack_rtt)
 {
-        tcp_rtt_estimator(sk, seq_rtt);
-        tcp_set_rto(sk);
-        inet_csk(sk)->icsk_backoff = 0;
-}
-EXPORT_SYMBOL(tcp_valid_rtt_meas);
+        const struct tcp_sock *tp = tcp_sk(sk);
+
+        /* Prefer RTT measured from ACK's timing to TS-ECR. This is because
+         * broken middle-boxes or peers may corrupt TS-ECR fields. But
+         * Karn's algorithm forbids taking RTT if some retransmitted data
+         * is acked (RFC6298).
+         */
+        if (flag & FLAG_RETRANS_DATA_ACKED)
+                seq_rtt = -1;
+
+        if (seq_rtt < 0)
+                seq_rtt = sack_rtt;
 
-/* Read draft-ietf-tcplw-high-performance before mucking
- * with this code. (Supersedes RFC1323)
- */
-static void tcp_ack_saw_tstamp(struct sock *sk, int flag)
-{
         /* RTTM Rule: A TSecr value received in a segment is used to
          * update the averaged RTT measurement only if the segment
          * acknowledges some new data, i.e., only if it advances the
          * left edge of the send window.
-         *
          * See draft-ietf-tcplw-high-performance-00, section 3.3.
-         * 1998/04/10 Andrey V. Savochkin <saw@msu.ru>
-         *
-         * Changed: reset backoff as soon as we see the first valid sample.
-         * If we do not, we get strongly overestimated rto. With timestamps
-         * samples are accepted even from very old segments: f.e., when rtt=1
-         * increases to 8, we retransmit 5 times and after 8 seconds delayed
-         * answer arrives rto becomes 120 seconds! If at least one of segments
-         * in window is lost... Voila.                          --ANK (010210)
          */
-        struct tcp_sock *tp = tcp_sk(sk);
+        if (seq_rtt < 0 && tp->rx_opt.saw_tstamp && tp->rx_opt.rcv_tsecr)
+                seq_rtt = tcp_time_stamp - tp->rx_opt.rcv_tsecr;
 
-        tcp_valid_rtt_meas(sk, tcp_time_stamp - tp->rx_opt.rcv_tsecr);
-}
-
-static void tcp_ack_no_tstamp(struct sock *sk, u32 seq_rtt, int flag)
-{
-        /* We don't have a timestamp. Can only use
-         * packets that are not retransmitted to determine
-         * rtt estimates. Also, we must not reset the
-         * backoff for rto until we get a non-retransmitted
-         * packet. This allows us to deal with a situation
-         * where the network delay has increased suddenly.
-         * I.e. Karn's algorithm. (SIGCOMM '87, p5.)
-         */
+        if (seq_rtt < 0)
+                return false;
 
-        if (flag & FLAG_RETRANS_DATA_ACKED)
-                return;
+        tcp_rtt_estimator(sk, seq_rtt);
+        tcp_set_rto(sk);
 
-        tcp_valid_rtt_meas(sk, seq_rtt);
+        /* RFC6298: only reset backoff on valid RTT measurement. */
+        inet_csk(sk)->icsk_backoff = 0;
+        return true;
 }
 
-static inline void tcp_ack_update_rtt(struct sock *sk, const int flag,
-                                      const s32 seq_rtt)
+/* Compute time elapsed between (last) SYNACK and the ACK completing 3WHS. */
+static void tcp_synack_rtt_meas(struct sock *sk, struct request_sock *req)
 {
-        const struct tcp_sock *tp = tcp_sk(sk);
-        /* Note that peer MAY send zero echo. In this case it is ignored. (rfc1323) */
-        if (tp->rx_opt.saw_tstamp && tp->rx_opt.rcv_tsecr)
-                tcp_ack_saw_tstamp(sk, flag);
-        else if (seq_rtt >= 0)
-                tcp_ack_no_tstamp(sk, seq_rtt, flag);
+        struct tcp_sock *tp = tcp_sk(sk);
+        s32 seq_rtt = -1;
+
+        if (tp->lsndtime && !tp->total_retrans)
+                seq_rtt = tcp_time_stamp - tp->lsndtime;
+        tcp_ack_update_rtt(sk, FLAG_SYN_ACKED, seq_rtt, -1);
 }
 
 static void tcp_cong_avoid(struct sock *sk, u32 ack, u32 in_flight)
@@ -2999,7 +2964,7 @@ static u32 tcp_tso_acked(struct sock *sk, struct sk_buff *skb)
  * arrived at the other end.
  */
 static int tcp_clean_rtx_queue(struct sock *sk, int prior_fackets,
-                               u32 prior_snd_una)
+                               u32 prior_snd_una, s32 sack_rtt)
 {
         struct tcp_sock *tp = tcp_sk(sk);
         const struct inet_connection_sock *icsk = inet_csk(sk);
@@ -3038,8 +3003,6 @@ static int tcp_clean_rtx_queue(struct sock *sk, int prior_fackets,
                         if (sacked & TCPCB_SACKED_RETRANS)
                                 tp->retrans_out -= acked_pcount;
                         flag |= FLAG_RETRANS_DATA_ACKED;
-                        ca_seq_rtt = -1;
-                        seq_rtt = -1;
                 } else {
                         ca_seq_rtt = now - scb->when;
                         last_ackt = skb->tstamp;
@@ -3079,7 +3042,6 @@ static int tcp_clean_rtx_queue(struct sock *sk, int prior_fackets,
 
                 tcp_unlink_write_queue(skb, sk);
                 sk_wmem_free_skb(sk, skb);
-                tp->scoreboard_skb_hint = NULL;
                 if (skb == tp->retransmit_skb_hint)
                         tp->retransmit_skb_hint = NULL;
                 if (skb == tp->lost_skb_hint)
@@ -3092,6 +3054,10 @@ static int tcp_clean_rtx_queue(struct sock *sk, int prior_fackets,
         if (skb && (TCP_SKB_CB(skb)->sacked & TCPCB_SACKED_ACKED))
                 flag |= FLAG_SACK_RENEGING;
 
+        if (tcp_ack_update_rtt(sk, flag, seq_rtt, sack_rtt) ||
+            (flag & FLAG_ACKED))
+                tcp_rearm_rto(sk);
+
         if (flag & FLAG_ACKED) {
                 const struct tcp_congestion_ops *ca_ops
                         = inet_csk(sk)->icsk_ca_ops;
@@ -3101,9 +3067,6 @@ static int tcp_clean_rtx_queue(struct sock *sk, int prior_fackets,
                         tcp_mtup_probe_success(sk);
                 }
 
-                tcp_ack_update_rtt(sk, flag, seq_rtt);
-                tcp_rearm_rto(sk);
-
                 if (tcp_is_reno(tp)) {
                         tcp_remove_reno_sacks(sk, pkts_acked);
                 } else {
@@ -3191,11 +3154,22 @@ static inline bool tcp_ack_is_dubious(const struct sock *sk, const int flag)
                 inet_csk(sk)->icsk_ca_state != TCP_CA_Open;
 }
 
+/* Decide wheather to run the increase function of congestion control. */
 static inline bool tcp_may_raise_cwnd(const struct sock *sk, const int flag)
 {
-        const struct tcp_sock *tp = tcp_sk(sk);
-        return (!(flag & FLAG_ECE) || tp->snd_cwnd < tp->snd_ssthresh) &&
-                !tcp_in_cwnd_reduction(sk);
+        if (tcp_in_cwnd_reduction(sk))
+                return false;
+
+        /* If reordering is high then always grow cwnd whenever data is
+         * delivered regardless of its ordering. Otherwise stay conservative
+         * and only grow cwnd on in-order delivery (RFC5681). A stretched ACK w/
+         * new SACK or ECE mark may first advance cwnd here and later reduce
+         * cwnd in tcp_fastretrans_alert() based on more states.
+         */
+        if (tcp_sk(sk)->reordering > sysctl_tcp_reordering)
+                return flag & FLAG_FORWARD_PROGRESS;
+
+        return flag & FLAG_DATA_ACKED;
 }
 
 /* Check that window update is acceptable.
@@ -3330,12 +3304,12 @@ static int tcp_ack(struct sock *sk, const struct sk_buff *skb, int flag)
         u32 ack_seq = TCP_SKB_CB(skb)->seq;
         u32 ack = TCP_SKB_CB(skb)->ack_seq;
         bool is_dupack = false;
-        u32 prior_in_flight;
+        u32 prior_in_flight, prior_cwnd = tp->snd_cwnd, prior_rtt = tp->srtt;
         u32 prior_fackets;
         int prior_packets = tp->packets_out;
-        int prior_sacked = tp->sacked_out;
-        int pkts_acked = 0;
-        int previous_packets_out = 0;
+        const int prior_unsacked = tp->packets_out - tp->sacked_out;
+        int acked = 0; /* Number of packets newly acked */
+        s32 sack_rtt = -1;
 
         /* If the ack is older than previous acks
          * then we can probably ignore it.
@@ -3392,7 +3366,8 @@ static int tcp_ack(struct sock *sk, const struct sk_buff *skb, int flag)
                 flag |= tcp_ack_update_window(sk, skb, ack, ack_seq);
 
                 if (TCP_SKB_CB(skb)->sacked)
-                        flag |= tcp_sacktag_write_queue(sk, skb, prior_snd_una);
+                        flag |= tcp_sacktag_write_queue(sk, skb, prior_snd_una,
+                                                        &sack_rtt);
 
                 if (TCP_ECN_rcv_ecn_echo(tp, tcp_hdr(skb)))
                         flag |= FLAG_ECE;
@@ -3410,23 +3385,19 @@ static int tcp_ack(struct sock *sk, const struct sk_buff *skb, int flag)
                 goto no_queue;
 
         /* See if we can take anything off of the retransmit queue. */
-        previous_packets_out = tp->packets_out;
-        flag |= tcp_clean_rtx_queue(sk, prior_fackets, prior_snd_una);
+        acked = tp->packets_out;
+        flag |= tcp_clean_rtx_queue(sk, prior_fackets, prior_snd_una, sack_rtt);
+        acked -= tp->packets_out;
 
-        pkts_acked = previous_packets_out - tp->packets_out;
+        /* Advance cwnd if state allows */
+        if (tcp_may_raise_cwnd(sk, flag))
+                tcp_cong_avoid(sk, ack, prior_in_flight);
 
         if (tcp_ack_is_dubious(sk, flag)) {
-                /* Advance CWND, if state allows this. */
-                if ((flag & FLAG_DATA_ACKED) && tcp_may_raise_cwnd(sk, flag))
-                        tcp_cong_avoid(sk, ack, prior_in_flight);
                 is_dupack = !(flag & (FLAG_SND_UNA_ADVANCED | FLAG_NOT_DUP));
-                tcp_fastretrans_alert(sk, pkts_acked, prior_sacked,
-                                      prior_packets, is_dupack, flag);
-        } else {
-                if (flag & FLAG_DATA_ACKED)
-                        tcp_cong_avoid(sk, ack, prior_in_flight);
+                tcp_fastretrans_alert(sk, acked, prior_unsacked,
+                                      is_dupack, flag);
         }
-
         if (tp->tlp_high_seq)
                 tcp_process_tlp_ack(sk, ack, flag);
 
@@ -3438,13 +3409,15 @@ static int tcp_ack(struct sock *sk, const struct sk_buff *skb, int flag)
 
         if (icsk->icsk_pending == ICSK_TIME_RETRANS)
                 tcp_schedule_loss_probe(sk);
+        if (tp->srtt != prior_rtt || tp->snd_cwnd != prior_cwnd)
+                tcp_update_pacing_rate(sk);
         return 1;
 
 no_queue:
         /* If data was DSACKed, see if we can undo a cwnd reduction. */
         if (flag & FLAG_DSACKING_ACK)
-                tcp_fastretrans_alert(sk, pkts_acked, prior_sacked,
-                                      prior_packets, is_dupack, flag);
+                tcp_fastretrans_alert(sk, acked, prior_unsacked,
+                                      is_dupack, flag);
         /* If this ack opens up a zero window, clear backoff.  It was
          * being used to time the probes, and is probably far higher than
          * it needs to be for normal retransmission.
@@ -3465,9 +3438,10 @@ old_ack:
          * If data was DSACKed, see if we can undo a cwnd reduction.
          */
         if (TCP_SKB_CB(skb)->sacked) {
-                flag |= tcp_sacktag_write_queue(sk, skb, prior_snd_una);
-                tcp_fastretrans_alert(sk, pkts_acked, prior_sacked,
-                                      prior_packets, is_dupack, flag);
+                flag |= tcp_sacktag_write_queue(sk, skb, prior_snd_una,
+                                                &sack_rtt);
+                tcp_fastretrans_alert(sk, acked, prior_unsacked,
+                                      is_dupack, flag);
         }
 
         SOCK_DEBUG(sk, "Ack %u before %u:%u\n", ack, tp->snd_una, tp->snd_nxt);
@@ -3598,7 +3572,10 @@ static bool tcp_parse_aligned_timestamp(struct tcp_sock *tp, const struct tcphdr
                 ++ptr;
                 tp->rx_opt.rcv_tsval = ntohl(*ptr);
                 ++ptr;
-                tp->rx_opt.rcv_tsecr = ntohl(*ptr) - tp->tsoffset;
+                if (*ptr)
+                        tp->rx_opt.rcv_tsecr = ntohl(*ptr) - tp->tsoffset;
+                else
+                        tp->rx_opt.rcv_tsecr = 0;
                 return true;
         }
         return false;
@@ -3623,7 +3600,7 @@ static bool tcp_fast_parse_options(const struct sk_buff *skb,
         }
 
         tcp_parse_options(skb, &tp->rx_opt, 1, NULL);
-        if (tp->rx_opt.saw_tstamp)
+        if (tp->rx_opt.saw_tstamp && tp->rx_opt.rcv_tsecr)
                 tp->rx_opt.rcv_tsecr -= tp->tsoffset;
 
         return true;
@@ -3780,6 +3757,7 @@ void tcp_reset(struct sock *sk)
 static void tcp_fin(struct sock *sk)
 {
         struct tcp_sock *tp = tcp_sk(sk);
+        const struct dst_entry *dst;
 
         inet_csk_schedule_ack(sk);
 
@@ -3791,7 +3769,9 @@ static void tcp_fin(struct sock *sk)
         case TCP_ESTABLISHED:
                 /* Move to CLOSE_WAIT */
                 tcp_set_state(sk, TCP_CLOSE_WAIT);
-                inet_csk(sk)->icsk_ack.pingpong = 1;
+                dst = __sk_dst_get(sk);
+                if (!dst || !dst_metric(dst, RTAX_QUICKACK))
+                        inet_csk(sk)->icsk_ack.pingpong = 1;
                 break;
 
         case TCP_CLOSE_WAIT:
@@ -4159,6 +4139,7 @@ static void tcp_data_queue_ofo(struct sock *sk, struct sk_buff *skb)
                 if (!tcp_try_coalesce(sk, skb1, skb, &fragstolen)) {
                         __skb_queue_after(&tp->out_of_order_queue, skb1, skb);
                 } else {
+                        tcp_grow_window(sk, skb);
                         kfree_skb_partial(skb, fragstolen);
                         skb = NULL;
                 }
@@ -4234,8 +4215,10 @@ add_sack:
         if (tcp_is_sack(tp))
                 tcp_sack_new_ofo_skb(sk, seq, end_seq);
 end:
-        if (skb)
+        if (skb) {
+                tcp_grow_window(sk, skb);
                 skb_set_owner_r(skb, sk);
+        }
 }
 
 static int __must_check tcp_queue_rcv(struct sock *sk, struct sk_buff *skb, int hdrlen,
@@ -5070,8 +5053,8 @@ discard:
  *      the rest is checked inline. Fast processing is turned on in
  *      tcp_data_queue when everything is OK.
  */
-int tcp_rcv_established(struct sock *sk, struct sk_buff *skb,
-                        const struct tcphdr *th, unsigned int len)
+void tcp_rcv_established(struct sock *sk, struct sk_buff *skb,
+                         const struct tcphdr *th, unsigned int len)
 {
         struct tcp_sock *tp = tcp_sk(sk);
 
@@ -5148,7 +5131,7 @@ int tcp_rcv_established(struct sock *sk, struct sk_buff *skb,
                                 tcp_ack(sk, skb, 0);
                                 __kfree_skb(skb);
                                 tcp_data_snd_check(sk);
-                                return 0;
+                                return;
                         } else { /* Header too small */
                                 TCP_INC_STATS_BH(sock_net(sk), TCP_MIB_INERRS);
                                 goto discard;
@@ -5241,7 +5224,7 @@ no_ack:
                         if (eaten)
                                 kfree_skb_partial(skb, fragstolen);
                         sk->sk_data_ready(sk, 0);
-                        return 0;
+                        return;
                 }
         }
 
@@ -5257,7 +5240,7 @@ slow_path:
          */
 
         if (!tcp_validate_incoming(sk, skb, th, 1))
-                return 0;
+                return;
 
 step5:
         if (tcp_ack(sk, skb, FLAG_SLOWPATH | FLAG_UPDATE_TS_RECENT) < 0)
@@ -5273,7 +5256,7 @@ step5:
 
         tcp_data_snd_check(sk);
         tcp_ack_snd_check(sk);
-        return 0;
+        return;
 
 csum_error:
         TCP_INC_STATS_BH(sock_net(sk), TCP_MIB_CSUMERRORS);
@@ -5281,7 +5264,6 @@ csum_error:
 
 discard:
         __kfree_skb(skb);
-        return 0;
 }
 EXPORT_SYMBOL(tcp_rcv_established);
 
@@ -5376,7 +5358,7 @@ static int tcp_rcv_synsent_state_process(struct sock *sk, struct sk_buff *skb,
         int saved_clamp = tp->rx_opt.mss_clamp;
 
         tcp_parse_options(skb, &tp->rx_opt, 0, &foc);
-        if (tp->rx_opt.saw_tstamp)
+        if (tp->rx_opt.saw_tstamp && tp->rx_opt.rcv_tsecr)
                 tp->rx_opt.rcv_tsecr -= tp->tsoffset;
 
         if (th->ack) {
@@ -5601,6 +5583,7 @@ int tcp_rcv_state_process(struct sock *sk, struct sk_buff *skb,
         struct inet_connection_sock *icsk = inet_csk(sk);
         struct request_sock *req;
         int queued = 0;
+        bool acceptable;
 
         tp->rx_opt.saw_tstamp = 0;
 
@@ -5671,157 +5654,146 @@ int tcp_rcv_state_process(struct sock *sk, struct sk_buff *skb,
                 return 0;
 
         /* step 5: check the ACK field */
-        if (true) {
-                int acceptable = tcp_ack(sk, skb, FLAG_SLOWPATH |
-                                                  FLAG_UPDATE_TS_RECENT) > 0;
-
-                switch (sk->sk_state) {
-                case TCP_SYN_RECV:
-                        if (acceptable) {
-                                /* Once we leave TCP_SYN_RECV, we no longer
-                                 * need req so release it.
-                                 */
-                                if (req) {
-                                        tcp_synack_rtt_meas(sk, req);
-                                        tp->total_retrans = req->num_retrans;
-
-                                        reqsk_fastopen_remove(sk, req, false);
-                                } else {
-                                        /* Make sure socket is routed, for
-                                         * correct metrics.
-                                         */
-                                        icsk->icsk_af_ops->rebuild_header(sk);
-                                        tcp_init_congestion_control(sk);
+        acceptable = tcp_ack(sk, skb, FLAG_SLOWPATH |
+                                      FLAG_UPDATE_TS_RECENT) > 0;
 
-                                        tcp_mtup_init(sk);
-                                        tcp_init_buffer_space(sk);
-                                        tp->copied_seq = tp->rcv_nxt;
-                                }
-                                smp_mb();
-                                tcp_set_state(sk, TCP_ESTABLISHED);
-                                sk->sk_state_change(sk);
-
-                                /* Note, that this wakeup is only for marginal
-                                 * crossed SYN case. Passively open sockets
-                                 * are not waked up, because sk->sk_sleep ==
-                                 * NULL and sk->sk_socket == NULL.
-                                 */
-                                if (sk->sk_socket)
-                                        sk_wake_async(sk,
-                                                      SOCK_WAKE_IO, POLL_OUT);
-
-                                tp->snd_una = TCP_SKB_CB(skb)->ack_seq;
-                                tp->snd_wnd = ntohs(th->window) <<
-                                              tp->rx_opt.snd_wscale;
-                                tcp_init_wl(tp, TCP_SKB_CB(skb)->seq);
-
-                                if (tp->rx_opt.tstamp_ok)
-                                        tp->advmss -= TCPOLEN_TSTAMP_ALIGNED;
-
-                                if (req) {
-                                        /* Re-arm the timer because data may
-                                         * have been sent out. This is similar
-                                         * to the regular data transmission case
-                                         * when new data has just been ack'ed.
-                                         *
-                                         * (TFO) - we could try to be more
-                                         * aggressive and retranmitting any data
-                                         * sooner based on when they were sent
-                                         * out.
-                                         */
-                                        tcp_rearm_rto(sk);
-                                } else
-                                        tcp_init_metrics(sk);
+        switch (sk->sk_state) {
+        case TCP_SYN_RECV:
+                if (!acceptable)
+                        return 1;
 
-                                /* Prevent spurious tcp_cwnd_restart() on
-                                 * first data packet.
-                                 */
-                                tp->lsndtime = tcp_time_stamp;
+                /* Once we leave TCP_SYN_RECV, we no longer need req
+                 * so release it.
+                 */
+                if (req) {
+                        tp->total_retrans = req->num_retrans;
+                        reqsk_fastopen_remove(sk, req, false);
+                } else {
+                        /* Make sure socket is routed, for correct metrics. */
+                        icsk->icsk_af_ops->rebuild_header(sk);
+                        tcp_init_congestion_control(sk);
 
-                                tcp_initialize_rcv_mss(sk);
-                                tcp_fast_path_on(tp);
-                        } else {
-                                return 1;
-                        }
-                        break;
+                        tcp_mtup_init(sk);
+                        tcp_init_buffer_space(sk);
+                        tp->copied_seq = tp->rcv_nxt;
+                }
+                smp_mb();
+                tcp_set_state(sk, TCP_ESTABLISHED);
+                sk->sk_state_change(sk);
+
+                /* Note, that this wakeup is only for marginal crossed SYN case.
+                 * Passively open sockets are not waked up, because
+                 * sk->sk_sleep == NULL and sk->sk_socket == NULL.
+                 */
+                if (sk->sk_socket)
+                        sk_wake_async(sk, SOCK_WAKE_IO, POLL_OUT);
+
+                tp->snd_una = TCP_SKB_CB(skb)->ack_seq;
+                tp->snd_wnd = ntohs(th->window) << tp->rx_opt.snd_wscale;
+                tcp_init_wl(tp, TCP_SKB_CB(skb)->seq);
+                tcp_synack_rtt_meas(sk, req);
+
+                if (tp->rx_opt.tstamp_ok)
+                        tp->advmss -= TCPOLEN_TSTAMP_ALIGNED;
 
-                case TCP_FIN_WAIT1:
-                        /* If we enter the TCP_FIN_WAIT1 state and we are a
-                         * Fast Open socket and this is the first acceptable
-                         * ACK we have received, this would have acknowledged
-                         * our SYNACK so stop the SYNACK timer.
+                if (req) {
+                        /* Re-arm the timer because data may have been sent out.
+                         * This is similar to the regular data transmission case
+                         * when new data has just been ack'ed.
+                         *
+                         * (TFO) - we could try to be more aggressive and
+                         * retransmitting any data sooner based on when they
+                         * are sent out.
                          */
-                        if (req != NULL) {
-                                /* Return RST if ack_seq is invalid.
-                                 * Note that RFC793 only says to generate a
-                                 * DUPACK for it but for TCP Fast Open it seems
-                                 * better to treat this case like TCP_SYN_RECV
-                                 * above.
-                                 */
-                                if (!acceptable)
-                                        return 1;
-                                /* We no longer need the request sock. */
-                                reqsk_fastopen_remove(sk, req, false);
-                                tcp_rearm_rto(sk);
-                        }
-                        if (tp->snd_una == tp->write_seq) {
-                                struct dst_entry *dst;
-
-                                tcp_set_state(sk, TCP_FIN_WAIT2);
-                                sk->sk_shutdown |= SEND_SHUTDOWN;
-
-                                dst = __sk_dst_get(sk);
-                                if (dst)
-                                        dst_confirm(dst);
-
-                                if (!sock_flag(sk, SOCK_DEAD))
-                                        /* Wake up lingering close() */
-                                        sk->sk_state_change(sk);
-                                else {
-                                        int tmo;
-
-                                        if (tp->linger2 < 0 ||
-                                            (TCP_SKB_CB(skb)->end_seq != TCP_SKB_CB(skb)->seq &&
-                                             after(TCP_SKB_CB(skb)->end_seq - th->fin, tp->rcv_nxt))) {
-                                                tcp_done(sk);
-                                                NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_TCPABORTONDATA);
-                                                return 1;
-                                        }
+                        tcp_rearm_rto(sk);
+                } else
+                        tcp_init_metrics(sk);
 
-                                        tmo = tcp_fin_time(sk);
-                                        if (tmo > TCP_TIMEWAIT_LEN) {
-                                                inet_csk_reset_keepalive_timer(sk, tmo - TCP_TIMEWAIT_LEN);
-                                        } else if (th->fin || sock_owned_by_user(sk)) {
-                                                /* Bad case. We could lose such FIN otherwise.
-                                                 * It is not a big problem, but it looks confusing
-                                                 * and not so rare event. We still can lose it now,
-                                                 * if it spins in bh_lock_sock(), but it is really
-                                                 * marginal case.
-                                                 */
-                                                inet_csk_reset_keepalive_timer(sk, tmo);
-                                        } else {
-                                                tcp_time_wait(sk, TCP_FIN_WAIT2, tmo);
-                                                goto discard;
-                                        }
-                                }
-                        }
-                        break;
+                /* Prevent spurious tcp_cwnd_restart() on first data packet */
+                tp->lsndtime = tcp_time_stamp;
 
-                case TCP_CLOSING:
-                        if (tp->snd_una == tp->write_seq) {
-                                tcp_time_wait(sk, TCP_TIME_WAIT, 0);
-                                goto discard;
-                        }
+                tcp_initialize_rcv_mss(sk);
+                tcp_fast_path_on(tp);
+                break;
+
+        case TCP_FIN_WAIT1: {
+                struct dst_entry *dst;
+                int tmo;
+
+                /* If we enter the TCP_FIN_WAIT1 state and we are a
+                 * Fast Open socket and this is the first acceptable
+                 * ACK we have received, this would have acknowledged
+                 * our SYNACK so stop the SYNACK timer.
+                 */
+                if (req != NULL) {
+                        /* Return RST if ack_seq is invalid.
+                         * Note that RFC793 only says to generate a
+                         * DUPACK for it but for TCP Fast Open it seems
+                         * better to treat this case like TCP_SYN_RECV
+                         * above.
+                         */
+                        if (!acceptable)
+                                return 1;
+                        /* We no longer need the request sock. */
+                        reqsk_fastopen_remove(sk, req, false);
+                        tcp_rearm_rto(sk);
+                }
+                if (tp->snd_una != tp->write_seq)
                         break;
 
-                case TCP_LAST_ACK:
-                        if (tp->snd_una == tp->write_seq) {
-                                tcp_update_metrics(sk);
-                                tcp_done(sk);
-                                goto discard;
-                        }
+                tcp_set_state(sk, TCP_FIN_WAIT2);
+                sk->sk_shutdown |= SEND_SHUTDOWN;
+
+                dst = __sk_dst_get(sk);
+                if (dst)
+                        dst_confirm(dst);
+
+                if (!sock_flag(sk, SOCK_DEAD)) {
+                        /* Wake up lingering close() */
+                        sk->sk_state_change(sk);
                         break;
                 }
+
+                if (tp->linger2 < 0 ||
+                    (TCP_SKB_CB(skb)->end_seq != TCP_SKB_CB(skb)->seq &&
+                     after(TCP_SKB_CB(skb)->end_seq - th->fin, tp->rcv_nxt))) {
+                        tcp_done(sk);
+                        NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_TCPABORTONDATA);
+                        return 1;
+                }
+
+                tmo = tcp_fin_time(sk);
+                if (tmo > TCP_TIMEWAIT_LEN) {
+                        inet_csk_reset_keepalive_timer(sk, tmo - TCP_TIMEWAIT_LEN);
+                } else if (th->fin || sock_owned_by_user(sk)) {
+                        /* Bad case. We could lose such FIN otherwise.
+                         * It is not a big problem, but it looks confusing
+                         * and not so rare event. We still can lose it now,
+                         * if it spins in bh_lock_sock(), but it is really
+                         * marginal case.
+                         */
+                        inet_csk_reset_keepalive_timer(sk, tmo);
+                } else {
+                        tcp_time_wait(sk, TCP_FIN_WAIT2, tmo);
+                        goto discard;
+                }
+                break;
+        }
+
+        case TCP_CLOSING:
+                if (tp->snd_una == tp->write_seq) {
+                        tcp_time_wait(sk, TCP_TIME_WAIT, 0);
+                        goto discard;
+                }
+                break;
+
+        case TCP_LAST_ACK:
+                if (tp->snd_una == tp->write_seq) {
+                        tcp_update_metrics(sk);
+                        tcp_done(sk);
+                        goto discard;
+                }
+                break;
         }
 
         /* step 6: check the URG bit */
diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
index 719652305a29..b14266bb91eb 100644
--- a/net/ipv4/tcp_ipv4.c
+++ b/net/ipv4/tcp_ipv4.c
@@ -75,6 +75,7 @@
 #include <net/netdma.h>
 #include <net/secure_seq.h>
 #include <net/tcp_memcontrol.h>
+#include <net/busy_poll.h>
 
 #include <linux/inet.h>
 #include <linux/ipv6.h>
@@ -545,8 +546,7 @@ out:
         sock_put(sk);
 }
 
-static void __tcp_v4_send_check(struct sk_buff *skb,
-                                __be32 saddr, __be32 daddr)
+void __tcp_v4_send_check(struct sk_buff *skb, __be32 saddr, __be32 daddr)
 {
         struct tcphdr *th = tcp_hdr(skb);
 
@@ -571,23 +571,6 @@ void tcp_v4_send_check(struct sock *sk, struct sk_buff *skb)
 }
 EXPORT_SYMBOL(tcp_v4_send_check);
 
-int tcp_v4_gso_send_check(struct sk_buff *skb)
-{
-        const struct iphdr *iph;
-        struct tcphdr *th;
-
-        if (!pskb_may_pull(skb, sizeof(*th)))
-                return -EINVAL;
-
-        iph = ip_hdr(skb);
-        th = tcp_hdr(skb);
-
-        th->check = 0;
-        skb->ip_summed = CHECKSUM_PARTIAL;
-        __tcp_v4_send_check(skb, iph->saddr, iph->daddr);
-        return 0;
-}
-
 /*
  *      This routine will send an RST to the other tcp.
  *
@@ -838,8 +821,7 @@ static void tcp_v4_reqsk_send_ack(struct sock *sk, struct sk_buff *skb,
  */
 static int tcp_v4_send_synack(struct sock *sk, struct dst_entry *dst,
                               struct request_sock *req,
-                              u16 queue_mapping,
-                              bool nocache)
+                              u16 queue_mapping)
 {
         const struct inet_request_sock *ireq = inet_rsk(req);
         struct flowi4 fl4;
@@ -869,7 +851,7 @@ static int tcp_v4_send_synack(struct sock *sk, struct dst_entry *dst,
 
 static int tcp_v4_rtx_synack(struct sock *sk, struct request_sock *req)
 {
-        int res = tcp_v4_send_synack(sk, NULL, req, 0, false);
+        int res = tcp_v4_send_synack(sk, NULL, req, 0);
 
         if (!res)
                 TCP_INC_STATS_BH(sock_net(sk), TCP_MIB_RETRANSSEGS);
@@ -907,7 +889,7 @@ bool tcp_syn_flood_action(struct sock *sk,
                 NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_TCPREQQFULLDROP);
 
         lopt = inet_csk(sk)->icsk_accept_queue.listen_opt;
-        if (!lopt->synflood_warned) {
+        if (!lopt->synflood_warned && sysctl_tcp_syncookies != 2) {
                 lopt->synflood_warned = 1;
                 pr_info("%s: Possible SYN flooding on port %d. %s.  Check SNMP counters.\n",
                         proto, ntohs(tcp_hdr(skb)->dest), msg);
@@ -1003,7 +985,7 @@ int tcp_md5_do_add(struct sock *sk, const union tcp_md5_addr *addr,
         struct tcp_sock *tp = tcp_sk(sk);
         struct tcp_md5sig_info *md5sig;
 
-        key = tcp_md5_do_lookup(sk, (union tcp_md5_addr *)&addr, AF_INET);
+        key = tcp_md5_do_lookup(sk, addr, family);
         if (key) {
                 /* Pre-existing entry - just update that one. */
                 memcpy(key->key, newkey, newkeylen);
@@ -1026,7 +1008,7 @@ int tcp_md5_do_add(struct sock *sk, const union tcp_md5_addr *addr,
         key = sock_kmalloc(sk, sizeof(*key), gfp);
         if (!key)
                 return -ENOMEM;
-        if (hlist_empty(&md5sig->head) && !tcp_alloc_md5sig_pool(sk)) {
+        if (!tcp_alloc_md5sig_pool()) {
                 sock_kfree_s(sk, key, sizeof(*key));
                 return -ENOMEM;
         }
@@ -1044,20 +1026,14 @@ EXPORT_SYMBOL(tcp_md5_do_add);
 
 int tcp_md5_do_del(struct sock *sk, const union tcp_md5_addr *addr, int family)
 {
-        struct tcp_sock *tp = tcp_sk(sk);
         struct tcp_md5sig_key *key;
-        struct tcp_md5sig_info *md5sig;
 
-        key = tcp_md5_do_lookup(sk, (union tcp_md5_addr *)&addr, AF_INET);
+        key = tcp_md5_do_lookup(sk, addr, family);
         if (!key)
                 return -ENOENT;
         hlist_del_rcu(&key->node);
         atomic_sub(sizeof(*key), &sk->sk_omem_alloc);
         kfree_rcu(key, rcu);
-        md5sig = rcu_dereference_protected(tp->md5sig_info,
-                                           sock_owned_by_user(sk));
-        if (hlist_empty(&md5sig->head))
-                tcp_free_md5sig_pool();
         return 0;
 }
 EXPORT_SYMBOL(tcp_md5_do_del);
@@ -1071,8 +1047,6 @@ static void tcp_clear_md5_list(struct sock *sk)
 
         md5sig = rcu_dereference_protected(tp->md5sig_info, 1);
 
-        if (!hlist_empty(&md5sig->head))
-                tcp_free_md5sig_pool();
         hlist_for_each_entry_safe(key, n, &md5sig->head, node) {
                 hlist_del_rcu(&key->node);
                 atomic_sub(sizeof(*key), &sk->sk_omem_alloc);
@@ -1341,9 +1315,11 @@ static bool tcp_fastopen_check(struct sock *sk, struct sk_buff *skb,
                 tcp_rsk(req)->rcv_nxt = TCP_SKB_CB(skb)->end_seq;
                 return true;
         }
+
         if (foc->len == TCP_FASTOPEN_COOKIE_SIZE) {
                 if ((sysctl_tcp_fastopen & TFO_SERVER_COOKIE_NOT_CHKED) == 0) {
-                        tcp_fastopen_cookie_gen(ip_hdr(skb)->saddr, valid_foc);
+                        tcp_fastopen_cookie_gen(ip_hdr(skb)->saddr,
+                                                ip_hdr(skb)->daddr, valid_foc);
                         if ((valid_foc->len != TCP_FASTOPEN_COOKIE_SIZE) ||
                             memcmp(&foc->val[0], &valid_foc->val[0],
                             TCP_FASTOPEN_COOKIE_SIZE) != 0)
@@ -1354,14 +1330,16 @@ static bool tcp_fastopen_check(struct sock *sk, struct sk_buff *skb,
                 tcp_rsk(req)->rcv_nxt = TCP_SKB_CB(skb)->end_seq;
                 return true;
         } else if (foc->len == 0) { /* Client requesting a cookie */
-                tcp_fastopen_cookie_gen(ip_hdr(skb)->saddr, valid_foc);
+                tcp_fastopen_cookie_gen(ip_hdr(skb)->saddr,
+                                        ip_hdr(skb)->daddr, valid_foc);
                 NET_INC_STATS_BH(sock_net(sk),
                     LINUX_MIB_TCPFASTOPENCOOKIEREQD);
         } else {
                 /* Client sent a cookie with wrong size. Treat it
                  * the same as invalid and return a valid one.
                  */
-                tcp_fastopen_cookie_gen(ip_hdr(skb)->saddr, valid_foc);
+                tcp_fastopen_cookie_gen(ip_hdr(skb)->saddr,
+                                        ip_hdr(skb)->daddr, valid_foc);
         }
         return false;
 }
@@ -1487,7 +1465,8 @@ int tcp_v4_conn_request(struct sock *sk, struct sk_buff *skb)
          * limitations, they conserve resources and peer is
          * evidently real one.
          */
-        if (inet_csk_reqsk_queue_is_full(sk) && !isn) {
+        if ((sysctl_tcp_syncookies == 2 ||
+             inet_csk_reqsk_queue_is_full(sk)) && !isn) {
                 want_cookie = tcp_syn_flood_action(sk, skb, "TCP");
                 if (!want_cookie)
                         goto drop;
@@ -1696,8 +1675,6 @@ struct sock *tcp_v4_syn_recv_sock(struct sock *sk, struct sk_buff *skb,
                 newtp->advmss = tcp_sk(sk)->rx_opt.user_mss;
 
         tcp_initialize_rcv_mss(newsk);
-        tcp_synack_rtt_meas(newsk, req);
-        newtp->total_retrans = req->num_retrans;
 
 #ifdef CONFIG_TCP_MD5SIG
         /* Copy over the MD5 key from the original socket */
@@ -1822,10 +1799,7 @@ int tcp_v4_do_rcv(struct sock *sk, struct sk_buff *skb)
                                 sk->sk_rx_dst = NULL;
                         }
                 }
-                if (tcp_rcv_established(sk, skb, tcp_hdr(skb), skb->len)) {
-                        rsk = sk;
-                        goto reset;
-                }
+                tcp_rcv_established(sk, skb, tcp_hdr(skb), skb->len);
                 return 0;
         }
 
@@ -2019,6 +1993,7 @@ process:
         if (sk_filter(sk, skb))
                 goto discard_and_relse;
 
+        sk_mark_napi_id(sk, skb);
         skb->dev = NULL;
 
         bh_lock_sock_nested(sk);
@@ -2629,7 +2604,7 @@ static void get_openreq4(const struct sock *sk, const struct request_sock *req,
         long delta = req->expires - jiffies;
 
         seq_printf(f, "%4d: %08X:%04X %08X:%04X"
-                " %02X %08X:%08X %02X:%08lX %08X %5d %8d %u %d %pK%n",
+                " %02X %08X:%08X %02X:%08lX %08X %5u %8d %u %d %pK%n",
                 i,
                 ireq->loc_addr,
                 ntohs(inet_sk(sk)->inet_sport),
@@ -2687,7 +2662,7 @@ static void get_tcp4_sock(struct sock *sk, struct seq_file *f, int i, int *len)
                 rx_queue = max_t(int, tp->rcv_nxt - tp->copied_seq, 0);
 
         seq_printf(f, "%4d: %08X:%04X %08X:%04X %02X %08X:%08X %02X:%08lX "
-                        "%08X %5d %8d %lu %d %pK %lu %lu %u %u %d%n",
+                        "%08X %5u %8d %lu %d %pK %lu %lu %u %u %d%n",
                 i, src, srcp, dest, destp, sk->sk_state,
                 tp->write_seq - tp->snd_una,
                 rx_queue,
@@ -2803,52 +2778,6 @@ void tcp4_proc_exit(void)
 }
 #endif /* CONFIG_PROC_FS */
 
-struct sk_buff **tcp4_gro_receive(struct sk_buff **head, struct sk_buff *skb)
-{
-        const struct iphdr *iph = skb_gro_network_header(skb);
-        __wsum wsum;
-        __sum16 sum;
-
-        switch (skb->ip_summed) {
-        case CHECKSUM_COMPLETE:
-                if (!tcp_v4_check(skb_gro_len(skb), iph->saddr, iph->daddr,
-                                  skb->csum)) {
-                        skb->ip_summed = CHECKSUM_UNNECESSARY;
-                        break;
-                }
-flush:
-                NAPI_GRO_CB(skb)->flush = 1;
-                return NULL;
-
-        case CHECKSUM_NONE:
-                wsum = csum_tcpudp_nofold(iph->saddr, iph->daddr,
-                                          skb_gro_len(skb), IPPROTO_TCP, 0);
-                sum = csum_fold(skb_checksum(skb,
-                                             skb_gro_offset(skb),
-                                             skb_gro_len(skb),
-                                             wsum));
-                if (sum)
-                        goto flush;
-
-                skb->ip_summed = CHECKSUM_UNNECESSARY;
-                break;
-        }
-
-        return tcp_gro_receive(head, skb);
-}
-
-int tcp4_gro_complete(struct sk_buff *skb)
-{
-        const struct iphdr *iph = ip_hdr(skb);
-        struct tcphdr *th = tcp_hdr(skb);
-
-        th->check = ~tcp_v4_check(skb->len - skb_transport_offset(skb),
-                                  iph->saddr, iph->daddr, 0);
-        skb_shinfo(skb)->gso_type = SKB_GSO_TCPV4;
-
-        return tcp_gro_complete(skb);
-}
-
 struct proto tcp_prot = {
         .name                   = "TCP",
         .owner                  = THIS_MODULE,
@@ -2872,6 +2801,7 @@ struct proto tcp_prot = {
         .unhash                 = inet_unhash,
         .get_port               = inet_csk_get_port,
         .enter_memory_pressure  = tcp_enter_memory_pressure,
+        .stream_memory_free     = tcp_stream_memory_free,
         .sockets_allocated      = &tcp_sockets_allocated,
         .orphan_count           = &tcp_orphan_count,
         .memory_allocated       = &tcp_memory_allocated,
diff --git a/net/ipv4/tcp_memcontrol.c b/net/ipv4/tcp_memcontrol.c
index da14436c1735..559d4ae6ebf4 100644
--- a/net/ipv4/tcp_memcontrol.c
+++ b/net/ipv4/tcp_memcontrol.c
@@ -87,8 +87,8 @@ static int tcp_update_limit(struct mem_cgroup *memcg, u64 val)
         if (!cg_proto)
                 return -EINVAL;
 
-        if (val > RESOURCE_MAX)
-                val = RESOURCE_MAX;
+        if (val > RES_COUNTER_MAX)
+                val = RES_COUNTER_MAX;
 
         tcp = tcp_from_cgproto(cg_proto);
 
@@ -101,9 +101,9 @@ static int tcp_update_limit(struct mem_cgroup *memcg, u64 val)
                 tcp->tcp_prot_mem[i] = min_t(long, val >> PAGE_SHIFT,
                                              net->ipv4.sysctl_tcp_mem[i]);
 
-        if (val == RESOURCE_MAX)
+        if (val == RES_COUNTER_MAX)
                 clear_bit(MEMCG_SOCK_ACTIVE, &cg_proto->flags);
-        else if (val != RESOURCE_MAX) {
+        else if (val != RES_COUNTER_MAX) {
                 /*
                  * The active bit needs to be written after the static_key
                  * update. This is what guarantees that the socket activation
@@ -132,10 +132,10 @@ static int tcp_update_limit(struct mem_cgroup *memcg, u64 val)
         return 0;
 }
 
-static int tcp_cgroup_write(struct cgroup *cont, struct cftype *cft,
+static int tcp_cgroup_write(struct cgroup_subsys_state *css, struct cftype *cft,
                             const char *buffer)
 {
-        struct mem_cgroup *memcg = mem_cgroup_from_cont(cont);
+        struct mem_cgroup *memcg = mem_cgroup_from_css(css);
         unsigned long long val;
         int ret = 0;
 
@@ -180,14 +180,14 @@ static u64 tcp_read_usage(struct mem_cgroup *memcg)
         return res_counter_read_u64(&tcp->tcp_memory_allocated, RES_USAGE);
 }
 
-static u64 tcp_cgroup_read(struct cgroup *cont, struct cftype *cft)
+static u64 tcp_cgroup_read(struct cgroup_subsys_state *css, struct cftype *cft)
 {
-        struct mem_cgroup *memcg = mem_cgroup_from_cont(cont);
+        struct mem_cgroup *memcg = mem_cgroup_from_css(css);
         u64 val;
 
         switch (cft->private) {
         case RES_LIMIT:
-                val = tcp_read_stat(memcg, RES_LIMIT, RESOURCE_MAX);
+                val = tcp_read_stat(memcg, RES_LIMIT, RES_COUNTER_MAX);
                 break;
         case RES_USAGE:
                 val = tcp_read_usage(memcg);
@@ -202,13 +202,13 @@ static u64 tcp_cgroup_read(struct cgroup *cont, struct cftype *cft)
         return val;
 }
 
-static int tcp_cgroup_reset(struct cgroup *cont, unsigned int event)
+static int tcp_cgroup_reset(struct cgroup_subsys_state *css, unsigned int event)
 {
         struct mem_cgroup *memcg;
         struct tcp_memcontrol *tcp;
         struct cg_proto *cg_proto;
 
-        memcg = mem_cgroup_from_cont(cont);
+        memcg = mem_cgroup_from_css(css);
         cg_proto = tcp_prot.proto_cgroup(memcg);
         if (!cg_proto)
                 return 0;
diff --git a/net/ipv4/tcp_metrics.c b/net/ipv4/tcp_metrics.c
index f6a005c485a9..52f3c6b971d2 100644
--- a/net/ipv4/tcp_metrics.c
+++ b/net/ipv4/tcp_metrics.c
@@ -443,7 +443,7 @@ void tcp_init_metrics(struct sock *sk)
         struct dst_entry *dst = __sk_dst_get(sk);
         struct tcp_sock *tp = tcp_sk(sk);
         struct tcp_metrics_block *tm;
-        u32 val;
+        u32 val, crtt = 0; /* cached RTT scaled by 8 */
 
         if (dst == NULL)
                 goto reset;
@@ -478,15 +478,19 @@ void tcp_init_metrics(struct sock *sk)
                 tp->reordering = val;
         }
 
-        val = tcp_metric_get(tm, TCP_METRIC_RTT);
-        if (val == 0 || tp->srtt == 0) {
-                rcu_read_unlock();
-                goto reset;
-        }
-        /* Initial rtt is determined from SYN,SYN-ACK.
-         * The segment is small and rtt may appear much
-         * less than real one. Use per-dst memory
-         * to make it more realistic.
+        crtt = tcp_metric_get_jiffies(tm, TCP_METRIC_RTT);
+        rcu_read_unlock();
+reset:
+        /* The initial RTT measurement from the SYN/SYN-ACK is not ideal
+         * to seed the RTO for later data packets because SYN packets are
+         * small. Use the per-dst cached values to seed the RTO but keep
+         * the RTT estimator variables intact (e.g., srtt, mdev, rttvar).
+         * Later the RTO will be updated immediately upon obtaining the first
+         * data RTT sample (tcp_rtt_estimator()). Hence the cached RTT only
+         * influences the first RTO but not later RTT estimation.
+         *
+         * But if RTT is not available from the SYN (due to retransmits or
+         * syn cookies) or the cache, force a conservative 3secs timeout.
          *
          * A bit of theory. RTT is time passed after "normal" sized packet
          * is sent until it is ACKed. In normal circumstances sending small
@@ -497,21 +501,11 @@ void tcp_init_metrics(struct sock *sk)
          * to low value, and then abruptly stops to do it and starts to delay
          * ACKs, wait for troubles.
          */
-        val = msecs_to_jiffies(val);
-        if (val > tp->srtt) {
-                tp->srtt = val;
-                tp->rtt_seq = tp->snd_nxt;
-        }
-        val = tcp_metric_get_jiffies(tm, TCP_METRIC_RTTVAR);
-        if (val > tp->mdev) {
-                tp->mdev = val;
-                tp->mdev_max = tp->rttvar = max(tp->mdev, tcp_rto_min(sk));
-        }
-        rcu_read_unlock();
-
-        tcp_set_rto(sk);
-reset:
-        if (tp->srtt == 0) {
+        if (crtt > tp->srtt) {
+                /* Set RTO like tcp_rtt_estimator(), but from cached RTT. */
+                crtt >>= 3;
+                inet_csk(sk)->icsk_rto = crtt + max(2 * crtt, tcp_rto_min(sk));
+        } else if (tp->srtt == 0) {
                 /* RFC6298: 5.7 We've failed to get a valid RTT sample from
                  * 3WHS. This is most likely due to retransmission,
                  * including spurious one. Reset the RTO back to 3secs
diff --git a/net/ipv4/tcp_minisocks.c b/net/ipv4/tcp_minisocks.c
index 0f0178827259..58a3e69aef64 100644
--- a/net/ipv4/tcp_minisocks.c
+++ b/net/ipv4/tcp_minisocks.c
@@ -317,7 +317,7 @@ void tcp_time_wait(struct sock *sk, int state, int timeo)
                         key = tp->af_specific->md5_lookup(sk, sk);
                         if (key != NULL) {
                                 tcptw->tw_md5_key = kmemdup(key, sizeof(*key), GFP_ATOMIC);
-                                if (tcptw->tw_md5_key && tcp_alloc_md5sig_pool(sk) == NULL)
+                                if (tcptw->tw_md5_key && !tcp_alloc_md5sig_pool())
                                         BUG();
                         }
                 } while (0);
@@ -358,10 +358,8 @@ void tcp_twsk_destructor(struct sock *sk)
 #ifdef CONFIG_TCP_MD5SIG
         struct tcp_timewait_sock *twsk = tcp_twsk(sk);
 
-        if (twsk->tw_md5_key) {
-                tcp_free_md5sig_pool();
+        if (twsk->tw_md5_key)
                 kfree_rcu(twsk->tw_md5_key, rcu);
-        }
 #endif
 }
 EXPORT_SYMBOL_GPL(tcp_twsk_destructor);
@@ -413,6 +411,8 @@ struct sock *tcp_create_openreq_child(struct sock *sk, struct request_sock *req,
                 newtp->snd_ssthresh = TCP_INFINITE_SSTHRESH;
                 tcp_enable_early_retrans(newtp);
                 newtp->tlp_high_seq = 0;
+                newtp->lsndtime = treq->snt_synack;
+                newtp->total_retrans = req->num_retrans;
 
                 /* So many TCP implementations out there (incorrectly) count the
                  * initial SYN frame in their delayed-ACK and congestion control
@@ -668,12 +668,6 @@ struct sock *tcp_check_req(struct sock *sk, struct sk_buff *skb,
         if (!(flg & TCP_FLAG_ACK))
                 return NULL;
 
-        /* Got ACK for our SYNACK, so update baseline for SYNACK RTT sample. */
-        if (tmp_opt.saw_tstamp && tmp_opt.rcv_tsecr)
-                tcp_rsk(req)->snt_synack = tmp_opt.rcv_tsecr;
-        else if (req->num_retrans) /* don't take RTT sample if retrans && ~TS */
-                tcp_rsk(req)->snt_synack = 0;
-
         /* For Fast Open no more processing is needed (sk is the
          * child socket).
          */
diff --git a/net/ipv4/tcp_offload.c b/net/ipv4/tcp_offload.c
new file mode 100644
index 000000000000..3a7525e6c086
--- /dev/null
+++ b/net/ipv4/tcp_offload.c
@@ -0,0 +1,332 @@
+/*
+ *      IPV4 GSO/GRO offload support
+ *      Linux INET implementation
+ *
+ *      This program is free software; you can redistribute it and/or
+ *      modify it under the terms of the GNU General Public License
+ *      as published by the Free Software Foundation; either version
+ *      2 of the License, or (at your option) any later version.
+ *
+ *      TCPv4 GSO/GRO support
+ */
+
+#include <linux/skbuff.h>
+#include <net/tcp.h>
+#include <net/protocol.h>
+
+struct sk_buff *tcp_tso_segment(struct sk_buff *skb,
+                                netdev_features_t features)
+{
+        struct sk_buff *segs = ERR_PTR(-EINVAL);
+        struct tcphdr *th;
+        unsigned int thlen;
+        unsigned int seq;
+        __be32 delta;
+        unsigned int oldlen;
+        unsigned int mss;
+        struct sk_buff *gso_skb = skb;
+        __sum16 newcheck;
+        bool ooo_okay, copy_destructor;
+
+        if (!pskb_may_pull(skb, sizeof(*th)))
+                goto out;
+
+        th = tcp_hdr(skb);
+        thlen = th->doff * 4;
+        if (thlen < sizeof(*th))
+                goto out;
+
+        if (!pskb_may_pull(skb, thlen))
+                goto out;
+
+        oldlen = (u16)~skb->len;
+        __skb_pull(skb, thlen);
+
+        mss = tcp_skb_mss(skb);
+        if (unlikely(skb->len <= mss))
+                goto out;
+
+        if (skb_gso_ok(skb, features | NETIF_F_GSO_ROBUST)) {
+                /* Packet is from an untrusted source, reset gso_segs. */
+                int type = skb_shinfo(skb)->gso_type;
+
+                if (unlikely(type &
+                             ~(SKB_GSO_TCPV4 |
+                               SKB_GSO_DODGY |
+                               SKB_GSO_TCP_ECN |
+                               SKB_GSO_TCPV6 |
+                               SKB_GSO_GRE |
+                               SKB_GSO_MPLS |
+                               SKB_GSO_UDP_TUNNEL |
+                               0) ||
+                             !(type & (SKB_GSO_TCPV4 | SKB_GSO_TCPV6))))
+                        goto out;
+
+                skb_shinfo(skb)->gso_segs = DIV_ROUND_UP(skb->len, mss);
+
+                segs = NULL;
+                goto out;
+        }
+
+        copy_destructor = gso_skb->destructor == tcp_wfree;
+        ooo_okay = gso_skb->ooo_okay;
+        /* All segments but the first should have ooo_okay cleared */
+        skb->ooo_okay = 0;
+
+        segs = skb_segment(skb, features);
+        if (IS_ERR(segs))
+                goto out;
+
+        /* Only first segment might have ooo_okay set */
+        segs->ooo_okay = ooo_okay;
+
+        delta = htonl(oldlen + (thlen + mss));
+
+        skb = segs;
+        th = tcp_hdr(skb);
+        seq = ntohl(th->seq);
+
+        newcheck = ~csum_fold((__force __wsum)((__force u32)th->check +
+                                               (__force u32)delta));
+
+        do {
+                th->fin = th->psh = 0;
+                th->check = newcheck;
+
+                if (skb->ip_summed != CHECKSUM_PARTIAL)
+                        th->check =
+                             csum_fold(csum_partial(skb_transport_header(skb),
+                                                    thlen, skb->csum));
+
+                seq += mss;
+                if (copy_destructor) {
+                        skb->destructor = gso_skb->destructor;
+                        skb->sk = gso_skb->sk;
+                        /* {tcp|sock}_wfree() use exact truesize accounting :
+                         * sum(skb->truesize) MUST be exactly be gso_skb->truesize
+                         * So we account mss bytes of 'true size' for each segment.
+                         * The last segment will contain the remaining.
+                         */
+                        skb->truesize = mss;
+                        gso_skb->truesize -= mss;
+                }
+                skb = skb->next;
+                th = tcp_hdr(skb);
+
+                th->seq = htonl(seq);
+                th->cwr = 0;
+        } while (skb->next);
+
+        /* Following permits TCP Small Queues to work well with GSO :
+         * The callback to TCP stack will be called at the time last frag
+         * is freed at TX completion, and not right now when gso_skb
+         * is freed by GSO engine
+         */
+        if (copy_destructor) {
+                swap(gso_skb->sk, skb->sk);
+                swap(gso_skb->destructor, skb->destructor);
+                swap(gso_skb->truesize, skb->truesize);
+        }
+
+        delta = htonl(oldlen + (skb_tail_pointer(skb) -
+                                skb_transport_header(skb)) +
+                      skb->data_len);
+        th->check = ~csum_fold((__force __wsum)((__force u32)th->check +
+                                (__force u32)delta));
+        if (skb->ip_summed != CHECKSUM_PARTIAL)
+                th->check = csum_fold(csum_partial(skb_transport_header(skb),
+                                                   thlen, skb->csum));
+out:
+        return segs;
+}
+EXPORT_SYMBOL(tcp_tso_segment);
+
+struct sk_buff **tcp_gro_receive(struct sk_buff **head, struct sk_buff *skb)
+{
+        struct sk_buff **pp = NULL;
+        struct sk_buff *p;
+        struct tcphdr *th;
+        struct tcphdr *th2;
+        unsigned int len;
+        unsigned int thlen;
+        __be32 flags;
+        unsigned int mss = 1;
+        unsigned int hlen;
+        unsigned int off;
+        int flush = 1;
+        int i;
+
+        off = skb_gro_offset(skb);
+        hlen = off + sizeof(*th);
+        th = skb_gro_header_fast(skb, off);
+        if (skb_gro_header_hard(skb, hlen)) {
+                th = skb_gro_header_slow(skb, hlen, off);
+                if (unlikely(!th))
+                        goto out;
+        }
+
+        thlen = th->doff * 4;
+        if (thlen < sizeof(*th))
+                goto out;
+
+        hlen = off + thlen;
+        if (skb_gro_header_hard(skb, hlen)) {
+                th = skb_gro_header_slow(skb, hlen, off);
+                if (unlikely(!th))
+                        goto out;
+        }
+
+        skb_gro_pull(skb, thlen);
+
+        len = skb_gro_len(skb);
+        flags = tcp_flag_word(th);
+
+        for (; (p = *head); head = &p->next) {
+                if (!NAPI_GRO_CB(p)->same_flow)
+                        continue;
+
+                th2 = tcp_hdr(p);
+
+                if (*(u32 *)&th->source ^ *(u32 *)&th2->source) {
+                        NAPI_GRO_CB(p)->same_flow = 0;
+                        continue;
+                }
+
+                goto found;
+        }
+
+        goto out_check_final;
+
+found:
+        flush = NAPI_GRO_CB(p)->flush;
+        flush |= (__force int)(flags & TCP_FLAG_CWR);
+        flush |= (__force int)((flags ^ tcp_flag_word(th2)) &
+                  ~(TCP_FLAG_CWR | TCP_FLAG_FIN | TCP_FLAG_PSH));
+        flush |= (__force int)(th->ack_seq ^ th2->ack_seq);
+        for (i = sizeof(*th); i < thlen; i += 4)
+                flush |= *(u32 *)((u8 *)th + i) ^
+                         *(u32 *)((u8 *)th2 + i);
+
+        mss = tcp_skb_mss(p);
+
+        flush |= (len - 1) >= mss;
+        flush |= (ntohl(th2->seq) + skb_gro_len(p)) ^ ntohl(th->seq);
+
+        if (flush || skb_gro_receive(head, skb)) {
+                mss = 1;
+                goto out_check_final;
+        }
+
+        p = *head;
+        th2 = tcp_hdr(p);
+        tcp_flag_word(th2) |= flags & (TCP_FLAG_FIN | TCP_FLAG_PSH);
+
+out_check_final:
+        flush = len < mss;
+        flush |= (__force int)(flags & (TCP_FLAG_URG | TCP_FLAG_PSH |
+                                        TCP_FLAG_RST | TCP_FLAG_SYN |
+                                        TCP_FLAG_FIN));
+
+        if (p && (!NAPI_GRO_CB(skb)->same_flow || flush))
+                pp = head;
+
+out:
+        NAPI_GRO_CB(skb)->flush |= flush;
+
+        return pp;
+}
+EXPORT_SYMBOL(tcp_gro_receive);
+
+int tcp_gro_complete(struct sk_buff *skb)
+{
+        struct tcphdr *th = tcp_hdr(skb);
+
+        skb->csum_start = skb_transport_header(skb) - skb->head;
+        skb->csum_offset = offsetof(struct tcphdr, check);
+        skb->ip_summed = CHECKSUM_PARTIAL;
+
+        skb_shinfo(skb)->gso_segs = NAPI_GRO_CB(skb)->count;
+
+        if (th->cwr)
+                skb_shinfo(skb)->gso_type |= SKB_GSO_TCP_ECN;
+
+        return 0;
+}
+EXPORT_SYMBOL(tcp_gro_complete);
+
+static int tcp_v4_gso_send_check(struct sk_buff *skb)
+{
+        const struct iphdr *iph;
+        struct tcphdr *th;
+
+        if (!pskb_may_pull(skb, sizeof(*th)))
+                return -EINVAL;
+
+        iph = ip_hdr(skb);
+        th = tcp_hdr(skb);
+
+        th->check = 0;
+        skb->ip_summed = CHECKSUM_PARTIAL;
+        __tcp_v4_send_check(skb, iph->saddr, iph->daddr);
+        return 0;
+}
+
+static struct sk_buff **tcp4_gro_receive(struct sk_buff **head, struct sk_buff *skb)
+{
+        const struct iphdr *iph = skb_gro_network_header(skb);
+        __wsum wsum;
+        __sum16 sum;
+
+        switch (skb->ip_summed) {
+        case CHECKSUM_COMPLETE:
+                if (!tcp_v4_check(skb_gro_len(skb), iph->saddr, iph->daddr,
+                                  skb->csum)) {
+                        skb->ip_summed = CHECKSUM_UNNECESSARY;
+                        break;
+                }
+flush:
+                NAPI_GRO_CB(skb)->flush = 1;
+                return NULL;
+
+        case CHECKSUM_NONE:
+                wsum = csum_tcpudp_nofold(iph->saddr, iph->daddr,
+                                          skb_gro_len(skb), IPPROTO_TCP, 0);
+                sum = csum_fold(skb_checksum(skb,
+                                             skb_gro_offset(skb),
+                                             skb_gro_len(skb),
+                                             wsum));
+                if (sum)
+                        goto flush;
+
+                skb->ip_summed = CHECKSUM_UNNECESSARY;
+                break;
+        }
+
+        return tcp_gro_receive(head, skb);
+}
+
+static int tcp4_gro_complete(struct sk_buff *skb)
+{
+        const struct iphdr *iph = ip_hdr(skb);
+        struct tcphdr *th = tcp_hdr(skb);
+
+        th->check = ~tcp_v4_check(skb->len - skb_transport_offset(skb),
+                                  iph->saddr, iph->daddr, 0);
+        skb_shinfo(skb)->gso_type = SKB_GSO_TCPV4;
+
+        return tcp_gro_complete(skb);
+}
+
+static const struct net_offload tcpv4_offload = {
+        .callbacks = {
+                .gso_send_check =       tcp_v4_gso_send_check,
+                .gso_segment    =       tcp_tso_segment,
+                .gro_receive    =       tcp4_gro_receive,
+                .gro_complete   =       tcp4_gro_complete,
+        },
+};
+
+int __init tcpv4_offload_init(void)
+{
+        return inet_add_offload(&tcpv4_offload, IPPROTO_TCP);
+}
diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
index ec335fabd5cc..e6bb8256e59f 100644
--- a/net/ipv4/tcp_output.c
+++ b/net/ipv4/tcp_output.c
@@ -65,6 +65,9 @@ int sysctl_tcp_base_mss __read_mostly = TCP_BASE_MSS;
 /* By default, RFC2861 behavior.  */
 int sysctl_tcp_slow_start_after_idle __read_mostly = 1;
 
+unsigned int sysctl_tcp_notsent_lowat __read_mostly = UINT_MAX;
+EXPORT_SYMBOL(sysctl_tcp_notsent_lowat);
+
 static bool tcp_write_xmit(struct sock *sk, unsigned int mss_now, int nonagle,
                            int push_one, gfp_t gfp);
 
@@ -160,6 +163,7 @@ static void tcp_event_data_sent(struct tcp_sock *tp,
 {
         struct inet_connection_sock *icsk = inet_csk(sk);
         const u32 now = tcp_time_stamp;
+        const struct dst_entry *dst = __sk_dst_get(sk);
 
         if (sysctl_tcp_slow_start_after_idle &&
             (!tp->packets_out && (s32)(now - tp->lsndtime) > icsk->icsk_rto))
@@ -170,8 +174,9 @@ static void tcp_event_data_sent(struct tcp_sock *tp,
         /* If it is a reply for ato after last received
          * packet, enter pingpong mode.
          */
-        if ((u32)(now - icsk->icsk_ack.lrcvtime) < icsk->icsk_ack.ato)
-                icsk->icsk_ack.pingpong = 1;
+        if ((u32)(now - icsk->icsk_ack.lrcvtime) < icsk->icsk_ack.ato &&
+            (!dst || !dst_metric(dst, RTAX_QUICKACK)))
+                        icsk->icsk_ack.pingpong = 1;
 }
 
 /* Account for an ACK we sent. */
@@ -181,6 +186,21 @@ static inline void tcp_event_ack_sent(struct sock *sk, unsigned int pkts)
         inet_csk_clear_xmit_timer(sk, ICSK_TIME_DACK);
 }
 
+
+u32 tcp_default_init_rwnd(u32 mss)
+{
+        /* Initial receive window should be twice of TCP_INIT_CWND to
+         * enable proper sending of new unsent data during fast recovery
+         * (RFC 3517, Section 4, NextSeg() rule (2)). Further place a
+         * limit when mss is larger than 1460.
+         */
+        u32 init_rwnd = TCP_INIT_CWND * 2;
+
+        if (mss > 1460)
+                init_rwnd = max((1460 * init_rwnd) / mss, 2U);
+        return init_rwnd;
+}
+
 /* Determine a window scaling and initial window to offer.
  * Based on the assumption that the given amount of space
  * will be offered. Store the results in the tp structure.
@@ -230,22 +250,10 @@ void tcp_select_initial_window(int __space, __u32 mss,
                 }
         }
 
-        /* Set initial window to a value enough for senders starting with
-         * initial congestion window of TCP_DEFAULT_INIT_RCVWND. Place
-         * a limit on the initial window when mss is larger than 1460.
-         */
         if (mss > (1 << *rcv_wscale)) {
-                int init_cwnd = TCP_DEFAULT_INIT_RCVWND;
-                if (mss > 1460)
-                        init_cwnd =
-                        max_t(u32, (1460 * TCP_DEFAULT_INIT_RCVWND) / mss, 2);
-                /* when initializing use the value from init_rcv_wnd
-                 * rather than the default from above
-                 */
-                if (init_rcv_wnd)
-                        *rcv_wnd = min(*rcv_wnd, init_rcv_wnd * mss);
-                else
-                        *rcv_wnd = min(*rcv_wnd, init_cwnd * mss);
+                if (!init_rcv_wnd) /* Use default unless specified otherwise */
+                        init_rcv_wnd = tcp_default_init_rwnd(mss);
+                *rcv_wnd = min(*rcv_wnd, init_rcv_wnd * mss);
         }
 
         /* Set the clamp no higher than max representable value */
@@ -887,8 +895,7 @@ static int tcp_transmit_skb(struct sock *sk, struct sk_buff *skb, int clone_it,
 
         skb_orphan(skb);
         skb->sk = sk;
-        skb->destructor = (sysctl_tcp_limit_output_bytes > 0) ?
-                          tcp_wfree : sock_wfree;
+        skb->destructor = tcp_wfree;
         atomic_add(skb->truesize, &sk->sk_wmem_alloc);
 
         /* Build TCP header and checksum it. */
@@ -1623,7 +1630,7 @@ static bool tcp_tso_should_defer(struct sock *sk, struct sk_buff *skb)
 
         /* If a full-sized TSO skb can be sent, do it. */
         if (limit >= min_t(unsigned int, sk->sk_gso_max_size,
-                           sk->sk_gso_max_segs * tp->mss_cache))
+                           tp->xmit_size_goal_segs * tp->mss_cache))
                 goto send_now;
 
         /* Middle in queue won't get any more data, full sendable already? */
@@ -1832,7 +1839,6 @@ static bool tcp_write_xmit(struct sock *sk, unsigned int mss_now, int nonagle,
         while ((skb = tcp_send_head(sk))) {
                 unsigned int limit;
 
-
                 tso_segs = tcp_init_tso_segs(sk, skb, mss_now);
                 BUG_ON(!tso_segs);
 
@@ -1861,13 +1867,20 @@ static bool tcp_write_xmit(struct sock *sk, unsigned int mss_now, int nonagle,
                                 break;
                 }
 
-                /* TSQ : sk_wmem_alloc accounts skb truesize,
-                 * including skb overhead. But thats OK.
+                /* TCP Small Queues :
+                 * Control number of packets in qdisc/devices to two packets / or ~1 ms.
+                 * This allows for :
+                 *  - better RTT estimation and ACK scheduling
+                 *  - faster recovery
+                 *  - high rates
                  */
-                if (atomic_read(&sk->sk_wmem_alloc) >= sysctl_tcp_limit_output_bytes) {
+                limit = max(skb->truesize, sk->sk_pacing_rate >> 10);
+
+                if (atomic_read(&sk->sk_wmem_alloc) > limit) {
                         set_bit(TSQ_THROTTLED, &tp->tsq_flags);
                         break;
                 }
+
                 limit = mss_now;
                 if (tso_segs > 1 && !tcp_urg_mode(tp))
                         limit = tcp_mss_split_point(sk, skb, mss_now,
@@ -2402,6 +2415,8 @@ int tcp_retransmit_skb(struct sock *sk, struct sk_buff *skb)
                  * see tcp_input.c tcp_sacktag_write_queue().
                  */
                 TCP_SKB_CB(skb)->ack_seq = tp->snd_nxt;
+        } else {
+                NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_TCPRETRANSFAIL);
         }
         return err;
 }
@@ -2523,10 +2538,9 @@ begin_fwd:
                 if (sacked & (TCPCB_SACKED_ACKED|TCPCB_SACKED_RETRANS))
                         continue;
 
-                if (tcp_retransmit_skb(sk, skb)) {
-                        NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_TCPRETRANSFAIL);
+                if (tcp_retransmit_skb(sk, skb))
                         return;
-                }
+
                 NET_INC_STATS_BH(sock_net(sk), mib_idx);
 
                 if (tcp_in_cwnd_reduction(sk))
@@ -2664,7 +2678,7 @@ struct sk_buff *tcp_make_synack(struct sock *sk, struct dst_entry *dst,
         int tcp_header_size;
         int mss;
 
-        skb = alloc_skb(MAX_TCP_HEADER + 15, sk_gfp_atomic(sk, GFP_ATOMIC));
+        skb = sock_wmalloc(sk, MAX_TCP_HEADER + 15, 1, GFP_ATOMIC);
         if (unlikely(!skb)) {
                 dst_release(dst);
                 return NULL;
@@ -2808,6 +2822,8 @@ void tcp_connect_init(struct sock *sk)
 
         if (likely(!tp->repair))
                 tp->rcv_nxt = 0;
+        else
+                tp->rcv_tstamp = tcp_time_stamp;
         tp->rcv_wup = tp->rcv_nxt;
         tp->copied_seq = tp->rcv_nxt;
 
diff --git a/net/ipv4/tcp_probe.c b/net/ipv4/tcp_probe.c
index d4943f67aff2..611beab38a00 100644
--- a/net/ipv4/tcp_probe.c
+++ b/net/ipv4/tcp_probe.c
@@ -46,6 +46,10 @@ static unsigned int bufsize __read_mostly = 4096;
 MODULE_PARM_DESC(bufsize, "Log buffer size in packets (4096)");
 module_param(bufsize, uint, 0);
 
+static unsigned int fwmark __read_mostly = 0;
+MODULE_PARM_DESC(fwmark, "skb mark to match (0=no mark)");
+module_param(fwmark, uint, 0);
+
 static int full __read_mostly;
 MODULE_PARM_DESC(full, "Full log (1=every ack packet received,  0=only cwnd changes)");
 module_param(full, int, 0);
@@ -54,12 +58,16 @@ static const char procname[] = "tcpprobe";
 
 struct tcp_log {
         ktime_t tstamp;
-        __be32  saddr, daddr;
-        __be16  sport, dport;
+        union {
+                struct sockaddr         raw;
+                struct sockaddr_in      v4;
+                struct sockaddr_in6     v6;
+        }       src, dst;
         u16     length;
         u32     snd_nxt;
         u32     snd_una;
         u32     snd_wnd;
+        u32     rcv_wnd;
         u32     snd_cwnd;
         u32     ssthresh;
         u32     srtt;
@@ -86,19 +94,45 @@ static inline int tcp_probe_avail(void)
         return bufsize - tcp_probe_used() - 1;
 }
 
+#define tcp_probe_copy_fl_to_si4(inet, si4, mem)                \
+        do {                                                    \
+                si4.sin_family = AF_INET;                       \
+                si4.sin_port = inet->inet_##mem##port;          \
+                si4.sin_addr.s_addr = inet->inet_##mem##addr;   \
+        } while (0)                                             \
+
+#if IS_ENABLED(CONFIG_IPV6)
+#define tcp_probe_copy_fl_to_si6(inet, si6, mem)                \
+        do {                                                    \
+                struct ipv6_pinfo *pi6 = inet->pinet6;          \
+                si6.sin6_family = AF_INET6;                     \
+                si6.sin6_port = inet->inet_##mem##port;         \
+                si6.sin6_addr = pi6->mem##addr;                 \
+                si6.sin6_flowinfo = 0; /* No need here. */      \
+                si6.sin6_scope_id = 0;  /* No need here. */     \
+        } while (0)
+#else
+#define tcp_probe_copy_fl_to_si6(fl, si6, mem)                  \
+        do {                                                    \
+                memset(&si6, 0, sizeof(si6));                   \
+        } while (0)
+#endif
+
 /*
  * Hook inserted to be called before each receive packet.
  * Note: arguments must match tcp_rcv_established()!
  */
-static int jtcp_rcv_established(struct sock *sk, struct sk_buff *skb,
-                               struct tcphdr *th, unsigned int len)
+static void jtcp_rcv_established(struct sock *sk, struct sk_buff *skb,
+                                 const struct tcphdr *th, unsigned int len)
 {
         const struct tcp_sock *tp = tcp_sk(sk);
         const struct inet_sock *inet = inet_sk(sk);
 
-        /* Only update if port matches */
-        if ((port == 0 || ntohs(inet->inet_dport) == port ||
-             ntohs(inet->inet_sport) == port) &&
+        /* Only update if port or skb mark matches */
+        if (((port == 0 && fwmark == 0) ||
+             ntohs(inet->inet_dport) == port ||
+             ntohs(inet->inet_sport) == port ||
+             (fwmark > 0 && skb->mark == fwmark)) &&
             (full || tp->snd_cwnd != tcp_probe.lastcwnd)) {
 
                 spin_lock(&tcp_probe.lock);
@@ -107,15 +141,25 @@ static int jtcp_rcv_established(struct sock *sk, struct sk_buff *skb,
                         struct tcp_log *p = tcp_probe.log + tcp_probe.head;
 
                         p->tstamp = ktime_get();
-                        p->saddr = inet->inet_saddr;
-                        p->sport = inet->inet_sport;
-                        p->daddr = inet->inet_daddr;
-                        p->dport = inet->inet_dport;
+                        switch (sk->sk_family) {
+                        case AF_INET:
+                                tcp_probe_copy_fl_to_si4(inet, p->src.v4, s);
+                                tcp_probe_copy_fl_to_si4(inet, p->dst.v4, d);
+                                break;
+                        case AF_INET6:
+                                tcp_probe_copy_fl_to_si6(inet, p->src.v6, s);
+                                tcp_probe_copy_fl_to_si6(inet, p->dst.v6, d);
+                                break;
+                        default:
+                                BUG();
+                        }
+
                         p->length = skb->len;
                         p->snd_nxt = tp->snd_nxt;
                         p->snd_una = tp->snd_una;
                         p->snd_cwnd = tp->snd_cwnd;
                         p->snd_wnd = tp->snd_wnd;
+                        p->rcv_wnd = tp->rcv_wnd;
                         p->ssthresh = tcp_current_ssthresh(sk);
                         p->srtt = tp->srtt >> 3;
 
@@ -128,7 +172,6 @@ static int jtcp_rcv_established(struct sock *sk, struct sk_buff *skb,
         }
 
         jprobe_return();
-        return 0;
 }
 
 static struct jprobe tcp_jprobe = {
@@ -157,13 +200,11 @@ static int tcpprobe_sprint(char *tbuf, int n)
                 = ktime_to_timespec(ktime_sub(p->tstamp, tcp_probe.start));
 
         return scnprintf(tbuf, n,
-                        "%lu.%09lu %pI4:%u %pI4:%u %d %#x %#x %u %u %u %u\n",
+                        "%lu.%09lu %pISpc %pISpc %d %#x %#x %u %u %u %u %u\n",
                         (unsigned long) tv.tv_sec,
                         (unsigned long) tv.tv_nsec,
-                        &p->saddr, ntohs(p->sport),
-                        &p->daddr, ntohs(p->dport),
-                        p->length, p->snd_nxt, p->snd_una,
-                        p->snd_cwnd, p->ssthresh, p->snd_wnd, p->srtt);
+                        &p->src, &p->dst, p->length, p->snd_nxt, p->snd_una,
+                        p->snd_cwnd, p->ssthresh, p->snd_wnd, p->srtt, p->rcv_wnd);
 }
 
 static ssize_t tcpprobe_read(struct file *file, char __user *buf,
@@ -176,7 +217,7 @@ static ssize_t tcpprobe_read(struct file *file, char __user *buf,
                 return -EINVAL;
 
         while (cnt < len) {
-                char tbuf[164];
+                char tbuf[256];
                 int width;
 
                 /* Wait for data in buffer */
@@ -223,6 +264,13 @@ static __init int tcpprobe_init(void)
 {
         int ret = -ENOMEM;
 
+        /* Warning: if the function signature of tcp_rcv_established,
+         * has been changed, you also have to change the signature of
+         * jtcp_rcv_established, otherwise you end up right here!
+         */
+        BUILD_BUG_ON(__same_type(tcp_rcv_established,
+                                 jtcp_rcv_established) == 0);
+
         init_waitqueue_head(&tcp_probe.wait);
         spin_lock_init(&tcp_probe.lock);
 
@@ -241,7 +289,8 @@ static __init int tcpprobe_init(void)
         if (ret)
                 goto err1;
 
-        pr_info("probe registered (port=%d) bufsize=%u\n", port, bufsize);
+        pr_info("probe registered (port=%d/fwmark=%u) bufsize=%u\n",
+                port, fwmark, bufsize);
         return 0;
  err1:
         remove_proc_entry(procname, init_net.proc_net);
diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
index 0bf5d399a03c..0ca44df51ee9 100644
--- a/net/ipv4/udp.c
+++ b/net/ipv4/udp.c
@@ -109,6 +109,7 @@
 #include <trace/events/udp.h>
 #include <linux/static_key.h>
 #include <trace/events/skb.h>
+#include <net/busy_poll.h>
 #include "udp_impl.h"
 
 struct udp_table udp_table __read_mostly;
@@ -429,7 +430,7 @@ begin:
                         reuseport = sk->sk_reuseport;
                         if (reuseport) {
                                 hash = inet_ehashfn(net, daddr, hnum,
-                                                    saddr, htons(sport));
+                                                    saddr, sport);
                                 matches = 1;
                         }
                 } else if (score == badness && reuseport) {
@@ -510,7 +511,7 @@ begin:
                         reuseport = sk->sk_reuseport;
                         if (reuseport) {
                                 hash = inet_ehashfn(net, daddr, hnum,
-                                                    saddr, htons(sport));
+                                                    saddr, sport);
                                 matches = 1;
                         }
                 } else if (score == badness && reuseport) {
@@ -657,7 +658,7 @@ void __udp4_lib_err(struct sk_buff *skb, u32 info, struct udp_table *udptable)
                 break;
         case ICMP_REDIRECT:
                 ipv4_sk_redirect(skb, sk);
-                break;
+                goto out;
         }
 
         /*
@@ -703,7 +704,7 @@ EXPORT_SYMBOL(udp_flush_pending_frames);
  *      @src:   source IP address
  *      @dst:   destination IP address
  */
-static void udp4_hwcsum(struct sk_buff *skb, __be32 src, __be32 dst)
+void udp4_hwcsum(struct sk_buff *skb, __be32 src, __be32 dst)
 {
         struct udphdr *uh = udp_hdr(skb);
         struct sk_buff *frags = skb_shinfo(skb)->frag_list;
@@ -739,6 +740,7 @@ static void udp4_hwcsum(struct sk_buff *skb, __be32 src, __be32 dst)
                         uh->check = CSUM_MANGLED_0;
         }
 }
+EXPORT_SYMBOL_GPL(udp4_hwcsum);
 
 static int udp_send_skb(struct sk_buff *skb, struct flowi4 *fl4)
 {
@@ -799,7 +801,7 @@ send:
 /*
  * Push out all pending data as one UDP datagram. Socket is locked.
  */
-static int udp_push_pending_frames(struct sock *sk)
+int udp_push_pending_frames(struct sock *sk)
 {
         struct udp_sock  *up = udp_sk(sk);
         struct inet_sock *inet = inet_sk(sk);
@@ -818,6 +820,7 @@ out:
         up->pending = 0;
         return err;
 }
+EXPORT_SYMBOL(udp_push_pending_frames);
 
 int udp_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
                 size_t len)
@@ -1709,7 +1712,10 @@ int __udp4_lib_rcv(struct sk_buff *skb, struct udp_table *udptable,
         sk = __udp4_lib_lookup_skb(skb, uh->source, uh->dest, udptable);
 
         if (sk != NULL) {
-                int ret = udp_queue_rcv_skb(sk, skb);
+                int ret;
+
+                sk_mark_napi_id(sk, skb);
+                ret = udp_queue_rcv_skb(sk, skb);
                 sock_put(sk);
 
                 /* a return value > 0 means to resubmit the input, but
@@ -1967,6 +1973,8 @@ unsigned int udp_poll(struct file *file, struct socket *sock, poll_table *wait)
         unsigned int mask = datagram_poll(file, sock, wait);
         struct sock *sk = sock->sk;
 
+        sock_rps_record_flow(sk);
+
         /* Check for false positives due to checksum errors */
         if ((mask & POLLRDNORM) && !(file->f_flags & O_NONBLOCK) &&
             !(sk->sk_shutdown & RCV_SHUTDOWN) && !first_packet_length(sk))
@@ -2151,7 +2159,7 @@ static void udp4_format_sock(struct sock *sp, struct seq_file *f,
         __u16 srcp        = ntohs(inet->inet_sport);
 
         seq_printf(f, "%5d: %08X:%04X %08X:%04X"
-                " %02X %08X:%08X %02X:%08lX %08X %5d %8d %lu %d %pK %d%n",
+                " %02X %08X:%08X %02X:%08lX %08X %5u %8d %lu %d %pK %d%n",
                 bucket, src, srcp, dest, destp, sp->sk_state,
                 sk_wmem_alloc_get(sp),
                 sk_rmem_alloc_get(sp),
@@ -2284,29 +2292,8 @@ void __init udp_init(void)
         sysctl_udp_wmem_min = SK_MEM_QUANTUM;
 }
 
-int udp4_ufo_send_check(struct sk_buff *skb)
-{
-        if (!pskb_may_pull(skb, sizeof(struct udphdr)))
-                return -EINVAL;
-
-        if (likely(!skb->encapsulation)) {
-                const struct iphdr *iph;
-                struct udphdr *uh;
-
-                iph = ip_hdr(skb);
-                uh = udp_hdr(skb);
-
-                uh->check = ~csum_tcpudp_magic(iph->saddr, iph->daddr, skb->len,
-                                IPPROTO_UDP, 0);
-                skb->csum_start = skb_transport_header(skb) - skb->head;
-                skb->csum_offset = offsetof(struct udphdr, check);
-                skb->ip_summed = CHECKSUM_PARTIAL;
-        }
-        return 0;
-}
-
-static struct sk_buff *skb_udp_tunnel_segment(struct sk_buff *skb,
-                netdev_features_t features)
+struct sk_buff *skb_udp_tunnel_segment(struct sk_buff *skb,
+                                       netdev_features_t features)
 {
         struct sk_buff *segs = ERR_PTR(-EINVAL);
         int mac_len = skb->mac_len;
@@ -2337,6 +2324,9 @@ static struct sk_buff *skb_udp_tunnel_segment(struct sk_buff *skb,
                 struct udphdr *uh;
                 int udp_offset = outer_hlen - tnl_hlen;
 
+                skb_reset_inner_headers(skb);
+                skb->encapsulation = 1;
+
                 skb->mac_len = mac_len;
 
                 skb_push(skb, outer_hlen);
@@ -2347,7 +2337,7 @@ static struct sk_buff *skb_udp_tunnel_segment(struct sk_buff *skb,
                 uh->len = htons(skb->len - udp_offset);
 
                 /* csum segment if tunnel sets skb with csum. */
-                if (unlikely(uh->check)) {
+                if (protocol == htons(ETH_P_IP) && unlikely(uh->check)) {
                         struct iphdr *iph = ip_hdr(skb);
 
                         uh->check = ~csum_tcpudp_magic(iph->saddr, iph->daddr,
@@ -2358,60 +2348,20 @@ static struct sk_buff *skb_udp_tunnel_segment(struct sk_buff *skb,
                         if (uh->check == 0)
                                 uh->check = CSUM_MANGLED_0;
 
+                } else if (protocol == htons(ETH_P_IPV6)) {
+                        struct ipv6hdr *ipv6h = ipv6_hdr(skb);
+                        u32 len = skb->len - udp_offset;
+
+                        uh->check = ~csum_ipv6_magic(&ipv6h->saddr, &ipv6h->daddr,
+                                                     len, IPPROTO_UDP, 0);
+                        uh->check = csum_fold(skb_checksum(skb, udp_offset, len, 0));
+                        if (uh->check == 0)
+                                uh->check = CSUM_MANGLED_0;
+                        skb->ip_summed = CHECKSUM_NONE;
                 }
-                skb->ip_summed = CHECKSUM_NONE;
+
                 skb->protocol = protocol;
         } while ((skb = skb->next));
 out:
         return segs;
 }
-
-struct sk_buff *udp4_ufo_fragment(struct sk_buff *skb,
-        netdev_features_t features)
-{
-        struct sk_buff *segs = ERR_PTR(-EINVAL);
-        unsigned int mss;
-        mss = skb_shinfo(skb)->gso_size;
-        if (unlikely(skb->len <= mss))
-                goto out;
-
-        if (skb_gso_ok(skb, features | NETIF_F_GSO_ROBUST)) {
-                /* Packet is from an untrusted source, reset gso_segs. */
-                int type = skb_shinfo(skb)->gso_type;
-
-                if (unlikely(type & ~(SKB_GSO_UDP | SKB_GSO_DODGY |
-                                      SKB_GSO_UDP_TUNNEL |
-                                      SKB_GSO_GRE) ||
-                             !(type & (SKB_GSO_UDP))))
-                        goto out;
-
-                skb_shinfo(skb)->gso_segs = DIV_ROUND_UP(skb->len, mss);
-
-                segs = NULL;
-                goto out;
-        }
-
-        /* Fragment the skb. IP headers of the fragments are updated in
-         * inet_gso_segment()
-         */
-        if (skb->encapsulation && skb_shinfo(skb)->gso_type & SKB_GSO_UDP_TUNNEL)
-                segs = skb_udp_tunnel_segment(skb, features);
-        else {
-                int offset;
-                __wsum csum;
-
-                /* Do software UFO. Complete and fill in the UDP checksum as
-                 * HW cannot do checksum of UDP packets sent as multiple
-                 * IP fragments.
-                 */
-                offset = skb_checksum_start_offset(skb);
-                csum = skb_checksum(skb, offset, skb->len - offset, 0);
-                offset += skb->csum_offset;
-                *(__sum16 *)(skb->data + offset) = csum_fold(csum);
-                skb->ip_summed = CHECKSUM_NONE;
-
-                segs = skb_segment(skb, features);
-        }
-out:
-        return segs;
-}
diff --git a/net/ipv4/udp_offload.c b/net/ipv4/udp_offload.c
new file mode 100644
index 000000000000..f35eccaa855e
--- /dev/null
+++ b/net/ipv4/udp_offload.c
@@ -0,0 +1,100 @@
+/*
+ *      IPV4 GSO/GRO offload support
+ *      Linux INET implementation
+ *
+ *      This program is free software; you can redistribute it and/or
+ *      modify it under the terms of the GNU General Public License
+ *      as published by the Free Software Foundation; either version
+ *      2 of the License, or (at your option) any later version.
+ *
+ *      UDPv4 GSO support
+ */
+
+#include <linux/skbuff.h>
+#include <net/udp.h>
+#include <net/protocol.h>
+
+static int udp4_ufo_send_check(struct sk_buff *skb)
+{
+        if (!pskb_may_pull(skb, sizeof(struct udphdr)))
+                return -EINVAL;
+
+        if (likely(!skb->encapsulation)) {
+                const struct iphdr *iph;
+                struct udphdr *uh;
+
+                iph = ip_hdr(skb);
+                uh = udp_hdr(skb);
+
+                uh->check = ~csum_tcpudp_magic(iph->saddr, iph->daddr, skb->len,
+                                IPPROTO_UDP, 0);
+                skb->csum_start = skb_transport_header(skb) - skb->head;
+                skb->csum_offset = offsetof(struct udphdr, check);
+                skb->ip_summed = CHECKSUM_PARTIAL;
+        }
+
+        return 0;
+}
+
+static struct sk_buff *udp4_ufo_fragment(struct sk_buff *skb,
+                                         netdev_features_t features)
+{
+        struct sk_buff *segs = ERR_PTR(-EINVAL);
+        unsigned int mss;
+
+        mss = skb_shinfo(skb)->gso_size;
+        if (unlikely(skb->len <= mss))
+                goto out;
+
+        if (skb_gso_ok(skb, features | NETIF_F_GSO_ROBUST)) {
+                /* Packet is from an untrusted source, reset gso_segs. */
+                int type = skb_shinfo(skb)->gso_type;
+
+                if (unlikely(type & ~(SKB_GSO_UDP | SKB_GSO_DODGY |
+                                      SKB_GSO_UDP_TUNNEL |
+                                      SKB_GSO_GRE | SKB_GSO_MPLS) ||
+                             !(type & (SKB_GSO_UDP))))
+                        goto out;
+
+                skb_shinfo(skb)->gso_segs = DIV_ROUND_UP(skb->len, mss);
+
+                segs = NULL;
+                goto out;
+        }
+
+        /* Fragment the skb. IP headers of the fragments are updated in
+         * inet_gso_segment()
+         */
+        if (skb->encapsulation && skb_shinfo(skb)->gso_type & SKB_GSO_UDP_TUNNEL)
+                segs = skb_udp_tunnel_segment(skb, features);
+        else {
+                int offset;
+                __wsum csum;
+
+                /* Do software UFO. Complete and fill in the UDP checksum as
+                 * HW cannot do checksum of UDP packets sent as multiple
+                 * IP fragments.
+                 */
+                offset = skb_checksum_start_offset(skb);
+                csum = skb_checksum(skb, offset, skb->len - offset, 0);
+                offset += skb->csum_offset;
+                *(__sum16 *)(skb->data + offset) = csum_fold(csum);
+                skb->ip_summed = CHECKSUM_NONE;
+
+                segs = skb_segment(skb, features);
+        }
+out:
+        return segs;
+}
+
+static const struct net_offload udpv4_offload = {
+        .callbacks = {
+                .gso_send_check = udp4_ufo_send_check,
+                .gso_segment = udp4_ufo_fragment,
+        },
+};
+
+int __init udpv4_offload_init(void)
+{
+        return inet_add_offload(&udpv4_offload, IPPROTO_UDP);
+}
diff --git a/net/ipv4/xfrm4_mode_tunnel.c b/net/ipv4/xfrm4_mode_tunnel.c
index eb1dd4d643f2..b5663c37f089 100644
--- a/net/ipv4/xfrm4_mode_tunnel.c
+++ b/net/ipv4/xfrm4_mode_tunnel.c
@@ -117,7 +117,7 @@ static int xfrm4_mode_tunnel_output(struct xfrm_state *x, struct sk_buff *skb)
 
         top_iph->frag_off = (flags & XFRM_STATE_NOPMTUDISC) ?
                 0 : (XFRM_MODE_SKB_CB(skb)->frag_off & htons(IP_DF));
-        ip_select_ident(top_iph, dst->child, NULL);
+        ip_select_ident(skb, dst->child, NULL);
 
         top_iph->ttl = ip4_dst_hoplimit(dst->child);
 
diff --git a/net/ipv4/xfrm4_output.c b/net/ipv4/xfrm4_output.c
index 327a617d594c..baa0f63731fd 100644
--- a/net/ipv4/xfrm4_output.c
+++ b/net/ipv4/xfrm4_output.c
@@ -21,7 +21,6 @@
 static int xfrm4_tunnel_check_size(struct sk_buff *skb)
 {
         int mtu, ret = 0;
-        struct dst_entry *dst;
 
         if (IPCB(skb)->flags & IPSKB_XFRM_TUNNEL_SIZE)
                 goto out;
@@ -29,12 +28,10 @@ static int xfrm4_tunnel_check_size(struct sk_buff *skb)
         if (!(ip_hdr(skb)->frag_off & htons(IP_DF)) || skb->local_df)
                 goto out;
 
-        dst = skb_dst(skb);
-        mtu = dst_mtu(dst);
+        mtu = dst_mtu(skb_dst(skb));
         if (skb->len > mtu) {
                 if (skb->sk)
-                        ip_local_error(skb->sk, EMSGSIZE, ip_hdr(skb)->daddr,
-                                       inet_sk(skb->sk)->inet_dport, mtu);
+                        xfrm_local_error(skb, mtu);
                 else
                         icmp_send(skb, ICMP_DEST_UNREACH,
                                   ICMP_FRAG_NEEDED, htonl(mtu));
@@ -99,3 +96,12 @@ int xfrm4_output(struct sk_buff *skb)
                             x->outer_mode->afinfo->output_finish,
                             !(IPCB(skb)->flags & IPSKB_REROUTED));
 }
+
+void xfrm4_local_error(struct sk_buff *skb, u32 mtu)
+{
+        struct iphdr *hdr;
+
+        hdr = skb->encapsulation ? inner_ip_hdr(skb) : ip_hdr(skb);
+        ip_local_error(skb->sk, EMSGSIZE, hdr->daddr,
+                       inet_sk(skb->sk)->inet_dport, mtu);
+}
diff --git a/net/ipv4/xfrm4_state.c b/net/ipv4/xfrm4_state.c
index 9258e751baba..0b2a0641526a 100644
--- a/net/ipv4/xfrm4_state.c
+++ b/net/ipv4/xfrm4_state.c
@@ -83,6 +83,7 @@ static struct xfrm_state_afinfo xfrm4_state_afinfo = {
         .extract_input          = xfrm4_extract_input,
         .extract_output         = xfrm4_extract_output,
         .transport_finish       = xfrm4_transport_finish,
+        .local_error            = xfrm4_local_error,
 };
 
 void __init xfrm4_state_init(void)
diff --git a/net/ipv4/xfrm4_tunnel.c b/net/ipv4/xfrm4_tunnel.c
index 05a5df2febc9..06347dbd32c1 100644
--- a/net/ipv4/xfrm4_tunnel.c
+++ b/net/ipv4/xfrm4_tunnel.c
@@ -63,7 +63,7 @@ static int xfrm_tunnel_err(struct sk_buff *skb, u32 info)
 static struct xfrm_tunnel xfrm_tunnel_handler __read_mostly = {
         .handler        =       xfrm_tunnel_rcv,
         .err_handler    =       xfrm_tunnel_err,
-        .priority       =       2,
+        .priority       =       3,
 };
 
 #if IS_ENABLED(CONFIG_IPV6)
diff --git a/net/ipv6/Makefile b/net/ipv6/Makefile
index 9af088d2cdaa..470a9c008e9b 100644
--- a/net/ipv6/Makefile
+++ b/net/ipv6/Makefile
@@ -7,7 +7,7 @@ obj-$(CONFIG_IPV6) += ipv6.o
 ipv6-objs :=    af_inet6.o anycast.o ip6_output.o ip6_input.o addrconf.o \
                 addrlabel.o \
                 route.o ip6_fib.o ipv6_sockglue.o ndisc.o udp.o udplite.o \
-                raw.o icmp.o mcast.o reassembly.o tcp_ipv6.o \
+                raw.o icmp.o mcast.o reassembly.o tcp_ipv6.o ping.o \
                 exthdrs.o datagram.o ip6_flowlabel.o inet6_connection_sock.o
 
 ipv6-offload := ip6_offload.o tcpv6_offload.o udp_offload.o exthdrs_offload.o
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index 1bbf744c2cc3..cd3fb301da38 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -99,9 +99,9 @@
 #define ACONF_DEBUG 2
 
 #if ACONF_DEBUG >= 3
-#define ADBG(x) printk x
+#define ADBG(fmt, ...) printk(fmt, ##__VA_ARGS__)
 #else
-#define ADBG(x)
+#define ADBG(fmt, ...) do { if (0) printk(fmt, ##__VA_ARGS__); } while (0)
 #endif
 
 #define INFINITY_LIFE_TIME      0xFFFFFFFF
@@ -177,6 +177,8 @@ static struct ipv6_devconf ipv6_devconf __read_mostly = {
         .accept_redirects       = 1,
         .autoconf               = 1,
         .force_mld_version      = 0,
+        .mldv1_unsolicited_report_interval = 10 * HZ,
+        .mldv2_unsolicited_report_interval = HZ,
         .dad_transmits          = 1,
         .rtr_solicits           = MAX_RTR_SOLICITATIONS,
         .rtr_solicit_interval   = RTR_SOLICITATION_INTERVAL,
@@ -202,6 +204,7 @@ static struct ipv6_devconf ipv6_devconf __read_mostly = {
         .accept_source_route    = 0,    /* we do not accept RH0 by default. */
         .disable_ipv6           = 0,
         .accept_dad             = 1,
+        .suppress_frag_ndisc    = 1,
 };
 
 static struct ipv6_devconf ipv6_devconf_dflt __read_mostly = {
@@ -211,6 +214,9 @@ static struct ipv6_devconf ipv6_devconf_dflt __read_mostly = {
         .accept_ra              = 1,
         .accept_redirects       = 1,
         .autoconf               = 1,
+        .force_mld_version      = 0,
+        .mldv1_unsolicited_report_interval = 10 * HZ,
+        .mldv2_unsolicited_report_interval = HZ,
         .dad_transmits          = 1,
         .rtr_solicits           = MAX_RTR_SOLICITATIONS,
         .rtr_solicit_interval   = RTR_SOLICITATION_INTERVAL,
@@ -236,54 +242,41 @@ static struct ipv6_devconf ipv6_devconf_dflt __read_mostly = {
         .accept_source_route    = 0,    /* we do not accept RH0 by default. */
         .disable_ipv6           = 0,
         .accept_dad             = 1,
+        .suppress_frag_ndisc    = 1,
 };
 
-/* IPv6 Wildcard Address and Loopback Address defined by RFC2553 */
-const struct in6_addr in6addr_any = IN6ADDR_ANY_INIT;
-const struct in6_addr in6addr_loopback = IN6ADDR_LOOPBACK_INIT;
-const struct in6_addr in6addr_linklocal_allnodes = IN6ADDR_LINKLOCAL_ALLNODES_INIT;
-const struct in6_addr in6addr_linklocal_allrouters = IN6ADDR_LINKLOCAL_ALLROUTERS_INIT;
-const struct in6_addr in6addr_interfacelocal_allnodes = IN6ADDR_INTERFACELOCAL_ALLNODES_INIT;
-const struct in6_addr in6addr_interfacelocal_allrouters = IN6ADDR_INTERFACELOCAL_ALLROUTERS_INIT;
-const struct in6_addr in6addr_sitelocal_allrouters = IN6ADDR_SITELOCAL_ALLROUTERS_INIT;
-
 /* Check if a valid qdisc is available */
 static inline bool addrconf_qdisc_ok(const struct net_device *dev)
 {
         return !qdisc_tx_is_noop(dev);
 }
 
-static void addrconf_del_timer(struct inet6_ifaddr *ifp)
+static void addrconf_del_rs_timer(struct inet6_dev *idev)
+{
+        if (del_timer(&idev->rs_timer))
+                __in6_dev_put(idev);
+}
+
+static void addrconf_del_dad_timer(struct inet6_ifaddr *ifp)
 {
-        if (del_timer(&ifp->timer))
+        if (del_timer(&ifp->dad_timer))
                 __in6_ifa_put(ifp);
 }
 
-enum addrconf_timer_t {
-        AC_NONE,
-        AC_DAD,
-        AC_RS,
-};
+static void addrconf_mod_rs_timer(struct inet6_dev *idev,
+                                  unsigned long when)
+{
+        if (!timer_pending(&idev->rs_timer))
+                in6_dev_hold(idev);
+        mod_timer(&idev->rs_timer, jiffies + when);
+}
 
-static void addrconf_mod_timer(struct inet6_ifaddr *ifp,
-                               enum addrconf_timer_t what,
-                               unsigned long when)
+static void addrconf_mod_dad_timer(struct inet6_ifaddr *ifp,
+                                   unsigned long when)
 {
-        if (!del_timer(&ifp->timer))
+        if (!timer_pending(&ifp->dad_timer))
                 in6_ifa_hold(ifp);
-
-        switch (what) {
-        case AC_DAD:
-                ifp->timer.function = addrconf_dad_timer;
-                break;
-        case AC_RS:
-                ifp->timer.function = addrconf_rs_timer;
-                break;
-        default:
-                break;
-        }
-        ifp->timer.expires = jiffies + when;
-        add_timer(&ifp->timer);
+        mod_timer(&ifp->dad_timer, jiffies + when);
 }
 
 static int snmp6_alloc_dev(struct inet6_dev *idev)
@@ -311,35 +304,6 @@ err_ip:
         return -ENOMEM;
 }
 
-static void snmp6_free_dev(struct inet6_dev *idev)
-{
-        kfree(idev->stats.icmpv6msgdev);
-        kfree(idev->stats.icmpv6dev);
-        snmp_mib_free((void __percpu **)idev->stats.ipv6);
-}
-
-/* Nobody refers to this device, we may destroy it. */
-
-void in6_dev_finish_destroy(struct inet6_dev *idev)
-{
-        struct net_device *dev = idev->dev;
-
-        WARN_ON(!list_empty(&idev->addr_list));
-        WARN_ON(idev->mc_list != NULL);
-
-#ifdef NET_REFCNT_DEBUG
-        pr_debug("%s: %s\n", __func__, dev ? dev->name : "NIL");
-#endif
-        dev_put(dev);
-        if (!idev->dead) {
-                pr_warn("Freeing alive inet6 device %p\n", idev);
-                return;
-        }
-        snmp6_free_dev(idev);
-        kfree_rcu(idev, rcu);
-}
-EXPORT_SYMBOL(in6_dev_finish_destroy);
-
 static struct inet6_dev *ipv6_add_dev(struct net_device *dev)
 {
         struct inet6_dev *ndev;
@@ -357,7 +321,8 @@ static struct inet6_dev *ipv6_add_dev(struct net_device *dev)
         rwlock_init(&ndev->lock);
         ndev->dev = dev;
         INIT_LIST_HEAD(&ndev->addr_list);
-
+        setup_timer(&ndev->rs_timer, addrconf_rs_timer,
+                    (unsigned long)ndev);
         memcpy(&ndev->cnf, dev_net(dev)->ipv6.devconf_dflt, sizeof(ndev->cnf));
         ndev->cnf.mtu6 = dev->mtu;
         ndev->cnf.sysctl = NULL;
@@ -372,9 +337,9 @@ static struct inet6_dev *ipv6_add_dev(struct net_device *dev)
         dev_hold(dev);
 
         if (snmp6_alloc_dev(ndev) < 0) {
-                ADBG((KERN_WARNING
+                ADBG(KERN_WARNING
                         "%s: cannot allocate memory for statistics; dev=%s.\n",
-                        __func__, dev->name));
+                        __func__, dev->name);
                 neigh_parms_release(&nd_tbl, ndev->nd_parms);
                 dev_put(dev);
                 kfree(ndev);
@@ -382,9 +347,9 @@ static struct inet6_dev *ipv6_add_dev(struct net_device *dev)
         }
 
         if (snmp6_register_dev(ndev) < 0) {
-                ADBG((KERN_WARNING
+                ADBG(KERN_WARNING
                         "%s: cannot create /proc/net/dev_snmp6/%s\n",
-                        __func__, dev->name));
+                        __func__, dev->name);
                 neigh_parms_release(&nd_tbl, ndev->nd_parms);
                 ndev->dead = 1;
                 in6_dev_finish_destroy(ndev);
@@ -776,7 +741,7 @@ void inet6_ifa_finish_destroy(struct inet6_ifaddr *ifp)
 
         in6_dev_put(ifp->idev);
 
-        if (del_timer(&ifp->timer))
+        if (del_timer(&ifp->dad_timer))
                 pr_notice("Timer is still running, when freeing ifa=%p\n", ifp);
 
         if (ifp->state != INET6_IFADDR_STATE_DEAD) {
@@ -816,8 +781,9 @@ static u32 inet6_addr_hash(const struct in6_addr *addr)
 /* On success it returns ifp with increased reference count */
 
 static struct inet6_ifaddr *
-ipv6_add_addr(struct inet6_dev *idev, const struct in6_addr *addr, int pfxlen,
-              int scope, u32 flags)
+ipv6_add_addr(struct inet6_dev *idev, const struct in6_addr *addr,
+              const struct in6_addr *peer_addr, int pfxlen,
+              int scope, u32 flags, u32 valid_lft, u32 prefered_lft)
 {
         struct inet6_ifaddr *ifa = NULL;
         struct rt6_info *rt;
@@ -846,7 +812,7 @@ ipv6_add_addr(struct inet6_dev *idev, const struct in6_addr *addr, int pfxlen,
 
         /* Ignore adding duplicate addresses on an interface */
         if (ipv6_chk_same_addr(dev_net(idev->dev), addr, idev->dev)) {
-                ADBG(("ipv6_add_addr: already assigned\n"));
+                ADBG("ipv6_add_addr: already assigned\n");
                 err = -EEXIST;
                 goto out;
         }
@@ -854,7 +820,7 @@ ipv6_add_addr(struct inet6_dev *idev, const struct in6_addr *addr, int pfxlen,
         ifa = kzalloc(sizeof(struct inet6_ifaddr), GFP_ATOMIC);
 
         if (ifa == NULL) {
-                ADBG(("ipv6_add_addr: malloc failed\n"));
+                ADBG("ipv6_add_addr: malloc failed\n");
                 err = -ENOBUFS;
                 goto out;
         }
@@ -866,15 +832,19 @@ ipv6_add_addr(struct inet6_dev *idev, const struct in6_addr *addr, int pfxlen,
         }
 
         ifa->addr = *addr;
+        if (peer_addr)
+                ifa->peer_addr = *peer_addr;
 
         spin_lock_init(&ifa->lock);
         spin_lock_init(&ifa->state_lock);
-        init_timer(&ifa->timer);
+        setup_timer(&ifa->dad_timer, addrconf_dad_timer,
+                    (unsigned long)ifa);
         INIT_HLIST_NODE(&ifa->addr_lst);
-        ifa->timer.data = (unsigned long) ifa;
         ifa->scope = scope;
         ifa->prefix_len = pfxlen;
         ifa->flags = flags | IFA_F_TENTATIVE;
+        ifa->valid_lft = valid_lft;
+        ifa->prefered_lft = prefered_lft;
         ifa->cstamp = ifa->tstamp = jiffies;
         ifa->tokenized = false;
 
@@ -994,7 +964,7 @@ static void ipv6_del_addr(struct inet6_ifaddr *ifp)
         }
         write_unlock_bh(&idev->lock);
 
-        addrconf_del_timer(ifp);
+        addrconf_del_dad_timer(ifp);
 
         ipv6_ifa_notify(RTM_DELADDR, ifp);
 
@@ -1052,7 +1022,6 @@ static int ipv6_create_tempaddr(struct inet6_ifaddr *ifp, struct inet6_ifaddr *i
         unsigned long regen_advance;
         int tmp_plen;
         int ret = 0;
-        int max_addresses;
         u32 addr_flags;
         unsigned long now = jiffies;
 
@@ -1098,7 +1067,6 @@ retry:
                                  idev->cnf.temp_prefered_lft + age -
                                  idev->cnf.max_desync_factor);
         tmp_plen = ifp->prefix_len;
-        max_addresses = idev->cnf.max_addresses;
         tmp_tstamp = ifp->tstamp;
         spin_unlock_bh(&ifp->lock);
 
@@ -1124,12 +1092,10 @@ retry:
         if (ifp->flags & IFA_F_OPTIMISTIC)
                 addr_flags |= IFA_F_OPTIMISTIC;
 
-        ift = !max_addresses ||
-              ipv6_count_addresses(idev) < max_addresses ?
-                ipv6_add_addr(idev, &addr, tmp_plen,
-                              ipv6_addr_type(&addr)&IPV6_ADDR_SCOPE_MASK,
-                              addr_flags) : NULL;
-        if (IS_ERR_OR_NULL(ift)) {
+        ift = ipv6_add_addr(idev, &addr, NULL, tmp_plen,
+                            ipv6_addr_scope(&addr), addr_flags,
+                            tmp_valid_lft, tmp_prefered_lft);
+        if (IS_ERR(ift)) {
                 in6_ifa_put(ifp);
                 in6_dev_put(idev);
                 pr_info("%s: retry temporary address regeneration\n", __func__);
@@ -1140,8 +1106,6 @@ retry:
 
         spin_lock_bh(&ift->lock);
         ift->ifpub = ifp;
-        ift->valid_lft = tmp_valid_lft;
-        ift->prefered_lft = tmp_prefered_lft;
         ift->cstamp = now;
         ift->tstamp = tmp_tstamp;
         spin_unlock_bh(&ift->lock);
@@ -1448,6 +1412,23 @@ try_nextdev:
 }
 EXPORT_SYMBOL(ipv6_dev_get_saddr);
 
+int __ipv6_get_lladdr(struct inet6_dev *idev, struct in6_addr *addr,
+                      unsigned char banned_flags)
+{
+        struct inet6_ifaddr *ifp;
+        int err = -EADDRNOTAVAIL;
+
+        list_for_each_entry(ifp, &idev->addr_list, if_list) {
+                if (ifp->scope == IFA_LINK &&
+                    !(ifp->flags & banned_flags)) {
+                        *addr = ifp->addr;
+                        err = 0;
+                        break;
+                }
+        }
+        return err;
+}
+
 int ipv6_get_lladdr(struct net_device *dev, struct in6_addr *addr,
                     unsigned char banned_flags)
 {
@@ -1457,17 +1438,8 @@ int ipv6_get_lladdr(struct net_device *dev, struct in6_addr *addr,
         rcu_read_lock();
         idev = __in6_dev_get(dev);
         if (idev) {
-                struct inet6_ifaddr *ifp;
-
                 read_lock_bh(&idev->lock);
-                list_for_each_entry(ifp, &idev->addr_list, if_list) {
-                        if (ifp->scope == IFA_LINK &&
-                            !(ifp->flags & banned_flags)) {
-                                *addr = ifp->addr;
-                                err = 0;
-                                break;
-                        }
-                }
+                err = __ipv6_get_lladdr(idev, addr, banned_flags);
                 read_unlock_bh(&idev->lock);
         }
         rcu_read_unlock();
@@ -1527,6 +1499,33 @@ static bool ipv6_chk_same_addr(struct net *net, const struct in6_addr *addr,
         return false;
 }
 
+/* Compares an address/prefix_len with addresses on device @dev.
+ * If one is found it returns true.
+ */
+bool ipv6_chk_custom_prefix(const struct in6_addr *addr,
+        const unsigned int prefix_len, struct net_device *dev)
+{
+        struct inet6_dev *idev;
+        struct inet6_ifaddr *ifa;
+        bool ret = false;
+
+        rcu_read_lock();
+        idev = __in6_dev_get(dev);
+        if (idev) {
+                read_lock_bh(&idev->lock);
+                list_for_each_entry(ifa, &idev->addr_list, if_list) {
+                        ret = ipv6_prefix_equal(addr, &ifa->addr, prefix_len);
+                        if (ret)
+                                break;
+                }
+                read_unlock_bh(&idev->lock);
+        }
+        rcu_read_unlock();
+
+        return ret;
+}
+EXPORT_SYMBOL(ipv6_chk_custom_prefix);
+
 int ipv6_chk_prefix(const struct in6_addr *addr, struct net_device *dev)
 {
         struct inet6_dev *idev;
@@ -1581,7 +1580,7 @@ static void addrconf_dad_stop(struct inet6_ifaddr *ifp, int dad_failed)
 {
         if (ifp->flags&IFA_F_PERMANENT) {
                 spin_lock_bh(&ifp->lock);
-                addrconf_del_timer(ifp);
+                addrconf_del_dad_timer(ifp);
                 ifp->flags |= IFA_F_TENTATIVE;
                 if (dad_failed)
                         ifp->flags |= IFA_F_DADFAILED;
@@ -1801,6 +1800,16 @@ static int addrconf_ifid_gre(u8 *eui, struct net_device *dev)
         return __ipv6_isatap_ifid(eui, *(__be32 *)dev->dev_addr);
 }
 
+static int addrconf_ifid_ip6tnl(u8 *eui, struct net_device *dev)
+{
+        memcpy(eui, dev->perm_addr, 3);
+        memcpy(eui + 5, dev->perm_addr + 3, 3);
+        eui[3] = 0xFF;
+        eui[4] = 0xFE;
+        eui[0] ^= 2;
+        return 0;
+}
+
 static int ipv6_generate_eui64(u8 *eui, struct net_device *dev)
 {
         switch (dev->type) {
@@ -1819,6 +1828,8 @@ static int ipv6_generate_eui64(u8 *eui, struct net_device *dev)
                 return addrconf_ifid_eui64(eui, dev);
         case ARPHRD_IEEE1394:
                 return addrconf_ifid_ieee1394(eui, dev);
+        case ARPHRD_TUNNEL6:
+                return addrconf_ifid_ip6tnl(eui, dev);
         }
         return -1;
 }
@@ -2044,7 +2055,7 @@ void addrconf_prefix_rcv(struct net_device *dev, u8 *opt, int len, bool sllao)
         pinfo = (struct prefix_info *) opt;
 
         if (len < sizeof(struct prefix_info)) {
-                ADBG(("addrconf: prefix option too short\n"));
+                ADBG("addrconf: prefix option too short\n");
                 return;
         }
 
@@ -2175,16 +2186,19 @@ ok:
                          */
                         if (!max_addresses ||
                             ipv6_count_addresses(in6_dev) < max_addresses)
-                                ifp = ipv6_add_addr(in6_dev, &addr, pinfo->prefix_len,
+                                ifp = ipv6_add_addr(in6_dev, &addr, NULL,
+                                                    pinfo->prefix_len,
                                                     addr_type&IPV6_ADDR_SCOPE_MASK,
-                                                    addr_flags);
+                                                    addr_flags, valid_lft,
+                                                    prefered_lft);
 
                         if (IS_ERR_OR_NULL(ifp)) {
                                 in6_dev_put(in6_dev);
                                 return;
                         }
 
-                        update_lft = create = 1;
+                        update_lft = 0;
+                        create = 1;
                         ifp->cstamp = jiffies;
                         ifp->tokenized = tokenized;
                         addrconf_dad_start(ifp);
@@ -2205,44 +2219,22 @@ ok:
                                 stored_lft = ifp->valid_lft - (now - ifp->tstamp) / HZ;
                         else
                                 stored_lft = 0;
-                        if (!update_lft && stored_lft) {
-                                if (valid_lft > MIN_VALID_LIFETIME ||
-                                    valid_lft > stored_lft)
-                                        update_lft = 1;
-                                else if (stored_lft <= MIN_VALID_LIFETIME) {
-                                        /* valid_lft <= stored_lft is always true */
-                                        /*
-                                         * RFC 4862 Section 5.5.3e:
-                                         * "Note that the preferred lifetime of
-                                         *  the corresponding address is always
-                                         *  reset to the Preferred Lifetime in
-                                         *  the received Prefix Information
-                                         *  option, regardless of whether the
-                                         *  valid lifetime is also reset or
-                                         *  ignored."
-                                         *
-                                         *  So if the preferred lifetime in
-                                         *  this advertisement is different
-                                         *  than what we have stored, but the
-                                         *  valid lifetime is invalid, just
-                                         *  reset prefered_lft.
-                                         *
-                                         *  We must set the valid lifetime
-                                         *  to the stored lifetime since we'll
-                                         *  be updating the timestamp below,
-                                         *  else we'll set it back to the
-                                         *  minimum.
-                                         */
-                                        if (prefered_lft != ifp->prefered_lft) {
-                                                valid_lft = stored_lft;
-                                                update_lft = 1;
-                                        }
-                                } else {
-                                        valid_lft = MIN_VALID_LIFETIME;
-                                        if (valid_lft < prefered_lft)
-                                                prefered_lft = valid_lft;
-                                        update_lft = 1;
-                                }
+                        if (!update_lft && !create && stored_lft) {
+                                const u32 minimum_lft = min(
+                                        stored_lft, (u32)MIN_VALID_LIFETIME);
+                                valid_lft = max(valid_lft, minimum_lft);
+
+                                /* RFC4862 Section 5.5.3e:
+                                 * "Note that the preferred lifetime of the
+                                 *  corresponding address is always reset to
+                                 *  the Preferred Lifetime in the received
+                                 *  Prefix Information option, regardless of
+                                 *  whether the valid lifetime is also reset or
+                                 *  ignored."
+                                 *
+                                 * So we should always update prefered_lft here.
+                                 */
+                                update_lft = 1;
                         }
 
                         if (update_lft) {
@@ -2402,6 +2394,7 @@ err_exit:
  *      Manual configuration of address on an interface
  */
 static int inet6_addr_add(struct net *net, int ifindex, const struct in6_addr *pfx,
+                          const struct in6_addr *peer_pfx,
                           unsigned int plen, __u8 ifa_flags, __u32 prefered_lft,
                           __u32 valid_lft)
 {
@@ -2450,15 +2443,10 @@ static int inet6_addr_add(struct net *net, int ifindex, const struct in6_addr *p
                 prefered_lft = timeout;
         }
 
-        ifp = ipv6_add_addr(idev, pfx, plen, scope, ifa_flags);
+        ifp = ipv6_add_addr(idev, pfx, peer_pfx, plen, scope, ifa_flags,
+                            valid_lft, prefered_lft);
 
         if (!IS_ERR(ifp)) {
-                spin_lock_bh(&ifp->lock);
-                ifp->valid_lft = valid_lft;
-                ifp->prefered_lft = prefered_lft;
-                ifp->tstamp = jiffies;
-                spin_unlock_bh(&ifp->lock);
-
                 addrconf_prefix_route(&ifp->addr, ifp->prefix_len, dev,
                                       expires, flags);
                 /*
@@ -2500,12 +2488,6 @@ static int inet6_addr_del(struct net *net, int ifindex, const struct in6_addr *p
                         read_unlock_bh(&idev->lock);
 
                         ipv6_del_addr(ifp);
-
-                        /* If the last address is deleted administratively,
-                           disable IPv6 on this interface.
-                         */
-                        if (list_empty(&idev->addr_list))
-                                addrconf_ifdown(idev->dev, 1);
                         return 0;
                 }
         }
@@ -2526,7 +2508,7 @@ int addrconf_add_ifaddr(struct net *net, void __user *arg)
                 return -EFAULT;
 
         rtnl_lock();
-        err = inet6_addr_add(net, ireq.ifr6_ifindex, &ireq.ifr6_addr,
+        err = inet6_addr_add(net, ireq.ifr6_ifindex, &ireq.ifr6_addr, NULL,
                              ireq.ifr6_prefixlen, IFA_F_PERMANENT,
                              INFINITY_LIFE_TIME, INFINITY_LIFE_TIME);
         rtnl_unlock();
@@ -2556,7 +2538,8 @@ static void add_addr(struct inet6_dev *idev, const struct in6_addr *addr,
 {
         struct inet6_ifaddr *ifp;
 
-        ifp = ipv6_add_addr(idev, addr, plen, scope, IFA_F_PERMANENT);
+        ifp = ipv6_add_addr(idev, addr, NULL, plen,
+                            scope, IFA_F_PERMANENT, 0, 0);
         if (!IS_ERR(ifp)) {
                 spin_lock_bh(&ifp->lock);
                 ifp->flags &= ~IFA_F_TENTATIVE;
@@ -2655,6 +2638,9 @@ static void init_loopback(struct net_device *dev)
                         if (sp_ifa->flags & (IFA_F_DADFAILED | IFA_F_TENTATIVE))
                                 continue;
 
+                        if (sp_ifa->rt)
+                                continue;
+
                         sp_rt = addrconf_dst_alloc(idev, &sp_ifa->addr, 0);
 
                         /* Failure cases are ignored */
@@ -2679,7 +2665,7 @@ static void addrconf_add_linklocal(struct inet6_dev *idev, const struct in6_addr
 #endif
 
 
-        ifp = ipv6_add_addr(idev, addr, 64, IFA_LINK, addr_flags);
+        ifp = ipv6_add_addr(idev, addr, NULL, 64, IFA_LINK, addr_flags, 0, 0);
         if (!IS_ERR(ifp)) {
                 addrconf_prefix_route(&ifp->addr, ifp->prefix_len, idev->dev, 0, 0);
                 addrconf_dad_start(ifp);
@@ -2699,7 +2685,8 @@ static void addrconf_dev_config(struct net_device *dev)
             (dev->type != ARPHRD_ARCNET) &&
             (dev->type != ARPHRD_INFINIBAND) &&
             (dev->type != ARPHRD_IEEE802154) &&
-            (dev->type != ARPHRD_IEEE1394)) {
+            (dev->type != ARPHRD_IEEE1394) &&
+            (dev->type != ARPHRD_TUNNEL6)) {
                 /* Alas, we support only Ethernet autoconfiguration. */
                 return;
         }
@@ -2758,8 +2745,6 @@ static void addrconf_gre_config(struct net_device *dev)
         struct inet6_dev *idev;
         struct in6_addr addr;
 
-        pr_info("%s(%s)\n", __func__, dev->name);
-
         ASSERT_RTNL();
 
         if ((idev = ipv6_find_idev(dev)) == NULL) {
@@ -2787,48 +2772,10 @@ ipv6_inherit_linklocal(struct inet6_dev *idev, struct net_device *link_dev)
         return -1;
 }
 
-static void ip6_tnl_add_linklocal(struct inet6_dev *idev)
-{
-        struct net_device *link_dev;
-        struct net *net = dev_net(idev->dev);
-
-        /* first try to inherit the link-local address from the link device */
-        if (idev->dev->iflink &&
-            (link_dev = __dev_get_by_index(net, idev->dev->iflink))) {
-                if (!ipv6_inherit_linklocal(idev, link_dev))
-                        return;
-        }
-        /* then try to inherit it from any device */
-        for_each_netdev(net, link_dev) {
-                if (!ipv6_inherit_linklocal(idev, link_dev))
-                        return;
-        }
-        pr_debug("init ip6-ip6: add_linklocal failed\n");
-}
-
-/*
- * Autoconfigure tunnel with a link-local address so routing protocols,
- * DHCPv6, MLD etc. can be run over the virtual link
- */
-
-static void addrconf_ip6_tnl_config(struct net_device *dev)
-{
-        struct inet6_dev *idev;
-
-        ASSERT_RTNL();
-
-        idev = addrconf_add_dev(dev);
-        if (IS_ERR(idev)) {
-                pr_debug("init ip6-ip6: add_dev failed\n");
-                return;
-        }
-        ip6_tnl_add_linklocal(idev);
-}
-
 static int addrconf_notify(struct notifier_block *this, unsigned long event,
-                           void *data)
+                           void *ptr)
 {
-        struct net_device *dev = (struct net_device *) data;
+        struct net_device *dev = netdev_notifier_info_to_dev(ptr);
         struct inet6_dev *idev = __in6_dev_get(dev);
         int run_pending = 0;
         int err;
@@ -2892,9 +2839,6 @@ static int addrconf_notify(struct notifier_block *this, unsigned long event,
                         addrconf_gre_config(dev);
                         break;
 #endif
-                case ARPHRD_TUNNEL6:
-                        addrconf_ip6_tnl_config(dev);
-                        break;
                 case ARPHRD_LOOPBACK:
                         init_loopback(dev);
                         break;
@@ -3036,7 +2980,7 @@ static int addrconf_ifdown(struct net_device *dev, int how)
                 hlist_for_each_entry_rcu(ifa, h, addr_lst) {
                         if (ifa->idev == idev) {
                                 hlist_del_init_rcu(&ifa->addr_lst);
-                                addrconf_del_timer(ifa);
+                                addrconf_del_dad_timer(ifa);
                                 goto restart;
                         }
                 }
@@ -3045,6 +2989,8 @@ static int addrconf_ifdown(struct net_device *dev, int how)
 
         write_lock_bh(&idev->lock);
 
+        addrconf_del_rs_timer(idev);
+
         /* Step 2: clear flags for stateless addrconf */
         if (!how)
                 idev->if_flags &= ~(IF_RS_SENT|IF_RA_RCVD|IF_READY);
@@ -3074,7 +3020,7 @@ static int addrconf_ifdown(struct net_device *dev, int how)
         while (!list_empty(&idev->addr_list)) {
                 ifa = list_first_entry(&idev->addr_list,
                                        struct inet6_ifaddr, if_list);
-                addrconf_del_timer(ifa);
+                addrconf_del_dad_timer(ifa);
 
                 list_del(&ifa->if_list);
 
@@ -3116,10 +3062,11 @@ static int addrconf_ifdown(struct net_device *dev, int how)
 
 static void addrconf_rs_timer(unsigned long data)
 {
-        struct inet6_ifaddr *ifp = (struct inet6_ifaddr *) data;
-        struct inet6_dev *idev = ifp->idev;
+        struct inet6_dev *idev = (struct inet6_dev *)data;
+        struct net_device *dev = idev->dev;
+        struct in6_addr lladdr;
 
-        read_lock(&idev->lock);
+        write_lock(&idev->lock);
         if (idev->dead || !(idev->if_flags & IF_READY))
                 goto out;
 
@@ -3130,18 +3077,21 @@ static void addrconf_rs_timer(unsigned long data)
         if (idev->if_flags & IF_RA_RCVD)
                 goto out;
 
-        spin_lock(&ifp->lock);
-        if (ifp->probes++ < idev->cnf.rtr_solicits) {
-                /* The wait after the last probe can be shorter */
-                addrconf_mod_timer(ifp, AC_RS,
-                                   (ifp->probes == idev->cnf.rtr_solicits) ?
-                                   idev->cnf.rtr_solicit_delay :
-                                   idev->cnf.rtr_solicit_interval);
-                spin_unlock(&ifp->lock);
+        if (idev->rs_probes++ < idev->cnf.rtr_solicits) {
+                write_unlock(&idev->lock);
+                if (!ipv6_get_lladdr(dev, &lladdr, IFA_F_TENTATIVE))
+                        ndisc_send_rs(dev, &lladdr,
+                                      &in6addr_linklocal_allrouters);
+                else
+                        goto put;
 
-                ndisc_send_rs(idev->dev, &ifp->addr, &in6addr_linklocal_allrouters);
+                write_lock(&idev->lock);
+                /* The wait after the last probe can be shorter */
+                addrconf_mod_rs_timer(idev, (idev->rs_probes ==
+                                             idev->cnf.rtr_solicits) ?
+                                      idev->cnf.rtr_solicit_delay :
+                                      idev->cnf.rtr_solicit_interval);
         } else {
-                spin_unlock(&ifp->lock);
                 /*
                  * Note: we do not support deprecated "all on-link"
                  * assumption any longer.
@@ -3150,8 +3100,9 @@ static void addrconf_rs_timer(unsigned long data)
         }
 
 out:
-        read_unlock(&idev->lock);
-        in6_ifa_put(ifp);
+        write_unlock(&idev->lock);
+put:
+        in6_dev_put(idev);
 }
 
 /*
@@ -3167,8 +3118,8 @@ static void addrconf_dad_kick(struct inet6_ifaddr *ifp)
         else
                 rand_num = net_random() % (idev->cnf.rtr_solicit_delay ? : 1);
 
-        ifp->probes = idev->cnf.dad_transmits;
-        addrconf_mod_timer(ifp, AC_DAD, rand_num);
+        ifp->dad_probes = idev->cnf.dad_transmits;
+        addrconf_mod_dad_timer(ifp, rand_num);
 }
 
 static void addrconf_dad_start(struct inet6_ifaddr *ifp)
@@ -3229,40 +3180,40 @@ static void addrconf_dad_timer(unsigned long data)
         struct inet6_dev *idev = ifp->idev;
         struct in6_addr mcaddr;
 
-        if (!ifp->probes && addrconf_dad_end(ifp))
+        if (!ifp->dad_probes && addrconf_dad_end(ifp))
                 goto out;
 
-        read_lock(&idev->lock);
+        write_lock(&idev->lock);
         if (idev->dead || !(idev->if_flags & IF_READY)) {
-                read_unlock(&idev->lock);
+                write_unlock(&idev->lock);
                 goto out;
         }
 
         spin_lock(&ifp->lock);
         if (ifp->state == INET6_IFADDR_STATE_DEAD) {
                 spin_unlock(&ifp->lock);
-                read_unlock(&idev->lock);
+                write_unlock(&idev->lock);
                 goto out;
         }
 
-        if (ifp->probes == 0) {
+        if (ifp->dad_probes == 0) {
                 /*
                  * DAD was successful
                  */
 
                 ifp->flags &= ~(IFA_F_TENTATIVE|IFA_F_OPTIMISTIC|IFA_F_DADFAILED);
                 spin_unlock(&ifp->lock);
-                read_unlock(&idev->lock);
+                write_unlock(&idev->lock);
 
                 addrconf_dad_completed(ifp);
 
                 goto out;
         }
 
-        ifp->probes--;
-        addrconf_mod_timer(ifp, AC_DAD, ifp->idev->nd_parms->retrans_time);
+        ifp->dad_probes--;
+        addrconf_mod_dad_timer(ifp, ifp->idev->nd_parms->retrans_time);
         spin_unlock(&ifp->lock);
-        read_unlock(&idev->lock);
+        write_unlock(&idev->lock);
 
         /* send a neighbour solicitation for our addr */
         addrconf_addr_solict_mult(&ifp->addr, &mcaddr);
@@ -3274,6 +3225,10 @@ out:
 static void addrconf_dad_completed(struct inet6_ifaddr *ifp)
 {
         struct net_device *dev = ifp->idev->dev;
+        struct in6_addr lladdr;
+        bool send_rs, send_mld;
+
+        addrconf_del_dad_timer(ifp);
 
         /*
          *      Configure the address for reception. Now it is valid.
@@ -3285,22 +3240,41 @@ static void addrconf_dad_completed(struct inet6_ifaddr *ifp)
            router advertisements, start sending router solicitations.
          */
 
-        if (ipv6_accept_ra(ifp->idev) &&
-            ifp->idev->cnf.rtr_solicits > 0 &&
-            (dev->flags&IFF_LOOPBACK) == 0 &&
-            (ipv6_addr_type(&ifp->addr) & IPV6_ADDR_LINKLOCAL)) {
+        read_lock_bh(&ifp->idev->lock);
+        spin_lock(&ifp->lock);
+        send_mld = ipv6_addr_type(&ifp->addr) & IPV6_ADDR_LINKLOCAL &&
+                   ifp->idev->valid_ll_addr_cnt == 1;
+        send_rs = send_mld &&
+                  ipv6_accept_ra(ifp->idev) &&
+                  ifp->idev->cnf.rtr_solicits > 0 &&
+                  (dev->flags&IFF_LOOPBACK) == 0;
+        spin_unlock(&ifp->lock);
+        read_unlock_bh(&ifp->idev->lock);
+
+        /* While dad is in progress mld report's source address is in6_addrany.
+         * Resend with proper ll now.
+         */
+        if (send_mld)
+                ipv6_mc_dad_complete(ifp->idev);
+
+        if (send_rs) {
                 /*
                  *      If a host as already performed a random delay
                  *      [...] as part of DAD [...] there is no need
                  *      to delay again before sending the first RS
                  */
-                ndisc_send_rs(ifp->idev->dev, &ifp->addr, &in6addr_linklocal_allrouters);
+                if (ipv6_get_lladdr(dev, &lladdr, IFA_F_TENTATIVE))
+                        return;
+                ndisc_send_rs(dev, &lladdr, &in6addr_linklocal_allrouters);
 
-                spin_lock_bh(&ifp->lock);
-                ifp->probes = 1;
+                write_lock_bh(&ifp->idev->lock);
+                spin_lock(&ifp->lock);
+                ifp->idev->rs_probes = 1;
                 ifp->idev->if_flags |= IF_RS_SENT;
-                addrconf_mod_timer(ifp, AC_RS, ifp->idev->cnf.rtr_solicit_interval);
-                spin_unlock_bh(&ifp->lock);
+                addrconf_mod_rs_timer(ifp->idev,
+                                      ifp->idev->cnf.rtr_solicit_interval);
+                spin_unlock(&ifp->lock);
+                write_unlock_bh(&ifp->idev->lock);
         }
 }
 
@@ -3603,8 +3577,8 @@ restart:
         if (time_before(next_sched, jiffies + ADDRCONF_TIMER_FUZZ_MAX))
                 next_sched = jiffies + ADDRCONF_TIMER_FUZZ_MAX;
 
-        ADBG((KERN_DEBUG "now = %lu, schedule = %lu, rounded schedule = %lu => %lu\n",
-              now, next, next_sec, next_sched));
+        ADBG(KERN_DEBUG "now = %lu, schedule = %lu, rounded schedule = %lu => %lu\n",
+              now, next, next_sec, next_sched);
 
         addr_chk_timer.expires = next_sched;
         add_timer(&addr_chk_timer);
@@ -3612,18 +3586,20 @@ restart:
         rcu_read_unlock_bh();
 }
 
-static struct in6_addr *extract_addr(struct nlattr *addr, struct nlattr *local)
+static struct in6_addr *extract_addr(struct nlattr *addr, struct nlattr *local,
+                                     struct in6_addr **peer_pfx)
 {
         struct in6_addr *pfx = NULL;
 
+        *peer_pfx = NULL;
+
         if (addr)
                 pfx = nla_data(addr);
 
         if (local) {
                 if (pfx && nla_memcmp(local, pfx, sizeof(*pfx)))
-                        pfx = NULL;
-                else
-                        pfx = nla_data(local);
+                        *peer_pfx = pfx;
+                pfx = nla_data(local);
         }
 
         return pfx;
@@ -3641,7 +3617,7 @@ inet6_rtm_deladdr(struct sk_buff *skb, struct nlmsghdr *nlh)
         struct net *net = sock_net(skb->sk);
         struct ifaddrmsg *ifm;
         struct nlattr *tb[IFA_MAX+1];
-        struct in6_addr *pfx;
+        struct in6_addr *pfx, *peer_pfx;
         int err;
 
         err = nlmsg_parse(nlh, sizeof(*ifm), tb, IFA_MAX, ifa_ipv6_policy);
@@ -3649,7 +3625,7 @@ inet6_rtm_deladdr(struct sk_buff *skb, struct nlmsghdr *nlh)
                 return err;
 
         ifm = nlmsg_data(nlh);
-        pfx = extract_addr(tb[IFA_ADDRESS], tb[IFA_LOCAL]);
+        pfx = extract_addr(tb[IFA_ADDRESS], tb[IFA_LOCAL], &peer_pfx);
         if (pfx == NULL)
                 return -EINVAL;
 
@@ -3707,7 +3683,7 @@ inet6_rtm_newaddr(struct sk_buff *skb, struct nlmsghdr *nlh)
         struct net *net = sock_net(skb->sk);
         struct ifaddrmsg *ifm;
         struct nlattr *tb[IFA_MAX+1];
-        struct in6_addr *pfx;
+        struct in6_addr *pfx, *peer_pfx;
         struct inet6_ifaddr *ifa;
         struct net_device *dev;
         u32 valid_lft = INFINITY_LIFE_TIME, preferred_lft = INFINITY_LIFE_TIME;
@@ -3719,7 +3695,7 @@ inet6_rtm_newaddr(struct sk_buff *skb, struct nlmsghdr *nlh)
                 return err;
 
         ifm = nlmsg_data(nlh);
-        pfx = extract_addr(tb[IFA_ADDRESS], tb[IFA_LOCAL]);
+        pfx = extract_addr(tb[IFA_ADDRESS], tb[IFA_LOCAL], &peer_pfx);
         if (pfx == NULL)
                 return -EINVAL;
 
@@ -3747,7 +3723,7 @@ inet6_rtm_newaddr(struct sk_buff *skb, struct nlmsghdr *nlh)
                  * It would be best to check for !NLM_F_CREATE here but
                  * userspace alreay relies on not having to provide this.
                  */
-                return inet6_addr_add(net, ifm->ifa_index, pfx,
+                return inet6_addr_add(net, ifm->ifa_index, pfx, peer_pfx,
                                       ifm->ifa_prefixlen, ifa_flags,
                                       preferred_lft, valid_lft);
         }
@@ -3804,6 +3780,7 @@ static inline int rt_scope(int ifa_scope)
 static inline int inet6_ifaddr_msgsize(void)
 {
         return NLMSG_ALIGN(sizeof(struct ifaddrmsg))
+               + nla_total_size(16) /* IFA_LOCAL */
                + nla_total_size(16) /* IFA_ADDRESS */
                + nla_total_size(sizeof(struct ifa_cacheinfo));
 }
@@ -3842,13 +3819,22 @@ static int inet6_fill_ifaddr(struct sk_buff *skb, struct inet6_ifaddr *ifa,
                 valid = INFINITY_LIFE_TIME;
         }
 
-        if (nla_put(skb, IFA_ADDRESS, 16, &ifa->addr) < 0 ||
-            put_cacheinfo(skb, ifa->cstamp, ifa->tstamp, preferred, valid) < 0) {
-                nlmsg_cancel(skb, nlh);
-                return -EMSGSIZE;
-        }
+        if (!ipv6_addr_any(&ifa->peer_addr)) {
+                if (nla_put(skb, IFA_LOCAL, 16, &ifa->addr) < 0 ||
+                    nla_put(skb, IFA_ADDRESS, 16, &ifa->peer_addr) < 0)
+                        goto error;
+        } else
+                if (nla_put(skb, IFA_ADDRESS, 16, &ifa->addr) < 0)
+                        goto error;
+
+        if (put_cacheinfo(skb, ifa->cstamp, ifa->tstamp, preferred, valid) < 0)
+                goto error;
 
         return nlmsg_end(skb, nlh);
+
+error:
+        nlmsg_cancel(skb, nlh);
+        return -EMSGSIZE;
 }
 
 static int inet6_fill_ifmcaddr(struct sk_buff *skb, struct ifmcaddr6 *ifmca,
@@ -4048,7 +4034,7 @@ static int inet6_rtm_getaddr(struct sk_buff *in_skb, struct nlmsghdr *nlh)
         struct net *net = sock_net(in_skb->sk);
         struct ifaddrmsg *ifm;
         struct nlattr *tb[IFA_MAX+1];
-        struct in6_addr *addr = NULL;
+        struct in6_addr *addr = NULL, *peer;
         struct net_device *dev = NULL;
         struct inet6_ifaddr *ifa;
         struct sk_buff *skb;
@@ -4058,7 +4044,7 @@ static int inet6_rtm_getaddr(struct sk_buff *in_skb, struct nlmsghdr *nlh)
         if (err < 0)
                 goto errout;
 
-        addr = extract_addr(tb[IFA_ADDRESS], tb[IFA_LOCAL]);
+        addr = extract_addr(tb[IFA_ADDRESS], tb[IFA_LOCAL], &peer);
         if (addr == NULL) {
                 err = -EINVAL;
                 goto errout;
@@ -4138,6 +4124,10 @@ static inline void ipv6_store_devconf(struct ipv6_devconf *cnf,
         array[DEVCONF_RTR_SOLICIT_DELAY] =
                 jiffies_to_msecs(cnf->rtr_solicit_delay);
         array[DEVCONF_FORCE_MLD_VERSION] = cnf->force_mld_version;
+        array[DEVCONF_MLDV1_UNSOLICITED_REPORT_INTERVAL] =
+                jiffies_to_msecs(cnf->mldv1_unsolicited_report_interval);
+        array[DEVCONF_MLDV2_UNSOLICITED_REPORT_INTERVAL] =
+                jiffies_to_msecs(cnf->mldv2_unsolicited_report_interval);
 #ifdef CONFIG_IPV6_PRIVACY
         array[DEVCONF_USE_TEMPADDR] = cnf->use_tempaddr;
         array[DEVCONF_TEMP_VALID_LFT] = cnf->temp_valid_lft;
@@ -4168,6 +4158,7 @@ static inline void ipv6_store_devconf(struct ipv6_devconf *cnf,
         array[DEVCONF_ACCEPT_DAD] = cnf->accept_dad;
         array[DEVCONF_FORCE_TLLAO] = cnf->force_tllao;
         array[DEVCONF_NDISC_NOTIFY] = cnf->ndisc_notify;
+        array[DEVCONF_SUPPRESS_FRAG_NDISC] = cnf->suppress_frag_ndisc;
 }
 
 static inline size_t inet6_ifla6_size(void)
@@ -4303,6 +4294,7 @@ static int inet6_set_iftoken(struct inet6_dev *idev, struct in6_addr *token)
         struct inet6_ifaddr *ifp;
         struct net_device *dev = idev->dev;
         bool update_rs = false;
+        struct in6_addr ll_addr;
 
         if (token == NULL)
                 return -EINVAL;
@@ -4322,11 +4314,9 @@ static int inet6_set_iftoken(struct inet6_dev *idev, struct in6_addr *token)
 
         write_unlock_bh(&idev->lock);
 
-        if (!idev->dead && (idev->if_flags & IF_READY)) {
-                struct in6_addr ll_addr;
-
-                ipv6_get_lladdr(dev, &ll_addr, IFA_F_TENTATIVE |
-                                IFA_F_OPTIMISTIC);
+        if (!idev->dead && (idev->if_flags & IF_READY) &&
+            !ipv6_get_lladdr(dev, &ll_addr, IFA_F_TENTATIVE |
+                             IFA_F_OPTIMISTIC)) {
 
                 /* If we're not ready, then normal ifup will take care
                  * of this. Otherwise, we need to request our rs here.
@@ -4337,8 +4327,11 @@ static int inet6_set_iftoken(struct inet6_dev *idev, struct in6_addr *token)
 
         write_lock_bh(&idev->lock);
 
-        if (update_rs)
+        if (update_rs) {
                 idev->if_flags |= IF_RS_SENT;
+                idev->rs_probes = 1;
+                addrconf_mod_rs_timer(idev, idev->cnf.rtr_solicit_interval);
+        }
 
         /* Well, that's kinda nasty ... */
         list_for_each_entry(ifp, &idev->addr_list, if_list) {
@@ -4351,6 +4344,7 @@ static int inet6_set_iftoken(struct inet6_dev *idev, struct in6_addr *token)
         }
 
         write_unlock_bh(&idev->lock);
+        addrconf_verify(0);
         return 0;
 }
 
@@ -4548,6 +4542,19 @@ errout:
                 rtnl_set_sk_err(net, RTNLGRP_IPV6_PREFIX, err);
 }
 
+static void update_valid_ll_addr_cnt(struct inet6_ifaddr *ifp, int count)
+{
+        write_lock_bh(&ifp->idev->lock);
+        spin_lock(&ifp->lock);
+        if (((ifp->flags & (IFA_F_PERMANENT|IFA_F_TENTATIVE|IFA_F_OPTIMISTIC|
+                            IFA_F_DADFAILED)) == IFA_F_PERMANENT) &&
+            (ipv6_addr_type(&ifp->addr) & IPV6_ADDR_LINKLOCAL))
+                ifp->idev->valid_ll_addr_cnt += count;
+        WARN_ON(ifp->idev->valid_ll_addr_cnt < 0);
+        spin_unlock(&ifp->lock);
+        write_unlock_bh(&ifp->idev->lock);
+}
+
 static void __ipv6_ifa_notify(int event, struct inet6_ifaddr *ifp)
 {
         struct net *net = dev_net(ifp->idev->dev);
@@ -4556,6 +4563,8 @@ static void __ipv6_ifa_notify(int event, struct inet6_ifaddr *ifp)
 
         switch (event) {
         case RTM_NEWADDR:
+                update_valid_ll_addr_cnt(ifp, 1);
+
                 /*
                  * If the address was optimistic
                  * we inserted the route at the start of
@@ -4566,11 +4575,28 @@ static void __ipv6_ifa_notify(int event, struct inet6_ifaddr *ifp)
                         ip6_ins_rt(ifp->rt);
                 if (ifp->idev->cnf.forwarding)
                         addrconf_join_anycast(ifp);
+                if (!ipv6_addr_any(&ifp->peer_addr))
+                        addrconf_prefix_route(&ifp->peer_addr, 128,
+                                              ifp->idev->dev, 0, 0);
                 break;
         case RTM_DELADDR:
+                update_valid_ll_addr_cnt(ifp, -1);
+
                 if (ifp->idev->cnf.forwarding)
                         addrconf_leave_anycast(ifp);
                 addrconf_leave_solict(ifp->idev, &ifp->addr);
+                if (!ipv6_addr_any(&ifp->peer_addr)) {
+                        struct rt6_info *rt;
+                        struct net_device *dev = ifp->idev->dev;
+
+                        rt = rt6_lookup(dev_net(dev), &ifp->peer_addr, NULL,
+                                        dev->ifindex, 1);
+                        if (rt) {
+                                dst_hold(&rt->dst);
+                                if (ip6_del_rt(rt))
+                                        dst_free(&rt->dst);
+                        }
+                }
                 dst_hold(&ifp->rt->dst);
 
                 if (ip6_del_rt(ifp->rt))
@@ -4578,6 +4604,7 @@ static void __ipv6_ifa_notify(int event, struct inet6_ifaddr *ifp)
                 break;
         }
         atomic_inc(&net->ipv6.dev_addr_genid);
+        rt_genid_bump_ipv6(net);
 }
 
 static void ipv6_ifa_notify(int event, struct inet6_ifaddr *ifp)
@@ -4591,13 +4618,13 @@ static void ipv6_ifa_notify(int event, struct inet6_ifaddr *ifp)
 #ifdef CONFIG_SYSCTL
 
 static
-int addrconf_sysctl_forward(ctl_table *ctl, int write,
+int addrconf_sysctl_forward(struct ctl_table *ctl, int write,
                            void __user *buffer, size_t *lenp, loff_t *ppos)
 {
         int *valp = ctl->data;
         int val = *valp;
         loff_t pos = *ppos;
-        ctl_table lctl;
+        struct ctl_table lctl;
         int ret;
 
         /*
@@ -4618,13 +4645,16 @@ int addrconf_sysctl_forward(ctl_table *ctl, int write,
 
 static void dev_disable_change(struct inet6_dev *idev)
 {
+        struct netdev_notifier_info info;
+
         if (!idev || !idev->dev)
                 return;
 
+        netdev_notifier_info_init(&info, idev->dev);
         if (idev->cnf.disable_ipv6)
-                addrconf_notify(NULL, NETDEV_DOWN, idev->dev);
+                addrconf_notify(NULL, NETDEV_DOWN, &info);
         else
-                addrconf_notify(NULL, NETDEV_UP, idev->dev);
+                addrconf_notify(NULL, NETDEV_UP, &info);
 }
 
 static void addrconf_disable_change(struct net *net, __s32 newf)
@@ -4673,13 +4703,13 @@ static int addrconf_disable_ipv6(struct ctl_table *table, int *p, int newf)
 }
 
 static
-int addrconf_sysctl_disable(ctl_table *ctl, int write,
+int addrconf_sysctl_disable(struct ctl_table *ctl, int write,
                             void __user *buffer, size_t *lenp, loff_t *ppos)
 {
         int *valp = ctl->data;
         int val = *valp;
         loff_t pos = *ppos;
-        ctl_table lctl;
+        struct ctl_table lctl;
         int ret;
 
         /*
@@ -4701,7 +4731,7 @@ int addrconf_sysctl_disable(ctl_table *ctl, int write,
 static struct addrconf_sysctl_table
 {
         struct ctl_table_header *sysctl_header;
-        ctl_table addrconf_vars[DEVCONF_MAX+1];
+        struct ctl_table addrconf_vars[DEVCONF_MAX+1];
 } addrconf_sysctl __read_mostly = {
         .sysctl_header = NULL,
         .addrconf_vars = {
@@ -4782,6 +4812,22 @@ static struct addrconf_sysctl_table
                         .mode           = 0644,
                         .proc_handler   = proc_dointvec,
                 },
+                {
+                        .procname       = "mldv1_unsolicited_report_interval",
+                        .data           =
+                                &ipv6_devconf.mldv1_unsolicited_report_interval,
+                        .maxlen         = sizeof(int),
+                        .mode           = 0644,
+                        .proc_handler   = proc_dointvec_ms_jiffies,
+                },
+                {
+                        .procname       = "mldv2_unsolicited_report_interval",
+                        .data           =
+                                &ipv6_devconf.mldv2_unsolicited_report_interval,
+                        .maxlen         = sizeof(int),
+                        .mode           = 0644,
+                        .proc_handler   = proc_dointvec_ms_jiffies,
+                },
 #ifdef CONFIG_IPV6_PRIVACY
                 {
                         .procname       = "use_tempaddr",
@@ -4927,6 +4973,13 @@ static struct addrconf_sysctl_table
                         .proc_handler   = proc_dointvec
                 },
                 {
+                        .procname       = "suppress_frag_ndisc",
+                        .data           = &ipv6_devconf.suppress_frag_ndisc,
+                        .maxlen         = sizeof(int),
+                        .mode           = 0644,
+                        .proc_handler   = proc_dointvec
+                },
+                {
                         /* sentinel */
                 }
         },
diff --git a/net/ipv6/addrconf_core.c b/net/ipv6/addrconf_core.c
index 72104562c864..4c11cbcf8308 100644
--- a/net/ipv6/addrconf_core.c
+++ b/net/ipv6/addrconf_core.c
@@ -5,6 +5,8 @@
 
 #include <linux/export.h>
 #include <net/ipv6.h>
+#include <net/addrconf.h>
+#include <net/ip.h>
 
 #define IPV6_ADDR_SCOPE_TYPE(scope)     ((scope) << 16)
 
@@ -97,3 +99,52 @@ int inet6addr_notifier_call_chain(unsigned long val, void *v)
         return atomic_notifier_call_chain(&inet6addr_chain, val, v);
 }
 EXPORT_SYMBOL(inet6addr_notifier_call_chain);
+
+const struct ipv6_stub *ipv6_stub __read_mostly;
+EXPORT_SYMBOL_GPL(ipv6_stub);
+
+/* IPv6 Wildcard Address and Loopback Address defined by RFC2553 */
+const struct in6_addr in6addr_loopback = IN6ADDR_LOOPBACK_INIT;
+EXPORT_SYMBOL(in6addr_loopback);
+const struct in6_addr in6addr_any = IN6ADDR_ANY_INIT;
+EXPORT_SYMBOL(in6addr_any);
+const struct in6_addr in6addr_linklocal_allnodes = IN6ADDR_LINKLOCAL_ALLNODES_INIT;
+EXPORT_SYMBOL(in6addr_linklocal_allnodes);
+const struct in6_addr in6addr_linklocal_allrouters = IN6ADDR_LINKLOCAL_ALLROUTERS_INIT;
+EXPORT_SYMBOL(in6addr_linklocal_allrouters);
+const struct in6_addr in6addr_interfacelocal_allnodes = IN6ADDR_INTERFACELOCAL_ALLNODES_INIT;
+EXPORT_SYMBOL(in6addr_interfacelocal_allnodes);
+const struct in6_addr in6addr_interfacelocal_allrouters = IN6ADDR_INTERFACELOCAL_ALLROUTERS_INIT;
+EXPORT_SYMBOL(in6addr_interfacelocal_allrouters);
+const struct in6_addr in6addr_sitelocal_allrouters = IN6ADDR_SITELOCAL_ALLROUTERS_INIT;
+EXPORT_SYMBOL(in6addr_sitelocal_allrouters);
+
+static void snmp6_free_dev(struct inet6_dev *idev)
+{
+        kfree(idev->stats.icmpv6msgdev);
+        kfree(idev->stats.icmpv6dev);
+        snmp_mib_free((void __percpu **)idev->stats.ipv6);
+}
+
+/* Nobody refers to this device, we may destroy it. */
+
+void in6_dev_finish_destroy(struct inet6_dev *idev)
+{
+        struct net_device *dev = idev->dev;
+
+        WARN_ON(!list_empty(&idev->addr_list));
+        WARN_ON(idev->mc_list != NULL);
+        WARN_ON(timer_pending(&idev->rs_timer));
+
+#ifdef NET_REFCNT_DEBUG
+        pr_debug("%s: %s\n", __func__, dev ? dev->name : "NIL");
+#endif
+        dev_put(dev);
+        if (!idev->dead) {
+                pr_warn("Freeing alive inet6 device %p\n", idev);
+                return;
+        }
+        snmp6_free_dev(idev);
+        kfree_rcu(idev, rcu);
+}
+EXPORT_SYMBOL(in6_dev_finish_destroy);
diff --git a/net/ipv6/addrlabel.c b/net/ipv6/addrlabel.c
index f083a583a05c..b30ad3741b46 100644
--- a/net/ipv6/addrlabel.c
+++ b/net/ipv6/addrlabel.c
@@ -251,38 +251,36 @@ static struct ip6addrlbl_entry *ip6addrlbl_alloc(struct net *net,
 /* add a label */
 static int __ip6addrlbl_add(struct ip6addrlbl_entry *newp, int replace)
 {
+        struct hlist_node *n;
+        struct ip6addrlbl_entry *last = NULL, *p = NULL;
         int ret = 0;
 
-        ADDRLABEL(KERN_DEBUG "%s(newp=%p, replace=%d)\n",
-                        __func__,
-                        newp, replace);
+        ADDRLABEL(KERN_DEBUG "%s(newp=%p, replace=%d)\n", __func__, newp,
+                  replace);
 
-        if (hlist_empty(&ip6addrlbl_table.head)) {
-                hlist_add_head_rcu(&newp->list, &ip6addrlbl_table.head);
-        } else {
-                struct hlist_node *n;
-                struct ip6addrlbl_entry *p = NULL;
-                hlist_for_each_entry_safe(p, n,
-                                          &ip6addrlbl_table.head, list) {
-                        if (p->prefixlen == newp->prefixlen &&
-                            net_eq(ip6addrlbl_net(p), ip6addrlbl_net(newp)) &&
-                            p->ifindex == newp->ifindex &&
-                            ipv6_addr_equal(&p->prefix, &newp->prefix)) {
-                                if (!replace) {
-                                        ret = -EEXIST;
-                                        goto out;
-                                }
-                                hlist_replace_rcu(&p->list, &newp->list);
-                                ip6addrlbl_put(p);
-                                goto out;
-                        } else if ((p->prefixlen == newp->prefixlen && !p->ifindex) ||
-                                   (p->prefixlen < newp->prefixlen)) {
-                                hlist_add_before_rcu(&newp->list, &p->list);
+        hlist_for_each_entry_safe(p, n, &ip6addrlbl_table.head, list) {
+                if (p->prefixlen == newp->prefixlen &&
+                    net_eq(ip6addrlbl_net(p), ip6addrlbl_net(newp)) &&
+                    p->ifindex == newp->ifindex &&
+                    ipv6_addr_equal(&p->prefix, &newp->prefix)) {
+                        if (!replace) {
+                                ret = -EEXIST;
                                 goto out;
                         }
+                        hlist_replace_rcu(&p->list, &newp->list);
+                        ip6addrlbl_put(p);
+                        goto out;
+                } else if ((p->prefixlen == newp->prefixlen && !p->ifindex) ||
+                           (p->prefixlen < newp->prefixlen)) {
+                        hlist_add_before_rcu(&newp->list, &p->list);
+                        goto out;
                 }
-                hlist_add_after_rcu(&p->list, &newp->list);
+                last = p;
         }
+        if (last)
+                hlist_add_after_rcu(&last->list, &newp->list);
+        else
+                hlist_add_head_rcu(&newp->list, &ip6addrlbl_table.head);
 out:
         if (!ret)
                 ip6addrlbl_table.seq++;
diff --git a/net/ipv6/af_inet6.c b/net/ipv6/af_inet6.c
index ab5c7ad482cd..7c96100b021e 100644
--- a/net/ipv6/af_inet6.c
+++ b/net/ipv6/af_inet6.c
@@ -49,12 +49,14 @@
 #include <net/udp.h>
 #include <net/udplite.h>
 #include <net/tcp.h>
+#include <net/ping.h>
 #include <net/protocol.h>
 #include <net/inet_common.h>
 #include <net/route.h>
 #include <net/transp_v6.h>
 #include <net/ip6_route.h>
 #include <net/addrconf.h>
+#include <net/ndisc.h>
 #ifdef CONFIG_IPV6_TUNNEL
 #include <net/ip6_tunnel.h>
 #endif
@@ -765,6 +767,7 @@ static int __net_init inet6_net_init(struct net *net)
 
         net->ipv6.sysctl.bindv6only = 0;
         net->ipv6.sysctl.icmpv6_time = 1*HZ;
+        atomic_set(&net->ipv6.rt_genid, 0);
 
         err = ipv6_init_mibs(net);
         if (err)
@@ -808,6 +811,15 @@ static struct pernet_operations inet6_net_ops = {
         .exit = inet6_net_exit,
 };
 
+static const struct ipv6_stub ipv6_stub_impl = {
+        .ipv6_sock_mc_join = ipv6_sock_mc_join,
+        .ipv6_sock_mc_drop = ipv6_sock_mc_drop,
+        .ipv6_dst_lookup = ip6_dst_lookup,
+        .udpv6_encap_enable = udpv6_encap_enable,
+        .ndisc_send_na = ndisc_send_na,
+        .nd_tbl = &nd_tbl,
+};
+
 static int __init inet6_init(void)
 {
         struct list_head *r;
@@ -840,6 +852,9 @@ static int __init inet6_init(void)
         if (err)
                 goto out_unregister_udplite_proto;
 
+        err = proto_register(&pingv6_prot, 1);
+        if (err)
+                goto out_unregister_ping_proto;
 
         /* We MUST register RAW sockets before we create the ICMP6,
          * IGMP6, or NDISC control sockets.
@@ -879,6 +894,9 @@ static int __init inet6_init(void)
         err = igmp6_init();
         if (err)
                 goto igmp_fail;
+
+        ipv6_stub = &ipv6_stub_impl;
+
         err = ipv6_netfilter_init();
         if (err)
                 goto netfilter_fail;
@@ -897,6 +915,9 @@ static int __init inet6_init(void)
         err = ip6_route_init();
         if (err)
                 goto ip6_route_fail;
+        err = ndisc_late_init();
+        if (err)
+                goto ndisc_late_fail;
         err = ip6_flowlabel_init();
         if (err)
                 goto ip6_flowlabel_fail;
@@ -930,6 +951,10 @@ static int __init inet6_init(void)
         if (err)
                 goto ipv6_packet_fail;
 
+        err = pingv6_init();
+        if (err)
+                goto pingv6_fail;
+
 #ifdef CONFIG_SYSCTL
         err = ipv6_sysctl_register();
         if (err)
@@ -942,6 +967,8 @@ out:
 sysctl_fail:
         ipv6_packet_cleanup();
 #endif
+pingv6_fail:
+        pingv6_exit();
 ipv6_packet_fail:
         tcpv6_exit();
 tcpv6_fail:
@@ -957,6 +984,8 @@ ipv6_exthdrs_fail:
 addrconf_fail:
         ip6_flowlabel_cleanup();
 ip6_flowlabel_fail:
+        ndisc_late_cleanup();
+ndisc_late_fail:
         ip6_route_cleanup();
 ip6_route_fail:
 #ifdef CONFIG_PROC_FS
@@ -985,6 +1014,8 @@ register_pernet_fail:
         rtnl_unregister_all(PF_INET6);
 out_sock_register_fail:
         rawv6_exit();
+out_unregister_ping_proto:
+        proto_unregister(&pingv6_prot);
 out_unregister_raw_proto:
         proto_unregister(&rawv6_prot);
 out_unregister_udplite_proto:
@@ -1017,6 +1048,7 @@ static void __exit inet6_exit(void)
         ipv6_exthdrs_exit();
         addrconf_cleanup();
         ip6_flowlabel_cleanup();
+        ndisc_late_cleanup();
         ip6_route_cleanup();
 #ifdef CONFIG_PROC_FS
 
@@ -1027,6 +1059,7 @@ static void __exit inet6_exit(void)
         raw6_proc_exit();
 #endif
         ipv6_netfilter_fini();
+        ipv6_stub = NULL;
         igmp6_cleanup();
         ndisc_cleanup();
         ip6_mr_cleanup();
diff --git a/net/ipv6/ah6.c b/net/ipv6/ah6.c
index bb02e176cb70..73784c3d4642 100644
--- a/net/ipv6/ah6.c
+++ b/net/ipv6/ah6.c
@@ -628,7 +628,7 @@ static void ah6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
                 return;
 
         if (type == NDISC_REDIRECT)
-                ip6_redirect(skb, net, 0, 0);
+                ip6_redirect(skb, net, skb->dev->ifindex, 0);
         else
                 ip6_update_pmtu(skb, net, info, 0, 0);
         xfrm_state_put(x);
diff --git a/net/ipv6/datagram.c b/net/ipv6/datagram.c
index 4b56cbbc7890..48b6bd2a9a14 100644
--- a/net/ipv6/datagram.c
+++ b/net/ipv6/datagram.c
@@ -879,3 +879,30 @@ exit_f:
         return err;
 }
 EXPORT_SYMBOL_GPL(ip6_datagram_send_ctl);
+
+void ip6_dgram_sock_seq_show(struct seq_file *seq, struct sock *sp,
+                             __u16 srcp, __u16 destp, int bucket)
+{
+        struct ipv6_pinfo *np = inet6_sk(sp);
+        const struct in6_addr *dest, *src;
+
+        dest  = &np->daddr;
+        src   = &np->rcv_saddr;
+        seq_printf(seq,
+                   "%5d: %08X%08X%08X%08X:%04X %08X%08X%08X%08X:%04X "
+                   "%02X %08X:%08X %02X:%08lX %08X %5u %8d %lu %d %pK %d\n",
+                   bucket,
+                   src->s6_addr32[0], src->s6_addr32[1],
+                   src->s6_addr32[2], src->s6_addr32[3], srcp,
+                   dest->s6_addr32[0], dest->s6_addr32[1],
+                   dest->s6_addr32[2], dest->s6_addr32[3], destp,
+                   sp->sk_state,
+                   sk_wmem_alloc_get(sp),
+                   sk_rmem_alloc_get(sp),
+                   0, 0L, 0,
+                   from_kuid_munged(seq_user_ns(seq), sock_i_uid(sp)),
+                   0,
+                   sock_i_ino(sp),
+                   atomic_read(&sp->sk_refcnt), sp,
+                   atomic_read(&sp->sk_drops));
+}
diff --git a/net/ipv6/esp6.c b/net/ipv6/esp6.c
index 40ffd72243a4..d3618a78fcac 100644
--- a/net/ipv6/esp6.c
+++ b/net/ipv6/esp6.c
@@ -425,7 +425,7 @@ static u32 esp6_get_mtu(struct xfrm_state *x, int mtu)
                 net_adj = 0;
 
         return ((mtu - x->props.header_len - crypto_aead_authsize(esp->aead) -
-                 net_adj) & ~(align - 1)) + (net_adj - 2);
+                 net_adj) & ~(align - 1)) + net_adj - 2;
 }
 
 static void esp6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
@@ -447,7 +447,7 @@ static void esp6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
                 return;
 
         if (type == NDISC_REDIRECT)
-                ip6_redirect(skb, net, 0, 0);
+                ip6_redirect(skb, net, skb->dev->ifindex, 0);
         else
                 ip6_update_pmtu(skb, net, info, 0, 0);
         xfrm_state_put(x);
diff --git a/net/ipv6/exthdrs.c b/net/ipv6/exthdrs.c
index 07a7d65a7cb6..8d67900aa003 100644
--- a/net/ipv6/exthdrs.c
+++ b/net/ipv6/exthdrs.c
@@ -162,12 +162,6 @@ static bool ip6_parse_tlv(const struct tlvtype_proc *procs, struct sk_buff *skb)
                 off += optlen;
                 len -= optlen;
         }
-        /* This case will not be caught by above check since its padding
-         * length is smaller than 7:
-         * 1 byte NH + 1 byte Length + 6 bytes Padding
-         */
-        if ((padlen == 6) && ((off - skb_network_header_len(skb)) == 8))
-                goto bad;
 
         if (len == 0)
                 return true;
diff --git a/net/ipv6/exthdrs_core.c b/net/ipv6/exthdrs_core.c
index c5e83fae4df4..140748debc4a 100644
--- a/net/ipv6/exthdrs_core.c
+++ b/net/ipv6/exthdrs_core.c
@@ -115,7 +115,7 @@ EXPORT_SYMBOL(ipv6_skip_exthdr);
 int ipv6_find_tlv(struct sk_buff *skb, int offset, int type)
 {
         const unsigned char *nh = skb_network_header(skb);
-        int packet_len = skb->tail - skb->network_header;
+        int packet_len = skb_tail_pointer(skb) - skb_network_header(skb);
         struct ipv6_opt_hdr *hdr;
         int len;
 
diff --git a/net/ipv6/fib6_rules.c b/net/ipv6/fib6_rules.c
index 2e1a432867c0..e27591635f92 100644
--- a/net/ipv6/fib6_rules.c
+++ b/net/ipv6/fib6_rules.c
@@ -55,26 +55,33 @@ static int fib6_rule_action(struct fib_rule *rule, struct flowi *flp,
         struct fib6_table *table;
         struct net *net = rule->fr_net;
         pol_lookup_t lookup = arg->lookup_ptr;
+        int err = 0;
 
         switch (rule->action) {
         case FR_ACT_TO_TBL:
                 break;
         case FR_ACT_UNREACHABLE:
+                err = -ENETUNREACH;
                 rt = net->ipv6.ip6_null_entry;
                 goto discard_pkt;
         default:
         case FR_ACT_BLACKHOLE:
+                err = -EINVAL;
                 rt = net->ipv6.ip6_blk_hole_entry;
                 goto discard_pkt;
         case FR_ACT_PROHIBIT:
+                err = -EACCES;
                 rt = net->ipv6.ip6_prohibit_entry;
                 goto discard_pkt;
         }
 
         table = fib6_get_table(net, rule->table);
-        if (table)
-                rt = lookup(net, table, flp6, flags);
+        if (!table) {
+                err = -EAGAIN;
+                goto out;
+        }
 
+        rt = lookup(net, table, flp6, flags);
         if (rt != net->ipv6.ip6_null_entry) {
                 struct fib6_rule *r = (struct fib6_rule *)rule;
 
@@ -101,6 +108,7 @@ static int fib6_rule_action(struct fib_rule *rule, struct flowi *flp,
         }
 again:
         ip6_rt_put(rt);
+        err = -EAGAIN;
         rt = NULL;
         goto out;
 
@@ -108,9 +116,31 @@ discard_pkt:
         dst_hold(&rt->dst);
 out:
         arg->result = rt;
-        return rt == NULL ? -EAGAIN : 0;
+        return err;
 }
 
+static bool fib6_rule_suppress(struct fib_rule *rule, struct fib_lookup_arg *arg)
+{
+        struct rt6_info *rt = (struct rt6_info *) arg->result;
+        struct net_device *dev = rt->rt6i_idev->dev;
+        /* do not accept result if the route does
+         * not meet the required prefix length
+         */
+        if (rt->rt6i_dst.plen <= rule->suppress_prefixlen)
+                goto suppress_route;
+
+        /* do not accept result if the route uses a device
+         * belonging to a forbidden interface group
+         */
+        if (rule->suppress_ifgroup != -1 && dev && dev->group == rule->suppress_ifgroup)
+                goto suppress_route;
+
+        return false;
+
+suppress_route:
+        ip6_rt_put(rt);
+        return true;
+}
 
 static int fib6_rule_match(struct fib_rule *rule, struct flowi *fl, int flags)
 {
@@ -244,6 +274,7 @@ static const struct fib_rules_ops __net_initconst fib6_rules_ops_template = {
         .addr_size              = sizeof(struct in6_addr),
         .action                 = fib6_rule_action,
         .match                  = fib6_rule_match,
+        .suppress               = fib6_rule_suppress,
         .configure              = fib6_rule_configure,
         .compare                = fib6_rule_compare,
         .fill                   = fib6_rule_fill,
diff --git a/net/ipv6/icmp.c b/net/ipv6/icmp.c
index b4ff0a42b8c7..eef8d945b362 100644
--- a/net/ipv6/icmp.c
+++ b/net/ipv6/icmp.c
@@ -57,6 +57,7 @@
 
 #include <net/ipv6.h>
 #include <net/ip6_checksum.h>
+#include <net/ping.h>
 #include <net/protocol.h>
 #include <net/raw.h>
 #include <net/rawv6.h>
@@ -84,12 +85,18 @@ static inline struct sock *icmpv6_sk(struct net *net)
 static void icmpv6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
                        u8 type, u8 code, int offset, __be32 info)
 {
+        /* icmpv6_notify checks 8 bytes can be pulled, icmp6hdr is 8 bytes */
+        struct icmp6hdr *icmp6 = (struct icmp6hdr *) (skb->data + offset);
         struct net *net = dev_net(skb->dev);
 
         if (type == ICMPV6_PKT_TOOBIG)
                 ip6_update_pmtu(skb, net, info, 0, 0);
         else if (type == NDISC_REDIRECT)
-                ip6_redirect(skb, net, 0, 0);
+                ip6_redirect(skb, net, skb->dev->ifindex, 0);
+
+        if (!(type & ICMPV6_INFOMSG_MASK))
+                if (icmp6->icmp6_type == ICMPV6_ECHO_REQUEST)
+                        ping_err(skb, offset, info);
 }
 
 static int icmpv6_rcv(struct sk_buff *skb);
@@ -224,7 +231,8 @@ static bool opt_unrec(struct sk_buff *skb, __u32 offset)
         return (*op & 0xC0) == 0x80;
 }
 
-static int icmpv6_push_pending_frames(struct sock *sk, struct flowi6 *fl6, struct icmp6hdr *thdr, int len)
+int icmpv6_push_pending_frames(struct sock *sk, struct flowi6 *fl6,
+                               struct icmp6hdr *thdr, int len)
 {
         struct sk_buff *skb;
         struct icmp6hdr *icmp6h;
@@ -307,8 +315,8 @@ static void mip6_addr_swap(struct sk_buff *skb)
 static inline void mip6_addr_swap(struct sk_buff *skb) {}
 #endif
 
-static struct dst_entry *icmpv6_route_lookup(struct net *net, struct sk_buff *skb,
-                                             struct sock *sk, struct flowi6 *fl6)
+struct dst_entry *icmpv6_route_lookup(struct net *net, struct sk_buff *skb,
+                                      struct sock *sk, struct flowi6 *fl6)
 {
         struct dst_entry *dst, *dst2;
         struct flowi6 fl2;
@@ -391,7 +399,7 @@ static void icmp6_send(struct sk_buff *skb, u8 type, u8 code, __u32 info)
         int err = 0;
 
         if ((u8 *)hdr < skb->head ||
-            (skb->network_header + sizeof(*hdr)) > skb->tail)
+            (skb_network_header(skb) + sizeof(*hdr)) > skb_tail_pointer(skb))
                 return;
 
         /*
@@ -697,7 +705,8 @@ static int icmpv6_rcv(struct sk_buff *skb)
                 skb->csum = ~csum_unfold(csum_ipv6_magic(saddr, daddr, skb->len,
                                              IPPROTO_ICMPV6, 0));
                 if (__skb_checksum_complete(skb)) {
-                        LIMIT_NETDEBUG(KERN_DEBUG "ICMPv6 checksum failed [%pI6 > %pI6]\n",
+                        LIMIT_NETDEBUG(KERN_DEBUG
+                                       "ICMPv6 checksum failed [%pI6c > %pI6c]\n",
                                        saddr, daddr);
                         goto csum_error;
                 }
@@ -718,7 +727,7 @@ static int icmpv6_rcv(struct sk_buff *skb)
                 break;
 
         case ICMPV6_ECHO_REPLY:
-                /* we couldn't care less */
+                ping_rcv(skb);
                 break;
 
         case ICMPV6_PKT_TOOBIG:
@@ -931,6 +940,14 @@ static const struct icmp6_err {
                 .err    = ECONNREFUSED,
                 .fatal  = 1,
         },
+        {       /* POLICY_FAIL */
+                .err    = EACCES,
+                .fatal  = 1,
+        },
+        {       /* REJECT_ROUTE */
+                .err    = EACCES,
+                .fatal  = 1,
+        },
 };
 
 int icmpv6_err_convert(u8 type, u8 code, int *err)
@@ -942,7 +959,7 @@ int icmpv6_err_convert(u8 type, u8 code, int *err)
         switch (type) {
         case ICMPV6_DEST_UNREACH:
                 fatal = 1;
-                if (code <= ICMPV6_PORT_UNREACH) {
+                if (code < ARRAY_SIZE(tab_unreach)) {
                         *err  = tab_unreach[code].err;
                         fatal = tab_unreach[code].fatal;
                 }
@@ -967,7 +984,7 @@ int icmpv6_err_convert(u8 type, u8 code, int *err)
 EXPORT_SYMBOL(icmpv6_err_convert);
 
 #ifdef CONFIG_SYSCTL
-ctl_table ipv6_icmp_table_template[] = {
+struct ctl_table ipv6_icmp_table_template[] = {
         {
                 .procname       = "ratelimit",
                 .data           = &init_net.ipv6.sysctl.icmpv6_time,
diff --git a/net/ipv6/ip6_fib.c b/net/ipv6/ip6_fib.c
index 192dd1a0e188..5bec666aba61 100644
--- a/net/ipv6/ip6_fib.c
+++ b/net/ipv6/ip6_fib.c
@@ -425,8 +425,8 @@ out:
  *      node.
  */
 
-static struct fib6_node * fib6_add_1(struct fib6_node *root, void *addr,
-                                     int addrlen, int plen,
+static struct fib6_node *fib6_add_1(struct fib6_node *root,
+                                     struct in6_addr *addr, int plen,
                                      int offset, int allow_create,
                                      int replace_required)
 {
@@ -543,7 +543,7 @@ insert_above:
            but if it is >= plen, the value is ignored in any case.
          */
 
-        bit = __ipv6_addr_diff(addr, &key->addr, addrlen);
+        bit = __ipv6_addr_diff(addr, &key->addr, sizeof(*addr));
 
         /*
          *              (intermediate)[in]
@@ -632,6 +632,12 @@ insert_above:
         return ln;
 }
 
+static inline bool rt6_qualify_for_ecmp(struct rt6_info *rt)
+{
+        return (rt->rt6i_flags & (RTF_GATEWAY|RTF_ADDRCONF|RTF_DYNAMIC)) ==
+               RTF_GATEWAY;
+}
+
 /*
  *      Insert routing information in a node.
  */
@@ -646,6 +652,7 @@ static int fib6_add_rt2node(struct fib6_node *fn, struct rt6_info *rt,
         int add = (!info->nlh ||
                    (info->nlh->nlmsg_flags & NLM_F_CREATE));
         int found = 0;
+        bool rt_can_ecmp = rt6_qualify_for_ecmp(rt);
 
         ins = &fn->leaf;
 
@@ -691,9 +698,8 @@ static int fib6_add_rt2node(struct fib6_node *fn, struct rt6_info *rt,
                          * To avoid long list, we only had siblings if the
                          * route have a gateway.
                          */
-                        if (rt->rt6i_flags & RTF_GATEWAY &&
-                            !(rt->rt6i_flags & RTF_EXPIRES) &&
-                            !(iter->rt6i_flags & RTF_EXPIRES))
+                        if (rt_can_ecmp &&
+                            rt6_qualify_for_ecmp(iter))
                                 rt->rt6i_nsiblings++;
                 }
 
@@ -715,7 +721,8 @@ static int fib6_add_rt2node(struct fib6_node *fn, struct rt6_info *rt,
                 /* Find the first route that have the same metric */
                 sibling = fn->leaf;
                 while (sibling) {
-                        if (sibling->rt6i_metric == rt->rt6i_metric) {
+                        if (sibling->rt6i_metric == rt->rt6i_metric &&
+                            rt6_qualify_for_ecmp(sibling)) {
                                 list_add_tail(&rt->rt6i_siblings,
                                               &sibling->rt6i_siblings);
                                 break;
@@ -815,12 +822,12 @@ int fib6_add(struct fib6_node *root, struct rt6_info *rt, struct nl_info *info)
         if (!allow_create && !replace_required)
                 pr_warn("RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE\n");
 
-        fn = fib6_add_1(root, &rt->rt6i_dst.addr, sizeof(struct in6_addr),
-                        rt->rt6i_dst.plen, offsetof(struct rt6_info, rt6i_dst),
-                        allow_create, replace_required);
-
+        fn = fib6_add_1(root, &rt->rt6i_dst.addr, rt->rt6i_dst.plen,
+                        offsetof(struct rt6_info, rt6i_dst), allow_create,
+                        replace_required);
         if (IS_ERR(fn)) {
                 err = PTR_ERR(fn);
+                fn = NULL;
                 goto out;
         }
 
@@ -856,7 +863,7 @@ int fib6_add(struct fib6_node *root, struct rt6_info *rt, struct nl_info *info)
                         /* Now add the first leaf node to new subtree */
 
                         sn = fib6_add_1(sfn, &rt->rt6i_src.addr,
-                                        sizeof(struct in6_addr), rt->rt6i_src.plen,
+                                        rt->rt6i_src.plen,
                                         offsetof(struct rt6_info, rt6i_src),
                                         allow_create, replace_required);
 
@@ -875,7 +882,7 @@ int fib6_add(struct fib6_node *root, struct rt6_info *rt, struct nl_info *info)
                         fn->subtree = sfn;
                 } else {
                         sn = fib6_add_1(fn->subtree, &rt->rt6i_src.addr,
-                                        sizeof(struct in6_addr), rt->rt6i_src.plen,
+                                        rt->rt6i_src.plen,
                                         offsetof(struct rt6_info, rt6i_src),
                                         allow_create, replace_required);
 
@@ -986,14 +993,22 @@ static struct fib6_node * fib6_lookup_1(struct fib6_node *root,
 
                         if (ipv6_prefix_equal(&key->addr, args->addr, key->plen)) {
 #ifdef CONFIG_IPV6_SUBTREES
-                                if (fn->subtree)
-                                        fn = fib6_lookup_1(fn->subtree, args + 1);
+                                if (fn->subtree) {
+                                        struct fib6_node *sfn;
+                                        sfn = fib6_lookup_1(fn->subtree,
+                                                            args + 1);
+                                        if (!sfn)
+                                                goto backtrack;
+                                        fn = sfn;
+                                }
 #endif
-                                if (!fn || fn->fn_flags & RTN_RTINFO)
+                                if (fn->fn_flags & RTN_RTINFO)
                                         return fn;
                         }
                 }
-
+#ifdef CONFIG_IPV6_SUBTREES
+backtrack:
+#endif
                 if (fn->fn_flags & RTN_ROOT)
                         break;
 
@@ -1625,27 +1640,28 @@ static int fib6_age(struct rt6_info *rt, void *arg)
 
 static DEFINE_SPINLOCK(fib6_gc_lock);
 
-void fib6_run_gc(unsigned long expires, struct net *net)
+void fib6_run_gc(unsigned long expires, struct net *net, bool force)
 {
-        if (expires != ~0UL) {
+        unsigned long now;
+
+        if (force) {
                 spin_lock_bh(&fib6_gc_lock);
-                gc_args.timeout = expires ? (int)expires :
-                        net->ipv6.sysctl.ip6_rt_gc_interval;
-        } else {
-                if (!spin_trylock_bh(&fib6_gc_lock)) {
-                        mod_timer(&net->ipv6.ip6_fib_timer, jiffies + HZ);
-                        return;
-                }
-                gc_args.timeout = net->ipv6.sysctl.ip6_rt_gc_interval;
+        } else if (!spin_trylock_bh(&fib6_gc_lock)) {
+                mod_timer(&net->ipv6.ip6_fib_timer, jiffies + HZ);
+                return;
         }
+        gc_args.timeout = expires ? (int)expires :
+                          net->ipv6.sysctl.ip6_rt_gc_interval;
 
         gc_args.more = icmp6_dst_gc();
 
         fib6_clean_all(net, fib6_age, 0, NULL);
+        now = jiffies;
+        net->ipv6.ip6_rt_last_gc = now;
 
         if (gc_args.more)
                 mod_timer(&net->ipv6.ip6_fib_timer,
-                          round_jiffies(jiffies
+                          round_jiffies(now
                                         + net->ipv6.sysctl.ip6_rt_gc_interval));
         else
                 del_timer(&net->ipv6.ip6_fib_timer);
@@ -1654,7 +1670,7 @@ void fib6_run_gc(unsigned long expires, struct net *net)
 
 static void fib6_gc_timer_cb(unsigned long arg)
 {
-        fib6_run_gc(0, (struct net *)arg);
+        fib6_run_gc(0, (struct net *)arg, true);
 }
 
 static int __net_init fib6_net_init(struct net *net)
diff --git a/net/ipv6/ip6_gre.c b/net/ipv6/ip6_gre.c
index ecd60733e5e2..7bb5446b9d73 100644
--- a/net/ipv6/ip6_gre.c
+++ b/net/ipv6/ip6_gre.c
@@ -335,6 +335,7 @@ static struct ip6_tnl *ip6gre_tunnel_locate(struct net *net,
         dev->rtnl_link_ops = &ip6gre_link_ops;
 
         nt->dev = dev;
+        nt->net = dev_net(dev);
         ip6gre_tnl_link_config(nt, 1);
 
         if (register_netdevice(dev) < 0)
@@ -508,8 +509,6 @@ static int ip6gre_rcv(struct sk_buff *skb)
                         goto drop;
                 }
 
-                secpath_reset(skb);
-
                 skb->protocol = gre_proto;
                 /* WCCP version 1 and 2 protocol decoding.
                  * - Change protocol to IP
@@ -524,7 +523,6 @@ static int ip6gre_rcv(struct sk_buff *skb)
                 skb->mac_header = skb->network_header;
                 __pskb_pull(skb, offset);
                 skb_postpull_rcsum(skb, skb_transport_header(skb), offset);
-                skb->pkt_type = PACKET_HOST;
 
                 if (((flags&GRE_CSUM) && csum) ||
                     (!(flags&GRE_CSUM) && tunnel->parms.i_flags&GRE_CSUM)) {
@@ -556,7 +554,7 @@ static int ip6gre_rcv(struct sk_buff *skb)
                         skb_postpull_rcsum(skb, eth_hdr(skb), ETH_HLEN);
                 }
 
-                __skb_tunnel_rx(skb, tunnel->dev);
+                __skb_tunnel_rx(skb, tunnel->dev, tunnel->net);
 
                 skb_reset_network_header(skb);
 
@@ -620,7 +618,7 @@ static netdev_tx_t ip6gre_xmit2(struct sk_buff *skb,
         struct ip6_tnl *tunnel = netdev_priv(dev);
         struct net_device *tdev;    /* Device to other host */
         struct ipv6hdr  *ipv6h;     /* Our new IP header */
-        unsigned int max_headroom;  /* The extra header space needed */
+        unsigned int max_headroom = 0; /* The extra header space needed */
         int    gre_hlen;
         struct ipv6_tel_txoption opt;
         int    mtu;
@@ -693,7 +691,9 @@ static netdev_tx_t ip6gre_xmit2(struct sk_buff *skb,
                         tunnel->err_count = 0;
         }
 
-        max_headroom = LL_RESERVED_SPACE(tdev) + gre_hlen + dst->header_len;
+        skb_scrub_packet(skb, !net_eq(tunnel->net, dev_net(dev)));
+
+        max_headroom += LL_RESERVED_SPACE(tdev) + gre_hlen + dst->header_len;
 
         if (skb_headroom(skb) < max_headroom || skb_shared(skb) ||
             (skb_cloned(skb) && !skb_clone_writable(skb, 0))) {
@@ -709,8 +709,6 @@ static netdev_tx_t ip6gre_xmit2(struct sk_buff *skb,
                 skb = new_skb;
         }
 
-        skb_dst_drop(skb);
-
         if (fl6->flowi6_mark) {
                 skb_dst_set(skb, dst);
                 ndst = NULL;
@@ -724,6 +722,11 @@ static netdev_tx_t ip6gre_xmit2(struct sk_buff *skb,
                 ipv6_push_nfrag_opts(skb, &opt.ops, &proto, NULL);
         }
 
+        if (likely(!skb->encapsulation)) {
+                skb_reset_inner_headers(skb);
+                skb->encapsulation = 1;
+        }
+
         skb_push(skb, gre_hlen);
         skb_reset_network_header(skb);
         skb_set_transport_header(skb, sizeof(*ipv6h));
@@ -1255,6 +1258,7 @@ static int ip6gre_tunnel_init(struct net_device *dev)
         tunnel = netdev_priv(dev);
 
         tunnel->dev = dev;
+        tunnel->net = dev_net(dev);
         strcpy(tunnel->parms.name, dev->name);
 
         memcpy(dev->dev_addr, &tunnel->parms.laddr, sizeof(struct in6_addr));
@@ -1275,6 +1279,7 @@ static void ip6gre_fb_tunnel_init(struct net_device *dev)
         struct ip6_tnl *tunnel = netdev_priv(dev);
 
         tunnel->dev = dev;
+        tunnel->net = dev_net(dev);
         strcpy(tunnel->parms.name, dev->name);
 
         tunnel->hlen            = sizeof(struct ipv6hdr) + 4;
@@ -1450,6 +1455,7 @@ static int ip6gre_tap_init(struct net_device *dev)
         tunnel = netdev_priv(dev);
 
         tunnel->dev = dev;
+        tunnel->net = dev_net(dev);
         strcpy(tunnel->parms.name, dev->name);
 
         ip6gre_tnl_link_config(tunnel, 1);
@@ -1501,6 +1507,7 @@ static int ip6gre_newlink(struct net *src_net, struct net_device *dev,
                 eth_hw_addr_random(dev);
 
         nt->dev = dev;
+        nt->net = dev_net(dev);
         ip6gre_tnl_link_config(nt, !tb[IFLA_MTU]);
 
         /* Can use a lockless transmit, unless we generate output sequences */
diff --git a/net/ipv6/ip6_input.c b/net/ipv6/ip6_input.c
index 2bab2aa59745..302d6fb1ff2b 100644
--- a/net/ipv6/ip6_input.c
+++ b/net/ipv6/ip6_input.c
@@ -44,7 +44,7 @@
 #include <net/ip6_route.h>
 #include <net/addrconf.h>
 #include <net/xfrm.h>
-
+#include <net/inet_ecn.h>
 
 
 int ip6_rcv_finish(struct sk_buff *skb)
@@ -109,6 +109,10 @@ int ipv6_rcv(struct sk_buff *skb, struct net_device *dev, struct packet_type *pt
         if (hdr->version != 6)
                 goto err;
 
+        IP6_ADD_STATS_BH(dev_net(dev), idev,
+                         IPSTATS_MIB_NOECTPKTS +
+                                (ipv6_get_dsfield(hdr) & INET_ECN_MASK),
+                         max_t(unsigned short, 1, skb_shinfo(skb)->gso_segs));
         /*
          * RFC4291 2.5.3
          * A packet received on an interface with a destination address
diff --git a/net/ipv6/ip6_offload.c b/net/ipv6/ip6_offload.c
index 71b766ee821d..d82de7228100 100644
--- a/net/ipv6/ip6_offload.c
+++ b/net/ipv6/ip6_offload.c
@@ -91,6 +91,7 @@ static struct sk_buff *ipv6_gso_segment(struct sk_buff *skb,
         unsigned int unfrag_ip6hlen;
         u8 *prevhdr;
         int offset = 0;
+        bool tunnel;
 
         if (unlikely(skb_shinfo(skb)->gso_type &
                      ~(SKB_GSO_UDP |
@@ -98,6 +99,7 @@ static struct sk_buff *ipv6_gso_segment(struct sk_buff *skb,
                        SKB_GSO_TCP_ECN |
                        SKB_GSO_GRE |
                        SKB_GSO_UDP_TUNNEL |
+                       SKB_GSO_MPLS |
                        SKB_GSO_TCPV6 |
                        0)))
                 goto out;
@@ -105,6 +107,7 @@ static struct sk_buff *ipv6_gso_segment(struct sk_buff *skb,
         if (unlikely(!pskb_may_pull(skb, sizeof(*ipv6h))))
                 goto out;
 
+        tunnel = skb->encapsulation;
         ipv6h = ipv6_hdr(skb);
         __skb_pull(skb, sizeof(*ipv6h));
         segs = ERR_PTR(-EPROTONOSUPPORT);
@@ -125,7 +128,7 @@ static struct sk_buff *ipv6_gso_segment(struct sk_buff *skb,
                 ipv6h = ipv6_hdr(skb);
                 ipv6h->payload_len = htons(skb->len - skb->mac_len -
                                            sizeof(*ipv6h));
-                if (proto == IPPROTO_UDP) {
+                if (!tunnel && proto == IPPROTO_UDP) {
                         unfrag_ip6hlen = ip6_find_1stfragopt(skb, &prevhdr);
                         fptr = (struct frag_hdr *)(skb_network_header(skb) +
                                 unfrag_ip6hlen);
diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
index dae1949019d7..a54c45ce4a48 100644
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -56,31 +56,6 @@
 #include <net/checksum.h>
 #include <linux/mroute6.h>
 
-int __ip6_local_out(struct sk_buff *skb)
-{
-        int len;
-
-        len = skb->len - sizeof(struct ipv6hdr);
-        if (len > IPV6_MAXPLEN)
-                len = 0;
-        ipv6_hdr(skb)->payload_len = htons(len);
-
-        return nf_hook(NFPROTO_IPV6, NF_INET_LOCAL_OUT, skb, NULL,
-                       skb_dst(skb)->dev, dst_output);
-}
-
-int ip6_local_out(struct sk_buff *skb)
-{
-        int err;
-
-        err = __ip6_local_out(skb);
-        if (likely(err == 1))
-                err = dst_output(skb);
-
-        return err;
-}
-EXPORT_SYMBOL_GPL(ip6_local_out);
-
 static int ip6_finish_output2(struct sk_buff *skb)
 {
         struct dst_entry *dst = skb_dst(skb);
@@ -238,6 +213,7 @@ int ip6_xmit(struct sock *sk, struct sk_buff *skb, struct flowi6 *fl6,
         hdr->saddr = fl6->saddr;
         hdr->daddr = *first_hop;
 
+        skb->protocol = htons(ETH_P_IPV6);
         skb->priority = sk->sk_priority;
         skb->mark = sk->sk_mark;
 
@@ -381,9 +357,8 @@ int ip6_forward(struct sk_buff *skb)
          *      cannot be fragmented, because there is no warranty
          *      that different fragments will go along one path. --ANK
          */
-        if (opt->ra) {
-                u8 *ptr = skb_network_header(skb) + opt->ra;
-                if (ip6_call_ra_chain(skb, (ptr[2]<<8) + ptr[3]))
+        if (unlikely(opt->flags & IP6SKB_ROUTERALERT)) {
+                if (ip6_call_ra_chain(skb, ntohs(opt->ra)))
                         return 0;
         }
 
@@ -822,11 +797,17 @@ static struct dst_entry *ip6_sk_dst_check(struct sock *sk,
                                           const struct flowi6 *fl6)
 {
         struct ipv6_pinfo *np = inet6_sk(sk);
-        struct rt6_info *rt = (struct rt6_info *)dst;
+        struct rt6_info *rt;
 
         if (!dst)
                 goto out;
 
+        if (dst->ops->family != AF_INET6) {
+                dst_release(dst);
+                return NULL;
+        }
+
+        rt = (struct rt6_info *)dst;
         /* Yes, checking route validity in not connected
          * case is not very simple. Take into account,
          * that we do not support routing by source, TOS,
@@ -1034,6 +1015,8 @@ static inline int ip6_ufo_append_data(struct sock *sk,
          * udp datagram
          */
         if ((skb = skb_peek_tail(&sk->sk_write_queue)) == NULL) {
+                struct frag_hdr fhdr;
+
                 skb = sock_alloc_send_skb(sk,
                         hh_len + fragheaderlen + transhdrlen + 20,
                         (flags & MSG_DONTWAIT), &err);
@@ -1052,14 +1035,9 @@ static inline int ip6_ufo_append_data(struct sock *sk,
                 /* initialize protocol header pointer */
                 skb->transport_header = skb->network_header + fragheaderlen;
 
+                skb->protocol = htons(ETH_P_IPV6);
                 skb->ip_summed = CHECKSUM_PARTIAL;
                 skb->csum = 0;
-        }
-
-        err = skb_append_datato_frags(sk,skb, getfrag, from,
-                                      (length - transhdrlen));
-        if (!err) {
-                struct frag_hdr fhdr;
 
                 /* Specify the length of each IPv6 datagram fragment.
                  * It has to be a multiple of 8.
@@ -1070,15 +1048,10 @@ static inline int ip6_ufo_append_data(struct sock *sk,
                 ipv6_select_ident(&fhdr, rt);
                 skb_shinfo(skb)->ip6_frag_id = fhdr.identification;
                 __skb_queue_tail(&sk->sk_write_queue, skb);
-
-                return 0;
         }
-        /* There is not enough support do UPD LSO,
-         * so follow normal path
-         */
-        kfree_skb(skb);
 
-        return err;
+        return skb_append_datato_frags(sk, skb, getfrag, from,
+                                       (length - transhdrlen));
 }
 
 static inline struct ipv6_opt_hdr *ip6_opt_dup(struct ipv6_opt_hdr *src,
@@ -1093,11 +1066,12 @@ static inline struct ipv6_rt_hdr *ip6_rthdr_dup(struct ipv6_rt_hdr *src,
         return src ? kmemdup(src, (src->hdrlen + 1) * 8, gfp) : NULL;
 }
 
-static void ip6_append_data_mtu(int *mtu,
+static void ip6_append_data_mtu(unsigned int *mtu,
                                 int *maxfraglen,
                                 unsigned int fragheaderlen,
                                 struct sk_buff *skb,
-                                struct rt6_info *rt)
+                                struct rt6_info *rt,
+                                bool pmtuprobe)
 {
         if (!(rt->dst.flags & DST_XFRM_TUNNEL)) {
                 if (skb == NULL) {
@@ -1109,7 +1083,9 @@ static void ip6_append_data_mtu(int *mtu,
                          * this fragment is not first, the headers
                          * space is regarded as data space.
                          */
-                        *mtu = dst_mtu(rt->dst.path);
+                        *mtu = min(*mtu, pmtuprobe ?
+                                   rt->dst.dev->mtu :
+                                   dst_mtu(rt->dst.path));
                 }
                 *maxfraglen = ((*mtu - fragheaderlen) & ~7)
                               + fragheaderlen - sizeof(struct frag_hdr);
@@ -1126,11 +1102,10 @@ int ip6_append_data(struct sock *sk, int getfrag(void *from, char *to,
         struct ipv6_pinfo *np = inet6_sk(sk);
         struct inet_cork *cork;
         struct sk_buff *skb, *skb_prev = NULL;
-        unsigned int maxfraglen, fragheaderlen;
+        unsigned int maxfraglen, fragheaderlen, mtu;
         int exthdrlen;
         int dst_exthdrlen;
         int hh_len;
-        int mtu;
         int copy;
         int err;
         int offset = 0;
@@ -1243,27 +1218,27 @@ int ip6_append_data(struct sock *sk, int getfrag(void *from, char *to,
          * --yoshfuji
          */
 
-        cork->length += length;
-        if (length > mtu) {
-                int proto = sk->sk_protocol;
-                if (dontfrag && (proto == IPPROTO_UDP || proto == IPPROTO_RAW)){
-                        ipv6_local_rxpmtu(sk, fl6, mtu-exthdrlen);
-                        return -EMSGSIZE;
-                }
-
-                if (proto == IPPROTO_UDP &&
-                    (rt->dst.dev->features & NETIF_F_UFO)) {
+        if ((length > mtu) && dontfrag && (sk->sk_protocol == IPPROTO_UDP ||
+                                           sk->sk_protocol == IPPROTO_RAW)) {
+                ipv6_local_rxpmtu(sk, fl6, mtu-exthdrlen);
+                return -EMSGSIZE;
+        }
 
-                        err = ip6_ufo_append_data(sk, getfrag, from, length,
-                                                  hh_len, fragheaderlen,
-                                                  transhdrlen, mtu, flags, rt);
-                        if (err)
-                                goto error;
-                        return 0;
-                }
+        skb = skb_peek_tail(&sk->sk_write_queue);
+        cork->length += length;
+        if (((length > mtu) ||
+             (skb && skb_is_gso(skb))) &&
+            (sk->sk_protocol == IPPROTO_UDP) &&
+            (rt->dst.dev->features & NETIF_F_UFO)) {
+                err = ip6_ufo_append_data(sk, getfrag, from, length,
+                                          hh_len, fragheaderlen,
+                                          transhdrlen, mtu, flags, rt);
+                if (err)
+                        goto error;
+                return 0;
         }
 
-        if ((skb = skb_peek_tail(&sk->sk_write_queue)) == NULL)
+        if (!skb)
                 goto alloc_new_skb;
 
         while (length > 0) {
@@ -1287,7 +1262,9 @@ alloc_new_skb:
                         /* update mtu and maxfraglen if necessary */
                         if (skb == NULL || skb_prev == NULL)
                                 ip6_append_data_mtu(&mtu, &maxfraglen,
-                                                    fragheaderlen, skb, rt);
+                                                    fragheaderlen, skb, rt,
+                                                    np->pmtudisc ==
+                                                    IPV6_PMTUDISC_PROBE);
 
                         skb_prev = skb;
 
@@ -1350,6 +1327,7 @@ alloc_new_skb:
                         /*
                          *      Fill in the control structures
                          */
+                        skb->protocol = htons(ETH_P_IPV6);
                         skb->ip_summed = CHECKSUM_NONE;
                         skb->csum = 0;
                         /* reserve for fragmentation and ipsec header */
diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c
index 1e55866cead7..a791552e0422 100644
--- a/net/ipv6/ip6_tunnel.c
+++ b/net/ipv6/ip6_tunnel.c
@@ -41,6 +41,7 @@
 #include <linux/netfilter_ipv6.h>
 #include <linux/slab.h>
 #include <linux/hash.h>
+#include <linux/etherdevice.h>
 
 #include <asm/uaccess.h>
 #include <linux/atomic.h>
@@ -315,6 +316,7 @@ static struct ip6_tnl *ip6_tnl_create(struct net *net, struct __ip6_tnl_parm *p)
 
         t = netdev_priv(dev);
         t->parms = *p;
+        t->net = dev_net(dev);
         err = ip6_tnl_create2(dev);
         if (err < 0)
                 goto failed_free;
@@ -374,7 +376,7 @@ static void
 ip6_tnl_dev_uninit(struct net_device *dev)
 {
         struct ip6_tnl *t = netdev_priv(dev);
-        struct net *net = dev_net(dev);
+        struct net *net = t->net;
         struct ip6_tnl_net *ip6n = net_generic(net, ip6_tnl_net_id);
 
         if (dev == ip6n->fb_tnl_dev)
@@ -741,7 +743,7 @@ int ip6_tnl_rcv_ctl(struct ip6_tnl *t,
 {
         struct __ip6_tnl_parm *p = &t->parms;
         int ret = 0;
-        struct net *net = dev_net(t->dev);
+        struct net *net = t->net;
 
         if ((p->flags & IP6_TNL_F_CAP_RCV) ||
             ((p->flags & IP6_TNL_F_CAP_PER_PACKET) &&
@@ -800,14 +802,12 @@ static int ip6_tnl_rcv(struct sk_buff *skb, __u16 protocol,
                         rcu_read_unlock();
                         goto discard;
                 }
-                secpath_reset(skb);
                 skb->mac_header = skb->network_header;
                 skb_reset_network_header(skb);
                 skb->protocol = htons(protocol);
-                skb->pkt_type = PACKET_HOST;
                 memset(skb->cb, 0, sizeof(struct inet6_skb_parm));
 
-                __skb_tunnel_rx(skb, t->dev);
+                __skb_tunnel_rx(skb, t->dev, t->net);
 
                 err = dscp_ecn_decapsulate(t, ipv6h, skb);
                 if (unlikely(err)) {
@@ -895,7 +895,7 @@ int ip6_tnl_xmit_ctl(struct ip6_tnl *t)
 {
         struct __ip6_tnl_parm *p = &t->parms;
         int ret = 0;
-        struct net *net = dev_net(t->dev);
+        struct net *net = t->net;
 
         if (p->flags & IP6_TNL_F_CAP_XMIT) {
                 struct net_device *ldev = NULL;
@@ -945,8 +945,8 @@ static int ip6_tnl_xmit2(struct sk_buff *skb,
                          int encap_limit,
                          __u32 *pmtu)
 {
-        struct net *net = dev_net(dev);
         struct ip6_tnl *t = netdev_priv(dev);
+        struct net *net = t->net;
         struct net_device_stats *stats = &t->dev->stats;
         struct ipv6hdr *ipv6h = ipv6_hdr(skb);
         struct ipv6_tel_txoption opt;
@@ -996,6 +996,8 @@ static int ip6_tnl_xmit2(struct sk_buff *skb,
                 goto tx_err_dst_release;
         }
 
+        skb_scrub_packet(skb, !net_eq(t->net, dev_net(dev)));
+
         /*
          * Okay, now see if we can stuff it in the buffer as-is.
          */
@@ -1013,7 +1015,6 @@ static int ip6_tnl_xmit2(struct sk_buff *skb,
                 consume_skb(skb);
                 skb = new_skb;
         }
-        skb_dst_drop(skb);
         if (fl6->flowi6_mark) {
                 skb_dst_set(skb, dst);
                 ndst = NULL;
@@ -1027,6 +1028,12 @@ static int ip6_tnl_xmit2(struct sk_buff *skb,
                 init_tel_txopt(&opt, encap_limit);
                 ipv6_push_nfrag_opts(skb, &opt.ops, &proto, NULL);
         }
+
+        if (likely(!skb->encapsulation)) {
+                skb_reset_inner_headers(skb);
+                skb->encapsulation = 1;
+        }
+
         skb_push(skb, sizeof(struct ipv6hdr));
         skb_reset_network_header(skb);
         ipv6h = ipv6_hdr(skb);
@@ -1202,7 +1209,7 @@ static void ip6_tnl_link_config(struct ip6_tnl *t)
                 int strict = (ipv6_addr_type(&p->raddr) &
                               (IPV6_ADDR_MULTICAST|IPV6_ADDR_LINKLOCAL));
 
-                struct rt6_info *rt = rt6_lookup(dev_net(dev),
+                struct rt6_info *rt = rt6_lookup(t->net,
                                                  &p->raddr, &p->laddr,
                                                  p->link, strict);
 
@@ -1251,7 +1258,7 @@ ip6_tnl_change(struct ip6_tnl *t, const struct __ip6_tnl_parm *p)
 
 static int ip6_tnl_update(struct ip6_tnl *t, struct __ip6_tnl_parm *p)
 {
-        struct net *net = dev_net(t->dev);
+        struct net *net = t->net;
         struct ip6_tnl_net *ip6n = net_generic(net, ip6_tnl_net_id);
         int err;
 
@@ -1463,8 +1470,10 @@ static void ip6_tnl_dev_setup(struct net_device *dev)
                 dev->mtu-=8;
         dev->flags |= IFF_NOARP;
         dev->addr_len = sizeof(struct in6_addr);
-        dev->features |= NETIF_F_NETNS_LOCAL;
         dev->priv_flags &= ~IFF_XMIT_DST_RELEASE;
+        /* This perm addr will be used as interface identifier by IPv6 */
+        dev->addr_assign_type = NET_ADDR_RANDOM;
+        eth_random_addr(dev->perm_addr);
 }
 
 
@@ -1479,6 +1488,7 @@ ip6_tnl_dev_init_gen(struct net_device *dev)
         struct ip6_tnl *t = netdev_priv(dev);
 
         t->dev = dev;
+        t->net = dev_net(dev);
         dev->tstats = alloc_percpu(struct pcpu_tstats);
         if (!dev->tstats)
                 return -ENOMEM;
@@ -1596,9 +1606,9 @@ static int ip6_tnl_newlink(struct net *src_net, struct net_device *dev,
 static int ip6_tnl_changelink(struct net_device *dev, struct nlattr *tb[],
                               struct nlattr *data[])
 {
-        struct ip6_tnl *t;
+        struct ip6_tnl *t = netdev_priv(dev);
         struct __ip6_tnl_parm p;
-        struct net *net = dev_net(dev);
+        struct net *net = t->net;
         struct ip6_tnl_net *ip6n = net_generic(net, ip6_tnl_net_id);
 
         if (dev == ip6n->fb_tnl_dev)
@@ -1646,9 +1656,9 @@ static int ip6_tnl_fill_info(struct sk_buff *skb, const struct net_device *dev)
 
         if (nla_put_u32(skb, IFLA_IPTUN_LINK, parm->link) ||
             nla_put(skb, IFLA_IPTUN_LOCAL, sizeof(struct in6_addr),
-                    &parm->raddr) ||
-            nla_put(skb, IFLA_IPTUN_REMOTE, sizeof(struct in6_addr),
                     &parm->laddr) ||
+            nla_put(skb, IFLA_IPTUN_REMOTE, sizeof(struct in6_addr),
+                    &parm->raddr) ||
             nla_put_u8(skb, IFLA_IPTUN_TTL, parm->hop_limit) ||
             nla_put_u8(skb, IFLA_IPTUN_ENCAP_LIMIT, parm->encap_limit) ||
             nla_put_be32(skb, IFLA_IPTUN_FLOWINFO, parm->flowinfo) ||
@@ -1699,20 +1709,28 @@ static struct xfrm6_tunnel ip6ip6_handler __read_mostly = {
 
 static void __net_exit ip6_tnl_destroy_tunnels(struct ip6_tnl_net *ip6n)
 {
+        struct net *net = dev_net(ip6n->fb_tnl_dev);
+        struct net_device *dev, *aux;
         int h;
         struct ip6_tnl *t;
         LIST_HEAD(list);
 
+        for_each_netdev_safe(net, dev, aux)
+                if (dev->rtnl_link_ops == &ip6_link_ops)
+                        unregister_netdevice_queue(dev, &list);
+
         for (h = 0; h < HASH_SIZE; h++) {
                 t = rtnl_dereference(ip6n->tnls_r_l[h]);
                 while (t != NULL) {
-                        unregister_netdevice_queue(t->dev, &list);
+                        /* If dev is in the same netns, it has already
+                         * been added to the list by the previous loop.
+                         */
+                        if (!net_eq(dev_net(t->dev), net))
+                                unregister_netdevice_queue(t->dev, &list);
                         t = rtnl_dereference(t->next);
                 }
         }
 
-        t = rtnl_dereference(ip6n->tnls_wc[0]);
-        unregister_netdevice_queue(t->dev, &list);
         unregister_netdevice_many(&list);
 }
 
@@ -1732,6 +1750,11 @@ static int __net_init ip6_tnl_init_net(struct net *net)
         if (!ip6n->fb_tnl_dev)
                 goto err_alloc_dev;
         dev_net_set(ip6n->fb_tnl_dev, net);
+        ip6n->fb_tnl_dev->rtnl_link_ops = &ip6_link_ops;
+        /* FB netdevice is special: we have one, and only one per netns.
+         * Allowing to move it to another netns is clearly unsafe.
+         */
+        ip6n->fb_tnl_dev->features |= NETIF_F_NETNS_LOCAL;
 
         err = ip6_fb_tnl_dev_init(ip6n->fb_tnl_dev);
         if (err < 0)
diff --git a/net/ipv6/ip6mr.c b/net/ipv6/ip6mr.c
index 241fb8ad9fcf..f365310bfcca 100644
--- a/net/ipv6/ip6mr.c
+++ b/net/ipv6/ip6mr.c
@@ -110,8 +110,8 @@ static struct kmem_cache *mrt_cachep __read_mostly;
 static struct mr6_table *ip6mr_new_table(struct net *net, u32 id);
 static void ip6mr_free_table(struct mr6_table *mrt);
 
-static int ip6_mr_forward(struct net *net, struct mr6_table *mrt,
-                          struct sk_buff *skb, struct mfc6_cache *cache);
+static void ip6_mr_forward(struct net *net, struct mr6_table *mrt,
+                           struct sk_buff *skb, struct mfc6_cache *cache);
 static int ip6mr_cache_report(struct mr6_table *mrt, struct sk_buff *pkt,
                               mifi_t mifi, int assert);
 static int __ip6mr_fill_mroute(struct mr6_table *mrt, struct sk_buff *skb,
@@ -259,10 +259,12 @@ static void __net_exit ip6mr_rules_exit(struct net *net)
 {
         struct mr6_table *mrt, *next;
 
+        rtnl_lock();
         list_for_each_entry_safe(mrt, next, &net->ipv6.mr6_tables, list) {
                 list_del(&mrt->list);
                 ip6mr_free_table(mrt);
         }
+        rtnl_unlock();
         fib_rules_unregister(net->ipv6.mr6_rules_ops);
 }
 #else
@@ -289,7 +291,10 @@ static int __net_init ip6mr_rules_init(struct net *net)
 
 static void __net_exit ip6mr_rules_exit(struct net *net)
 {
+        rtnl_lock();
         ip6mr_free_table(net->ipv6.mrt6);
+        net->ipv6.mrt6 = NULL;
+        rtnl_unlock();
 }
 #endif
 
@@ -667,9 +672,8 @@ static int pim6_rcv(struct sk_buff *skb)
         skb_reset_network_header(skb);
         skb->protocol = htons(ETH_P_IPV6);
         skb->ip_summed = CHECKSUM_NONE;
-        skb->pkt_type = PACKET_HOST;
 
-        skb_tunnel_rx(skb, reg_dev);
+        skb_tunnel_rx(skb, reg_dev, dev_net(reg_dev));
 
         netif_rx(skb);
 
@@ -1319,7 +1323,7 @@ static int ip6mr_mfc_delete(struct mr6_table *mrt, struct mf6cctl *mfc,
 static int ip6mr_device_event(struct notifier_block *this,
                               unsigned long event, void *ptr)
 {
-        struct net_device *dev = ptr;
+        struct net_device *dev = netdev_notifier_info_to_dev(ptr);
         struct net *net = dev_net(dev);
         struct mr6_table *mrt;
         struct mif_device *v;
@@ -2069,8 +2073,8 @@ static int ip6mr_find_vif(struct mr6_table *mrt, struct net_device *dev)
         return ct;
 }
 
-static int ip6_mr_forward(struct net *net, struct mr6_table *mrt,
-                          struct sk_buff *skb, struct mfc6_cache *cache)
+static void ip6_mr_forward(struct net *net, struct mr6_table *mrt,
+                           struct sk_buff *skb, struct mfc6_cache *cache)
 {
         int psend = -1;
         int vif, ct;
@@ -2151,12 +2155,11 @@ forward:
 last_forward:
         if (psend != -1) {
                 ip6mr_forward2(net, mrt, skb, cache, psend);
-                return 0;
+                return;
         }
 
 dont_forward:
         kfree_skb(skb);
-        return 0;
 }
 
 
diff --git a/net/ipv6/ipcomp6.c b/net/ipv6/ipcomp6.c
index 7af5aee75d98..5636a912074a 100644
--- a/net/ipv6/ipcomp6.c
+++ b/net/ipv6/ipcomp6.c
@@ -76,7 +76,7 @@ static void ipcomp6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
                 return;
 
         if (type == NDISC_REDIRECT)
-                ip6_redirect(skb, net, 0, 0);
+                ip6_redirect(skb, net, skb->dev->ifindex, 0);
         else
                 ip6_update_pmtu(skb, net, info, 0, 0);
         xfrm_state_put(x);
diff --git a/net/ipv6/mcast.c b/net/ipv6/mcast.c
index bfa6cc36ef2a..d18f9f903db6 100644
--- a/net/ipv6/mcast.c
+++ b/net/ipv6/mcast.c
@@ -44,6 +44,7 @@
 #include <linux/proc_fs.h>
 #include <linux/seq_file.h>
 #include <linux/slab.h>
+#include <linux/pkt_sched.h>
 #include <net/mld.h>
 
 #include <linux/netfilter.h>
@@ -94,6 +95,7 @@ static void mld_ifc_event(struct inet6_dev *idev);
 static void mld_add_delrec(struct inet6_dev *idev, struct ifmcaddr6 *pmc);
 static void mld_del_delrec(struct inet6_dev *idev, const struct in6_addr *addr);
 static void mld_clear_delrec(struct inet6_dev *idev);
+static bool mld_in_v1_mode(const struct inet6_dev *idev);
 static int sf_setstate(struct ifmcaddr6 *pmc);
 static void sf_markstate(struct ifmcaddr6 *pmc);
 static void ip6_mc_clear_src(struct ifmcaddr6 *pmc);
@@ -106,14 +108,15 @@ static int ip6_mc_add_src(struct inet6_dev *idev, const struct in6_addr *pmca,
 static int ip6_mc_leave_src(struct sock *sk, struct ipv6_mc_socklist *iml,
                             struct inet6_dev *idev);
 
-
-#define IGMP6_UNSOLICITED_IVAL  (10*HZ)
 #define MLD_QRV_DEFAULT         2
+/* RFC3810, 9.2. Query Interval */
+#define MLD_QI_DEFAULT          (125 * HZ)
+/* RFC3810, 9.3. Query Response Interval */
+#define MLD_QRI_DEFAULT         (10 * HZ)
 
-#define MLD_V1_SEEN(idev) (dev_net((idev)->dev)->ipv6.devconf_all->force_mld_version == 1 || \
-                (idev)->cnf.force_mld_version == 1 || \
-                ((idev)->mc_v1_seen && \
-                time_before(jiffies, (idev)->mc_v1_seen)))
+/* RFC3810, 8.1 Query Version Distinctions */
+#define MLD_V1_QUERY_LEN        24
+#define MLD_V2_QUERY_LEN_MIN    28
 
 #define IPV6_MLD_MAX_MSF        64
 
@@ -128,6 +131,18 @@ int sysctl_mld_max_msf __read_mostly = IPV6_MLD_MAX_MSF;
              pmc != NULL;                                       \
              pmc = rcu_dereference(pmc->next))
 
+static int unsolicited_report_interval(struct inet6_dev *idev)
+{
+        int iv;
+
+        if (mld_in_v1_mode(idev))
+                iv = idev->cnf.mldv1_unsolicited_report_interval;
+        else
+                iv = idev->cnf.mldv2_unsolicited_report_interval;
+
+        return iv > 0 ? iv : 1;
+}
+
 int ipv6_sock_mc_join(struct sock *sk, int ifindex, const struct in6_addr *addr)
 {
         struct net_device *dev = NULL;
@@ -676,7 +691,7 @@ static void igmp6_group_added(struct ifmcaddr6 *mc)
         if (!(dev->flags & IFF_UP) || (mc->mca_flags & MAF_NOREPORT))
                 return;
 
-        if (MLD_V1_SEEN(mc->idev)) {
+        if (mld_in_v1_mode(mc->idev)) {
                 igmp6_join_group(mc);
                 return;
         }
@@ -984,21 +999,49 @@ bool ipv6_chk_mcast_addr(struct net_device *dev, const struct in6_addr *group,
 
 static void mld_gq_start_timer(struct inet6_dev *idev)
 {
-        int tv = net_random() % idev->mc_maxdelay;
+        unsigned long tv = net_random() % idev->mc_maxdelay;
 
         idev->mc_gq_running = 1;
         if (!mod_timer(&idev->mc_gq_timer, jiffies+tv+2))
                 in6_dev_hold(idev);
 }
 
-static void mld_ifc_start_timer(struct inet6_dev *idev, int delay)
+static void mld_gq_stop_timer(struct inet6_dev *idev)
+{
+        idev->mc_gq_running = 0;
+        if (del_timer(&idev->mc_gq_timer))
+                __in6_dev_put(idev);
+}
+
+static void mld_ifc_start_timer(struct inet6_dev *idev, unsigned long delay)
 {
-        int tv = net_random() % delay;
+        unsigned long tv = net_random() % delay;
 
         if (!mod_timer(&idev->mc_ifc_timer, jiffies+tv+2))
                 in6_dev_hold(idev);
 }
 
+static void mld_ifc_stop_timer(struct inet6_dev *idev)
+{
+        idev->mc_ifc_count = 0;
+        if (del_timer(&idev->mc_ifc_timer))
+                __in6_dev_put(idev);
+}
+
+static void mld_dad_start_timer(struct inet6_dev *idev, unsigned long delay)
+{
+        unsigned long tv = net_random() % delay;
+
+        if (!mod_timer(&idev->mc_dad_timer, jiffies+tv+2))
+                in6_dev_hold(idev);
+}
+
+static void mld_dad_stop_timer(struct inet6_dev *idev)
+{
+        if (del_timer(&idev->mc_dad_timer))
+                __in6_dev_put(idev);
+}
+
 /*
  *      IGMP handling (alias multicast ICMPv6 messages)
  */
@@ -1017,12 +1060,9 @@ static void igmp6_group_queried(struct ifmcaddr6 *ma, unsigned long resptime)
                 delay = ma->mca_timer.expires - jiffies;
         }
 
-        if (delay >= resptime) {
-                if (resptime)
-                        delay = net_random() % resptime;
-                else
-                        delay = 1;
-        }
+        if (delay >= resptime)
+                delay = net_random() % resptime;
+
         ma->mca_timer.expires = jiffies + delay;
         if (!mod_timer(&ma->mca_timer, jiffies + delay))
                 atomic_inc(&ma->mca_refcnt);
@@ -1089,6 +1129,158 @@ static bool mld_marksources(struct ifmcaddr6 *pmc, int nsrcs,
         return true;
 }
 
+static int mld_force_mld_version(const struct inet6_dev *idev)
+{
+        /* Normally, both are 0 here. If enforcement to a particular is
+         * being used, individual device enforcement will have a lower
+         * precedence over 'all' device (.../conf/all/force_mld_version).
+         */
+
+        if (dev_net(idev->dev)->ipv6.devconf_all->force_mld_version != 0)
+                return dev_net(idev->dev)->ipv6.devconf_all->force_mld_version;
+        else
+                return idev->cnf.force_mld_version;
+}
+
+static bool mld_in_v2_mode_only(const struct inet6_dev *idev)
+{
+        return mld_force_mld_version(idev) == 2;
+}
+
+static bool mld_in_v1_mode_only(const struct inet6_dev *idev)
+{
+        return mld_force_mld_version(idev) == 1;
+}
+
+static bool mld_in_v1_mode(const struct inet6_dev *idev)
+{
+        if (mld_in_v2_mode_only(idev))
+                return false;
+        if (mld_in_v1_mode_only(idev))
+                return true;
+        if (idev->mc_v1_seen && time_before(jiffies, idev->mc_v1_seen))
+                return true;
+
+        return false;
+}
+
+static void mld_set_v1_mode(struct inet6_dev *idev)
+{
+        /* RFC3810, relevant sections:
+         *  - 9.1. Robustness Variable
+         *  - 9.2. Query Interval
+         *  - 9.3. Query Response Interval
+         *  - 9.12. Older Version Querier Present Timeout
+         */
+        unsigned long switchback;
+
+        switchback = (idev->mc_qrv * idev->mc_qi) + idev->mc_qri;
+
+        idev->mc_v1_seen = jiffies + switchback;
+}
+
+static void mld_update_qrv(struct inet6_dev *idev,
+                           const struct mld2_query *mlh2)
+{
+        /* RFC3810, relevant sections:
+         *  - 5.1.8. QRV (Querier's Robustness Variable)
+         *  - 9.1. Robustness Variable
+         */
+
+        /* The value of the Robustness Variable MUST NOT be zero,
+         * and SHOULD NOT be one. Catch this here if we ever run
+         * into such a case in future.
+         */
+        WARN_ON(idev->mc_qrv == 0);
+
+        if (mlh2->mld2q_qrv > 0)
+                idev->mc_qrv = mlh2->mld2q_qrv;
+
+        if (unlikely(idev->mc_qrv < 2)) {
+                net_warn_ratelimited("IPv6: MLD: clamping QRV from %u to %u!\n",
+                                     idev->mc_qrv, MLD_QRV_DEFAULT);
+                idev->mc_qrv = MLD_QRV_DEFAULT;
+        }
+}
+
+static void mld_update_qi(struct inet6_dev *idev,
+                          const struct mld2_query *mlh2)
+{
+        /* RFC3810, relevant sections:
+         *  - 5.1.9. QQIC (Querier's Query Interval Code)
+         *  - 9.2. Query Interval
+         *  - 9.12. Older Version Querier Present Timeout
+         *    (the [Query Interval] in the last Query received)
+         */
+        unsigned long mc_qqi;
+
+        if (mlh2->mld2q_qqic < 128) {
+                mc_qqi = mlh2->mld2q_qqic;
+        } else {
+                unsigned long mc_man, mc_exp;
+
+                mc_exp = MLDV2_QQIC_EXP(mlh2->mld2q_qqic);
+                mc_man = MLDV2_QQIC_MAN(mlh2->mld2q_qqic);
+
+                mc_qqi = (mc_man | 0x10) << (mc_exp + 3);
+        }
+
+        idev->mc_qi = mc_qqi * HZ;
+}
+
+static void mld_update_qri(struct inet6_dev *idev,
+                           const struct mld2_query *mlh2)
+{
+        /* RFC3810, relevant sections:
+         *  - 5.1.3. Maximum Response Code
+         *  - 9.3. Query Response Interval
+         */
+        idev->mc_qri = msecs_to_jiffies(mldv2_mrc(mlh2));
+}
+
+static int mld_process_v1(struct inet6_dev *idev, struct mld_msg *mld,
+                          unsigned long *max_delay)
+{
+        unsigned long mldv1_md;
+
+        /* Ignore v1 queries */
+        if (mld_in_v2_mode_only(idev))
+                return -EINVAL;
+
+        /* MLDv1 router present */
+        mldv1_md = ntohs(mld->mld_maxdelay);
+        *max_delay = max(msecs_to_jiffies(mldv1_md), 1UL);
+
+        mld_set_v1_mode(idev);
+
+        /* cancel MLDv2 report timer */
+        mld_gq_stop_timer(idev);
+        /* cancel the interface change timer */
+        mld_ifc_stop_timer(idev);
+        /* clear deleted report items */
+        mld_clear_delrec(idev);
+
+        return 0;
+}
+
+static int mld_process_v2(struct inet6_dev *idev, struct mld2_query *mld,
+                          unsigned long *max_delay)
+{
+        /* hosts need to stay in MLDv1 mode, discard MLDv2 queries */
+        if (mld_in_v1_mode(idev))
+                return -EINVAL;
+
+        *max_delay = max(msecs_to_jiffies(mldv2_mrc(mld)), 1UL);
+
+        mld_update_qrv(idev, mld);
+        mld_update_qi(idev, mld);
+        mld_update_qri(idev, mld);
+
+        idev->mc_maxdelay = *max_delay;
+
+        return 0;
+}
+
 /* called with rcu_read_lock() */
 int igmp6_event_query(struct sk_buff *skb)
 {
@@ -1100,7 +1292,7 @@ int igmp6_event_query(struct sk_buff *skb)
         struct mld_msg *mld;
         int group_type;
         int mark = 0;
-        int len;
+        int len, err;
 
         if (!pskb_may_pull(skb, sizeof(struct in6_addr)))
                 return -EINVAL;
@@ -1114,7 +1306,6 @@ int igmp6_event_query(struct sk_buff *skb)
                 return -EINVAL;
 
         idev = __in6_dev_get(skb->dev);
-
         if (idev == NULL)
                 return 0;
 
@@ -1126,35 +1317,23 @@ int igmp6_event_query(struct sk_buff *skb)
             !(group_type&IPV6_ADDR_MULTICAST))
                 return -EINVAL;
 
-        if (len == 24) {
-                int switchback;
-                /* MLDv1 router present */
-
-                /* Translate milliseconds to jiffies */
-                max_delay = (ntohs(mld->mld_maxdelay)*HZ)/1000;
-
-                switchback = (idev->mc_qrv + 1) * max_delay;
-                idev->mc_v1_seen = jiffies + switchback;
-
-                /* cancel the interface change timer */
-                idev->mc_ifc_count = 0;
-                if (del_timer(&idev->mc_ifc_timer))
-                        __in6_dev_put(idev);
-                /* clear deleted report items */
-                mld_clear_delrec(idev);
-        } else if (len >= 28) {
+        if (len == MLD_V1_QUERY_LEN) {
+                err = mld_process_v1(idev, mld, &max_delay);
+                if (err < 0)
+                        return err;
+        } else if (len >= MLD_V2_QUERY_LEN_MIN) {
                 int srcs_offset = sizeof(struct mld2_query) -
                                   sizeof(struct icmp6hdr);
+
                 if (!pskb_may_pull(skb, srcs_offset))
                         return -EINVAL;
 
                 mlh2 = (struct mld2_query *)skb_transport_header(skb);
-                max_delay = (MLDV2_MRC(ntohs(mlh2->mld2q_mrc))*HZ)/1000;
-                if (!max_delay)
-                        max_delay = 1;
-                idev->mc_maxdelay = max_delay;
-                if (mlh2->mld2q_qrv)
-                        idev->mc_qrv = mlh2->mld2q_qrv;
+
+                err = mld_process_v2(idev, mlh2, &max_delay);
+                if (err < 0)
+                        return err;
+
                 if (group_type == IPV6_ADDR_ANY) { /* general query */
                         if (mlh2->mld2q_nsrcs)
                                 return -EINVAL; /* no sources allowed */
@@ -1343,8 +1522,9 @@ static void ip6_mc_hdr(struct sock *sk, struct sk_buff *skb,
         hdr->daddr = *daddr;
 }
 
-static struct sk_buff *mld_newpack(struct net_device *dev, int size)
+static struct sk_buff *mld_newpack(struct inet6_dev *idev, int size)
 {
+        struct net_device *dev = idev->dev;
         struct net *net = dev_net(dev);
         struct sock *sk = net->ipv6.igmp_sk;
         struct sk_buff *skb;
@@ -1367,9 +1547,10 @@ static struct sk_buff *mld_newpack(struct net_device *dev, int size)
         if (!skb)
                 return NULL;
 
+        skb->priority = TC_PRIO_CONTROL;
         skb_reserve(skb, hlen);
 
-        if (ipv6_get_lladdr(dev, &addr_buf, IFA_F_TENTATIVE)) {
+        if (__ipv6_get_lladdr(idev, &addr_buf, IFA_F_TENTATIVE)) {
                 /* <draft-ietf-magma-mld-source-05.txt>:
                  * use unspecified address as the source address
                  * when a valid link-local address is not available.
@@ -1409,8 +1590,9 @@ static void mld_sendpack(struct sk_buff *skb)
         idev = __in6_dev_get(skb->dev);
         IP6_UPD_PO_STATS(net, idev, IPSTATS_MIB_OUT, skb->len);
 
-        payload_len = (skb->tail - skb->network_header) - sizeof(*pip6);
-        mldlen = skb->tail - skb->transport_header;
+        payload_len = (skb_tail_pointer(skb) - skb_network_header(skb)) -
+                sizeof(*pip6);
+        mldlen = skb_tail_pointer(skb) - skb_transport_header(skb);
         pip6->payload_len = htons(payload_len);
 
         pmr->mld2r_cksum = csum_ipv6_magic(&pip6->saddr, &pip6->daddr, mldlen,
@@ -1465,7 +1647,7 @@ static struct sk_buff *add_grhead(struct sk_buff *skb, struct ifmcaddr6 *pmc,
         struct mld2_grec *pgr;
 
         if (!skb)
-                skb = mld_newpack(dev, dev->mtu);
+                skb = mld_newpack(pmc->idev, dev->mtu);
         if (!skb)
                 return NULL;
         pgr = (struct mld2_grec *)skb_put(skb, sizeof(struct mld2_grec));
@@ -1485,7 +1667,8 @@ static struct sk_buff *add_grhead(struct sk_buff *skb, struct ifmcaddr6 *pmc,
 static struct sk_buff *add_grec(struct sk_buff *skb, struct ifmcaddr6 *pmc,
         int type, int gdeleted, int sdeleted)
 {
-        struct net_device *dev = pmc->idev->dev;
+        struct inet6_dev *idev = pmc->idev;
+        struct net_device *dev = idev->dev;
         struct mld2_report *pmr;
         struct mld2_grec *pgr = NULL;
         struct ip6_sf_list *psf, *psf_next, *psf_prev, **psf_list;
@@ -1514,7 +1697,7 @@ static struct sk_buff *add_grec(struct sk_buff *skb, struct ifmcaddr6 *pmc,
                     AVAILABLE(skb) < grec_size(pmc, type, gdeleted, sdeleted)) {
                         if (skb)
                                 mld_sendpack(skb);
-                        skb = mld_newpack(dev, dev->mtu);
+                        skb = mld_newpack(idev, dev->mtu);
                 }
         }
         first = 1;
@@ -1541,7 +1724,7 @@ static struct sk_buff *add_grec(struct sk_buff *skb, struct ifmcaddr6 *pmc,
                                 pgr->grec_nsrcs = htons(scount);
                         if (skb)
                                 mld_sendpack(skb);
-                        skb = mld_newpack(dev, dev->mtu);
+                        skb = mld_newpack(idev, dev->mtu);
                         first = 1;
                         scount = 0;
                 }
@@ -1596,8 +1779,8 @@ static void mld_send_report(struct inet6_dev *idev, struct ifmcaddr6 *pmc)
         struct sk_buff *skb = NULL;
         int type;
 
+        read_lock_bh(&idev->lock);
         if (!pmc) {
-                read_lock_bh(&idev->lock);
                 for (pmc=idev->mc_list; pmc; pmc=pmc->next) {
                         if (pmc->mca_flags & MAF_NOREPORT)
                                 continue;
@@ -1609,7 +1792,6 @@ static void mld_send_report(struct inet6_dev *idev, struct ifmcaddr6 *pmc)
                         skb = add_grec(skb, pmc, type, 0, 0);
                         spin_unlock_bh(&pmc->mca_lock);
                 }
-                read_unlock_bh(&idev->lock);
         } else {
                 spin_lock_bh(&pmc->mca_lock);
                 if (pmc->mca_sfcount[MCAST_EXCLUDE])
@@ -1619,6 +1801,7 @@ static void mld_send_report(struct inet6_dev *idev, struct ifmcaddr6 *pmc)
                 skb = add_grec(skb, pmc, type, 0, 0);
                 spin_unlock_bh(&pmc->mca_lock);
         }
+        read_unlock_bh(&idev->lock);
         if (skb)
                 mld_sendpack(skb);
 }
@@ -1758,7 +1941,7 @@ static void igmp6_send(struct in6_addr *addr, struct net_device *dev, int type)
                 rcu_read_unlock();
                 return;
         }
-
+        skb->priority = TC_PRIO_CONTROL;
         skb_reserve(skb, hlen);
 
         if (ipv6_get_lladdr(dev, &addr_buf, IFA_F_TENTATIVE)) {
@@ -1814,6 +1997,46 @@ err_out:
         goto out;
 }
 
+static void mld_resend_report(struct inet6_dev *idev)
+{
+        if (mld_in_v1_mode(idev)) {
+                struct ifmcaddr6 *mcaddr;
+                read_lock_bh(&idev->lock);
+                for (mcaddr = idev->mc_list; mcaddr; mcaddr = mcaddr->next) {
+                        if (!(mcaddr->mca_flags & MAF_NOREPORT))
+                                igmp6_send(&mcaddr->mca_addr, idev->dev,
+                                           ICMPV6_MGM_REPORT);
+                }
+                read_unlock_bh(&idev->lock);
+        } else {
+                mld_send_report(idev, NULL);
+        }
+}
+
+void ipv6_mc_dad_complete(struct inet6_dev *idev)
+{
+        idev->mc_dad_count = idev->mc_qrv;
+        if (idev->mc_dad_count) {
+                mld_resend_report(idev);
+                idev->mc_dad_count--;
+                if (idev->mc_dad_count)
+                        mld_dad_start_timer(idev, idev->mc_maxdelay);
+        }
+}
+
+static void mld_dad_timer_expire(unsigned long data)
+{
+        struct inet6_dev *idev = (struct inet6_dev *)data;
+
+        mld_resend_report(idev);
+        if (idev->mc_dad_count) {
+                idev->mc_dad_count--;
+                if (idev->mc_dad_count)
+                        mld_dad_start_timer(idev, idev->mc_maxdelay);
+        }
+        in6_dev_put(idev);
+}
+
 static int ip6_mc_del1_src(struct ifmcaddr6 *pmc, int sfmode,
         const struct in6_addr *psfsrc)
 {
@@ -1840,7 +2063,7 @@ static int ip6_mc_del1_src(struct ifmcaddr6 *pmc, int sfmode,
                 else
                         pmc->mca_sources = psf->sf_next;
                 if (psf->sf_oldin && !(pmc->mca_flags & MAF_NOREPORT) &&
-                    !MLD_V1_SEEN(idev)) {
+                    !mld_in_v1_mode(idev)) {
                         psf->sf_crcount = idev->mc_qrv;
                         psf->sf_next = pmc->mca_tomb;
                         pmc->mca_tomb = psf;
@@ -2105,7 +2328,7 @@ static void igmp6_join_group(struct ifmcaddr6 *ma)
 
         igmp6_send(&ma->mca_addr, ma->idev->dev, ICMPV6_MGM_REPORT);
 
-        delay = net_random() % IGMP6_UNSOLICITED_IVAL;
+        delay = net_random() % unsolicited_report_interval(ma->idev);
 
         spin_lock_bh(&ma->mca_lock);
         if (del_timer(&ma->mca_timer)) {
@@ -2140,7 +2363,7 @@ static int ip6_mc_leave_src(struct sock *sk, struct ipv6_mc_socklist *iml,
 
 static void igmp6_leave_group(struct ifmcaddr6 *ma)
 {
-        if (MLD_V1_SEEN(ma->idev)) {
+        if (mld_in_v1_mode(ma->idev)) {
                 if (ma->mca_flags & MAF_LAST_REPORTER)
                         igmp6_send(&ma->mca_addr, ma->idev->dev,
                                 ICMPV6_MGM_REDUCTION);
@@ -2156,7 +2379,7 @@ static void mld_gq_timer_expire(unsigned long data)
 
         idev->mc_gq_running = 0;
         mld_send_report(idev, NULL);
-        __in6_dev_put(idev);
+        in6_dev_put(idev);
 }
 
 static void mld_ifc_timer_expire(unsigned long data)
@@ -2169,12 +2392,12 @@ static void mld_ifc_timer_expire(unsigned long data)
                 if (idev->mc_ifc_count)
                         mld_ifc_start_timer(idev, idev->mc_maxdelay);
         }
-        __in6_dev_put(idev);
+        in6_dev_put(idev);
 }
 
 static void mld_ifc_event(struct inet6_dev *idev)
 {
-        if (MLD_V1_SEEN(idev))
+        if (mld_in_v1_mode(idev))
                 return;
         idev->mc_ifc_count = idev->mc_qrv;
         mld_ifc_start_timer(idev, 1);
@@ -2185,7 +2408,7 @@ static void igmp6_timer_handler(unsigned long data)
 {
         struct ifmcaddr6 *ma = (struct ifmcaddr6 *) data;
 
-        if (MLD_V1_SEEN(ma->idev))
+        if (mld_in_v1_mode(ma->idev))
                 igmp6_send(&ma->mca_addr, ma->idev->dev, ICMPV6_MGM_REPORT);
         else
                 mld_send_report(ma->idev, ma);
@@ -2225,12 +2448,9 @@ void ipv6_mc_down(struct inet6_dev *idev)
         /* Withdraw multicast list */
 
         read_lock_bh(&idev->lock);
-        idev->mc_ifc_count = 0;
-        if (del_timer(&idev->mc_ifc_timer))
-                __in6_dev_put(idev);
-        idev->mc_gq_running = 0;
-        if (del_timer(&idev->mc_gq_timer))
-                __in6_dev_put(idev);
+        mld_ifc_stop_timer(idev);
+        mld_gq_stop_timer(idev);
+        mld_dad_stop_timer(idev);
 
         for (i = idev->mc_list; i; i=i->next)
                 igmp6_group_dropped(i);
@@ -2267,8 +2487,14 @@ void ipv6_mc_init_dev(struct inet6_dev *idev)
         idev->mc_ifc_count = 0;
         setup_timer(&idev->mc_ifc_timer, mld_ifc_timer_expire,
                         (unsigned long)idev);
+        setup_timer(&idev->mc_dad_timer, mld_dad_timer_expire,
+                    (unsigned long)idev);
+
         idev->mc_qrv = MLD_QRV_DEFAULT;
-        idev->mc_maxdelay = IGMP6_UNSOLICITED_IVAL;
+        idev->mc_qi = MLD_QI_DEFAULT;
+        idev->mc_qri = MLD_QRI_DEFAULT;
+
+        idev->mc_maxdelay = unsolicited_report_interval(idev);
         idev->mc_v1_seen = 0;
         write_unlock_bh(&idev->lock);
 }
diff --git a/net/ipv6/mip6.c b/net/ipv6/mip6.c
index 0f9bdc5ee9f3..9ac01dc9402e 100644
--- a/net/ipv6/mip6.c
+++ b/net/ipv6/mip6.c
@@ -268,7 +268,8 @@ static int mip6_destopt_offset(struct xfrm_state *x, struct sk_buff *skb,
         struct ipv6_opt_hdr *exthdr =
                                    (struct ipv6_opt_hdr *)(ipv6_hdr(skb) + 1);
         const unsigned char *nh = skb_network_header(skb);
-        unsigned int packet_len = skb->tail - skb->network_header;
+        unsigned int packet_len = skb_tail_pointer(skb) -
+                skb_network_header(skb);
         int found_rhdr = 0;
 
         *nexthdr = &ipv6_hdr(skb)->nexthdr;
@@ -404,7 +405,8 @@ static int mip6_rthdr_offset(struct xfrm_state *x, struct sk_buff *skb,
         struct ipv6_opt_hdr *exthdr =
                                    (struct ipv6_opt_hdr *)(ipv6_hdr(skb) + 1);
         const unsigned char *nh = skb_network_header(skb);
-        unsigned int packet_len = skb->tail - skb->network_header;
+        unsigned int packet_len = skb_tail_pointer(skb) -
+                skb_network_header(skb);
         int found_rhdr = 0;
 
         *nexthdr = &ipv6_hdr(skb)->nexthdr;
diff --git a/net/ipv6/ndisc.c b/net/ipv6/ndisc.c
index 2712ab22a174..f8a55ff1971b 100644
--- a/net/ipv6/ndisc.c
+++ b/net/ipv6/ndisc.c
@@ -372,14 +372,11 @@ static struct sk_buff *ndisc_alloc_skb(struct net_device *dev,
         int tlen = dev->needed_tailroom;
         struct sock *sk = dev_net(dev)->ipv6.ndisc_sk;
         struct sk_buff *skb;
-        int err;
 
-        skb = sock_alloc_send_skb(sk,
-                                  hlen + sizeof(struct ipv6hdr) + len + tlen,
-                                  1, &err);
+        skb = alloc_skb(hlen + sizeof(struct ipv6hdr) + len + tlen, GFP_ATOMIC);
         if (!skb) {
-                ND_PRINTK(0, err, "ndisc: %s failed to allocate an skb, err=%d\n",
-                          __func__, err);
+                ND_PRINTK(0, err, "ndisc: %s failed to allocate an skb\n",
+                          __func__);
                 return NULL;
         }
 
@@ -389,6 +386,11 @@ static struct sk_buff *ndisc_alloc_skb(struct net_device *dev,
         skb_reserve(skb, hlen + sizeof(struct ipv6hdr));
         skb_reset_transport_header(skb);
 
+        /* Manually assign socket ownership as we avoid calling
+         * sock_alloc_send_pskb() to bypass wmem buffer limits
+         */
+        skb_set_owner_w(skb, sk);
+
         return skb;
 }
 
@@ -428,7 +430,6 @@ static void ndisc_send_skb(struct sk_buff *skb,
         type = icmp6h->icmp6_type;
 
         if (!dst) {
-                struct sock *sk = net->ipv6.ndisc_sk;
                 struct flowi6 fl6;
 
                 icmpv6_flow_init(sk, &fl6, type, saddr, daddr, skb->dev->ifindex);
@@ -462,10 +463,10 @@ static void ndisc_send_skb(struct sk_buff *skb,
         rcu_read_unlock();
 }
 
-static void ndisc_send_na(struct net_device *dev, struct neighbour *neigh,
-                          const struct in6_addr *daddr,
-                          const struct in6_addr *solicited_addr,
-                          bool router, bool solicited, bool override, bool inc_opt)
+void ndisc_send_na(struct net_device *dev, struct neighbour *neigh,
+                   const struct in6_addr *daddr,
+                   const struct in6_addr *solicited_addr,
+                   bool router, bool solicited, bool override, bool inc_opt)
 {
         struct sk_buff *skb;
         struct in6_addr tmpaddr;
@@ -479,7 +480,7 @@ static void ndisc_send_na(struct net_device *dev, struct neighbour *neigh,
         if (ifp) {
                 src_addr = solicited_addr;
                 if (ifp->flags & IFA_F_OPTIMISTIC)
-                        override = 0;
+                        override = false;
                 inc_opt |= ifp->idev->cnf.force_tllao;
                 in6_ifa_put(ifp);
         } else {
@@ -557,7 +558,7 @@ void ndisc_send_ns(struct net_device *dev, struct neighbour *neigh,
         }
 
         if (ipv6_addr_any(saddr))
-                inc_opt = 0;
+                inc_opt = false;
         if (inc_opt)
                 optlen += ndisc_opt_addr_space(dev);
 
@@ -663,9 +664,7 @@ static void ndisc_solicit(struct neighbour *neigh, struct sk_buff *skb)
                 }
                 ndisc_send_ns(dev, neigh, target, target, saddr);
         } else if ((probes -= neigh->parms->app_probes) < 0) {
-#ifdef CONFIG_ARPD
                 neigh_app_ns(neigh);
-#endif
         } else {
                 addrconf_addr_solict_mult(target, &mcaddr);
                 ndisc_send_ns(dev, NULL, target, &mcaddr, saddr);
@@ -693,7 +692,7 @@ static void ndisc_recv_ns(struct sk_buff *skb)
         const struct in6_addr *saddr = &ipv6_hdr(skb)->saddr;
         const struct in6_addr *daddr = &ipv6_hdr(skb)->daddr;
         u8 *lladdr = NULL;
-        u32 ndoptlen = skb->tail - (skb->transport_header +
+        u32 ndoptlen = skb_tail_pointer(skb) - (skb_transport_header(skb) +
                                     offsetof(struct nd_msg, opt));
         struct ndisc_options ndopts;
         struct net_device *dev = skb->dev;
@@ -790,7 +789,7 @@ static void ndisc_recv_ns(struct sk_buff *skb)
                      (is_router = pndisc_is_router(&msg->target, dev)) >= 0)) {
                         if (!(NEIGH_CB(skb)->flags & LOCALLY_ENQUEUED) &&
                             skb->pkt_type != PACKET_HOST &&
-                            inc != 0 &&
+                            inc &&
                             idev->nd_parms->proxy_delay != 0) {
                                 /*
                                  * for anycast or proxy,
@@ -853,7 +852,7 @@ static void ndisc_recv_na(struct sk_buff *skb)
         const struct in6_addr *saddr = &ipv6_hdr(skb)->saddr;
         const struct in6_addr *daddr = &ipv6_hdr(skb)->daddr;
         u8 *lladdr = NULL;
-        u32 ndoptlen = skb->tail - (skb->transport_header +
+        u32 ndoptlen = skb_tail_pointer(skb) - (skb_transport_header(skb) +
                                     offsetof(struct nd_msg, opt));
         struct ndisc_options ndopts;
         struct net_device *dev = skb->dev;
@@ -1069,7 +1068,8 @@ static void ndisc_router_discovery(struct sk_buff *skb)
 
         __u8 * opt = (__u8 *)(ra_msg + 1);
 
-        optlen = (skb->tail - skb->transport_header) - sizeof(struct ra_msg);
+        optlen = (skb_tail_pointer(skb) - skb_transport_header(skb)) -
+                sizeof(struct ra_msg);
 
         if (!(ipv6_addr_type(&ipv6_hdr(skb)->saddr) & IPV6_ADDR_LINKLOCAL)) {
                 ND_PRINTK(2, warn, "RA: source address is not link-local\n");
@@ -1346,7 +1346,7 @@ static void ndisc_redirect_rcv(struct sk_buff *skb)
         u8 *hdr;
         struct ndisc_options ndopts;
         struct rd_msg *msg = (struct rd_msg *)skb_transport_header(skb);
-        u32 ndoptlen = skb->tail - (skb->transport_header +
+        u32 ndoptlen = skb_tail_pointer(skb) - (skb_transport_header(skb) +
                                     offsetof(struct rd_msg, opt));
 
 #ifdef CONFIG_IPV6_NDISC_NODETYPE
@@ -1368,8 +1368,11 @@ static void ndisc_redirect_rcv(struct sk_buff *skb)
         if (!ndisc_parse_options(msg->opt, ndoptlen, &ndopts))
                 return;
 
-        if (!ndopts.nd_opts_rh)
+        if (!ndopts.nd_opts_rh) {
+                ip6_redirect_no_header(skb, dev_net(skb->dev),
+                                        skb->dev->ifindex, 0);
                 return;
+        }
 
         hdr = (u8 *)ndopts.nd_opts_rh;
         hdr += 8;
@@ -1493,7 +1496,7 @@ void ndisc_send_redirect(struct sk_buff *skb, const struct in6_addr *target)
          */
 
         if (ha)
-                ndisc_fill_addr_option(skb, ND_OPT_TARGET_LL_ADDR, ha);
+                ndisc_fill_addr_option(buff, ND_OPT_TARGET_LL_ADDR, ha);
 
         /*
          *      build redirect option and copy skb over to the new packet.
@@ -1516,10 +1519,27 @@ static void pndisc_redo(struct sk_buff *skb)
         kfree_skb(skb);
 }
 
+static bool ndisc_suppress_frag_ndisc(struct sk_buff *skb)
+{
+        struct inet6_dev *idev = __in6_dev_get(skb->dev);
+
+        if (!idev)
+                return true;
+        if (IP6CB(skb)->flags & IP6SKB_FRAGMENTED &&
+            idev->cnf.suppress_frag_ndisc) {
+                net_warn_ratelimited("Received fragmented ndisc packet. Carefully consider disabling suppress_frag_ndisc.\n");
+                return true;
+        }
+        return false;
+}
+
 int ndisc_rcv(struct sk_buff *skb)
 {
         struct nd_msg *msg;
 
+        if (ndisc_suppress_frag_ndisc(skb))
+                return 0;
+
         if (skb_linearize(skb))
                 return 0;
 
@@ -1568,14 +1588,14 @@ int ndisc_rcv(struct sk_buff *skb)
 
 static int ndisc_netdev_event(struct notifier_block *this, unsigned long event, void *ptr)
 {
-        struct net_device *dev = ptr;
+        struct net_device *dev = netdev_notifier_info_to_dev(ptr);
         struct net *net = dev_net(dev);
         struct inet6_dev *idev;
 
         switch (event) {
         case NETDEV_CHANGEADDR:
                 neigh_changeaddr(&nd_tbl, dev);
-                fib6_run_gc(~0UL, net);
+                fib6_run_gc(0, net, false);
                 idev = in6_dev_get(dev);
                 if (!idev)
                         break;
@@ -1585,7 +1605,7 @@ static int ndisc_netdev_event(struct notifier_block *this, unsigned long event,
                 break;
         case NETDEV_DOWN:
                 neigh_ifdown(&nd_tbl, dev);
-                fib6_run_gc(~0UL, net);
+                fib6_run_gc(0, net, false);
                 break;
         case NETDEV_NOTIFY_PEERS:
                 ndisc_send_unsol_na(dev);
@@ -1707,24 +1727,28 @@ int __init ndisc_init(void)
         if (err)
                 goto out_unregister_pernet;
 #endif
-        err = register_netdevice_notifier(&ndisc_netdev_notifier);
-        if (err)
-                goto out_unregister_sysctl;
 out:
         return err;
 
-out_unregister_sysctl:
 #ifdef CONFIG_SYSCTL
-        neigh_sysctl_unregister(&nd_tbl.parms);
 out_unregister_pernet:
-#endif
         unregister_pernet_subsys(&ndisc_net_ops);
         goto out;
+#endif
 }
 
-void ndisc_cleanup(void)
+int __init ndisc_late_init(void)
+{
+        return register_netdevice_notifier(&ndisc_netdev_notifier);
+}
+
+void ndisc_late_cleanup(void)
 {
         unregister_netdevice_notifier(&ndisc_netdev_notifier);
+}
+
+void ndisc_cleanup(void)
+{
 #ifdef CONFIG_SYSCTL
         neigh_sysctl_unregister(&nd_tbl.parms);
 #endif
diff --git a/net/ipv6/netfilter/Kconfig b/net/ipv6/netfilter/Kconfig
index 4433ab40e7de..a7f842b29b67 100644
--- a/net/ipv6/netfilter/Kconfig
+++ b/net/ipv6/netfilter/Kconfig
@@ -153,6 +153,19 @@ config IP6_NF_TARGET_REJECT
 
           To compile it as a module, choose M here.  If unsure, say N.
 
+config IP6_NF_TARGET_SYNPROXY
+        tristate "SYNPROXY target support"
+        depends on NF_CONNTRACK && NETFILTER_ADVANCED
+        select NETFILTER_SYNPROXY
+        select SYN_COOKIES
+        help
+          The SYNPROXY target allows you to intercept TCP connections and
+          establish them using syncookies before they are passed on to the
+          server. This allows to avoid conntrack and server resource usage
+          during SYN-flood attacks.
+
+          To compile it as a module, choose M here. If unsure, say N.
+
 config IP6_NF_MANGLE
         tristate "Packet mangling"
         default m if NETFILTER_ADVANCED=n
diff --git a/net/ipv6/netfilter/Makefile b/net/ipv6/netfilter/Makefile
index 2d11fcc2cf3c..2b53738f798c 100644
--- a/net/ipv6/netfilter/Makefile
+++ b/net/ipv6/netfilter/Makefile
@@ -14,7 +14,7 @@ obj-$(CONFIG_NF_NAT_IPV6) += ip6table_nat.o
 nf_conntrack_ipv6-y  :=  nf_conntrack_l3proto_ipv6.o nf_conntrack_proto_icmpv6.o
 
 # l3 independent conntrack
-obj-$(CONFIG_NF_CONNTRACK_IPV6) += nf_conntrack_ipv6.o nf_defrag_ipv6.o
+obj-$(CONFIG_NF_CONNTRACK_IPV6) += nf_conntrack_ipv6.o
 
 nf_nat_ipv6-y           := nf_nat_l3proto_ipv6.o nf_nat_proto_icmpv6.o
 obj-$(CONFIG_NF_NAT_IPV6) += nf_nat_ipv6.o
@@ -37,3 +37,4 @@ obj-$(CONFIG_IP6_NF_MATCH_RT) += ip6t_rt.o
 obj-$(CONFIG_IP6_NF_TARGET_MASQUERADE) += ip6t_MASQUERADE.o
 obj-$(CONFIG_IP6_NF_TARGET_NPT) += ip6t_NPT.o
 obj-$(CONFIG_IP6_NF_TARGET_REJECT) += ip6t_REJECT.o
+obj-$(CONFIG_IP6_NF_TARGET_SYNPROXY) += ip6t_SYNPROXY.o
diff --git a/net/ipv6/netfilter/ip6t_MASQUERADE.c b/net/ipv6/netfilter/ip6t_MASQUERADE.c
index 60e9053bab05..3e4e92d5e157 100644
--- a/net/ipv6/netfilter/ip6t_MASQUERADE.c
+++ b/net/ipv6/netfilter/ip6t_MASQUERADE.c
@@ -71,12 +71,12 @@ static int device_cmp(struct nf_conn *ct, void *ifindex)
 static int masq_device_event(struct notifier_block *this,
                              unsigned long event, void *ptr)
 {
-        const struct net_device *dev = ptr;
+        const struct net_device *dev = netdev_notifier_info_to_dev(ptr);
         struct net *net = dev_net(dev);
 
         if (event == NETDEV_DOWN)
                 nf_ct_iterate_cleanup(net, device_cmp,
-                                      (void *)(long)dev->ifindex);
+                                      (void *)(long)dev->ifindex, 0, 0);
 
         return NOTIFY_DONE;
 }
@@ -89,8 +89,10 @@ static int masq_inet_event(struct notifier_block *this,
                            unsigned long event, void *ptr)
 {
         struct inet6_ifaddr *ifa = ptr;
+        struct netdev_notifier_info info;
 
-        return masq_device_event(this, event, ifa->idev->dev);
+        netdev_notifier_info_init(&info, ifa->idev->dev);
+        return masq_device_event(this, event, &info);
 }
 
 static struct notifier_block masq_inet_notifier = {
diff --git a/net/ipv6/netfilter/ip6t_REJECT.c b/net/ipv6/netfilter/ip6t_REJECT.c
index 70f9abc0efe9..56eef30ee5f6 100644
--- a/net/ipv6/netfilter/ip6t_REJECT.c
+++ b/net/ipv6/netfilter/ip6t_REJECT.c
@@ -169,7 +169,25 @@ static void send_reset(struct net *net, struct sk_buff *oldskb)
 
         nf_ct_attach(nskb, oldskb);
 
-        ip6_local_out(nskb);
+#ifdef CONFIG_BRIDGE_NETFILTER
+        /* If we use ip6_local_out for bridged traffic, the MAC source on
+         * the RST will be ours, instead of the destination's.  This confuses
+         * some routers/firewalls, and they drop the packet.  So we need to
+         * build the eth header using the original destination's MAC as the
+         * source, and send the RST packet directly.
+         */
+        if (oldskb->nf_bridge) {
+                struct ethhdr *oeth = eth_hdr(oldskb);
+                nskb->dev = oldskb->nf_bridge->physindev;
+                nskb->protocol = htons(ETH_P_IPV6);
+                ip6h->payload_len = htons(sizeof(struct tcphdr));
+                if (dev_hard_header(nskb, nskb->dev, ntohs(nskb->protocol),
+                                    oeth->h_source, oeth->h_dest, nskb->len) < 0)
+                        return;
+                dev_queue_xmit(nskb);
+        } else
+#endif
+                ip6_local_out(nskb);
 }
 
 static inline void
diff --git a/net/ipv6/netfilter/ip6t_SYNPROXY.c b/net/ipv6/netfilter/ip6t_SYNPROXY.c
new file mode 100644
index 000000000000..2748b042da72
--- /dev/null
+++ b/net/ipv6/netfilter/ip6t_SYNPROXY.c
@@ -0,0 +1,503 @@
+/*
+ * Copyright (c) 2013 Patrick McHardy <kaber@trash.net>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+
+#include <linux/module.h>
+#include <linux/skbuff.h>
+#include <net/ip6_checksum.h>
+#include <net/ip6_route.h>
+#include <net/tcp.h>
+
+#include <linux/netfilter_ipv6/ip6_tables.h>
+#include <linux/netfilter/x_tables.h>
+#include <linux/netfilter/xt_SYNPROXY.h>
+#include <net/netfilter/nf_conntrack.h>
+#include <net/netfilter/nf_conntrack_seqadj.h>
+#include <net/netfilter/nf_conntrack_synproxy.h>
+
+static struct ipv6hdr *
+synproxy_build_ip(struct sk_buff *skb, const struct in6_addr *saddr,
+                                       const struct in6_addr *daddr)
+{
+        struct ipv6hdr *iph;
+
+        skb_reset_network_header(skb);
+        iph = (struct ipv6hdr *)skb_put(skb, sizeof(*iph));
+        ip6_flow_hdr(iph, 0, 0);
+        iph->hop_limit  = 64;   //XXX
+        iph->nexthdr    = IPPROTO_TCP;
+        iph->saddr      = *saddr;
+        iph->daddr      = *daddr;
+
+        return iph;
+}
+
+static void
+synproxy_send_tcp(const struct sk_buff *skb, struct sk_buff *nskb,
+                  struct nf_conntrack *nfct, enum ip_conntrack_info ctinfo,
+                  struct ipv6hdr *niph, struct tcphdr *nth,
+                  unsigned int tcp_hdr_size)
+{
+        struct net *net = nf_ct_net((struct nf_conn *)nfct);
+        struct dst_entry *dst;
+        struct flowi6 fl6;
+
+        nth->check = ~tcp_v6_check(tcp_hdr_size, &niph->saddr, &niph->daddr, 0);
+        nskb->ip_summed   = CHECKSUM_PARTIAL;
+        nskb->csum_start  = (unsigned char *)nth - nskb->head;
+        nskb->csum_offset = offsetof(struct tcphdr, check);
+
+        memset(&fl6, 0, sizeof(fl6));
+        fl6.flowi6_proto = IPPROTO_TCP;
+        fl6.saddr = niph->saddr;
+        fl6.daddr = niph->daddr;
+        fl6.fl6_sport = nth->source;
+        fl6.fl6_dport = nth->dest;
+        security_skb_classify_flow((struct sk_buff *)skb, flowi6_to_flowi(&fl6));
+        dst = ip6_route_output(net, NULL, &fl6);
+        if (dst == NULL || dst->error) {
+                dst_release(dst);
+                goto free_nskb;
+        }
+        dst = xfrm_lookup(net, dst, flowi6_to_flowi(&fl6), NULL, 0);
+        if (IS_ERR(dst))
+                goto free_nskb;
+
+        skb_dst_set(nskb, dst);
+
+        if (nfct) {
+                nskb->nfct = nfct;
+                nskb->nfctinfo = ctinfo;
+                nf_conntrack_get(nfct);
+        }
+
+        ip6_local_out(nskb);
+        return;
+
+free_nskb:
+        kfree_skb(nskb);
+}
+
+static void
+synproxy_send_client_synack(const struct sk_buff *skb, const struct tcphdr *th,
+                            const struct synproxy_options *opts)
+{
+        struct sk_buff *nskb;
+        struct ipv6hdr *iph, *niph;
+        struct tcphdr *nth;
+        unsigned int tcp_hdr_size;
+        u16 mss = opts->mss;
+
+        iph = ipv6_hdr(skb);
+
+        tcp_hdr_size = sizeof(*nth) + synproxy_options_size(opts);
+        nskb = alloc_skb(sizeof(*niph) + tcp_hdr_size + MAX_TCP_HEADER,
+                         GFP_ATOMIC);
+        if (nskb == NULL)
+                return;
+        skb_reserve(nskb, MAX_TCP_HEADER);
+
+        niph = synproxy_build_ip(nskb, &iph->daddr, &iph->saddr);
+
+        skb_reset_transport_header(nskb);
+        nth = (struct tcphdr *)skb_put(nskb, tcp_hdr_size);
+        nth->source     = th->dest;
+        nth->dest       = th->source;
+        nth->seq        = htonl(__cookie_v6_init_sequence(iph, th, &mss));
+        nth->ack_seq    = htonl(ntohl(th->seq) + 1);
+        tcp_flag_word(nth) = TCP_FLAG_SYN | TCP_FLAG_ACK;
+        if (opts->options & XT_SYNPROXY_OPT_ECN)
+                tcp_flag_word(nth) |= TCP_FLAG_ECE;
+        nth->doff       = tcp_hdr_size / 4;
+        nth->window     = 0;
+        nth->check      = 0;
+        nth->urg_ptr    = 0;
+
+        synproxy_build_options(nth, opts);
+
+        synproxy_send_tcp(skb, nskb, skb->nfct, IP_CT_ESTABLISHED_REPLY,
+                          niph, nth, tcp_hdr_size);
+}
+
+static void
+synproxy_send_server_syn(const struct synproxy_net *snet,
+                         const struct sk_buff *skb, const struct tcphdr *th,
+                         const struct synproxy_options *opts, u32 recv_seq)
+{
+        struct sk_buff *nskb;
+        struct ipv6hdr *iph, *niph;
+        struct tcphdr *nth;
+        unsigned int tcp_hdr_size;
+
+        iph = ipv6_hdr(skb);
+
+        tcp_hdr_size = sizeof(*nth) + synproxy_options_size(opts);
+        nskb = alloc_skb(sizeof(*niph) + tcp_hdr_size + MAX_TCP_HEADER,
+                         GFP_ATOMIC);
+        if (nskb == NULL)
+                return;
+        skb_reserve(nskb, MAX_TCP_HEADER);
+
+        niph = synproxy_build_ip(nskb, &iph->saddr, &iph->daddr);
+
+        skb_reset_transport_header(nskb);
+        nth = (struct tcphdr *)skb_put(nskb, tcp_hdr_size);
+        nth->source     = th->source;
+        nth->dest       = th->dest;
+        nth->seq        = htonl(recv_seq - 1);
+        /* ack_seq is used to relay our ISN to the synproxy hook to initialize
+         * sequence number translation once a connection tracking entry exists.
+         */
+        nth->ack_seq    = htonl(ntohl(th->ack_seq) - 1);
+        tcp_flag_word(nth) = TCP_FLAG_SYN;
+        if (opts->options & XT_SYNPROXY_OPT_ECN)
+                tcp_flag_word(nth) |= TCP_FLAG_ECE | TCP_FLAG_CWR;
+        nth->doff       = tcp_hdr_size / 4;
+        nth->window     = th->window;
+        nth->check      = 0;
+        nth->urg_ptr    = 0;
+
+        synproxy_build_options(nth, opts);
+
+        synproxy_send_tcp(skb, nskb, &snet->tmpl->ct_general, IP_CT_NEW,
+                          niph, nth, tcp_hdr_size);
+}
+
+static void
+synproxy_send_server_ack(const struct synproxy_net *snet,
+                         const struct ip_ct_tcp *state,
+                         const struct sk_buff *skb, const struct tcphdr *th,
+                         const struct synproxy_options *opts)
+{
+        struct sk_buff *nskb;
+        struct ipv6hdr *iph, *niph;
+        struct tcphdr *nth;
+        unsigned int tcp_hdr_size;
+
+        iph = ipv6_hdr(skb);
+
+        tcp_hdr_size = sizeof(*nth) + synproxy_options_size(opts);
+        nskb = alloc_skb(sizeof(*niph) + tcp_hdr_size + MAX_TCP_HEADER,
+                         GFP_ATOMIC);
+        if (nskb == NULL)
+                return;
+        skb_reserve(nskb, MAX_TCP_HEADER);
+
+        niph = synproxy_build_ip(nskb, &iph->daddr, &iph->saddr);
+
+        skb_reset_transport_header(nskb);
+        nth = (struct tcphdr *)skb_put(nskb, tcp_hdr_size);
+        nth->source     = th->dest;
+        nth->dest       = th->source;
+        nth->seq        = htonl(ntohl(th->ack_seq));
+        nth->ack_seq    = htonl(ntohl(th->seq) + 1);
+        tcp_flag_word(nth) = TCP_FLAG_ACK;
+        nth->doff       = tcp_hdr_size / 4;
+        nth->window     = htons(state->seen[IP_CT_DIR_ORIGINAL].td_maxwin);
+        nth->check      = 0;
+        nth->urg_ptr    = 0;
+
+        synproxy_build_options(nth, opts);
+
+        synproxy_send_tcp(skb, nskb, NULL, 0, niph, nth, tcp_hdr_size);
+}
+
+static void
+synproxy_send_client_ack(const struct synproxy_net *snet,
+                         const struct sk_buff *skb, const struct tcphdr *th,
+                         const struct synproxy_options *opts)
+{
+        struct sk_buff *nskb;
+        struct ipv6hdr *iph, *niph;
+        struct tcphdr *nth;
+        unsigned int tcp_hdr_size;
+
+        iph = ipv6_hdr(skb);
+
+        tcp_hdr_size = sizeof(*nth) + synproxy_options_size(opts);
+        nskb = alloc_skb(sizeof(*niph) + tcp_hdr_size + MAX_TCP_HEADER,
+                         GFP_ATOMIC);
+        if (nskb == NULL)
+                return;
+        skb_reserve(nskb, MAX_TCP_HEADER);
+
+        niph = synproxy_build_ip(nskb, &iph->saddr, &iph->daddr);
+
+        skb_reset_transport_header(nskb);
+        nth = (struct tcphdr *)skb_put(nskb, tcp_hdr_size);
+        nth->source     = th->source;
+        nth->dest       = th->dest;
+        nth->seq        = htonl(ntohl(th->seq) + 1);
+        nth->ack_seq    = th->ack_seq;
+        tcp_flag_word(nth) = TCP_FLAG_ACK;
+        nth->doff       = tcp_hdr_size / 4;
+        nth->window     = ntohs(htons(th->window) >> opts->wscale);
+        nth->check      = 0;
+        nth->urg_ptr    = 0;
+
+        synproxy_build_options(nth, opts);
+
+        synproxy_send_tcp(skb, nskb, NULL, 0, niph, nth, tcp_hdr_size);
+}
+
+static bool
+synproxy_recv_client_ack(const struct synproxy_net *snet,
+                         const struct sk_buff *skb, const struct tcphdr *th,
+                         struct synproxy_options *opts, u32 recv_seq)
+{
+        int mss;
+
+        mss = __cookie_v6_check(ipv6_hdr(skb), th, ntohl(th->ack_seq) - 1);
+        if (mss == 0) {
+                this_cpu_inc(snet->stats->cookie_invalid);
+                return false;
+        }
+
+        this_cpu_inc(snet->stats->cookie_valid);
+        opts->mss = mss;
+
+        if (opts->options & XT_SYNPROXY_OPT_TIMESTAMP)
+                synproxy_check_timestamp_cookie(opts);
+
+        synproxy_send_server_syn(snet, skb, th, opts, recv_seq);
+        return true;
+}
+
+static unsigned int
+synproxy_tg6(struct sk_buff *skb, const struct xt_action_param *par)
+{
+        const struct xt_synproxy_info *info = par->targinfo;
+        struct synproxy_net *snet = synproxy_pernet(dev_net(par->in));
+        struct synproxy_options opts = {};
+        struct tcphdr *th, _th;
+
+        if (nf_ip6_checksum(skb, par->hooknum, par->thoff, IPPROTO_TCP))
+                return NF_DROP;
+
+        th = skb_header_pointer(skb, par->thoff, sizeof(_th), &_th);
+        if (th == NULL)
+                return NF_DROP;
+
+        if (!synproxy_parse_options(skb, par->thoff, th, &opts))
+                return NF_DROP;
+
+        if (th->syn && !(th->ack || th->fin || th->rst)) {
+                /* Initial SYN from client */
+                this_cpu_inc(snet->stats->syn_received);
+
+                if (th->ece && th->cwr)
+                        opts.options |= XT_SYNPROXY_OPT_ECN;
+
+                opts.options &= info->options;
+                if (opts.options & XT_SYNPROXY_OPT_TIMESTAMP)
+                        synproxy_init_timestamp_cookie(info, &opts);
+                else
+                        opts.options &= ~(XT_SYNPROXY_OPT_WSCALE |
+                                          XT_SYNPROXY_OPT_SACK_PERM |
+                                          XT_SYNPROXY_OPT_ECN);
+
+                synproxy_send_client_synack(skb, th, &opts);
+                return NF_DROP;
+
+        } else if (th->ack && !(th->fin || th->rst || th->syn)) {
+                /* ACK from client */
+                synproxy_recv_client_ack(snet, skb, th, &opts, ntohl(th->seq));
+                return NF_DROP;
+        }
+
+        return XT_CONTINUE;
+}
+
+static unsigned int ipv6_synproxy_hook(unsigned int hooknum,
+                                       struct sk_buff *skb,
+                                       const struct net_device *in,
+                                       const struct net_device *out,
+                                       int (*okfn)(struct sk_buff *))
+{
+        struct synproxy_net *snet = synproxy_pernet(dev_net(in ? : out));
+        enum ip_conntrack_info ctinfo;
+        struct nf_conn *ct;
+        struct nf_conn_synproxy *synproxy;
+        struct synproxy_options opts = {};
+        const struct ip_ct_tcp *state;
+        struct tcphdr *th, _th;
+        __be16 frag_off;
+        u8 nexthdr;
+        int thoff;
+
+        ct = nf_ct_get(skb, &ctinfo);
+        if (ct == NULL)
+                return NF_ACCEPT;
+
+        synproxy = nfct_synproxy(ct);
+        if (synproxy == NULL)
+                return NF_ACCEPT;
+
+        if (nf_is_loopback_packet(skb))
+                return NF_ACCEPT;
+
+        nexthdr = ipv6_hdr(skb)->nexthdr;
+        thoff = ipv6_skip_exthdr(skb, sizeof(struct ipv6hdr), &nexthdr,
+                                 &frag_off);
+        if (thoff < 0)
+                return NF_ACCEPT;
+
+        th = skb_header_pointer(skb, thoff, sizeof(_th), &_th);
+        if (th == NULL)
+                return NF_DROP;
+
+        state = &ct->proto.tcp;
+        switch (state->state) {
+        case TCP_CONNTRACK_CLOSE:
+                if (th->rst && !test_bit(IPS_SEEN_REPLY_BIT, &ct->status)) {
+                        nf_ct_seqadj_init(ct, ctinfo, synproxy->isn -
+                                                      ntohl(th->seq) + 1);
+                        break;
+                }
+
+                if (!th->syn || th->ack ||
+                    CTINFO2DIR(ctinfo) != IP_CT_DIR_ORIGINAL)
+                        break;
+
+                /* Reopened connection - reset the sequence number and timestamp
+                 * adjustments, they will get initialized once the connection is
+                 * reestablished.
+                 */
+                nf_ct_seqadj_init(ct, ctinfo, 0);
+                synproxy->tsoff = 0;
+                this_cpu_inc(snet->stats->conn_reopened);
+
+                /* fall through */
+        case TCP_CONNTRACK_SYN_SENT:
+                if (!synproxy_parse_options(skb, thoff, th, &opts))
+                        return NF_DROP;
+
+                if (!th->syn && th->ack &&
+                    CTINFO2DIR(ctinfo) == IP_CT_DIR_ORIGINAL) {
+                        /* Keep-Alives are sent with SEG.SEQ = SND.NXT-1,
+                         * therefore we need to add 1 to make the SYN sequence
+                         * number match the one of first SYN.
+                         */
+                        if (synproxy_recv_client_ack(snet, skb, th, &opts,
+                                                     ntohl(th->seq) + 1))
+                                this_cpu_inc(snet->stats->cookie_retrans);
+
+                        return NF_DROP;
+                }
+
+                synproxy->isn = ntohl(th->ack_seq);
+                if (opts.options & XT_SYNPROXY_OPT_TIMESTAMP)
+                        synproxy->its = opts.tsecr;
+                break;
+        case TCP_CONNTRACK_SYN_RECV:
+                if (!th->syn || !th->ack)
+                        break;
+
+                if (!synproxy_parse_options(skb, thoff, th, &opts))
+                        return NF_DROP;
+
+                if (opts.options & XT_SYNPROXY_OPT_TIMESTAMP)
+                        synproxy->tsoff = opts.tsval - synproxy->its;
+
+                opts.options &= ~(XT_SYNPROXY_OPT_MSS |
+                                  XT_SYNPROXY_OPT_WSCALE |
+                                  XT_SYNPROXY_OPT_SACK_PERM);
+
+                swap(opts.tsval, opts.tsecr);
+                synproxy_send_server_ack(snet, state, skb, th, &opts);
+
+                nf_ct_seqadj_init(ct, ctinfo, synproxy->isn - ntohl(th->seq));
+
+                swap(opts.tsval, opts.tsecr);
+                synproxy_send_client_ack(snet, skb, th, &opts);
+
+                consume_skb(skb);
+                return NF_STOLEN;
+        default:
+                break;
+        }
+
+        synproxy_tstamp_adjust(skb, thoff, th, ct, ctinfo, synproxy);
+        return NF_ACCEPT;
+}
+
+static int synproxy_tg6_check(const struct xt_tgchk_param *par)
+{
+        const struct ip6t_entry *e = par->entryinfo;
+
+        if (!(e->ipv6.flags & IP6T_F_PROTO) ||
+            e->ipv6.proto != IPPROTO_TCP ||
+            e->ipv6.invflags & XT_INV_PROTO)
+                return -EINVAL;
+
+        return nf_ct_l3proto_try_module_get(par->family);
+}
+
+static void synproxy_tg6_destroy(const struct xt_tgdtor_param *par)
+{
+        nf_ct_l3proto_module_put(par->family);
+}
+
+static struct xt_target synproxy_tg6_reg __read_mostly = {
+        .name           = "SYNPROXY",
+        .family         = NFPROTO_IPV6,
+        .target         = synproxy_tg6,
+        .targetsize     = sizeof(struct xt_synproxy_info),
+        .checkentry     = synproxy_tg6_check,
+        .destroy        = synproxy_tg6_destroy,
+        .me             = THIS_MODULE,
+};
+
+static struct nf_hook_ops ipv6_synproxy_ops[] __read_mostly = {
+        {
+                .hook           = ipv6_synproxy_hook,
+                .owner          = THIS_MODULE,
+                .pf             = NFPROTO_IPV6,
+                .hooknum        = NF_INET_LOCAL_IN,
+                .priority       = NF_IP_PRI_CONNTRACK_CONFIRM - 1,
+        },
+        {
+                .hook           = ipv6_synproxy_hook,
+                .owner          = THIS_MODULE,
+                .pf             = NFPROTO_IPV6,
+                .hooknum        = NF_INET_POST_ROUTING,
+                .priority       = NF_IP_PRI_CONNTRACK_CONFIRM - 1,
+        },
+};
+
+static int __init synproxy_tg6_init(void)
+{
+        int err;
+
+        err = nf_register_hooks(ipv6_synproxy_ops,
+                                ARRAY_SIZE(ipv6_synproxy_ops));
+        if (err < 0)
+                goto err1;
+
+        err = xt_register_target(&synproxy_tg6_reg);
+        if (err < 0)
+                goto err2;
+
+        return 0;
+
+err2:
+        nf_unregister_hooks(ipv6_synproxy_ops, ARRAY_SIZE(ipv6_synproxy_ops));
+err1:
+        return err;
+}
+
+static void __exit synproxy_tg6_exit(void)
+{
+        xt_unregister_target(&synproxy_tg6_reg);
+        nf_unregister_hooks(ipv6_synproxy_ops, ARRAY_SIZE(ipv6_synproxy_ops));
+}
+
+module_init(synproxy_tg6_init);
+module_exit(synproxy_tg6_exit);
+
+MODULE_LICENSE("GPL");
+MODULE_AUTHOR("Patrick McHardy <kaber@trash.net>");
diff --git a/net/ipv6/netfilter/ip6table_filter.c b/net/ipv6/netfilter/ip6table_filter.c
index beb5777d2043..29b44b14c5ea 100644
--- a/net/ipv6/netfilter/ip6table_filter.c
+++ b/net/ipv6/netfilter/ip6table_filter.c
@@ -61,7 +61,7 @@ static int __net_init ip6table_filter_net_init(struct net *net)
         net->ipv6.ip6table_filter =
                 ip6t_register_table(net, &packet_filter, repl);
         kfree(repl);
-        return PTR_RET(net->ipv6.ip6table_filter);
+        return PTR_ERR_OR_ZERO(net->ipv6.ip6table_filter);
 }
 
 static void __net_exit ip6table_filter_net_exit(struct net *net)
diff --git a/net/ipv6/netfilter/ip6table_mangle.c b/net/ipv6/netfilter/ip6table_mangle.c
index e075399d8b72..c705907ae6ab 100644
--- a/net/ipv6/netfilter/ip6table_mangle.c
+++ b/net/ipv6/netfilter/ip6table_mangle.c
@@ -101,7 +101,7 @@ static int __net_init ip6table_mangle_net_init(struct net *net)
         net->ipv6.ip6table_mangle =
                 ip6t_register_table(net, &packet_mangler, repl);
         kfree(repl);
-        return PTR_RET(net->ipv6.ip6table_mangle);
+        return PTR_ERR_OR_ZERO(net->ipv6.ip6table_mangle);
 }
 
 static void __net_exit ip6table_mangle_net_exit(struct net *net)
diff --git a/net/ipv6/netfilter/ip6table_nat.c b/net/ipv6/netfilter/ip6table_nat.c
index 6383f90efda8..9b076d2d3a7b 100644
--- a/net/ipv6/netfilter/ip6table_nat.c
+++ b/net/ipv6/netfilter/ip6table_nat.c
@@ -293,7 +293,7 @@ static int __net_init ip6table_nat_net_init(struct net *net)
                 return -ENOMEM;
         net->ipv6.ip6table_nat = ip6t_register_table(net, &nf_nat_ipv6_table, repl);
         kfree(repl);
-        return PTR_RET(net->ipv6.ip6table_nat);
+        return PTR_ERR_OR_ZERO(net->ipv6.ip6table_nat);
 }
 
 static void __net_exit ip6table_nat_net_exit(struct net *net)
diff --git a/net/ipv6/netfilter/ip6table_raw.c b/net/ipv6/netfilter/ip6table_raw.c
index 60d1bddff7a0..9a626d86720f 100644
--- a/net/ipv6/netfilter/ip6table_raw.c
+++ b/net/ipv6/netfilter/ip6table_raw.c
@@ -40,7 +40,7 @@ static int __net_init ip6table_raw_net_init(struct net *net)
         net->ipv6.ip6table_raw =
                 ip6t_register_table(net, &packet_raw, repl);
         kfree(repl);
-        return PTR_RET(net->ipv6.ip6table_raw);
+        return PTR_ERR_OR_ZERO(net->ipv6.ip6table_raw);
 }
 
 static void __net_exit ip6table_raw_net_exit(struct net *net)
diff --git a/net/ipv6/netfilter/ip6table_security.c b/net/ipv6/netfilter/ip6table_security.c
index db155351339c..ce88d1d7e525 100644
--- a/net/ipv6/netfilter/ip6table_security.c
+++ b/net/ipv6/netfilter/ip6table_security.c
@@ -58,7 +58,7 @@ static int __net_init ip6table_security_net_init(struct net *net)
         net->ipv6.ip6table_security =
                 ip6t_register_table(net, &security_table, repl);
         kfree(repl);
-        return PTR_RET(net->ipv6.ip6table_security);
+        return PTR_ERR_OR_ZERO(net->ipv6.ip6table_security);
 }
 
 static void __net_exit ip6table_security_net_exit(struct net *net)
diff --git a/net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c b/net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c
index 97bcf2bae857..d6e4dd8b58df 100644
--- a/net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c
+++ b/net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c
@@ -28,6 +28,7 @@
 #include <net/netfilter/nf_conntrack_l3proto.h>
 #include <net/netfilter/nf_conntrack_core.h>
 #include <net/netfilter/nf_conntrack_zones.h>
+#include <net/netfilter/nf_conntrack_seqadj.h>
 #include <net/netfilter/ipv6/nf_conntrack_ipv6.h>
 #include <net/netfilter/nf_nat_helper.h>
 #include <net/netfilter/ipv6/nf_defrag_ipv6.h>
@@ -158,11 +159,7 @@ static unsigned int ipv6_confirm(unsigned int hooknum,
         /* adjust seqs for loopback traffic only in outgoing direction */
         if (test_bit(IPS_SEQ_ADJUST_BIT, &ct->status) &&
             !nf_is_loopback_packet(skb)) {
-                typeof(nf_nat_seq_adjust_hook) seq_adjust;
-
-                seq_adjust = rcu_dereference(nf_nat_seq_adjust_hook);
-                if (!seq_adjust ||
-                    !seq_adjust(skb, ct, ctinfo, protoff)) {
+                if (!nf_ct_seq_adjust(skb, ct, ctinfo, protoff)) {
                         NF_CT_STAT_INC_ATOMIC(nf_ct_net(ct), drop);
                         return NF_DROP;
                 }
@@ -204,7 +201,7 @@ static unsigned int __ipv6_conntrack_in(struct net *net,
                 if (ct != NULL && !nf_ct_is_untracked(ct)) {
                         help = nfct_help(ct);
                         if ((help && help->helper) || !nf_ct_is_confirmed(ct)) {
-                                nf_conntrack_get_reasm(skb);
+                                nf_conntrack_get_reasm(reasm);
                                 NF_HOOK_THRESH(NFPROTO_IPV6, hooknum, reasm,
                                                (struct net_device *)in,
                                                (struct net_device *)out,
diff --git a/net/ipv6/netfilter/nf_nat_proto_icmpv6.c b/net/ipv6/netfilter/nf_nat_proto_icmpv6.c
index 61aaf70f376e..2205e8eeeacf 100644
--- a/net/ipv6/netfilter/nf_nat_proto_icmpv6.c
+++ b/net/ipv6/netfilter/nf_nat_proto_icmpv6.c
@@ -69,8 +69,8 @@ icmpv6_manip_pkt(struct sk_buff *skb,
         hdr = (struct icmp6hdr *)(skb->data + hdroff);
         l3proto->csum_update(skb, iphdroff, &hdr->icmp6_cksum,
                              tuple, maniptype);
-        if (hdr->icmp6_code == ICMPV6_ECHO_REQUEST ||
-            hdr->icmp6_code == ICMPV6_ECHO_REPLY) {
+        if (hdr->icmp6_type == ICMPV6_ECHO_REQUEST ||
+            hdr->icmp6_type == ICMPV6_ECHO_REPLY) {
                 inet_proto_csum_replace2(&hdr->icmp6_cksum, skb,
                                          hdr->icmp6_identifier,
                                          tuple->src.u.icmp.id, 0);
diff --git a/net/ipv6/output_core.c b/net/ipv6/output_core.c
index c2e73e647e44..827f795209cf 100644
--- a/net/ipv6/output_core.c
+++ b/net/ipv6/output_core.c
@@ -5,6 +5,7 @@
 #include <linux/export.h>
 #include <net/ipv6.h>
 #include <net/ip6_fib.h>
+#include <net/addrconf.h>
 
 void ipv6_select_ident(struct frag_hdr *fhdr, struct rt6_info *rt)
 {
@@ -40,7 +41,8 @@ int ip6_find_1stfragopt(struct sk_buff *skb, u8 **nexthdr)
         u16 offset = sizeof(struct ipv6hdr);
         struct ipv6_opt_hdr *exthdr =
                                 (struct ipv6_opt_hdr *)(ipv6_hdr(skb) + 1);
-        unsigned int packet_len = skb->tail - skb->network_header;
+        unsigned int packet_len = skb_tail_pointer(skb) -
+                skb_network_header(skb);
         int found_rhdr = 0;
         *nexthdr = &ipv6_hdr(skb)->nexthdr;
 
@@ -74,3 +76,50 @@ int ip6_find_1stfragopt(struct sk_buff *skb, u8 **nexthdr)
         return offset;
 }
 EXPORT_SYMBOL(ip6_find_1stfragopt);
+
+#if IS_ENABLED(CONFIG_IPV6)
+int ip6_dst_hoplimit(struct dst_entry *dst)
+{
+        int hoplimit = dst_metric_raw(dst, RTAX_HOPLIMIT);
+        if (hoplimit == 0) {
+                struct net_device *dev = dst->dev;
+                struct inet6_dev *idev;
+
+                rcu_read_lock();
+                idev = __in6_dev_get(dev);
+                if (idev)
+                        hoplimit = idev->cnf.hop_limit;
+                else
+                        hoplimit = dev_net(dev)->ipv6.devconf_all->hop_limit;
+                rcu_read_unlock();
+        }
+        return hoplimit;
+}
+EXPORT_SYMBOL(ip6_dst_hoplimit);
+#endif
+
+int __ip6_local_out(struct sk_buff *skb)
+{
+        int len;
+
+        len = skb->len - sizeof(struct ipv6hdr);
+        if (len > IPV6_MAXPLEN)
+                len = 0;
+        ipv6_hdr(skb)->payload_len = htons(len);
+
+        return nf_hook(NFPROTO_IPV6, NF_INET_LOCAL_OUT, skb, NULL,
+                       skb_dst(skb)->dev, dst_output);
+}
+EXPORT_SYMBOL_GPL(__ip6_local_out);
+
+int ip6_local_out(struct sk_buff *skb)
+{
+        int err;
+
+        err = __ip6_local_out(skb);
+        if (likely(err == 1))
+                err = dst_output(skb);
+
+        return err;
+}
+EXPORT_SYMBOL_GPL(ip6_local_out);
diff --git a/net/ipv6/ping.c b/net/ipv6/ping.c
new file mode 100644
index 000000000000..18f19df4189f
--- /dev/null
+++ b/net/ipv6/ping.c
@@ -0,0 +1,277 @@
+/*
+ * INET         An implementation of the TCP/IP protocol suite for the LINUX
+ *              operating system.  INET is implemented using the  BSD Socket
+ *              interface as the means of communication with the user level.
+ *
+ *              "Ping" sockets
+ *
+ *              This program is free software; you can redistribute it and/or
+ *              modify it under the terms of the GNU General Public License
+ *              as published by the Free Software Foundation; either version
+ *              2 of the License, or (at your option) any later version.
+ *
+ * Based on ipv4/ping.c code.
+ *
+ * Authors:     Lorenzo Colitti (IPv6 support)
+ *              Vasiliy Kulikov / Openwall (IPv4 implementation, for Linux 2.6),
+ *              Pavel Kankovsky (IPv4 implementation, for Linux 2.4.32)
+ *
+ */
+
+#include <net/addrconf.h>
+#include <net/ipv6.h>
+#include <net/ip6_route.h>
+#include <net/protocol.h>
+#include <net/udp.h>
+#include <net/transp_v6.h>
+#include <net/ping.h>
+
+struct proto pingv6_prot = {
+        .name =         "PINGv6",
+        .owner =        THIS_MODULE,
+        .init =         ping_init_sock,
+        .close =        ping_close,
+        .connect =      ip6_datagram_connect,
+        .disconnect =   udp_disconnect,
+        .setsockopt =   ipv6_setsockopt,
+        .getsockopt =   ipv6_getsockopt,
+        .sendmsg =      ping_v6_sendmsg,
+        .recvmsg =      ping_recvmsg,
+        .bind =         ping_bind,
+        .backlog_rcv =  ping_queue_rcv_skb,
+        .hash =         ping_hash,
+        .unhash =       ping_unhash,
+        .get_port =     ping_get_port,
+        .obj_size =     sizeof(struct raw6_sock),
+};
+EXPORT_SYMBOL_GPL(pingv6_prot);
+
+static struct inet_protosw pingv6_protosw = {
+        .type =      SOCK_DGRAM,
+        .protocol =  IPPROTO_ICMPV6,
+        .prot =      &pingv6_prot,
+        .ops =       &inet6_dgram_ops,
+        .no_check =  UDP_CSUM_DEFAULT,
+        .flags =     INET_PROTOSW_REUSE,
+};
+
+
+/* Compatibility glue so we can support IPv6 when it's compiled as a module */
+static int dummy_ipv6_recv_error(struct sock *sk, struct msghdr *msg, int len)
+{
+        return -EAFNOSUPPORT;
+}
+static int dummy_ip6_datagram_recv_ctl(struct sock *sk, struct msghdr *msg,
+                                       struct sk_buff *skb)
+{
+        return -EAFNOSUPPORT;
+}
+static int dummy_icmpv6_err_convert(u8 type, u8 code, int *err)
+{
+        return -EAFNOSUPPORT;
+}
+static void dummy_ipv6_icmp_error(struct sock *sk, struct sk_buff *skb, int err,
+                                  __be16 port, u32 info, u8 *payload) {}
+static int dummy_ipv6_chk_addr(struct net *net, const struct in6_addr *addr,
+                               const struct net_device *dev, int strict)
+{
+        return 0;
+}
+
+int ping_v6_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
+                    size_t len)
+{
+        struct inet_sock *inet = inet_sk(sk);
+        struct ipv6_pinfo *np = inet6_sk(sk);
+        struct icmp6hdr user_icmph;
+        int addr_type;
+        struct in6_addr *daddr;
+        int iif = 0;
+        struct flowi6 fl6;
+        int err;
+        int hlimit;
+        struct dst_entry *dst;
+        struct rt6_info *rt;
+        struct pingfakehdr pfh;
+
+        pr_debug("ping_v6_sendmsg(sk=%p,sk->num=%u)\n", inet, inet->inet_num);
+
+        err = ping_common_sendmsg(AF_INET6, msg, len, &user_icmph,
+                                  sizeof(user_icmph));
+        if (err)
+                return err;
+
+        if (msg->msg_name) {
+                struct sockaddr_in6 *u = (struct sockaddr_in6 *) msg->msg_name;
+                if (msg->msg_namelen < sizeof(struct sockaddr_in6) ||
+                    u->sin6_family != AF_INET6) {
+                        return -EINVAL;
+                }
+                if (sk->sk_bound_dev_if &&
+                    sk->sk_bound_dev_if != u->sin6_scope_id) {
+                        return -EINVAL;
+                }
+                daddr = &(u->sin6_addr);
+                iif = u->sin6_scope_id;
+        } else {
+                if (sk->sk_state != TCP_ESTABLISHED)
+                        return -EDESTADDRREQ;
+                daddr = &np->daddr;
+        }
+
+        if (!iif)
+                iif = sk->sk_bound_dev_if;
+
+        addr_type = ipv6_addr_type(daddr);
+        if (__ipv6_addr_needs_scope_id(addr_type) && !iif)
+                return -EINVAL;
+        if (addr_type & IPV6_ADDR_MAPPED)
+                return -EINVAL;
+
+        /* TODO: use ip6_datagram_send_ctl to get options from cmsg */
+
+        memset(&fl6, 0, sizeof(fl6));
+
+        fl6.flowi6_proto = IPPROTO_ICMPV6;
+        fl6.saddr = np->saddr;
+        fl6.daddr = *daddr;
+        fl6.fl6_icmp_type = user_icmph.icmp6_type;
+        fl6.fl6_icmp_code = user_icmph.icmp6_code;
+        security_sk_classify_flow(sk, flowi6_to_flowi(&fl6));
+
+        if (!fl6.flowi6_oif && ipv6_addr_is_multicast(&fl6.daddr))
+                fl6.flowi6_oif = np->mcast_oif;
+        else if (!fl6.flowi6_oif)
+                fl6.flowi6_oif = np->ucast_oif;
+
+        dst = ip6_sk_dst_lookup_flow(sk, &fl6,  daddr, 1);
+        if (IS_ERR(dst))
+                return PTR_ERR(dst);
+        rt = (struct rt6_info *) dst;
+
+        np = inet6_sk(sk);
+        if (!np)
+                return -EBADF;
+
+        if (!fl6.flowi6_oif && ipv6_addr_is_multicast(&fl6.daddr))
+                fl6.flowi6_oif = np->mcast_oif;
+        else if (!fl6.flowi6_oif)
+                fl6.flowi6_oif = np->ucast_oif;
+
+        pfh.icmph.type = user_icmph.icmp6_type;
+        pfh.icmph.code = user_icmph.icmp6_code;
+        pfh.icmph.checksum = 0;
+        pfh.icmph.un.echo.id = inet->inet_sport;
+        pfh.icmph.un.echo.sequence = user_icmph.icmp6_sequence;
+        pfh.iov = msg->msg_iov;
+        pfh.wcheck = 0;
+        pfh.family = AF_INET6;
+
+        if (ipv6_addr_is_multicast(&fl6.daddr))
+                hlimit = np->mcast_hops;
+        else
+                hlimit = np->hop_limit;
+        if (hlimit < 0)
+                hlimit = ip6_dst_hoplimit(dst);
+
+        lock_sock(sk);
+        err = ip6_append_data(sk, ping_getfrag, &pfh, len,
+                              0, hlimit,
+                              np->tclass, NULL, &fl6, rt,
+                              MSG_DONTWAIT, np->dontfrag);
+
+        if (err) {
+                ICMP6_INC_STATS_BH(sock_net(sk), rt->rt6i_idev,
+                                   ICMP6_MIB_OUTERRORS);
+                ip6_flush_pending_frames(sk);
+        } else {
+                err = icmpv6_push_pending_frames(sk, &fl6,
+                                                 (struct icmp6hdr *) &pfh.icmph,
+                                                 len);
+        }
+        release_sock(sk);
+
+        if (err)
+                return err;
+
+        return len;
+}
+
+#ifdef CONFIG_PROC_FS
+static void *ping_v6_seq_start(struct seq_file *seq, loff_t *pos)
+{
+        return ping_seq_start(seq, pos, AF_INET6);
+}
+
+static int ping_v6_seq_show(struct seq_file *seq, void *v)
+{
+        if (v == SEQ_START_TOKEN) {
+                seq_puts(seq, IPV6_SEQ_DGRAM_HEADER);
+        } else {
+                int bucket = ((struct ping_iter_state *) seq->private)->bucket;
+                struct inet_sock *inet = inet_sk(v);
+                __u16 srcp = ntohs(inet->inet_sport);
+                __u16 destp = ntohs(inet->inet_dport);
+                ip6_dgram_sock_seq_show(seq, v, srcp, destp, bucket);
+        }
+        return 0;
+}
+
+static struct ping_seq_afinfo ping_v6_seq_afinfo = {
+        .name           = "icmp6",
+        .family         = AF_INET6,
+        .seq_fops       = &ping_seq_fops,
+        .seq_ops        = {
+                .start          = ping_v6_seq_start,
+                .show           = ping_v6_seq_show,
+                .next           = ping_seq_next,
+                .stop           = ping_seq_stop,
+        },
+};
+
+static int __net_init ping_v6_proc_init_net(struct net *net)
+{
+        return ping_proc_register(net, &ping_v6_seq_afinfo);
+}
+
+static void __net_init ping_v6_proc_exit_net(struct net *net)
+{
+        return ping_proc_unregister(net, &ping_v6_seq_afinfo);
+}
+
+static struct pernet_operations ping_v6_net_ops = {
+        .init = ping_v6_proc_init_net,
+        .exit = ping_v6_proc_exit_net,
+};
+#endif
+
+int __init pingv6_init(void)
+{
+#ifdef CONFIG_PROC_FS
+        int ret = register_pernet_subsys(&ping_v6_net_ops);
+        if (ret)
+                return ret;
+#endif
+        pingv6_ops.ipv6_recv_error = ipv6_recv_error;
+        pingv6_ops.ip6_datagram_recv_ctl = ip6_datagram_recv_ctl;
+        pingv6_ops.icmpv6_err_convert = icmpv6_err_convert;
+        pingv6_ops.ipv6_icmp_error = ipv6_icmp_error;
+        pingv6_ops.ipv6_chk_addr = ipv6_chk_addr;
+        return inet6_register_protosw(&pingv6_protosw);
+}
+
+/* This never gets called because it's not possible to unload the ipv6 module,
+ * but just in case.
+ */
+void pingv6_exit(void)
+{
+        pingv6_ops.ipv6_recv_error = dummy_ipv6_recv_error;
+        pingv6_ops.ip6_datagram_recv_ctl = dummy_ip6_datagram_recv_ctl;
+        pingv6_ops.icmpv6_err_convert = dummy_icmpv6_err_convert;
+        pingv6_ops.ipv6_icmp_error = dummy_ipv6_icmp_error;
+        pingv6_ops.ipv6_chk_addr = dummy_ipv6_chk_addr;
+#ifdef CONFIG_PROC_FS
+        unregister_pernet_subsys(&ping_v6_net_ops);
+#endif
+        inet6_unregister_protosw(&pingv6_protosw);
+}
diff --git a/net/ipv6/proc.c b/net/ipv6/proc.c
index 51c3285b5d9b..091d066a57b3 100644
--- a/net/ipv6/proc.c
+++ b/net/ipv6/proc.c
@@ -91,6 +91,10 @@ static const struct snmp_mib snmp6_ipstats_list[] = {
         SNMP_MIB_ITEM("Ip6InBcastOctets", IPSTATS_MIB_INBCASTOCTETS),
         SNMP_MIB_ITEM("Ip6OutBcastOctets", IPSTATS_MIB_OUTBCASTOCTETS),
         /* IPSTATS_MIB_CSUMERRORS is not relevant in IPv6 (no checksum) */
+        SNMP_MIB_ITEM("Ip6InNoECTPkts", IPSTATS_MIB_NOECTPKTS),
+        SNMP_MIB_ITEM("Ip6InECT1Pkts", IPSTATS_MIB_ECT1PKTS),
+        SNMP_MIB_ITEM("Ip6InECT0Pkts", IPSTATS_MIB_ECT0PKTS),
+        SNMP_MIB_ITEM("Ip6InCEPkts", IPSTATS_MIB_CEPKTS),
         SNMP_MIB_SENTINEL
 };
 
diff --git a/net/ipv6/raw.c b/net/ipv6/raw.c
index eedff8ccded5..a4ed2416399e 100644
--- a/net/ipv6/raw.c
+++ b/net/ipv6/raw.c
@@ -63,6 +63,8 @@
 #include <linux/seq_file.h>
 #include <linux/export.h>
 
+#define ICMPV6_HDRLEN   4       /* ICMPv6 header, RFC 4443 Section 2.1 */
+
 static struct raw_hashinfo raw_v6_hashinfo = {
         .lock = __RW_LOCK_UNLOCKED(raw_v6_hashinfo.lock),
 };
@@ -108,11 +110,14 @@ found:
  */
 static int icmpv6_filter(const struct sock *sk, const struct sk_buff *skb)
 {
-        struct icmp6hdr *_hdr;
+        struct icmp6hdr _hdr;
         const struct icmp6hdr *hdr;
 
+        /* We require only the four bytes of the ICMPv6 header, not any
+         * additional bytes of message body in "struct icmp6hdr".
+         */
         hdr = skb_header_pointer(skb, skb_transport_offset(skb),
-                                 sizeof(_hdr), &_hdr);
+                                 ICMPV6_HDRLEN, &_hdr);
         if (hdr) {
                 const __u32 *data = &raw6_sk(sk)->filter.data[0];
                 unsigned int type = hdr->icmp6_type;
@@ -330,8 +335,10 @@ static void rawv6_err(struct sock *sk, struct sk_buff *skb,
                 ip6_sk_update_pmtu(skb, sk, info);
                 harderr = (np->pmtudisc == IPV6_PMTUDISC_DO);
         }
-        if (type == NDISC_REDIRECT)
+        if (type == NDISC_REDIRECT) {
                 ip6_sk_redirect(skb, sk);
+                return;
+        }
         if (np->recverr) {
                 u8 *payload = skb->data;
                 if (!inet->hdrincl)
@@ -628,6 +635,7 @@ static int rawv6_send_hdrinc(struct sock *sk, void *from, int length,
                 goto error;
         skb_reserve(skb, hlen);
 
+        skb->protocol = htons(ETH_P_IPV6);
         skb->priority = sk->sk_priority;
         skb->mark = sk->sk_mark;
         skb_dst_set(skb, &rt->dst);
@@ -1132,7 +1140,8 @@ static int rawv6_ioctl(struct sock *sk, int cmd, unsigned long arg)
                 spin_lock_bh(&sk->sk_receive_queue.lock);
                 skb = skb_peek(&sk->sk_receive_queue);
                 if (skb != NULL)
-                        amount = skb->tail - skb->transport_header;
+                        amount = skb_tail_pointer(skb) -
+                                skb_transport_header(skb);
                 spin_unlock_bh(&sk->sk_receive_queue.lock);
                 return put_user(amount, (int __user *)arg);
         }
@@ -1226,45 +1235,16 @@ struct proto rawv6_prot = {
 };
 
 #ifdef CONFIG_PROC_FS
-static void raw6_sock_seq_show(struct seq_file *seq, struct sock *sp, int i)
-{
-        struct ipv6_pinfo *np = inet6_sk(sp);
-        const struct in6_addr *dest, *src;
-        __u16 destp, srcp;
-
-        dest  = &np->daddr;
-        src   = &np->rcv_saddr;
-        destp = 0;
-        srcp  = inet_sk(sp)->inet_num;
-        seq_printf(seq,
-                   "%4d: %08X%08X%08X%08X:%04X %08X%08X%08X%08X:%04X "
-                   "%02X %08X:%08X %02X:%08lX %08X %5d %8d %lu %d %pK %d\n",
-                   i,
-                   src->s6_addr32[0], src->s6_addr32[1],
-                   src->s6_addr32[2], src->s6_addr32[3], srcp,
-                   dest->s6_addr32[0], dest->s6_addr32[1],
-                   dest->s6_addr32[2], dest->s6_addr32[3], destp,
-                   sp->sk_state,
-                   sk_wmem_alloc_get(sp),
-                   sk_rmem_alloc_get(sp),
-                   0, 0L, 0,
-                   from_kuid_munged(seq_user_ns(seq), sock_i_uid(sp)),
-                   0,
-                   sock_i_ino(sp),
-                   atomic_read(&sp->sk_refcnt), sp, atomic_read(&sp->sk_drops));
-}
-
 static int raw6_seq_show(struct seq_file *seq, void *v)
 {
-        if (v == SEQ_START_TOKEN)
-                seq_printf(seq,
-                           "  sl  "
-                           "local_address                         "
-                           "remote_address                        "
-                           "st tx_queue rx_queue tr tm->when retrnsmt"
-                           "   uid  timeout inode ref pointer drops\n");
-        else
-                raw6_sock_seq_show(seq, v, raw_seq_private(seq)->bucket);
+        if (v == SEQ_START_TOKEN) {
+                seq_puts(seq, IPV6_SEQ_DGRAM_HEADER);
+        } else {
+                struct sock *sp = v;
+                __u16 srcp  = inet_sk(sp)->inet_num;
+                ip6_dgram_sock_seq_show(seq, v, srcp, 0,
+                                        raw_seq_private(seq)->bucket);
+        }
         return 0;
 }
 
diff --git a/net/ipv6/reassembly.c b/net/ipv6/reassembly.c
index 790d9f4b8b0b..1aeb473b2cc6 100644
--- a/net/ipv6/reassembly.c
+++ b/net/ipv6/reassembly.c
@@ -490,6 +490,7 @@ static int ip6_frag_reasm(struct frag_queue *fq, struct sk_buff *prev,
         ipv6_hdr(head)->payload_len = htons(payload_len);
         ipv6_change_dsfield(ipv6_hdr(head), 0xff, ecn);
         IP6CB(head)->nhoff = nhoff;
+        IP6CB(head)->flags |= IP6SKB_FRAGMENTED;
 
         /* Yes, and fold redundant checksum back. 8) */
         if (head->ip_summed == CHECKSUM_COMPLETE)
@@ -524,6 +525,9 @@ static int ipv6_frag_rcv(struct sk_buff *skb)
         struct net *net = dev_net(skb_dst(skb)->dev);
         int evicted;
 
+        if (IP6CB(skb)->flags & IP6SKB_FRAGMENTED)
+                goto fail_hdr;
+
         IP6_INC_STATS_BH(net, ip6_dst_idev(skb_dst(skb)), IPSTATS_MIB_REASMREQDS);
 
         /* Jumbo payload inhibits frag. header */
@@ -544,6 +548,7 @@ static int ipv6_frag_rcv(struct sk_buff *skb)
                                  ip6_dst_idev(skb_dst(skb)), IPSTATS_MIB_REASMOKS);
 
                 IP6CB(skb)->nhoff = (u8 *)fhdr - skb_network_header(skb);
+                IP6CB(skb)->flags |= IP6SKB_FRAGMENTED;
                 return 1;
         }
 
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index ad0aa6b0b86a..c979dd96d82a 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -65,6 +65,12 @@
 #include <linux/sysctl.h>
 #endif
 
+enum rt6_nud_state {
+        RT6_NUD_FAIL_HARD = -2,
+        RT6_NUD_FAIL_SOFT = -1,
+        RT6_NUD_SUCCEED = 1
+};
+
 static struct rt6_info *ip6_rt_copy(struct rt6_info *ort,
                                     const struct in6_addr *dest);
 static struct dst_entry *ip6_dst_check(struct dst_entry *dst, u32 cookie);
@@ -83,6 +89,7 @@ static void		ip6_rt_update_pmtu(struct dst_entry *dst, struct sock *sk,
                                            struct sk_buff *skb, u32 mtu);
 static void             rt6_do_redirect(struct dst_entry *dst, struct sock *sk,
                                         struct sk_buff *skb);
+static int rt6_score_route(struct rt6_info *rt, int oif, int strict);
 
 #ifdef CONFIG_IPV6_ROUTE_INFO
 static struct rt6_info *rt6_add_route_info(struct net *net,
@@ -276,9 +283,8 @@ static inline struct rt6_info *ip6_dst_alloc(struct net *net,
 
                 memset(dst + 1, 0, sizeof(*rt) - sizeof(*dst));
                 rt6_init_peer(rt, table ? &table->tb6_peers : net->ipv6.peers);
-                rt->rt6i_genid = rt_genid(net);
+                rt->rt6i_genid = rt_genid_ipv6(net);
                 INIT_LIST_HEAD(&rt->rt6i_siblings);
-                rt->rt6i_nsiblings = 0;
         }
         return rt;
 }
@@ -394,7 +400,8 @@ static int rt6_info_hash_nhsfn(unsigned int candidate_count,
 }
 
 static struct rt6_info *rt6_multipath_select(struct rt6_info *match,
-                                             struct flowi6 *fl6)
+                                             struct flowi6 *fl6, int oif,
+                                             int strict)
 {
         struct rt6_info *sibling, *next_sibling;
         int route_choosen;
@@ -408,6 +415,8 @@ static struct rt6_info *rt6_multipath_select(struct rt6_info *match,
                                 &match->rt6i_siblings, rt6i_siblings) {
                         route_choosen--;
                         if (route_choosen == 0) {
+                                if (rt6_score_route(sibling, oif, strict) < 0)
+                                        break;
                                 match = sibling;
                                 break;
                         }
@@ -527,26 +536,29 @@ static inline int rt6_check_dev(struct rt6_info *rt, int oif)
         return 0;
 }
 
-static inline bool rt6_check_neigh(struct rt6_info *rt)
+static inline enum rt6_nud_state rt6_check_neigh(struct rt6_info *rt)
 {
         struct neighbour *neigh;
-        bool ret = false;
+        enum rt6_nud_state ret = RT6_NUD_FAIL_HARD;
 
         if (rt->rt6i_flags & RTF_NONEXTHOP ||
             !(rt->rt6i_flags & RTF_GATEWAY))
-                return true;
+                return RT6_NUD_SUCCEED;
 
         rcu_read_lock_bh();
         neigh = __ipv6_neigh_lookup_noref(rt->dst.dev, &rt->rt6i_gateway);
         if (neigh) {
                 read_lock(&neigh->lock);
                 if (neigh->nud_state & NUD_VALID)
-                        ret = true;
+                        ret = RT6_NUD_SUCCEED;
 #ifdef CONFIG_IPV6_ROUTER_PREF
                 else if (!(neigh->nud_state & NUD_FAILED))
-                        ret = true;
+                        ret = RT6_NUD_SUCCEED;
 #endif
                 read_unlock(&neigh->lock);
+        } else {
+                ret = IS_ENABLED(CONFIG_IPV6_ROUTER_PREF) ?
+                      RT6_NUD_SUCCEED : RT6_NUD_FAIL_SOFT;
         }
         rcu_read_unlock_bh();
 
@@ -560,43 +572,52 @@ static int rt6_score_route(struct rt6_info *rt, int oif,
 
         m = rt6_check_dev(rt, oif);
         if (!m && (strict & RT6_LOOKUP_F_IFACE))
-                return -1;
+                return RT6_NUD_FAIL_HARD;
 #ifdef CONFIG_IPV6_ROUTER_PREF
         m |= IPV6_DECODE_PREF(IPV6_EXTRACT_PREF(rt->rt6i_flags)) << 2;
 #endif
-        if (!rt6_check_neigh(rt) && (strict & RT6_LOOKUP_F_REACHABLE))
-                return -1;
+        if (strict & RT6_LOOKUP_F_REACHABLE) {
+                int n = rt6_check_neigh(rt);
+                if (n < 0)
+                        return n;
+        }
         return m;
 }
 
 static struct rt6_info *find_match(struct rt6_info *rt, int oif, int strict,
-                                   int *mpri, struct rt6_info *match)
+                                   int *mpri, struct rt6_info *match,
+                                   bool *do_rr)
 {
         int m;
+        bool match_do_rr = false;
 
         if (rt6_check_expired(rt))
                 goto out;
 
         m = rt6_score_route(rt, oif, strict);
-        if (m < 0)
+        if (m == RT6_NUD_FAIL_SOFT && !IS_ENABLED(CONFIG_IPV6_ROUTER_PREF)) {
+                match_do_rr = true;
+                m = 0; /* lowest valid score */
+        } else if (m < 0) {
                 goto out;
+        }
+
+        if (strict & RT6_LOOKUP_F_REACHABLE)
+                rt6_probe(rt);
 
         if (m > *mpri) {
-                if (strict & RT6_LOOKUP_F_REACHABLE)
-                        rt6_probe(match);
+                *do_rr = match_do_rr;
                 *mpri = m;
                 match = rt;
-        } else if (strict & RT6_LOOKUP_F_REACHABLE) {
-                rt6_probe(rt);
         }
-
 out:
         return match;
 }
 
 static struct rt6_info *find_rr_leaf(struct fib6_node *fn,
                                      struct rt6_info *rr_head,
-                                     u32 metric, int oif, int strict)
+                                     u32 metric, int oif, int strict,
+                                     bool *do_rr)
 {
         struct rt6_info *rt, *match;
         int mpri = -1;
@@ -604,10 +625,10 @@ static struct rt6_info *find_rr_leaf(struct fib6_node *fn,
         match = NULL;
         for (rt = rr_head; rt && rt->rt6i_metric == metric;
              rt = rt->dst.rt6_next)
-                match = find_match(rt, oif, strict, &mpri, match);
+                match = find_match(rt, oif, strict, &mpri, match, do_rr);
         for (rt = fn->leaf; rt && rt != rr_head && rt->rt6i_metric == metric;
              rt = rt->dst.rt6_next)
-                match = find_match(rt, oif, strict, &mpri, match);
+                match = find_match(rt, oif, strict, &mpri, match, do_rr);
 
         return match;
 }
@@ -616,15 +637,16 @@ static struct rt6_info *rt6_select(struct fib6_node *fn, int oif, int strict)
 {
         struct rt6_info *match, *rt0;
         struct net *net;
+        bool do_rr = false;
 
         rt0 = fn->rr_ptr;
         if (!rt0)
                 fn->rr_ptr = rt0 = fn->leaf;
 
-        match = find_rr_leaf(fn, rt0, rt0->rt6i_metric, oif, strict);
+        match = find_rr_leaf(fn, rt0, rt0->rt6i_metric, oif, strict,
+                             &do_rr);
 
-        if (!match &&
-            (strict & RT6_LOOKUP_F_REACHABLE)) {
+        if (do_rr) {
                 struct rt6_info *next = rt0->dst.rt6_next;
 
                 /* no entries matched; do round-robin */
@@ -743,7 +765,7 @@ restart:
         rt = fn->leaf;
         rt = rt6_device_match(net, rt, &fl6->saddr, fl6->flowi6_oif, flags);
         if (rt->rt6i_nsiblings && fl6->flowi6_oif == 0)
-                rt = rt6_multipath_select(rt, fl6);
+                rt = rt6_multipath_select(rt, fl6, fl6->flowi6_oif, flags);
         BACKTRACK(net, &fl6->saddr);
 out:
         dst_use(&rt->dst, jiffies);
@@ -875,8 +897,8 @@ restart_2:
 
 restart:
         rt = rt6_select(fn, oif, strict | reachable);
-        if (rt->rt6i_nsiblings && oif == 0)
-                rt = rt6_multipath_select(rt, fl6);
+        if (rt->rt6i_nsiblings)
+                rt = rt6_multipath_select(rt, fl6, oif, strict | reachable);
         BACKTRACK(net, &fl6->saddr);
         if (rt == net->ipv6.ip6_null_entry ||
             rt->rt6i_flags & RTF_CACHE)
@@ -1039,7 +1061,7 @@ static struct dst_entry *ip6_dst_check(struct dst_entry *dst, u32 cookie)
          * DST_OBSOLETE_FORCE_CHK which forces validation calls down
          * into this function always.
          */
-        if (rt->rt6i_genid != rt_genid(dev_net(rt->dst.dev)))
+        if (rt->rt6i_genid != rt_genid_ipv6(dev_net(rt->dst.dev)))
                 return NULL;
 
         if (rt->rt6i_node && (rt->rt6i_node->fn_sernum == cookie))
@@ -1074,10 +1096,13 @@ static void ip6_link_failure(struct sk_buff *skb)
 
         rt = (struct rt6_info *) skb_dst(skb);
         if (rt) {
-                if (rt->rt6i_flags & RTF_CACHE)
-                        rt6_update_expires(rt, 0);
-                else if (rt->rt6i_node && (rt->rt6i_flags & RTF_DEFAULT))
+                if (rt->rt6i_flags & RTF_CACHE) {
+                        dst_hold(&rt->dst);
+                        if (ip6_del_rt(rt))
+                                dst_free(&rt->dst);
+                } else if (rt->rt6i_node && (rt->rt6i_flags & RTF_DEFAULT)) {
                         rt->rt6i_node->fn_sernum = -1;
+                }
         }
 }
 
@@ -1131,6 +1156,77 @@ void ip6_sk_update_pmtu(struct sk_buff *skb, struct sock *sk, __be32 mtu)
 }
 EXPORT_SYMBOL_GPL(ip6_sk_update_pmtu);
 
+/* Handle redirects */
+struct ip6rd_flowi {
+        struct flowi6 fl6;
+        struct in6_addr gateway;
+};
+
+static struct rt6_info *__ip6_route_redirect(struct net *net,
+                                             struct fib6_table *table,
+                                             struct flowi6 *fl6,
+                                             int flags)
+{
+        struct ip6rd_flowi *rdfl = (struct ip6rd_flowi *)fl6;
+        struct rt6_info *rt;
+        struct fib6_node *fn;
+
+        /* Get the "current" route for this destination and
+         * check if the redirect has come from approriate router.
+         *
+         * RFC 4861 specifies that redirects should only be
+         * accepted if they come from the nexthop to the target.
+         * Due to the way the routes are chosen, this notion
+         * is a bit fuzzy and one might need to check all possible
+         * routes.
+         */
+
+        read_lock_bh(&table->tb6_lock);
+        fn = fib6_lookup(&table->tb6_root, &fl6->daddr, &fl6->saddr);
+restart:
+        for (rt = fn->leaf; rt; rt = rt->dst.rt6_next) {
+                if (rt6_check_expired(rt))
+                        continue;
+                if (rt->dst.error)
+                        break;
+                if (!(rt->rt6i_flags & RTF_GATEWAY))
+                        continue;
+                if (fl6->flowi6_oif != rt->dst.dev->ifindex)
+                        continue;
+                if (!ipv6_addr_equal(&rdfl->gateway, &rt->rt6i_gateway))
+                        continue;
+                break;
+        }
+
+        if (!rt)
+                rt = net->ipv6.ip6_null_entry;
+        else if (rt->dst.error) {
+                rt = net->ipv6.ip6_null_entry;
+                goto out;
+        }
+        BACKTRACK(net, &fl6->saddr);
+out:
+        dst_hold(&rt->dst);
+
+        read_unlock_bh(&table->tb6_lock);
+
+        return rt;
+};
+
+static struct dst_entry *ip6_route_redirect(struct net *net,
+                                        const struct flowi6 *fl6,
+                                        const struct in6_addr *gateway)
+{
+        int flags = RT6_LOOKUP_F_HAS_SADDR;
+        struct ip6rd_flowi rdfl;
+
+        rdfl.fl6 = *fl6;
+        rdfl.gateway = *gateway;
+
+        return fib6_rule_lookup(net, &rdfl.fl6,
+                                flags, __ip6_route_redirect);
+}
+
 void ip6_redirect(struct sk_buff *skb, struct net *net, int oif, u32 mark)
 {
         const struct ipv6hdr *iph = (struct ipv6hdr *) skb->data;
@@ -1145,13 +1241,32 @@ void ip6_redirect(struct sk_buff *skb, struct net *net, int oif, u32 mark)
         fl6.saddr = iph->saddr;
         fl6.flowlabel = ip6_flowinfo(iph);
 
-        dst = ip6_route_output(net, NULL, &fl6);
-        if (!dst->error)
-                rt6_do_redirect(dst, NULL, skb);
+        dst = ip6_route_redirect(net, &fl6, &ipv6_hdr(skb)->saddr);
+        rt6_do_redirect(dst, NULL, skb);
         dst_release(dst);
 }
 EXPORT_SYMBOL_GPL(ip6_redirect);
 
+void ip6_redirect_no_header(struct sk_buff *skb, struct net *net, int oif,
+                            u32 mark)
+{
+        const struct ipv6hdr *iph = ipv6_hdr(skb);
+        const struct rd_msg *msg = (struct rd_msg *)icmp6_hdr(skb);
+        struct dst_entry *dst;
+        struct flowi6 fl6;
+
+        memset(&fl6, 0, sizeof(fl6));
+        fl6.flowi6_oif = oif;
+        fl6.flowi6_mark = mark;
+        fl6.flowi6_flags = 0;
+        fl6.daddr = msg->dest;
+        fl6.saddr = iph->daddr;
+
+        dst = ip6_route_redirect(net, &fl6, &iph->saddr);
+        rt6_do_redirect(dst, NULL, skb);
+        dst_release(dst);
+}
+
 void ip6_sk_redirect(struct sk_buff *skb, struct sock *sk)
 {
         ip6_redirect(skb, sock_net(sk), sk->sk_bound_dev_if, sk->sk_mark);
@@ -1285,7 +1400,6 @@ static void icmp6_clean_all(int (*func)(struct rt6_info *rt, void *arg),
 
 static int ip6_dst_gc(struct dst_ops *ops)
 {
-        unsigned long now = jiffies;
         struct net *net = container_of(ops, struct net, ipv6.ip6_dst_ops);
         int rt_min_interval = net->ipv6.sysctl.ip6_rt_gc_min_interval;
         int rt_max_size = net->ipv6.sysctl.ip6_rt_max_size;
@@ -1295,13 +1409,12 @@ static int ip6_dst_gc(struct dst_ops *ops)
         int entries;
 
         entries = dst_entries_get_fast(ops);
-        if (time_after(rt_last_gc + rt_min_interval, now) &&
+        if (time_after(rt_last_gc + rt_min_interval, jiffies) &&
             entries <= rt_max_size)
                 goto out;
 
         net->ipv6.ip6_rt_gc_expire++;
-        fib6_run_gc(net->ipv6.ip6_rt_gc_expire, net);
-        net->ipv6.ip6_rt_last_gc = now;
+        fib6_run_gc(net->ipv6.ip6_rt_gc_expire, net, entries > rt_max_size);
         entries = dst_entries_get_slow(ops);
         if (entries < ops->gc_thresh)
                 net->ipv6.ip6_rt_gc_expire = rt_gc_timeout>>1;
@@ -1310,25 +1423,6 @@ out:
         return entries > rt_max_size;
 }
 
-int ip6_dst_hoplimit(struct dst_entry *dst)
-{
-        int hoplimit = dst_metric_raw(dst, RTAX_HOPLIMIT);
-        if (hoplimit == 0) {
-                struct net_device *dev = dst->dev;
-                struct inet6_dev *idev;
-
-                rcu_read_lock();
-                idev = __in6_dev_get(dev);
-                if (idev)
-                        hoplimit = idev->cnf.hop_limit;
-                else
-                        hoplimit = dev_net(dev)->ipv6.devconf_all->hop_limit;
-                rcu_read_unlock();
-        }
-        return hoplimit;
-}
-EXPORT_SYMBOL(ip6_dst_hoplimit);
-
 /*
  *
  */
@@ -1649,7 +1743,7 @@ static void rt6_do_redirect(struct dst_entry *dst, struct sock *sk, struct sk_bu
         int optlen, on_link;
         u8 *lladdr;
 
-        optlen = skb->tail - skb->transport_header;
+        optlen = skb_tail_pointer(skb) - skb_transport_header(skb);
         optlen -= sizeof(*msg);
 
         if (optlen < 0) {
@@ -2681,9 +2775,9 @@ errout:
 }
 
 static int ip6_route_dev_notify(struct notifier_block *this,
-                                unsigned long event, void *data)
+                                unsigned long event, void *ptr)
 {
-        struct net_device *dev = (struct net_device *)data;
+        struct net_device *dev = netdev_notifier_info_to_dev(ptr);
         struct net *net = dev_net(dev);
 
         if (event == NETDEV_REGISTER && (dev->flags & IFF_LOOPBACK)) {
@@ -2790,7 +2884,7 @@ static const struct file_operations rt6_stats_seq_fops = {
 #ifdef CONFIG_SYSCTL
 
 static
-int ipv6_sysctl_rtcache_flush(ctl_table *ctl, int write,
+int ipv6_sysctl_rtcache_flush(struct ctl_table *ctl, int write,
                               void __user *buffer, size_t *lenp, loff_t *ppos)
 {
         struct net *net;
@@ -2801,11 +2895,11 @@ int ipv6_sysctl_rtcache_flush(ctl_table *ctl, int write,
         net = (struct net *)ctl->extra1;
         delay = net->ipv6.sysctl.flush_delay;
         proc_dointvec(ctl, write, buffer, lenp, ppos);
-        fib6_run_gc(delay <= 0 ? ~0UL : (unsigned long)delay, net);
+        fib6_run_gc(delay <= 0 ? 0 : (unsigned long)delay, net, delay > 0);
         return 0;
 }
 
-ctl_table ipv6_route_table_template[] = {
+struct ctl_table ipv6_route_table_template[] = {
         {
                 .procname       =       "flush",
                 .data           =       &init_net.ipv6.sysctl.flush_delay,
diff --git a/net/ipv6/sit.c b/net/ipv6/sit.c
index 335363478bbf..19269453a8ea 100644
--- a/net/ipv6/sit.c
+++ b/net/ipv6/sit.c
@@ -466,14 +466,14 @@ isatap_chksrc(struct sk_buff *skb, const struct iphdr *iph, struct ip_tunnel *t)
 
 static void ipip6_tunnel_uninit(struct net_device *dev)
 {
-        struct net *net = dev_net(dev);
-        struct sit_net *sitn = net_generic(net, sit_net_id);
+        struct ip_tunnel *tunnel = netdev_priv(dev);
+        struct sit_net *sitn = net_generic(tunnel->net, sit_net_id);
 
         if (dev == sitn->fb_tunnel_dev) {
                 RCU_INIT_POINTER(sitn->tunnels_wc[0], NULL);
         } else {
-                ipip6_tunnel_unlink(sitn, netdev_priv(dev));
-                ipip6_tunnel_del_prl(netdev_priv(dev), NULL);
+                ipip6_tunnel_unlink(sitn, tunnel);
+                ipip6_tunnel_del_prl(tunnel, NULL);
         }
         dev_put(dev);
 }
@@ -566,6 +566,70 @@ static inline bool is_spoofed_6rd(struct ip_tunnel *tunnel, const __be32 v4addr,
         return false;
 }
 
+/* Checks if an address matches an address on the tunnel interface.
+ * Used to detect the NAT of proto 41 packets and let them pass spoofing test.
+ * Long story:
+ * This function is called after we considered the packet as spoofed
+ * in is_spoofed_6rd.
+ * We may have a router that is doing NAT for proto 41 packets
+ * for an internal station. Destination a.a.a.a/PREFIX:bbbb:bbbb
+ * will be translated to n.n.n.n/PREFIX:bbbb:bbbb. And is_spoofed_6rd
+ * function will return true, dropping the packet.
+ * But, we can still check if is spoofed against the IP
+ * addresses associated with the interface.
+ */
+static bool only_dnatted(const struct ip_tunnel *tunnel,
+        const struct in6_addr *v6dst)
+{
+        int prefix_len;
+
+#ifdef CONFIG_IPV6_SIT_6RD
+        prefix_len = tunnel->ip6rd.prefixlen + 32
+                - tunnel->ip6rd.relay_prefixlen;
+#else
+        prefix_len = 48;
+#endif
+        return ipv6_chk_custom_prefix(v6dst, prefix_len, tunnel->dev);
+}
+
+/* Returns true if a packet is spoofed */
+static bool packet_is_spoofed(struct sk_buff *skb,
+                              const struct iphdr *iph,
+                              struct ip_tunnel *tunnel)
+{
+        const struct ipv6hdr *ipv6h;
+
+        if (tunnel->dev->priv_flags & IFF_ISATAP) {
+                if (!isatap_chksrc(skb, iph, tunnel))
+                        return true;
+
+                return false;
+        }
+
+        if (tunnel->dev->flags & IFF_POINTOPOINT)
+                return false;
+
+        ipv6h = ipv6_hdr(skb);
+
+        if (unlikely(is_spoofed_6rd(tunnel, iph->saddr, &ipv6h->saddr))) {
+                net_warn_ratelimited("Src spoofed %pI4/%pI6c -> %pI4/%pI6c\n",
+                                     &iph->saddr, &ipv6h->saddr,
+                                     &iph->daddr, &ipv6h->daddr);
+                return true;
+        }
+
+        if (likely(!is_spoofed_6rd(tunnel, iph->daddr, &ipv6h->daddr)))
+                return false;
+
+        if (only_dnatted(tunnel, &ipv6h->daddr))
+                return false;
+
+        net_warn_ratelimited("Dst spoofed %pI4/%pI6c -> %pI4/%pI6c\n",
+                             &iph->saddr, &ipv6h->saddr,
+                             &iph->daddr, &ipv6h->daddr);
+        return true;
+}
+
 static int ipip6_rcv(struct sk_buff *skb)
 {
         const struct iphdr *iph = ip_hdr(skb);
@@ -577,29 +641,21 @@ static int ipip6_rcv(struct sk_buff *skb)
         if (tunnel != NULL) {
                 struct pcpu_tstats *tstats;
 
-                secpath_reset(skb);
+                if (tunnel->parms.iph.protocol != IPPROTO_IPV6 &&
+                    tunnel->parms.iph.protocol != 0)
+                        goto out;
+
                 skb->mac_header = skb->network_header;
                 skb_reset_network_header(skb);
                 IPCB(skb)->flags = 0;
                 skb->protocol = htons(ETH_P_IPV6);
-                skb->pkt_type = PACKET_HOST;
 
-                if (tunnel->dev->priv_flags & IFF_ISATAP) {
-                        if (!isatap_chksrc(skb, iph, tunnel)) {
-                                tunnel->dev->stats.rx_errors++;
-                                goto out;
-                        }
-                } else {
-                        if (is_spoofed_6rd(tunnel, iph->saddr,
-                                           &ipv6_hdr(skb)->saddr) ||
-                            is_spoofed_6rd(tunnel, iph->daddr,
-                                           &ipv6_hdr(skb)->daddr)) {
-                                tunnel->dev->stats.rx_errors++;
-                                goto out;
-                        }
+                if (packet_is_spoofed(skb, iph, tunnel)) {
+                        tunnel->dev->stats.rx_errors++;
+                        goto out;
                 }
 
-                __skb_tunnel_rx(skb, tunnel->dev);
+                __skb_tunnel_rx(skb, tunnel->dev, tunnel->net);
 
                 err = IP_ECN_decapsulate(iph, skb);
                 if (unlikely(err)) {
@@ -629,6 +685,38 @@ out:
         return 0;
 }
 
+static const struct tnl_ptk_info tpi = {
+        /* no tunnel info required for ipip. */
+        .proto = htons(ETH_P_IP),
+};
+
+static int ipip_rcv(struct sk_buff *skb)
+{
+        const struct iphdr *iph;
+        struct ip_tunnel *tunnel;
+
+        iph = ip_hdr(skb);
+        tunnel = ipip6_tunnel_lookup(dev_net(skb->dev), skb->dev,
+                                     iph->saddr, iph->daddr);
+        if (tunnel != NULL) {
+                if (tunnel->parms.iph.protocol != IPPROTO_IPIP &&
+                    tunnel->parms.iph.protocol != 0)
+                        goto drop;
+
+                if (!xfrm4_policy_check(NULL, XFRM_POLICY_IN, skb))
+                        goto drop;
+                if (iptunnel_pull_header(skb, 0, tpi.proto))
+                        goto drop;
+                return ip_tunnel_rcv(tunnel, skb, &tpi, log_ecn_error);
+        }
+
+        return 1;
+
+drop:
+        kfree_skb(skb);
+        return 0;
+}
+
 /*
  * If the IPv6 address comes from 6rd / 6to4 (RFC 3056) addr space this function
  * stores the embedded IPv4 address in v4dst and returns true.
@@ -690,13 +778,14 @@ static netdev_tx_t ipip6_tunnel_xmit(struct sk_buff *skb,
         __be16 df = tiph->frag_off;
         struct rtable *rt;                      /* Route to the other host */
         struct net_device *tdev;                /* Device to other host */
-        struct iphdr  *iph;                     /* Our new IP header */
         unsigned int max_headroom;              /* The extra header space needed */
         __be32 dst = tiph->daddr;
         struct flowi4 fl4;
         int    mtu;
         const struct in6_addr *addr6;
         int addr_type;
+        u8 ttl;
+        int err;
 
         if (skb->protocol != htons(ETH_P_IPV6))
                 goto tx_error;
@@ -713,7 +802,7 @@ static netdev_tx_t ipip6_tunnel_xmit(struct sk_buff *skb,
                         neigh = dst_neigh_lookup(skb_dst(skb), &iph6->daddr);
 
                 if (neigh == NULL) {
-                        net_dbg_ratelimited("sit: nexthop == NULL\n");
+                        net_dbg_ratelimited("nexthop == NULL\n");
                         goto tx_error;
                 }
 
@@ -742,7 +831,7 @@ static netdev_tx_t ipip6_tunnel_xmit(struct sk_buff *skb,
                         neigh = dst_neigh_lookup(skb_dst(skb), &iph6->daddr);
 
                 if (neigh == NULL) {
-                        net_dbg_ratelimited("sit: nexthop == NULL\n");
+                        net_dbg_ratelimited("nexthop == NULL\n");
                         goto tx_error;
                 }
 
@@ -764,7 +853,7 @@ static netdev_tx_t ipip6_tunnel_xmit(struct sk_buff *skb,
                         goto tx_error;
         }
 
-        rt = ip_route_output_ports(dev_net(dev), &fl4, NULL,
+        rt = ip_route_output_ports(tunnel->net, &fl4, NULL,
                                    dst, tiph->saddr,
                                    0, 0,
                                    IPPROTO_IPV6, RT_TOS(tos),
@@ -839,34 +928,19 @@ static netdev_tx_t ipip6_tunnel_xmit(struct sk_buff *skb,
                 skb = new_skb;
                 iph6 = ipv6_hdr(skb);
         }
+        ttl = tiph->ttl;
+        if (ttl == 0)
+                ttl = iph6->hop_limit;
+        tos = INET_ECN_encapsulate(tos, ipv6_get_dsfield(iph6));
+
+        if (likely(!skb->encapsulation)) {
+                skb_reset_inner_headers(skb);
+                skb->encapsulation = 1;
+        }
 
-        skb->transport_header = skb->network_header;
-        skb_push(skb, sizeof(struct iphdr));
-        skb_reset_network_header(skb);
-        memset(&(IPCB(skb)->opt), 0, sizeof(IPCB(skb)->opt));
-        IPCB(skb)->flags = 0;
-        skb_dst_drop(skb);
-        skb_dst_set(skb, &rt->dst);
-
-        /*
-         *      Push down and install the IPIP header.
-         */
-
-        iph                     =       ip_hdr(skb);
-        iph->version            =       4;
-        iph->ihl                =       sizeof(struct iphdr)>>2;
-        iph->frag_off           =       df;
-        iph->protocol           =       IPPROTO_IPV6;
-        iph->tos                =       INET_ECN_encapsulate(tos, ipv6_get_dsfield(iph6));
-        iph->daddr              =       fl4.daddr;
-        iph->saddr              =       fl4.saddr;
-
-        if ((iph->ttl = tiph->ttl) == 0)
-                iph->ttl        =       iph6->hop_limit;
-
-        skb->ip_summed = CHECKSUM_NONE;
-        ip_select_ident(iph, skb_dst(skb), NULL);
-        iptunnel_xmit(skb, dev);
+        err = iptunnel_xmit(rt, skb, fl4.saddr, fl4.daddr, IPPROTO_IPV6, tos,
+                            ttl, df, !net_eq(tunnel->net, dev_net(dev)));
+        iptunnel_xmit_stats(err, &dev->stats, dev->tstats);
         return NETDEV_TX_OK;
 
 tx_error_icmp:
@@ -877,6 +951,43 @@ tx_error:
         return NETDEV_TX_OK;
 }
 
+static netdev_tx_t ipip_tunnel_xmit(struct sk_buff *skb, struct net_device *dev)
+{
+        struct ip_tunnel *tunnel = netdev_priv(dev);
+        const struct iphdr  *tiph = &tunnel->parms.iph;
+
+        if (likely(!skb->encapsulation)) {
+                skb_reset_inner_headers(skb);
+                skb->encapsulation = 1;
+        }
+
+        ip_tunnel_xmit(skb, dev, tiph, IPPROTO_IPIP);
+        return NETDEV_TX_OK;
+}
+
+static netdev_tx_t sit_tunnel_xmit(struct sk_buff *skb,
+                                   struct net_device *dev)
+{
+        switch (skb->protocol) {
+        case htons(ETH_P_IP):
+                ipip_tunnel_xmit(skb, dev);
+                break;
+        case htons(ETH_P_IPV6):
+                ipip6_tunnel_xmit(skb, dev);
+                break;
+        default:
+                goto tx_err;
+        }
+
+        return NETDEV_TX_OK;
+
+tx_err:
+        dev->stats.tx_errors++;
+        dev_kfree_skb(skb);
+        return NETDEV_TX_OK;
+
+}
+
 static void ipip6_tunnel_bind_dev(struct net_device *dev)
 {
         struct net_device *tdev = NULL;
@@ -888,7 +999,8 @@ static void ipip6_tunnel_bind_dev(struct net_device *dev)
         iph = &tunnel->parms.iph;
 
         if (iph->daddr) {
-                struct rtable *rt = ip_route_output_ports(dev_net(dev), &fl4, NULL,
+                struct rtable *rt = ip_route_output_ports(tunnel->net, &fl4,
+                                                          NULL,
                                                           iph->daddr, iph->saddr,
                                                           0, 0,
                                                           IPPROTO_IPV6,
@@ -903,7 +1015,7 @@ static void ipip6_tunnel_bind_dev(struct net_device *dev)
         }
 
         if (!tdev && tunnel->parms.link)
-                tdev = __dev_get_by_index(dev_net(dev), tunnel->parms.link);
+                tdev = __dev_get_by_index(tunnel->net, tunnel->parms.link);
 
         if (tdev) {
                 dev->hard_header_len = tdev->hard_header_len + sizeof(struct iphdr);
@@ -916,7 +1028,7 @@ static void ipip6_tunnel_bind_dev(struct net_device *dev)
 
 static void ipip6_tunnel_update(struct ip_tunnel *t, struct ip_tunnel_parm *p)
 {
-        struct net *net = dev_net(t->dev);
+        struct net *net = t->net;
         struct sit_net *sitn = net_generic(net, sit_net_id);
 
         ipip6_tunnel_unlink(sitn, t);
@@ -1027,7 +1139,11 @@ ipip6_tunnel_ioctl (struct net_device *dev, struct ifreq *ifr, int cmd)
                         goto done;
 
                 err = -EINVAL;
-                if (p.iph.version != 4 || p.iph.protocol != IPPROTO_IPV6 ||
+                if (p.iph.protocol != IPPROTO_IPV6 &&
+                    p.iph.protocol != IPPROTO_IPIP &&
+                    p.iph.protocol != 0)
+                        goto done;
+                if (p.iph.version != 4 ||
                     p.iph.ihl != 5 || (p.iph.frag_off&htons(~IP_DF)))
                         goto done;
                 if (p.iph.ttl)
@@ -1164,7 +1280,7 @@ static int ipip6_tunnel_change_mtu(struct net_device *dev, int new_mtu)
 
 static const struct net_device_ops ipip6_netdev_ops = {
         .ndo_uninit     = ipip6_tunnel_uninit,
-        .ndo_start_xmit = ipip6_tunnel_xmit,
+        .ndo_start_xmit = sit_tunnel_xmit,
         .ndo_do_ioctl   = ipip6_tunnel_ioctl,
         .ndo_change_mtu = ipip6_tunnel_change_mtu,
         .ndo_get_stats64 = ip_tunnel_get_stats64,
@@ -1188,7 +1304,6 @@ static void ipip6_tunnel_setup(struct net_device *dev)
         dev->priv_flags        &= ~IFF_XMIT_DST_RELEASE;
         dev->iflink             = 0;
         dev->addr_len           = 4;
-        dev->features           |= NETIF_F_NETNS_LOCAL;
         dev->features           |= NETIF_F_LLTX;
 }
 
@@ -1197,6 +1312,7 @@ static int ipip6_tunnel_init(struct net_device *dev)
         struct ip_tunnel *tunnel = netdev_priv(dev);
 
         tunnel->dev = dev;
+        tunnel->net = dev_net(dev);
 
         memcpy(dev->dev_addr, &tunnel->parms.iph.saddr, 4);
         memcpy(dev->broadcast, &tunnel->parms.iph.daddr, 4);
@@ -1217,6 +1333,7 @@ static int __net_init ipip6_fb_tunnel_init(struct net_device *dev)
         struct sit_net *sitn = net_generic(net, sit_net_id);
 
         tunnel->dev = dev;
+        tunnel->net = dev_net(dev);
         strcpy(tunnel->parms.name, dev->name);
 
         iph->version            = 4;
@@ -1232,6 +1349,22 @@ static int __net_init ipip6_fb_tunnel_init(struct net_device *dev)
         return 0;
 }
 
+static int ipip6_validate(struct nlattr *tb[], struct nlattr *data[])
+{
+        u8 proto;
+
+        if (!data || !data[IFLA_IPTUN_PROTO])
+                return 0;
+
+        proto = nla_get_u8(data[IFLA_IPTUN_PROTO]);
+        if (proto != IPPROTO_IPV6 &&
+            proto != IPPROTO_IPIP &&
+            proto != 0)
+                return -EINVAL;
+
+        return 0;
+}
+
 static void ipip6_netlink_parms(struct nlattr *data[],
                                 struct ip_tunnel_parm *parms)
 {
@@ -1268,6 +1401,10 @@ static void ipip6_netlink_parms(struct nlattr *data[],
 
         if (data[IFLA_IPTUN_FLAGS])
                 parms->i_flags = nla_get_be16(data[IFLA_IPTUN_FLAGS]);
+
+        if (data[IFLA_IPTUN_PROTO])
+                parms->iph.protocol = nla_get_u8(data[IFLA_IPTUN_PROTO]);
+
 }
 
 #ifdef CONFIG_IPV6_SIT_6RD
@@ -1339,9 +1476,9 @@ static int ipip6_newlink(struct net *src_net, struct net_device *dev,
 static int ipip6_changelink(struct net_device *dev, struct nlattr *tb[],
                           struct nlattr *data[])
 {
-        struct ip_tunnel *t;
+        struct ip_tunnel *t = netdev_priv(dev);
         struct ip_tunnel_parm p;
-        struct net *net = dev_net(dev);
+        struct net *net = t->net;
         struct sit_net *sitn = net_generic(net, sit_net_id);
 #ifdef CONFIG_IPV6_SIT_6RD
         struct ip_tunnel_6rd ip6rd;
@@ -1391,6 +1528,8 @@ static size_t ipip6_get_size(const struct net_device *dev)
                 nla_total_size(1) +
                 /* IFLA_IPTUN_FLAGS */
                 nla_total_size(2) +
+                /* IFLA_IPTUN_PROTO */
+                nla_total_size(1) +
 #ifdef CONFIG_IPV6_SIT_6RD
                 /* IFLA_IPTUN_6RD_PREFIX */
                 nla_total_size(sizeof(struct in6_addr)) +
@@ -1416,6 +1555,7 @@ static int ipip6_fill_info(struct sk_buff *skb, const struct net_device *dev)
             nla_put_u8(skb, IFLA_IPTUN_TOS, parm->iph.tos) ||
             nla_put_u8(skb, IFLA_IPTUN_PMTUDISC,
                        !!(parm->iph.frag_off & htons(IP_DF))) ||
+            nla_put_u8(skb, IFLA_IPTUN_PROTO, parm->iph.protocol) ||
             nla_put_be16(skb, IFLA_IPTUN_FLAGS, parm->i_flags))
                 goto nla_put_failure;
 
@@ -1445,6 +1585,7 @@ static const struct nla_policy ipip6_policy[IFLA_IPTUN_MAX + 1] = {
         [IFLA_IPTUN_TOS]                = { .type = NLA_U8 },
         [IFLA_IPTUN_PMTUDISC]           = { .type = NLA_U8 },
         [IFLA_IPTUN_FLAGS]              = { .type = NLA_U16 },
+        [IFLA_IPTUN_PROTO]              = { .type = NLA_U8 },
 #ifdef CONFIG_IPV6_SIT_6RD
         [IFLA_IPTUN_6RD_PREFIX]         = { .len = sizeof(struct in6_addr) },
         [IFLA_IPTUN_6RD_RELAY_PREFIX]   = { .type = NLA_U32 },
@@ -1459,6 +1600,7 @@ static struct rtnl_link_ops sit_link_ops __read_mostly = {
         .policy         = ipip6_policy,
         .priv_size      = sizeof(struct ip_tunnel),
         .setup          = ipip6_tunnel_setup,
+        .validate       = ipip6_validate,
         .newlink        = ipip6_newlink,
         .changelink     = ipip6_changelink,
         .get_size       = ipip6_get_size,
@@ -1471,10 +1613,22 @@ static struct xfrm_tunnel sit_handler __read_mostly = {
         .priority       =       1,
 };
 
+static struct xfrm_tunnel ipip_handler __read_mostly = {
+        .handler        =       ipip_rcv,
+        .err_handler    =       ipip6_err,
+        .priority       =       2,
+};
+
 static void __net_exit sit_destroy_tunnels(struct sit_net *sitn, struct list_head *head)
 {
+        struct net *net = dev_net(sitn->fb_tunnel_dev);
+        struct net_device *dev, *aux;
         int prio;
 
+        for_each_netdev_safe(net, dev, aux)
+                if (dev->rtnl_link_ops == &sit_link_ops)
+                        unregister_netdevice_queue(dev, head);
+
         for (prio = 1; prio < 4; prio++) {
                 int h;
                 for (h = 0; h < HASH_SIZE; h++) {
@@ -1482,7 +1636,12 @@ static void __net_exit sit_destroy_tunnels(struct sit_net *sitn, struct list_hea
 
                         t = rtnl_dereference(sitn->tunnels[prio][h]);
                         while (t != NULL) {
-                                unregister_netdevice_queue(t->dev, head);
+                                /* If dev is in the same netns, it has already
+                                 * been added to the list by the previous loop.
+                                 */
+                                if (!net_eq(dev_net(t->dev), net))
+                                        unregister_netdevice_queue(t->dev,
+                                                                   head);
                                 t = rtnl_dereference(t->next);
                         }
                 }
@@ -1507,6 +1666,11 @@ static int __net_init sit_init_net(struct net *net)
                 goto err_alloc_dev;
         }
         dev_net_set(sitn->fb_tunnel_dev, net);
+        sitn->fb_tunnel_dev->rtnl_link_ops = &sit_link_ops;
+        /* FB netdevice is special: we have one, and only one per netns.
+         * Allowing to move it to another netns is clearly unsafe.
+         */
+        sitn->fb_tunnel_dev->features |= NETIF_F_NETNS_LOCAL;
 
         err = ipip6_fb_tunnel_init(sitn->fb_tunnel_dev);
         if (err)
@@ -1537,7 +1701,6 @@ static void __net_exit sit_exit_net(struct net *net)
 
         rtnl_lock();
         sit_destroy_tunnels(sitn, &list);
-        unregister_netdevice_queue(sitn->fb_tunnel_dev, &list);
         unregister_netdevice_many(&list);
         rtnl_unlock();
 }
@@ -1553,6 +1716,7 @@ static void __exit sit_cleanup(void)
 {
         rtnl_link_unregister(&sit_link_ops);
         xfrm4_tunnel_deregister(&sit_handler, AF_INET6);
+        xfrm4_tunnel_deregister(&ipip_handler, AF_INET);
 
         unregister_pernet_device(&sit_net_ops);
         rcu_barrier(); /* Wait for completion of call_rcu()'s */
@@ -1569,9 +1733,14 @@ static int __init sit_init(void)
                 return err;
         err = xfrm4_tunnel_register(&sit_handler, AF_INET6);
         if (err < 0) {
-                pr_info("%s: can't add protocol\n", __func__);
+                pr_info("%s: can't register ip6ip4\n", __func__);
                 goto xfrm_tunnel_failed;
         }
+        err = xfrm4_tunnel_register(&ipip_handler, AF_INET);
+        if (err < 0) {
+                pr_info("%s: can't register ip4ip4\n", __func__);
+                goto xfrm_tunnel4_failed;
+        }
         err = rtnl_link_register(&sit_link_ops);
         if (err < 0)
                 goto rtnl_link_failed;
@@ -1580,6 +1749,8 @@ out:
         return err;
 
 rtnl_link_failed:
+        xfrm4_tunnel_deregister(&ipip_handler, AF_INET);
+xfrm_tunnel4_failed:
         xfrm4_tunnel_deregister(&sit_handler, AF_INET6);
 xfrm_tunnel_failed:
         unregister_pernet_device(&sit_net_ops);
diff --git a/net/ipv6/syncookies.c b/net/ipv6/syncookies.c
index d5dda20bd717..bf63ac8a49b9 100644
--- a/net/ipv6/syncookies.c
+++ b/net/ipv6/syncookies.c
@@ -112,32 +112,38 @@ static __u32 check_tcp_syn_cookie(__u32 cookie, const struct in6_addr *saddr,
                 & COOKIEMASK;
 }
 
-__u32 cookie_v6_init_sequence(struct sock *sk, const struct sk_buff *skb, __u16 *mssp)
+u32 __cookie_v6_init_sequence(const struct ipv6hdr *iph,
+                              const struct tcphdr *th, __u16 *mssp)
 {
-        const struct ipv6hdr *iph = ipv6_hdr(skb);
-        const struct tcphdr *th = tcp_hdr(skb);
         int mssind;
         const __u16 mss = *mssp;
 
-        tcp_synq_overflow(sk);
-
         for (mssind = ARRAY_SIZE(msstab) - 1; mssind ; mssind--)
                 if (mss >= msstab[mssind])
                         break;
 
         *mssp = msstab[mssind];
 
-        NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_SYNCOOKIESSENT);
-
         return secure_tcp_syn_cookie(&iph->saddr, &iph->daddr, th->source,
                                      th->dest, ntohl(th->seq),
                                      jiffies / (HZ * 60), mssind);
 }
+EXPORT_SYMBOL_GPL(__cookie_v6_init_sequence);
 
-static inline int cookie_check(const struct sk_buff *skb, __u32 cookie)
+__u32 cookie_v6_init_sequence(struct sock *sk, const struct sk_buff *skb, __u16 *mssp)
 {
         const struct ipv6hdr *iph = ipv6_hdr(skb);
         const struct tcphdr *th = tcp_hdr(skb);
+
+        tcp_synq_overflow(sk);
+        NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_SYNCOOKIESSENT);
+
+        return __cookie_v6_init_sequence(iph, th, mssp);
+}
+
+int __cookie_v6_check(const struct ipv6hdr *iph, const struct tcphdr *th,
+                      __u32 cookie)
+{
         __u32 seq = ntohl(th->seq) - 1;
         __u32 mssind = check_tcp_syn_cookie(cookie, &iph->saddr, &iph->daddr,
                                             th->source, th->dest, seq,
@@ -145,6 +151,7 @@ static inline int cookie_check(const struct sk_buff *skb, __u32 cookie)
 
         return mssind < ARRAY_SIZE(msstab) ? msstab[mssind] : 0;
 }
+EXPORT_SYMBOL_GPL(__cookie_v6_check);
 
 struct sock *cookie_v6_check(struct sock *sk, struct sk_buff *skb)
 {
@@ -167,7 +174,7 @@ struct sock *cookie_v6_check(struct sock *sk, struct sk_buff *skb)
                 goto out;
 
         if (tcp_synq_no_recent_overflow(sk) ||
-                (mss = cookie_check(skb, cookie)) == 0) {
+                (mss = __cookie_v6_check(ipv6_hdr(skb), th, cookie)) == 0) {
                 NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_SYNCOOKIESFAILED);
                 goto out;
         }
diff --git a/net/ipv6/sysctl_net_ipv6.c b/net/ipv6/sysctl_net_ipv6.c
index e85c48bd404f..107b2f1d90ae 100644
--- a/net/ipv6/sysctl_net_ipv6.c
+++ b/net/ipv6/sysctl_net_ipv6.c
@@ -16,7 +16,7 @@
 #include <net/addrconf.h>
 #include <net/inet_frag.h>
 
-static ctl_table ipv6_table_template[] = {
+static struct ctl_table ipv6_table_template[] = {
         {
                 .procname       = "bindv6only",
                 .data           = &init_net.ipv6.sysctl.bindv6only,
@@ -27,7 +27,7 @@ static ctl_table ipv6_table_template[] = {
         { }
 };
 
-static ctl_table ipv6_rotable[] = {
+static struct ctl_table ipv6_rotable[] = {
         {
                 .procname       = "mld_max_msf",
                 .data           = &sysctl_mld_max_msf,
diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
index 0a17ed9eaf39..5c71501fc917 100644
--- a/net/ipv6/tcp_ipv6.c
+++ b/net/ipv6/tcp_ipv6.c
@@ -63,6 +63,7 @@
 #include <net/inet_common.h>
 #include <net/secure_seq.h>
 #include <net/tcp_memcontrol.h>
+#include <net/busy_poll.h>
 
 #include <asm/uaccess.h>
 
@@ -962,7 +963,8 @@ static int tcp_v6_conn_request(struct sock *sk, struct sk_buff *skb)
         if (!ipv6_unicast_destination(skb))
                 goto drop;
 
-        if (inet_csk_reqsk_queue_is_full(sk) && !isn) {
+        if ((sysctl_tcp_syncookies == 2 ||
+             inet_csk_reqsk_queue_is_full(sk)) && !isn) {
                 want_cookie = tcp_syn_flood_action(sk, skb, "TCPv6");
                 if (!want_cookie)
                         goto drop;
@@ -1236,8 +1238,6 @@ static struct sock * tcp_v6_syn_recv_sock(struct sock *sk, struct sk_buff *skb,
                 newtp->advmss = tcp_sk(sk)->rx_opt.user_mss;
 
         tcp_initialize_rcv_mss(newsk);
-        tcp_synack_rtt_meas(newsk, req);
-        newtp->total_retrans = req->num_retrans;
 
         newinet->inet_daddr = newinet->inet_saddr = LOOPBACK4_IPV6;
         newinet->inet_rcv_saddr = LOOPBACK4_IPV6;
@@ -1360,8 +1360,7 @@ static int tcp_v6_do_rcv(struct sock *sk, struct sk_buff *skb)
                         }
                 }
 
-                if (tcp_rcv_established(sk, skb, tcp_hdr(skb), skb->len))
-                        goto reset;
+                tcp_rcv_established(sk, skb, tcp_hdr(skb), skb->len);
                 if (opt_skb)
                         goto ipv6_pktoptions;
                 return 0;
@@ -1426,7 +1425,7 @@ ipv6_pktoptions:
                 if (np->rxopt.bits.rxhlim || np->rxopt.bits.rxohlim)
                         np->mcast_hops = ipv6_hdr(opt_skb)->hop_limit;
                 if (np->rxopt.bits.rxtclass)
-                        np->rcv_tclass = ipv6_get_dsfield(ipv6_hdr(skb));
+                        np->rcv_tclass = ipv6_get_dsfield(ipv6_hdr(opt_skb));
                 if (ipv6_opt_accepted(sk, opt_skb)) {
                         skb_set_owner_r(opt_skb, sk);
                         opt_skb = xchg(&np->pktoptions, opt_skb);
@@ -1498,6 +1497,7 @@ process:
         if (sk_filter(sk, skb))
                 goto discard_and_relse;
 
+        sk_mark_napi_id(sk, skb);
         skb->dev = NULL;
 
         bh_lock_sock_nested(sk);
@@ -1730,7 +1730,7 @@ static void get_openreq6(struct seq_file *seq,
 
         seq_printf(seq,
                    "%4d: %08X%08X%08X%08X:%04X %08X%08X%08X%08X:%04X "
-                   "%02X %08X:%08X %02X:%08lX %08X %5d %8d %d %d %pK\n",
+                   "%02X %08X:%08X %02X:%08lX %08X %5u %8d %d %d %pK\n",
                    i,
                    src->s6_addr32[0], src->s6_addr32[1],
                    src->s6_addr32[2], src->s6_addr32[3],
@@ -1781,7 +1781,7 @@ static void get_tcp6_sock(struct seq_file *seq, struct sock *sp, int i)
 
         seq_printf(seq,
                    "%4d: %08X%08X%08X%08X:%04X %08X%08X%08X%08X:%04X "
-                   "%02X %08X:%08X %02X:%08lX %08X %5d %8d %lu %d %pK %lu %lu %u %u %d\n",
+                   "%02X %08X:%08X %02X:%08lX %08X %5u %8d %lu %d %pK %lu %lu %u %u %d\n",
                    i,
                    src->s6_addr32[0], src->s6_addr32[1],
                    src->s6_addr32[2], src->s6_addr32[3], srcp,
@@ -1924,6 +1924,7 @@ struct proto tcpv6_prot = {
         .unhash                 = inet_unhash,
         .get_port               = inet_csk_get_port,
         .enter_memory_pressure  = tcp_enter_memory_pressure,
+        .stream_memory_free     = tcp_stream_memory_free,
         .sockets_allocated      = &tcp_sockets_allocated,
         .memory_allocated       = &tcp_memory_allocated,
         .memory_pressure        = &tcp_memory_pressure,
diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
index 42923b14dfa6..72b7eaaf3ca0 100644
--- a/net/ipv6/udp.c
+++ b/net/ipv6/udp.c
@@ -46,6 +46,7 @@
 #include <net/ip6_checksum.h>
 #include <net/xfrm.h>
 #include <net/inet6_hashtables.h>
+#include <net/busy_poll.h>
 
 #include <linux/proc_fs.h>
 #include <linux/seq_file.h>
@@ -524,8 +525,10 @@ void __udp6_lib_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
 
         if (type == ICMPV6_PKT_TOOBIG)
                 ip6_sk_update_pmtu(skb, sk, info);
-        if (type == NDISC_REDIRECT)
+        if (type == NDISC_REDIRECT) {
                 ip6_sk_redirect(skb, sk);
+                goto out;
+        }
 
         np = inet6_sk(sk);
 
@@ -841,7 +844,10 @@ int __udp6_lib_rcv(struct sk_buff *skb, struct udp_table *udptable,
          */
         sk = __udp6_lib_lookup_skb(skb, uh->source, uh->dest, udptable);
         if (sk != NULL) {
-                int ret = udpv6_queue_rcv_skb(sk, skb);
+                int ret;
+
+                sk_mark_napi_id(sk, skb);
+                ret = udpv6_queue_rcv_skb(sk, skb);
                 sock_put(sk);
 
                 /* a return value > 0 means to resubmit the input, but
@@ -955,11 +961,16 @@ static int udp_v6_push_pending_frames(struct sock *sk)
         struct udphdr *uh;
         struct udp_sock  *up = udp_sk(sk);
         struct inet_sock *inet = inet_sk(sk);
-        struct flowi6 *fl6 = &inet->cork.fl.u.ip6;
+        struct flowi6 *fl6;
         int err = 0;
         int is_udplite = IS_UDPLITE(sk);
         __wsum csum = 0;
 
+        if (up->pending == AF_INET)
+                return udp_push_pending_frames(sk);
+
+        fl6 = &inet->cork.fl.u.ip6;
+
         /* Grab the skbuff where UDP header space exists. */
         if ((skb = skb_peek(&sk->sk_write_queue)) == NULL)
                 goto out;
@@ -1359,48 +1370,17 @@ static const struct inet6_protocol udpv6_protocol = {
 
 /* ------------------------------------------------------------------------ */
 #ifdef CONFIG_PROC_FS
-
-static void udp6_sock_seq_show(struct seq_file *seq, struct sock *sp, int bucket)
-{
-        struct inet_sock *inet = inet_sk(sp);
-        struct ipv6_pinfo *np = inet6_sk(sp);
-        const struct in6_addr *dest, *src;
-        __u16 destp, srcp;
-
-        dest  = &np->daddr;
-        src   = &np->rcv_saddr;
-        destp = ntohs(inet->inet_dport);
-        srcp  = ntohs(inet->inet_sport);
-        seq_printf(seq,
-                   "%5d: %08X%08X%08X%08X:%04X %08X%08X%08X%08X:%04X "
-                   "%02X %08X:%08X %02X:%08lX %08X %5d %8d %lu %d %pK %d\n",
-                   bucket,
-                   src->s6_addr32[0], src->s6_addr32[1],
-                   src->s6_addr32[2], src->s6_addr32[3], srcp,
-                   dest->s6_addr32[0], dest->s6_addr32[1],
-                   dest->s6_addr32[2], dest->s6_addr32[3], destp,
-                   sp->sk_state,
-                   sk_wmem_alloc_get(sp),
-                   sk_rmem_alloc_get(sp),
-                   0, 0L, 0,
-                   from_kuid_munged(seq_user_ns(seq), sock_i_uid(sp)),
-                   0,
-                   sock_i_ino(sp),
-                   atomic_read(&sp->sk_refcnt), sp,
-                   atomic_read(&sp->sk_drops));
-}
-
 int udp6_seq_show(struct seq_file *seq, void *v)
 {
-        if (v == SEQ_START_TOKEN)
-                seq_printf(seq,
-                           "  sl  "
-                           "local_address                         "
-                           "remote_address                        "
-                           "st tx_queue rx_queue tr tm->when retrnsmt"
-                           "   uid  timeout inode ref pointer drops\n");
-        else
-                udp6_sock_seq_show(seq, v, ((struct udp_iter_state *)seq->private)->bucket);
+        if (v == SEQ_START_TOKEN) {
+                seq_puts(seq, IPV6_SEQ_DGRAM_HEADER);
+        } else {
+                int bucket = ((struct udp_iter_state *)seq->private)->bucket;
+                struct inet_sock *inet = inet_sk(v);
+                __u16 srcp = ntohs(inet->inet_sport);
+                __u16 destp = ntohs(inet->inet_dport);
+                ip6_dgram_sock_seq_show(seq, v, srcp, destp, bucket);
+        }
         return 0;
 }
 
diff --git a/net/ipv6/udp_offload.c b/net/ipv6/udp_offload.c
index d3cfaf9c7a08..60559511bd9c 100644
--- a/net/ipv6/udp_offload.c
+++ b/net/ipv6/udp_offload.c
@@ -21,26 +21,25 @@ static int udp6_ufo_send_check(struct sk_buff *skb)
         const struct ipv6hdr *ipv6h;
         struct udphdr *uh;
 
-        /* UDP Tunnel offload on ipv6 is not yet supported. */
-        if (skb->encapsulation)
-                return -EINVAL;
-
         if (!pskb_may_pull(skb, sizeof(*uh)))
                 return -EINVAL;
 
-        ipv6h = ipv6_hdr(skb);
-        uh = udp_hdr(skb);
+        if (likely(!skb->encapsulation)) {
+                ipv6h = ipv6_hdr(skb);
+                uh = udp_hdr(skb);
+
+                uh->check = ~csum_ipv6_magic(&ipv6h->saddr, &ipv6h->daddr, skb->len,
+                                             IPPROTO_UDP, 0);
+                skb->csum_start = skb_transport_header(skb) - skb->head;
+                skb->csum_offset = offsetof(struct udphdr, check);
+                skb->ip_summed = CHECKSUM_PARTIAL;
+        }
 
-        uh->check = ~csum_ipv6_magic(&ipv6h->saddr, &ipv6h->daddr, skb->len,
-                                     IPPROTO_UDP, 0);
-        skb->csum_start = skb_transport_header(skb) - skb->head;
-        skb->csum_offset = offsetof(struct udphdr, check);
-        skb->ip_summed = CHECKSUM_PARTIAL;
         return 0;
 }
 
 static struct sk_buff *udp6_ufo_fragment(struct sk_buff *skb,
-        netdev_features_t features)
+                                         netdev_features_t features)
 {
         struct sk_buff *segs = ERR_PTR(-EINVAL);
         unsigned int mss;
@@ -64,7 +63,8 @@ static struct sk_buff *udp6_ufo_fragment(struct sk_buff *skb,
                 if (unlikely(type & ~(SKB_GSO_UDP |
                                       SKB_GSO_DODGY |
                                       SKB_GSO_UDP_TUNNEL |
-                                      SKB_GSO_GRE) ||
+                                      SKB_GSO_GRE |
+                                      SKB_GSO_MPLS) ||
                              !(type & (SKB_GSO_UDP))))
                         goto out;
 
@@ -74,47 +74,51 @@ static struct sk_buff *udp6_ufo_fragment(struct sk_buff *skb,
                 goto out;
         }
 
-        /* Do software UFO. Complete and fill in the UDP checksum as HW cannot
-         * do checksum of UDP packets sent as multiple IP fragments.
-         */
-        offset = skb_checksum_start_offset(skb);
-        csum = skb_checksum(skb, offset, skb->len - offset, 0);
-        offset += skb->csum_offset;
-        *(__sum16 *)(skb->data + offset) = csum_fold(csum);
-        skb->ip_summed = CHECKSUM_NONE;
-
-        /* Check if there is enough headroom to insert fragment header. */
-        tnl_hlen = skb_tnl_header_len(skb);
-        if (skb_headroom(skb) < (tnl_hlen + frag_hdr_sz)) {
-                if (gso_pskb_expand_head(skb, tnl_hlen + frag_hdr_sz))
-                        goto out;
+        if (skb->encapsulation && skb_shinfo(skb)->gso_type & SKB_GSO_UDP_TUNNEL)
+                segs = skb_udp_tunnel_segment(skb, features);
+        else {
+                /* Do software UFO. Complete and fill in the UDP checksum as HW cannot
+                 * do checksum of UDP packets sent as multiple IP fragments.
+                 */
+                offset = skb_checksum_start_offset(skb);
+                csum = skb_checksum(skb, offset, skb->len - offset, 0);
+                offset += skb->csum_offset;
+                *(__sum16 *)(skb->data + offset) = csum_fold(csum);
+                skb->ip_summed = CHECKSUM_NONE;
+
+                /* Check if there is enough headroom to insert fragment header. */
+                tnl_hlen = skb_tnl_header_len(skb);
+                if (skb_headroom(skb) < (tnl_hlen + frag_hdr_sz)) {
+                        if (gso_pskb_expand_head(skb, tnl_hlen + frag_hdr_sz))
+                                goto out;
+                }
+
+                /* Find the unfragmentable header and shift it left by frag_hdr_sz
+                 * bytes to insert fragment header.
+                 */
+                unfrag_ip6hlen = ip6_find_1stfragopt(skb, &prevhdr);
+                nexthdr = *prevhdr;
+                *prevhdr = NEXTHDR_FRAGMENT;
+                unfrag_len = (skb_network_header(skb) - skb_mac_header(skb)) +
+                             unfrag_ip6hlen + tnl_hlen;
+                packet_start = (u8 *) skb->head + SKB_GSO_CB(skb)->mac_offset;
+                memmove(packet_start-frag_hdr_sz, packet_start, unfrag_len);
+
+                SKB_GSO_CB(skb)->mac_offset -= frag_hdr_sz;
+                skb->mac_header -= frag_hdr_sz;
+                skb->network_header -= frag_hdr_sz;
+
+                fptr = (struct frag_hdr *)(skb_network_header(skb) + unfrag_ip6hlen);
+                fptr->nexthdr = nexthdr;
+                fptr->reserved = 0;
+                ipv6_select_ident(fptr, (struct rt6_info *)skb_dst(skb));
+
+                /* Fragment the skb. ipv6 header and the remaining fields of the
+                 * fragment header are updated in ipv6_gso_segment()
+                 */
+                segs = skb_segment(skb, features);
         }
 
-        /* Find the unfragmentable header and shift it left by frag_hdr_sz
-         * bytes to insert fragment header.
-         */
-        unfrag_ip6hlen = ip6_find_1stfragopt(skb, &prevhdr);
-        nexthdr = *prevhdr;
-        *prevhdr = NEXTHDR_FRAGMENT;
-        unfrag_len = (skb_network_header(skb) - skb_mac_header(skb)) +
-                     unfrag_ip6hlen + tnl_hlen;
-        packet_start = (u8 *) skb->head + SKB_GSO_CB(skb)->mac_offset;
-        memmove(packet_start-frag_hdr_sz, packet_start, unfrag_len);
-
-        SKB_GSO_CB(skb)->mac_offset -= frag_hdr_sz;
-        skb->mac_header -= frag_hdr_sz;
-        skb->network_header -= frag_hdr_sz;
-
-        fptr = (struct frag_hdr *)(skb_network_header(skb) + unfrag_ip6hlen);
-        fptr->nexthdr = nexthdr;
-        fptr->reserved = 0;
-        ipv6_select_ident(fptr, (struct rt6_info *)skb_dst(skb));
-
-        /* Fragment the skb. ipv6 header and the remaining fields of the
-         * fragment header are updated in ipv6_gso_segment()
-         */
-        segs = skb_segment(skb, features);
-
 out:
         return segs;
 }
diff --git a/net/ipv6/xfrm6_output.c b/net/ipv6/xfrm6_output.c
index 8755a3079d0f..6cd625e37706 100644
--- a/net/ipv6/xfrm6_output.c
+++ b/net/ipv6/xfrm6_output.c
@@ -34,8 +34,10 @@ static int xfrm6_local_dontfrag(struct sk_buff *skb)
         struct sock *sk = skb->sk;
 
         if (sk) {
-                proto = sk->sk_protocol;
+                if (sk->sk_family != AF_INET6)
+                        return 0;
 
+                proto = sk->sk_protocol;
                 if (proto == IPPROTO_UDP || proto == IPPROTO_RAW)
                         return inet6_sk(sk)->dontfrag;
         }
@@ -54,13 +56,15 @@ static void xfrm6_local_rxpmtu(struct sk_buff *skb, u32 mtu)
         ipv6_local_rxpmtu(sk, &fl6, mtu);
 }
 
-static void xfrm6_local_error(struct sk_buff *skb, u32 mtu)
+void xfrm6_local_error(struct sk_buff *skb, u32 mtu)
 {
         struct flowi6 fl6;
+        const struct ipv6hdr *hdr;
         struct sock *sk = skb->sk;
 
+        hdr = skb->encapsulation ? inner_ipv6_hdr(skb) : ipv6_hdr(skb);
         fl6.fl6_dport = inet_sk(sk)->inet_dport;
-        fl6.daddr = ipv6_hdr(skb)->daddr;
+        fl6.daddr = hdr->daddr;
 
         ipv6_local_error(sk, EMSGSIZE, &fl6, mtu);
 }
@@ -80,7 +84,7 @@ static int xfrm6_tunnel_check_size(struct sk_buff *skb)
                 if (xfrm6_local_dontfrag(skb))
                         xfrm6_local_rxpmtu(skb, mtu);
                 else if (skb->sk)
-                        xfrm6_local_error(skb, mtu);
+                        xfrm_local_error(skb, mtu);
                 else
                         icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu);
                 ret = -EMSGSIZE;
@@ -136,13 +140,18 @@ static int __xfrm6_output(struct sk_buff *skb)
 {
         struct dst_entry *dst = skb_dst(skb);
         struct xfrm_state *x = dst->xfrm;
-        int mtu = ip6_skb_dst_mtu(skb);
+        int mtu;
+
+        if (skb->protocol == htons(ETH_P_IPV6))
+                mtu = ip6_skb_dst_mtu(skb);
+        else
+                mtu = dst_mtu(skb_dst(skb));
 
         if (skb->len > mtu && xfrm6_local_dontfrag(skb)) {
                 xfrm6_local_rxpmtu(skb, mtu);
                 return -EMSGSIZE;
         } else if (!skb->local_df && skb->len > mtu && skb->sk) {
-                xfrm6_local_error(skb, mtu);
+                xfrm_local_error(skb, mtu);
                 return -EMSGSIZE;
         }
 
diff --git a/net/ipv6/xfrm6_state.c b/net/ipv6/xfrm6_state.c
index d8c70b8efc24..3fc970135fc6 100644
--- a/net/ipv6/xfrm6_state.c
+++ b/net/ipv6/xfrm6_state.c
@@ -183,6 +183,7 @@ static struct xfrm_state_afinfo xfrm6_state_afinfo = {
         .extract_input          = xfrm6_extract_input,
         .extract_output         = xfrm6_extract_output,
         .transport_finish       = xfrm6_transport_finish,
+        .local_error            = xfrm6_local_error,
 };
 
 int __init xfrm6_state_init(void)
diff --git a/net/ipx/af_ipx.c b/net/ipx/af_ipx.c
index f547a47d381c..7a1e0fc1bd4d 100644
--- a/net/ipx/af_ipx.c
+++ b/net/ipx/af_ipx.c
@@ -330,7 +330,7 @@ static __inline__ void __ipxitf_put(struct ipx_interface *intrfc)
 static int ipxitf_device_event(struct notifier_block *notifier,
                                 unsigned long event, void *ptr)
 {
-        struct net_device *dev = ptr;
+        struct net_device *dev = netdev_notifier_info_to_dev(ptr);
         struct ipx_interface *i, *tmp;
 
         if (!net_eq(dev_net(dev), &init_net))
diff --git a/net/ipx/ipx_proc.c b/net/ipx/ipx_proc.c
index 65e8833a2510..e15c16a517e7 100644
--- a/net/ipx/ipx_proc.c
+++ b/net/ipx/ipx_proc.c
@@ -213,7 +213,7 @@ static int ipx_seq_socket_show(struct seq_file *seq, void *v)
                            ntohs(ipxs->dest_addr.sock));
         }
 
-        seq_printf(seq, "%08X  %08X  %02X     %03d\n",
+        seq_printf(seq, "%08X  %08X  %02X     %03u\n",
                    sk_wmem_alloc_get(s),
                    sk_rmem_alloc_get(s),
                    s->sk_state,
diff --git a/net/irda/irlan/irlan_eth.c b/net/irda/irlan/irlan_eth.c
index d14152e866d9..ffcec225b5d9 100644
--- a/net/irda/irlan/irlan_eth.c
+++ b/net/irda/irlan/irlan_eth.c
@@ -44,12 +44,12 @@ static int  irlan_eth_open(struct net_device *dev);
 static int  irlan_eth_close(struct net_device *dev);
 static netdev_tx_t  irlan_eth_xmit(struct sk_buff *skb,
                                          struct net_device *dev);
-static void irlan_eth_set_multicast_list( struct net_device *dev);
+static void irlan_eth_set_multicast_list(struct net_device *dev);
 
 static const struct net_device_ops irlan_eth_netdev_ops = {
-        .ndo_open               = irlan_eth_open,
-        .ndo_stop               = irlan_eth_close,
-        .ndo_start_xmit         = irlan_eth_xmit,
+        .ndo_open               = irlan_eth_open,
+        .ndo_stop               = irlan_eth_close,
+        .ndo_start_xmit         = irlan_eth_xmit,
         .ndo_set_rx_mode        = irlan_eth_set_multicast_list,
         .ndo_change_mtu         = eth_change_mtu,
         .ndo_validate_addr      = eth_validate_addr,
@@ -110,7 +110,7 @@ static int irlan_eth_open(struct net_device *dev)
 {
         struct irlan_cb *self = netdev_priv(dev);
 
-        IRDA_DEBUG(2, "%s()\n", __func__ );
+        IRDA_DEBUG(2, "%s()\n", __func__);
 
         /* Ready to play! */
         netif_stop_queue(dev); /* Wait until data link is ready */
@@ -137,7 +137,7 @@ static int irlan_eth_close(struct net_device *dev)
 {
         struct irlan_cb *self = netdev_priv(dev);
 
-        IRDA_DEBUG(2, "%s()\n", __func__ );
+        IRDA_DEBUG(2, "%s()\n", __func__);
 
         /* Stop device */
         netif_stop_queue(dev);
@@ -310,35 +310,32 @@ static void irlan_eth_set_multicast_list(struct net_device *dev)
 {
         struct irlan_cb *self = netdev_priv(dev);
 
-        IRDA_DEBUG(2, "%s()\n", __func__ );
+        IRDA_DEBUG(2, "%s()\n", __func__);
 
         /* Check if data channel has been connected yet */
         if (self->client.state != IRLAN_DATA) {
-                IRDA_DEBUG(1, "%s(), delaying!\n", __func__ );
+                IRDA_DEBUG(1, "%s(), delaying!\n", __func__);
                 return;
         }
 
         if (dev->flags & IFF_PROMISC) {
                 /* Enable promiscuous mode */
                 IRDA_WARNING("Promiscuous mode not implemented by IrLAN!\n");
-        }
-        else if ((dev->flags & IFF_ALLMULTI) ||
+        } else if ((dev->flags & IFF_ALLMULTI) ||
                  netdev_mc_count(dev) > HW_MAX_ADDRS) {
                 /* Disable promiscuous mode, use normal mode. */
-                IRDA_DEBUG(4, "%s(), Setting multicast filter\n", __func__ );
+                IRDA_DEBUG(4, "%s(), Setting multicast filter\n", __func__);
                 /* hardware_set_filter(NULL); */
 
                 irlan_set_multicast_filter(self, TRUE);
-        }
-        else if (!netdev_mc_empty(dev)) {
-                IRDA_DEBUG(4, "%s(), Setting multicast filter\n", __func__ );
+        } else if (!netdev_mc_empty(dev)) {
+                IRDA_DEBUG(4, "%s(), Setting multicast filter\n", __func__);
                 /* Walk the address list, and load the filter */
                 /* hardware_set_filter(dev->mc_list); */
 
                 irlan_set_multicast_filter(self, TRUE);
-        }
-        else {
-                IRDA_DEBUG(4, "%s(), Clearing multicast filter\n", __func__ );
+        } else {
+                IRDA_DEBUG(4, "%s(), Clearing multicast filter\n", __func__);
                 irlan_set_multicast_filter(self, FALSE);
         }
 
diff --git a/net/irda/irsysctl.c b/net/irda/irsysctl.c
index de73f6496db5..d6a59651767a 100644
--- a/net/irda/irsysctl.c
+++ b/net/irda/irsysctl.c
@@ -73,7 +73,7 @@ static int min_lap_keepalive_time = 100;	/* 100us */
 /* For other sysctl, I've no idea of the range. Maybe Dag could help
  * us on that - Jean II */
 
-static int do_devname(ctl_table *table, int write,
+static int do_devname(struct ctl_table *table, int write,
                       void __user *buffer, size_t *lenp, loff_t *ppos)
 {
         int ret;
@@ -90,7 +90,7 @@ static int do_devname(ctl_table *table, int write,
 }
 
 
-static int do_discovery(ctl_table *table, int write,
+static int do_discovery(struct ctl_table *table, int write,
                     void __user *buffer, size_t *lenp, loff_t *ppos)
 {
        int ret;
@@ -111,7 +111,7 @@ static int do_discovery(ctl_table *table, int write,
 }
 
 /* One file */
-static ctl_table irda_table[] = {
+static struct ctl_table irda_table[] = {
         {
                 .procname       = "discovery",
                 .data           = &sysctl_discovery,
diff --git a/net/irda/irttp.c b/net/irda/irttp.c
index ae43c62f9045..85372cfa7b9f 100644
--- a/net/irda/irttp.c
+++ b/net/irda/irttp.c
@@ -75,7 +75,7 @@ static pi_minor_info_t pi_minor_call_table[] = {
         { NULL, 0 },                                             /* 0x00 */
         { irttp_param_max_sdu_size, PV_INTEGER | PV_BIG_ENDIAN } /* 0x01 */
 };
-static pi_major_info_t pi_major_call_table[] = {{ pi_minor_call_table, 2 }};
+static pi_major_info_t pi_major_call_table[] = { { pi_minor_call_table, 2 } };
 static pi_param_info_t param_info = { pi_major_call_table, 1, 0x0f, 4 };
 
 /************************ GLOBAL PROCEDURES ************************/
@@ -205,7 +205,7 @@ static void irttp_todo_expired(unsigned long data)
  */
 static void irttp_flush_queues(struct tsap_cb *self)
 {
-        struct sk_buff* skb;
+        struct sk_buff *skb;
 
         IRDA_DEBUG(4, "%s()\n", __func__);
 
@@ -400,7 +400,7 @@ struct tsap_cb *irttp_open_tsap(__u8 stsap_sel, int credit, notify_t *notify)
         /* The IrLMP spec (IrLMP 1.1 p10) says that we have the right to
          * use only 0x01-0x6F. Of course, we can use LSAP_ANY as well.
          * JeanII */
-        if((stsap_sel != LSAP_ANY) &&
+        if ((stsap_sel != LSAP_ANY) &&
            ((stsap_sel < 0x01) || (stsap_sel >= 0x70))) {
                 IRDA_DEBUG(0, "%s(), invalid tsap!\n", __func__);
                 return NULL;
@@ -427,7 +427,7 @@ struct tsap_cb *irttp_open_tsap(__u8 stsap_sel, int credit, notify_t *notify)
         ttp_notify.data_indication = irttp_data_indication;
         ttp_notify.udata_indication = irttp_udata_indication;
         ttp_notify.flow_indication = irttp_flow_indication;
-        if(notify->status_indication != NULL)
+        if (notify->status_indication != NULL)
                 ttp_notify.status_indication = irttp_status_indication;
         ttp_notify.instance = self;
         strncpy(ttp_notify.name, notify->name, NOTIFY_MAX_NAME);
@@ -639,8 +639,7 @@ int irttp_data_request(struct tsap_cb *self, struct sk_buff *skb)
          */
         if ((self->tx_max_sdu_size != 0) &&
             (self->tx_max_sdu_size != TTP_SAR_UNBOUND) &&
-            (skb->len > self->tx_max_sdu_size))
-        {
+            (skb->len > self->tx_max_sdu_size)) {
                 IRDA_ERROR("%s: SAR enabled, but data is larger than TxMaxSduSize!\n",
                            __func__);
                 ret = -EMSGSIZE;
@@ -733,8 +732,7 @@ static void irttp_run_tx_queue(struct tsap_cb *self)
          * poll us through irttp_flow_indication() - Jean II */
         while ((self->send_credit > 0) &&
                (!irlmp_lap_tx_queue_full(self->lsap)) &&
-               (skb = skb_dequeue(&self->tx_queue)))
-        {
+               (skb = skb_dequeue(&self->tx_queue))) {
                 /*
                  *  Since we can transmit and receive frames concurrently,
                  *  the code below is a critical region and we must assure that
@@ -798,8 +796,7 @@ static void irttp_run_tx_queue(struct tsap_cb *self)
          * where we can spend a bit of time doing stuff. - Jean II */
         if ((self->tx_sdu_busy) &&
             (skb_queue_len(&self->tx_queue) < TTP_TX_LOW_THRESHOLD) &&
-            (!self->close_pend))
-        {
+            (!self->close_pend)) {
                 if (self->notify.flow_indication)
                         self->notify.flow_indication(self->notify.instance,
                                                      self, FLOW_START);
@@ -892,7 +889,7 @@ static int irttp_udata_indication(void *instance, void *sap,
         /* Just pass data to layer above */
         if (self->notify.udata_indication) {
                 err = self->notify.udata_indication(self->notify.instance,
-                                                    self,skb);
+                                                    self, skb);
                 /* Same comment as in irttp_do_data_indication() */
                 if (!err)
                         return 0;
@@ -1057,7 +1054,7 @@ static void irttp_flow_indication(void *instance, void *sap, LOCAL_FLOW flow)
          * to do that. Jean II */
 
         /* If we need to send disconnect. try to do it now */
-        if(self->disconnect_pend)
+        if (self->disconnect_pend)
                 irttp_start_todo_timer(self, 0);
 }
 
@@ -1116,7 +1113,7 @@ int irttp_connect_request(struct tsap_cb *self, __u8 dtsap_sel,
         IRDA_ASSERT(self->magic == TTP_TSAP_MAGIC, return -EBADR;);
 
         if (self->connected) {
-                if(userdata)
+                if (userdata)
                         dev_kfree_skb(userdata);
                 return -EISCONN;
         }
@@ -1137,7 +1134,7 @@ int irttp_connect_request(struct tsap_cb *self, __u8 dtsap_sel,
                  *  headers
                  */
                 IRDA_ASSERT(skb_headroom(userdata) >= TTP_MAX_HEADER,
-                        { dev_kfree_skb(userdata); return -1; } );
+                        { dev_kfree_skb(userdata); return -1; });
         }
 
         /* Initialize connection parameters */
@@ -1157,7 +1154,7 @@ int irttp_connect_request(struct tsap_cb *self, __u8 dtsap_sel,
          *  Give away max 127 credits for now
          */
         if (n > 127) {
-                self->avail_credit=n-127;
+                self->avail_credit = n - 127;
                 n = 127;
         }
 
@@ -1166,10 +1163,10 @@ int irttp_connect_request(struct tsap_cb *self, __u8 dtsap_sel,
         /* SAR enabled? */
         if (max_sdu_size > 0) {
                 IRDA_ASSERT(skb_headroom(tx_skb) >= (TTP_MAX_HEADER + TTP_SAR_HEADER),
-                        { dev_kfree_skb(tx_skb); return -1; } );
+                        { dev_kfree_skb(tx_skb); return -1; });
 
                 /* Insert SAR parameters */
-                frame = skb_push(tx_skb, TTP_HEADER+TTP_SAR_HEADER);
+                frame = skb_push(tx_skb, TTP_HEADER + TTP_SAR_HEADER);
 
                 frame[0] = TTP_PARAMETERS | n;
                 frame[1] = 0x04; /* Length */
@@ -1386,7 +1383,7 @@ int irttp_connect_response(struct tsap_cb *self, __u32 max_sdu_size,
                  *  headers
                  */
                 IRDA_ASSERT(skb_headroom(userdata) >= TTP_MAX_HEADER,
-                        { dev_kfree_skb(userdata); return -1; } );
+                        { dev_kfree_skb(userdata); return -1; });
         }
 
         self->avail_credit = 0;
@@ -1409,10 +1406,10 @@ int irttp_connect_response(struct tsap_cb *self, __u32 max_sdu_size,
         /* SAR enabled? */
         if (max_sdu_size > 0) {
                 IRDA_ASSERT(skb_headroom(tx_skb) >= (TTP_MAX_HEADER + TTP_SAR_HEADER),
-                        { dev_kfree_skb(tx_skb); return -1; } );
+                        { dev_kfree_skb(tx_skb); return -1; });
 
                 /* Insert TTP header with SAR parameters */
-                frame = skb_push(tx_skb, TTP_HEADER+TTP_SAR_HEADER);
+                frame = skb_push(tx_skb, TTP_HEADER + TTP_SAR_HEADER);
 
                 frame[0] = TTP_PARAMETERS | n;
                 frame[1] = 0x04; /* Length */
@@ -1522,7 +1519,7 @@ int irttp_disconnect_request(struct tsap_cb *self, struct sk_buff *userdata,
          * function may be called from various context, like user, timer
          * for following a disconnect_indication() (i.e. net_bh).
          * Jean II */
-        if(test_and_set_bit(0, &self->disconnect_pend)) {
+        if (test_and_set_bit(0, &self->disconnect_pend)) {
                 IRDA_DEBUG(0, "%s(), disconnect already pending\n",
                            __func__);
                 if (userdata)
@@ -1627,7 +1624,7 @@ static void irttp_disconnect_indication(void *instance, void *sap,
          * Jean II */
 
         /* No need to notify the client if has already tried to disconnect */
-        if(self->notify.disconnect_indication)
+        if (self->notify.disconnect_indication)
                 self->notify.disconnect_indication(self->notify.instance, self,
                                                    reason, skb);
         else
@@ -1738,8 +1735,7 @@ static void irttp_run_rx_queue(struct tsap_cb *self)
                  *  This is the last fragment, so time to reassemble!
                  */
                 if ((self->rx_sdu_size <= self->rx_max_sdu_size) ||
-                    (self->rx_max_sdu_size == TTP_SAR_UNBOUND))
-                {
+                    (self->rx_max_sdu_size == TTP_SAR_UNBOUND)) {
                         /*
                          * A little optimizing. Only queue the fragment if
                          * there are other fragments. Since if this is the
@@ -1860,7 +1856,7 @@ static int irttp_seq_show(struct seq_file *seq, void *v)
         seq_printf(seq, "dtsap_sel: %02x\n",
                    self->dtsap_sel);
         seq_printf(seq, "  connected: %s, ",
-                   self->connected? "TRUE":"FALSE");
+                   self->connected ? "TRUE" : "FALSE");
         seq_printf(seq, "avail credit: %d, ",
                    self->avail_credit);
         seq_printf(seq, "remote credit: %d, ",
@@ -1876,9 +1872,9 @@ static int irttp_seq_show(struct seq_file *seq, void *v)
         seq_printf(seq, "rx_queue len: %u\n",
                    skb_queue_len(&self->rx_queue));
         seq_printf(seq, "  tx_sdu_busy: %s, ",
-                   self->tx_sdu_busy? "TRUE":"FALSE");
+                   self->tx_sdu_busy ? "TRUE" : "FALSE");
         seq_printf(seq, "rx_sdu_busy: %s\n",
-                   self->rx_sdu_busy? "TRUE":"FALSE");
+                   self->rx_sdu_busy ? "TRUE" : "FALSE");
         seq_printf(seq, "  max_seg_size: %u, ",
                    self->max_seg_size);
         seq_printf(seq, "tx_max_sdu_size: %u, ",
diff --git a/net/iucv/af_iucv.c b/net/iucv/af_iucv.c
index ae691651b721..168aff5e60de 100644
--- a/net/iucv/af_iucv.c
+++ b/net/iucv/af_iucv.c
@@ -2293,7 +2293,7 @@ out_unlock:
 static int afiucv_netdev_event(struct notifier_block *this,
                                unsigned long event, void *ptr)
 {
-        struct net_device *event_dev = (struct net_device *)ptr;
+        struct net_device *event_dev = netdev_notifier_info_to_dev(ptr);
         struct sock *sk;
         struct iucv_sock *iucv;
 
diff --git a/net/iucv/iucv.c b/net/iucv/iucv.c
index 4fe76ff214c2..cd5b8ec9be04 100644
--- a/net/iucv/iucv.c
+++ b/net/iucv/iucv.c
@@ -621,7 +621,7 @@ static void iucv_disable(void)
         put_online_cpus();
 }
 
-static int __cpuinit iucv_cpu_notify(struct notifier_block *self,
+static int iucv_cpu_notify(struct notifier_block *self,
                                      unsigned long action, void *hcpu)
 {
         cpumask_t cpumask;
diff --git a/net/key/af_key.c b/net/key/af_key.c
index c5fbd7589681..9d585370c5b4 100644
--- a/net/key/af_key.c
+++ b/net/key/af_key.c
@@ -45,7 +45,7 @@ struct netns_pfkey {
 static DEFINE_MUTEX(pfkey_mutex);
 
 #define DUMMY_MARK 0
-static struct xfrm_mark dummy_mark = {0, 0};
+static const struct xfrm_mark dummy_mark = {0, 0};
 struct pfkey_sock {
         /* struct sock must be the first member of struct pfkey_sock */
         struct sock     sk;
@@ -338,7 +338,7 @@ static int pfkey_error(const struct sadb_msg *orig, int err, struct sock *sk)
         return 0;
 }
 
-static u8 sadb_ext_min_len[] = {
+static const u8 sadb_ext_min_len[] = {
         [SADB_EXT_RESERVED]             = (u8) 0,
         [SADB_EXT_SA]                   = (u8) sizeof(struct sadb_sa),
         [SADB_EXT_LIFETIME_CURRENT]     = (u8) sizeof(struct sadb_lifetime),
@@ -1196,10 +1196,6 @@ static struct xfrm_state * pfkey_msg2xfrm_state(struct net *net,
 
         x->props.family = pfkey_sadb_addr2xfrm_addr((struct sadb_address *) ext_hdrs[SADB_EXT_ADDRESS_SRC-1],
                                                     &x->props.saddr);
-        if (!x->props.family) {
-                err = -EAFNOSUPPORT;
-                goto out;
-        }
         pfkey_sadb_addr2xfrm_addr((struct sadb_address *) ext_hdrs[SADB_EXT_ADDRESS_DST-1],
                                   &x->id.daddr);
 
@@ -1710,6 +1706,7 @@ static int key_notify_sa_flush(const struct km_event *c)
         hdr->sadb_msg_version = PF_KEY_V2;
         hdr->sadb_msg_errno = (uint8_t) 0;
         hdr->sadb_msg_len = (sizeof(struct sadb_msg) / sizeof(uint64_t));
+        hdr->sadb_msg_reserved = 0;
 
         pfkey_broadcast(skb, GFP_ATOMIC, BROADCAST_ALL, NULL, c->net);
 
@@ -2080,6 +2077,7 @@ static int pfkey_xfrm_policy2msg(struct sk_buff *skb, const struct xfrm_policy *
                         pol->sadb_x_policy_type = IPSEC_POLICY_NONE;
         }
         pol->sadb_x_policy_dir = dir+1;
+        pol->sadb_x_policy_reserved = 0;
         pol->sadb_x_policy_id = xp->index;
         pol->sadb_x_policy_priority = xp->priority;
 
@@ -2203,10 +2201,6 @@ static int pfkey_spdadd(struct sock *sk, struct sk_buff *skb, const struct sadb_
 
         sa = ext_hdrs[SADB_EXT_ADDRESS_SRC-1];
         xp->family = pfkey_sadb_addr2xfrm_addr(sa, &xp->selector.saddr);
-        if (!xp->family) {
-                err = -EINVAL;
-                goto out;
-        }
         xp->selector.family = xp->family;
         xp->selector.prefixlen_s = sa->sadb_address_prefixlen;
         xp->selector.proto = pfkey_proto_to_xfrm(sa->sadb_address_proto);
@@ -2699,6 +2693,7 @@ static int key_notify_policy_flush(const struct km_event *c)
         hdr->sadb_msg_errno = (uint8_t) 0;
         hdr->sadb_msg_satype = SADB_SATYPE_UNSPEC;
         hdr->sadb_msg_len = (sizeof(struct sadb_msg) / sizeof(uint64_t));
+        hdr->sadb_msg_reserved = 0;
         pfkey_broadcast(skb_out, GFP_ATOMIC, BROADCAST_ALL, NULL, c->net);
         return 0;
 
@@ -2734,7 +2729,7 @@ static int pfkey_spdflush(struct sock *sk, struct sk_buff *skb, const struct sad
 
 typedef int (*pfkey_handler)(struct sock *sk, struct sk_buff *skb,
                              const struct sadb_msg *hdr, void * const *ext_hdrs);
-static pfkey_handler pfkey_funcs[SADB_MAX + 1] = {
+static const pfkey_handler pfkey_funcs[SADB_MAX + 1] = {
         [SADB_RESERVED]         = pfkey_reserved,
         [SADB_GETSPI]           = pfkey_getspi,
         [SADB_UPDATE]           = pfkey_add,
@@ -3135,7 +3130,9 @@ static int pfkey_send_acquire(struct xfrm_state *x, struct xfrm_tmpl *t, struct
         pol->sadb_x_policy_exttype = SADB_X_EXT_POLICY;
         pol->sadb_x_policy_type = IPSEC_POLICY_IPSEC;
         pol->sadb_x_policy_dir = XFRM_POLICY_OUT + 1;
+        pol->sadb_x_policy_reserved = 0;
         pol->sadb_x_policy_id = xp->index;
+        pol->sadb_x_policy_priority = xp->priority;
 
         /* Set sadb_comb's. */
         if (x->id.proto == IPPROTO_AH)
@@ -3523,6 +3520,7 @@ static int pfkey_send_migrate(const struct xfrm_selector *sel, u8 dir, u8 type,
         pol->sadb_x_policy_exttype = SADB_X_EXT_POLICY;
         pol->sadb_x_policy_type = IPSEC_POLICY_IPSEC;
         pol->sadb_x_policy_dir = dir + 1;
+        pol->sadb_x_policy_reserved = 0;
         pol->sadb_x_policy_id = 0;
         pol->sadb_x_policy_priority = 0;
 
diff --git a/net/l2tp/l2tp_core.c b/net/l2tp/l2tp_core.c
index 6984c3a353cd..feae495a0a30 100644
--- a/net/l2tp/l2tp_core.c
+++ b/net/l2tp/l2tp_core.c
@@ -414,10 +414,7 @@ static void l2tp_recv_dequeue_skb(struct l2tp_session *session, struct sk_buff *
         if (L2TP_SKB_CB(skb)->has_seq) {
                 /* Bump our Nr */
                 session->nr++;
-                if (tunnel->version == L2TP_HDR_VER_2)
-                        session->nr &= 0xffff;
-                else
-                        session->nr &= 0xffffff;
+                session->nr &= session->nr_max;
 
                 l2tp_dbg(session, L2TP_MSG_SEQ, "%s: updated nr to %hu\n",
                          session->name, session->nr);
@@ -542,6 +539,84 @@ static inline int l2tp_verify_udp_checksum(struct sock *sk,
         return __skb_checksum_complete(skb);
 }
 
+static int l2tp_seq_check_rx_window(struct l2tp_session *session, u32 nr)
+{
+        u32 nws;
+
+        if (nr >= session->nr)
+                nws = nr - session->nr;
+        else
+                nws = (session->nr_max + 1) - (session->nr - nr);
+
+        return nws < session->nr_window_size;
+}
+
+/* If packet has sequence numbers, queue it if acceptable. Returns 0 if
+ * acceptable, else non-zero.
+ */
+static int l2tp_recv_data_seq(struct l2tp_session *session, struct sk_buff *skb)
+{
+        if (!l2tp_seq_check_rx_window(session, L2TP_SKB_CB(skb)->ns)) {
+                /* Packet sequence number is outside allowed window.
+                 * Discard it.
+                 */
+                l2tp_dbg(session, L2TP_MSG_SEQ,
+                         "%s: pkt %u len %d discarded, outside window, nr=%u\n",
+                         session->name, L2TP_SKB_CB(skb)->ns,
+                         L2TP_SKB_CB(skb)->length, session->nr);
+                goto discard;
+        }
+
+        if (session->reorder_timeout != 0) {
+                /* Packet reordering enabled. Add skb to session's
+                 * reorder queue, in order of ns.
+                 */
+                l2tp_recv_queue_skb(session, skb);
+                goto out;
+        }
+
+        /* Packet reordering disabled. Discard out-of-sequence packets, while
+         * tracking the number if in-sequence packets after the first OOS packet
+         * is seen. After nr_oos_count_max in-sequence packets, reset the
+         * sequence number to re-enable packet reception.
+         */
+        if (L2TP_SKB_CB(skb)->ns == session->nr) {
+                skb_queue_tail(&session->reorder_q, skb);
+        } else {
+                u32 nr_oos = L2TP_SKB_CB(skb)->ns;
+                u32 nr_next = (session->nr_oos + 1) & session->nr_max;
+
+                if (nr_oos == nr_next)
+                        session->nr_oos_count++;
+                else
+                        session->nr_oos_count = 0;
+
+                session->nr_oos = nr_oos;
+                if (session->nr_oos_count > session->nr_oos_count_max) {
+                        session->reorder_skip = 1;
+                        l2tp_dbg(session, L2TP_MSG_SEQ,
+                                 "%s: %d oos packets received. Resetting sequence numbers\n",
+                                 session->name, session->nr_oos_count);
+                }
+                if (!session->reorder_skip) {
+                        atomic_long_inc(&session->stats.rx_seq_discards);
+                        l2tp_dbg(session, L2TP_MSG_SEQ,
+                                 "%s: oos pkt %u len %d discarded, waiting for %u, reorder_q_len=%d\n",
+                                 session->name, L2TP_SKB_CB(skb)->ns,
+                                 L2TP_SKB_CB(skb)->length, session->nr,
+                                 skb_queue_len(&session->reorder_q));
+                        goto discard;
+                }
+                skb_queue_tail(&session->reorder_q, skb);
+        }
+
+out:
+        return 0;
+
+discard:
+        return 1;
+}
+
 /* Do receive processing of L2TP data frames. We handle both L2TPv2
  * and L2TPv3 data frames here.
  *
@@ -757,26 +832,8 @@ void l2tp_recv_common(struct l2tp_session *session, struct sk_buff *skb,
          * enabled. Saved L2TP protocol info is stored in skb->sb[].
          */
         if (L2TP_SKB_CB(skb)->has_seq) {
-                if (session->reorder_timeout != 0) {
-                        /* Packet reordering enabled. Add skb to session's
-                         * reorder queue, in order of ns.
-                         */
-                        l2tp_recv_queue_skb(session, skb);
-                } else {
-                        /* Packet reordering disabled. Discard out-of-sequence
-                         * packets
-                         */
-                        if (L2TP_SKB_CB(skb)->ns != session->nr) {
-                                atomic_long_inc(&session->stats.rx_seq_discards);
-                                l2tp_dbg(session, L2TP_MSG_SEQ,
-                                         "%s: oos pkt %u len %d discarded, waiting for %u, reorder_q_len=%d\n",
-                                         session->name, L2TP_SKB_CB(skb)->ns,
-                                         L2TP_SKB_CB(skb)->length, session->nr,
-                                         skb_queue_len(&session->reorder_q));
-                                goto discard;
-                        }
-                        skb_queue_tail(&session->reorder_q, skb);
-                }
+                if (l2tp_recv_data_seq(session, skb))
+                        goto discard;
         } else {
                 /* No sequence numbers. Add the skb to the tail of the
                  * reorder queue. This ensures that it will be
@@ -1812,6 +1869,15 @@ struct l2tp_session *l2tp_session_create(int priv_size, struct l2tp_tunnel *tunn
                 session->session_id = session_id;
                 session->peer_session_id = peer_session_id;
                 session->nr = 0;
+                if (tunnel->version == L2TP_HDR_VER_2)
+                        session->nr_max = 0xffff;
+                else
+                        session->nr_max = 0xffffff;
+                session->nr_window_size = session->nr_max / 2;
+                session->nr_oos_count_max = 4;
+
+                /* Use NR of first received packet */
+                session->reorder_skip = 1;
 
                 sprintf(&session->name[0], "sess %u/%u",
                         tunnel->tunnel_id, session->session_id);
diff --git a/net/l2tp/l2tp_core.h b/net/l2tp/l2tp_core.h
index 485a490fd990..66a559b104b6 100644
--- a/net/l2tp/l2tp_core.h
+++ b/net/l2tp/l2tp_core.h
@@ -102,6 +102,11 @@ struct l2tp_session {
         u32                     nr;             /* session NR state (receive) */
         u32                     ns;             /* session NR state (send) */
         struct sk_buff_head     reorder_q;      /* receive reorder queue */
+        u32                     nr_max;         /* max NR. Depends on tunnel */
+        u32                     nr_window_size; /* NR window size */
+        u32                     nr_oos;         /* NR of last OOS packet */
+        int                     nr_oos_count;   /* For OOS recovery */
+        int                     nr_oos_count_max;
         struct hlist_node       hlist;          /* Hash list node */
         atomic_t                ref_count;
 
diff --git a/net/l2tp/l2tp_ppp.c b/net/l2tp/l2tp_ppp.c
index 637a341c1e2d..5ebee2ded9e9 100644
--- a/net/l2tp/l2tp_ppp.c
+++ b/net/l2tp/l2tp_ppp.c
@@ -346,19 +346,19 @@ static int pppol2tp_sendmsg(struct kiocb *iocb, struct socket *sock, struct msgh
         skb_put(skb, 2);
 
         /* Copy user data into skb */
-        error = memcpy_fromiovec(skb->data, m->msg_iov, total_len);
+        error = memcpy_fromiovec(skb_put(skb, total_len), m->msg_iov,
+                                 total_len);
         if (error < 0) {
                 kfree_skb(skb);
                 goto error_put_sess_tun;
         }
-        skb_put(skb, total_len);
 
         l2tp_xmit_skb(session, skb, session->hdr_len);
 
         sock_put(ps->tunnel_sock);
         sock_put(sk);
 
-        return error;
+        return total_len;
 
 error_put_sess_tun:
         sock_put(ps->tunnel_sock);
@@ -1793,7 +1793,8 @@ static const struct proto_ops pppol2tp_ops = {
 
 static const struct pppox_proto pppol2tp_proto = {
         .create         = pppol2tp_create,
-        .ioctl          = pppol2tp_ioctl
+        .ioctl          = pppol2tp_ioctl,
+        .owner          = THIS_MODULE,
 };
 
 #ifdef CONFIG_L2TP_V3
diff --git a/net/lapb/lapb_timer.c b/net/lapb/lapb_timer.c
index 54563ad8aeb1..355cc3b6fa4d 100644
--- a/net/lapb/lapb_timer.c
+++ b/net/lapb/lapb_timer.c
@@ -154,6 +154,7 @@ static void lapb_t1timer_expiry(unsigned long param)
                         } else {
                                 lapb->n2count++;
                                 lapb_requeue_frames(lapb);
+                                lapb_kick(lapb);
                         }
                         break;
 
diff --git a/net/llc/af_llc.c b/net/llc/af_llc.c
index 48aaa89253e0..6cba486353e8 100644
--- a/net/llc/af_llc.c
+++ b/net/llc/af_llc.c
@@ -321,12 +321,12 @@ static int llc_ui_bind(struct socket *sock, struct sockaddr *uaddr, int addrlen)
                 if (llc->dev) {
                         if (!addr->sllc_arphrd)
                                 addr->sllc_arphrd = llc->dev->type;
-                        if (llc_mac_null(addr->sllc_mac))
+                        if (is_zero_ether_addr(addr->sllc_mac))
                                 memcpy(addr->sllc_mac, llc->dev->dev_addr,
                                        IFHWADDRLEN);
                         if (addr->sllc_arphrd != llc->dev->type ||
-                            !llc_mac_match(addr->sllc_mac,
-                                           llc->dev->dev_addr)) {
+                            !ether_addr_equal(addr->sllc_mac,
+                                              llc->dev->dev_addr)) {
                                 rc = -EINVAL;
                                 llc->dev = NULL;
                         }
diff --git a/net/llc/llc_conn.c b/net/llc/llc_conn.c
index 0d0d416dfab6..cd8724177965 100644
--- a/net/llc/llc_conn.c
+++ b/net/llc/llc_conn.c
@@ -478,8 +478,8 @@ static inline bool llc_estab_match(const struct llc_sap *sap,
 
         return llc->laddr.lsap == laddr->lsap &&
                 llc->daddr.lsap == daddr->lsap &&
-                llc_mac_match(llc->laddr.mac, laddr->mac) &&
-                llc_mac_match(llc->daddr.mac, daddr->mac);
+                ether_addr_equal(llc->laddr.mac, laddr->mac) &&
+                ether_addr_equal(llc->daddr.mac, daddr->mac);
 }
 
 /**
@@ -550,7 +550,7 @@ static inline bool llc_listener_match(const struct llc_sap *sap,
 
         return sk->sk_type == SOCK_STREAM && sk->sk_state == TCP_LISTEN &&
                 llc->laddr.lsap == laddr->lsap &&
-                llc_mac_match(llc->laddr.mac, laddr->mac);
+                ether_addr_equal(llc->laddr.mac, laddr->mac);
 }
 
 static struct sock *__llc_lookup_listener(struct llc_sap *sap,
diff --git a/net/llc/llc_proc.c b/net/llc/llc_proc.c
index 7b4799cfbf8d..1a3c7e0f5d0d 100644
--- a/net/llc/llc_proc.c
+++ b/net/llc/llc_proc.c
@@ -147,7 +147,7 @@ static int llc_seq_socket_show(struct seq_file *seq, void *v)
         }
         seq_printf(seq, "@%02X ", llc->sap->laddr.lsap);
         llc_ui_format_mac(seq, llc->daddr.mac);
-        seq_printf(seq, "@%02X %8d %8d %2d %3d %4d\n", llc->daddr.lsap,
+        seq_printf(seq, "@%02X %8d %8d %2d %3u %4d\n", llc->daddr.lsap,
                    sk_wmem_alloc_get(sk),
                    sk_rmem_alloc_get(sk) - llc->copied_seq,
                    sk->sk_state,
diff --git a/net/llc/llc_sap.c b/net/llc/llc_sap.c
index 78be45cda5c1..e5850699098e 100644
--- a/net/llc/llc_sap.c
+++ b/net/llc/llc_sap.c
@@ -302,7 +302,7 @@ static inline bool llc_dgram_match(const struct llc_sap *sap,
 
      return sk->sk_type == SOCK_DGRAM &&
           llc->laddr.lsap == laddr->lsap &&
-          llc_mac_match(llc->laddr.mac, laddr->mac);
+          ether_addr_equal(llc->laddr.mac, laddr->mac);
 }
 
 /**
@@ -425,7 +425,7 @@ void llc_sap_handler(struct llc_sap *sap, struct sk_buff *skb)
         llc_pdu_decode_da(skb, laddr.mac);
         llc_pdu_decode_dsap(skb, &laddr.lsap);
 
-        if (llc_mac_multicast(laddr.mac)) {
+        if (is_multicast_ether_addr(laddr.mac)) {
                 llc_sap_mcast(sap, &laddr, skb);
                 kfree_skb(skb);
         } else {
diff --git a/net/mac80211/aes_ccm.c b/net/mac80211/aes_ccm.c
index 0785e95c9924..be7614b9ed27 100644
--- a/net/mac80211/aes_ccm.c
+++ b/net/mac80211/aes_ccm.c
@@ -85,7 +85,7 @@ void ieee80211_aes_ccm_encrypt(struct crypto_cipher *tfm, u8 *scratch,
                         *cpos++ = *pos++ ^ e[i];
         }
 
-        for (i = 0; i < CCMP_MIC_LEN; i++)
+        for (i = 0; i < IEEE80211_CCMP_MIC_LEN; i++)
                 mic[i] = b[i] ^ s_0[i];
 }
 
@@ -123,7 +123,7 @@ int ieee80211_aes_ccm_decrypt(struct crypto_cipher *tfm, u8 *scratch,
                 crypto_cipher_encrypt_one(tfm, a, a);
         }
 
-        for (i = 0; i < CCMP_MIC_LEN; i++) {
+        for (i = 0; i < IEEE80211_CCMP_MIC_LEN; i++) {
                 if ((mic[i] ^ s_0[i]) != a[i])
                         return -1;
         }
@@ -138,7 +138,7 @@ struct crypto_cipher *ieee80211_aes_key_setup_encrypt(const u8 key[])
 
         tfm = crypto_alloc_cipher("aes", 0, CRYPTO_ALG_ASYNC);
         if (!IS_ERR(tfm))
-                crypto_cipher_setkey(tfm, key, ALG_CCMP_KEY_LEN);
+                crypto_cipher_setkey(tfm, key, WLAN_KEY_LEN_CCMP);
 
         return tfm;
 }
diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
index 1a89c80e6407..2e7855a1b10d 100644
--- a/net/mac80211/cfg.c
+++ b/net/mac80211/cfg.c
@@ -73,16 +73,19 @@ static int ieee80211_change_iface(struct wiphy *wiphy,
                 struct ieee80211_local *local = sdata->local;
 
                 if (ieee80211_sdata_running(sdata)) {
+                        u32 mask = MONITOR_FLAG_COOK_FRAMES |
+                                   MONITOR_FLAG_ACTIVE;
+
                         /*
-                         * Prohibit MONITOR_FLAG_COOK_FRAMES to be
-                         * changed while the interface is up.
+                         * Prohibit MONITOR_FLAG_COOK_FRAMES and
+                         * MONITOR_FLAG_ACTIVE to be changed while the
+                         * interface is up.
                          * Else we would need to add a lot of cruft
                          * to update everything:
                          *      cooked_mntrs, monitor and all fif_* counters
                          *      reconfigure hardware
                          */
-                        if ((*flags & MONITOR_FLAG_COOK_FRAMES) !=
-                            (sdata->u.mntr_flags & MONITOR_FLAG_COOK_FRAMES))
+                        if ((*flags & mask) != (sdata->u.mntr_flags & mask))
                                 return -EBUSY;
 
                         ieee80211_adjust_monitor_flags(sdata, -1);
@@ -392,9 +395,13 @@ void sta_set_rate_info_tx(struct sta_info *sta,
                 rinfo->nss = ieee80211_rate_get_vht_nss(rate);
         } else {
                 struct ieee80211_supported_band *sband;
+                int shift = ieee80211_vif_get_shift(&sta->sdata->vif);
+                u16 brate;
+
                 sband = sta->local->hw.wiphy->bands[
                                 ieee80211_get_sdata_band(sta->sdata)];
-                rinfo->legacy = sband->bitrates[rate->idx].bitrate;
+                brate = sband->bitrates[rate->idx].bitrate;
+                rinfo->legacy = DIV_ROUND_UP(brate, 1 << shift);
         }
         if (rate->flags & IEEE80211_TX_RC_40_MHZ_WIDTH)
                 rinfo->flags |= RATE_INFO_FLAGS_40_MHZ_WIDTH;
@@ -419,11 +426,13 @@ void sta_set_rate_info_rx(struct sta_info *sta, struct rate_info *rinfo)
                 rinfo->mcs = sta->last_rx_rate_idx;
         } else {
                 struct ieee80211_supported_band *sband;
+                int shift = ieee80211_vif_get_shift(&sta->sdata->vif);
+                u16 brate;
 
                 sband = sta->local->hw.wiphy->bands[
                                 ieee80211_get_sdata_band(sta->sdata)];
-                rinfo->legacy =
-                        sband->bitrates[sta->last_rx_rate_idx].bitrate;
+                brate = sband->bitrates[sta->last_rx_rate_idx].bitrate;
+                rinfo->legacy = DIV_ROUND_UP(brate, 1 << shift);
         }
 
         if (sta->last_rx_rate_flag & RX_FLAG_40MHZ)
@@ -444,7 +453,7 @@ static void sta_set_sinfo(struct sta_info *sta, struct station_info *sinfo)
         struct ieee80211_local *local = sdata->local;
         struct timespec uptime;
         u64 packets = 0;
-        int ac;
+        int i, ac;
 
         sinfo->generation = sdata->local->sta_generation;
 
@@ -488,6 +497,17 @@ static void sta_set_sinfo(struct sta_info *sta, struct station_info *sinfo)
                         sinfo->signal = (s8)sta->last_signal;
                 sinfo->signal_avg = (s8) -ewma_read(&sta->avg_signal);
         }
+        if (sta->chains) {
+                sinfo->filled |= STATION_INFO_CHAIN_SIGNAL |
+                                 STATION_INFO_CHAIN_SIGNAL_AVG;
+
+                sinfo->chains = sta->chains;
+                for (i = 0; i < ARRAY_SIZE(sinfo->chain_signal); i++) {
+                        sinfo->chain_signal[i] = sta->chain_signal_last[i];
+                        sinfo->chain_signal_avg[i] =
+                                (s8) -ewma_read(&sta->chain_signal_avg[i]);
+                }
+        }
 
         sta_set_rate_info_tx(sta, &sta->last_tx_rate, &sinfo->txrate);
         sta_set_rate_info_rx(sta, &sinfo->rxrate);
@@ -652,6 +672,8 @@ static void ieee80211_get_et_stats(struct wiphy *wiphy,
                         if (sta->sdata->dev != dev)
                                 continue;
 
+                        sinfo.filled = 0;
+                        sta_set_sinfo(sta, &sinfo);
                         i = 0;
                         ADD_STA_STATS(sta);
                 }
@@ -728,7 +750,7 @@ static void ieee80211_get_et_strings(struct wiphy *wiphy,
 
         if (sset == ETH_SS_STATS) {
                 sz_sta_stats = sizeof(ieee80211_gstrings_sta_stats);
-                memcpy(data, *ieee80211_gstrings_sta_stats, sz_sta_stats);
+                memcpy(data, ieee80211_gstrings_sta_stats, sz_sta_stats);
         }
         drv_get_et_strings(sdata, sset, &(data[sz_sta_stats]));
 }
@@ -840,8 +862,8 @@ static int ieee80211_set_probe_resp(struct ieee80211_sub_if_data *sdata,
         return 0;
 }
 
-static int ieee80211_assign_beacon(struct ieee80211_sub_if_data *sdata,
-                                   struct cfg80211_beacon_data *params)
+int ieee80211_assign_beacon(struct ieee80211_sub_if_data *sdata,
+                            struct cfg80211_beacon_data *params)
 {
         struct beacon_data *new, *old;
         int new_head_len, new_tail_len;
@@ -1004,6 +1026,12 @@ static int ieee80211_change_beacon(struct wiphy *wiphy, struct net_device *dev,
 
         sdata = IEEE80211_DEV_TO_SUB_IF(dev);
 
+        /* don't allow changing the beacon while CSA is in place - offset
+         * of channel switch counter may change
+         */
+        if (sdata->vif.csa_active)
+                return -EBUSY;
+
         old = rtnl_dereference(sdata->u.ap.beacon);
         if (!old)
                 return -ENOENT;
@@ -1028,6 +1056,10 @@ static int ieee80211_stop_ap(struct wiphy *wiphy, struct net_device *dev)
                 return -ENOENT;
         old_probe_resp = rtnl_dereference(sdata->u.ap.probe_resp);
 
+        /* abort any running channel switch */
+        sdata->vif.csa_active = false;
+        cancel_work_sync(&sdata->csa_finalize_work);
+
         /* turn off carrier for this interface and dependent VLANs */
         list_for_each_entry(vlan, &sdata->u.ap.vlans, u.vlan.list)
                 netif_carrier_off(vlan->dev);
@@ -1057,6 +1089,12 @@ static int ieee80211_stop_ap(struct wiphy *wiphy, struct net_device *dev)
         clear_bit(SDATA_STATE_OFFCHANNEL_BEACON_STOPPED, &sdata->state);
         ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_BEACON_ENABLED);
 
+        if (sdata->wdev.cac_started) {
+                cancel_delayed_work_sync(&sdata->dfs_cac_timer_work);
+                cfg80211_cac_event(sdata->dev, NL80211_RADAR_CAC_ABORTED,
+                                   GFP_KERNEL);
+        }
+
         drv_stop_ap(sdata->local, sdata);
 
         /* free all potentially still buffered bcast frames */
@@ -1170,8 +1208,6 @@ static int sta_apply_parameters(struct ieee80211_local *local,
                                 struct station_parameters *params)
 {
         int ret = 0;
-        u32 rates;
-        int i, j;
         struct ieee80211_supported_band *sband;
         struct ieee80211_sub_if_data *sdata = sta->sdata;
         enum ieee80211_band band = ieee80211_get_sdata_band(sdata);
@@ -1264,16 +1300,10 @@ static int sta_apply_parameters(struct ieee80211_local *local,
                 sta->listen_interval = params->listen_interval;
 
         if (params->supported_rates) {
-                rates = 0;
-
-                for (i = 0; i < params->supported_rates_len; i++) {
-                        int rate = (params->supported_rates[i] & 0x7f) * 5;
-                        for (j = 0; j < sband->n_bitrates; j++) {
-                                if (sband->bitrates[j].bitrate == rate)
-                                        rates |= BIT(j);
-                        }
-                }
-                sta->sta.supp_rates[band] = rates;
+                ieee80211_parse_bitrates(&sdata->vif.bss_conf.chandef,
+                                         sband, params->supported_rates,
+                                         params->supported_rates_len,
+                                         &sta->sta.supp_rates[band]);
         }
 
         if (params->ht_capa)
@@ -1735,6 +1765,7 @@ static int copy_mesh_setup(struct ieee80211_if_mesh *ifmsh,
         ifmsh->mesh_pp_id = setup->path_sel_proto;
         ifmsh->mesh_pm_id = setup->path_metric;
         ifmsh->user_mpm = setup->user_mpm;
+        ifmsh->mesh_auth_id = setup->auth_id;
         ifmsh->security = IEEE80211_MESH_SEC_NONE;
         if (setup->is_authenticated)
                 ifmsh->security |= IEEE80211_MESH_SEC_AUTHED;
@@ -1744,6 +1775,7 @@ static int copy_mesh_setup(struct ieee80211_if_mesh *ifmsh,
         /* mcast rate setting in Mesh Node */
         memcpy(sdata->vif.bss_conf.mcast_rate, setup->mcast_rate,
                                                 sizeof(setup->mcast_rate));
+        sdata->vif.bss_conf.basic_rates = setup->basic_rates;
 
         sdata->vif.bss_conf.beacon_int = setup->beacon_interval;
         sdata->vif.bss_conf.dtim_period = setup->dtim_period;
@@ -1856,6 +1888,8 @@ static int ieee80211_update_mesh_config(struct wiphy *wiphy,
         if (_chg_mesh_attr(NL80211_MESHCONF_AWAKE_WINDOW, mask))
                 conf->dot11MeshAwakeWindowDuration =
                         nconf->dot11MeshAwakeWindowDuration;
+        if (_chg_mesh_attr(NL80211_MESHCONF_PLINK_TIMEOUT, mask))
+                conf->plink_timeout = nconf->plink_timeout;
         ieee80211_mbss_info_change_notify(sdata, BSS_CHANGED_BEACON);
         return 0;
 }
@@ -1932,18 +1966,11 @@ static int ieee80211_change_bss(struct wiphy *wiphy,
         }
 
         if (params->basic_rates) {
-                int i, j;
-                u32 rates = 0;
-                struct ieee80211_supported_band *sband = wiphy->bands[band];
-
-                for (i = 0; i < params->basic_rates_len; i++) {
-                        int rate = (params->basic_rates[i] & 0x7f) * 5;
-                        for (j = 0; j < sband->n_bitrates; j++) {
-                                if (sband->bitrates[j].bitrate == rate)
-                                        rates |= BIT(j);
-                        }
-                }
-                sdata->vif.bss_conf.basic_rates = rates;
+                ieee80211_parse_bitrates(&sdata->vif.bss_conf.chandef,
+                                         wiphy->bands[band],
+                                         params->basic_rates,
+                                         params->basic_rates_len,
+                                         &sdata->vif.bss_conf.basic_rates);
                 changed |= BSS_CHANGED_BASIC_RATES;
         }
 
@@ -2275,14 +2302,25 @@ static void ieee80211_rfkill_poll(struct wiphy *wiphy)
 }
 
 #ifdef CONFIG_NL80211_TESTMODE
-static int ieee80211_testmode_cmd(struct wiphy *wiphy, void *data, int len)
+static int ieee80211_testmode_cmd(struct wiphy *wiphy,
+                                  struct wireless_dev *wdev,
+                                  void *data, int len)
 {
         struct ieee80211_local *local = wiphy_priv(wiphy);
+        struct ieee80211_vif *vif = NULL;
 
         if (!local->ops->testmode_cmd)
                 return -EOPNOTSUPP;
 
-        return local->ops->testmode_cmd(&local->hw, data, len);
+        if (wdev) {
+                struct ieee80211_sub_if_data *sdata;
+
+                sdata = IEEE80211_WDEV_TO_SUB_IF(wdev);
+                if (sdata->flags & IEEE80211_SDATA_IN_DRIVER)
+                        vif = &sdata->vif;
+        }
+
+        return local->ops->testmode_cmd(&local->hw, vif, data, len);
 }
 
 static int ieee80211_testmode_dump(struct wiphy *wiphy,
@@ -2306,7 +2344,7 @@ int __ieee80211_request_smps(struct ieee80211_sub_if_data *sdata,
         enum ieee80211_smps_mode old_req;
         int err;
 
-        lockdep_assert_held(&sdata->u.mgd.mtx);
+        lockdep_assert_held(&sdata->wdev.mtx);
 
         old_req = sdata->u.mgd.req_smps;
         sdata->u.mgd.req_smps = smps_mode;
@@ -2363,9 +2401,9 @@ static int ieee80211_set_power_mgmt(struct wiphy *wiphy, struct net_device *dev,
         local->dynamic_ps_forced_timeout = timeout;
 
         /* no change, but if automatic follow powersave */
-        mutex_lock(&sdata->u.mgd.mtx);
+        sdata_lock(sdata);
         __ieee80211_request_smps(sdata, sdata->u.mgd.req_smps);
-        mutex_unlock(&sdata->u.mgd.mtx);
+        sdata_unlock(sdata);
 
         if (local->hw.flags & IEEE80211_HW_SUPPORTS_DYNAMIC_PS)
                 ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_PS);
@@ -2760,6 +2798,178 @@ static int ieee80211_start_radar_detection(struct wiphy *wiphy,
         return 0;
 }
 
+static struct cfg80211_beacon_data *
+cfg80211_beacon_dup(struct cfg80211_beacon_data *beacon)
+{
+        struct cfg80211_beacon_data *new_beacon;
+        u8 *pos;
+        int len;
+
+        len = beacon->head_len + beacon->tail_len + beacon->beacon_ies_len +
+              beacon->proberesp_ies_len + beacon->assocresp_ies_len +
+              beacon->probe_resp_len;
+
+        new_beacon = kzalloc(sizeof(*new_beacon) + len, GFP_KERNEL);
+        if (!new_beacon)
+                return NULL;
+
+        pos = (u8 *)(new_beacon + 1);
+        if (beacon->head_len) {
+                new_beacon->head_len = beacon->head_len;
+                new_beacon->head = pos;
+                memcpy(pos, beacon->head, beacon->head_len);
+                pos += beacon->head_len;
+        }
+        if (beacon->tail_len) {
+                new_beacon->tail_len = beacon->tail_len;
+                new_beacon->tail = pos;
+                memcpy(pos, beacon->tail, beacon->tail_len);
+                pos += beacon->tail_len;
+        }
+        if (beacon->beacon_ies_len) {
+                new_beacon->beacon_ies_len = beacon->beacon_ies_len;
+                new_beacon->beacon_ies = pos;
+                memcpy(pos, beacon->beacon_ies, beacon->beacon_ies_len);
+                pos += beacon->beacon_ies_len;
+        }
+        if (beacon->proberesp_ies_len) {
+                new_beacon->proberesp_ies_len = beacon->proberesp_ies_len;
+                new_beacon->proberesp_ies = pos;
+                memcpy(pos, beacon->proberesp_ies, beacon->proberesp_ies_len);
+                pos += beacon->proberesp_ies_len;
+        }
+        if (beacon->assocresp_ies_len) {
+                new_beacon->assocresp_ies_len = beacon->assocresp_ies_len;
+                new_beacon->assocresp_ies = pos;
+                memcpy(pos, beacon->assocresp_ies, beacon->assocresp_ies_len);
+                pos += beacon->assocresp_ies_len;
+        }
+        if (beacon->probe_resp_len) {
+                new_beacon->probe_resp_len = beacon->probe_resp_len;
+                beacon->probe_resp = pos;
+                memcpy(pos, beacon->probe_resp, beacon->probe_resp_len);
+                pos += beacon->probe_resp_len;
+        }
+
+        return new_beacon;
+}
+
+void ieee80211_csa_finalize_work(struct work_struct *work)
+{
+        struct ieee80211_sub_if_data *sdata =
+                container_of(work, struct ieee80211_sub_if_data,
+                             csa_finalize_work);
+        struct ieee80211_local *local = sdata->local;
+        int err, changed;
+
+        if (!ieee80211_sdata_running(sdata))
+                return;
+
+        if (WARN_ON(sdata->vif.type != NL80211_IFTYPE_AP))
+                return;
+
+        sdata->radar_required = sdata->csa_radar_required;
+        err = ieee80211_vif_change_channel(sdata, &local->csa_chandef,
+                                           &changed);
+        if (WARN_ON(err < 0))
+                return;
+
+        err = ieee80211_assign_beacon(sdata, sdata->u.ap.next_beacon);
+        if (err < 0)
+                return;
+
+        changed |= err;
+        kfree(sdata->u.ap.next_beacon);
+        sdata->u.ap.next_beacon = NULL;
+        sdata->vif.csa_active = false;
+
+        ieee80211_wake_queues_by_reason(&sdata->local->hw,
+                                        IEEE80211_MAX_QUEUE_MAP,
+                                        IEEE80211_QUEUE_STOP_REASON_CSA);
+
+        ieee80211_bss_info_change_notify(sdata, changed);
+
+        cfg80211_ch_switch_notify(sdata->dev, &local->csa_chandef);
+}
+
+static int ieee80211_channel_switch(struct wiphy *wiphy, struct net_device *dev,
+                                    struct cfg80211_csa_settings *params)
+{
+        struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
+        struct ieee80211_local *local = sdata->local;
+        struct ieee80211_chanctx_conf *chanctx_conf;
+        struct ieee80211_chanctx *chanctx;
+        int err, num_chanctx;
+
+        if (!list_empty(&local->roc_list) || local->scanning)
+                return -EBUSY;
+
+        if (sdata->wdev.cac_started)
+                return -EBUSY;
+
+        if (cfg80211_chandef_identical(&params->chandef,
+                                       &sdata->vif.bss_conf.chandef))
+                return -EINVAL;
+
+        rcu_read_lock();
+        chanctx_conf = rcu_dereference(sdata->vif.chanctx_conf);
+        if (!chanctx_conf) {
+                rcu_read_unlock();
+                return -EBUSY;
+        }
+
+        /* don't handle for multi-VIF cases */
+        chanctx = container_of(chanctx_conf, struct ieee80211_chanctx, conf);
+        if (chanctx->refcount > 1) {
+                rcu_read_unlock();
+                return -EBUSY;
+        }
+        num_chanctx = 0;
+        list_for_each_entry_rcu(chanctx, &local->chanctx_list, list)
+                num_chanctx++;
+        rcu_read_unlock();
+
+        if (num_chanctx > 1)
+                return -EBUSY;
+
+        /* don't allow another channel switch if one is already active. */
+        if (sdata->vif.csa_active)
+                return -EBUSY;
+
+        /* only handle AP for now. */
+        switch (sdata->vif.type) {
+        case NL80211_IFTYPE_AP:
+                break;
+        default:
+                return -EOPNOTSUPP;
+        }
+
+        sdata->u.ap.next_beacon = cfg80211_beacon_dup(&params->beacon_after);
+        if (!sdata->u.ap.next_beacon)
+                return -ENOMEM;
+
+        sdata->csa_counter_offset_beacon = params->counter_offset_beacon;
+        sdata->csa_counter_offset_presp = params->counter_offset_presp;
+        sdata->csa_radar_required = params->radar_required;
+
+        if (params->block_tx)
+                ieee80211_stop_queues_by_reason(&local->hw,
+                                IEEE80211_MAX_QUEUE_MAP,
+                                IEEE80211_QUEUE_STOP_REASON_CSA);
+
+        err = ieee80211_assign_beacon(sdata, &params->beacon_csa);
+        if (err < 0)
+                return err;
+
+        local->csa_chandef = params->chandef;
+        sdata->vif.csa_active = true;
+
+        ieee80211_bss_info_change_notify(sdata, err);
+        drv_channel_switch_beacon(sdata, &params->chandef);
+
+        return 0;
+}
+
 static int ieee80211_mgmt_tx(struct wiphy *wiphy, struct wireless_dev *wdev,
                              struct ieee80211_channel *chan, bool offchan,
                              unsigned int wait, const u8 *buf, size_t len,
@@ -2803,7 +3013,8 @@ static int ieee80211_mgmt_tx(struct wiphy *wiphy, struct wireless_dev *wdev,
                     !rcu_access_pointer(sdata->bss->beacon))
                         need_offchan = true;
                 if (!ieee80211_is_action(mgmt->frame_control) ||
-                    mgmt->u.action.category == WLAN_CATEGORY_PUBLIC)
+                    mgmt->u.action.category == WLAN_CATEGORY_PUBLIC ||
+                    mgmt->u.action.category == WLAN_CATEGORY_SELF_PROTECTED)
                         break;
                 rcu_read_lock();
                 sta = sta_info_get(sdata, mgmt->da);
@@ -2823,6 +3034,12 @@ static int ieee80211_mgmt_tx(struct wiphy *wiphy, struct wireless_dev *wdev,
                 return -EOPNOTSUPP;
         }
 
+        /* configurations requiring offchan cannot work if no channel has been
+         * specified
+         */
+        if (need_offchan && !chan)
+                return -EINVAL;
+
         mutex_lock(&local->mtx);
 
         /* Check if the operating channel is the requested channel */
@@ -2832,10 +3049,15 @@ static int ieee80211_mgmt_tx(struct wiphy *wiphy, struct wireless_dev *wdev,
                 rcu_read_lock();
                 chanctx_conf = rcu_dereference(sdata->vif.chanctx_conf);
 
-                if (chanctx_conf)
-                        need_offchan = chan != chanctx_conf->def.chan;
-                else
+                if (chanctx_conf) {
+                        need_offchan = chan && (chan != chanctx_conf->def.chan);
+                } else if (!chan) {
+                        ret = -EINVAL;
+                        rcu_read_unlock();
+                        goto out_unlock;
+                } else {
                         need_offchan = true;
+                }
                 rcu_read_unlock();
         }
 
@@ -2895,19 +3117,8 @@ static void ieee80211_mgmt_frame_register(struct wiphy *wiphy,
                                           u16 frame_type, bool reg)
 {
         struct ieee80211_local *local = wiphy_priv(wiphy);
-        struct ieee80211_sub_if_data *sdata = IEEE80211_WDEV_TO_SUB_IF(wdev);
 
         switch (frame_type) {
-        case IEEE80211_FTYPE_MGMT | IEEE80211_STYPE_AUTH:
-                if (sdata->vif.type == NL80211_IFTYPE_ADHOC) {
-                        struct ieee80211_if_ibss *ifibss = &sdata->u.ibss;
-
-                        if (reg)
-                                ifibss->auth_frame_registrations++;
-                        else
-                                ifibss->auth_frame_registrations--;
-                }
-                break;
         case IEEE80211_FTYPE_MGMT | IEEE80211_STYPE_PROBE_REQ:
                 if (reg)
                         local->probe_req_reg++;
@@ -3476,4 +3687,5 @@ struct cfg80211_ops mac80211_config_ops = {
         .get_et_strings = ieee80211_get_et_strings,
         .get_channel = ieee80211_cfg_get_channel,
         .start_radar_detection = ieee80211_start_radar_detection,
+        .channel_switch = ieee80211_channel_switch,
 };
diff --git a/net/mac80211/chan.c b/net/mac80211/chan.c
index 03e8d2e3270e..3a4764b2869e 100644
--- a/net/mac80211/chan.c
+++ b/net/mac80211/chan.c
@@ -410,6 +410,64 @@ int ieee80211_vif_use_channel(struct ieee80211_sub_if_data *sdata,
         return ret;
 }
 
+int ieee80211_vif_change_channel(struct ieee80211_sub_if_data *sdata,
+                                 const struct cfg80211_chan_def *chandef,
+                                 u32 *changed)
+{
+        struct ieee80211_local *local = sdata->local;
+        struct ieee80211_chanctx_conf *conf;
+        struct ieee80211_chanctx *ctx;
+        int ret;
+        u32 chanctx_changed = 0;
+
+        /* should never be called if not performing a channel switch. */
+        if (WARN_ON(!sdata->vif.csa_active))
+                return -EINVAL;
+
+        if (!cfg80211_chandef_usable(sdata->local->hw.wiphy, chandef,
+                                     IEEE80211_CHAN_DISABLED))
+                return -EINVAL;
+
+        mutex_lock(&local->chanctx_mtx);
+        conf = rcu_dereference_protected(sdata->vif.chanctx_conf,
+                                         lockdep_is_held(&local->chanctx_mtx));
+        if (!conf) {
+                ret = -EINVAL;
+                goto out;
+        }
+
+        ctx = container_of(conf, struct ieee80211_chanctx, conf);
+        if (ctx->refcount != 1) {
+                ret = -EINVAL;
+                goto out;
+        }
+
+        if (sdata->vif.bss_conf.chandef.width != chandef->width) {
+                chanctx_changed = IEEE80211_CHANCTX_CHANGE_WIDTH;
+                *changed |= BSS_CHANGED_BANDWIDTH;
+        }
+
+        sdata->vif.bss_conf.chandef = *chandef;
+        ctx->conf.def = *chandef;
+
+        chanctx_changed |= IEEE80211_CHANCTX_CHANGE_CHANNEL;
+        drv_change_chanctx(local, ctx, chanctx_changed);
+
+        if (!local->use_chanctx) {
+                local->_oper_chandef = *chandef;
+                ieee80211_hw_config(local, 0);
+        }
+
+        ieee80211_recalc_chanctx_chantype(local, ctx);
+        ieee80211_recalc_smps_chanctx(local, ctx);
+        ieee80211_recalc_radar_chanctx(local, ctx);
+
+        ret = 0;
+ out:
+        mutex_unlock(&local->chanctx_mtx);
+        return ret;
+}
+
 int ieee80211_vif_change_bandwidth(struct ieee80211_sub_if_data *sdata,
                                    const struct cfg80211_chan_def *chandef,
                                    u32 *changed)
diff --git a/net/mac80211/debugfs_netdev.c b/net/mac80211/debugfs_netdev.c
index 14abcf44f974..cafe614ef93d 100644
--- a/net/mac80211/debugfs_netdev.c
+++ b/net/mac80211/debugfs_netdev.c
@@ -228,9 +228,9 @@ static int ieee80211_set_smps(struct ieee80211_sub_if_data *sdata,
         if (sdata->vif.type != NL80211_IFTYPE_STATION)
                 return -EOPNOTSUPP;
 
-        mutex_lock(&sdata->u.mgd.mtx);
+        sdata_lock(sdata);
         err = __ieee80211_request_smps(sdata, smps_mode);
-        mutex_unlock(&sdata->u.mgd.mtx);
+        sdata_unlock(sdata);
 
         return err;
 }
@@ -313,16 +313,16 @@ static ssize_t ieee80211_if_parse_tkip_mic_test(
         case NL80211_IFTYPE_STATION:
                 fc |= cpu_to_le16(IEEE80211_FCTL_TODS);
                 /* BSSID SA DA */
-                mutex_lock(&sdata->u.mgd.mtx);
+                sdata_lock(sdata);
                 if (!sdata->u.mgd.associated) {
-                        mutex_unlock(&sdata->u.mgd.mtx);
+                        sdata_unlock(sdata);
                         dev_kfree_skb(skb);
                         return -ENOTCONN;
                 }
                 memcpy(hdr->addr1, sdata->u.mgd.associated->bssid, ETH_ALEN);
                 memcpy(hdr->addr2, sdata->vif.addr, ETH_ALEN);
                 memcpy(hdr->addr3, addr, ETH_ALEN);
-                mutex_unlock(&sdata->u.mgd.mtx);
+                sdata_unlock(sdata);
                 break;
         default:
                 dev_kfree_skb(skb);
@@ -471,6 +471,8 @@ __IEEE80211_IF_FILE_W(tsf);
 IEEE80211_IF_FILE(peer, u.wds.remote_addr, MAC);
 
 #ifdef CONFIG_MAC80211_MESH
+IEEE80211_IF_FILE(estab_plinks, u.mesh.estab_plinks, ATOMIC);
+
 /* Mesh stats attributes */
 IEEE80211_IF_FILE(fwded_mcast, u.mesh.mshstats.fwded_mcast, DEC);
 IEEE80211_IF_FILE(fwded_unicast, u.mesh.mshstats.fwded_unicast, DEC);
@@ -480,7 +482,6 @@ IEEE80211_IF_FILE(dropped_frames_congestion,
                   u.mesh.mshstats.dropped_frames_congestion, DEC);
 IEEE80211_IF_FILE(dropped_frames_no_route,
                   u.mesh.mshstats.dropped_frames_no_route, DEC);
-IEEE80211_IF_FILE(estab_plinks, u.mesh.estab_plinks, ATOMIC);
 
 /* Mesh parameters */
 IEEE80211_IF_FILE(dot11MeshMaxRetries,
@@ -583,6 +584,7 @@ static void add_wds_files(struct ieee80211_sub_if_data *sdata)
 static void add_mesh_files(struct ieee80211_sub_if_data *sdata)
 {
         DEBUGFS_ADD_MODE(tsf, 0600);
+        DEBUGFS_ADD_MODE(estab_plinks, 0400);
 }
 
 static void add_mesh_stats(struct ieee80211_sub_if_data *sdata)
@@ -598,7 +600,6 @@ static void add_mesh_stats(struct ieee80211_sub_if_data *sdata)
         MESHSTATS_ADD(dropped_frames_ttl);
         MESHSTATS_ADD(dropped_frames_no_route);
         MESHSTATS_ADD(dropped_frames_congestion);
-        MESHSTATS_ADD(estab_plinks);
 #undef MESHSTATS_ADD
 }
 
diff --git a/net/mac80211/debugfs_sta.c b/net/mac80211/debugfs_sta.c
index 44e201d60a13..19c54a44ed47 100644
--- a/net/mac80211/debugfs_sta.c
+++ b/net/mac80211/debugfs_sta.c
@@ -455,6 +455,15 @@ void ieee80211_sta_debugfs_add(struct sta_info *sta)
         DEBUGFS_ADD_COUNTER(tx_retry_count, tx_retry_count);
         DEBUGFS_ADD_COUNTER(wep_weak_iv_count, wep_weak_iv_count);
 
+        if (sizeof(sta->driver_buffered_tids) == sizeof(u32))
+                debugfs_create_x32("driver_buffered_tids", 0400,
+                                   sta->debugfs.dir,
+                                   (u32 *)&sta->driver_buffered_tids);
+        else
+                debugfs_create_x64("driver_buffered_tids", 0400,
+                                   sta->debugfs.dir,
+                                   (u64 *)&sta->driver_buffered_tids);
+
         drv_sta_add_debugfs(local, sdata, &sta->sta, sta->debugfs.dir);
 }
 
diff --git a/net/mac80211/driver-ops.h b/net/mac80211/driver-ops.h
index 169664c122e2..b3ea11f3d526 100644
--- a/net/mac80211/driver-ops.h
+++ b/net/mac80211/driver-ops.h
@@ -146,7 +146,8 @@ static inline int drv_add_interface(struct ieee80211_local *local,
 
         if (WARN_ON(sdata->vif.type == NL80211_IFTYPE_AP_VLAN ||
                     (sdata->vif.type == NL80211_IFTYPE_MONITOR &&
-                     !(local->hw.flags & IEEE80211_HW_WANT_MONITOR_VIF))))
+                     !(local->hw.flags & IEEE80211_HW_WANT_MONITOR_VIF) &&
+                     !(sdata->u.mntr_flags & MONITOR_FLAG_ACTIVE))))
                 return -EINVAL;
 
         trace_drv_add_interface(local, sdata);
@@ -1071,4 +1072,17 @@ static inline void drv_ipv6_addr_change(struct ieee80211_local *local,
 }
 #endif
 
+static inline void
+drv_channel_switch_beacon(struct ieee80211_sub_if_data *sdata,
+                          struct cfg80211_chan_def *chandef)
+{
+        struct ieee80211_local *local = sdata->local;
+
+        if (local->ops->channel_switch_beacon) {
+                trace_drv_channel_switch_beacon(local, sdata, chandef);
+                local->ops->channel_switch_beacon(&local->hw, &sdata->vif,
+                                                  chandef);
+        }
+}
+
 #endif /* __MAC80211_DRIVER_OPS */
diff --git a/net/mac80211/ht.c b/net/mac80211/ht.c
index af8cee06e4f3..529bf58bc145 100644
--- a/net/mac80211/ht.c
+++ b/net/mac80211/ht.c
@@ -19,13 +19,14 @@
 #include "ieee80211_i.h"
 #include "rate.h"
 
-static void __check_htcap_disable(struct ieee80211_sub_if_data *sdata,
+static void __check_htcap_disable(struct ieee80211_ht_cap *ht_capa,
+                                  struct ieee80211_ht_cap *ht_capa_mask,
                                   struct ieee80211_sta_ht_cap *ht_cap,
                                   u16 flag)
 {
         __le16 le_flag = cpu_to_le16(flag);
-        if (sdata->u.mgd.ht_capa_mask.cap_info & le_flag) {
-                if (!(sdata->u.mgd.ht_capa.cap_info & le_flag))
+        if (ht_capa_mask->cap_info & le_flag) {
+                if (!(ht_capa->cap_info & le_flag))
                         ht_cap->cap &= ~flag;
         }
 }
@@ -33,13 +34,30 @@ static void __check_htcap_disable(struct ieee80211_sub_if_data *sdata,
 void ieee80211_apply_htcap_overrides(struct ieee80211_sub_if_data *sdata,
                                      struct ieee80211_sta_ht_cap *ht_cap)
 {
-        u8 *scaps = (u8 *)(&sdata->u.mgd.ht_capa.mcs.rx_mask);
-        u8 *smask = (u8 *)(&sdata->u.mgd.ht_capa_mask.mcs.rx_mask);
+        struct ieee80211_ht_cap *ht_capa, *ht_capa_mask;
+        u8 *scaps, *smask;
         int i;
 
         if (!ht_cap->ht_supported)
                 return;
 
+        switch (sdata->vif.type) {
+        case NL80211_IFTYPE_STATION:
+                ht_capa = &sdata->u.mgd.ht_capa;
+                ht_capa_mask = &sdata->u.mgd.ht_capa_mask;
+                break;
+        case NL80211_IFTYPE_ADHOC:
+                ht_capa = &sdata->u.ibss.ht_capa;
+                ht_capa_mask = &sdata->u.ibss.ht_capa_mask;
+                break;
+        default:
+                WARN_ON_ONCE(1);
+                return;
+        }
+
+        scaps = (u8 *)(&ht_capa->mcs.rx_mask);
+        smask = (u8 *)(&ht_capa_mask->mcs.rx_mask);
+
         /* NOTE:  If you add more over-rides here, update register_hw
          * ht_capa_mod_msk logic in main.c as well.
          * And, if this method can ever change ht_cap.ht_supported, fix
@@ -55,28 +73,32 @@ void ieee80211_apply_htcap_overrides(struct ieee80211_sub_if_data *sdata,
         }
 
         /* Force removal of HT-40 capabilities? */
-        __check_htcap_disable(sdata, ht_cap, IEEE80211_HT_CAP_SUP_WIDTH_20_40);
-        __check_htcap_disable(sdata, ht_cap, IEEE80211_HT_CAP_SGI_40);
+        __check_htcap_disable(ht_capa, ht_capa_mask, ht_cap,
+                              IEEE80211_HT_CAP_SUP_WIDTH_20_40);
+        __check_htcap_disable(ht_capa, ht_capa_mask, ht_cap,
+                              IEEE80211_HT_CAP_SGI_40);
 
         /* Allow user to disable SGI-20 (SGI-40 is handled above) */
-        __check_htcap_disable(sdata, ht_cap, IEEE80211_HT_CAP_SGI_20);
+        __check_htcap_disable(ht_capa, ht_capa_mask, ht_cap,
+                              IEEE80211_HT_CAP_SGI_20);
 
         /* Allow user to disable the max-AMSDU bit. */
-        __check_htcap_disable(sdata, ht_cap, IEEE80211_HT_CAP_MAX_AMSDU);
+        __check_htcap_disable(ht_capa, ht_capa_mask, ht_cap,
+                              IEEE80211_HT_CAP_MAX_AMSDU);
 
         /* Allow user to decrease AMPDU factor */
-        if (sdata->u.mgd.ht_capa_mask.ampdu_params_info &
+        if (ht_capa_mask->ampdu_params_info &
             IEEE80211_HT_AMPDU_PARM_FACTOR) {
-                u8 n = sdata->u.mgd.ht_capa.ampdu_params_info
-                        & IEEE80211_HT_AMPDU_PARM_FACTOR;
+                u8 n = ht_capa->ampdu_params_info &
+                       IEEE80211_HT_AMPDU_PARM_FACTOR;
                 if (n < ht_cap->ampdu_factor)
                         ht_cap->ampdu_factor = n;
         }
 
         /* Allow the user to increase AMPDU density. */
-        if (sdata->u.mgd.ht_capa_mask.ampdu_params_info &
+        if (ht_capa_mask->ampdu_params_info &
             IEEE80211_HT_AMPDU_PARM_DENSITY) {
-                u8 n = (sdata->u.mgd.ht_capa.ampdu_params_info &
+                u8 n = (ht_capa->ampdu_params_info &
                         IEEE80211_HT_AMPDU_PARM_DENSITY)
                         >> IEEE80211_HT_AMPDU_PARM_DENSITY_SHIFT;
                 if (n > ht_cap->ampdu_density)
@@ -112,7 +134,8 @@ bool ieee80211_ht_cap_ie_to_sta_ht_cap(struct ieee80211_sub_if_data *sdata,
          * we advertised a restricted capability set to. Override
          * our own capabilities and then use those below.
          */
-        if (sdata->vif.type == NL80211_IFTYPE_STATION &&
+        if ((sdata->vif.type == NL80211_IFTYPE_STATION ||
+             sdata->vif.type == NL80211_IFTYPE_ADHOC) &&
             !test_sta_flag(sta, WLAN_STA_TDLS_PEER))
                 ieee80211_apply_htcap_overrides(sdata, &own_cap);
 
@@ -281,13 +304,14 @@ void ieee80211_ba_session_work(struct work_struct *work)
                                 sta, tid, WLAN_BACK_RECIPIENT,
                                 WLAN_REASON_UNSPECIFIED, true);
 
+                spin_lock_bh(&sta->lock);
+
                 tid_tx = sta->ampdu_mlme.tid_start_tx[tid];
                 if (tid_tx) {
                         /*
                          * Assign it over to the normal tid_tx array
                          * where it "goes live".
                          */
-                        spin_lock_bh(&sta->lock);
 
                         sta->ampdu_mlme.tid_start_tx[tid] = NULL;
                         /* could there be a race? */
@@ -300,6 +324,7 @@ void ieee80211_ba_session_work(struct work_struct *work)
                         ieee80211_tx_ba_session_handle_start(sta, tid);
                         continue;
                 }
+                spin_unlock_bh(&sta->lock);
 
                 tid_tx = rcu_dereference_protected_tid_tx(sta, tid);
                 if (tid_tx && test_and_clear_bit(HT_AGG_STATE_WANT_STOP,
@@ -429,9 +454,9 @@ void ieee80211_request_smps_work(struct work_struct *work)
                 container_of(work, struct ieee80211_sub_if_data,
                              u.mgd.request_smps_work);
 
-        mutex_lock(&sdata->u.mgd.mtx);
+        sdata_lock(sdata);
         __ieee80211_request_smps(sdata, sdata->u.mgd.driver_smps_mode);
-        mutex_unlock(&sdata->u.mgd.mtx);
+        sdata_unlock(sdata);
 }
 
 void ieee80211_request_smps(struct ieee80211_vif *vif,
diff --git a/net/mac80211/ibss.c b/net/mac80211/ibss.c
index 170f9a7fa319..a12afe77bb26 100644
--- a/net/mac80211/ibss.c
+++ b/net/mac80211/ibss.c
@@ -30,75 +30,27 @@
 
 #define IEEE80211_IBSS_MERGE_INTERVAL (30 * HZ)
 #define IEEE80211_IBSS_INACTIVITY_LIMIT (60 * HZ)
+#define IEEE80211_IBSS_RSN_INACTIVITY_LIMIT (10 * HZ)
 
 #define IEEE80211_IBSS_MAX_STA_ENTRIES 128
 
-
-static void __ieee80211_sta_join_ibss(struct ieee80211_sub_if_data *sdata,
-                                      const u8 *bssid, const int beacon_int,
-                                      struct ieee80211_channel *chan,
-                                      const u32 basic_rates,
-                                      const u16 capability, u64 tsf,
-                                      bool creator)
+static struct beacon_data *
+ieee80211_ibss_build_presp(struct ieee80211_sub_if_data *sdata,
+                           const int beacon_int, const u32 basic_rates,
+                           const u16 capability, u64 tsf,
+                           struct cfg80211_chan_def *chandef,
+                           bool *have_higher_than_11mbit)
 {
         struct ieee80211_if_ibss *ifibss = &sdata->u.ibss;
         struct ieee80211_local *local = sdata->local;
-        int rates, i;
+        int rates_n = 0, i, ri;
         struct ieee80211_mgmt *mgmt;
         u8 *pos;
         struct ieee80211_supported_band *sband;
-        struct cfg80211_bss *bss;
-        u32 bss_change;
-        u8 supp_rates[IEEE80211_MAX_SUPP_RATES];
-        struct cfg80211_chan_def chandef;
+        u32 rate_flags, rates = 0, rates_added = 0;
         struct beacon_data *presp;
         int frame_len;
-
-        lockdep_assert_held(&ifibss->mtx);
-
-        /* Reset own TSF to allow time synchronization work. */
-        drv_reset_tsf(local, sdata);
-
-        if (!ether_addr_equal(ifibss->bssid, bssid))
-                sta_info_flush(sdata);
-
-        /* if merging, indicate to driver that we leave the old IBSS */
-        if (sdata->vif.bss_conf.ibss_joined) {
-                sdata->vif.bss_conf.ibss_joined = false;
-                sdata->vif.bss_conf.ibss_creator = false;
-                sdata->vif.bss_conf.enable_beacon = false;
-                netif_carrier_off(sdata->dev);
-                ieee80211_bss_info_change_notify(sdata,
-                                                 BSS_CHANGED_IBSS |
-                                                 BSS_CHANGED_BEACON_ENABLED);
-        }
-
-        presp = rcu_dereference_protected(ifibss->presp,
-                                          lockdep_is_held(&ifibss->mtx));
-        rcu_assign_pointer(ifibss->presp, NULL);
-        if (presp)
-                kfree_rcu(presp, rcu_head);
-
-        sdata->drop_unencrypted = capability & WLAN_CAPABILITY_PRIVACY ? 1 : 0;
-
-        cfg80211_chandef_create(&chandef, chan, ifibss->channel_type);
-        if (!cfg80211_reg_can_beacon(local->hw.wiphy, &chandef)) {
-                chandef.width = NL80211_CHAN_WIDTH_20;
-                chandef.center_freq1 = chan->center_freq;
-        }
-
-        ieee80211_vif_release_channel(sdata);
-        if (ieee80211_vif_use_channel(sdata, &chandef,
-                                      ifibss->fixed_channel ?
-                                        IEEE80211_CHANCTX_SHARED :
-                                        IEEE80211_CHANCTX_EXCLUSIVE)) {
-                sdata_info(sdata, "Failed to join IBSS, no channel context\n");
-                return;
-        }
-
-        memcpy(ifibss->bssid, bssid, ETH_ALEN);
-
-        sband = local->hw.wiphy->bands[chan->band];
+        int shift;
 
         /* Build IBSS probe response */
         frame_len = sizeof(struct ieee80211_hdr_3addr) +
@@ -113,7 +65,7 @@ static void __ieee80211_sta_join_ibss(struct ieee80211_sub_if_data *sdata,
                     ifibss->ie_len;
         presp = kzalloc(sizeof(*presp) + frame_len, GFP_KERNEL);
         if (!presp)
-                return;
+                return NULL;
 
         presp->head = (void *)(presp + 1);
 
@@ -134,21 +86,47 @@ static void __ieee80211_sta_join_ibss(struct ieee80211_sub_if_data *sdata,
         memcpy(pos, ifibss->ssid, ifibss->ssid_len);
         pos += ifibss->ssid_len;
 
-        rates = min_t(int, 8, sband->n_bitrates);
+        sband = local->hw.wiphy->bands[chandef->chan->band];
+        rate_flags = ieee80211_chandef_rate_flags(chandef);
+        shift = ieee80211_chandef_get_shift(chandef);
+        rates_n = 0;
+        if (have_higher_than_11mbit)
+                *have_higher_than_11mbit = false;
+
+        for (i = 0; i < sband->n_bitrates; i++) {
+                if ((rate_flags & sband->bitrates[i].flags) != rate_flags)
+                        continue;
+                if (sband->bitrates[i].bitrate > 110 &&
+                    have_higher_than_11mbit)
+                        *have_higher_than_11mbit = true;
+
+                rates |= BIT(i);
+                rates_n++;
+        }
+
         *pos++ = WLAN_EID_SUPP_RATES;
-        *pos++ = rates;
-        for (i = 0; i < rates; i++) {
-                int rate = sband->bitrates[i].bitrate;
+        *pos++ = min_t(int, 8, rates_n);
+        for (ri = 0; ri < sband->n_bitrates; ri++) {
+                int rate = DIV_ROUND_UP(sband->bitrates[ri].bitrate,
+                                        5 * (1 << shift));
                 u8 basic = 0;
-                if (basic_rates & BIT(i))
+                if (!(rates & BIT(ri)))
+                        continue;
+
+                if (basic_rates & BIT(ri))
                         basic = 0x80;
-                *pos++ = basic | (u8) (rate / 5);
+                *pos++ = basic | (u8) rate;
+                if (++rates_added == 8) {
+                        ri++; /* continue at next rate for EXT_SUPP_RATES */
+                        break;
+                }
         }
 
         if (sband->band == IEEE80211_BAND_2GHZ) {
                 *pos++ = WLAN_EID_DS_PARAMS;
                 *pos++ = 1;
-                *pos++ = ieee80211_frequency_to_channel(chan->center_freq);
+                *pos++ = ieee80211_frequency_to_channel(
+                                chandef->chan->center_freq);
         }
 
         *pos++ = WLAN_EID_IBSS_PARAMS;
@@ -157,15 +135,20 @@ static void __ieee80211_sta_join_ibss(struct ieee80211_sub_if_data *sdata,
         *pos++ = 0;
         *pos++ = 0;
 
-        if (sband->n_bitrates > 8) {
+        /* put the remaining rates in WLAN_EID_EXT_SUPP_RATES */
+        if (rates_n > 8) {
                 *pos++ = WLAN_EID_EXT_SUPP_RATES;
-                *pos++ = sband->n_bitrates - 8;
-                for (i = 8; i < sband->n_bitrates; i++) {
-                        int rate = sband->bitrates[i].bitrate;
+                *pos++ = rates_n - 8;
+                for (; ri < sband->n_bitrates; ri++) {
+                        int rate = DIV_ROUND_UP(sband->bitrates[ri].bitrate,
+                                                5 * (1 << shift));
                         u8 basic = 0;
-                        if (basic_rates & BIT(i))
+                        if (!(rates & BIT(ri)))
+                                continue;
+
+                        if (basic_rates & BIT(ri))
                                 basic = 0x80;
-                        *pos++ = basic | (u8) (rate / 5);
+                        *pos++ = basic | (u8) rate;
                 }
         }
 
@@ -175,17 +158,23 @@ static void __ieee80211_sta_join_ibss(struct ieee80211_sub_if_data *sdata,
         }
 
         /* add HT capability and information IEs */
-        if (chandef.width != NL80211_CHAN_WIDTH_20_NOHT &&
+        if (chandef->width != NL80211_CHAN_WIDTH_20_NOHT &&
+            chandef->width != NL80211_CHAN_WIDTH_5 &&
+            chandef->width != NL80211_CHAN_WIDTH_10 &&
             sband->ht_cap.ht_supported) {
-                pos = ieee80211_ie_build_ht_cap(pos, &sband->ht_cap,
-                                                sband->ht_cap.cap);
+                struct ieee80211_sta_ht_cap ht_cap;
+
+                memcpy(&ht_cap, &sband->ht_cap, sizeof(ht_cap));
+                ieee80211_apply_htcap_overrides(sdata, &ht_cap);
+
+                pos = ieee80211_ie_build_ht_cap(pos, &ht_cap, ht_cap.cap);
                 /*
                  * Note: According to 802.11n-2009 9.13.3.1, HT Protection
                  * field and RIFS Mode are reserved in IBSS mode, therefore
                  * keep them at 0
                  */
                 pos = ieee80211_ie_build_ht_oper(pos, &sband->ht_cap,
-                                                 &chandef, 0);
+                                                 chandef, 0);
         }
 
         if (local->hw.queues >= IEEE80211_NUM_ACS) {
@@ -202,9 +191,97 @@ static void __ieee80211_sta_join_ibss(struct ieee80211_sub_if_data *sdata,
 
         presp->head_len = pos - presp->head;
         if (WARN_ON(presp->head_len > frame_len))
+                goto error;
+
+        return presp;
+error:
+        kfree(presp);
+        return NULL;
+}
+
+static void __ieee80211_sta_join_ibss(struct ieee80211_sub_if_data *sdata,
+                                      const u8 *bssid, const int beacon_int,
+                                      struct cfg80211_chan_def *req_chandef,
+                                      const u32 basic_rates,
+                                      const u16 capability, u64 tsf,
+                                      bool creator)
+{
+        struct ieee80211_if_ibss *ifibss = &sdata->u.ibss;
+        struct ieee80211_local *local = sdata->local;
+        struct ieee80211_supported_band *sband;
+        struct ieee80211_mgmt *mgmt;
+        struct cfg80211_bss *bss;
+        u32 bss_change;
+        struct cfg80211_chan_def chandef;
+        struct ieee80211_channel *chan;
+        struct beacon_data *presp;
+        enum nl80211_bss_scan_width scan_width;
+        bool have_higher_than_11mbit;
+
+        sdata_assert_lock(sdata);
+
+        /* Reset own TSF to allow time synchronization work. */
+        drv_reset_tsf(local, sdata);
+
+        if (!ether_addr_equal(ifibss->bssid, bssid))
+                sta_info_flush(sdata);
+
+        /* if merging, indicate to driver that we leave the old IBSS */
+        if (sdata->vif.bss_conf.ibss_joined) {
+                sdata->vif.bss_conf.ibss_joined = false;
+                sdata->vif.bss_conf.ibss_creator = false;
+                sdata->vif.bss_conf.enable_beacon = false;
+                netif_carrier_off(sdata->dev);
+                ieee80211_bss_info_change_notify(sdata,
+                                                 BSS_CHANGED_IBSS |
+                                                 BSS_CHANGED_BEACON_ENABLED);
+        }
+
+        presp = rcu_dereference_protected(ifibss->presp,
+                                          lockdep_is_held(&sdata->wdev.mtx));
+        rcu_assign_pointer(ifibss->presp, NULL);
+        if (presp)
+                kfree_rcu(presp, rcu_head);
+
+        sdata->drop_unencrypted = capability & WLAN_CAPABILITY_PRIVACY ? 1 : 0;
+
+        /* make a copy of the chandef, it could be modified below. */
+        chandef = *req_chandef;
+        chan = chandef.chan;
+        if (!cfg80211_reg_can_beacon(local->hw.wiphy, &chandef)) {
+                if (chandef.width == NL80211_CHAN_WIDTH_5 ||
+                    chandef.width == NL80211_CHAN_WIDTH_10 ||
+                    chandef.width == NL80211_CHAN_WIDTH_20_NOHT ||
+                    chandef.width == NL80211_CHAN_WIDTH_20) {
+                        sdata_info(sdata,
+                                   "Failed to join IBSS, beacons forbidden\n");
+                        return;
+                }
+                chandef.width = NL80211_CHAN_WIDTH_20;
+                chandef.center_freq1 = chan->center_freq;
+        }
+
+        ieee80211_vif_release_channel(sdata);
+        if (ieee80211_vif_use_channel(sdata, &chandef,
+                                      ifibss->fixed_channel ?
+                                        IEEE80211_CHANCTX_SHARED :
+                                        IEEE80211_CHANCTX_EXCLUSIVE)) {
+                sdata_info(sdata, "Failed to join IBSS, no channel context\n");
+                return;
+        }
+
+        memcpy(ifibss->bssid, bssid, ETH_ALEN);
+
+        sband = local->hw.wiphy->bands[chan->band];
+
+        presp = ieee80211_ibss_build_presp(sdata, beacon_int, basic_rates,
+                                           capability, tsf, &chandef,
+                                           &have_higher_than_11mbit);
+        if (!presp)
                 return;
 
         rcu_assign_pointer(ifibss->presp, presp);
+        mgmt = (void *)presp->head;
 
         sdata->vif.bss_conf.enable_beacon = true;
         sdata->vif.bss_conf.beacon_int = beacon_int;
@@ -234,18 +311,26 @@ static void __ieee80211_sta_join_ibss(struct ieee80211_sub_if_data *sdata,
         sdata->vif.bss_conf.use_short_slot = chan->band == IEEE80211_BAND_5GHZ;
         bss_change |= BSS_CHANGED_ERP_SLOT;
 
+        /* cf. IEEE 802.11 9.2.12 */
+        if (chan->band == IEEE80211_BAND_2GHZ && have_higher_than_11mbit)
+                sdata->flags |= IEEE80211_SDATA_OPERATING_GMODE;
+        else
+                sdata->flags &= ~IEEE80211_SDATA_OPERATING_GMODE;
+
         sdata->vif.bss_conf.ibss_joined = true;
         sdata->vif.bss_conf.ibss_creator = creator;
         ieee80211_bss_info_change_notify(sdata, bss_change);
 
-        ieee80211_sta_def_wmm_params(sdata, sband->n_bitrates, supp_rates);
+        ieee80211_set_wmm_default(sdata, true);
 
         ifibss->state = IEEE80211_IBSS_MLME_JOINED;
         mod_timer(&ifibss->timer,
                   round_jiffies(jiffies + IEEE80211_IBSS_MERGE_INTERVAL));
 
-        bss = cfg80211_inform_bss_frame(local->hw.wiphy, chan,
-                                        mgmt, presp->head_len, 0, GFP_KERNEL);
+        scan_width = cfg80211_chandef_to_scan_width(&chandef);
+        bss = cfg80211_inform_bss_width_frame(local->hw.wiphy, chan,
+                                              scan_width, mgmt,
+                                              presp->head_len, 0, GFP_KERNEL);
         cfg80211_put_bss(local->hw.wiphy, bss);
         netif_carrier_on(sdata->dev);
         cfg80211_ibss_joined(sdata->dev, ifibss->bssid, GFP_KERNEL);
@@ -257,27 +342,60 @@ static void ieee80211_sta_join_ibss(struct ieee80211_sub_if_data *sdata,
         struct cfg80211_bss *cbss =
                 container_of((void *)bss, struct cfg80211_bss, priv);
         struct ieee80211_supported_band *sband;
+        struct cfg80211_chan_def chandef;
         u32 basic_rates;
         int i, j;
         u16 beacon_int = cbss->beacon_interval;
         const struct cfg80211_bss_ies *ies;
+        enum nl80211_channel_type chan_type;
         u64 tsf;
+        u32 rate_flags;
+        int shift;
 
-        lockdep_assert_held(&sdata->u.ibss.mtx);
+        sdata_assert_lock(sdata);
 
         if (beacon_int < 10)
                 beacon_int = 10;
 
+        switch (sdata->u.ibss.chandef.width) {
+        case NL80211_CHAN_WIDTH_20_NOHT:
+        case NL80211_CHAN_WIDTH_20:
+        case NL80211_CHAN_WIDTH_40:
+                chan_type = cfg80211_get_chandef_type(&sdata->u.ibss.chandef);
+                cfg80211_chandef_create(&chandef, cbss->channel, chan_type);
+                break;
+        case NL80211_CHAN_WIDTH_5:
+        case NL80211_CHAN_WIDTH_10:
+                cfg80211_chandef_create(&chandef, cbss->channel,
+                                        NL80211_CHAN_WIDTH_20_NOHT);
+                chandef.width = sdata->u.ibss.chandef.width;
+                break;
+        default:
+                /* fall back to 20 MHz for unsupported modes */
+                cfg80211_chandef_create(&chandef, cbss->channel,
+                                        NL80211_CHAN_WIDTH_20_NOHT);
+                break;
+        }
+
         sband = sdata->local->hw.wiphy->bands[cbss->channel->band];
+        rate_flags = ieee80211_chandef_rate_flags(&sdata->u.ibss.chandef);
+        shift = ieee80211_vif_get_shift(&sdata->vif);
 
         basic_rates = 0;
 
         for (i = 0; i < bss->supp_rates_len; i++) {
-                int rate = (bss->supp_rates[i] & 0x7f) * 5;
+                int rate = bss->supp_rates[i] & 0x7f;
                 bool is_basic = !!(bss->supp_rates[i] & 0x80);
 
                 for (j = 0; j < sband->n_bitrates; j++) {
-                        if (sband->bitrates[j].bitrate == rate) {
+                        int brate;
+                        if ((rate_flags & sband->bitrates[j].flags)
+                            != rate_flags)
+                                continue;
+
+                        brate = DIV_ROUND_UP(sband->bitrates[j].bitrate,
+                                             5 * (1 << shift));
+                        if (brate == rate) {
                                 if (is_basic)
                                         basic_rates |= BIT(j);
                                 break;
@@ -292,14 +410,13 @@ static void ieee80211_sta_join_ibss(struct ieee80211_sub_if_data *sdata,
 
         __ieee80211_sta_join_ibss(sdata, cbss->bssid,
                                   beacon_int,
-                                  cbss->channel,
+                                  &chandef,
                                   basic_rates,
                                   cbss->capability,
                                   tsf, false);
 }
 
-static struct sta_info *ieee80211_ibss_finish_sta(struct sta_info *sta,
-                                                  bool auth)
+static struct sta_info *ieee80211_ibss_finish_sta(struct sta_info *sta)
         __acquires(RCU)
 {
         struct ieee80211_sub_if_data *sdata = sta->sdata;
@@ -321,26 +438,20 @@ static struct sta_info *ieee80211_ibss_finish_sta(struct sta_info *sta,
         /* If it fails, maybe we raced another insertion? */
         if (sta_info_insert_rcu(sta))
                 return sta_info_get(sdata, addr);
-        if (auth && !sdata->u.ibss.auth_frame_registrations) {
-                ibss_dbg(sdata,
-                         "TX Auth SA=%pM DA=%pM BSSID=%pM (auth_transaction=1)\n",
-                         sdata->vif.addr, addr, sdata->u.ibss.bssid);
-                ieee80211_send_auth(sdata, 1, WLAN_AUTH_OPEN, 0, NULL, 0,
-                                    addr, sdata->u.ibss.bssid, NULL, 0, 0, 0);
-        }
         return sta;
 }
 
 static struct sta_info *
-ieee80211_ibss_add_sta(struct ieee80211_sub_if_data *sdata,
-                       const u8 *bssid, const u8 *addr,
-                       u32 supp_rates, bool auth)
+ieee80211_ibss_add_sta(struct ieee80211_sub_if_data *sdata, const u8 *bssid,
+                       const u8 *addr, u32 supp_rates)
         __acquires(RCU)
 {
         struct ieee80211_if_ibss *ifibss = &sdata->u.ibss;
         struct ieee80211_local *local = sdata->local;
         struct sta_info *sta;
         struct ieee80211_chanctx_conf *chanctx_conf;
+        struct ieee80211_supported_band *sband;
+        enum nl80211_bss_scan_width scan_width;
         int band;
 
         /*
@@ -369,6 +480,7 @@ ieee80211_ibss_add_sta(struct ieee80211_sub_if_data *sdata,
         if (WARN_ON_ONCE(!chanctx_conf))
                 return NULL;
         band = chanctx_conf->def.chan->band;
+        scan_width = cfg80211_chandef_to_scan_width(&chanctx_conf->def);
         rcu_read_unlock();
 
         sta = sta_info_alloc(sdata, addr, GFP_KERNEL);
@@ -380,10 +492,11 @@ ieee80211_ibss_add_sta(struct ieee80211_sub_if_data *sdata,
         sta->last_rx = jiffies;
 
         /* make sure mandatory rates are always added */
+        sband = local->hw.wiphy->bands[band];
         sta->sta.supp_rates[band] = supp_rates |
-                        ieee80211_mandatory_rates(local, band);
+                        ieee80211_mandatory_rates(sband, scan_width);
 
-        return ieee80211_ibss_finish_sta(sta, auth);
+        return ieee80211_ibss_finish_sta(sta);
 }
 
 static void ieee80211_rx_mgmt_deauth_ibss(struct ieee80211_sub_if_data *sdata,
@@ -405,10 +518,8 @@ static void ieee80211_rx_mgmt_auth_ibss(struct ieee80211_sub_if_data *sdata,
                                         size_t len)
 {
         u16 auth_alg, auth_transaction;
-        struct sta_info *sta;
-        u8 deauth_frame_buf[IEEE80211_DEAUTH_FRAME_LEN];
 
-        lockdep_assert_held(&sdata->u.ibss.mtx);
+        sdata_assert_lock(sdata);
 
         if (len < 24 + 6)
                 return;
@@ -423,22 +534,6 @@ static void ieee80211_rx_mgmt_auth_ibss(struct ieee80211_sub_if_data *sdata,
         if (auth_alg != WLAN_AUTH_OPEN || auth_transaction != 1)
                 return;
 
-        sta_info_destroy_addr(sdata, mgmt->sa);
-        sta = ieee80211_ibss_add_sta(sdata, mgmt->bssid, mgmt->sa, 0, false);
-        rcu_read_unlock();
-
-        /*
-         * if we have any problem in allocating the new station, we reply with a
-         * DEAUTH frame to tell the other end that we had a problem
-         */
-        if (!sta) {
-                ieee80211_send_deauth_disassoc(sdata, sdata->u.ibss.bssid,
-                                               IEEE80211_STYPE_DEAUTH,
-                                               WLAN_REASON_UNSPECIFIED, true,
-                                               deauth_frame_buf);
-                return;
-        }
-
         /*
          * IEEE 802.11 standard does not require authentication in IBSS
          * networks and most implementations do not seem to use it.
@@ -463,6 +558,7 @@ static void ieee80211_rx_bss_info(struct ieee80211_sub_if_data *sdata,
         u64 beacon_timestamp, rx_timestamp;
         u32 supp_rates = 0;
         enum ieee80211_band band = rx_status->band;
+        enum nl80211_bss_scan_width scan_width;
         struct ieee80211_supported_band *sband = local->hw.wiphy->bands[band];
         bool rates_updated = false;
 
@@ -484,16 +580,22 @@ static void ieee80211_rx_bss_info(struct ieee80211_sub_if_data *sdata,
                 sta = sta_info_get(sdata, mgmt->sa);
 
                 if (elems->supp_rates) {
-                        supp_rates = ieee80211_sta_get_rates(local, elems,
+                        supp_rates = ieee80211_sta_get_rates(sdata, elems,
                                                              band, NULL);
                         if (sta) {
                                 u32 prev_rates;
 
                                 prev_rates = sta->sta.supp_rates[band];
                                 /* make sure mandatory rates are always added */
-                                sta->sta.supp_rates[band] = supp_rates |
-                                        ieee80211_mandatory_rates(local, band);
+                                scan_width = NL80211_BSS_CHAN_WIDTH_20;
+                                if (rx_status->flag & RX_FLAG_5MHZ)
+                                        scan_width = NL80211_BSS_CHAN_WIDTH_5;
+                                if (rx_status->flag & RX_FLAG_10MHZ)
+                                        scan_width = NL80211_BSS_CHAN_WIDTH_10;
 
+                                sta->sta.supp_rates[band] = supp_rates |
+                                        ieee80211_mandatory_rates(sband,
+                                                                  scan_width);
                                 if (sta->sta.supp_rates[band] != prev_rates) {
                                         ibss_dbg(sdata,
                                                  "updated supp_rates set for %pM based on beacon/probe_resp (0x%x -> 0x%x)\n",
@@ -504,7 +606,7 @@ static void ieee80211_rx_bss_info(struct ieee80211_sub_if_data *sdata,
                         } else {
                                 rcu_read_unlock();
                                 sta = ieee80211_ibss_add_sta(sdata, mgmt->bssid,
-                                                mgmt->sa, supp_rates, true);
+                                                mgmt->sa, supp_rates);
                         }
                 }
 
@@ -512,7 +614,9 @@ static void ieee80211_rx_bss_info(struct ieee80211_sub_if_data *sdata,
                         set_sta_flag(sta, WLAN_STA_WME);
 
                 if (sta && elems->ht_operation && elems->ht_cap_elem &&
-                    sdata->u.ibss.channel_type != NL80211_CHAN_NO_HT) {
+                    sdata->u.ibss.chandef.width != NL80211_CHAN_WIDTH_20_NOHT &&
+                    sdata->u.ibss.chandef.width != NL80211_CHAN_WIDTH_5 &&
+                    sdata->u.ibss.chandef.width != NL80211_CHAN_WIDTH_10) {
                         /* we both use HT */
                         struct ieee80211_ht_cap htcap_ie;
                         struct cfg80211_chan_def chandef;
@@ -527,8 +631,8 @@ static void ieee80211_rx_bss_info(struct ieee80211_sub_if_data *sdata,
                          * fall back to HT20 if we don't use or use
                          * the other extension channel
                          */
-                        if (cfg80211_get_chandef_type(&chandef) !=
-                                                sdata->u.ibss.channel_type)
+                        if (chandef.center_freq1 !=
+                            sdata->u.ibss.chandef.center_freq1)
                                 htcap_ie.cap_info &=
                                         cpu_to_le16(~IEEE80211_HT_CAP_SUP_WIDTH_20_40);
 
@@ -567,7 +671,7 @@ static void ieee80211_rx_bss_info(struct ieee80211_sub_if_data *sdata,
 
         /* different channel */
         if (sdata->u.ibss.fixed_channel &&
-            sdata->u.ibss.channel != cbss->channel)
+            sdata->u.ibss.chandef.chan != cbss->channel)
                 goto put_bss;
 
         /* different SSID */
@@ -606,9 +710,9 @@ static void ieee80211_rx_bss_info(struct ieee80211_sub_if_data *sdata,
                          "beacon TSF higher than local TSF - IBSS merge with BSSID %pM\n",
                          mgmt->bssid);
                 ieee80211_sta_join_ibss(sdata, bss);
-                supp_rates = ieee80211_sta_get_rates(local, elems, band, NULL);
+                supp_rates = ieee80211_sta_get_rates(sdata, elems, band, NULL);
                 ieee80211_ibss_add_sta(sdata, mgmt->bssid, mgmt->sa,
-                                       supp_rates, true);
+                                       supp_rates);
                 rcu_read_unlock();
         }
 
@@ -624,6 +728,8 @@ void ieee80211_ibss_rx_no_sta(struct ieee80211_sub_if_data *sdata,
         struct ieee80211_local *local = sdata->local;
         struct sta_info *sta;
         struct ieee80211_chanctx_conf *chanctx_conf;
+        struct ieee80211_supported_band *sband;
+        enum nl80211_bss_scan_width scan_width;
         int band;
 
         /*
@@ -649,6 +755,7 @@ void ieee80211_ibss_rx_no_sta(struct ieee80211_sub_if_data *sdata,
                 return;
         }
         band = chanctx_conf->def.chan->band;
+        scan_width = cfg80211_chandef_to_scan_width(&chanctx_conf->def);
         rcu_read_unlock();
 
         sta = sta_info_alloc(sdata, addr, GFP_ATOMIC);
@@ -658,8 +765,9 @@ void ieee80211_ibss_rx_no_sta(struct ieee80211_sub_if_data *sdata,
         sta->last_rx = jiffies;
 
         /* make sure mandatory rates are always added */
+        sband = local->hw.wiphy->bands[band];
         sta->sta.supp_rates[band] = supp_rates |
-                        ieee80211_mandatory_rates(local, band);
+                        ieee80211_mandatory_rates(sband, scan_width);
 
         spin_lock(&ifibss->incomplete_lock);
         list_add(&sta->list, &ifibss->incomplete_stations);
@@ -673,7 +781,7 @@ static int ieee80211_sta_active_ibss(struct ieee80211_sub_if_data *sdata)
         int active = 0;
         struct sta_info *sta;
 
-        lockdep_assert_held(&sdata->u.ibss.mtx);
+        sdata_assert_lock(sdata);
 
         rcu_read_lock();
 
@@ -691,6 +799,33 @@ static int ieee80211_sta_active_ibss(struct ieee80211_sub_if_data *sdata)
         return active;
 }
 
+static void ieee80211_ibss_sta_expire(struct ieee80211_sub_if_data *sdata)
+{
+        struct ieee80211_local *local = sdata->local;
+        struct sta_info *sta, *tmp;
+        unsigned long exp_time = IEEE80211_IBSS_INACTIVITY_LIMIT;
+        unsigned long exp_rsn_time = IEEE80211_IBSS_RSN_INACTIVITY_LIMIT;
+
+        mutex_lock(&local->sta_mtx);
+
+        list_for_each_entry_safe(sta, tmp, &local->sta_list, list) {
+                if (sdata != sta->sdata)
+                        continue;
+
+                if (time_after(jiffies, sta->last_rx + exp_time) ||
+                    (time_after(jiffies, sta->last_rx + exp_rsn_time) &&
+                     sta->sta_state != IEEE80211_STA_AUTHORIZED)) {
+                        sta_dbg(sta->sdata, "expiring inactive %sSTA %pM\n",
+                                sta->sta_state != IEEE80211_STA_AUTHORIZED ?
+                                "not authorized " : "", sta->sta.addr);
+
+                        WARN_ON(__sta_info_destroy(sta));
+                }
+        }
+
+        mutex_unlock(&local->sta_mtx);
+}
+
 /*
  * This function is called with state == IEEE80211_IBSS_MLME_JOINED
  */
@@ -698,13 +833,14 @@ static int ieee80211_sta_active_ibss(struct ieee80211_sub_if_data *sdata)
 static void ieee80211_sta_merge_ibss(struct ieee80211_sub_if_data *sdata)
 {
         struct ieee80211_if_ibss *ifibss = &sdata->u.ibss;
+        enum nl80211_bss_scan_width scan_width;
 
-        lockdep_assert_held(&ifibss->mtx);
+        sdata_assert_lock(sdata);
 
         mod_timer(&ifibss->timer,
                   round_jiffies(jiffies + IEEE80211_IBSS_MERGE_INTERVAL));
 
-        ieee80211_sta_expire(sdata, IEEE80211_IBSS_INACTIVITY_LIMIT);
+        ieee80211_ibss_sta_expire(sdata);
 
         if (time_before(jiffies, ifibss->last_scan_completed +
                        IEEE80211_IBSS_MERGE_INTERVAL))
@@ -719,8 +855,9 @@ static void ieee80211_sta_merge_ibss(struct ieee80211_sub_if_data *sdata)
         sdata_info(sdata,
                    "No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge)\n");
 
+        scan_width = cfg80211_chandef_to_scan_width(&ifibss->chandef);
         ieee80211_request_ibss_scan(sdata, ifibss->ssid, ifibss->ssid_len,
-                                    NULL);
+                                    NULL, scan_width);
 }
 
 static void ieee80211_sta_create_ibss(struct ieee80211_sub_if_data *sdata)
@@ -730,7 +867,7 @@ static void ieee80211_sta_create_ibss(struct ieee80211_sub_if_data *sdata)
         u16 capability;
         int i;
 
-        lockdep_assert_held(&ifibss->mtx);
+        sdata_assert_lock(sdata);
 
         if (ifibss->fixed_bssid) {
                 memcpy(bssid, ifibss->bssid, ETH_ALEN);
@@ -755,7 +892,7 @@ static void ieee80211_sta_create_ibss(struct ieee80211_sub_if_data *sdata)
                 sdata->drop_unencrypted = 0;
 
         __ieee80211_sta_join_ibss(sdata, bssid, sdata->vif.bss_conf.beacon_int,
-                                  ifibss->channel, ifibss->basic_rates,
+                                  &ifibss->chandef, ifibss->basic_rates,
                                   capability, 0, true);
 }
 
@@ -770,10 +907,11 @@ static void ieee80211_sta_find_ibss(struct ieee80211_sub_if_data *sdata)
         struct cfg80211_bss *cbss;
         struct ieee80211_channel *chan = NULL;
         const u8 *bssid = NULL;
+        enum nl80211_bss_scan_width scan_width;
         int active_ibss;
         u16 capability;
 
-        lockdep_assert_held(&ifibss->mtx);
+        sdata_assert_lock(sdata);
 
         active_ibss = ieee80211_sta_active_ibss(sdata);
         ibss_dbg(sdata, "sta_find_ibss (active_ibss=%d)\n", active_ibss);
@@ -787,7 +925,7 @@ static void ieee80211_sta_find_ibss(struct ieee80211_sub_if_data *sdata)
         if (ifibss->fixed_bssid)
                 bssid = ifibss->bssid;
         if (ifibss->fixed_channel)
-                chan = ifibss->channel;
+                chan = ifibss->chandef.chan;
         if (!is_zero_ether_addr(ifibss->bssid))
                 bssid = ifibss->bssid;
         cbss = cfg80211_get_bss(local->hw.wiphy, chan, bssid,
@@ -811,6 +949,17 @@ static void ieee80211_sta_find_ibss(struct ieee80211_sub_if_data *sdata)
                 return;
         }
 
+        /* if a fixed bssid and a fixed freq have been provided create the IBSS
+         * directly and do not waste time scanning
+         */
+        if (ifibss->fixed_bssid && ifibss->fixed_channel) {
+                sdata_info(sdata, "Created IBSS using preconfigured BSSID %pM\n",
+                           bssid);
+                ieee80211_sta_create_ibss(sdata);
+                return;
+        }
+
+
         ibss_dbg(sdata, "sta_find_ibss: did not try to join ibss\n");
 
         /* Selected IBSS not found in current scan results - try to scan */
@@ -818,8 +967,10 @@ static void ieee80211_sta_find_ibss(struct ieee80211_sub_if_data *sdata)
                                         IEEE80211_SCAN_INTERVAL)) {
                 sdata_info(sdata, "Trigger new scan to find an IBSS to join\n");
 
+                scan_width = cfg80211_chandef_to_scan_width(&ifibss->chandef);
                 ieee80211_request_ibss_scan(sdata, ifibss->ssid,
-                                            ifibss->ssid_len, chan);
+                                            ifibss->ssid_len, chan,
+                                            scan_width);
         } else {
                 int interval = IEEE80211_SCAN_INTERVAL;
 
@@ -843,10 +994,10 @@ static void ieee80211_rx_mgmt_probe_req(struct ieee80211_sub_if_data *sdata,
         struct beacon_data *presp;
         u8 *pos, *end;
 
-        lockdep_assert_held(&ifibss->mtx);
+        sdata_assert_lock(sdata);
 
         presp = rcu_dereference_protected(ifibss->presp,
-                                          lockdep_is_held(&ifibss->mtx));
+                                          lockdep_is_held(&sdata->wdev.mtx));
 
         if (ifibss->state != IEEE80211_IBSS_MLME_JOINED ||
             len < 24 + 2 || !presp)
@@ -930,7 +1081,7 @@ void ieee80211_ibss_rx_queued_mgmt(struct ieee80211_sub_if_data *sdata,
         mgmt = (struct ieee80211_mgmt *) skb->data;
         fc = le16_to_cpu(mgmt->frame_control);
 
-        mutex_lock(&sdata->u.ibss.mtx);
+        sdata_lock(sdata);
 
         if (!sdata->u.ibss.ssid_len)
                 goto mgmt_out; /* not ready to merge yet */
@@ -953,7 +1104,7 @@ void ieee80211_ibss_rx_queued_mgmt(struct ieee80211_sub_if_data *sdata,
         }
 
  mgmt_out:
-        mutex_unlock(&sdata->u.ibss.mtx);
+        sdata_unlock(sdata);
 }
 
 void ieee80211_ibss_work(struct ieee80211_sub_if_data *sdata)
@@ -961,7 +1112,7 @@ void ieee80211_ibss_work(struct ieee80211_sub_if_data *sdata)
         struct ieee80211_if_ibss *ifibss = &sdata->u.ibss;
         struct sta_info *sta;
 
-        mutex_lock(&ifibss->mtx);
+        sdata_lock(sdata);
 
         /*
          * Work could be scheduled after scan or similar
@@ -978,7 +1129,7 @@ void ieee80211_ibss_work(struct ieee80211_sub_if_data *sdata)
                 list_del(&sta->list);
                 spin_unlock_bh(&ifibss->incomplete_lock);
 
-                ieee80211_ibss_finish_sta(sta, true);
+                ieee80211_ibss_finish_sta(sta);
                 rcu_read_unlock();
                 spin_lock_bh(&ifibss->incomplete_lock);
         }
@@ -997,7 +1148,7 @@ void ieee80211_ibss_work(struct ieee80211_sub_if_data *sdata)
         }
 
  out:
-        mutex_unlock(&ifibss->mtx);
+        sdata_unlock(sdata);
 }
 
 static void ieee80211_ibss_timer(unsigned long data)
@@ -1014,7 +1165,6 @@ void ieee80211_ibss_setup_sdata(struct ieee80211_sub_if_data *sdata)
 
         setup_timer(&ifibss->timer, ieee80211_ibss_timer,
                     (unsigned long) sdata);
-        mutex_init(&ifibss->mtx);
         INIT_LIST_HEAD(&ifibss->incomplete_stations);
         spin_lock_init(&ifibss->incomplete_lock);
 }
@@ -1040,8 +1190,9 @@ int ieee80211_ibss_join(struct ieee80211_sub_if_data *sdata,
                         struct cfg80211_ibss_params *params)
 {
         u32 changed = 0;
-
-        mutex_lock(&sdata->u.ibss.mtx);
+        u32 rate_flags;
+        struct ieee80211_supported_band *sband;
+        int i;
 
         if (params->bssid) {
                 memcpy(sdata->u.ibss.bssid, params->bssid, ETH_ALEN);
@@ -1052,14 +1203,20 @@ int ieee80211_ibss_join(struct ieee80211_sub_if_data *sdata,
         sdata->u.ibss.privacy = params->privacy;
         sdata->u.ibss.control_port = params->control_port;
         sdata->u.ibss.basic_rates = params->basic_rates;
+
+        /* fix basic_rates if channel does not support these rates */
+        rate_flags = ieee80211_chandef_rate_flags(&params->chandef);
+        sband = sdata->local->hw.wiphy->bands[params->chandef.chan->band];
+        for (i = 0; i < sband->n_bitrates; i++) {
+                if ((rate_flags & sband->bitrates[i].flags) != rate_flags)
+                        sdata->u.ibss.basic_rates &= ~BIT(i);
+        }
         memcpy(sdata->vif.bss_conf.mcast_rate, params->mcast_rate,
                sizeof(params->mcast_rate));
 
         sdata->vif.bss_conf.beacon_int = params->beacon_interval;
 
-        sdata->u.ibss.channel = params->chandef.chan;
-        sdata->u.ibss.channel_type =
-                cfg80211_get_chandef_type(&params->chandef);
+        sdata->u.ibss.chandef = params->chandef;
         sdata->u.ibss.fixed_channel = params->channel_fixed;
 
         if (params->ie) {
@@ -1075,7 +1232,10 @@ int ieee80211_ibss_join(struct ieee80211_sub_if_data *sdata,
         memcpy(sdata->u.ibss.ssid, params->ssid, params->ssid_len);
         sdata->u.ibss.ssid_len = params->ssid_len;
 
-        mutex_unlock(&sdata->u.ibss.mtx);
+        memcpy(&sdata->u.ibss.ht_capa, &params->ht_capa,
+               sizeof(sdata->u.ibss.ht_capa));
+        memcpy(&sdata->u.ibss.ht_capa_mask, &params->ht_capa_mask,
+               sizeof(sdata->u.ibss.ht_capa_mask));
 
         /*
          * 802.11n-2009 9.13.3.1: In an IBSS, the HT Protection field is
@@ -1112,8 +1272,6 @@ int ieee80211_ibss_leave(struct ieee80211_sub_if_data *sdata)
         struct sta_info *sta;
         struct beacon_data *presp;
 
-        mutex_lock(&sdata->u.ibss.mtx);
-
         active_ibss = ieee80211_sta_active_ibss(sdata);
 
         if (!active_ibss && !is_zero_ether_addr(ifibss->bssid)) {
@@ -1122,7 +1280,7 @@ int ieee80211_ibss_leave(struct ieee80211_sub_if_data *sdata)
                 if (ifibss->privacy)
                         capability |= WLAN_CAPABILITY_PRIVACY;
 
-                cbss = cfg80211_get_bss(local->hw.wiphy, ifibss->channel,
+                cbss = cfg80211_get_bss(local->hw.wiphy, ifibss->chandef.chan,
                                         ifibss->bssid, ifibss->ssid,
                                         ifibss->ssid_len, WLAN_CAPABILITY_IBSS |
                                         WLAN_CAPABILITY_PRIVACY,
@@ -1157,8 +1315,13 @@ int ieee80211_ibss_leave(struct ieee80211_sub_if_data *sdata)
         /* remove beacon */
         kfree(sdata->u.ibss.ie);
         presp = rcu_dereference_protected(ifibss->presp,
-                                          lockdep_is_held(&sdata->u.ibss.mtx));
+                                          lockdep_is_held(&sdata->wdev.mtx));
         RCU_INIT_POINTER(sdata->u.ibss.presp, NULL);
+
+        /* on the next join, re-program HT parameters */
+        memset(&ifibss->ht_capa, 0, sizeof(ifibss->ht_capa));
+        memset(&ifibss->ht_capa_mask, 0, sizeof(ifibss->ht_capa_mask));
+
         sdata->vif.bss_conf.ibss_joined = false;
         sdata->vif.bss_conf.ibss_creator = false;
         sdata->vif.bss_conf.enable_beacon = false;
@@ -1166,6 +1329,7 @@ int ieee80211_ibss_leave(struct ieee80211_sub_if_data *sdata)
         clear_bit(SDATA_STATE_OFFCHANNEL_BEACON_STOPPED, &sdata->state);
         ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_BEACON_ENABLED |
                                                 BSS_CHANGED_IBSS);
+        ieee80211_vif_release_channel(sdata);
         synchronize_rcu();
         kfree(presp);
 
@@ -1173,7 +1337,5 @@ int ieee80211_ibss_leave(struct ieee80211_sub_if_data *sdata)
 
         del_timer_sync(&sdata->u.ibss.timer);
 
-        mutex_unlock(&sdata->u.ibss.mtx);
-
         return 0;
 }
diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h
index 44be28cfc6c4..b6186517ec56 100644
--- a/net/mac80211/ieee80211_i.h
+++ b/net/mac80211/ieee80211_i.h
@@ -53,9 +53,6 @@ struct ieee80211_local;
  * increased memory use (about 2 kB of RAM per entry). */
 #define IEEE80211_FRAGMENT_MAX 4
 
-#define TU_TO_JIFFIES(x)        (usecs_to_jiffies((x) * 1024))
-#define TU_TO_EXP_TIME(x)       (jiffies + TU_TO_JIFFIES(x))
-
 /* power level hasn't been configured (or set to automatic) */
 #define IEEE80211_UNSET_POWER_LEVEL     INT_MIN
 
@@ -94,6 +91,7 @@ struct ieee80211_bss {
 #define IEEE80211_MAX_SUPP_RATES 32
         u8 supp_rates[IEEE80211_MAX_SUPP_RATES];
         size_t supp_rates_len;
+        struct ieee80211_rate *beacon_rate;
 
         /*
          * During association, we save an ERP value from a probe response so
@@ -258,6 +256,8 @@ struct ieee80211_if_ap {
         struct beacon_data __rcu *beacon;
         struct probe_resp __rcu *probe_resp;
 
+        /* to be used after channel switch. */
+        struct cfg80211_beacon_data *next_beacon;
         struct list_head vlans;
 
         struct ps_data ps;
@@ -366,7 +366,7 @@ struct ieee80211_mgd_assoc_data {
         u8 ssid_len;
         u8 supp_rates_len;
         bool wmm, uapsd;
-        bool have_beacon, need_beacon;
+        bool need_beacon;
         bool synced;
         bool timeout_started;
 
@@ -394,7 +394,6 @@ struct ieee80211_if_managed {
         bool nullfunc_failed;
         bool connection_loss;
 
-        struct mutex mtx;
         struct cfg80211_bss *associated;
         struct ieee80211_mgd_auth_data *auth_data;
         struct ieee80211_mgd_assoc_data *assoc_data;
@@ -405,6 +404,7 @@ struct ieee80211_if_managed {
 
         bool powersave; /* powersave requested for this iface */
         bool broken_ap; /* AP is broken -- turn off powersave */
+        bool have_beacon;
         u8 dtim_period;
         enum ieee80211_smps_mode req_smps, /* requested smps mode */
                                  driver_smps_mode; /* smps mode request */
@@ -488,8 +488,6 @@ struct ieee80211_if_managed {
 struct ieee80211_if_ibss {
         struct timer_list timer;
 
-        struct mutex mtx;
-
         unsigned long last_scan_completed;
 
         u32 basic_rates;
@@ -499,19 +497,20 @@ struct ieee80211_if_ibss {
         bool privacy;
 
         bool control_port;
-        unsigned int auth_frame_registrations;
 
         u8 bssid[ETH_ALEN] __aligned(2);
         u8 ssid[IEEE80211_MAX_SSID_LEN];
         u8 ssid_len, ie_len;
         u8 *ie;
-        struct ieee80211_channel *channel;
-        enum nl80211_channel_type channel_type;
+        struct cfg80211_chan_def chandef;
 
         unsigned long ibss_join_req;
         /* probe response/beacon for IBSS */
         struct beacon_data __rcu *presp;
 
+        struct ieee80211_ht_cap ht_capa; /* configured ht-cap over-rides */
+        struct ieee80211_ht_cap ht_capa_mask; /* Valid parts of ht_capa */
+
         spinlock_t incomplete_lock;
         struct list_head incomplete_stations;
 
@@ -545,6 +544,7 @@ struct ieee80211_if_mesh {
         struct timer_list mesh_path_root_timer;
 
         unsigned long wrkq_flags;
+        unsigned long mbss_changed;
 
         u8 mesh_id[IEEE80211_MAX_MESH_ID_LEN];
         size_t mesh_id_len;
@@ -580,8 +580,6 @@ struct ieee80211_if_mesh {
         bool accepting_plinks;
         int num_gates;
         struct beacon_data __rcu *beacon;
-        /* just protects beacon updates for now */
-        struct mutex mtx;
         const u8 *ie;
         u8 ie_len;
         enum {
@@ -717,6 +715,11 @@ struct ieee80211_sub_if_data {
 
         struct ieee80211_tx_queue_params tx_conf[IEEE80211_NUM_ACS];
 
+        struct work_struct csa_finalize_work;
+        int csa_counter_offset_beacon;
+        int csa_counter_offset_presp;
+        bool csa_radar_required;
+
         /* used to reconfigure hardware SM PS */
         struct work_struct recalc_smps;
 
@@ -778,6 +781,26 @@ struct ieee80211_sub_if_data *vif_to_sdata(struct ieee80211_vif *p)
         return container_of(p, struct ieee80211_sub_if_data, vif);
 }
 
+static inline void sdata_lock(struct ieee80211_sub_if_data *sdata)
+        __acquires(&sdata->wdev.mtx)
+{
+        mutex_lock(&sdata->wdev.mtx);
+        __acquire(&sdata->wdev.mtx);
+}
+
+static inline void sdata_unlock(struct ieee80211_sub_if_data *sdata)
+        __releases(&sdata->wdev.mtx)
+{
+        mutex_unlock(&sdata->wdev.mtx);
+        __release(&sdata->wdev.mtx);
+}
+
+static inline void
+sdata_assert_lock(struct ieee80211_sub_if_data *sdata)
+{
+        lockdep_assert_held(&sdata->wdev.mtx);
+}
+
 static inline enum ieee80211_band
 ieee80211_get_sdata_band(struct ieee80211_sub_if_data *sdata)
 {
@@ -793,6 +816,34 @@ ieee80211_get_sdata_band(struct ieee80211_sub_if_data *sdata)
         return band;
 }
 
+static inline int
+ieee80211_chandef_get_shift(struct cfg80211_chan_def *chandef)
+{
+        switch (chandef->width) {
+        case NL80211_CHAN_WIDTH_5:
+                return 2;
+        case NL80211_CHAN_WIDTH_10:
+                return 1;
+        default:
+                return 0;
+        }
+}
+
+static inline int
+ieee80211_vif_get_shift(struct ieee80211_vif *vif)
+{
+        struct ieee80211_chanctx_conf *chanctx_conf;
+        int shift = 0;
+
+        rcu_read_lock();
+        chanctx_conf = rcu_dereference(vif->chanctx_conf);
+        if (chanctx_conf)
+                shift = ieee80211_chandef_get_shift(&chanctx_conf->def);
+        rcu_read_unlock();
+
+        return shift;
+}
+
 enum sdata_queue_type {
         IEEE80211_SDATA_QUEUE_TYPE_FRAME        = 0,
         IEEE80211_SDATA_QUEUE_AGG_START         = 1,
@@ -1010,7 +1061,7 @@ struct ieee80211_local {
         struct cfg80211_ssid scan_ssid;
         struct cfg80211_scan_request *int_scan_req;
         struct cfg80211_scan_request *scan_req, *hw_scan_req;
-        struct ieee80211_channel *scan_channel;
+        struct cfg80211_chan_def scan_chandef;
         enum ieee80211_band hw_scan_band;
         int scan_channel_idx;
         int scan_ies_len;
@@ -1047,7 +1098,6 @@ struct ieee80211_local {
         u32 dot11TransmittedFrameCount;
 
 #ifdef CONFIG_MAC80211_LEDS
-        int tx_led_counter, rx_led_counter;
         struct led_trigger *tx_led, *rx_led, *assoc_led, *radio_led;
         struct tpt_led_trigger *tpt_led_trigger;
         char tx_led_name[32], rx_led_name[32],
@@ -1290,7 +1340,8 @@ void ieee80211_mesh_rx_queued_mgmt(struct ieee80211_sub_if_data *sdata,
 void ieee80211_scan_work(struct work_struct *work);
 int ieee80211_request_ibss_scan(struct ieee80211_sub_if_data *sdata,
                                 const u8 *ssid, u8 ssid_len,
-                                struct ieee80211_channel *chan);
+                                struct ieee80211_channel *chan,
+                                enum nl80211_bss_scan_width scan_width);
 int ieee80211_request_scan(struct ieee80211_sub_if_data *sdata,
                            struct cfg80211_scan_request *req);
 void ieee80211_scan_cancel(struct ieee80211_local *local);
@@ -1325,6 +1376,9 @@ void ieee80211_roc_notify_destroy(struct ieee80211_roc_work *roc, bool free);
 void ieee80211_sw_roc_work(struct work_struct *work);
 void ieee80211_handle_roc_started(struct ieee80211_roc_work *roc);
 
+/* channel switch handling */
+void ieee80211_csa_finalize_work(struct work_struct *work);
+
 /* interface handling */
 int ieee80211_iface_init(void);
 void ieee80211_iface_exit(void);
@@ -1346,6 +1400,8 @@ void ieee80211_del_virtual_monitor(struct ieee80211_local *local);
 
 bool __ieee80211_recalc_txpower(struct ieee80211_sub_if_data *sdata);
 void ieee80211_recalc_txpower(struct ieee80211_sub_if_data *sdata);
+int ieee80211_assign_beacon(struct ieee80211_sub_if_data *sdata,
+                            struct cfg80211_beacon_data *params);
 
 static inline bool ieee80211_sdata_running(struct ieee80211_sub_if_data *sdata)
 {
@@ -1449,7 +1505,8 @@ extern void *mac80211_wiphy_privid; /* for wiphy privid */
 u8 *ieee80211_get_bssid(struct ieee80211_hdr *hdr, size_t len,
                         enum nl80211_iftype type);
 int ieee80211_frame_duration(enum ieee80211_band band, size_t len,
-                             int rate, int erp, int short_preamble);
+                             int rate, int erp, int short_preamble,
+                             int shift);
 void mac80211_ev_michael_mic_failure(struct ieee80211_sub_if_data *sdata, int keyidx,
                                      struct ieee80211_hdr *hdr, const u8 *tsc,
                                      gfp_t gfp);
@@ -1497,18 +1554,16 @@ static inline void ieee80211_tx_skb(struct ieee80211_sub_if_data *sdata,
         ieee80211_tx_skb_tid(sdata, skb, 7);
 }
 
-u32 ieee802_11_parse_elems_crc(u8 *start, size_t len, bool action,
+u32 ieee802_11_parse_elems_crc(const u8 *start, size_t len, bool action,
                                struct ieee802_11_elems *elems,
                                u64 filter, u32 crc);
-static inline void ieee802_11_parse_elems(u8 *start, size_t len, bool action,
+static inline void ieee802_11_parse_elems(const u8 *start, size_t len,
+                                          bool action,
                                           struct ieee802_11_elems *elems)
 {
         ieee802_11_parse_elems_crc(start, len, action, elems, 0, 0);
 }
 
-u32 ieee80211_mandatory_rates(struct ieee80211_local *local,
-                              enum ieee80211_band band);
-
 void ieee80211_dynamic_ps_enable_work(struct work_struct *work);
 void ieee80211_dynamic_ps_disable_work(struct work_struct *work);
 void ieee80211_dynamic_ps_timer(unsigned long data);
@@ -1555,7 +1610,7 @@ void ieee80211_send_deauth_disassoc(struct ieee80211_sub_if_data *sdata,
 int ieee80211_build_preq_ies(struct ieee80211_local *local, u8 *buffer,
                              size_t buffer_len, const u8 *ie, size_t ie_len,
                              enum ieee80211_band band, u32 rate_mask,
-                             u8 channel);
+                             struct cfg80211_chan_def *chandef);
 struct sk_buff *ieee80211_build_probe_req(struct ieee80211_sub_if_data *sdata,
                                           u8 *dst, u32 ratemask,
                                           struct ieee80211_channel *chan,
@@ -1568,10 +1623,7 @@ void ieee80211_send_probe_req(struct ieee80211_sub_if_data *sdata, u8 *dst,
                               u32 ratemask, bool directed, u32 tx_flags,
                               struct ieee80211_channel *channel, bool scan);
 
-void ieee80211_sta_def_wmm_params(struct ieee80211_sub_if_data *sdata,
-                                  const size_t supp_rates_len,
-                                  const u8 *supp_rates);
-u32 ieee80211_sta_get_rates(struct ieee80211_local *local,
+u32 ieee80211_sta_get_rates(struct ieee80211_sub_if_data *sdata,
                             struct ieee802_11_elems *elems,
                             enum ieee80211_band band, u32 *basic_rates);
 int __ieee80211_request_smps(struct ieee80211_sub_if_data *sdata,
@@ -1588,6 +1640,9 @@ u8 *ieee80211_ie_build_ht_oper(u8 *pos, struct ieee80211_sta_ht_cap *ht_cap,
                                u16 prot_mode);
 u8 *ieee80211_ie_build_vht_cap(u8 *pos, struct ieee80211_sta_vht_cap *vht_cap,
                                u32 cap);
+int ieee80211_parse_bitrates(struct cfg80211_chan_def *chandef,
+                             const struct ieee80211_supported_band *sband,
+                             const u8 *srates, int srates_len, u32 *rates);
 int ieee80211_add_srates_ie(struct ieee80211_sub_if_data *sdata,
                             struct sk_buff *skb, bool need_basic,
                             enum ieee80211_band band);
@@ -1608,6 +1663,11 @@ int __must_check
 ieee80211_vif_change_bandwidth(struct ieee80211_sub_if_data *sdata,
                                const struct cfg80211_chan_def *chandef,
                                u32 *changed);
+/* NOTE: only use ieee80211_vif_change_channel() for channel switch */
+int __must_check
+ieee80211_vif_change_channel(struct ieee80211_sub_if_data *sdata,
+                             const struct cfg80211_chan_def *chandef,
+                             u32 *changed);
 void ieee80211_vif_release_channel(struct ieee80211_sub_if_data *sdata);
 void ieee80211_vif_vlan_copy_chanctx(struct ieee80211_sub_if_data *sdata);
 void ieee80211_vif_copy_chanctx_to_vlans(struct ieee80211_sub_if_data *sdata,
diff --git a/net/mac80211/iface.c b/net/mac80211/iface.c
index 98d20c0f6fed..fcecd633514e 100644
--- a/net/mac80211/iface.c
+++ b/net/mac80211/iface.c
@@ -54,7 +54,7 @@ bool __ieee80211_recalc_txpower(struct ieee80211_sub_if_data *sdata)
                 return false;
         }
 
-        power = chanctx_conf->def.chan->max_power;
+        power = ieee80211_chandef_max_power(&chanctx_conf->def);
         rcu_read_unlock();
 
         if (sdata->user_power_level != IEEE80211_UNSET_POWER_LEVEL)
@@ -159,7 +159,8 @@ static int ieee80211_change_mtu(struct net_device *dev, int new_mtu)
         return 0;
 }
 
-static int ieee80211_verify_mac(struct ieee80211_sub_if_data *sdata, u8 *addr)
+static int ieee80211_verify_mac(struct ieee80211_sub_if_data *sdata, u8 *addr,
+                                bool check_dup)
 {
         struct ieee80211_local *local = sdata->local;
         struct ieee80211_sub_if_data *iter;
@@ -180,13 +181,16 @@ static int ieee80211_verify_mac(struct ieee80211_sub_if_data *sdata, u8 *addr)
                 ((u64)m[2] << 3*8) | ((u64)m[3] << 2*8) |
                 ((u64)m[4] << 1*8) | ((u64)m[5] << 0*8);
 
+        if (!check_dup)
+                return ret;
 
         mutex_lock(&local->iflist_mtx);
         list_for_each_entry(iter, &local->interfaces, list) {
                 if (iter == sdata)
                         continue;
 
-                if (iter->vif.type == NL80211_IFTYPE_MONITOR)
+                if (iter->vif.type == NL80211_IFTYPE_MONITOR &&
+                    !(iter->u.mntr_flags & MONITOR_FLAG_ACTIVE))
                         continue;
 
                 m = iter->vif.addr;
@@ -208,12 +212,17 @@ static int ieee80211_change_mac(struct net_device *dev, void *addr)
 {
         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
         struct sockaddr *sa = addr;
+        bool check_dup = true;
         int ret;
 
         if (ieee80211_sdata_running(sdata))
                 return -EBUSY;
 
-        ret = ieee80211_verify_mac(sdata, sa->sa_data);
+        if (sdata->vif.type == NL80211_IFTYPE_MONITOR &&
+            !(sdata->u.mntr_flags & MONITOR_FLAG_ACTIVE))
+                check_dup = false;
+
+        ret = ieee80211_verify_mac(sdata, sa->sa_data, check_dup);
         if (ret)
                 return ret;
 
@@ -265,6 +274,12 @@ static int ieee80211_check_concurrent_iface(struct ieee80211_sub_if_data *sdata,
                         if (iftype == NL80211_IFTYPE_ADHOC &&
                             nsdata->vif.type == NL80211_IFTYPE_ADHOC)
                                 return -EBUSY;
+                        /*
+                         * will not add another interface while any channel
+                         * switch is active.
+                         */
+                        if (nsdata->vif.csa_active)
+                                return -EBUSY;
 
                         /*
                          * The remaining checks are only performed for interfaces
@@ -293,12 +308,13 @@ static int ieee80211_check_concurrent_iface(struct ieee80211_sub_if_data *sdata,
         return 0;
 }
 
-static int ieee80211_check_queues(struct ieee80211_sub_if_data *sdata)
+static int ieee80211_check_queues(struct ieee80211_sub_if_data *sdata,
+                                  enum nl80211_iftype iftype)
 {
         int n_queues = sdata->local->hw.queues;
         int i;
 
-        if (sdata->vif.type != NL80211_IFTYPE_P2P_DEVICE) {
+        if (iftype != NL80211_IFTYPE_P2P_DEVICE) {
                 for (i = 0; i < IEEE80211_NUM_ACS; i++) {
                         if (WARN_ON_ONCE(sdata->vif.hw_queue[i] ==
                                          IEEE80211_INVAL_HW_QUEUE))
@@ -309,8 +325,9 @@ static int ieee80211_check_queues(struct ieee80211_sub_if_data *sdata)
                 }
         }
 
-        if ((sdata->vif.type != NL80211_IFTYPE_AP &&
-             sdata->vif.type != NL80211_IFTYPE_MESH_POINT) ||
+        if ((iftype != NL80211_IFTYPE_AP &&
+             iftype != NL80211_IFTYPE_P2P_GO &&
+             iftype != NL80211_IFTYPE_MESH_POINT) ||
             !(sdata->local->hw.flags & IEEE80211_HW_QUEUE_CONTROL)) {
                 sdata->vif.cab_queue = IEEE80211_INVAL_HW_QUEUE;
                 return 0;
@@ -393,7 +410,7 @@ int ieee80211_add_virtual_monitor(struct ieee80211_local *local)
                 return ret;
         }
 
-        ret = ieee80211_check_queues(sdata);
+        ret = ieee80211_check_queues(sdata, NL80211_IFTYPE_MONITOR);
         if (ret) {
                 kfree(sdata);
                 return ret;
@@ -545,7 +562,11 @@ int ieee80211_do_open(struct wireless_dev *wdev, bool coming_up)
                         break;
                 }
 
-                if (local->monitors == 0 && local->open_count == 0) {
+                if (sdata->u.mntr_flags & MONITOR_FLAG_ACTIVE) {
+                        res = drv_add_interface(local, sdata);
+                        if (res)
+                                goto err_stop;
+                } else if (local->monitors == 0 && local->open_count == 0) {
                         res = ieee80211_add_virtual_monitor(local);
                         if (res)
                                 goto err_stop;
@@ -573,7 +594,8 @@ int ieee80211_do_open(struct wireless_dev *wdev, bool coming_up)
                         res = drv_add_interface(local, sdata);
                         if (res)
                                 goto err_stop;
-                        res = ieee80211_check_queues(sdata);
+                        res = ieee80211_check_queues(sdata,
+                                ieee80211_vif_type_p2p(&sdata->vif));
                         if (res)
                                 goto err_del_interface;
                 }
@@ -791,6 +813,8 @@ static void ieee80211_do_stop(struct ieee80211_sub_if_data *sdata,
         cancel_work_sync(&local->dynamic_ps_enable_work);
 
         cancel_work_sync(&sdata->recalc_smps);
+        sdata->vif.csa_active = false;
+        cancel_work_sync(&sdata->csa_finalize_work);
 
         cancel_delayed_work_sync(&sdata->dfs_cac_timer_work);
 
@@ -923,7 +947,11 @@ static void ieee80211_do_stop(struct ieee80211_sub_if_data *sdata,
                 mutex_lock(&local->mtx);
                 ieee80211_recalc_idle(local);
                 mutex_unlock(&local->mtx);
-                break;
+
+                if (!(sdata->u.mntr_flags & MONITOR_FLAG_ACTIVE))
+                        break;
+
+                /* fall through */
         default:
                 if (going_down)
                         drv_remove_interface(local, sdata);
@@ -1072,7 +1100,7 @@ static const struct net_device_ops ieee80211_monitorif_ops = {
         .ndo_start_xmit         = ieee80211_monitor_start_xmit,
         .ndo_set_rx_mode        = ieee80211_set_multicast_list,
         .ndo_change_mtu         = ieee80211_change_mtu,
-        .ndo_set_mac_address    = eth_mac_addr,
+        .ndo_set_mac_address    = ieee80211_change_mac,
         .ndo_select_queue       = ieee80211_monitor_select_queue,
 };
 
@@ -1250,6 +1278,7 @@ static void ieee80211_setup_sdata(struct ieee80211_sub_if_data *sdata,
         skb_queue_head_init(&sdata->skb_queue);
         INIT_WORK(&sdata->work, ieee80211_iface_work);
         INIT_WORK(&sdata->recalc_smps, ieee80211_recalc_smps_work);
+        INIT_WORK(&sdata->csa_finalize_work, ieee80211_csa_finalize_work);
 
         switch (type) {
         case NL80211_IFTYPE_P2P_GO:
@@ -1363,14 +1392,14 @@ static int ieee80211_runtime_change_iftype(struct ieee80211_sub_if_data *sdata,
 
         ret = drv_change_interface(local, sdata, internal_type, p2p);
         if (ret)
-                type = sdata->vif.type;
+                type = ieee80211_vif_type_p2p(&sdata->vif);
 
         /*
          * Ignore return value here, there's not much we can do since
          * the driver changed the interface type internally already.
          * The warnings will hopefully make driver authors fix it :-)
          */
-        ieee80211_check_queues(sdata);
+        ieee80211_check_queues(sdata, type);
 
         ieee80211_setup_sdata(sdata, type);
 
@@ -1747,10 +1776,9 @@ void ieee80211_remove_interfaces(struct ieee80211_local *local)
 }
 
 static int netdev_notify(struct notifier_block *nb,
-                         unsigned long state,
-                         void *ndev)
+                         unsigned long state, void *ptr)
 {
-        struct net_device *dev = ndev;
+        struct net_device *dev = netdev_notifier_info_to_dev(ptr);
         struct ieee80211_sub_if_data *sdata;
 
         if (state != NETDEV_CHANGENAME)
diff --git a/net/mac80211/key.c b/net/mac80211/key.c
index 67059b88fea5..620677e897bd 100644
--- a/net/mac80211/key.c
+++ b/net/mac80211/key.c
@@ -93,6 +93,9 @@ static int ieee80211_key_enable_hw_accel(struct ieee80211_key *key)
 
         might_sleep();
 
+        if (key->flags & KEY_FLAG_TAINTED)
+                return -EINVAL;
+
         if (!key->local->ops->set_key)
                 goto out_unsupported;
 
@@ -335,12 +338,12 @@ struct ieee80211_key *ieee80211_key_alloc(u32 cipher, int idx, size_t key_len,
         switch (cipher) {
         case WLAN_CIPHER_SUITE_WEP40:
         case WLAN_CIPHER_SUITE_WEP104:
-                key->conf.iv_len = WEP_IV_LEN;
-                key->conf.icv_len = WEP_ICV_LEN;
+                key->conf.iv_len = IEEE80211_WEP_IV_LEN;
+                key->conf.icv_len = IEEE80211_WEP_ICV_LEN;
                 break;
         case WLAN_CIPHER_SUITE_TKIP:
-                key->conf.iv_len = TKIP_IV_LEN;
-                key->conf.icv_len = TKIP_ICV_LEN;
+                key->conf.iv_len = IEEE80211_TKIP_IV_LEN;
+                key->conf.icv_len = IEEE80211_TKIP_ICV_LEN;
                 if (seq) {
                         for (i = 0; i < IEEE80211_NUM_TIDS; i++) {
                                 key->u.tkip.rx[i].iv32 =
@@ -352,13 +355,13 @@ struct ieee80211_key *ieee80211_key_alloc(u32 cipher, int idx, size_t key_len,
                 spin_lock_init(&key->u.tkip.txlock);
                 break;
         case WLAN_CIPHER_SUITE_CCMP:
-                key->conf.iv_len = CCMP_HDR_LEN;
-                key->conf.icv_len = CCMP_MIC_LEN;
+                key->conf.iv_len = IEEE80211_CCMP_HDR_LEN;
+                key->conf.icv_len = IEEE80211_CCMP_MIC_LEN;
                 if (seq) {
                         for (i = 0; i < IEEE80211_NUM_TIDS + 1; i++)
-                                for (j = 0; j < CCMP_PN_LEN; j++)
+                                for (j = 0; j < IEEE80211_CCMP_PN_LEN; j++)
                                         key->u.ccmp.rx_pn[i][j] =
-                                                seq[CCMP_PN_LEN - j - 1];
+                                                seq[IEEE80211_CCMP_PN_LEN - j - 1];
                 }
                 /*
                  * Initialize AES key state here as an optimization so that
@@ -375,9 +378,9 @@ struct ieee80211_key *ieee80211_key_alloc(u32 cipher, int idx, size_t key_len,
                 key->conf.iv_len = 0;
                 key->conf.icv_len = sizeof(struct ieee80211_mmie);
                 if (seq)
-                        for (j = 0; j < CMAC_PN_LEN; j++)
+                        for (j = 0; j < IEEE80211_CMAC_PN_LEN; j++)
                                 key->u.aes_cmac.rx_pn[j] =
-                                        seq[CMAC_PN_LEN - j - 1];
+                                        seq[IEEE80211_CMAC_PN_LEN - j - 1];
                 /*
                  * Initialize AES key state here as an optimization so that
                  * it does not need to be initialized for every packet.
@@ -455,6 +458,7 @@ int ieee80211_key_link(struct ieee80211_key *key,
                        struct ieee80211_sub_if_data *sdata,
                        struct sta_info *sta)
 {
+        struct ieee80211_local *local = sdata->local;
         struct ieee80211_key *old_key;
         int idx, ret;
         bool pairwise;
@@ -484,10 +488,13 @@ int ieee80211_key_link(struct ieee80211_key *key,
 
         ieee80211_debugfs_key_add(key);
 
-        ret = ieee80211_key_enable_hw_accel(key);
-
-        if (ret)
-                ieee80211_key_free(key, true);
+        if (!local->wowlan) {
+                ret = ieee80211_key_enable_hw_accel(key);
+                if (ret)
+                        ieee80211_key_free(key, true);
+        } else {
+                ret = 0;
+        }
 
         mutex_unlock(&sdata->local->key_mtx);
 
@@ -540,7 +547,7 @@ void ieee80211_iter_keys(struct ieee80211_hw *hw,
                          void *iter_data)
 {
         struct ieee80211_local *local = hw_to_local(hw);
-        struct ieee80211_key *key;
+        struct ieee80211_key *key, *tmp;
         struct ieee80211_sub_if_data *sdata;
 
         ASSERT_RTNL();
@@ -548,13 +555,14 @@ void ieee80211_iter_keys(struct ieee80211_hw *hw,
         mutex_lock(&local->key_mtx);
         if (vif) {
                 sdata = vif_to_sdata(vif);
-                list_for_each_entry(key, &sdata->key_list, list)
+                list_for_each_entry_safe(key, tmp, &sdata->key_list, list)
                         iter(hw, &sdata->vif,
                              key->sta ? &key->sta->sta : NULL,
                              &key->conf, iter_data);
         } else {
                 list_for_each_entry(sdata, &local->interfaces, list)
-                        list_for_each_entry(key, &sdata->key_list, list)
+                        list_for_each_entry_safe(key, tmp,
+                                                 &sdata->key_list, list)
                                 iter(hw, &sdata->vif,
                                      key->sta ? &key->sta->sta : NULL,
                                      &key->conf, iter_data);
@@ -740,14 +748,146 @@ void ieee80211_get_key_rx_seq(struct ieee80211_key_conf *keyconf,
                         pn = key->u.ccmp.rx_pn[IEEE80211_NUM_TIDS];
                 else
                         pn = key->u.ccmp.rx_pn[tid];
-                memcpy(seq->ccmp.pn, pn, CCMP_PN_LEN);
+                memcpy(seq->ccmp.pn, pn, IEEE80211_CCMP_PN_LEN);
                 break;
         case WLAN_CIPHER_SUITE_AES_CMAC:
                 if (WARN_ON(tid != 0))
                         return;
                 pn = key->u.aes_cmac.rx_pn;
-                memcpy(seq->aes_cmac.pn, pn, CMAC_PN_LEN);
+                memcpy(seq->aes_cmac.pn, pn, IEEE80211_CMAC_PN_LEN);
                 break;
         }
 }
 EXPORT_SYMBOL(ieee80211_get_key_rx_seq);
+
+void ieee80211_set_key_tx_seq(struct ieee80211_key_conf *keyconf,
+                              struct ieee80211_key_seq *seq)
+{
+        struct ieee80211_key *key;
+        u64 pn64;
+
+        key = container_of(keyconf, struct ieee80211_key, conf);
+
+        switch (key->conf.cipher) {
+        case WLAN_CIPHER_SUITE_TKIP:
+                key->u.tkip.tx.iv32 = seq->tkip.iv32;
+                key->u.tkip.tx.iv16 = seq->tkip.iv16;
+                break;
+        case WLAN_CIPHER_SUITE_CCMP:
+                pn64 = (u64)seq->ccmp.pn[5] |
+                       ((u64)seq->ccmp.pn[4] << 8) |
+                       ((u64)seq->ccmp.pn[3] << 16) |
+                       ((u64)seq->ccmp.pn[2] << 24) |
+                       ((u64)seq->ccmp.pn[1] << 32) |
+                       ((u64)seq->ccmp.pn[0] << 40);
+                atomic64_set(&key->u.ccmp.tx_pn, pn64);
+                break;
+        case WLAN_CIPHER_SUITE_AES_CMAC:
+                pn64 = (u64)seq->aes_cmac.pn[5] |
+                       ((u64)seq->aes_cmac.pn[4] << 8) |
+                       ((u64)seq->aes_cmac.pn[3] << 16) |
+                       ((u64)seq->aes_cmac.pn[2] << 24) |
+                       ((u64)seq->aes_cmac.pn[1] << 32) |
+                       ((u64)seq->aes_cmac.pn[0] << 40);
+                atomic64_set(&key->u.aes_cmac.tx_pn, pn64);
+                break;
+        default:
+                WARN_ON(1);
+                break;
+        }
+}
+EXPORT_SYMBOL_GPL(ieee80211_set_key_tx_seq);
+
+void ieee80211_set_key_rx_seq(struct ieee80211_key_conf *keyconf,
+                              int tid, struct ieee80211_key_seq *seq)
+{
+        struct ieee80211_key *key;
+        u8 *pn;
+
+        key = container_of(keyconf, struct ieee80211_key, conf);
+
+        switch (key->conf.cipher) {
+        case WLAN_CIPHER_SUITE_TKIP:
+                if (WARN_ON(tid < 0 || tid >= IEEE80211_NUM_TIDS))
+                        return;
+                key->u.tkip.rx[tid].iv32 = seq->tkip.iv32;
+                key->u.tkip.rx[tid].iv16 = seq->tkip.iv16;
+                break;
+        case WLAN_CIPHER_SUITE_CCMP:
+                if (WARN_ON(tid < -1 || tid >= IEEE80211_NUM_TIDS))
+                        return;
+                if (tid < 0)
+                        pn = key->u.ccmp.rx_pn[IEEE80211_NUM_TIDS];
+                else
+                        pn = key->u.ccmp.rx_pn[tid];
+                memcpy(pn, seq->ccmp.pn, IEEE80211_CCMP_PN_LEN);
+                break;
+        case WLAN_CIPHER_SUITE_AES_CMAC:
+                if (WARN_ON(tid != 0))
+                        return;
+                pn = key->u.aes_cmac.rx_pn;
+                memcpy(pn, seq->aes_cmac.pn, IEEE80211_CMAC_PN_LEN);
+                break;
+        default:
+                WARN_ON(1);
+                break;
+        }
+}
+EXPORT_SYMBOL_GPL(ieee80211_set_key_rx_seq);
+
+void ieee80211_remove_key(struct ieee80211_key_conf *keyconf)
+{
+        struct ieee80211_key *key;
+
+        key = container_of(keyconf, struct ieee80211_key, conf);
+
+        assert_key_lock(key->local);
+
+        /*
+         * if key was uploaded, we assume the driver will/has remove(d)
+         * it, so adjust bookkeeping accordingly
+         */
+        if (key->flags & KEY_FLAG_UPLOADED_TO_HARDWARE) {
+                key->flags &= ~KEY_FLAG_UPLOADED_TO_HARDWARE;
+
+                if (!((key->conf.flags & IEEE80211_KEY_FLAG_GENERATE_MMIC) ||
+                      (key->conf.flags & IEEE80211_KEY_FLAG_GENERATE_IV) ||
+                      (key->conf.flags & IEEE80211_KEY_FLAG_PUT_IV_SPACE)))
+                        increment_tailroom_need_count(key->sdata);
+        }
+
+        ieee80211_key_free(key, false);
+}
+EXPORT_SYMBOL_GPL(ieee80211_remove_key);
+
+struct ieee80211_key_conf *
+ieee80211_gtk_rekey_add(struct ieee80211_vif *vif,
+                        struct ieee80211_key_conf *keyconf)
+{
+        struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
+        struct ieee80211_local *local = sdata->local;
+        struct ieee80211_key *key;
+        int err;
+
+        if (WARN_ON(!local->wowlan))
+                return ERR_PTR(-EINVAL);
+
+        if (WARN_ON(vif->type != NL80211_IFTYPE_STATION))
+                return ERR_PTR(-EINVAL);
+
+        key = ieee80211_key_alloc(keyconf->cipher, keyconf->keyidx,
+                                  keyconf->keylen, keyconf->key,
+                                  0, NULL);
+        if (IS_ERR(key))
+                return ERR_PTR(PTR_ERR(key));
+
+        if (sdata->u.mgd.mfp != IEEE80211_MFP_DISABLED)
+                key->conf.flags |= IEEE80211_KEY_FLAG_RX_MGMT;
+
+        err = ieee80211_key_link(key, sdata, NULL);
+        if (err)
+                return ERR_PTR(err);
+
+        return &key->conf;
+}
+EXPORT_SYMBOL_GPL(ieee80211_gtk_rekey_add);
diff --git a/net/mac80211/key.h b/net/mac80211/key.h
index e8de3e6d7804..036d57e76a5e 100644
--- a/net/mac80211/key.h
+++ b/net/mac80211/key.h
@@ -19,17 +19,6 @@
 #define NUM_DEFAULT_KEYS 4
 #define NUM_DEFAULT_MGMT_KEYS 2
 
-#define WEP_IV_LEN              4
-#define WEP_ICV_LEN             4
-#define ALG_CCMP_KEY_LEN        16
-#define CCMP_HDR_LEN            8
-#define CCMP_MIC_LEN            8
-#define CCMP_TK_LEN             16
-#define CCMP_PN_LEN             6
-#define TKIP_IV_LEN             8
-#define TKIP_ICV_LEN            4
-#define CMAC_PN_LEN             6
-
 struct ieee80211_local;
 struct ieee80211_sub_if_data;
 struct sta_info;
@@ -93,13 +82,13 @@ struct ieee80211_key {
                          * frames and the last counter is used with Robust
                          * Management frames.
                          */
-                        u8 rx_pn[IEEE80211_NUM_TIDS + 1][CCMP_PN_LEN];
+                        u8 rx_pn[IEEE80211_NUM_TIDS + 1][IEEE80211_CCMP_PN_LEN];
                         struct crypto_cipher *tfm;
                         u32 replays; /* dot11RSNAStatsCCMPReplays */
                 } ccmp;
                 struct {
                         atomic64_t tx_pn;
-                        u8 rx_pn[CMAC_PN_LEN];
+                        u8 rx_pn[IEEE80211_CMAC_PN_LEN];
                         struct crypto_cipher *tfm;
                         u32 replays; /* dot11RSNAStatsCMACReplays */
                         u32 icverrors; /* dot11RSNAStatsCMACICVErrors */
diff --git a/net/mac80211/led.c b/net/mac80211/led.c
index bcffa6903129..e2b836446af3 100644
--- a/net/mac80211/led.c
+++ b/net/mac80211/led.c
@@ -12,27 +12,22 @@
 #include <linux/export.h>
 #include "led.h"
 
+#define MAC80211_BLINK_DELAY 50 /* ms */
+
 void ieee80211_led_rx(struct ieee80211_local *local)
 {
+        unsigned long led_delay = MAC80211_BLINK_DELAY;
         if (unlikely(!local->rx_led))
                 return;
-        if (local->rx_led_counter++ % 2 == 0)
-                led_trigger_event(local->rx_led, LED_OFF);
-        else
-                led_trigger_event(local->rx_led, LED_FULL);
+        led_trigger_blink_oneshot(local->rx_led, &led_delay, &led_delay, 0);
 }
 
-/* q is 1 if a packet was enqueued, 0 if it has been transmitted */
-void ieee80211_led_tx(struct ieee80211_local *local, int q)
+void ieee80211_led_tx(struct ieee80211_local *local)
 {
+        unsigned long led_delay = MAC80211_BLINK_DELAY;
         if (unlikely(!local->tx_led))
                 return;
-        /* not sure how this is supposed to work ... */
-        local->tx_led_counter += 2*q-1;
-        if (local->tx_led_counter % 2 == 0)
-                led_trigger_event(local->tx_led, LED_OFF);
-        else
-                led_trigger_event(local->tx_led, LED_FULL);
+        led_trigger_blink_oneshot(local->tx_led, &led_delay, &led_delay, 0);
 }
 
 void ieee80211_led_assoc(struct ieee80211_local *local, bool associated)
diff --git a/net/mac80211/led.h b/net/mac80211/led.h
index e0275d9befa8..89f4344f13b9 100644
--- a/net/mac80211/led.h
+++ b/net/mac80211/led.h
@@ -13,7 +13,7 @@
 
 #ifdef CONFIG_MAC80211_LEDS
 void ieee80211_led_rx(struct ieee80211_local *local);
-void ieee80211_led_tx(struct ieee80211_local *local, int q);
+void ieee80211_led_tx(struct ieee80211_local *local);
 void ieee80211_led_assoc(struct ieee80211_local *local,
                          bool associated);
 void ieee80211_led_radio(struct ieee80211_local *local,
@@ -27,7 +27,7 @@ void ieee80211_mod_tpt_led_trig(struct ieee80211_local *local,
 static inline void ieee80211_led_rx(struct ieee80211_local *local)
 {
 }
-static inline void ieee80211_led_tx(struct ieee80211_local *local, int q)
+static inline void ieee80211_led_tx(struct ieee80211_local *local)
 {
 }
 static inline void ieee80211_led_assoc(struct ieee80211_local *local,
diff --git a/net/mac80211/main.c b/net/mac80211/main.c
index 8a7bfc47d577..21d5d44444d0 100644
--- a/net/mac80211/main.c
+++ b/net/mac80211/main.c
@@ -102,17 +102,8 @@ static u32 ieee80211_hw_conf_chan(struct ieee80211_local *local)
 
         offchannel_flag = local->hw.conf.flags & IEEE80211_CONF_OFFCHANNEL;
 
-        if (local->scan_channel) {
-                chandef.chan = local->scan_channel;
-                /* If scanning on oper channel, use whatever channel-type
-                 * is currently in use.
-                 */
-                if (chandef.chan == local->_oper_chandef.chan) {
-                        chandef = local->_oper_chandef;
-                } else {
-                        chandef.width = NL80211_CHAN_WIDTH_20_NOHT;
-                        chandef.center_freq1 = chandef.chan->center_freq;
-                }
+        if (local->scan_chandef.chan) {
+                chandef = local->scan_chandef;
         } else if (local->tmp_channel) {
                 chandef.chan = local->tmp_channel;
                 chandef.width = NL80211_CHAN_WIDTH_20_NOHT;
@@ -151,7 +142,7 @@ static u32 ieee80211_hw_conf_chan(struct ieee80211_local *local)
                 changed |= IEEE80211_CONF_CHANGE_SMPS;
         }
 
-        power = chandef.chan->max_power;
+        power = ieee80211_chandef_max_power(&chandef);
 
         rcu_read_lock();
         list_for_each_entry_rcu(sdata, &local->interfaces, list) {
@@ -331,7 +322,7 @@ static int ieee80211_ifa_changed(struct notifier_block *nb,
                 return NOTIFY_DONE;
 
         ifmgd = &sdata->u.mgd;
-        mutex_lock(&ifmgd->mtx);
+        sdata_lock(sdata);
 
         /* Copy the addresses to the bss_conf list */
         ifa = idev->ifa_list;
@@ -349,7 +340,7 @@ static int ieee80211_ifa_changed(struct notifier_block *nb,
                 ieee80211_bss_info_change_notify(sdata,
                                                  BSS_CHANGED_ARP_FILTER);
 
-        mutex_unlock(&ifmgd->mtx);
+        sdata_unlock(sdata);
 
         return NOTIFY_DONE;
 }
@@ -686,8 +677,7 @@ int ieee80211_register_hw(struct ieee80211_hw *hw)
                 return -EINVAL;
 
 #ifdef CONFIG_PM
-        if ((hw->wiphy->wowlan.flags || hw->wiphy->wowlan.n_patterns) &&
-            (!local->ops->suspend || !local->ops->resume))
+        if (hw->wiphy->wowlan && (!local->ops->suspend || !local->ops->resume))
                 return -EINVAL;
 #endif
 
@@ -902,9 +892,6 @@ int ieee80211_register_hw(struct ieee80211_hw *hw)
         if (!local->ops->remain_on_channel)
                 local->hw.wiphy->max_remain_on_channel_duration = 5000;
 
-        if (local->ops->sched_scan_start)
-                local->hw.wiphy->flags |= WIPHY_FLAG_SUPPORTS_SCHED_SCAN;
-
         /* mac80211 based drivers don't support internal TDLS setup */
         if (local->hw.wiphy->flags & WIPHY_FLAG_SUPPORTS_TDLS)
                 local->hw.wiphy->flags |= WIPHY_FLAG_TDLS_EXTERNAL_SETUP;
@@ -921,7 +908,7 @@ int ieee80211_register_hw(struct ieee80211_hw *hw)
                 hw->queues = IEEE80211_MAX_QUEUES;
 
         local->workqueue =
-                alloc_ordered_workqueue(wiphy_name(local->hw.wiphy), 0);
+                alloc_ordered_workqueue("%s", 0, wiphy_name(local->hw.wiphy));
         if (!local->workqueue) {
                 result = -ENOMEM;
                 goto fail_workqueue;
diff --git a/net/mac80211/mesh.c b/net/mac80211/mesh.c
index 6952760881c8..707ac61d63e5 100644
--- a/net/mac80211/mesh.c
+++ b/net/mac80211/mesh.c
@@ -62,7 +62,6 @@ bool mesh_matches_local(struct ieee80211_sub_if_data *sdata,
                         struct ieee802_11_elems *ie)
 {
         struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
-        struct ieee80211_local *local = sdata->local;
         u32 basic_rates = 0;
         struct cfg80211_chan_def sta_chan_def;
 
@@ -85,7 +84,7 @@ bool mesh_matches_local(struct ieee80211_sub_if_data *sdata,
              (ifmsh->mesh_auth_id == ie->mesh_config->meshconf_auth)))
                 return false;
 
-        ieee80211_sta_get_rates(local, ie, ieee80211_get_sdata_band(sdata),
+        ieee80211_sta_get_rates(sdata, ie, ieee80211_get_sdata_band(sdata),
                                 &basic_rates);
 
         if (sdata->vif.bss_conf.basic_rates != basic_rates)
@@ -271,11 +270,12 @@ int mesh_add_meshconf_ie(struct ieee80211_sub_if_data *sdata,
         *pos++ = ifmsh->mesh_auth_id;
         /* Mesh Formation Info - number of neighbors */
         neighbors = atomic_read(&ifmsh->estab_plinks);
-        /* Number of neighbor mesh STAs or 15 whichever is smaller */
-        neighbors = (neighbors > 15) ? 15 : neighbors;
+        neighbors = min_t(int, neighbors, IEEE80211_MAX_MESH_PEERINGS);
         *pos++ = neighbors << 1;
         /* Mesh capability */
-        *pos = IEEE80211_MESHCONF_CAPAB_FORWARDING;
+        *pos = 0x00;
+        *pos |= ifmsh->mshcfg.dot11MeshForwarding ?
+                        IEEE80211_MESHCONF_CAPAB_FORWARDING : 0x00;
         *pos |= ifmsh->accepting_plinks ?
                         IEEE80211_MESHCONF_CAPAB_ACCEPT_PLINKS : 0x00;
         /* Mesh PS mode. See IEEE802.11-2012 8.4.2.100.8 */
@@ -417,7 +417,9 @@ int mesh_add_ht_cap_ie(struct ieee80211_sub_if_data *sdata,
 
         sband = local->hw.wiphy->bands[band];
         if (!sband->ht_cap.ht_supported ||
-            sdata->vif.bss_conf.chandef.width == NL80211_CHAN_WIDTH_20_NOHT)
+            sdata->vif.bss_conf.chandef.width == NL80211_CHAN_WIDTH_20_NOHT ||
+            sdata->vif.bss_conf.chandef.width == NL80211_CHAN_WIDTH_5 ||
+            sdata->vif.bss_conf.chandef.width == NL80211_CHAN_WIDTH_10)
                 return 0;
 
         if (skb_tailroom(skb) < 2 + sizeof(struct ieee80211_ht_cap))
@@ -573,7 +575,7 @@ static void ieee80211_mesh_housekeeping(struct ieee80211_sub_if_data *sdata)
         struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
         u32 changed;
 
-        ieee80211_sta_expire(sdata, IEEE80211_MESH_PEER_INACTIVITY_LIMIT);
+        ieee80211_sta_expire(sdata, ifmsh->mshcfg.plink_timeout * HZ);
         mesh_path_expire(sdata);
 
         changed = mesh_accept_plinks_update(sdata);
@@ -697,38 +699,38 @@ out_free:
 }
 
 static int
-ieee80211_mesh_rebuild_beacon(struct ieee80211_if_mesh *ifmsh)
+ieee80211_mesh_rebuild_beacon(struct ieee80211_sub_if_data *sdata)
 {
         struct beacon_data *old_bcn;
         int ret;
 
-        mutex_lock(&ifmsh->mtx);
-
-        old_bcn = rcu_dereference_protected(ifmsh->beacon,
-                                            lockdep_is_held(&ifmsh->mtx));
-        ret = ieee80211_mesh_build_beacon(ifmsh);
+        old_bcn = rcu_dereference_protected(sdata->u.mesh.beacon,
+                                            lockdep_is_held(&sdata->wdev.mtx));
+        ret = ieee80211_mesh_build_beacon(&sdata->u.mesh);
         if (ret)
                 /* just reuse old beacon */
-                goto out;
+                return ret;
 
         if (old_bcn)
                 kfree_rcu(old_bcn, rcu_head);
-out:
-        mutex_unlock(&ifmsh->mtx);
-        return ret;
+        return 0;
 }
 
 void ieee80211_mbss_info_change_notify(struct ieee80211_sub_if_data *sdata,
                                        u32 changed)
 {
-        if (sdata->vif.bss_conf.enable_beacon &&
-            (changed & (BSS_CHANGED_BEACON |
-                        BSS_CHANGED_HT |
-                        BSS_CHANGED_BASIC_RATES |
-                        BSS_CHANGED_BEACON_INT)))
-                if (ieee80211_mesh_rebuild_beacon(&sdata->u.mesh))
-                        return;
-        ieee80211_bss_info_change_notify(sdata, changed);
+        struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
+        unsigned long bits = changed;
+        u32 bit;
+
+        if (!bits)
+                return;
+
+        /* if we race with running work, worst case this work becomes a noop */
+        for_each_set_bit(bit, &bits, sizeof(changed) * BITS_PER_BYTE)
+                set_bit(bit, &ifmsh->mbss_changed);
+        set_bit(MESH_WORK_MBSS_CHANGED, &ifmsh->wrkq_flags);
+        ieee80211_queue_work(&sdata->local->hw, &sdata->work);
 }
 
 int ieee80211_start_mesh(struct ieee80211_sub_if_data *sdata)
@@ -740,7 +742,6 @@ int ieee80211_start_mesh(struct ieee80211_sub_if_data *sdata)
                       BSS_CHANGED_HT |
                       BSS_CHANGED_BASIC_RATES |
                       BSS_CHANGED_BEACON_INT;
-        enum ieee80211_band band = ieee80211_get_sdata_band(sdata);
 
         local->fif_other_bss++;
         /* mesh ifaces must set allmulti to forward mcast traffic */
@@ -748,7 +749,6 @@ int ieee80211_start_mesh(struct ieee80211_sub_if_data *sdata)
         ieee80211_configure_filter(local);
 
         ifmsh->mesh_cc_id = 0;  /* Disabled */
-        ifmsh->mesh_auth_id = 0;        /* Disabled */
         /* register sync ops from extensible synchronization framework */
         ifmsh->sync_ops = ieee80211_mesh_sync_ops_get(ifmsh->mesh_sp_id);
         ifmsh->adjusting_tbtt = false;
@@ -759,8 +759,6 @@ int ieee80211_start_mesh(struct ieee80211_sub_if_data *sdata)
         sdata->vif.bss_conf.ht_operation_mode =
                                 ifmsh->mshcfg.ht_opmode;
         sdata->vif.bss_conf.enable_beacon = true;
-        sdata->vif.bss_conf.basic_rates =
-                ieee80211_mandatory_rates(local, band);
 
         changed |= ieee80211_mps_local_status_update(sdata);
 
@@ -788,12 +786,10 @@ void ieee80211_stop_mesh(struct ieee80211_sub_if_data *sdata)
         sdata->vif.bss_conf.enable_beacon = false;
         clear_bit(SDATA_STATE_OFFCHANNEL_BEACON_STOPPED, &sdata->state);
         ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_BEACON_ENABLED);
-        mutex_lock(&ifmsh->mtx);
         bcn = rcu_dereference_protected(ifmsh->beacon,
-                                        lockdep_is_held(&ifmsh->mtx));
+                                        lockdep_is_held(&sdata->wdev.mtx));
         rcu_assign_pointer(ifmsh->beacon, NULL);
         kfree_rcu(bcn, rcu_head);
-        mutex_unlock(&ifmsh->mtx);
 
         /* flush STAs and mpaths on this iface */
         sta_info_flush(sdata);
@@ -806,14 +802,10 @@ void ieee80211_stop_mesh(struct ieee80211_sub_if_data *sdata)
         del_timer_sync(&sdata->u.mesh.housekeeping_timer);
         del_timer_sync(&sdata->u.mesh.mesh_path_root_timer);
         del_timer_sync(&sdata->u.mesh.mesh_path_timer);
-        /*
-         * If the timer fired while we waited for it, it will have
-         * requeued the work. Now the work will be running again
-         * but will not rearm the timer again because it checks
-         * whether the interface is running, which, at this point,
-         * it no longer is.
-         */
-        cancel_work_sync(&sdata->work);
+
+        /* clear any mesh work (for next join) we may have accrued */
+        ifmsh->wrkq_flags = 0;
+        ifmsh->mbss_changed = 0;
 
         local->fif_other_bss--;
         atomic_dec(&local->iff_allmultis);
@@ -840,6 +832,9 @@ ieee80211_mesh_rx_probe_req(struct ieee80211_sub_if_data *sdata,
 
         ieee802_11_parse_elems(pos, len - baselen, false, &elems);
 
+        if (!elems.mesh_id)
+                return;
+
         /* 802.11-2012 10.1.4.3.2 */
         if ((!ether_addr_equal(mgmt->da, sdata->vif.addr) &&
              !is_broadcast_ether_addr(mgmt->da)) ||
@@ -954,6 +949,12 @@ void ieee80211_mesh_rx_queued_mgmt(struct ieee80211_sub_if_data *sdata,
         struct ieee80211_mgmt *mgmt;
         u16 stype;
 
+        sdata_lock(sdata);
+
+        /* mesh already went down */
+        if (!sdata->wdev.mesh_id_len)
+                goto out;
+
         rx_status = IEEE80211_SKB_RXCB(skb);
         mgmt = (struct ieee80211_mgmt *) skb->data;
         stype = le16_to_cpu(mgmt->frame_control) & IEEE80211_FCTL_STYPE;
@@ -971,12 +972,42 @@ void ieee80211_mesh_rx_queued_mgmt(struct ieee80211_sub_if_data *sdata,
                 ieee80211_mesh_rx_mgmt_action(sdata, mgmt, skb->len, rx_status);
                 break;
         }
+out:
+        sdata_unlock(sdata);
+}
+
+static void mesh_bss_info_changed(struct ieee80211_sub_if_data *sdata)
+{
+        struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
+        u32 bit, changed = 0;
+
+        for_each_set_bit(bit, &ifmsh->mbss_changed,
+                         sizeof(changed) * BITS_PER_BYTE) {
+                clear_bit(bit, &ifmsh->mbss_changed);
+                changed |= BIT(bit);
+        }
+
+        if (sdata->vif.bss_conf.enable_beacon &&
+            (changed & (BSS_CHANGED_BEACON |
+                        BSS_CHANGED_HT |
+                        BSS_CHANGED_BASIC_RATES |
+                        BSS_CHANGED_BEACON_INT)))
+                if (ieee80211_mesh_rebuild_beacon(sdata))
+                        return;
+
+        ieee80211_bss_info_change_notify(sdata, changed);
 }
 
 void ieee80211_mesh_work(struct ieee80211_sub_if_data *sdata)
 {
         struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
 
+        sdata_lock(sdata);
+
+        /* mesh already went down */
+        if (!sdata->wdev.mesh_id_len)
+                goto out;
+
         if (ifmsh->preq_queue_len &&
             time_after(jiffies,
                        ifmsh->last_preq + msecs_to_jiffies(ifmsh->mshcfg.dot11MeshHWMPpreqMinInterval)))
@@ -996,6 +1027,11 @@ void ieee80211_mesh_work(struct ieee80211_sub_if_data *sdata)
 
         if (test_and_clear_bit(MESH_WORK_DRIFT_ADJUST, &ifmsh->wrkq_flags))
                 mesh_sync_adjust_tbtt(sdata);
+
+        if (test_and_clear_bit(MESH_WORK_MBSS_CHANGED, &ifmsh->wrkq_flags))
+                mesh_bss_info_changed(sdata);
+out:
+        sdata_unlock(sdata);
 }
 
 void ieee80211_mesh_notify_scan_completed(struct ieee80211_local *local)
@@ -1041,7 +1077,6 @@ void ieee80211_mesh_init_sdata(struct ieee80211_sub_if_data *sdata)
         spin_lock_init(&ifmsh->mesh_preq_queue_lock);
         spin_lock_init(&ifmsh->sync_offset_lock);
         RCU_INIT_POINTER(ifmsh->beacon, NULL);
-        mutex_init(&ifmsh->mtx);
 
         sdata->vif.bss_conf.bssid = zero_addr;
 }
diff --git a/net/mac80211/mesh.h b/net/mac80211/mesh.h
index da158774eebb..2bc7fd2f787d 100644
--- a/net/mac80211/mesh.h
+++ b/net/mac80211/mesh.h
@@ -58,6 +58,7 @@ enum mesh_path_flags {
  * @MESH_WORK_ROOT: the mesh root station needs to send a frame
  * @MESH_WORK_DRIFT_ADJUST: time to compensate for clock drift relative to other
  * mesh nodes
+ * @MESH_WORK_MBSS_CHANGED: rebuild beacon and notify driver of BSS changes
  */
 enum mesh_deferred_task_flags {
         MESH_WORK_HOUSEKEEPING,
@@ -65,6 +66,7 @@ enum mesh_deferred_task_flags {
         MESH_WORK_GROW_MPP_TABLE,
         MESH_WORK_ROOT,
         MESH_WORK_DRIFT_ADJUST,
+        MESH_WORK_MBSS_CHANGED,
 };
 
 /**
@@ -188,7 +190,6 @@ struct mesh_rmc {
         u32 idx_mask;
 };
 
-#define IEEE80211_MESH_PEER_INACTIVITY_LIMIT (1800 * HZ)
 #define IEEE80211_MESH_HOUSEKEEPING_INTERVAL (60 * HZ)
 
 #define MESH_PATH_EXPIRE (600 * HZ)
@@ -324,14 +325,14 @@ static inline
 u32 mesh_plink_inc_estab_count(struct ieee80211_sub_if_data *sdata)
 {
         atomic_inc(&sdata->u.mesh.estab_plinks);
-        return mesh_accept_plinks_update(sdata);
+        return mesh_accept_plinks_update(sdata) | BSS_CHANGED_BEACON;
 }
 
 static inline
 u32 mesh_plink_dec_estab_count(struct ieee80211_sub_if_data *sdata)
 {
         atomic_dec(&sdata->u.mesh.estab_plinks);
-        return mesh_accept_plinks_update(sdata);
+        return mesh_accept_plinks_update(sdata) | BSS_CHANGED_BEACON;
 }
 
 static inline int mesh_plink_free_count(struct ieee80211_sub_if_data *sdata)
diff --git a/net/mac80211/mesh_plink.c b/net/mac80211/mesh_plink.c
index 09bebed99416..6b65d5055f5b 100644
--- a/net/mac80211/mesh_plink.c
+++ b/net/mac80211/mesh_plink.c
@@ -154,8 +154,14 @@ static u32 mesh_set_ht_prot_mode(struct ieee80211_sub_if_data *sdata)
         u16 ht_opmode;
         bool non_ht_sta = false, ht20_sta = false;
 
-        if (sdata->vif.bss_conf.chandef.width == NL80211_CHAN_WIDTH_20_NOHT)
+        switch (sdata->vif.bss_conf.chandef.width) {
+        case NL80211_CHAN_WIDTH_20_NOHT:
+        case NL80211_CHAN_WIDTH_5:
+        case NL80211_CHAN_WIDTH_10:
                 return 0;
+        default:
+                break;
+        }
 
         rcu_read_lock();
         list_for_each_entry_rcu(sta, &local->sta_list, list) {
@@ -373,7 +379,7 @@ static void mesh_sta_info_init(struct ieee80211_sub_if_data *sdata,
         u32 rates, basic_rates = 0, changed = 0;
 
         sband = local->hw.wiphy->bands[band];
-        rates = ieee80211_sta_get_rates(local, elems, band, &basic_rates);
+        rates = ieee80211_sta_get_rates(sdata, elems, band, &basic_rates);
 
         spin_lock_bh(&sta->lock);
         sta->last_rx = jiffies;
diff --git a/net/mac80211/mesh_ps.c b/net/mac80211/mesh_ps.c
index 3b7bfc01ee36..22290a929b94 100644
--- a/net/mac80211/mesh_ps.c
+++ b/net/mac80211/mesh_ps.c
@@ -229,6 +229,10 @@ void ieee80211_mps_sta_status_update(struct sta_info *sta)
         enum nl80211_mesh_power_mode pm;
         bool do_buffer;
 
+        /* For non-assoc STA, prevent buffering or frame transmission */
+        if (sta->sta_state < IEEE80211_STA_ASSOC)
+                return;
+
         /*
          * use peer-specific power mode if peering is established and the
          * peer's power mode is known
diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
index a8c2130c8ba4..86e4ad56b573 100644
--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
@@ -31,10 +31,12 @@
 #include "led.h"
 
 #define IEEE80211_AUTH_TIMEOUT          (HZ / 5)
+#define IEEE80211_AUTH_TIMEOUT_LONG     (HZ / 2)
 #define IEEE80211_AUTH_TIMEOUT_SHORT    (HZ / 10)
 #define IEEE80211_AUTH_MAX_TRIES        3
 #define IEEE80211_AUTH_WAIT_ASSOC       (HZ * 5)
 #define IEEE80211_ASSOC_TIMEOUT         (HZ / 5)
+#define IEEE80211_ASSOC_TIMEOUT_LONG    (HZ / 2)
 #define IEEE80211_ASSOC_TIMEOUT_SHORT   (HZ / 10)
 #define IEEE80211_ASSOC_MAX_TRIES       3
 
@@ -91,41 +93,6 @@ MODULE_PARM_DESC(probe_wait_ms,
 #define IEEE80211_SIGNAL_AVE_MIN_COUNT  4
 
 /*
- * All cfg80211 functions have to be called outside a locked
- * section so that they can acquire a lock themselves... This
- * is much simpler than queuing up things in cfg80211, but we
- * do need some indirection for that here.
- */
-enum rx_mgmt_action {
-        /* no action required */
-        RX_MGMT_NONE,
-
-        /* caller must call cfg80211_send_deauth() */
-        RX_MGMT_CFG80211_DEAUTH,
-
-        /* caller must call cfg80211_send_disassoc() */
-        RX_MGMT_CFG80211_DISASSOC,
-
-        /* caller must call cfg80211_send_rx_auth() */
-        RX_MGMT_CFG80211_RX_AUTH,
-
-        /* caller must call cfg80211_send_rx_assoc() */
-        RX_MGMT_CFG80211_RX_ASSOC,
-
-        /* caller must call cfg80211_send_assoc_timeout() */
-        RX_MGMT_CFG80211_ASSOC_TIMEOUT,
-
-        /* used when a processed beacon causes a deauth */
-        RX_MGMT_CFG80211_TX_DEAUTH,
-};
-
-/* utils */
-static inline void ASSERT_MGD_MTX(struct ieee80211_if_managed *ifmgd)
-{
-        lockdep_assert_held(&ifmgd->mtx);
-}
-
-/*
  * We can have multiple work items (and connection probing)
  * scheduling this timer, but we need to take care to only
  * reschedule it when it should fire _earlier_ than it was
@@ -135,13 +102,14 @@ static inline void ASSERT_MGD_MTX(struct ieee80211_if_managed *ifmgd)
  * has happened -- the work that runs from this timer will
  * do that.
  */
-static void run_again(struct ieee80211_if_managed *ifmgd, unsigned long timeout)
+static void run_again(struct ieee80211_sub_if_data *sdata,
+                      unsigned long timeout)
 {
-        ASSERT_MGD_MTX(ifmgd);
+        sdata_assert_lock(sdata);
 
-        if (!timer_pending(&ifmgd->timer) ||
-            time_before(timeout, ifmgd->timer.expires))
-                mod_timer(&ifmgd->timer, timeout);
+        if (!timer_pending(&sdata->u.mgd.timer) ||
+            time_before(timeout, sdata->u.mgd.timer.expires))
+                mod_timer(&sdata->u.mgd.timer, timeout);
 }
 
 void ieee80211_sta_reset_beacon_monitor(struct ieee80211_sub_if_data *sdata)
@@ -224,6 +192,12 @@ static u32 chandef_downgrade(struct cfg80211_chan_def *c)
                 c->width = NL80211_CHAN_WIDTH_20_NOHT;
                 ret = IEEE80211_STA_DISABLE_HT | IEEE80211_STA_DISABLE_VHT;
                 break;
+        case NL80211_CHAN_WIDTH_5:
+        case NL80211_CHAN_WIDTH_10:
+                WARN_ON_ONCE(1);
+                /* keep c->width */
+                ret = IEEE80211_STA_DISABLE_HT | IEEE80211_STA_DISABLE_VHT;
+                break;
         }
 
         WARN_ON_ONCE(!cfg80211_chandef_valid(c));
@@ -237,8 +211,9 @@ ieee80211_determine_chantype(struct ieee80211_sub_if_data *sdata,
                              struct ieee80211_channel *channel,
                              const struct ieee80211_ht_operation *ht_oper,
                              const struct ieee80211_vht_operation *vht_oper,
-                             struct cfg80211_chan_def *chandef, bool verbose)
+                             struct cfg80211_chan_def *chandef, bool tracking)
 {
+        struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
         struct cfg80211_chan_def vht_chandef;
         u32 ht_cfreq, ret;
 
@@ -257,7 +232,7 @@ ieee80211_determine_chantype(struct ieee80211_sub_if_data *sdata,
         ht_cfreq = ieee80211_channel_to_frequency(ht_oper->primary_chan,
                                                   channel->band);
         /* check that channel matches the right operating channel */
-        if (channel->center_freq != ht_cfreq) {
+        if (!tracking && channel->center_freq != ht_cfreq) {
                 /*
                  * It's possible that some APs are confused here;
                  * Netgear WNDR3700 sometimes reports 4 higher than
@@ -265,11 +240,10 @@ ieee80211_determine_chantype(struct ieee80211_sub_if_data *sdata,
                  * since we look at probe response/beacon data here
                  * it should be OK.
                  */
-                if (verbose)
-                        sdata_info(sdata,
-                                   "Wrong control channel: center-freq: %d ht-cfreq: %d ht->primary_chan: %d band: %d - Disabling HT\n",
-                                   channel->center_freq, ht_cfreq,
-                                   ht_oper->primary_chan, channel->band);
+                sdata_info(sdata,
+                           "Wrong control channel: center-freq: %d ht-cfreq: %d ht->primary_chan: %d band: %d - Disabling HT\n",
+                           channel->center_freq, ht_cfreq,
+                           ht_oper->primary_chan, channel->band);
                 ret = IEEE80211_STA_DISABLE_HT | IEEE80211_STA_DISABLE_VHT;
                 goto out;
         }
@@ -323,7 +297,7 @@ ieee80211_determine_chantype(struct ieee80211_sub_if_data *sdata,
                                 channel->band);
                 break;
         default:
-                if (verbose)
+                if (!(ifmgd->flags & IEEE80211_STA_DISABLE_VHT))
                         sdata_info(sdata,
                                    "AP VHT operation IE has invalid channel width (%d), disable VHT\n",
                                    vht_oper->chan_width);
@@ -332,7 +306,7 @@ ieee80211_determine_chantype(struct ieee80211_sub_if_data *sdata,
         }
 
         if (!cfg80211_chandef_valid(&vht_chandef)) {
-                if (verbose)
+                if (!(ifmgd->flags & IEEE80211_STA_DISABLE_VHT))
                         sdata_info(sdata,
                                    "AP VHT information is invalid, disable VHT\n");
                 ret = IEEE80211_STA_DISABLE_VHT;
@@ -345,7 +319,7 @@ ieee80211_determine_chantype(struct ieee80211_sub_if_data *sdata,
         }
 
         if (!cfg80211_chandef_compatible(chandef, &vht_chandef)) {
-                if (verbose)
+                if (!(ifmgd->flags & IEEE80211_STA_DISABLE_VHT))
                         sdata_info(sdata,
                                    "AP VHT information doesn't match HT, disable VHT\n");
                 ret = IEEE80211_STA_DISABLE_VHT;
@@ -361,18 +335,27 @@ out:
         if (ret & IEEE80211_STA_DISABLE_VHT)
                 vht_chandef = *chandef;
 
+        /*
+         * Ignore the DISABLED flag when we're already connected and only
+         * tracking the APs beacon for bandwidth changes - otherwise we
+         * might get disconnected here if we connect to an AP, update our
+         * regulatory information based on the AP's country IE and the
+         * information we have is wrong/outdated and disables the channel
+         * that we're actually using for the connection to the AP.
+         */
         while (!cfg80211_chandef_usable(sdata->local->hw.wiphy, chandef,
-                                        IEEE80211_CHAN_DISABLED)) {
+                                        tracking ? 0 :
+                                                   IEEE80211_CHAN_DISABLED)) {
                 if (WARN_ON(chandef->width == NL80211_CHAN_WIDTH_20_NOHT)) {
                         ret = IEEE80211_STA_DISABLE_HT |
                               IEEE80211_STA_DISABLE_VHT;
-                        goto out;
+                        break;
                 }
 
                 ret |= chandef_downgrade(chandef);
         }
 
-        if (chandef->width != vht_chandef.width && verbose)
+        if (chandef->width != vht_chandef.width && !tracking)
                 sdata_info(sdata,
                            "capabilities/regulatory prevented using AP HT/VHT configuration, downgraded\n");
 
@@ -412,7 +395,7 @@ static int ieee80211_config_bw(struct ieee80211_sub_if_data *sdata,
 
         /* calculate new channel (type) based on HT/VHT operation IEs */
         flags = ieee80211_determine_chantype(sdata, sband, chan, ht_oper,
-                                             vht_oper, &chandef, false);
+                                             vht_oper, &chandef, true);
 
         /*
          * Downgrade the new channel if we associated with restricted
@@ -506,27 +489,6 @@ static int ieee80211_config_bw(struct ieee80211_sub_if_data *sdata,
 
 /* frame sending functions */
 
-static int ieee80211_compatible_rates(const u8 *supp_rates, int supp_rates_len,
-                                      struct ieee80211_supported_band *sband,
-                                      u32 *rates)
-{
-        int i, j, count;
-        *rates = 0;
-        count = 0;
-        for (i = 0; i < supp_rates_len; i++) {
-                int rate = (supp_rates[i] & 0x7F) * 5;
-
-                for (j = 0; j < sband->n_bitrates; j++)
-                        if (sband->bitrates[j].bitrate == rate) {
-                                *rates |= BIT(j);
-                                count++;
-                                break;
-                        }
-        }
-
-        return count;
-}
-
 static void ieee80211_add_ht_ie(struct ieee80211_sub_if_data *sdata,
                                 struct sk_buff *skb, u8 ap_ht_param,
                                 struct ieee80211_supported_band *sband,
@@ -645,14 +607,14 @@ static void ieee80211_send_assoc(struct ieee80211_sub_if_data *sdata)
         struct ieee80211_mgmt *mgmt;
         u8 *pos, qos_info;
         size_t offset = 0, noffset;
-        int i, count, rates_len, supp_rates_len;
+        int i, count, rates_len, supp_rates_len, shift;
         u16 capab;
         struct ieee80211_supported_band *sband;
         struct ieee80211_chanctx_conf *chanctx_conf;
         struct ieee80211_channel *chan;
-        u32 rates = 0;
+        u32 rate_flags, rates = 0;
 
-        lockdep_assert_held(&ifmgd->mtx);
+        sdata_assert_lock(sdata);
 
         rcu_read_lock();
         chanctx_conf = rcu_dereference(sdata->vif.chanctx_conf);
@@ -661,8 +623,10 @@ static void ieee80211_send_assoc(struct ieee80211_sub_if_data *sdata)
                 return;
         }
         chan = chanctx_conf->def.chan;
+        rate_flags = ieee80211_chandef_rate_flags(&chanctx_conf->def);
         rcu_read_unlock();
         sband = local->hw.wiphy->bands[chan->band];
+        shift = ieee80211_vif_get_shift(&sdata->vif);
 
         if (assoc_data->supp_rates_len) {
                 /*
@@ -671,17 +635,24 @@ static void ieee80211_send_assoc(struct ieee80211_sub_if_data *sdata)
                  * in the association request (e.g. D-Link DAP 1353 in
                  * b-only mode)...
                  */
-                rates_len = ieee80211_compatible_rates(assoc_data->supp_rates,
-                                                       assoc_data->supp_rates_len,
-                                                       sband, &rates);
+                rates_len = ieee80211_parse_bitrates(&chanctx_conf->def, sband,
+                                                     assoc_data->supp_rates,
+                                                     assoc_data->supp_rates_len,
+                                                     &rates);
         } else {
                 /*
                  * In case AP not provide any supported rates information
                  * before association, we send information element(s) with
                  * all rates that we support.
                  */
-                rates = ~0;
-                rates_len = sband->n_bitrates;
+                rates_len = 0;
+                for (i = 0; i < sband->n_bitrates; i++) {
+                        if ((rate_flags & sband->bitrates[i].flags)
+                            != rate_flags)
+                                continue;
+                        rates |= BIT(i);
+                        rates_len++;
+                }
         }
 
         skb = alloc_skb(local->hw.extra_tx_headroom +
@@ -758,8 +729,9 @@ static void ieee80211_send_assoc(struct ieee80211_sub_if_data *sdata)
         count = 0;
         for (i = 0; i < sband->n_bitrates; i++) {
                 if (BIT(i) & rates) {
-                        int rate = sband->bitrates[i].bitrate;
-                        *pos++ = (u8) (rate / 5);
+                        int rate = DIV_ROUND_UP(sband->bitrates[i].bitrate,
+                                                5 * (1 << shift));
+                        *pos++ = (u8) rate;
                         if (++count == 8)
                                 break;
                 }
@@ -772,8 +744,10 @@ static void ieee80211_send_assoc(struct ieee80211_sub_if_data *sdata)
 
                 for (i++; i < sband->n_bitrates; i++) {
                         if (BIT(i) & rates) {
-                                int rate = sband->bitrates[i].bitrate;
-                                *pos++ = (u8) (rate / 5);
+                                int rate;
+                                rate = DIV_ROUND_UP(sband->bitrates[i].bitrate,
+                                                    5 * (1 << shift));
+                                *pos++ = (u8) rate;
                         }
                 }
         }
@@ -784,7 +758,8 @@ static void ieee80211_send_assoc(struct ieee80211_sub_if_data *sdata)
                 *pos++ = WLAN_EID_PWR_CAPABILITY;
                 *pos++ = 2;
                 *pos++ = 0; /* min tx power */
-                *pos++ = chan->max_power; /* max tx power */
+                 /* max tx power */
+                *pos++ = ieee80211_chandef_max_power(&chanctx_conf->def);
 
                 /* 2. supported channels */
                 /* TODO: get this in reg domain format */
@@ -914,6 +889,10 @@ void ieee80211_send_nullfunc(struct ieee80211_local *local,
 
         IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT |
                                         IEEE80211_TX_INTFL_OFFCHAN_TX_OK;
+
+        if (local->hw.flags & IEEE80211_HW_REPORTS_TX_ACK_STATUS)
+                IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_CTL_REQ_TX_STATUS;
+
         if (ifmgd->flags & (IEEE80211_STA_BEACON_POLL |
                             IEEE80211_STA_CONNECTION_POLL))
                 IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_CTL_USE_MINRATE;
@@ -962,7 +941,7 @@ static void ieee80211_chswitch_work(struct work_struct *work)
         if (!ieee80211_sdata_running(sdata))
                 return;
 
-        mutex_lock(&ifmgd->mtx);
+        sdata_lock(sdata);
         if (!ifmgd->associated)
                 goto out;
 
@@ -985,7 +964,7 @@ static void ieee80211_chswitch_work(struct work_struct *work)
                                         IEEE80211_QUEUE_STOP_REASON_CSA);
  out:
         ifmgd->flags &= ~IEEE80211_STA_CSA_RECEIVED;
-        mutex_unlock(&ifmgd->mtx);
+        sdata_unlock(sdata);
 }
 
 void ieee80211_chswitch_done(struct ieee80211_vif *vif, bool success)
@@ -1036,7 +1015,7 @@ ieee80211_sta_process_chanswitch(struct ieee80211_sub_if_data *sdata,
         const struct ieee80211_ht_operation *ht_oper;
         int secondary_channel_offset = -1;
 
-        ASSERT_MGD_MTX(ifmgd);
+        sdata_assert_lock(sdata);
 
         if (!cbss)
                 return;
@@ -1134,6 +1113,15 @@ ieee80211_sta_process_chanswitch(struct ieee80211_sub_if_data *sdata,
         case -1:
                 cfg80211_chandef_create(&new_chandef, new_chan,
                                         NL80211_CHAN_NO_HT);
+                /* keep width for 5/10 MHz channels */
+                switch (sdata->vif.bss_conf.chandef.width) {
+                case NL80211_CHAN_WIDTH_5:
+                case NL80211_CHAN_WIDTH_10:
+                        new_chandef.width = sdata->vif.bss_conf.chandef.width;
+                        break;
+                default:
+                        break;
+                }
                 break;
         }
 
@@ -1390,6 +1378,9 @@ static bool ieee80211_powersave_allowed(struct ieee80211_sub_if_data *sdata)
                           IEEE80211_STA_CONNECTION_POLL))
                 return false;
 
+        if (!mgd->have_beacon)
+                return false;
+
         rcu_read_lock();
         sta = sta_info_get(sdata, mgd->bssid);
         if (sta)
@@ -1798,7 +1789,7 @@ static void ieee80211_set_associated(struct ieee80211_sub_if_data *sdata,
 
         ieee80211_led_assoc(local, 1);
 
-        if (sdata->u.mgd.assoc_data->have_beacon) {
+        if (sdata->u.mgd.have_beacon) {
                 /*
                  * If the AP is buggy we may get here with no DTIM period
                  * known, so assume it's 1 which is the only safe assumption
@@ -1806,8 +1797,10 @@ static void ieee80211_set_associated(struct ieee80211_sub_if_data *sdata,
                  * probably just won't work at all.
                  */
                 bss_conf->dtim_period = sdata->u.mgd.dtim_period ?: 1;
-                bss_info_changed |= BSS_CHANGED_DTIM_PERIOD;
+                bss_conf->beacon_rate = bss->beacon_rate;
+                bss_info_changed |= BSS_CHANGED_BEACON_INFO;
         } else {
+                bss_conf->beacon_rate = NULL;
                 bss_conf->dtim_period = 0;
         }
 
@@ -1842,7 +1835,7 @@ static void ieee80211_set_disassoc(struct ieee80211_sub_if_data *sdata,
         struct ieee80211_local *local = sdata->local;
         u32 changed = 0;
 
-        ASSERT_MGD_MTX(ifmgd);
+        sdata_assert_lock(sdata);
 
         if (WARN_ON_ONCE(tx && !frame_buf))
                 return;
@@ -1930,6 +1923,9 @@ static void ieee80211_set_disassoc(struct ieee80211_sub_if_data *sdata,
         del_timer_sync(&sdata->u.mgd.chswitch_timer);
 
         sdata->vif.bss_conf.dtim_period = 0;
+        sdata->vif.bss_conf.beacon_rate = NULL;
+
+        ifmgd->have_beacon = false;
 
         ifmgd->flags = 0;
         ieee80211_vif_release_channel(sdata);
@@ -2051,7 +2047,7 @@ static void ieee80211_mgd_probe_ap_send(struct ieee80211_sub_if_data *sdata)
         }
 
         ifmgd->probe_timeout = jiffies + msecs_to_jiffies(probe_wait_ms);
-        run_again(ifmgd, ifmgd->probe_timeout);
+        run_again(sdata, ifmgd->probe_timeout);
         if (sdata->local->hw.flags & IEEE80211_HW_REPORTS_TX_ACK_STATUS)
                 ieee80211_flush_queues(sdata->local, sdata);
 }
@@ -2065,7 +2061,7 @@ static void ieee80211_mgd_probe_ap(struct ieee80211_sub_if_data *sdata,
         if (!ieee80211_sdata_running(sdata))
                 return;
 
-        mutex_lock(&ifmgd->mtx);
+        sdata_lock(sdata);
 
         if (!ifmgd->associated)
                 goto out;
@@ -2119,7 +2115,7 @@ static void ieee80211_mgd_probe_ap(struct ieee80211_sub_if_data *sdata,
         ifmgd->probe_send_count = 0;
         ieee80211_mgd_probe_ap_send(sdata);
  out:
-        mutex_unlock(&ifmgd->mtx);
+        sdata_unlock(sdata);
 }
 
 struct sk_buff *ieee80211_ap_probereq_get(struct ieee80211_hw *hw,
@@ -2135,7 +2131,7 @@ struct sk_buff *ieee80211_ap_probereq_get(struct ieee80211_hw *hw,
         if (WARN_ON(sdata->vif.type != NL80211_IFTYPE_STATION))
                 return NULL;
 
-        ASSERT_MGD_MTX(ifmgd);
+        sdata_assert_lock(sdata);
 
         if (ifmgd->associated)
                 cbss = ifmgd->associated;
@@ -2168,9 +2164,9 @@ static void __ieee80211_disconnect(struct ieee80211_sub_if_data *sdata)
         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
         u8 frame_buf[IEEE80211_DEAUTH_FRAME_LEN];
 
-        mutex_lock(&ifmgd->mtx);
+        sdata_lock(sdata);
         if (!ifmgd->associated) {
-                mutex_unlock(&ifmgd->mtx);
+                sdata_unlock(sdata);
                 return;
         }
 
@@ -2181,13 +2177,10 @@ static void __ieee80211_disconnect(struct ieee80211_sub_if_data *sdata)
         ieee80211_wake_queues_by_reason(&sdata->local->hw,
                                         IEEE80211_MAX_QUEUE_MAP,
                                         IEEE80211_QUEUE_STOP_REASON_CSA);
-        mutex_unlock(&ifmgd->mtx);
 
-        /*
-         * must be outside lock due to cfg80211,
-         * but that's not a problem.
-         */
-        cfg80211_send_deauth(sdata->dev, frame_buf, IEEE80211_DEAUTH_FRAME_LEN);
+        cfg80211_tx_mlme_mgmt(sdata->dev, frame_buf,
+                              IEEE80211_DEAUTH_FRAME_LEN);
+        sdata_unlock(sdata);
 }
 
 static void ieee80211_beacon_connection_loss_work(struct work_struct *work)
@@ -2254,7 +2247,7 @@ static void ieee80211_destroy_auth_data(struct ieee80211_sub_if_data *sdata,
 {
         struct ieee80211_mgd_auth_data *auth_data = sdata->u.mgd.auth_data;
 
-        lockdep_assert_held(&sdata->u.mgd.mtx);
+        sdata_assert_lock(sdata);
 
         if (!assoc) {
                 sta_info_destroy_addr(sdata, auth_data->bss->bssid);
@@ -2295,27 +2288,26 @@ static void ieee80211_auth_challenge(struct ieee80211_sub_if_data *sdata,
                             auth_data->key_idx, tx_flags);
 }
 
-static enum rx_mgmt_action __must_check
-ieee80211_rx_mgmt_auth(struct ieee80211_sub_if_data *sdata,
-                       struct ieee80211_mgmt *mgmt, size_t len)
+static void ieee80211_rx_mgmt_auth(struct ieee80211_sub_if_data *sdata,
+                                   struct ieee80211_mgmt *mgmt, size_t len)
 {
         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
         u8 bssid[ETH_ALEN];
         u16 auth_alg, auth_transaction, status_code;
         struct sta_info *sta;
 
-        lockdep_assert_held(&ifmgd->mtx);
+        sdata_assert_lock(sdata);
 
         if (len < 24 + 6)
-                return RX_MGMT_NONE;
+                return;
 
         if (!ifmgd->auth_data || ifmgd->auth_data->done)
-                return RX_MGMT_NONE;
+                return;
 
         memcpy(bssid, ifmgd->auth_data->bss->bssid, ETH_ALEN);
 
         if (!ether_addr_equal(bssid, mgmt->bssid))
-                return RX_MGMT_NONE;
+                return;
 
         auth_alg = le16_to_cpu(mgmt->u.auth.auth_alg);
         auth_transaction = le16_to_cpu(mgmt->u.auth.auth_transaction);
@@ -2327,14 +2319,15 @@ ieee80211_rx_mgmt_auth(struct ieee80211_sub_if_data *sdata,
                            mgmt->sa, auth_alg, ifmgd->auth_data->algorithm,
                            auth_transaction,
                            ifmgd->auth_data->expected_transaction);
-                return RX_MGMT_NONE;
+                return;
         }
 
         if (status_code != WLAN_STATUS_SUCCESS) {
                 sdata_info(sdata, "%pM denied authentication (status %d)\n",
                            mgmt->sa, status_code);
                 ieee80211_destroy_auth_data(sdata, false);
-                return RX_MGMT_CFG80211_RX_AUTH;
+                cfg80211_rx_mlme_mgmt(sdata->dev, (u8 *)mgmt, len);
+                return;
         }
 
         switch (ifmgd->auth_data->algorithm) {
@@ -2347,20 +2340,20 @@ ieee80211_rx_mgmt_auth(struct ieee80211_sub_if_data *sdata,
                 if (ifmgd->auth_data->expected_transaction != 4) {
                         ieee80211_auth_challenge(sdata, mgmt, len);
                         /* need another frame */
-                        return RX_MGMT_NONE;
+                        return;
                 }
                 break;
         default:
                 WARN_ONCE(1, "invalid auth alg %d",
                           ifmgd->auth_data->algorithm);
-                return RX_MGMT_NONE;
+                return;
         }
 
         sdata_info(sdata, "authenticated\n");
         ifmgd->auth_data->done = true;
         ifmgd->auth_data->timeout = jiffies + IEEE80211_AUTH_WAIT_ASSOC;
         ifmgd->auth_data->timeout_started = true;
-        run_again(ifmgd, ifmgd->auth_data->timeout);
+        run_again(sdata, ifmgd->auth_data->timeout);
 
         if (ifmgd->auth_data->algorithm == WLAN_AUTH_SAE &&
             ifmgd->auth_data->expected_transaction != 2) {
@@ -2368,7 +2361,8 @@ ieee80211_rx_mgmt_auth(struct ieee80211_sub_if_data *sdata,
                  * Report auth frame to user space for processing since another
                  * round of Authentication frames is still needed.
                  */
-                return RX_MGMT_CFG80211_RX_AUTH;
+                cfg80211_rx_mlme_mgmt(sdata->dev, (u8 *)mgmt, len);
+                return;
         }
 
         /* move station state to auth */
@@ -2384,30 +2378,29 @@ ieee80211_rx_mgmt_auth(struct ieee80211_sub_if_data *sdata,
         }
         mutex_unlock(&sdata->local->sta_mtx);
 
-        return RX_MGMT_CFG80211_RX_AUTH;
+        cfg80211_rx_mlme_mgmt(sdata->dev, (u8 *)mgmt, len);
+        return;
  out_err:
         mutex_unlock(&sdata->local->sta_mtx);
         /* ignore frame -- wait for timeout */
-        return RX_MGMT_NONE;
 }
 
 
-static enum rx_mgmt_action __must_check
-ieee80211_rx_mgmt_deauth(struct ieee80211_sub_if_data *sdata,
-                         struct ieee80211_mgmt *mgmt, size_t len)
+static void ieee80211_rx_mgmt_deauth(struct ieee80211_sub_if_data *sdata,
+                                     struct ieee80211_mgmt *mgmt, size_t len)
 {
         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
         const u8 *bssid = NULL;
         u16 reason_code;
 
-        lockdep_assert_held(&ifmgd->mtx);
+        sdata_assert_lock(sdata);
 
         if (len < 24 + 2)
-                return RX_MGMT_NONE;
+                return;
 
         if (!ifmgd->associated ||
             !ether_addr_equal(mgmt->bssid, ifmgd->associated->bssid))
-                return RX_MGMT_NONE;
+                return;
 
         bssid = ifmgd->associated->bssid;
 
@@ -2418,25 +2411,24 @@ ieee80211_rx_mgmt_deauth(struct ieee80211_sub_if_data *sdata,
 
         ieee80211_set_disassoc(sdata, 0, 0, false, NULL);
 
-        return RX_MGMT_CFG80211_DEAUTH;
+        cfg80211_rx_mlme_mgmt(sdata->dev, (u8 *)mgmt, len);
 }
 
 
-static enum rx_mgmt_action __must_check
-ieee80211_rx_mgmt_disassoc(struct ieee80211_sub_if_data *sdata,
-                           struct ieee80211_mgmt *mgmt, size_t len)
+static void ieee80211_rx_mgmt_disassoc(struct ieee80211_sub_if_data *sdata,
+                                       struct ieee80211_mgmt *mgmt, size_t len)
 {
         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
         u16 reason_code;
 
-        lockdep_assert_held(&ifmgd->mtx);
+        sdata_assert_lock(sdata);
 
         if (len < 24 + 2)
-                return RX_MGMT_NONE;
+                return;
 
         if (!ifmgd->associated ||
             !ether_addr_equal(mgmt->bssid, ifmgd->associated->bssid))
-                return RX_MGMT_NONE;
+                return;
 
         reason_code = le16_to_cpu(mgmt->u.disassoc.reason_code);
 
@@ -2445,22 +2437,23 @@ ieee80211_rx_mgmt_disassoc(struct ieee80211_sub_if_data *sdata,
 
         ieee80211_set_disassoc(sdata, 0, 0, false, NULL);
 
-        return RX_MGMT_CFG80211_DISASSOC;
+        cfg80211_rx_mlme_mgmt(sdata->dev, (u8 *)mgmt, len);
 }
 
 static void ieee80211_get_rates(struct ieee80211_supported_band *sband,
                                 u8 *supp_rates, unsigned int supp_rates_len,
                                 u32 *rates, u32 *basic_rates,
                                 bool *have_higher_than_11mbit,
-                                int *min_rate, int *min_rate_index)
+                                int *min_rate, int *min_rate_index,
+                                int shift, u32 rate_flags)
 {
         int i, j;
 
         for (i = 0; i < supp_rates_len; i++) {
-                int rate = (supp_rates[i] & 0x7f) * 5;
+                int rate = supp_rates[i] & 0x7f;
                 bool is_basic = !!(supp_rates[i] & 0x80);
 
-                if (rate > 110)
+                if ((rate * 5 * (1 << shift)) > 110)
                         *have_higher_than_11mbit = true;
 
                 /*
@@ -2476,12 +2469,20 @@ static void ieee80211_get_rates(struct ieee80211_supported_band *sband,
                         continue;
 
                 for (j = 0; j < sband->n_bitrates; j++) {
-                        if (sband->bitrates[j].bitrate == rate) {
+                        struct ieee80211_rate *br;
+                        int brate;
+
+                        br = &sband->bitrates[j];
+                        if ((rate_flags & br->flags) != rate_flags)
+                                continue;
+
+                        brate = DIV_ROUND_UP(br->bitrate, (1 << shift) * 5);
+                        if (brate == rate) {
                                 *rates |= BIT(j);
                                 if (is_basic)
                                         *basic_rates |= BIT(j);
-                                if (rate < *min_rate) {
-                                        *min_rate = rate;
+                                if ((rate * 5) < *min_rate) {
+                                        *min_rate = rate * 5;
                                         *min_rate_index = j;
                                 }
                                 break;
@@ -2495,7 +2496,7 @@ static void ieee80211_destroy_assoc_data(struct ieee80211_sub_if_data *sdata,
 {
         struct ieee80211_mgd_assoc_data *assoc_data = sdata->u.mgd.assoc_data;
 
-        lockdep_assert_held(&sdata->u.mgd.mtx);
+        sdata_assert_lock(sdata);
 
         if (!assoc) {
                 sta_info_destroy_addr(sdata, assoc_data->bss->bssid);
@@ -2522,8 +2523,11 @@ static bool ieee80211_assoc_success(struct ieee80211_sub_if_data *sdata,
         u16 capab_info, aid;
         struct ieee802_11_elems elems;
         struct ieee80211_bss_conf *bss_conf = &sdata->vif.bss_conf;
+        const struct cfg80211_bss_ies *bss_ies = NULL;
+        struct ieee80211_mgd_assoc_data *assoc_data = ifmgd->assoc_data;
         u32 changed = 0;
         int err;
+        bool ret;
 
         /* AssocResp and ReassocResp have identical structure */
 
@@ -2555,21 +2559,86 @@ static bool ieee80211_assoc_success(struct ieee80211_sub_if_data *sdata,
         ifmgd->aid = aid;
 
         /*
+         * Some APs are erroneously not including some information in their
+         * (re)association response frames. Try to recover by using the data
+         * from the beacon or probe response. This seems to afflict mobile
+         * 2G/3G/4G wifi routers, reported models include the "Onda PN51T",
+         * "Vodafone PocketWiFi 2", "ZTE MF60" and a similar T-Mobile device.
+         */
+        if ((assoc_data->wmm && !elems.wmm_param) ||
+            (!(ifmgd->flags & IEEE80211_STA_DISABLE_HT) &&
+             (!elems.ht_cap_elem || !elems.ht_operation)) ||
+            (!(ifmgd->flags & IEEE80211_STA_DISABLE_VHT) &&
+             (!elems.vht_cap_elem || !elems.vht_operation))) {
+                const struct cfg80211_bss_ies *ies;
+                struct ieee802_11_elems bss_elems;
+
+                rcu_read_lock();
+                ies = rcu_dereference(cbss->ies);
+                if (ies)
+                        bss_ies = kmemdup(ies, sizeof(*ies) + ies->len,
+                                          GFP_ATOMIC);
+                rcu_read_unlock();
+                if (!bss_ies)
+                        return false;
+
+                ieee802_11_parse_elems(bss_ies->data, bss_ies->len,
+                                       false, &bss_elems);
+                if (assoc_data->wmm &&
+                    !elems.wmm_param && bss_elems.wmm_param) {
+                        elems.wmm_param = bss_elems.wmm_param;
+                        sdata_info(sdata,
+                                   "AP bug: WMM param missing from AssocResp\n");
+                }
+
+                /*
+                 * Also check if we requested HT/VHT, otherwise the AP doesn't
+                 * have to include the IEs in the (re)association response.
+                 */
+                if (!elems.ht_cap_elem && bss_elems.ht_cap_elem &&
+                    !(ifmgd->flags & IEEE80211_STA_DISABLE_HT)) {
+                        elems.ht_cap_elem = bss_elems.ht_cap_elem;
+                        sdata_info(sdata,
+                                   "AP bug: HT capability missing from AssocResp\n");
+                }
+                if (!elems.ht_operation && bss_elems.ht_operation &&
+                    !(ifmgd->flags & IEEE80211_STA_DISABLE_HT)) {
+                        elems.ht_operation = bss_elems.ht_operation;
+                        sdata_info(sdata,
+                                   "AP bug: HT operation missing from AssocResp\n");
+                }
+                if (!elems.vht_cap_elem && bss_elems.vht_cap_elem &&
+                    !(ifmgd->flags & IEEE80211_STA_DISABLE_VHT)) {
+                        elems.vht_cap_elem = bss_elems.vht_cap_elem;
+                        sdata_info(sdata,
+                                   "AP bug: VHT capa missing from AssocResp\n");
+                }
+                if (!elems.vht_operation && bss_elems.vht_operation &&
+                    !(ifmgd->flags & IEEE80211_STA_DISABLE_VHT)) {
+                        elems.vht_operation = bss_elems.vht_operation;
+                        sdata_info(sdata,
+                                   "AP bug: VHT operation missing from AssocResp\n");
+                }
+        }
+
+        /*
          * We previously checked these in the beacon/probe response, so
          * they should be present here. This is just a safety net.
          */
         if (!(ifmgd->flags & IEEE80211_STA_DISABLE_HT) &&
             (!elems.wmm_param || !elems.ht_cap_elem || !elems.ht_operation)) {
                 sdata_info(sdata,
-                           "HT AP is missing WMM params or HT capability/operation in AssocResp\n");
-                return false;
+                           "HT AP is missing WMM params or HT capability/operation\n");
+                ret = false;
+                goto out;
         }
 
         if (!(ifmgd->flags & IEEE80211_STA_DISABLE_VHT) &&
             (!elems.vht_cap_elem || !elems.vht_operation)) {
                 sdata_info(sdata,
-                           "VHT AP is missing VHT capability/operation in AssocResp\n");
-                return false;
+                           "VHT AP is missing VHT capability/operation\n");
+                ret = false;
+                goto out;
         }
 
         mutex_lock(&sdata->local->sta_mtx);
@@ -2580,7 +2649,8 @@ static bool ieee80211_assoc_success(struct ieee80211_sub_if_data *sdata,
         sta = sta_info_get(sdata, cbss->bssid);
         if (WARN_ON(!sta)) {
                 mutex_unlock(&sdata->local->sta_mtx);
-                return false;
+                ret = false;
+                goto out;
         }
 
         sband = local->hw.wiphy->bands[ieee80211_get_sdata_band(sdata)];
@@ -2633,7 +2703,8 @@ static bool ieee80211_assoc_success(struct ieee80211_sub_if_data *sdata,
                            sta->sta.addr);
                 WARN_ON(__sta_info_destroy(sta));
                 mutex_unlock(&sdata->local->sta_mtx);
-                return false;
+                ret = false;
+                goto out;
         }
 
         mutex_unlock(&sdata->local->sta_mtx);
@@ -2673,13 +2744,15 @@ static bool ieee80211_assoc_success(struct ieee80211_sub_if_data *sdata,
         ieee80211_sta_rx_notify(sdata, (struct ieee80211_hdr *)mgmt);
         ieee80211_sta_reset_beacon_monitor(sdata);
 
-        return true;
+        ret = true;
+ out:
+        kfree(bss_ies);
+        return ret;
 }
 
-static enum rx_mgmt_action __must_check
-ieee80211_rx_mgmt_assoc_resp(struct ieee80211_sub_if_data *sdata,
-                             struct ieee80211_mgmt *mgmt, size_t len,
-                             struct cfg80211_bss **bss)
+static void ieee80211_rx_mgmt_assoc_resp(struct ieee80211_sub_if_data *sdata,
+                                         struct ieee80211_mgmt *mgmt,
+                                         size_t len)
 {
         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
         struct ieee80211_mgd_assoc_data *assoc_data = ifmgd->assoc_data;
@@ -2687,13 +2760,14 @@ ieee80211_rx_mgmt_assoc_resp(struct ieee80211_sub_if_data *sdata,
         struct ieee802_11_elems elems;
         u8 *pos;
         bool reassoc;
+        struct cfg80211_bss *bss;
 
-        lockdep_assert_held(&ifmgd->mtx);
+        sdata_assert_lock(sdata);
 
         if (!assoc_data)
-                return RX_MGMT_NONE;
+                return;
         if (!ether_addr_equal(assoc_data->bss->bssid, mgmt->bssid))
-                return RX_MGMT_NONE;
+                return;
 
         /*
          * AssocResp and ReassocResp have identical structure, so process both
@@ -2701,7 +2775,7 @@ ieee80211_rx_mgmt_assoc_resp(struct ieee80211_sub_if_data *sdata,
          */
 
         if (len < 24 + 6)
-                return RX_MGMT_NONE;
+                return;
 
         reassoc = ieee80211_is_reassoc_req(mgmt->frame_control);
         capab_info = le16_to_cpu(mgmt->u.assoc_resp.capab_info);
@@ -2728,22 +2802,22 @@ ieee80211_rx_mgmt_assoc_resp(struct ieee80211_sub_if_data *sdata,
                 assoc_data->timeout = jiffies + msecs_to_jiffies(ms);
                 assoc_data->timeout_started = true;
                 if (ms > IEEE80211_ASSOC_TIMEOUT)
-                        run_again(ifmgd, assoc_data->timeout);
-                return RX_MGMT_NONE;
+                        run_again(sdata, assoc_data->timeout);
+                return;
         }
 
-        *bss = assoc_data->bss;
+        bss = assoc_data->bss;
 
         if (status_code != WLAN_STATUS_SUCCESS) {
                 sdata_info(sdata, "%pM denied association (code=%d)\n",
                            mgmt->sa, status_code);
                 ieee80211_destroy_assoc_data(sdata, false);
         } else {
-                if (!ieee80211_assoc_success(sdata, *bss, mgmt, len)) {
+                if (!ieee80211_assoc_success(sdata, bss, mgmt, len)) {
                         /* oops -- internal error -- send timeout for now */
                         ieee80211_destroy_assoc_data(sdata, false);
-                        cfg80211_put_bss(sdata->local->hw.wiphy, *bss);
-                        return RX_MGMT_CFG80211_ASSOC_TIMEOUT;
+                        cfg80211_assoc_timeout(sdata->dev, bss);
+                        return;
                 }
                 sdata_info(sdata, "associated\n");
 
@@ -2755,7 +2829,7 @@ ieee80211_rx_mgmt_assoc_resp(struct ieee80211_sub_if_data *sdata,
                 ieee80211_destroy_assoc_data(sdata, true);
         }
 
-        return RX_MGMT_CFG80211_RX_ASSOC;
+        cfg80211_rx_assoc_resp(sdata->dev, bss, (u8 *)mgmt, len);
 }
 
 static void ieee80211_rx_bss_info(struct ieee80211_sub_if_data *sdata,
@@ -2767,23 +2841,8 @@ static void ieee80211_rx_bss_info(struct ieee80211_sub_if_data *sdata,
         int freq;
         struct ieee80211_bss *bss;
         struct ieee80211_channel *channel;
-        bool need_ps = false;
 
-        lockdep_assert_held(&sdata->u.mgd.mtx);
-
-        if ((sdata->u.mgd.associated &&
-             ether_addr_equal(mgmt->bssid, sdata->u.mgd.associated->bssid)) ||
-            (sdata->u.mgd.assoc_data &&
-             ether_addr_equal(mgmt->bssid,
-                              sdata->u.mgd.assoc_data->bss->bssid))) {
-                /* not previously set so we may need to recalc */
-                need_ps = sdata->u.mgd.associated && !sdata->u.mgd.dtim_period;
-
-                if (elems->tim && !elems->parse_error) {
-                        const struct ieee80211_tim_ie *tim_ie = elems->tim;
-                        sdata->u.mgd.dtim_period = tim_ie->dtim_period;
-                }
-        }
+        sdata_assert_lock(sdata);
 
         if (elems->ds_params)
                 freq = ieee80211_channel_to_frequency(elems->ds_params[0],
@@ -2798,22 +2857,10 @@ static void ieee80211_rx_bss_info(struct ieee80211_sub_if_data *sdata,
 
         bss = ieee80211_bss_info_update(local, rx_status, mgmt, len, elems,
                                         channel);
-        if (bss)
+        if (bss) {
                 ieee80211_rx_bss_put(local, bss);
-
-        if (!sdata->u.mgd.associated ||
-            !ether_addr_equal(mgmt->bssid, sdata->u.mgd.associated->bssid))
-                return;
-
-        if (need_ps) {
-                mutex_lock(&local->iflist_mtx);
-                ieee80211_recalc_ps(local, -1);
-                mutex_unlock(&local->iflist_mtx);
+                sdata->vif.bss_conf.beacon_rate = bss->beacon_rate;
         }
-
-        ieee80211_sta_process_chanswitch(sdata, rx_status->mactime,
-                                         elems, true);
-
 }
 
 
@@ -2828,7 +2875,7 @@ static void ieee80211_rx_mgmt_probe_resp(struct ieee80211_sub_if_data *sdata,
 
         ifmgd = &sdata->u.mgd;
 
-        ASSERT_MGD_MTX(ifmgd);
+        sdata_assert_lock(sdata);
 
         if (!ether_addr_equal(mgmt->da, sdata->vif.addr))
                 return; /* ignore ProbeResp to foreign address */
@@ -2853,7 +2900,7 @@ static void ieee80211_rx_mgmt_probe_resp(struct ieee80211_sub_if_data *sdata,
                 ifmgd->auth_data->tries = 0;
                 ifmgd->auth_data->timeout = jiffies;
                 ifmgd->auth_data->timeout_started = true;
-                run_again(ifmgd, ifmgd->auth_data->timeout);
+                run_again(sdata, ifmgd->auth_data->timeout);
         }
 }
 
@@ -2878,10 +2925,9 @@ static const u64 care_about_ies =
         (1ULL << WLAN_EID_HT_CAPABILITY) |
         (1ULL << WLAN_EID_HT_OPERATION);
 
-static enum rx_mgmt_action
-ieee80211_rx_mgmt_beacon(struct ieee80211_sub_if_data *sdata,
-                         struct ieee80211_mgmt *mgmt, size_t len,
-                         u8 *deauth_buf, struct ieee80211_rx_status *rx_status)
+static void ieee80211_rx_mgmt_beacon(struct ieee80211_sub_if_data *sdata,
+                                     struct ieee80211_mgmt *mgmt, size_t len,
+                                     struct ieee80211_rx_status *rx_status)
 {
         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
         struct ieee80211_bss_conf *bss_conf = &sdata->vif.bss_conf;
@@ -2896,24 +2942,25 @@ ieee80211_rx_mgmt_beacon(struct ieee80211_sub_if_data *sdata,
         u8 erp_value = 0;
         u32 ncrc;
         u8 *bssid;
+        u8 deauth_buf[IEEE80211_DEAUTH_FRAME_LEN];
 
-        lockdep_assert_held(&ifmgd->mtx);
+        sdata_assert_lock(sdata);
 
         /* Process beacon from the current BSS */
         baselen = (u8 *) mgmt->u.beacon.variable - (u8 *) mgmt;
         if (baselen > len)
-                return RX_MGMT_NONE;
+                return;
 
         rcu_read_lock();
         chanctx_conf = rcu_dereference(sdata->vif.chanctx_conf);
         if (!chanctx_conf) {
                 rcu_read_unlock();
-                return RX_MGMT_NONE;
+                return;
         }
 
         if (rx_status->freq != chanctx_conf->def.chan->center_freq) {
                 rcu_read_unlock();
-                return RX_MGMT_NONE;
+                return;
         }
         chan = chanctx_conf->def.chan;
         rcu_read_unlock();
@@ -2924,7 +2971,11 @@ ieee80211_rx_mgmt_beacon(struct ieee80211_sub_if_data *sdata,
                                        len - baselen, false, &elems);
 
                 ieee80211_rx_bss_info(sdata, mgmt, len, rx_status, &elems);
-                ifmgd->assoc_data->have_beacon = true;
+                if (elems.tim && !elems.parse_error) {
+                        const struct ieee80211_tim_ie *tim_ie = elems.tim;
+                        ifmgd->dtim_period = tim_ie->dtim_period;
+                }
+                ifmgd->have_beacon = true;
                 ifmgd->assoc_data->need_beacon = false;
                 if (local->hw.flags & IEEE80211_HW_TIMING_BEACON_ONLY) {
                         sdata->vif.bss_conf.sync_tsf =
@@ -2940,13 +2991,13 @@ ieee80211_rx_mgmt_beacon(struct ieee80211_sub_if_data *sdata,
                 /* continue assoc process */
                 ifmgd->assoc_data->timeout = jiffies;
                 ifmgd->assoc_data->timeout_started = true;
-                run_again(ifmgd, ifmgd->assoc_data->timeout);
-                return RX_MGMT_NONE;
+                run_again(sdata, ifmgd->assoc_data->timeout);
+                return;
         }
 
         if (!ifmgd->associated ||
             !ether_addr_equal(mgmt->bssid, ifmgd->associated->bssid))
-                return RX_MGMT_NONE;
+                return;
         bssid = ifmgd->associated->bssid;
 
         /* Track average RSSI from the Beacon frames of the current AP */
@@ -3092,12 +3143,15 @@ ieee80211_rx_mgmt_beacon(struct ieee80211_sub_if_data *sdata,
         }
 
         if (ncrc == ifmgd->beacon_crc && ifmgd->beacon_crc_valid)
-                return RX_MGMT_NONE;
+                return;
         ifmgd->beacon_crc = ncrc;
         ifmgd->beacon_crc_valid = true;
 
         ieee80211_rx_bss_info(sdata, mgmt, len, rx_status, &elems);
 
+        ieee80211_sta_process_chanswitch(sdata, rx_status->mactime,
+                                         &elems, true);
+
         if (ieee80211_sta_wmm_params(local, sdata, elems.wmm_param,
                                      elems.wmm_param_len))
                 changed |= BSS_CHANGED_QOS;
@@ -3106,7 +3160,7 @@ ieee80211_rx_mgmt_beacon(struct ieee80211_sub_if_data *sdata,
          * If we haven't had a beacon before, tell the driver about the
          * DTIM period (and beacon timing if desired) now.
          */
-        if (!bss_conf->dtim_period) {
+        if (!ifmgd->have_beacon) {
                 /* a few bogus AP send dtim_period = 0 or no TIM IE */
                 if (elems.tim)
                         bss_conf->dtim_period = elems.tim->dtim_period ?: 1;
@@ -3125,7 +3179,14 @@ ieee80211_rx_mgmt_beacon(struct ieee80211_sub_if_data *sdata,
                                 sdata->vif.bss_conf.sync_dtim_count = 0;
                 }
 
-                changed |= BSS_CHANGED_DTIM_PERIOD;
+                changed |= BSS_CHANGED_BEACON_INFO;
+                ifmgd->have_beacon = true;
+
+                mutex_lock(&local->iflist_mtx);
+                ieee80211_recalc_ps(local, -1);
+                mutex_unlock(&local->iflist_mtx);
+
+                ieee80211_recalc_ps_vif(sdata);
         }
 
         if (elems.erp_info) {
@@ -3147,7 +3208,9 @@ ieee80211_rx_mgmt_beacon(struct ieee80211_sub_if_data *sdata,
                 ieee80211_set_disassoc(sdata, IEEE80211_STYPE_DEAUTH,
                                        WLAN_REASON_DEAUTH_LEAVING,
                                        true, deauth_buf);
-                return RX_MGMT_CFG80211_TX_DEAUTH;
+                cfg80211_tx_mlme_mgmt(sdata->dev, deauth_buf,
+                                      sizeof(deauth_buf));
+                return;
         }
 
         if (sta && elems.opmode_notif)
@@ -3164,19 +3227,13 @@ ieee80211_rx_mgmt_beacon(struct ieee80211_sub_if_data *sdata,
                                                        elems.pwr_constr_elem);
 
         ieee80211_bss_info_change_notify(sdata, changed);
-
-        return RX_MGMT_NONE;
 }
 
 void ieee80211_sta_rx_queued_mgmt(struct ieee80211_sub_if_data *sdata,
                                   struct sk_buff *skb)
 {
-        struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
         struct ieee80211_rx_status *rx_status;
         struct ieee80211_mgmt *mgmt;
-        struct cfg80211_bss *bss = NULL;
-        enum rx_mgmt_action rma = RX_MGMT_NONE;
-        u8 deauth_buf[IEEE80211_DEAUTH_FRAME_LEN];
         u16 fc;
         struct ieee802_11_elems elems;
         int ies_len;
@@ -3185,28 +3242,27 @@ void ieee80211_sta_rx_queued_mgmt(struct ieee80211_sub_if_data *sdata,
         mgmt = (struct ieee80211_mgmt *) skb->data;
         fc = le16_to_cpu(mgmt->frame_control);
 
-        mutex_lock(&ifmgd->mtx);
+        sdata_lock(sdata);
 
         switch (fc & IEEE80211_FCTL_STYPE) {
         case IEEE80211_STYPE_BEACON:
-                rma = ieee80211_rx_mgmt_beacon(sdata, mgmt, skb->len,
-                                               deauth_buf, rx_status);
+                ieee80211_rx_mgmt_beacon(sdata, mgmt, skb->len, rx_status);
                 break;
         case IEEE80211_STYPE_PROBE_RESP:
                 ieee80211_rx_mgmt_probe_resp(sdata, skb);
                 break;
         case IEEE80211_STYPE_AUTH:
-                rma = ieee80211_rx_mgmt_auth(sdata, mgmt, skb->len);
+                ieee80211_rx_mgmt_auth(sdata, mgmt, skb->len);
                 break;
         case IEEE80211_STYPE_DEAUTH:
-                rma = ieee80211_rx_mgmt_deauth(sdata, mgmt, skb->len);
+                ieee80211_rx_mgmt_deauth(sdata, mgmt, skb->len);
                 break;
         case IEEE80211_STYPE_DISASSOC:
-                rma = ieee80211_rx_mgmt_disassoc(sdata, mgmt, skb->len);
+                ieee80211_rx_mgmt_disassoc(sdata, mgmt, skb->len);
                 break;
         case IEEE80211_STYPE_ASSOC_RESP:
         case IEEE80211_STYPE_REASSOC_RESP:
-                rma = ieee80211_rx_mgmt_assoc_resp(sdata, mgmt, skb->len, &bss);
+                ieee80211_rx_mgmt_assoc_resp(sdata, mgmt, skb->len);
                 break;
         case IEEE80211_STYPE_ACTION:
                 if (mgmt->u.action.category == WLAN_CATEGORY_SPECTRUM_MGMT) {
@@ -3252,34 +3308,7 @@ void ieee80211_sta_rx_queued_mgmt(struct ieee80211_sub_if_data *sdata,
                 }
                 break;
         }
-        mutex_unlock(&ifmgd->mtx);
-
-        switch (rma) {
-        case RX_MGMT_NONE:
-                /* no action */
-                break;
-        case RX_MGMT_CFG80211_DEAUTH:
-                cfg80211_send_deauth(sdata->dev, (u8 *)mgmt, skb->len);
-                break;
-        case RX_MGMT_CFG80211_DISASSOC:
-                cfg80211_send_disassoc(sdata->dev, (u8 *)mgmt, skb->len);
-                break;
-        case RX_MGMT_CFG80211_RX_AUTH:
-                cfg80211_send_rx_auth(sdata->dev, (u8 *)mgmt, skb->len);
-                break;
-        case RX_MGMT_CFG80211_RX_ASSOC:
-                cfg80211_send_rx_assoc(sdata->dev, bss, (u8 *)mgmt, skb->len);
-                break;
-        case RX_MGMT_CFG80211_ASSOC_TIMEOUT:
-                cfg80211_send_assoc_timeout(sdata->dev, mgmt->bssid);
-                break;
-        case RX_MGMT_CFG80211_TX_DEAUTH:
-                cfg80211_send_deauth(sdata->dev, deauth_buf,
-                                     sizeof(deauth_buf));
-                break;
-        default:
-                WARN(1, "unexpected: %d", rma);
-        }
+        sdata_unlock(sdata);
 }
 
 static void ieee80211_sta_timer(unsigned long data)
@@ -3293,20 +3322,13 @@ static void ieee80211_sta_timer(unsigned long data)
 static void ieee80211_sta_connection_lost(struct ieee80211_sub_if_data *sdata,
                                           u8 *bssid, u8 reason, bool tx)
 {
-        struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
         u8 frame_buf[IEEE80211_DEAUTH_FRAME_LEN];
 
         ieee80211_set_disassoc(sdata, IEEE80211_STYPE_DEAUTH, reason,
                                tx, frame_buf);
-        mutex_unlock(&ifmgd->mtx);
-
-        /*
-         * must be outside lock due to cfg80211,
-         * but that's not a problem.
-         */
-        cfg80211_send_deauth(sdata->dev, frame_buf, IEEE80211_DEAUTH_FRAME_LEN);
 
-        mutex_lock(&ifmgd->mtx);
+        cfg80211_tx_mlme_mgmt(sdata->dev, frame_buf,
+                              IEEE80211_DEAUTH_FRAME_LEN);
 }
 
 static int ieee80211_probe_auth(struct ieee80211_sub_if_data *sdata)
@@ -3316,7 +3338,7 @@ static int ieee80211_probe_auth(struct ieee80211_sub_if_data *sdata)
         struct ieee80211_mgd_auth_data *auth_data = ifmgd->auth_data;
         u32 tx_flags = 0;
 
-        lockdep_assert_held(&ifmgd->mtx);
+        sdata_assert_lock(sdata);
 
         if (WARN_ON_ONCE(!auth_data))
                 return -EINVAL;
@@ -3388,10 +3410,13 @@ static int ieee80211_probe_auth(struct ieee80211_sub_if_data *sdata)
 
         if (tx_flags == 0) {
                 auth_data->timeout = jiffies + IEEE80211_AUTH_TIMEOUT;
-                ifmgd->auth_data->timeout_started = true;
-                run_again(ifmgd, auth_data->timeout);
+                auth_data->timeout_started = true;
+                run_again(sdata, auth_data->timeout);
         } else {
-                auth_data->timeout_started = false;
+                auth_data->timeout =
+                        round_jiffies_up(jiffies + IEEE80211_AUTH_TIMEOUT_LONG);
+                auth_data->timeout_started = true;
+                run_again(sdata, auth_data->timeout);
         }
 
         return 0;
@@ -3402,7 +3427,7 @@ static int ieee80211_do_assoc(struct ieee80211_sub_if_data *sdata)
         struct ieee80211_mgd_assoc_data *assoc_data = sdata->u.mgd.assoc_data;
         struct ieee80211_local *local = sdata->local;
 
-        lockdep_assert_held(&sdata->u.mgd.mtx);
+        sdata_assert_lock(sdata);
 
         assoc_data->tries++;
         if (assoc_data->tries > IEEE80211_ASSOC_MAX_TRIES) {
@@ -3426,9 +3451,13 @@ static int ieee80211_do_assoc(struct ieee80211_sub_if_data *sdata)
         if (!(local->hw.flags & IEEE80211_HW_REPORTS_TX_ACK_STATUS)) {
                 assoc_data->timeout = jiffies + IEEE80211_ASSOC_TIMEOUT;
                 assoc_data->timeout_started = true;
-                run_again(&sdata->u.mgd, assoc_data->timeout);
+                run_again(sdata, assoc_data->timeout);
         } else {
-                assoc_data->timeout_started = false;
+                assoc_data->timeout =
+                        round_jiffies_up(jiffies +
+                                         IEEE80211_ASSOC_TIMEOUT_LONG);
+                assoc_data->timeout_started = true;
+                run_again(sdata, assoc_data->timeout);
         }
 
         return 0;
@@ -3451,7 +3480,7 @@ void ieee80211_sta_work(struct ieee80211_sub_if_data *sdata)
         struct ieee80211_local *local = sdata->local;
         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
 
-        mutex_lock(&ifmgd->mtx);
+        sdata_lock(sdata);
 
         if (ifmgd->status_received) {
                 __le16 fc = ifmgd->status_fc;
@@ -3463,7 +3492,7 @@ void ieee80211_sta_work(struct ieee80211_sub_if_data *sdata)
                         if (status_acked) {
                                 ifmgd->auth_data->timeout =
                                         jiffies + IEEE80211_AUTH_TIMEOUT_SHORT;
-                                run_again(ifmgd, ifmgd->auth_data->timeout);
+                                run_again(sdata, ifmgd->auth_data->timeout);
                         } else {
                                 ifmgd->auth_data->timeout = jiffies - 1;
                         }
@@ -3474,7 +3503,7 @@ void ieee80211_sta_work(struct ieee80211_sub_if_data *sdata)
                         if (status_acked) {
                                 ifmgd->assoc_data->timeout =
                                         jiffies + IEEE80211_ASSOC_TIMEOUT_SHORT;
-                                run_again(ifmgd, ifmgd->assoc_data->timeout);
+                                run_again(sdata, ifmgd->assoc_data->timeout);
                         } else {
                                 ifmgd->assoc_data->timeout = jiffies - 1;
                         }
@@ -3497,30 +3526,22 @@ void ieee80211_sta_work(struct ieee80211_sub_if_data *sdata)
 
                         ieee80211_destroy_auth_data(sdata, false);
 
-                        mutex_unlock(&ifmgd->mtx);
-                        cfg80211_send_auth_timeout(sdata->dev, bssid);
-                        mutex_lock(&ifmgd->mtx);
+                        cfg80211_auth_timeout(sdata->dev, bssid);
                 }
         } else if (ifmgd->auth_data && ifmgd->auth_data->timeout_started)
-                run_again(ifmgd, ifmgd->auth_data->timeout);
+                run_again(sdata, ifmgd->auth_data->timeout);
 
         if (ifmgd->assoc_data && ifmgd->assoc_data->timeout_started &&
             time_after(jiffies, ifmgd->assoc_data->timeout)) {
-                if ((ifmgd->assoc_data->need_beacon &&
-                     !ifmgd->assoc_data->have_beacon) ||
+                if ((ifmgd->assoc_data->need_beacon && !ifmgd->have_beacon) ||
                     ieee80211_do_assoc(sdata)) {
-                        u8 bssid[ETH_ALEN];
-
-                        memcpy(bssid, ifmgd->assoc_data->bss->bssid, ETH_ALEN);
+                        struct cfg80211_bss *bss = ifmgd->assoc_data->bss;
 
                         ieee80211_destroy_assoc_data(sdata, false);
-
-                        mutex_unlock(&ifmgd->mtx);
-                        cfg80211_send_assoc_timeout(sdata->dev, bssid);
-                        mutex_lock(&ifmgd->mtx);
+                        cfg80211_assoc_timeout(sdata->dev, bss);
                 }
         } else if (ifmgd->assoc_data && ifmgd->assoc_data->timeout_started)
-                run_again(ifmgd, ifmgd->assoc_data->timeout);
+                run_again(sdata, ifmgd->assoc_data->timeout);
 
         if (ifmgd->flags & (IEEE80211_STA_BEACON_POLL |
                             IEEE80211_STA_CONNECTION_POLL) &&
@@ -3554,7 +3575,7 @@ void ieee80211_sta_work(struct ieee80211_sub_if_data *sdata)
                                         false);
                         }
                 } else if (time_is_after_jiffies(ifmgd->probe_timeout))
-                        run_again(ifmgd, ifmgd->probe_timeout);
+                        run_again(sdata, ifmgd->probe_timeout);
                 else if (local->hw.flags & IEEE80211_HW_REPORTS_TX_ACK_STATUS) {
                         mlme_dbg(sdata,
                                  "Failed to send nullfunc to AP %pM after %dms, disconnecting\n",
@@ -3583,7 +3604,7 @@ void ieee80211_sta_work(struct ieee80211_sub_if_data *sdata)
                 }
         }
 
-        mutex_unlock(&ifmgd->mtx);
+        sdata_unlock(sdata);
 }
 
 static void ieee80211_sta_bcn_mon_timer(unsigned long data)
@@ -3644,9 +3665,9 @@ void ieee80211_sta_restart(struct ieee80211_sub_if_data *sdata)
 {
         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
 
-        mutex_lock(&ifmgd->mtx);
+        sdata_lock(sdata);
         if (!ifmgd->associated) {
-                mutex_unlock(&ifmgd->mtx);
+                sdata_unlock(sdata);
                 return;
         }
 
@@ -3657,10 +3678,10 @@ void ieee80211_sta_restart(struct ieee80211_sub_if_data *sdata)
                                               ifmgd->associated->bssid,
                                               WLAN_REASON_UNSPECIFIED,
                                               true);
-                mutex_unlock(&ifmgd->mtx);
+                sdata_unlock(sdata);
                 return;
         }
-        mutex_unlock(&ifmgd->mtx);
+        sdata_unlock(sdata);
 }
 #endif
 
@@ -3692,8 +3713,6 @@ void ieee80211_sta_setup_sdata(struct ieee80211_sub_if_data *sdata)
         ifmgd->uapsd_max_sp_len = sdata->local->hw.uapsd_max_sp_len;
         ifmgd->p2p_noa_index = -1;
 
-        mutex_init(&ifmgd->mtx);
-
         if (sdata->local->hw.flags & IEEE80211_HW_SUPPORTS_DYNAMIC_SMPS)
                 ifmgd->req_smps = IEEE80211_SMPS_AUTOMATIC;
         else
@@ -3833,7 +3852,7 @@ static int ieee80211_prep_channel(struct ieee80211_sub_if_data *sdata,
         ifmgd->flags |= ieee80211_determine_chantype(sdata, sband,
                                                      cbss->channel,
                                                      ht_oper, vht_oper,
-                                                     &chandef, true);
+                                                     &chandef, false);
 
         sdata->needed_rx_chains = min(ieee80211_ht_vht_rx_chains(sdata, cbss),
                                       local->rx_chains);
@@ -3850,6 +3869,12 @@ static int ieee80211_prep_channel(struct ieee80211_sub_if_data *sdata,
          */
         ret = ieee80211_vif_use_channel(sdata, &chandef,
                                         IEEE80211_CHANCTX_SHARED);
+
+        /* don't downgrade for 5 and 10 MHz channels, though. */
+        if (chandef.width == NL80211_CHAN_WIDTH_5 ||
+            chandef.width == NL80211_CHAN_WIDTH_10)
+                return ret;
+
         while (ret && chandef.width != NL80211_CHAN_WIDTH_20_NOHT) {
                 ifmgd->flags |= chandef_downgrade(&chandef);
                 ret = ieee80211_vif_use_channel(sdata, &chandef,
@@ -3882,27 +3907,40 @@ static int ieee80211_prep_connection(struct ieee80211_sub_if_data *sdata,
                 if (!new_sta)
                         return -ENOMEM;
         }
-
         if (new_sta) {
                 u32 rates = 0, basic_rates = 0;
                 bool have_higher_than_11mbit;
                 int min_rate = INT_MAX, min_rate_index = -1;
+                struct ieee80211_chanctx_conf *chanctx_conf;
                 struct ieee80211_supported_band *sband;
                 const struct cfg80211_bss_ies *ies;
+                int shift;
+                u32 rate_flags;
 
                 sband = local->hw.wiphy->bands[cbss->channel->band];
 
                 err = ieee80211_prep_channel(sdata, cbss);
                 if (err) {
                         sta_info_free(local, new_sta);
-                        return err;
+                        return -EINVAL;
                 }
+                shift = ieee80211_vif_get_shift(&sdata->vif);
+
+                rcu_read_lock();
+                chanctx_conf = rcu_dereference(sdata->vif.chanctx_conf);
+                if (WARN_ON(!chanctx_conf)) {
+                        rcu_read_unlock();
+                        return -EINVAL;
+                }
+                rate_flags = ieee80211_chandef_rate_flags(&chanctx_conf->def);
+                rcu_read_unlock();
 
                 ieee80211_get_rates(sband, bss->supp_rates,
                                     bss->supp_rates_len,
                                     &rates, &basic_rates,
                                     &have_higher_than_11mbit,
-                                    &min_rate, &min_rate_index);
+                                    &min_rate, &min_rate_index,
+                                    shift, rate_flags);
 
                 /*
                  * This used to be a workaround for basic rates missing
@@ -4049,8 +4087,6 @@ int ieee80211_mgd_auth(struct ieee80211_sub_if_data *sdata,
 
         /* try to authenticate/probe */
 
-        mutex_lock(&ifmgd->mtx);
-
         if ((ifmgd->auth_data && !ifmgd->auth_data->done) ||
             ifmgd->assoc_data) {
                 err = -EBUSY;
@@ -4070,8 +4106,8 @@ int ieee80211_mgd_auth(struct ieee80211_sub_if_data *sdata,
                                        WLAN_REASON_UNSPECIFIED,
                                        false, frame_buf);
 
-                __cfg80211_send_deauth(sdata->dev, frame_buf,
-                                       sizeof(frame_buf));
+                cfg80211_tx_mlme_mgmt(sdata->dev, frame_buf,
+                                      sizeof(frame_buf));
         }
 
         sdata_info(sdata, "authenticate with %pM\n", req->bss->bssid);
@@ -4088,8 +4124,7 @@ int ieee80211_mgd_auth(struct ieee80211_sub_if_data *sdata,
 
         /* hold our own reference */
         cfg80211_ref_bss(local->hw.wiphy, auth_data->bss);
-        err = 0;
-        goto out_unlock;
+        return 0;
 
  err_clear:
         memset(ifmgd->bssid, 0, ETH_ALEN);
@@ -4097,9 +4132,6 @@ int ieee80211_mgd_auth(struct ieee80211_sub_if_data *sdata,
         ifmgd->auth_data = NULL;
  err_free:
         kfree(auth_data);
- out_unlock:
-        mutex_unlock(&ifmgd->mtx);
-
         return err;
 }
 
@@ -4130,8 +4162,6 @@ int ieee80211_mgd_assoc(struct ieee80211_sub_if_data *sdata,
         assoc_data->ssid_len = ssidie[1];
         rcu_read_unlock();
 
-        mutex_lock(&ifmgd->mtx);
-
         if (ifmgd->associated) {
                 u8 frame_buf[IEEE80211_DEAUTH_FRAME_LEN];
 
@@ -4139,8 +4169,8 @@ int ieee80211_mgd_assoc(struct ieee80211_sub_if_data *sdata,
                                        WLAN_REASON_UNSPECIFIED,
                                        false, frame_buf);
 
-                __cfg80211_send_deauth(sdata->dev, frame_buf,
-                                       sizeof(frame_buf));
+                cfg80211_tx_mlme_mgmt(sdata->dev, frame_buf,
+                                      sizeof(frame_buf));
         }
 
         if (ifmgd->auth_data && !ifmgd->auth_data->done) {
@@ -4287,6 +4317,7 @@ int ieee80211_mgd_assoc(struct ieee80211_sub_if_data *sdata,
 
         ifmgd->assoc_data = assoc_data;
         ifmgd->dtim_period = 0;
+        ifmgd->have_beacon = false;
 
         err = ieee80211_prep_connection(sdata, req->bss, true);
         if (err)
@@ -4318,7 +4349,7 @@ int ieee80211_mgd_assoc(struct ieee80211_sub_if_data *sdata,
                         ifmgd->dtim_period = tim->dtim_period;
                         dtim_count = tim->dtim_count;
                 }
-                assoc_data->have_beacon = true;
+                ifmgd->have_beacon = true;
                 assoc_data->timeout = jiffies;
                 assoc_data->timeout_started = true;
 
@@ -4334,7 +4365,7 @@ int ieee80211_mgd_assoc(struct ieee80211_sub_if_data *sdata,
         }
         rcu_read_unlock();
 
-        run_again(ifmgd, assoc_data->timeout);
+        run_again(sdata, assoc_data->timeout);
 
         if (bss->corrupt_data) {
                 char *corrupt_type = "data";
@@ -4350,17 +4381,13 @@ int ieee80211_mgd_assoc(struct ieee80211_sub_if_data *sdata,
                            corrupt_type);
         }
 
-        err = 0;
-        goto out;
+        return 0;
  err_clear:
         memset(ifmgd->bssid, 0, ETH_ALEN);
         ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_BSSID);
         ifmgd->assoc_data = NULL;
  err_free:
         kfree(assoc_data);
- out:
-        mutex_unlock(&ifmgd->mtx);
-
         return err;
 }
 
@@ -4372,8 +4399,6 @@ int ieee80211_mgd_deauth(struct ieee80211_sub_if_data *sdata,
         bool tx = !req->local_state_change;
         bool report_frame = false;
 
-        mutex_lock(&ifmgd->mtx);
-
         sdata_info(sdata,
                    "deauthenticating from %pM by local choice (reason=%d)\n",
                    req->bssid, req->reason_code);
@@ -4385,7 +4410,6 @@ int ieee80211_mgd_deauth(struct ieee80211_sub_if_data *sdata,
                                                req->reason_code, tx,
                                                frame_buf);
                 ieee80211_destroy_auth_data(sdata, false);
-                mutex_unlock(&ifmgd->mtx);
 
                 report_frame = true;
                 goto out;
@@ -4397,12 +4421,11 @@ int ieee80211_mgd_deauth(struct ieee80211_sub_if_data *sdata,
                                        req->reason_code, tx, frame_buf);
                 report_frame = true;
         }
-        mutex_unlock(&ifmgd->mtx);
 
  out:
         if (report_frame)
-                __cfg80211_send_deauth(sdata->dev, frame_buf,
-                                       IEEE80211_DEAUTH_FRAME_LEN);
+                cfg80211_tx_mlme_mgmt(sdata->dev, frame_buf,
+                                      IEEE80211_DEAUTH_FRAME_LEN);
 
         return 0;
 }
@@ -4414,18 +4437,14 @@ int ieee80211_mgd_disassoc(struct ieee80211_sub_if_data *sdata,
         u8 bssid[ETH_ALEN];
         u8 frame_buf[IEEE80211_DEAUTH_FRAME_LEN];
 
-        mutex_lock(&ifmgd->mtx);
-
         /*
          * cfg80211 should catch this ... but it's racy since
          * we can receive a disassoc frame, process it, hand it
          * to cfg80211 while that's in a locked section already
          * trying to tell us that the user wants to disconnect.
          */
-        if (ifmgd->associated != req->bss) {
-                mutex_unlock(&ifmgd->mtx);
+        if (ifmgd->associated != req->bss)
                 return -ENOLINK;
-        }
 
         sdata_info(sdata,
                    "disassociating from %pM by local choice (reason=%d)\n",
@@ -4435,10 +4454,9 @@ int ieee80211_mgd_disassoc(struct ieee80211_sub_if_data *sdata,
         ieee80211_set_disassoc(sdata, IEEE80211_STYPE_DISASSOC,
                                req->reason_code, !req->local_state_change,
                                frame_buf);
-        mutex_unlock(&ifmgd->mtx);
 
-        __cfg80211_send_disassoc(sdata->dev, frame_buf,
-                                 IEEE80211_DEAUTH_FRAME_LEN);
+        cfg80211_tx_mlme_mgmt(sdata->dev, frame_buf,
+                              IEEE80211_DEAUTH_FRAME_LEN);
 
         return 0;
 }
@@ -4458,13 +4476,16 @@ void ieee80211_mgd_stop(struct ieee80211_sub_if_data *sdata)
         cancel_work_sync(&ifmgd->csa_connection_drop_work);
         cancel_work_sync(&ifmgd->chswitch_work);
 
-        mutex_lock(&ifmgd->mtx);
-        if (ifmgd->assoc_data)
+        sdata_lock(sdata);
+        if (ifmgd->assoc_data) {
+                struct cfg80211_bss *bss = ifmgd->assoc_data->bss;
                 ieee80211_destroy_assoc_data(sdata, false);
+                cfg80211_assoc_timeout(sdata->dev, bss);
+        }
         if (ifmgd->auth_data)
                 ieee80211_destroy_auth_data(sdata, false);
         del_timer_sync(&ifmgd->timer);
-        mutex_unlock(&ifmgd->mtx);
+        sdata_unlock(sdata);
 }
 
 void ieee80211_cqm_rssi_notify(struct ieee80211_vif *vif,
diff --git a/net/mac80211/pm.c b/net/mac80211/pm.c
index 7fc5d0d8149a..340126204343 100644
--- a/net/mac80211/pm.c
+++ b/net/mac80211/pm.c
@@ -99,10 +99,13 @@ int __ieee80211_suspend(struct ieee80211_hw *hw, struct cfg80211_wowlan *wowlan)
         }
         mutex_unlock(&local->sta_mtx);
 
-        /* remove all interfaces */
+        /* remove all interfaces that were created in the driver */
         list_for_each_entry(sdata, &local->interfaces, list) {
-                if (!ieee80211_sdata_running(sdata))
+                if (!ieee80211_sdata_running(sdata) ||
+                    sdata->vif.type == NL80211_IFTYPE_AP_VLAN ||
+                    sdata->vif.type == NL80211_IFTYPE_MONITOR)
                         continue;
+
                 drv_remove_interface(local, sdata);
         }
 
diff --git a/net/mac80211/rate.c b/net/mac80211/rate.c
index d3f414fe67e0..e126605cec66 100644
--- a/net/mac80211/rate.c
+++ b/net/mac80211/rate.c
@@ -210,7 +210,7 @@ static bool rc_no_data_or_no_ack_use_min(struct ieee80211_tx_rate_control *txrc)
                 !ieee80211_is_data(fc);
 }
 
-static void rc_send_low_broadcast(s8 *idx, u32 basic_rates,
+static void rc_send_low_basicrate(s8 *idx, u32 basic_rates,
                                   struct ieee80211_supported_band *sband)
 {
         u8 i;
@@ -232,37 +232,28 @@ static void rc_send_low_broadcast(s8 *idx, u32 basic_rates,
         /* could not find a basic rate; use original selection */
 }
 
-static inline s8
-rate_lowest_non_cck_index(struct ieee80211_supported_band *sband,
-                          struct ieee80211_sta *sta)
+static void __rate_control_send_low(struct ieee80211_hw *hw,
+                                    struct ieee80211_supported_band *sband,
+                                    struct ieee80211_sta *sta,
+                                    struct ieee80211_tx_info *info)
 {
         int i;
+        u32 rate_flags =
+                ieee80211_chandef_rate_flags(&hw->conf.chandef);
+
+        if ((sband->band == IEEE80211_BAND_2GHZ) &&
+            (info->flags & IEEE80211_TX_CTL_NO_CCK_RATE))
+                rate_flags |= IEEE80211_RATE_ERP_G;
 
+        info->control.rates[0].idx = 0;
         for (i = 0; i < sband->n_bitrates; i++) {
-                struct ieee80211_rate *srate = &sband->bitrates[i];
-                if ((srate->bitrate == 10) || (srate->bitrate == 20) ||
-                    (srate->bitrate == 55) || (srate->bitrate == 110))
+                if (!rate_supported(sta, sband->band, i))
                         continue;
 
-                if (rate_supported(sta, sband->band, i))
-                        return i;
+                info->control.rates[0].idx = i;
+                break;
         }
-
-        /* No matching rate found */
-        return 0;
-}
-
-static void __rate_control_send_low(struct ieee80211_hw *hw,
-                                    struct ieee80211_supported_band *sband,
-                                    struct ieee80211_sta *sta,
-                                    struct ieee80211_tx_info *info)
-{
-        if ((sband->band != IEEE80211_BAND_2GHZ) ||
-            !(info->flags & IEEE80211_TX_CTL_NO_CCK_RATE))
-                info->control.rates[0].idx = rate_lowest_index(sband, sta);
-        else
-                info->control.rates[0].idx =
-                        rate_lowest_non_cck_index(sband, sta);
+        WARN_ON_ONCE(i == sband->n_bitrates);
 
         info->control.rates[0].count =
                 (info->flags & IEEE80211_TX_CTL_NO_ACK) ?
@@ -272,28 +263,37 @@ static void __rate_control_send_low(struct ieee80211_hw *hw,
 }
 
 
-bool rate_control_send_low(struct ieee80211_sta *sta,
+bool rate_control_send_low(struct ieee80211_sta *pubsta,
                            void *priv_sta,
                            struct ieee80211_tx_rate_control *txrc)
 {
         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(txrc->skb);
         struct ieee80211_supported_band *sband = txrc->sband;
+        struct sta_info *sta;
         int mcast_rate;
+        bool use_basicrate = false;
 
-        if (!sta || !priv_sta || rc_no_data_or_no_ack_use_min(txrc)) {
-                __rate_control_send_low(txrc->hw, sband, sta, info);
+        if (!pubsta || !priv_sta || rc_no_data_or_no_ack_use_min(txrc)) {
+                __rate_control_send_low(txrc->hw, sband, pubsta, info);
 
-                if (!sta && txrc->bss) {
+                if (!pubsta && txrc->bss) {
                         mcast_rate = txrc->bss_conf->mcast_rate[sband->band];
                         if (mcast_rate > 0) {
                                 info->control.rates[0].idx = mcast_rate - 1;
                                 return true;
                         }
+                        use_basicrate = true;
+                } else if (pubsta) {
+                        sta = container_of(pubsta, struct sta_info, sta);
+                        if (ieee80211_vif_is_mesh(&sta->sdata->vif))
+                                use_basicrate = true;
+                }
 
-                        rc_send_low_broadcast(&info->control.rates[0].idx,
+                if (use_basicrate)
+                        rc_send_low_basicrate(&info->control.rates[0].idx,
                                               txrc->bss_conf->basic_rates,
                                               sband);
-                }
+
                 return true;
         }
         return false;
@@ -397,8 +397,14 @@ static void rate_idx_match_mask(struct ieee80211_tx_rate *rate,
                         return;
 
                 /* if HT BSS, and we handle a data frame, also try HT rates */
-                if (chan_width == NL80211_CHAN_WIDTH_20_NOHT)
+                switch (chan_width) {
+                case NL80211_CHAN_WIDTH_20_NOHT:
+                case NL80211_CHAN_WIDTH_5:
+                case NL80211_CHAN_WIDTH_10:
                         return;
+                default:
+                        break;
+                }
 
                 alt_rate.idx = 0;
                 /* keep protection flags */
@@ -579,6 +585,7 @@ static void rate_control_apply_mask(struct ieee80211_sub_if_data *sdata,
         u8 mcs_mask[IEEE80211_HT_MCS_MASK_LEN];
         bool has_mcs_mask;
         u32 mask;
+        u32 rate_flags;
         int i;
 
         /*
@@ -588,6 +595,12 @@ static void rate_control_apply_mask(struct ieee80211_sub_if_data *sdata,
          */
         mask = sdata->rc_rateidx_mask[info->band];
         has_mcs_mask = sdata->rc_has_mcs_mask[info->band];
+        rate_flags =
+                ieee80211_chandef_rate_flags(&sdata->vif.bss_conf.chandef);
+        for (i = 0; i < sband->n_bitrates; i++)
+                if ((rate_flags & sband->bitrates[i].flags) != rate_flags)
+                        mask &= ~BIT(i);
+
         if (mask == (1 << sband->n_bitrates) - 1 && !has_mcs_mask)
                 return;
 
@@ -615,7 +628,7 @@ static void rate_control_apply_mask(struct ieee80211_sub_if_data *sdata,
                 if (rates[i].idx < 0)
                         break;
 
-                rate_idx_match_mask(&rates[i], sband, mask, chan_width,
+                rate_idx_match_mask(&rates[i], sband, chan_width, mask,
                                     mcs_mask);
         }
 }
diff --git a/net/mac80211/rate.h b/net/mac80211/rate.h
index d35a5dd3fb13..5dedc56c94db 100644
--- a/net/mac80211/rate.h
+++ b/net/mac80211/rate.h
@@ -66,11 +66,12 @@ static inline void rate_control_rate_init(struct sta_info *sta)
         }
 
         sband = local->hw.wiphy->bands[chanctx_conf->def.chan->band];
-        rcu_read_unlock();
 
         ieee80211_sta_set_rx_nss(sta);
 
-        ref->ops->rate_init(ref->priv, sband, ista, priv_sta);
+        ref->ops->rate_init(ref->priv, sband, &chanctx_conf->def, ista,
+                            priv_sta);
+        rcu_read_unlock();
         set_sta_flag(sta, WLAN_STA_RATE_CONTROL);
 }
 
@@ -81,10 +82,21 @@ static inline void rate_control_rate_update(struct ieee80211_local *local,
         struct rate_control_ref *ref = local->rate_ctrl;
         struct ieee80211_sta *ista = &sta->sta;
         void *priv_sta = sta->rate_ctrl_priv;
+        struct ieee80211_chanctx_conf *chanctx_conf;
+
+        if (ref && ref->ops->rate_update) {
+                rcu_read_lock();
 
-        if (ref && ref->ops->rate_update)
-                ref->ops->rate_update(ref->priv, sband, ista,
-                                      priv_sta, changed);
+                chanctx_conf = rcu_dereference(sta->sdata->vif.chanctx_conf);
+                if (WARN_ON(!chanctx_conf)) {
+                        rcu_read_unlock();
+                        return;
+                }
+
+                ref->ops->rate_update(ref->priv, sband, &chanctx_conf->def,
+                                      ista, priv_sta, changed);
+                rcu_read_unlock();
+        }
         drv_sta_rc_update(local, sta->sdata, &sta->sta, changed);
 }
 
diff --git a/net/mac80211/rc80211_minstrel.c b/net/mac80211/rc80211_minstrel.c
index ac7ef5414bde..8b5f7ef7c0c9 100644
--- a/net/mac80211/rc80211_minstrel.c
+++ b/net/mac80211/rc80211_minstrel.c
@@ -290,7 +290,7 @@ minstrel_get_rate(void *priv, struct ieee80211_sta *sta,
         struct minstrel_rate *msr, *mr;
         unsigned int ndx;
         bool mrr_capable;
-        bool prev_sample = mi->prev_sample;
+        bool prev_sample;
         int delta;
         int sampling_ratio;
 
@@ -314,6 +314,7 @@ minstrel_get_rate(void *priv, struct ieee80211_sta *sta,
                         (mi->sample_count + mi->sample_deferred / 2);
 
         /* delta < 0: no sampling required */
+        prev_sample = mi->prev_sample;
         mi->prev_sample = false;
         if (delta < 0 || (!mrr_capable && prev_sample))
                 return;
@@ -382,14 +383,18 @@ minstrel_get_rate(void *priv, struct ieee80211_sta *sta,
 static void
 calc_rate_durations(enum ieee80211_band band,
                     struct minstrel_rate *d,
-                    struct ieee80211_rate *rate)
+                    struct ieee80211_rate *rate,
+                    struct cfg80211_chan_def *chandef)
 {
         int erp = !!(rate->flags & IEEE80211_RATE_ERP_G);
+        int shift = ieee80211_chandef_get_shift(chandef);
 
         d->perfect_tx_time = ieee80211_frame_duration(band, 1200,
-                        rate->bitrate, erp, 1);
+                        DIV_ROUND_UP(rate->bitrate, 1 << shift), erp, 1,
+                        shift);
         d->ack_time = ieee80211_frame_duration(band, 10,
-                        rate->bitrate, erp, 1);
+                        DIV_ROUND_UP(rate->bitrate, 1 << shift), erp, 1,
+                        shift);
 }
 
 static void
@@ -417,21 +422,25 @@ init_sample_table(struct minstrel_sta_info *mi)
 
 static void
 minstrel_rate_init(void *priv, struct ieee80211_supported_band *sband,
-               struct ieee80211_sta *sta, void *priv_sta)
+                   struct cfg80211_chan_def *chandef,
+                   struct ieee80211_sta *sta, void *priv_sta)
 {
         struct minstrel_sta_info *mi = priv_sta;
         struct minstrel_priv *mp = priv;
         struct ieee80211_rate *ctl_rate;
         unsigned int i, n = 0;
         unsigned int t_slot = 9; /* FIXME: get real slot time */
+        u32 rate_flags;
 
         mi->sta = sta;
         mi->lowest_rix = rate_lowest_index(sband, sta);
         ctl_rate = &sband->bitrates[mi->lowest_rix];
         mi->sp_ack_dur = ieee80211_frame_duration(sband->band, 10,
                                 ctl_rate->bitrate,
-                                !!(ctl_rate->flags & IEEE80211_RATE_ERP_G), 1);
+                                !!(ctl_rate->flags & IEEE80211_RATE_ERP_G), 1,
+                                ieee80211_chandef_get_shift(chandef));
 
+        rate_flags = ieee80211_chandef_rate_flags(&mp->hw->conf.chandef);
         memset(mi->max_tp_rate, 0, sizeof(mi->max_tp_rate));
         mi->max_prob_rate = 0;
 
@@ -440,15 +449,22 @@ minstrel_rate_init(void *priv, struct ieee80211_supported_band *sband,
                 unsigned int tx_time = 0, tx_time_cts = 0, tx_time_rtscts = 0;
                 unsigned int tx_time_single;
                 unsigned int cw = mp->cw_min;
+                int shift;
 
                 if (!rate_supported(sta, sband->band, i))
                         continue;
+                if ((rate_flags & sband->bitrates[i].flags) != rate_flags)
+                        continue;
+
                 n++;
                 memset(mr, 0, sizeof(*mr));
 
                 mr->rix = i;
-                mr->bitrate = sband->bitrates[i].bitrate / 5;
-                calc_rate_durations(sband->band, mr, &sband->bitrates[i]);
+                shift = ieee80211_chandef_get_shift(chandef);
+                mr->bitrate = DIV_ROUND_UP(sband->bitrates[i].bitrate,
+                                           (1 << shift) * 5);
+                calc_rate_durations(sband->band, mr, &sband->bitrates[i],
+                                    chandef);
 
                 /* calculate maximum number of retransmissions before
                  * fallback (based on maximum segment size) */
@@ -546,6 +562,7 @@ minstrel_init_cck_rates(struct minstrel_priv *mp)
 {
         static const int bitrates[4] = { 10, 20, 55, 110 };
         struct ieee80211_supported_band *sband;
+        u32 rate_flags = ieee80211_chandef_rate_flags(&mp->hw->conf.chandef);
         int i, j;
 
         sband = mp->hw->wiphy->bands[IEEE80211_BAND_2GHZ];
@@ -558,6 +575,9 @@ minstrel_init_cck_rates(struct minstrel_priv *mp)
                 if (rate->flags & IEEE80211_RATE_ERP_G)
                         continue;
 
+                if ((rate_flags & sband->bitrates[i].flags) != rate_flags)
+                        continue;
+
                 for (j = 0; j < ARRAY_SIZE(bitrates); j++) {
                         if (rate->bitrate != bitrates[j])
                                 continue;
diff --git a/net/mac80211/rc80211_minstrel_ht.c b/net/mac80211/rc80211_minstrel_ht.c
index 5b2d3012b983..7c323f27ba23 100644
--- a/net/mac80211/rc80211_minstrel_ht.c
+++ b/net/mac80211/rc80211_minstrel_ht.c
@@ -776,7 +776,7 @@ minstrel_ht_get_rate(void *priv, struct ieee80211_sta *sta, void *priv_sta,
 
         /* Don't use EAPOL frames for sampling on non-mrr hw */
         if (mp->hw->max_rates == 1 &&
-            txrc->skb->protocol == cpu_to_be16(ETH_P_PAE))
+            (info->control.flags & IEEE80211_TX_CTRL_PORT_CTRL_PROTO))
                 sample_idx = -1;
         else
                 sample_idx = minstrel_get_sample_rate(mp, mi);
@@ -804,10 +804,18 @@ minstrel_ht_get_rate(void *priv, struct ieee80211_sta *sta, void *priv_sta,
 
         sample_group = &minstrel_mcs_groups[sample_idx / MCS_GROUP_RATES];
         info->flags |= IEEE80211_TX_CTL_RATE_CTRL_PROBE;
+        rate->count = 1;
+
+        if (sample_idx / MCS_GROUP_RATES == MINSTREL_CCK_GROUP) {
+                int idx = sample_idx % ARRAY_SIZE(mp->cck_rates);
+                rate->idx = mp->cck_rates[idx];
+                rate->flags = 0;
+                return;
+        }
+
         rate->idx = sample_idx % MCS_GROUP_RATES +
                     (sample_group->streams - 1) * MCS_GROUP_RATES;
         rate->flags = IEEE80211_TX_RC_MCS | sample_group->flags;
-        rate->count = 1;
 }
 
 static void
@@ -820,6 +828,9 @@ minstrel_ht_update_cck(struct minstrel_priv *mp, struct minstrel_ht_sta *mi,
         if (sband->band != IEEE80211_BAND_2GHZ)
                 return;
 
+        if (!(mp->hw->flags & IEEE80211_HW_SUPPORTS_HT_CCK_RATES))
+                return;
+
         mi->cck_supported = 0;
         mi->cck_supported_short = 0;
         for (i = 0; i < 4; i++) {
@@ -836,6 +847,7 @@ minstrel_ht_update_cck(struct minstrel_priv *mp, struct minstrel_ht_sta *mi,
 
 static void
 minstrel_ht_update_caps(void *priv, struct ieee80211_supported_band *sband,
+                        struct cfg80211_chan_def *chandef,
                         struct ieee80211_sta *sta, void *priv_sta)
 {
         struct minstrel_priv *mp = priv;
@@ -861,8 +873,9 @@ minstrel_ht_update_caps(void *priv, struct ieee80211_supported_band *sband,
         mi->sta = sta;
         mi->stats_update = jiffies;
 
-        ack_dur = ieee80211_frame_duration(sband->band, 10, 60, 1, 1);
-        mi->overhead = ieee80211_frame_duration(sband->band, 0, 60, 1, 1) + ack_dur;
+        ack_dur = ieee80211_frame_duration(sband->band, 10, 60, 1, 1, 0);
+        mi->overhead = ieee80211_frame_duration(sband->band, 0, 60, 1, 1, 0);
+        mi->overhead += ack_dur;
         mi->overhead_rtscts = mi->overhead + 2 * ack_dur;
 
         mi->avg_ampdu_len = MINSTREL_FRAC(1, 1);
@@ -931,22 +944,25 @@ use_legacy:
         memset(&msp->legacy, 0, sizeof(msp->legacy));
         msp->legacy.r = msp->ratelist;
         msp->legacy.sample_table = msp->sample_table;
-        return mac80211_minstrel.rate_init(priv, sband, sta, &msp->legacy);
+        return mac80211_minstrel.rate_init(priv, sband, chandef, sta,
+                                           &msp->legacy);
 }
 
 static void
 minstrel_ht_rate_init(void *priv, struct ieee80211_supported_band *sband,
+                      struct cfg80211_chan_def *chandef,
                       struct ieee80211_sta *sta, void *priv_sta)
 {
-        minstrel_ht_update_caps(priv, sband, sta, priv_sta);
+        minstrel_ht_update_caps(priv, sband, chandef, sta, priv_sta);
 }
 
 static void
 minstrel_ht_rate_update(void *priv, struct ieee80211_supported_band *sband,
+                        struct cfg80211_chan_def *chandef,
                         struct ieee80211_sta *sta, void *priv_sta,
                         u32 changed)
 {
-        minstrel_ht_update_caps(priv, sband, sta, priv_sta);
+        minstrel_ht_update_caps(priv, sband, chandef, sta, priv_sta);
 }
 
 static void *
diff --git a/net/mac80211/rc80211_pid_algo.c b/net/mac80211/rc80211_pid_algo.c
index 502d3ecc4a79..958fad07b54c 100644
--- a/net/mac80211/rc80211_pid_algo.c
+++ b/net/mac80211/rc80211_pid_algo.c
@@ -293,6 +293,7 @@ rate_control_pid_get_rate(void *priv, struct ieee80211_sta *sta,
 
 static void
 rate_control_pid_rate_init(void *priv, struct ieee80211_supported_band *sband,
+                           struct cfg80211_chan_def *chandef,
                            struct ieee80211_sta *sta, void *priv_sta)
 {
         struct rc_pid_sta_info *spinfo = priv_sta;
diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
index 8e2952620256..54395d7583ba 100644
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -87,11 +87,13 @@ ieee80211_rx_radiotap_space(struct ieee80211_local *local,
         int len;
 
         /* always present fields */
-        len = sizeof(struct ieee80211_radiotap_header) + 9;
+        len = sizeof(struct ieee80211_radiotap_header) + 8;
 
-        /* allocate extra bitmap */
+        /* allocate extra bitmaps */
         if (status->vendor_radiotap_len)
                 len += 4;
+        if (status->chains)
+                len += 4 * hweight8(status->chains);
 
         if (ieee80211_have_rx_timestamp(status)) {
                 len = ALIGN(len, 8);
@@ -100,6 +102,10 @@ ieee80211_rx_radiotap_space(struct ieee80211_local *local,
         if (local->hw.flags & IEEE80211_HW_SIGNAL_DBM)
                 len += 1;
 
+        /* antenna field, if we don't have per-chain info */
+        if (!status->chains)
+                len += 1;
+
         /* padding for RX_FLAGS if necessary */
         len = ALIGN(len, 2);
 
@@ -116,6 +122,11 @@ ieee80211_rx_radiotap_space(struct ieee80211_local *local,
                 len += 12;
         }
 
+        if (status->chains) {
+                /* antenna and antenna signal fields */
+                len += 2 * hweight8(status->chains);
+        }
+
         if (status->vendor_radiotap_len) {
                 if (WARN_ON_ONCE(status->vendor_radiotap_align == 0))
                         status->vendor_radiotap_align = 1;
@@ -145,8 +156,12 @@ ieee80211_add_rx_radiotap_header(struct ieee80211_local *local,
         struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
         struct ieee80211_radiotap_header *rthdr;
         unsigned char *pos;
+        __le32 *it_present;
+        u32 it_present_val;
         u16 rx_flags = 0;
-        int mpdulen;
+        u16 channel_flags = 0;
+        int mpdulen, chain;
+        unsigned long chains = status->chains;
 
         mpdulen = skb->len;
         if (!(has_fcs && (local->hw.flags & IEEE80211_HW_RX_INCLUDES_FCS)))
@@ -154,25 +169,39 @@ ieee80211_add_rx_radiotap_header(struct ieee80211_local *local,
 
         rthdr = (struct ieee80211_radiotap_header *)skb_push(skb, rtap_len);
         memset(rthdr, 0, rtap_len);
+        it_present = &rthdr->it_present;
 
         /* radiotap header, set always present flags */
-        rthdr->it_present =
-                cpu_to_le32((1 << IEEE80211_RADIOTAP_FLAGS) |
-                            (1 << IEEE80211_RADIOTAP_CHANNEL) |
-                            (1 << IEEE80211_RADIOTAP_ANTENNA) |
-                            (1 << IEEE80211_RADIOTAP_RX_FLAGS));
         rthdr->it_len = cpu_to_le16(rtap_len + status->vendor_radiotap_len);
+        it_present_val = BIT(IEEE80211_RADIOTAP_FLAGS) |
+                         BIT(IEEE80211_RADIOTAP_CHANNEL) |
+                         BIT(IEEE80211_RADIOTAP_RX_FLAGS);
 
-        pos = (unsigned char *)(rthdr + 1);
+        if (!status->chains)
+                it_present_val |= BIT(IEEE80211_RADIOTAP_ANTENNA);
+
+        for_each_set_bit(chain, &chains, IEEE80211_MAX_CHAINS) {
+                it_present_val |=
+                        BIT(IEEE80211_RADIOTAP_EXT) |
+                        BIT(IEEE80211_RADIOTAP_RADIOTAP_NAMESPACE);
+                put_unaligned_le32(it_present_val, it_present);
+                it_present++;
+                it_present_val = BIT(IEEE80211_RADIOTAP_ANTENNA) |
+                                 BIT(IEEE80211_RADIOTAP_DBM_ANTSIGNAL);
+        }
 
         if (status->vendor_radiotap_len) {
-                rthdr->it_present |=
-                        cpu_to_le32(BIT(IEEE80211_RADIOTAP_VENDOR_NAMESPACE)) |
-                        cpu_to_le32(BIT(IEEE80211_RADIOTAP_EXT));
-                put_unaligned_le32(status->vendor_radiotap_bitmap, pos);
-                pos += 4;
+                it_present_val |= BIT(IEEE80211_RADIOTAP_VENDOR_NAMESPACE) |
+                                  BIT(IEEE80211_RADIOTAP_EXT);
+                put_unaligned_le32(it_present_val, it_present);
+                it_present++;
+                it_present_val = status->vendor_radiotap_bitmap;
         }
 
+        put_unaligned_le32(it_present_val, it_present);
+
+        pos = (void *)(it_present + 1);
+
         /* the order of the following fields is important */
 
         /* IEEE80211_RADIOTAP_TSFT */
@@ -207,28 +236,35 @@ ieee80211_add_rx_radiotap_header(struct ieee80211_local *local,
                  */
                 *pos = 0;
         } else {
+                int shift = 0;
                 rthdr->it_present |= cpu_to_le32(1 << IEEE80211_RADIOTAP_RATE);
-                *pos = rate->bitrate / 5;
+                if (status->flag & RX_FLAG_10MHZ)
+                        shift = 1;
+                else if (status->flag & RX_FLAG_5MHZ)
+                        shift = 2;
+                *pos = DIV_ROUND_UP(rate->bitrate, 5 * (1 << shift));
         }
         pos++;
 
         /* IEEE80211_RADIOTAP_CHANNEL */
         put_unaligned_le16(status->freq, pos);
         pos += 2;
+        if (status->flag & RX_FLAG_10MHZ)
+                channel_flags |= IEEE80211_CHAN_HALF;
+        else if (status->flag & RX_FLAG_5MHZ)
+                channel_flags |= IEEE80211_CHAN_QUARTER;
+
         if (status->band == IEEE80211_BAND_5GHZ)
-                put_unaligned_le16(IEEE80211_CHAN_OFDM | IEEE80211_CHAN_5GHZ,
-                                   pos);
+                channel_flags |= IEEE80211_CHAN_OFDM | IEEE80211_CHAN_5GHZ;
         else if (status->flag & (RX_FLAG_HT | RX_FLAG_VHT))
-                put_unaligned_le16(IEEE80211_CHAN_DYN | IEEE80211_CHAN_2GHZ,
-                                   pos);
+                channel_flags |= IEEE80211_CHAN_DYN | IEEE80211_CHAN_2GHZ;
         else if (rate && rate->flags & IEEE80211_RATE_ERP_G)
-                put_unaligned_le16(IEEE80211_CHAN_OFDM | IEEE80211_CHAN_2GHZ,
-                                   pos);
+                channel_flags |= IEEE80211_CHAN_OFDM | IEEE80211_CHAN_2GHZ;
         else if (rate)
-                put_unaligned_le16(IEEE80211_CHAN_CCK | IEEE80211_CHAN_2GHZ,
-                                   pos);
+                channel_flags |= IEEE80211_CHAN_OFDM | IEEE80211_CHAN_2GHZ;
         else
-                put_unaligned_le16(IEEE80211_CHAN_2GHZ, pos);
+                channel_flags |= IEEE80211_CHAN_2GHZ;
+        put_unaligned_le16(channel_flags, pos);
         pos += 2;
 
         /* IEEE80211_RADIOTAP_DBM_ANTSIGNAL */
@@ -242,9 +278,11 @@ ieee80211_add_rx_radiotap_header(struct ieee80211_local *local,
 
         /* IEEE80211_RADIOTAP_LOCK_QUALITY is missing */
 
-        /* IEEE80211_RADIOTAP_ANTENNA */
-        *pos = status->antenna;
-        pos++;
+        if (!status->chains) {
+                /* IEEE80211_RADIOTAP_ANTENNA */
+                *pos = status->antenna;
+                pos++;
+        }
 
         /* IEEE80211_RADIOTAP_DB_ANTNOISE is not used */
 
@@ -258,6 +296,8 @@ ieee80211_add_rx_radiotap_header(struct ieee80211_local *local,
         pos += 2;
 
         if (status->flag & RX_FLAG_HT) {
+                unsigned int stbc;
+
                 rthdr->it_present |= cpu_to_le32(1 << IEEE80211_RADIOTAP_MCS);
                 *pos++ = local->hw.radiotap_mcs_details;
                 *pos = 0;
@@ -267,6 +307,8 @@ ieee80211_add_rx_radiotap_header(struct ieee80211_local *local,
                         *pos |= IEEE80211_RADIOTAP_MCS_BW_40;
                 if (status->flag & RX_FLAG_HT_GF)
                         *pos |= IEEE80211_RADIOTAP_MCS_FMT_GF;
+                stbc = (status->flag & RX_FLAG_STBC_MASK) >> RX_FLAG_STBC_SHIFT;
+                *pos |= stbc << IEEE80211_RADIOTAP_MCS_STBC_SHIFT;
                 pos++;
                 *pos++ = status->rate_idx;
         }
@@ -337,6 +379,11 @@ ieee80211_add_rx_radiotap_header(struct ieee80211_local *local,
                 pos += 2;
         }
 
+        for_each_set_bit(chain, &chains, IEEE80211_MAX_CHAINS) {
+                *pos++ = status->chain_signal[chain];
+                *pos++ = chain;
+        }
+
         if (status->vendor_radiotap_len) {
                 /* ensure 2 byte alignment for the vendor field as required */
                 if ((pos - (u8 *)rthdr) & 1)
@@ -932,8 +979,14 @@ ieee80211_rx_h_check(struct ieee80211_rx_data *rx)
         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
         struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
 
-        /* Drop duplicate 802.11 retransmissions (IEEE 802.11 Chap. 9.2.9) */
-        if (rx->sta && !is_multicast_ether_addr(hdr->addr1)) {
+        /*
+         * Drop duplicate 802.11 retransmissions
+         * (IEEE 802.11-2012: 9.3.2.10 "Duplicate detection and recovery")
+         */
+        if (rx->skb->len >= 24 && rx->sta &&
+            !ieee80211_is_ctl(hdr->frame_control) &&
+            !ieee80211_is_qos_nullfunc(hdr->frame_control) &&
+            !is_multicast_ether_addr(hdr->addr1)) {
                 if (unlikely(ieee80211_has_retry(hdr->frame_control) &&
                              rx->sta->last_seq_ctrl[rx->seqno_idx] ==
                              hdr->seq_ctrl)) {
@@ -1002,207 +1055,6 @@ ieee80211_rx_h_check(struct ieee80211_rx_data *rx)
 
 
 static ieee80211_rx_result debug_noinline
-ieee80211_rx_h_decrypt(struct ieee80211_rx_data *rx)
-{
-        struct sk_buff *skb = rx->skb;
-        struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
-        struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
-        int keyidx;
-        int hdrlen;
-        ieee80211_rx_result result = RX_DROP_UNUSABLE;
-        struct ieee80211_key *sta_ptk = NULL;
-        int mmie_keyidx = -1;
-        __le16 fc;
-
-        /*
-         * Key selection 101
-         *
-         * There are four types of keys:
-         *  - GTK (group keys)
-         *  - IGTK (group keys for management frames)
-         *  - PTK (pairwise keys)
-         *  - STK (station-to-station pairwise keys)
-         *
-         * When selecting a key, we have to distinguish between multicast
-         * (including broadcast) and unicast frames, the latter can only
-         * use PTKs and STKs while the former always use GTKs and IGTKs.
-         * Unless, of course, actual WEP keys ("pre-RSNA") are used, then
-         * unicast frames can also use key indices like GTKs. Hence, if we
-         * don't have a PTK/STK we check the key index for a WEP key.
-         *
-         * Note that in a regular BSS, multicast frames are sent by the
-         * AP only, associated stations unicast the frame to the AP first
-         * which then multicasts it on their behalf.
-         *
-         * There is also a slight problem in IBSS mode: GTKs are negotiated
-         * with each station, that is something we don't currently handle.
-         * The spec seems to expect that one negotiates the same key with
-         * every station but there's no such requirement; VLANs could be
-         * possible.
-         */
-
-        /*
-         * No point in finding a key and decrypting if the frame is neither
-         * addressed to us nor a multicast frame.
-         */
-        if (!(status->rx_flags & IEEE80211_RX_RA_MATCH))
-                return RX_CONTINUE;
-
-        /* start without a key */
-        rx->key = NULL;
-
-        if (rx->sta)
-                sta_ptk = rcu_dereference(rx->sta->ptk);
-
-        fc = hdr->frame_control;
-
-        if (!ieee80211_has_protected(fc))
-                mmie_keyidx = ieee80211_get_mmie_keyidx(rx->skb);
-
-        if (!is_multicast_ether_addr(hdr->addr1) && sta_ptk) {
-                rx->key = sta_ptk;
-                if ((status->flag & RX_FLAG_DECRYPTED) &&
-                    (status->flag & RX_FLAG_IV_STRIPPED))
-                        return RX_CONTINUE;
-                /* Skip decryption if the frame is not protected. */
-                if (!ieee80211_has_protected(fc))
-                        return RX_CONTINUE;
-        } else if (mmie_keyidx >= 0) {
-                /* Broadcast/multicast robust management frame / BIP */
-                if ((status->flag & RX_FLAG_DECRYPTED) &&
-                    (status->flag & RX_FLAG_IV_STRIPPED))
-                        return RX_CONTINUE;
-
-                if (mmie_keyidx < NUM_DEFAULT_KEYS ||
-                    mmie_keyidx >= NUM_DEFAULT_KEYS + NUM_DEFAULT_MGMT_KEYS)
-                        return RX_DROP_MONITOR; /* unexpected BIP keyidx */
-                if (rx->sta)
-                        rx->key = rcu_dereference(rx->sta->gtk[mmie_keyidx]);
-                if (!rx->key)
-                        rx->key = rcu_dereference(rx->sdata->keys[mmie_keyidx]);
-        } else if (!ieee80211_has_protected(fc)) {
-                /*
-                 * The frame was not protected, so skip decryption. However, we
-                 * need to set rx->key if there is a key that could have been
-                 * used so that the frame may be dropped if encryption would
-                 * have been expected.
-                 */
-                struct ieee80211_key *key = NULL;
-                struct ieee80211_sub_if_data *sdata = rx->sdata;
-                int i;
-
-                if (ieee80211_is_mgmt(fc) &&
-                    is_multicast_ether_addr(hdr->addr1) &&
-                    (key = rcu_dereference(rx->sdata->default_mgmt_key)))
-                        rx->key = key;
-                else {
-                        if (rx->sta) {
-                                for (i = 0; i < NUM_DEFAULT_KEYS; i++) {
-                                        key = rcu_dereference(rx->sta->gtk[i]);
-                                        if (key)
-                                                break;
-                                }
-                        }
-                        if (!key) {
-                                for (i = 0; i < NUM_DEFAULT_KEYS; i++) {
-                                        key = rcu_dereference(sdata->keys[i]);
-                                        if (key)
-                                                break;
-                                }
-                        }
-                        if (key)
-                                rx->key = key;
-                }
-                return RX_CONTINUE;
-        } else {
-                u8 keyid;
-                /*
-                 * The device doesn't give us the IV so we won't be
-                 * able to look up the key. That's ok though, we
-                 * don't need to decrypt the frame, we just won't
-                 * be able to keep statistics accurate.
-                 * Except for key threshold notifications, should
-                 * we somehow allow the driver to tell us which key
-                 * the hardware used if this flag is set?
-                 */
-                if ((status->flag & RX_FLAG_DECRYPTED) &&
-                    (status->flag & RX_FLAG_IV_STRIPPED))
-                        return RX_CONTINUE;
-
-                hdrlen = ieee80211_hdrlen(fc);
-
-                if (rx->skb->len < 8 + hdrlen)
-                        return RX_DROP_UNUSABLE; /* TODO: count this? */
-
-                /*
-                 * no need to call ieee80211_wep_get_keyidx,
-                 * it verifies a bunch of things we've done already
-                 */
-                skb_copy_bits(rx->skb, hdrlen + 3, &keyid, 1);
-                keyidx = keyid >> 6;
-
-                /* check per-station GTK first, if multicast packet */
-                if (is_multicast_ether_addr(hdr->addr1) && rx->sta)
-                        rx->key = rcu_dereference(rx->sta->gtk[keyidx]);
-
-                /* if not found, try default key */
-                if (!rx->key) {
-                        rx->key = rcu_dereference(rx->sdata->keys[keyidx]);
-
-                        /*
-                         * RSNA-protected unicast frames should always be
-                         * sent with pairwise or station-to-station keys,
-                         * but for WEP we allow using a key index as well.
-                         */
-                        if (rx->key &&
-                            rx->key->conf.cipher != WLAN_CIPHER_SUITE_WEP40 &&
-                            rx->key->conf.cipher != WLAN_CIPHER_SUITE_WEP104 &&
-                            !is_multicast_ether_addr(hdr->addr1))
-                                rx->key = NULL;
-                }
-        }
-
-        if (rx->key) {
-                if (unlikely(rx->key->flags & KEY_FLAG_TAINTED))
-                        return RX_DROP_MONITOR;
-
-                rx->key->tx_rx_count++;
-                /* TODO: add threshold stuff again */
-        } else {
-                return RX_DROP_MONITOR;
-        }
-
-        switch (rx->key->conf.cipher) {
-        case WLAN_CIPHER_SUITE_WEP40:
-        case WLAN_CIPHER_SUITE_WEP104:
-                result = ieee80211_crypto_wep_decrypt(rx);
-                break;
-        case WLAN_CIPHER_SUITE_TKIP:
-                result = ieee80211_crypto_tkip_decrypt(rx);
-                break;
-        case WLAN_CIPHER_SUITE_CCMP:
-                result = ieee80211_crypto_ccmp_decrypt(rx);
-                break;
-        case WLAN_CIPHER_SUITE_AES_CMAC:
-                result = ieee80211_crypto_aes_cmac_decrypt(rx);
-                break;
-        default:
-                /*
-                 * We can reach here only with HW-only algorithms
-                 * but why didn't it decrypt the frame?!
-                 */
-                return RX_DROP_UNUSABLE;
-        }
-
-        /* the hdr variable is invalid after the decrypt handlers */
-
-        /* either the frame has been decrypted or will be dropped */
-        status->flag |= RX_FLAG_DECRYPTED;
-
-        return result;
-}
-
-static ieee80211_rx_result debug_noinline
 ieee80211_rx_h_check_more_data(struct ieee80211_rx_data *rx)
 {
         struct ieee80211_local *local;
@@ -1372,6 +1224,7 @@ ieee80211_rx_h_sta_process(struct ieee80211_rx_data *rx)
         struct sk_buff *skb = rx->skb;
         struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
+        int i;
 
         if (!sta)
                 return RX_CONTINUE;
@@ -1422,6 +1275,19 @@ ieee80211_rx_h_sta_process(struct ieee80211_rx_data *rx)
                 ewma_add(&sta->avg_signal, -status->signal);
         }
 
+        if (status->chains) {
+                sta->chains = status->chains;
+                for (i = 0; i < ARRAY_SIZE(status->chain_signal); i++) {
+                        int signal = status->chain_signal[i];
+
+                        if (!(status->chains & BIT(i)))
+                                continue;
+
+                        sta->chain_signal_last[i] = signal;
+                        ewma_add(&sta->chain_signal_avg[i], -signal);
+                }
+        }
+
         /*
          * Change STA power saving mode only at the end of a frame
          * exchange sequence.
@@ -1489,6 +1355,207 @@ ieee80211_rx_h_sta_process(struct ieee80211_rx_data *rx)
         return RX_CONTINUE;
 } /* ieee80211_rx_h_sta_process */
 
+static ieee80211_rx_result debug_noinline
+ieee80211_rx_h_decrypt(struct ieee80211_rx_data *rx)
+{
+        struct sk_buff *skb = rx->skb;
+        struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
+        struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
+        int keyidx;
+        int hdrlen;
+        ieee80211_rx_result result = RX_DROP_UNUSABLE;
+        struct ieee80211_key *sta_ptk = NULL;
+        int mmie_keyidx = -1;
+        __le16 fc;
+
+        /*
+         * Key selection 101
+         *
+         * There are four types of keys:
+         *  - GTK (group keys)
+         *  - IGTK (group keys for management frames)
+         *  - PTK (pairwise keys)
+         *  - STK (station-to-station pairwise keys)
+         *
+         * When selecting a key, we have to distinguish between multicast
+         * (including broadcast) and unicast frames, the latter can only
+         * use PTKs and STKs while the former always use GTKs and IGTKs.
+         * Unless, of course, actual WEP keys ("pre-RSNA") are used, then
+         * unicast frames can also use key indices like GTKs. Hence, if we
+         * don't have a PTK/STK we check the key index for a WEP key.
+         *
+         * Note that in a regular BSS, multicast frames are sent by the
+         * AP only, associated stations unicast the frame to the AP first
+         * which then multicasts it on their behalf.
+         *
+         * There is also a slight problem in IBSS mode: GTKs are negotiated
+         * with each station, that is something we don't currently handle.
+         * The spec seems to expect that one negotiates the same key with
+         * every station but there's no such requirement; VLANs could be
+         * possible.
+         */
+
+        /*
+         * No point in finding a key and decrypting if the frame is neither
+         * addressed to us nor a multicast frame.
+         */
+        if (!(status->rx_flags & IEEE80211_RX_RA_MATCH))
+                return RX_CONTINUE;
+
+        /* start without a key */
+        rx->key = NULL;
+
+        if (rx->sta)
+                sta_ptk = rcu_dereference(rx->sta->ptk);
+
+        fc = hdr->frame_control;
+
+        if (!ieee80211_has_protected(fc))
+                mmie_keyidx = ieee80211_get_mmie_keyidx(rx->skb);
+
+        if (!is_multicast_ether_addr(hdr->addr1) && sta_ptk) {
+                rx->key = sta_ptk;
+                if ((status->flag & RX_FLAG_DECRYPTED) &&
+                    (status->flag & RX_FLAG_IV_STRIPPED))
+                        return RX_CONTINUE;
+                /* Skip decryption if the frame is not protected. */
+                if (!ieee80211_has_protected(fc))
+                        return RX_CONTINUE;
+        } else if (mmie_keyidx >= 0) {
+                /* Broadcast/multicast robust management frame / BIP */
+                if ((status->flag & RX_FLAG_DECRYPTED) &&
+                    (status->flag & RX_FLAG_IV_STRIPPED))
+                        return RX_CONTINUE;
+
+                if (mmie_keyidx < NUM_DEFAULT_KEYS ||
+                    mmie_keyidx >= NUM_DEFAULT_KEYS + NUM_DEFAULT_MGMT_KEYS)
+                        return RX_DROP_MONITOR; /* unexpected BIP keyidx */
+                if (rx->sta)
+                        rx->key = rcu_dereference(rx->sta->gtk[mmie_keyidx]);
+                if (!rx->key)
+                        rx->key = rcu_dereference(rx->sdata->keys[mmie_keyidx]);
+        } else if (!ieee80211_has_protected(fc)) {
+                /*
+                 * The frame was not protected, so skip decryption. However, we
+                 * need to set rx->key if there is a key that could have been
+                 * used so that the frame may be dropped if encryption would
+                 * have been expected.
+                 */
+                struct ieee80211_key *key = NULL;
+                struct ieee80211_sub_if_data *sdata = rx->sdata;
+                int i;
+
+                if (ieee80211_is_mgmt(fc) &&
+                    is_multicast_ether_addr(hdr->addr1) &&
+                    (key = rcu_dereference(rx->sdata->default_mgmt_key)))
+                        rx->key = key;
+                else {
+                        if (rx->sta) {
+                                for (i = 0; i < NUM_DEFAULT_KEYS; i++) {
+                                        key = rcu_dereference(rx->sta->gtk[i]);
+                                        if (key)
+                                                break;
+                                }
+                        }
+                        if (!key) {
+                                for (i = 0; i < NUM_DEFAULT_KEYS; i++) {
+                                        key = rcu_dereference(sdata->keys[i]);
+                                        if (key)
+                                                break;
+                                }
+                        }
+                        if (key)
+                                rx->key = key;
+                }
+                return RX_CONTINUE;
+        } else {
+                u8 keyid;
+                /*
+                 * The device doesn't give us the IV so we won't be
+                 * able to look up the key. That's ok though, we
+                 * don't need to decrypt the frame, we just won't
+                 * be able to keep statistics accurate.
+                 * Except for key threshold notifications, should
+                 * we somehow allow the driver to tell us which key
+                 * the hardware used if this flag is set?
+                 */
+                if ((status->flag & RX_FLAG_DECRYPTED) &&
+                    (status->flag & RX_FLAG_IV_STRIPPED))
+                        return RX_CONTINUE;
+
+                hdrlen = ieee80211_hdrlen(fc);
+
+                if (rx->skb->len < 8 + hdrlen)
+                        return RX_DROP_UNUSABLE; /* TODO: count this? */
+
+                /*
+                 * no need to call ieee80211_wep_get_keyidx,
+                 * it verifies a bunch of things we've done already
+                 */
+                skb_copy_bits(rx->skb, hdrlen + 3, &keyid, 1);
+                keyidx = keyid >> 6;
+
+                /* check per-station GTK first, if multicast packet */
+                if (is_multicast_ether_addr(hdr->addr1) && rx->sta)
+                        rx->key = rcu_dereference(rx->sta->gtk[keyidx]);
+
+                /* if not found, try default key */
+                if (!rx->key) {
+                        rx->key = rcu_dereference(rx->sdata->keys[keyidx]);
+
+                        /*
+                         * RSNA-protected unicast frames should always be
+                         * sent with pairwise or station-to-station keys,
+                         * but for WEP we allow using a key index as well.
+                         */
+                        if (rx->key &&
+                            rx->key->conf.cipher != WLAN_CIPHER_SUITE_WEP40 &&
+                            rx->key->conf.cipher != WLAN_CIPHER_SUITE_WEP104 &&
+                            !is_multicast_ether_addr(hdr->addr1))
+                                rx->key = NULL;
+                }
+        }
+
+        if (rx->key) {
+                if (unlikely(rx->key->flags & KEY_FLAG_TAINTED))
+                        return RX_DROP_MONITOR;
+
+                rx->key->tx_rx_count++;
+                /* TODO: add threshold stuff again */
+        } else {
+                return RX_DROP_MONITOR;
+        }
+
+        switch (rx->key->conf.cipher) {
+        case WLAN_CIPHER_SUITE_WEP40:
+        case WLAN_CIPHER_SUITE_WEP104:
+                result = ieee80211_crypto_wep_decrypt(rx);
+                break;
+        case WLAN_CIPHER_SUITE_TKIP:
+                result = ieee80211_crypto_tkip_decrypt(rx);
+                break;
+        case WLAN_CIPHER_SUITE_CCMP:
+                result = ieee80211_crypto_ccmp_decrypt(rx);
+                break;
+        case WLAN_CIPHER_SUITE_AES_CMAC:
+                result = ieee80211_crypto_aes_cmac_decrypt(rx);
+                break;
+        default:
+                /*
+                 * We can reach here only with HW-only algorithms
+                 * but why didn't it decrypt the frame?!
+                 */
+                return RX_DROP_UNUSABLE;
+        }
+
+        /* the hdr variable is invalid after the decrypt handlers */
+
+        /* either the frame has been decrypted or will be dropped */
+        status->flag |= RX_FLAG_DECRYPTED;
+
+        return result;
+}
+
 static inline struct ieee80211_fragment_entry *
 ieee80211_reassemble_add(struct ieee80211_sub_if_data *sdata,
                          unsigned int frag, unsigned int seq, int rx_queue,
@@ -1608,7 +1675,7 @@ ieee80211_rx_h_defragment(struct ieee80211_rx_data *rx)
                         entry->ccmp = 1;
                         memcpy(entry->last_pn,
                                rx->key->u.ccmp.rx_pn[queue],
-                               CCMP_PN_LEN);
+                               IEEE80211_CCMP_PN_LEN);
                 }
                 return RX_QUEUED;
         }
@@ -1627,21 +1694,21 @@ ieee80211_rx_h_defragment(struct ieee80211_rx_data *rx)
          * (IEEE 802.11i, 8.3.3.4.5) */
         if (entry->ccmp) {
                 int i;
-                u8 pn[CCMP_PN_LEN], *rpn;
+                u8 pn[IEEE80211_CCMP_PN_LEN], *rpn;
                 int queue;
                 if (!rx->key || rx->key->conf.cipher != WLAN_CIPHER_SUITE_CCMP)
                         return RX_DROP_UNUSABLE;
-                memcpy(pn, entry->last_pn, CCMP_PN_LEN);
-                for (i = CCMP_PN_LEN - 1; i >= 0; i--) {
+                memcpy(pn, entry->last_pn, IEEE80211_CCMP_PN_LEN);
+                for (i = IEEE80211_CCMP_PN_LEN - 1; i >= 0; i--) {
                         pn[i]++;
                         if (pn[i])
                                 break;
                 }
                 queue = rx->security_idx;
                 rpn = rx->key->u.ccmp.rx_pn[queue];
-                if (memcmp(pn, rpn, CCMP_PN_LEN))
+                if (memcmp(pn, rpn, IEEE80211_CCMP_PN_LEN))
                         return RX_DROP_UNUSABLE;
-                memcpy(entry->last_pn, pn, CCMP_PN_LEN);
+                memcpy(entry->last_pn, pn, IEEE80211_CCMP_PN_LEN);
         }
 
         skb_pull(rx->skb, ieee80211_hdrlen(fc));
@@ -1729,27 +1796,21 @@ static int ieee80211_drop_unencrypted_mgmt(struct ieee80211_rx_data *rx)
                 if (unlikely(!ieee80211_has_protected(fc) &&
                              ieee80211_is_unicast_robust_mgmt_frame(rx->skb) &&
                              rx->key)) {
-                        if (ieee80211_is_deauth(fc))
-                                cfg80211_send_unprot_deauth(rx->sdata->dev,
-                                                            rx->skb->data,
-                                                            rx->skb->len);
-                        else if (ieee80211_is_disassoc(fc))
-                                cfg80211_send_unprot_disassoc(rx->sdata->dev,
-                                                              rx->skb->data,
-                                                              rx->skb->len);
+                        if (ieee80211_is_deauth(fc) ||
+                            ieee80211_is_disassoc(fc))
+                                cfg80211_rx_unprot_mlme_mgmt(rx->sdata->dev,
+                                                             rx->skb->data,
+                                                             rx->skb->len);
                         return -EACCES;
                 }
                 /* BIP does not use Protected field, so need to check MMIE */
                 if (unlikely(ieee80211_is_multicast_robust_mgmt_frame(rx->skb) &&
                              ieee80211_get_mmie_keyidx(rx->skb) < 0)) {
-                        if (ieee80211_is_deauth(fc))
-                                cfg80211_send_unprot_deauth(rx->sdata->dev,
-                                                            rx->skb->data,
-                                                            rx->skb->len);
-                        else if (ieee80211_is_disassoc(fc))
-                                cfg80211_send_unprot_disassoc(rx->sdata->dev,
-                                                              rx->skb->data,
-                                                              rx->skb->len);
+                        if (ieee80211_is_deauth(fc) ||
+                            ieee80211_is_disassoc(fc))
+                                cfg80211_rx_unprot_mlme_mgmt(rx->sdata->dev,
+                                                             rx->skb->data,
+                                                             rx->skb->len);
                         return -EACCES;
                 }
                 /*
@@ -2623,8 +2684,7 @@ ieee80211_rx_h_userspace_mgmt(struct ieee80211_rx_data *rx)
                 sig = status->signal;
 
         if (cfg80211_rx_mgmt(&rx->sdata->wdev, status->freq, sig,
-                             rx->skb->data, rx->skb->len,
-                             GFP_ATOMIC)) {
+                             rx->skb->data, rx->skb->len, 0, GFP_ATOMIC)) {
                 if (rx->sta)
                         rx->sta->rx_packets++;
                 dev_kfree_skb(rx->skb);
@@ -2878,10 +2938,10 @@ static void ieee80211_rx_handlers(struct ieee80211_rx_data *rx,
                  */
                 rx->skb = skb;
 
-                CALL_RXH(ieee80211_rx_h_decrypt)
                 CALL_RXH(ieee80211_rx_h_check_more_data)
                 CALL_RXH(ieee80211_rx_h_uapsd_and_pspoll)
                 CALL_RXH(ieee80211_rx_h_sta_process)
+                CALL_RXH(ieee80211_rx_h_decrypt)
                 CALL_RXH(ieee80211_rx_h_defragment)
                 CALL_RXH(ieee80211_rx_h_michael_mic_verify)
                 /* must be after MMIC verify so header is counted in MPDU mic */
diff --git a/net/mac80211/scan.c b/net/mac80211/scan.c
index 99b103921a4b..08afe74b98f4 100644
--- a/net/mac80211/scan.c
+++ b/net/mac80211/scan.c
@@ -66,6 +66,7 @@ ieee80211_bss_info_update(struct ieee80211_local *local,
         struct cfg80211_bss *cbss;
         struct ieee80211_bss *bss;
         int clen, srlen;
+        enum nl80211_bss_scan_width scan_width;
         s32 signal = 0;
 
         if (local->hw.flags & IEEE80211_HW_SIGNAL_DBM)
@@ -73,8 +74,15 @@ ieee80211_bss_info_update(struct ieee80211_local *local,
         else if (local->hw.flags & IEEE80211_HW_SIGNAL_UNSPEC)
                 signal = (rx_status->signal * 100) / local->hw.max_signal;
 
-        cbss = cfg80211_inform_bss_frame(local->hw.wiphy, channel,
-                                         mgmt, len, signal, GFP_ATOMIC);
+        scan_width = NL80211_BSS_CHAN_WIDTH_20;
+        if (rx_status->flag & RX_FLAG_5MHZ)
+                scan_width = NL80211_BSS_CHAN_WIDTH_5;
+        if (rx_status->flag & RX_FLAG_10MHZ)
+                scan_width = NL80211_BSS_CHAN_WIDTH_10;
+
+        cbss = cfg80211_inform_bss_width_frame(local->hw.wiphy, channel,
+                                               scan_width, mgmt, len, signal,
+                                               GFP_ATOMIC);
         if (!cbss)
                 return NULL;
 
@@ -140,6 +148,15 @@ ieee80211_bss_info_update(struct ieee80211_local *local,
                         bss->valid_data |= IEEE80211_BSS_VALID_WMM;
         }
 
+        if (beacon) {
+                struct ieee80211_supported_band *sband =
+                        local->hw.wiphy->bands[rx_status->band];
+                if (!(rx_status->flag & RX_FLAG_HT) &&
+                    !(rx_status->flag & RX_FLAG_VHT))
+                        bss->beacon_rate =
+                                &sband->bitrates[rx_status->rate_idx];
+        }
+
         return bss;
 }
 
@@ -195,10 +212,29 @@ void ieee80211_scan_rx(struct ieee80211_local *local, struct sk_buff *skb)
                 ieee80211_rx_bss_put(local, bss);
 }
 
+static void
+ieee80211_prepare_scan_chandef(struct cfg80211_chan_def *chandef,
+                               enum nl80211_bss_scan_width scan_width)
+{
+        memset(chandef, 0, sizeof(*chandef));
+        switch (scan_width) {
+        case NL80211_BSS_CHAN_WIDTH_5:
+                chandef->width = NL80211_CHAN_WIDTH_5;
+                break;
+        case NL80211_BSS_CHAN_WIDTH_10:
+                chandef->width = NL80211_CHAN_WIDTH_10;
+                break;
+        default:
+                chandef->width = NL80211_CHAN_WIDTH_20_NOHT;
+                break;
+        }
+}
+
 /* return false if no more work */
 static bool ieee80211_prep_hw_scan(struct ieee80211_local *local)
 {
         struct cfg80211_scan_request *req = local->scan_req;
+        struct cfg80211_chan_def chandef;
         enum ieee80211_band band;
         int i, ielen, n_chans;
 
@@ -220,11 +256,12 @@ static bool ieee80211_prep_hw_scan(struct ieee80211_local *local)
         } while (!n_chans);
 
         local->hw_scan_req->n_channels = n_chans;
+        ieee80211_prepare_scan_chandef(&chandef, req->scan_width);
 
         ielen = ieee80211_build_preq_ies(local, (u8 *)local->hw_scan_req->ie,
                                          local->hw_scan_ies_bufsize,
                                          req->ie, req->ie_len, band,
-                                         req->rates[band], 0);
+                                         req->rates[band], &chandef);
         local->hw_scan_req->ie_len = ielen;
         local->hw_scan_req->no_cck = req->no_cck;
 
@@ -271,7 +308,7 @@ static void __ieee80211_scan_completed(struct ieee80211_hw *hw, bool aborted,
         rcu_assign_pointer(local->scan_sdata, NULL);
 
         local->scanning = 0;
-        local->scan_channel = NULL;
+        local->scan_chandef.chan = NULL;
 
         /* Set power back to normal operating levels. */
         ieee80211_hw_config(local, 0);
@@ -606,11 +643,34 @@ static void ieee80211_scan_state_set_channel(struct ieee80211_local *local,
 {
         int skip;
         struct ieee80211_channel *chan;
+        enum nl80211_bss_scan_width oper_scan_width;
 
         skip = 0;
         chan = local->scan_req->channels[local->scan_channel_idx];
 
-        local->scan_channel = chan;
+        local->scan_chandef.chan = chan;
+        local->scan_chandef.center_freq1 = chan->center_freq;
+        local->scan_chandef.center_freq2 = 0;
+        switch (local->scan_req->scan_width) {
+        case NL80211_BSS_CHAN_WIDTH_5:
+                local->scan_chandef.width = NL80211_CHAN_WIDTH_5;
+                break;
+        case NL80211_BSS_CHAN_WIDTH_10:
+                local->scan_chandef.width = NL80211_CHAN_WIDTH_10;
+                break;
+        case NL80211_BSS_CHAN_WIDTH_20:
+                /* If scanning on oper channel, use whatever channel-type
+                 * is currently in use.
+                 */
+                oper_scan_width = cfg80211_chandef_to_scan_width(
+                                        &local->_oper_chandef);
+                if (chan == local->_oper_chandef.chan &&
+                    oper_scan_width == local->scan_req->scan_width)
+                        local->scan_chandef = local->_oper_chandef;
+                else
+                        local->scan_chandef.width = NL80211_CHAN_WIDTH_20_NOHT;
+                break;
+        }
 
         if (ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_CHANNEL))
                 skip = 1;
@@ -650,7 +710,7 @@ static void ieee80211_scan_state_suspend(struct ieee80211_local *local,
                                          unsigned long *next_delay)
 {
         /* switch back to the operating channel */
-        local->scan_channel = NULL;
+        local->scan_chandef.chan = NULL;
         ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_CHANNEL);
 
         /* disable PS */
@@ -792,7 +852,8 @@ int ieee80211_request_scan(struct ieee80211_sub_if_data *sdata,
 
 int ieee80211_request_ibss_scan(struct ieee80211_sub_if_data *sdata,
                                 const u8 *ssid, u8 ssid_len,
-                                struct ieee80211_channel *chan)
+                                struct ieee80211_channel *chan,
+                                enum nl80211_bss_scan_width scan_width)
 {
         struct ieee80211_local *local = sdata->local;
         int ret = -EBUSY;
@@ -842,6 +903,7 @@ int ieee80211_request_ibss_scan(struct ieee80211_sub_if_data *sdata,
 
         local->int_scan_req->ssids = &local->scan_ssid;
         local->int_scan_req->n_ssids = 1;
+        local->int_scan_req->scan_width = scan_width;
         memcpy(local->int_scan_req->ssids[0].ssid, ssid, IEEE80211_MAX_SSID_LEN);
         local->int_scan_req->ssids[0].ssid_len = ssid_len;
 
@@ -903,6 +965,7 @@ int ieee80211_request_sched_scan_start(struct ieee80211_sub_if_data *sdata,
 {
         struct ieee80211_local *local = sdata->local;
         struct ieee80211_sched_scan_ies sched_scan_ies = {};
+        struct cfg80211_chan_def chandef;
         int ret, i, iebufsz;
 
         iebufsz = 2 + IEEE80211_MAX_SSID_LEN +
@@ -930,10 +993,12 @@ int ieee80211_request_sched_scan_start(struct ieee80211_sub_if_data *sdata,
                         goto out_free;
                 }
 
+                ieee80211_prepare_scan_chandef(&chandef, req->scan_width);
+
                 sched_scan_ies.len[i] =
                         ieee80211_build_preq_ies(local, sched_scan_ies.ie[i],
                                                  iebufsz, req->ie, req->ie_len,
-                                                 i, (u32) -1, 0);
+                                                 i, (u32) -1, &chandef);
         }
 
         ret = drv_sched_scan_start(local, sdata, req, &sched_scan_ies);
diff --git a/net/mac80211/sta_info.c b/net/mac80211/sta_info.c
index 11216bc13b27..aeb967a0aeed 100644
--- a/net/mac80211/sta_info.c
+++ b/net/mac80211/sta_info.c
@@ -149,6 +149,7 @@ static void cleanup_single_sta(struct sta_info *sta)
          * directly by station destruction.
          */
         for (i = 0; i < IEEE80211_NUM_TIDS; i++) {
+                kfree(sta->ampdu_mlme.tid_start_tx[i]);
                 tid_tx = rcu_dereference_raw(sta->ampdu_mlme.tid_tx[i]);
                 if (!tid_tx)
                         continue;
@@ -346,6 +347,7 @@ struct sta_info *sta_info_alloc(struct ieee80211_sub_if_data *sdata,
         if (ieee80211_vif_is_mesh(&sdata->vif) &&
             !sdata->u.mesh.user_mpm)
                 init_timer(&sta->plink_timer);
+        sta->nonpeer_pm = NL80211_MESH_POWER_ACTIVE;
 #endif
 
         memcpy(sta->sta.addr, addr, ETH_ALEN);
@@ -358,6 +360,8 @@ struct sta_info *sta_info_alloc(struct ieee80211_sub_if_data *sdata,
         do_posix_clock_monotonic_gettime(&uptime);
         sta->last_connected = uptime.tv_sec;
         ewma_init(&sta->avg_signal, 1024, 8);
+        for (i = 0; i < ARRAY_SIZE(sta->chain_signal_avg); i++)
+                ewma_init(&sta->chain_signal_avg[i], 1024, 8);
 
         if (sta_prepare_rate_control(local, sta, gfp)) {
                 kfree(sta);
@@ -1130,6 +1134,7 @@ static void ieee80211_send_null_response(struct ieee80211_sub_if_data *sdata,
          * ends the poll/service period.
          */
         info->flags |= IEEE80211_TX_CTL_NO_PS_BUFFER |
+                       IEEE80211_TX_CTL_PS_RESPONSE |
                        IEEE80211_TX_STATUS_EOSP |
                        IEEE80211_TX_CTL_REQ_TX_STATUS;
 
@@ -1267,7 +1272,8 @@ ieee80211_sta_ps_deliver_response(struct sta_info *sta,
                          * STA may still remain is PS mode after this frame
                          * exchange.
                          */
-                        info->flags |= IEEE80211_TX_CTL_NO_PS_BUFFER;
+                        info->flags |= IEEE80211_TX_CTL_NO_PS_BUFFER |
+                                       IEEE80211_TX_CTL_PS_RESPONSE;
 
                         /*
                          * Use MoreData flag to indicate whether there are
diff --git a/net/mac80211/sta_info.h b/net/mac80211/sta_info.h
index adc30045f99e..4208dbd5861f 100644
--- a/net/mac80211/sta_info.h
+++ b/net/mac80211/sta_info.h
@@ -203,6 +203,7 @@ struct tid_ampdu_rx {
  *      driver requested to close until the work for it runs
  * @mtx: mutex to protect all TX data (except non-NULL assignments
  *      to tid_tx[idx], which are protected by the sta spinlock)
+ *      tid_start_tx is also protected by sta->lock.
  */
 struct sta_ampdu_mlme {
         struct mutex mtx;
@@ -297,6 +298,9 @@ struct sta_ampdu_mlme {
  * @rcu_head: RCU head used for freeing this station struct
  * @cur_max_bandwidth: maximum bandwidth to use for TX to the station,
  *      taken from HT/VHT capabilities or VHT operating mode notification
+ * @chains: chains ever used for RX from this station
+ * @chain_signal_last: last signal (per chain)
+ * @chain_signal_avg: signal average (per chain)
  */
 struct sta_info {
         /* General information, mostly static */
@@ -344,6 +348,11 @@ struct sta_info {
         int last_signal;
         struct ewma avg_signal;
         int last_ack_signal;
+
+        u8 chains;
+        s8 chain_signal_last[IEEE80211_MAX_CHAINS];
+        struct ewma chain_signal_avg[IEEE80211_MAX_CHAINS];
+
         /* Plus 1 for non-QoS frames */
         __le16 last_seq_ctrl[IEEE80211_NUM_TIDS + 1];
 
diff --git a/net/mac80211/status.c b/net/mac80211/status.c
index 43439203f4e4..368837fe3b80 100644
--- a/net/mac80211/status.c
+++ b/net/mac80211/status.c
@@ -235,7 +235,8 @@ static int ieee80211_tx_radiotap_len(struct ieee80211_tx_info *info)
 
         /* IEEE80211_RADIOTAP_RATE rate */
         if (info->status.rates[0].idx >= 0 &&
-            !(info->status.rates[0].flags & IEEE80211_TX_RC_MCS))
+            !(info->status.rates[0].flags & (IEEE80211_TX_RC_MCS |
+                                             IEEE80211_TX_RC_VHT_MCS)))
                 len += 2;
 
         /* IEEE80211_RADIOTAP_TX_FLAGS */
@@ -244,17 +245,23 @@ static int ieee80211_tx_radiotap_len(struct ieee80211_tx_info *info)
         /* IEEE80211_RADIOTAP_DATA_RETRIES */
         len += 1;
 
-        /* IEEE80211_TX_RC_MCS */
-        if (info->status.rates[0].idx >= 0 &&
-            info->status.rates[0].flags & IEEE80211_TX_RC_MCS)
-                len += 3;
+        /* IEEE80211_RADIOTAP_MCS
+         * IEEE80211_RADIOTAP_VHT */
+        if (info->status.rates[0].idx >= 0) {
+                if (info->status.rates[0].flags & IEEE80211_TX_RC_MCS)
+                        len += 3;
+                else if (info->status.rates[0].flags & IEEE80211_TX_RC_VHT_MCS)
+                        len = ALIGN(len, 2) + 12;
+        }
 
         return len;
 }
 
-static void ieee80211_add_tx_radiotap_header(struct ieee80211_supported_band
-                                             *sband, struct sk_buff *skb,
-                                             int retry_count, int rtap_len)
+static void
+ieee80211_add_tx_radiotap_header(struct ieee80211_local *local,
+                                 struct ieee80211_supported_band *sband,
+                                 struct sk_buff *skb, int retry_count,
+                                 int rtap_len, int shift)
 {
         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
@@ -279,9 +286,13 @@ static void ieee80211_add_tx_radiotap_header(struct ieee80211_supported_band
 
         /* IEEE80211_RADIOTAP_RATE */
         if (info->status.rates[0].idx >= 0 &&
-            !(info->status.rates[0].flags & IEEE80211_TX_RC_MCS)) {
+            !(info->status.rates[0].flags & (IEEE80211_TX_RC_MCS |
+                                             IEEE80211_TX_RC_VHT_MCS))) {
+                u16 rate;
+
                 rthdr->it_present |= cpu_to_le32(1 << IEEE80211_RADIOTAP_RATE);
-                *pos = sband->bitrates[info->status.rates[0].idx].bitrate / 5;
+                rate = sband->bitrates[info->status.rates[0].idx].bitrate;
+                *pos = DIV_ROUND_UP(rate, 5 * (1 << shift));
                 /* padding for tx flags */
                 pos += 2;
         }
@@ -306,9 +317,12 @@ static void ieee80211_add_tx_radiotap_header(struct ieee80211_supported_band
         *pos = retry_count;
         pos++;
 
-        /* IEEE80211_TX_RC_MCS */
-        if (info->status.rates[0].idx >= 0 &&
-            info->status.rates[0].flags & IEEE80211_TX_RC_MCS) {
+        if (info->status.rates[0].idx < 0)
+                return;
+
+        /* IEEE80211_RADIOTAP_MCS
+         * IEEE80211_RADIOTAP_VHT */
+        if (info->status.rates[0].flags & IEEE80211_TX_RC_MCS) {
                 rthdr->it_present |= cpu_to_le32(1 << IEEE80211_RADIOTAP_MCS);
                 pos[0] = IEEE80211_RADIOTAP_MCS_HAVE_MCS |
                          IEEE80211_RADIOTAP_MCS_HAVE_GI |
@@ -321,8 +335,48 @@ static void ieee80211_add_tx_radiotap_header(struct ieee80211_supported_band
                         pos[1] |= IEEE80211_RADIOTAP_MCS_FMT_GF;
                 pos[2] = info->status.rates[0].idx;
                 pos += 3;
-        }
+        } else if (info->status.rates[0].flags & IEEE80211_TX_RC_VHT_MCS) {
+                u16 known = local->hw.radiotap_vht_details &
+                        (IEEE80211_RADIOTAP_VHT_KNOWN_GI |
+                         IEEE80211_RADIOTAP_VHT_KNOWN_BANDWIDTH);
+
+                rthdr->it_present |= cpu_to_le32(1 << IEEE80211_RADIOTAP_VHT);
+
+                /* required alignment from rthdr */
+                pos = (u8 *)rthdr + ALIGN(pos - (u8 *)rthdr, 2);
 
+                /* u16 known - IEEE80211_RADIOTAP_VHT_KNOWN_* */
+                put_unaligned_le16(known, pos);
+                pos += 2;
+
+                /* u8 flags - IEEE80211_RADIOTAP_VHT_FLAG_* */
+                if (info->status.rates[0].flags & IEEE80211_TX_RC_SHORT_GI)
+                        *pos |= IEEE80211_RADIOTAP_VHT_FLAG_SGI;
+                pos++;
+
+                /* u8 bandwidth */
+                if (info->status.rates[0].flags & IEEE80211_TX_RC_40_MHZ_WIDTH)
+                        *pos = 1;
+                else if (info->status.rates[0].flags & IEEE80211_TX_RC_80_MHZ_WIDTH)
+                        *pos = 4;
+                else if (info->status.rates[0].flags & IEEE80211_TX_RC_160_MHZ_WIDTH)
+                        *pos = 11;
+                else /* IEEE80211_TX_RC_{20_MHZ_WIDTH,FIXME:DUP_DATA} */
+                        *pos = 0;
+                pos++;
+
+                /* u8 mcs_nss[4] */
+                *pos = (ieee80211_rate_get_vht_mcs(&info->status.rates[0]) << 4) |
+                        ieee80211_rate_get_vht_nss(&info->status.rates[0]);
+                pos += 4;
+
+                /* u8 coding */
+                pos++;
+                /* u8 group_id */
+                pos++;
+                /* u16 partial_aid */
+                pos += 2;
+        }
 }
 
 static void ieee80211_report_used_skb(struct ieee80211_local *local,
@@ -424,6 +478,7 @@ void ieee80211_tx_status(struct ieee80211_hw *hw, struct sk_buff *skb)
         bool acked;
         struct ieee80211_bar *bar;
         int rtap_len;
+        int shift = 0;
 
         for (i = 0; i < IEEE80211_TX_MAX_RATES; i++) {
                 if ((info->flags & IEEE80211_TX_CTL_AMPDU) &&
@@ -458,6 +513,8 @@ void ieee80211_tx_status(struct ieee80211_hw *hw, struct sk_buff *skb)
                 if (!ether_addr_equal(hdr->addr2, sta->sdata->vif.addr))
                         continue;
 
+                shift = ieee80211_vif_get_shift(&sta->sdata->vif);
+
                 if (info->flags & IEEE80211_TX_STATUS_EOSP)
                         clear_sta_flag(sta, WLAN_STA_SP);
 
@@ -557,7 +614,7 @@ void ieee80211_tx_status(struct ieee80211_hw *hw, struct sk_buff *skb)
 
         rcu_read_unlock();
 
-        ieee80211_led_tx(local, 0);
+        ieee80211_led_tx(local);
 
         /* SNMP counters
          * Fragments are passed to low-level drivers as separate skbs, so these
@@ -624,7 +681,8 @@ void ieee80211_tx_status(struct ieee80211_hw *hw, struct sk_buff *skb)
                 dev_kfree_skb(skb);
                 return;
         }
-        ieee80211_add_tx_radiotap_header(sband, skb, retry_count, rtap_len);
+        ieee80211_add_tx_radiotap_header(local, sband, skb, retry_count,
+                                         rtap_len, shift);
 
         /* XXX: is this sufficient for BPF? */
         skb_set_mac_header(skb, 0);
diff --git a/net/mac80211/trace.h b/net/mac80211/trace.h
index c215fafd7a2f..1aba645882bd 100644
--- a/net/mac80211/trace.h
+++ b/net/mac80211/trace.h
@@ -1906,6 +1906,32 @@ TRACE_EVENT(api_radar_detected,
         )
 );
 
+TRACE_EVENT(drv_channel_switch_beacon,
+        TP_PROTO(struct ieee80211_local *local,
+                 struct ieee80211_sub_if_data *sdata,
+                 struct cfg80211_chan_def *chandef),
+
+        TP_ARGS(local, sdata, chandef),
+
+        TP_STRUCT__entry(
+                LOCAL_ENTRY
+                VIF_ENTRY
+                CHANDEF_ENTRY
+        ),
+
+        TP_fast_assign(
+                LOCAL_ASSIGN;
+                VIF_ASSIGN;
+                CHANDEF_ASSIGN(chandef);
+        ),
+
+        TP_printk(
+                LOCAL_PR_FMT VIF_PR_FMT " channel switch to " CHANDEF_PR_FMT,
+                LOCAL_PR_ARG, VIF_PR_ARG, CHANDEF_PR_ARG
+        )
+);
+
+
 #ifdef CONFIG_MAC80211_MESSAGE_TRACING
 #undef TRACE_SYSTEM
 #define TRACE_SYSTEM mac80211_msg
diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
index 9972e07a2f96..3456c0486b48 100644
--- a/net/mac80211/tx.c
+++ b/net/mac80211/tx.c
@@ -40,12 +40,22 @@ static __le16 ieee80211_duration(struct ieee80211_tx_data *tx,
                                  struct sk_buff *skb, int group_addr,
                                  int next_frag_len)
 {
-        int rate, mrate, erp, dur, i;
+        int rate, mrate, erp, dur, i, shift = 0;
         struct ieee80211_rate *txrate;
         struct ieee80211_local *local = tx->local;
         struct ieee80211_supported_band *sband;
         struct ieee80211_hdr *hdr;
         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
+        struct ieee80211_chanctx_conf *chanctx_conf;
+        u32 rate_flags = 0;
+
+        rcu_read_lock();
+        chanctx_conf = rcu_dereference(tx->sdata->vif.chanctx_conf);
+        if (chanctx_conf) {
+                shift = ieee80211_chandef_get_shift(&chanctx_conf->def);
+                rate_flags = ieee80211_chandef_rate_flags(&chanctx_conf->def);
+        }
+        rcu_read_unlock();
 
         /* assume HW handles this */
         if (tx->rate.flags & IEEE80211_TX_RC_MCS)
@@ -122,8 +132,11 @@ static __le16 ieee80211_duration(struct ieee80211_tx_data *tx,
                 if (r->bitrate > txrate->bitrate)
                         break;
 
+                if ((rate_flags & r->flags) != rate_flags)
+                        continue;
+
                 if (tx->sdata->vif.bss_conf.basic_rates & BIT(i))
-                        rate = r->bitrate;
+                        rate = DIV_ROUND_UP(r->bitrate, 1 << shift);
 
                 switch (sband->band) {
                 case IEEE80211_BAND_2GHZ: {
@@ -150,7 +163,7 @@ static __le16 ieee80211_duration(struct ieee80211_tx_data *tx,
         if (rate == -1) {
                 /* No matching basic rate found; use highest suitable mandatory
                  * PHY rate */
-                rate = mrate;
+                rate = DIV_ROUND_UP(mrate, 1 << shift);
         }
 
         /* Don't calculate ACKs for QoS Frames with NoAck Policy set */
@@ -162,7 +175,8 @@ static __le16 ieee80211_duration(struct ieee80211_tx_data *tx,
                  * (10 bytes + 4-byte FCS = 112 bits) plus SIFS; rounded up
                  * to closest integer */
                 dur = ieee80211_frame_duration(sband->band, 10, rate, erp,
-                                tx->sdata->vif.bss_conf.use_short_preamble);
+                                tx->sdata->vif.bss_conf.use_short_preamble,
+                                shift);
 
         if (next_frag_len) {
                 /* Frame is fragmented: duration increases with time needed to
@@ -171,7 +185,8 @@ static __le16 ieee80211_duration(struct ieee80211_tx_data *tx,
                 /* next fragment */
                 dur += ieee80211_frame_duration(sband->band, next_frag_len,
                                 txrate->bitrate, erp,
-                                tx->sdata->vif.bss_conf.use_short_preamble);
+                                tx->sdata->vif.bss_conf.use_short_preamble,
+                                shift);
         }
 
         return cpu_to_le16(dur);
@@ -398,13 +413,14 @@ ieee80211_tx_h_multicast_ps_buf(struct ieee80211_tx_data *tx)
         if (ieee80211_has_order(hdr->frame_control))
                 return TX_CONTINUE;
 
+        if (tx->local->hw.flags & IEEE80211_HW_QUEUE_CONTROL)
+                info->hw_queue = tx->sdata->vif.cab_queue;
+
         /* no stations in PS mode */
         if (!atomic_read(&ps->num_sta_ps))
                 return TX_CONTINUE;
 
         info->flags |= IEEE80211_TX_CTL_SEND_AFTER_DTIM;
-        if (tx->local->hw.flags & IEEE80211_HW_QUEUE_CONTROL)
-                info->hw_queue = tx->sdata->vif.cab_queue;
 
         /* device releases frame after DTIM beacon */
         if (!(tx->local->hw.flags & IEEE80211_HW_HOST_BROADCAST_PS_BUFFERING))
@@ -523,9 +539,11 @@ ieee80211_tx_h_check_control_port_protocol(struct ieee80211_tx_data *tx)
 {
         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(tx->skb);
 
-        if (unlikely(tx->sdata->control_port_protocol == tx->skb->protocol &&
-                     tx->sdata->control_port_no_encrypt))
-                info->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT;
+        if (unlikely(tx->sdata->control_port_protocol == tx->skb->protocol)) {
+                if (tx->sdata->control_port_no_encrypt)
+                        info->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT;
+                info->control.flags |= IEEE80211_TX_CTRL_PORT_CTRL_PROTO;
+        }
 
         return TX_CONTINUE;
 }
@@ -763,9 +781,11 @@ ieee80211_tx_h_sequence(struct ieee80211_tx_data *tx)
         /*
          * Anything but QoS data that has a sequence number field
          * (is long enough) gets a sequence number from the global
-         * counter.
+         * counter.  QoS data frames with a multicast destination
+         * also use the global counter (802.11-2012 9.3.2.10).
          */
-        if (!ieee80211_is_data_qos(hdr->frame_control)) {
+        if (!ieee80211_is_data_qos(hdr->frame_control) ||
+            is_multicast_ether_addr(hdr->addr1)) {
                 /* driver should assign sequence number */
                 info->flags |= IEEE80211_TX_CTL_ASSIGN_SEQ;
                 /* for pure STA mode without beacons, we can do it */
@@ -1256,6 +1276,10 @@ static bool __ieee80211_tx(struct ieee80211_local *local,
 
         switch (sdata->vif.type) {
         case NL80211_IFTYPE_MONITOR:
+                if (sdata->u.mntr_flags & MONITOR_FLAG_ACTIVE) {
+                        vif = &sdata->vif;
+                        break;
+                }
                 sdata = rcu_dereference(local->monitor_sdata);
                 if (sdata) {
                         vif = &sdata->vif;
@@ -1280,7 +1304,6 @@ static bool __ieee80211_tx(struct ieee80211_local *local,
                                     txpending);
 
         ieee80211_tpt_led_trig_tx(local, fc, led_len);
-        ieee80211_led_tx(local, 1);
 
         WARN_ON_ONCE(!skb_queue_empty(skbs));
 
@@ -1789,12 +1812,6 @@ netdev_tx_t ieee80211_subif_start_xmit(struct sk_buff *skb,
                 break;
 #ifdef CONFIG_MAC80211_MESH
         case NL80211_IFTYPE_MESH_POINT:
-                if (!sdata->u.mesh.mshcfg.dot11MeshTTL) {
-                        /* Do not send frames with mesh_ttl == 0 */
-                        sdata->u.mesh.mshstats.dropped_frames_ttl++;
-                        goto fail_rcu;
-                }
-
                 if (!is_multicast_ether_addr(skb->data)) {
                         struct sta_info *next_hop;
                         bool mpp_lookup = true;
@@ -2325,6 +2342,81 @@ static int ieee80211_beacon_add_tim(struct ieee80211_sub_if_data *sdata,
         return 0;
 }
 
+void ieee80211_csa_finish(struct ieee80211_vif *vif)
+{
+        struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
+
+        ieee80211_queue_work(&sdata->local->hw,
+                             &sdata->csa_finalize_work);
+}
+EXPORT_SYMBOL(ieee80211_csa_finish);
+
+static void ieee80211_update_csa(struct ieee80211_sub_if_data *sdata,
+                                 struct beacon_data *beacon)
+{
+        struct probe_resp *resp;
+        int counter_offset_beacon = sdata->csa_counter_offset_beacon;
+        int counter_offset_presp = sdata->csa_counter_offset_presp;
+
+        /* warn if the driver did not check for/react to csa completeness */
+        if (WARN_ON(((u8 *)beacon->tail)[counter_offset_beacon] == 0))
+                return;
+
+        ((u8 *)beacon->tail)[counter_offset_beacon]--;
+
+        if (sdata->vif.type == NL80211_IFTYPE_AP &&
+            counter_offset_presp) {
+                rcu_read_lock();
+                resp = rcu_dereference(sdata->u.ap.probe_resp);
+
+                /* if nl80211 accepted the offset, this should not happen. */
+                if (WARN_ON(!resp)) {
+                        rcu_read_unlock();
+                        return;
+                }
+                resp->data[counter_offset_presp]--;
+                rcu_read_unlock();
+        }
+}
+
+bool ieee80211_csa_is_complete(struct ieee80211_vif *vif)
+{
+        struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
+        struct beacon_data *beacon = NULL;
+        u8 *beacon_data;
+        size_t beacon_data_len;
+        int counter_beacon = sdata->csa_counter_offset_beacon;
+        int ret = false;
+
+        if (!ieee80211_sdata_running(sdata))
+                return false;
+
+        rcu_read_lock();
+        if (vif->type == NL80211_IFTYPE_AP) {
+                struct ieee80211_if_ap *ap = &sdata->u.ap;
+
+                beacon = rcu_dereference(ap->beacon);
+                if (WARN_ON(!beacon || !beacon->tail))
+                        goto out;
+                beacon_data = beacon->tail;
+                beacon_data_len = beacon->tail_len;
+        } else {
+                WARN_ON(1);
+                goto out;
+        }
+
+        if (WARN_ON(counter_beacon > beacon_data_len))
+                goto out;
+
+        if (beacon_data[counter_beacon] == 0)
+                ret = true;
+ out:
+        rcu_read_unlock();
+
+        return ret;
+}
+EXPORT_SYMBOL(ieee80211_csa_is_complete);
+
 struct sk_buff *ieee80211_beacon_get_tim(struct ieee80211_hw *hw,
                                          struct ieee80211_vif *vif,
                                          u16 *tim_offset, u16 *tim_length)
@@ -2355,6 +2447,9 @@ struct sk_buff *ieee80211_beacon_get_tim(struct ieee80211_hw *hw,
                 struct beacon_data *beacon = rcu_dereference(ap->beacon);
 
                 if (beacon) {
+                        if (sdata->vif.csa_active)
+                                ieee80211_update_csa(sdata, beacon);
+
                         /*
                          * headroom, head length,
                          * tail length and maximum TIM length
diff --git a/net/mac80211/util.c b/net/mac80211/util.c
index 27e07150eb46..e1b34a18b243 100644
--- a/net/mac80211/util.c
+++ b/net/mac80211/util.c
@@ -107,7 +107,8 @@ void ieee80211_tx_set_protected(struct ieee80211_tx_data *tx)
 }
 
 int ieee80211_frame_duration(enum ieee80211_band band, size_t len,
-                             int rate, int erp, int short_preamble)
+                             int rate, int erp, int short_preamble,
+                             int shift)
 {
         int dur;
 
@@ -118,6 +119,9 @@ int ieee80211_frame_duration(enum ieee80211_band band, size_t len,
          *
          * rate is in 100 kbps, so divident is multiplied by 10 in the
          * DIV_ROUND_UP() operations.
+         *
+         * shift may be 2 for 5 MHz channels or 1 for 10 MHz channels, and
+         * is assumed to be 0 otherwise.
          */
 
         if (band == IEEE80211_BAND_5GHZ || erp) {
@@ -130,13 +134,23 @@ int ieee80211_frame_duration(enum ieee80211_band band, size_t len,
                  * TXTIME = T_PREAMBLE + T_SIGNAL + T_SYM x N_SYM + Signal Ext
                  *
                  * T_SYM = 4 usec
-                 * 802.11a - 17.5.2: aSIFSTime = 16 usec
+                 * 802.11a - 18.5.2: aSIFSTime = 16 usec
                  * 802.11g - 19.8.4: aSIFSTime = 10 usec +
                  *      signal ext = 6 usec
                  */
                 dur = 16; /* SIFS + signal ext */
-                dur += 16; /* 17.3.2.3: T_PREAMBLE = 16 usec */
-                dur += 4; /* 17.3.2.3: T_SIGNAL = 4 usec */
+                dur += 16; /* IEEE 802.11-2012 18.3.2.4: T_PREAMBLE = 16 usec */
+                dur += 4; /* IEEE 802.11-2012 18.3.2.4: T_SIGNAL = 4 usec */
+
+                /* IEEE 802.11-2012 18.3.2.4: all values above are:
+                 *  * times 4 for 5 MHz
+                 *  * times 2 for 10 MHz
+                 */
+                dur *= 1 << shift;
+
+                /* rates should already consider the channel bandwidth,
+                 * don't apply divisor again.
+                 */
                 dur += 4 * DIV_ROUND_UP((16 + 8 * (len + 4) + 6) * 10,
                                         4 * rate); /* T_SYM x N_SYM */
         } else {
@@ -168,7 +182,7 @@ __le16 ieee80211_generic_frame_duration(struct ieee80211_hw *hw,
 {
         struct ieee80211_sub_if_data *sdata;
         u16 dur;
-        int erp;
+        int erp, shift = 0;
         bool short_preamble = false;
 
         erp = 0;
@@ -177,10 +191,11 @@ __le16 ieee80211_generic_frame_duration(struct ieee80211_hw *hw,
                 short_preamble = sdata->vif.bss_conf.use_short_preamble;
                 if (sdata->flags & IEEE80211_SDATA_OPERATING_GMODE)
                         erp = rate->flags & IEEE80211_RATE_ERP_G;
+                shift = ieee80211_vif_get_shift(vif);
         }
 
         dur = ieee80211_frame_duration(band, frame_len, rate->bitrate, erp,
-                                       short_preamble);
+                                       short_preamble, shift);
 
         return cpu_to_le16(dur);
 }
@@ -194,7 +209,7 @@ __le16 ieee80211_rts_duration(struct ieee80211_hw *hw,
         struct ieee80211_rate *rate;
         struct ieee80211_sub_if_data *sdata;
         bool short_preamble;
-        int erp;
+        int erp, shift = 0, bitrate;
         u16 dur;
         struct ieee80211_supported_band *sband;
 
@@ -210,17 +225,20 @@ __le16 ieee80211_rts_duration(struct ieee80211_hw *hw,
                 short_preamble = sdata->vif.bss_conf.use_short_preamble;
                 if (sdata->flags & IEEE80211_SDATA_OPERATING_GMODE)
                         erp = rate->flags & IEEE80211_RATE_ERP_G;
+                shift = ieee80211_vif_get_shift(vif);
         }
 
+        bitrate = DIV_ROUND_UP(rate->bitrate, 1 << shift);
+
         /* CTS duration */
-        dur = ieee80211_frame_duration(sband->band, 10, rate->bitrate,
-                                       erp, short_preamble);
+        dur = ieee80211_frame_duration(sband->band, 10, bitrate,
+                                       erp, short_preamble, shift);
         /* Data frame duration */
-        dur += ieee80211_frame_duration(sband->band, frame_len, rate->bitrate,
-                                        erp, short_preamble);
+        dur += ieee80211_frame_duration(sband->band, frame_len, bitrate,
+                                        erp, short_preamble, shift);
         /* ACK duration */
-        dur += ieee80211_frame_duration(sband->band, 10, rate->bitrate,
-                                        erp, short_preamble);
+        dur += ieee80211_frame_duration(sband->band, 10, bitrate,
+                                        erp, short_preamble, shift);
 
         return cpu_to_le16(dur);
 }
@@ -235,7 +253,7 @@ __le16 ieee80211_ctstoself_duration(struct ieee80211_hw *hw,
         struct ieee80211_rate *rate;
         struct ieee80211_sub_if_data *sdata;
         bool short_preamble;
-        int erp;
+        int erp, shift = 0, bitrate;
         u16 dur;
         struct ieee80211_supported_band *sband;
 
@@ -250,15 +268,18 @@ __le16 ieee80211_ctstoself_duration(struct ieee80211_hw *hw,
                 short_preamble = sdata->vif.bss_conf.use_short_preamble;
                 if (sdata->flags & IEEE80211_SDATA_OPERATING_GMODE)
                         erp = rate->flags & IEEE80211_RATE_ERP_G;
+                shift = ieee80211_vif_get_shift(vif);
         }
 
+        bitrate = DIV_ROUND_UP(rate->bitrate, 1 << shift);
+
         /* Data frame duration */
-        dur = ieee80211_frame_duration(sband->band, frame_len, rate->bitrate,
-                                       erp, short_preamble);
+        dur = ieee80211_frame_duration(sband->band, frame_len, bitrate,
+                                       erp, short_preamble, shift);
         if (!(frame_txctl->flags & IEEE80211_TX_CTL_NO_ACK)) {
                 /* ACK duration */
-                dur += ieee80211_frame_duration(sband->band, 10, rate->bitrate,
-                                                erp, short_preamble);
+                dur += ieee80211_frame_duration(sband->band, 10, bitrate,
+                                                erp, short_preamble, shift);
         }
 
         return cpu_to_le16(dur);
@@ -560,6 +581,9 @@ void ieee80211_iterate_active_interfaces(
         list_for_each_entry(sdata, &local->interfaces, list) {
                 switch (sdata->vif.type) {
                 case NL80211_IFTYPE_MONITOR:
+                        if (!(sdata->u.mntr_flags & MONITOR_FLAG_ACTIVE))
+                                continue;
+                        break;
                 case NL80211_IFTYPE_AP_VLAN:
                         continue;
                 default:
@@ -598,6 +622,9 @@ void ieee80211_iterate_active_interfaces_atomic(
         list_for_each_entry_rcu(sdata, &local->interfaces, list) {
                 switch (sdata->vif.type) {
                 case NL80211_IFTYPE_MONITOR:
+                        if (!(sdata->u.mntr_flags & MONITOR_FLAG_ACTIVE))
+                                continue;
+                        break;
                 case NL80211_IFTYPE_AP_VLAN:
                         continue;
                 default:
@@ -661,12 +688,12 @@ void ieee80211_queue_delayed_work(struct ieee80211_hw *hw,
 }
 EXPORT_SYMBOL(ieee80211_queue_delayed_work);
 
-u32 ieee802_11_parse_elems_crc(u8 *start, size_t len, bool action,
+u32 ieee802_11_parse_elems_crc(const u8 *start, size_t len, bool action,
                                struct ieee802_11_elems *elems,
                                u64 filter, u32 crc)
 {
         size_t left = len;
-        u8 *pos = start;
+        const u8 *pos = start;
         bool calc_crc = filter != 0;
         DECLARE_BITMAP(seen_elems, 256);
         const u8 *ie;
@@ -1046,58 +1073,6 @@ void ieee80211_set_wmm_default(struct ieee80211_sub_if_data *sdata,
         }
 }
 
-void ieee80211_sta_def_wmm_params(struct ieee80211_sub_if_data *sdata,
-                                  const size_t supp_rates_len,
-                                  const u8 *supp_rates)
-{
-        struct ieee80211_chanctx_conf *chanctx_conf;
-        int i, have_higher_than_11mbit = 0;
-
-        /* cf. IEEE 802.11 9.2.12 */
-        for (i = 0; i < supp_rates_len; i++)
-                if ((supp_rates[i] & 0x7f) * 5 > 110)
-                        have_higher_than_11mbit = 1;
-
-        rcu_read_lock();
-        chanctx_conf = rcu_dereference(sdata->vif.chanctx_conf);
-
-        if (chanctx_conf &&
-            chanctx_conf->def.chan->band == IEEE80211_BAND_2GHZ &&
-            have_higher_than_11mbit)
-                sdata->flags |= IEEE80211_SDATA_OPERATING_GMODE;
-        else
-                sdata->flags &= ~IEEE80211_SDATA_OPERATING_GMODE;
-        rcu_read_unlock();
-
-        ieee80211_set_wmm_default(sdata, true);
-}
-
-u32 ieee80211_mandatory_rates(struct ieee80211_local *local,
-                              enum ieee80211_band band)
-{
-        struct ieee80211_supported_band *sband;
-        struct ieee80211_rate *bitrates;
-        u32 mandatory_rates;
-        enum ieee80211_rate_flags mandatory_flag;
-        int i;
-
-        sband = local->hw.wiphy->bands[band];
-        if (WARN_ON(!sband))
-                return 1;
-
-        if (band == IEEE80211_BAND_2GHZ)
-                mandatory_flag = IEEE80211_RATE_MANDATORY_B;
-        else
-                mandatory_flag = IEEE80211_RATE_MANDATORY_A;
-
-        bitrates = sband->bitrates;
-        mandatory_rates = 0;
-        for (i = 0; i < sband->n_bitrates; i++)
-                if (bitrates[i].flags & mandatory_flag)
-                        mandatory_rates |= BIT(i);
-        return mandatory_rates;
-}
-
 void ieee80211_send_auth(struct ieee80211_sub_if_data *sdata,
                          u16 transaction, u16 auth_alg, u16 status,
                          const u8 *extra, size_t extra_len, const u8 *da,
@@ -1182,7 +1157,7 @@ void ieee80211_send_deauth_disassoc(struct ieee80211_sub_if_data *sdata,
 int ieee80211_build_preq_ies(struct ieee80211_local *local, u8 *buffer,
                              size_t buffer_len, const u8 *ie, size_t ie_len,
                              enum ieee80211_band band, u32 rate_mask,
-                             u8 channel)
+                             struct cfg80211_chan_def *chandef)
 {
         struct ieee80211_supported_band *sband;
         u8 *pos = buffer, *end = buffer + buffer_len;
@@ -1191,16 +1166,26 @@ int ieee80211_build_preq_ies(struct ieee80211_local *local, u8 *buffer,
         u8 rates[32];
         int num_rates;
         int ext_rates_len;
+        int shift;
+        u32 rate_flags;
 
         sband = local->hw.wiphy->bands[band];
         if (WARN_ON_ONCE(!sband))
                 return 0;
 
+        rate_flags = ieee80211_chandef_rate_flags(chandef);
+        shift = ieee80211_chandef_get_shift(chandef);
+
         num_rates = 0;
         for (i = 0; i < sband->n_bitrates; i++) {
                 if ((BIT(i) & rate_mask) == 0)
                         continue; /* skip rate */
-                rates[num_rates++] = (u8) (sband->bitrates[i].bitrate / 5);
+                if ((rate_flags & sband->bitrates[i].flags) != rate_flags)
+                        continue;
+
+                rates[num_rates++] =
+                        (u8) DIV_ROUND_UP(sband->bitrates[i].bitrate,
+                                          (1 << shift) * 5);
         }
 
         supp_rates_len = min_t(int, num_rates, 8);
@@ -1240,12 +1225,13 @@ int ieee80211_build_preq_ies(struct ieee80211_local *local, u8 *buffer,
                 pos += ext_rates_len;
         }
 
-        if (channel && sband->band == IEEE80211_BAND_2GHZ) {
+        if (chandef->chan && sband->band == IEEE80211_BAND_2GHZ) {
                 if (end - pos < 3)
                         goto out_err;
                 *pos++ = WLAN_EID_DS_PARAMS;
                 *pos++ = 1;
-                *pos++ = channel;
+                *pos++ = ieee80211_frequency_to_channel(
+                                chandef->chan->center_freq);
         }
 
         /* insert custom IEs that go before HT */
@@ -1310,9 +1296,9 @@ struct sk_buff *ieee80211_build_probe_req(struct ieee80211_sub_if_data *sdata,
                                           bool directed)
 {
         struct ieee80211_local *local = sdata->local;
+        struct cfg80211_chan_def chandef;
         struct sk_buff *skb;
         struct ieee80211_mgmt *mgmt;
-        u8 chan_no;
         int ies_len;
 
         /*
@@ -1320,10 +1306,11 @@ struct sk_buff *ieee80211_build_probe_req(struct ieee80211_sub_if_data *sdata,
          * in order to maximize the chance that we get a response.  Some
          * badly-behaved APs don't respond when this parameter is included.
          */
+        chandef.width = sdata->vif.bss_conf.chandef.width;
         if (directed)
-                chan_no = 0;
+                chandef.chan = NULL;
         else
-                chan_no = ieee80211_frequency_to_channel(chan->center_freq);
+                chandef.chan = chan;
 
         skb = ieee80211_probereq_get(&local->hw, &sdata->vif,
                                      ssid, ssid_len, 100 + ie_len);
@@ -1333,7 +1320,7 @@ struct sk_buff *ieee80211_build_probe_req(struct ieee80211_sub_if_data *sdata,
         ies_len = ieee80211_build_preq_ies(local, skb_tail_pointer(skb),
                                            skb_tailroom(skb),
                                            ie, ie_len, chan->band,
-                                           ratemask, chan_no);
+                                           ratemask, &chandef);
         skb_put(skb, ies_len);
 
         if (dst) {
@@ -1367,16 +1354,19 @@ void ieee80211_send_probe_req(struct ieee80211_sub_if_data *sdata, u8 *dst,
         }
 }
 
-u32 ieee80211_sta_get_rates(struct ieee80211_local *local,
+u32 ieee80211_sta_get_rates(struct ieee80211_sub_if_data *sdata,
                             struct ieee802_11_elems *elems,
                             enum ieee80211_band band, u32 *basic_rates)
 {
         struct ieee80211_supported_band *sband;
         struct ieee80211_rate *bitrates;
         size_t num_rates;
-        u32 supp_rates;
-        int i, j;
-        sband = local->hw.wiphy->bands[band];
+        u32 supp_rates, rate_flags;
+        int i, j, shift;
+        sband = sdata->local->hw.wiphy->bands[band];
+
+        rate_flags = ieee80211_chandef_rate_flags(&sdata->vif.bss_conf.chandef);
+        shift = ieee80211_vif_get_shift(&sdata->vif);
 
         if (WARN_ON(!sband))
                 return 1;
@@ -1401,7 +1391,15 @@ u32 ieee80211_sta_get_rates(struct ieee80211_local *local,
                         continue;
 
                 for (j = 0; j < num_rates; j++) {
-                        if (bitrates[j].bitrate == own_rate) {
+                        int brate;
+                        if ((rate_flags & sband->bitrates[j].flags)
+                            != rate_flags)
+                                continue;
+
+                        brate = DIV_ROUND_UP(sband->bitrates[j].bitrate,
+                                             1 << shift);
+
+                        if (brate == own_rate) {
                                 supp_rates |= BIT(j);
                                 if (basic_rates && is_basic)
                                         *basic_rates |= BIT(j);
@@ -1455,8 +1453,8 @@ int ieee80211_reconfig(struct ieee80211_local *local)
                 local->resuming = true;
 
         if (local->wowlan) {
-                local->wowlan = false;
                 res = drv_resume(local);
+                local->wowlan = false;
                 if (res < 0) {
                         local->resuming = false;
                         return res;
@@ -1604,12 +1602,13 @@ int ieee80211_reconfig(struct ieee80211_local *local)
                                    BSS_CHANGED_ARP_FILTER |
                                    BSS_CHANGED_PS;
 
-                        if (sdata->u.mgd.dtim_period)
-                                changed |= BSS_CHANGED_DTIM_PERIOD;
+                        /* Re-send beacon info report to the driver */
+                        if (sdata->u.mgd.have_beacon)
+                                changed |= BSS_CHANGED_BEACON_INFO;
 
-                        mutex_lock(&sdata->u.mgd.mtx);
+                        sdata_lock(sdata);
                         ieee80211_bss_info_change_notify(sdata, changed);
-                        mutex_unlock(&sdata->u.mgd.mtx);
+                        sdata_unlock(sdata);
                         break;
                 case NL80211_IFTYPE_ADHOC:
                         changed |= BSS_CHANGED_IBSS;
@@ -2023,18 +2022,56 @@ void ieee80211_ht_oper_to_chandef(struct ieee80211_channel *control_chan,
         cfg80211_chandef_create(chandef, control_chan, channel_type);
 }
 
+int ieee80211_parse_bitrates(struct cfg80211_chan_def *chandef,
+                             const struct ieee80211_supported_band *sband,
+                             const u8 *srates, int srates_len, u32 *rates)
+{
+        u32 rate_flags = ieee80211_chandef_rate_flags(chandef);
+        int shift = ieee80211_chandef_get_shift(chandef);
+        struct ieee80211_rate *br;
+        int brate, rate, i, j, count = 0;
+
+        *rates = 0;
+
+        for (i = 0; i < srates_len; i++) {
+                rate = srates[i] & 0x7f;
+
+                for (j = 0; j < sband->n_bitrates; j++) {
+                        br = &sband->bitrates[j];
+                        if ((rate_flags & br->flags) != rate_flags)
+                                continue;
+
+                        brate = DIV_ROUND_UP(br->bitrate, (1 << shift) * 5);
+                        if (brate == rate) {
+                                *rates |= BIT(j);
+                                count++;
+                                break;
+                        }
+                }
+        }
+        return count;
+}
+
 int ieee80211_add_srates_ie(struct ieee80211_sub_if_data *sdata,
                             struct sk_buff *skb, bool need_basic,
                             enum ieee80211_band band)
 {
         struct ieee80211_local *local = sdata->local;
         struct ieee80211_supported_band *sband;
-        int rate;
+        int rate, shift;
         u8 i, rates, *pos;
         u32 basic_rates = sdata->vif.bss_conf.basic_rates;
+        u32 rate_flags;
 
+        shift = ieee80211_vif_get_shift(&sdata->vif);
+        rate_flags = ieee80211_chandef_rate_flags(&sdata->vif.bss_conf.chandef);
         sband = local->hw.wiphy->bands[band];
-        rates = sband->n_bitrates;
+        rates = 0;
+        for (i = 0; i < sband->n_bitrates; i++) {
+                if ((rate_flags & sband->bitrates[i].flags) != rate_flags)
+                        continue;
+                rates++;
+        }
         if (rates > 8)
                 rates = 8;
 
@@ -2046,10 +2083,15 @@ int ieee80211_add_srates_ie(struct ieee80211_sub_if_data *sdata,
         *pos++ = rates;
         for (i = 0; i < rates; i++) {
                 u8 basic = 0;
+                if ((rate_flags & sband->bitrates[i].flags) != rate_flags)
+                        continue;
+
                 if (need_basic && basic_rates & BIT(i))
                         basic = 0x80;
                 rate = sband->bitrates[i].bitrate;
-                *pos++ = basic | (u8) (rate / 5);
+                rate = DIV_ROUND_UP(sband->bitrates[i].bitrate,
+                                    5 * (1 << shift));
+                *pos++ = basic | (u8) rate;
         }
 
         return 0;
@@ -2061,12 +2103,22 @@ int ieee80211_add_ext_srates_ie(struct ieee80211_sub_if_data *sdata,
 {
         struct ieee80211_local *local = sdata->local;
         struct ieee80211_supported_band *sband;
-        int rate;
+        int rate, skip, shift;
         u8 i, exrates, *pos;
         u32 basic_rates = sdata->vif.bss_conf.basic_rates;
+        u32 rate_flags;
+
+        rate_flags = ieee80211_chandef_rate_flags(&sdata->vif.bss_conf.chandef);
+        shift = ieee80211_vif_get_shift(&sdata->vif);
 
         sband = local->hw.wiphy->bands[band];
-        exrates = sband->n_bitrates;
+        exrates = 0;
+        for (i = 0; i < sband->n_bitrates; i++) {
+                if ((rate_flags & sband->bitrates[i].flags) != rate_flags)
+                        continue;
+                exrates++;
+        }
+
         if (exrates > 8)
                 exrates -= 8;
         else
@@ -2079,12 +2131,19 @@ int ieee80211_add_ext_srates_ie(struct ieee80211_sub_if_data *sdata,
                 pos = skb_put(skb, exrates + 2);
                 *pos++ = WLAN_EID_EXT_SUPP_RATES;
                 *pos++ = exrates;
+                skip = 0;
                 for (i = 8; i < sband->n_bitrates; i++) {
                         u8 basic = 0;
+                        if ((rate_flags & sband->bitrates[i].flags)
+                            != rate_flags)
+                                continue;
+                        if (skip++ < 8)
+                                continue;
                         if (need_basic && basic_rates & BIT(i))
                                 basic = 0x80;
-                        rate = sband->bitrates[i].bitrate;
-                        *pos++ = basic | (u8) (rate / 5);
+                        rate = DIV_ROUND_UP(sband->bitrates[i].bitrate,
+                                            5 * (1 << shift));
+                        *pos++ = basic | (u8) rate;
                 }
         }
         return 0;
@@ -2168,9 +2227,17 @@ u64 ieee80211_calculate_rx_timestamp(struct ieee80211_local *local,
                         ri.flags |= RATE_INFO_FLAGS_SHORT_GI;
         } else {
                 struct ieee80211_supported_band *sband;
+                int shift = 0;
+                int bitrate;
+
+                if (status->flag & RX_FLAG_10MHZ)
+                        shift = 1;
+                if (status->flag & RX_FLAG_5MHZ)
+                        shift = 2;
 
                 sband = local->hw.wiphy->bands[status->band];
-                ri.legacy = sband->bitrates[status->rate_idx].bitrate;
+                bitrate = sband->bitrates[status->rate_idx].bitrate;
+                ri.legacy = DIV_ROUND_UP(bitrate, (1 << shift));
         }
 
         rate = cfg80211_calculate_bitrate(&ri);
diff --git a/net/mac80211/vht.c b/net/mac80211/vht.c
index 171344d4eb7c..97c289414e32 100644
--- a/net/mac80211/vht.c
+++ b/net/mac80211/vht.c
@@ -396,7 +396,7 @@ void ieee80211_vht_handle_opmode(struct ieee80211_sub_if_data *sdata,
         new_bw = ieee80211_sta_cur_vht_bw(sta);
         if (new_bw != sta->sta.bandwidth) {
                 sta->sta.bandwidth = new_bw;
-                changed |= IEEE80211_RC_NSS_CHANGED;
+                changed |= IEEE80211_RC_BW_CHANGED;
         }
 
  change:
diff --git a/net/mac80211/wep.c b/net/mac80211/wep.c
index c04d401dae92..6ee2b5863572 100644
--- a/net/mac80211/wep.c
+++ b/net/mac80211/wep.c
@@ -28,7 +28,7 @@
 int ieee80211_wep_init(struct ieee80211_local *local)
 {
         /* start WEP IV from a random value */
-        get_random_bytes(&local->wep_iv, WEP_IV_LEN);
+        get_random_bytes(&local->wep_iv, IEEE80211_WEP_IV_LEN);
 
         local->wep_tx_tfm = crypto_alloc_cipher("arc4", 0, CRYPTO_ALG_ASYNC);
         if (IS_ERR(local->wep_tx_tfm)) {
@@ -98,20 +98,21 @@ static u8 *ieee80211_wep_add_iv(struct ieee80211_local *local,
 
         hdr->frame_control |= cpu_to_le16(IEEE80211_FCTL_PROTECTED);
 
-        if (WARN_ON(skb_tailroom(skb) < WEP_ICV_LEN ||
-                    skb_headroom(skb) < WEP_IV_LEN))
+        if (WARN_ON(skb_tailroom(skb) < IEEE80211_WEP_ICV_LEN ||
+                    skb_headroom(skb) < IEEE80211_WEP_IV_LEN))
                 return NULL;
 
         hdrlen = ieee80211_hdrlen(hdr->frame_control);
-        newhdr = skb_push(skb, WEP_IV_LEN);
-        memmove(newhdr, newhdr + WEP_IV_LEN, hdrlen);
+        newhdr = skb_push(skb, IEEE80211_WEP_IV_LEN);
+        memmove(newhdr, newhdr + IEEE80211_WEP_IV_LEN, hdrlen);
 
         /* the HW only needs room for the IV, but not the actual IV */
         if (info->control.hw_key &&
             (info->control.hw_key->flags & IEEE80211_KEY_FLAG_PUT_IV_SPACE))
                 return newhdr + hdrlen;
 
-        skb_set_network_header(skb, skb_network_offset(skb) + WEP_IV_LEN);
+        skb_set_network_header(skb, skb_network_offset(skb) +
+                                    IEEE80211_WEP_IV_LEN);
         ieee80211_wep_get_iv(local, keylen, keyidx, newhdr + hdrlen);
         return newhdr + hdrlen;
 }
@@ -125,8 +126,8 @@ static void ieee80211_wep_remove_iv(struct ieee80211_local *local,
         unsigned int hdrlen;
 
         hdrlen = ieee80211_hdrlen(hdr->frame_control);
-        memmove(skb->data + WEP_IV_LEN, skb->data, hdrlen);
-        skb_pull(skb, WEP_IV_LEN);
+        memmove(skb->data + IEEE80211_WEP_IV_LEN, skb->data, hdrlen);
+        skb_pull(skb, IEEE80211_WEP_IV_LEN);
 }
 
 
@@ -146,7 +147,7 @@ int ieee80211_wep_encrypt_data(struct crypto_cipher *tfm, u8 *rc4key,
         put_unaligned(icv, (__le32 *)(data + data_len));
 
         crypto_cipher_setkey(tfm, rc4key, klen);
-        for (i = 0; i < data_len + WEP_ICV_LEN; i++)
+        for (i = 0; i < data_len + IEEE80211_WEP_ICV_LEN; i++)
                 crypto_cipher_encrypt_one(tfm, data + i, data + i);
 
         return 0;
@@ -172,7 +173,7 @@ int ieee80211_wep_encrypt(struct ieee80211_local *local,
         if (!iv)
                 return -1;
 
-        len = skb->len - (iv + WEP_IV_LEN - skb->data);
+        len = skb->len - (iv + IEEE80211_WEP_IV_LEN - skb->data);
 
         /* Prepend 24-bit IV to RC4 key */
         memcpy(rc4key, iv, 3);
@@ -181,10 +182,10 @@ int ieee80211_wep_encrypt(struct ieee80211_local *local,
         memcpy(rc4key + 3, key, keylen);
 
         /* Add room for ICV */
-        skb_put(skb, WEP_ICV_LEN);
+        skb_put(skb, IEEE80211_WEP_ICV_LEN);
 
         return ieee80211_wep_encrypt_data(local->wep_tx_tfm, rc4key, keylen + 3,
-                                          iv + WEP_IV_LEN, len);
+                                          iv + IEEE80211_WEP_IV_LEN, len);
 }
 
 
@@ -201,11 +202,11 @@ int ieee80211_wep_decrypt_data(struct crypto_cipher *tfm, u8 *rc4key,
                 return -1;
 
         crypto_cipher_setkey(tfm, rc4key, klen);
-        for (i = 0; i < data_len + WEP_ICV_LEN; i++)
+        for (i = 0; i < data_len + IEEE80211_WEP_ICV_LEN; i++)
                 crypto_cipher_decrypt_one(tfm, data + i, data + i);
 
         crc = cpu_to_le32(~crc32_le(~0, data, data_len));
-        if (memcmp(&crc, data + data_len, WEP_ICV_LEN) != 0)
+        if (memcmp(&crc, data + data_len, IEEE80211_WEP_ICV_LEN) != 0)
                 /* ICV mismatch */
                 return -1;
 
@@ -237,10 +238,10 @@ static int ieee80211_wep_decrypt(struct ieee80211_local *local,
                 return -1;
 
         hdrlen = ieee80211_hdrlen(hdr->frame_control);
-        if (skb->len < hdrlen + WEP_IV_LEN + WEP_ICV_LEN)
+        if (skb->len < hdrlen + IEEE80211_WEP_IV_LEN + IEEE80211_WEP_ICV_LEN)
                 return -1;
 
-        len = skb->len - hdrlen - WEP_IV_LEN - WEP_ICV_LEN;
+        len = skb->len - hdrlen - IEEE80211_WEP_IV_LEN - IEEE80211_WEP_ICV_LEN;
 
         keyidx = skb->data[hdrlen + 3] >> 6;
 
@@ -256,16 +257,16 @@ static int ieee80211_wep_decrypt(struct ieee80211_local *local,
         memcpy(rc4key + 3, key->conf.key, key->conf.keylen);
 
         if (ieee80211_wep_decrypt_data(local->wep_rx_tfm, rc4key, klen,
-                                       skb->data + hdrlen + WEP_IV_LEN,
-                                       len))
+                                       skb->data + hdrlen +
+                                       IEEE80211_WEP_IV_LEN, len))
                 ret = -1;
 
         /* Trim ICV */
-        skb_trim(skb, skb->len - WEP_ICV_LEN);
+        skb_trim(skb, skb->len - IEEE80211_WEP_ICV_LEN);
 
         /* Remove IV */
-        memmove(skb->data + WEP_IV_LEN, skb->data, hdrlen);
-        skb_pull(skb, WEP_IV_LEN);
+        memmove(skb->data + IEEE80211_WEP_IV_LEN, skb->data, hdrlen);
+        skb_pull(skb, IEEE80211_WEP_IV_LEN);
 
         return ret;
 }
@@ -305,13 +306,14 @@ ieee80211_crypto_wep_decrypt(struct ieee80211_rx_data *rx)
                 if (ieee80211_wep_decrypt(rx->local, rx->skb, rx->key))
                         return RX_DROP_UNUSABLE;
         } else if (!(status->flag & RX_FLAG_IV_STRIPPED)) {
-                if (!pskb_may_pull(rx->skb, ieee80211_hdrlen(fc) + WEP_IV_LEN))
+                if (!pskb_may_pull(rx->skb, ieee80211_hdrlen(fc) +
+                                            IEEE80211_WEP_IV_LEN))
                         return RX_DROP_UNUSABLE;
                 if (rx->sta && ieee80211_wep_is_weak_iv(rx->skb, rx->key))
                         rx->sta->wep_weak_iv_count++;
                 ieee80211_wep_remove_iv(rx->local, rx->skb, rx->key);
                 /* remove ICV */
-                if (pskb_trim(rx->skb, rx->skb->len - WEP_ICV_LEN))
+                if (pskb_trim(rx->skb, rx->skb->len - IEEE80211_WEP_ICV_LEN))
                         return RX_DROP_UNUSABLE;
         }
 
diff --git a/net/mac80211/wpa.c b/net/mac80211/wpa.c
index c7c6d644486f..c9edfcb7a13b 100644
--- a/net/mac80211/wpa.c
+++ b/net/mac80211/wpa.c
@@ -62,10 +62,10 @@ ieee80211_tx_h_michael_mic_add(struct ieee80211_tx_data *tx)
 
         tail = MICHAEL_MIC_LEN;
         if (!info->control.hw_key)
-                tail += TKIP_ICV_LEN;
+                tail += IEEE80211_TKIP_ICV_LEN;
 
         if (WARN_ON(skb_tailroom(skb) < tail ||
-                    skb_headroom(skb) < TKIP_IV_LEN))
+                    skb_headroom(skb) < IEEE80211_TKIP_IV_LEN))
                 return TX_DROP;
 
         key = &tx->key->conf.key[NL80211_TKIP_DATA_OFFSET_TX_MIC_KEY];
@@ -198,15 +198,16 @@ static int tkip_encrypt_skb(struct ieee80211_tx_data *tx, struct sk_buff *skb)
         if (info->control.hw_key)
                 tail = 0;
         else
-                tail = TKIP_ICV_LEN;
+                tail = IEEE80211_TKIP_ICV_LEN;
 
         if (WARN_ON(skb_tailroom(skb) < tail ||
-                    skb_headroom(skb) < TKIP_IV_LEN))
+                    skb_headroom(skb) < IEEE80211_TKIP_IV_LEN))
                 return -1;
 
-        pos = skb_push(skb, TKIP_IV_LEN);
-        memmove(pos, pos + TKIP_IV_LEN, hdrlen);
-        skb_set_network_header(skb, skb_network_offset(skb) + TKIP_IV_LEN);
+        pos = skb_push(skb, IEEE80211_TKIP_IV_LEN);
+        memmove(pos, pos + IEEE80211_TKIP_IV_LEN, hdrlen);
+        skb_set_network_header(skb, skb_network_offset(skb) +
+                                    IEEE80211_TKIP_IV_LEN);
         pos += hdrlen;
 
         /* the HW only needs room for the IV, but not the actual IV */
@@ -227,7 +228,7 @@ static int tkip_encrypt_skb(struct ieee80211_tx_data *tx, struct sk_buff *skb)
                 return 0;
 
         /* Add room for ICV */
-        skb_put(skb, TKIP_ICV_LEN);
+        skb_put(skb, IEEE80211_TKIP_ICV_LEN);
 
         return ieee80211_tkip_encrypt_data(tx->local->wep_tx_tfm,
                                            key, skb, pos, len);
@@ -290,11 +291,11 @@ ieee80211_crypto_tkip_decrypt(struct ieee80211_rx_data *rx)
                 return RX_DROP_UNUSABLE;
 
         /* Trim ICV */
-        skb_trim(skb, skb->len - TKIP_ICV_LEN);
+        skb_trim(skb, skb->len - IEEE80211_TKIP_ICV_LEN);
 
         /* Remove IV */
-        memmove(skb->data + TKIP_IV_LEN, skb->data, hdrlen);
-        skb_pull(skb, TKIP_IV_LEN);
+        memmove(skb->data + IEEE80211_TKIP_IV_LEN, skb->data, hdrlen);
+        skb_pull(skb, IEEE80211_TKIP_IV_LEN);
 
         return RX_CONTINUE;
 }
@@ -337,9 +338,9 @@ static void ccmp_special_blocks(struct sk_buff *skb, u8 *pn, u8 *scratch,
         else
                 qos_tid = 0;
 
-        data_len = skb->len - hdrlen - CCMP_HDR_LEN;
+        data_len = skb->len - hdrlen - IEEE80211_CCMP_HDR_LEN;
         if (encrypted)
-                data_len -= CCMP_MIC_LEN;
+                data_len -= IEEE80211_CCMP_MIC_LEN;
 
         /* First block, b_0 */
         b_0[0] = 0x59; /* flags: Adata: 1, M: 011, L: 001 */
@@ -348,7 +349,7 @@ static void ccmp_special_blocks(struct sk_buff *skb, u8 *pn, u8 *scratch,
          */
         b_0[1] = qos_tid | (mgmt << 4);
         memcpy(&b_0[2], hdr->addr2, ETH_ALEN);
-        memcpy(&b_0[8], pn, CCMP_PN_LEN);
+        memcpy(&b_0[8], pn, IEEE80211_CCMP_PN_LEN);
         /* l(m) */
         put_unaligned_be16(data_len, &b_0[14]);
 
@@ -424,15 +425,16 @@ static int ccmp_encrypt_skb(struct ieee80211_tx_data *tx, struct sk_buff *skb)
         if (info->control.hw_key)
                 tail = 0;
         else
-                tail = CCMP_MIC_LEN;
+                tail = IEEE80211_CCMP_MIC_LEN;
 
         if (WARN_ON(skb_tailroom(skb) < tail ||
-                    skb_headroom(skb) < CCMP_HDR_LEN))
+                    skb_headroom(skb) < IEEE80211_CCMP_HDR_LEN))
                 return -1;
 
-        pos = skb_push(skb, CCMP_HDR_LEN);
-        memmove(pos, pos + CCMP_HDR_LEN, hdrlen);
-        skb_set_network_header(skb, skb_network_offset(skb) + CCMP_HDR_LEN);
+        pos = skb_push(skb, IEEE80211_CCMP_HDR_LEN);
+        memmove(pos, pos + IEEE80211_CCMP_HDR_LEN, hdrlen);
+        skb_set_network_header(skb, skb_network_offset(skb) +
+                                    IEEE80211_CCMP_HDR_LEN);
 
         /* the HW only needs room for the IV, but not the actual IV */
         if (info->control.hw_key &&
@@ -457,10 +459,10 @@ static int ccmp_encrypt_skb(struct ieee80211_tx_data *tx, struct sk_buff *skb)
         if (info->control.hw_key)
                 return 0;
 
-        pos += CCMP_HDR_LEN;
+        pos += IEEE80211_CCMP_HDR_LEN;
         ccmp_special_blocks(skb, pn, scratch, 0);
         ieee80211_aes_ccm_encrypt(key->u.ccmp.tfm, scratch, pos, len,
-                                  pos, skb_put(skb, CCMP_MIC_LEN));
+                                  pos, skb_put(skb, IEEE80211_CCMP_MIC_LEN));
 
         return 0;
 }
@@ -490,7 +492,7 @@ ieee80211_crypto_ccmp_decrypt(struct ieee80211_rx_data *rx)
         struct ieee80211_key *key = rx->key;
         struct sk_buff *skb = rx->skb;
         struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
-        u8 pn[CCMP_PN_LEN];
+        u8 pn[IEEE80211_CCMP_PN_LEN];
         int data_len;
         int queue;
 
@@ -500,12 +502,13 @@ ieee80211_crypto_ccmp_decrypt(struct ieee80211_rx_data *rx)
             !ieee80211_is_robust_mgmt_frame(hdr))
                 return RX_CONTINUE;
 
-        data_len = skb->len - hdrlen - CCMP_HDR_LEN - CCMP_MIC_LEN;
+        data_len = skb->len - hdrlen - IEEE80211_CCMP_HDR_LEN -
+                   IEEE80211_CCMP_MIC_LEN;
         if (!rx->sta || data_len < 0)
                 return RX_DROP_UNUSABLE;
 
         if (status->flag & RX_FLAG_DECRYPTED) {
-                if (!pskb_may_pull(rx->skb, hdrlen + CCMP_HDR_LEN))
+                if (!pskb_may_pull(rx->skb, hdrlen + IEEE80211_CCMP_HDR_LEN))
                         return RX_DROP_UNUSABLE;
         } else {
                 if (skb_linearize(rx->skb))
@@ -516,7 +519,7 @@ ieee80211_crypto_ccmp_decrypt(struct ieee80211_rx_data *rx)
 
         queue = rx->security_idx;
 
-        if (memcmp(pn, key->u.ccmp.rx_pn[queue], CCMP_PN_LEN) <= 0) {
+        if (memcmp(pn, key->u.ccmp.rx_pn[queue], IEEE80211_CCMP_PN_LEN) <= 0) {
                 key->u.ccmp.replays++;
                 return RX_DROP_UNUSABLE;
         }
@@ -528,19 +531,20 @@ ieee80211_crypto_ccmp_decrypt(struct ieee80211_rx_data *rx)
 
                 if (ieee80211_aes_ccm_decrypt(
                             key->u.ccmp.tfm, scratch,
-                            skb->data + hdrlen + CCMP_HDR_LEN, data_len,
-                            skb->data + skb->len - CCMP_MIC_LEN,
-                            skb->data + hdrlen + CCMP_HDR_LEN))
+                            skb->data + hdrlen + IEEE80211_CCMP_HDR_LEN,
+                            data_len,
+                            skb->data + skb->len - IEEE80211_CCMP_MIC_LEN,
+                            skb->data + hdrlen + IEEE80211_CCMP_HDR_LEN))
                         return RX_DROP_UNUSABLE;
         }
 
-        memcpy(key->u.ccmp.rx_pn[queue], pn, CCMP_PN_LEN);
+        memcpy(key->u.ccmp.rx_pn[queue], pn, IEEE80211_CCMP_PN_LEN);
 
         /* Remove CCMP header and MIC */
-        if (pskb_trim(skb, skb->len - CCMP_MIC_LEN))
+        if (pskb_trim(skb, skb->len - IEEE80211_CCMP_MIC_LEN))
                 return RX_DROP_UNUSABLE;
-        memmove(skb->data + CCMP_HDR_LEN, skb->data, hdrlen);
-        skb_pull(skb, CCMP_HDR_LEN);
+        memmove(skb->data + IEEE80211_CCMP_HDR_LEN, skb->data, hdrlen);
+        skb_pull(skb, IEEE80211_CCMP_HDR_LEN);
 
         return RX_CONTINUE;
 }
diff --git a/net/mpls/Kconfig b/net/mpls/Kconfig
new file mode 100644
index 000000000000..37421db88965
--- /dev/null
+++ b/net/mpls/Kconfig
@@ -0,0 +1,9 @@
+#
+# MPLS configuration
+#
+config NET_MPLS_GSO
+        tristate "MPLS: GSO support"
+        help
+         This is helper module to allow segmentation of non-MPLS GSO packets
+         that have had MPLS stack entries pushed onto them and thus
+         become MPLS GSO packets.
diff --git a/net/mpls/Makefile b/net/mpls/Makefile
new file mode 100644
index 000000000000..0a3c171be537
--- /dev/null
+++ b/net/mpls/Makefile
@@ -0,0 +1,4 @@
+#
+# Makefile for MPLS.
+#
+obj-y += mpls_gso.o
diff --git a/net/mpls/mpls_gso.c b/net/mpls/mpls_gso.c
new file mode 100644
index 000000000000..1bec1219ab81
--- /dev/null
+++ b/net/mpls/mpls_gso.c
@@ -0,0 +1,108 @@
+/*
+ *      MPLS GSO Support
+ *
+ *      Authors: Simon Horman (horms@verge.net.au)
+ *
+ *      This program is free software; you can redistribute it and/or
+ *      modify it under the terms of the GNU General Public License
+ *      as published by the Free Software Foundation; either version
+ *      2 of the License, or (at your option) any later version.
+ *
+ *      Based on: GSO portions of net/ipv4/gre.c
+ */
+
+#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
+
+#include <linux/err.h>
+#include <linux/module.h>
+#include <linux/netdev_features.h>
+#include <linux/netdevice.h>
+#include <linux/skbuff.h>
+
+static struct sk_buff *mpls_gso_segment(struct sk_buff *skb,
+                                       netdev_features_t features)
+{
+        struct sk_buff *segs = ERR_PTR(-EINVAL);
+        netdev_features_t mpls_features;
+        __be16 mpls_protocol;
+
+        if (unlikely(skb_shinfo(skb)->gso_type &
+                                ~(SKB_GSO_TCPV4 |
+                                  SKB_GSO_TCPV6 |
+                                  SKB_GSO_UDP |
+                                  SKB_GSO_DODGY |
+                                  SKB_GSO_TCP_ECN |
+                                  SKB_GSO_GRE |
+                                  SKB_GSO_MPLS)))
+                goto out;
+
+        /* Setup inner SKB. */
+        mpls_protocol = skb->protocol;
+        skb->protocol = skb->inner_protocol;
+
+        /* Push back the mac header that skb_mac_gso_segment() has pulled.
+         * It will be re-pulled by the call to skb_mac_gso_segment() below
+         */
+        __skb_push(skb, skb->mac_len);
+
+        /* Segment inner packet. */
+        mpls_features = skb->dev->mpls_features & netif_skb_features(skb);
+        segs = skb_mac_gso_segment(skb, mpls_features);
+
+
+        /* Restore outer protocol. */
+        skb->protocol = mpls_protocol;
+
+        /* Re-pull the mac header that the call to skb_mac_gso_segment()
+         * above pulled.  It will be re-pushed after returning
+         * skb_mac_gso_segment(), an indirect caller of this function.
+         */
+        __skb_push(skb, skb->data - skb_mac_header(skb));
+
+out:
+        return segs;
+}
+
+static int mpls_gso_send_check(struct sk_buff *skb)
+{
+        return 0;
+}
+
+static struct packet_offload mpls_mc_offload = {
+        .type = cpu_to_be16(ETH_P_MPLS_MC),
+        .callbacks = {
+                .gso_send_check =       mpls_gso_send_check,
+                .gso_segment    =       mpls_gso_segment,
+        },
+};
+
+static struct packet_offload mpls_uc_offload = {
+        .type = cpu_to_be16(ETH_P_MPLS_UC),
+        .callbacks = {
+                .gso_send_check =       mpls_gso_send_check,
+                .gso_segment    =       mpls_gso_segment,
+        },
+};
+
+static int __init mpls_gso_init(void)
+{
+        pr_info("MPLS GSO support\n");
+
+        dev_add_offload(&mpls_uc_offload);
+        dev_add_offload(&mpls_mc_offload);
+
+        return 0;
+}
+
+static void __exit mpls_gso_exit(void)
+{
+        dev_remove_offload(&mpls_uc_offload);
+        dev_remove_offload(&mpls_mc_offload);
+}
+
+module_init(mpls_gso_init);
+module_exit(mpls_gso_exit);
+
+MODULE_DESCRIPTION("MPLS GSO support");
+MODULE_AUTHOR("Simon Horman (horms@verge.net.au)");
+MODULE_LICENSE("GPL");
diff --git a/net/netfilter/Kconfig b/net/netfilter/Kconfig
index 56d22cae5906..6e839b6dff2b 100644
--- a/net/netfilter/Kconfig
+++ b/net/netfilter/Kconfig
@@ -408,21 +408,10 @@ config NF_NAT_TFTP
         depends on NF_CONNTRACK && NF_NAT
         default NF_NAT && NF_CONNTRACK_TFTP
 
-endif # NF_CONNTRACK
-
-# transparent proxy support
-config NETFILTER_TPROXY
-        tristate "Transparent proxying support"
-        depends on IP_NF_MANGLE
-        depends on NETFILTER_ADVANCED
-        help
-          This option enables transparent proxying support, that is,
-          support for handling non-locally bound IPv4 TCP and UDP sockets.
-          For it to work you will have to configure certain iptables rules
-          and use policy routing. For more information on how to set it up
-          see Documentation/networking/tproxy.txt.
+config NETFILTER_SYNPROXY
+        tristate
 
-          To compile it as a module, choose M here.  If unsure, say N.
+endif # NF_CONNTRACK
 
 config NETFILTER_XTABLES
         tristate "Netfilter Xtables support (required for ip_tables)"
@@ -720,10 +709,10 @@ config NETFILTER_XT_TARGET_TEE
         this clone be rerouted to another nexthop.
 
 config NETFILTER_XT_TARGET_TPROXY
-        tristate '"TPROXY" target support'
-        depends on NETFILTER_TPROXY
+        tristate '"TPROXY" target transparent proxying support'
         depends on NETFILTER_XTABLES
         depends on NETFILTER_ADVANCED
+        depends on IP_NF_MANGLE
         select NF_DEFRAG_IPV4
         select NF_DEFRAG_IPV6 if IP6_NF_IPTABLES
         help
@@ -731,6 +720,9 @@ config NETFILTER_XT_TARGET_TPROXY
           REDIRECT.  It can only be used in the mangle table and is useful
           to redirect traffic to a transparent proxy.  It does _not_ depend
           on Netfilter connection tracking and NAT, unlike REDIRECT.
+          For it to work you will have to configure certain iptables rules
+          and use policy routing. For more information on how to set it up
+          see Documentation/networking/tproxy.txt.
 
           To compile it as a module, choose M here.  If unsure, say N.
 
@@ -1180,10 +1172,10 @@ config NETFILTER_XT_MATCH_SCTP
 
 config NETFILTER_XT_MATCH_SOCKET
         tristate '"socket" match support'
-        depends on NETFILTER_TPROXY
         depends on NETFILTER_XTABLES
         depends on NETFILTER_ADVANCED
         depends on !NF_CONNTRACK || NF_CONNTRACK
+        depends on (IPV6 || IPV6=n)
         select NF_DEFRAG_IPV4
         select NF_DEFRAG_IPV6 if IP6_NF_IPTABLES
         help
diff --git a/net/netfilter/Makefile b/net/netfilter/Makefile
index a1abf87d43bf..c3a0a12907f6 100644
--- a/net/netfilter/Makefile
+++ b/net/netfilter/Makefile
@@ -1,6 +1,6 @@
 netfilter-objs := core.o nf_log.o nf_queue.o nf_sockopt.o
 
-nf_conntrack-y  := nf_conntrack_core.o nf_conntrack_standalone.o nf_conntrack_expect.o nf_conntrack_helper.o nf_conntrack_proto.o nf_conntrack_l3proto_generic.o nf_conntrack_proto_generic.o nf_conntrack_proto_tcp.o nf_conntrack_proto_udp.o nf_conntrack_extend.o nf_conntrack_acct.o
+nf_conntrack-y  := nf_conntrack_core.o nf_conntrack_standalone.o nf_conntrack_expect.o nf_conntrack_helper.o nf_conntrack_proto.o nf_conntrack_l3proto_generic.o nf_conntrack_proto_generic.o nf_conntrack_proto_tcp.o nf_conntrack_proto_udp.o nf_conntrack_extend.o nf_conntrack_acct.o nf_conntrack_seqadj.o
 nf_conntrack-$(CONFIG_NF_CONNTRACK_TIMEOUT) += nf_conntrack_timeout.o
 nf_conntrack-$(CONFIG_NF_CONNTRACK_TIMESTAMP) += nf_conntrack_timestamp.o
 nf_conntrack-$(CONFIG_NF_CONNTRACK_EVENTS) += nf_conntrack_ecache.o
@@ -61,8 +61,8 @@ obj-$(CONFIG_NF_NAT_IRC) += nf_nat_irc.o
 obj-$(CONFIG_NF_NAT_SIP) += nf_nat_sip.o
 obj-$(CONFIG_NF_NAT_TFTP) += nf_nat_tftp.o
 
-# transparent proxy support
-obj-$(CONFIG_NETFILTER_TPROXY) += nf_tproxy_core.o
+# SYNPROXY
+obj-$(CONFIG_NETFILTER_SYNPROXY) += nf_synproxy_core.o
 
 # generic X tables 
 obj-$(CONFIG_NETFILTER_XTABLES) += x_tables.o xt_tcpudp.o
diff --git a/net/netfilter/core.c b/net/netfilter/core.c
index 857ca9f35177..593b16ea45e0 100644
--- a/net/netfilter/core.c
+++ b/net/netfilter/core.c
@@ -234,12 +234,13 @@ EXPORT_SYMBOL(skb_make_writable);
 /* This does not belong here, but locally generated errors need it if connection
    tracking in use: without this, connection may not be in hash table, and hence
    manufactured ICMP or RST packets will not be associated with it. */
-void (*ip_ct_attach)(struct sk_buff *, struct sk_buff *) __rcu __read_mostly;
+void (*ip_ct_attach)(struct sk_buff *, const struct sk_buff *)
+                __rcu __read_mostly;
 EXPORT_SYMBOL(ip_ct_attach);
 
-void nf_ct_attach(struct sk_buff *new, struct sk_buff *skb)
+void nf_ct_attach(struct sk_buff *new, const struct sk_buff *skb)
 {
-        void (*attach)(struct sk_buff *, struct sk_buff *);
+        void (*attach)(struct sk_buff *, const struct sk_buff *);
 
         if (skb->nfct) {
                 rcu_read_lock();
@@ -304,17 +305,26 @@ static struct pernet_operations netfilter_net_ops = {
         .exit = netfilter_net_exit,
 };
 
-void __init netfilter_init(void)
+int __init netfilter_init(void)
 {
-        int i, h;
+        int i, h, ret;
+
         for (i = 0; i < ARRAY_SIZE(nf_hooks); i++) {
                 for (h = 0; h < NF_MAX_HOOKS; h++)
                         INIT_LIST_HEAD(&nf_hooks[i][h]);
         }
 
-        if (register_pernet_subsys(&netfilter_net_ops) < 0)
-                panic("cannot create netfilter proc entry");
+        ret = register_pernet_subsys(&netfilter_net_ops);
+        if (ret < 0)
+                goto err;
+
+        ret = netfilter_log_init();
+        if (ret < 0)
+                goto err_pernet;
 
-        if (netfilter_log_init() < 0)
-                panic("cannot initialize nf_log");
+        return 0;
+err_pernet:
+        unregister_pernet_subsys(&netfilter_net_ops);
+err:
+        return ret;
 }
diff --git a/net/netfilter/ipset/ip_set_core.c b/net/netfilter/ipset/ip_set_core.c
index f77139007983..f2e30fb31e78 100644
--- a/net/netfilter/ipset/ip_set_core.c
+++ b/net/netfilter/ipset/ip_set_core.c
@@ -1052,7 +1052,7 @@ ip_set_swap(struct sock *ctnl, struct sk_buff *skb,
          * Not an artificial restriction anymore, as we must prevent
          * possible loops created by swapping in setlist type of sets. */
         if (!(from->type->features == to->type->features &&
-              from->type->family == to->type->family))
+              from->family == to->family))
                 return -IPSET_ERR_TYPE_MISMATCH;
 
         strncpy(from_name, from->name, IPSET_MAXNAMELEN);
@@ -1489,8 +1489,7 @@ ip_set_utest(struct sock *ctnl, struct sk_buff *skb,
         if (ret == -EAGAIN)
                 ret = 1;
 
-        return (ret < 0 && ret != -ENOTEMPTY) ? ret :
-                ret > 0 ? 0 : -IPSET_ERR_EXIST;
+        return ret > 0 ? 0 : -IPSET_ERR_EXIST;
 }
 
 /* Get headed data of a set */
diff --git a/net/netfilter/ipset/ip_set_getport.c b/net/netfilter/ipset/ip_set_getport.c
index 6fdf88ae2353..dac156f819ac 100644
--- a/net/netfilter/ipset/ip_set_getport.c
+++ b/net/netfilter/ipset/ip_set_getport.c
@@ -116,12 +116,12 @@ ip_set_get_ip6_port(const struct sk_buff *skb, bool src,
 {
         int protoff;
         u8 nexthdr;
-        __be16 frag_off;
+        __be16 frag_off = 0;
 
         nexthdr = ipv6_hdr(skb)->nexthdr;
         protoff = ipv6_skip_exthdr(skb, sizeof(struct ipv6hdr), &nexthdr,
                                    &frag_off);
-        if (protoff < 0)
+        if (protoff < 0 || (frag_off & htons(~0x7)) != 0)
                 return false;
 
         return get_port(skb, nexthdr, protoff, src, port, proto);
diff --git a/net/netfilter/ipset/ip_set_hash_gen.h b/net/netfilter/ipset/ip_set_hash_gen.h
index 57beb1762b2d..707bc520d629 100644
--- a/net/netfilter/ipset/ip_set_hash_gen.h
+++ b/net/netfilter/ipset/ip_set_hash_gen.h
@@ -325,18 +325,22 @@ mtype_add_cidr(struct htype *h, u8 cidr, u8 nets_length)
 static void
 mtype_del_cidr(struct htype *h, u8 cidr, u8 nets_length)
 {
-        u8 i, j;
-
-        for (i = 0; i < nets_length - 1 && h->nets[i].cidr != cidr; i++)
-                ;
-        h->nets[i].nets--;
-
-        if (h->nets[i].nets != 0)
-                return;
-
-        for (j = i; j < nets_length - 1 && h->nets[j].nets; j++) {
-                h->nets[j].cidr = h->nets[j + 1].cidr;
-                h->nets[j].nets = h->nets[j + 1].nets;
+        u8 i, j, net_end = nets_length - 1;
+
+        for (i = 0; i < nets_length; i++) {
+                if (h->nets[i].cidr != cidr)
+                        continue;
+                if (h->nets[i].nets > 1 || i == net_end ||
+                    h->nets[i + 1].nets == 0) {
+                        h->nets[i].nets--;
+                        return;
+                }
+                for (j = i; j < net_end && h->nets[j].nets; j++) {
+                        h->nets[j].cidr = h->nets[j + 1].cidr;
+                        h->nets[j].nets = h->nets[j + 1].nets;
+                }
+                h->nets[j].nets = 0;
+                return;
         }
 }
 #endif
diff --git a/net/netfilter/ipset/ip_set_hash_ipportnet.c b/net/netfilter/ipset/ip_set_hash_ipportnet.c
index c6a525373be4..f15f3e28b9c3 100644
--- a/net/netfilter/ipset/ip_set_hash_ipportnet.c
+++ b/net/netfilter/ipset/ip_set_hash_ipportnet.c
@@ -260,7 +260,7 @@ hash_ipportnet4_uadt(struct ip_set *set, struct nlattr *tb[],
                 e.ip = htonl(ip);
                 e.ip2 = htonl(ip2_from & ip_set_hostmask(e.cidr + 1));
                 ret = adtfn(set, &e, &ext, &ext, flags);
-                return ip_set_enomatch(ret, flags, adt) ? 1 :
+                return ip_set_enomatch(ret, flags, adt, set) ? -ret :
                        ip_set_eexist(ret, flags) ? 0 : ret;
         }
 
@@ -544,7 +544,7 @@ hash_ipportnet6_uadt(struct ip_set *set, struct nlattr *tb[],
 
         if (adt == IPSET_TEST || !with_ports || !tb[IPSET_ATTR_PORT_TO]) {
                 ret = adtfn(set, &e, &ext, &ext, flags);
-                return ip_set_enomatch(ret, flags, adt) ? 1 :
+                return ip_set_enomatch(ret, flags, adt, set) ? -ret :
                        ip_set_eexist(ret, flags) ? 0 : ret;
         }
 
diff --git a/net/netfilter/ipset/ip_set_hash_net.c b/net/netfilter/ipset/ip_set_hash_net.c
index da740ceb56ae..223e9f546d0f 100644
--- a/net/netfilter/ipset/ip_set_hash_net.c
+++ b/net/netfilter/ipset/ip_set_hash_net.c
@@ -199,7 +199,7 @@ hash_net4_uadt(struct ip_set *set, struct nlattr *tb[],
         if (adt == IPSET_TEST || !tb[IPSET_ATTR_IP_TO]) {
                 e.ip = htonl(ip & ip_set_hostmask(e.cidr));
                 ret = adtfn(set, &e, &ext, &ext, flags);
-                return ip_set_enomatch(ret, flags, adt) ? 1 :
+                return ip_set_enomatch(ret, flags, adt, set) ? -ret:
                        ip_set_eexist(ret, flags) ? 0 : ret;
         }
 
@@ -396,7 +396,7 @@ hash_net6_uadt(struct ip_set *set, struct nlattr *tb[],
 
         ret = adtfn(set, &e, &ext, &ext, flags);
 
-        return ip_set_enomatch(ret, flags, adt) ? 1 :
+        return ip_set_enomatch(ret, flags, adt, set) ? -ret :
                ip_set_eexist(ret, flags) ? 0 : ret;
 }
 
diff --git a/net/netfilter/ipset/ip_set_hash_netiface.c b/net/netfilter/ipset/ip_set_hash_netiface.c
index 84ae6f6ce624..7d798d5d5cd3 100644
--- a/net/netfilter/ipset/ip_set_hash_netiface.c
+++ b/net/netfilter/ipset/ip_set_hash_netiface.c
@@ -368,7 +368,7 @@ hash_netiface4_uadt(struct ip_set *set, struct nlattr *tb[],
         if (adt == IPSET_TEST || !tb[IPSET_ATTR_IP_TO]) {
                 e.ip = htonl(ip & ip_set_hostmask(e.cidr));
                 ret = adtfn(set, &e, &ext, &ext, flags);
-                return ip_set_enomatch(ret, flags, adt) ? 1 :
+                return ip_set_enomatch(ret, flags, adt, set) ? -ret :
                        ip_set_eexist(ret, flags) ? 0 : ret;
         }
 
@@ -634,7 +634,7 @@ hash_netiface6_uadt(struct ip_set *set, struct nlattr *tb[],
 
         ret = adtfn(set, &e, &ext, &ext, flags);
 
-        return ip_set_enomatch(ret, flags, adt) ? 1 :
+        return ip_set_enomatch(ret, flags, adt, set) ? -ret :
                ip_set_eexist(ret, flags) ? 0 : ret;
 }
 
diff --git a/net/netfilter/ipset/ip_set_hash_netport.c b/net/netfilter/ipset/ip_set_hash_netport.c
index 9a0869853be5..09d6690bee6f 100644
--- a/net/netfilter/ipset/ip_set_hash_netport.c
+++ b/net/netfilter/ipset/ip_set_hash_netport.c
@@ -244,7 +244,7 @@ hash_netport4_uadt(struct ip_set *set, struct nlattr *tb[],
         if (adt == IPSET_TEST || !(with_ports || tb[IPSET_ATTR_IP_TO])) {
                 e.ip = htonl(ip & ip_set_hostmask(e.cidr + 1));
                 ret = adtfn(set, &e, &ext, &ext, flags);
-                return ip_set_enomatch(ret, flags, adt) ? 1 :
+                return ip_set_enomatch(ret, flags, adt, set) ? -ret :
                        ip_set_eexist(ret, flags) ? 0 : ret;
         }
 
@@ -489,7 +489,7 @@ hash_netport6_uadt(struct ip_set *set, struct nlattr *tb[],
 
         if (adt == IPSET_TEST || !with_ports || !tb[IPSET_ATTR_PORT_TO]) {
                 ret = adtfn(set, &e, &ext, &ext, flags);
-                return ip_set_enomatch(ret, flags, adt) ? 1 :
+                return ip_set_enomatch(ret, flags, adt, set) ? -ret :
                        ip_set_eexist(ret, flags) ? 0 : ret;
         }
 
diff --git a/net/netfilter/ipvs/ip_vs_conn.c b/net/netfilter/ipvs/ip_vs_conn.c
index a083bda322b6..4c8e5c0aa1ab 100644
--- a/net/netfilter/ipvs/ip_vs_conn.c
+++ b/net/netfilter/ipvs/ip_vs_conn.c
@@ -975,8 +975,7 @@ static void *ip_vs_conn_array(struct seq_file *seq, loff_t pos)
                                 return cp;
                         }
                 }
-                rcu_read_unlock();
-                rcu_read_lock();
+                cond_resched_rcu();
         }
 
         return NULL;
@@ -1015,8 +1014,7 @@ static void *ip_vs_conn_seq_next(struct seq_file *seq, void *v, loff_t *pos)
                         iter->l = &ip_vs_conn_tab[idx];
                         return cp;
                 }
-                rcu_read_unlock();
-                rcu_read_lock();
+                cond_resched_rcu();
         }
         iter->l = NULL;
         return NULL;
@@ -1206,17 +1204,13 @@ void ip_vs_random_dropentry(struct net *net)
         int idx;
         struct ip_vs_conn *cp, *cp_c;
 
+        rcu_read_lock();
         /*
          * Randomly scan 1/32 of the whole table every second
          */
         for (idx = 0; idx < (ip_vs_conn_tab_size>>5); idx++) {
                 unsigned int hash = net_random() & ip_vs_conn_tab_mask;
 
-                /*
-                 *  Lock is actually needed in this loop.
-                 */
-                rcu_read_lock();
-
                 hlist_for_each_entry_rcu(cp, &ip_vs_conn_tab[hash], c_list) {
                         if (cp->flags & IP_VS_CONN_F_TEMPLATE)
                                 /* connection template */
@@ -1237,6 +1231,18 @@ void ip_vs_random_dropentry(struct net *net)
                                 default:
                                         continue;
                                 }
+                        } else if (cp->protocol == IPPROTO_SCTP) {
+                                switch (cp->state) {
+                                case IP_VS_SCTP_S_INIT1:
+                                case IP_VS_SCTP_S_INIT:
+                                        break;
+                                case IP_VS_SCTP_S_ESTABLISHED:
+                                        if (todrop_entry(cp))
+                                                break;
+                                        continue;
+                                default:
+                                        continue;
+                                }
                         } else {
                                 if (!todrop_entry(cp))
                                         continue;
@@ -1252,8 +1258,9 @@ void ip_vs_random_dropentry(struct net *net)
                                 __ip_vs_conn_put(cp);
                         }
                 }
-                rcu_read_unlock();
+                cond_resched_rcu();
         }
+        rcu_read_unlock();
 }
 
 
@@ -1267,11 +1274,8 @@ static void ip_vs_conn_flush(struct net *net)
         struct netns_ipvs *ipvs = net_ipvs(net);
 
 flush_again:
+        rcu_read_lock();
         for (idx = 0; idx < ip_vs_conn_tab_size; idx++) {
-                /*
-                 *  Lock is actually needed in this loop.
-                 */
-                rcu_read_lock();
 
                 hlist_for_each_entry_rcu(cp, &ip_vs_conn_tab[idx], c_list) {
                         if (!ip_vs_conn_net_eq(cp, net))
@@ -1286,8 +1290,9 @@ flush_again:
                                 __ip_vs_conn_put(cp);
                         }
                 }
-                rcu_read_unlock();
+                cond_resched_rcu();
         }
+        rcu_read_unlock();
 
         /* the counter may be not NULL, because maybe some conn entries
            are run by slow timer handler or unhashed but still referred */
diff --git a/net/netfilter/ipvs/ip_vs_core.c b/net/netfilter/ipvs/ip_vs_core.c
index 05565d2b3a61..74fd00c27210 100644
--- a/net/netfilter/ipvs/ip_vs_core.c
+++ b/net/netfilter/ipvs/ip_vs_core.c
@@ -116,6 +116,7 @@ ip_vs_in_stats(struct ip_vs_conn *cp, struct sk_buff *skb)
 
         if (dest && (dest->flags & IP_VS_DEST_F_AVAILABLE)) {
                 struct ip_vs_cpu_stats *s;
+                struct ip_vs_service *svc;
 
                 s = this_cpu_ptr(dest->stats.cpustats);
                 s->ustats.inpkts++;
@@ -123,11 +124,14 @@ ip_vs_in_stats(struct ip_vs_conn *cp, struct sk_buff *skb)
                 s->ustats.inbytes += skb->len;
                 u64_stats_update_end(&s->syncp);
 
-                s = this_cpu_ptr(dest->svc->stats.cpustats);
+                rcu_read_lock();
+                svc = rcu_dereference(dest->svc);
+                s = this_cpu_ptr(svc->stats.cpustats);
                 s->ustats.inpkts++;
                 u64_stats_update_begin(&s->syncp);
                 s->ustats.inbytes += skb->len;
                 u64_stats_update_end(&s->syncp);
+                rcu_read_unlock();
 
                 s = this_cpu_ptr(ipvs->tot_stats.cpustats);
                 s->ustats.inpkts++;
@@ -146,6 +150,7 @@ ip_vs_out_stats(struct ip_vs_conn *cp, struct sk_buff *skb)
 
         if (dest && (dest->flags & IP_VS_DEST_F_AVAILABLE)) {
                 struct ip_vs_cpu_stats *s;
+                struct ip_vs_service *svc;
 
                 s = this_cpu_ptr(dest->stats.cpustats);
                 s->ustats.outpkts++;
@@ -153,11 +158,14 @@ ip_vs_out_stats(struct ip_vs_conn *cp, struct sk_buff *skb)
                 s->ustats.outbytes += skb->len;
                 u64_stats_update_end(&s->syncp);
 
-                s = this_cpu_ptr(dest->svc->stats.cpustats);
+                rcu_read_lock();
+                svc = rcu_dereference(dest->svc);
+                s = this_cpu_ptr(svc->stats.cpustats);
                 s->ustats.outpkts++;
                 u64_stats_update_begin(&s->syncp);
                 s->ustats.outbytes += skb->len;
                 u64_stats_update_end(&s->syncp);
+                rcu_read_unlock();
 
                 s = this_cpu_ptr(ipvs->tot_stats.cpustats);
                 s->ustats.outpkts++;
@@ -305,7 +313,7 @@ ip_vs_sched_persist(struct ip_vs_service *svc,
                  * return *ignored=0 i.e. ICMP and NF_DROP
                  */
                 sched = rcu_dereference(svc->scheduler);
-                dest = sched->schedule(svc, skb);
+                dest = sched->schedule(svc, skb, iph);
                 if (!dest) {
                         IP_VS_DBG(1, "p-schedule: no dest found.\n");
                         kfree(param.pe_data);
@@ -452,7 +460,7 @@ ip_vs_schedule(struct ip_vs_service *svc, struct sk_buff *skb,
         }
 
         sched = rcu_dereference(svc->scheduler);
-        dest = sched->schedule(svc, skb);
+        dest = sched->schedule(svc, skb, iph);
         if (dest == NULL) {
                 IP_VS_DBG(1, "Schedule: no dest found.\n");
                 return NULL;
@@ -1442,7 +1450,8 @@ ignore_ipip:
 
         /* do the statistics and put it back */
         ip_vs_in_stats(cp, skb);
-        if (IPPROTO_TCP == cih->protocol || IPPROTO_UDP == cih->protocol)
+        if (IPPROTO_TCP == cih->protocol || IPPROTO_UDP == cih->protocol ||
+            IPPROTO_SCTP == cih->protocol)
                 offset += 2 * sizeof(__u16);
         verdict = ip_vs_icmp_xmit(skb, cp, pp, offset, hooknum, &ciph);
 
diff --git a/net/netfilter/ipvs/ip_vs_ctl.c b/net/netfilter/ipvs/ip_vs_ctl.c
index 5b142fb16480..a3df9bddc4f7 100644
--- a/net/netfilter/ipvs/ip_vs_ctl.c
+++ b/net/netfilter/ipvs/ip_vs_ctl.c
@@ -460,7 +460,7 @@ static inline void
 __ip_vs_bind_svc(struct ip_vs_dest *dest, struct ip_vs_service *svc)
 {
         atomic_inc(&svc->refcnt);
-        dest->svc = svc;
+        rcu_assign_pointer(dest->svc, svc);
 }
 
 static void ip_vs_service_free(struct ip_vs_service *svc)
@@ -470,18 +470,25 @@ static void ip_vs_service_free(struct ip_vs_service *svc)
         kfree(svc);
 }
 
-static void
-__ip_vs_unbind_svc(struct ip_vs_dest *dest)
+static void ip_vs_service_rcu_free(struct rcu_head *head)
 {
-        struct ip_vs_service *svc = dest->svc;
+        struct ip_vs_service *svc;
+
+        svc = container_of(head, struct ip_vs_service, rcu_head);
+        ip_vs_service_free(svc);
+}
 
-        dest->svc = NULL;
+static void __ip_vs_svc_put(struct ip_vs_service *svc, bool do_delay)
+{
         if (atomic_dec_and_test(&svc->refcnt)) {
                 IP_VS_DBG_BUF(3, "Removing service %u/%s:%u\n",
                               svc->fwmark,
                               IP_VS_DBG_ADDR(svc->af, &svc->addr),
                               ntohs(svc->port));
-                ip_vs_service_free(svc);
+                if (do_delay)
+                        call_rcu(&svc->rcu_head, ip_vs_service_rcu_free);
+                else
+                        ip_vs_service_free(svc);
         }
 }
 
@@ -667,11 +674,6 @@ ip_vs_trash_get_dest(struct ip_vs_service *svc, const union nf_inet_addr *daddr,
                               IP_VS_DBG_ADDR(svc->af, &dest->addr),
                               ntohs(dest->port),
                               atomic_read(&dest->refcnt));
-                /* We can not reuse dest while in grace period
-                 * because conns still can use dest->svc
-                 */
-                if (test_bit(IP_VS_DEST_STATE_REMOVING, &dest->state))
-                        continue;
                 if (dest->af == svc->af &&
                     ip_vs_addr_equal(svc->af, &dest->addr, daddr) &&
                     dest->port == dport &&
@@ -697,8 +699,10 @@ out:
 
 static void ip_vs_dest_free(struct ip_vs_dest *dest)
 {
+        struct ip_vs_service *svc = rcu_dereference_protected(dest->svc, 1);
+
         __ip_vs_dst_cache_reset(dest);
-        __ip_vs_unbind_svc(dest);
+        __ip_vs_svc_put(svc, false);
         free_percpu(dest->stats.cpustats);
         kfree(dest);
 }
@@ -771,6 +775,7 @@ __ip_vs_update_dest(struct ip_vs_service *svc, struct ip_vs_dest *dest,
                     struct ip_vs_dest_user_kern *udest, int add)
 {
         struct netns_ipvs *ipvs = net_ipvs(svc->net);
+        struct ip_vs_service *old_svc;
         struct ip_vs_scheduler *sched;
         int conn_flags;
 
@@ -792,13 +797,14 @@ __ip_vs_update_dest(struct ip_vs_service *svc, struct ip_vs_dest *dest,
         atomic_set(&dest->conn_flags, conn_flags);
 
         /* bind the service */
-        if (!dest->svc) {
+        old_svc = rcu_dereference_protected(dest->svc, 1);
+        if (!old_svc) {
                 __ip_vs_bind_svc(dest, svc);
         } else {
-                if (dest->svc != svc) {
-                        __ip_vs_unbind_svc(dest);
+                if (old_svc != svc) {
                         ip_vs_zero_stats(&dest->stats);
                         __ip_vs_bind_svc(dest, svc);
+                        __ip_vs_svc_put(old_svc, true);
                 }
         }
 
@@ -998,16 +1004,6 @@ ip_vs_edit_dest(struct ip_vs_service *svc, struct ip_vs_dest_user_kern *udest)
         return 0;
 }
 
-static void ip_vs_dest_wait_readers(struct rcu_head *head)
-{
-        struct ip_vs_dest *dest = container_of(head, struct ip_vs_dest,
-                                               rcu_head);
-
-        /* End of grace period after unlinking */
-        clear_bit(IP_VS_DEST_STATE_REMOVING, &dest->state);
-}
-
-
 /*
  *      Delete a destination (must be already unlinked from the service)
  */
@@ -1023,20 +1019,16 @@ static void __ip_vs_del_dest(struct net *net, struct ip_vs_dest *dest,
          */
         ip_vs_rs_unhash(dest);
 
-        if (!cleanup) {
-                set_bit(IP_VS_DEST_STATE_REMOVING, &dest->state);
-                call_rcu(&dest->rcu_head, ip_vs_dest_wait_readers);
-        }
-
         spin_lock_bh(&ipvs->dest_trash_lock);
         IP_VS_DBG_BUF(3, "Moving dest %s:%u into trash, dest->refcnt=%d\n",
                       IP_VS_DBG_ADDR(dest->af, &dest->addr), ntohs(dest->port),
                       atomic_read(&dest->refcnt));
         if (list_empty(&ipvs->dest_trash) && !cleanup)
                 mod_timer(&ipvs->dest_trash_timer,
-                          jiffies + IP_VS_DEST_TRASH_PERIOD);
+                          jiffies + (IP_VS_DEST_TRASH_PERIOD >> 1));
         /* dest lives in trash without reference */
         list_add(&dest->t_list, &ipvs->dest_trash);
+        dest->idle_start = 0;
         spin_unlock_bh(&ipvs->dest_trash_lock);
         ip_vs_dest_put(dest);
 }
@@ -1108,24 +1100,30 @@ static void ip_vs_dest_trash_expire(unsigned long data)
         struct net *net = (struct net *) data;
         struct netns_ipvs *ipvs = net_ipvs(net);
         struct ip_vs_dest *dest, *next;
+        unsigned long now = jiffies;
 
         spin_lock(&ipvs->dest_trash_lock);
         list_for_each_entry_safe(dest, next, &ipvs->dest_trash, t_list) {
-                /* Skip if dest is in grace period */
-                if (test_bit(IP_VS_DEST_STATE_REMOVING, &dest->state))
-                        continue;
                 if (atomic_read(&dest->refcnt) > 0)
                         continue;
+                if (dest->idle_start) {
+                        if (time_before(now, dest->idle_start +
+                                             IP_VS_DEST_TRASH_PERIOD))
+                                continue;
+                } else {
+                        dest->idle_start = max(1UL, now);
+                        continue;
+                }
                 IP_VS_DBG_BUF(3, "Removing destination %u/%s:%u from trash\n",
                               dest->vfwmark,
-                              IP_VS_DBG_ADDR(dest->svc->af, &dest->addr),
+                              IP_VS_DBG_ADDR(dest->af, &dest->addr),
                               ntohs(dest->port));
                 list_del(&dest->t_list);
                 ip_vs_dest_free(dest);
         }
         if (!list_empty(&ipvs->dest_trash))
                 mod_timer(&ipvs->dest_trash_timer,
-                          jiffies + IP_VS_DEST_TRASH_PERIOD);
+                          jiffies + (IP_VS_DEST_TRASH_PERIOD >> 1));
         spin_unlock(&ipvs->dest_trash_lock);
 }
 
@@ -1320,14 +1318,6 @@ out:
         return ret;
 }
 
-static void ip_vs_service_rcu_free(struct rcu_head *head)
-{
-        struct ip_vs_service *svc;
-
-        svc = container_of(head, struct ip_vs_service, rcu_head);
-        ip_vs_service_free(svc);
-}
-
 /*
  *      Delete a service from the service list
  *      - The service must be unlinked, unlocked and not referenced!
@@ -1376,13 +1366,7 @@ static void __ip_vs_del_service(struct ip_vs_service *svc, bool cleanup)
         /*
          *    Free the service if nobody refers to it
          */
-        if (atomic_dec_and_test(&svc->refcnt)) {
-                IP_VS_DBG_BUF(3, "Removing service %u/%s:%u\n",
-                              svc->fwmark,
-                              IP_VS_DBG_ADDR(svc->af, &svc->addr),
-                              ntohs(svc->port));
-                call_rcu(&svc->rcu_head, ip_vs_service_rcu_free);
-        }
+        __ip_vs_svc_put(svc, true);
 
         /* decrease the module use count */
         ip_vs_use_count_dec();
@@ -1487,9 +1471,9 @@ ip_vs_forget_dev(struct ip_vs_dest *dest, struct net_device *dev)
  * Currently only NETDEV_DOWN is handled to release refs to cached dsts
  */
 static int ip_vs_dst_event(struct notifier_block *this, unsigned long event,
-                            void *ptr)
+                           void *ptr)
 {
-        struct net_device *dev = ptr;
+        struct net_device *dev = netdev_notifier_info_to_dev(ptr);
         struct net *net = dev_net(dev);
         struct netns_ipvs *ipvs = net_ipvs(net);
         struct ip_vs_service *svc;
@@ -1575,7 +1559,7 @@ static int zero;
 static int three = 3;
 
 static int
-proc_do_defense_mode(ctl_table *table, int write,
+proc_do_defense_mode(struct ctl_table *table, int write,
                      void __user *buffer, size_t *lenp, loff_t *ppos)
 {
         struct net *net = current->nsproxy->net_ns;
@@ -1596,7 +1580,7 @@ proc_do_defense_mode(ctl_table *table, int write,
 }
 
 static int
-proc_do_sync_threshold(ctl_table *table, int write,
+proc_do_sync_threshold(struct ctl_table *table, int write,
                        void __user *buffer, size_t *lenp, loff_t *ppos)
 {
         int *valp = table->data;
@@ -1616,7 +1600,7 @@ proc_do_sync_threshold(ctl_table *table, int write,
 }
 
 static int
-proc_do_sync_mode(ctl_table *table, int write,
+proc_do_sync_mode(struct ctl_table *table, int write,
                      void __user *buffer, size_t *lenp, loff_t *ppos)
 {
         int *valp = table->data;
@@ -1634,7 +1618,7 @@ proc_do_sync_mode(ctl_table *table, int write,
 }
 
 static int
-proc_do_sync_ports(ctl_table *table, int write,
+proc_do_sync_ports(struct ctl_table *table, int write,
                    void __user *buffer, size_t *lenp, loff_t *ppos)
 {
         int *valp = table->data;
@@ -1715,12 +1699,18 @@ static struct ctl_table vs_vars[] = {
                 .proc_handler   = &proc_do_sync_ports,
         },
         {
-                .procname       = "sync_qlen_max",
+                .procname       = "sync_persist_mode",
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
                 .proc_handler   = proc_dointvec,
         },
         {
+                .procname       = "sync_qlen_max",
+                .maxlen         = sizeof(unsigned long),
+                .mode           = 0644,
+                .proc_handler   = proc_doulongvec_minmax,
+        },
+        {
                 .procname       = "sync_sock_size",
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
@@ -1739,6 +1729,18 @@ static struct ctl_table vs_vars[] = {
                 .proc_handler   = proc_dointvec,
         },
         {
+                .procname       = "sloppy_tcp",
+                .maxlen         = sizeof(int),
+                .mode           = 0644,
+                .proc_handler   = proc_dointvec,
+        },
+        {
+                .procname       = "sloppy_sctp",
+                .maxlen         = sizeof(int),
+                .mode           = 0644,
+                .proc_handler   = proc_dointvec,
+        },
+        {
                 .procname       = "expire_quiescent_template",
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
@@ -2542,6 +2544,7 @@ __ip_vs_get_dest_entries(struct net *net, const struct ip_vs_get_dests *get,
                 struct ip_vs_dest *dest;
                 struct ip_vs_dest_entry entry;
 
+                memset(&entry, 0, sizeof(entry));
                 list_for_each_entry(dest, &svc->destinations, n_list) {
                         if (count >= get->num_dests)
                                 break;
@@ -3716,12 +3719,15 @@ static int __net_init ip_vs_control_net_init_sysctl(struct net *net)
         tbl[idx++].data = &ipvs->sysctl_sync_ver;
         ipvs->sysctl_sync_ports = 1;
         tbl[idx++].data = &ipvs->sysctl_sync_ports;
+        tbl[idx++].data = &ipvs->sysctl_sync_persist_mode;
         ipvs->sysctl_sync_qlen_max = nr_free_buffer_pages() / 32;
         tbl[idx++].data = &ipvs->sysctl_sync_qlen_max;
         ipvs->sysctl_sync_sock_size = 0;
         tbl[idx++].data = &ipvs->sysctl_sync_sock_size;
         tbl[idx++].data = &ipvs->sysctl_cache_bypass;
         tbl[idx++].data = &ipvs->sysctl_expire_nodest_conn;
+        tbl[idx++].data = &ipvs->sysctl_sloppy_tcp;
+        tbl[idx++].data = &ipvs->sysctl_sloppy_sctp;
         tbl[idx++].data = &ipvs->sysctl_expire_quiescent_template;
         ipvs->sysctl_sync_threshold[0] = DEFAULT_SYNC_THRESHOLD;
         ipvs->sysctl_sync_threshold[1] = DEFAULT_SYNC_PERIOD;
diff --git a/net/netfilter/ipvs/ip_vs_dh.c b/net/netfilter/ipvs/ip_vs_dh.c
index ccab120df45e..c3b84546ea9e 100644
--- a/net/netfilter/ipvs/ip_vs_dh.c
+++ b/net/netfilter/ipvs/ip_vs_dh.c
@@ -214,18 +214,16 @@ static inline int is_overloaded(struct ip_vs_dest *dest)
  *      Destination hashing scheduling
  */
 static struct ip_vs_dest *
-ip_vs_dh_schedule(struct ip_vs_service *svc, const struct sk_buff *skb)
+ip_vs_dh_schedule(struct ip_vs_service *svc, const struct sk_buff *skb,
+                  struct ip_vs_iphdr *iph)
 {
         struct ip_vs_dest *dest;
         struct ip_vs_dh_state *s;
-        struct ip_vs_iphdr iph;
-
-        ip_vs_fill_iph_addr_only(svc->af, skb, &iph);
 
         IP_VS_DBG(6, "%s(): Scheduling...\n", __func__);
 
         s = (struct ip_vs_dh_state *) svc->sched_data;
-        dest = ip_vs_dh_get(svc->af, s, &iph.daddr);
+        dest = ip_vs_dh_get(svc->af, s, &iph->daddr);
         if (!dest
             || !(dest->flags & IP_VS_DEST_F_AVAILABLE)
             || atomic_read(&dest->weight) <= 0
@@ -235,7 +233,7 @@ ip_vs_dh_schedule(struct ip_vs_service *svc, const struct sk_buff *skb)
         }
 
         IP_VS_DBG_BUF(6, "DH: destination IP address %s --> server %s:%d\n",
-                      IP_VS_DBG_ADDR(svc->af, &iph.daddr),
+                      IP_VS_DBG_ADDR(svc->af, &iph->daddr),
                       IP_VS_DBG_ADDR(svc->af, &dest->addr),
                       ntohs(dest->port));
 
diff --git a/net/netfilter/ipvs/ip_vs_est.c b/net/netfilter/ipvs/ip_vs_est.c
index 6bee6d0c73a5..1425e9a924c4 100644
--- a/net/netfilter/ipvs/ip_vs_est.c
+++ b/net/netfilter/ipvs/ip_vs_est.c
@@ -59,12 +59,13 @@ static void ip_vs_read_cpu_stats(struct ip_vs_stats_user *sum,
                                  struct ip_vs_cpu_stats __percpu *stats)
 {
         int i;
+        bool add = false;
 
         for_each_possible_cpu(i) {
                 struct ip_vs_cpu_stats *s = per_cpu_ptr(stats, i);
                 unsigned int start;
                 __u64 inbytes, outbytes;
-                if (i) {
+                if (add) {
                         sum->conns += s->ustats.conns;
                         sum->inpkts += s->ustats.inpkts;
                         sum->outpkts += s->ustats.outpkts;
@@ -76,6 +77,7 @@ static void ip_vs_read_cpu_stats(struct ip_vs_stats_user *sum,
                         sum->inbytes += inbytes;
                         sum->outbytes += outbytes;
                 } else {
+                        add = true;
                         sum->conns = s->ustats.conns;
                         sum->inpkts = s->ustats.inpkts;
                         sum->outpkts = s->ustats.outpkts;
diff --git a/net/netfilter/ipvs/ip_vs_lblc.c b/net/netfilter/ipvs/ip_vs_lblc.c
index 5ea26bd87743..eff13c94498e 100644
--- a/net/netfilter/ipvs/ip_vs_lblc.c
+++ b/net/netfilter/ipvs/ip_vs_lblc.c
@@ -93,7 +93,7 @@ struct ip_vs_lblc_entry {
         struct hlist_node       list;
         int                     af;             /* address family */
         union nf_inet_addr      addr;           /* destination IP address */
-        struct ip_vs_dest __rcu *dest;          /* real server (cache) */
+        struct ip_vs_dest       *dest;          /* real server (cache) */
         unsigned long           lastuse;        /* last used time */
         struct rcu_head         rcu_head;
 };
@@ -118,7 +118,7 @@ struct ip_vs_lblc_table {
  *      IPVS LBLC sysctl table
  */
 #ifdef CONFIG_SYSCTL
-static ctl_table vs_vars_table[] = {
+static struct ctl_table vs_vars_table[] = {
         {
                 .procname       = "lblc_expiration",
                 .data           = NULL,
@@ -130,20 +130,21 @@ static ctl_table vs_vars_table[] = {
 };
 #endif
 
-static inline void ip_vs_lblc_free(struct ip_vs_lblc_entry *en)
+static void ip_vs_lblc_rcu_free(struct rcu_head *head)
 {
-        struct ip_vs_dest *dest;
+        struct ip_vs_lblc_entry *en = container_of(head,
+                                                   struct ip_vs_lblc_entry,
+                                                   rcu_head);
 
-        hlist_del_rcu(&en->list);
-        /*
-         * We don't kfree dest because it is referred either by its service
-         * or the trash dest list.
-         */
-        dest = rcu_dereference_protected(en->dest, 1);
-        ip_vs_dest_put(dest);
-        kfree_rcu(en, rcu_head);
+        ip_vs_dest_put(en->dest);
+        kfree(en);
 }
 
+static inline void ip_vs_lblc_del(struct ip_vs_lblc_entry *en)
+{
+        hlist_del_rcu(&en->list);
+        call_rcu(&en->rcu_head, ip_vs_lblc_rcu_free);
+}
 
 /*
  *      Returns hash value for IPVS LBLC entry
@@ -203,30 +204,23 @@ ip_vs_lblc_new(struct ip_vs_lblc_table *tbl, const union nf_inet_addr *daddr,
         struct ip_vs_lblc_entry *en;
 
         en = ip_vs_lblc_get(dest->af, tbl, daddr);
-        if (!en) {
-                en = kmalloc(sizeof(*en), GFP_ATOMIC);
-                if (!en)
-                        return NULL;
-
-                en->af = dest->af;
-                ip_vs_addr_copy(dest->af, &en->addr, daddr);
-                en->lastuse = jiffies;
+        if (en) {
+                if (en->dest == dest)
+                        return en;
+                ip_vs_lblc_del(en);
+        }
+        en = kmalloc(sizeof(*en), GFP_ATOMIC);
+        if (!en)
+                return NULL;
 
-                ip_vs_dest_hold(dest);
-                RCU_INIT_POINTER(en->dest, dest);
+        en->af = dest->af;
+        ip_vs_addr_copy(dest->af, &en->addr, daddr);
+        en->lastuse = jiffies;
 
-                ip_vs_lblc_hash(tbl, en);
-        } else {
-                struct ip_vs_dest *old_dest;
+        ip_vs_dest_hold(dest);
+        en->dest = dest;
 
-                old_dest = rcu_dereference_protected(en->dest, 1);
-                if (old_dest != dest) {
-                        ip_vs_dest_put(old_dest);
-                        ip_vs_dest_hold(dest);
-                        /* No ordering constraints for refcnt */
-                        RCU_INIT_POINTER(en->dest, dest);
-                }
-        }
+        ip_vs_lblc_hash(tbl, en);
 
         return en;
 }
@@ -246,7 +240,7 @@ static void ip_vs_lblc_flush(struct ip_vs_service *svc)
         tbl->dead = 1;
         for (i=0; i<IP_VS_LBLC_TAB_SIZE; i++) {
                 hlist_for_each_entry_safe(en, next, &tbl->bucket[i], list) {
-                        ip_vs_lblc_free(en);
+                        ip_vs_lblc_del(en);
                         atomic_dec(&tbl->entries);
                 }
         }
@@ -281,7 +275,7 @@ static inline void ip_vs_lblc_full_check(struct ip_vs_service *svc)
                                         sysctl_lblc_expiration(svc)))
                                 continue;
 
-                        ip_vs_lblc_free(en);
+                        ip_vs_lblc_del(en);
                         atomic_dec(&tbl->entries);
                 }
                 spin_unlock(&svc->sched_lock);
@@ -335,7 +329,7 @@ static void ip_vs_lblc_check_expire(unsigned long data)
                         if (time_before(now, en->lastuse + ENTRY_TIMEOUT))
                                 continue;
 
-                        ip_vs_lblc_free(en);
+                        ip_vs_lblc_del(en);
                         atomic_dec(&tbl->entries);
                         goal--;
                 }
@@ -443,8 +437,8 @@ __ip_vs_lblc_schedule(struct ip_vs_service *svc)
                         continue;
 
                 doh = ip_vs_dest_conn_overhead(dest);
-                if (loh * atomic_read(&dest->weight) >
-                    doh * atomic_read(&least->weight)) {
+                if ((__s64)loh * atomic_read(&dest->weight) >
+                    (__s64)doh * atomic_read(&least->weight)) {
                         least = dest;
                         loh = doh;
                 }
@@ -487,19 +481,17 @@ is_overloaded(struct ip_vs_dest *dest, struct ip_vs_service *svc)
  *    Locality-Based (weighted) Least-Connection scheduling
  */
 static struct ip_vs_dest *
-ip_vs_lblc_schedule(struct ip_vs_service *svc, const struct sk_buff *skb)
+ip_vs_lblc_schedule(struct ip_vs_service *svc, const struct sk_buff *skb,
+                    struct ip_vs_iphdr *iph)
 {
         struct ip_vs_lblc_table *tbl = svc->sched_data;
-        struct ip_vs_iphdr iph;
         struct ip_vs_dest *dest = NULL;
         struct ip_vs_lblc_entry *en;
 
-        ip_vs_fill_iph_addr_only(svc->af, skb, &iph);
-
         IP_VS_DBG(6, "%s(): Scheduling...\n", __func__);
 
         /* First look in our cache */
-        en = ip_vs_lblc_get(svc->af, tbl, &iph.daddr);
+        en = ip_vs_lblc_get(svc->af, tbl, &iph->daddr);
         if (en) {
                 /* We only hold a read lock, but this is atomic */
                 en->lastuse = jiffies;
@@ -513,7 +505,7 @@ ip_vs_lblc_schedule(struct ip_vs_service *svc, const struct sk_buff *skb)
                  * free up entries from the trash at any time.
                  */
 
-                dest = rcu_dereference(en->dest);
+                dest = en->dest;
                 if ((dest->flags & IP_VS_DEST_F_AVAILABLE) &&
                     atomic_read(&dest->weight) > 0 && !is_overloaded(dest, svc))
                         goto out;
@@ -529,12 +521,12 @@ ip_vs_lblc_schedule(struct ip_vs_service *svc, const struct sk_buff *skb)
         /* If we fail to create a cache entry, we'll just use the valid dest */
         spin_lock_bh(&svc->sched_lock);
         if (!tbl->dead)
-                ip_vs_lblc_new(tbl, &iph.daddr, dest);
+                ip_vs_lblc_new(tbl, &iph->daddr, dest);
         spin_unlock_bh(&svc->sched_lock);
 
 out:
         IP_VS_DBG_BUF(6, "LBLC: destination IP address %s --> server %s:%d\n",
-                      IP_VS_DBG_ADDR(svc->af, &iph.daddr),
+                      IP_VS_DBG_ADDR(svc->af, &iph->daddr),
                       IP_VS_DBG_ADDR(svc->af, &dest->addr), ntohs(dest->port));
 
         return dest;
@@ -633,7 +625,7 @@ static void __exit ip_vs_lblc_cleanup(void)
 {
         unregister_ip_vs_scheduler(&ip_vs_lblc_scheduler);
         unregister_pernet_subsys(&ip_vs_lblc_ops);
-        synchronize_rcu();
+        rcu_barrier();
 }
 
 
diff --git a/net/netfilter/ipvs/ip_vs_lblcr.c b/net/netfilter/ipvs/ip_vs_lblcr.c
index 50123c2ab484..0b8550089a2e 100644
--- a/net/netfilter/ipvs/ip_vs_lblcr.c
+++ b/net/netfilter/ipvs/ip_vs_lblcr.c
@@ -89,7 +89,7 @@
  */
 struct ip_vs_dest_set_elem {
         struct list_head        list;          /* list link */
-        struct ip_vs_dest __rcu *dest;         /* destination server */
+        struct ip_vs_dest       *dest;          /* destination server */
         struct rcu_head         rcu_head;
 };
 
@@ -107,11 +107,7 @@ static void ip_vs_dest_set_insert(struct ip_vs_dest_set *set,
 
         if (check) {
                 list_for_each_entry(e, &set->list, list) {
-                        struct ip_vs_dest *d;
-
-                        d = rcu_dereference_protected(e->dest, 1);
-                        if (d == dest)
-                                /* already existed */
+                        if (e->dest == dest)
                                 return;
                 }
         }
@@ -121,7 +117,7 @@ static void ip_vs_dest_set_insert(struct ip_vs_dest_set *set,
                 return;
 
         ip_vs_dest_hold(dest);
-        RCU_INIT_POINTER(e->dest, dest);
+        e->dest = dest;
 
         list_add_rcu(&e->list, &set->list);
         atomic_inc(&set->size);
@@ -129,22 +125,27 @@ static void ip_vs_dest_set_insert(struct ip_vs_dest_set *set,
         set->lastmod = jiffies;
 }
 
+static void ip_vs_lblcr_elem_rcu_free(struct rcu_head *head)
+{
+        struct ip_vs_dest_set_elem *e;
+
+        e = container_of(head, struct ip_vs_dest_set_elem, rcu_head);
+        ip_vs_dest_put(e->dest);
+        kfree(e);
+}
+
 static void
 ip_vs_dest_set_erase(struct ip_vs_dest_set *set, struct ip_vs_dest *dest)
 {
         struct ip_vs_dest_set_elem *e;
 
         list_for_each_entry(e, &set->list, list) {
-                struct ip_vs_dest *d;
-
-                d = rcu_dereference_protected(e->dest, 1);
-                if (d == dest) {
+                if (e->dest == dest) {
                         /* HIT */
                         atomic_dec(&set->size);
                         set->lastmod = jiffies;
-                        ip_vs_dest_put(dest);
                         list_del_rcu(&e->list);
-                        kfree_rcu(e, rcu_head);
+                        call_rcu(&e->rcu_head, ip_vs_lblcr_elem_rcu_free);
                         break;
                 }
         }
@@ -155,16 +156,8 @@ static void ip_vs_dest_set_eraseall(struct ip_vs_dest_set *set)
         struct ip_vs_dest_set_elem *e, *ep;
 
         list_for_each_entry_safe(e, ep, &set->list, list) {
-                struct ip_vs_dest *d;
-
-                d = rcu_dereference_protected(e->dest, 1);
-                /*
-                 * We don't kfree dest because it is referred either
-                 * by its service or by the trash dest list.
-                 */
-                ip_vs_dest_put(d);
                 list_del_rcu(&e->list);
-                kfree_rcu(e, rcu_head);
+                call_rcu(&e->rcu_head, ip_vs_lblcr_elem_rcu_free);
         }
 }
 
@@ -175,12 +168,9 @@ static inline struct ip_vs_dest *ip_vs_dest_set_min(struct ip_vs_dest_set *set)
         struct ip_vs_dest *dest, *least;
         int loh, doh;
 
-        if (set == NULL)
-                return NULL;
-
         /* select the first destination server, whose weight > 0 */
         list_for_each_entry_rcu(e, &set->list, list) {
-                least = rcu_dereference(e->dest);
+                least = e->dest;
                 if (least->flags & IP_VS_DEST_F_OVERLOAD)
                         continue;
 
@@ -195,13 +185,13 @@ static inline struct ip_vs_dest *ip_vs_dest_set_min(struct ip_vs_dest_set *set)
         /* find the destination with the weighted least load */
   nextstage:
         list_for_each_entry_continue_rcu(e, &set->list, list) {
-                dest = rcu_dereference(e->dest);
+                dest = e->dest;
                 if (dest->flags & IP_VS_DEST_F_OVERLOAD)
                         continue;
 
                 doh = ip_vs_dest_conn_overhead(dest);
-                if ((loh * atomic_read(&dest->weight) >
-                     doh * atomic_read(&least->weight))
+                if (((__s64)loh * atomic_read(&dest->weight) >
+                     (__s64)doh * atomic_read(&least->weight))
                     && (dest->flags & IP_VS_DEST_F_AVAILABLE)) {
                         least = dest;
                         loh = doh;
@@ -232,7 +222,7 @@ static inline struct ip_vs_dest *ip_vs_dest_set_max(struct ip_vs_dest_set *set)
 
         /* select the first destination server, whose weight > 0 */
         list_for_each_entry(e, &set->list, list) {
-                most = rcu_dereference_protected(e->dest, 1);
+                most = e->dest;
                 if (atomic_read(&most->weight) > 0) {
                         moh = ip_vs_dest_conn_overhead(most);
                         goto nextstage;
@@ -243,11 +233,11 @@ static inline struct ip_vs_dest *ip_vs_dest_set_max(struct ip_vs_dest_set *set)
         /* find the destination with the weighted most load */
   nextstage:
         list_for_each_entry_continue(e, &set->list, list) {
-                dest = rcu_dereference_protected(e->dest, 1);
+                dest = e->dest;
                 doh = ip_vs_dest_conn_overhead(dest);
                 /* moh/mw < doh/dw ==> moh*dw < doh*mw, where mw,dw>0 */
-                if ((moh * atomic_read(&dest->weight) <
-                     doh * atomic_read(&most->weight))
+                if (((__s64)moh * atomic_read(&dest->weight) <
+                     (__s64)doh * atomic_read(&most->weight))
                     && (atomic_read(&dest->weight) > 0)) {
                         most = dest;
                         moh = doh;
@@ -299,7 +289,7 @@ struct ip_vs_lblcr_table {
  *      IPVS LBLCR sysctl table
  */
 
-static ctl_table vs_vars_table[] = {
+static struct ctl_table vs_vars_table[] = {
         {
                 .procname       = "lblcr_expiration",
                 .data           = NULL,
@@ -414,7 +404,7 @@ static void ip_vs_lblcr_flush(struct ip_vs_service *svc)
 
         spin_lock_bh(&svc->sched_lock);
         tbl->dead = 1;
-        for (i=0; i<IP_VS_LBLCR_TAB_SIZE; i++) {
+        for (i = 0; i < IP_VS_LBLCR_TAB_SIZE; i++) {
                 hlist_for_each_entry_safe(en, next, &tbl->bucket[i], list) {
                         ip_vs_lblcr_free(en);
                 }
@@ -440,7 +430,7 @@ static inline void ip_vs_lblcr_full_check(struct ip_vs_service *svc)
         struct ip_vs_lblcr_entry *en;
         struct hlist_node *next;
 
-        for (i=0, j=tbl->rover; i<IP_VS_LBLCR_TAB_SIZE; i++) {
+        for (i = 0, j = tbl->rover; i < IP_VS_LBLCR_TAB_SIZE; i++) {
                 j = (j + 1) & IP_VS_LBLCR_TAB_MASK;
 
                 spin_lock(&svc->sched_lock);
@@ -495,7 +485,7 @@ static void ip_vs_lblcr_check_expire(unsigned long data)
         if (goal > tbl->max_size/2)
                 goal = tbl->max_size/2;
 
-        for (i=0, j=tbl->rover; i<IP_VS_LBLCR_TAB_SIZE; i++) {
+        for (i = 0, j = tbl->rover; i < IP_VS_LBLCR_TAB_SIZE; i++) {
                 j = (j + 1) & IP_VS_LBLCR_TAB_MASK;
 
                 spin_lock(&svc->sched_lock);
@@ -536,7 +526,7 @@ static int ip_vs_lblcr_init_svc(struct ip_vs_service *svc)
         /*
          *    Initialize the hash buckets
          */
-        for (i=0; i<IP_VS_LBLCR_TAB_SIZE; i++) {
+        for (i = 0; i < IP_VS_LBLCR_TAB_SIZE; i++) {
                 INIT_HLIST_HEAD(&tbl->bucket[i]);
         }
         tbl->max_size = IP_VS_LBLCR_TAB_SIZE*16;
@@ -611,8 +601,8 @@ __ip_vs_lblcr_schedule(struct ip_vs_service *svc)
                         continue;
 
                 doh = ip_vs_dest_conn_overhead(dest);
-                if (loh * atomic_read(&dest->weight) >
-                    doh * atomic_read(&least->weight)) {
+                if ((__s64)loh * atomic_read(&dest->weight) >
+                    (__s64)doh * atomic_read(&least->weight)) {
                         least = dest;
                         loh = doh;
                 }
@@ -655,19 +645,17 @@ is_overloaded(struct ip_vs_dest *dest, struct ip_vs_service *svc)
  *    Locality-Based (weighted) Least-Connection scheduling
  */
 static struct ip_vs_dest *
-ip_vs_lblcr_schedule(struct ip_vs_service *svc, const struct sk_buff *skb)
+ip_vs_lblcr_schedule(struct ip_vs_service *svc, const struct sk_buff *skb,
+                     struct ip_vs_iphdr *iph)
 {
         struct ip_vs_lblcr_table *tbl = svc->sched_data;
-        struct ip_vs_iphdr iph;
         struct ip_vs_dest *dest;
         struct ip_vs_lblcr_entry *en;
 
-        ip_vs_fill_iph_addr_only(svc->af, skb, &iph);
-
         IP_VS_DBG(6, "%s(): Scheduling...\n", __func__);
 
         /* First look in our cache */
-        en = ip_vs_lblcr_get(svc->af, tbl, &iph.daddr);
+        en = ip_vs_lblcr_get(svc->af, tbl, &iph->daddr);
         if (en) {
                 en->lastuse = jiffies;
 
@@ -718,12 +706,12 @@ ip_vs_lblcr_schedule(struct ip_vs_service *svc, const struct sk_buff *skb)
         /* If we fail to create a cache entry, we'll just use the valid dest */
         spin_lock_bh(&svc->sched_lock);
         if (!tbl->dead)
-                ip_vs_lblcr_new(tbl, &iph.daddr, dest);
+                ip_vs_lblcr_new(tbl, &iph->daddr, dest);
         spin_unlock_bh(&svc->sched_lock);
 
 out:
         IP_VS_DBG_BUF(6, "LBLCR: destination IP address %s --> server %s:%d\n",
-                      IP_VS_DBG_ADDR(svc->af, &iph.daddr),
+                      IP_VS_DBG_ADDR(svc->af, &iph->daddr),
                       IP_VS_DBG_ADDR(svc->af, &dest->addr), ntohs(dest->port));
 
         return dest;
@@ -821,7 +809,7 @@ static void __exit ip_vs_lblcr_cleanup(void)
 {
         unregister_ip_vs_scheduler(&ip_vs_lblcr_scheduler);
         unregister_pernet_subsys(&ip_vs_lblcr_ops);
-        synchronize_rcu();
+        rcu_barrier();
 }
 
 
diff --git a/net/netfilter/ipvs/ip_vs_lc.c b/net/netfilter/ipvs/ip_vs_lc.c
index 5128e338a749..2bdcb1cf2127 100644
--- a/net/netfilter/ipvs/ip_vs_lc.c
+++ b/net/netfilter/ipvs/ip_vs_lc.c
@@ -26,7 +26,8 @@
  *      Least Connection scheduling
  */
 static struct ip_vs_dest *
-ip_vs_lc_schedule(struct ip_vs_service *svc, const struct sk_buff *skb)
+ip_vs_lc_schedule(struct ip_vs_service *svc, const struct sk_buff *skb,
+                  struct ip_vs_iphdr *iph)
 {
         struct ip_vs_dest *dest, *least = NULL;
         unsigned int loh = 0, doh;
diff --git a/net/netfilter/ipvs/ip_vs_nq.c b/net/netfilter/ipvs/ip_vs_nq.c
index 646cfd4baa73..961a6de9bb29 100644
--- a/net/netfilter/ipvs/ip_vs_nq.c
+++ b/net/netfilter/ipvs/ip_vs_nq.c
@@ -40,7 +40,7 @@
 #include <net/ip_vs.h>
 
 
-static inline unsigned int
+static inline int
 ip_vs_nq_dest_overhead(struct ip_vs_dest *dest)
 {
         /*
@@ -55,10 +55,11 @@ ip_vs_nq_dest_overhead(struct ip_vs_dest *dest)
  *      Weighted Least Connection scheduling
  */
 static struct ip_vs_dest *
-ip_vs_nq_schedule(struct ip_vs_service *svc, const struct sk_buff *skb)
+ip_vs_nq_schedule(struct ip_vs_service *svc, const struct sk_buff *skb,
+                  struct ip_vs_iphdr *iph)
 {
         struct ip_vs_dest *dest, *least = NULL;
-        unsigned int loh = 0, doh;
+        int loh = 0, doh;
 
         IP_VS_DBG(6, "%s(): Scheduling...\n", __func__);
 
@@ -91,8 +92,8 @@ ip_vs_nq_schedule(struct ip_vs_service *svc, const struct sk_buff *skb)
                 }
 
                 if (!least ||
-                    (loh * atomic_read(&dest->weight) >
-                     doh * atomic_read(&least->weight))) {
+                    ((__s64)loh * atomic_read(&dest->weight) >
+                     (__s64)doh * atomic_read(&least->weight))) {
                         least = dest;
                         loh = doh;
                 }
diff --git a/net/netfilter/ipvs/ip_vs_proto_sctp.c b/net/netfilter/ipvs/ip_vs_proto_sctp.c
index 86464881cd20..23e596e438b3 100644
--- a/net/netfilter/ipvs/ip_vs_proto_sctp.c
+++ b/net/netfilter/ipvs/ip_vs_proto_sctp.c
@@ -15,6 +15,7 @@ sctp_conn_schedule(int af, struct sk_buff *skb, struct ip_vs_proto_data *pd,
 {
         struct net *net;
         struct ip_vs_service *svc;
+        struct netns_ipvs *ipvs;
         sctp_chunkhdr_t _schunkh, *sch;
         sctp_sctphdr_t *sh, _sctph;
 
@@ -27,13 +28,14 @@ sctp_conn_schedule(int af, struct sk_buff *skb, struct ip_vs_proto_data *pd,
         if (sch == NULL)
                 return 0;
         net = skb_net(skb);
+        ipvs = net_ipvs(net);
         rcu_read_lock();
-        if ((sch->type == SCTP_CID_INIT) &&
+        if ((sch->type == SCTP_CID_INIT || sysctl_sloppy_sctp(ipvs)) &&
             (svc = ip_vs_service_find(net, af, skb->mark, iph->protocol,
                                       &iph->daddr, sh->dest))) {
                 int ignored;
 
-                if (ip_vs_todrop(net_ipvs(net))) {
+                if (ip_vs_todrop(ipvs)) {
                         /*
                          * It seems that we are very loaded.
                          * We have to drop this packet :(
@@ -64,15 +66,7 @@ sctp_conn_schedule(int af, struct sk_buff *skb, struct ip_vs_proto_data *pd,
 static void sctp_nat_csum(struct sk_buff *skb, sctp_sctphdr_t *sctph,
                           unsigned int sctphoff)
 {
-        __u32 crc32;
-        struct sk_buff *iter;
-
-        crc32 = sctp_start_cksum((__u8 *)sctph, skb_headlen(skb) - sctphoff);
-        skb_walk_frags(skb, iter)
-                crc32 = sctp_update_cksum((u8 *) iter->data,
-                                          skb_headlen(iter), crc32);
-        sctph->checksum = sctp_end_cksum(crc32);
-
+        sctph->checksum = sctp_compute_cksum(skb, sctphoff);
         skb->ip_summed = CHECKSUM_UNNECESSARY;
 }
 
@@ -149,10 +143,7 @@ sctp_csum_check(int af, struct sk_buff *skb, struct ip_vs_protocol *pp)
 {
         unsigned int sctphoff;
         struct sctphdr *sh, _sctph;
-        struct sk_buff *iter;
-        __le32 cmp;
-        __le32 val;
-        __u32 tmp;
+        __le32 cmp, val;
 
 #ifdef CONFIG_IP_VS_IPV6
         if (af == AF_INET6)
@@ -166,13 +157,7 @@ sctp_csum_check(int af, struct sk_buff *skb, struct ip_vs_protocol *pp)
                 return 0;
 
         cmp = sh->checksum;
-
-        tmp = sctp_start_cksum((__u8 *) sh, skb_headlen(skb));
-        skb_walk_frags(skb, iter)
-                tmp = sctp_update_cksum((__u8 *) iter->data,
-                                        skb_headlen(iter), tmp);
-
-        val = sctp_end_cksum(tmp);
+        val = sctp_compute_cksum(skb, sctphoff);
 
         if (val != cmp) {
                 /* CRC failure, dump it. */
@@ -183,710 +168,159 @@ sctp_csum_check(int af, struct sk_buff *skb, struct ip_vs_protocol *pp)
         return 1;
 }
 
-struct ipvs_sctp_nextstate {
-        int next_state;
-};
 enum ipvs_sctp_event_t {
-        IP_VS_SCTP_EVE_DATA_CLI,
-        IP_VS_SCTP_EVE_DATA_SER,
-        IP_VS_SCTP_EVE_INIT_CLI,
-        IP_VS_SCTP_EVE_INIT_SER,
-        IP_VS_SCTP_EVE_INIT_ACK_CLI,
-        IP_VS_SCTP_EVE_INIT_ACK_SER,
-        IP_VS_SCTP_EVE_COOKIE_ECHO_CLI,
-        IP_VS_SCTP_EVE_COOKIE_ECHO_SER,
-        IP_VS_SCTP_EVE_COOKIE_ACK_CLI,
-        IP_VS_SCTP_EVE_COOKIE_ACK_SER,
-        IP_VS_SCTP_EVE_ABORT_CLI,
-        IP_VS_SCTP_EVE__ABORT_SER,
-        IP_VS_SCTP_EVE_SHUT_CLI,
-        IP_VS_SCTP_EVE_SHUT_SER,
-        IP_VS_SCTP_EVE_SHUT_ACK_CLI,
-        IP_VS_SCTP_EVE_SHUT_ACK_SER,
-        IP_VS_SCTP_EVE_SHUT_COM_CLI,
-        IP_VS_SCTP_EVE_SHUT_COM_SER,
-        IP_VS_SCTP_EVE_LAST
+        IP_VS_SCTP_DATA = 0,            /* DATA, SACK, HEARTBEATs */
+        IP_VS_SCTP_INIT,
+        IP_VS_SCTP_INIT_ACK,
+        IP_VS_SCTP_COOKIE_ECHO,
+        IP_VS_SCTP_COOKIE_ACK,
+        IP_VS_SCTP_SHUTDOWN,
+        IP_VS_SCTP_SHUTDOWN_ACK,
+        IP_VS_SCTP_SHUTDOWN_COMPLETE,
+        IP_VS_SCTP_ERROR,
+        IP_VS_SCTP_ABORT,
+        IP_VS_SCTP_EVENT_LAST
 };
 
-static enum ipvs_sctp_event_t sctp_events[256] = {
-        IP_VS_SCTP_EVE_DATA_CLI,
-        IP_VS_SCTP_EVE_INIT_CLI,
-        IP_VS_SCTP_EVE_INIT_ACK_CLI,
-        IP_VS_SCTP_EVE_DATA_CLI,
-        IP_VS_SCTP_EVE_DATA_CLI,
-        IP_VS_SCTP_EVE_DATA_CLI,
-        IP_VS_SCTP_EVE_ABORT_CLI,
-        IP_VS_SCTP_EVE_SHUT_CLI,
-        IP_VS_SCTP_EVE_SHUT_ACK_CLI,
-        IP_VS_SCTP_EVE_DATA_CLI,
-        IP_VS_SCTP_EVE_COOKIE_ECHO_CLI,
-        IP_VS_SCTP_EVE_COOKIE_ACK_CLI,
-        IP_VS_SCTP_EVE_DATA_CLI,
-        IP_VS_SCTP_EVE_DATA_CLI,
-        IP_VS_SCTP_EVE_SHUT_COM_CLI,
+/* RFC 2960, 3.2 Chunk Field Descriptions */
+static __u8 sctp_events[] = {
+        [SCTP_CID_DATA]                 = IP_VS_SCTP_DATA,
+        [SCTP_CID_INIT]                 = IP_VS_SCTP_INIT,
+        [SCTP_CID_INIT_ACK]             = IP_VS_SCTP_INIT_ACK,
+        [SCTP_CID_SACK]                 = IP_VS_SCTP_DATA,
+        [SCTP_CID_HEARTBEAT]            = IP_VS_SCTP_DATA,
+        [SCTP_CID_HEARTBEAT_ACK]        = IP_VS_SCTP_DATA,
+        [SCTP_CID_ABORT]                = IP_VS_SCTP_ABORT,
+        [SCTP_CID_SHUTDOWN]             = IP_VS_SCTP_SHUTDOWN,
+        [SCTP_CID_SHUTDOWN_ACK]         = IP_VS_SCTP_SHUTDOWN_ACK,
+        [SCTP_CID_ERROR]                = IP_VS_SCTP_ERROR,
+        [SCTP_CID_COOKIE_ECHO]          = IP_VS_SCTP_COOKIE_ECHO,
+        [SCTP_CID_COOKIE_ACK]           = IP_VS_SCTP_COOKIE_ACK,
+        [SCTP_CID_ECN_ECNE]             = IP_VS_SCTP_DATA,
+        [SCTP_CID_ECN_CWR]              = IP_VS_SCTP_DATA,
+        [SCTP_CID_SHUTDOWN_COMPLETE]    = IP_VS_SCTP_SHUTDOWN_COMPLETE,
 };
 
-static struct ipvs_sctp_nextstate
- sctp_states_table[IP_VS_SCTP_S_LAST][IP_VS_SCTP_EVE_LAST] = {
-        /*
-         * STATE : IP_VS_SCTP_S_NONE
-         */
-        /*next state *//*event */
-        {{IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_DATA_CLI */ },
-         {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_DATA_SER */ },
-         {IP_VS_SCTP_S_INIT_CLI /* IP_VS_SCTP_EVE_INIT_CLI */ },
-         {IP_VS_SCTP_S_INIT_SER /* IP_VS_SCTP_EVE_INIT_SER */ },
-         {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_INIT_ACK_CLI */ },
-         {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_INIT_ACK_SER */ },
-         {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_COOKIE_ECHO_CLI */ },
-         {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_COOKIE_ECHO_SER */ },
-         {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_COOKIE_ACK_CLI */ },
-         {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_COOKIE_ACK_SER */ },
-         {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_ABORT_CLI */ },
-         {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_ABORT_SER */ },
-         {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_SHUT_CLI */ },
-         {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_SHUT_SER */ },
-         {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_SHUT_ACK_CLI */ },
-         {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_SHUT_ACK_SER */ },
-         {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_SHUT_COM_CLI */ },
-         {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_SHUT_COM_SER */ },
-         },
-        /*
-         * STATE : IP_VS_SCTP_S_INIT_CLI
-         * Cient sent INIT and is waiting for reply from server(In ECHO_WAIT)
-         */
-        {{IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_DATA_CLI */ },
-         {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_DATA_SER */ },
-         {IP_VS_SCTP_S_INIT_CLI /* IP_VS_SCTP_EVE_INIT_CLI */ },
-         {IP_VS_SCTP_S_INIT_SER /* IP_VS_SCTP_EVE_INIT_SER */ },
-         {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_INIT_ACK_CLI */ },
-         {IP_VS_SCTP_S_INIT_ACK_SER /* IP_VS_SCTP_EVE_INIT_ACK_SER */ },
-         {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_ECHO_CLI */ },
-         {IP_VS_SCTP_S_INIT_CLI /* IP_VS_SCTP_EVE_ECHO_SER */ },
-         {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_COOKIE_ACK_CLI */ },
-         {IP_VS_SCTP_S_INIT_CLI /* IP_VS_SCTP_EVE_COOKIE_ACK_SER */ },
-         {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_ABORT_CLI */ },
-         {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_ABORT_SER */ },
-         {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_SHUT_CLI */ },
-         {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_SHUT_SER */ },
-         {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_SHUT_ACK_CLI */ },
-         {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_SHUT_ACK_SER */ },
-         {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_SHUT_COM_CLI */ },
-         {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_SHUT_COM_SER */ }
-         },
-        /*
-         * State : IP_VS_SCTP_S_INIT_SER
-         * Server sent INIT and waiting for INIT ACK from the client
-         */
-        {{IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_DATA_CLI */ },
-         {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_DATA_SER */ },
-         {IP_VS_SCTP_S_INIT_CLI /* IP_VS_SCTP_EVE_INIT_CLI */ },
-         {IP_VS_SCTP_S_INIT_SER /* IP_VS_SCTP_EVE_INIT_SER */ },
-         {IP_VS_SCTP_S_INIT_ACK_CLI /* IP_VS_SCTP_EVE_INIT_ACK_CLI */ },
-         {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_INIT_ACK_SER */ },
-         {IP_VS_SCTP_S_INIT_SER /* IP_VS_SCTP_EVE_COOKIE_ECHO_CLI */ },
-         {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_COOKIE_ECHO_SER */ },
-         {IP_VS_SCTP_S_INIT_SER /* IP_VS_SCTP_EVE_COOKIE_ACK_CLI */ },
-         {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_COOKIE_ACK_SER */ },
-         {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_ABORT_CLI */ },
-         {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_ABORT_SER */ },
-         {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_SHUT_CLI */ },
-         {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_SHUT_SER */ },
-         {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_SHUT_ACK_CLI */ },
-         {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_SHUT_ACK_SER */ },
-         {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_SHUT_COM_CLI */ },
-         {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_SHUT_COM_SER */ }
-         },
-        /*
-         * State : IP_VS_SCTP_S_INIT_ACK_CLI
-         * Client sent INIT ACK and waiting for ECHO from the server
-         */
-        {{IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_DATA_CLI */ },
-         {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_DATA_SER */ },
-         /*
-          * We have got an INIT from client. From the spec.“Upon receipt of
-          * an INIT in the COOKIE-WAIT state, an endpoint MUST respond with
-          * an INIT ACK using the same parameters it sent in its  original
-          * INIT chunk (including its Initiate Tag, unchanged”).
-          */
-         {IP_VS_SCTP_S_INIT_CLI /* IP_VS_SCTP_EVE_INIT_CLI */ },
-         {IP_VS_SCTP_S_INIT_SER /* IP_VS_SCTP_EVE_INIT_SER */ },
-         /*
-          * INIT_ACK has been resent by the client, let us stay is in
-          * the same state
-          */
-         {IP_VS_SCTP_S_INIT_ACK_CLI /* IP_VS_SCTP_EVE_INIT_ACK_CLI */ },
-         /*
-          * INIT_ACK sent by the server, close the connection
-          */
-         {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_INIT_ACK_SER */ },
-         /*
-          * ECHO by client, it should not happen, close the connection
-          */
-         {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_COOKIE_ECHO_CLI */ },
-         /*
-          * ECHO by server, this is what we are expecting, move to ECHO_SER
-          */
-         {IP_VS_SCTP_S_ECHO_SER /* IP_VS_SCTP_EVE_COOKIE_ECHO_SER */ },
-         /*
-          * COOKIE ACK from client, it should not happen, close the connection
-          */
-         {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_COOKIE_ACK_CLI */ },
-         /*
-          * Unexpected COOKIE ACK from server, staty in the same state
-          */
-         {IP_VS_SCTP_S_INIT_ACK_CLI /* IP_VS_SCTP_EVE_COOKIE_ACK_SER */ },
-         {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_ABORT_CLI */ },
-         {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_ABORT_SER */ },
-         {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_SHUT_CLI */ },
-         {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_SHUT_SER */ },
-         {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_SHUT_ACK_CLI */ },
-         {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_SHUT_ACK_SER */ },
-         {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_SHUT_COM_CLI */ },
-         {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_SHUT_COM_SER */ }
-         },
-        /*
-         * State : IP_VS_SCTP_S_INIT_ACK_SER
-         * Server sent INIT ACK and waiting for ECHO from the client
-         */
-        {{IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_DATA_CLI */ },
-         {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_DATA_SER */ },
-         /*
-          * We have got an INIT from client. From the spec.“Upon receipt of
-          * an INIT in the COOKIE-WAIT state, an endpoint MUST respond with
-          * an INIT ACK using the same parameters it sent in its  original
-          * INIT chunk (including its Initiate Tag, unchanged”).
-          */
-         {IP_VS_SCTP_S_INIT_CLI /* IP_VS_SCTP_EVE_INIT_CLI */ },
-         {IP_VS_SCTP_S_INIT_SER /* IP_VS_SCTP_EVE_INIT_SER */ },
-         /*
-          * Unexpected INIT_ACK by the client, let us close the connection
-          */
-         {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_INIT_ACK_CLI */ },
-         /*
-          * INIT_ACK resent by the server, let us move to same state
-          */
-         {IP_VS_SCTP_S_INIT_ACK_SER /* IP_VS_SCTP_EVE_INIT_ACK_SER */ },
-         /*
-          * Client send the ECHO, this is what we are expecting,
-          * move to ECHO_CLI
-          */
-         {IP_VS_SCTP_S_ECHO_CLI /* IP_VS_SCTP_EVE_COOKIE_ECHO_CLI */ },
-         /*
-          * ECHO received from the server, Not sure what to do,
-          * let us close it
-          */
-         {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_COOKIE_ECHO_SER */ },
-         /*
-          * COOKIE ACK from client, let us stay in the same state
-          */
-         {IP_VS_SCTP_S_INIT_ACK_SER /* IP_VS_SCTP_EVE_COOKIE_ACK_CLI */ },
-         /*
-          * COOKIE ACK from server, hmm... this should not happen, lets close
-          * the connection.
-          */
-         {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_COOKIE_ACK_SER */ },
-         {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_ABORT_CLI */ },
-         {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_ABORT_SER */ },
-         {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_SHUT_CLI */ },
-         {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_SHUT_SER */ },
-         {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_SHUT_ACK_CLI */ },
-         {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_SHUT_ACK_SER */ },
-         {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_SHUT_COM_CLI */ },
-         {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_SHUT_COM_SER */ }
-         },
-        /*
-         * State : IP_VS_SCTP_S_ECHO_CLI
-         * Cient  sent ECHO and waiting COOKEI ACK from the Server
-         */
-        {{IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_DATA_CLI */ },
-         {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_DATA_SER */ },
-         /*
-          * We have got an INIT from client. From the spec.“Upon receipt of
-          * an INIT in the COOKIE-WAIT state, an endpoint MUST respond with
-          * an INIT ACK using the same parameters it sent in its  original
-          * INIT chunk (including its Initiate Tag, unchanged”).
-          */
-         {IP_VS_SCTP_S_INIT_CLI /* IP_VS_SCTP_EVE_INIT_CLI */ },
-         {IP_VS_SCTP_S_INIT_SER /* IP_VS_SCTP_EVE_INIT_SER */ },
-         /*
-          * INIT_ACK has been by the client, let us close the connection
-          */
-         {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_INIT_ACK_CLI */ },
-         /*
-          * INIT_ACK sent by the server, Unexpected INIT ACK, spec says,
-          * “If an INIT ACK is received by an endpoint in any state other
-          * than the COOKIE-WAIT state, the endpoint should discard the
-          * INIT ACK chunk”. Stay in the same state
-          */
-         {IP_VS_SCTP_S_ECHO_CLI /* IP_VS_SCTP_EVE_INIT_ACK_SER */ },
-         /*
-          * Client resent the ECHO, let us stay in the same state
-          */
-         {IP_VS_SCTP_S_ECHO_CLI /* IP_VS_SCTP_EVE_COOKIE_ECHO_CLI */ },
-         /*
-          * ECHO received from the server, Not sure what to do,
-          * let us close it
-          */
-         {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_COOKIE_ECHO_SER */ },
-         /*
-          * COOKIE ACK from client, this shoud not happen, let's close the
-          * connection
-          */
-         {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_COOKIE_ACK_CLI */ },
-         /*
-          * COOKIE ACK from server, this is what we are awaiting,lets move to
-          * ESTABLISHED.
-          */
-         {IP_VS_SCTP_S_ESTABLISHED /* IP_VS_SCTP_EVE_COOKIE_ACK_SER */ },
-         {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_ABORT_CLI */ },
-         {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_ABORT_SER */ },
-         {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_SHUT_CLI */ },
-         {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_SHUT_SER */ },
-         {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_SHUT_ACK_CLI */ },
-         {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_SHUT_ACK_SER */ },
-         {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_SHUT_COM_CLI */ },
-         {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_SHUT_COM_SER */ }
-         },
-        /*
-         * State : IP_VS_SCTP_S_ECHO_SER
-         * Server sent ECHO and waiting COOKEI ACK from the client
-         */
-        {{IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_DATA_CLI */ },
-         {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_DATA_SER */ },
-         /*
-          * We have got an INIT from client. From the spec.“Upon receipt of
-          * an INIT in the COOKIE-WAIT state, an endpoint MUST respond with
-          * an INIT ACK using the same parameters it sent in its  original
-          * INIT chunk (including its Initiate Tag, unchanged”).
-          */
-         {IP_VS_SCTP_S_INIT_CLI /* IP_VS_SCTP_EVE_INIT_CLI */ },
-         {IP_VS_SCTP_S_INIT_SER /* IP_VS_SCTP_EVE_INIT_SER */ },
-         /*
-          * INIT_ACK sent by the server, Unexpected INIT ACK, spec says,
-          * “If an INIT ACK is received by an endpoint in any state other
-          * than the COOKIE-WAIT state, the endpoint should discard the
-          * INIT ACK chunk”. Stay in the same state
-          */
-         {IP_VS_SCTP_S_ECHO_SER /* IP_VS_SCTP_EVE_INIT_ACK_CLI */ },
-         /*
-          * INIT_ACK has been by the server, let us close the connection
-          */
-         {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_INIT_ACK_SER */ },
-         /*
-          * Client sent the ECHO, not sure what to do, let's close the
-          * connection.
-          */
-         {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_COOKIE_ECHO_CLI */ },
-         /*
-          * ECHO resent by the server, stay in the same state
-          */
-         {IP_VS_SCTP_S_ECHO_SER /* IP_VS_SCTP_EVE_COOKIE_ECHO_SER */ },
-         /*
-          * COOKIE ACK from client, this is what we are expecting, let's move
-          * to ESTABLISHED.
-          */
-         {IP_VS_SCTP_S_ESTABLISHED /* IP_VS_SCTP_EVE_COOKIE_ACK_CLI */ },
-         /*
-          * COOKIE ACK from server, this should not happen, lets close the
-          * connection.
-          */
-         {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_COOKIE_ACK_SER */ },
-         {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_ABORT_CLI */ },
-         {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_ABORT_SER */ },
-         {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_SHUT_CLI */ },
-         {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_SHUT_SER */ },
-         {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_SHUT_ACK_CLI */ },
-         {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_SHUT_ACK_SER */ },
-         {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_SHUT_COM_CLI */ },
-         {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_SHUT_COM_SER */ }
-         },
-        /*
-         * State : IP_VS_SCTP_S_ESTABLISHED
-         * Association established
-         */
-        {{IP_VS_SCTP_S_ESTABLISHED /* IP_VS_SCTP_EVE_DATA_CLI */ },
-         {IP_VS_SCTP_S_ESTABLISHED /* IP_VS_SCTP_EVE_DATA_SER */ },
-         /*
-          * We have got an INIT from client. From the spec.“Upon receipt of
-          * an INIT in the COOKIE-WAIT state, an endpoint MUST respond with
-          * an INIT ACK using the same parameters it sent in its  original
-          * INIT chunk (including its Initiate Tag, unchanged”).
-          */
-         {IP_VS_SCTP_S_INIT_CLI /* IP_VS_SCTP_EVE_INIT_CLI */ },
-         {IP_VS_SCTP_S_INIT_SER /* IP_VS_SCTP_EVE_INIT_SER */ },
-         /*
-          * INIT_ACK sent by the server, Unexpected INIT ACK, spec says,
-          * “If an INIT ACK is received by an endpoint in any state other
-          * than the COOKIE-WAIT state, the endpoint should discard the
-          * INIT ACK chunk”. Stay in the same state
-          */
-         {IP_VS_SCTP_S_ESTABLISHED /* IP_VS_SCTP_EVE_INIT_ACK_CLI */ },
-         {IP_VS_SCTP_S_ESTABLISHED /* IP_VS_SCTP_EVE_INIT_ACK_SER */ },
-         /*
-          * Client sent ECHO, Spec(sec 5.2.4) says it may be handled by the
-          * peer and peer shall move to the ESTABISHED. if it doesn't handle
-          * it will send ERROR chunk. So, stay in the same state
-          */
-         {IP_VS_SCTP_S_ESTABLISHED /* IP_VS_SCTP_EVE_COOKIE_ECHO_CLI */ },
-         {IP_VS_SCTP_S_ESTABLISHED /* IP_VS_SCTP_EVE_COOKIE_ECHO_SER */ },
-         /*
-          * COOKIE ACK from client, not sure what to do stay in the same state
-          */
-         {IP_VS_SCTP_S_ESTABLISHED /* IP_VS_SCTP_EVE_COOKIE_ACK_CLI */ },
-         {IP_VS_SCTP_S_ESTABLISHED /* IP_VS_SCTP_EVE_COOKIE_ACK_SER */ },
-         {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_ABORT_CLI */ },
-         {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_ABORT_SER */ },
-         /*
-          * SHUTDOWN from the client, move to SHUDDOWN_CLI
-          */
-         {IP_VS_SCTP_S_SHUT_CLI /* IP_VS_SCTP_EVE_SHUT_CLI */ },
-         /*
-          * SHUTDOWN from the server, move to SHUTDOWN_SER
-          */
-         {IP_VS_SCTP_S_SHUT_SER /* IP_VS_SCTP_EVE_SHUT_SER */ },
-         /*
-          * client sent SHUDTDOWN_ACK, this should not happen, let's close
-          * the connection
-          */
-         {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_SHUT_ACK_CLI */ },
-         {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_SHUT_ACK_SER */ },
-         {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_SHUT_COM_CLI */ },
-         {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_SHUT_COM_SER */ }
-         },
-        /*
-         * State : IP_VS_SCTP_S_SHUT_CLI
-         * SHUTDOWN sent from the client, waitinf for SHUT ACK from the server
-         */
-        /*
-         * We received the data chuck, keep the state unchanged. I assume
-         * that still data chuncks  can be received by both the peers in
-         * SHUDOWN state
-         */
-
-        {{IP_VS_SCTP_S_SHUT_CLI /* IP_VS_SCTP_EVE_DATA_CLI */ },
-         {IP_VS_SCTP_S_SHUT_CLI /* IP_VS_SCTP_EVE_DATA_SER */ },
-         /*
-          * We have got an INIT from client. From the spec.“Upon receipt of
-          * an INIT in the COOKIE-WAIT state, an endpoint MUST respond with
-          * an INIT ACK using the same parameters it sent in its  original
-          * INIT chunk (including its Initiate Tag, unchanged”).
-          */
-         {IP_VS_SCTP_S_INIT_CLI /* IP_VS_SCTP_EVE_INIT_CLI */ },
-         {IP_VS_SCTP_S_INIT_SER /* IP_VS_SCTP_EVE_INIT_SER */ },
-         /*
-          * INIT_ACK sent by the server, Unexpected INIT ACK, spec says,
-          * “If an INIT ACK is received by an endpoint in any state other
-          * than the COOKIE-WAIT state, the endpoint should discard the
-          * INIT ACK chunk”. Stay in the same state
-          */
-         {IP_VS_SCTP_S_SHUT_CLI /* IP_VS_SCTP_EVE_INIT_ACK_CLI */ },
-         {IP_VS_SCTP_S_SHUT_CLI /* IP_VS_SCTP_EVE_INIT_ACK_SER */ },
-         /*
-          * Client sent ECHO, Spec(sec 5.2.4) says it may be handled by the
-          * peer and peer shall move to the ESTABISHED. if it doesn't handle
-          * it will send ERROR chunk. So, stay in the same state
-          */
-         {IP_VS_SCTP_S_ESTABLISHED /* IP_VS_SCTP_EVE_COOKIE_ECHO_CLI */ },
-         {IP_VS_SCTP_S_ESTABLISHED /* IP_VS_SCTP_EVE_COOKIE_ECHO_SER */ },
-         /*
-          * COOKIE ACK from client, not sure what to do stay in the same state
-          */
-         {IP_VS_SCTP_S_SHUT_CLI /* IP_VS_SCTP_EVE_COOKIE_ACK_CLI */ },
-         {IP_VS_SCTP_S_SHUT_CLI /* IP_VS_SCTP_EVE_COOKIE_ACK_SER */ },
-         {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_ABORT_CLI */ },
-         {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_ABORT_SER */ },
-         /*
-          * SHUTDOWN resent from the client, move to SHUDDOWN_CLI
-          */
-         {IP_VS_SCTP_S_SHUT_CLI /* IP_VS_SCTP_EVE_SHUT_CLI */ },
-         /*
-          * SHUTDOWN from the server, move to SHUTDOWN_SER
-          */
-         {IP_VS_SCTP_S_SHUT_SER /* IP_VS_SCTP_EVE_SHUT_SER */ },
-         /*
-          * client sent SHUDTDOWN_ACK, this should not happen, let's close
-          * the connection
-          */
-         {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_SHUT_ACK_CLI */ },
-         /*
-          * Server sent SHUTDOWN ACK, this is what we are expecting, let's move
-          * to SHUDOWN_ACK_SER
-          */
-         {IP_VS_SCTP_S_SHUT_ACK_SER /* IP_VS_SCTP_EVE_SHUT_ACK_SER */ },
-         /*
-          * SHUTDOWN COM from client, this should not happen, let's close the
-          * connection
-          */
-         {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_SHUT_COM_CLI */ },
-         {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_SHUT_COM_SER */ }
-         },
-        /*
-         * State : IP_VS_SCTP_S_SHUT_SER
-         * SHUTDOWN sent from the server, waitinf for SHUTDOWN ACK from client
-         */
-        /*
-         * We received the data chuck, keep the state unchanged. I assume
-         * that still data chuncks  can be received by both the peers in
-         * SHUDOWN state
-         */
-
-        {{IP_VS_SCTP_S_SHUT_SER /* IP_VS_SCTP_EVE_DATA_CLI */ },
-         {IP_VS_SCTP_S_SHUT_SER /* IP_VS_SCTP_EVE_DATA_SER */ },
-         /*
-          * We have got an INIT from client. From the spec.“Upon receipt of
-          * an INIT in the COOKIE-WAIT state, an endpoint MUST respond with
-          * an INIT ACK using the same parameters it sent in its  original
-          * INIT chunk (including its Initiate Tag, unchanged”).
-          */
-         {IP_VS_SCTP_S_INIT_CLI /* IP_VS_SCTP_EVE_INIT_CLI */ },
-         {IP_VS_SCTP_S_INIT_SER /* IP_VS_SCTP_EVE_INIT_SER */ },
-         /*
-          * INIT_ACK sent by the server, Unexpected INIT ACK, spec says,
-          * “If an INIT ACK is received by an endpoint in any state other
-          * than the COOKIE-WAIT state, the endpoint should discard the
-          * INIT ACK chunk”. Stay in the same state
-          */
-         {IP_VS_SCTP_S_SHUT_SER /* IP_VS_SCTP_EVE_INIT_ACK_CLI */ },
-         {IP_VS_SCTP_S_SHUT_SER /* IP_VS_SCTP_EVE_INIT_ACK_SER */ },
-         /*
-          * Client sent ECHO, Spec(sec 5.2.4) says it may be handled by the
-          * peer and peer shall move to the ESTABISHED. if it doesn't handle
-          * it will send ERROR chunk. So, stay in the same state
-          */
-         {IP_VS_SCTP_S_ESTABLISHED /* IP_VS_SCTP_EVE_COOKIE_ECHO_CLI */ },
-         {IP_VS_SCTP_S_ESTABLISHED /* IP_VS_SCTP_EVE_COOKIE_ECHO_SER */ },
-         /*
-          * COOKIE ACK from client, not sure what to do stay in the same state
-          */
-         {IP_VS_SCTP_S_SHUT_SER /* IP_VS_SCTP_EVE_COOKIE_ACK_CLI */ },
-         {IP_VS_SCTP_S_SHUT_SER /* IP_VS_SCTP_EVE_COOKIE_ACK_SER */ },
-         {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_ABORT_CLI */ },
-         {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_ABORT_SER */ },
-         /*
-          * SHUTDOWN resent from the client, move to SHUDDOWN_CLI
-          */
-         {IP_VS_SCTP_S_SHUT_CLI /* IP_VS_SCTP_EVE_SHUT_CLI */ },
-         /*
-          * SHUTDOWN resent from the server, move to SHUTDOWN_SER
-          */
-         {IP_VS_SCTP_S_SHUT_SER /* IP_VS_SCTP_EVE_SHUT_SER */ },
-         /*
-          * client sent SHUDTDOWN_ACK, this is what we are expecting, let's
-          * move to SHUT_ACK_CLI
-          */
-         {IP_VS_SCTP_S_SHUT_ACK_CLI /* IP_VS_SCTP_EVE_SHUT_ACK_CLI */ },
-         /*
-          * Server sent SHUTDOWN ACK, this should not happen, let's close the
-          * connection
-          */
-         {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_SHUT_ACK_SER */ },
-         /*
-          * SHUTDOWN COM from client, this should not happen, let's close the
-          * connection
-          */
-         {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_SHUT_COM_CLI */ },
-         {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_SHUT_COM_SER */ }
-         },
-
-        /*
-         * State : IP_VS_SCTP_S_SHUT_ACK_CLI
-         * SHUTDOWN ACK from the client, awaiting for SHUTDOWN COM from server
-         */
-        /*
-         * We received the data chuck, keep the state unchanged. I assume
-         * that still data chuncks  can be received by both the peers in
-         * SHUDOWN state
-         */
-
-        {{IP_VS_SCTP_S_SHUT_ACK_CLI /* IP_VS_SCTP_EVE_DATA_CLI */ },
-         {IP_VS_SCTP_S_SHUT_ACK_CLI /* IP_VS_SCTP_EVE_DATA_SER */ },
-         /*
-          * We have got an INIT from client. From the spec.“Upon receipt of
-          * an INIT in the COOKIE-WAIT state, an endpoint MUST respond with
-          * an INIT ACK using the same parameters it sent in its  original
-          * INIT chunk (including its Initiate Tag, unchanged”).
-          */
-         {IP_VS_SCTP_S_INIT_CLI /* IP_VS_SCTP_EVE_INIT_CLI */ },
-         {IP_VS_SCTP_S_INIT_SER /* IP_VS_SCTP_EVE_INIT_SER */ },
-         /*
-          * INIT_ACK sent by the server, Unexpected INIT ACK, spec says,
-          * “If an INIT ACK is received by an endpoint in any state other
-          * than the COOKIE-WAIT state, the endpoint should discard the
-          * INIT ACK chunk”. Stay in the same state
-          */
-         {IP_VS_SCTP_S_SHUT_ACK_CLI /* IP_VS_SCTP_EVE_INIT_ACK_CLI */ },
-         {IP_VS_SCTP_S_SHUT_ACK_CLI /* IP_VS_SCTP_EVE_INIT_ACK_SER */ },
-         /*
-          * Client sent ECHO, Spec(sec 5.2.4) says it may be handled by the
-          * peer and peer shall move to the ESTABISHED. if it doesn't handle
-          * it will send ERROR chunk. So, stay in the same state
-          */
-         {IP_VS_SCTP_S_ESTABLISHED /* IP_VS_SCTP_EVE_COOKIE_ECHO_CLI */ },
-         {IP_VS_SCTP_S_ESTABLISHED /* IP_VS_SCTP_EVE_COOKIE_ECHO_SER */ },
-         /*
-          * COOKIE ACK from client, not sure what to do stay in the same state
-          */
-         {IP_VS_SCTP_S_SHUT_ACK_CLI /* IP_VS_SCTP_EVE_COOKIE_ACK_CLI */ },
-         {IP_VS_SCTP_S_SHUT_ACK_CLI /* IP_VS_SCTP_EVE_COOKIE_ACK_SER */ },
-         {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_ABORT_CLI */ },
-         {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_ABORT_SER */ },
-         /*
-          * SHUTDOWN sent from the client, move to SHUDDOWN_CLI
-          */
-         {IP_VS_SCTP_S_SHUT_CLI /* IP_VS_SCTP_EVE_SHUT_CLI */ },
-         /*
-          * SHUTDOWN sent from the server, move to SHUTDOWN_SER
-          */
-         {IP_VS_SCTP_S_SHUT_SER /* IP_VS_SCTP_EVE_SHUT_SER */ },
-         /*
-          * client resent SHUDTDOWN_ACK, let's stay in the same state
-          */
-         {IP_VS_SCTP_S_SHUT_ACK_CLI /* IP_VS_SCTP_EVE_SHUT_ACK_CLI */ },
-         /*
-          * Server sent SHUTDOWN ACK, this should not happen, let's close the
-          * connection
-          */
-         {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_SHUT_ACK_SER */ },
-         /*
-          * SHUTDOWN COM from client, this should not happen, let's close the
-          * connection
-          */
-         {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_SHUT_COM_CLI */ },
-         /*
-          * SHUTDOWN COMPLETE from server this is what we are expecting.
-          */
-         {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_SHUT_COM_SER */ }
-         },
-
-        /*
-         * State : IP_VS_SCTP_S_SHUT_ACK_SER
-         * SHUTDOWN ACK from the server, awaiting for SHUTDOWN COM from client
-         */
-        /*
-         * We received the data chuck, keep the state unchanged. I assume
-         * that still data chuncks  can be received by both the peers in
-         * SHUDOWN state
-         */
+/* SCTP States:
+ * See RFC 2960, 4. SCTP Association State Diagram
+ *
+ * New states (not in diagram):
+ * - INIT1 state: use shorter timeout for dropped INIT packets
+ * - REJECTED state: use shorter timeout if INIT is rejected with ABORT
+ * - INIT, COOKIE_SENT, COOKIE_REPLIED, COOKIE states: for better debugging
+ *
+ * The states are as seen in real server. In the diagram, INIT1, INIT,
+ * COOKIE_SENT and COOKIE_REPLIED processing happens in CLOSED state.
+ *
+ * States as per packets from client (C) and server (S):
+ *
+ * Setup of client connection:
+ * IP_VS_SCTP_S_INIT1: First C:INIT sent, wait for S:INIT-ACK
+ * IP_VS_SCTP_S_INIT: Next C:INIT sent, wait for S:INIT-ACK
+ * IP_VS_SCTP_S_COOKIE_SENT: S:INIT-ACK sent, wait for C:COOKIE-ECHO
+ * IP_VS_SCTP_S_COOKIE_REPLIED: C:COOKIE-ECHO sent, wait for S:COOKIE-ACK
+ *
+ * Setup of server connection:
+ * IP_VS_SCTP_S_COOKIE_WAIT: S:INIT sent, wait for C:INIT-ACK
+ * IP_VS_SCTP_S_COOKIE: C:INIT-ACK sent, wait for S:COOKIE-ECHO
+ * IP_VS_SCTP_S_COOKIE_ECHOED: S:COOKIE-ECHO sent, wait for C:COOKIE-ACK
+ */
 
-        {{IP_VS_SCTP_S_SHUT_ACK_SER /* IP_VS_SCTP_EVE_DATA_CLI */ },
-         {IP_VS_SCTP_S_SHUT_ACK_SER /* IP_VS_SCTP_EVE_DATA_SER */ },
-         /*
-          * We have got an INIT from client. From the spec.“Upon receipt of
-          * an INIT in the COOKIE-WAIT state, an endpoint MUST respond with
-          * an INIT ACK using the same parameters it sent in its  original
-          * INIT chunk (including its Initiate Tag, unchanged”).
-          */
-         {IP_VS_SCTP_S_INIT_CLI /* IP_VS_SCTP_EVE_INIT_CLI */ },
-         {IP_VS_SCTP_S_INIT_SER /* IP_VS_SCTP_EVE_INIT_SER */ },
-         /*
-          * INIT_ACK sent by the server, Unexpected INIT ACK, spec says,
-          * “If an INIT ACK is received by an endpoint in any state other
-          * than the COOKIE-WAIT state, the endpoint should discard the
-          * INIT ACK chunk”. Stay in the same state
-          */
-         {IP_VS_SCTP_S_SHUT_ACK_SER /* IP_VS_SCTP_EVE_INIT_ACK_CLI */ },
-         {IP_VS_SCTP_S_SHUT_ACK_SER /* IP_VS_SCTP_EVE_INIT_ACK_SER */ },
-         /*
-          * Client sent ECHO, Spec(sec 5.2.4) says it may be handled by the
-          * peer and peer shall move to the ESTABISHED. if it doesn't handle
-          * it will send ERROR chunk. So, stay in the same state
-          */
-         {IP_VS_SCTP_S_ESTABLISHED /* IP_VS_SCTP_EVE_COOKIE_ECHO_CLI */ },
-         {IP_VS_SCTP_S_ESTABLISHED /* IP_VS_SCTP_EVE_COOKIE_ECHO_SER */ },
-         /*
-          * COOKIE ACK from client, not sure what to do stay in the same state
-          */
-         {IP_VS_SCTP_S_SHUT_ACK_SER /* IP_VS_SCTP_EVE_COOKIE_ACK_CLI */ },
-         {IP_VS_SCTP_S_SHUT_ACK_SER /* IP_VS_SCTP_EVE_COOKIE_ACK_SER */ },
-         {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_ABORT_CLI */ },
-         {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_ABORT_SER */ },
-         /*
-          * SHUTDOWN sent from the client, move to SHUDDOWN_CLI
-          */
-         {IP_VS_SCTP_S_SHUT_CLI /* IP_VS_SCTP_EVE_SHUT_CLI */ },
-         /*
-          * SHUTDOWN sent from the server, move to SHUTDOWN_SER
-          */
-         {IP_VS_SCTP_S_SHUT_SER /* IP_VS_SCTP_EVE_SHUT_SER */ },
-         /*
-          * client sent SHUDTDOWN_ACK, this should not happen let's close
-          * the connection.
-          */
-         {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_SHUT_ACK_CLI */ },
-         /*
-          * Server resent SHUTDOWN ACK, stay in the same state
-          */
-         {IP_VS_SCTP_S_SHUT_ACK_SER /* IP_VS_SCTP_EVE_SHUT_ACK_SER */ },
-         /*
-          * SHUTDOWN COM from client, this what we are expecting, let's close
-          * the connection
-          */
-         {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_SHUT_COM_CLI */ },
-         /*
-          * SHUTDOWN COMPLETE from server this should not happen.
-          */
-         {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_SHUT_COM_SER */ }
-         },
-        /*
-         * State : IP_VS_SCTP_S_CLOSED
-         */
-        {{IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_DATA_CLI */ },
-         {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_DATA_SER */ },
-         {IP_VS_SCTP_S_INIT_CLI /* IP_VS_SCTP_EVE_INIT_CLI */ },
-         {IP_VS_SCTP_S_INIT_SER /* IP_VS_SCTP_EVE_INIT_SER */ },
-         {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_INIT_ACK_CLI */ },
-         {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_INIT_ACK_SER */ },
-         {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_COOKIE_ECHO_CLI */ },
-         {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_COOKIE_ECHO_SER */ },
-         {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_COOKIE_ACK_CLI */ },
-         {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_COOKIE_ACK_SER */ },
-         {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_ABORT_CLI */ },
-         {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_ABORT_SER */ },
-         {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_SHUT_CLI */ },
-         {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_SHUT_SER */ },
-         {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_SHUT_ACK_CLI */ },
-         {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_SHUT_ACK_SER */ },
-         {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_SHUT_COM_CLI */ },
-         {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_SHUT_COM_SER */ }
-         }
+#define sNO IP_VS_SCTP_S_NONE
+#define sI1 IP_VS_SCTP_S_INIT1
+#define sIN IP_VS_SCTP_S_INIT
+#define sCS IP_VS_SCTP_S_COOKIE_SENT
+#define sCR IP_VS_SCTP_S_COOKIE_REPLIED
+#define sCW IP_VS_SCTP_S_COOKIE_WAIT
+#define sCO IP_VS_SCTP_S_COOKIE
+#define sCE IP_VS_SCTP_S_COOKIE_ECHOED
+#define sES IP_VS_SCTP_S_ESTABLISHED
+#define sSS IP_VS_SCTP_S_SHUTDOWN_SENT
+#define sSR IP_VS_SCTP_S_SHUTDOWN_RECEIVED
+#define sSA IP_VS_SCTP_S_SHUTDOWN_ACK_SENT
+#define sRJ IP_VS_SCTP_S_REJECTED
+#define sCL IP_VS_SCTP_S_CLOSED
+
+static const __u8 sctp_states
+        [IP_VS_DIR_LAST][IP_VS_SCTP_EVENT_LAST][IP_VS_SCTP_S_LAST] = {
+        { /* INPUT */
+/*        sNO, sI1, sIN, sCS, sCR, sCW, sCO, sCE, sES, sSS, sSR, sSA, sRJ, sCL*/
+/* d   */{sES, sI1, sIN, sCS, sCR, sCW, sCO, sCE, sES, sSS, sSR, sSA, sRJ, sCL},
+/* i   */{sI1, sIN, sIN, sCS, sCR, sCW, sCO, sCE, sES, sSS, sSR, sSA, sIN, sIN},
+/* i_a */{sCW, sCW, sCW, sCS, sCR, sCO, sCO, sCE, sES, sSS, sSR, sSA, sRJ, sCL},
+/* c_e */{sCR, sIN, sIN, sCR, sCR, sCW, sCO, sCE, sES, sSS, sSR, sSA, sRJ, sCL},
+/* c_a */{sES, sI1, sIN, sCS, sCR, sCW, sCO, sES, sES, sSS, sSR, sSA, sRJ, sCL},
+/* s   */{sSR, sI1, sIN, sCS, sCR, sCW, sCO, sCE, sSR, sSS, sSR, sSA, sRJ, sCL},
+/* s_a */{sCL, sIN, sIN, sCS, sCR, sCW, sCO, sCE, sES, sCL, sSR, sCL, sRJ, sCL},
+/* s_c */{sCL, sCL, sCL, sCS, sCR, sCW, sCO, sCE, sES, sSS, sSR, sCL, sRJ, sCL},
+/* err */{sCL, sI1, sIN, sCS, sCR, sCW, sCO, sCL, sES, sSS, sSR, sSA, sRJ, sCL},
+/* ab  */{sCL, sCL, sCL, sCL, sCL, sRJ, sCL, sCL, sCL, sCL, sCL, sCL, sCL, sCL},
+        },
+        { /* OUTPUT */
+/*        sNO, sI1, sIN, sCS, sCR, sCW, sCO, sCE, sES, sSS, sSR, sSA, sRJ, sCL*/
+/* d   */{sES, sI1, sIN, sCS, sCR, sCW, sCO, sCE, sES, sSS, sSR, sSA, sRJ, sCL},
+/* i   */{sCW, sCW, sCW, sCW, sCW, sCW, sCW, sCW, sES, sCW, sCW, sCW, sCW, sCW},
+/* i_a */{sCS, sCS, sCS, sCS, sCR, sCW, sCO, sCE, sES, sSS, sSR, sSA, sRJ, sCL},
+/* c_e */{sCE, sCE, sCE, sCE, sCE, sCE, sCE, sCE, sES, sSS, sSR, sSA, sRJ, sCL},
+/* c_a */{sES, sES, sES, sES, sES, sES, sES, sES, sES, sSS, sSR, sSA, sRJ, sCL},
+/* s   */{sSS, sSS, sSS, sSS, sSS, sSS, sSS, sSS, sSS, sSS, sSR, sSA, sRJ, sCL},
+/* s_a */{sSA, sSA, sSA, sSA, sSA, sCW, sCO, sCE, sES, sSA, sSA, sSA, sRJ, sCL},
+/* s_c */{sCL, sI1, sIN, sCS, sCR, sCW, sCO, sCE, sES, sSS, sSR, sSA, sRJ, sCL},
+/* err */{sCL, sCL, sCL, sCL, sCL, sCW, sCO, sCE, sES, sSS, sSR, sSA, sRJ, sCL},
+/* ab  */{sCL, sRJ, sCL, sCL, sCL, sCL, sCL, sCL, sCL, sCL, sCL, sCL, sCL, sCL},
+        },
+        { /* INPUT-ONLY */
+/*        sNO, sI1, sIN, sCS, sCR, sCW, sCO, sCE, sES, sSS, sSR, sSA, sRJ, sCL*/
+/* d   */{sES, sI1, sIN, sCS, sCR, sES, sCO, sCE, sES, sSS, sSR, sSA, sRJ, sCL},
+/* i   */{sI1, sIN, sIN, sIN, sIN, sIN, sCO, sCE, sES, sSS, sSR, sSA, sIN, sIN},
+/* i_a */{sCE, sCE, sCE, sCE, sCE, sCE, sCO, sCE, sES, sSS, sSR, sSA, sRJ, sCL},
+/* c_e */{sES, sES, sES, sES, sES, sES, sCO, sCE, sES, sSS, sSR, sSA, sRJ, sCL},
+/* c_a */{sES, sI1, sIN, sES, sES, sCW, sES, sES, sES, sSS, sSR, sSA, sRJ, sCL},
+/* s   */{sSR, sI1, sIN, sCS, sCR, sCW, sCO, sCE, sSR, sSS, sSR, sSA, sRJ, sCL},
+/* s_a */{sCL, sIN, sIN, sCS, sCR, sCW, sCO, sCE, sCL, sCL, sSR, sCL, sRJ, sCL},
+/* s_c */{sCL, sCL, sCL, sCL, sCL, sCW, sCO, sCE, sES, sSS, sCL, sCL, sRJ, sCL},
+/* err */{sCL, sI1, sIN, sCS, sCR, sCW, sCO, sCE, sES, sSS, sSR, sSA, sRJ, sCL},
+/* ab  */{sCL, sCL, sCL, sCL, sCL, sRJ, sCL, sCL, sCL, sCL, sCL, sCL, sCL, sCL},
+        },
 };
 
-/*
- *      Timeout table[state]
- */
+#define IP_VS_SCTP_MAX_RTO      ((60 + 1) * HZ)
+
+/* Timeout table[state] */
 static const int sctp_timeouts[IP_VS_SCTP_S_LAST + 1] = {
-        [IP_VS_SCTP_S_NONE]         =     2 * HZ,
-        [IP_VS_SCTP_S_INIT_CLI]     =     1 * 60 * HZ,
-        [IP_VS_SCTP_S_INIT_SER]     =     1 * 60 * HZ,
-        [IP_VS_SCTP_S_INIT_ACK_CLI] =     1 * 60 * HZ,
-        [IP_VS_SCTP_S_INIT_ACK_SER] =     1 * 60 * HZ,
-        [IP_VS_SCTP_S_ECHO_CLI]     =     1 * 60 * HZ,
-        [IP_VS_SCTP_S_ECHO_SER]     =     1 * 60 * HZ,
-        [IP_VS_SCTP_S_ESTABLISHED]  =    15 * 60 * HZ,
-        [IP_VS_SCTP_S_SHUT_CLI]     =     1 * 60 * HZ,
-        [IP_VS_SCTP_S_SHUT_SER]     =     1 * 60 * HZ,
-        [IP_VS_SCTP_S_SHUT_ACK_CLI] =     1 * 60 * HZ,
-        [IP_VS_SCTP_S_SHUT_ACK_SER] =     1 * 60 * HZ,
-        [IP_VS_SCTP_S_CLOSED]       =    10 * HZ,
-        [IP_VS_SCTP_S_LAST]         =     2 * HZ,
+        [IP_VS_SCTP_S_NONE]                     = 2 * HZ,
+        [IP_VS_SCTP_S_INIT1]                    = (0 + 3 + 1) * HZ,
+        [IP_VS_SCTP_S_INIT]                     = IP_VS_SCTP_MAX_RTO,
+        [IP_VS_SCTP_S_COOKIE_SENT]              = IP_VS_SCTP_MAX_RTO,
+        [IP_VS_SCTP_S_COOKIE_REPLIED]           = IP_VS_SCTP_MAX_RTO,
+        [IP_VS_SCTP_S_COOKIE_WAIT]              = IP_VS_SCTP_MAX_RTO,
+        [IP_VS_SCTP_S_COOKIE]                   = IP_VS_SCTP_MAX_RTO,
+        [IP_VS_SCTP_S_COOKIE_ECHOED]            = IP_VS_SCTP_MAX_RTO,
+        [IP_VS_SCTP_S_ESTABLISHED]              = 15 * 60 * HZ,
+        [IP_VS_SCTP_S_SHUTDOWN_SENT]            = IP_VS_SCTP_MAX_RTO,
+        [IP_VS_SCTP_S_SHUTDOWN_RECEIVED]        = IP_VS_SCTP_MAX_RTO,
+        [IP_VS_SCTP_S_SHUTDOWN_ACK_SENT]        = IP_VS_SCTP_MAX_RTO,
+        [IP_VS_SCTP_S_REJECTED]                 = (0 + 3 + 1) * HZ,
+        [IP_VS_SCTP_S_CLOSED]                   = IP_VS_SCTP_MAX_RTO,
+        [IP_VS_SCTP_S_LAST]                     = 2 * HZ,
 };
 
 static const char *sctp_state_name_table[IP_VS_SCTP_S_LAST + 1] = {
-        [IP_VS_SCTP_S_NONE]         =    "NONE",
-        [IP_VS_SCTP_S_INIT_CLI]     =    "INIT_CLI",
-        [IP_VS_SCTP_S_INIT_SER]     =    "INIT_SER",
-        [IP_VS_SCTP_S_INIT_ACK_CLI] =    "INIT_ACK_CLI",
-        [IP_VS_SCTP_S_INIT_ACK_SER] =    "INIT_ACK_SER",
-        [IP_VS_SCTP_S_ECHO_CLI]     =    "COOKIE_ECHO_CLI",
-        [IP_VS_SCTP_S_ECHO_SER]     =    "COOKIE_ECHO_SER",
-        [IP_VS_SCTP_S_ESTABLISHED]  =    "ESTABISHED",
-        [IP_VS_SCTP_S_SHUT_CLI]     =    "SHUTDOWN_CLI",
-        [IP_VS_SCTP_S_SHUT_SER]     =    "SHUTDOWN_SER",
-        [IP_VS_SCTP_S_SHUT_ACK_CLI] =    "SHUTDOWN_ACK_CLI",
-        [IP_VS_SCTP_S_SHUT_ACK_SER] =    "SHUTDOWN_ACK_SER",
-        [IP_VS_SCTP_S_CLOSED]       =    "CLOSED",
-        [IP_VS_SCTP_S_LAST]         =    "BUG!"
+        [IP_VS_SCTP_S_NONE]                     = "NONE",
+        [IP_VS_SCTP_S_INIT1]                    = "INIT1",
+        [IP_VS_SCTP_S_INIT]                     = "INIT",
+        [IP_VS_SCTP_S_COOKIE_SENT]              = "C-SENT",
+        [IP_VS_SCTP_S_COOKIE_REPLIED]           = "C-REPLIED",
+        [IP_VS_SCTP_S_COOKIE_WAIT]              = "C-WAIT",
+        [IP_VS_SCTP_S_COOKIE]                   = "COOKIE",
+        [IP_VS_SCTP_S_COOKIE_ECHOED]            = "C-ECHOED",
+        [IP_VS_SCTP_S_ESTABLISHED]              = "ESTABLISHED",
+        [IP_VS_SCTP_S_SHUTDOWN_SENT]            = "S-SENT",
+        [IP_VS_SCTP_S_SHUTDOWN_RECEIVED]        = "S-RECEIVED",
+        [IP_VS_SCTP_S_SHUTDOWN_ACK_SENT]        = "S-ACK-SENT",
+        [IP_VS_SCTP_S_REJECTED]                 = "REJECTED",
+        [IP_VS_SCTP_S_CLOSED]                   = "CLOSED",
+        [IP_VS_SCTP_S_LAST]                     = "BUG!",
 };
 
 
@@ -943,17 +377,20 @@ set_sctp_state(struct ip_vs_proto_data *pd, struct ip_vs_conn *cp,
                 }
         }
 
-        event = sctp_events[chunk_type];
+        event = (chunk_type < sizeof(sctp_events)) ?
+                sctp_events[chunk_type] : IP_VS_SCTP_DATA;
 
-        /*
-         *  If the direction is IP_VS_DIR_OUTPUT, this event is from server
-         */
-        if (direction == IP_VS_DIR_OUTPUT)
-                event++;
-        /*
-         * get next state
+        /* Update direction to INPUT_ONLY if necessary
+         * or delete NO_OUTPUT flag if output packet detected
          */
-        next_state = sctp_states_table[cp->state][event].next_state;
+        if (cp->flags & IP_VS_CONN_F_NOOUTPUT) {
+                if (direction == IP_VS_DIR_OUTPUT)
+                        cp->flags &= ~IP_VS_CONN_F_NOOUTPUT;
+                else
+                        direction = IP_VS_DIR_INPUT_ONLY;
+        }
+
+        next_state = sctp_states[direction][event][cp->state];
 
         if (next_state != cp->state) {
                 struct ip_vs_dest *dest = cp->dest;
diff --git a/net/netfilter/ipvs/ip_vs_proto_tcp.c b/net/netfilter/ipvs/ip_vs_proto_tcp.c
index 50a15944c6c1..e3a697234a98 100644
--- a/net/netfilter/ipvs/ip_vs_proto_tcp.c
+++ b/net/netfilter/ipvs/ip_vs_proto_tcp.c
@@ -39,6 +39,7 @@ tcp_conn_schedule(int af, struct sk_buff *skb, struct ip_vs_proto_data *pd,
         struct net *net;
         struct ip_vs_service *svc;
         struct tcphdr _tcph, *th;
+        struct netns_ipvs *ipvs;
 
         th = skb_header_pointer(skb, iph->len, sizeof(_tcph), &_tcph);
         if (th == NULL) {
@@ -46,14 +47,15 @@ tcp_conn_schedule(int af, struct sk_buff *skb, struct ip_vs_proto_data *pd,
                 return 0;
         }
         net = skb_net(skb);
+        ipvs = net_ipvs(net);
         /* No !th->ack check to allow scheduling on SYN+ACK for Active FTP */
         rcu_read_lock();
-        if (th->syn &&
+        if ((th->syn || sysctl_sloppy_tcp(ipvs)) && !th->rst &&
             (svc = ip_vs_service_find(net, af, skb->mark, iph->protocol,
                                       &iph->daddr, th->dest))) {
                 int ignored;
 
-                if (ip_vs_todrop(net_ipvs(net))) {
+                if (ip_vs_todrop(ipvs)) {
                         /*
                          * It seems that we are very loaded.
                          * We have to drop this packet :(
@@ -401,7 +403,7 @@ static struct tcp_states_t tcp_states [] = {
 /*        sNO, sES, sSS, sSR, sFW, sTW, sCL, sCW, sLA, sLI, sSA */
 /*syn*/ {{sSR, sES, sES, sSR, sSR, sSR, sSR, sSR, sSR, sSR, sSR }},
 /*fin*/ {{sCL, sCW, sSS, sTW, sTW, sTW, sCL, sCW, sLA, sLI, sTW }},
-/*ack*/ {{sCL, sES, sSS, sES, sFW, sTW, sCL, sCW, sCL, sLI, sES }},
+/*ack*/ {{sES, sES, sSS, sES, sFW, sTW, sCL, sCW, sCL, sLI, sES }},
 /*rst*/ {{sCL, sCL, sCL, sSR, sCL, sCL, sCL, sCL, sLA, sLI, sSR }},
 
 /*      OUTPUT */
@@ -415,7 +417,7 @@ static struct tcp_states_t tcp_states [] = {
 /*        sNO, sES, sSS, sSR, sFW, sTW, sCL, sCW, sLA, sLI, sSA */
 /*syn*/ {{sSR, sES, sES, sSR, sSR, sSR, sSR, sSR, sSR, sSR, sSR }},
 /*fin*/ {{sCL, sFW, sSS, sTW, sFW, sTW, sCL, sCW, sLA, sLI, sTW }},
-/*ack*/ {{sCL, sES, sSS, sES, sFW, sTW, sCL, sCW, sCL, sLI, sES }},
+/*ack*/ {{sES, sES, sSS, sES, sFW, sTW, sCL, sCW, sCL, sLI, sES }},
 /*rst*/ {{sCL, sCL, sCL, sSR, sCL, sCL, sCL, sCL, sLA, sLI, sCL }},
 };
 
@@ -424,7 +426,7 @@ static struct tcp_states_t tcp_states_dos [] = {
 /*        sNO, sES, sSS, sSR, sFW, sTW, sCL, sCW, sLA, sLI, sSA */
 /*syn*/ {{sSR, sES, sES, sSR, sSR, sSR, sSR, sSR, sSR, sSR, sSA }},
 /*fin*/ {{sCL, sCW, sSS, sTW, sTW, sTW, sCL, sCW, sLA, sLI, sSA }},
-/*ack*/ {{sCL, sES, sSS, sSR, sFW, sTW, sCL, sCW, sCL, sLI, sSA }},
+/*ack*/ {{sES, sES, sSS, sSR, sFW, sTW, sCL, sCW, sCL, sLI, sSA }},
 /*rst*/ {{sCL, sCL, sCL, sSR, sCL, sCL, sCL, sCL, sLA, sLI, sCL }},
 
 /*      OUTPUT */
@@ -438,7 +440,7 @@ static struct tcp_states_t tcp_states_dos [] = {
 /*        sNO, sES, sSS, sSR, sFW, sTW, sCL, sCW, sLA, sLI, sSA */
 /*syn*/ {{sSA, sES, sES, sSR, sSA, sSA, sSA, sSA, sSA, sSA, sSA }},
 /*fin*/ {{sCL, sFW, sSS, sTW, sFW, sTW, sCL, sCW, sLA, sLI, sTW }},
-/*ack*/ {{sCL, sES, sSS, sES, sFW, sTW, sCL, sCW, sCL, sLI, sES }},
+/*ack*/ {{sES, sES, sSS, sES, sFW, sTW, sCL, sCW, sCL, sLI, sES }},
 /*rst*/ {{sCL, sCL, sCL, sSR, sCL, sCL, sCL, sCL, sLA, sLI, sCL }},
 };
 
diff --git a/net/netfilter/ipvs/ip_vs_rr.c b/net/netfilter/ipvs/ip_vs_rr.c
index c35986c793d9..176b87c35e34 100644
--- a/net/netfilter/ipvs/ip_vs_rr.c
+++ b/net/netfilter/ipvs/ip_vs_rr.c
@@ -55,7 +55,8 @@ static int ip_vs_rr_del_dest(struct ip_vs_service *svc, struct ip_vs_dest *dest)
  * Round-Robin Scheduling
  */
 static struct ip_vs_dest *
-ip_vs_rr_schedule(struct ip_vs_service *svc, const struct sk_buff *skb)
+ip_vs_rr_schedule(struct ip_vs_service *svc, const struct sk_buff *skb,
+                  struct ip_vs_iphdr *iph)
 {
         struct list_head *p;
         struct ip_vs_dest *dest, *last;
diff --git a/net/netfilter/ipvs/ip_vs_sed.c b/net/netfilter/ipvs/ip_vs_sed.c
index f3205925359a..e446b9fa7424 100644
--- a/net/netfilter/ipvs/ip_vs_sed.c
+++ b/net/netfilter/ipvs/ip_vs_sed.c
@@ -44,7 +44,7 @@
 #include <net/ip_vs.h>
 
 
-static inline unsigned int
+static inline int
 ip_vs_sed_dest_overhead(struct ip_vs_dest *dest)
 {
         /*
@@ -59,10 +59,11 @@ ip_vs_sed_dest_overhead(struct ip_vs_dest *dest)
  *      Weighted Least Connection scheduling
  */
 static struct ip_vs_dest *
-ip_vs_sed_schedule(struct ip_vs_service *svc, const struct sk_buff *skb)
+ip_vs_sed_schedule(struct ip_vs_service *svc, const struct sk_buff *skb,
+                   struct ip_vs_iphdr *iph)
 {
         struct ip_vs_dest *dest, *least;
-        unsigned int loh, doh;
+        int loh, doh;
 
         IP_VS_DBG(6, "%s(): Scheduling...\n", __func__);
 
@@ -98,8 +99,8 @@ ip_vs_sed_schedule(struct ip_vs_service *svc, const struct sk_buff *skb)
                 if (dest->flags & IP_VS_DEST_F_OVERLOAD)
                         continue;
                 doh = ip_vs_sed_dest_overhead(dest);
-                if (loh * atomic_read(&dest->weight) >
-                    doh * atomic_read(&least->weight)) {
+                if ((__s64)loh * atomic_read(&dest->weight) >
+                    (__s64)doh * atomic_read(&least->weight)) {
                         least = dest;
                         loh = doh;
                 }
diff --git a/net/netfilter/ipvs/ip_vs_sh.c b/net/netfilter/ipvs/ip_vs_sh.c
index a65edfe4b16c..3588faebe529 100644
--- a/net/netfilter/ipvs/ip_vs_sh.c
+++ b/net/netfilter/ipvs/ip_vs_sh.c
@@ -48,6 +48,10 @@
 
 #include <net/ip_vs.h>
 
+#include <net/tcp.h>
+#include <linux/udp.h>
+#include <linux/sctp.h>
+
 
 /*
  *      IPVS SH bucket
@@ -71,10 +75,19 @@ struct ip_vs_sh_state {
         struct ip_vs_sh_bucket          buckets[IP_VS_SH_TAB_SIZE];
 };
 
+/* Helper function to determine if server is unavailable */
+static inline bool is_unavailable(struct ip_vs_dest *dest)
+{
+        return atomic_read(&dest->weight) <= 0 ||
+               dest->flags & IP_VS_DEST_F_OVERLOAD;
+}
+
 /*
  *      Returns hash value for IPVS SH entry
  */
-static inline unsigned int ip_vs_sh_hashkey(int af, const union nf_inet_addr *addr)
+static inline unsigned int
+ip_vs_sh_hashkey(int af, const union nf_inet_addr *addr,
+                 __be16 port, unsigned int offset)
 {
         __be32 addr_fold = addr->ip;
 
@@ -83,7 +96,8 @@ static inline unsigned int ip_vs_sh_hashkey(int af, const union nf_inet_addr *ad
                 addr_fold = addr->ip6[0]^addr->ip6[1]^
                             addr->ip6[2]^addr->ip6[3];
 #endif
-        return (ntohl(addr_fold)*2654435761UL) & IP_VS_SH_TAB_MASK;
+        return (offset + (ntohs(port) + ntohl(addr_fold))*2654435761UL) &
+                IP_VS_SH_TAB_MASK;
 }
 
 
@@ -91,12 +105,42 @@ static inline unsigned int ip_vs_sh_hashkey(int af, const union nf_inet_addr *ad
  *      Get ip_vs_dest associated with supplied parameters.
  */
 static inline struct ip_vs_dest *
-ip_vs_sh_get(int af, struct ip_vs_sh_state *s, const union nf_inet_addr *addr)
+ip_vs_sh_get(struct ip_vs_service *svc, struct ip_vs_sh_state *s,
+             const union nf_inet_addr *addr, __be16 port)
 {
-        return rcu_dereference(s->buckets[ip_vs_sh_hashkey(af, addr)].dest);
+        unsigned int hash = ip_vs_sh_hashkey(svc->af, addr, port, 0);
+        struct ip_vs_dest *dest = rcu_dereference(s->buckets[hash].dest);
+
+        return (!dest || is_unavailable(dest)) ? NULL : dest;
 }
 
 
+/* As ip_vs_sh_get, but with fallback if selected server is unavailable */
+static inline struct ip_vs_dest *
+ip_vs_sh_get_fallback(struct ip_vs_service *svc, struct ip_vs_sh_state *s,
+                      const union nf_inet_addr *addr, __be16 port)
+{
+        unsigned int offset;
+        unsigned int hash;
+        struct ip_vs_dest *dest;
+
+        for (offset = 0; offset < IP_VS_SH_TAB_SIZE; offset++) {
+                hash = ip_vs_sh_hashkey(svc->af, addr, port, offset);
+                dest = rcu_dereference(s->buckets[hash].dest);
+                if (!dest)
+                        break;
+                if (is_unavailable(dest))
+                        IP_VS_DBG_BUF(6, "SH: selected unavailable server "
+                                      "%s:%d (offset %d)",
+                                      IP_VS_DBG_ADDR(svc->af, &dest->addr),
+                                      ntohs(dest->port), offset);
+                else
+                        return dest;
+        }
+
+        return NULL;
+}
+
 /*
  *      Assign all the hash buckets of the specified table with the service.
  */
@@ -213,13 +257,39 @@ static int ip_vs_sh_dest_changed(struct ip_vs_service *svc,
 }
 
 
-/*
- *      If the dest flags is set with IP_VS_DEST_F_OVERLOAD,
- *      consider that the server is overloaded here.
- */
-static inline int is_overloaded(struct ip_vs_dest *dest)
+/* Helper function to get port number */
+static inline __be16
+ip_vs_sh_get_port(const struct sk_buff *skb, struct ip_vs_iphdr *iph)
 {
-        return dest->flags & IP_VS_DEST_F_OVERLOAD;
+        __be16 port;
+        struct tcphdr _tcph, *th;
+        struct udphdr _udph, *uh;
+        sctp_sctphdr_t _sctph, *sh;
+
+        switch (iph->protocol) {
+        case IPPROTO_TCP:
+                th = skb_header_pointer(skb, iph->len, sizeof(_tcph), &_tcph);
+                if (unlikely(th == NULL))
+                        return 0;
+                port = th->source;
+                break;
+        case IPPROTO_UDP:
+                uh = skb_header_pointer(skb, iph->len, sizeof(_udph), &_udph);
+                if (unlikely(uh == NULL))
+                        return 0;
+                port = uh->source;
+                break;
+        case IPPROTO_SCTP:
+                sh = skb_header_pointer(skb, iph->len, sizeof(_sctph), &_sctph);
+                if (unlikely(sh == NULL))
+                        return 0;
+                port = sh->source;
+                break;
+        default:
+                port = 0;
+        }
+
+        return port;
 }
 
 
@@ -227,28 +297,32 @@ static inline int is_overloaded(struct ip_vs_dest *dest)
  *      Source Hashing scheduling
  */
 static struct ip_vs_dest *
-ip_vs_sh_schedule(struct ip_vs_service *svc, const struct sk_buff *skb)
+ip_vs_sh_schedule(struct ip_vs_service *svc, const struct sk_buff *skb,
+                  struct ip_vs_iphdr *iph)
 {
         struct ip_vs_dest *dest;
         struct ip_vs_sh_state *s;
-        struct ip_vs_iphdr iph;
-
-        ip_vs_fill_iph_addr_only(svc->af, skb, &iph);
+        __be16 port = 0;
 
         IP_VS_DBG(6, "ip_vs_sh_schedule(): Scheduling...\n");
 
+        if (svc->flags & IP_VS_SVC_F_SCHED_SH_PORT)
+                port = ip_vs_sh_get_port(skb, iph);
+
         s = (struct ip_vs_sh_state *) svc->sched_data;
-        dest = ip_vs_sh_get(svc->af, s, &iph.saddr);
-        if (!dest
-            || !(dest->flags & IP_VS_DEST_F_AVAILABLE)
-            || atomic_read(&dest->weight) <= 0
-            || is_overloaded(dest)) {
+
+        if (svc->flags & IP_VS_SVC_F_SCHED_SH_FALLBACK)
+                dest = ip_vs_sh_get_fallback(svc, s, &iph->saddr, port);
+        else
+                dest = ip_vs_sh_get(svc, s, &iph->saddr, port);
+
+        if (!dest) {
                 ip_vs_scheduler_err(svc, "no destination available");
                 return NULL;
         }
 
         IP_VS_DBG_BUF(6, "SH: source IP address %s --> server %s:%d\n",
-                      IP_VS_DBG_ADDR(svc->af, &iph.saddr),
+                      IP_VS_DBG_ADDR(svc->af, &iph->saddr),
                       IP_VS_DBG_ADDR(svc->af, &dest->addr),
                       ntohs(dest->port));
 
diff --git a/net/netfilter/ipvs/ip_vs_sync.c b/net/netfilter/ipvs/ip_vs_sync.c
index f6046d9af8d3..f4484719f3e6 100644
--- a/net/netfilter/ipvs/ip_vs_sync.c
+++ b/net/netfilter/ipvs/ip_vs_sync.c
@@ -425,6 +425,16 @@ ip_vs_sync_buff_create_v0(struct netns_ipvs *ipvs)
         return sb;
 }
 
+/* Check if connection is controlled by persistence */
+static inline bool in_persistence(struct ip_vs_conn *cp)
+{
+        for (cp = cp->control; cp; cp = cp->control) {
+                if (cp->flags & IP_VS_CONN_F_TEMPLATE)
+                        return true;
+        }
+        return false;
+}
+
 /* Check if conn should be synced.
  * pkts: conn packets, use sysctl_sync_threshold to avoid packet check
  * - (1) sync_refresh_period: reduce sync rate. Additionally, retry
@@ -447,6 +457,8 @@ static int ip_vs_sync_conn_needed(struct netns_ipvs *ipvs,
         /* Check if we sync in current state */
         if (unlikely(cp->flags & IP_VS_CONN_F_TEMPLATE))
                 force = 0;
+        else if (unlikely(sysctl_sync_persist_mode(ipvs) && in_persistence(cp)))
+                return 0;
         else if (likely(cp->protocol == IPPROTO_TCP)) {
                 if (!((1 << cp->state) &
                       ((1 << IP_VS_TCP_S_ESTABLISHED) |
@@ -461,9 +473,10 @@ static int ip_vs_sync_conn_needed(struct netns_ipvs *ipvs,
         } else if (unlikely(cp->protocol == IPPROTO_SCTP)) {
                 if (!((1 << cp->state) &
                       ((1 << IP_VS_SCTP_S_ESTABLISHED) |
-                       (1 << IP_VS_SCTP_S_CLOSED) |
-                       (1 << IP_VS_SCTP_S_SHUT_ACK_CLI) |
-                       (1 << IP_VS_SCTP_S_SHUT_ACK_SER))))
+                       (1 << IP_VS_SCTP_S_SHUTDOWN_SENT) |
+                       (1 << IP_VS_SCTP_S_SHUTDOWN_RECEIVED) |
+                       (1 << IP_VS_SCTP_S_SHUTDOWN_ACK_SENT) |
+                       (1 << IP_VS_SCTP_S_CLOSED))))
                         return 0;
                 force = cp->state != cp->old_state;
                 if (force && cp->state != IP_VS_SCTP_S_ESTABLISHED)
diff --git a/net/netfilter/ipvs/ip_vs_wlc.c b/net/netfilter/ipvs/ip_vs_wlc.c
index c60a81c4ce9a..b5b4650d50a9 100644
--- a/net/netfilter/ipvs/ip_vs_wlc.c
+++ b/net/netfilter/ipvs/ip_vs_wlc.c
@@ -31,10 +31,11 @@
  *      Weighted Least Connection scheduling
  */
 static struct ip_vs_dest *
-ip_vs_wlc_schedule(struct ip_vs_service *svc, const struct sk_buff *skb)
+ip_vs_wlc_schedule(struct ip_vs_service *svc, const struct sk_buff *skb,
+                   struct ip_vs_iphdr *iph)
 {
         struct ip_vs_dest *dest, *least;
-        unsigned int loh, doh;
+        int loh, doh;
 
         IP_VS_DBG(6, "ip_vs_wlc_schedule(): Scheduling...\n");
 
@@ -70,8 +71,8 @@ ip_vs_wlc_schedule(struct ip_vs_service *svc, const struct sk_buff *skb)
                 if (dest->flags & IP_VS_DEST_F_OVERLOAD)
                         continue;
                 doh = ip_vs_dest_conn_overhead(dest);
-                if (loh * atomic_read(&dest->weight) >
-                    doh * atomic_read(&least->weight)) {
+                if ((__s64)loh * atomic_read(&dest->weight) >
+                    (__s64)doh * atomic_read(&least->weight)) {
                         least = dest;
                         loh = doh;
                 }
diff --git a/net/netfilter/ipvs/ip_vs_wrr.c b/net/netfilter/ipvs/ip_vs_wrr.c
index 0e68555bceb9..0546cd572d6b 100644
--- a/net/netfilter/ipvs/ip_vs_wrr.c
+++ b/net/netfilter/ipvs/ip_vs_wrr.c
@@ -162,7 +162,8 @@ static int ip_vs_wrr_dest_changed(struct ip_vs_service *svc,
  *    Weighted Round-Robin Scheduling
  */
 static struct ip_vs_dest *
-ip_vs_wrr_schedule(struct ip_vs_service *svc, const struct sk_buff *skb)
+ip_vs_wrr_schedule(struct ip_vs_service *svc, const struct sk_buff *skb,
+                   struct ip_vs_iphdr *iph)
 {
         struct ip_vs_dest *dest, *last, *stop = NULL;
         struct ip_vs_wrr_mark *mark = svc->sched_data;
diff --git a/net/netfilter/ipvs/ip_vs_xmit.c b/net/netfilter/ipvs/ip_vs_xmit.c
index b75ff6429a04..c47444e4cf8c 100644
--- a/net/netfilter/ipvs/ip_vs_xmit.c
+++ b/net/netfilter/ipvs/ip_vs_xmit.c
@@ -883,7 +883,7 @@ ip_vs_tunnel_xmit(struct sk_buff *skb, struct ip_vs_conn *cp,
         iph->daddr              =       cp->daddr.ip;
         iph->saddr              =       saddr;
         iph->ttl                =       old_iph->ttl;
-        ip_select_ident(iph, &rt->dst, NULL);
+        ip_select_ident(skb, &rt->dst, NULL);
 
         /* Another hack: avoid icmp_send in ip_fragment */
         skb->local_df = 1;
diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c
index 0283baedcdfb..5d892febd64c 100644
--- a/net/netfilter/nf_conntrack_core.c
+++ b/net/netfilter/nf_conntrack_core.c
@@ -39,6 +39,7 @@
 #include <net/netfilter/nf_conntrack_l4proto.h>
 #include <net/netfilter/nf_conntrack_expect.h>
 #include <net/netfilter/nf_conntrack_helper.h>
+#include <net/netfilter/nf_conntrack_seqadj.h>
 #include <net/netfilter/nf_conntrack_core.h>
 #include <net/netfilter/nf_conntrack_extend.h>
 #include <net/netfilter/nf_conntrack_acct.h>
@@ -47,6 +48,7 @@
 #include <net/netfilter/nf_conntrack_timestamp.h>
 #include <net/netfilter/nf_conntrack_timeout.h>
 #include <net/netfilter/nf_conntrack_labels.h>
+#include <net/netfilter/nf_conntrack_synproxy.h>
 #include <net/netfilter/nf_nat.h>
 #include <net/netfilter/nf_nat_core.h>
 #include <net/netfilter/nf_nat_helper.h>
@@ -238,7 +240,7 @@ destroy_conntrack(struct nf_conntrack *nfct)
         nf_conntrack_free(ct);
 }
 
-void nf_ct_delete_from_lists(struct nf_conn *ct)
+static void nf_ct_delete_from_lists(struct nf_conn *ct)
 {
         struct net *net = nf_ct_net(ct);
 
@@ -253,7 +255,6 @@ void nf_ct_delete_from_lists(struct nf_conn *ct)
                              &net->ct.dying);
         spin_unlock_bh(&nf_conntrack_lock);
 }
-EXPORT_SYMBOL_GPL(nf_ct_delete_from_lists);
 
 static void death_by_event(unsigned long ul_conntrack)
 {
@@ -275,7 +276,7 @@ static void death_by_event(unsigned long ul_conntrack)
         nf_ct_put(ct);
 }
 
-void nf_ct_dying_timeout(struct nf_conn *ct)
+static void nf_ct_dying_timeout(struct nf_conn *ct)
 {
         struct net *net = nf_ct_net(ct);
         struct nf_conntrack_ecache *ecache = nf_ct_ecache_find(ct);
@@ -288,27 +289,33 @@ void nf_ct_dying_timeout(struct nf_conn *ct)
                 (prandom_u32() % net->ct.sysctl_events_retry_timeout);
         add_timer(&ecache->timeout);
 }
-EXPORT_SYMBOL_GPL(nf_ct_dying_timeout);
 
-static void death_by_timeout(unsigned long ul_conntrack)
+bool nf_ct_delete(struct nf_conn *ct, u32 portid, int report)
 {
-        struct nf_conn *ct = (void *)ul_conntrack;
         struct nf_conn_tstamp *tstamp;
 
         tstamp = nf_conn_tstamp_find(ct);
         if (tstamp && tstamp->stop == 0)
                 tstamp->stop = ktime_to_ns(ktime_get_real());
 
-        if (!test_bit(IPS_DYING_BIT, &ct->status) &&
-            unlikely(nf_conntrack_event(IPCT_DESTROY, ct) < 0)) {
+        if (!nf_ct_is_dying(ct) &&
+            unlikely(nf_conntrack_event_report(IPCT_DESTROY, ct,
+            portid, report) < 0)) {
                 /* destroy event was not delivered */
                 nf_ct_delete_from_lists(ct);
                 nf_ct_dying_timeout(ct);
-                return;
+                return false;
         }
         set_bit(IPS_DYING_BIT, &ct->status);
         nf_ct_delete_from_lists(ct);
         nf_ct_put(ct);
+        return true;
+}
+EXPORT_SYMBOL_GPL(nf_ct_delete);
+
+static void death_by_timeout(unsigned long ul_conntrack)
+{
+        nf_ct_delete((struct nf_conn *)ul_conntrack, 0, 0);
 }
 
 /*
@@ -643,10 +650,7 @@ static noinline int early_drop(struct net *net, unsigned int hash)
                 return dropped;
 
         if (del_timer(&ct->timeout)) {
-                death_by_timeout((unsigned long)ct);
-                /* Check if we indeed killed this entry. Reliable event
-                   delivery may have inserted it into the dying list. */
-                if (test_bit(IPS_DYING_BIT, &ct->status)) {
+                if (nf_ct_delete(ct, 0, 0)) {
                         dropped = 1;
                         NF_CT_STAT_INC_ATOMIC(net, early_drop);
                 }
@@ -796,6 +800,11 @@ init_conntrack(struct net *net, struct nf_conn *tmpl,
         if (IS_ERR(ct))
                 return (struct nf_conntrack_tuple_hash *)ct;
 
+        if (tmpl && nfct_synproxy(tmpl)) {
+                nfct_seqadj_ext_add(ct);
+                nfct_synproxy_ext_add(ct);
+        }
+
         timeout_ext = tmpl ? nf_ct_timeout_find(tmpl) : NULL;
         if (timeout_ext)
                 timeouts = NF_CT_TIMEOUT_EXT_DATA(timeout_ext);
@@ -1192,7 +1201,7 @@ EXPORT_SYMBOL_GPL(nf_ct_port_nlattr_tuple_size);
 #endif
 
 /* Used by ipt_REJECT and ip6t_REJECT. */
-static void nf_conntrack_attach(struct sk_buff *nskb, struct sk_buff *skb)
+static void nf_conntrack_attach(struct sk_buff *nskb, const struct sk_buff *skb)
 {
         struct nf_conn *ct;
         enum ip_conntrack_info ctinfo;
@@ -1244,7 +1253,7 @@ found:
 
 void nf_ct_iterate_cleanup(struct net *net,
                            int (*iter)(struct nf_conn *i, void *data),
-                           void *data)
+                           void *data, u32 portid, int report)
 {
         struct nf_conn *ct;
         unsigned int bucket = 0;
@@ -1252,7 +1261,8 @@ void nf_ct_iterate_cleanup(struct net *net,
         while ((ct = get_next_corpse(net, iter, data, &bucket)) != NULL) {
                 /* Time to push up daises... */
                 if (del_timer(&ct->timeout))
-                        death_by_timeout((unsigned long)ct);
+                        nf_ct_delete(ct, portid, report);
+
                 /* ... else the timer will get him soon. */
 
                 nf_ct_put(ct);
@@ -1260,30 +1270,6 @@ void nf_ct_iterate_cleanup(struct net *net,
 }
 EXPORT_SYMBOL_GPL(nf_ct_iterate_cleanup);
 
-struct __nf_ct_flush_report {
-        u32 portid;
-        int report;
-};
-
-static int kill_report(struct nf_conn *i, void *data)
-{
-        struct __nf_ct_flush_report *fr = (struct __nf_ct_flush_report *)data;
-        struct nf_conn_tstamp *tstamp;
-
-        tstamp = nf_conn_tstamp_find(i);
-        if (tstamp && tstamp->stop == 0)
-                tstamp->stop = ktime_to_ns(ktime_get_real());
-
-        /* If we fail to deliver the event, death_by_timeout() will retry */
-        if (nf_conntrack_event_report(IPCT_DESTROY, i,
-                                      fr->portid, fr->report) < 0)
-                return 1;
-
-        /* Avoid the delivery of the destroy event in death_by_timeout(). */
-        set_bit(IPS_DYING_BIT, &i->status);
-        return 1;
-}
-
 static int kill_all(struct nf_conn *i, void *data)
 {
         return 1;
@@ -1301,11 +1287,7 @@ EXPORT_SYMBOL_GPL(nf_ct_free_hashtable);
 
 void nf_conntrack_flush_report(struct net *net, u32 portid, int report)
 {
-        struct __nf_ct_flush_report fr = {
-                .portid = portid,
-                .report = report,
-        };
-        nf_ct_iterate_cleanup(net, kill_report, &fr);
+        nf_ct_iterate_cleanup(net, kill_all, NULL, portid, report);
 }
 EXPORT_SYMBOL_GPL(nf_conntrack_flush_report);
 
@@ -1351,6 +1333,7 @@ void nf_conntrack_cleanup_end(void)
         nf_ct_extend_unregister(&nf_ct_zone_extend);
 #endif
         nf_conntrack_proto_fini();
+        nf_conntrack_seqadj_fini();
         nf_conntrack_labels_fini();
         nf_conntrack_helper_fini();
         nf_conntrack_timeout_fini();
@@ -1386,7 +1369,7 @@ void nf_conntrack_cleanup_net_list(struct list_head *net_exit_list)
 i_see_dead_people:
         busy = 0;
         list_for_each_entry(net, net_exit_list, exit_list) {
-                nf_ct_iterate_cleanup(net, kill_all, NULL);
+                nf_ct_iterate_cleanup(net, kill_all, NULL, 0, 0);
                 nf_ct_release_dying_list(net);
                 if (atomic_read(&net->ct.count) != 0)
                         busy = 1;
@@ -1556,6 +1539,10 @@ int nf_conntrack_init_start(void)
         if (ret < 0)
                 goto err_labels;
 
+        ret = nf_conntrack_seqadj_init();
+        if (ret < 0)
+                goto err_seqadj;
+
 #ifdef CONFIG_NF_CONNTRACK_ZONES
         ret = nf_ct_extend_register(&nf_ct_zone_extend);
         if (ret < 0)
@@ -1580,6 +1567,8 @@ err_proto:
         nf_ct_extend_unregister(&nf_ct_zone_extend);
 err_extend:
 #endif
+        nf_conntrack_seqadj_fini();
+err_seqadj:
         nf_conntrack_labels_fini();
 err_labels:
         nf_conntrack_helper_fini();
@@ -1602,9 +1591,6 @@ void nf_conntrack_init_end(void)
         /* For use by REJECT target */
         RCU_INIT_POINTER(ip_ct_attach, nf_conntrack_attach);
         RCU_INIT_POINTER(nf_ct_destroy, destroy_conntrack);
-
-        /* Howto get NAT offsets */
-        RCU_INIT_POINTER(nf_ct_nat_offset, NULL);
 }
 
 /*
@@ -1691,8 +1677,3 @@ err_slabname:
 err_stat:
         return ret;
 }
-
-s16 (*nf_ct_nat_offset)(const struct nf_conn *ct,
-                        enum ip_conntrack_dir dir,
-                        u32 seq);
-EXPORT_SYMBOL_GPL(nf_ct_nat_offset);
diff --git a/net/netfilter/nf_conntrack_expect.c b/net/netfilter/nf_conntrack_expect.c
index c63b618cd619..4fd1ca94fd4a 100644
--- a/net/netfilter/nf_conntrack_expect.c
+++ b/net/netfilter/nf_conntrack_expect.c
@@ -293,6 +293,11 @@ void nf_ct_expect_init(struct nf_conntrack_expect *exp, unsigned int class,
                        sizeof(exp->tuple.dst.u3) - len);
 
         exp->tuple.dst.u.all = *dst;
+
+#ifdef CONFIG_NF_NAT_NEEDED
+        memset(&exp->saved_addr, 0, sizeof(exp->saved_addr));
+        memset(&exp->saved_proto, 0, sizeof(exp->saved_proto));
+#endif
 }
 EXPORT_SYMBOL_GPL(nf_ct_expect_init);
 
diff --git a/net/netfilter/nf_conntrack_ftp.c b/net/netfilter/nf_conntrack_ftp.c
index 6b217074237b..b8a0924064ef 100644
--- a/net/netfilter/nf_conntrack_ftp.c
+++ b/net/netfilter/nf_conntrack_ftp.c
@@ -55,10 +55,14 @@ unsigned int (*nf_nat_ftp_hook)(struct sk_buff *skb,
                                 struct nf_conntrack_expect *exp);
 EXPORT_SYMBOL_GPL(nf_nat_ftp_hook);
 
-static int try_rfc959(const char *, size_t, struct nf_conntrack_man *, char);
-static int try_eprt(const char *, size_t, struct nf_conntrack_man *, char);
+static int try_rfc959(const char *, size_t, struct nf_conntrack_man *,
+                      char, unsigned int *);
+static int try_rfc1123(const char *, size_t, struct nf_conntrack_man *,
+                       char, unsigned int *);
+static int try_eprt(const char *, size_t, struct nf_conntrack_man *,
+                    char, unsigned int *);
 static int try_epsv_response(const char *, size_t, struct nf_conntrack_man *,
-                             char);
+                             char, unsigned int *);
 
 static struct ftp_search {
         const char *pattern;
@@ -66,7 +70,7 @@ static struct ftp_search {
         char skip;
         char term;
         enum nf_ct_ftp_type ftptype;
-        int (*getnum)(const char *, size_t, struct nf_conntrack_man *, char);
+        int (*getnum)(const char *, size_t, struct nf_conntrack_man *, char, unsigned int *);
 } search[IP_CT_DIR_MAX][2] = {
         [IP_CT_DIR_ORIGINAL] = {
                 {
@@ -90,10 +94,8 @@ static struct ftp_search {
                 {
                         .pattern        = "227 ",
                         .plen           = sizeof("227 ") - 1,
-                        .skip           = '(',
-                        .term           = ')',
                         .ftptype        = NF_CT_FTP_PASV,
-                        .getnum         = try_rfc959,
+                        .getnum         = try_rfc1123,
                 },
                 {
                         .pattern        = "229 ",
@@ -132,8 +134,9 @@ static int try_number(const char *data, size_t dlen, u_int32_t array[],
                         i++;
                 else {
                         /* Unexpected character; true if it's the
-                           terminator and we're finished. */
-                        if (*data == term && i == array_size - 1)
+                           terminator (or we don't care about one)
+                           and we're finished. */
+                        if ((*data == term || !term) && i == array_size - 1)
                                 return len;
 
                         pr_debug("Char %u (got %u nums) `%u' unexpected\n",
@@ -148,7 +151,8 @@ static int try_number(const char *data, size_t dlen, u_int32_t array[],
 
 /* Returns 0, or length of numbers: 192,168,1,1,5,6 */
 static int try_rfc959(const char *data, size_t dlen,
-                      struct nf_conntrack_man *cmd, char term)
+                      struct nf_conntrack_man *cmd, char term,
+                      unsigned int *offset)
 {
         int length;
         u_int32_t array[6];
@@ -163,6 +167,33 @@ static int try_rfc959(const char *data, size_t dlen,
         return length;
 }
 
+/*
+ * From RFC 1123:
+ * The format of the 227 reply to a PASV command is not
+ * well standardized.  In particular, an FTP client cannot
+ * assume that the parentheses shown on page 40 of RFC-959
+ * will be present (and in fact, Figure 3 on page 43 omits
+ * them).  Therefore, a User-FTP program that interprets
+ * the PASV reply must scan the reply for the first digit
+ * of the host and port numbers.
+ */
+static int try_rfc1123(const char *data, size_t dlen,
+                       struct nf_conntrack_man *cmd, char term,
+                       unsigned int *offset)
+{
+        int i;
+        for (i = 0; i < dlen; i++)
+                if (isdigit(data[i]))
+                        break;
+
+        if (i == dlen)
+                return 0;
+
+        *offset += i;
+
+        return try_rfc959(data + i, dlen - i, cmd, 0, offset);
+}
+
 /* Grab port: number up to delimiter */
 static int get_port(const char *data, int start, size_t dlen, char delim,
                     __be16 *port)
@@ -191,7 +222,7 @@ static int get_port(const char *data, int start, size_t dlen, char delim,
 
 /* Returns 0, or length of numbers: |1|132.235.1.2|6275| or |2|3ffe::1|6275| */
 static int try_eprt(const char *data, size_t dlen, struct nf_conntrack_man *cmd,
-                    char term)
+                    char term, unsigned int *offset)
 {
         char delim;
         int length;
@@ -239,7 +270,8 @@ static int try_eprt(const char *data, size_t dlen, struct nf_conntrack_man *cmd,
 
 /* Returns 0, or length of numbers: |||6446| */
 static int try_epsv_response(const char *data, size_t dlen,
-                             struct nf_conntrack_man *cmd, char term)
+                             struct nf_conntrack_man *cmd, char term,
+                             unsigned int *offset)
 {
         char delim;
 
@@ -261,9 +293,10 @@ static int find_pattern(const char *data, size_t dlen,
                         unsigned int *numlen,
                         struct nf_conntrack_man *cmd,
                         int (*getnum)(const char *, size_t,
-                                      struct nf_conntrack_man *, char))
+                                      struct nf_conntrack_man *, char,
+                                      unsigned int *))
 {
-        size_t i;
+        size_t i = plen;
 
         pr_debug("find_pattern `%s': dlen = %Zu\n", pattern, dlen);
         if (dlen == 0)
@@ -293,16 +326,18 @@ static int find_pattern(const char *data, size_t dlen,
         pr_debug("Pattern matches!\n");
         /* Now we've found the constant string, try to skip
            to the 'skip' character */
-        for (i = plen; data[i] != skip; i++)
-                if (i == dlen - 1) return -1;
+        if (skip) {
+                for (i = plen; data[i] != skip; i++)
+                        if (i == dlen - 1) return -1;
 
-        /* Skip over the last character */
-        i++;
+                /* Skip over the last character */
+                i++;
+        }
 
         pr_debug("Skipped up to `%c'!\n", skip);
 
         *numoff = i;
-        *numlen = getnum(data + i, dlen - i, cmd, term);
+        *numlen = getnum(data + i, dlen - i, cmd, term, numoff);
         if (!*numlen)
                 return -1;
 
diff --git a/net/netfilter/nf_conntrack_labels.c b/net/netfilter/nf_conntrack_labels.c
index 8fe2e99428b7..bb53f120e79c 100644
--- a/net/netfilter/nf_conntrack_labels.c
+++ b/net/netfilter/nf_conntrack_labels.c
@@ -8,12 +8,8 @@
  * published by the Free Software Foundation.
  */
 
-#include <linux/ctype.h>
 #include <linux/export.h>
-#include <linux/jhash.h>
-#include <linux/spinlock.h>
 #include <linux/types.h>
-#include <linux/slab.h>
 
 #include <net/netfilter/nf_conntrack_ecache.h>
 #include <net/netfilter/nf_conntrack_labels.h>
@@ -45,7 +41,7 @@ int nf_connlabel_set(struct nf_conn *ct, u16 bit)
         if (test_bit(bit, labels->bits))
                 return 0;
 
-        if (test_and_set_bit(bit, labels->bits))
+        if (!test_and_set_bit(bit, labels->bits))
                 nf_conntrack_event_cache(IPCT_LABEL, ct);
 
         return 0;
diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c
index 6d0f8a17c5b7..eea936b70d15 100644
--- a/net/netfilter/nf_conntrack_netlink.c
+++ b/net/netfilter/nf_conntrack_netlink.c
@@ -37,6 +37,7 @@
 #include <net/netfilter/nf_conntrack_core.h>
 #include <net/netfilter/nf_conntrack_expect.h>
 #include <net/netfilter/nf_conntrack_helper.h>
+#include <net/netfilter/nf_conntrack_seqadj.h>
 #include <net/netfilter/nf_conntrack_l3proto.h>
 #include <net/netfilter/nf_conntrack_l4proto.h>
 #include <net/netfilter/nf_conntrack_tuple.h>
@@ -381,9 +382,8 @@ nla_put_failure:
         return -1;
 }
 
-#ifdef CONFIG_NF_NAT_NEEDED
 static int
-dump_nat_seq_adj(struct sk_buff *skb, const struct nf_nat_seq *natseq, int type)
+dump_ct_seq_adj(struct sk_buff *skb, const struct nf_ct_seqadj *seq, int type)
 {
         struct nlattr *nest_parms;
 
@@ -391,12 +391,12 @@ dump_nat_seq_adj(struct sk_buff *skb, const struct nf_nat_seq *natseq, int type)
         if (!nest_parms)
                 goto nla_put_failure;
 
-        if (nla_put_be32(skb, CTA_NAT_SEQ_CORRECTION_POS,
-                         htonl(natseq->correction_pos)) ||
-            nla_put_be32(skb, CTA_NAT_SEQ_OFFSET_BEFORE,
-                         htonl(natseq->offset_before)) ||
-            nla_put_be32(skb, CTA_NAT_SEQ_OFFSET_AFTER,
-                         htonl(natseq->offset_after)))
+        if (nla_put_be32(skb, CTA_SEQADJ_CORRECTION_POS,
+                         htonl(seq->correction_pos)) ||
+            nla_put_be32(skb, CTA_SEQADJ_OFFSET_BEFORE,
+                         htonl(seq->offset_before)) ||
+            nla_put_be32(skb, CTA_SEQADJ_OFFSET_AFTER,
+                         htonl(seq->offset_after)))
                 goto nla_put_failure;
 
         nla_nest_end(skb, nest_parms);
@@ -408,27 +408,24 @@ nla_put_failure:
 }
 
 static inline int
-ctnetlink_dump_nat_seq_adj(struct sk_buff *skb, const struct nf_conn *ct)
+ctnetlink_dump_ct_seq_adj(struct sk_buff *skb, const struct nf_conn *ct)
 {
-        struct nf_nat_seq *natseq;
-        struct nf_conn_nat *nat = nfct_nat(ct);
+        struct nf_conn_seqadj *seqadj = nfct_seqadj(ct);
+        struct nf_ct_seqadj *seq;
 
-        if (!(ct->status & IPS_SEQ_ADJUST) || !nat)
+        if (!(ct->status & IPS_SEQ_ADJUST) || !seqadj)
                 return 0;
 
-        natseq = &nat->seq[IP_CT_DIR_ORIGINAL];
-        if (dump_nat_seq_adj(skb, natseq, CTA_NAT_SEQ_ADJ_ORIG) == -1)
+        seq = &seqadj->seq[IP_CT_DIR_ORIGINAL];
+        if (dump_ct_seq_adj(skb, seq, CTA_SEQ_ADJ_ORIG) == -1)
                 return -1;
 
-        natseq = &nat->seq[IP_CT_DIR_REPLY];
-        if (dump_nat_seq_adj(skb, natseq, CTA_NAT_SEQ_ADJ_REPLY) == -1)
+        seq = &seqadj->seq[IP_CT_DIR_REPLY];
+        if (dump_ct_seq_adj(skb, seq, CTA_SEQ_ADJ_REPLY) == -1)
                 return -1;
 
         return 0;
 }
-#else
-#define ctnetlink_dump_nat_seq_adj(a, b) (0)
-#endif
 
 static inline int
 ctnetlink_dump_id(struct sk_buff *skb, const struct nf_conn *ct)
@@ -502,7 +499,7 @@ ctnetlink_fill_info(struct sk_buff *skb, u32 portid, u32 seq, u32 type,
             ctnetlink_dump_id(skb, ct) < 0 ||
             ctnetlink_dump_use(skb, ct) < 0 ||
             ctnetlink_dump_master(skb, ct) < 0 ||
-            ctnetlink_dump_nat_seq_adj(skb, ct) < 0)
+            ctnetlink_dump_ct_seq_adj(skb, ct) < 0)
                 goto nla_put_failure;
 
         nlmsg_end(skb, nlh);
@@ -707,8 +704,8 @@ ctnetlink_conntrack_event(unsigned int events, struct nf_ct_event *item)
                     ctnetlink_dump_master(skb, ct) < 0)
                         goto nla_put_failure;
 
-                if (events & (1 << IPCT_NATSEQADJ) &&
-                    ctnetlink_dump_nat_seq_adj(skb, ct) < 0)
+                if (events & (1 << IPCT_SEQADJ) &&
+                    ctnetlink_dump_ct_seq_adj(skb, ct) < 0)
                         goto nla_put_failure;
         }
 
@@ -828,7 +825,9 @@ ctnetlink_parse_tuple_ip(struct nlattr *attr, struct nf_conntrack_tuple *tuple)
         struct nf_conntrack_l3proto *l3proto;
         int ret = 0;
 
-        nla_parse_nested(tb, CTA_IP_MAX, attr, NULL);
+        ret = nla_parse_nested(tb, CTA_IP_MAX, attr, NULL);
+        if (ret < 0)
+                return ret;
 
         rcu_read_lock();
         l3proto = __nf_ct_l3proto_find(tuple->src.l3num);
@@ -895,7 +894,9 @@ ctnetlink_parse_tuple(const struct nlattr * const cda[],
 
         memset(tuple, 0, sizeof(*tuple));
 
-        nla_parse_nested(tb, CTA_TUPLE_MAX, cda[type], tuple_nla_policy);
+        err = nla_parse_nested(tb, CTA_TUPLE_MAX, cda[type], tuple_nla_policy);
+        if (err < 0)
+                return err;
 
         if (!tb[CTA_TUPLE_IP])
                 return -EINVAL;
@@ -946,9 +947,12 @@ static inline int
 ctnetlink_parse_help(const struct nlattr *attr, char **helper_name,
                      struct nlattr **helpinfo)
 {
+        int err;
         struct nlattr *tb[CTA_HELP_MAX+1];
 
-        nla_parse_nested(tb, CTA_HELP_MAX, attr, help_nla_policy);
+        err = nla_parse_nested(tb, CTA_HELP_MAX, attr, help_nla_policy);
+        if (err < 0)
+                return err;
 
         if (!tb[CTA_HELP_NAME])
                 return -EINVAL;
@@ -1031,21 +1035,9 @@ ctnetlink_del_conntrack(struct sock *ctnl, struct sk_buff *skb,
                 }
         }
 
-        if (del_timer(&ct->timeout)) {
-                if (nf_conntrack_event_report(IPCT_DESTROY, ct,
-                                              NETLINK_CB(skb).portid,
-                                              nlmsg_report(nlh)) < 0) {
-                        nf_ct_delete_from_lists(ct);
-                        /* we failed to report the event, try later */
-                        nf_ct_dying_timeout(ct);
-                        nf_ct_put(ct);
-                        return 0;
-                }
-                /* death_by_timeout would report the event again */
-                set_bit(IPS_DYING_BIT, &ct->status);
-                nf_ct_delete_from_lists(ct);
-                nf_ct_put(ct);
-        }
+        if (del_timer(&ct->timeout))
+                nf_ct_delete(ct, NETLINK_CB(skb).portid, nlmsg_report(nlh));
+
         nf_ct_put(ct);
 
         return 0;
@@ -1431,7 +1423,9 @@ ctnetlink_change_protoinfo(struct nf_conn *ct, const struct nlattr * const cda[]
         struct nf_conntrack_l4proto *l4proto;
         int err = 0;
 
-        nla_parse_nested(tb, CTA_PROTOINFO_MAX, attr, protoinfo_policy);
+        err = nla_parse_nested(tb, CTA_PROTOINFO_MAX, attr, protoinfo_policy);
+        if (err < 0)
+                return err;
 
         rcu_read_lock();
         l4proto = __nf_ct_l4proto_find(nf_ct_l3num(ct), nf_ct_protonum(ct));
@@ -1442,63 +1436,65 @@ ctnetlink_change_protoinfo(struct nf_conn *ct, const struct nlattr * const cda[]
         return err;
 }
 
-#ifdef CONFIG_NF_NAT_NEEDED
-static const struct nla_policy nat_seq_policy[CTA_NAT_SEQ_MAX+1] = {
-        [CTA_NAT_SEQ_CORRECTION_POS]    = { .type = NLA_U32 },
-        [CTA_NAT_SEQ_OFFSET_BEFORE]     = { .type = NLA_U32 },
-        [CTA_NAT_SEQ_OFFSET_AFTER]      = { .type = NLA_U32 },
+static const struct nla_policy seqadj_policy[CTA_SEQADJ_MAX+1] = {
+        [CTA_SEQADJ_CORRECTION_POS]     = { .type = NLA_U32 },
+        [CTA_SEQADJ_OFFSET_BEFORE]      = { .type = NLA_U32 },
+        [CTA_SEQADJ_OFFSET_AFTER]       = { .type = NLA_U32 },
 };
 
 static inline int
-change_nat_seq_adj(struct nf_nat_seq *natseq, const struct nlattr * const attr)
+change_seq_adj(struct nf_ct_seqadj *seq, const struct nlattr * const attr)
 {
-        struct nlattr *cda[CTA_NAT_SEQ_MAX+1];
+        int err;
+        struct nlattr *cda[CTA_SEQADJ_MAX+1];
 
-        nla_parse_nested(cda, CTA_NAT_SEQ_MAX, attr, nat_seq_policy);
+        err = nla_parse_nested(cda, CTA_SEQADJ_MAX, attr, seqadj_policy);
+        if (err < 0)
+                return err;
 
-        if (!cda[CTA_NAT_SEQ_CORRECTION_POS])
+        if (!cda[CTA_SEQADJ_CORRECTION_POS])
                 return -EINVAL;
 
-        natseq->correction_pos =
-                ntohl(nla_get_be32(cda[CTA_NAT_SEQ_CORRECTION_POS]));
+        seq->correction_pos =
+                ntohl(nla_get_be32(cda[CTA_SEQADJ_CORRECTION_POS]));
 
-        if (!cda[CTA_NAT_SEQ_OFFSET_BEFORE])
+        if (!cda[CTA_SEQADJ_OFFSET_BEFORE])
                 return -EINVAL;
 
-        natseq->offset_before =
-                ntohl(nla_get_be32(cda[CTA_NAT_SEQ_OFFSET_BEFORE]));
+        seq->offset_before =
+                ntohl(nla_get_be32(cda[CTA_SEQADJ_OFFSET_BEFORE]));
 
-        if (!cda[CTA_NAT_SEQ_OFFSET_AFTER])
+        if (!cda[CTA_SEQADJ_OFFSET_AFTER])
                 return -EINVAL;
 
-        natseq->offset_after =
-                ntohl(nla_get_be32(cda[CTA_NAT_SEQ_OFFSET_AFTER]));
+        seq->offset_after =
+                ntohl(nla_get_be32(cda[CTA_SEQADJ_OFFSET_AFTER]));
 
         return 0;
 }
 
 static int
-ctnetlink_change_nat_seq_adj(struct nf_conn *ct,
-                             const struct nlattr * const cda[])
+ctnetlink_change_seq_adj(struct nf_conn *ct,
+                         const struct nlattr * const cda[])
 {
+        struct nf_conn_seqadj *seqadj = nfct_seqadj(ct);
         int ret = 0;
-        struct nf_conn_nat *nat = nfct_nat(ct);
 
-        if (!nat)
+        if (!seqadj)
                 return 0;
 
-        if (cda[CTA_NAT_SEQ_ADJ_ORIG]) {
-                ret = change_nat_seq_adj(&nat->seq[IP_CT_DIR_ORIGINAL],
-                                         cda[CTA_NAT_SEQ_ADJ_ORIG]);
+        if (cda[CTA_SEQ_ADJ_ORIG]) {
+                ret = change_seq_adj(&seqadj->seq[IP_CT_DIR_ORIGINAL],
+                                     cda[CTA_SEQ_ADJ_ORIG]);
                 if (ret < 0)
                         return ret;
 
                 ct->status |= IPS_SEQ_ADJUST;
         }
 
-        if (cda[CTA_NAT_SEQ_ADJ_REPLY]) {
-                ret = change_nat_seq_adj(&nat->seq[IP_CT_DIR_REPLY],
-                                         cda[CTA_NAT_SEQ_ADJ_REPLY]);
+        if (cda[CTA_SEQ_ADJ_REPLY]) {
+                ret = change_seq_adj(&seqadj->seq[IP_CT_DIR_REPLY],
+                                     cda[CTA_SEQ_ADJ_REPLY]);
                 if (ret < 0)
                         return ret;
 
@@ -1507,7 +1503,6 @@ ctnetlink_change_nat_seq_adj(struct nf_conn *ct,
 
         return 0;
 }
-#endif
 
 static int
 ctnetlink_attach_labels(struct nf_conn *ct, const struct nlattr * const cda[])
@@ -1573,13 +1568,12 @@ ctnetlink_change_conntrack(struct nf_conn *ct,
                 ct->mark = ntohl(nla_get_be32(cda[CTA_MARK]));
 #endif
 
-#ifdef CONFIG_NF_NAT_NEEDED
-        if (cda[CTA_NAT_SEQ_ADJ_ORIG] || cda[CTA_NAT_SEQ_ADJ_REPLY]) {
-                err = ctnetlink_change_nat_seq_adj(ct, cda);
+        if (cda[CTA_SEQ_ADJ_ORIG] || cda[CTA_SEQ_ADJ_REPLY]) {
+                err = ctnetlink_change_seq_adj(ct, cda);
                 if (err < 0)
                         return err;
         }
-#endif
+
         if (cda[CTA_LABELS]) {
                 err = ctnetlink_attach_labels(ct, cda);
                 if (err < 0)
@@ -1684,13 +1678,11 @@ ctnetlink_create_conntrack(struct net *net, u16 zone,
                         goto err2;
         }
 
-#ifdef CONFIG_NF_NAT_NEEDED
-        if (cda[CTA_NAT_SEQ_ADJ_ORIG] || cda[CTA_NAT_SEQ_ADJ_REPLY]) {
-                err = ctnetlink_change_nat_seq_adj(ct, cda);
+        if (cda[CTA_SEQ_ADJ_ORIG] || cda[CTA_SEQ_ADJ_REPLY]) {
+                err = ctnetlink_change_seq_adj(ct, cda);
                 if (err < 0)
                         goto err2;
         }
-#endif
 
         memset(&ct->proto, 0, sizeof(ct->proto));
         if (cda[CTA_PROTOINFO]) {
@@ -1804,7 +1796,7 @@ ctnetlink_new_conntrack(struct sock *ctnl, struct sk_buff *skb,
                                                       (1 << IPCT_ASSURED) |
                                                       (1 << IPCT_HELPER) |
                                                       (1 << IPCT_PROTOINFO) |
-                                                      (1 << IPCT_NATSEQADJ) |
+                                                      (1 << IPCT_SEQADJ) |
                                                       (1 << IPCT_MARK) | events,
                                                       ct, NETLINK_CB(skb).portid,
                                                       nlmsg_report(nlh));
@@ -1825,8 +1817,9 @@ ctnetlink_new_conntrack(struct sock *ctnl, struct sk_buff *skb,
                         nf_conntrack_eventmask_report((1 << IPCT_REPLY) |
                                                       (1 << IPCT_ASSURED) |
                                                       (1 << IPCT_HELPER) |
+                                                      (1 << IPCT_LABEL) |
                                                       (1 << IPCT_PROTOINFO) |
-                                                      (1 << IPCT_NATSEQADJ) |
+                                                      (1 << IPCT_SEQADJ) |
                                                       (1 << IPCT_MARK),
                                                       ct, NETLINK_CB(skb).portid,
                                                       nlmsg_report(nlh));
@@ -1986,6 +1979,27 @@ out:
         return err == -EAGAIN ? -ENOBUFS : err;
 }
 
+static const struct nla_policy exp_nla_policy[CTA_EXPECT_MAX+1] = {
+        [CTA_EXPECT_MASTER]     = { .type = NLA_NESTED },
+        [CTA_EXPECT_TUPLE]      = { .type = NLA_NESTED },
+        [CTA_EXPECT_MASK]       = { .type = NLA_NESTED },
+        [CTA_EXPECT_TIMEOUT]    = { .type = NLA_U32 },
+        [CTA_EXPECT_ID]         = { .type = NLA_U32 },
+        [CTA_EXPECT_HELP_NAME]  = { .type = NLA_NUL_STRING,
+                                    .len = NF_CT_HELPER_NAME_LEN - 1 },
+        [CTA_EXPECT_ZONE]       = { .type = NLA_U16 },
+        [CTA_EXPECT_FLAGS]      = { .type = NLA_U32 },
+        [CTA_EXPECT_CLASS]      = { .type = NLA_U32 },
+        [CTA_EXPECT_NAT]        = { .type = NLA_NESTED },
+        [CTA_EXPECT_FN]         = { .type = NLA_NUL_STRING },
+};
+
+static struct nf_conntrack_expect *
+ctnetlink_alloc_expect(const struct nlattr *const cda[], struct nf_conn *ct,
+                       struct nf_conntrack_helper *helper,
+                       struct nf_conntrack_tuple *tuple,
+                       struct nf_conntrack_tuple *mask);
+
 #ifdef CONFIG_NETFILTER_NETLINK_QUEUE_CT
 static size_t
 ctnetlink_nfqueue_build_size(const struct nf_conn *ct)
@@ -2060,7 +2074,7 @@ ctnetlink_nfqueue_build(struct sk_buff *skb, struct nf_conn *ct)
                 goto nla_put_failure;
 
         if ((ct->status & IPS_SEQ_ADJUST) &&
-            ctnetlink_dump_nat_seq_adj(skb, ct) < 0)
+            ctnetlink_dump_ct_seq_adj(skb, ct) < 0)
                 goto nla_put_failure;
 
 #ifdef CONFIG_NF_CONNTRACK_MARK
@@ -2115,7 +2129,9 @@ ctnetlink_nfqueue_parse(const struct nlattr *attr, struct nf_conn *ct)
         struct nlattr *cda[CTA_MAX+1];
         int ret;
 
-        nla_parse_nested(cda, CTA_MAX, attr, ct_nla_policy);
+        ret = nla_parse_nested(cda, CTA_MAX, attr, ct_nla_policy);
+        if (ret < 0)
+                return ret;
 
         spin_lock_bh(&nf_conntrack_lock);
         ret = ctnetlink_nfqueue_parse_ct((const struct nlattr **)cda, ct);
@@ -2124,10 +2140,70 @@ ctnetlink_nfqueue_parse(const struct nlattr *attr, struct nf_conn *ct)
         return ret;
 }
 
+static int ctnetlink_nfqueue_exp_parse(const struct nlattr * const *cda,
+                                       const struct nf_conn *ct,
+                                       struct nf_conntrack_tuple *tuple,
+                                       struct nf_conntrack_tuple *mask)
+{
+        int err;
+
+        err = ctnetlink_parse_tuple(cda, tuple, CTA_EXPECT_TUPLE,
+                                    nf_ct_l3num(ct));
+        if (err < 0)
+                return err;
+
+        return ctnetlink_parse_tuple(cda, mask, CTA_EXPECT_MASK,
+                                     nf_ct_l3num(ct));
+}
+
+static int
+ctnetlink_nfqueue_attach_expect(const struct nlattr *attr, struct nf_conn *ct,
+                                u32 portid, u32 report)
+{
+        struct nlattr *cda[CTA_EXPECT_MAX+1];
+        struct nf_conntrack_tuple tuple, mask;
+        struct nf_conntrack_helper *helper = NULL;
+        struct nf_conntrack_expect *exp;
+        int err;
+
+        err = nla_parse_nested(cda, CTA_EXPECT_MAX, attr, exp_nla_policy);
+        if (err < 0)
+                return err;
+
+        err = ctnetlink_nfqueue_exp_parse((const struct nlattr * const *)cda,
+                                          ct, &tuple, &mask);
+        if (err < 0)
+                return err;
+
+        if (cda[CTA_EXPECT_HELP_NAME]) {
+                const char *helpname = nla_data(cda[CTA_EXPECT_HELP_NAME]);
+
+                helper = __nf_conntrack_helper_find(helpname, nf_ct_l3num(ct),
+                                                    nf_ct_protonum(ct));
+                if (helper == NULL)
+                        return -EOPNOTSUPP;
+        }
+
+        exp = ctnetlink_alloc_expect((const struct nlattr * const *)cda, ct,
+                                     helper, &tuple, &mask);
+        if (IS_ERR(exp))
+                return PTR_ERR(exp);
+
+        err = nf_ct_expect_related_report(exp, portid, report);
+        if (err < 0) {
+                nf_ct_expect_put(exp);
+                return err;
+        }
+
+        return 0;
+}
+
 static struct nfq_ct_hook ctnetlink_nfqueue_hook = {
         .build_size     = ctnetlink_nfqueue_build_size,
         .build          = ctnetlink_nfqueue_build,
         .parse          = ctnetlink_nfqueue_parse,
+        .attach_expect  = ctnetlink_nfqueue_attach_expect,
+        .seq_adjust     = nf_ct_tcp_seqadj_set,
 };
 #endif /* CONFIG_NETFILTER_NETLINK_QUEUE_CT */
 
@@ -2495,21 +2571,6 @@ static int ctnetlink_dump_exp_ct(struct sock *ctnl, struct sk_buff *skb,
         return err;
 }
 
-static const struct nla_policy exp_nla_policy[CTA_EXPECT_MAX+1] = {
-        [CTA_EXPECT_MASTER]     = { .type = NLA_NESTED },
-        [CTA_EXPECT_TUPLE]      = { .type = NLA_NESTED },
-        [CTA_EXPECT_MASK]       = { .type = NLA_NESTED },
-        [CTA_EXPECT_TIMEOUT]    = { .type = NLA_U32 },
-        [CTA_EXPECT_ID]         = { .type = NLA_U32 },
-        [CTA_EXPECT_HELP_NAME]  = { .type = NLA_NUL_STRING,
-                                    .len = NF_CT_HELPER_NAME_LEN - 1 },
-        [CTA_EXPECT_ZONE]       = { .type = NLA_U16 },
-        [CTA_EXPECT_FLAGS]      = { .type = NLA_U32 },
-        [CTA_EXPECT_CLASS]      = { .type = NLA_U32 },
-        [CTA_EXPECT_NAT]        = { .type = NLA_NESTED },
-        [CTA_EXPECT_FN]         = { .type = NLA_NUL_STRING },
-};
-
 static int
 ctnetlink_get_expect(struct sock *ctnl, struct sk_buff *skb,
                      const struct nlmsghdr *nlh,
@@ -2710,7 +2771,9 @@ ctnetlink_parse_expect_nat(const struct nlattr *attr,
         struct nf_conntrack_tuple nat_tuple = {};
         int err;
 
-        nla_parse_nested(tb, CTA_EXPECT_NAT_MAX, attr, exp_nat_nla_policy);
+        err = nla_parse_nested(tb, CTA_EXPECT_NAT_MAX, attr, exp_nat_nla_policy);
+        if (err < 0)
+                return err;
 
         if (!tb[CTA_EXPECT_NAT_DIR] || !tb[CTA_EXPECT_NAT_TUPLE])
                 return -EINVAL;
@@ -2730,76 +2793,26 @@ ctnetlink_parse_expect_nat(const struct nlattr *attr,
 #endif
 }
 
-static int
-ctnetlink_create_expect(struct net *net, u16 zone,
-                        const struct nlattr * const cda[],
-                        u_int8_t u3,
-                        u32 portid, int report)
+static struct nf_conntrack_expect *
+ctnetlink_alloc_expect(const struct nlattr * const cda[], struct nf_conn *ct,
+                       struct nf_conntrack_helper *helper,
+                       struct nf_conntrack_tuple *tuple,
+                       struct nf_conntrack_tuple *mask)
 {
-        struct nf_conntrack_tuple tuple, mask, master_tuple;
-        struct nf_conntrack_tuple_hash *h = NULL;
+        u_int32_t class = 0;
         struct nf_conntrack_expect *exp;
-        struct nf_conn *ct;
         struct nf_conn_help *help;
-        struct nf_conntrack_helper *helper = NULL;
-        u_int32_t class = 0;
-        int err = 0;
-
-        /* caller guarantees that those three CTA_EXPECT_* exist */
-        err = ctnetlink_parse_tuple(cda, &tuple, CTA_EXPECT_TUPLE, u3);
-        if (err < 0)
-                return err;
-        err = ctnetlink_parse_tuple(cda, &mask, CTA_EXPECT_MASK, u3);
-        if (err < 0)
-                return err;
-        err = ctnetlink_parse_tuple(cda, &master_tuple, CTA_EXPECT_MASTER, u3);
-        if (err < 0)
-                return err;
-
-        /* Look for master conntrack of this expectation */
-        h = nf_conntrack_find_get(net, zone, &master_tuple);
-        if (!h)
-                return -ENOENT;
-        ct = nf_ct_tuplehash_to_ctrack(h);
-
-        /* Look for helper of this expectation */
-        if (cda[CTA_EXPECT_HELP_NAME]) {
-                const char *helpname = nla_data(cda[CTA_EXPECT_HELP_NAME]);
-
-                helper = __nf_conntrack_helper_find(helpname, nf_ct_l3num(ct),
-                                                    nf_ct_protonum(ct));
-                if (helper == NULL) {
-#ifdef CONFIG_MODULES
-                        if (request_module("nfct-helper-%s", helpname) < 0) {
-                                err = -EOPNOTSUPP;
-                                goto out;
-                        }
-
-                        helper = __nf_conntrack_helper_find(helpname,
-                                                            nf_ct_l3num(ct),
-                                                            nf_ct_protonum(ct));
-                        if (helper) {
-                                err = -EAGAIN;
-                                goto out;
-                        }
-#endif
-                        err = -EOPNOTSUPP;
-                        goto out;
-                }
-        }
+        int err;
 
         if (cda[CTA_EXPECT_CLASS] && helper) {
                 class = ntohl(nla_get_be32(cda[CTA_EXPECT_CLASS]));
-                if (class > helper->expect_class_max) {
-                        err = -EINVAL;
-                        goto out;
-                }
+                if (class > helper->expect_class_max)
+                        return ERR_PTR(-EINVAL);
         }
         exp = nf_ct_expect_alloc(ct);
-        if (!exp) {
-                err = -ENOMEM;
-                goto out;
-        }
+        if (!exp)
+                return ERR_PTR(-ENOMEM);
+
         help = nfct_help(ct);
         if (!help) {
                 if (!cda[CTA_EXPECT_TIMEOUT]) {
@@ -2837,21 +2850,89 @@ ctnetlink_create_expect(struct net *net, u16 zone,
         exp->class = class;
         exp->master = ct;
         exp->helper = helper;
-        memcpy(&exp->tuple, &tuple, sizeof(struct nf_conntrack_tuple));
-        memcpy(&exp->mask.src.u3, &mask.src.u3, sizeof(exp->mask.src.u3));
-        exp->mask.src.u.all = mask.src.u.all;
+        exp->tuple = *tuple;
+        exp->mask.src.u3 = mask->src.u3;
+        exp->mask.src.u.all = mask->src.u.all;
 
         if (cda[CTA_EXPECT_NAT]) {
                 err = ctnetlink_parse_expect_nat(cda[CTA_EXPECT_NAT],
-                                                 exp, u3);
+                                                 exp, nf_ct_l3num(ct));
                 if (err < 0)
                         goto err_out;
         }
-        err = nf_ct_expect_related_report(exp, portid, report);
+        return exp;
 err_out:
         nf_ct_expect_put(exp);
-out:
-        nf_ct_put(nf_ct_tuplehash_to_ctrack(h));
+        return ERR_PTR(err);
+}
+
+static int
+ctnetlink_create_expect(struct net *net, u16 zone,
+                        const struct nlattr * const cda[],
+                        u_int8_t u3, u32 portid, int report)
+{
+        struct nf_conntrack_tuple tuple, mask, master_tuple;
+        struct nf_conntrack_tuple_hash *h = NULL;
+        struct nf_conntrack_helper *helper = NULL;
+        struct nf_conntrack_expect *exp;
+        struct nf_conn *ct;
+        int err;
+
+        /* caller guarantees that those three CTA_EXPECT_* exist */
+        err = ctnetlink_parse_tuple(cda, &tuple, CTA_EXPECT_TUPLE, u3);
+        if (err < 0)
+                return err;
+        err = ctnetlink_parse_tuple(cda, &mask, CTA_EXPECT_MASK, u3);
+        if (err < 0)
+                return err;
+        err = ctnetlink_parse_tuple(cda, &master_tuple, CTA_EXPECT_MASTER, u3);
+        if (err < 0)
+                return err;
+
+        /* Look for master conntrack of this expectation */
+        h = nf_conntrack_find_get(net, zone, &master_tuple);
+        if (!h)
+                return -ENOENT;
+        ct = nf_ct_tuplehash_to_ctrack(h);
+
+        if (cda[CTA_EXPECT_HELP_NAME]) {
+                const char *helpname = nla_data(cda[CTA_EXPECT_HELP_NAME]);
+
+                helper = __nf_conntrack_helper_find(helpname, u3,
+                                                    nf_ct_protonum(ct));
+                if (helper == NULL) {
+#ifdef CONFIG_MODULES
+                        if (request_module("nfct-helper-%s", helpname) < 0) {
+                                err = -EOPNOTSUPP;
+                                goto err_ct;
+                        }
+                        helper = __nf_conntrack_helper_find(helpname, u3,
+                                                            nf_ct_protonum(ct));
+                        if (helper) {
+                                err = -EAGAIN;
+                                goto err_ct;
+                        }
+#endif
+                        err = -EOPNOTSUPP;
+                        goto err_ct;
+                }
+        }
+
+        exp = ctnetlink_alloc_expect(cda, ct, helper, &tuple, &mask);
+        if (IS_ERR(exp)) {
+                err = PTR_ERR(exp);
+                goto err_ct;
+        }
+
+        err = nf_ct_expect_related_report(exp, portid, report);
+        if (err < 0)
+                goto err_exp;
+
+        return 0;
+err_exp:
+        nf_ct_expect_put(exp);
+err_ct:
+        nf_ct_put(ct);
         return err;
 }
 
diff --git a/net/netfilter/nf_conntrack_proto.c b/net/netfilter/nf_conntrack_proto.c
index 0ab9636ac57e..ce3004156eeb 100644
--- a/net/netfilter/nf_conntrack_proto.c
+++ b/net/netfilter/nf_conntrack_proto.c
@@ -281,7 +281,7 @@ void nf_ct_l3proto_pernet_unregister(struct net *net,
         nf_ct_l3proto_unregister_sysctl(net, proto);
 
         /* Remove all contrack entries for this protocol */
-        nf_ct_iterate_cleanup(net, kill_l3proto, proto);
+        nf_ct_iterate_cleanup(net, kill_l3proto, proto, 0, 0);
 }
 EXPORT_SYMBOL_GPL(nf_ct_l3proto_pernet_unregister);
 
@@ -476,7 +476,7 @@ void nf_ct_l4proto_pernet_unregister(struct net *net,
         nf_ct_l4proto_unregister_sysctl(net, pn, l4proto);
 
         /* Remove all contrack entries for this protocol */
-        nf_ct_iterate_cleanup(net, kill_l4proto, l4proto);
+        nf_ct_iterate_cleanup(net, kill_l4proto, l4proto, 0, 0);
 }
 EXPORT_SYMBOL_GPL(nf_ct_l4proto_pernet_unregister);
 
diff --git a/net/netfilter/nf_conntrack_proto_tcp.c b/net/netfilter/nf_conntrack_proto_tcp.c
index 4d4d8f1d01fc..44d1ea32570a 100644
--- a/net/netfilter/nf_conntrack_proto_tcp.c
+++ b/net/netfilter/nf_conntrack_proto_tcp.c
@@ -27,6 +27,8 @@
 #include <net/netfilter/nf_conntrack.h>
 #include <net/netfilter/nf_conntrack_l4proto.h>
 #include <net/netfilter/nf_conntrack_ecache.h>
+#include <net/netfilter/nf_conntrack_seqadj.h>
+#include <net/netfilter/nf_conntrack_synproxy.h>
 #include <net/netfilter/nf_log.h>
 #include <net/netfilter/ipv4/nf_conntrack_ipv4.h>
 #include <net/netfilter/ipv6/nf_conntrack_ipv6.h>
@@ -495,21 +497,6 @@ static void tcp_sack(const struct sk_buff *skb, unsigned int dataoff,
         }
 }
 
-#ifdef CONFIG_NF_NAT_NEEDED
-static inline s16 nat_offset(const struct nf_conn *ct,
-                             enum ip_conntrack_dir dir,
-                             u32 seq)
-{
-        typeof(nf_ct_nat_offset) get_offset = rcu_dereference(nf_ct_nat_offset);
-
-        return get_offset != NULL ? get_offset(ct, dir, seq) : 0;
-}
-#define NAT_OFFSET(ct, dir, seq) \
-        (nat_offset(ct, dir, seq))
-#else
-#define NAT_OFFSET(ct, dir, seq)        0
-#endif
-
 static bool tcp_in_window(const struct nf_conn *ct,
                           struct ip_ct_tcp *state,
                           enum ip_conntrack_dir dir,
@@ -525,8 +512,8 @@ static bool tcp_in_window(const struct nf_conn *ct,
         struct ip_ct_tcp_state *receiver = &state->seen[!dir];
         const struct nf_conntrack_tuple *tuple = &ct->tuplehash[dir].tuple;
         __u32 seq, ack, sack, end, win, swin;
-        s16 receiver_offset;
-        bool res;
+        s32 receiver_offset;
+        bool res, in_recv_win;
 
         /*
          * Get the required data from the packet.
@@ -540,7 +527,7 @@ static bool tcp_in_window(const struct nf_conn *ct,
                 tcp_sack(skb, dataoff, tcph, &sack);
 
         /* Take into account NAT sequence number mangling */
-        receiver_offset = NAT_OFFSET(ct, !dir, ack - 1);
+        receiver_offset = nf_ct_seq_offset(ct, !dir, ack - 1);
         ack -= receiver_offset;
         sack -= receiver_offset;
 
@@ -649,14 +636,18 @@ static bool tcp_in_window(const struct nf_conn *ct,
                  receiver->td_end, receiver->td_maxend, receiver->td_maxwin,
                  receiver->td_scale);
 
+        /* Is the ending sequence in the receive window (if available)? */
+        in_recv_win = !receiver->td_maxwin ||
+                      after(end, sender->td_end - receiver->td_maxwin - 1);
+
         pr_debug("tcp_in_window: I=%i II=%i III=%i IV=%i\n",
                  before(seq, sender->td_maxend + 1),
-                 after(end, sender->td_end - receiver->td_maxwin - 1),
+                 (in_recv_win ? 1 : 0),
                  before(sack, receiver->td_end + 1),
                  after(sack, receiver->td_end - MAXACKWINDOW(sender) - 1));
 
         if (before(seq, sender->td_maxend + 1) &&
-            after(end, sender->td_end - receiver->td_maxwin - 1) &&
+            in_recv_win &&
             before(sack, receiver->td_end + 1) &&
             after(sack, receiver->td_end - MAXACKWINDOW(sender) - 1)) {
                 /*
@@ -725,7 +716,7 @@ static bool tcp_in_window(const struct nf_conn *ct,
                         nf_log_packet(net, pf, 0, skb, NULL, NULL, NULL,
                         "nf_ct_tcp: %s ",
                         before(seq, sender->td_maxend + 1) ?
-                        after(end, sender->td_end - receiver->td_maxwin - 1) ?
+                        in_recv_win ?
                         before(sack, receiver->td_end + 1) ?
                         after(sack, receiver->td_end - MAXACKWINDOW(sender) - 1) ? "BUG"
                         : "ACK is under the lower bound (possible overly delayed ACK)"
@@ -956,6 +947,21 @@ static int tcp_packet(struct nf_conn *ct,
                                   "state %s ", tcp_conntrack_names[old_state]);
                 return NF_ACCEPT;
         case TCP_CONNTRACK_MAX:
+                /* Special case for SYN proxy: when the SYN to the server or
+                 * the SYN/ACK from the server is lost, the client may transmit
+                 * a keep-alive packet while in SYN_SENT state. This needs to
+                 * be associated with the original conntrack entry in order to
+                 * generate a new SYN with the correct sequence number.
+                 */
+                if (nfct_synproxy(ct) && old_state == TCP_CONNTRACK_SYN_SENT &&
+                    index == TCP_ACK_SET && dir == IP_CT_DIR_ORIGINAL &&
+                    ct->proto.tcp.last_dir == IP_CT_DIR_ORIGINAL &&
+                    ct->proto.tcp.seen[dir].td_end - 1 == ntohl(th->seq)) {
+                        pr_debug("nf_ct_tcp: SYN proxy client keep alive\n");
+                        spin_unlock_bh(&ct->lock);
+                        return NF_ACCEPT;
+                }
+
                 /* Invalid packet */
                 pr_debug("nf_ct_tcp: Invalid dir=%i index=%u ostate=%u\n",
                          dir, get_conntrack_index(th), old_state);
@@ -1043,6 +1049,12 @@ static int tcp_packet(struct nf_conn *ct,
                         nf_ct_kill_acct(ct, ctinfo, skb);
                         return NF_ACCEPT;
                 }
+                /* ESTABLISHED without SEEN_REPLY, i.e. mid-connection
+                 * pickup with loose=1. Avoid large ESTABLISHED timeout.
+                 */
+                if (new_state == TCP_CONNTRACK_ESTABLISHED &&
+                    timeout > timeouts[TCP_CONNTRACK_UNACK])
+                        timeout = timeouts[TCP_CONNTRACK_UNACK];
         } else if (!test_bit(IPS_ASSURED_BIT, &ct->status)
                    && (old_state == TCP_CONNTRACK_SYN_RECV
                        || old_state == TCP_CONNTRACK_ESTABLISHED)
diff --git a/net/netfilter/nf_conntrack_seqadj.c b/net/netfilter/nf_conntrack_seqadj.c
new file mode 100644
index 000000000000..5f9bfd060dea
--- /dev/null
+++ b/net/netfilter/nf_conntrack_seqadj.c
@@ -0,0 +1,238 @@
+#include <linux/types.h>
+#include <linux/netfilter.h>
+#include <net/tcp.h>
+
+#include <net/netfilter/nf_conntrack.h>
+#include <net/netfilter/nf_conntrack_extend.h>
+#include <net/netfilter/nf_conntrack_seqadj.h>
+
+int nf_ct_seqadj_init(struct nf_conn *ct, enum ip_conntrack_info ctinfo,
+                      s32 off)
+{
+        enum ip_conntrack_dir dir = CTINFO2DIR(ctinfo);
+        struct nf_conn_seqadj *seqadj;
+        struct nf_ct_seqadj *this_way;
+
+        if (off == 0)
+                return 0;
+
+        set_bit(IPS_SEQ_ADJUST_BIT, &ct->status);
+
+        seqadj = nfct_seqadj(ct);
+        this_way = &seqadj->seq[dir];
+        this_way->offset_before  = off;
+        this_way->offset_after   = off;
+        return 0;
+}
+EXPORT_SYMBOL_GPL(nf_ct_seqadj_init);
+
+int nf_ct_seqadj_set(struct nf_conn *ct, enum ip_conntrack_info ctinfo,
+                     __be32 seq, s32 off)
+{
+        struct nf_conn_seqadj *seqadj = nfct_seqadj(ct);
+        enum ip_conntrack_dir dir = CTINFO2DIR(ctinfo);
+        struct nf_ct_seqadj *this_way;
+
+        if (off == 0)
+                return 0;
+
+        set_bit(IPS_SEQ_ADJUST_BIT, &ct->status);
+
+        spin_lock_bh(&ct->lock);
+        this_way = &seqadj->seq[dir];
+        if (this_way->offset_before == this_way->offset_after ||
+            before(this_way->correction_pos, seq)) {
+                this_way->correction_pos = seq;
+                this_way->offset_before  = this_way->offset_after;
+                this_way->offset_after  += off;
+        }
+        spin_unlock_bh(&ct->lock);
+        return 0;
+}
+EXPORT_SYMBOL_GPL(nf_ct_seqadj_set);
+
+void nf_ct_tcp_seqadj_set(struct sk_buff *skb,
+                          struct nf_conn *ct, enum ip_conntrack_info ctinfo,
+                          s32 off)
+{
+        const struct tcphdr *th;
+
+        if (nf_ct_protonum(ct) != IPPROTO_TCP)
+                return;
+
+        th = (struct tcphdr *)(skb_network_header(skb) + ip_hdrlen(skb));
+        nf_ct_seqadj_set(ct, ctinfo, th->seq, off);
+}
+EXPORT_SYMBOL_GPL(nf_ct_tcp_seqadj_set);
+
+/* Adjust one found SACK option including checksum correction */
+static void nf_ct_sack_block_adjust(struct sk_buff *skb,
+                                    struct tcphdr *tcph,
+                                    unsigned int sackoff,
+                                    unsigned int sackend,
+                                    struct nf_ct_seqadj *seq)
+{
+        while (sackoff < sackend) {
+                struct tcp_sack_block_wire *sack;
+                __be32 new_start_seq, new_end_seq;
+
+                sack = (void *)skb->data + sackoff;
+                if (after(ntohl(sack->start_seq) - seq->offset_before,
+                          seq->correction_pos))
+                        new_start_seq = htonl(ntohl(sack->start_seq) -
+                                        seq->offset_after);
+                else
+                        new_start_seq = htonl(ntohl(sack->start_seq) -
+                                        seq->offset_before);
+
+                if (after(ntohl(sack->end_seq) - seq->offset_before,
+                          seq->correction_pos))
+                        new_end_seq = htonl(ntohl(sack->end_seq) -
+                                      seq->offset_after);
+                else
+                        new_end_seq = htonl(ntohl(sack->end_seq) -
+                                      seq->offset_before);
+
+                pr_debug("sack_adjust: start_seq: %d->%d, end_seq: %d->%d\n",
+                         ntohl(sack->start_seq), new_start_seq,
+                         ntohl(sack->end_seq), new_end_seq);
+
+                inet_proto_csum_replace4(&tcph->check, skb,
+                                         sack->start_seq, new_start_seq, 0);
+                inet_proto_csum_replace4(&tcph->check, skb,
+                                         sack->end_seq, new_end_seq, 0);
+                sack->start_seq = new_start_seq;
+                sack->end_seq = new_end_seq;
+                sackoff += sizeof(*sack);
+        }
+}
+
+/* TCP SACK sequence number adjustment */
+static unsigned int nf_ct_sack_adjust(struct sk_buff *skb,
+                                      unsigned int protoff,
+                                      struct tcphdr *tcph,
+                                      struct nf_conn *ct,
+                                      enum ip_conntrack_info ctinfo)
+{
+        unsigned int dir, optoff, optend;
+        struct nf_conn_seqadj *seqadj = nfct_seqadj(ct);
+
+        optoff = protoff + sizeof(struct tcphdr);
+        optend = protoff + tcph->doff * 4;
+
+        if (!skb_make_writable(skb, optend))
+                return 0;
+
+        dir = CTINFO2DIR(ctinfo);
+
+        while (optoff < optend) {
+                /* Usually: option, length. */
+                unsigned char *op = skb->data + optoff;
+
+                switch (op[0]) {
+                case TCPOPT_EOL:
+                        return 1;
+                case TCPOPT_NOP:
+                        optoff++;
+                        continue;
+                default:
+                        /* no partial options */
+                        if (optoff + 1 == optend ||
+                            optoff + op[1] > optend ||
+                            op[1] < 2)
+                                return 0;
+                        if (op[0] == TCPOPT_SACK &&
+                            op[1] >= 2+TCPOLEN_SACK_PERBLOCK &&
+                            ((op[1] - 2) % TCPOLEN_SACK_PERBLOCK) == 0)
+                                nf_ct_sack_block_adjust(skb, tcph, optoff + 2,
+                                                        optoff+op[1],
+                                                        &seqadj->seq[!dir]);
+                        optoff += op[1];
+                }
+        }
+        return 1;
+}
+
+/* TCP sequence number adjustment.  Returns 1 on success, 0 on failure */
+int nf_ct_seq_adjust(struct sk_buff *skb,
+                     struct nf_conn *ct, enum ip_conntrack_info ctinfo,
+                     unsigned int protoff)
+{
+        enum ip_conntrack_dir dir = CTINFO2DIR(ctinfo);
+        struct tcphdr *tcph;
+        __be32 newseq, newack;
+        s32 seqoff, ackoff;
+        struct nf_conn_seqadj *seqadj = nfct_seqadj(ct);
+        struct nf_ct_seqadj *this_way, *other_way;
+        int res;
+
+        this_way  = &seqadj->seq[dir];
+        other_way = &seqadj->seq[!dir];
+
+        if (!skb_make_writable(skb, protoff + sizeof(*tcph)))
+                return 0;
+
+        tcph = (void *)skb->data + protoff;
+        spin_lock_bh(&ct->lock);
+        if (after(ntohl(tcph->seq), this_way->correction_pos))
+                seqoff = this_way->offset_after;
+        else
+                seqoff = this_way->offset_before;
+
+        if (after(ntohl(tcph->ack_seq) - other_way->offset_before,
+                  other_way->correction_pos))
+                ackoff = other_way->offset_after;
+        else
+                ackoff = other_way->offset_before;
+
+        newseq = htonl(ntohl(tcph->seq) + seqoff);
+        newack = htonl(ntohl(tcph->ack_seq) - ackoff);
+
+        inet_proto_csum_replace4(&tcph->check, skb, tcph->seq, newseq, 0);
+        inet_proto_csum_replace4(&tcph->check, skb, tcph->ack_seq, newack, 0);
+
+        pr_debug("Adjusting sequence number from %u->%u, ack from %u->%u\n",
+                 ntohl(tcph->seq), ntohl(newseq), ntohl(tcph->ack_seq),
+                 ntohl(newack));
+
+        tcph->seq = newseq;
+        tcph->ack_seq = newack;
+
+        res = nf_ct_sack_adjust(skb, protoff, tcph, ct, ctinfo);
+        spin_unlock_bh(&ct->lock);
+
+        return res;
+}
+EXPORT_SYMBOL_GPL(nf_ct_seq_adjust);
+
+s32 nf_ct_seq_offset(const struct nf_conn *ct,
+                     enum ip_conntrack_dir dir,
+                     u32 seq)
+{
+        struct nf_conn_seqadj *seqadj = nfct_seqadj(ct);
+        struct nf_ct_seqadj *this_way;
+
+        if (!seqadj)
+                return 0;
+
+        this_way = &seqadj->seq[dir];
+        return after(seq, this_way->correction_pos) ?
+                 this_way->offset_after : this_way->offset_before;
+}
+EXPORT_SYMBOL_GPL(nf_ct_seq_offset);
+
+static struct nf_ct_ext_type nf_ct_seqadj_extend __read_mostly = {
+        .len    = sizeof(struct nf_conn_seqadj),
+        .align  = __alignof__(struct nf_conn_seqadj),
+        .id     = NF_CT_EXT_SEQADJ,
+};
+
+int nf_conntrack_seqadj_init(void)
+{
+        return nf_ct_extend_register(&nf_ct_seqadj_extend);
+}
+
+void nf_conntrack_seqadj_fini(void)
+{
+        nf_ct_extend_unregister(&nf_ct_seqadj_extend);
+}
diff --git a/net/netfilter/nf_conntrack_standalone.c b/net/netfilter/nf_conntrack_standalone.c
index bd700b4013c1..f641751dba9d 100644
--- a/net/netfilter/nf_conntrack_standalone.c
+++ b/net/netfilter/nf_conntrack_standalone.c
@@ -408,7 +408,7 @@ static int log_invalid_proto_max = 255;
 
 static struct ctl_table_header *nf_ct_netfilter_header;
 
-static ctl_table nf_ct_sysctl_table[] = {
+static struct ctl_table nf_ct_sysctl_table[] = {
         {
                 .procname       = "nf_conntrack_max",
                 .data           = &nf_conntrack_max,
@@ -458,7 +458,7 @@ static ctl_table nf_ct_sysctl_table[] = {
 
 #define NET_NF_CONNTRACK_MAX 2089
 
-static ctl_table nf_ct_netfilter_table[] = {
+static struct ctl_table nf_ct_netfilter_table[] = {
         {
                 .procname       = "nf_conntrack_max",
                 .data           = &nf_conntrack_max,
diff --git a/net/netfilter/nf_log.c b/net/netfilter/nf_log.c
index 3b18dd1be7d9..85296d4eac0e 100644
--- a/net/netfilter/nf_log.c
+++ b/net/netfilter/nf_log.c
@@ -245,7 +245,7 @@ static const struct file_operations nflog_file_ops = {
 static char nf_log_sysctl_fnames[NFPROTO_NUMPROTO-NFPROTO_UNSPEC][3];
 static struct ctl_table nf_log_sysctl_table[NFPROTO_NUMPROTO+1];
 
-static int nf_log_proc_dostring(ctl_table *table, int write,
+static int nf_log_proc_dostring(struct ctl_table *table, int write,
                          void __user *buffer, size_t *lenp, loff_t *ppos)
 {
         const struct nf_logger *logger;
@@ -369,9 +369,7 @@ static int __net_init nf_log_net_init(struct net *net)
 
 out_sysctl:
 #ifdef CONFIG_PROC_FS
-        /* For init_net: errors will trigger panic, don't unroll on error. */
-        if (!net_eq(net, &init_net))
-                remove_proc_entry("nf_log", net->nf.proc_netfilter);
+        remove_proc_entry("nf_log", net->nf.proc_netfilter);
 #endif
         return ret;
 }
diff --git a/net/netfilter/nf_nat_core.c b/net/netfilter/nf_nat_core.c
index 038eee5c8f85..6f0f4f7f68a5 100644
--- a/net/netfilter/nf_nat_core.c
+++ b/net/netfilter/nf_nat_core.c
@@ -25,6 +25,7 @@
 #include <net/netfilter/nf_nat_core.h>
 #include <net/netfilter/nf_nat_helper.h>
 #include <net/netfilter/nf_conntrack_helper.h>
+#include <net/netfilter/nf_conntrack_seqadj.h>
 #include <net/netfilter/nf_conntrack_l3proto.h>
 #include <net/netfilter/nf_conntrack_zones.h>
 #include <linux/netfilter/nf_nat.h>
@@ -402,6 +403,9 @@ nf_nat_setup_info(struct nf_conn *ct,
                         ct->status |= IPS_SRC_NAT;
                 else
                         ct->status |= IPS_DST_NAT;
+
+                if (nfct_help(ct))
+                        nfct_seqadj_ext_add(ct);
         }
 
         if (maniptype == NF_NAT_MANIP_SRC) {
@@ -497,7 +501,7 @@ static void nf_nat_l4proto_clean(u8 l3proto, u8 l4proto)
 
         rtnl_lock();
         for_each_net(net)
-                nf_ct_iterate_cleanup(net, nf_nat_proto_remove, &clean);
+                nf_ct_iterate_cleanup(net, nf_nat_proto_remove, &clean, 0, 0);
         rtnl_unlock();
 }
 
@@ -511,7 +515,7 @@ static void nf_nat_l3proto_clean(u8 l3proto)
         rtnl_lock();
 
         for_each_net(net)
-                nf_ct_iterate_cleanup(net, nf_nat_proto_remove, &clean);
+                nf_ct_iterate_cleanup(net, nf_nat_proto_remove, &clean, 0, 0);
         rtnl_unlock();
 }
 
@@ -749,7 +753,7 @@ static void __net_exit nf_nat_net_exit(struct net *net)
 {
         struct nf_nat_proto_clean clean = {};
 
-        nf_ct_iterate_cleanup(net, &nf_nat_proto_remove, &clean);
+        nf_ct_iterate_cleanup(net, &nf_nat_proto_remove, &clean, 0, 0);
         synchronize_rcu();
         nf_ct_free_hashtable(net->ct.nat_bysource, net->ct.nat_htable_size);
 }
@@ -764,10 +768,6 @@ static struct nf_ct_helper_expectfn follow_master_nat = {
         .expectfn       = nf_nat_follow_master,
 };
 
-static struct nfq_ct_nat_hook nfq_ct_nat = {
-        .seq_adjust     = nf_nat_tcp_seq_adjust,
-};
-
 static int __init nf_nat_init(void)
 {
         int ret;
@@ -787,14 +787,9 @@ static int __init nf_nat_init(void)
         /* Initialize fake conntrack so that NAT will skip it */
         nf_ct_untracked_status_or(IPS_NAT_DONE_MASK);
 
-        BUG_ON(nf_nat_seq_adjust_hook != NULL);
-        RCU_INIT_POINTER(nf_nat_seq_adjust_hook, nf_nat_seq_adjust);
         BUG_ON(nfnetlink_parse_nat_setup_hook != NULL);
         RCU_INIT_POINTER(nfnetlink_parse_nat_setup_hook,
                            nfnetlink_parse_nat_setup);
-        BUG_ON(nf_ct_nat_offset != NULL);
-        RCU_INIT_POINTER(nf_ct_nat_offset, nf_nat_get_offset);
-        RCU_INIT_POINTER(nfq_ct_nat_hook, &nfq_ct_nat);
 #ifdef CONFIG_XFRM
         BUG_ON(nf_nat_decode_session_hook != NULL);
         RCU_INIT_POINTER(nf_nat_decode_session_hook, __nf_nat_decode_session);
@@ -813,10 +808,7 @@ static void __exit nf_nat_cleanup(void)
         unregister_pernet_subsys(&nf_nat_net_ops);
         nf_ct_extend_unregister(&nat_extend);
         nf_ct_helper_expectfn_unregister(&follow_master_nat);
-        RCU_INIT_POINTER(nf_nat_seq_adjust_hook, NULL);
         RCU_INIT_POINTER(nfnetlink_parse_nat_setup_hook, NULL);
-        RCU_INIT_POINTER(nf_ct_nat_offset, NULL);
-        RCU_INIT_POINTER(nfq_ct_nat_hook, NULL);
 #ifdef CONFIG_XFRM
         RCU_INIT_POINTER(nf_nat_decode_session_hook, NULL);
 #endif
diff --git a/net/netfilter/nf_nat_helper.c b/net/netfilter/nf_nat_helper.c
index 5fea563afe30..2840abb5bb99 100644
--- a/net/netfilter/nf_nat_helper.c
+++ b/net/netfilter/nf_nat_helper.c
@@ -20,74 +20,13 @@
 #include <net/netfilter/nf_conntrack_helper.h>
 #include <net/netfilter/nf_conntrack_ecache.h>
 #include <net/netfilter/nf_conntrack_expect.h>
+#include <net/netfilter/nf_conntrack_seqadj.h>
 #include <net/netfilter/nf_nat.h>
 #include <net/netfilter/nf_nat_l3proto.h>
 #include <net/netfilter/nf_nat_l4proto.h>
 #include <net/netfilter/nf_nat_core.h>
 #include <net/netfilter/nf_nat_helper.h>
 
-#define DUMP_OFFSET(x) \
-        pr_debug("offset_before=%d, offset_after=%d, correction_pos=%u\n", \
-                 x->offset_before, x->offset_after, x->correction_pos);
-
-static DEFINE_SPINLOCK(nf_nat_seqofs_lock);
-
-/* Setup TCP sequence correction given this change at this sequence */
-static inline void
-adjust_tcp_sequence(u32 seq,
-                    int sizediff,
-                    struct nf_conn *ct,
-                    enum ip_conntrack_info ctinfo)
-{
-        enum ip_conntrack_dir dir = CTINFO2DIR(ctinfo);
-        struct nf_conn_nat *nat = nfct_nat(ct);
-        struct nf_nat_seq *this_way = &nat->seq[dir];
-
-        pr_debug("adjust_tcp_sequence: seq = %u, sizediff = %d\n",
-                 seq, sizediff);
-
-        pr_debug("adjust_tcp_sequence: Seq_offset before: ");
-        DUMP_OFFSET(this_way);
-
-        spin_lock_bh(&nf_nat_seqofs_lock);
-
-        /* SYN adjust. If it's uninitialized, or this is after last
-         * correction, record it: we don't handle more than one
-         * adjustment in the window, but do deal with common case of a
-         * retransmit */
-        if (this_way->offset_before == this_way->offset_after ||
-            before(this_way->correction_pos, seq)) {
-                this_way->correction_pos = seq;
-                this_way->offset_before = this_way->offset_after;
-                this_way->offset_after += sizediff;
-        }
-        spin_unlock_bh(&nf_nat_seqofs_lock);
-
-        pr_debug("adjust_tcp_sequence: Seq_offset after: ");
-        DUMP_OFFSET(this_way);
-}
-
-/* Get the offset value, for conntrack */
-s16 nf_nat_get_offset(const struct nf_conn *ct,
-                      enum ip_conntrack_dir dir,
-                      u32 seq)
-{
-        struct nf_conn_nat *nat = nfct_nat(ct);
-        struct nf_nat_seq *this_way;
-        s16 offset;
-
-        if (!nat)
-                return 0;
-
-        this_way = &nat->seq[dir];
-        spin_lock_bh(&nf_nat_seqofs_lock);
-        offset = after(seq, this_way->correction_pos)
-                 ? this_way->offset_after : this_way->offset_before;
-        spin_unlock_bh(&nf_nat_seqofs_lock);
-
-        return offset;
-}
-
 /* Frobs data inside this packet, which is linear. */
 static void mangle_contents(struct sk_buff *skb,
                             unsigned int dataoff,
@@ -104,7 +43,7 @@ static void mangle_contents(struct sk_buff *skb,
         /* move post-replacement */
         memmove(data + match_offset + rep_len,
                 data + match_offset + match_len,
-                skb->tail - (skb->network_header + dataoff +
+                skb_tail_pointer(skb) - (skb_network_header(skb) + dataoff +
                              match_offset + match_len));
 
         /* insert data from buffer */
@@ -142,30 +81,6 @@ static int enlarge_skb(struct sk_buff *skb, unsigned int extra)
         return 1;
 }
 
-void nf_nat_set_seq_adjust(struct nf_conn *ct, enum ip_conntrack_info ctinfo,
-                           __be32 seq, s16 off)
-{
-        if (!off)
-                return;
-        set_bit(IPS_SEQ_ADJUST_BIT, &ct->status);
-        adjust_tcp_sequence(ntohl(seq), off, ct, ctinfo);
-        nf_conntrack_event_cache(IPCT_NATSEQADJ, ct);
-}
-EXPORT_SYMBOL_GPL(nf_nat_set_seq_adjust);
-
-void nf_nat_tcp_seq_adjust(struct sk_buff *skb, struct nf_conn *ct,
-                           u32 ctinfo, int off)
-{
-        const struct tcphdr *th;
-
-        if (nf_ct_protonum(ct) != IPPROTO_TCP)
-                return;
-
-        th = (struct tcphdr *)(skb_network_header(skb)+ ip_hdrlen(skb));
-        nf_nat_set_seq_adjust(ct, ctinfo, th->seq, off);
-}
-EXPORT_SYMBOL_GPL(nf_nat_tcp_seq_adjust);
-
 /* Generic function for mangling variable-length address changes inside
  * NATed TCP connections (like the PORT XXX,XXX,XXX,XXX,XXX,XXX
  * command in FTP).
@@ -210,8 +125,8 @@ int __nf_nat_mangle_tcp_packet(struct sk_buff *skb,
                              datalen, oldlen);
 
         if (adjust && rep_len != match_len)
-                nf_nat_set_seq_adjust(ct, ctinfo, tcph->seq,
-                                      (int)rep_len - (int)match_len);
+                nf_ct_seqadj_set(ct, ctinfo, tcph->seq,
+                                 (int)rep_len - (int)match_len);
 
         return 1;
 }
@@ -271,145 +186,6 @@ nf_nat_mangle_udp_packet(struct sk_buff *skb,
 }
 EXPORT_SYMBOL(nf_nat_mangle_udp_packet);
 
-/* Adjust one found SACK option including checksum correction */
-static void
-sack_adjust(struct sk_buff *skb,
-            struct tcphdr *tcph,
-            unsigned int sackoff,
-            unsigned int sackend,
-            struct nf_nat_seq *natseq)
-{
-        while (sackoff < sackend) {
-                struct tcp_sack_block_wire *sack;
-                __be32 new_start_seq, new_end_seq;
-
-                sack = (void *)skb->data + sackoff;
-                if (after(ntohl(sack->start_seq) - natseq->offset_before,
-                          natseq->correction_pos))
-                        new_start_seq = htonl(ntohl(sack->start_seq)
-                                        - natseq->offset_after);
-                else
-                        new_start_seq = htonl(ntohl(sack->start_seq)
-                                        - natseq->offset_before);
-
-                if (after(ntohl(sack->end_seq) - natseq->offset_before,
-                          natseq->correction_pos))
-                        new_end_seq = htonl(ntohl(sack->end_seq)
-                                      - natseq->offset_after);
-                else
-                        new_end_seq = htonl(ntohl(sack->end_seq)
-                                      - natseq->offset_before);
-
-                pr_debug("sack_adjust: start_seq: %d->%d, end_seq: %d->%d\n",
-                         ntohl(sack->start_seq), new_start_seq,
-                         ntohl(sack->end_seq), new_end_seq);
-
-                inet_proto_csum_replace4(&tcph->check, skb,
-                                         sack->start_seq, new_start_seq, 0);
-                inet_proto_csum_replace4(&tcph->check, skb,
-                                         sack->end_seq, new_end_seq, 0);
-                sack->start_seq = new_start_seq;
-                sack->end_seq = new_end_seq;
-                sackoff += sizeof(*sack);
-        }
-}
-
-/* TCP SACK sequence number adjustment */
-static inline unsigned int
-nf_nat_sack_adjust(struct sk_buff *skb,
-                   unsigned int protoff,
-                   struct tcphdr *tcph,
-                   struct nf_conn *ct,
-                   enum ip_conntrack_info ctinfo)
-{
-        unsigned int dir, optoff, optend;
-        struct nf_conn_nat *nat = nfct_nat(ct);
-
-        optoff = protoff + sizeof(struct tcphdr);
-        optend = protoff + tcph->doff * 4;
-
-        if (!skb_make_writable(skb, optend))
-                return 0;
-
-        dir = CTINFO2DIR(ctinfo);
-
-        while (optoff < optend) {
-                /* Usually: option, length. */
-                unsigned char *op = skb->data + optoff;
-
-                switch (op[0]) {
-                case TCPOPT_EOL:
-                        return 1;
-                case TCPOPT_NOP:
-                        optoff++;
-                        continue;
-                default:
-                        /* no partial options */
-                        if (optoff + 1 == optend ||
-                            optoff + op[1] > optend ||
-                            op[1] < 2)
-                                return 0;
-                        if (op[0] == TCPOPT_SACK &&
-                            op[1] >= 2+TCPOLEN_SACK_PERBLOCK &&
-                            ((op[1] - 2) % TCPOLEN_SACK_PERBLOCK) == 0)
-                                sack_adjust(skb, tcph, optoff+2,
-                                            optoff+op[1], &nat->seq[!dir]);
-                        optoff += op[1];
-                }
-        }
-        return 1;
-}
-
-/* TCP sequence number adjustment.  Returns 1 on success, 0 on failure */
-int
-nf_nat_seq_adjust(struct sk_buff *skb,
-                  struct nf_conn *ct,
-                  enum ip_conntrack_info ctinfo,
-                  unsigned int protoff)
-{
-        struct tcphdr *tcph;
-        int dir;
-        __be32 newseq, newack;
-        s16 seqoff, ackoff;
-        struct nf_conn_nat *nat = nfct_nat(ct);
-        struct nf_nat_seq *this_way, *other_way;
-
-        dir = CTINFO2DIR(ctinfo);
-
-        this_way = &nat->seq[dir];
-        other_way = &nat->seq[!dir];
-
-        if (!skb_make_writable(skb, protoff + sizeof(*tcph)))
-                return 0;
-
-        tcph = (void *)skb->data + protoff;
-        if (after(ntohl(tcph->seq), this_way->correction_pos))
-                seqoff = this_way->offset_after;
-        else
-                seqoff = this_way->offset_before;
-
-        if (after(ntohl(tcph->ack_seq) - other_way->offset_before,
-                  other_way->correction_pos))
-                ackoff = other_way->offset_after;
-        else
-                ackoff = other_way->offset_before;
-
-        newseq = htonl(ntohl(tcph->seq) + seqoff);
-        newack = htonl(ntohl(tcph->ack_seq) - ackoff);
-
-        inet_proto_csum_replace4(&tcph->check, skb, tcph->seq, newseq, 0);
-        inet_proto_csum_replace4(&tcph->check, skb, tcph->ack_seq, newack, 0);
-
-        pr_debug("Adjusting sequence number from %u->%u, ack from %u->%u\n",
-                 ntohl(tcph->seq), ntohl(newseq), ntohl(tcph->ack_seq),
-                 ntohl(newack));
-
-        tcph->seq = newseq;
-        tcph->ack_seq = newack;
-
-        return nf_nat_sack_adjust(skb, protoff, tcph, ct, ctinfo);
-}
-
 /* Setup NAT on this expected conntrack so it follows master. */
 /* If we fail to get a free NAT slot, we'll get dropped on confirm */
 void nf_nat_follow_master(struct nf_conn *ct,
diff --git a/net/netfilter/nf_nat_proto_sctp.c b/net/netfilter/nf_nat_proto_sctp.c
index 396e55d46f90..754536f2c674 100644
--- a/net/netfilter/nf_nat_proto_sctp.c
+++ b/net/netfilter/nf_nat_proto_sctp.c
@@ -34,9 +34,7 @@ sctp_manip_pkt(struct sk_buff *skb,
                const struct nf_conntrack_tuple *tuple,
                enum nf_nat_manip_type maniptype)
 {
-        struct sk_buff *frag;
         sctp_sctphdr_t *hdr;
-        __u32 crc32;
 
         if (!skb_make_writable(skb, hdroff + sizeof(*hdr)))
                 return false;
@@ -51,11 +49,7 @@ sctp_manip_pkt(struct sk_buff *skb,
                 hdr->dest = tuple->dst.u.sctp.port;
         }
 
-        crc32 = sctp_start_cksum((u8 *)hdr, skb_headlen(skb) - hdroff);
-        skb_walk_frags(skb, frag)
-                crc32 = sctp_update_cksum((u8 *)frag->data, skb_headlen(frag),
-                                          crc32);
-        hdr->checksum = sctp_end_cksum(crc32);
+        hdr->checksum = sctp_compute_cksum(skb, hdroff);
 
         return true;
 }
diff --git a/net/netfilter/nf_nat_sip.c b/net/netfilter/nf_nat_sip.c
index 96ccdf78a29f..f9790405b7ff 100644
--- a/net/netfilter/nf_nat_sip.c
+++ b/net/netfilter/nf_nat_sip.c
@@ -20,6 +20,7 @@
 #include <net/netfilter/nf_nat_helper.h>
 #include <net/netfilter/nf_conntrack_helper.h>
 #include <net/netfilter/nf_conntrack_expect.h>
+#include <net/netfilter/nf_conntrack_seqadj.h>
 #include <linux/netfilter/nf_conntrack_sip.h>
 
 MODULE_LICENSE("GPL");
@@ -230,9 +231,10 @@ static unsigned int nf_nat_sip(struct sk_buff *skb, unsigned int protoff,
                                         &ct->tuplehash[!dir].tuple.src.u3,
                                         false);
                         if (!mangle_packet(skb, protoff, dataoff, dptr, datalen,
-                                           poff, plen, buffer, buflen))
+                                           poff, plen, buffer, buflen)) {
                                 nf_ct_helper_log(skb, ct, "cannot mangle received");
                                 return NF_DROP;
+                        }
                 }
 
                 /* The rport= parameter (RFC 3581) contains the port number
@@ -307,7 +309,7 @@ static void nf_nat_sip_seq_adjust(struct sk_buff *skb, unsigned int protoff,
                 return;
 
         th = (struct tcphdr *)(skb->data + protoff);
-        nf_nat_set_seq_adjust(ct, ctinfo, th->seq, off);
+        nf_ct_seqadj_set(ct, ctinfo, th->seq, off);
 }
 
 /* Handles expected signalling connections and media streams */
diff --git a/net/netfilter/nf_synproxy_core.c b/net/netfilter/nf_synproxy_core.c
new file mode 100644
index 000000000000..cdf4567ba9b3
--- /dev/null
+++ b/net/netfilter/nf_synproxy_core.c
@@ -0,0 +1,434 @@
+/*
+ * Copyright (c) 2013 Patrick McHardy <kaber@trash.net>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+
+#include <linux/module.h>
+#include <linux/skbuff.h>
+#include <asm/unaligned.h>
+#include <net/tcp.h>
+#include <net/netns/generic.h>
+
+#include <linux/netfilter_ipv4/ip_tables.h>
+#include <linux/netfilter/x_tables.h>
+#include <linux/netfilter/xt_tcpudp.h>
+#include <linux/netfilter/xt_SYNPROXY.h>
+#include <net/netfilter/nf_conntrack.h>
+#include <net/netfilter/nf_conntrack_extend.h>
+#include <net/netfilter/nf_conntrack_seqadj.h>
+#include <net/netfilter/nf_conntrack_synproxy.h>
+
+int synproxy_net_id;
+EXPORT_SYMBOL_GPL(synproxy_net_id);
+
+bool
+synproxy_parse_options(const struct sk_buff *skb, unsigned int doff,
+                       const struct tcphdr *th, struct synproxy_options *opts)
+{
+        int length = (th->doff * 4) - sizeof(*th);
+        u8 buf[40], *ptr;
+
+        ptr = skb_header_pointer(skb, doff + sizeof(*th), length, buf);
+        if (ptr == NULL)
+                return false;
+
+        opts->options = 0;
+        while (length > 0) {
+                int opcode = *ptr++;
+                int opsize;
+
+                switch (opcode) {
+                case TCPOPT_EOL:
+                        return true;
+                case TCPOPT_NOP:
+                        length--;
+                        continue;
+                default:
+                        opsize = *ptr++;
+                        if (opsize < 2)
+                                return true;
+                        if (opsize > length)
+                                return true;
+
+                        switch (opcode) {
+                        case TCPOPT_MSS:
+                                if (opsize == TCPOLEN_MSS) {
+                                        opts->mss = get_unaligned_be16(ptr);
+                                        opts->options |= XT_SYNPROXY_OPT_MSS;
+                                }
+                                break;
+                        case TCPOPT_WINDOW:
+                                if (opsize == TCPOLEN_WINDOW) {
+                                        opts->wscale = *ptr;
+                                        if (opts->wscale > 14)
+                                                opts->wscale = 14;
+                                        opts->options |= XT_SYNPROXY_OPT_WSCALE;
+                                }
+                                break;
+                        case TCPOPT_TIMESTAMP:
+                                if (opsize == TCPOLEN_TIMESTAMP) {
+                                        opts->tsval = get_unaligned_be32(ptr);
+                                        opts->tsecr = get_unaligned_be32(ptr + 4);
+                                        opts->options |= XT_SYNPROXY_OPT_TIMESTAMP;
+                                }
+                                break;
+                        case TCPOPT_SACK_PERM:
+                                if (opsize == TCPOLEN_SACK_PERM)
+                                        opts->options |= XT_SYNPROXY_OPT_SACK_PERM;
+                                break;
+                        }
+
+                        ptr += opsize - 2;
+                        length -= opsize;
+                }
+        }
+        return true;
+}
+EXPORT_SYMBOL_GPL(synproxy_parse_options);
+
+unsigned int synproxy_options_size(const struct synproxy_options *opts)
+{
+        unsigned int size = 0;
+
+        if (opts->options & XT_SYNPROXY_OPT_MSS)
+                size += TCPOLEN_MSS_ALIGNED;
+        if (opts->options & XT_SYNPROXY_OPT_TIMESTAMP)
+                size += TCPOLEN_TSTAMP_ALIGNED;
+        else if (opts->options & XT_SYNPROXY_OPT_SACK_PERM)
+                size += TCPOLEN_SACKPERM_ALIGNED;
+        if (opts->options & XT_SYNPROXY_OPT_WSCALE)
+                size += TCPOLEN_WSCALE_ALIGNED;
+
+        return size;
+}
+EXPORT_SYMBOL_GPL(synproxy_options_size);
+
+void
+synproxy_build_options(struct tcphdr *th, const struct synproxy_options *opts)
+{
+        __be32 *ptr = (__be32 *)(th + 1);
+        u8 options = opts->options;
+
+        if (options & XT_SYNPROXY_OPT_MSS)
+                *ptr++ = htonl((TCPOPT_MSS << 24) |
+                               (TCPOLEN_MSS << 16) |
+                               opts->mss);
+
+        if (options & XT_SYNPROXY_OPT_TIMESTAMP) {
+                if (options & XT_SYNPROXY_OPT_SACK_PERM)
+                        *ptr++ = htonl((TCPOPT_SACK_PERM << 24) |
+                                       (TCPOLEN_SACK_PERM << 16) |
+                                       (TCPOPT_TIMESTAMP << 8) |
+                                       TCPOLEN_TIMESTAMP);
+                else
+                        *ptr++ = htonl((TCPOPT_NOP << 24) |
+                                       (TCPOPT_NOP << 16) |
+                                       (TCPOPT_TIMESTAMP << 8) |
+                                       TCPOLEN_TIMESTAMP);
+
+                *ptr++ = htonl(opts->tsval);
+                *ptr++ = htonl(opts->tsecr);
+        } else if (options & XT_SYNPROXY_OPT_SACK_PERM)
+                *ptr++ = htonl((TCPOPT_NOP << 24) |
+                               (TCPOPT_NOP << 16) |
+                               (TCPOPT_SACK_PERM << 8) |
+                               TCPOLEN_SACK_PERM);
+
+        if (options & XT_SYNPROXY_OPT_WSCALE)
+                *ptr++ = htonl((TCPOPT_NOP << 24) |
+                               (TCPOPT_WINDOW << 16) |
+                               (TCPOLEN_WINDOW << 8) |
+                               opts->wscale);
+}
+EXPORT_SYMBOL_GPL(synproxy_build_options);
+
+void synproxy_init_timestamp_cookie(const struct xt_synproxy_info *info,
+                                    struct synproxy_options *opts)
+{
+        opts->tsecr = opts->tsval;
+        opts->tsval = tcp_time_stamp & ~0x3f;
+
+        if (opts->options & XT_SYNPROXY_OPT_WSCALE)
+                opts->tsval |= info->wscale;
+        else
+                opts->tsval |= 0xf;
+
+        if (opts->options & XT_SYNPROXY_OPT_SACK_PERM)
+                opts->tsval |= 1 << 4;
+
+        if (opts->options & XT_SYNPROXY_OPT_ECN)
+                opts->tsval |= 1 << 5;
+}
+EXPORT_SYMBOL_GPL(synproxy_init_timestamp_cookie);
+
+void synproxy_check_timestamp_cookie(struct synproxy_options *opts)
+{
+        opts->wscale = opts->tsecr & 0xf;
+        if (opts->wscale != 0xf)
+                opts->options |= XT_SYNPROXY_OPT_WSCALE;
+
+        opts->options |= opts->tsecr & (1 << 4) ? XT_SYNPROXY_OPT_SACK_PERM : 0;
+
+        opts->options |= opts->tsecr & (1 << 5) ? XT_SYNPROXY_OPT_ECN : 0;
+}
+EXPORT_SYMBOL_GPL(synproxy_check_timestamp_cookie);
+
+unsigned int synproxy_tstamp_adjust(struct sk_buff *skb,
+                                    unsigned int protoff,
+                                    struct tcphdr *th,
+                                    struct nf_conn *ct,
+                                    enum ip_conntrack_info ctinfo,
+                                    const struct nf_conn_synproxy *synproxy)
+{
+        unsigned int optoff, optend;
+        u32 *ptr, old;
+
+        if (synproxy->tsoff == 0)
+                return 1;
+
+        optoff = protoff + sizeof(struct tcphdr);
+        optend = protoff + th->doff * 4;
+
+        if (!skb_make_writable(skb, optend))
+                return 0;
+
+        while (optoff < optend) {
+                unsigned char *op = skb->data + optoff;
+
+                switch (op[0]) {
+                case TCPOPT_EOL:
+                        return 1;
+                case TCPOPT_NOP:
+                        optoff++;
+                        continue;
+                default:
+                        if (optoff + 1 == optend ||
+                            optoff + op[1] > optend ||
+                            op[1] < 2)
+                                return 0;
+                        if (op[0] == TCPOPT_TIMESTAMP &&
+                            op[1] == TCPOLEN_TIMESTAMP) {
+                                if (CTINFO2DIR(ctinfo) == IP_CT_DIR_REPLY) {
+                                        ptr = (u32 *)&op[2];
+                                        old = *ptr;
+                                        *ptr = htonl(ntohl(*ptr) -
+                                                     synproxy->tsoff);
+                                } else {
+                                        ptr = (u32 *)&op[6];
+                                        old = *ptr;
+                                        *ptr = htonl(ntohl(*ptr) +
+                                                     synproxy->tsoff);
+                                }
+                                inet_proto_csum_replace4(&th->check, skb,
+                                                         old, *ptr, 0);
+                                return 1;
+                        }
+                        optoff += op[1];
+                }
+        }
+        return 1;
+}
+EXPORT_SYMBOL_GPL(synproxy_tstamp_adjust);
+
+static struct nf_ct_ext_type nf_ct_synproxy_extend __read_mostly = {
+        .len            = sizeof(struct nf_conn_synproxy),
+        .align          = __alignof__(struct nf_conn_synproxy),
+        .id             = NF_CT_EXT_SYNPROXY,
+};
+
+#ifdef CONFIG_PROC_FS
+static void *synproxy_cpu_seq_start(struct seq_file *seq, loff_t *pos)
+{
+        struct synproxy_net *snet = synproxy_pernet(seq_file_net(seq));
+        int cpu;
+
+        if (*pos == 0)
+                return SEQ_START_TOKEN;
+
+        for (cpu = *pos - 1; cpu < nr_cpu_ids; cpu++) {
+                if (!cpu_possible(cpu))
+                        continue;
+                *pos = cpu + 1;
+                return per_cpu_ptr(snet->stats, cpu);
+        }
+
+        return NULL;
+}
+
+static void *synproxy_cpu_seq_next(struct seq_file *seq, void *v, loff_t *pos)
+{
+        struct synproxy_net *snet = synproxy_pernet(seq_file_net(seq));
+        int cpu;
+
+        for (cpu = *pos; cpu < nr_cpu_ids; cpu++) {
+                if (!cpu_possible(cpu))
+                        continue;
+                *pos = cpu + 1;
+                return per_cpu_ptr(snet->stats, cpu);
+        }
+
+        return NULL;
+}
+
+static void synproxy_cpu_seq_stop(struct seq_file *seq, void *v)
+{
+        return;
+}
+
+static int synproxy_cpu_seq_show(struct seq_file *seq, void *v)
+{
+        struct synproxy_stats *stats = v;
+
+        if (v == SEQ_START_TOKEN) {
+                seq_printf(seq, "entries\t\tsyn_received\t"
+                                "cookie_invalid\tcookie_valid\t"
+                                "cookie_retrans\tconn_reopened\n");
+                return 0;
+        }
+
+        seq_printf(seq, "%08x\t%08x\t%08x\t%08x\t%08x\t%08x\n", 0,
+                   stats->syn_received,
+                   stats->cookie_invalid,
+                   stats->cookie_valid,
+                   stats->cookie_retrans,
+                   stats->conn_reopened);
+
+        return 0;
+}
+
+static const struct seq_operations synproxy_cpu_seq_ops = {
+        .start          = synproxy_cpu_seq_start,
+        .next           = synproxy_cpu_seq_next,
+        .stop           = synproxy_cpu_seq_stop,
+        .show           = synproxy_cpu_seq_show,
+};
+
+static int synproxy_cpu_seq_open(struct inode *inode, struct file *file)
+{
+        return seq_open_net(inode, file, &synproxy_cpu_seq_ops,
+                            sizeof(struct seq_net_private));
+}
+
+static const struct file_operations synproxy_cpu_seq_fops = {
+        .owner          = THIS_MODULE,
+        .open           = synproxy_cpu_seq_open,
+        .read           = seq_read,
+        .llseek         = seq_lseek,
+        .release        = seq_release_net,
+};
+
+static int __net_init synproxy_proc_init(struct net *net)
+{
+        if (!proc_create("synproxy", S_IRUGO, net->proc_net_stat,
+                         &synproxy_cpu_seq_fops))
+                return -ENOMEM;
+        return 0;
+}
+
+static void __net_exit synproxy_proc_exit(struct net *net)
+{
+        remove_proc_entry("synproxy", net->proc_net_stat);
+}
+#else
+static int __net_init synproxy_proc_init(struct net *net)
+{
+        return 0;
+}
+
+static void __net_exit synproxy_proc_exit(struct net *net)
+{
+        return;
+}
+#endif /* CONFIG_PROC_FS */
+
+static int __net_init synproxy_net_init(struct net *net)
+{
+        struct synproxy_net *snet = synproxy_pernet(net);
+        struct nf_conntrack_tuple t;
+        struct nf_conn *ct;
+        int err = -ENOMEM;
+
+        memset(&t, 0, sizeof(t));
+        ct = nf_conntrack_alloc(net, 0, &t, &t, GFP_KERNEL);
+        if (IS_ERR(ct)) {
+                err = PTR_ERR(ct);
+                goto err1;
+        }
+
+        if (!nfct_seqadj_ext_add(ct))
+                goto err2;
+        if (!nfct_synproxy_ext_add(ct))
+                goto err2;
+        __set_bit(IPS_TEMPLATE_BIT, &ct->status);
+        __set_bit(IPS_CONFIRMED_BIT, &ct->status);
+
+        snet->tmpl = ct;
+
+        snet->stats = alloc_percpu(struct synproxy_stats);
+        if (snet->stats == NULL)
+                goto err2;
+
+        err = synproxy_proc_init(net);
+        if (err < 0)
+                goto err3;
+
+        return 0;
+
+err3:
+        free_percpu(snet->stats);
+err2:
+        nf_conntrack_free(ct);
+err1:
+        return err;
+}
+
+static void __net_exit synproxy_net_exit(struct net *net)
+{
+        struct synproxy_net *snet = synproxy_pernet(net);
+
+        nf_conntrack_free(snet->tmpl);
+        synproxy_proc_exit(net);
+        free_percpu(snet->stats);
+}
+
+static struct pernet_operations synproxy_net_ops = {
+        .init           = synproxy_net_init,
+        .exit           = synproxy_net_exit,
+        .id             = &synproxy_net_id,
+        .size           = sizeof(struct synproxy_net),
+};
+
+static int __init synproxy_core_init(void)
+{
+        int err;
+
+        err = nf_ct_extend_register(&nf_ct_synproxy_extend);
+        if (err < 0)
+                goto err1;
+
+        err = register_pernet_subsys(&synproxy_net_ops);
+        if (err < 0)
+                goto err2;
+
+        return 0;
+
+err2:
+        nf_ct_extend_unregister(&nf_ct_synproxy_extend);
+err1:
+        return err;
+}
+
+static void __exit synproxy_core_exit(void)
+{
+        unregister_pernet_subsys(&synproxy_net_ops);
+        nf_ct_extend_unregister(&nf_ct_synproxy_extend);
+}
+
+module_init(synproxy_core_init);
+module_exit(synproxy_core_exit);
+
+MODULE_LICENSE("GPL");
+MODULE_AUTHOR("Patrick McHardy <kaber@trash.net>");
diff --git a/net/netfilter/nf_tproxy_core.c b/net/netfilter/nf_tproxy_core.c
deleted file mode 100644
index 474d621cbc2e..000000000000
--- a/net/netfilter/nf_tproxy_core.c
+++ /dev/null
@@ -1,62 +0,0 @@
-/*
- * Transparent proxy support for Linux/iptables
- *
- * Copyright (c) 2006-2007 BalaBit IT Ltd.
- * Author: Balazs Scheidler, Krisztian Kovacs
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation.
- *
- */
-
-#include <linux/module.h>
-
-#include <linux/net.h>
-#include <linux/if.h>
-#include <linux/netdevice.h>
-#include <net/udp.h>
-#include <net/netfilter/nf_tproxy_core.h>
-
-
-static void
-nf_tproxy_destructor(struct sk_buff *skb)
-{
-        struct sock *sk = skb->sk;
-
-        skb->sk = NULL;
-        skb->destructor = NULL;
-
-        if (sk)
-                sock_put(sk);
-}
-
-/* consumes sk */
-void
-nf_tproxy_assign_sock(struct sk_buff *skb, struct sock *sk)
-{
-        /* assigning tw sockets complicates things; most
-         * skb->sk->X checks would have to test sk->sk_state first */
-        if (sk->sk_state == TCP_TIME_WAIT) {
-                inet_twsk_put(inet_twsk(sk));
-                return;
-        }
-
-        skb_orphan(skb);
-        skb->sk = sk;
-        skb->destructor = nf_tproxy_destructor;
-}
-EXPORT_SYMBOL_GPL(nf_tproxy_assign_sock);
-
-static int __init nf_tproxy_init(void)
-{
-        pr_info("NF_TPROXY: Transparent proxy support initialized, version 4.1.0\n");
-        pr_info("NF_TPROXY: Copyright (c) 2006-2007 BalaBit IT Ltd.\n");
-        return 0;
-}
-
-module_init(nf_tproxy_init);
-
-MODULE_LICENSE("GPL");
-MODULE_AUTHOR("Krisztian Kovacs");
-MODULE_DESCRIPTION("Transparent proxy support core routines");
diff --git a/net/netfilter/nfnetlink_acct.c b/net/netfilter/nfnetlink_acct.c
index dc3fd5d44464..c7b6d466a662 100644
--- a/net/netfilter/nfnetlink_acct.c
+++ b/net/netfilter/nfnetlink_acct.c
@@ -149,9 +149,12 @@ nfnl_acct_dump(struct sk_buff *skb, struct netlink_callback *cb)
 
         rcu_read_lock();
         list_for_each_entry_rcu(cur, &nfnl_acct_list, head) {
-                if (last && cur != last)
-                        continue;
+                if (last) {
+                        if (cur != last)
+                                continue;
 
+                        last = NULL;
+                }
                 if (nfnl_acct_fill_info(skb, NETLINK_CB(cb->skb).portid,
                                        cb->nlh->nlmsg_seq,
                                        NFNL_MSG_TYPE(cb->nlh->nlmsg_type),
diff --git a/net/netfilter/nfnetlink_cthelper.c b/net/netfilter/nfnetlink_cthelper.c
index a191b6db657e..9e287cb56a04 100644
--- a/net/netfilter/nfnetlink_cthelper.c
+++ b/net/netfilter/nfnetlink_cthelper.c
@@ -67,9 +67,12 @@ static int
 nfnl_cthelper_parse_tuple(struct nf_conntrack_tuple *tuple,
                           const struct nlattr *attr)
 {
+        int err;
         struct nlattr *tb[NFCTH_TUPLE_MAX+1];
 
-        nla_parse_nested(tb, NFCTH_TUPLE_MAX, attr, nfnl_cthelper_tuple_pol);
+        err = nla_parse_nested(tb, NFCTH_TUPLE_MAX, attr, nfnl_cthelper_tuple_pol);
+        if (err < 0)
+                return err;
 
         if (!tb[NFCTH_TUPLE_L3PROTONUM] || !tb[NFCTH_TUPLE_L4PROTONUM])
                 return -EINVAL;
@@ -121,9 +124,12 @@ static int
 nfnl_cthelper_expect_policy(struct nf_conntrack_expect_policy *expect_policy,
                             const struct nlattr *attr)
 {
+        int err;
         struct nlattr *tb[NFCTH_POLICY_MAX+1];
 
-        nla_parse_nested(tb, NFCTH_POLICY_MAX, attr, nfnl_cthelper_expect_pol);
+        err = nla_parse_nested(tb, NFCTH_POLICY_MAX, attr, nfnl_cthelper_expect_pol);
+        if (err < 0)
+                return err;
 
         if (!tb[NFCTH_POLICY_NAME] ||
             !tb[NFCTH_POLICY_EXPECT_MAX] ||
@@ -153,8 +159,10 @@ nfnl_cthelper_parse_expect_policy(struct nf_conntrack_helper *helper,
         struct nf_conntrack_expect_policy *expect_policy;
         struct nlattr *tb[NFCTH_POLICY_SET_MAX+1];
 
-        nla_parse_nested(tb, NFCTH_POLICY_SET_MAX, attr,
-                                        nfnl_cthelper_expect_policy_set);
+        ret = nla_parse_nested(tb, NFCTH_POLICY_SET_MAX, attr,
+                               nfnl_cthelper_expect_policy_set);
+        if (ret < 0)
+                return ret;
 
         if (!tb[NFCTH_POLICY_SET_NUM])
                 return -EINVAL;
diff --git a/net/netfilter/nfnetlink_cttimeout.c b/net/netfilter/nfnetlink_cttimeout.c
index 701c88a20fea..50580494148d 100644
--- a/net/netfilter/nfnetlink_cttimeout.c
+++ b/net/netfilter/nfnetlink_cttimeout.c
@@ -59,8 +59,10 @@ ctnl_timeout_parse_policy(struct ctnl_timeout *timeout,
         if (likely(l4proto->ctnl_timeout.nlattr_to_obj)) {
                 struct nlattr *tb[l4proto->ctnl_timeout.nlattr_max+1];
 
-                nla_parse_nested(tb, l4proto->ctnl_timeout.nlattr_max,
-                                 attr, l4proto->ctnl_timeout.nla_policy);
+                ret = nla_parse_nested(tb, l4proto->ctnl_timeout.nlattr_max,
+                                       attr, l4proto->ctnl_timeout.nla_policy);
+                if (ret < 0)
+                        return ret;
 
                 ret = l4proto->ctnl_timeout.nlattr_to_obj(tb, net,
                                                           &timeout->data);
@@ -220,9 +222,12 @@ ctnl_timeout_dump(struct sk_buff *skb, struct netlink_callback *cb)
 
         rcu_read_lock();
         list_for_each_entry_rcu(cur, &cttimeout_list, head) {
-                if (last && cur != last)
-                        continue;
+                if (last) {
+                        if (cur != last)
+                                continue;
 
+                        last = NULL;
+                }
                 if (ctnl_timeout_fill_info(skb, NETLINK_CB(cb->skb).portid,
                                            cb->nlh->nlmsg_seq,
                                            NFNL_MSG_TYPE(cb->nlh->nlmsg_type),
diff --git a/net/netfilter/nfnetlink_log.c b/net/netfilter/nfnetlink_log.c
index 962e9792e317..d92cc317bf8b 100644
--- a/net/netfilter/nfnetlink_log.c
+++ b/net/netfilter/nfnetlink_log.c
@@ -419,6 +419,7 @@ __build_packet_message(struct nfnl_log_net *log,
         nfmsg->version = NFNETLINK_V0;
         nfmsg->res_id = htons(inst->group_num);
 
+        memset(&pmsg, 0, sizeof(pmsg));
         pmsg.hw_protocol        = skb->protocol;
         pmsg.hook               = hooknum;
 
@@ -498,7 +499,10 @@ __build_packet_message(struct nfnl_log_net *log,
         if (indev && skb->dev &&
             skb->mac_header != skb->network_header) {
                 struct nfulnl_msg_packet_hw phw;
-                int len = dev_parse_header(skb, phw.hw_addr);
+                int len;
+
+                memset(&phw, 0, sizeof(phw));
+                len = dev_parse_header(skb, phw.hw_addr);
                 if (len > 0) {
                         phw.hw_addrlen = htons(len);
                         if (nla_put(inst->skb, NFULA_HWADDR, sizeof(phw), &phw))
diff --git a/net/netfilter/nfnetlink_queue_core.c b/net/netfilter/nfnetlink_queue_core.c
index 4e27fa035814..ae2e5c11d01a 100644
--- a/net/netfilter/nfnetlink_queue_core.c
+++ b/net/netfilter/nfnetlink_queue_core.c
@@ -41,6 +41,14 @@
 
 #define NFQNL_QMAX_DEFAULT 1024
 
+/* We're using struct nlattr which has 16bit nla_len. Note that nla_len
+ * includes the header length. Thus, the maximum packet length that we
+ * support is 65531 bytes. We send truncated packets if the specified length
+ * is larger than that.  Userspace can check for presence of NFQA_CAP_LEN
+ * attribute to detect truncation.
+ */
+#define NFQNL_MAX_COPY_RANGE (0xffff - NLA_HDRLEN)
+
 struct nfqnl_instance {
         struct hlist_node hlist;                /* global list of queues */
         struct rcu_head rcu;
@@ -122,7 +130,7 @@ instance_create(struct nfnl_queue_net *q, u_int16_t queue_num,
         inst->queue_num = queue_num;
         inst->peer_portid = portid;
         inst->queue_maxlen = NFQNL_QMAX_DEFAULT;
-        inst->copy_range = 0xffff;
+        inst->copy_range = NFQNL_MAX_COPY_RANGE;
         inst->copy_mode = NFQNL_COPY_NONE;
         spin_lock_init(&inst->lock);
         INIT_LIST_HEAD(&inst->queue_list);
@@ -272,12 +280,17 @@ nfqnl_zcopy(struct sk_buff *to, const struct sk_buff *from, int len, int hlen)
         skb_shinfo(to)->nr_frags = j;
 }
 
-static int nfqnl_put_packet_info(struct sk_buff *nlskb, struct sk_buff *packet)
+static int
+nfqnl_put_packet_info(struct sk_buff *nlskb, struct sk_buff *packet,
+                      bool csum_verify)
 {
         __u32 flags = 0;
 
         if (packet->ip_summed == CHECKSUM_PARTIAL)
                 flags = NFQA_SKB_CSUMNOTREADY;
+        else if (csum_verify)
+                flags = NFQA_SKB_CSUM_NOTVERIFIED;
+
         if (skb_is_gso(packet))
                 flags |= NFQA_SKB_GSO;
 
@@ -302,6 +315,7 @@ nfqnl_build_packet_message(struct nfqnl_instance *queue,
         struct net_device *outdev;
         struct nf_conn *ct = NULL;
         enum ip_conntrack_info uninitialized_var(ctinfo);
+        bool csum_verify;
 
         size =    nlmsg_total_size(sizeof(struct nfgenmsg))
                 + nla_total_size(sizeof(struct nfqnl_msg_packet_hdr))
@@ -319,6 +333,12 @@ nfqnl_build_packet_message(struct nfqnl_instance *queue,
         if (entskb->tstamp.tv64)
                 size += nla_total_size(sizeof(struct nfqnl_msg_packet_timestamp));
 
+        if (entry->hook <= NF_INET_FORWARD ||
+           (entry->hook == NF_INET_POST_ROUTING && entskb->sk == NULL))
+                csum_verify = !skb_csum_unnecessary(entskb);
+        else
+                csum_verify = false;
+
         outdev = entry->outdev;
 
         switch ((enum nfqnl_config_mode)ACCESS_ONCE(queue->copy_mode)) {
@@ -333,10 +353,9 @@ nfqnl_build_packet_message(struct nfqnl_instance *queue,
                         return NULL;
 
                 data_len = ACCESS_ONCE(queue->copy_range);
-                if (data_len == 0 || data_len > entskb->len)
+                if (data_len > entskb->len)
                         data_len = entskb->len;
 
-
                 if (!entskb->head_frag ||
                     skb_headlen(entskb) < L1_CACHE_BYTES ||
                     skb_shinfo(entskb)->nr_frags >= MAX_SKB_FRAGS)
@@ -444,7 +463,10 @@ nfqnl_build_packet_message(struct nfqnl_instance *queue,
         if (indev && entskb->dev &&
             entskb->mac_header != entskb->network_header) {
                 struct nfqnl_msg_packet_hw phw;
-                int len = dev_parse_header(entskb, phw.hw_addr);
+                int len;
+
+                memset(&phw, 0, sizeof(phw));
+                len = dev_parse_header(entskb, phw.hw_addr);
                 if (len) {
                         phw.hw_addrlen = htons(len);
                         if (nla_put(skb, NFQA_HWADDR, sizeof(phw), &phw))
@@ -465,10 +487,11 @@ nfqnl_build_packet_message(struct nfqnl_instance *queue,
         if (ct && nfqnl_ct_put(skb, ct, ctinfo) < 0)
                 goto nla_put_failure;
 
-        if (cap_len > 0 && nla_put_be32(skb, NFQA_CAP_LEN, htonl(cap_len)))
+        if (cap_len > data_len &&
+            nla_put_be32(skb, NFQA_CAP_LEN, htonl(cap_len)))
                 goto nla_put_failure;
 
-        if (nfqnl_put_packet_info(skb, entskb))
+        if (nfqnl_put_packet_info(skb, entskb, csum_verify))
                 goto nla_put_failure;
 
         if (data_len) {
@@ -509,10 +532,6 @@ __nfqnl_enqueue_packet(struct net *net, struct nfqnl_instance *queue,
         }
         spin_lock_bh(&queue->lock);
 
-        if (!queue->peer_portid) {
-                err = -EINVAL;
-                goto err_out_free_nskb;
-        }
         if (queue->queue_total >= queue->queue_maxlen) {
                 if (queue->flags & NFQA_CFG_F_FAIL_OPEN) {
                         failopen = 1;
@@ -637,9 +656,6 @@ nfqnl_enqueue_packet(struct nf_queue_entry *entry, unsigned int queuenum)
         if (queue->copy_mode == NFQNL_COPY_NONE)
                 return -EINVAL;
 
-        if ((queue->flags & NFQA_CFG_F_GSO) || !skb_is_gso(entry->skb))
-                return __nfqnl_enqueue_packet(net, queue, entry);
-
         skb = entry->skb;
 
         switch (entry->pf) {
@@ -651,6 +667,9 @@ nfqnl_enqueue_packet(struct nf_queue_entry *entry, unsigned int queuenum)
                 break;
         }
 
+        if ((queue->flags & NFQA_CFG_F_GSO) || !skb_is_gso(skb))
+                return __nfqnl_enqueue_packet(net, queue, entry);
+
         nf_bridge_adjust_skb_data(skb);
         segs = skb_gso_segment(skb, 0);
         /* Does not use PTR_ERR to limit the number of error codes that can be
@@ -731,13 +750,8 @@ nfqnl_set_mode(struct nfqnl_instance *queue,
 
         case NFQNL_COPY_PACKET:
                 queue->copy_mode = mode;
-                /* We're using struct nlattr which has 16bit nla_len. Note that
-                 * nla_len includes the header length. Thus, the maximum packet
-                 * length that we support is 65531 bytes. We send truncated
-                 * packets if the specified length is larger than that.
-                 */
-                if (range > 0xffff - NLA_HDRLEN)
-                        queue->copy_range = 0xffff - NLA_HDRLEN;
+                if (range == 0 || range > NFQNL_MAX_COPY_RANGE)
+                        queue->copy_range = NFQNL_MAX_COPY_RANGE;
                 else
                         queue->copy_range = range;
                 break;
@@ -800,7 +814,7 @@ static int
 nfqnl_rcv_dev_event(struct notifier_block *this,
                     unsigned long event, void *ptr)
 {
-        struct net_device *dev = ptr;
+        struct net_device *dev = netdev_notifier_info_to_dev(ptr);
 
         /* Drop any packets associated with the downed device */
         if (event == NETDEV_DOWN)
@@ -848,6 +862,7 @@ static const struct nla_policy nfqa_verdict_policy[NFQA_MAX+1] = {
         [NFQA_MARK]             = { .type = NLA_U32 },
         [NFQA_PAYLOAD]          = { .type = NLA_UNSPEC },
         [NFQA_CT]               = { .type = NLA_UNSPEC },
+        [NFQA_EXP]              = { .type = NLA_UNSPEC },
 };
 
 static const struct nla_policy nfqa_verdict_batch_policy[NFQA_MAX+1] = {
@@ -976,9 +991,14 @@ nfqnl_recv_verdict(struct sock *ctnl, struct sk_buff *skb,
         if (entry == NULL)
                 return -ENOENT;
 
-        rcu_read_lock();
-        if (nfqa[NFQA_CT] && (queue->flags & NFQA_CFG_F_CONNTRACK))
+        if (nfqa[NFQA_CT]) {
                 ct = nfqnl_ct_parse(entry->skb, nfqa[NFQA_CT], &ctinfo);
+                if (ct && nfqa[NFQA_EXP]) {
+                        nfqnl_attach_expect(ct, nfqa[NFQA_EXP],
+                                            NETLINK_CB(skb).portid,
+                                            nlmsg_report(nlh));
+                }
+        }
 
         if (nfqa[NFQA_PAYLOAD]) {
                 u16 payload_len = nla_len(nfqa[NFQA_PAYLOAD]);
@@ -989,9 +1009,8 @@ nfqnl_recv_verdict(struct sock *ctnl, struct sk_buff *skb,
                         verdict = NF_DROP;
 
                 if (ct)
-                        nfqnl_ct_seq_adjust(skb, ct, ctinfo, diff);
+                        nfqnl_ct_seq_adjust(entry->skb, ct, ctinfo, diff);
         }
-        rcu_read_unlock();
 
         if (nfqa[NFQA_MARK])
                 entry->skb->mark = ntohl(nla_get_be32(nfqa[NFQA_MARK]));
diff --git a/net/netfilter/nfnetlink_queue_ct.c b/net/netfilter/nfnetlink_queue_ct.c
index ab61d66bc0b9..96cac50e0d12 100644
--- a/net/netfilter/nfnetlink_queue_ct.c
+++ b/net/netfilter/nfnetlink_queue_ct.c
@@ -87,12 +87,27 @@ nla_put_failure:
 void nfqnl_ct_seq_adjust(struct sk_buff *skb, struct nf_conn *ct,
                          enum ip_conntrack_info ctinfo, int diff)
 {
-        struct nfq_ct_nat_hook *nfq_nat_ct;
+        struct nfq_ct_hook *nfq_ct;
 
-        nfq_nat_ct = rcu_dereference(nfq_ct_nat_hook);
-        if (nfq_nat_ct == NULL)
+        nfq_ct = rcu_dereference(nfq_ct_hook);
+        if (nfq_ct == NULL)
                 return;
 
         if ((ct->status & IPS_NAT_MASK) && diff)
-                nfq_nat_ct->seq_adjust(skb, ct, ctinfo, diff);
+                nfq_ct->seq_adjust(skb, ct, ctinfo, diff);
+}
+
+int nfqnl_attach_expect(struct nf_conn *ct, const struct nlattr *attr,
+                        u32 portid, u32 report)
+{
+        struct nfq_ct_hook *nfq_ct;
+
+        if (nf_ct_is_untracked(ct))
+                return 0;
+
+        nfq_ct = rcu_dereference(nfq_ct_hook);
+        if (nfq_ct == NULL)
+                return -EOPNOTSUPP;
+
+        return nfq_ct->attach_expect(attr, ct, portid, report);
 }
diff --git a/net/netfilter/xt_CT.c b/net/netfilter/xt_CT.c
index a60261cb0e80..da35ac06a975 100644
--- a/net/netfilter/xt_CT.c
+++ b/net/netfilter/xt_CT.c
@@ -26,6 +26,9 @@ static inline int xt_ct_target(struct sk_buff *skb, struct nf_conn *ct)
         if (skb->nfct != NULL)
                 return XT_CONTINUE;
 
+        /* special case the untracked ct : we want the percpu object */
+        if (!ct)
+                ct = nf_ct_untracked_get();
         atomic_inc(&ct->ct_general.use);
         skb->nfct = &ct->ct_general;
         skb->nfctinfo = IP_CT_NEW;
@@ -186,8 +189,7 @@ static int xt_ct_tg_check(const struct xt_tgchk_param *par,
         int ret = -EOPNOTSUPP;
 
         if (info->flags & XT_CT_NOTRACK) {
-                ct = nf_ct_untracked_get();
-                atomic_inc(&ct->ct_general.use);
+                ct = NULL;
                 goto out;
         }
 
@@ -311,7 +313,7 @@ static void xt_ct_tg_destroy(const struct xt_tgdtor_param *par,
         struct nf_conn *ct = info->ct;
         struct nf_conn_help *help;
 
-        if (!nf_ct_is_untracked(ct)) {
+        if (ct && !nf_ct_is_untracked(ct)) {
                 help = nfct_help(ct);
                 if (help)
                         module_put(help->helper->me);
@@ -319,8 +321,8 @@ static void xt_ct_tg_destroy(const struct xt_tgdtor_param *par,
                 nf_ct_l3proto_module_put(par->family);
 
                 xt_ct_destroy_timeout(ct);
+                nf_ct_put(info->ct);
         }
-        nf_ct_put(info->ct);
 }
 
 static void xt_ct_tg_destroy_v0(const struct xt_tgdtor_param *par)
diff --git a/net/netfilter/xt_TCPMSS.c b/net/netfilter/xt_TCPMSS.c
index a75240f0d42b..cd24290f3b2f 100644
--- a/net/netfilter/xt_TCPMSS.c
+++ b/net/netfilter/xt_TCPMSS.c
@@ -45,25 +45,34 @@ optlen(const u_int8_t *opt, unsigned int offset)
 
 static int
 tcpmss_mangle_packet(struct sk_buff *skb,
-                     const struct xt_tcpmss_info *info,
+                     const struct xt_action_param *par,
                      unsigned int in_mtu,
                      unsigned int tcphoff,
                      unsigned int minlen)
 {
+        const struct xt_tcpmss_info *info = par->targinfo;
         struct tcphdr *tcph;
-        unsigned int tcplen, i;
+        int len, tcp_hdrlen;
+        unsigned int i;
         __be16 oldval;
         u16 newmss;
         u8 *opt;
 
+        /* This is a fragment, no TCP header is available */
+        if (par->fragoff != 0)
+                return 0;
+
         if (!skb_make_writable(skb, skb->len))
                 return -1;
 
-        tcplen = skb->len - tcphoff;
+        len = skb->len - tcphoff;
+        if (len < (int)sizeof(struct tcphdr))
+                return -1;
+
         tcph = (struct tcphdr *)(skb_network_header(skb) + tcphoff);
+        tcp_hdrlen = tcph->doff * 4;
 
-        /* Header cannot be larger than the packet */
-        if (tcplen < tcph->doff*4)
+        if (len < tcp_hdrlen)
                 return -1;
 
         if (info->mss == XT_TCPMSS_CLAMP_PMTU) {
@@ -82,9 +91,8 @@ tcpmss_mangle_packet(struct sk_buff *skb,
                 newmss = info->mss;
 
         opt = (u_int8_t *)tcph;
-        for (i = sizeof(struct tcphdr); i < tcph->doff*4; i += optlen(opt, i)) {
-                if (opt[i] == TCPOPT_MSS && tcph->doff*4 - i >= TCPOLEN_MSS &&
-                    opt[i+1] == TCPOLEN_MSS) {
+        for (i = sizeof(struct tcphdr); i <= tcp_hdrlen - TCPOLEN_MSS; i += optlen(opt, i)) {
+                if (opt[i] == TCPOPT_MSS && opt[i+1] == TCPOLEN_MSS) {
                         u_int16_t oldmss;
 
                         oldmss = (opt[i+2] << 8) | opt[i+3];
@@ -107,9 +115,10 @@ tcpmss_mangle_packet(struct sk_buff *skb,
         }
 
         /* There is data after the header so the option can't be added
-           without moving it, and doing so may make the SYN packet
-           itself too large. Accept the packet unmodified instead. */
-        if (tcplen > tcph->doff*4)
+         * without moving it, and doing so may make the SYN packet
+         * itself too large. Accept the packet unmodified instead.
+         */
+        if (len > tcp_hdrlen)
                 return 0;
 
         /*
@@ -125,11 +134,23 @@ tcpmss_mangle_packet(struct sk_buff *skb,
 
         skb_put(skb, TCPOLEN_MSS);
 
+        /*
+         * IPv4: RFC 1122 states "If an MSS option is not received at
+         * connection setup, TCP MUST assume a default send MSS of 536".
+         * IPv6: RFC 2460 states IPv6 has a minimum MTU of 1280 and a minimum
+         * length IPv6 header of 60, ergo the default MSS value is 1220
+         * Since no MSS was provided, we must use the default values
+         */
+        if (par->family == NFPROTO_IPV4)
+                newmss = min(newmss, (u16)536);
+        else
+                newmss = min(newmss, (u16)1220);
+
         opt = (u_int8_t *)tcph + sizeof(struct tcphdr);
-        memmove(opt + TCPOLEN_MSS, opt, tcplen - sizeof(struct tcphdr));
+        memmove(opt + TCPOLEN_MSS, opt, len - sizeof(struct tcphdr));
 
         inet_proto_csum_replace2(&tcph->check, skb,
-                                 htons(tcplen), htons(tcplen + TCPOLEN_MSS), 1);
+                                 htons(len), htons(len + TCPOLEN_MSS), 1);
         opt[0] = TCPOPT_MSS;
         opt[1] = TCPOLEN_MSS;
         opt[2] = (newmss & 0xff00) >> 8;
@@ -182,7 +203,7 @@ tcpmss_tg4(struct sk_buff *skb, const struct xt_action_param *par)
         __be16 newlen;
         int ret;
 
-        ret = tcpmss_mangle_packet(skb, par->targinfo,
+        ret = tcpmss_mangle_packet(skb, par,
                                    tcpmss_reverse_mtu(skb, PF_INET),
                                    iph->ihl * 4,
                                    sizeof(*iph) + sizeof(struct tcphdr));
@@ -211,7 +232,7 @@ tcpmss_tg6(struct sk_buff *skb, const struct xt_action_param *par)
         tcphoff = ipv6_skip_exthdr(skb, sizeof(*ipv6h), &nexthdr, &frag_off);
         if (tcphoff < 0)
                 return NF_DROP;
-        ret = tcpmss_mangle_packet(skb, par->targinfo,
+        ret = tcpmss_mangle_packet(skb, par,
                                    tcpmss_reverse_mtu(skb, PF_INET6),
                                    tcphoff,
                                    sizeof(*ipv6h) + sizeof(struct tcphdr));
diff --git a/net/netfilter/xt_TCPOPTSTRIP.c b/net/netfilter/xt_TCPOPTSTRIP.c
index 1eb1a44bfd3d..625fa1d636a0 100644
--- a/net/netfilter/xt_TCPOPTSTRIP.c
+++ b/net/netfilter/xt_TCPOPTSTRIP.c
@@ -38,7 +38,7 @@ tcpoptstrip_mangle_packet(struct sk_buff *skb,
         struct tcphdr *tcph;
         u_int16_t n, o;
         u_int8_t *opt;
-        int len;
+        int len, tcp_hdrlen;
 
         /* This is a fragment, no TCP header is available */
         if (par->fragoff != 0)
@@ -48,21 +48,25 @@ tcpoptstrip_mangle_packet(struct sk_buff *skb,
                 return NF_DROP;
 
         len = skb->len - tcphoff;
-        if (len < (int)sizeof(struct tcphdr) ||
-            tcp_hdr(skb)->doff * 4 > len)
+        if (len < (int)sizeof(struct tcphdr))
                 return NF_DROP;
 
         tcph = (struct tcphdr *)(skb_network_header(skb) + tcphoff);
+        tcp_hdrlen = tcph->doff * 4;
+
+        if (len < tcp_hdrlen)
+                return NF_DROP;
+
         opt  = (u_int8_t *)tcph;
 
         /*
          * Walk through all TCP options - if we find some option to remove,
          * set all octets to %TCPOPT_NOP and adjust checksum.
          */
-        for (i = sizeof(struct tcphdr); i < tcp_hdrlen(skb); i += optl) {
+        for (i = sizeof(struct tcphdr); i < tcp_hdrlen - 1; i += optl) {
                 optl = optlen(opt, i);
 
-                if (i + optl > tcp_hdrlen(skb))
+                if (i + optl > tcp_hdrlen)
                         break;
 
                 if (!tcpoptstrip_test_bit(info->strip_bmap, opt[i]))
diff --git a/net/netfilter/xt_TEE.c b/net/netfilter/xt_TEE.c
index bd93e51d30ac..292934d23482 100644
--- a/net/netfilter/xt_TEE.c
+++ b/net/netfilter/xt_TEE.c
@@ -200,7 +200,7 @@ tee_tg6(struct sk_buff *skb, const struct xt_action_param *par)
 static int tee_netdev_event(struct notifier_block *this, unsigned long event,
                             void *ptr)
 {
-        struct net_device *dev = ptr;
+        struct net_device *dev = netdev_notifier_info_to_dev(ptr);
         struct xt_tee_priv *priv;
 
         priv = container_of(this, struct xt_tee_priv, notifier);
diff --git a/net/netfilter/xt_TPROXY.c b/net/netfilter/xt_TPROXY.c
index d7f195388f66..5d8a3a3cd5a7 100644
--- a/net/netfilter/xt_TPROXY.c
+++ b/net/netfilter/xt_TPROXY.c
@@ -15,7 +15,9 @@
 #include <linux/ip.h>
 #include <net/checksum.h>
 #include <net/udp.h>
+#include <net/tcp.h>
 #include <net/inet_sock.h>
+#include <net/inet_hashtables.h>
 #include <linux/inetdevice.h>
 #include <linux/netfilter/x_tables.h>
 #include <linux/netfilter_ipv4/ip_tables.h>
@@ -26,13 +28,18 @@
 #define XT_TPROXY_HAVE_IPV6 1
 #include <net/if_inet6.h>
 #include <net/addrconf.h>
+#include <net/inet6_hashtables.h>
 #include <linux/netfilter_ipv6/ip6_tables.h>
 #include <net/netfilter/ipv6/nf_defrag_ipv6.h>
 #endif
 
-#include <net/netfilter/nf_tproxy_core.h>
 #include <linux/netfilter/xt_TPROXY.h>
 
+enum nf_tproxy_lookup_t {
+         NFT_LOOKUP_LISTENER,
+         NFT_LOOKUP_ESTABLISHED,
+};
+
 static bool tproxy_sk_is_transparent(struct sock *sk)
 {
         if (sk->sk_state != TCP_TIME_WAIT) {
@@ -68,6 +75,157 @@ tproxy_laddr4(struct sk_buff *skb, __be32 user_laddr, __be32 daddr)
         return laddr ? laddr : daddr;
 }
 
+/*
+ * This is used when the user wants to intercept a connection matching
+ * an explicit iptables rule. In this case the sockets are assumed
+ * matching in preference order:
+ *
+ *   - match: if there's a fully established connection matching the
+ *     _packet_ tuple, it is returned, assuming the redirection
+ *     already took place and we process a packet belonging to an
+ *     established connection
+ *
+ *   - match: if there's a listening socket matching the redirection
+ *     (e.g. on-port & on-ip of the connection), it is returned,
+ *     regardless if it was bound to 0.0.0.0 or an explicit
+ *     address. The reasoning is that if there's an explicit rule, it
+ *     does not really matter if the listener is bound to an interface
+ *     or to 0. The user already stated that he wants redirection
+ *     (since he added the rule).
+ *
+ * Please note that there's an overlap between what a TPROXY target
+ * and a socket match will match. Normally if you have both rules the
+ * "socket" match will be the first one, effectively all packets
+ * belonging to established connections going through that one.
+ */
+static inline struct sock *
+nf_tproxy_get_sock_v4(struct net *net, const u8 protocol,
+                      const __be32 saddr, const __be32 daddr,
+                      const __be16 sport, const __be16 dport,
+                      const struct net_device *in,
+                      const enum nf_tproxy_lookup_t lookup_type)
+{
+        struct sock *sk;
+
+        switch (protocol) {
+        case IPPROTO_TCP:
+                switch (lookup_type) {
+                case NFT_LOOKUP_LISTENER:
+                        sk = inet_lookup_listener(net, &tcp_hashinfo,
+                                                    saddr, sport,
+                                                    daddr, dport,
+                                                    in->ifindex);
+
+                        /* NOTE: we return listeners even if bound to
+                         * 0.0.0.0, those are filtered out in
+                         * xt_socket, since xt_TPROXY needs 0 bound
+                         * listeners too
+                         */
+                        break;
+                case NFT_LOOKUP_ESTABLISHED:
+                        sk = inet_lookup_established(net, &tcp_hashinfo,
+                                                    saddr, sport, daddr, dport,
+                                                    in->ifindex);
+                        break;
+                default:
+                        BUG();
+                }
+                break;
+        case IPPROTO_UDP:
+                sk = udp4_lib_lookup(net, saddr, sport, daddr, dport,
+                                     in->ifindex);
+                if (sk) {
+                        int connected = (sk->sk_state == TCP_ESTABLISHED);
+                        int wildcard = (inet_sk(sk)->inet_rcv_saddr == 0);
+
+                        /* NOTE: we return listeners even if bound to
+                         * 0.0.0.0, those are filtered out in
+                         * xt_socket, since xt_TPROXY needs 0 bound
+                         * listeners too
+                         */
+                        if ((lookup_type == NFT_LOOKUP_ESTABLISHED && (!connected || wildcard)) ||
+                            (lookup_type == NFT_LOOKUP_LISTENER && connected)) {
+                                sock_put(sk);
+                                sk = NULL;
+                        }
+                }
+                break;
+        default:
+                WARN_ON(1);
+                sk = NULL;
+        }
+
+        pr_debug("tproxy socket lookup: proto %u %08x:%u -> %08x:%u, lookup type: %d, sock %p\n",
+                 protocol, ntohl(saddr), ntohs(sport), ntohl(daddr), ntohs(dport), lookup_type, sk);
+
+        return sk;
+}
+
+#ifdef XT_TPROXY_HAVE_IPV6
+static inline struct sock *
+nf_tproxy_get_sock_v6(struct net *net, const u8 protocol,
+                      const struct in6_addr *saddr, const struct in6_addr *daddr,
+                      const __be16 sport, const __be16 dport,
+                      const struct net_device *in,
+                      const enum nf_tproxy_lookup_t lookup_type)
+{
+        struct sock *sk;
+
+        switch (protocol) {
+        case IPPROTO_TCP:
+                switch (lookup_type) {
+                case NFT_LOOKUP_LISTENER:
+                        sk = inet6_lookup_listener(net, &tcp_hashinfo,
+                                                   saddr, sport,
+                                                   daddr, ntohs(dport),
+                                                   in->ifindex);
+
+                        /* NOTE: we return listeners even if bound to
+                         * 0.0.0.0, those are filtered out in
+                         * xt_socket, since xt_TPROXY needs 0 bound
+                         * listeners too
+                         */
+                        break;
+                case NFT_LOOKUP_ESTABLISHED:
+                        sk = __inet6_lookup_established(net, &tcp_hashinfo,
+                                                        saddr, sport, daddr, ntohs(dport),
+                                                        in->ifindex);
+                        break;
+                default:
+                        BUG();
+                }
+                break;
+        case IPPROTO_UDP:
+                sk = udp6_lib_lookup(net, saddr, sport, daddr, dport,
+                                     in->ifindex);
+                if (sk) {
+                        int connected = (sk->sk_state == TCP_ESTABLISHED);
+                        int wildcard = ipv6_addr_any(&inet6_sk(sk)->rcv_saddr);
+
+                        /* NOTE: we return listeners even if bound to
+                         * 0.0.0.0, those are filtered out in
+                         * xt_socket, since xt_TPROXY needs 0 bound
+                         * listeners too
+                         */
+                        if ((lookup_type == NFT_LOOKUP_ESTABLISHED && (!connected || wildcard)) ||
+                            (lookup_type == NFT_LOOKUP_LISTENER && connected)) {
+                                sock_put(sk);
+                                sk = NULL;
+                        }
+                }
+                break;
+        default:
+                WARN_ON(1);
+                sk = NULL;
+        }
+
+        pr_debug("tproxy socket lookup: proto %u %pI6:%u -> %pI6:%u, lookup type: %d, sock %p\n",
+                 protocol, saddr, ntohs(sport), daddr, ntohs(dport), lookup_type, sk);
+
+        return sk;
+}
+#endif
+
 /**
  * tproxy_handle_time_wait4 - handle IPv4 TCP TIME_WAIT reopen redirections
  * @skb:        The skb being processed.
@@ -117,6 +275,15 @@ tproxy_handle_time_wait4(struct sk_buff *skb, __be32 laddr, __be16 lport,
         return sk;
 }
 
+/* assign a socket to the skb -- consumes sk */
+static void
+nf_tproxy_assign_sock(struct sk_buff *skb, struct sock *sk)
+{
+        skb_orphan(skb);
+        skb->sk = sk;
+        skb->destructor = sock_edemux;
+}
+
 static unsigned int
 tproxy_tg4(struct sk_buff *skb, __be32 laddr, __be16 lport,
            u_int32_t mark_mask, u_int32_t mark_value)
diff --git a/net/netfilter/xt_addrtype.c b/net/netfilter/xt_addrtype.c
index 68ff29f60867..fab6eea1bf38 100644
--- a/net/netfilter/xt_addrtype.c
+++ b/net/netfilter/xt_addrtype.c
@@ -202,7 +202,7 @@ static int addrtype_mt_checkentry_v1(const struct xt_mtchk_param *par)
                         return -EINVAL;
                 }
                 if ((info->source | info->dest) >= XT_ADDRTYPE_PROHIBIT) {
-                        pr_err("ipv6 PROHIBT (THROW, NAT ..) matching not supported\n");
+                        pr_err("ipv6 PROHIBIT (THROW, NAT ..) matching not supported\n");
                         return -EINVAL;
                 }
                 if ((info->source | info->dest) & XT_ADDRTYPE_BROADCAST) {
diff --git a/net/netfilter/xt_rateest.c b/net/netfilter/xt_rateest.c
index ed0db15ab00e..7720b036d76a 100644
--- a/net/netfilter/xt_rateest.c
+++ b/net/netfilter/xt_rateest.c
@@ -18,7 +18,7 @@ static bool
 xt_rateest_mt(const struct sk_buff *skb, struct xt_action_param *par)
 {
         const struct xt_rateest_match_info *info = par->matchinfo;
-        struct gnet_stats_rate_est *r;
+        struct gnet_stats_rate_est64 *r;
         u_int32_t bps1, bps2, pps1, pps2;
         bool ret = true;
 
diff --git a/net/netfilter/xt_socket.c b/net/netfilter/xt_socket.c
index 63b2bdb59e95..06df2b9110f5 100644
--- a/net/netfilter/xt_socket.c
+++ b/net/netfilter/xt_socket.c
@@ -19,12 +19,12 @@
 #include <net/icmp.h>
 #include <net/sock.h>
 #include <net/inet_sock.h>
-#include <net/netfilter/nf_tproxy_core.h>
 #include <net/netfilter/ipv4/nf_defrag_ipv4.h>
 
 #if IS_ENABLED(CONFIG_IP6_NF_IPTABLES)
 #define XT_SOCKET_HAVE_IPV6 1
 #include <linux/netfilter_ipv6/ip6_tables.h>
+#include <net/inet6_hashtables.h>
 #include <net/netfilter/ipv6/nf_defrag_ipv6.h>
 #endif
 
@@ -101,13 +101,50 @@ extract_icmp4_fields(const struct sk_buff *skb,
         return 0;
 }
 
+/* "socket" match based redirection (no specific rule)
+ * ===================================================
+ *
+ * There are connections with dynamic endpoints (e.g. FTP data
+ * connection) that the user is unable to add explicit rules
+ * for. These are taken care of by a generic "socket" rule. It is
+ * assumed that the proxy application is trusted to open such
+ * connections without explicit iptables rule (except of course the
+ * generic 'socket' rule). In this case the following sockets are
+ * matched in preference order:
+ *
+ *   - match: if there's a fully established connection matching the
+ *     _packet_ tuple
+ *
+ *   - match: if there's a non-zero bound listener (possibly with a
+ *     non-local address) We don't accept zero-bound listeners, since
+ *     then local services could intercept traffic going through the
+ *     box.
+ */
+static struct sock *
+xt_socket_get_sock_v4(struct net *net, const u8 protocol,
+                      const __be32 saddr, const __be32 daddr,
+                      const __be16 sport, const __be16 dport,
+                      const struct net_device *in)
+{
+        switch (protocol) {
+        case IPPROTO_TCP:
+                return __inet_lookup(net, &tcp_hashinfo,
+                                     saddr, sport, daddr, dport,
+                                     in->ifindex);
+        case IPPROTO_UDP:
+                return udp4_lib_lookup(net, saddr, sport, daddr, dport,
+                                       in->ifindex);
+        }
+        return NULL;
+}
+
 static bool
 socket_match(const struct sk_buff *skb, struct xt_action_param *par,
              const struct xt_socket_mtinfo1 *info)
 {
         const struct iphdr *iph = ip_hdr(skb);
         struct udphdr _hdr, *hp = NULL;
-        struct sock *sk;
+        struct sock *sk = skb->sk;
         __be32 uninitialized_var(daddr), uninitialized_var(saddr);
         __be16 uninitialized_var(dport), uninitialized_var(sport);
         u8 uninitialized_var(protocol);
@@ -155,25 +192,31 @@ socket_match(const struct sk_buff *skb, struct xt_action_param *par,
         }
 #endif
 
-        sk = nf_tproxy_get_sock_v4(dev_net(skb->dev), protocol,
-                                   saddr, daddr, sport, dport, par->in, NFT_LOOKUP_ANY);
-        if (sk != NULL) {
+        if (!sk)
+                sk = xt_socket_get_sock_v4(dev_net(skb->dev), protocol,
+                                           saddr, daddr, sport, dport,
+                                           par->in);
+        if (sk) {
                 bool wildcard;
                 bool transparent = true;
 
-                /* Ignore sockets listening on INADDR_ANY */
-                wildcard = (sk->sk_state != TCP_TIME_WAIT &&
+                /* Ignore sockets listening on INADDR_ANY,
+                 * unless XT_SOCKET_NOWILDCARD is set
+                 */
+                wildcard = (!(info->flags & XT_SOCKET_NOWILDCARD) &&
+                            sk->sk_state != TCP_TIME_WAIT &&
                             inet_sk(sk)->inet_rcv_saddr == 0);
 
                 /* Ignore non-transparent sockets,
                    if XT_SOCKET_TRANSPARENT is used */
-                if (info && info->flags & XT_SOCKET_TRANSPARENT)
+                if (info->flags & XT_SOCKET_TRANSPARENT)
                         transparent = ((sk->sk_state != TCP_TIME_WAIT &&
                                         inet_sk(sk)->transparent) ||
                                        (sk->sk_state == TCP_TIME_WAIT &&
                                         inet_twsk(sk)->tw_transparent));
 
-                xt_socket_put_sk(sk);
+                if (sk != skb->sk)
+                        xt_socket_put_sk(sk);
 
                 if (wildcard || !transparent)
                         sk = NULL;
@@ -190,11 +233,15 @@ socket_match(const struct sk_buff *skb, struct xt_action_param *par,
 static bool
 socket_mt4_v0(const struct sk_buff *skb, struct xt_action_param *par)
 {
-        return socket_match(skb, par, NULL);
+        static struct xt_socket_mtinfo1 xt_info_v0 = {
+                .flags = 0,
+        };
+
+        return socket_match(skb, par, &xt_info_v0);
 }
 
 static bool
-socket_mt4_v1(const struct sk_buff *skb, struct xt_action_param *par)
+socket_mt4_v1_v2(const struct sk_buff *skb, struct xt_action_param *par)
 {
         return socket_match(skb, par, par->matchinfo);
 }
@@ -255,12 +302,31 @@ extract_icmp6_fields(const struct sk_buff *skb,
         return 0;
 }
 
+static struct sock *
+xt_socket_get_sock_v6(struct net *net, const u8 protocol,
+                      const struct in6_addr *saddr, const struct in6_addr *daddr,
+                      const __be16 sport, const __be16 dport,
+                      const struct net_device *in)
+{
+        switch (protocol) {
+        case IPPROTO_TCP:
+                return inet6_lookup(net, &tcp_hashinfo,
+                                    saddr, sport, daddr, dport,
+                                    in->ifindex);
+        case IPPROTO_UDP:
+                return udp6_lib_lookup(net, saddr, sport, daddr, dport,
+                                       in->ifindex);
+        }
+
+        return NULL;
+}
+
 static bool
-socket_mt6_v1(const struct sk_buff *skb, struct xt_action_param *par)
+socket_mt6_v1_v2(const struct sk_buff *skb, struct xt_action_param *par)
 {
         struct ipv6hdr *iph = ipv6_hdr(skb);
         struct udphdr _hdr, *hp = NULL;
-        struct sock *sk;
+        struct sock *sk = skb->sk;
         struct in6_addr *daddr = NULL, *saddr = NULL;
         __be16 uninitialized_var(dport), uninitialized_var(sport);
         int thoff = 0, uninitialized_var(tproto);
@@ -291,25 +357,31 @@ socket_mt6_v1(const struct sk_buff *skb, struct xt_action_param *par)
                 return false;
         }
 
-        sk = nf_tproxy_get_sock_v6(dev_net(skb->dev), tproto,
-                                   saddr, daddr, sport, dport, par->in, NFT_LOOKUP_ANY);
-        if (sk != NULL) {
+        if (!sk)
+                sk = xt_socket_get_sock_v6(dev_net(skb->dev), tproto,
+                                           saddr, daddr, sport, dport,
+                                           par->in);
+        if (sk) {
                 bool wildcard;
                 bool transparent = true;
 
-                /* Ignore sockets listening on INADDR_ANY */
-                wildcard = (sk->sk_state != TCP_TIME_WAIT &&
+                /* Ignore sockets listening on INADDR_ANY
+                 * unless XT_SOCKET_NOWILDCARD is set
+                 */
+                wildcard = (!(info->flags & XT_SOCKET_NOWILDCARD) &&
+                            sk->sk_state != TCP_TIME_WAIT &&
                             ipv6_addr_any(&inet6_sk(sk)->rcv_saddr));
 
                 /* Ignore non-transparent sockets,
                    if XT_SOCKET_TRANSPARENT is used */
-                if (info && info->flags & XT_SOCKET_TRANSPARENT)
+                if (info->flags & XT_SOCKET_TRANSPARENT)
                         transparent = ((sk->sk_state != TCP_TIME_WAIT &&
                                         inet_sk(sk)->transparent) ||
                                        (sk->sk_state == TCP_TIME_WAIT &&
                                         inet_twsk(sk)->tw_transparent));
 
-                xt_socket_put_sk(sk);
+                if (sk != skb->sk)
+                        xt_socket_put_sk(sk);
 
                 if (wildcard || !transparent)
                         sk = NULL;
@@ -325,6 +397,28 @@ socket_mt6_v1(const struct sk_buff *skb, struct xt_action_param *par)
 }
 #endif
 
+static int socket_mt_v1_check(const struct xt_mtchk_param *par)
+{
+        const struct xt_socket_mtinfo1 *info = (struct xt_socket_mtinfo1 *) par->matchinfo;
+
+        if (info->flags & ~XT_SOCKET_FLAGS_V1) {
+                pr_info("unknown flags 0x%x\n", info->flags & ~XT_SOCKET_FLAGS_V1);
+                return -EINVAL;
+        }
+        return 0;
+}
+
+static int socket_mt_v2_check(const struct xt_mtchk_param *par)
+{
+        const struct xt_socket_mtinfo2 *info = (struct xt_socket_mtinfo2 *) par->matchinfo;
+
+        if (info->flags & ~XT_SOCKET_FLAGS_V2) {
+                pr_info("unknown flags 0x%x\n", info->flags & ~XT_SOCKET_FLAGS_V2);
+                return -EINVAL;
+        }
+        return 0;
+}
+
 static struct xt_match socket_mt_reg[] __read_mostly = {
         {
                 .name           = "socket",
@@ -339,7 +433,8 @@ static struct xt_match socket_mt_reg[] __read_mostly = {
                 .name           = "socket",
                 .revision       = 1,
                 .family         = NFPROTO_IPV4,
-                .match          = socket_mt4_v1,
+                .match          = socket_mt4_v1_v2,
+                .checkentry     = socket_mt_v1_check,
                 .matchsize      = sizeof(struct xt_socket_mtinfo1),
                 .hooks          = (1 << NF_INET_PRE_ROUTING) |
                                   (1 << NF_INET_LOCAL_IN),
@@ -350,7 +445,32 @@ static struct xt_match socket_mt_reg[] __read_mostly = {
                 .name           = "socket",
                 .revision       = 1,
                 .family         = NFPROTO_IPV6,
-                .match          = socket_mt6_v1,
+                .match          = socket_mt6_v1_v2,
+                .checkentry     = socket_mt_v1_check,
+                .matchsize      = sizeof(struct xt_socket_mtinfo1),
+                .hooks          = (1 << NF_INET_PRE_ROUTING) |
+                                  (1 << NF_INET_LOCAL_IN),
+                .me             = THIS_MODULE,
+        },
+#endif
+        {
+                .name           = "socket",
+                .revision       = 2,
+                .family         = NFPROTO_IPV4,
+                .match          = socket_mt4_v1_v2,
+                .checkentry     = socket_mt_v2_check,
+                .matchsize      = sizeof(struct xt_socket_mtinfo1),
+                .hooks          = (1 << NF_INET_PRE_ROUTING) |
+                                  (1 << NF_INET_LOCAL_IN),
+                .me             = THIS_MODULE,
+        },
+#ifdef XT_SOCKET_HAVE_IPV6
+        {
+                .name           = "socket",
+                .revision       = 2,
+                .family         = NFPROTO_IPV6,
+                .match          = socket_mt6_v1_v2,
+                .checkentry     = socket_mt_v2_check,
                 .matchsize      = sizeof(struct xt_socket_mtinfo1),
                 .hooks          = (1 << NF_INET_PRE_ROUTING) |
                                   (1 << NF_INET_LOCAL_IN),
diff --git a/net/netlabel/netlabel_cipso_v4.c b/net/netlabel/netlabel_cipso_v4.c
index c15042f987bd..a1100640495d 100644
--- a/net/netlabel/netlabel_cipso_v4.c
+++ b/net/netlabel/netlabel_cipso_v4.c
@@ -691,8 +691,8 @@ static int netlbl_cipsov4_remove_cb(struct netlbl_dom_map *entry, void *arg)
 {
         struct netlbl_domhsh_walk_arg *cb_arg = arg;
 
-        if (entry->type == NETLBL_NLTYPE_CIPSOV4 &&
-            entry->type_def.cipsov4->doi == cb_arg->doi)
+        if (entry->def.type == NETLBL_NLTYPE_CIPSOV4 &&
+            entry->def.cipso->doi == cb_arg->doi)
                 return netlbl_domhsh_remove_entry(entry, cb_arg->audit_info);
 
         return 0;
diff --git a/net/netlabel/netlabel_domainhash.c b/net/netlabel/netlabel_domainhash.c
index 6bb1d42f0fac..85d842e6e431 100644
--- a/net/netlabel/netlabel_domainhash.c
+++ b/net/netlabel/netlabel_domainhash.c
@@ -84,15 +84,15 @@ static void netlbl_domhsh_free_entry(struct rcu_head *entry)
 #endif /* IPv6 */
 
         ptr = container_of(entry, struct netlbl_dom_map, rcu);
-        if (ptr->type == NETLBL_NLTYPE_ADDRSELECT) {
+        if (ptr->def.type == NETLBL_NLTYPE_ADDRSELECT) {
                 netlbl_af4list_foreach_safe(iter4, tmp4,
-                                            &ptr->type_def.addrsel->list4) {
+                                            &ptr->def.addrsel->list4) {
                         netlbl_af4list_remove_entry(iter4);
                         kfree(netlbl_domhsh_addr4_entry(iter4));
                 }
 #if IS_ENABLED(CONFIG_IPV6)
                 netlbl_af6list_foreach_safe(iter6, tmp6,
-                                            &ptr->type_def.addrsel->list6) {
+                                            &ptr->def.addrsel->list6) {
                         netlbl_af6list_remove_entry(iter6);
                         kfree(netlbl_domhsh_addr6_entry(iter6));
                 }
@@ -213,21 +213,21 @@ static void netlbl_domhsh_audit_add(struct netlbl_dom_map *entry,
                 if (addr4 != NULL) {
                         struct netlbl_domaddr4_map *map4;
                         map4 = netlbl_domhsh_addr4_entry(addr4);
-                        type = map4->type;
-                        cipsov4 = map4->type_def.cipsov4;
+                        type = map4->def.type;
+                        cipsov4 = map4->def.cipso;
                         netlbl_af4list_audit_addr(audit_buf, 0, NULL,
                                                   addr4->addr, addr4->mask);
 #if IS_ENABLED(CONFIG_IPV6)
                 } else if (addr6 != NULL) {
                         struct netlbl_domaddr6_map *map6;
                         map6 = netlbl_domhsh_addr6_entry(addr6);
-                        type = map6->type;
+                        type = map6->def.type;
                         netlbl_af6list_audit_addr(audit_buf, 0, NULL,
                                                   &addr6->addr, &addr6->mask);
 #endif /* IPv6 */
                 } else {
-                        type = entry->type;
-                        cipsov4 = entry->type_def.cipsov4;
+                        type = entry->def.type;
+                        cipsov4 = entry->def.cipso;
                 }
                 switch (type) {
                 case NETLBL_NLTYPE_UNLABELED:
@@ -265,26 +265,25 @@ static int netlbl_domhsh_validate(const struct netlbl_dom_map *entry)
         if (entry == NULL)
                 return -EINVAL;
 
-        switch (entry->type) {
+        switch (entry->def.type) {
         case NETLBL_NLTYPE_UNLABELED:
-                if (entry->type_def.cipsov4 != NULL ||
-                    entry->type_def.addrsel != NULL)
+                if (entry->def.cipso != NULL || entry->def.addrsel != NULL)
                         return -EINVAL;
                 break;
         case NETLBL_NLTYPE_CIPSOV4:
-                if (entry->type_def.cipsov4 == NULL)
+                if (entry->def.cipso == NULL)
                         return -EINVAL;
                 break;
         case NETLBL_NLTYPE_ADDRSELECT:
-                netlbl_af4list_foreach(iter4, &entry->type_def.addrsel->list4) {
+                netlbl_af4list_foreach(iter4, &entry->def.addrsel->list4) {
                         map4 = netlbl_domhsh_addr4_entry(iter4);
-                        switch (map4->type) {
+                        switch (map4->def.type) {
                         case NETLBL_NLTYPE_UNLABELED:
-                                if (map4->type_def.cipsov4 != NULL)
+                                if (map4->def.cipso != NULL)
                                         return -EINVAL;
                                 break;
                         case NETLBL_NLTYPE_CIPSOV4:
-                                if (map4->type_def.cipsov4 == NULL)
+                                if (map4->def.cipso == NULL)
                                         return -EINVAL;
                                 break;
                         default:
@@ -292,9 +291,9 @@ static int netlbl_domhsh_validate(const struct netlbl_dom_map *entry)
                         }
                 }
 #if IS_ENABLED(CONFIG_IPV6)
-                netlbl_af6list_foreach(iter6, &entry->type_def.addrsel->list6) {
+                netlbl_af6list_foreach(iter6, &entry->def.addrsel->list6) {
                         map6 = netlbl_domhsh_addr6_entry(iter6);
-                        switch (map6->type) {
+                        switch (map6->def.type) {
                         case NETLBL_NLTYPE_UNLABELED:
                                 break;
                         default:
@@ -402,32 +401,31 @@ int netlbl_domhsh_add(struct netlbl_dom_map *entry,
                         rcu_assign_pointer(netlbl_domhsh_def, entry);
                 }
 
-                if (entry->type == NETLBL_NLTYPE_ADDRSELECT) {
+                if (entry->def.type == NETLBL_NLTYPE_ADDRSELECT) {
                         netlbl_af4list_foreach_rcu(iter4,
-                                               &entry->type_def.addrsel->list4)
+                                                   &entry->def.addrsel->list4)
                                 netlbl_domhsh_audit_add(entry, iter4, NULL,
                                                         ret_val, audit_info);
 #if IS_ENABLED(CONFIG_IPV6)
                         netlbl_af6list_foreach_rcu(iter6,
-                                               &entry->type_def.addrsel->list6)
+                                                   &entry->def.addrsel->list6)
                                 netlbl_domhsh_audit_add(entry, NULL, iter6,
                                                         ret_val, audit_info);
 #endif /* IPv6 */
                 } else
                         netlbl_domhsh_audit_add(entry, NULL, NULL,
                                                 ret_val, audit_info);
-        } else if (entry_old->type == NETLBL_NLTYPE_ADDRSELECT &&
-                   entry->type == NETLBL_NLTYPE_ADDRSELECT) {
+        } else if (entry_old->def.type == NETLBL_NLTYPE_ADDRSELECT &&
+                   entry->def.type == NETLBL_NLTYPE_ADDRSELECT) {
                 struct list_head *old_list4;
                 struct list_head *old_list6;
 
-                old_list4 = &entry_old->type_def.addrsel->list4;
-                old_list6 = &entry_old->type_def.addrsel->list6;
+                old_list4 = &entry_old->def.addrsel->list4;
+                old_list6 = &entry_old->def.addrsel->list6;
 
                 /* we only allow the addition of address selectors if all of
                  * the selectors do not exist in the existing domain map */
-                netlbl_af4list_foreach_rcu(iter4,
-                                           &entry->type_def.addrsel->list4)
+                netlbl_af4list_foreach_rcu(iter4, &entry->def.addrsel->list4)
                         if (netlbl_af4list_search_exact(iter4->addr,
                                                         iter4->mask,
                                                         old_list4)) {
@@ -435,8 +433,7 @@ int netlbl_domhsh_add(struct netlbl_dom_map *entry,
                                 goto add_return;
                         }
 #if IS_ENABLED(CONFIG_IPV6)
-                netlbl_af6list_foreach_rcu(iter6,
-                                           &entry->type_def.addrsel->list6)
+                netlbl_af6list_foreach_rcu(iter6, &entry->def.addrsel->list6)
                         if (netlbl_af6list_search_exact(&iter6->addr,
                                                         &iter6->mask,
                                                         old_list6)) {
@@ -446,7 +443,7 @@ int netlbl_domhsh_add(struct netlbl_dom_map *entry,
 #endif /* IPv6 */
 
                 netlbl_af4list_foreach_safe(iter4, tmp4,
-                                            &entry->type_def.addrsel->list4) {
+                                            &entry->def.addrsel->list4) {
                         netlbl_af4list_remove_entry(iter4);
                         iter4->valid = 1;
                         ret_val = netlbl_af4list_add(iter4, old_list4);
@@ -457,7 +454,7 @@ int netlbl_domhsh_add(struct netlbl_dom_map *entry,
                 }
 #if IS_ENABLED(CONFIG_IPV6)
                 netlbl_af6list_foreach_safe(iter6, tmp6,
-                                            &entry->type_def.addrsel->list6) {
+                                            &entry->def.addrsel->list6) {
                         netlbl_af6list_remove_entry(iter6);
                         iter6->valid = 1;
                         ret_val = netlbl_af6list_add(iter6, old_list6);
@@ -538,18 +535,18 @@ int netlbl_domhsh_remove_entry(struct netlbl_dom_map *entry,
                 struct netlbl_af4list *iter4;
                 struct netlbl_domaddr4_map *map4;
 
-                switch (entry->type) {
+                switch (entry->def.type) {
                 case NETLBL_NLTYPE_ADDRSELECT:
                         netlbl_af4list_foreach_rcu(iter4,
-                                             &entry->type_def.addrsel->list4) {
+                                             &entry->def.addrsel->list4) {
                                 map4 = netlbl_domhsh_addr4_entry(iter4);
-                                cipso_v4_doi_putdef(map4->type_def.cipsov4);
+                                cipso_v4_doi_putdef(map4->def.cipso);
                         }
                         /* no need to check the IPv6 list since we currently
                          * support only unlabeled protocols for IPv6 */
                         break;
                 case NETLBL_NLTYPE_CIPSOV4:
-                        cipso_v4_doi_putdef(entry->type_def.cipsov4);
+                        cipso_v4_doi_putdef(entry->def.cipso);
                         break;
                 }
                 call_rcu(&entry->rcu, netlbl_domhsh_free_entry);
@@ -590,20 +587,21 @@ int netlbl_domhsh_remove_af4(const char *domain,
                 entry_map = netlbl_domhsh_search(domain);
         else
                 entry_map = netlbl_domhsh_search_def(domain);
-        if (entry_map == NULL || entry_map->type != NETLBL_NLTYPE_ADDRSELECT)
+        if (entry_map == NULL ||
+            entry_map->def.type != NETLBL_NLTYPE_ADDRSELECT)
                 goto remove_af4_failure;
 
         spin_lock(&netlbl_domhsh_lock);
         entry_addr = netlbl_af4list_remove(addr->s_addr, mask->s_addr,
-                                           &entry_map->type_def.addrsel->list4);
+                                           &entry_map->def.addrsel->list4);
         spin_unlock(&netlbl_domhsh_lock);
 
         if (entry_addr == NULL)
                 goto remove_af4_failure;
-        netlbl_af4list_foreach_rcu(iter4, &entry_map->type_def.addrsel->list4)
+        netlbl_af4list_foreach_rcu(iter4, &entry_map->def.addrsel->list4)
                 goto remove_af4_single_addr;
 #if IS_ENABLED(CONFIG_IPV6)
-        netlbl_af6list_foreach_rcu(iter6, &entry_map->type_def.addrsel->list6)
+        netlbl_af6list_foreach_rcu(iter6, &entry_map->def.addrsel->list6)
                 goto remove_af4_single_addr;
 #endif /* IPv6 */
         /* the domain mapping is empty so remove it from the mapping table */
@@ -616,7 +614,7 @@ remove_af4_single_addr:
          * shouldn't be a problem */
         synchronize_rcu();
         entry = netlbl_domhsh_addr4_entry(entry_addr);
-        cipso_v4_doi_putdef(entry->type_def.cipsov4);
+        cipso_v4_doi_putdef(entry->def.cipso);
         kfree(entry);
         return 0;
 
@@ -693,8 +691,8 @@ struct netlbl_dom_map *netlbl_domhsh_getentry(const char *domain)
  * responsible for ensuring that rcu_read_[un]lock() is called.
  *
  */
-struct netlbl_domaddr4_map *netlbl_domhsh_getentry_af4(const char *domain,
-                                                       __be32 addr)
+struct netlbl_dommap_def *netlbl_domhsh_getentry_af4(const char *domain,
+                                                     __be32 addr)
 {
         struct netlbl_dom_map *dom_iter;
         struct netlbl_af4list *addr_iter;
@@ -702,15 +700,13 @@ struct netlbl_domaddr4_map *netlbl_domhsh_getentry_af4(const char *domain,
         dom_iter = netlbl_domhsh_search_def(domain);
         if (dom_iter == NULL)
                 return NULL;
-        if (dom_iter->type != NETLBL_NLTYPE_ADDRSELECT)
-                return NULL;
 
-        addr_iter = netlbl_af4list_search(addr,
-                                          &dom_iter->type_def.addrsel->list4);
+        if (dom_iter->def.type != NETLBL_NLTYPE_ADDRSELECT)
+                return &dom_iter->def;
+        addr_iter = netlbl_af4list_search(addr, &dom_iter->def.addrsel->list4);
         if (addr_iter == NULL)
                 return NULL;
-
-        return netlbl_domhsh_addr4_entry(addr_iter);
+        return &(netlbl_domhsh_addr4_entry(addr_iter)->def);
 }
 
 #if IS_ENABLED(CONFIG_IPV6)
@@ -725,7 +721,7 @@ struct netlbl_domaddr4_map *netlbl_domhsh_getentry_af4(const char *domain,
  * responsible for ensuring that rcu_read_[un]lock() is called.
  *
  */
-struct netlbl_domaddr6_map *netlbl_domhsh_getentry_af6(const char *domain,
+struct netlbl_dommap_def *netlbl_domhsh_getentry_af6(const char *domain,
                                                    const struct in6_addr *addr)
 {
         struct netlbl_dom_map *dom_iter;
@@ -734,15 +730,13 @@ struct netlbl_domaddr6_map *netlbl_domhsh_getentry_af6(const char *domain,
         dom_iter = netlbl_domhsh_search_def(domain);
         if (dom_iter == NULL)
                 return NULL;
-        if (dom_iter->type != NETLBL_NLTYPE_ADDRSELECT)
-                return NULL;
 
-        addr_iter = netlbl_af6list_search(addr,
-                                          &dom_iter->type_def.addrsel->list6);
+        if (dom_iter->def.type != NETLBL_NLTYPE_ADDRSELECT)
+                return &dom_iter->def;
+        addr_iter = netlbl_af6list_search(addr, &dom_iter->def.addrsel->list6);
         if (addr_iter == NULL)
                 return NULL;
-
-        return netlbl_domhsh_addr6_entry(addr_iter);
+        return &(netlbl_domhsh_addr6_entry(addr_iter)->def);
 }
 #endif /* IPv6 */
 
diff --git a/net/netlabel/netlabel_domainhash.h b/net/netlabel/netlabel_domainhash.h
index 90872c4ca30f..b9be0eed8980 100644
--- a/net/netlabel/netlabel_domainhash.h
+++ b/net/netlabel/netlabel_domainhash.h
@@ -43,37 +43,35 @@
 #define NETLBL_DOMHSH_BITSIZE       7
 
 /* Domain mapping definition structures */
+struct netlbl_domaddr_map {
+        struct list_head list4;
+        struct list_head list6;
+};
+struct netlbl_dommap_def {
+        u32 type;
+        union {
+                struct netlbl_domaddr_map *addrsel;
+                struct cipso_v4_doi *cipso;
+        };
+};
 #define netlbl_domhsh_addr4_entry(iter) \
         container_of(iter, struct netlbl_domaddr4_map, list)
 struct netlbl_domaddr4_map {
-        u32 type;
-        union {
-                struct cipso_v4_doi *cipsov4;
-        } type_def;
+        struct netlbl_dommap_def def;
 
         struct netlbl_af4list list;
 };
 #define netlbl_domhsh_addr6_entry(iter) \
         container_of(iter, struct netlbl_domaddr6_map, list)
 struct netlbl_domaddr6_map {
-        u32 type;
-
-        /* NOTE: no 'type_def' union needed at present since we don't currently
-         *       support any IPv6 labeling protocols */
+        struct netlbl_dommap_def def;
 
         struct netlbl_af6list list;
 };
-struct netlbl_domaddr_map {
-        struct list_head list4;
-        struct list_head list6;
-};
+
 struct netlbl_dom_map {
         char *domain;
-        u32 type;
-        union {
-                struct cipso_v4_doi *cipsov4;
-                struct netlbl_domaddr_map *addrsel;
-        } type_def;
+        struct netlbl_dommap_def def;
 
         u32 valid;
         struct list_head list;
@@ -97,16 +95,16 @@ int netlbl_domhsh_remove_af4(const char *domain,
 int netlbl_domhsh_remove(const char *domain, struct netlbl_audit *audit_info);
 int netlbl_domhsh_remove_default(struct netlbl_audit *audit_info);
 struct netlbl_dom_map *netlbl_domhsh_getentry(const char *domain);
-struct netlbl_domaddr4_map *netlbl_domhsh_getentry_af4(const char *domain,
-                                                       __be32 addr);
+struct netlbl_dommap_def *netlbl_domhsh_getentry_af4(const char *domain,
+                                                     __be32 addr);
+#if IS_ENABLED(CONFIG_IPV6)
+struct netlbl_dommap_def *netlbl_domhsh_getentry_af6(const char *domain,
+                                                   const struct in6_addr *addr);
+#endif /* IPv6 */
+
 int netlbl_domhsh_walk(u32 *skip_bkt,
                      u32 *skip_chain,
                      int (*callback) (struct netlbl_dom_map *entry, void *arg),
                      void *cb_arg);
 
-#if IS_ENABLED(CONFIG_IPV6)
-struct netlbl_domaddr6_map *netlbl_domhsh_getentry_af6(const char *domain,
-                                                  const struct in6_addr *addr);
-#endif /* IPv6 */
-
 #endif
diff --git a/net/netlabel/netlabel_kapi.c b/net/netlabel/netlabel_kapi.c
index 7c94aedd0912..96a458e12f60 100644
--- a/net/netlabel/netlabel_kapi.c
+++ b/net/netlabel/netlabel_kapi.c
@@ -122,7 +122,7 @@ int netlbl_cfg_unlbl_map_add(const char *domain,
         }
 
         if (addr == NULL && mask == NULL)
-                entry->type = NETLBL_NLTYPE_UNLABELED;
+                entry->def.type = NETLBL_NLTYPE_UNLABELED;
         else if (addr != NULL && mask != NULL) {
                 addrmap = kzalloc(sizeof(*addrmap), GFP_ATOMIC);
                 if (addrmap == NULL)
@@ -137,7 +137,7 @@ int netlbl_cfg_unlbl_map_add(const char *domain,
                         map4 = kzalloc(sizeof(*map4), GFP_ATOMIC);
                         if (map4 == NULL)
                                 goto cfg_unlbl_map_add_failure;
-                        map4->type = NETLBL_NLTYPE_UNLABELED;
+                        map4->def.type = NETLBL_NLTYPE_UNLABELED;
                         map4->list.addr = addr4->s_addr & mask4->s_addr;
                         map4->list.mask = mask4->s_addr;
                         map4->list.valid = 1;
@@ -154,7 +154,7 @@ int netlbl_cfg_unlbl_map_add(const char *domain,
                         map6 = kzalloc(sizeof(*map6), GFP_ATOMIC);
                         if (map6 == NULL)
                                 goto cfg_unlbl_map_add_failure;
-                        map6->type = NETLBL_NLTYPE_UNLABELED;
+                        map6->def.type = NETLBL_NLTYPE_UNLABELED;
                         map6->list.addr = *addr6;
                         map6->list.addr.s6_addr32[0] &= mask6->s6_addr32[0];
                         map6->list.addr.s6_addr32[1] &= mask6->s6_addr32[1];
@@ -174,8 +174,8 @@ int netlbl_cfg_unlbl_map_add(const char *domain,
                         break;
                 }
 
-                entry->type_def.addrsel = addrmap;
-                entry->type = NETLBL_NLTYPE_ADDRSELECT;
+                entry->def.addrsel = addrmap;
+                entry->def.type = NETLBL_NLTYPE_ADDRSELECT;
         } else {
                 ret_val = -EINVAL;
                 goto cfg_unlbl_map_add_failure;
@@ -355,8 +355,8 @@ int netlbl_cfg_cipsov4_map_add(u32 doi,
         }
 
         if (addr == NULL && mask == NULL) {
-                entry->type_def.cipsov4 = doi_def;
-                entry->type = NETLBL_NLTYPE_CIPSOV4;
+                entry->def.cipso = doi_def;
+                entry->def.type = NETLBL_NLTYPE_CIPSOV4;
         } else if (addr != NULL && mask != NULL) {
                 addrmap = kzalloc(sizeof(*addrmap), GFP_ATOMIC);
                 if (addrmap == NULL)
@@ -367,8 +367,8 @@ int netlbl_cfg_cipsov4_map_add(u32 doi,
                 addrinfo = kzalloc(sizeof(*addrinfo), GFP_ATOMIC);
                 if (addrinfo == NULL)
                         goto out_addrinfo;
-                addrinfo->type_def.cipsov4 = doi_def;
-                addrinfo->type = NETLBL_NLTYPE_CIPSOV4;
+                addrinfo->def.cipso = doi_def;
+                addrinfo->def.type = NETLBL_NLTYPE_CIPSOV4;
                 addrinfo->list.addr = addr->s_addr & mask->s_addr;
                 addrinfo->list.mask = mask->s_addr;
                 addrinfo->list.valid = 1;
@@ -376,8 +376,8 @@ int netlbl_cfg_cipsov4_map_add(u32 doi,
                 if (ret_val != 0)
                         goto cfg_cipsov4_map_add_failure;
 
-                entry->type_def.addrsel = addrmap;
-                entry->type = NETLBL_NLTYPE_ADDRSELECT;
+                entry->def.addrsel = addrmap;
+                entry->def.type = NETLBL_NLTYPE_ADDRSELECT;
         } else {
                 ret_val = -EINVAL;
                 goto out_addrmap;
@@ -657,14 +657,14 @@ int netlbl_sock_setattr(struct sock *sk,
         }
         switch (family) {
         case AF_INET:
-                switch (dom_entry->type) {
+                switch (dom_entry->def.type) {
                 case NETLBL_NLTYPE_ADDRSELECT:
                         ret_val = -EDESTADDRREQ;
                         break;
                 case NETLBL_NLTYPE_CIPSOV4:
                         ret_val = cipso_v4_sock_setattr(sk,
-                                                    dom_entry->type_def.cipsov4,
-                                                    secattr);
+                                                        dom_entry->def.cipso,
+                                                        secattr);
                         break;
                 case NETLBL_NLTYPE_UNLABELED:
                         ret_val = 0;
@@ -754,23 +754,22 @@ int netlbl_conn_setattr(struct sock *sk,
 {
         int ret_val;
         struct sockaddr_in *addr4;
-        struct netlbl_domaddr4_map *af4_entry;
+        struct netlbl_dommap_def *entry;
 
         rcu_read_lock();
         switch (addr->sa_family) {
         case AF_INET:
                 addr4 = (struct sockaddr_in *)addr;
-                af4_entry = netlbl_domhsh_getentry_af4(secattr->domain,
-                                                       addr4->sin_addr.s_addr);
-                if (af4_entry == NULL) {
+                entry = netlbl_domhsh_getentry_af4(secattr->domain,
+                                                   addr4->sin_addr.s_addr);
+                if (entry == NULL) {
                         ret_val = -ENOENT;
                         goto conn_setattr_return;
                 }
-                switch (af4_entry->type) {
+                switch (entry->type) {
                 case NETLBL_NLTYPE_CIPSOV4:
                         ret_val = cipso_v4_sock_setattr(sk,
-                                                   af4_entry->type_def.cipsov4,
-                                                   secattr);
+                                                        entry->cipso, secattr);
                         break;
                 case NETLBL_NLTYPE_UNLABELED:
                         /* just delete the protocols we support for right now
@@ -812,36 +811,21 @@ int netlbl_req_setattr(struct request_sock *req,
                        const struct netlbl_lsm_secattr *secattr)
 {
         int ret_val;
-        struct netlbl_dom_map *dom_entry;
-        struct netlbl_domaddr4_map *af4_entry;
-        u32 proto_type;
-        struct cipso_v4_doi *proto_cv4;
+        struct netlbl_dommap_def *entry;
 
         rcu_read_lock();
-        dom_entry = netlbl_domhsh_getentry(secattr->domain);
-        if (dom_entry == NULL) {
-                ret_val = -ENOENT;
-                goto req_setattr_return;
-        }
         switch (req->rsk_ops->family) {
         case AF_INET:
-                if (dom_entry->type == NETLBL_NLTYPE_ADDRSELECT) {
-                        struct inet_request_sock *req_inet = inet_rsk(req);
-                        af4_entry = netlbl_domhsh_getentry_af4(secattr->domain,
-                                                            req_inet->rmt_addr);
-                        if (af4_entry == NULL) {
-                                ret_val = -ENOENT;
-                                goto req_setattr_return;
-                        }
-                        proto_type = af4_entry->type;
-                        proto_cv4 = af4_entry->type_def.cipsov4;
-                } else {
-                        proto_type = dom_entry->type;
-                        proto_cv4 = dom_entry->type_def.cipsov4;
+                entry = netlbl_domhsh_getentry_af4(secattr->domain,
+                                                   inet_rsk(req)->rmt_addr);
+                if (entry == NULL) {
+                        ret_val = -ENOENT;
+                        goto req_setattr_return;
                 }
-                switch (proto_type) {
+                switch (entry->type) {
                 case NETLBL_NLTYPE_CIPSOV4:
-                        ret_val = cipso_v4_req_setattr(req, proto_cv4, secattr);
+                        ret_val = cipso_v4_req_setattr(req,
+                                                       entry->cipso, secattr);
                         break;
                 case NETLBL_NLTYPE_UNLABELED:
                         /* just delete the protocols we support for right now
@@ -899,23 +883,21 @@ int netlbl_skbuff_setattr(struct sk_buff *skb,
 {
         int ret_val;
         struct iphdr *hdr4;
-        struct netlbl_domaddr4_map *af4_entry;
+        struct netlbl_dommap_def *entry;
 
         rcu_read_lock();
         switch (family) {
         case AF_INET:
                 hdr4 = ip_hdr(skb);
-                af4_entry = netlbl_domhsh_getentry_af4(secattr->domain,
-                                                       hdr4->daddr);
-                if (af4_entry == NULL) {
+                entry = netlbl_domhsh_getentry_af4(secattr->domain,hdr4->daddr);
+                if (entry == NULL) {
                         ret_val = -ENOENT;
                         goto skbuff_setattr_return;
                 }
-                switch (af4_entry->type) {
+                switch (entry->type) {
                 case NETLBL_NLTYPE_CIPSOV4:
-                        ret_val = cipso_v4_skbuff_setattr(skb,
-                                                   af4_entry->type_def.cipsov4,
-                                                   secattr);
+                        ret_val = cipso_v4_skbuff_setattr(skb, entry->cipso,
+                                                          secattr);
                         break;
                 case NETLBL_NLTYPE_UNLABELED:
                         /* just delete the protocols we support for right now
diff --git a/net/netlabel/netlabel_mgmt.c b/net/netlabel/netlabel_mgmt.c
index c5384ffc6146..dd1c37d7acbc 100644
--- a/net/netlabel/netlabel_mgmt.c
+++ b/net/netlabel/netlabel_mgmt.c
@@ -104,7 +104,7 @@ static int netlbl_mgmt_add_common(struct genl_info *info,
                 ret_val = -ENOMEM;
                 goto add_failure;
         }
-        entry->type = nla_get_u32(info->attrs[NLBL_MGMT_A_PROTOCOL]);
+        entry->def.type = nla_get_u32(info->attrs[NLBL_MGMT_A_PROTOCOL]);
         if (info->attrs[NLBL_MGMT_A_DOMAIN]) {
                 size_t tmp_size = nla_len(info->attrs[NLBL_MGMT_A_DOMAIN]);
                 entry->domain = kmalloc(tmp_size, GFP_KERNEL);
@@ -116,12 +116,12 @@ static int netlbl_mgmt_add_common(struct genl_info *info,
                             info->attrs[NLBL_MGMT_A_DOMAIN], tmp_size);
         }
 
-        /* NOTE: internally we allow/use a entry->type value of
+        /* NOTE: internally we allow/use a entry->def.type value of
          *       NETLBL_NLTYPE_ADDRSELECT but we don't currently allow users
          *       to pass that as a protocol value because we need to know the
          *       "real" protocol */
 
-        switch (entry->type) {
+        switch (entry->def.type) {
         case NETLBL_NLTYPE_UNLABELED:
                 break;
         case NETLBL_NLTYPE_CIPSOV4:
@@ -132,7 +132,7 @@ static int netlbl_mgmt_add_common(struct genl_info *info,
                 cipsov4 = cipso_v4_doi_getdef(tmp_val);
                 if (cipsov4 == NULL)
                         goto add_failure;
-                entry->type_def.cipsov4 = cipsov4;
+                entry->def.cipso = cipsov4;
                 break;
         default:
                 goto add_failure;
@@ -172,9 +172,9 @@ static int netlbl_mgmt_add_common(struct genl_info *info,
                 map->list.addr = addr->s_addr & mask->s_addr;
                 map->list.mask = mask->s_addr;
                 map->list.valid = 1;
-                map->type = entry->type;
+                map->def.type = entry->def.type;
                 if (cipsov4)
-                        map->type_def.cipsov4 = cipsov4;
+                        map->def.cipso = cipsov4;
 
                 ret_val = netlbl_af4list_add(&map->list, &addrmap->list4);
                 if (ret_val != 0) {
@@ -182,8 +182,8 @@ static int netlbl_mgmt_add_common(struct genl_info *info,
                         goto add_failure;
                 }
 
-                entry->type = NETLBL_NLTYPE_ADDRSELECT;
-                entry->type_def.addrsel = addrmap;
+                entry->def.type = NETLBL_NLTYPE_ADDRSELECT;
+                entry->def.addrsel = addrmap;
 #if IS_ENABLED(CONFIG_IPV6)
         } else if (info->attrs[NLBL_MGMT_A_IPV6ADDR]) {
                 struct in6_addr *addr;
@@ -223,7 +223,7 @@ static int netlbl_mgmt_add_common(struct genl_info *info,
                 map->list.addr.s6_addr32[3] &= mask->s6_addr32[3];
                 map->list.mask = *mask;
                 map->list.valid = 1;
-                map->type = entry->type;
+                map->def.type = entry->def.type;
 
                 ret_val = netlbl_af6list_add(&map->list, &addrmap->list6);
                 if (ret_val != 0) {
@@ -231,8 +231,8 @@ static int netlbl_mgmt_add_common(struct genl_info *info,
                         goto add_failure;
                 }
 
-                entry->type = NETLBL_NLTYPE_ADDRSELECT;
-                entry->type_def.addrsel = addrmap;
+                entry->def.type = NETLBL_NLTYPE_ADDRSELECT;
+                entry->def.addrsel = addrmap;
 #endif /* IPv6 */
         }
 
@@ -281,14 +281,13 @@ static int netlbl_mgmt_listentry(struct sk_buff *skb,
                         return ret_val;
         }
 
-        switch (entry->type) {
+        switch (entry->def.type) {
         case NETLBL_NLTYPE_ADDRSELECT:
                 nla_a = nla_nest_start(skb, NLBL_MGMT_A_SELECTORLIST);
                 if (nla_a == NULL)
                         return -ENOMEM;
 
-                netlbl_af4list_foreach_rcu(iter4,
-                                           &entry->type_def.addrsel->list4) {
+                netlbl_af4list_foreach_rcu(iter4, &entry->def.addrsel->list4) {
                         struct netlbl_domaddr4_map *map4;
                         struct in_addr addr_struct;
 
@@ -310,13 +309,13 @@ static int netlbl_mgmt_listentry(struct sk_buff *skb,
                                 return ret_val;
                         map4 = netlbl_domhsh_addr4_entry(iter4);
                         ret_val = nla_put_u32(skb, NLBL_MGMT_A_PROTOCOL,
-                                              map4->type);
+                                              map4->def.type);
                         if (ret_val != 0)
                                 return ret_val;
-                        switch (map4->type) {
+                        switch (map4->def.type) {
                         case NETLBL_NLTYPE_CIPSOV4:
                                 ret_val = nla_put_u32(skb, NLBL_MGMT_A_CV4DOI,
-                                                  map4->type_def.cipsov4->doi);
+                                                      map4->def.cipso->doi);
                                 if (ret_val != 0)
                                         return ret_val;
                                 break;
@@ -325,8 +324,7 @@ static int netlbl_mgmt_listentry(struct sk_buff *skb,
                         nla_nest_end(skb, nla_b);
                 }
 #if IS_ENABLED(CONFIG_IPV6)
-                netlbl_af6list_foreach_rcu(iter6,
-                                           &entry->type_def.addrsel->list6) {
+                netlbl_af6list_foreach_rcu(iter6, &entry->def.addrsel->list6) {
                         struct netlbl_domaddr6_map *map6;
 
                         nla_b = nla_nest_start(skb, NLBL_MGMT_A_ADDRSELECTOR);
@@ -345,7 +343,7 @@ static int netlbl_mgmt_listentry(struct sk_buff *skb,
                                 return ret_val;
                         map6 = netlbl_domhsh_addr6_entry(iter6);
                         ret_val = nla_put_u32(skb, NLBL_MGMT_A_PROTOCOL,
-                                              map6->type);
+                                              map6->def.type);
                         if (ret_val != 0)
                                 return ret_val;
 
@@ -356,14 +354,14 @@ static int netlbl_mgmt_listentry(struct sk_buff *skb,
                 nla_nest_end(skb, nla_a);
                 break;
         case NETLBL_NLTYPE_UNLABELED:
-                ret_val = nla_put_u32(skb, NLBL_MGMT_A_PROTOCOL, entry->type);
+                ret_val = nla_put_u32(skb,NLBL_MGMT_A_PROTOCOL,entry->def.type);
                 break;
         case NETLBL_NLTYPE_CIPSOV4:
-                ret_val = nla_put_u32(skb, NLBL_MGMT_A_PROTOCOL, entry->type);
+                ret_val = nla_put_u32(skb,NLBL_MGMT_A_PROTOCOL,entry->def.type);
                 if (ret_val != 0)
                         return ret_val;
                 ret_val = nla_put_u32(skb, NLBL_MGMT_A_CV4DOI,
-                                      entry->type_def.cipsov4->doi);
+                                      entry->def.cipso->doi);
                 break;
         }
 
diff --git a/net/netlabel/netlabel_unlabeled.c b/net/netlabel/netlabel_unlabeled.c
index 8a6c6ea466d8..8f0897407a2c 100644
--- a/net/netlabel/netlabel_unlabeled.c
+++ b/net/netlabel/netlabel_unlabeled.c
@@ -708,7 +708,7 @@ unlhsh_remove_return:
  * netlbl_unlhsh_netdev_handler - Network device notification handler
  * @this: notifier block
  * @event: the event
- * @ptr: the network device (cast to void)
+ * @ptr: the netdevice notifier info (cast to void)
  *
  * Description:
  * Handle network device events, although at present all we care about is a
@@ -717,10 +717,9 @@ unlhsh_remove_return:
  *
  */
 static int netlbl_unlhsh_netdev_handler(struct notifier_block *this,
-                                        unsigned long event,
-                                        void *ptr)
+                                        unsigned long event, void *ptr)
 {
-        struct net_device *dev = ptr;
+        struct net_device *dev = netdev_notifier_info_to_dev(ptr);
         struct netlbl_unlhsh_iface *iface = NULL;
 
         if (!net_eq(dev_net(dev), &init_net))
@@ -1542,7 +1541,7 @@ int __init netlbl_unlabel_defconf(void)
         entry = kzalloc(sizeof(*entry), GFP_KERNEL);
         if (entry == NULL)
                 return -ENOMEM;
-        entry->type = NETLBL_NLTYPE_UNLABELED;
+        entry->def.type = NETLBL_NLTYPE_UNLABELED;
         ret_val = netlbl_domhsh_add_default(entry, &audit_info);
         if (ret_val != 0)
                 return ret_val;
diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c
index d0b3dd60d386..8df7f64c6db3 100644
--- a/net/netlink/af_netlink.c
+++ b/net/netlink/af_netlink.c
@@ -57,6 +57,7 @@
 #include <linux/audit.h>
 #include <linux/mutex.h>
 #include <linux/vmalloc.h>
+#include <linux/if_arp.h>
 #include <asm/cacheflush.h>
 
 #include <net/net_namespace.h>
@@ -101,6 +102,9 @@ static atomic_t nl_table_users = ATOMIC_INIT(0);
 
 static ATOMIC_NOTIFIER_HEAD(netlink_chain);
 
+static DEFINE_SPINLOCK(netlink_tap_lock);
+static struct list_head netlink_tap_all __read_mostly;
+
 static inline u32 netlink_group_mask(u32 group)
 {
         return group ? 1 << (group - 1) : 0;
@@ -111,6 +115,130 @@ static inline struct hlist_head *nl_portid_hashfn(struct nl_portid_hash *hash, u
         return &hash->table[jhash_1word(portid, hash->rnd) & hash->mask];
 }
 
+int netlink_add_tap(struct netlink_tap *nt)
+{
+        if (unlikely(nt->dev->type != ARPHRD_NETLINK))
+                return -EINVAL;
+
+        spin_lock(&netlink_tap_lock);
+        list_add_rcu(&nt->list, &netlink_tap_all);
+        spin_unlock(&netlink_tap_lock);
+
+        if (nt->module)
+                __module_get(nt->module);
+
+        return 0;
+}
+EXPORT_SYMBOL_GPL(netlink_add_tap);
+
+int __netlink_remove_tap(struct netlink_tap *nt)
+{
+        bool found = false;
+        struct netlink_tap *tmp;
+
+        spin_lock(&netlink_tap_lock);
+
+        list_for_each_entry(tmp, &netlink_tap_all, list) {
+                if (nt == tmp) {
+                        list_del_rcu(&nt->list);
+                        found = true;
+                        goto out;
+                }
+        }
+
+        pr_warn("__netlink_remove_tap: %p not found\n", nt);
+out:
+        spin_unlock(&netlink_tap_lock);
+
+        if (found && nt->module)
+                module_put(nt->module);
+
+        return found ? 0 : -ENODEV;
+}
+EXPORT_SYMBOL_GPL(__netlink_remove_tap);
+
+int netlink_remove_tap(struct netlink_tap *nt)
+{
+        int ret;
+
+        ret = __netlink_remove_tap(nt);
+        synchronize_net();
+
+        return ret;
+}
+EXPORT_SYMBOL_GPL(netlink_remove_tap);
+
+static bool netlink_filter_tap(const struct sk_buff *skb)
+{
+        struct sock *sk = skb->sk;
+        bool pass = false;
+
+        /* We take the more conservative approach and
+         * whitelist socket protocols that may pass.
+         */
+        switch (sk->sk_protocol) {
+        case NETLINK_ROUTE:
+        case NETLINK_USERSOCK:
+        case NETLINK_SOCK_DIAG:
+        case NETLINK_NFLOG:
+        case NETLINK_XFRM:
+        case NETLINK_FIB_LOOKUP:
+        case NETLINK_NETFILTER:
+        case NETLINK_GENERIC:
+                pass = true;
+                break;
+        }
+
+        return pass;
+}
+
+static int __netlink_deliver_tap_skb(struct sk_buff *skb,
+                                     struct net_device *dev)
+{
+        struct sk_buff *nskb;
+        struct sock *sk = skb->sk;
+        int ret = -ENOMEM;
+
+        dev_hold(dev);
+        nskb = skb_clone(skb, GFP_ATOMIC);
+        if (nskb) {
+                nskb->dev = dev;
+                nskb->protocol = htons((u16) sk->sk_protocol);
+
+                ret = dev_queue_xmit(nskb);
+                if (unlikely(ret > 0))
+                        ret = net_xmit_errno(ret);
+        }
+
+        dev_put(dev);
+        return ret;
+}
+
+static void __netlink_deliver_tap(struct sk_buff *skb)
+{
+        int ret;
+        struct netlink_tap *tmp;
+
+        if (!netlink_filter_tap(skb))
+                return;
+
+        list_for_each_entry_rcu(tmp, &netlink_tap_all, list) {
+                ret = __netlink_deliver_tap_skb(skb, tmp->dev);
+                if (unlikely(ret))
+                        break;
+        }
+}
+
+static void netlink_deliver_tap(struct sk_buff *skb)
+{
+        rcu_read_lock();
+
+        if (unlikely(!list_empty(&netlink_tap_all)))
+                __netlink_deliver_tap(skb);
+
+        rcu_read_unlock();
+}
+
 static void netlink_overrun(struct sock *sk)
 {
         struct netlink_sock *nlk = nlk_sk(sk);
@@ -196,14 +324,14 @@ static void **alloc_pg_vec(struct netlink_sock *nlk,
 {
         unsigned int block_nr = req->nm_block_nr;
         unsigned int i;
-        void **pg_vec, *ptr;
+        void **pg_vec;
 
         pg_vec = kcalloc(block_nr, sizeof(void *), GFP_KERNEL);
         if (pg_vec == NULL)
                 return NULL;
 
         for (i = 0; i < block_nr; i++) {
-                pg_vec[i] = ptr = alloc_one_pg_vec_page(order);
+                pg_vec[i] = alloc_one_pg_vec_page(order);
                 if (pg_vec[i] == NULL)
                         goto err1;
         }
@@ -371,7 +499,7 @@ static int netlink_mmap(struct file *file, struct socket *sock,
         err = 0;
 out:
         mutex_unlock(&nlk->pg_vec_lock);
-        return 0;
+        return err;
 }
 
 static void netlink_frame_flush_dcache(const struct nl_mmap_hdr *hdr)
@@ -497,7 +625,7 @@ static unsigned int netlink_poll(struct file *file, struct socket *sock,
                  * for dumps is performed here. A dump is allowed to continue
                  * if at least half the ring is unused.
                  */
-                while (nlk->cb != NULL && netlink_dump_space(nlk)) {
+                while (nlk->cb_running && netlink_dump_space(nlk)) {
                         err = netlink_dump(sk);
                         if (err < 0) {
                                 sk->sk_err = err;
@@ -704,18 +832,6 @@ static void netlink_ring_set_copied(struct sock *sk, struct sk_buff *skb)
 #define netlink_mmap_sendmsg(sk, msg, dst_portid, dst_group, siocb)     0
 #endif /* CONFIG_NETLINK_MMAP */
 
-static void netlink_destroy_callback(struct netlink_callback *cb)
-{
-        kfree_skb(cb->skb);
-        kfree(cb);
-}
-
-static void netlink_consume_callback(struct netlink_callback *cb)
-{
-        consume_skb(cb->skb);
-        kfree(cb);
-}
-
 static void netlink_skb_destructor(struct sk_buff *skb)
 {
 #ifdef CONFIG_NETLINK_MMAP
@@ -750,6 +866,13 @@ static void netlink_skb_destructor(struct sk_buff *skb)
                 skb->head = NULL;
         }
 #endif
+        if (is_vmalloc_addr(skb->head)) {
+                if (!skb->cloned ||
+                    !atomic_dec_return(&(skb_shinfo(skb)->dataref)))
+                        vfree(skb->head);
+
+                skb->head = NULL;
+        }
         if (skb->sk != NULL)
                 sock_rfree(skb);
 }
@@ -767,12 +890,12 @@ static void netlink_sock_destruct(struct sock *sk)
 {
         struct netlink_sock *nlk = nlk_sk(sk);
 
-        if (nlk->cb) {
-                if (nlk->cb->done)
-                        nlk->cb->done(nlk->cb);
+        if (nlk->cb_running) {
+                if (nlk->cb.done)
+                        nlk->cb.done(&nlk->cb);
 
-                module_put(nlk->cb->module);
-                netlink_destroy_callback(nlk->cb);
+                module_put(nlk->cb.module);
+                kfree_skb(nlk->cb.skb);
         }
 
         skb_queue_purge(&sk->sk_receive_queue);
@@ -854,16 +977,23 @@ netlink_unlock_table(void)
                 wake_up(&nl_table_wait);
 }
 
+static bool netlink_compare(struct net *net, struct sock *sk)
+{
+        return net_eq(sock_net(sk), net);
+}
+
 static struct sock *netlink_lookup(struct net *net, int protocol, u32 portid)
 {
-        struct nl_portid_hash *hash = &nl_table[protocol].hash;
+        struct netlink_table *table = &nl_table[protocol];
+        struct nl_portid_hash *hash = &table->hash;
         struct hlist_head *head;
         struct sock *sk;
 
         read_lock(&nl_table_lock);
         head = nl_portid_hashfn(hash, portid);
         sk_for_each(sk, head) {
-                if (net_eq(sock_net(sk), net) && (nlk_sk(sk)->portid == portid)) {
+                if (table->compare(net, sk) &&
+                    (nlk_sk(sk)->portid == portid)) {
                         sock_hold(sk);
                         goto found;
                 }
@@ -976,7 +1106,8 @@ netlink_update_listeners(struct sock *sk)
 
 static int netlink_insert(struct sock *sk, struct net *net, u32 portid)
 {
-        struct nl_portid_hash *hash = &nl_table[sk->sk_protocol].hash;
+        struct netlink_table *table = &nl_table[sk->sk_protocol];
+        struct nl_portid_hash *hash = &table->hash;
         struct hlist_head *head;
         int err = -EADDRINUSE;
         struct sock *osk;
@@ -986,7 +1117,8 @@ static int netlink_insert(struct sock *sk, struct net *net, u32 portid)
         head = nl_portid_hashfn(hash, portid);
         len = 0;
         sk_for_each(osk, head) {
-                if (net_eq(sock_net(osk), net) && (nlk_sk(osk)->portid == portid))
+                if (table->compare(net, osk) &&
+                    (nlk_sk(osk)->portid == portid))
                         break;
                 len++;
         }
@@ -1183,7 +1315,8 @@ static int netlink_autobind(struct socket *sock)
 {
         struct sock *sk = sock->sk;
         struct net *net = sock_net(sk);
-        struct nl_portid_hash *hash = &nl_table[sk->sk_protocol].hash;
+        struct netlink_table *table = &nl_table[sk->sk_protocol];
+        struct nl_portid_hash *hash = &table->hash;
         struct hlist_head *head;
         struct sock *osk;
         s32 portid = task_tgid_vnr(current);
@@ -1195,7 +1328,7 @@ retry:
         netlink_table_grab();
         head = nl_portid_hashfn(hash, portid);
         sk_for_each(osk, head) {
-                if (!net_eq(sock_net(osk), net))
+                if (!table->compare(net, osk))
                         continue;
                 if (nlk_sk(osk)->portid == portid) {
                         /* Bind collision, search negative portid values. */
@@ -1420,6 +1553,33 @@ struct sock *netlink_getsockbyfilp(struct file *filp)
         return sock;
 }
 
+static struct sk_buff *netlink_alloc_large_skb(unsigned int size,
+                                               int broadcast)
+{
+        struct sk_buff *skb;
+        void *data;
+
+        if (size <= NLMSG_GOODSIZE || broadcast)
+                return alloc_skb(size, GFP_KERNEL);
+
+        size = SKB_DATA_ALIGN(size) +
+               SKB_DATA_ALIGN(sizeof(struct skb_shared_info));
+
+        data = vmalloc(size);
+        if (data == NULL)
+                return NULL;
+
+        skb = build_skb(data, size);
+        if (skb == NULL)
+                vfree(data);
+        else {
+                skb->head_frag = 0;
+                skb->destructor = netlink_skb_destructor;
+        }
+
+        return skb;
+}
+
 /*
  * Attach a skb to a netlink socket.
  * The caller must hold a reference to the destination socket. On error, the
@@ -1475,6 +1635,8 @@ static int __netlink_sendskb(struct sock *sk, struct sk_buff *skb)
 {
         int len = skb->len;
 
+        netlink_deliver_tap(skb);
+
 #ifdef CONFIG_NETLINK_MMAP
         if (netlink_skb_is_mmaped(skb))
                 netlink_queue_mmaped_skb(sk, skb);
@@ -1510,7 +1672,7 @@ static struct sk_buff *netlink_trim(struct sk_buff *skb, gfp_t allocation)
                 return skb;
 
         delta = skb->end - skb->tail;
-        if (delta * 2 < skb->truesize)
+        if (is_vmalloc_addr(skb->head) || delta * 2 < skb->truesize)
                 return skb;
 
         if (skb_shared(skb)) {
@@ -1535,6 +1697,11 @@ static int netlink_unicast_kernel(struct sock *sk, struct sk_buff *skb,
 
         ret = -ECONNREFUSED;
         if (nlk->netlink_rcv != NULL) {
+                /* We could do a netlink_deliver_tap(skb) here as well
+                 * but since this is intended for the kernel only, we
+                 * should rather let it stay under the hood.
+                 */
+
                 ret = skb->len;
                 netlink_skb_set_owner_r(skb, sk);
                 NETLINK_CB(skb).sk = ssk;
@@ -2096,7 +2263,7 @@ static int netlink_sendmsg(struct kiocb *kiocb, struct socket *sock,
         if (len > sk->sk_sndbuf - 32)
                 goto out;
         err = -ENOBUFS;
-        skb = alloc_skb(len, GFP_KERNEL);
+        skb = netlink_alloc_large_skb(len, dst_group);
         if (skb == NULL)
                 goto out;
 
@@ -2201,7 +2368,8 @@ static int netlink_recvmsg(struct kiocb *kiocb, struct socket *sock,
 
         skb_free_datagram(sk, skb);
 
-        if (nlk->cb && atomic_read(&sk->sk_rmem_alloc) <= sk->sk_rcvbuf / 2) {
+        if (nlk->cb_running &&
+            atomic_read(&sk->sk_rmem_alloc) <= sk->sk_rcvbuf / 2) {
                 ret = netlink_dump(sk);
                 if (ret) {
                         sk->sk_err = ret;
@@ -2285,6 +2453,8 @@ __netlink_kernel_create(struct net *net, int unit, struct module *module,
                 if (cfg) {
                         nl_table[unit].bind = cfg->bind;
                         nl_table[unit].flags = cfg->flags;
+                        if (cfg->compare)
+                                nl_table[unit].compare = cfg->compare;
                 }
                 nl_table[unit].registered = 1;
         } else {
@@ -2415,13 +2585,12 @@ static int netlink_dump(struct sock *sk)
         int alloc_size;
 
         mutex_lock(nlk->cb_mutex);
-
-        cb = nlk->cb;
-        if (cb == NULL) {
+        if (!nlk->cb_running) {
                 err = -EINVAL;
                 goto errout_skb;
         }
 
+        cb = &nlk->cb;
         alloc_size = max_t(int, cb->min_dump_alloc, NLMSG_GOODSIZE);
 
         if (!netlink_rx_is_mmaped(sk) &&
@@ -2459,11 +2628,11 @@ static int netlink_dump(struct sock *sk)
 
         if (cb->done)
                 cb->done(cb);
-        nlk->cb = NULL;
-        mutex_unlock(nlk->cb_mutex);
 
+        nlk->cb_running = false;
+        mutex_unlock(nlk->cb_mutex);
         module_put(cb->module);
-        netlink_consume_callback(cb);
+        consume_skb(cb->skb);
         return 0;
 
 errout_skb:
@@ -2481,59 +2650,51 @@ int __netlink_dump_start(struct sock *ssk, struct sk_buff *skb,
         struct netlink_sock *nlk;
         int ret;
 
-        cb = kzalloc(sizeof(*cb), GFP_KERNEL);
-        if (cb == NULL)
-                return -ENOBUFS;
-
         /* Memory mapped dump requests need to be copied to avoid looping
          * on the pending state in netlink_mmap_sendmsg() while the CB hold
          * a reference to the skb.
          */
         if (netlink_skb_is_mmaped(skb)) {
                 skb = skb_copy(skb, GFP_KERNEL);
-                if (skb == NULL) {
-                        kfree(cb);
+                if (skb == NULL)
                         return -ENOBUFS;
-                }
         } else
                 atomic_inc(&skb->users);
 
-        cb->dump = control->dump;
-        cb->done = control->done;
-        cb->nlh = nlh;
-        cb->data = control->data;
-        cb->module = control->module;
-        cb->min_dump_alloc = control->min_dump_alloc;
-        cb->skb = skb;
-
         sk = netlink_lookup(sock_net(ssk), ssk->sk_protocol, NETLINK_CB(skb).portid);
         if (sk == NULL) {
-                netlink_destroy_callback(cb);
-                return -ECONNREFUSED;
+                ret = -ECONNREFUSED;
+                goto error_free;
         }
-        nlk = nlk_sk(sk);
 
+        nlk = nlk_sk(sk);
         mutex_lock(nlk->cb_mutex);
         /* A dump is in progress... */
-        if (nlk->cb) {
-                mutex_unlock(nlk->cb_mutex);
-                netlink_destroy_callback(cb);
+        if (nlk->cb_running) {
                 ret = -EBUSY;
-                goto out;
+                goto error_unlock;
         }
         /* add reference of module which cb->dump belongs to */
-        if (!try_module_get(cb->module)) {
-                mutex_unlock(nlk->cb_mutex);
-                netlink_destroy_callback(cb);
+        if (!try_module_get(control->module)) {
                 ret = -EPROTONOSUPPORT;
-                goto out;
+                goto error_unlock;
         }
 
-        nlk->cb = cb;
+        cb = &nlk->cb;
+        memset(cb, 0, sizeof(*cb));
+        cb->dump = control->dump;
+        cb->done = control->done;
+        cb->nlh = nlh;
+        cb->data = control->data;
+        cb->module = control->module;
+        cb->min_dump_alloc = control->min_dump_alloc;
+        cb->skb = skb;
+
+        nlk->cb_running = true;
+
         mutex_unlock(nlk->cb_mutex);
 
         ret = netlink_dump(sk);
-out:
         sock_put(sk);
 
         if (ret)
@@ -2543,6 +2704,13 @@ out:
          * signal not to send ACK even if it was requested.
          */
         return -EINTR;
+
+error_unlock:
+        sock_put(sk);
+        mutex_unlock(nlk->cb_mutex);
+error_free:
+        kfree_skb(skb);
+        return ret;
 }
 EXPORT_SYMBOL(__netlink_dump_start);
 
@@ -2707,6 +2875,7 @@ static void *netlink_seq_next(struct seq_file *seq, void *v, loff_t *pos)
 {
         struct sock *s;
         struct nl_seq_iter *iter;
+        struct net *net;
         int i, j;
 
         ++*pos;
@@ -2714,11 +2883,12 @@ static void *netlink_seq_next(struct seq_file *seq, void *v, loff_t *pos)
         if (v == SEQ_START_TOKEN)
                 return netlink_seq_socket_idx(seq, 0);
 
+        net = seq_file_net(seq);
         iter = seq->private;
         s = v;
         do {
                 s = sk_next(s);
-        } while (s && sock_net(s) != seq_file_net(seq));
+        } while (s && !nl_table[s->sk_protocol].compare(net, s));
         if (s)
                 return s;
 
@@ -2730,7 +2900,8 @@ static void *netlink_seq_next(struct seq_file *seq, void *v, loff_t *pos)
 
                 for (; j <= hash->mask; j++) {
                         s = sk_head(&hash->table[j]);
-                        while (s && sock_net(s) != seq_file_net(seq))
+
+                        while (s && !nl_table[s->sk_protocol].compare(net, s))
                                 s = sk_next(s);
                         if (s) {
                                 iter->link = i;
@@ -2762,14 +2933,14 @@ static int netlink_seq_show(struct seq_file *seq, void *v)
                 struct sock *s = v;
                 struct netlink_sock *nlk = nlk_sk(s);
 
-                seq_printf(seq, "%pK %-3d %-6u %08x %-8d %-8d %pK %-8d %-8d %-8lu\n",
+                seq_printf(seq, "%pK %-3d %-6u %08x %-8d %-8d %d %-8d %-8d %-8lu\n",
                            s,
                            s->sk_protocol,
                            nlk->portid,
                            nlk->groups ? (u32)nlk->groups[0] : 0,
                            sk_rmem_alloc_get(s),
                            sk_wmem_alloc_get(s),
-                           nlk->cb,
+                           nlk->cb_running,
                            atomic_read(&s->sk_refcnt),
                            atomic_read(&s->sk_drops),
                            sock_i_ino(s)
@@ -2923,8 +3094,12 @@ static int __init netlink_proto_init(void)
                 hash->shift = 0;
                 hash->mask = 0;
                 hash->rehash_time = jiffies;
+
+                nl_table[i].compare = netlink_compare;
         }
 
+        INIT_LIST_HEAD(&netlink_tap_all);
+
         netlink_add_usersock_entry();
 
         sock_register(&netlink_family_ops);
diff --git a/net/netlink/af_netlink.h b/net/netlink/af_netlink.h
index ed8522265f4e..acbd774eeb7c 100644
--- a/net/netlink/af_netlink.h
+++ b/net/netlink/af_netlink.h
@@ -32,7 +32,8 @@ struct netlink_sock {
         unsigned long           *groups;
         unsigned long           state;
         wait_queue_head_t       wait;
-        struct netlink_callback *cb;
+        bool                    cb_running;
+        struct netlink_callback cb;
         struct mutex            *cb_mutex;
         struct mutex            cb_def_mutex;
         void                    (*netlink_rcv)(struct sk_buff *skb);
@@ -73,6 +74,7 @@ struct netlink_table {
         struct mutex            *cb_mutex;
         struct module           *module;
         void                    (*bind)(int group);
+        bool                    (*compare)(struct net *net, struct sock *sock);
         int                     registered;
 };
 
diff --git a/net/netlink/genetlink.c b/net/netlink/genetlink.c
index 2fd6dbea327a..0c741cec4d0d 100644
--- a/net/netlink/genetlink.c
+++ b/net/netlink/genetlink.c
@@ -364,7 +364,7 @@ int genl_unregister_ops(struct genl_family *family, struct genl_ops *ops)
 EXPORT_SYMBOL(genl_unregister_ops);
 
 /**
- * genl_register_family - register a generic netlink family
+ * __genl_register_family - register a generic netlink family
  * @family: generic netlink family
  *
  * Registers the specified family after validating it first. Only one
@@ -374,7 +374,7 @@ EXPORT_SYMBOL(genl_unregister_ops);
  *
  * Return 0 on success or a negative error code.
  */
-int genl_register_family(struct genl_family *family)
+int __genl_register_family(struct genl_family *family)
 {
         int err = -EINVAL;
 
@@ -430,10 +430,10 @@ errout_locked:
 errout:
         return err;
 }
-EXPORT_SYMBOL(genl_register_family);
+EXPORT_SYMBOL(__genl_register_family);
 
 /**
- * genl_register_family_with_ops - register a generic netlink family
+ * __genl_register_family_with_ops - register a generic netlink family
  * @family: generic netlink family
  * @ops: operations to be registered
  * @n_ops: number of elements to register
@@ -457,12 +457,12 @@ EXPORT_SYMBOL(genl_register_family);
  *
  * Return 0 on success or a negative error code.
  */
-int genl_register_family_with_ops(struct genl_family *family,
+int __genl_register_family_with_ops(struct genl_family *family,
         struct genl_ops *ops, size_t n_ops)
 {
         int err, i;
 
-        err = genl_register_family(family);
+        err = __genl_register_family(family);
         if (err)
                 return err;
 
@@ -476,7 +476,7 @@ err_out:
         genl_unregister_family(family);
         return err;
 }
-EXPORT_SYMBOL(genl_register_family_with_ops);
+EXPORT_SYMBOL(__genl_register_family_with_ops);
 
 /**
  * genl_unregister_family - unregister generic netlink family
@@ -544,6 +544,30 @@ void *genlmsg_put(struct sk_buff *skb, u32 portid, u32 seq,
 }
 EXPORT_SYMBOL(genlmsg_put);
 
+static int genl_lock_dumpit(struct sk_buff *skb, struct netlink_callback *cb)
+{
+        struct genl_ops *ops = cb->data;
+        int rc;
+
+        genl_lock();
+        rc = ops->dumpit(skb, cb);
+        genl_unlock();
+        return rc;
+}
+
+static int genl_lock_done(struct netlink_callback *cb)
+{
+        struct genl_ops *ops = cb->data;
+        int rc = 0;
+
+        if (ops->done) {
+                genl_lock();
+                rc = ops->done(cb);
+                genl_unlock();
+        }
+        return rc;
+}
+
 static int genl_family_rcv_msg(struct genl_family *family,
                                struct sk_buff *skb,
                                struct nlmsghdr *nlh)
@@ -571,16 +595,35 @@ static int genl_family_rcv_msg(struct genl_family *family,
             !capable(CAP_NET_ADMIN))
                 return -EPERM;
 
-        if (nlh->nlmsg_flags & NLM_F_DUMP) {
-                struct netlink_dump_control c = {
-                        .dump = ops->dumpit,
-                        .done = ops->done,
-                };
+        if ((nlh->nlmsg_flags & NLM_F_DUMP) == NLM_F_DUMP) {
+                int rc;
 
                 if (ops->dumpit == NULL)
                         return -EOPNOTSUPP;
 
-                return netlink_dump_start(net->genl_sock, skb, nlh, &c);
+                if (!family->parallel_ops) {
+                        struct netlink_dump_control c = {
+                                .module = family->module,
+                                .data = ops,
+                                .dump = genl_lock_dumpit,
+                                .done = genl_lock_done,
+                        };
+
+                        genl_unlock();
+                        rc = __netlink_dump_start(net->genl_sock, skb, nlh, &c);
+                        genl_lock();
+
+                } else {
+                        struct netlink_dump_control c = {
+                                .module = family->module,
+                                .dump = ops->dumpit,
+                                .done = ops->done,
+                        };
+
+                        rc = __netlink_dump_start(net->genl_sock, skb, nlh, &c);
+                }
+
+                return rc;
         }
 
         if (ops->doit == NULL)
@@ -877,8 +920,10 @@ static int ctrl_getfamily(struct sk_buff *skb, struct genl_info *info)
 #ifdef CONFIG_MODULES
                 if (res == NULL) {
                         genl_unlock();
+                        up_read(&cb_lock);
                         request_module("net-pf-%d-proto-%d-family-%s",
                                        PF_NETLINK, NETLINK_GENERIC, name);
+                        down_read(&cb_lock);
                         genl_lock();
                         res = genl_family_find_byname(name);
                 }
diff --git a/net/netrom/af_netrom.c b/net/netrom/af_netrom.c
index ec0c80fde69f..698814bfa7ad 100644
--- a/net/netrom/af_netrom.c
+++ b/net/netrom/af_netrom.c
@@ -117,7 +117,7 @@ static void nr_kill_by_device(struct net_device *dev)
  */
 static int nr_device_event(struct notifier_block *this, unsigned long event, void *ptr)
 {
-        struct net_device *dev = (struct net_device *)ptr;
+        struct net_device *dev = netdev_notifier_info_to_dev(ptr);
 
         if (!net_eq(dev_net(dev), &init_net))
                 return NOTIFY_DONE;
diff --git a/net/netrom/sysctl_net_netrom.c b/net/netrom/sysctl_net_netrom.c
index 42f630b9a698..ba1c368b3f18 100644
--- a/net/netrom/sysctl_net_netrom.c
+++ b/net/netrom/sysctl_net_netrom.c
@@ -34,7 +34,7 @@ static int min_reset[]   = {0}, max_reset[]   = {1};
 
 static struct ctl_table_header *nr_table_header;
 
-static ctl_table nr_table[] = {
+static struct ctl_table nr_table[] = {
         {
                 .procname       = "default_path_quality",
                 .data           = &sysctl_netrom_default_path_quality,
diff --git a/net/nfc/core.c b/net/nfc/core.c
index 40d2527693da..e92923cf3e03 100644
--- a/net/nfc/core.c
+++ b/net/nfc/core.c
@@ -44,6 +44,55 @@ DEFINE_MUTEX(nfc_devlist_mutex);
 /* NFC device ID bitmap */
 static DEFINE_IDA(nfc_index_ida);
 
+int nfc_fw_download(struct nfc_dev *dev, const char *firmware_name)
+{
+        int rc = 0;
+
+        pr_debug("%s do firmware %s\n", dev_name(&dev->dev), firmware_name);
+
+        device_lock(&dev->dev);
+
+        if (!device_is_registered(&dev->dev)) {
+                rc = -ENODEV;
+                goto error;
+        }
+
+        if (dev->dev_up) {
+                rc = -EBUSY;
+                goto error;
+        }
+
+        if (!dev->ops->fw_download) {
+                rc = -EOPNOTSUPP;
+                goto error;
+        }
+
+        dev->fw_download_in_progress = true;
+        rc = dev->ops->fw_download(dev, firmware_name);
+        if (rc)
+                dev->fw_download_in_progress = false;
+
+error:
+        device_unlock(&dev->dev);
+        return rc;
+}
+
+/**
+ * nfc_fw_download_done - inform that a firmware download was completed
+ *
+ * @dev: The nfc device to which firmware was downloaded
+ * @firmware_name: The firmware filename
+ * @result: The positive value of a standard errno value
+ */
+int nfc_fw_download_done(struct nfc_dev *dev, const char *firmware_name,
+                         u32 result)
+{
+        dev->fw_download_in_progress = false;
+
+        return nfc_genl_fw_download_done(dev, firmware_name, result);
+}
+EXPORT_SYMBOL(nfc_fw_download_done);
+
 /**
  * nfc_dev_up - turn on the NFC device
  *
@@ -69,6 +118,11 @@ int nfc_dev_up(struct nfc_dev *dev)
                 goto error;
         }
 
+        if (dev->fw_download_in_progress) {
+                rc = -EBUSY;
+                goto error;
+        }
+
         if (dev->dev_up) {
                 rc = -EALREADY;
                 goto error;
@@ -80,6 +134,13 @@ int nfc_dev_up(struct nfc_dev *dev)
         if (!rc)
                 dev->dev_up = true;
 
+        /* We have to enable the device before discovering SEs */
+        if (dev->ops->discover_se) {
+                rc = dev->ops->discover_se(dev);
+                if (rc)
+                        pr_warn("SE discovery failed\n");
+        }
+
 error:
         device_unlock(&dev->dev);
         return rc;
@@ -475,6 +536,112 @@ error:
         return rc;
 }
 
+static struct nfc_se *find_se(struct nfc_dev *dev, u32 se_idx)
+{
+        struct nfc_se *se, *n;
+
+        list_for_each_entry_safe(se, n, &dev->secure_elements, list)
+                if (se->idx == se_idx)
+                        return se;
+
+        return NULL;
+}
+
+int nfc_enable_se(struct nfc_dev *dev, u32 se_idx)
+{
+
+        struct nfc_se *se;
+        int rc;
+
+        pr_debug("%s se index %d\n", dev_name(&dev->dev), se_idx);
+
+        device_lock(&dev->dev);
+
+        if (!device_is_registered(&dev->dev)) {
+                rc = -ENODEV;
+                goto error;
+        }
+
+        if (!dev->dev_up) {
+                rc = -ENODEV;
+                goto error;
+        }
+
+        if (dev->polling) {
+                rc = -EBUSY;
+                goto error;
+        }
+
+        if (!dev->ops->enable_se || !dev->ops->disable_se) {
+                rc = -EOPNOTSUPP;
+                goto error;
+        }
+
+        se = find_se(dev, se_idx);
+        if (!se) {
+                rc = -EINVAL;
+                goto error;
+        }
+
+        if (se->state == NFC_SE_ENABLED) {
+                rc = -EALREADY;
+                goto error;
+        }
+
+        rc = dev->ops->enable_se(dev, se_idx);
+        if (rc >= 0)
+                se->state = NFC_SE_ENABLED;
+
+error:
+        device_unlock(&dev->dev);
+        return rc;
+}
+
+int nfc_disable_se(struct nfc_dev *dev, u32 se_idx)
+{
+
+        struct nfc_se *se;
+        int rc;
+
+        pr_debug("%s se index %d\n", dev_name(&dev->dev), se_idx);
+
+        device_lock(&dev->dev);
+
+        if (!device_is_registered(&dev->dev)) {
+                rc = -ENODEV;
+                goto error;
+        }
+
+        if (!dev->dev_up) {
+                rc = -ENODEV;
+                goto error;
+        }
+
+        if (!dev->ops->enable_se || !dev->ops->disable_se) {
+                rc = -EOPNOTSUPP;
+                goto error;
+        }
+
+        se = find_se(dev, se_idx);
+        if (!se) {
+                rc = -EINVAL;
+                goto error;
+        }
+
+        if (se->state == NFC_SE_DISABLED) {
+                rc = -EALREADY;
+                goto error;
+        }
+
+        rc = dev->ops->disable_se(dev, se_idx);
+        if (rc >= 0)
+                se->state = NFC_SE_DISABLED;
+
+error:
+        device_unlock(&dev->dev);
+        return rc;
+}
+
 int nfc_set_remote_general_bytes(struct nfc_dev *dev, u8 *gb, u8 gb_len)
 {
         pr_debug("dev_name=%s gb_len=%d\n", dev_name(&dev->dev), gb_len);
@@ -707,14 +874,79 @@ inline void nfc_driver_failure(struct nfc_dev *dev, int err)
 }
 EXPORT_SYMBOL(nfc_driver_failure);
 
+int nfc_add_se(struct nfc_dev *dev, u32 se_idx, u16 type)
+{
+        struct nfc_se *se;
+        int rc;
+
+        pr_debug("%s se index %d\n", dev_name(&dev->dev), se_idx);
+
+        se = find_se(dev, se_idx);
+        if (se)
+                return -EALREADY;
+
+        se = kzalloc(sizeof(struct nfc_se), GFP_KERNEL);
+        if (!se)
+                return -ENOMEM;
+
+        se->idx = se_idx;
+        se->type = type;
+        se->state = NFC_SE_DISABLED;
+        INIT_LIST_HEAD(&se->list);
+
+        list_add(&se->list, &dev->secure_elements);
+
+        rc = nfc_genl_se_added(dev, se_idx, type);
+        if (rc < 0) {
+                list_del(&se->list);
+                kfree(se);
+
+                return rc;
+        }
+
+        return 0;
+}
+EXPORT_SYMBOL(nfc_add_se);
+
+int nfc_remove_se(struct nfc_dev *dev, u32 se_idx)
+{
+        struct nfc_se *se, *n;
+        int rc;
+
+        pr_debug("%s se index %d\n", dev_name(&dev->dev), se_idx);
+
+        list_for_each_entry_safe(se, n, &dev->secure_elements, list)
+                if (se->idx == se_idx) {
+                        rc = nfc_genl_se_removed(dev, se_idx);
+                        if (rc < 0)
+                                return rc;
+
+                        list_del(&se->list);
+                        kfree(se);
+
+                        return 0;
+                }
+
+        return -EINVAL;
+}
+EXPORT_SYMBOL(nfc_remove_se);
+
 static void nfc_release(struct device *d)
 {
         struct nfc_dev *dev = to_nfc_dev(d);
+        struct nfc_se *se, *n;
 
         pr_debug("dev_name=%s\n", dev_name(&dev->dev));
 
         nfc_genl_data_exit(&dev->genl_data);
         kfree(dev->targets);
+
+        list_for_each_entry_safe(se, n, &dev->secure_elements, list) {
+                        nfc_genl_se_removed(dev, se->idx);
+                        list_del(&se->list);
+                        kfree(se);
+        }
+
         kfree(dev);
 }
 
@@ -786,7 +1018,6 @@ struct nfc_dev *nfc_get_device(unsigned int idx)
  */
 struct nfc_dev *nfc_allocate_device(struct nfc_ops *ops,
                                     u32 supported_protocols,
-                                    u32 supported_se,
                                     int tx_headroom, int tx_tailroom)
 {
         struct nfc_dev *dev;
@@ -804,10 +1035,9 @@ struct nfc_dev *nfc_allocate_device(struct nfc_ops *ops,
 
         dev->ops = ops;
         dev->supported_protocols = supported_protocols;
-        dev->supported_se = supported_se;
-        dev->active_se = NFC_SE_NONE;
         dev->tx_headroom = tx_headroom;
         dev->tx_tailroom = tx_tailroom;
+        INIT_LIST_HEAD(&dev->secure_elements);
 
         nfc_genl_data_init(&dev->genl_data);
 
diff --git a/net/nfc/hci/core.c b/net/nfc/hci/core.c
index 91020b210d87..d07ca4c5cf8c 100644
--- a/net/nfc/hci/core.c
+++ b/net/nfc/hci/core.c
@@ -570,21 +570,21 @@ static int hci_dep_link_up(struct nfc_dev *nfc_dev, struct nfc_target *target,
 {
         struct nfc_hci_dev *hdev = nfc_get_drvdata(nfc_dev);
 
-        if (hdev->ops->dep_link_up)
-                return hdev->ops->dep_link_up(hdev, target, comm_mode,
-                                                gb, gb_len);
+        if (!hdev->ops->dep_link_up)
+                return 0;
 
-        return 0;
+        return hdev->ops->dep_link_up(hdev, target, comm_mode,
+                                      gb, gb_len);
 }
 
 static int hci_dep_link_down(struct nfc_dev *nfc_dev)
 {
         struct nfc_hci_dev *hdev = nfc_get_drvdata(nfc_dev);
 
-        if (hdev->ops->dep_link_down)
-                return hdev->ops->dep_link_down(hdev);
+        if (!hdev->ops->dep_link_down)
+                return 0;
 
-        return 0;
+        return hdev->ops->dep_link_down(hdev);
 }
 
 static int hci_activate_target(struct nfc_dev *nfc_dev,
@@ -673,12 +673,12 @@ static int hci_tm_send(struct nfc_dev *nfc_dev, struct sk_buff *skb)
 {
         struct nfc_hci_dev *hdev = nfc_get_drvdata(nfc_dev);
 
-        if (hdev->ops->tm_send)
-                return hdev->ops->tm_send(hdev, skb);
-
-        kfree_skb(skb);
+        if (!hdev->ops->tm_send) {
+                kfree_skb(skb);
+                return -ENOTSUPP;
+        }
 
-        return -ENOTSUPP;
+        return hdev->ops->tm_send(hdev, skb);
 }
 
 static int hci_check_presence(struct nfc_dev *nfc_dev,
@@ -686,8 +686,38 @@ static int hci_check_presence(struct nfc_dev *nfc_dev,
 {
         struct nfc_hci_dev *hdev = nfc_get_drvdata(nfc_dev);
 
-        if (hdev->ops->check_presence)
-                return hdev->ops->check_presence(hdev, target);
+        if (!hdev->ops->check_presence)
+                return 0;
+
+        return hdev->ops->check_presence(hdev, target);
+}
+
+static int hci_discover_se(struct nfc_dev *nfc_dev)
+{
+        struct nfc_hci_dev *hdev = nfc_get_drvdata(nfc_dev);
+
+        if (hdev->ops->discover_se)
+                return hdev->ops->discover_se(hdev);
+
+        return 0;
+}
+
+static int hci_enable_se(struct nfc_dev *nfc_dev, u32 se_idx)
+{
+        struct nfc_hci_dev *hdev = nfc_get_drvdata(nfc_dev);
+
+        if (hdev->ops->enable_se)
+                return hdev->ops->enable_se(hdev, se_idx);
+
+        return 0;
+}
+
+static int hci_disable_se(struct nfc_dev *nfc_dev, u32 se_idx)
+{
+        struct nfc_hci_dev *hdev = nfc_get_drvdata(nfc_dev);
+
+        if (hdev->ops->disable_se)
+                return hdev->ops->disable_se(hdev, se_idx);
 
         return 0;
 }
@@ -779,6 +809,16 @@ static void nfc_hci_recv_from_llc(struct nfc_hci_dev *hdev, struct sk_buff *skb)
         }
 }
 
+static int hci_fw_download(struct nfc_dev *nfc_dev, const char *firmware_name)
+{
+        struct nfc_hci_dev *hdev = nfc_get_drvdata(nfc_dev);
+
+        if (!hdev->ops->fw_download)
+                return -ENOTSUPP;
+
+        return hdev->ops->fw_download(hdev, firmware_name);
+}
+
 static struct nfc_ops hci_nfc_ops = {
         .dev_up = hci_dev_up,
         .dev_down = hci_dev_down,
@@ -791,13 +831,16 @@ static struct nfc_ops hci_nfc_ops = {
         .im_transceive = hci_transceive,
         .tm_send = hci_tm_send,
         .check_presence = hci_check_presence,
+        .fw_download = hci_fw_download,
+        .discover_se = hci_discover_se,
+        .enable_se = hci_enable_se,
+        .disable_se = hci_disable_se,
 };
 
 struct nfc_hci_dev *nfc_hci_allocate_device(struct nfc_hci_ops *ops,
                                             struct nfc_hci_init_data *init_data,
                                             unsigned long quirks,
                                             u32 protocols,
-                                            u32 supported_se,
                                             const char *llc_name,
                                             int tx_headroom,
                                             int tx_tailroom,
@@ -823,7 +866,7 @@ struct nfc_hci_dev *nfc_hci_allocate_device(struct nfc_hci_ops *ops,
                 return NULL;
         }
 
-        hdev->ndev = nfc_allocate_device(&hci_nfc_ops, protocols, supported_se,
+        hdev->ndev = nfc_allocate_device(&hci_nfc_ops, protocols,
                                          tx_headroom + HCI_CMDS_HEADROOM,
                                          tx_tailroom);
         if (!hdev->ndev) {
diff --git a/net/nfc/llcp.h b/net/nfc/llcp.h
index ff8c434f7df8..f4d48b57ea11 100644
--- a/net/nfc/llcp.h
+++ b/net/nfc/llcp.h
@@ -19,6 +19,8 @@
 
 enum llcp_state {
         LLCP_CONNECTED = 1, /* wait_for_packet() wants that */
+        LLCP_CONNECTING,
+        LLCP_DISCONNECTING,
         LLCP_CLOSED,
         LLCP_BOUND,
         LLCP_LISTEN,
@@ -246,7 +248,6 @@ struct nfc_llcp_sdp_tlv *nfc_llcp_build_sdreq_tlv(u8 tid, char *uri,
 void nfc_llcp_free_sdp_tlv(struct nfc_llcp_sdp_tlv *sdp);
 void nfc_llcp_free_sdp_tlv_list(struct hlist_head *sdp_head);
 void nfc_llcp_recv(void *data, struct sk_buff *skb, int err);
-int nfc_llcp_disconnect(struct nfc_llcp_sock *sock);
 int nfc_llcp_send_symm(struct nfc_dev *dev);
 int nfc_llcp_send_connect(struct nfc_llcp_sock *sock);
 int nfc_llcp_send_cc(struct nfc_llcp_sock *sock);
diff --git a/net/nfc/llcp_commands.c b/net/nfc/llcp_commands.c
index c1b23eef83ca..1017894807c0 100644
--- a/net/nfc/llcp_commands.c
+++ b/net/nfc/llcp_commands.c
@@ -339,7 +339,7 @@ static struct sk_buff *llcp_allocate_pdu(struct nfc_llcp_sock *sock,
         return skb;
 }
 
-int nfc_llcp_disconnect(struct nfc_llcp_sock *sock)
+int nfc_llcp_send_disconnect(struct nfc_llcp_sock *sock)
 {
         struct sk_buff *skb;
         struct nfc_dev *dev;
@@ -630,26 +630,6 @@ int nfc_llcp_send_dm(struct nfc_llcp_local *local, u8 ssap, u8 dsap, u8 reason)
         return 0;
 }
 
-int nfc_llcp_send_disconnect(struct nfc_llcp_sock *sock)
-{
-        struct sk_buff *skb;
-        struct nfc_llcp_local *local;
-
-        pr_debug("Send DISC\n");
-
-        local = sock->local;
-        if (local == NULL)
-                return -ENODEV;
-
-        skb = llcp_allocate_pdu(sock, LLCP_PDU_DISC, 0);
-        if (skb == NULL)
-                return -ENOMEM;
-
-        skb_queue_head(&local->tx_queue, skb);
-
-        return 0;
-}
-
 int nfc_llcp_send_i_frame(struct nfc_llcp_sock *sock,
                           struct msghdr *msg, size_t len)
 {
diff --git a/net/nfc/llcp_core.c b/net/nfc/llcp_core.c
index 158bdbf668cc..81cd3416c7d4 100644
--- a/net/nfc/llcp_core.c
+++ b/net/nfc/llcp_core.c
@@ -537,6 +537,7 @@ static int nfc_llcp_build_gb(struct nfc_llcp_local *local)
         u8 *lto_tlv, lto_length;
         u8 *wks_tlv, wks_length;
         u8 *miux_tlv, miux_length;
+        __be16 wks = cpu_to_be16(local->local_wks);
         u8 gb_len = 0;
         int ret = 0;
 
@@ -549,8 +550,7 @@ static int nfc_llcp_build_gb(struct nfc_llcp_local *local)
         gb_len += lto_length;
 
         pr_debug("Local wks 0x%lx\n", local->local_wks);
-        wks_tlv = nfc_llcp_build_tlv(LLCP_TLV_WKS, (u8 *)&local->local_wks, 2,
-                                     &wks_length);
+        wks_tlv = nfc_llcp_build_tlv(LLCP_TLV_WKS, (u8 *)&wks, 2, &wks_length);
         gb_len += wks_length;
 
         miux_tlv = nfc_llcp_build_tlv(LLCP_TLV_MIUX, (u8 *)&local->miux, 0,
@@ -719,6 +719,10 @@ static void nfc_llcp_tx_work(struct work_struct *work)
                 llcp_sock = nfc_llcp_sock(sk);
 
                 if (llcp_sock == NULL && nfc_llcp_ptype(skb) == LLCP_PDU_I) {
+                        kfree_skb(skb);
+                        nfc_llcp_send_symm(local->dev);
+                } else if (llcp_sock && !llcp_sock->remote_ready) {
+                        skb_queue_head(&local->tx_queue, skb);
                         nfc_llcp_send_symm(local->dev);
                 } else {
                         struct sk_buff *copy_skb = NULL;
@@ -730,6 +734,13 @@ static void nfc_llcp_tx_work(struct work_struct *work)
                                        DUMP_PREFIX_OFFSET, 16, 1,
                                        skb->data, skb->len, true);
 
+                        if (ptype == LLCP_PDU_DISC && sk != NULL &&
+                            sk->sk_state == LLCP_DISCONNECTING) {
+                                nfc_llcp_sock_unlink(&local->sockets, sk);
+                                sock_orphan(sk);
+                                sock_put(sk);
+                        }
+
                         if (ptype == LLCP_PDU_I)
                                 copy_skb = skb_copy(skb, GFP_ATOMIC);
 
@@ -1579,6 +1590,7 @@ int nfc_llcp_register_device(struct nfc_dev *ndev)
         local->lto = 150; /* 1500 ms */
         local->rw = LLCP_MAX_RW;
         local->miux = cpu_to_be16(LLCP_MAX_MIUX);
+        local->local_wks = 0x1; /* LLC Link Management */
 
         nfc_llcp_build_gb(local);
 
diff --git a/net/nfc/llcp_sock.c b/net/nfc/llcp_sock.c
index 380253eccb74..d308402b67d8 100644
--- a/net/nfc/llcp_sock.c
+++ b/net/nfc/llcp_sock.c
@@ -571,7 +571,7 @@ static unsigned int llcp_sock_poll(struct file *file, struct socket *sock,
         if (sk->sk_shutdown == SHUTDOWN_MASK)
                 mask |= POLLHUP;
 
-        if (sock_writeable(sk))
+        if (sock_writeable(sk) && sk->sk_state == LLCP_CONNECTED)
                 mask |= POLLOUT | POLLWRNORM | POLLWRBAND;
         else
                 set_bit(SOCK_ASYNC_NOSPACE, &sk->sk_socket->flags);
@@ -603,7 +603,7 @@ static int llcp_sock_release(struct socket *sock)
 
         /* Send a DISC */
         if (sk->sk_state == LLCP_CONNECTED)
-                nfc_llcp_disconnect(llcp_sock);
+                nfc_llcp_send_disconnect(llcp_sock);
 
         if (sk->sk_state == LLCP_LISTEN) {
                 struct nfc_llcp_sock *lsk, *n;
@@ -614,7 +614,7 @@ static int llcp_sock_release(struct socket *sock)
                         accept_sk = &lsk->sk;
                         lock_sock(accept_sk);
 
-                        nfc_llcp_disconnect(lsk);
+                        nfc_llcp_send_disconnect(lsk);
                         nfc_llcp_accept_unlink(accept_sk);
 
                         release_sock(accept_sk);
@@ -626,6 +626,13 @@ static int llcp_sock_release(struct socket *sock)
 
         release_sock(sk);
 
+        /* Keep this sock alive and therefore do not remove it from the sockets
+         * list until the DISC PDU has been actually sent. Otherwise we would
+         * reply with DM PDUs before sending the DISC one.
+         */
+        if (sk->sk_state == LLCP_DISCONNECTING)
+                return err;
+
         if (sock->type == SOCK_RAW)
                 nfc_llcp_sock_unlink(&local->raw_sockets, sk);
         else
@@ -722,14 +729,16 @@ static int llcp_sock_connect(struct socket *sock, struct sockaddr *_addr,
         if (ret)
                 goto sock_unlink;
 
+        sk->sk_state = LLCP_CONNECTING;
+
         ret = sock_wait_state(sk, LLCP_CONNECTED,
                               sock_sndtimeo(sk, flags & O_NONBLOCK));
-        if (ret)
+        if (ret && ret != -EINPROGRESS)
                 goto sock_unlink;
 
         release_sock(sk);
 
-        return 0;
+        return ret;
 
 sock_unlink:
         nfc_llcp_put_ssap(local, llcp_sock->ssap);
diff --git a/net/nfc/nci/Kconfig b/net/nfc/nci/Kconfig
index 6d69b5f0f19b..a4f1e42e3481 100644
--- a/net/nfc/nci/Kconfig
+++ b/net/nfc/nci/Kconfig
@@ -8,3 +8,14 @@ config NFC_NCI
 
           Say Y here to compile NCI support into the kernel or say M to
           compile it as module (nci).
+
+config NFC_NCI_SPI
+        depends on NFC_NCI && SPI
+        select CRC_CCITT
+        bool "NCI over SPI protocol support"
+        default n
+        help
+          NCI (NFC Controller Interface) is a communication protocol between
+          an NFC Controller (NFCC) and a Device Host (DH).
+
+          Say yes if you use an NCI driver that requires SPI link layer.
diff --git a/net/nfc/nci/Makefile b/net/nfc/nci/Makefile
index cdb3a2e44471..7aeedc43187d 100644
--- a/net/nfc/nci/Makefile
+++ b/net/nfc/nci/Makefile
@@ -4,4 +4,6 @@
 
 obj-$(CONFIG_NFC_NCI) += nci.o
 
-nci-objs := core.o data.o lib.o ntf.o rsp.o
\ No newline at end of file
+nci-objs := core.o data.o lib.o ntf.o rsp.o
+
+nci-$(CONFIG_NFC_NCI_SPI) += spi.o
diff --git a/net/nfc/nci/core.c b/net/nfc/nci/core.c
index 48ada0ec749e..b943d46a1644 100644
--- a/net/nfc/nci/core.c
+++ b/net/nfc/nci/core.c
@@ -636,6 +636,21 @@ static int nci_transceive(struct nfc_dev *nfc_dev, struct nfc_target *target,
         return rc;
 }
 
+static int nci_enable_se(struct nfc_dev *nfc_dev, u32 se_idx)
+{
+        return 0;
+}
+
+static int nci_disable_se(struct nfc_dev *nfc_dev, u32 se_idx)
+{
+        return 0;
+}
+
+static int nci_discover_se(struct nfc_dev *nfc_dev)
+{
+        return 0;
+}
+
 static struct nfc_ops nci_nfc_ops = {
         .dev_up = nci_dev_up,
         .dev_down = nci_dev_down,
@@ -646,6 +661,9 @@ static struct nfc_ops nci_nfc_ops = {
         .activate_target = nci_activate_target,
         .deactivate_target = nci_deactivate_target,
         .im_transceive = nci_transceive,
+        .enable_se = nci_enable_se,
+        .disable_se = nci_disable_se,
+        .discover_se = nci_discover_se,
 };
 
 /* ---- Interface to NCI drivers ---- */
@@ -658,7 +676,6 @@ static struct nfc_ops nci_nfc_ops = {
  */
 struct nci_dev *nci_allocate_device(struct nci_ops *ops,
                                     __u32 supported_protocols,
-                                    __u32 supported_se,
                                     int tx_headroom, int tx_tailroom)
 {
         struct nci_dev *ndev;
@@ -681,7 +698,6 @@ struct nci_dev *nci_allocate_device(struct nci_ops *ops,
 
         ndev->nfc_dev = nfc_allocate_device(&nci_nfc_ops,
                                             supported_protocols,
-                                            supported_se,
                                             tx_headroom + NCI_DATA_HDR_SIZE,
                                             tx_tailroom);
         if (!ndev->nfc_dev)
@@ -797,12 +813,11 @@ EXPORT_SYMBOL(nci_unregister_device);
 /**
  * nci_recv_frame - receive frame from NCI drivers
  *
+ * @ndev: The nci device
  * @skb: The sk_buff to receive
  */
-int nci_recv_frame(struct sk_buff *skb)
+int nci_recv_frame(struct nci_dev *ndev, struct sk_buff *skb)
 {
-        struct nci_dev *ndev = (struct nci_dev *) skb->dev;
-
         pr_debug("len %d\n", skb->len);
 
         if (!ndev || (!test_bit(NCI_UP, &ndev->flags) &&
@@ -819,10 +834,8 @@ int nci_recv_frame(struct sk_buff *skb)
 }
 EXPORT_SYMBOL(nci_recv_frame);
 
-static int nci_send_frame(struct sk_buff *skb)
+static int nci_send_frame(struct nci_dev *ndev, struct sk_buff *skb)
 {
-        struct nci_dev *ndev = (struct nci_dev *) skb->dev;
-
         pr_debug("len %d\n", skb->len);
 
         if (!ndev) {
@@ -833,7 +846,7 @@ static int nci_send_frame(struct sk_buff *skb)
         /* Get rid of skb owner, prior to sending to the driver. */
         skb_orphan(skb);
 
-        return ndev->ops->send(skb);
+        return ndev->ops->send(ndev, skb);
 }
 
 /* Send NCI command */
@@ -861,8 +874,6 @@ int nci_send_cmd(struct nci_dev *ndev, __u16 opcode, __u8 plen, void *payload)
         if (plen)
                 memcpy(skb_put(skb, plen), payload, plen);
 
-        skb->dev = (void *) ndev;
-
         skb_queue_tail(&ndev->cmd_q, skb);
         queue_work(ndev->cmd_wq, &ndev->cmd_work);
 
@@ -894,7 +905,7 @@ static void nci_tx_work(struct work_struct *work)
                          nci_conn_id(skb->data),
                          nci_plen(skb->data));
 
-                nci_send_frame(skb);
+                nci_send_frame(ndev, skb);
 
                 mod_timer(&ndev->data_timer,
                           jiffies + msecs_to_jiffies(NCI_DATA_TIMEOUT));
@@ -963,7 +974,7 @@ static void nci_cmd_work(struct work_struct *work)
                          nci_opcode_oid(nci_opcode(skb->data)),
                          nci_plen(skb->data));
 
-                nci_send_frame(skb);
+                nci_send_frame(ndev, skb);
 
                 mod_timer(&ndev->cmd_timer,
                           jiffies + msecs_to_jiffies(NCI_CMD_TIMEOUT));
diff --git a/net/nfc/nci/data.c b/net/nfc/nci/data.c
index 76c48c5324f8..2a9399dd6c68 100644
--- a/net/nfc/nci/data.c
+++ b/net/nfc/nci/data.c
@@ -80,8 +80,6 @@ static inline void nci_push_data_hdr(struct nci_dev *ndev,
 
         nci_mt_set((__u8 *)hdr, NCI_MT_DATA_PKT);
         nci_pbf_set((__u8 *)hdr, pbf);
-
-        skb->dev = (void *) ndev;
 }
 
 static int nci_queue_tx_data_frags(struct nci_dev *ndev,
diff --git a/net/nfc/nci/spi.c b/net/nfc/nci/spi.c
new file mode 100644
index 000000000000..c7cf37ba7298
--- /dev/null
+++ b/net/nfc/nci/spi.c
@@ -0,0 +1,378 @@
+/*
+ * Copyright (C) 2013  Intel Corporation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms and conditions of the GNU General Public License,
+ * version 2, as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin St - Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ */
+
+#define pr_fmt(fmt) "nci_spi: %s: " fmt, __func__
+
+#include <linux/export.h>
+#include <linux/spi/spi.h>
+#include <linux/crc-ccitt.h>
+#include <linux/nfc.h>
+#include <net/nfc/nci_core.h>
+
+#define NCI_SPI_HDR_LEN                 4
+#define NCI_SPI_CRC_LEN                 2
+#define NCI_SPI_ACK_SHIFT               6
+#define NCI_SPI_MSB_PAYLOAD_MASK        0x3F
+
+#define NCI_SPI_SEND_TIMEOUT    (NCI_CMD_TIMEOUT > NCI_DATA_TIMEOUT ? \
+                                        NCI_CMD_TIMEOUT : NCI_DATA_TIMEOUT)
+
+#define NCI_SPI_DIRECT_WRITE    0x01
+#define NCI_SPI_DIRECT_READ     0x02
+
+#define ACKNOWLEDGE_NONE        0
+#define ACKNOWLEDGE_ACK         1
+#define ACKNOWLEDGE_NACK        2
+
+#define CRC_INIT                0xFFFF
+
+static int nci_spi_open(struct nci_dev *nci_dev)
+{
+        struct nci_spi_dev *ndev = nci_get_drvdata(nci_dev);
+
+        return ndev->ops->open(ndev);
+}
+
+static int nci_spi_close(struct nci_dev *nci_dev)
+{
+        struct nci_spi_dev *ndev = nci_get_drvdata(nci_dev);
+
+        return ndev->ops->close(ndev);
+}
+
+static int __nci_spi_send(struct nci_spi_dev *ndev, struct sk_buff *skb)
+{
+        struct spi_message m;
+        struct spi_transfer t;
+
+        t.tx_buf = skb->data;
+        t.len = skb->len;
+        t.cs_change = 0;
+        t.delay_usecs = ndev->xfer_udelay;
+
+        spi_message_init(&m);
+        spi_message_add_tail(&t, &m);
+
+        return spi_sync(ndev->spi, &m);
+}
+
+static int nci_spi_send(struct nci_dev *nci_dev, struct sk_buff *skb)
+{
+        struct nci_spi_dev *ndev = nci_get_drvdata(nci_dev);
+        unsigned int payload_len = skb->len;
+        unsigned char *hdr;
+        int ret;
+        long completion_rc;
+
+        ndev->ops->deassert_int(ndev);
+
+        /* add the NCI SPI header to the start of the buffer */
+        hdr = skb_push(skb, NCI_SPI_HDR_LEN);
+        hdr[0] = NCI_SPI_DIRECT_WRITE;
+        hdr[1] = ndev->acknowledge_mode;
+        hdr[2] = payload_len >> 8;
+        hdr[3] = payload_len & 0xFF;
+
+        if (ndev->acknowledge_mode == NCI_SPI_CRC_ENABLED) {
+                u16 crc;
+
+                crc = crc_ccitt(CRC_INIT, skb->data, skb->len);
+                *skb_put(skb, 1) = crc >> 8;
+                *skb_put(skb, 1) = crc & 0xFF;
+        }
+
+        ret = __nci_spi_send(ndev, skb);
+
+        kfree_skb(skb);
+        ndev->ops->assert_int(ndev);
+
+        if (ret != 0 || ndev->acknowledge_mode == NCI_SPI_CRC_DISABLED)
+                goto done;
+
+        init_completion(&ndev->req_completion);
+        completion_rc =
+                wait_for_completion_interruptible_timeout(&ndev->req_completion,
+                                                          NCI_SPI_SEND_TIMEOUT);
+
+        if (completion_rc <= 0 || ndev->req_result == ACKNOWLEDGE_NACK)
+                ret = -EIO;
+
+done:
+        return ret;
+}
+
+static struct nci_ops nci_spi_ops = {
+        .open = nci_spi_open,
+        .close = nci_spi_close,
+        .send = nci_spi_send,
+};
+
+/* ---- Interface to NCI SPI drivers ---- */
+
+/**
+ * nci_spi_allocate_device - allocate a new nci spi device
+ *
+ * @spi: SPI device
+ * @ops: device operations
+ * @supported_protocols: NFC protocols supported by the device
+ * @supported_se: NFC Secure Elements supported by the device
+ * @acknowledge_mode: Acknowledge mode used by the device
+ * @delay: delay between transactions in us
+ */
+struct nci_spi_dev *nci_spi_allocate_device(struct spi_device *spi,
+                                                struct nci_spi_ops *ops,
+                                                u32 supported_protocols,
+                                                u32 supported_se,
+                                                u8 acknowledge_mode,
+                                                unsigned int delay)
+{
+        struct nci_spi_dev *ndev;
+        int tailroom = 0;
+
+        if (!ops->open || !ops->close || !ops->assert_int || !ops->deassert_int)
+                return NULL;
+
+        if (!supported_protocols)
+                return NULL;
+
+        ndev = devm_kzalloc(&spi->dev, sizeof(struct nci_dev), GFP_KERNEL);
+        if (!ndev)
+                return NULL;
+
+        ndev->ops = ops;
+        ndev->acknowledge_mode = acknowledge_mode;
+        ndev->xfer_udelay = delay;
+
+        if (acknowledge_mode == NCI_SPI_CRC_ENABLED)
+                tailroom += NCI_SPI_CRC_LEN;
+
+        ndev->nci_dev = nci_allocate_device(&nci_spi_ops, supported_protocols,
+                                            NCI_SPI_HDR_LEN, tailroom);
+        if (!ndev->nci_dev)
+                return NULL;
+
+        nci_set_drvdata(ndev->nci_dev, ndev);
+
+        return ndev;
+}
+EXPORT_SYMBOL_GPL(nci_spi_allocate_device);
+
+/**
+ * nci_spi_free_device - deallocate nci spi device
+ *
+ * @ndev: The nci spi device to deallocate
+ */
+void nci_spi_free_device(struct nci_spi_dev *ndev)
+{
+        nci_free_device(ndev->nci_dev);
+}
+EXPORT_SYMBOL_GPL(nci_spi_free_device);
+
+/**
+ * nci_spi_register_device - register a nci spi device in the nfc subsystem
+ *
+ * @pdev: The nci spi device to register
+ */
+int nci_spi_register_device(struct nci_spi_dev *ndev)
+{
+        return nci_register_device(ndev->nci_dev);
+}
+EXPORT_SYMBOL_GPL(nci_spi_register_device);
+
+/**
+ * nci_spi_unregister_device - unregister a nci spi device in the nfc subsystem
+ *
+ * @dev: The nci spi device to unregister
+ */
+void nci_spi_unregister_device(struct nci_spi_dev *ndev)
+{
+        nci_unregister_device(ndev->nci_dev);
+}
+EXPORT_SYMBOL_GPL(nci_spi_unregister_device);
+
+static int send_acknowledge(struct nci_spi_dev *ndev, u8 acknowledge)
+{
+        struct sk_buff *skb;
+        unsigned char *hdr;
+        u16 crc;
+        int ret;
+
+        skb = nci_skb_alloc(ndev->nci_dev, 0, GFP_KERNEL);
+
+        /* add the NCI SPI header to the start of the buffer */
+        hdr = skb_push(skb, NCI_SPI_HDR_LEN);
+        hdr[0] = NCI_SPI_DIRECT_WRITE;
+        hdr[1] = NCI_SPI_CRC_ENABLED;
+        hdr[2] = acknowledge << NCI_SPI_ACK_SHIFT;
+        hdr[3] = 0;
+
+        crc = crc_ccitt(CRC_INIT, skb->data, skb->len);
+        *skb_put(skb, 1) = crc >> 8;
+        *skb_put(skb, 1) = crc & 0xFF;
+
+        ret = __nci_spi_send(ndev, skb);
+
+        kfree_skb(skb);
+
+        return ret;
+}
+
+static struct sk_buff *__nci_spi_recv_frame(struct nci_spi_dev *ndev)
+{
+        struct sk_buff *skb;
+        struct spi_message m;
+        unsigned char req[2], resp_hdr[2];
+        struct spi_transfer tx, rx;
+        unsigned short rx_len = 0;
+        int ret;
+
+        spi_message_init(&m);
+        req[0] = NCI_SPI_DIRECT_READ;
+        req[1] = ndev->acknowledge_mode;
+        tx.tx_buf = req;
+        tx.len = 2;
+        tx.cs_change = 0;
+        spi_message_add_tail(&tx, &m);
+        rx.rx_buf = resp_hdr;
+        rx.len = 2;
+        rx.cs_change = 1;
+        spi_message_add_tail(&rx, &m);
+        ret = spi_sync(ndev->spi, &m);
+
+        if (ret)
+                return NULL;
+
+        if (ndev->acknowledge_mode == NCI_SPI_CRC_ENABLED)
+                rx_len = ((resp_hdr[0] & NCI_SPI_MSB_PAYLOAD_MASK) << 8) +
+                                resp_hdr[1] + NCI_SPI_CRC_LEN;
+        else
+                rx_len = (resp_hdr[0] << 8) | resp_hdr[1];
+
+        skb = nci_skb_alloc(ndev->nci_dev, rx_len, GFP_KERNEL);
+        if (!skb)
+                return NULL;
+
+        spi_message_init(&m);
+        rx.rx_buf = skb_put(skb, rx_len);
+        rx.len = rx_len;
+        rx.cs_change = 0;
+        rx.delay_usecs = ndev->xfer_udelay;
+        spi_message_add_tail(&rx, &m);
+        ret = spi_sync(ndev->spi, &m);
+
+        if (ret)
+                goto receive_error;
+
+        if (ndev->acknowledge_mode == NCI_SPI_CRC_ENABLED) {
+                *skb_push(skb, 1) = resp_hdr[1];
+                *skb_push(skb, 1) = resp_hdr[0];
+        }
+
+        return skb;
+
+receive_error:
+        kfree_skb(skb);
+
+        return NULL;
+}
+
+static int nci_spi_check_crc(struct sk_buff *skb)
+{
+        u16 crc_data = (skb->data[skb->len - 2] << 8) |
+                        skb->data[skb->len - 1];
+        int ret;
+
+        ret = (crc_ccitt(CRC_INIT, skb->data, skb->len - NCI_SPI_CRC_LEN)
+                        == crc_data);
+
+        skb_trim(skb, skb->len - NCI_SPI_CRC_LEN);
+
+        return ret;
+}
+
+static u8 nci_spi_get_ack(struct sk_buff *skb)
+{
+        u8 ret;
+
+        ret = skb->data[0] >> NCI_SPI_ACK_SHIFT;
+
+        /* Remove NFCC part of the header: ACK, NACK and MSB payload len */
+        skb_pull(skb, 2);
+
+        return ret;
+}
+
+/**
+ * nci_spi_recv_frame - receive frame from NCI SPI drivers
+ *
+ * @ndev: The nci spi device
+ * Context: can sleep
+ *
+ * This call may only be used from a context that may sleep.  The sleep
+ * is non-interruptible, and has no timeout.
+ *
+ * It returns zero on success, else a negative error code.
+ */
+int nci_spi_recv_frame(struct nci_spi_dev *ndev)
+{
+        struct sk_buff *skb;
+        int ret = 0;
+
+        ndev->ops->deassert_int(ndev);
+
+        /* Retrieve frame from SPI */
+        skb = __nci_spi_recv_frame(ndev);
+        if (!skb) {
+                ret = -EIO;
+                goto done;
+        }
+
+        if (ndev->acknowledge_mode == NCI_SPI_CRC_ENABLED) {
+                if (!nci_spi_check_crc(skb)) {
+                        send_acknowledge(ndev, ACKNOWLEDGE_NACK);
+                        goto done;
+                }
+
+                /* In case of acknowledged mode: if ACK or NACK received,
+                 * unblock completion of latest frame sent.
+                 */
+                ndev->req_result = nci_spi_get_ack(skb);
+                if (ndev->req_result)
+                        complete(&ndev->req_completion);
+        }
+
+        /* If there is no payload (ACK/NACK only frame),
+         * free the socket buffer
+         */
+        if (skb->len == 0) {
+                kfree_skb(skb);
+                goto done;
+        }
+
+        if (ndev->acknowledge_mode == NCI_SPI_CRC_ENABLED)
+                send_acknowledge(ndev, ACKNOWLEDGE_ACK);
+
+        /* Forward skb to NCI core layer */
+        ret = nci_recv_frame(ndev->nci_dev, skb);
+
+done:
+        ndev->ops->assert_int(ndev);
+
+        return ret;
+}
+EXPORT_SYMBOL_GPL(nci_spi_recv_frame);
diff --git a/net/nfc/netlink.c b/net/nfc/netlink.c
index f0c4d61f37c0..68063b2025da 100644
--- a/net/nfc/netlink.c
+++ b/net/nfc/netlink.c
@@ -56,6 +56,8 @@ static const struct nla_policy nfc_genl_policy[NFC_ATTR_MAX + 1] = {
         [NFC_ATTR_LLC_PARAM_RW] = { .type = NLA_U8 },
         [NFC_ATTR_LLC_PARAM_MIUX] = { .type = NLA_U16 },
         [NFC_ATTR_LLC_SDP] = { .type = NLA_NESTED },
+        [NFC_ATTR_FIRMWARE_NAME] = { .type = NLA_STRING,
+                                     .len = NFC_FIRMWARE_NAME_MAXSIZE },
 };
 
 static const struct nla_policy nfc_sdp_genl_policy[NFC_SDP_ATTR_MAX + 1] = {
@@ -424,6 +426,69 @@ free_msg:
         return rc;
 }
 
+int nfc_genl_se_added(struct nfc_dev *dev, u32 se_idx, u16 type)
+{
+        struct sk_buff *msg;
+        void *hdr;
+
+        msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
+        if (!msg)
+                return -ENOMEM;
+
+        hdr = genlmsg_put(msg, 0, 0, &nfc_genl_family, 0,
+                          NFC_EVENT_SE_ADDED);
+        if (!hdr)
+                goto free_msg;
+
+        if (nla_put_u32(msg, NFC_ATTR_DEVICE_INDEX, dev->idx) ||
+            nla_put_u32(msg, NFC_ATTR_SE_INDEX, se_idx) ||
+            nla_put_u8(msg, NFC_ATTR_SE_TYPE, type))
+                goto nla_put_failure;
+
+        genlmsg_end(msg, hdr);
+
+        genlmsg_multicast(msg, 0, nfc_genl_event_mcgrp.id, GFP_KERNEL);
+
+        return 0;
+
+nla_put_failure:
+        genlmsg_cancel(msg, hdr);
+free_msg:
+        nlmsg_free(msg);
+        return -EMSGSIZE;
+}
+
+int nfc_genl_se_removed(struct nfc_dev *dev, u32 se_idx)
+{
+        struct sk_buff *msg;
+        void *hdr;
+
+        msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
+        if (!msg)
+                return -ENOMEM;
+
+        hdr = genlmsg_put(msg, 0, 0, &nfc_genl_family, 0,
+                          NFC_EVENT_SE_REMOVED);
+        if (!hdr)
+                goto free_msg;
+
+        if (nla_put_u32(msg, NFC_ATTR_DEVICE_INDEX, dev->idx) ||
+            nla_put_u32(msg, NFC_ATTR_SE_INDEX, se_idx))
+                goto nla_put_failure;
+
+        genlmsg_end(msg, hdr);
+
+        genlmsg_multicast(msg, 0, nfc_genl_event_mcgrp.id, GFP_KERNEL);
+
+        return 0;
+
+nla_put_failure:
+        genlmsg_cancel(msg, hdr);
+free_msg:
+        nlmsg_free(msg);
+        return -EMSGSIZE;
+}
+
 static int nfc_genl_send_device(struct sk_buff *msg, struct nfc_dev *dev,
                                 u32 portid, u32 seq,
                                 struct netlink_callback *cb,
@@ -442,7 +507,6 @@ static int nfc_genl_send_device(struct sk_buff *msg, struct nfc_dev *dev,
         if (nla_put_string(msg, NFC_ATTR_DEVICE_NAME, nfc_device_name(dev)) ||
             nla_put_u32(msg, NFC_ATTR_DEVICE_INDEX, dev->idx) ||
             nla_put_u32(msg, NFC_ATTR_PROTOCOLS, dev->supported_protocols) ||
-            nla_put_u32(msg, NFC_ATTR_SE, dev->supported_se) ||
             nla_put_u8(msg, NFC_ATTR_DEVICE_POWERED, dev->dev_up) ||
             nla_put_u8(msg, NFC_ATTR_RF_MODE, dev->rf_mode))
                 goto nla_put_failure;
@@ -1025,6 +1089,195 @@ exit:
         return rc;
 }
 
+static int nfc_genl_fw_download(struct sk_buff *skb, struct genl_info *info)
+{
+        struct nfc_dev *dev;
+        int rc;
+        u32 idx;
+        char firmware_name[NFC_FIRMWARE_NAME_MAXSIZE + 1];
+
+        if (!info->attrs[NFC_ATTR_DEVICE_INDEX])
+                return -EINVAL;
+
+        idx = nla_get_u32(info->attrs[NFC_ATTR_DEVICE_INDEX]);
+
+        dev = nfc_get_device(idx);
+        if (!dev)
+                return -ENODEV;
+
+        nla_strlcpy(firmware_name, info->attrs[NFC_ATTR_FIRMWARE_NAME],
+                    sizeof(firmware_name));
+
+        rc = nfc_fw_download(dev, firmware_name);
+
+        nfc_put_device(dev);
+        return rc;
+}
+
+int nfc_genl_fw_download_done(struct nfc_dev *dev, const char *firmware_name,
+                              u32 result)
+{
+        struct sk_buff *msg;
+        void *hdr;
+
+        msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
+        if (!msg)
+                return -ENOMEM;
+
+        hdr = genlmsg_put(msg, 0, 0, &nfc_genl_family, 0,
+                          NFC_CMD_FW_DOWNLOAD);
+        if (!hdr)
+                goto free_msg;
+
+        if (nla_put_string(msg, NFC_ATTR_FIRMWARE_NAME, firmware_name) ||
+            nla_put_u32(msg, NFC_ATTR_FIRMWARE_DOWNLOAD_STATUS, result) ||
+            nla_put_u32(msg, NFC_ATTR_DEVICE_INDEX, dev->idx))
+                goto nla_put_failure;
+
+        genlmsg_end(msg, hdr);
+
+        genlmsg_multicast(msg, 0, nfc_genl_event_mcgrp.id, GFP_KERNEL);
+
+        return 0;
+
+nla_put_failure:
+        genlmsg_cancel(msg, hdr);
+free_msg:
+        nlmsg_free(msg);
+        return -EMSGSIZE;
+}
+
+static int nfc_genl_enable_se(struct sk_buff *skb, struct genl_info *info)
+{
+        struct nfc_dev *dev;
+        int rc;
+        u32 idx, se_idx;
+
+        if (!info->attrs[NFC_ATTR_DEVICE_INDEX] ||
+            !info->attrs[NFC_ATTR_SE_INDEX])
+                return -EINVAL;
+
+        idx = nla_get_u32(info->attrs[NFC_ATTR_DEVICE_INDEX]);
+        se_idx = nla_get_u32(info->attrs[NFC_ATTR_SE_INDEX]);
+
+        dev = nfc_get_device(idx);
+        if (!dev)
+                return -ENODEV;
+
+        rc = nfc_enable_se(dev, se_idx);
+
+        nfc_put_device(dev);
+        return rc;
+}
+
+static int nfc_genl_disable_se(struct sk_buff *skb, struct genl_info *info)
+{
+        struct nfc_dev *dev;
+        int rc;
+        u32 idx, se_idx;
+
+        if (!info->attrs[NFC_ATTR_DEVICE_INDEX] ||
+            !info->attrs[NFC_ATTR_SE_INDEX])
+                return -EINVAL;
+
+        idx = nla_get_u32(info->attrs[NFC_ATTR_DEVICE_INDEX]);
+        se_idx = nla_get_u32(info->attrs[NFC_ATTR_SE_INDEX]);
+
+        dev = nfc_get_device(idx);
+        if (!dev)
+                return -ENODEV;
+
+        rc = nfc_disable_se(dev, se_idx);
+
+        nfc_put_device(dev);
+        return rc;
+}
+
+static int nfc_genl_send_se(struct sk_buff *msg, struct nfc_dev *dev,
+                                u32 portid, u32 seq,
+                                struct netlink_callback *cb,
+                                int flags)
+{
+        void *hdr;
+        struct nfc_se *se, *n;
+
+        list_for_each_entry_safe(se, n, &dev->secure_elements, list) {
+                hdr = genlmsg_put(msg, portid, seq, &nfc_genl_family, flags,
+                                  NFC_CMD_GET_SE);
+                if (!hdr)
+                        goto nla_put_failure;
+
+                if (cb)
+                        genl_dump_check_consistent(cb, hdr, &nfc_genl_family);
+
+                if (nla_put_u32(msg, NFC_ATTR_DEVICE_INDEX, dev->idx) ||
+                    nla_put_u32(msg, NFC_ATTR_SE_INDEX, se->idx) ||
+                    nla_put_u8(msg, NFC_ATTR_SE_TYPE, se->type))
+                        goto nla_put_failure;
+
+                if (genlmsg_end(msg, hdr) < 0)
+                        goto nla_put_failure;
+        }
+
+        return 0;
+
+nla_put_failure:
+        genlmsg_cancel(msg, hdr);
+        return -EMSGSIZE;
+}
+
+static int nfc_genl_dump_ses(struct sk_buff *skb,
+                                 struct netlink_callback *cb)
+{
+        struct class_dev_iter *iter = (struct class_dev_iter *) cb->args[0];
+        struct nfc_dev *dev = (struct nfc_dev *) cb->args[1];
+        bool first_call = false;
+
+        if (!iter) {
+                first_call = true;
+                iter = kmalloc(sizeof(struct class_dev_iter), GFP_KERNEL);
+                if (!iter)
+                        return -ENOMEM;
+                cb->args[0] = (long) iter;
+        }
+
+        mutex_lock(&nfc_devlist_mutex);
+
+        cb->seq = nfc_devlist_generation;
+
+        if (first_call) {
+                nfc_device_iter_init(iter);
+                dev = nfc_device_iter_next(iter);
+        }
+
+        while (dev) {
+                int rc;
+
+                rc = nfc_genl_send_se(skb, dev, NETLINK_CB(cb->skb).portid,
+                                          cb->nlh->nlmsg_seq, cb, NLM_F_MULTI);
+                if (rc < 0)
+                        break;
+
+                dev = nfc_device_iter_next(iter);
+        }
+
+        mutex_unlock(&nfc_devlist_mutex);
+
+        cb->args[1] = (long) dev;
+
+        return skb->len;
+}
+
+static int nfc_genl_dump_ses_done(struct netlink_callback *cb)
+{
+        struct class_dev_iter *iter = (struct class_dev_iter *) cb->args[0];
+
+        nfc_device_iter_exit(iter);
+        kfree(iter);
+
+        return 0;
+}
+
 static struct genl_ops nfc_genl_ops[] = {
         {
                 .cmd = NFC_CMD_GET_DEVICE,
@@ -1084,6 +1337,27 @@ static struct genl_ops nfc_genl_ops[] = {
                 .doit = nfc_genl_llc_sdreq,
                 .policy = nfc_genl_policy,
         },
+        {
+                .cmd = NFC_CMD_FW_DOWNLOAD,
+                .doit = nfc_genl_fw_download,
+                .policy = nfc_genl_policy,
+        },
+        {
+                .cmd = NFC_CMD_ENABLE_SE,
+                .doit = nfc_genl_enable_se,
+                .policy = nfc_genl_policy,
+        },
+        {
+                .cmd = NFC_CMD_DISABLE_SE,
+                .doit = nfc_genl_disable_se,
+                .policy = nfc_genl_policy,
+        },
+        {
+                .cmd = NFC_CMD_GET_SE,
+                .dumpit = nfc_genl_dump_ses,
+                .done = nfc_genl_dump_ses_done,
+                .policy = nfc_genl_policy,
+        },
 };
 
 
diff --git a/net/nfc/nfc.h b/net/nfc/nfc.h
index afa1f84ba040..aaf606fc1faa 100644
--- a/net/nfc/nfc.h
+++ b/net/nfc/nfc.h
@@ -94,6 +94,9 @@ int nfc_genl_tm_deactivated(struct nfc_dev *dev);
 
 int nfc_genl_llc_send_sdres(struct nfc_dev *dev, struct hlist_head *sdres_list);
 
+int nfc_genl_se_added(struct nfc_dev *dev, u32 se_idx, u16 type);
+int nfc_genl_se_removed(struct nfc_dev *dev, u32 se_idx);
+
 struct nfc_dev *nfc_get_device(unsigned int idx);
 
 static inline void nfc_put_device(struct nfc_dev *dev)
@@ -120,6 +123,10 @@ static inline void nfc_device_iter_exit(struct class_dev_iter *iter)
         class_dev_iter_exit(iter);
 }
 
+int nfc_fw_download(struct nfc_dev *dev, const char *firmware_name);
+int nfc_genl_fw_download_done(struct nfc_dev *dev, const char *firmware_name,
+                              u32 result);
+
 int nfc_dev_up(struct nfc_dev *dev);
 
 int nfc_dev_down(struct nfc_dev *dev);
@@ -139,4 +146,7 @@ int nfc_deactivate_target(struct nfc_dev *dev, u32 target_idx);
 int nfc_data_exchange(struct nfc_dev *dev, u32 target_idx, struct sk_buff *skb,
                       data_exchange_cb_t cb, void *cb_context);
 
+int nfc_enable_se(struct nfc_dev *dev, u32 se_idx);
+int nfc_disable_se(struct nfc_dev *dev, u32 se_idx);
+
 #endif /* __LOCAL_NFC_H */
diff --git a/net/openvswitch/Kconfig b/net/openvswitch/Kconfig
index d9ea33c361be..6ecf491ad509 100644
--- a/net/openvswitch/Kconfig
+++ b/net/openvswitch/Kconfig
@@ -4,6 +4,7 @@
 
 config OPENVSWITCH
         tristate "Open vSwitch"
+        select LIBCRC32C
         ---help---
           Open vSwitch is a multilayer Ethernet switch targeted at virtualized
           environments.  In addition to supporting a variety of features
@@ -26,3 +27,30 @@ config OPENVSWITCH
           called openvswitch.
 
           If unsure, say N.
+
+config OPENVSWITCH_GRE
+        bool "Open vSwitch GRE tunneling support"
+        depends on INET
+        depends on OPENVSWITCH
+        depends on NET_IPGRE_DEMUX && !(OPENVSWITCH=y && NET_IPGRE_DEMUX=m)
+        default y
+        ---help---
+          If you say Y here, then the Open vSwitch will be able create GRE
+          vport.
+
+          Say N to exclude this support and reduce the binary size.
+
+          If unsure, say Y.
+
+config OPENVSWITCH_VXLAN
+        bool "Open vSwitch VXLAN tunneling support"
+        depends on INET
+        depends on OPENVSWITCH
+        depends on VXLAN && !(OPENVSWITCH=y && VXLAN=m)
+        default y
+        ---help---
+          If you say Y here, then the Open vSwitch will be able create vxlan vport.
+
+          Say N to exclude this support and reduce the binary size.
+
+          If unsure, say Y.
diff --git a/net/openvswitch/Makefile b/net/openvswitch/Makefile
index 15e7384745c1..ea36e99089af 100644
--- a/net/openvswitch/Makefile
+++ b/net/openvswitch/Makefile
@@ -11,4 +11,12 @@ openvswitch-y := \
         flow.o \
         vport.o \
         vport-internal_dev.o \
-        vport-netdev.o \
+        vport-netdev.o
+
+ifneq ($(CONFIG_OPENVSWITCH_VXLAN),)
+openvswitch-y += vport-vxlan.o
+endif
+
+ifneq ($(CONFIG_OPENVSWITCH_GRE),)
+openvswitch-y += vport-gre.o
+endif
diff --git a/net/openvswitch/actions.c b/net/openvswitch/actions.c
index 894b6cbdd929..65cfaa816075 100644
--- a/net/openvswitch/actions.c
+++ b/net/openvswitch/actions.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2007-2012 Nicira, Inc.
+ * Copyright (c) 2007-2013 Nicira, Inc.
  *
  * This program is free software; you can redistribute it and/or
  * modify it under the terms of version 2 of the GNU General Public
@@ -22,6 +22,7 @@
 #include <linux/in.h>
 #include <linux/ip.h>
 #include <linux/openvswitch.h>
+#include <linux/sctp.h>
 #include <linux/tcp.h>
 #include <linux/udp.h>
 #include <linux/in6.h>
@@ -31,6 +32,7 @@
 #include <net/ipv6.h>
 #include <net/checksum.h>
 #include <net/dsfield.h>
+#include <net/sctp/checksum.h>
 
 #include "datapath.h"
 #include "vport.h"
@@ -130,9 +132,13 @@ static int set_eth_addr(struct sk_buff *skb,
         if (unlikely(err))
                 return err;
 
+        skb_postpull_rcsum(skb, eth_hdr(skb), ETH_ALEN * 2);
+
         memcpy(eth_hdr(skb)->h_source, eth_key->eth_src, ETH_ALEN);
         memcpy(eth_hdr(skb)->h_dest, eth_key->eth_dst, ETH_ALEN);
 
+        ovs_skb_postpush_rcsum(skb, eth_hdr(skb), ETH_ALEN * 2);
+
         return 0;
 }
 
@@ -348,6 +354,39 @@ static int set_tcp(struct sk_buff *skb, const struct ovs_key_tcp *tcp_port_key)
         return 0;
 }
 
+static int set_sctp(struct sk_buff *skb,
+                     const struct ovs_key_sctp *sctp_port_key)
+{
+        struct sctphdr *sh;
+        int err;
+        unsigned int sctphoff = skb_transport_offset(skb);
+
+        err = make_writable(skb, sctphoff + sizeof(struct sctphdr));
+        if (unlikely(err))
+                return err;
+
+        sh = sctp_hdr(skb);
+        if (sctp_port_key->sctp_src != sh->source ||
+            sctp_port_key->sctp_dst != sh->dest) {
+                __le32 old_correct_csum, new_csum, old_csum;
+
+                old_csum = sh->checksum;
+                old_correct_csum = sctp_compute_cksum(skb, sctphoff);
+
+                sh->source = sctp_port_key->sctp_src;
+                sh->dest = sctp_port_key->sctp_dst;
+
+                new_csum = sctp_compute_cksum(skb, sctphoff);
+
+                /* Carry any checksum errors through. */
+                sh->checksum = old_csum ^ old_correct_csum ^ new_csum;
+
+                skb->rxhash = 0;
+        }
+
+        return 0;
+}
+
 static int do_output(struct datapath *dp, struct sk_buff *skb, int out_port)
 {
         struct vport *vport;
@@ -372,8 +411,10 @@ static int output_userspace(struct datapath *dp, struct sk_buff *skb,
         const struct nlattr *a;
         int rem;
 
+        BUG_ON(!OVS_CB(skb)->pkt_key);
+
         upcall.cmd = OVS_PACKET_CMD_ACTION;
-        upcall.key = &OVS_CB(skb)->flow->key;
+        upcall.key = OVS_CB(skb)->pkt_key;
         upcall.userdata = NULL;
         upcall.portid = 0;
 
@@ -432,6 +473,10 @@ static int execute_set_action(struct sk_buff *skb,
                 skb->mark = nla_get_u32(nested_attr);
                 break;
 
+        case OVS_KEY_ATTR_IPV4_TUNNEL:
+                OVS_CB(skb)->tun_key = nla_data(nested_attr);
+                break;
+
         case OVS_KEY_ATTR_ETHERNET:
                 err = set_eth_addr(skb, nla_data(nested_attr));
                 break;
@@ -451,6 +496,10 @@ static int execute_set_action(struct sk_buff *skb,
         case OVS_KEY_ATTR_UDP:
                 err = set_udp(skb, nla_data(nested_attr));
                 break;
+
+        case OVS_KEY_ATTR_SCTP:
+                err = set_sctp(skb, nla_data(nested_attr));
+                break;
         }
 
         return err;
@@ -527,6 +576,7 @@ int ovs_execute_actions(struct datapath *dp, struct sk_buff *skb)
 {
         struct sw_flow_actions *acts = rcu_dereference(OVS_CB(skb)->flow->sf_acts);
 
+        OVS_CB(skb)->tun_key = NULL;
         return do_execute_actions(dp, skb, acts->actions,
                                          acts->actions_len, false);
 }
diff --git a/net/openvswitch/datapath.c b/net/openvswitch/datapath.c
index d12d6b8b5e8b..2aa13bd7f2b2 100644
--- a/net/openvswitch/datapath.c
+++ b/net/openvswitch/datapath.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2007-2012 Nicira, Inc.
+ * Copyright (c) 2007-2013 Nicira, Inc.
  *
  * This program is free software; you can redistribute it and/or
  * modify it under the terms of version 2 of the GNU General Public
@@ -165,7 +165,7 @@ static void destroy_dp_rcu(struct rcu_head *rcu)
 {
         struct datapath *dp = container_of(rcu, struct datapath, rcu);
 
-        ovs_flow_tbl_destroy((__force struct flow_table *)dp->table);
+        ovs_flow_tbl_destroy((__force struct flow_table *)dp->table, false);
         free_percpu(dp->stats_percpu);
         release_net(ovs_dp_get_net(dp));
         kfree(dp->ports);
@@ -226,19 +226,18 @@ void ovs_dp_process_received_packet(struct vport *p, struct sk_buff *skb)
         struct sw_flow_key key;
         u64 *stats_counter;
         int error;
-        int key_len;
 
         stats = this_cpu_ptr(dp->stats_percpu);
 
         /* Extract flow from 'skb' into 'key'. */
-        error = ovs_flow_extract(skb, p->port_no, &key, &key_len);
+        error = ovs_flow_extract(skb, p->port_no, &key);
         if (unlikely(error)) {
                 kfree_skb(skb);
                 return;
         }
 
         /* Look up flow. */
-        flow = ovs_flow_tbl_lookup(rcu_dereference(dp->table), &key, key_len);
+        flow = ovs_flow_lookup(rcu_dereference(dp->table), &key);
         if (unlikely(!flow)) {
                 struct dp_upcall_info upcall;
 
@@ -253,6 +252,7 @@ void ovs_dp_process_received_packet(struct vport *p, struct sk_buff *skb)
         }
 
         OVS_CB(skb)->flow = flow;
+        OVS_CB(skb)->pkt_key = &key;
 
         stats_counter = &stats->n_hit;
         ovs_flow_used(OVS_CB(skb)->flow, skb);
@@ -362,6 +362,14 @@ static int queue_gso_packets(struct net *net, int dp_ifindex,
 static size_t key_attr_size(void)
 {
         return    nla_total_size(4)   /* OVS_KEY_ATTR_PRIORITY */
+                + nla_total_size(0)   /* OVS_KEY_ATTR_TUNNEL */
+                  + nla_total_size(8)   /* OVS_TUNNEL_KEY_ATTR_ID */
+                  + nla_total_size(4)   /* OVS_TUNNEL_KEY_ATTR_IPV4_SRC */
+                  + nla_total_size(4)   /* OVS_TUNNEL_KEY_ATTR_IPV4_DST */
+                  + nla_total_size(1)   /* OVS_TUNNEL_KEY_ATTR_TOS */
+                  + nla_total_size(1)   /* OVS_TUNNEL_KEY_ATTR_TTL */
+                  + nla_total_size(0)   /* OVS_TUNNEL_KEY_ATTR_DONT_FRAGMENT */
+                  + nla_total_size(0)   /* OVS_TUNNEL_KEY_ATTR_CSUM */
                 + nla_total_size(4)   /* OVS_KEY_ATTR_IN_PORT */
                 + nla_total_size(4)   /* OVS_KEY_ATTR_SKB_MARK */
                 + nla_total_size(12)  /* OVS_KEY_ATTR_ETHERNET */
@@ -427,7 +435,7 @@ static int queue_userspace_packet(struct net *net, int dp_ifindex,
         upcall->dp_ifindex = dp_ifindex;
 
         nla = nla_nest_start(user_skb, OVS_PACKET_ATTR_KEY);
-        ovs_flow_to_nlattrs(upcall_info->key, user_skb);
+        ovs_flow_to_nlattrs(upcall_info->key, upcall_info->key, user_skb);
         nla_nest_end(user_skb, nla);
 
         if (upcall_info->userdata)
@@ -460,20 +468,93 @@ static int flush_flows(struct datapath *dp)
 
         rcu_assign_pointer(dp->table, new_table);
 
-        ovs_flow_tbl_deferred_destroy(old_table);
+        ovs_flow_tbl_destroy(old_table, true);
         return 0;
 }
 
-static int validate_actions(const struct nlattr *attr,
-                                const struct sw_flow_key *key, int depth);
+static struct nlattr *reserve_sfa_size(struct sw_flow_actions **sfa, int attr_len)
+{
+
+        struct sw_flow_actions *acts;
+        int new_acts_size;
+        int req_size = NLA_ALIGN(attr_len);
+        int next_offset = offsetof(struct sw_flow_actions, actions) +
+                                        (*sfa)->actions_len;
+
+        if (req_size <= (ksize(*sfa) - next_offset))
+                goto out;
+
+        new_acts_size = ksize(*sfa) * 2;
+
+        if (new_acts_size > MAX_ACTIONS_BUFSIZE) {
+                if ((MAX_ACTIONS_BUFSIZE - next_offset) < req_size)
+                        return ERR_PTR(-EMSGSIZE);
+                new_acts_size = MAX_ACTIONS_BUFSIZE;
+        }
+
+        acts = ovs_flow_actions_alloc(new_acts_size);
+        if (IS_ERR(acts))
+                return (void *)acts;
+
+        memcpy(acts->actions, (*sfa)->actions, (*sfa)->actions_len);
+        acts->actions_len = (*sfa)->actions_len;
+        kfree(*sfa);
+        *sfa = acts;
+
+out:
+        (*sfa)->actions_len += req_size;
+        return  (struct nlattr *) ((unsigned char *)(*sfa) + next_offset);
+}
+
+static int add_action(struct sw_flow_actions **sfa, int attrtype, void *data, int len)
+{
+        struct nlattr *a;
+
+        a = reserve_sfa_size(sfa, nla_attr_size(len));
+        if (IS_ERR(a))
+                return PTR_ERR(a);
+
+        a->nla_type = attrtype;
+        a->nla_len = nla_attr_size(len);
+
+        if (data)
+                memcpy(nla_data(a), data, len);
+        memset((unsigned char *) a + a->nla_len, 0, nla_padlen(len));
+
+        return 0;
+}
+
+static inline int add_nested_action_start(struct sw_flow_actions **sfa, int attrtype)
+{
+        int used = (*sfa)->actions_len;
+        int err;
+
+        err = add_action(sfa, attrtype, NULL, 0);
+        if (err)
+                return err;
+
+        return used;
+}
 
-static int validate_sample(const struct nlattr *attr,
-                                const struct sw_flow_key *key, int depth)
+static inline void add_nested_action_end(struct sw_flow_actions *sfa, int st_offset)
+{
+        struct nlattr *a = (struct nlattr *) ((unsigned char *)sfa->actions + st_offset);
+
+        a->nla_len = sfa->actions_len - st_offset;
+}
+
+static int validate_and_copy_actions(const struct nlattr *attr,
+                                     const struct sw_flow_key *key, int depth,
+                                     struct sw_flow_actions **sfa);
+
+static int validate_and_copy_sample(const struct nlattr *attr,
+                                    const struct sw_flow_key *key, int depth,
+                                    struct sw_flow_actions **sfa)
 {
         const struct nlattr *attrs[OVS_SAMPLE_ATTR_MAX + 1];
         const struct nlattr *probability, *actions;
         const struct nlattr *a;
-        int rem;
+        int rem, start, err, st_acts;
 
         memset(attrs, 0, sizeof(attrs));
         nla_for_each_nested(a, attr, rem) {
@@ -492,7 +573,26 @@ static int validate_sample(const struct nlattr *attr,
         actions = attrs[OVS_SAMPLE_ATTR_ACTIONS];
         if (!actions || (nla_len(actions) && nla_len(actions) < NLA_HDRLEN))
                 return -EINVAL;
-        return validate_actions(actions, key, depth + 1);
+
+        /* validation done, copy sample action. */
+        start = add_nested_action_start(sfa, OVS_ACTION_ATTR_SAMPLE);
+        if (start < 0)
+                return start;
+        err = add_action(sfa, OVS_SAMPLE_ATTR_PROBABILITY, nla_data(probability), sizeof(u32));
+        if (err)
+                return err;
+        st_acts = add_nested_action_start(sfa, OVS_SAMPLE_ATTR_ACTIONS);
+        if (st_acts < 0)
+                return st_acts;
+
+        err = validate_and_copy_actions(actions, key, depth + 1, sfa);
+        if (err)
+                return err;
+
+        add_nested_action_end(*sfa, st_acts);
+        add_nested_action_end(*sfa, start);
+
+        return 0;
 }
 
 static int validate_tp_port(const struct sw_flow_key *flow_key)
@@ -508,8 +608,33 @@ static int validate_tp_port(const struct sw_flow_key *flow_key)
         return -EINVAL;
 }
 
+static int validate_and_copy_set_tun(const struct nlattr *attr,
+                                     struct sw_flow_actions **sfa)
+{
+        struct sw_flow_match match;
+        struct sw_flow_key key;
+        int err, start;
+
+        ovs_match_init(&match, &key, NULL);
+        err = ovs_ipv4_tun_from_nlattr(nla_data(attr), &match, false);
+        if (err)
+                return err;
+
+        start = add_nested_action_start(sfa, OVS_ACTION_ATTR_SET);
+        if (start < 0)
+                return start;
+
+        err = add_action(sfa, OVS_KEY_ATTR_IPV4_TUNNEL, &match.key->tun_key,
+                        sizeof(match.key->tun_key));
+        add_nested_action_end(*sfa, start);
+
+        return err;
+}
+
 static int validate_set(const struct nlattr *a,
-                        const struct sw_flow_key *flow_key)
+                        const struct sw_flow_key *flow_key,
+                        struct sw_flow_actions **sfa,
+                        bool *set_tun)
 {
         const struct nlattr *ovs_key = nla_data(a);
         int key_type = nla_type(ovs_key);
@@ -519,18 +644,27 @@ static int validate_set(const struct nlattr *a,
                 return -EINVAL;
 
         if (key_type > OVS_KEY_ATTR_MAX ||
-            nla_len(ovs_key) != ovs_key_lens[key_type])
+           (ovs_key_lens[key_type] != nla_len(ovs_key) &&
+            ovs_key_lens[key_type] != -1))
                 return -EINVAL;
 
         switch (key_type) {
         const struct ovs_key_ipv4 *ipv4_key;
         const struct ovs_key_ipv6 *ipv6_key;
+        int err;
 
         case OVS_KEY_ATTR_PRIORITY:
         case OVS_KEY_ATTR_SKB_MARK:
         case OVS_KEY_ATTR_ETHERNET:
                 break;
 
+        case OVS_KEY_ATTR_TUNNEL:
+                *set_tun = true;
+                err = validate_and_copy_set_tun(a, sfa);
+                if (err)
+                        return err;
+                break;
+
         case OVS_KEY_ATTR_IPV4:
                 if (flow_key->eth.type != htons(ETH_P_IP))
                         return -EINVAL;
@@ -578,6 +712,12 @@ static int validate_set(const struct nlattr *a,
 
                 return validate_tp_port(flow_key);
 
+        case OVS_KEY_ATTR_SCTP:
+                if (flow_key->ip.proto != IPPROTO_SCTP)
+                        return -EINVAL;
+
+                return validate_tp_port(flow_key);
+
         default:
                 return -EINVAL;
         }
@@ -606,8 +746,24 @@ static int validate_userspace(const struct nlattr *attr)
         return 0;
 }
 
-static int validate_actions(const struct nlattr *attr,
-                                const struct sw_flow_key *key,  int depth)
+static int copy_action(const struct nlattr *from,
+                       struct sw_flow_actions **sfa)
+{
+        int totlen = NLA_ALIGN(from->nla_len);
+        struct nlattr *to;
+
+        to = reserve_sfa_size(sfa, from->nla_len);
+        if (IS_ERR(to))
+                return PTR_ERR(to);
+
+        memcpy(to, from, totlen);
+        return 0;
+}
+
+static int validate_and_copy_actions(const struct nlattr *attr,
+                                     const struct sw_flow_key *key,
+                                     int depth,
+                                     struct sw_flow_actions **sfa)
 {
         const struct nlattr *a;
         int rem, err;
@@ -627,12 +783,14 @@ static int validate_actions(const struct nlattr *attr,
                 };
                 const struct ovs_action_push_vlan *vlan;
                 int type = nla_type(a);
+                bool skip_copy;
 
                 if (type > OVS_ACTION_ATTR_MAX ||
                     (action_lens[type] != nla_len(a) &&
                      action_lens[type] != (u32)-1))
                         return -EINVAL;
 
+                skip_copy = false;
                 switch (type) {
                 case OVS_ACTION_ATTR_UNSPEC:
                         return -EINVAL;
@@ -661,20 +819,26 @@ static int validate_actions(const struct nlattr *attr,
                         break;
 
                 case OVS_ACTION_ATTR_SET:
-                        err = validate_set(a, key);
+                        err = validate_set(a, key, sfa, &skip_copy);
                         if (err)
                                 return err;
                         break;
 
                 case OVS_ACTION_ATTR_SAMPLE:
-                        err = validate_sample(a, key, depth);
+                        err = validate_and_copy_sample(a, key, depth, sfa);
                         if (err)
                                 return err;
+                        skip_copy = true;
                         break;
 
                 default:
                         return -EINVAL;
                 }
+                if (!skip_copy) {
+                        err = copy_action(a, sfa);
+                        if (err)
+                                return err;
+                }
         }
 
         if (rem > 0)
@@ -702,7 +866,6 @@ static int ovs_packet_cmd_execute(struct sk_buff *skb, struct genl_info *info)
         struct ethhdr *eth;
         int len;
         int err;
-        int key_len;
 
         err = -EINVAL;
         if (!a[OVS_PACKET_ATTR_PACKET] || !a[OVS_PACKET_ATTR_KEY] ||
@@ -735,30 +898,25 @@ static int ovs_packet_cmd_execute(struct sk_buff *skb, struct genl_info *info)
         if (IS_ERR(flow))
                 goto err_kfree_skb;
 
-        err = ovs_flow_extract(packet, -1, &flow->key, &key_len);
+        err = ovs_flow_extract(packet, -1, &flow->key);
         if (err)
                 goto err_flow_free;
 
-        err = ovs_flow_metadata_from_nlattrs(&flow->key.phy.priority,
-                                             &flow->key.phy.skb_mark,
-                                             &flow->key.phy.in_port,
-                                             a[OVS_PACKET_ATTR_KEY]);
+        err = ovs_flow_metadata_from_nlattrs(flow, a[OVS_PACKET_ATTR_KEY]);
         if (err)
                 goto err_flow_free;
-
-        err = validate_actions(a[OVS_PACKET_ATTR_ACTIONS], &flow->key, 0);
-        if (err)
-                goto err_flow_free;
-
-        flow->hash = ovs_flow_hash(&flow->key, key_len);
-
-        acts = ovs_flow_actions_alloc(a[OVS_PACKET_ATTR_ACTIONS]);
+        acts = ovs_flow_actions_alloc(nla_len(a[OVS_PACKET_ATTR_ACTIONS]));
         err = PTR_ERR(acts);
         if (IS_ERR(acts))
                 goto err_flow_free;
+
+        err = validate_and_copy_actions(a[OVS_PACKET_ATTR_ACTIONS], &flow->key, 0, &acts);
         rcu_assign_pointer(flow->sf_acts, acts);
+        if (err)
+                goto err_flow_free;
 
         OVS_CB(packet)->flow = flow;
+        OVS_CB(packet)->pkt_key = &flow->key;
         packet->priority = flow->key.phy.priority;
         packet->mark = flow->key.phy.skb_mark;
 
@@ -773,13 +931,13 @@ static int ovs_packet_cmd_execute(struct sk_buff *skb, struct genl_info *info)
         local_bh_enable();
         rcu_read_unlock();
 
-        ovs_flow_free(flow);
+        ovs_flow_free(flow, false);
         return err;
 
 err_unlock:
         rcu_read_unlock();
 err_flow_free:
-        ovs_flow_free(flow);
+        ovs_flow_free(flow, false);
 err_kfree_skb:
         kfree_skb(packet);
 err:
@@ -802,9 +960,10 @@ static struct genl_ops dp_packet_genl_ops[] = {
 
 static void get_dp_stats(struct datapath *dp, struct ovs_dp_stats *stats)
 {
+        struct flow_table *table;
         int i;
-        struct flow_table *table = ovsl_dereference(dp->table);
 
+        table = rcu_dereference_check(dp->table, lockdep_ovsl_is_held());
         stats->n_flows = ovs_flow_tbl_count(table);
 
         stats->n_hit = stats->n_missed = stats->n_lost = 0;
@@ -846,10 +1005,105 @@ static struct genl_multicast_group ovs_dp_flow_multicast_group = {
         .name = OVS_FLOW_MCGROUP
 };
 
+static int actions_to_attr(const struct nlattr *attr, int len, struct sk_buff *skb);
+static int sample_action_to_attr(const struct nlattr *attr, struct sk_buff *skb)
+{
+        const struct nlattr *a;
+        struct nlattr *start;
+        int err = 0, rem;
+
+        start = nla_nest_start(skb, OVS_ACTION_ATTR_SAMPLE);
+        if (!start)
+                return -EMSGSIZE;
+
+        nla_for_each_nested(a, attr, rem) {
+                int type = nla_type(a);
+                struct nlattr *st_sample;
+
+                switch (type) {
+                case OVS_SAMPLE_ATTR_PROBABILITY:
+                        if (nla_put(skb, OVS_SAMPLE_ATTR_PROBABILITY, sizeof(u32), nla_data(a)))
+                                return -EMSGSIZE;
+                        break;
+                case OVS_SAMPLE_ATTR_ACTIONS:
+                        st_sample = nla_nest_start(skb, OVS_SAMPLE_ATTR_ACTIONS);
+                        if (!st_sample)
+                                return -EMSGSIZE;
+                        err = actions_to_attr(nla_data(a), nla_len(a), skb);
+                        if (err)
+                                return err;
+                        nla_nest_end(skb, st_sample);
+                        break;
+                }
+        }
+
+        nla_nest_end(skb, start);
+        return err;
+}
+
+static int set_action_to_attr(const struct nlattr *a, struct sk_buff *skb)
+{
+        const struct nlattr *ovs_key = nla_data(a);
+        int key_type = nla_type(ovs_key);
+        struct nlattr *start;
+        int err;
+
+        switch (key_type) {
+        case OVS_KEY_ATTR_IPV4_TUNNEL:
+                start = nla_nest_start(skb, OVS_ACTION_ATTR_SET);
+                if (!start)
+                        return -EMSGSIZE;
+
+                err = ovs_ipv4_tun_to_nlattr(skb, nla_data(ovs_key),
+                                             nla_data(ovs_key));
+                if (err)
+                        return err;
+                nla_nest_end(skb, start);
+                break;
+        default:
+                if (nla_put(skb, OVS_ACTION_ATTR_SET, nla_len(a), ovs_key))
+                        return -EMSGSIZE;
+                break;
+        }
+
+        return 0;
+}
+
+static int actions_to_attr(const struct nlattr *attr, int len, struct sk_buff *skb)
+{
+        const struct nlattr *a;
+        int rem, err;
+
+        nla_for_each_attr(a, attr, len, rem) {
+                int type = nla_type(a);
+
+                switch (type) {
+                case OVS_ACTION_ATTR_SET:
+                        err = set_action_to_attr(a, skb);
+                        if (err)
+                                return err;
+                        break;
+
+                case OVS_ACTION_ATTR_SAMPLE:
+                        err = sample_action_to_attr(a, skb);
+                        if (err)
+                                return err;
+                        break;
+                default:
+                        if (nla_put(skb, type, nla_len(a), nla_data(a)))
+                                return -EMSGSIZE;
+                        break;
+                }
+        }
+
+        return 0;
+}
+
 static size_t ovs_flow_cmd_msg_size(const struct sw_flow_actions *acts)
 {
         return NLMSG_ALIGN(sizeof(struct ovs_header))
                 + nla_total_size(key_attr_size()) /* OVS_FLOW_ATTR_KEY */
+                + nla_total_size(key_attr_size()) /* OVS_FLOW_ATTR_MASK */
                 + nla_total_size(sizeof(struct ovs_flow_stats)) /* OVS_FLOW_ATTR_STATS */
                 + nla_total_size(1) /* OVS_FLOW_ATTR_TCP_FLAGS */
                 + nla_total_size(8) /* OVS_FLOW_ATTR_USED */
@@ -862,7 +1116,7 @@ static int ovs_flow_cmd_fill_info(struct sw_flow *flow, struct datapath *dp,
                                   u32 seq, u32 flags, u8 cmd)
 {
         const int skb_orig_len = skb->len;
-        const struct sw_flow_actions *sf_acts;
+        struct nlattr *start;
         struct ovs_flow_stats stats;
         struct ovs_header *ovs_header;
         struct nlattr *nla;
@@ -870,20 +1124,31 @@ static int ovs_flow_cmd_fill_info(struct sw_flow *flow, struct datapath *dp,
         u8 tcp_flags;
         int err;
 
-        sf_acts = ovsl_dereference(flow->sf_acts);
-
         ovs_header = genlmsg_put(skb, portid, seq, &dp_flow_genl_family, flags, cmd);
         if (!ovs_header)
                 return -EMSGSIZE;
 
         ovs_header->dp_ifindex = get_dpifindex(dp);
 
+        /* Fill flow key. */
         nla = nla_nest_start(skb, OVS_FLOW_ATTR_KEY);
         if (!nla)
                 goto nla_put_failure;
-        err = ovs_flow_to_nlattrs(&flow->key, skb);
+
+        err = ovs_flow_to_nlattrs(&flow->unmasked_key,
+                        &flow->unmasked_key, skb);
+        if (err)
+                goto error;
+        nla_nest_end(skb, nla);
+
+        nla = nla_nest_start(skb, OVS_FLOW_ATTR_MASK);
+        if (!nla)
+                goto nla_put_failure;
+
+        err = ovs_flow_to_nlattrs(&flow->key, &flow->mask->key, skb);
         if (err)
                 goto error;
+
         nla_nest_end(skb, nla);
 
         spin_lock_bh(&flow->lock);
@@ -916,10 +1181,24 @@ static int ovs_flow_cmd_fill_info(struct sw_flow *flow, struct datapath *dp,
          * This can only fail for dump operations because the skb is always
          * properly sized for single flows.
          */
-        err = nla_put(skb, OVS_FLOW_ATTR_ACTIONS, sf_acts->actions_len,
-                      sf_acts->actions);
-        if (err < 0 && skb_orig_len)
-                goto error;
+        start = nla_nest_start(skb, OVS_FLOW_ATTR_ACTIONS);
+        if (start) {
+                const struct sw_flow_actions *sf_acts;
+
+                sf_acts = rcu_dereference_check(flow->sf_acts,
+                                                lockdep_ovsl_is_held());
+
+                err = actions_to_attr(sf_acts->actions, sf_acts->actions_len, skb);
+                if (!err)
+                        nla_nest_end(skb, start);
+                else {
+                        if (skb_orig_len)
+                                goto error;
+
+                        nla_nest_cancel(skb, start);
+                }
+        } else if (skb_orig_len)
+                goto nla_put_failure;
 
         return genlmsg_end(skb, ovs_header);
 
@@ -959,27 +1238,41 @@ static int ovs_flow_cmd_new_or_set(struct sk_buff *skb, struct genl_info *info)
 {
         struct nlattr **a = info->attrs;
         struct ovs_header *ovs_header = info->userhdr;
-        struct sw_flow_key key;
-        struct sw_flow *flow;
+        struct sw_flow_key key, masked_key;
+        struct sw_flow *flow = NULL;
+        struct sw_flow_mask mask;
         struct sk_buff *reply;
         struct datapath *dp;
         struct flow_table *table;
+        struct sw_flow_actions *acts = NULL;
+        struct sw_flow_match match;
         int error;
-        int key_len;
 
         /* Extract key. */
         error = -EINVAL;
         if (!a[OVS_FLOW_ATTR_KEY])
                 goto error;
-        error = ovs_flow_from_nlattrs(&key, &key_len, a[OVS_FLOW_ATTR_KEY]);
+
+        ovs_match_init(&match, &key, &mask);
+        error = ovs_match_from_nlattrs(&match,
+                        a[OVS_FLOW_ATTR_KEY], a[OVS_FLOW_ATTR_MASK]);
         if (error)
                 goto error;
 
         /* Validate actions. */
         if (a[OVS_FLOW_ATTR_ACTIONS]) {
-                error = validate_actions(a[OVS_FLOW_ATTR_ACTIONS], &key,  0);
-                if (error)
+                acts = ovs_flow_actions_alloc(nla_len(a[OVS_FLOW_ATTR_ACTIONS]));
+                error = PTR_ERR(acts);
+                if (IS_ERR(acts))
                         goto error;
+
+                ovs_flow_key_mask(&masked_key, &key, &mask);
+                error = validate_and_copy_actions(a[OVS_FLOW_ATTR_ACTIONS],
+                                                  &masked_key, 0, &acts);
+                if (error) {
+                        OVS_NLERR("Flow actions may not be safe on all matching packets.\n");
+                        goto err_kfree;
+                }
         } else if (info->genlhdr->cmd == OVS_FLOW_CMD_NEW) {
                 error = -EINVAL;
                 goto error;
@@ -992,10 +1285,11 @@ static int ovs_flow_cmd_new_or_set(struct sk_buff *skb, struct genl_info *info)
                 goto err_unlock_ovs;
 
         table = ovsl_dereference(dp->table);
-        flow = ovs_flow_tbl_lookup(table, &key, key_len);
-        if (!flow) {
-                struct sw_flow_actions *acts;
 
+        /* Check if this is a duplicate flow */
+        flow = ovs_flow_lookup(table, &key);
+        if (!flow) {
+                struct sw_flow_mask *mask_p;
                 /* Bail out if we're not allowed to create a new flow. */
                 error = -ENOENT;
                 if (info->genlhdr->cmd == OVS_FLOW_CMD_SET)
@@ -1008,7 +1302,7 @@ static int ovs_flow_cmd_new_or_set(struct sk_buff *skb, struct genl_info *info)
                         new_table = ovs_flow_tbl_expand(table);
                         if (!IS_ERR(new_table)) {
                                 rcu_assign_pointer(dp->table, new_table);
-                                ovs_flow_tbl_deferred_destroy(table);
+                                ovs_flow_tbl_destroy(table, true);
                                 table = ovsl_dereference(dp->table);
                         }
                 }
@@ -1019,27 +1313,35 @@ static int ovs_flow_cmd_new_or_set(struct sk_buff *skb, struct genl_info *info)
                         error = PTR_ERR(flow);
                         goto err_unlock_ovs;
                 }
-                flow->key = key;
                 clear_stats(flow);
 
-                /* Obtain actions. */
-                acts = ovs_flow_actions_alloc(a[OVS_FLOW_ATTR_ACTIONS]);
-                error = PTR_ERR(acts);
-                if (IS_ERR(acts))
-                        goto error_free_flow;
+                flow->key = masked_key;
+                flow->unmasked_key = key;
+
+                /* Make sure mask is unique in the system */
+                mask_p = ovs_sw_flow_mask_find(table, &mask);
+                if (!mask_p) {
+                        /* Allocate a new mask if none exsits. */
+                        mask_p = ovs_sw_flow_mask_alloc();
+                        if (!mask_p)
+                                goto err_flow_free;
+                        mask_p->key = mask.key;
+                        mask_p->range = mask.range;
+                        ovs_sw_flow_mask_insert(table, mask_p);
+                }
+
+                ovs_sw_flow_mask_add_ref(mask_p);
+                flow->mask = mask_p;
                 rcu_assign_pointer(flow->sf_acts, acts);
 
                 /* Put flow in bucket. */
-                flow->hash = ovs_flow_hash(&key, key_len);
-                ovs_flow_tbl_insert(table, flow);
+                ovs_flow_insert(table, flow);
 
                 reply = ovs_flow_cmd_build_info(flow, dp, info->snd_portid,
-                                                info->snd_seq,
-                                                OVS_FLOW_CMD_NEW);
+                                                info->snd_seq, OVS_FLOW_CMD_NEW);
         } else {
                 /* We found a matching flow. */
                 struct sw_flow_actions *old_acts;
-                struct nlattr *acts_attrs;
 
                 /* Bail out if we're not allowed to modify an existing flow.
                  * We accept NLM_F_CREATE in place of the intended NLM_F_EXCL
@@ -1052,23 +1354,17 @@ static int ovs_flow_cmd_new_or_set(struct sk_buff *skb, struct genl_info *info)
                     info->nlhdr->nlmsg_flags & (NLM_F_CREATE | NLM_F_EXCL))
                         goto err_unlock_ovs;
 
+                /* The unmasked key has to be the same for flow updates. */
+                error = -EINVAL;
+                if (!ovs_flow_cmp_unmasked_key(flow, &key, match.range.end)) {
+                        OVS_NLERR("Flow modification message rejected, unmasked key does not match.\n");
+                        goto err_unlock_ovs;
+                }
+
                 /* Update actions. */
                 old_acts = ovsl_dereference(flow->sf_acts);
-                acts_attrs = a[OVS_FLOW_ATTR_ACTIONS];
-                if (acts_attrs &&
-                   (old_acts->actions_len != nla_len(acts_attrs) ||
-                   memcmp(old_acts->actions, nla_data(acts_attrs),
-                          old_acts->actions_len))) {
-                        struct sw_flow_actions *new_acts;
-
-                        new_acts = ovs_flow_actions_alloc(acts_attrs);
-                        error = PTR_ERR(new_acts);
-                        if (IS_ERR(new_acts))
-                                goto err_unlock_ovs;
-
-                        rcu_assign_pointer(flow->sf_acts, new_acts);
-                        ovs_flow_deferred_free_acts(old_acts);
-                }
+                rcu_assign_pointer(flow->sf_acts, acts);
+                ovs_flow_deferred_free_acts(old_acts);
 
                 reply = ovs_flow_cmd_build_info(flow, dp, info->snd_portid,
                                                info->snd_seq, OVS_FLOW_CMD_NEW);
@@ -1089,10 +1385,12 @@ static int ovs_flow_cmd_new_or_set(struct sk_buff *skb, struct genl_info *info)
                                 ovs_dp_flow_multicast_group.id, PTR_ERR(reply));
         return 0;
 
-error_free_flow:
-        ovs_flow_free(flow);
+err_flow_free:
+        ovs_flow_free(flow, false);
 err_unlock_ovs:
         ovs_unlock();
+err_kfree:
+        kfree(acts);
 error:
         return error;
 }
@@ -1106,12 +1404,16 @@ static int ovs_flow_cmd_get(struct sk_buff *skb, struct genl_info *info)
         struct sw_flow *flow;
         struct datapath *dp;
         struct flow_table *table;
+        struct sw_flow_match match;
         int err;
-        int key_len;
 
-        if (!a[OVS_FLOW_ATTR_KEY])
+        if (!a[OVS_FLOW_ATTR_KEY]) {
+                OVS_NLERR("Flow get message rejected, Key attribute missing.\n");
                 return -EINVAL;
-        err = ovs_flow_from_nlattrs(&key, &key_len, a[OVS_FLOW_ATTR_KEY]);
+        }
+
+        ovs_match_init(&match, &key, NULL);
+        err = ovs_match_from_nlattrs(&match, a[OVS_FLOW_ATTR_KEY], NULL);
         if (err)
                 return err;
 
@@ -1123,7 +1425,7 @@ static int ovs_flow_cmd_get(struct sk_buff *skb, struct genl_info *info)
         }
 
         table = ovsl_dereference(dp->table);
-        flow = ovs_flow_tbl_lookup(table, &key, key_len);
+        flow = ovs_flow_lookup_unmasked_key(table, &match);
         if (!flow) {
                 err = -ENOENT;
                 goto unlock;
@@ -1152,8 +1454,8 @@ static int ovs_flow_cmd_del(struct sk_buff *skb, struct genl_info *info)
         struct sw_flow *flow;
         struct datapath *dp;
         struct flow_table *table;
+        struct sw_flow_match match;
         int err;
-        int key_len;
 
         ovs_lock();
         dp = get_dp(sock_net(skb->sk), ovs_header->dp_ifindex);
@@ -1166,12 +1468,14 @@ static int ovs_flow_cmd_del(struct sk_buff *skb, struct genl_info *info)
                 err = flush_flows(dp);
                 goto unlock;
         }
-        err = ovs_flow_from_nlattrs(&key, &key_len, a[OVS_FLOW_ATTR_KEY]);
+
+        ovs_match_init(&match, &key, NULL);
+        err = ovs_match_from_nlattrs(&match, a[OVS_FLOW_ATTR_KEY], NULL);
         if (err)
                 goto unlock;
 
         table = ovsl_dereference(dp->table);
-        flow = ovs_flow_tbl_lookup(table, &key, key_len);
+        flow = ovs_flow_lookup_unmasked_key(table, &match);
         if (!flow) {
                 err = -ENOENT;
                 goto unlock;
@@ -1183,13 +1487,13 @@ static int ovs_flow_cmd_del(struct sk_buff *skb, struct genl_info *info)
                 goto unlock;
         }
 
-        ovs_flow_tbl_remove(table, flow);
+        ovs_flow_remove(table, flow);
 
         err = ovs_flow_cmd_fill_info(flow, dp, reply, info->snd_portid,
                                      info->snd_seq, 0, OVS_FLOW_CMD_DEL);
         BUG_ON(err < 0);
 
-        ovs_flow_deferred_free(flow);
+        ovs_flow_free(flow, true);
         ovs_unlock();
 
         ovs_notify(reply, info, &ovs_dp_flow_multicast_group);
@@ -1205,22 +1509,21 @@ static int ovs_flow_cmd_dump(struct sk_buff *skb, struct netlink_callback *cb)
         struct datapath *dp;
         struct flow_table *table;
 
-        ovs_lock();
+        rcu_read_lock();
         dp = get_dp(sock_net(skb->sk), ovs_header->dp_ifindex);
         if (!dp) {
-                ovs_unlock();
+                rcu_read_unlock();
                 return -ENODEV;
         }
 
-        table = ovsl_dereference(dp->table);
-
+        table = rcu_dereference(dp->table);
         for (;;) {
                 struct sw_flow *flow;
                 u32 bucket, obj;
 
                 bucket = cb->args[0];
                 obj = cb->args[1];
-                flow = ovs_flow_tbl_next(table, &bucket, &obj);
+                flow = ovs_flow_dump_next(table, &bucket, &obj);
                 if (!flow)
                         break;
 
@@ -1233,7 +1536,7 @@ static int ovs_flow_cmd_dump(struct sk_buff *skb, struct netlink_callback *cb)
                 cb->args[0] = bucket;
                 cb->args[1] = obj;
         }
-        ovs_unlock();
+        rcu_read_unlock();
         return skb->len;
 }
 
@@ -1429,7 +1732,7 @@ static int ovs_dp_cmd_new(struct sk_buff *skb, struct genl_info *info)
                 goto err_destroy_local_port;
 
         ovs_net = net_generic(ovs_dp_get_net(dp), ovs_net_id);
-        list_add_tail(&dp->list_node, &ovs_net->dps);
+        list_add_tail_rcu(&dp->list_node, &ovs_net->dps);
 
         ovs_unlock();
 
@@ -1443,7 +1746,7 @@ err_destroy_ports_array:
 err_destroy_percpu:
         free_percpu(dp->stats_percpu);
 err_destroy_table:
-        ovs_flow_tbl_destroy(ovsl_dereference(dp->table));
+        ovs_flow_tbl_destroy(ovsl_dereference(dp->table), false);
 err_free_dp:
         release_net(ovs_dp_get_net(dp));
         kfree(dp);
@@ -1467,7 +1770,7 @@ static void __dp_destroy(struct datapath *dp)
                                 ovs_dp_detach_port(vport);
         }
 
-        list_del(&dp->list_node);
+        list_del_rcu(&dp->list_node);
 
         /* OVSP_LOCAL is datapath internal port. We need to make sure that
          * all port in datapath are destroyed first before freeing datapath.
@@ -1572,8 +1875,8 @@ static int ovs_dp_cmd_dump(struct sk_buff *skb, struct netlink_callback *cb)
         int skip = cb->args[0];
         int i = 0;
 
-        ovs_lock();
-        list_for_each_entry(dp, &ovs_net->dps, list_node) {
+        rcu_read_lock();
+        list_for_each_entry_rcu(dp, &ovs_net->dps, list_node) {
                 if (i >= skip &&
                     ovs_dp_cmd_fill_info(dp, skb, NETLINK_CB(cb->skb).portid,
                                          cb->nlh->nlmsg_seq, NLM_F_MULTI,
@@ -1581,7 +1884,7 @@ static int ovs_dp_cmd_dump(struct sk_buff *skb, struct netlink_callback *cb)
                         break;
                 i++;
         }
-        ovs_unlock();
+        rcu_read_unlock();
 
         cb->args[0] = i;
 
@@ -1812,10 +2115,11 @@ static int ovs_vport_cmd_set(struct sk_buff *skb, struct genl_info *info)
         if (IS_ERR(vport))
                 goto exit_unlock;
 
-        err = 0;
         if (a[OVS_VPORT_ATTR_TYPE] &&
-            nla_get_u32(a[OVS_VPORT_ATTR_TYPE]) != vport->ops->type)
+            nla_get_u32(a[OVS_VPORT_ATTR_TYPE]) != vport->ops->type) {
                 err = -EINVAL;
+                goto exit_unlock;
+        }
 
         reply = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
         if (!reply) {
@@ -1823,10 +2127,11 @@ static int ovs_vport_cmd_set(struct sk_buff *skb, struct genl_info *info)
                 goto exit_unlock;
         }
 
-        if (!err && a[OVS_VPORT_ATTR_OPTIONS])
+        if (a[OVS_VPORT_ATTR_OPTIONS]) {
                 err = ovs_vport_set_options(vport, a[OVS_VPORT_ATTR_OPTIONS]);
-        if (err)
-                goto exit_free;
+                if (err)
+                        goto exit_free;
+        }
 
         if (a[OVS_VPORT_ATTR_UPCALL_PID])
                 vport->upcall_portid = nla_get_u32(a[OVS_VPORT_ATTR_UPCALL_PID]);
@@ -1839,9 +2144,6 @@ static int ovs_vport_cmd_set(struct sk_buff *skb, struct genl_info *info)
         ovs_notify(reply, info, &ovs_dp_vport_multicast_group);
         return 0;
 
-        rtnl_unlock();
-        return 0;
-
 exit_free:
         kfree_skb(reply);
 exit_unlock:
@@ -1867,8 +2169,8 @@ static int ovs_vport_cmd_del(struct sk_buff *skb, struct genl_info *info)
                 goto exit_unlock;
         }
 
-        reply = ovs_vport_cmd_build_info(vport, info->snd_portid, info->snd_seq,
-                                         OVS_VPORT_CMD_DEL);
+        reply = ovs_vport_cmd_build_info(vport, info->snd_portid,
+                                         info->snd_seq, OVS_VPORT_CMD_DEL);
         err = PTR_ERR(reply);
         if (IS_ERR(reply))
                 goto exit_unlock;
@@ -1897,8 +2199,8 @@ static int ovs_vport_cmd_get(struct sk_buff *skb, struct genl_info *info)
         if (IS_ERR(vport))
                 goto exit_unlock;
 
-        reply = ovs_vport_cmd_build_info(vport, info->snd_portid, info->snd_seq,
-                                         OVS_VPORT_CMD_NEW);
+        reply = ovs_vport_cmd_build_info(vport, info->snd_portid,
+                                         info->snd_seq, OVS_VPORT_CMD_NEW);
         err = PTR_ERR(reply);
         if (IS_ERR(reply))
                 goto exit_unlock;
@@ -2051,7 +2353,7 @@ static void rehash_flow_table(struct work_struct *work)
                         new_table = ovs_flow_tbl_rehash(old_table);
                         if (!IS_ERR(new_table)) {
                                 rcu_assign_pointer(dp->table, new_table);
-                                ovs_flow_tbl_deferred_destroy(old_table);
+                                ovs_flow_tbl_destroy(old_table, true);
                         }
                 }
         }
diff --git a/net/openvswitch/datapath.h b/net/openvswitch/datapath.h
index 16b840695216..4d109c176ef3 100644
--- a/net/openvswitch/datapath.h
+++ b/net/openvswitch/datapath.h
@@ -88,9 +88,14 @@ struct datapath {
 /**
  * struct ovs_skb_cb - OVS data in skb CB
  * @flow: The flow associated with this packet.  May be %NULL if no flow.
+ * @pkt_key: The flow information extracted from the packet.  Must be nonnull.
+ * @tun_key: Key for the tunnel that encapsulated this packet. NULL if the
+ * packet is not being tunneled.
  */
 struct ovs_skb_cb {
         struct sw_flow          *flow;
+        struct sw_flow_key      *pkt_key;
+        struct ovs_key_ipv4_tunnel  *tun_key;
 };
 #define OVS_CB(skb) ((struct ovs_skb_cb *)(skb)->cb)
 
@@ -119,6 +124,7 @@ struct dp_upcall_info {
 struct ovs_net {
         struct list_head dps;
         struct work_struct dp_notify_work;
+        struct vport_net vport_net;
 };
 
 extern int ovs_net_id;
@@ -179,4 +185,8 @@ struct sk_buff *ovs_vport_cmd_build_info(struct vport *, u32 pid, u32 seq,
 
 int ovs_execute_actions(struct datapath *dp, struct sk_buff *skb);
 void ovs_dp_notify_wq(struct work_struct *work);
+
+#define OVS_NLERR(fmt, ...) \
+        pr_info_once("netlink: " fmt, ##__VA_ARGS__)
+
 #endif /* datapath.h */
diff --git a/net/openvswitch/dp_notify.c b/net/openvswitch/dp_notify.c
index ef4feec6cd84..c3235675f359 100644
--- a/net/openvswitch/dp_notify.c
+++ b/net/openvswitch/dp_notify.c
@@ -78,7 +78,7 @@ static int dp_device_event(struct notifier_block *unused, unsigned long event,
                            void *ptr)
 {
         struct ovs_net *ovs_net;
-        struct net_device *dev = ptr;
+        struct net_device *dev = netdev_notifier_info_to_dev(ptr);
         struct vport *vport = NULL;
 
         if (!ovs_is_internal_dev(dev))
diff --git a/net/openvswitch/flow.c b/net/openvswitch/flow.c
index b15321a2228c..410db90db73d 100644
--- a/net/openvswitch/flow.c
+++ b/net/openvswitch/flow.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2007-2011 Nicira, Inc.
+ * Copyright (c) 2007-2013 Nicira, Inc.
  *
  * This program is free software; you can redistribute it and/or
  * modify it under the terms of version 2 of the GNU General Public
@@ -34,17 +34,215 @@
 #include <linux/if_arp.h>
 #include <linux/ip.h>
 #include <linux/ipv6.h>
+#include <linux/sctp.h>
 #include <linux/tcp.h>
 #include <linux/udp.h>
 #include <linux/icmp.h>
 #include <linux/icmpv6.h>
 #include <linux/rculist.h>
 #include <net/ip.h>
+#include <net/ip_tunnels.h>
 #include <net/ipv6.h>
 #include <net/ndisc.h>
 
 static struct kmem_cache *flow_cache;
 
+static void ovs_sw_flow_mask_set(struct sw_flow_mask *mask,
+                struct sw_flow_key_range *range, u8 val);
+
+static void update_range__(struct sw_flow_match *match,
+                          size_t offset, size_t size, bool is_mask)
+{
+        struct sw_flow_key_range *range = NULL;
+        size_t start = rounddown(offset, sizeof(long));
+        size_t end = roundup(offset + size, sizeof(long));
+
+        if (!is_mask)
+                range = &match->range;
+        else if (match->mask)
+                range = &match->mask->range;
+
+        if (!range)
+                return;
+
+        if (range->start == range->end) {
+                range->start = start;
+                range->end = end;
+                return;
+        }
+
+        if (range->start > start)
+                range->start = start;
+
+        if (range->end < end)
+                range->end = end;
+}
+
+#define SW_FLOW_KEY_PUT(match, field, value, is_mask) \
+        do { \
+                update_range__(match, offsetof(struct sw_flow_key, field),  \
+                                     sizeof((match)->key->field), is_mask); \
+                if (is_mask) {                                              \
+                        if ((match)->mask)                                  \
+                                (match)->mask->key.field = value;           \
+                } else {                                                    \
+                        (match)->key->field = value;                        \
+                }                                                           \
+        } while (0)
+
+#define SW_FLOW_KEY_MEMCPY(match, field, value_p, len, is_mask) \
+        do { \
+                update_range__(match, offsetof(struct sw_flow_key, field),  \
+                                len, is_mask);                              \
+                if (is_mask) {                                              \
+                        if ((match)->mask)                                  \
+                                memcpy(&(match)->mask->key.field, value_p, len);\
+                } else {                                                    \
+                        memcpy(&(match)->key->field, value_p, len);         \
+                }                                                           \
+        } while (0)
+
+static u16 range_n_bytes(const struct sw_flow_key_range *range)
+{
+        return range->end - range->start;
+}
+
+void ovs_match_init(struct sw_flow_match *match,
+                    struct sw_flow_key *key,
+                    struct sw_flow_mask *mask)
+{
+        memset(match, 0, sizeof(*match));
+        match->key = key;
+        match->mask = mask;
+
+        memset(key, 0, sizeof(*key));
+
+        if (mask) {
+                memset(&mask->key, 0, sizeof(mask->key));
+                mask->range.start = mask->range.end = 0;
+        }
+}
+
+static bool ovs_match_validate(const struct sw_flow_match *match,
+                u64 key_attrs, u64 mask_attrs)
+{
+        u64 key_expected = 1 << OVS_KEY_ATTR_ETHERNET;
+        u64 mask_allowed = key_attrs;  /* At most allow all key attributes */
+
+        /* The following mask attributes allowed only if they
+         * pass the validation tests. */
+        mask_allowed &= ~((1 << OVS_KEY_ATTR_IPV4)
+                        | (1 << OVS_KEY_ATTR_IPV6)
+                        | (1 << OVS_KEY_ATTR_TCP)
+                        | (1 << OVS_KEY_ATTR_UDP)
+                        | (1 << OVS_KEY_ATTR_SCTP)
+                        | (1 << OVS_KEY_ATTR_ICMP)
+                        | (1 << OVS_KEY_ATTR_ICMPV6)
+                        | (1 << OVS_KEY_ATTR_ARP)
+                        | (1 << OVS_KEY_ATTR_ND));
+
+        /* Always allowed mask fields. */
+        mask_allowed |= ((1 << OVS_KEY_ATTR_TUNNEL)
+                       | (1 << OVS_KEY_ATTR_IN_PORT)
+                       | (1 << OVS_KEY_ATTR_ETHERTYPE));
+
+        /* Check key attributes. */
+        if (match->key->eth.type == htons(ETH_P_ARP)
+                        || match->key->eth.type == htons(ETH_P_RARP)) {
+                key_expected |= 1 << OVS_KEY_ATTR_ARP;
+                if (match->mask && (match->mask->key.eth.type == htons(0xffff)))
+                        mask_allowed |= 1 << OVS_KEY_ATTR_ARP;
+        }
+
+        if (match->key->eth.type == htons(ETH_P_IP)) {
+                key_expected |= 1 << OVS_KEY_ATTR_IPV4;
+                if (match->mask && (match->mask->key.eth.type == htons(0xffff)))
+                        mask_allowed |= 1 << OVS_KEY_ATTR_IPV4;
+
+                if (match->key->ip.frag != OVS_FRAG_TYPE_LATER) {
+                        if (match->key->ip.proto == IPPROTO_UDP) {
+                                key_expected |= 1 << OVS_KEY_ATTR_UDP;
+                                if (match->mask && (match->mask->key.ip.proto == 0xff))
+                                        mask_allowed |= 1 << OVS_KEY_ATTR_UDP;
+                        }
+
+                        if (match->key->ip.proto == IPPROTO_SCTP) {
+                                key_expected |= 1 << OVS_KEY_ATTR_SCTP;
+                                if (match->mask && (match->mask->key.ip.proto == 0xff))
+                                        mask_allowed |= 1 << OVS_KEY_ATTR_SCTP;
+                        }
+
+                        if (match->key->ip.proto == IPPROTO_TCP) {
+                                key_expected |= 1 << OVS_KEY_ATTR_TCP;
+                                if (match->mask && (match->mask->key.ip.proto == 0xff))
+                                        mask_allowed |= 1 << OVS_KEY_ATTR_TCP;
+                        }
+
+                        if (match->key->ip.proto == IPPROTO_ICMP) {
+                                key_expected |= 1 << OVS_KEY_ATTR_ICMP;
+                                if (match->mask && (match->mask->key.ip.proto == 0xff))
+                                        mask_allowed |= 1 << OVS_KEY_ATTR_ICMP;
+                        }
+                }
+        }
+
+        if (match->key->eth.type == htons(ETH_P_IPV6)) {
+                key_expected |= 1 << OVS_KEY_ATTR_IPV6;
+                if (match->mask && (match->mask->key.eth.type == htons(0xffff)))
+                        mask_allowed |= 1 << OVS_KEY_ATTR_IPV6;
+
+                if (match->key->ip.frag != OVS_FRAG_TYPE_LATER) {
+                        if (match->key->ip.proto == IPPROTO_UDP) {
+                                key_expected |= 1 << OVS_KEY_ATTR_UDP;
+                                if (match->mask && (match->mask->key.ip.proto == 0xff))
+                                        mask_allowed |= 1 << OVS_KEY_ATTR_UDP;
+                        }
+
+                        if (match->key->ip.proto == IPPROTO_SCTP) {
+                                key_expected |= 1 << OVS_KEY_ATTR_SCTP;
+                                if (match->mask && (match->mask->key.ip.proto == 0xff))
+                                        mask_allowed |= 1 << OVS_KEY_ATTR_SCTP;
+                        }
+
+                        if (match->key->ip.proto == IPPROTO_TCP) {
+                                key_expected |= 1 << OVS_KEY_ATTR_TCP;
+                                if (match->mask && (match->mask->key.ip.proto == 0xff))
+                                        mask_allowed |= 1 << OVS_KEY_ATTR_TCP;
+                        }
+
+                        if (match->key->ip.proto == IPPROTO_ICMPV6) {
+                                key_expected |= 1 << OVS_KEY_ATTR_ICMPV6;
+                                if (match->mask && (match->mask->key.ip.proto == 0xff))
+                                        mask_allowed |= 1 << OVS_KEY_ATTR_ICMPV6;
+
+                                if (match->key->ipv6.tp.src ==
+                                                htons(NDISC_NEIGHBOUR_SOLICITATION) ||
+                                    match->key->ipv6.tp.src == htons(NDISC_NEIGHBOUR_ADVERTISEMENT)) {
+                                        key_expected |= 1 << OVS_KEY_ATTR_ND;
+                                        if (match->mask && (match->mask->key.ipv6.tp.src == htons(0xffff)))
+                                                mask_allowed |= 1 << OVS_KEY_ATTR_ND;
+                                }
+                        }
+                }
+        }
+
+        if ((key_attrs & key_expected) != key_expected) {
+                /* Key attributes check failed. */
+                OVS_NLERR("Missing expected key attributes (key_attrs=%llx, expected=%llx).\n",
+                                key_attrs, key_expected);
+                return false;
+        }
+
+        if ((mask_attrs & mask_allowed) != mask_attrs) {
+                /* Mask attributes check failed. */
+                OVS_NLERR("Contain more than allowed mask fields (mask_attrs=%llx, mask_allowed=%llx).\n",
+                                mask_attrs, mask_allowed);
+                return false;
+        }
+
+        return true;
+}
+
 static int check_header(struct sk_buff *skb, int len)
 {
         if (unlikely(skb->len < len))
@@ -101,6 +299,12 @@ static bool udphdr_ok(struct sk_buff *skb)
                                   sizeof(struct udphdr));
 }
 
+static bool sctphdr_ok(struct sk_buff *skb)
+{
+        return pskb_may_pull(skb, skb_transport_offset(skb) +
+                                  sizeof(struct sctphdr));
+}
+
 static bool icmphdr_ok(struct sk_buff *skb)
 {
         return pskb_may_pull(skb, skb_transport_offset(skb) +
@@ -120,12 +324,7 @@ u64 ovs_flow_used_time(unsigned long flow_jiffies)
         return cur_ms - idle_ms;
 }
 
-#define SW_FLOW_KEY_OFFSET(field)               \
-        (offsetof(struct sw_flow_key, field) +  \
-         FIELD_SIZEOF(struct sw_flow_key, field))
-
-static int parse_ipv6hdr(struct sk_buff *skb, struct sw_flow_key *key,
-                         int *key_lenp)
+static int parse_ipv6hdr(struct sk_buff *skb, struct sw_flow_key *key)
 {
         unsigned int nh_ofs = skb_network_offset(skb);
         unsigned int nh_len;
@@ -135,8 +334,6 @@ static int parse_ipv6hdr(struct sk_buff *skb, struct sw_flow_key *key,
         __be16 frag_off;
         int err;
 
-        *key_lenp = SW_FLOW_KEY_OFFSET(ipv6.label);
-
         err = check_header(skb, nh_ofs + sizeof(*nh));
         if (unlikely(err))
                 return err;
@@ -175,6 +372,22 @@ static bool icmp6hdr_ok(struct sk_buff *skb)
                                   sizeof(struct icmp6hdr));
 }
 
+void ovs_flow_key_mask(struct sw_flow_key *dst, const struct sw_flow_key *src,
+                       const struct sw_flow_mask *mask)
+{
+        const long *m = (long *)((u8 *)&mask->key + mask->range.start);
+        const long *s = (long *)((u8 *)src + mask->range.start);
+        long *d = (long *)((u8 *)dst + mask->range.start);
+        int i;
+
+        /* The memory outside of the 'mask->range' are not set since
+         * further operations on 'dst' only uses contents within
+         * 'mask->range'.
+         */
+        for (i = 0; i < range_n_bytes(&mask->range); i += sizeof(long))
+                *d++ = *s++ & *m++;
+}
+
 #define TCP_FLAGS_OFFSET 13
 #define TCP_FLAG_MASK 0x3f
 
@@ -198,20 +411,18 @@ void ovs_flow_used(struct sw_flow *flow, struct sk_buff *skb)
         spin_unlock(&flow->lock);
 }
 
-struct sw_flow_actions *ovs_flow_actions_alloc(const struct nlattr *actions)
+struct sw_flow_actions *ovs_flow_actions_alloc(int size)
 {
-        int actions_len = nla_len(actions);
         struct sw_flow_actions *sfa;
 
-        if (actions_len > MAX_ACTIONS_BUFSIZE)
+        if (size > MAX_ACTIONS_BUFSIZE)
                 return ERR_PTR(-EINVAL);
 
-        sfa = kmalloc(sizeof(*sfa) + actions_len, GFP_KERNEL);
+        sfa = kmalloc(sizeof(*sfa) + size, GFP_KERNEL);
         if (!sfa)
                 return ERR_PTR(-ENOMEM);
 
-        sfa->actions_len = actions_len;
-        nla_memcpy(sfa->actions, actions, actions_len);
+        sfa->actions_len = 0;
         return sfa;
 }
 
@@ -225,6 +436,7 @@ struct sw_flow *ovs_flow_alloc(void)
 
         spin_lock_init(&flow->lock);
         flow->sf_acts = NULL;
+        flow->mask = NULL;
 
         return flow;
 }
@@ -241,7 +453,7 @@ static struct flex_array *alloc_buckets(unsigned int n_buckets)
         struct flex_array *buckets;
         int i, err;
 
-        buckets = flex_array_alloc(sizeof(struct hlist_head *),
+        buckets = flex_array_alloc(sizeof(struct hlist_head),
                                    n_buckets, GFP_KERNEL);
         if (!buckets)
                 return NULL;
@@ -264,7 +476,7 @@ static void free_buckets(struct flex_array *buckets)
         flex_array_free(buckets);
 }
 
-struct flow_table *ovs_flow_tbl_alloc(int new_size)
+static struct flow_table *__flow_tbl_alloc(int new_size)
 {
         struct flow_table *table = kmalloc(sizeof(*table), GFP_KERNEL);
 
@@ -282,17 +494,15 @@ struct flow_table *ovs_flow_tbl_alloc(int new_size)
         table->node_ver = 0;
         table->keep_flows = false;
         get_random_bytes(&table->hash_seed, sizeof(u32));
+        table->mask_list = NULL;
 
         return table;
 }
 
-void ovs_flow_tbl_destroy(struct flow_table *table)
+static void __flow_tbl_destroy(struct flow_table *table)
 {
         int i;
 
-        if (!table)
-                return;
-
         if (table->keep_flows)
                 goto skip_flows;
 
@@ -303,32 +513,56 @@ void ovs_flow_tbl_destroy(struct flow_table *table)
                 int ver = table->node_ver;
 
                 hlist_for_each_entry_safe(flow, n, head, hash_node[ver]) {
-                        hlist_del_rcu(&flow->hash_node[ver]);
-                        ovs_flow_free(flow);
+                        hlist_del(&flow->hash_node[ver]);
+                        ovs_flow_free(flow, false);
                 }
         }
 
+        BUG_ON(!list_empty(table->mask_list));
+        kfree(table->mask_list);
+
 skip_flows:
         free_buckets(table->buckets);
         kfree(table);
 }
 
+struct flow_table *ovs_flow_tbl_alloc(int new_size)
+{
+        struct flow_table *table = __flow_tbl_alloc(new_size);
+
+        if (!table)
+                return NULL;
+
+        table->mask_list = kmalloc(sizeof(struct list_head), GFP_KERNEL);
+        if (!table->mask_list) {
+                table->keep_flows = true;
+                __flow_tbl_destroy(table);
+                return NULL;
+        }
+        INIT_LIST_HEAD(table->mask_list);
+
+        return table;
+}
+
 static void flow_tbl_destroy_rcu_cb(struct rcu_head *rcu)
 {
         struct flow_table *table = container_of(rcu, struct flow_table, rcu);
 
-        ovs_flow_tbl_destroy(table);
+        __flow_tbl_destroy(table);
 }
 
-void ovs_flow_tbl_deferred_destroy(struct flow_table *table)
+void ovs_flow_tbl_destroy(struct flow_table *table, bool deferred)
 {
         if (!table)
                 return;
 
-        call_rcu(&table->rcu, flow_tbl_destroy_rcu_cb);
+        if (deferred)
+                call_rcu(&table->rcu, flow_tbl_destroy_rcu_cb);
+        else
+                __flow_tbl_destroy(table);
 }
 
-struct sw_flow *ovs_flow_tbl_next(struct flow_table *table, u32 *bucket, u32 *last)
+struct sw_flow *ovs_flow_dump_next(struct flow_table *table, u32 *bucket, u32 *last)
 {
         struct sw_flow *flow;
         struct hlist_head *head;
@@ -354,6 +588,16 @@ struct sw_flow *ovs_flow_tbl_next(struct flow_table *table, u32 *bucket, u32 *la
         return NULL;
 }
 
+static void __tbl_insert(struct flow_table *table, struct sw_flow *flow)
+{
+        struct hlist_head *head;
+
+        head = find_bucket(table, flow->hash);
+        hlist_add_head_rcu(&flow->hash_node[table->node_ver], head);
+
+        table->count++;
+}
+
 static void flow_table_copy_flows(struct flow_table *old, struct flow_table *new)
 {
         int old_ver;
@@ -370,8 +614,10 @@ static void flow_table_copy_flows(struct flow_table *old, struct flow_table *new
                 head = flex_array_get(old->buckets, i);
 
                 hlist_for_each_entry(flow, head, hash_node[old_ver])
-                        ovs_flow_tbl_insert(new, flow);
+                        __tbl_insert(new, flow);
         }
+
+        new->mask_list = old->mask_list;
         old->keep_flows = true;
 }
 
@@ -379,7 +625,7 @@ static struct flow_table *__flow_tbl_rehash(struct flow_table *table, int n_buck
 {
         struct flow_table *new_table;
 
-        new_table = ovs_flow_tbl_alloc(n_buckets);
+        new_table = __flow_tbl_alloc(n_buckets);
         if (!new_table)
                 return ERR_PTR(-ENOMEM);
 
@@ -398,28 +644,30 @@ struct flow_table *ovs_flow_tbl_expand(struct flow_table *table)
         return __flow_tbl_rehash(table, table->n_buckets * 2);
 }
 
-void ovs_flow_free(struct sw_flow *flow)
+static void __flow_free(struct sw_flow *flow)
 {
-        if (unlikely(!flow))
-                return;
-
         kfree((struct sf_flow_acts __force *)flow->sf_acts);
         kmem_cache_free(flow_cache, flow);
 }
 
-/* RCU callback used by ovs_flow_deferred_free. */
 static void rcu_free_flow_callback(struct rcu_head *rcu)
 {
         struct sw_flow *flow = container_of(rcu, struct sw_flow, rcu);
 
-        ovs_flow_free(flow);
+        __flow_free(flow);
 }
 
-/* Schedules 'flow' to be freed after the next RCU grace period.
- * The caller must hold rcu_read_lock for this to be sensible. */
-void ovs_flow_deferred_free(struct sw_flow *flow)
+void ovs_flow_free(struct sw_flow *flow, bool deferred)
 {
-        call_rcu(&flow->rcu, rcu_free_flow_callback);
+        if (!flow)
+                return;
+
+        ovs_sw_flow_mask_del_ref(flow->mask, deferred);
+
+        if (deferred)
+                call_rcu(&flow->rcu, rcu_free_flow_callback);
+        else
+                __flow_free(flow);
 }
 
 /* Schedules 'sf_acts' to be freed after the next RCU grace period.
@@ -490,18 +738,15 @@ static __be16 parse_ethertype(struct sk_buff *skb)
 }
 
 static int parse_icmpv6(struct sk_buff *skb, struct sw_flow_key *key,
-                        int *key_lenp, int nh_len)
+                        int nh_len)
 {
         struct icmp6hdr *icmp = icmp6_hdr(skb);
-        int error = 0;
-        int key_len;
 
         /* The ICMPv6 type and code fields use the 16-bit transport port
          * fields, so we need to store them in 16-bit network byte order.
          */
         key->ipv6.tp.src = htons(icmp->icmp6_type);
         key->ipv6.tp.dst = htons(icmp->icmp6_code);
-        key_len = SW_FLOW_KEY_OFFSET(ipv6.tp);
 
         if (icmp->icmp6_code == 0 &&
             (icmp->icmp6_type == NDISC_NEIGHBOUR_SOLICITATION ||
@@ -510,21 +755,17 @@ static int parse_icmpv6(struct sk_buff *skb, struct sw_flow_key *key,
                 struct nd_msg *nd;
                 int offset;
 
-                key_len = SW_FLOW_KEY_OFFSET(ipv6.nd);
-
                 /* In order to process neighbor discovery options, we need the
                  * entire packet.
                  */
                 if (unlikely(icmp_len < sizeof(*nd)))
-                        goto out;
-                if (unlikely(skb_linearize(skb))) {
-                        error = -ENOMEM;
-                        goto out;
-                }
+                        return 0;
+
+                if (unlikely(skb_linearize(skb)))
+                        return -ENOMEM;
 
                 nd = (struct nd_msg *)skb_transport_header(skb);
                 key->ipv6.nd.target = nd->target;
-                key_len = SW_FLOW_KEY_OFFSET(ipv6.nd);
 
                 icmp_len -= sizeof(*nd);
                 offset = 0;
@@ -534,7 +775,7 @@ static int parse_icmpv6(struct sk_buff *skb, struct sw_flow_key *key,
                         int opt_len = nd_opt->nd_opt_len * 8;
 
                         if (unlikely(!opt_len || opt_len > icmp_len))
-                                goto invalid;
+                                return 0;
 
                         /* Store the link layer address if the appropriate
                          * option is provided.  It is considered an error if
@@ -559,16 +800,14 @@ static int parse_icmpv6(struct sk_buff *skb, struct sw_flow_key *key,
                 }
         }
 
-        goto out;
+        return 0;
 
 invalid:
         memset(&key->ipv6.nd.target, 0, sizeof(key->ipv6.nd.target));
         memset(key->ipv6.nd.sll, 0, sizeof(key->ipv6.nd.sll));
         memset(key->ipv6.nd.tll, 0, sizeof(key->ipv6.nd.tll));
 
-out:
-        *key_lenp = key_len;
-        return error;
+        return 0;
 }
 
 /**
@@ -577,7 +816,6 @@ out:
  * Ethernet header
  * @in_port: port number on which @skb was received.
  * @key: output flow key
- * @key_lenp: length of output flow key
  *
  * The caller must ensure that skb->len >= ETH_HLEN.
  *
@@ -590,21 +828,21 @@ out:
  *    - skb->network_header: just past the Ethernet header, or just past the
  *      VLAN header, to the first byte of the Ethernet payload.
  *
- *    - skb->transport_header: If key->dl_type is ETH_P_IP or ETH_P_IPV6
+ *    - skb->transport_header: If key->eth.type is ETH_P_IP or ETH_P_IPV6
  *      on output, then just past the IP header, if one is present and
  *      of a correct length, otherwise the same as skb->network_header.
- *      For other key->dl_type values it is left untouched.
+ *      For other key->eth.type values it is left untouched.
  */
-int ovs_flow_extract(struct sk_buff *skb, u16 in_port, struct sw_flow_key *key,
-                 int *key_lenp)
+int ovs_flow_extract(struct sk_buff *skb, u16 in_port, struct sw_flow_key *key)
 {
-        int error = 0;
-        int key_len = SW_FLOW_KEY_OFFSET(eth);
+        int error;
         struct ethhdr *eth;
 
         memset(key, 0, sizeof(*key));
 
         key->phy.priority = skb->priority;
+        if (OVS_CB(skb)->tun_key)
+                memcpy(&key->tun_key, OVS_CB(skb)->tun_key, sizeof(key->tun_key));
         key->phy.in_port = in_port;
         key->phy.skb_mark = skb->mark;
 
@@ -618,6 +856,9 @@ int ovs_flow_extract(struct sk_buff *skb, u16 in_port, struct sw_flow_key *key,
         memcpy(key->eth.dst, eth->h_dest, ETH_ALEN);
 
         __skb_pull(skb, 2 * ETH_ALEN);
+        /* We are going to push all headers that we pull, so no need to
+         * update skb->csum here.
+         */
 
         if (vlan_tx_tag_present(skb))
                 key->eth.tci = htons(skb->vlan_tci);
@@ -637,15 +878,13 @@ int ovs_flow_extract(struct sk_buff *skb, u16 in_port, struct sw_flow_key *key,
                 struct iphdr *nh;
                 __be16 offset;
 
-                key_len = SW_FLOW_KEY_OFFSET(ipv4.addr);
-
                 error = check_iphdr(skb);
                 if (unlikely(error)) {
                         if (error == -EINVAL) {
                                 skb->transport_header = skb->network_header;
                                 error = 0;
                         }
-                        goto out;
+                        return error;
                 }
 
                 nh = ip_hdr(skb);
@@ -659,7 +898,7 @@ int ovs_flow_extract(struct sk_buff *skb, u16 in_port, struct sw_flow_key *key,
                 offset = nh->frag_off & htons(IP_OFFSET);
                 if (offset) {
                         key->ip.frag = OVS_FRAG_TYPE_LATER;
-                        goto out;
+                        return 0;
                 }
                 if (nh->frag_off & htons(IP_MF) ||
                          skb_shinfo(skb)->gso_type & SKB_GSO_UDP)
@@ -667,21 +906,24 @@ int ovs_flow_extract(struct sk_buff *skb, u16 in_port, struct sw_flow_key *key,
 
                 /* Transport layer. */
                 if (key->ip.proto == IPPROTO_TCP) {
-                        key_len = SW_FLOW_KEY_OFFSET(ipv4.tp);
                         if (tcphdr_ok(skb)) {
                                 struct tcphdr *tcp = tcp_hdr(skb);
                                 key->ipv4.tp.src = tcp->source;
                                 key->ipv4.tp.dst = tcp->dest;
                         }
                 } else if (key->ip.proto == IPPROTO_UDP) {
-                        key_len = SW_FLOW_KEY_OFFSET(ipv4.tp);
                         if (udphdr_ok(skb)) {
                                 struct udphdr *udp = udp_hdr(skb);
                                 key->ipv4.tp.src = udp->source;
                                 key->ipv4.tp.dst = udp->dest;
                         }
+                } else if (key->ip.proto == IPPROTO_SCTP) {
+                        if (sctphdr_ok(skb)) {
+                                struct sctphdr *sctp = sctp_hdr(skb);
+                                key->ipv4.tp.src = sctp->source;
+                                key->ipv4.tp.dst = sctp->dest;
+                        }
                 } else if (key->ip.proto == IPPROTO_ICMP) {
-                        key_len = SW_FLOW_KEY_OFFSET(ipv4.tp);
                         if (icmphdr_ok(skb)) {
                                 struct icmphdr *icmp = icmp_hdr(skb);
                                 /* The ICMP type and code fields use the 16-bit
@@ -710,90 +952,175 @@ int ovs_flow_extract(struct sk_buff *skb, u16 in_port, struct sw_flow_key *key,
                         memcpy(&key->ipv4.addr.dst, arp->ar_tip, sizeof(key->ipv4.addr.dst));
                         memcpy(key->ipv4.arp.sha, arp->ar_sha, ETH_ALEN);
                         memcpy(key->ipv4.arp.tha, arp->ar_tha, ETH_ALEN);
-                        key_len = SW_FLOW_KEY_OFFSET(ipv4.arp);
                 }
         } else if (key->eth.type == htons(ETH_P_IPV6)) {
                 int nh_len;             /* IPv6 Header + Extensions */
 
-                nh_len = parse_ipv6hdr(skb, key, &key_len);
+                nh_len = parse_ipv6hdr(skb, key);
                 if (unlikely(nh_len < 0)) {
-                        if (nh_len == -EINVAL)
+                        if (nh_len == -EINVAL) {
                                 skb->transport_header = skb->network_header;
-                        else
+                                error = 0;
+                        } else {
                                 error = nh_len;
-                        goto out;
+                        }
+                        return error;
                 }
 
                 if (key->ip.frag == OVS_FRAG_TYPE_LATER)
-                        goto out;
+                        return 0;
                 if (skb_shinfo(skb)->gso_type & SKB_GSO_UDP)
                         key->ip.frag = OVS_FRAG_TYPE_FIRST;
 
                 /* Transport layer. */
                 if (key->ip.proto == NEXTHDR_TCP) {
-                        key_len = SW_FLOW_KEY_OFFSET(ipv6.tp);
                         if (tcphdr_ok(skb)) {
                                 struct tcphdr *tcp = tcp_hdr(skb);
                                 key->ipv6.tp.src = tcp->source;
                                 key->ipv6.tp.dst = tcp->dest;
                         }
                 } else if (key->ip.proto == NEXTHDR_UDP) {
-                        key_len = SW_FLOW_KEY_OFFSET(ipv6.tp);
                         if (udphdr_ok(skb)) {
                                 struct udphdr *udp = udp_hdr(skb);
                                 key->ipv6.tp.src = udp->source;
                                 key->ipv6.tp.dst = udp->dest;
                         }
+                } else if (key->ip.proto == NEXTHDR_SCTP) {
+                        if (sctphdr_ok(skb)) {
+                                struct sctphdr *sctp = sctp_hdr(skb);
+                                key->ipv6.tp.src = sctp->source;
+                                key->ipv6.tp.dst = sctp->dest;
+                        }
                 } else if (key->ip.proto == NEXTHDR_ICMP) {
-                        key_len = SW_FLOW_KEY_OFFSET(ipv6.tp);
                         if (icmp6hdr_ok(skb)) {
-                                error = parse_icmpv6(skb, key, &key_len, nh_len);
-                                if (error < 0)
-                                        goto out;
+                                error = parse_icmpv6(skb, key, nh_len);
+                                if (error)
+                                        return error;
                         }
                 }
         }
 
-out:
-        *key_lenp = key_len;
-        return error;
+        return 0;
+}
+
+static u32 ovs_flow_hash(const struct sw_flow_key *key, int key_start,
+                         int key_end)
+{
+        u32 *hash_key = (u32 *)((u8 *)key + key_start);
+        int hash_u32s = (key_end - key_start) >> 2;
+
+        /* Make sure number of hash bytes are multiple of u32. */
+        BUILD_BUG_ON(sizeof(long) % sizeof(u32));
+
+        return jhash2(hash_key, hash_u32s, 0);
+}
+
+static int flow_key_start(const struct sw_flow_key *key)
+{
+        if (key->tun_key.ipv4_dst)
+                return 0;
+        else
+                return rounddown(offsetof(struct sw_flow_key, phy),
+                                          sizeof(long));
+}
+
+static bool __cmp_key(const struct sw_flow_key *key1,
+                const struct sw_flow_key *key2,  int key_start, int key_end)
+{
+        const long *cp1 = (long *)((u8 *)key1 + key_start);
+        const long *cp2 = (long *)((u8 *)key2 + key_start);
+        long diffs = 0;
+        int i;
+
+        for (i = key_start; i < key_end;  i += sizeof(long))
+                diffs |= *cp1++ ^ *cp2++;
+
+        return diffs == 0;
+}
+
+static bool __flow_cmp_masked_key(const struct sw_flow *flow,
+                const struct sw_flow_key *key, int key_start, int key_end)
+{
+        return __cmp_key(&flow->key, key, key_start, key_end);
+}
+
+static bool __flow_cmp_unmasked_key(const struct sw_flow *flow,
+                  const struct sw_flow_key *key, int key_start, int key_end)
+{
+        return __cmp_key(&flow->unmasked_key, key, key_start, key_end);
+}
+
+bool ovs_flow_cmp_unmasked_key(const struct sw_flow *flow,
+                const struct sw_flow_key *key, int key_end)
+{
+        int key_start;
+        key_start = flow_key_start(key);
+
+        return __flow_cmp_unmasked_key(flow, key, key_start, key_end);
+
 }
 
-u32 ovs_flow_hash(const struct sw_flow_key *key, int key_len)
+struct sw_flow *ovs_flow_lookup_unmasked_key(struct flow_table *table,
+                                       struct sw_flow_match *match)
 {
-        return jhash2((u32 *)key, DIV_ROUND_UP(key_len, sizeof(u32)), 0);
+        struct sw_flow_key *unmasked = match->key;
+        int key_end = match->range.end;
+        struct sw_flow *flow;
+
+        flow = ovs_flow_lookup(table, unmasked);
+        if (flow && (!ovs_flow_cmp_unmasked_key(flow, unmasked, key_end)))
+                flow = NULL;
+
+        return flow;
 }
 
-struct sw_flow *ovs_flow_tbl_lookup(struct flow_table *table,
-                                struct sw_flow_key *key, int key_len)
+static struct sw_flow *ovs_masked_flow_lookup(struct flow_table *table,
+                                    const struct sw_flow_key *unmasked,
+                                    struct sw_flow_mask *mask)
 {
         struct sw_flow *flow;
         struct hlist_head *head;
+        int key_start = mask->range.start;
+        int key_end = mask->range.end;
         u32 hash;
+        struct sw_flow_key masked_key;
 
-        hash = ovs_flow_hash(key, key_len);
-
+        ovs_flow_key_mask(&masked_key, unmasked, mask);
+        hash = ovs_flow_hash(&masked_key, key_start, key_end);
         head = find_bucket(table, hash);
         hlist_for_each_entry_rcu(flow, head, hash_node[table->node_ver]) {
-
-                if (flow->hash == hash &&
-                    !memcmp(&flow->key, key, key_len)) {
+                if (flow->mask == mask &&
+                    __flow_cmp_masked_key(flow, &masked_key,
+                                          key_start, key_end))
                         return flow;
-                }
         }
         return NULL;
 }
 
-void ovs_flow_tbl_insert(struct flow_table *table, struct sw_flow *flow)
+struct sw_flow *ovs_flow_lookup(struct flow_table *tbl,
+                                const struct sw_flow_key *key)
 {
-        struct hlist_head *head;
+        struct sw_flow *flow = NULL;
+        struct sw_flow_mask *mask;
 
-        head = find_bucket(table, flow->hash);
-        hlist_add_head_rcu(&flow->hash_node[table->node_ver], head);
-        table->count++;
+        list_for_each_entry_rcu(mask, tbl->mask_list, list) {
+                flow = ovs_masked_flow_lookup(tbl, key, mask);
+                if (flow)  /* Found */
+                        break;
+        }
+
+        return flow;
+}
+
+
+void ovs_flow_insert(struct flow_table *table, struct sw_flow *flow)
+{
+        flow->hash = ovs_flow_hash(&flow->key, flow->mask->range.start,
+                        flow->mask->range.end);
+        __tbl_insert(table, flow);
 }
 
-void ovs_flow_tbl_remove(struct flow_table *table, struct sw_flow *flow)
+void ovs_flow_remove(struct flow_table *table, struct sw_flow *flow)
 {
         BUG_ON(table->count == 0);
         hlist_del_rcu(&flow->hash_node[table->node_ver]);
@@ -813,319 +1140,602 @@ const int ovs_key_lens[OVS_KEY_ATTR_MAX + 1] = {
         [OVS_KEY_ATTR_IPV6] = sizeof(struct ovs_key_ipv6),
         [OVS_KEY_ATTR_TCP] = sizeof(struct ovs_key_tcp),
         [OVS_KEY_ATTR_UDP] = sizeof(struct ovs_key_udp),
+        [OVS_KEY_ATTR_SCTP] = sizeof(struct ovs_key_sctp),
         [OVS_KEY_ATTR_ICMP] = sizeof(struct ovs_key_icmp),
         [OVS_KEY_ATTR_ICMPV6] = sizeof(struct ovs_key_icmpv6),
         [OVS_KEY_ATTR_ARP] = sizeof(struct ovs_key_arp),
         [OVS_KEY_ATTR_ND] = sizeof(struct ovs_key_nd),
+        [OVS_KEY_ATTR_TUNNEL] = -1,
 };
 
-static int ipv4_flow_from_nlattrs(struct sw_flow_key *swkey, int *key_len,
-                                  const struct nlattr *a[], u32 *attrs)
+static bool is_all_zero(const u8 *fp, size_t size)
 {
-        const struct ovs_key_icmp *icmp_key;
-        const struct ovs_key_tcp *tcp_key;
-        const struct ovs_key_udp *udp_key;
+        int i;
 
-        switch (swkey->ip.proto) {
-        case IPPROTO_TCP:
-                if (!(*attrs & (1 << OVS_KEY_ATTR_TCP)))
-                        return -EINVAL;
-                *attrs &= ~(1 << OVS_KEY_ATTR_TCP);
+        if (!fp)
+                return false;
 
-                *key_len = SW_FLOW_KEY_OFFSET(ipv4.tp);
-                tcp_key = nla_data(a[OVS_KEY_ATTR_TCP]);
-                swkey->ipv4.tp.src = tcp_key->tcp_src;
-                swkey->ipv4.tp.dst = tcp_key->tcp_dst;
-                break;
+        for (i = 0; i < size; i++)
+                if (fp[i])
+                        return false;
+
+        return true;
+}
+
+static int __parse_flow_nlattrs(const struct nlattr *attr,
+                              const struct nlattr *a[],
+                              u64 *attrsp, bool nz)
+{
+        const struct nlattr *nla;
+        u32 attrs;
+        int rem;
+
+        attrs = *attrsp;
+        nla_for_each_nested(nla, attr, rem) {
+                u16 type = nla_type(nla);
+                int expected_len;
 
-        case IPPROTO_UDP:
-                if (!(*attrs & (1 << OVS_KEY_ATTR_UDP)))
+                if (type > OVS_KEY_ATTR_MAX) {
+                        OVS_NLERR("Unknown key attribute (type=%d, max=%d).\n",
+                                  type, OVS_KEY_ATTR_MAX);
                         return -EINVAL;
-                *attrs &= ~(1 << OVS_KEY_ATTR_UDP);
+                }
 
-                *key_len = SW_FLOW_KEY_OFFSET(ipv4.tp);
-                udp_key = nla_data(a[OVS_KEY_ATTR_UDP]);
-                swkey->ipv4.tp.src = udp_key->udp_src;
-                swkey->ipv4.tp.dst = udp_key->udp_dst;
-                break;
+                if (attrs & (1 << type)) {
+                        OVS_NLERR("Duplicate key attribute (type %d).\n", type);
+                        return -EINVAL;
+                }
 
-        case IPPROTO_ICMP:
-                if (!(*attrs & (1 << OVS_KEY_ATTR_ICMP)))
+                expected_len = ovs_key_lens[type];
+                if (nla_len(nla) != expected_len && expected_len != -1) {
+                        OVS_NLERR("Key attribute has unexpected length (type=%d"
+                                  ", length=%d, expected=%d).\n", type,
+                                  nla_len(nla), expected_len);
                         return -EINVAL;
-                *attrs &= ~(1 << OVS_KEY_ATTR_ICMP);
+                }
 
-                *key_len = SW_FLOW_KEY_OFFSET(ipv4.tp);
-                icmp_key = nla_data(a[OVS_KEY_ATTR_ICMP]);
-                swkey->ipv4.tp.src = htons(icmp_key->icmp_type);
-                swkey->ipv4.tp.dst = htons(icmp_key->icmp_code);
-                break;
+                if (!nz || !is_all_zero(nla_data(nla), expected_len)) {
+                        attrs |= 1 << type;
+                        a[type] = nla;
+                }
+        }
+        if (rem) {
+                OVS_NLERR("Message has %d unknown bytes.\n", rem);
+                return -EINVAL;
         }
 
+        *attrsp = attrs;
         return 0;
 }
 
-static int ipv6_flow_from_nlattrs(struct sw_flow_key *swkey, int *key_len,
-                                  const struct nlattr *a[], u32 *attrs)
+static int parse_flow_mask_nlattrs(const struct nlattr *attr,
+                              const struct nlattr *a[], u64 *attrsp)
 {
-        const struct ovs_key_icmpv6 *icmpv6_key;
-        const struct ovs_key_tcp *tcp_key;
-        const struct ovs_key_udp *udp_key;
-
-        switch (swkey->ip.proto) {
-        case IPPROTO_TCP:
-                if (!(*attrs & (1 << OVS_KEY_ATTR_TCP)))
-                        return -EINVAL;
-                *attrs &= ~(1 << OVS_KEY_ATTR_TCP);
+        return __parse_flow_nlattrs(attr, a, attrsp, true);
+}
 
-                *key_len = SW_FLOW_KEY_OFFSET(ipv6.tp);
-                tcp_key = nla_data(a[OVS_KEY_ATTR_TCP]);
-                swkey->ipv6.tp.src = tcp_key->tcp_src;
-                swkey->ipv6.tp.dst = tcp_key->tcp_dst;
-                break;
+static int parse_flow_nlattrs(const struct nlattr *attr,
+                              const struct nlattr *a[], u64 *attrsp)
+{
+        return __parse_flow_nlattrs(attr, a, attrsp, false);
+}
 
-        case IPPROTO_UDP:
-                if (!(*attrs & (1 << OVS_KEY_ATTR_UDP)))
+int ovs_ipv4_tun_from_nlattr(const struct nlattr *attr,
+                             struct sw_flow_match *match, bool is_mask)
+{
+        struct nlattr *a;
+        int rem;
+        bool ttl = false;
+        __be16 tun_flags = 0;
+
+        nla_for_each_nested(a, attr, rem) {
+                int type = nla_type(a);
+                static const u32 ovs_tunnel_key_lens[OVS_TUNNEL_KEY_ATTR_MAX + 1] = {
+                        [OVS_TUNNEL_KEY_ATTR_ID] = sizeof(u64),
+                        [OVS_TUNNEL_KEY_ATTR_IPV4_SRC] = sizeof(u32),
+                        [OVS_TUNNEL_KEY_ATTR_IPV4_DST] = sizeof(u32),
+                        [OVS_TUNNEL_KEY_ATTR_TOS] = 1,
+                        [OVS_TUNNEL_KEY_ATTR_TTL] = 1,
+                        [OVS_TUNNEL_KEY_ATTR_DONT_FRAGMENT] = 0,
+                        [OVS_TUNNEL_KEY_ATTR_CSUM] = 0,
+                };
+
+                if (type > OVS_TUNNEL_KEY_ATTR_MAX) {
+                        OVS_NLERR("Unknown IPv4 tunnel attribute (type=%d, max=%d).\n",
+                        type, OVS_TUNNEL_KEY_ATTR_MAX);
                         return -EINVAL;
-                *attrs &= ~(1 << OVS_KEY_ATTR_UDP);
+                }
 
-                *key_len = SW_FLOW_KEY_OFFSET(ipv6.tp);
-                udp_key = nla_data(a[OVS_KEY_ATTR_UDP]);
-                swkey->ipv6.tp.src = udp_key->udp_src;
-                swkey->ipv6.tp.dst = udp_key->udp_dst;
-                break;
+                if (ovs_tunnel_key_lens[type] != nla_len(a)) {
+                        OVS_NLERR("IPv4 tunnel attribute type has unexpected "
+                                  " length (type=%d, length=%d, expected=%d).\n",
+                                  type, nla_len(a), ovs_tunnel_key_lens[type]);
+                        return -EINVAL;
+                }
 
-        case IPPROTO_ICMPV6:
-                if (!(*attrs & (1 << OVS_KEY_ATTR_ICMPV6)))
+                switch (type) {
+                case OVS_TUNNEL_KEY_ATTR_ID:
+                        SW_FLOW_KEY_PUT(match, tun_key.tun_id,
+                                        nla_get_be64(a), is_mask);
+                        tun_flags |= TUNNEL_KEY;
+                        break;
+                case OVS_TUNNEL_KEY_ATTR_IPV4_SRC:
+                        SW_FLOW_KEY_PUT(match, tun_key.ipv4_src,
+                                        nla_get_be32(a), is_mask);
+                        break;
+                case OVS_TUNNEL_KEY_ATTR_IPV4_DST:
+                        SW_FLOW_KEY_PUT(match, tun_key.ipv4_dst,
+                                        nla_get_be32(a), is_mask);
+                        break;
+                case OVS_TUNNEL_KEY_ATTR_TOS:
+                        SW_FLOW_KEY_PUT(match, tun_key.ipv4_tos,
+                                        nla_get_u8(a), is_mask);
+                        break;
+                case OVS_TUNNEL_KEY_ATTR_TTL:
+                        SW_FLOW_KEY_PUT(match, tun_key.ipv4_ttl,
+                                        nla_get_u8(a), is_mask);
+                        ttl = true;
+                        break;
+                case OVS_TUNNEL_KEY_ATTR_DONT_FRAGMENT:
+                        tun_flags |= TUNNEL_DONT_FRAGMENT;
+                        break;
+                case OVS_TUNNEL_KEY_ATTR_CSUM:
+                        tun_flags |= TUNNEL_CSUM;
+                        break;
+                default:
                         return -EINVAL;
-                *attrs &= ~(1 << OVS_KEY_ATTR_ICMPV6);
+                }
+        }
 
-                *key_len = SW_FLOW_KEY_OFFSET(ipv6.tp);
-                icmpv6_key = nla_data(a[OVS_KEY_ATTR_ICMPV6]);
-                swkey->ipv6.tp.src = htons(icmpv6_key->icmpv6_type);
-                swkey->ipv6.tp.dst = htons(icmpv6_key->icmpv6_code);
+        SW_FLOW_KEY_PUT(match, tun_key.tun_flags, tun_flags, is_mask);
 
-                if (swkey->ipv6.tp.src == htons(NDISC_NEIGHBOUR_SOLICITATION) ||
-                    swkey->ipv6.tp.src == htons(NDISC_NEIGHBOUR_ADVERTISEMENT)) {
-                        const struct ovs_key_nd *nd_key;
+        if (rem > 0) {
+                OVS_NLERR("IPv4 tunnel attribute has %d unknown bytes.\n", rem);
+                return -EINVAL;
+        }
 
-                        if (!(*attrs & (1 << OVS_KEY_ATTR_ND)))
-                                return -EINVAL;
-                        *attrs &= ~(1 << OVS_KEY_ATTR_ND);
-
-                        *key_len = SW_FLOW_KEY_OFFSET(ipv6.nd);
-                        nd_key = nla_data(a[OVS_KEY_ATTR_ND]);
-                        memcpy(&swkey->ipv6.nd.target, nd_key->nd_target,
-                               sizeof(swkey->ipv6.nd.target));
-                        memcpy(swkey->ipv6.nd.sll, nd_key->nd_sll, ETH_ALEN);
-                        memcpy(swkey->ipv6.nd.tll, nd_key->nd_tll, ETH_ALEN);
+        if (!is_mask) {
+                if (!match->key->tun_key.ipv4_dst) {
+                        OVS_NLERR("IPv4 tunnel destination address is zero.\n");
+                        return -EINVAL;
+                }
+
+                if (!ttl) {
+                        OVS_NLERR("IPv4 tunnel TTL not specified.\n");
+                        return -EINVAL;
                 }
-                break;
         }
 
         return 0;
 }
 
-static int parse_flow_nlattrs(const struct nlattr *attr,
-                              const struct nlattr *a[], u32 *attrsp)
+int ovs_ipv4_tun_to_nlattr(struct sk_buff *skb,
+                           const struct ovs_key_ipv4_tunnel *tun_key,
+                           const struct ovs_key_ipv4_tunnel *output)
 {
-        const struct nlattr *nla;
-        u32 attrs;
-        int rem;
+        struct nlattr *nla;
 
-        attrs = 0;
-        nla_for_each_nested(nla, attr, rem) {
-                u16 type = nla_type(nla);
-                int expected_len;
+        nla = nla_nest_start(skb, OVS_KEY_ATTR_TUNNEL);
+        if (!nla)
+                return -EMSGSIZE;
+
+        if (output->tun_flags & TUNNEL_KEY &&
+            nla_put_be64(skb, OVS_TUNNEL_KEY_ATTR_ID, output->tun_id))
+                return -EMSGSIZE;
+        if (output->ipv4_src &&
+                nla_put_be32(skb, OVS_TUNNEL_KEY_ATTR_IPV4_SRC, output->ipv4_src))
+                return -EMSGSIZE;
+        if (output->ipv4_dst &&
+                nla_put_be32(skb, OVS_TUNNEL_KEY_ATTR_IPV4_DST, output->ipv4_dst))
+                return -EMSGSIZE;
+        if (output->ipv4_tos &&
+                nla_put_u8(skb, OVS_TUNNEL_KEY_ATTR_TOS, output->ipv4_tos))
+                return -EMSGSIZE;
+        if (nla_put_u8(skb, OVS_TUNNEL_KEY_ATTR_TTL, output->ipv4_ttl))
+                return -EMSGSIZE;
+        if ((output->tun_flags & TUNNEL_DONT_FRAGMENT) &&
+                nla_put_flag(skb, OVS_TUNNEL_KEY_ATTR_DONT_FRAGMENT))
+                return -EMSGSIZE;
+        if ((output->tun_flags & TUNNEL_CSUM) &&
+                nla_put_flag(skb, OVS_TUNNEL_KEY_ATTR_CSUM))
+                return -EMSGSIZE;
+
+        nla_nest_end(skb, nla);
+        return 0;
+}
 
-                if (type > OVS_KEY_ATTR_MAX || attrs & (1 << type))
-                        return -EINVAL;
+static int metadata_from_nlattrs(struct sw_flow_match *match,  u64 *attrs,
+                const struct nlattr **a, bool is_mask)
+{
+        if (*attrs & (1 << OVS_KEY_ATTR_PRIORITY)) {
+                SW_FLOW_KEY_PUT(match, phy.priority,
+                          nla_get_u32(a[OVS_KEY_ATTR_PRIORITY]), is_mask);
+                *attrs &= ~(1 << OVS_KEY_ATTR_PRIORITY);
+        }
 
-                expected_len = ovs_key_lens[type];
-                if (nla_len(nla) != expected_len && expected_len != -1)
+        if (*attrs & (1 << OVS_KEY_ATTR_IN_PORT)) {
+                u32 in_port = nla_get_u32(a[OVS_KEY_ATTR_IN_PORT]);
+
+                if (is_mask)
+                        in_port = 0xffffffff; /* Always exact match in_port. */
+                else if (in_port >= DP_MAX_PORTS)
                         return -EINVAL;
 
-                attrs |= 1 << type;
-                a[type] = nla;
+                SW_FLOW_KEY_PUT(match, phy.in_port, in_port, is_mask);
+                *attrs &= ~(1 << OVS_KEY_ATTR_IN_PORT);
+        } else if (!is_mask) {
+                SW_FLOW_KEY_PUT(match, phy.in_port, DP_MAX_PORTS, is_mask);
         }
-        if (rem)
-                return -EINVAL;
 
-        *attrsp = attrs;
+        if (*attrs & (1 << OVS_KEY_ATTR_SKB_MARK)) {
+                uint32_t mark = nla_get_u32(a[OVS_KEY_ATTR_SKB_MARK]);
+
+                SW_FLOW_KEY_PUT(match, phy.skb_mark, mark, is_mask);
+                *attrs &= ~(1 << OVS_KEY_ATTR_SKB_MARK);
+        }
+        if (*attrs & (1 << OVS_KEY_ATTR_TUNNEL)) {
+                if (ovs_ipv4_tun_from_nlattr(a[OVS_KEY_ATTR_TUNNEL], match,
+                                        is_mask))
+                        return -EINVAL;
+                *attrs &= ~(1 << OVS_KEY_ATTR_TUNNEL);
+        }
         return 0;
 }
 
-/**
- * ovs_flow_from_nlattrs - parses Netlink attributes into a flow key.
- * @swkey: receives the extracted flow key.
- * @key_lenp: number of bytes used in @swkey.
- * @attr: Netlink attribute holding nested %OVS_KEY_ATTR_* Netlink attribute
- * sequence.
- */
-int ovs_flow_from_nlattrs(struct sw_flow_key *swkey, int *key_lenp,
-                      const struct nlattr *attr)
+static int ovs_key_from_nlattrs(struct sw_flow_match *match,  u64 attrs,
+                const struct nlattr **a, bool is_mask)
 {
-        const struct nlattr *a[OVS_KEY_ATTR_MAX + 1];
-        const struct ovs_key_ethernet *eth_key;
-        int key_len;
-        u32 attrs;
         int err;
+        u64 orig_attrs = attrs;
 
-        memset(swkey, 0, sizeof(struct sw_flow_key));
-        key_len = SW_FLOW_KEY_OFFSET(eth);
-
-        err = parse_flow_nlattrs(attr, a, &attrs);
+        err = metadata_from_nlattrs(match, &attrs, a, is_mask);
         if (err)
                 return err;
 
-        /* Metadata attributes. */
-        if (attrs & (1 << OVS_KEY_ATTR_PRIORITY)) {
-                swkey->phy.priority = nla_get_u32(a[OVS_KEY_ATTR_PRIORITY]);
-                attrs &= ~(1 << OVS_KEY_ATTR_PRIORITY);
-        }
-        if (attrs & (1 << OVS_KEY_ATTR_IN_PORT)) {
-                u32 in_port = nla_get_u32(a[OVS_KEY_ATTR_IN_PORT]);
-                if (in_port >= DP_MAX_PORTS)
-                        return -EINVAL;
-                swkey->phy.in_port = in_port;
-                attrs &= ~(1 << OVS_KEY_ATTR_IN_PORT);
-        } else {
-                swkey->phy.in_port = DP_MAX_PORTS;
-        }
-        if (attrs & (1 << OVS_KEY_ATTR_SKB_MARK)) {
-                swkey->phy.skb_mark = nla_get_u32(a[OVS_KEY_ATTR_SKB_MARK]);
-                attrs &= ~(1 << OVS_KEY_ATTR_SKB_MARK);
-        }
-
-        /* Data attributes. */
-        if (!(attrs & (1 << OVS_KEY_ATTR_ETHERNET)))
-                return -EINVAL;
-        attrs &= ~(1 << OVS_KEY_ATTR_ETHERNET);
+        if (attrs & (1 << OVS_KEY_ATTR_ETHERNET)) {
+                const struct ovs_key_ethernet *eth_key;
 
-        eth_key = nla_data(a[OVS_KEY_ATTR_ETHERNET]);
-        memcpy(swkey->eth.src, eth_key->eth_src, ETH_ALEN);
-        memcpy(swkey->eth.dst, eth_key->eth_dst, ETH_ALEN);
+                eth_key = nla_data(a[OVS_KEY_ATTR_ETHERNET]);
+                SW_FLOW_KEY_MEMCPY(match, eth.src,
+                                eth_key->eth_src, ETH_ALEN, is_mask);
+                SW_FLOW_KEY_MEMCPY(match, eth.dst,
+                                eth_key->eth_dst, ETH_ALEN, is_mask);
+                attrs &= ~(1 << OVS_KEY_ATTR_ETHERNET);
+        }
 
-        if (attrs & (1u << OVS_KEY_ATTR_ETHERTYPE) &&
-            nla_get_be16(a[OVS_KEY_ATTR_ETHERTYPE]) == htons(ETH_P_8021Q)) {
-                const struct nlattr *encap;
+        if (attrs & (1 << OVS_KEY_ATTR_VLAN)) {
                 __be16 tci;
 
-                if (attrs != ((1 << OVS_KEY_ATTR_VLAN) |
-                              (1 << OVS_KEY_ATTR_ETHERTYPE) |
-                              (1 << OVS_KEY_ATTR_ENCAP)))
-                        return -EINVAL;
-
-                encap = a[OVS_KEY_ATTR_ENCAP];
                 tci = nla_get_be16(a[OVS_KEY_ATTR_VLAN]);
-                if (tci & htons(VLAN_TAG_PRESENT)) {
-                        swkey->eth.tci = tci;
-
-                        err = parse_flow_nlattrs(encap, a, &attrs);
-                        if (err)
-                                return err;
-                } else if (!tci) {
-                        /* Corner case for truncated 802.1Q header. */
-                        if (nla_len(encap))
-                                return -EINVAL;
+                if (!(tci & htons(VLAN_TAG_PRESENT))) {
+                        if (is_mask)
+                                OVS_NLERR("VLAN TCI mask does not have exact match for VLAN_TAG_PRESENT bit.\n");
+                        else
+                                OVS_NLERR("VLAN TCI does not have VLAN_TAG_PRESENT bit set.\n");
 
-                        swkey->eth.type = htons(ETH_P_8021Q);
-                        *key_lenp = key_len;
-                        return 0;
-                } else {
                         return -EINVAL;
                 }
-        }
+
+                SW_FLOW_KEY_PUT(match, eth.tci, tci, is_mask);
+                attrs &= ~(1 << OVS_KEY_ATTR_VLAN);
+        } else if (!is_mask)
+                SW_FLOW_KEY_PUT(match, eth.tci, htons(0xffff), true);
 
         if (attrs & (1 << OVS_KEY_ATTR_ETHERTYPE)) {
-                swkey->eth.type = nla_get_be16(a[OVS_KEY_ATTR_ETHERTYPE]);
-                if (ntohs(swkey->eth.type) < ETH_P_802_3_MIN)
+                __be16 eth_type;
+
+                eth_type = nla_get_be16(a[OVS_KEY_ATTR_ETHERTYPE]);
+                if (is_mask) {
+                        /* Always exact match EtherType. */
+                        eth_type = htons(0xffff);
+                } else if (ntohs(eth_type) < ETH_P_802_3_MIN) {
+                        OVS_NLERR("EtherType is less than minimum (type=%x, min=%x).\n",
+                                        ntohs(eth_type), ETH_P_802_3_MIN);
                         return -EINVAL;
+                }
+
+                SW_FLOW_KEY_PUT(match, eth.type, eth_type, is_mask);
                 attrs &= ~(1 << OVS_KEY_ATTR_ETHERTYPE);
-        } else {
-                swkey->eth.type = htons(ETH_P_802_2);
+        } else if (!is_mask) {
+                SW_FLOW_KEY_PUT(match, eth.type, htons(ETH_P_802_2), is_mask);
         }
 
-        if (swkey->eth.type == htons(ETH_P_IP)) {
+        if (attrs & (1 << OVS_KEY_ATTR_IPV4)) {
                 const struct ovs_key_ipv4 *ipv4_key;
 
-                if (!(attrs & (1 << OVS_KEY_ATTR_IPV4)))
-                        return -EINVAL;
-                attrs &= ~(1 << OVS_KEY_ATTR_IPV4);
-
-                key_len = SW_FLOW_KEY_OFFSET(ipv4.addr);
                 ipv4_key = nla_data(a[OVS_KEY_ATTR_IPV4]);
-                if (ipv4_key->ipv4_frag > OVS_FRAG_TYPE_MAX)
+                if (!is_mask && ipv4_key->ipv4_frag > OVS_FRAG_TYPE_MAX) {
+                        OVS_NLERR("Unknown IPv4 fragment type (value=%d, max=%d).\n",
+                                ipv4_key->ipv4_frag, OVS_FRAG_TYPE_MAX);
                         return -EINVAL;
-                swkey->ip.proto = ipv4_key->ipv4_proto;
-                swkey->ip.tos = ipv4_key->ipv4_tos;
-                swkey->ip.ttl = ipv4_key->ipv4_ttl;
-                swkey->ip.frag = ipv4_key->ipv4_frag;
-                swkey->ipv4.addr.src = ipv4_key->ipv4_src;
-                swkey->ipv4.addr.dst = ipv4_key->ipv4_dst;
-
-                if (swkey->ip.frag != OVS_FRAG_TYPE_LATER) {
-                        err = ipv4_flow_from_nlattrs(swkey, &key_len, a, &attrs);
-                        if (err)
-                                return err;
                 }
-        } else if (swkey->eth.type == htons(ETH_P_IPV6)) {
-                const struct ovs_key_ipv6 *ipv6_key;
+                SW_FLOW_KEY_PUT(match, ip.proto,
+                                ipv4_key->ipv4_proto, is_mask);
+                SW_FLOW_KEY_PUT(match, ip.tos,
+                                ipv4_key->ipv4_tos, is_mask);
+                SW_FLOW_KEY_PUT(match, ip.ttl,
+                                ipv4_key->ipv4_ttl, is_mask);
+                SW_FLOW_KEY_PUT(match, ip.frag,
+                                ipv4_key->ipv4_frag, is_mask);
+                SW_FLOW_KEY_PUT(match, ipv4.addr.src,
+                                ipv4_key->ipv4_src, is_mask);
+                SW_FLOW_KEY_PUT(match, ipv4.addr.dst,
+                                ipv4_key->ipv4_dst, is_mask);
+                attrs &= ~(1 << OVS_KEY_ATTR_IPV4);
+        }
 
-                if (!(attrs & (1 << OVS_KEY_ATTR_IPV6)))
-                        return -EINVAL;
-                attrs &= ~(1 << OVS_KEY_ATTR_IPV6);
+        if (attrs & (1 << OVS_KEY_ATTR_IPV6)) {
+                const struct ovs_key_ipv6 *ipv6_key;
 
-                key_len = SW_FLOW_KEY_OFFSET(ipv6.label);
                 ipv6_key = nla_data(a[OVS_KEY_ATTR_IPV6]);
-                if (ipv6_key->ipv6_frag > OVS_FRAG_TYPE_MAX)
+                if (!is_mask && ipv6_key->ipv6_frag > OVS_FRAG_TYPE_MAX) {
+                        OVS_NLERR("Unknown IPv6 fragment type (value=%d, max=%d).\n",
+                                ipv6_key->ipv6_frag, OVS_FRAG_TYPE_MAX);
                         return -EINVAL;
-                swkey->ipv6.label = ipv6_key->ipv6_label;
-                swkey->ip.proto = ipv6_key->ipv6_proto;
-                swkey->ip.tos = ipv6_key->ipv6_tclass;
-                swkey->ip.ttl = ipv6_key->ipv6_hlimit;
-                swkey->ip.frag = ipv6_key->ipv6_frag;
-                memcpy(&swkey->ipv6.addr.src, ipv6_key->ipv6_src,
-                       sizeof(swkey->ipv6.addr.src));
-                memcpy(&swkey->ipv6.addr.dst, ipv6_key->ipv6_dst,
-                       sizeof(swkey->ipv6.addr.dst));
-
-                if (swkey->ip.frag != OVS_FRAG_TYPE_LATER) {
-                        err = ipv6_flow_from_nlattrs(swkey, &key_len, a, &attrs);
-                        if (err)
-                                return err;
                 }
-        } else if (swkey->eth.type == htons(ETH_P_ARP) ||
-                   swkey->eth.type == htons(ETH_P_RARP)) {
+                SW_FLOW_KEY_PUT(match, ipv6.label,
+                                ipv6_key->ipv6_label, is_mask);
+                SW_FLOW_KEY_PUT(match, ip.proto,
+                                ipv6_key->ipv6_proto, is_mask);
+                SW_FLOW_KEY_PUT(match, ip.tos,
+                                ipv6_key->ipv6_tclass, is_mask);
+                SW_FLOW_KEY_PUT(match, ip.ttl,
+                                ipv6_key->ipv6_hlimit, is_mask);
+                SW_FLOW_KEY_PUT(match, ip.frag,
+                                ipv6_key->ipv6_frag, is_mask);
+                SW_FLOW_KEY_MEMCPY(match, ipv6.addr.src,
+                                ipv6_key->ipv6_src,
+                                sizeof(match->key->ipv6.addr.src),
+                                is_mask);
+                SW_FLOW_KEY_MEMCPY(match, ipv6.addr.dst,
+                                ipv6_key->ipv6_dst,
+                                sizeof(match->key->ipv6.addr.dst),
+                                is_mask);
+
+                attrs &= ~(1 << OVS_KEY_ATTR_IPV6);
+        }
+
+        if (attrs & (1 << OVS_KEY_ATTR_ARP)) {
                 const struct ovs_key_arp *arp_key;
 
-                if (!(attrs & (1 << OVS_KEY_ATTR_ARP)))
+                arp_key = nla_data(a[OVS_KEY_ATTR_ARP]);
+                if (!is_mask && (arp_key->arp_op & htons(0xff00))) {
+                        OVS_NLERR("Unknown ARP opcode (opcode=%d).\n",
+                                  arp_key->arp_op);
                         return -EINVAL;
+                }
+
+                SW_FLOW_KEY_PUT(match, ipv4.addr.src,
+                                arp_key->arp_sip, is_mask);
+                SW_FLOW_KEY_PUT(match, ipv4.addr.dst,
+                        arp_key->arp_tip, is_mask);
+                SW_FLOW_KEY_PUT(match, ip.proto,
+                                ntohs(arp_key->arp_op), is_mask);
+                SW_FLOW_KEY_MEMCPY(match, ipv4.arp.sha,
+                                arp_key->arp_sha, ETH_ALEN, is_mask);
+                SW_FLOW_KEY_MEMCPY(match, ipv4.arp.tha,
+                                arp_key->arp_tha, ETH_ALEN, is_mask);
+
                 attrs &= ~(1 << OVS_KEY_ATTR_ARP);
+        }
 
-                key_len = SW_FLOW_KEY_OFFSET(ipv4.arp);
-                arp_key = nla_data(a[OVS_KEY_ATTR_ARP]);
-                swkey->ipv4.addr.src = arp_key->arp_sip;
-                swkey->ipv4.addr.dst = arp_key->arp_tip;
-                if (arp_key->arp_op & htons(0xff00))
+        if (attrs & (1 << OVS_KEY_ATTR_TCP)) {
+                const struct ovs_key_tcp *tcp_key;
+
+                tcp_key = nla_data(a[OVS_KEY_ATTR_TCP]);
+                if (orig_attrs & (1 << OVS_KEY_ATTR_IPV4)) {
+                        SW_FLOW_KEY_PUT(match, ipv4.tp.src,
+                                        tcp_key->tcp_src, is_mask);
+                        SW_FLOW_KEY_PUT(match, ipv4.tp.dst,
+                                        tcp_key->tcp_dst, is_mask);
+                } else {
+                        SW_FLOW_KEY_PUT(match, ipv6.tp.src,
+                                        tcp_key->tcp_src, is_mask);
+                        SW_FLOW_KEY_PUT(match, ipv6.tp.dst,
+                                        tcp_key->tcp_dst, is_mask);
+                }
+                attrs &= ~(1 << OVS_KEY_ATTR_TCP);
+        }
+
+        if (attrs & (1 << OVS_KEY_ATTR_UDP)) {
+                const struct ovs_key_udp *udp_key;
+
+                udp_key = nla_data(a[OVS_KEY_ATTR_UDP]);
+                if (orig_attrs & (1 << OVS_KEY_ATTR_IPV4)) {
+                        SW_FLOW_KEY_PUT(match, ipv4.tp.src,
+                                        udp_key->udp_src, is_mask);
+                        SW_FLOW_KEY_PUT(match, ipv4.tp.dst,
+                                        udp_key->udp_dst, is_mask);
+                } else {
+                        SW_FLOW_KEY_PUT(match, ipv6.tp.src,
+                                        udp_key->udp_src, is_mask);
+                        SW_FLOW_KEY_PUT(match, ipv6.tp.dst,
+                                        udp_key->udp_dst, is_mask);
+                }
+                attrs &= ~(1 << OVS_KEY_ATTR_UDP);
+        }
+
+        if (attrs & (1 << OVS_KEY_ATTR_SCTP)) {
+                const struct ovs_key_sctp *sctp_key;
+
+                sctp_key = nla_data(a[OVS_KEY_ATTR_SCTP]);
+                if (orig_attrs & (1 << OVS_KEY_ATTR_IPV4)) {
+                        SW_FLOW_KEY_PUT(match, ipv4.tp.src,
+                                        sctp_key->sctp_src, is_mask);
+                        SW_FLOW_KEY_PUT(match, ipv4.tp.dst,
+                                        sctp_key->sctp_dst, is_mask);
+                } else {
+                        SW_FLOW_KEY_PUT(match, ipv6.tp.src,
+                                        sctp_key->sctp_src, is_mask);
+                        SW_FLOW_KEY_PUT(match, ipv6.tp.dst,
+                                        sctp_key->sctp_dst, is_mask);
+                }
+                attrs &= ~(1 << OVS_KEY_ATTR_SCTP);
+        }
+
+        if (attrs & (1 << OVS_KEY_ATTR_ICMP)) {
+                const struct ovs_key_icmp *icmp_key;
+
+                icmp_key = nla_data(a[OVS_KEY_ATTR_ICMP]);
+                SW_FLOW_KEY_PUT(match, ipv4.tp.src,
+                                htons(icmp_key->icmp_type), is_mask);
+                SW_FLOW_KEY_PUT(match, ipv4.tp.dst,
+                                htons(icmp_key->icmp_code), is_mask);
+                attrs &= ~(1 << OVS_KEY_ATTR_ICMP);
+        }
+
+        if (attrs & (1 << OVS_KEY_ATTR_ICMPV6)) {
+                const struct ovs_key_icmpv6 *icmpv6_key;
+
+                icmpv6_key = nla_data(a[OVS_KEY_ATTR_ICMPV6]);
+                SW_FLOW_KEY_PUT(match, ipv6.tp.src,
+                                htons(icmpv6_key->icmpv6_type), is_mask);
+                SW_FLOW_KEY_PUT(match, ipv6.tp.dst,
+                                htons(icmpv6_key->icmpv6_code), is_mask);
+                attrs &= ~(1 << OVS_KEY_ATTR_ICMPV6);
+        }
+
+        if (attrs & (1 << OVS_KEY_ATTR_ND)) {
+                const struct ovs_key_nd *nd_key;
+
+                nd_key = nla_data(a[OVS_KEY_ATTR_ND]);
+                SW_FLOW_KEY_MEMCPY(match, ipv6.nd.target,
+                        nd_key->nd_target,
+                        sizeof(match->key->ipv6.nd.target),
+                        is_mask);
+                SW_FLOW_KEY_MEMCPY(match, ipv6.nd.sll,
+                        nd_key->nd_sll, ETH_ALEN, is_mask);
+                SW_FLOW_KEY_MEMCPY(match, ipv6.nd.tll,
+                                nd_key->nd_tll, ETH_ALEN, is_mask);
+                attrs &= ~(1 << OVS_KEY_ATTR_ND);
+        }
+
+        if (attrs != 0)
+                return -EINVAL;
+
+        return 0;
+}
+
+/**
+ * ovs_match_from_nlattrs - parses Netlink attributes into a flow key and
+ * mask. In case the 'mask' is NULL, the flow is treated as exact match
+ * flow. Otherwise, it is treated as a wildcarded flow, except the mask
+ * does not include any don't care bit.
+ * @match: receives the extracted flow match information.
+ * @key: Netlink attribute holding nested %OVS_KEY_ATTR_* Netlink attribute
+ * sequence. The fields should of the packet that triggered the creation
+ * of this flow.
+ * @mask: Optional. Netlink attribute holding nested %OVS_KEY_ATTR_* Netlink
+ * attribute specifies the mask field of the wildcarded flow.
+ */
+int ovs_match_from_nlattrs(struct sw_flow_match *match,
+                           const struct nlattr *key,
+                           const struct nlattr *mask)
+{
+        const struct nlattr *a[OVS_KEY_ATTR_MAX + 1];
+        const struct nlattr *encap;
+        u64 key_attrs = 0;
+        u64 mask_attrs = 0;
+        bool encap_valid = false;
+        int err;
+
+        err = parse_flow_nlattrs(key, a, &key_attrs);
+        if (err)
+                return err;
+
+        if ((key_attrs & (1 << OVS_KEY_ATTR_ETHERNET)) &&
+            (key_attrs & (1 << OVS_KEY_ATTR_ETHERTYPE)) &&
+            (nla_get_be16(a[OVS_KEY_ATTR_ETHERTYPE]) == htons(ETH_P_8021Q))) {
+                __be16 tci;
+
+                if (!((key_attrs & (1 << OVS_KEY_ATTR_VLAN)) &&
+                      (key_attrs & (1 << OVS_KEY_ATTR_ENCAP)))) {
+                        OVS_NLERR("Invalid Vlan frame.\n");
                         return -EINVAL;
-                swkey->ip.proto = ntohs(arp_key->arp_op);
-                memcpy(swkey->ipv4.arp.sha, arp_key->arp_sha, ETH_ALEN);
-                memcpy(swkey->ipv4.arp.tha, arp_key->arp_tha, ETH_ALEN);
+                }
+
+                key_attrs &= ~(1 << OVS_KEY_ATTR_ETHERTYPE);
+                tci = nla_get_be16(a[OVS_KEY_ATTR_VLAN]);
+                encap = a[OVS_KEY_ATTR_ENCAP];
+                key_attrs &= ~(1 << OVS_KEY_ATTR_ENCAP);
+                encap_valid = true;
+
+                if (tci & htons(VLAN_TAG_PRESENT)) {
+                        err = parse_flow_nlattrs(encap, a, &key_attrs);
+                        if (err)
+                                return err;
+                } else if (!tci) {
+                        /* Corner case for truncated 802.1Q header. */
+                        if (nla_len(encap)) {
+                                OVS_NLERR("Truncated 802.1Q header has non-zero encap attribute.\n");
+                                return -EINVAL;
+                        }
+                } else {
+                        OVS_NLERR("Encap attribute is set for a non-VLAN frame.\n");
+                        return  -EINVAL;
+                }
+        }
+
+        err = ovs_key_from_nlattrs(match, key_attrs, a, false);
+        if (err)
+                return err;
+
+        if (mask) {
+                err = parse_flow_mask_nlattrs(mask, a, &mask_attrs);
+                if (err)
+                        return err;
+
+                if (mask_attrs & 1ULL << OVS_KEY_ATTR_ENCAP)  {
+                        __be16 eth_type = 0;
+                        __be16 tci = 0;
+
+                        if (!encap_valid) {
+                                OVS_NLERR("Encap mask attribute is set for non-VLAN frame.\n");
+                                return  -EINVAL;
+                        }
+
+                        mask_attrs &= ~(1 << OVS_KEY_ATTR_ENCAP);
+                        if (a[OVS_KEY_ATTR_ETHERTYPE])
+                                eth_type = nla_get_be16(a[OVS_KEY_ATTR_ETHERTYPE]);
+
+                        if (eth_type == htons(0xffff)) {
+                                mask_attrs &= ~(1 << OVS_KEY_ATTR_ETHERTYPE);
+                                encap = a[OVS_KEY_ATTR_ENCAP];
+                                err = parse_flow_mask_nlattrs(encap, a, &mask_attrs);
+                        } else {
+                                OVS_NLERR("VLAN frames must have an exact match on the TPID (mask=%x).\n",
+                                                ntohs(eth_type));
+                                return -EINVAL;
+                        }
+
+                        if (a[OVS_KEY_ATTR_VLAN])
+                                tci = nla_get_be16(a[OVS_KEY_ATTR_VLAN]);
+
+                        if (!(tci & htons(VLAN_TAG_PRESENT))) {
+                                OVS_NLERR("VLAN tag present bit must have an exact match (tci_mask=%x).\n", ntohs(tci));
+                                return -EINVAL;
+                        }
+                }
+
+                err = ovs_key_from_nlattrs(match, mask_attrs, a, true);
+                if (err)
+                        return err;
+        } else {
+                /* Populate exact match flow's key mask. */
+                if (match->mask)
+                        ovs_sw_flow_mask_set(match->mask, &match->range, 0xff);
         }
 
-        if (attrs)
+        if (!ovs_match_validate(match, key_attrs, mask_attrs))
                 return -EINVAL;
-        *key_lenp = key_len;
 
         return 0;
 }
 
 /**
  * ovs_flow_metadata_from_nlattrs - parses Netlink attributes into a flow key.
- * @priority: receives the skb priority
- * @mark: receives the skb mark
- * @in_port: receives the extracted input port.
- * @key: Netlink attribute holding nested %OVS_KEY_ATTR_* Netlink attribute
+ * @flow: Receives extracted in_port, priority, tun_key and skb_mark.
+ * @attr: Netlink attribute holding nested %OVS_KEY_ATTR_* Netlink attribute
  * sequence.
  *
  * This parses a series of Netlink attributes that form a flow key, which must
@@ -1133,84 +1743,100 @@ int ovs_flow_from_nlattrs(struct sw_flow_key *swkey, int *key_lenp,
  * get the metadata, that is, the parts of the flow key that cannot be
  * extracted from the packet itself.
  */
-int ovs_flow_metadata_from_nlattrs(u32 *priority, u32 *mark, u16 *in_port,
-                               const struct nlattr *attr)
-{
-        const struct nlattr *nla;
-        int rem;
 
-        *in_port = DP_MAX_PORTS;
-        *priority = 0;
-        *mark = 0;
+int ovs_flow_metadata_from_nlattrs(struct sw_flow *flow,
+                const struct nlattr *attr)
+{
+        struct ovs_key_ipv4_tunnel *tun_key = &flow->key.tun_key;
+        const struct nlattr *a[OVS_KEY_ATTR_MAX + 1];
+        u64 attrs = 0;
+        int err;
+        struct sw_flow_match match;
 
-        nla_for_each_nested(nla, attr, rem) {
-                int type = nla_type(nla);
+        flow->key.phy.in_port = DP_MAX_PORTS;
+        flow->key.phy.priority = 0;
+        flow->key.phy.skb_mark = 0;
+        memset(tun_key, 0, sizeof(flow->key.tun_key));
 
-                if (type <= OVS_KEY_ATTR_MAX && ovs_key_lens[type] > 0) {
-                        if (nla_len(nla) != ovs_key_lens[type])
-                                return -EINVAL;
+        err = parse_flow_nlattrs(attr, a, &attrs);
+        if (err)
+                return -EINVAL;
 
-                        switch (type) {
-                        case OVS_KEY_ATTR_PRIORITY:
-                                *priority = nla_get_u32(nla);
-                                break;
+        memset(&match, 0, sizeof(match));
+        match.key = &flow->key;
 
-                        case OVS_KEY_ATTR_IN_PORT:
-                                if (nla_get_u32(nla) >= DP_MAX_PORTS)
-                                        return -EINVAL;
-                                *in_port = nla_get_u32(nla);
-                                break;
+        err = metadata_from_nlattrs(&match, &attrs, a, false);
+        if (err)
+                return err;
 
-                        case OVS_KEY_ATTR_SKB_MARK:
-                                *mark = nla_get_u32(nla);
-                                break;
-                        }
-                }
-        }
-        if (rem)
-                return -EINVAL;
         return 0;
 }
 
-int ovs_flow_to_nlattrs(const struct sw_flow_key *swkey, struct sk_buff *skb)
+int ovs_flow_to_nlattrs(const struct sw_flow_key *swkey,
+                const struct sw_flow_key *output, struct sk_buff *skb)
 {
         struct ovs_key_ethernet *eth_key;
         struct nlattr *nla, *encap;
+        bool is_mask = (swkey != output);
 
-        if (swkey->phy.priority &&
-            nla_put_u32(skb, OVS_KEY_ATTR_PRIORITY, swkey->phy.priority))
+        if (nla_put_u32(skb, OVS_KEY_ATTR_PRIORITY, output->phy.priority))
                 goto nla_put_failure;
 
-        if (swkey->phy.in_port != DP_MAX_PORTS &&
-            nla_put_u32(skb, OVS_KEY_ATTR_IN_PORT, swkey->phy.in_port))
+        if ((swkey->tun_key.ipv4_dst || is_mask) &&
+            ovs_ipv4_tun_to_nlattr(skb, &swkey->tun_key, &output->tun_key))
                 goto nla_put_failure;
 
-        if (swkey->phy.skb_mark &&
-            nla_put_u32(skb, OVS_KEY_ATTR_SKB_MARK, swkey->phy.skb_mark))
+        if (swkey->phy.in_port == DP_MAX_PORTS) {
+                if (is_mask && (output->phy.in_port == 0xffff))
+                        if (nla_put_u32(skb, OVS_KEY_ATTR_IN_PORT, 0xffffffff))
+                                goto nla_put_failure;
+        } else {
+                u16 upper_u16;
+                upper_u16 = !is_mask ? 0 : 0xffff;
+
+                if (nla_put_u32(skb, OVS_KEY_ATTR_IN_PORT,
+                                (upper_u16 << 16) | output->phy.in_port))
+                        goto nla_put_failure;
+        }
+
+        if (nla_put_u32(skb, OVS_KEY_ATTR_SKB_MARK, output->phy.skb_mark))
                 goto nla_put_failure;
 
         nla = nla_reserve(skb, OVS_KEY_ATTR_ETHERNET, sizeof(*eth_key));
         if (!nla)
                 goto nla_put_failure;
+
         eth_key = nla_data(nla);
-        memcpy(eth_key->eth_src, swkey->eth.src, ETH_ALEN);
-        memcpy(eth_key->eth_dst, swkey->eth.dst, ETH_ALEN);
+        memcpy(eth_key->eth_src, output->eth.src, ETH_ALEN);
+        memcpy(eth_key->eth_dst, output->eth.dst, ETH_ALEN);
 
         if (swkey->eth.tci || swkey->eth.type == htons(ETH_P_8021Q)) {
-                if (nla_put_be16(skb, OVS_KEY_ATTR_ETHERTYPE, htons(ETH_P_8021Q)) ||
-                    nla_put_be16(skb, OVS_KEY_ATTR_VLAN, swkey->eth.tci))
+                __be16 eth_type;
+                eth_type = !is_mask ? htons(ETH_P_8021Q) : htons(0xffff);
+                if (nla_put_be16(skb, OVS_KEY_ATTR_ETHERTYPE, eth_type) ||
+                    nla_put_be16(skb, OVS_KEY_ATTR_VLAN, output->eth.tci))
                         goto nla_put_failure;
                 encap = nla_nest_start(skb, OVS_KEY_ATTR_ENCAP);
                 if (!swkey->eth.tci)
                         goto unencap;
-        } else {
+        } else
                 encap = NULL;
-        }
 
-        if (swkey->eth.type == htons(ETH_P_802_2))
+        if (swkey->eth.type == htons(ETH_P_802_2)) {
+                /*
+                 * Ethertype 802.2 is represented in the netlink with omitted
+                 * OVS_KEY_ATTR_ETHERTYPE in the flow key attribute, and
+                 * 0xffff in the mask attribute.  Ethertype can also
+                 * be wildcarded.
+                 */
+                if (is_mask && output->eth.type)
+                        if (nla_put_be16(skb, OVS_KEY_ATTR_ETHERTYPE,
+                                                output->eth.type))
+                                goto nla_put_failure;
                 goto unencap;
+        }
 
-        if (nla_put_be16(skb, OVS_KEY_ATTR_ETHERTYPE, swkey->eth.type))
+        if (nla_put_be16(skb, OVS_KEY_ATTR_ETHERTYPE, output->eth.type))
                 goto nla_put_failure;
 
         if (swkey->eth.type == htons(ETH_P_IP)) {
@@ -1220,12 +1846,12 @@ int ovs_flow_to_nlattrs(const struct sw_flow_key *swkey, struct sk_buff *skb)
                 if (!nla)
                         goto nla_put_failure;
                 ipv4_key = nla_data(nla);
-                ipv4_key->ipv4_src = swkey->ipv4.addr.src;
-                ipv4_key->ipv4_dst = swkey->ipv4.addr.dst;
-                ipv4_key->ipv4_proto = swkey->ip.proto;
-                ipv4_key->ipv4_tos = swkey->ip.tos;
-                ipv4_key->ipv4_ttl = swkey->ip.ttl;
-                ipv4_key->ipv4_frag = swkey->ip.frag;
+                ipv4_key->ipv4_src = output->ipv4.addr.src;
+                ipv4_key->ipv4_dst = output->ipv4.addr.dst;
+                ipv4_key->ipv4_proto = output->ip.proto;
+                ipv4_key->ipv4_tos = output->ip.tos;
+                ipv4_key->ipv4_ttl = output->ip.ttl;
+                ipv4_key->ipv4_frag = output->ip.frag;
         } else if (swkey->eth.type == htons(ETH_P_IPV6)) {
                 struct ovs_key_ipv6 *ipv6_key;
 
@@ -1233,15 +1859,15 @@ int ovs_flow_to_nlattrs(const struct sw_flow_key *swkey, struct sk_buff *skb)
                 if (!nla)
                         goto nla_put_failure;
                 ipv6_key = nla_data(nla);
-                memcpy(ipv6_key->ipv6_src, &swkey->ipv6.addr.src,
+                memcpy(ipv6_key->ipv6_src, &output->ipv6.addr.src,
                                 sizeof(ipv6_key->ipv6_src));
-                memcpy(ipv6_key->ipv6_dst, &swkey->ipv6.addr.dst,
+                memcpy(ipv6_key->ipv6_dst, &output->ipv6.addr.dst,
                                 sizeof(ipv6_key->ipv6_dst));
-                ipv6_key->ipv6_label = swkey->ipv6.label;
-                ipv6_key->ipv6_proto = swkey->ip.proto;
-                ipv6_key->ipv6_tclass = swkey->ip.tos;
-                ipv6_key->ipv6_hlimit = swkey->ip.ttl;
-                ipv6_key->ipv6_frag = swkey->ip.frag;
+                ipv6_key->ipv6_label = output->ipv6.label;
+                ipv6_key->ipv6_proto = output->ip.proto;
+                ipv6_key->ipv6_tclass = output->ip.tos;
+                ipv6_key->ipv6_hlimit = output->ip.ttl;
+                ipv6_key->ipv6_frag = output->ip.frag;
         } else if (swkey->eth.type == htons(ETH_P_ARP) ||
                    swkey->eth.type == htons(ETH_P_RARP)) {
                 struct ovs_key_arp *arp_key;
@@ -1251,11 +1877,11 @@ int ovs_flow_to_nlattrs(const struct sw_flow_key *swkey, struct sk_buff *skb)
                         goto nla_put_failure;
                 arp_key = nla_data(nla);
                 memset(arp_key, 0, sizeof(struct ovs_key_arp));
-                arp_key->arp_sip = swkey->ipv4.addr.src;
-                arp_key->arp_tip = swkey->ipv4.addr.dst;
-                arp_key->arp_op = htons(swkey->ip.proto);
-                memcpy(arp_key->arp_sha, swkey->ipv4.arp.sha, ETH_ALEN);
-                memcpy(arp_key->arp_tha, swkey->ipv4.arp.tha, ETH_ALEN);
+                arp_key->arp_sip = output->ipv4.addr.src;
+                arp_key->arp_tip = output->ipv4.addr.dst;
+                arp_key->arp_op = htons(output->ip.proto);
+                memcpy(arp_key->arp_sha, output->ipv4.arp.sha, ETH_ALEN);
+                memcpy(arp_key->arp_tha, output->ipv4.arp.tha, ETH_ALEN);
         }
 
         if ((swkey->eth.type == htons(ETH_P_IP) ||
@@ -1270,11 +1896,11 @@ int ovs_flow_to_nlattrs(const struct sw_flow_key *swkey, struct sk_buff *skb)
                                 goto nla_put_failure;
                         tcp_key = nla_data(nla);
                         if (swkey->eth.type == htons(ETH_P_IP)) {
-                                tcp_key->tcp_src = swkey->ipv4.tp.src;
-                                tcp_key->tcp_dst = swkey->ipv4.tp.dst;
+                                tcp_key->tcp_src = output->ipv4.tp.src;
+                                tcp_key->tcp_dst = output->ipv4.tp.dst;
                         } else if (swkey->eth.type == htons(ETH_P_IPV6)) {
-                                tcp_key->tcp_src = swkey->ipv6.tp.src;
-                                tcp_key->tcp_dst = swkey->ipv6.tp.dst;
+                                tcp_key->tcp_src = output->ipv6.tp.src;
+                                tcp_key->tcp_dst = output->ipv6.tp.dst;
                         }
                 } else if (swkey->ip.proto == IPPROTO_UDP) {
                         struct ovs_key_udp *udp_key;
@@ -1284,11 +1910,25 @@ int ovs_flow_to_nlattrs(const struct sw_flow_key *swkey, struct sk_buff *skb)
                                 goto nla_put_failure;
                         udp_key = nla_data(nla);
                         if (swkey->eth.type == htons(ETH_P_IP)) {
-                                udp_key->udp_src = swkey->ipv4.tp.src;
-                                udp_key->udp_dst = swkey->ipv4.tp.dst;
+                                udp_key->udp_src = output->ipv4.tp.src;
+                                udp_key->udp_dst = output->ipv4.tp.dst;
+                        } else if (swkey->eth.type == htons(ETH_P_IPV6)) {
+                                udp_key->udp_src = output->ipv6.tp.src;
+                                udp_key->udp_dst = output->ipv6.tp.dst;
+                        }
+                } else if (swkey->ip.proto == IPPROTO_SCTP) {
+                        struct ovs_key_sctp *sctp_key;
+
+                        nla = nla_reserve(skb, OVS_KEY_ATTR_SCTP, sizeof(*sctp_key));
+                        if (!nla)
+                                goto nla_put_failure;
+                        sctp_key = nla_data(nla);
+                        if (swkey->eth.type == htons(ETH_P_IP)) {
+                                sctp_key->sctp_src = swkey->ipv4.tp.src;
+                                sctp_key->sctp_dst = swkey->ipv4.tp.dst;
                         } else if (swkey->eth.type == htons(ETH_P_IPV6)) {
-                                udp_key->udp_src = swkey->ipv6.tp.src;
-                                udp_key->udp_dst = swkey->ipv6.tp.dst;
+                                sctp_key->sctp_src = swkey->ipv6.tp.src;
+                                sctp_key->sctp_dst = swkey->ipv6.tp.dst;
                         }
                 } else if (swkey->eth.type == htons(ETH_P_IP) &&
                            swkey->ip.proto == IPPROTO_ICMP) {
@@ -1298,8 +1938,8 @@ int ovs_flow_to_nlattrs(const struct sw_flow_key *swkey, struct sk_buff *skb)
                         if (!nla)
                                 goto nla_put_failure;
                         icmp_key = nla_data(nla);
-                        icmp_key->icmp_type = ntohs(swkey->ipv4.tp.src);
-                        icmp_key->icmp_code = ntohs(swkey->ipv4.tp.dst);
+                        icmp_key->icmp_type = ntohs(output->ipv4.tp.src);
+                        icmp_key->icmp_code = ntohs(output->ipv4.tp.dst);
                 } else if (swkey->eth.type == htons(ETH_P_IPV6) &&
                            swkey->ip.proto == IPPROTO_ICMPV6) {
                         struct ovs_key_icmpv6 *icmpv6_key;
@@ -1309,8 +1949,8 @@ int ovs_flow_to_nlattrs(const struct sw_flow_key *swkey, struct sk_buff *skb)
                         if (!nla)
                                 goto nla_put_failure;
                         icmpv6_key = nla_data(nla);
-                        icmpv6_key->icmpv6_type = ntohs(swkey->ipv6.tp.src);
-                        icmpv6_key->icmpv6_code = ntohs(swkey->ipv6.tp.dst);
+                        icmpv6_key->icmpv6_type = ntohs(output->ipv6.tp.src);
+                        icmpv6_key->icmpv6_code = ntohs(output->ipv6.tp.dst);
 
                         if (icmpv6_key->icmpv6_type == NDISC_NEIGHBOUR_SOLICITATION ||
                             icmpv6_key->icmpv6_type == NDISC_NEIGHBOUR_ADVERTISEMENT) {
@@ -1320,10 +1960,10 @@ int ovs_flow_to_nlattrs(const struct sw_flow_key *swkey, struct sk_buff *skb)
                                 if (!nla)
                                         goto nla_put_failure;
                                 nd_key = nla_data(nla);
-                                memcpy(nd_key->nd_target, &swkey->ipv6.nd.target,
+                                memcpy(nd_key->nd_target, &output->ipv6.nd.target,
                                                         sizeof(nd_key->nd_target));
-                                memcpy(nd_key->nd_sll, swkey->ipv6.nd.sll, ETH_ALEN);
-                                memcpy(nd_key->nd_tll, swkey->ipv6.nd.tll, ETH_ALEN);
+                                memcpy(nd_key->nd_sll, output->ipv6.nd.sll, ETH_ALEN);
+                                memcpy(nd_key->nd_tll, output->ipv6.nd.tll, ETH_ALEN);
                         }
                 }
         }
@@ -1342,6 +1982,9 @@ nla_put_failure:
  * Returns zero if successful or a negative error code. */
 int ovs_flow_init(void)
 {
+        BUILD_BUG_ON(__alignof__(struct sw_flow_key) % __alignof__(long));
+        BUILD_BUG_ON(sizeof(struct sw_flow_key) % sizeof(long));
+
         flow_cache = kmem_cache_create("sw_flow", sizeof(struct sw_flow), 0,
                                         0, NULL);
         if (flow_cache == NULL)
@@ -1355,3 +1998,84 @@ void ovs_flow_exit(void)
 {
         kmem_cache_destroy(flow_cache);
 }
+
+struct sw_flow_mask *ovs_sw_flow_mask_alloc(void)
+{
+        struct sw_flow_mask *mask;
+
+        mask = kmalloc(sizeof(*mask), GFP_KERNEL);
+        if (mask)
+                mask->ref_count = 0;
+
+        return mask;
+}
+
+void ovs_sw_flow_mask_add_ref(struct sw_flow_mask *mask)
+{
+        mask->ref_count++;
+}
+
+void ovs_sw_flow_mask_del_ref(struct sw_flow_mask *mask, bool deferred)
+{
+        if (!mask)
+                return;
+
+        BUG_ON(!mask->ref_count);
+        mask->ref_count--;
+
+        if (!mask->ref_count) {
+                list_del_rcu(&mask->list);
+                if (deferred)
+                        kfree_rcu(mask, rcu);
+                else
+                        kfree(mask);
+        }
+}
+
+static bool ovs_sw_flow_mask_equal(const struct sw_flow_mask *a,
+                const struct sw_flow_mask *b)
+{
+        u8 *a_ = (u8 *)&a->key + a->range.start;
+        u8 *b_ = (u8 *)&b->key + b->range.start;
+
+        return  (a->range.end == b->range.end)
+                && (a->range.start == b->range.start)
+                && (memcmp(a_, b_, range_n_bytes(&a->range)) == 0);
+}
+
+struct sw_flow_mask *ovs_sw_flow_mask_find(const struct flow_table *tbl,
+                                           const struct sw_flow_mask *mask)
+{
+        struct list_head *ml;
+
+        list_for_each(ml, tbl->mask_list) {
+                struct sw_flow_mask *m;
+                m = container_of(ml, struct sw_flow_mask, list);
+                if (ovs_sw_flow_mask_equal(mask, m))
+                        return m;
+        }
+
+        return NULL;
+}
+
+/**
+ * add a new mask into the mask list.
+ * The caller needs to make sure that 'mask' is not the same
+ * as any masks that are already on the list.
+ */
+void ovs_sw_flow_mask_insert(struct flow_table *tbl, struct sw_flow_mask *mask)
+{
+        list_add_rcu(&mask->list, tbl->mask_list);
+}
+
+/**
+ * Set 'range' fields in the mask to the value of 'val'.
+ */
+static void ovs_sw_flow_mask_set(struct sw_flow_mask *mask,
+                struct sw_flow_key_range *range, u8 val)
+{
+        u8 *m = (u8 *)&mask->key + range->start;
+
+        mask->range = *range;
+        memset(m, val, range_n_bytes(range));
+}
diff --git a/net/openvswitch/flow.h b/net/openvswitch/flow.h
index 0875fde65b9c..212fbf7510c4 100644
--- a/net/openvswitch/flow.h
+++ b/net/openvswitch/flow.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2007-2011 Nicira, Inc.
+ * Copyright (c) 2007-2013 Nicira, Inc.
  *
  * This program is free software; you can redistribute it and/or
  * modify it under the terms of version 2 of the GNU General Public
@@ -33,6 +33,8 @@
 #include <net/inet_ecn.h>
 
 struct sk_buff;
+struct sw_flow_mask;
+struct flow_table;
 
 struct sw_flow_actions {
         struct rcu_head rcu;
@@ -40,7 +42,38 @@ struct sw_flow_actions {
         struct nlattr actions[];
 };
 
+/* Used to memset ovs_key_ipv4_tunnel padding. */
+#define OVS_TUNNEL_KEY_SIZE                                     \
+        (offsetof(struct ovs_key_ipv4_tunnel, ipv4_ttl) +       \
+        FIELD_SIZEOF(struct ovs_key_ipv4_tunnel, ipv4_ttl))
+
+struct ovs_key_ipv4_tunnel {
+        __be64 tun_id;
+        __be32 ipv4_src;
+        __be32 ipv4_dst;
+        __be16 tun_flags;
+        u8   ipv4_tos;
+        u8   ipv4_ttl;
+};
+
+static inline void ovs_flow_tun_key_init(struct ovs_key_ipv4_tunnel *tun_key,
+                                         const struct iphdr *iph, __be64 tun_id,
+                                         __be16 tun_flags)
+{
+        tun_key->tun_id = tun_id;
+        tun_key->ipv4_src = iph->saddr;
+        tun_key->ipv4_dst = iph->daddr;
+        tun_key->ipv4_tos = iph->tos;
+        tun_key->ipv4_ttl = iph->ttl;
+        tun_key->tun_flags = tun_flags;
+
+        /* clear struct padding. */
+        memset((unsigned char *) tun_key + OVS_TUNNEL_KEY_SIZE, 0,
+               sizeof(*tun_key) - OVS_TUNNEL_KEY_SIZE);
+}
+
 struct sw_flow_key {
+        struct ovs_key_ipv4_tunnel tun_key;  /* Encapsulating tunnel key. */
         struct {
                 u32     priority;       /* Packet QoS priority. */
                 u32     skb_mark;       /* SKB mark. */
@@ -66,8 +99,8 @@ struct sw_flow_key {
                         } addr;
                         union {
                                 struct {
-                                        __be16 src;             /* TCP/UDP source port. */
-                                        __be16 dst;             /* TCP/UDP destination port. */
+                                        __be16 src;             /* TCP/UDP/SCTP source port. */
+                                        __be16 dst;             /* TCP/UDP/SCTP destination port. */
                                 } tp;
                                 struct {
                                         u8 sha[ETH_ALEN];       /* ARP source hardware address. */
@@ -82,8 +115,8 @@ struct sw_flow_key {
                         } addr;
                         __be32 label;                   /* IPv6 flow label. */
                         struct {
-                                __be16 src;             /* TCP/UDP source port. */
-                                __be16 dst;             /* TCP/UDP destination port. */
+                                __be16 src;             /* TCP/UDP/SCTP source port. */
+                                __be16 dst;             /* TCP/UDP/SCTP destination port. */
                         } tp;
                         struct {
                                 struct in6_addr target; /* ND target address. */
@@ -92,7 +125,7 @@ struct sw_flow_key {
                         } nd;
                 } ipv6;
         };
-};
+} __aligned(BITS_PER_LONG/8); /* Ensure that we can do comparisons as longs. */
 
 struct sw_flow {
         struct rcu_head rcu;
@@ -100,6 +133,8 @@ struct sw_flow {
         u32 hash;
 
         struct sw_flow_key key;
+        struct sw_flow_key unmasked_key;
+        struct sw_flow_mask *mask;
         struct sw_flow_actions __rcu *sf_acts;
 
         spinlock_t lock;        /* Lock for values below. */
@@ -109,6 +144,20 @@ struct sw_flow {
         u8 tcp_flags;           /* Union of seen TCP flags. */
 };
 
+struct sw_flow_key_range {
+        size_t start;
+        size_t end;
+};
+
+struct sw_flow_match {
+        struct sw_flow_key *key;
+        struct sw_flow_key_range range;
+        struct sw_flow_mask *mask;
+};
+
+void ovs_match_init(struct sw_flow_match *match,
+                struct sw_flow_key *key, struct sw_flow_mask *mask);
+
 struct arp_eth_header {
         __be16      ar_hrd;     /* format of hardware address   */
         __be16      ar_pro;     /* format of protocol address   */
@@ -128,29 +177,30 @@ void ovs_flow_exit(void);
 
 struct sw_flow *ovs_flow_alloc(void);
 void ovs_flow_deferred_free(struct sw_flow *);
-void ovs_flow_free(struct sw_flow *flow);
+void ovs_flow_free(struct sw_flow *, bool deferred);
 
-struct sw_flow_actions *ovs_flow_actions_alloc(const struct nlattr *);
+struct sw_flow_actions *ovs_flow_actions_alloc(int actions_len);
 void ovs_flow_deferred_free_acts(struct sw_flow_actions *);
 
-int ovs_flow_extract(struct sk_buff *, u16 in_port, struct sw_flow_key *,
-                     int *key_lenp);
+int ovs_flow_extract(struct sk_buff *, u16 in_port, struct sw_flow_key *);
 void ovs_flow_used(struct sw_flow *, struct sk_buff *);
 u64 ovs_flow_used_time(unsigned long flow_jiffies);
-
-int ovs_flow_to_nlattrs(const struct sw_flow_key *, struct sk_buff *);
-int ovs_flow_from_nlattrs(struct sw_flow_key *swkey, int *key_lenp,
+int ovs_flow_to_nlattrs(const struct sw_flow_key *,
+                const struct sw_flow_key *, struct sk_buff *);
+int ovs_match_from_nlattrs(struct sw_flow_match *match,
+                      const struct nlattr *,
                       const struct nlattr *);
-int ovs_flow_metadata_from_nlattrs(u32 *priority, u32 *mark, u16 *in_port,
-                               const struct nlattr *);
+int ovs_flow_metadata_from_nlattrs(struct sw_flow *flow,
+                const struct nlattr *attr);
 
-#define MAX_ACTIONS_BUFSIZE    (16 * 1024)
+#define MAX_ACTIONS_BUFSIZE    (32 * 1024)
 #define TBL_MIN_BUCKETS         1024
 
 struct flow_table {
         struct flex_array *buckets;
         unsigned int count, n_buckets;
         struct rcu_head rcu;
+        struct list_head *mask_list;
         int node_ver;
         u32 hash_seed;
         bool keep_flows;
@@ -166,18 +216,44 @@ static inline int ovs_flow_tbl_need_to_expand(struct flow_table *table)
         return (table->count > table->n_buckets);
 }
 
-struct sw_flow *ovs_flow_tbl_lookup(struct flow_table *table,
-                                    struct sw_flow_key *key, int len);
-void ovs_flow_tbl_destroy(struct flow_table *table);
-void ovs_flow_tbl_deferred_destroy(struct flow_table *table);
+struct sw_flow *ovs_flow_lookup(struct flow_table *,
+                                const struct sw_flow_key *);
+struct sw_flow *ovs_flow_lookup_unmasked_key(struct flow_table *table,
+                                    struct sw_flow_match *match);
+
+void ovs_flow_tbl_destroy(struct flow_table *table, bool deferred);
 struct flow_table *ovs_flow_tbl_alloc(int new_size);
 struct flow_table *ovs_flow_tbl_expand(struct flow_table *table);
 struct flow_table *ovs_flow_tbl_rehash(struct flow_table *table);
-void ovs_flow_tbl_insert(struct flow_table *table, struct sw_flow *flow);
-void ovs_flow_tbl_remove(struct flow_table *table, struct sw_flow *flow);
-u32 ovs_flow_hash(const struct sw_flow_key *key, int key_len);
 
-struct sw_flow *ovs_flow_tbl_next(struct flow_table *table, u32 *bucket, u32 *idx);
+void ovs_flow_insert(struct flow_table *table, struct sw_flow *flow);
+void ovs_flow_remove(struct flow_table *table, struct sw_flow *flow);
+
+struct sw_flow *ovs_flow_dump_next(struct flow_table *table, u32 *bucket, u32 *idx);
 extern const int ovs_key_lens[OVS_KEY_ATTR_MAX + 1];
+int ovs_ipv4_tun_from_nlattr(const struct nlattr *attr,
+                             struct sw_flow_match *match, bool is_mask);
+int ovs_ipv4_tun_to_nlattr(struct sk_buff *skb,
+                           const struct ovs_key_ipv4_tunnel *tun_key,
+                           const struct ovs_key_ipv4_tunnel *output);
+
+bool ovs_flow_cmp_unmasked_key(const struct sw_flow *flow,
+                const struct sw_flow_key *key, int key_end);
+
+struct sw_flow_mask {
+        int ref_count;
+        struct rcu_head rcu;
+        struct list_head list;
+        struct sw_flow_key_range range;
+        struct sw_flow_key key;
+};
 
+struct sw_flow_mask *ovs_sw_flow_mask_alloc(void);
+void ovs_sw_flow_mask_add_ref(struct sw_flow_mask *);
+void ovs_sw_flow_mask_del_ref(struct sw_flow_mask *, bool deferred);
+void ovs_sw_flow_mask_insert(struct flow_table *, struct sw_flow_mask *);
+struct sw_flow_mask *ovs_sw_flow_mask_find(const struct flow_table *,
+                const struct sw_flow_mask *);
+void ovs_flow_key_mask(struct sw_flow_key *dst, const struct sw_flow_key *src,
+                       const struct sw_flow_mask *mask);
 #endif /* flow.h */
diff --git a/net/openvswitch/vport-gre.c b/net/openvswitch/vport-gre.c
new file mode 100644
index 000000000000..c99dea543d64
--- /dev/null
+++ b/net/openvswitch/vport-gre.c
@@ -0,0 +1,272 @@
+/*
+ * Copyright (c) 2007-2013 Nicira, Inc.
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of version 2 of the GNU General Public
+ * License as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
+ * 02110-1301, USA
+ */
+
+#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
+
+#include <linux/if.h>
+#include <linux/skbuff.h>
+#include <linux/ip.h>
+#include <linux/if_tunnel.h>
+#include <linux/if_vlan.h>
+#include <linux/in.h>
+#include <linux/if_vlan.h>
+#include <linux/in.h>
+#include <linux/in_route.h>
+#include <linux/inetdevice.h>
+#include <linux/jhash.h>
+#include <linux/list.h>
+#include <linux/kernel.h>
+#include <linux/workqueue.h>
+#include <linux/rculist.h>
+#include <net/route.h>
+#include <net/xfrm.h>
+
+#include <net/icmp.h>
+#include <net/ip.h>
+#include <net/ip_tunnels.h>
+#include <net/gre.h>
+#include <net/net_namespace.h>
+#include <net/netns/generic.h>
+#include <net/protocol.h>
+
+#include "datapath.h"
+#include "vport.h"
+
+/* Returns the least-significant 32 bits of a __be64. */
+static __be32 be64_get_low32(__be64 x)
+{
+#ifdef __BIG_ENDIAN
+        return (__force __be32)x;
+#else
+        return (__force __be32)((__force u64)x >> 32);
+#endif
+}
+
+static __be16 filter_tnl_flags(__be16 flags)
+{
+        return flags & (TUNNEL_CSUM | TUNNEL_KEY);
+}
+
+static struct sk_buff *__build_header(struct sk_buff *skb,
+                                      int tunnel_hlen)
+{
+        const struct ovs_key_ipv4_tunnel *tun_key = OVS_CB(skb)->tun_key;
+        struct tnl_ptk_info tpi;
+
+        skb = gre_handle_offloads(skb, !!(tun_key->tun_flags & TUNNEL_CSUM));
+        if (IS_ERR(skb))
+                return NULL;
+
+        tpi.flags = filter_tnl_flags(tun_key->tun_flags);
+        tpi.proto = htons(ETH_P_TEB);
+        tpi.key = be64_get_low32(tun_key->tun_id);
+        tpi.seq = 0;
+        gre_build_header(skb, &tpi, tunnel_hlen);
+
+        return skb;
+}
+
+static __be64 key_to_tunnel_id(__be32 key, __be32 seq)
+{
+#ifdef __BIG_ENDIAN
+        return (__force __be64)((__force u64)seq << 32 | (__force u32)key);
+#else
+        return (__force __be64)((__force u64)key << 32 | (__force u32)seq);
+#endif
+}
+
+/* Called with rcu_read_lock and BH disabled. */
+static int gre_rcv(struct sk_buff *skb,
+                   const struct tnl_ptk_info *tpi)
+{
+        struct ovs_key_ipv4_tunnel tun_key;
+        struct ovs_net *ovs_net;
+        struct vport *vport;
+        __be64 key;
+
+        ovs_net = net_generic(dev_net(skb->dev), ovs_net_id);
+        vport = rcu_dereference(ovs_net->vport_net.gre_vport);
+        if (unlikely(!vport))
+                return PACKET_REJECT;
+
+        key = key_to_tunnel_id(tpi->key, tpi->seq);
+        ovs_flow_tun_key_init(&tun_key, ip_hdr(skb), key,
+                              filter_tnl_flags(tpi->flags));
+
+        ovs_vport_receive(vport, skb, &tun_key);
+        return PACKET_RCVD;
+}
+
+static int gre_tnl_send(struct vport *vport, struct sk_buff *skb)
+{
+        struct net *net = ovs_dp_get_net(vport->dp);
+        struct flowi4 fl;
+        struct rtable *rt;
+        int min_headroom;
+        int tunnel_hlen;
+        __be16 df;
+        int err;
+
+        if (unlikely(!OVS_CB(skb)->tun_key)) {
+                err = -EINVAL;
+                goto error;
+        }
+
+        /* Route lookup */
+        memset(&fl, 0, sizeof(fl));
+        fl.daddr = OVS_CB(skb)->tun_key->ipv4_dst;
+        fl.saddr = OVS_CB(skb)->tun_key->ipv4_src;
+        fl.flowi4_tos = RT_TOS(OVS_CB(skb)->tun_key->ipv4_tos);
+        fl.flowi4_mark = skb->mark;
+        fl.flowi4_proto = IPPROTO_GRE;
+
+        rt = ip_route_output_key(net, &fl);
+        if (IS_ERR(rt))
+                return PTR_ERR(rt);
+
+        tunnel_hlen = ip_gre_calc_hlen(OVS_CB(skb)->tun_key->tun_flags);
+
+        min_headroom = LL_RESERVED_SPACE(rt->dst.dev) + rt->dst.header_len
+                        + tunnel_hlen + sizeof(struct iphdr)
+                        + (vlan_tx_tag_present(skb) ? VLAN_HLEN : 0);
+        if (skb_headroom(skb) < min_headroom || skb_header_cloned(skb)) {
+                int head_delta = SKB_DATA_ALIGN(min_headroom -
+                                                skb_headroom(skb) +
+                                                16);
+                err = pskb_expand_head(skb, max_t(int, head_delta, 0),
+                                        0, GFP_ATOMIC);
+                if (unlikely(err))
+                        goto err_free_rt;
+        }
+
+        if (vlan_tx_tag_present(skb)) {
+                if (unlikely(!__vlan_put_tag(skb,
+                                             skb->vlan_proto,
+                                             vlan_tx_tag_get(skb)))) {
+                        err = -ENOMEM;
+                        goto err_free_rt;
+                }
+                skb->vlan_tci = 0;
+        }
+
+        /* Push Tunnel header. */
+        skb = __build_header(skb, tunnel_hlen);
+        if (unlikely(!skb)) {
+                err = 0;
+                goto err_free_rt;
+        }
+
+        df = OVS_CB(skb)->tun_key->tun_flags & TUNNEL_DONT_FRAGMENT ?
+                htons(IP_DF) : 0;
+
+        skb->local_df = 1;
+
+        return iptunnel_xmit(rt, skb, fl.saddr,
+                             OVS_CB(skb)->tun_key->ipv4_dst, IPPROTO_GRE,
+                             OVS_CB(skb)->tun_key->ipv4_tos,
+                             OVS_CB(skb)->tun_key->ipv4_ttl, df, false);
+err_free_rt:
+        ip_rt_put(rt);
+error:
+        return err;
+}
+
+static struct gre_cisco_protocol gre_protocol = {
+        .handler        = gre_rcv,
+        .priority       = 1,
+};
+
+static int gre_ports;
+static int gre_init(void)
+{
+        int err;
+
+        gre_ports++;
+        if (gre_ports > 1)
+                return 0;
+
+        err = gre_cisco_register(&gre_protocol);
+        if (err)
+                pr_warn("cannot register gre protocol handler\n");
+
+        return err;
+}
+
+static void gre_exit(void)
+{
+        gre_ports--;
+        if (gre_ports > 0)
+                return;
+
+        gre_cisco_unregister(&gre_protocol);
+}
+
+static const char *gre_get_name(const struct vport *vport)
+{
+        return vport_priv(vport);
+}
+
+static struct vport *gre_create(const struct vport_parms *parms)
+{
+        struct net *net = ovs_dp_get_net(parms->dp);
+        struct ovs_net *ovs_net;
+        struct vport *vport;
+        int err;
+
+        err = gre_init();
+        if (err)
+                return ERR_PTR(err);
+
+        ovs_net = net_generic(net, ovs_net_id);
+        if (ovsl_dereference(ovs_net->vport_net.gre_vport)) {
+                vport = ERR_PTR(-EEXIST);
+                goto error;
+        }
+
+        vport = ovs_vport_alloc(IFNAMSIZ, &ovs_gre_vport_ops, parms);
+        if (IS_ERR(vport))
+                goto error;
+
+        strncpy(vport_priv(vport), parms->name, IFNAMSIZ);
+        rcu_assign_pointer(ovs_net->vport_net.gre_vport, vport);
+        return vport;
+
+error:
+        gre_exit();
+        return vport;
+}
+
+static void gre_tnl_destroy(struct vport *vport)
+{
+        struct net *net = ovs_dp_get_net(vport->dp);
+        struct ovs_net *ovs_net;
+
+        ovs_net = net_generic(net, ovs_net_id);
+
+        rcu_assign_pointer(ovs_net->vport_net.gre_vport, NULL);
+        ovs_vport_deferred_free(vport);
+        gre_exit();
+}
+
+const struct vport_ops ovs_gre_vport_ops = {
+        .type           = OVS_VPORT_TYPE_GRE,
+        .create         = gre_create,
+        .destroy        = gre_tnl_destroy,
+        .get_name       = gre_get_name,
+        .send           = gre_tnl_send,
+};
diff --git a/net/openvswitch/vport-internal_dev.c b/net/openvswitch/vport-internal_dev.c
index 84e0a0379186..98d3edbbc235 100644
--- a/net/openvswitch/vport-internal_dev.c
+++ b/net/openvswitch/vport-internal_dev.c
@@ -67,7 +67,7 @@ static struct rtnl_link_stats64 *internal_dev_get_stats(struct net_device *netde
 static int internal_dev_xmit(struct sk_buff *skb, struct net_device *netdev)
 {
         rcu_read_lock();
-        ovs_vport_receive(internal_dev_priv(netdev)->vport, skb);
+        ovs_vport_receive(internal_dev_priv(netdev)->vport, skb, NULL);
         rcu_read_unlock();
         return 0;
 }
@@ -221,6 +221,7 @@ static int internal_dev_recv(struct vport *vport, struct sk_buff *skb)
         skb->dev = netdev;
         skb->pkt_type = PACKET_HOST;
         skb->protocol = eth_type_trans(skb, netdev);
+        skb_postpull_rcsum(skb, eth_hdr(skb), ETH_HLEN);
 
         netif_rx(skb);
 
diff --git a/net/openvswitch/vport-netdev.c b/net/openvswitch/vport-netdev.c
index 4f01c6d2ffa4..09d93c13cfd6 100644
--- a/net/openvswitch/vport-netdev.c
+++ b/net/openvswitch/vport-netdev.c
@@ -25,6 +25,7 @@
 #include <linux/llc.h>
 #include <linux/rtnetlink.h>
 #include <linux/skbuff.h>
+#include <linux/openvswitch.h>
 
 #include <net/llc.h>
 
@@ -49,7 +50,9 @@ static void netdev_port_receive(struct vport *vport, struct sk_buff *skb)
                 return;
 
         skb_push(skb, ETH_HLEN);
-        ovs_vport_receive(vport, skb);
+        ovs_skb_postpush_rcsum(skb, skb->data, ETH_HLEN);
+
+        ovs_vport_receive(vport, skb, NULL);
         return;
 
 error:
@@ -72,6 +75,15 @@ static rx_handler_result_t netdev_frame_hook(struct sk_buff **pskb)
         return RX_HANDLER_CONSUMED;
 }
 
+static struct net_device *get_dpdev(struct datapath *dp)
+{
+        struct vport *local;
+
+        local = ovs_vport_ovsl(dp, OVSP_LOCAL);
+        BUG_ON(!local);
+        return netdev_vport_priv(local)->dev;
+}
+
 static struct vport *netdev_create(const struct vport_parms *parms)
 {
         struct vport *vport;
@@ -101,10 +113,15 @@ static struct vport *netdev_create(const struct vport_parms *parms)
         }
 
         rtnl_lock();
+        err = netdev_master_upper_dev_link(netdev_vport->dev,
+                                           get_dpdev(vport->dp));
+        if (err)
+                goto error_unlock;
+
         err = netdev_rx_handler_register(netdev_vport->dev, netdev_frame_hook,
                                          vport);
         if (err)
-                goto error_unlock;
+                goto error_master_upper_dev_unlink;
 
         dev_set_promiscuity(netdev_vport->dev, 1);
         netdev_vport->dev->priv_flags |= IFF_OVS_DATAPATH;
@@ -112,6 +129,8 @@ static struct vport *netdev_create(const struct vport_parms *parms)
 
         return vport;
 
+error_master_upper_dev_unlink:
+        netdev_upper_dev_unlink(netdev_vport->dev, get_dpdev(vport->dp));
 error_unlock:
         rtnl_unlock();
 error_put:
@@ -138,6 +157,7 @@ static void netdev_destroy(struct vport *vport)
         rtnl_lock();
         netdev_vport->dev->priv_flags &= ~IFF_OVS_DATAPATH;
         netdev_rx_handler_unregister(netdev_vport->dev);
+        netdev_upper_dev_unlink(netdev_vport->dev, get_dpdev(vport->dp));
         dev_set_promiscuity(netdev_vport->dev, -1);
         rtnl_unlock();
 
@@ -170,7 +190,7 @@ static int netdev_send(struct vport *vport, struct sk_buff *skb)
                 net_warn_ratelimited("%s: dropped over-mtu packet: %d > %d\n",
                                      netdev_vport->dev->name,
                                      packet_length(skb), mtu);
-                goto error;
+                goto drop;
         }
 
         skb->dev = netdev_vport->dev;
@@ -179,9 +199,8 @@ static int netdev_send(struct vport *vport, struct sk_buff *skb)
 
         return len;
 
-error:
+drop:
         kfree_skb(skb);
-        ovs_vport_record_error(vport, VPORT_E_TX_DROPPED);
         return 0;
 }
 
diff --git a/net/openvswitch/vport-netdev.h b/net/openvswitch/vport-netdev.h
index a3cb3a32cd77..dd298b5c5cdb 100644
--- a/net/openvswitch/vport-netdev.h
+++ b/net/openvswitch/vport-netdev.h
@@ -39,6 +39,5 @@ netdev_vport_priv(const struct vport *vport)
 }
 
 const char *ovs_netdev_get_name(const struct vport *);
-const char *ovs_netdev_get_config(const struct vport *);
 
 #endif /* vport_netdev.h */
diff --git a/net/openvswitch/vport-vxlan.c b/net/openvswitch/vport-vxlan.c
new file mode 100644
index 000000000000..a481c03e2861
--- /dev/null
+++ b/net/openvswitch/vport-vxlan.c
@@ -0,0 +1,204 @@
+/*
+ * Copyright (c) 2013 Nicira, Inc.
+ * Copyright (c) 2013 Cisco Systems, Inc.
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of version 2 of the GNU General Public
+ * License as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
+ * 02110-1301, USA
+ */
+
+#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
+
+#include <linux/in.h>
+#include <linux/ip.h>
+#include <linux/net.h>
+#include <linux/rculist.h>
+#include <linux/udp.h>
+
+#include <net/icmp.h>
+#include <net/ip.h>
+#include <net/udp.h>
+#include <net/ip_tunnels.h>
+#include <net/udp.h>
+#include <net/rtnetlink.h>
+#include <net/route.h>
+#include <net/dsfield.h>
+#include <net/inet_ecn.h>
+#include <net/net_namespace.h>
+#include <net/netns/generic.h>
+#include <net/vxlan.h>
+
+#include "datapath.h"
+#include "vport.h"
+
+/**
+ * struct vxlan_port - Keeps track of open UDP ports
+ * @vs: vxlan_sock created for the port.
+ * @name: vport name.
+ */
+struct vxlan_port {
+        struct vxlan_sock *vs;
+        char name[IFNAMSIZ];
+};
+
+static inline struct vxlan_port *vxlan_vport(const struct vport *vport)
+{
+        return vport_priv(vport);
+}
+
+/* Called with rcu_read_lock and BH disabled. */
+static void vxlan_rcv(struct vxlan_sock *vs, struct sk_buff *skb, __be32 vx_vni)
+{
+        struct ovs_key_ipv4_tunnel tun_key;
+        struct vport *vport = vs->data;
+        struct iphdr *iph;
+        __be64 key;
+
+        /* Save outer tunnel values */
+        iph = ip_hdr(skb);
+        key = cpu_to_be64(ntohl(vx_vni) >> 8);
+        ovs_flow_tun_key_init(&tun_key, iph, key, TUNNEL_KEY);
+
+        ovs_vport_receive(vport, skb, &tun_key);
+}
+
+static int vxlan_get_options(const struct vport *vport, struct sk_buff *skb)
+{
+        struct vxlan_port *vxlan_port = vxlan_vport(vport);
+        __be16 dst_port = inet_sk(vxlan_port->vs->sock->sk)->inet_sport;
+
+        if (nla_put_u16(skb, OVS_TUNNEL_ATTR_DST_PORT, ntohs(dst_port)))
+                return -EMSGSIZE;
+        return 0;
+}
+
+static void vxlan_tnl_destroy(struct vport *vport)
+{
+        struct vxlan_port *vxlan_port = vxlan_vport(vport);
+
+        vxlan_sock_release(vxlan_port->vs);
+
+        ovs_vport_deferred_free(vport);
+}
+
+static struct vport *vxlan_tnl_create(const struct vport_parms *parms)
+{
+        struct net *net = ovs_dp_get_net(parms->dp);
+        struct nlattr *options = parms->options;
+        struct vxlan_port *vxlan_port;
+        struct vxlan_sock *vs;
+        struct vport *vport;
+        struct nlattr *a;
+        u16 dst_port;
+        int err;
+
+        if (!options) {
+                err = -EINVAL;
+                goto error;
+        }
+        a = nla_find_nested(options, OVS_TUNNEL_ATTR_DST_PORT);
+        if (a && nla_len(a) == sizeof(u16)) {
+                dst_port = nla_get_u16(a);
+        } else {
+                /* Require destination port from userspace. */
+                err = -EINVAL;
+                goto error;
+        }
+
+        vport = ovs_vport_alloc(sizeof(struct vxlan_port),
+                                &ovs_vxlan_vport_ops, parms);
+        if (IS_ERR(vport))
+                return vport;
+
+        vxlan_port = vxlan_vport(vport);
+        strncpy(vxlan_port->name, parms->name, IFNAMSIZ);
+
+        vs = vxlan_sock_add(net, htons(dst_port), vxlan_rcv, vport, true, false);
+        if (IS_ERR(vs)) {
+                ovs_vport_free(vport);
+                return (void *)vs;
+        }
+        vxlan_port->vs = vs;
+
+        return vport;
+
+error:
+        return ERR_PTR(err);
+}
+
+static int vxlan_tnl_send(struct vport *vport, struct sk_buff *skb)
+{
+        struct net *net = ovs_dp_get_net(vport->dp);
+        struct vxlan_port *vxlan_port = vxlan_vport(vport);
+        __be16 dst_port = inet_sk(vxlan_port->vs->sock->sk)->inet_sport;
+        struct rtable *rt;
+        struct flowi4 fl;
+        __be16 src_port;
+        int port_min;
+        int port_max;
+        __be16 df;
+        int err;
+
+        if (unlikely(!OVS_CB(skb)->tun_key)) {
+                err = -EINVAL;
+                goto error;
+        }
+
+        /* Route lookup */
+        memset(&fl, 0, sizeof(fl));
+        fl.daddr = OVS_CB(skb)->tun_key->ipv4_dst;
+        fl.saddr = OVS_CB(skb)->tun_key->ipv4_src;
+        fl.flowi4_tos = RT_TOS(OVS_CB(skb)->tun_key->ipv4_tos);
+        fl.flowi4_mark = skb->mark;
+        fl.flowi4_proto = IPPROTO_UDP;
+
+        rt = ip_route_output_key(net, &fl);
+        if (IS_ERR(rt)) {
+                err = PTR_ERR(rt);
+                goto error;
+        }
+
+        df = OVS_CB(skb)->tun_key->tun_flags & TUNNEL_DONT_FRAGMENT ?
+                htons(IP_DF) : 0;
+
+        skb->local_df = 1;
+
+        inet_get_local_port_range(&port_min, &port_max);
+        src_port = vxlan_src_port(port_min, port_max, skb);
+
+        err = vxlan_xmit_skb(vxlan_port->vs, rt, skb,
+                             fl.saddr, OVS_CB(skb)->tun_key->ipv4_dst,
+                             OVS_CB(skb)->tun_key->ipv4_tos,
+                             OVS_CB(skb)->tun_key->ipv4_ttl, df,
+                             src_port, dst_port,
+                             htonl(be64_to_cpu(OVS_CB(skb)->tun_key->tun_id) << 8));
+        if (err < 0)
+                ip_rt_put(rt);
+error:
+        return err;
+}
+
+static const char *vxlan_get_name(const struct vport *vport)
+{
+        struct vxlan_port *vxlan_port = vxlan_vport(vport);
+        return vxlan_port->name;
+}
+
+const struct vport_ops ovs_vxlan_vport_ops = {
+        .type           = OVS_VPORT_TYPE_VXLAN,
+        .create         = vxlan_tnl_create,
+        .destroy        = vxlan_tnl_destroy,
+        .get_name       = vxlan_get_name,
+        .get_options    = vxlan_get_options,
+        .send           = vxlan_tnl_send,
+};
diff --git a/net/openvswitch/vport.c b/net/openvswitch/vport.c
index 720623190eaa..6f65dbe13812 100644
--- a/net/openvswitch/vport.c
+++ b/net/openvswitch/vport.c
@@ -38,6 +38,13 @@
 static const struct vport_ops *vport_ops_list[] = {
         &ovs_netdev_vport_ops,
         &ovs_internal_vport_ops,
+
+#ifdef CONFIG_OPENVSWITCH_GRE
+        &ovs_gre_vport_ops,
+#endif
+#ifdef CONFIG_OPENVSWITCH_VXLAN
+        &ovs_vxlan_vport_ops,
+#endif
 };
 
 /* Protected by RCU read lock for reading, ovs_mutex for writing. */
@@ -196,7 +203,7 @@ out:
  *      ovs_vport_set_options - modify existing vport device (for kernel callers)
  *
  * @vport: vport to modify.
- * @port: New configuration.
+ * @options: New configuration.
  *
  * Modifies an existing device with the specified configuration (which is
  * dependent on device type).  ovs_mutex must be held.
@@ -321,11 +328,13 @@ int ovs_vport_get_options(const struct vport *vport, struct sk_buff *skb)
  *
  * @vport: vport that received the packet
  * @skb: skb that was received
+ * @tun_key: tunnel (if any) that carried packet
  *
  * Must be called with rcu_read_lock.  The packet cannot be shared and
  * skb->data should point to the Ethernet header.
  */
-void ovs_vport_receive(struct vport *vport, struct sk_buff *skb)
+void ovs_vport_receive(struct vport *vport, struct sk_buff *skb,
+                       struct ovs_key_ipv4_tunnel *tun_key)
 {
         struct pcpu_tstats *stats;
 
@@ -335,6 +344,7 @@ void ovs_vport_receive(struct vport *vport, struct sk_buff *skb)
         stats->rx_bytes += skb->len;
         u64_stats_update_end(&stats->syncp);
 
+        OVS_CB(skb)->tun_key = tun_key;
         ovs_dp_process_received_packet(vport, skb);
 }
 
@@ -351,7 +361,7 @@ int ovs_vport_send(struct vport *vport, struct sk_buff *skb)
 {
         int sent = vport->ops->send(vport, skb);
 
-        if (likely(sent)) {
+        if (likely(sent > 0)) {
                 struct pcpu_tstats *stats;
 
                 stats = this_cpu_ptr(vport->percpu_stats);
@@ -360,7 +370,12 @@ int ovs_vport_send(struct vport *vport, struct sk_buff *skb)
                 stats->tx_packets++;
                 stats->tx_bytes += sent;
                 u64_stats_update_end(&stats->syncp);
-        }
+        } else if (sent < 0) {
+                ovs_vport_record_error(vport, VPORT_E_TX_ERROR);
+                kfree_skb(skb);
+        } else
+                ovs_vport_record_error(vport, VPORT_E_TX_DROPPED);
+
         return sent;
 }
 
@@ -371,7 +386,7 @@ int ovs_vport_send(struct vport *vport, struct sk_buff *skb)
  * @err_type: one of enum vport_err_type types to indicate the error type
  *
  * If using the vport generic stats layer indicate that an error of the given
- * type has occured.
+ * type has occurred.
  */
 void ovs_vport_record_error(struct vport *vport, enum vport_err_type err_type)
 {
@@ -397,3 +412,18 @@ void ovs_vport_record_error(struct vport *vport, enum vport_err_type err_type)
 
         spin_unlock(&vport->stats_lock);
 }
+
+static void free_vport_rcu(struct rcu_head *rcu)
+{
+        struct vport *vport = container_of(rcu, struct vport, rcu);
+
+        ovs_vport_free(vport);
+}
+
+void ovs_vport_deferred_free(struct vport *vport)
+{
+        if (!vport)
+                return;
+
+        call_rcu(&vport->rcu, free_vport_rcu);
+}
diff --git a/net/openvswitch/vport.h b/net/openvswitch/vport.h
index 68a377bc0841..1a9fbcec6e1b 100644
--- a/net/openvswitch/vport.h
+++ b/net/openvswitch/vport.h
@@ -34,6 +34,11 @@ struct vport_parms;
 
 /* The following definitions are for users of the vport subsytem: */
 
+/* The following definitions are for users of the vport subsytem: */
+struct vport_net {
+        struct vport __rcu *gre_vport;
+};
+
 int ovs_vport_init(void);
 void ovs_vport_exit(void);
 
@@ -123,9 +128,8 @@ struct vport_parms {
  * existing vport to a &struct sk_buff.  May be %NULL for a vport that does not
  * have any configuration.
  * @get_name: Get the device's name.
- * @get_config: Get the device's configuration.
- * May be null if the device does not have an ifindex.
- * @send: Send a packet on the device.  Returns the length of the packet sent.
+ * @send: Send a packet on the device.  Returns the length of the packet sent,
+ * zero for dropped packets or negative for error.
  */
 struct vport_ops {
         enum ovs_vport_type type;
@@ -139,7 +143,6 @@ struct vport_ops {
 
         /* Called with rcu_read_lock or ovs_mutex. */
         const char *(*get_name)(const struct vport *);
-        void (*get_config)(const struct vport *, void *);
 
         int (*send)(struct vport *, struct sk_buff *);
 };
@@ -154,6 +157,7 @@ enum vport_err_type {
 struct vport *ovs_vport_alloc(int priv_size, const struct vport_ops *,
                               const struct vport_parms *);
 void ovs_vport_free(struct vport *);
+void ovs_vport_deferred_free(struct vport *vport);
 
 #define VPORT_ALIGN 8
 
@@ -186,12 +190,22 @@ static inline struct vport *vport_from_priv(const void *priv)
         return (struct vport *)(priv - ALIGN(sizeof(struct vport), VPORT_ALIGN));
 }
 
-void ovs_vport_receive(struct vport *, struct sk_buff *);
+void ovs_vport_receive(struct vport *, struct sk_buff *,
+                       struct ovs_key_ipv4_tunnel *);
 void ovs_vport_record_error(struct vport *, enum vport_err_type err_type);
 
 /* List of statically compiled vport implementations.  Don't forget to also
  * add yours to the list at the top of vport.c. */
 extern const struct vport_ops ovs_netdev_vport_ops;
 extern const struct vport_ops ovs_internal_vport_ops;
+extern const struct vport_ops ovs_gre_vport_ops;
+extern const struct vport_ops ovs_vxlan_vport_ops;
+
+static inline void ovs_skb_postpush_rcsum(struct sk_buff *skb,
+                                      const void *start, unsigned int len)
+{
+        if (skb->ip_summed == CHECKSUM_COMPLETE)
+                skb->csum = csum_add(skb->csum, csum_partial(start, len, 0));
+}
 
 #endif /* vport.h */
diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
index 8ec1bca7f859..2e8286b47c28 100644
--- a/net/packet/af_packet.c
+++ b/net/packet/af_packet.c
@@ -88,7 +88,7 @@
 #include <linux/virtio_net.h>
 #include <linux/errqueue.h>
 #include <linux/net_tstamp.h>
-
+#include <linux/reciprocal_div.h>
 #ifdef CONFIG_INET
 #include <net/inet_common.h>
 #endif
@@ -1135,7 +1135,7 @@ static unsigned int fanout_demux_hash(struct packet_fanout *f,
                                       struct sk_buff *skb,
                                       unsigned int num)
 {
-        return (((u64)skb->rxhash) * num) >> 32;
+        return reciprocal_divide(skb->rxhash, num);
 }
 
 static unsigned int fanout_demux_lb(struct packet_fanout *f,
@@ -1158,6 +1158,13 @@ static unsigned int fanout_demux_cpu(struct packet_fanout *f,
         return smp_processor_id() % num;
 }
 
+static unsigned int fanout_demux_rnd(struct packet_fanout *f,
+                                     struct sk_buff *skb,
+                                     unsigned int num)
+{
+        return reciprocal_divide(prandom_u32(), num);
+}
+
 static unsigned int fanout_demux_rollover(struct packet_fanout *f,
                                           struct sk_buff *skb,
                                           unsigned int idx, unsigned int skip,
@@ -1215,6 +1222,9 @@ static int packet_rcv_fanout(struct sk_buff *skb, struct net_device *dev,
         case PACKET_FANOUT_CPU:
                 idx = fanout_demux_cpu(f, skb, num);
                 break;
+        case PACKET_FANOUT_RND:
+                idx = fanout_demux_rnd(f, skb, num);
+                break;
         case PACKET_FANOUT_ROLLOVER:
                 idx = fanout_demux_rollover(f, skb, 0, (unsigned int) -1, num);
                 break;
@@ -1284,6 +1294,7 @@ static int fanout_add(struct sock *sk, u16 id, u16 type_flags)
         case PACKET_FANOUT_HASH:
         case PACKET_FANOUT_LB:
         case PACKET_FANOUT_CPU:
+        case PACKET_FANOUT_RND:
                 break;
         default:
                 return -EINVAL;
@@ -2181,7 +2192,7 @@ static struct sk_buff *packet_alloc_skb(struct sock *sk, size_t prepad,
                 linear = len;
 
         skb = sock_alloc_send_pskb(sk, prepad + linear, len - linear, noblock,
-                                   err);
+                                   err, 0);
         if (!skb)
                 return NULL;
 
@@ -2638,51 +2649,6 @@ out:
         return err;
 }
 
-static int packet_recv_error(struct sock *sk, struct msghdr *msg, int len)
-{
-        struct sock_exterr_skb *serr;
-        struct sk_buff *skb, *skb2;
-        int copied, err;
-
-        err = -EAGAIN;
-        skb = skb_dequeue(&sk->sk_error_queue);
-        if (skb == NULL)
-                goto out;
-
-        copied = skb->len;
-        if (copied > len) {
-                msg->msg_flags |= MSG_TRUNC;
-                copied = len;
-        }
-        err = skb_copy_datagram_iovec(skb, 0, msg->msg_iov, copied);
-        if (err)
-                goto out_free_skb;
-
-        sock_recv_timestamp(msg, sk, skb);
-
-        serr = SKB_EXT_ERR(skb);
-        put_cmsg(msg, SOL_PACKET, PACKET_TX_TIMESTAMP,
-                 sizeof(serr->ee), &serr->ee);
-
-        msg->msg_flags |= MSG_ERRQUEUE;
-        err = copied;
-
-        /* Reset and regenerate socket error */
-        spin_lock_bh(&sk->sk_error_queue.lock);
-        sk->sk_err = 0;
-        if ((skb2 = skb_peek(&sk->sk_error_queue)) != NULL) {
-                sk->sk_err = SKB_EXT_ERR(skb2)->ee.ee_errno;
-                spin_unlock_bh(&sk->sk_error_queue.lock);
-                sk->sk_error_report(sk);
-        } else
-                spin_unlock_bh(&sk->sk_error_queue.lock);
-
-out_free_skb:
-        kfree_skb(skb);
-out:
-        return err;
-}
-
 /*
  *      Pull a packet from our receive queue and hand it to the user.
  *      If necessary we block.
@@ -2708,7 +2674,8 @@ static int packet_recvmsg(struct kiocb *iocb, struct socket *sock,
 #endif
 
         if (flags & MSG_ERRQUEUE) {
-                err = packet_recv_error(sk, msg, len);
+                err = sock_recv_errqueue(sk, msg, len,
+                                         SOL_PACKET, PACKET_TX_TIMESTAMP);
                 goto out;
         }
 
@@ -2851,12 +2818,11 @@ static int packet_getname_spkt(struct socket *sock, struct sockaddr *uaddr,
                 return -EOPNOTSUPP;
 
         uaddr->sa_family = AF_PACKET;
+        memset(uaddr->sa_data, 0, sizeof(uaddr->sa_data));
         rcu_read_lock();
         dev = dev_get_by_index_rcu(sock_net(sk), pkt_sk(sk)->ifindex);
         if (dev)
-                strncpy(uaddr->sa_data, dev->name, 14);
-        else
-                memset(uaddr->sa_data, 0, 14);
+                strlcpy(uaddr->sa_data, dev->name, sizeof(uaddr->sa_data));
         rcu_read_unlock();
         *uaddr_len = sizeof(*uaddr);
 
@@ -3260,9 +3226,11 @@ static int packet_getsockopt(struct socket *sock, int level, int optname,
 
                 if (po->tp_version == TPACKET_V3) {
                         lv = sizeof(struct tpacket_stats_v3);
+                        st.stats3.tp_packets += st.stats3.tp_drops;
                         data = &st.stats3;
                 } else {
                         lv = sizeof(struct tpacket_stats);
+                        st.stats1.tp_packets += st.stats1.tp_drops;
                         data = &st.stats1;
                 }
 
@@ -3331,10 +3299,11 @@ static int packet_getsockopt(struct socket *sock, int level, int optname,
 }
 
 
-static int packet_notifier(struct notifier_block *this, unsigned long msg, void *data)
+static int packet_notifier(struct notifier_block *this,
+                           unsigned long msg, void *ptr)
 {
         struct sock *sk;
-        struct net_device *dev = data;
+        struct net_device *dev = netdev_notifier_info_to_dev(ptr);
         struct net *net = dev_net(dev);
 
         rcu_read_lock();
diff --git a/net/phonet/pn_dev.c b/net/phonet/pn_dev.c
index 45a7df6575de..56a6146ac94b 100644
--- a/net/phonet/pn_dev.c
+++ b/net/phonet/pn_dev.c
@@ -292,9 +292,9 @@ static void phonet_route_autodel(struct net_device *dev)
 
 /* notify Phonet of device events */
 static int phonet_device_notify(struct notifier_block *me, unsigned long what,
-                                void *arg)
+                                void *ptr)
 {
-        struct net_device *dev = arg;
+        struct net_device *dev = netdev_notifier_info_to_dev(ptr);
 
         switch (what) {
         case NETDEV_REGISTER:
diff --git a/net/phonet/socket.c b/net/phonet/socket.c
index 1afd1381cdc7..77e38f733496 100644
--- a/net/phonet/socket.c
+++ b/net/phonet/socket.c
@@ -793,7 +793,7 @@ static int pn_res_seq_show(struct seq_file *seq, void *v)
                 struct sock **psk = v;
                 struct sock *sk = *psk;
 
-                seq_printf(seq, "%02X %5d %lu%n",
+                seq_printf(seq, "%02X %5u %lu%n",
                            (int) (psk - pnres.sk),
                            from_kuid_munged(seq_user_ns(seq), sock_i_uid(sk)),
                            sock_i_ino(sk), &len);
diff --git a/net/phonet/sysctl.c b/net/phonet/sysctl.c
index d6bbbbd0af18..c02a8c4bc11f 100644
--- a/net/phonet/sysctl.c
+++ b/net/phonet/sysctl.c
@@ -61,13 +61,13 @@ void phonet_get_local_port_range(int *min, int *max)
         } while (read_seqretry(&local_port_range_lock, seq));
 }
 
-static int proc_local_port_range(ctl_table *table, int write,
+static int proc_local_port_range(struct ctl_table *table, int write,
                                 void __user *buffer,
                                 size_t *lenp, loff_t *ppos)
 {
         int ret;
         int range[2] = {local_port_range[0], local_port_range[1]};
-        ctl_table tmp = {
+        struct ctl_table tmp = {
                 .data = &range,
                 .maxlen = sizeof(range),
                 .mode = table->mode,
diff --git a/net/rds/ib_sysctl.c b/net/rds/ib_sysctl.c
index 7e643bafb4af..e4e41b3afce7 100644
--- a/net/rds/ib_sysctl.c
+++ b/net/rds/ib_sysctl.c
@@ -61,7 +61,7 @@ static unsigned long rds_ib_sysctl_max_unsig_wr_max = 64;
  */
 unsigned int rds_ib_sysctl_flow_control = 0;
 
-static ctl_table rds_ib_sysctl_table[] = {
+static struct ctl_table rds_ib_sysctl_table[] = {
         {
                 .procname       = "max_send_wr",
                 .data           = &rds_ib_sysctl_max_send_wr,
diff --git a/net/rds/iw_sysctl.c b/net/rds/iw_sysctl.c
index 5d5ebd576f3f..89c91515ed0c 100644
--- a/net/rds/iw_sysctl.c
+++ b/net/rds/iw_sysctl.c
@@ -55,7 +55,7 @@ static unsigned long rds_iw_sysctl_max_unsig_bytes_max = ~0UL;
 
 unsigned int rds_iw_sysctl_flow_control = 1;
 
-static ctl_table rds_iw_sysctl_table[] = {
+static struct ctl_table rds_iw_sysctl_table[] = {
         {
                 .procname       = "max_send_wr",
                 .data           = &rds_iw_sysctl_max_send_wr,
diff --git a/net/rds/sysctl.c b/net/rds/sysctl.c
index 907214b4c4d0..b5cb2aa08f33 100644
--- a/net/rds/sysctl.c
+++ b/net/rds/sysctl.c
@@ -49,7 +49,7 @@ unsigned int  rds_sysctl_max_unacked_bytes = (16 << 20);
 
 unsigned int rds_sysctl_ping_enable = 1;
 
-static ctl_table rds_sysctl_rds_table[] = {
+static struct ctl_table rds_sysctl_rds_table[] = {
         {
                 .procname       = "reconnect_min_delay_ms",
                 .data           = &rds_sysctl_reconnect_min_jiffies,
diff --git a/net/rfkill/core.c b/net/rfkill/core.c
index 1cec5e4f3a5e..1bacc1079942 100644
--- a/net/rfkill/core.c
+++ b/net/rfkill/core.c
@@ -576,14 +576,14 @@ void rfkill_set_states(struct rfkill *rfkill, bool sw, bool hw)
 }
 EXPORT_SYMBOL(rfkill_set_states);
 
-static ssize_t rfkill_name_show(struct device *dev,
-                                struct device_attribute *attr,
-                                char *buf)
+static ssize_t name_show(struct device *dev, struct device_attribute *attr,
+                         char *buf)
 {
         struct rfkill *rfkill = to_rfkill(dev);
 
         return sprintf(buf, "%s\n", rfkill->name);
 }
+static DEVICE_ATTR_RO(name);
 
 static const char *rfkill_get_type_str(enum rfkill_type type)
 {
@@ -611,54 +611,52 @@ static const char *rfkill_get_type_str(enum rfkill_type type)
         }
 }
 
-static ssize_t rfkill_type_show(struct device *dev,
-                                struct device_attribute *attr,
-                                char *buf)
+static ssize_t type_show(struct device *dev, struct device_attribute *attr,
+                         char *buf)
 {
         struct rfkill *rfkill = to_rfkill(dev);
 
         return sprintf(buf, "%s\n", rfkill_get_type_str(rfkill->type));
 }
+static DEVICE_ATTR_RO(type);
 
-static ssize_t rfkill_idx_show(struct device *dev,
-                               struct device_attribute *attr,
-                               char *buf)
+static ssize_t index_show(struct device *dev, struct device_attribute *attr,
+                          char *buf)
 {
         struct rfkill *rfkill = to_rfkill(dev);
 
         return sprintf(buf, "%d\n", rfkill->idx);
 }
+static DEVICE_ATTR_RO(index);
 
-static ssize_t rfkill_persistent_show(struct device *dev,
-                               struct device_attribute *attr,
-                               char *buf)
+static ssize_t persistent_show(struct device *dev,
+                               struct device_attribute *attr, char *buf)
 {
         struct rfkill *rfkill = to_rfkill(dev);
 
         return sprintf(buf, "%d\n", rfkill->persistent);
 }
+static DEVICE_ATTR_RO(persistent);
 
-static ssize_t rfkill_hard_show(struct device *dev,
-                                 struct device_attribute *attr,
-                                 char *buf)
+static ssize_t hard_show(struct device *dev, struct device_attribute *attr,
+                         char *buf)
 {
         struct rfkill *rfkill = to_rfkill(dev);
 
         return sprintf(buf, "%d\n", (rfkill->state & RFKILL_BLOCK_HW) ? 1 : 0 );
 }
+static DEVICE_ATTR_RO(hard);
 
-static ssize_t rfkill_soft_show(struct device *dev,
-                                 struct device_attribute *attr,
-                                 char *buf)
+static ssize_t soft_show(struct device *dev, struct device_attribute *attr,
+                         char *buf)
 {
         struct rfkill *rfkill = to_rfkill(dev);
 
         return sprintf(buf, "%d\n", (rfkill->state & RFKILL_BLOCK_SW) ? 1 : 0 );
 }
 
-static ssize_t rfkill_soft_store(struct device *dev,
-                                  struct device_attribute *attr,
-                                  const char *buf, size_t count)
+static ssize_t soft_store(struct device *dev, struct device_attribute *attr,
+                          const char *buf, size_t count)
 {
         struct rfkill *rfkill = to_rfkill(dev);
         unsigned long state;
@@ -680,6 +678,7 @@ static ssize_t rfkill_soft_store(struct device *dev,
 
         return count;
 }
+static DEVICE_ATTR_RW(soft);
 
 static u8 user_state_from_blocked(unsigned long state)
 {
@@ -691,18 +690,16 @@ static u8 user_state_from_blocked(unsigned long state)
         return RFKILL_USER_STATE_UNBLOCKED;
 }
 
-static ssize_t rfkill_state_show(struct device *dev,
-                                 struct device_attribute *attr,
-                                 char *buf)
+static ssize_t state_show(struct device *dev, struct device_attribute *attr,
+                          char *buf)
 {
         struct rfkill *rfkill = to_rfkill(dev);
 
         return sprintf(buf, "%d\n", user_state_from_blocked(rfkill->state));
 }
 
-static ssize_t rfkill_state_store(struct device *dev,
-                                  struct device_attribute *attr,
-                                  const char *buf, size_t count)
+static ssize_t state_store(struct device *dev, struct device_attribute *attr,
+                           const char *buf, size_t count)
 {
         struct rfkill *rfkill = to_rfkill(dev);
         unsigned long state;
@@ -725,32 +722,27 @@ static ssize_t rfkill_state_store(struct device *dev,
 
         return count;
 }
+static DEVICE_ATTR_RW(state);
 
-static ssize_t rfkill_claim_show(struct device *dev,
-                                 struct device_attribute *attr,
-                                 char *buf)
+static ssize_t claim_show(struct device *dev, struct device_attribute *attr,
+                          char *buf)
 {
         return sprintf(buf, "%d\n", 0);
 }
-
-static ssize_t rfkill_claim_store(struct device *dev,
-                                  struct device_attribute *attr,
-                                  const char *buf, size_t count)
-{
-        return -EOPNOTSUPP;
-}
-
-static struct device_attribute rfkill_dev_attrs[] = {
-        __ATTR(name, S_IRUGO, rfkill_name_show, NULL),
-        __ATTR(type, S_IRUGO, rfkill_type_show, NULL),
-        __ATTR(index, S_IRUGO, rfkill_idx_show, NULL),
-        __ATTR(persistent, S_IRUGO, rfkill_persistent_show, NULL),
-        __ATTR(state, S_IRUGO|S_IWUSR, rfkill_state_show, rfkill_state_store),
-        __ATTR(claim, S_IRUGO|S_IWUSR, rfkill_claim_show, rfkill_claim_store),
-        __ATTR(soft, S_IRUGO|S_IWUSR, rfkill_soft_show, rfkill_soft_store),
-        __ATTR(hard, S_IRUGO, rfkill_hard_show, NULL),
-        __ATTR_NULL
+static DEVICE_ATTR_RO(claim);
+
+static struct attribute *rfkill_dev_attrs[] = {
+        &dev_attr_name.attr,
+        &dev_attr_type.attr,
+        &dev_attr_index.attr,
+        &dev_attr_persistent.attr,
+        &dev_attr_state.attr,
+        &dev_attr_claim.attr,
+        &dev_attr_soft.attr,
+        &dev_attr_hard.attr,
+        NULL,
 };
+ATTRIBUTE_GROUPS(rfkill_dev);
 
 static void rfkill_release(struct device *dev)
 {
@@ -830,7 +822,7 @@ static int rfkill_resume(struct device *dev)
 static struct class rfkill_class = {
         .name           = "rfkill",
         .dev_release    = rfkill_release,
-        .dev_attrs      = rfkill_dev_attrs,
+        .dev_groups     = rfkill_dev_groups,
         .dev_uevent     = rfkill_dev_uevent,
         .suspend        = rfkill_suspend,
         .resume         = rfkill_resume,
diff --git a/net/rfkill/rfkill-regulator.c b/net/rfkill/rfkill-regulator.c
index d11ac79246e4..cf5b145902e5 100644
--- a/net/rfkill/rfkill-regulator.c
+++ b/net/rfkill/rfkill-regulator.c
@@ -30,6 +30,7 @@ struct rfkill_regulator_data {
 static int rfkill_regulator_set_block(void *data, bool blocked)
 {
         struct rfkill_regulator_data *rfkill_data = data;
+        int ret = 0;
 
         pr_debug("%s: blocked: %d\n", __func__, blocked);
 
@@ -40,15 +41,16 @@ static int rfkill_regulator_set_block(void *data, bool blocked)
                 }
         } else {
                 if (!rfkill_data->reg_enabled) {
-                        regulator_enable(rfkill_data->vcc);
-                        rfkill_data->reg_enabled = true;
+                        ret = regulator_enable(rfkill_data->vcc);
+                        if (!ret)
+                                rfkill_data->reg_enabled = true;
                 }
         }
 
         pr_debug("%s: regulator_is_enabled after set_block: %d\n", __func__,
                 regulator_is_enabled(rfkill_data->vcc));
 
-        return 0;
+        return ret;
 }
 
 static struct rfkill_ops rfkill_regulator_ops = {
diff --git a/net/rose/af_rose.c b/net/rose/af_rose.c
index 9c8347451597..e98fcfbe6007 100644
--- a/net/rose/af_rose.c
+++ b/net/rose/af_rose.c
@@ -202,10 +202,10 @@ static void rose_kill_by_device(struct net_device *dev)
 /*
  *      Handle device status changes.
  */
-static int rose_device_event(struct notifier_block *this, unsigned long event,
-        void *ptr)
+static int rose_device_event(struct notifier_block *this,
+                             unsigned long event, void *ptr)
 {
-        struct net_device *dev = (struct net_device *)ptr;
+        struct net_device *dev = netdev_notifier_info_to_dev(ptr);
 
         if (!net_eq(dev_net(dev), &init_net))
                 return NOTIFY_DONE;
diff --git a/net/rose/sysctl_net_rose.c b/net/rose/sysctl_net_rose.c
index 94ca9c2ccd69..89a9278795a9 100644
--- a/net/rose/sysctl_net_rose.c
+++ b/net/rose/sysctl_net_rose.c
@@ -24,7 +24,7 @@ static int min_window[] = {1}, max_window[] = {7};
 
 static struct ctl_table_header *rose_table_header;
 
-static ctl_table rose_table[] = {
+static struct ctl_table rose_table[] = {
         {
                 .procname       = "restart_request_timeout",
                 .data           = &sysctl_rose_restart_request_timeout,
diff --git a/net/sched/Kconfig b/net/sched/Kconfig
index 235e01acac51..c03a32a0418e 100644
--- a/net/sched/Kconfig
+++ b/net/sched/Kconfig
@@ -272,6 +272,20 @@ config NET_SCH_FQ_CODEL
 
           If unsure, say N.
 
+config NET_SCH_FQ
+        tristate "Fair Queue"
+        help
+          Say Y here if you want to use the FQ packet scheduling algorithm.
+
+          FQ does flow separation, and is able to respect pacing requirements
+          set by TCP stack into sk->sk_pacing_rate (for localy generated
+          traffic)
+
+          To compile this driver as a module, choose M here: the module
+          will be called sch_fq.
+
+          If unsure, say N.
+
 config NET_SCH_INGRESS
         tristate "Ingress Qdisc"
         depends on NET_CLS_ACT
diff --git a/net/sched/Makefile b/net/sched/Makefile
index 978cbf004e80..e5f9abe9a5db 100644
--- a/net/sched/Makefile
+++ b/net/sched/Makefile
@@ -39,6 +39,7 @@ obj-$(CONFIG_NET_SCH_CHOKE)	+= sch_choke.o
 obj-$(CONFIG_NET_SCH_QFQ)       += sch_qfq.o
 obj-$(CONFIG_NET_SCH_CODEL)     += sch_codel.o
 obj-$(CONFIG_NET_SCH_FQ_CODEL)  += sch_fq_codel.o
+obj-$(CONFIG_NET_SCH_FQ)        += sch_fq.o
 
 obj-$(CONFIG_NET_CLS_U32)       += cls_u32.o
 obj-$(CONFIG_NET_CLS_ROUTE4)    += cls_route.o
diff --git a/net/sched/act_mirred.c b/net/sched/act_mirred.c
index 5d676edc22a6..977c10e0631b 100644
--- a/net/sched/act_mirred.c
+++ b/net/sched/act_mirred.c
@@ -243,7 +243,7 @@ nla_put_failure:
 static int mirred_device_event(struct notifier_block *unused,
                                unsigned long event, void *ptr)
 {
-        struct net_device *dev = ptr;
+        struct net_device *dev = netdev_notifier_info_to_dev(ptr);
         struct tcf_mirred *m;
 
         if (event == NETDEV_UNREGISTER)
diff --git a/net/sched/cls_cgroup.c b/net/sched/cls_cgroup.c
index 3a294eb98d61..867b4a3e3980 100644
--- a/net/sched/cls_cgroup.c
+++ b/net/sched/cls_cgroup.c
@@ -23,19 +23,18 @@
 #include <net/sock.h>
 #include <net/cls_cgroup.h>
 
-static inline struct cgroup_cls_state *cgrp_cls_state(struct cgroup *cgrp)
+static inline struct cgroup_cls_state *css_cls_state(struct cgroup_subsys_state *css)
 {
-        return container_of(cgroup_subsys_state(cgrp, net_cls_subsys_id),
-                            struct cgroup_cls_state, css);
+        return css ? container_of(css, struct cgroup_cls_state, css) : NULL;
 }
 
 static inline struct cgroup_cls_state *task_cls_state(struct task_struct *p)
 {
-        return container_of(task_subsys_state(p, net_cls_subsys_id),
-                            struct cgroup_cls_state, css);
+        return css_cls_state(task_css(p, net_cls_subsys_id));
 }
 
-static struct cgroup_subsys_state *cgrp_css_alloc(struct cgroup *cgrp)
+static struct cgroup_subsys_state *
+cgrp_css_alloc(struct cgroup_subsys_state *parent_css)
 {
         struct cgroup_cls_state *cs;
 
@@ -45,17 +44,19 @@ static struct cgroup_subsys_state *cgrp_css_alloc(struct cgroup *cgrp)
         return &cs->css;
 }
 
-static int cgrp_css_online(struct cgroup *cgrp)
+static int cgrp_css_online(struct cgroup_subsys_state *css)
 {
-        if (cgrp->parent)
-                cgrp_cls_state(cgrp)->classid =
-                        cgrp_cls_state(cgrp->parent)->classid;
+        struct cgroup_cls_state *cs = css_cls_state(css);
+        struct cgroup_cls_state *parent = css_cls_state(css_parent(css));
+
+        if (parent)
+                cs->classid = parent->classid;
         return 0;
 }
 
-static void cgrp_css_free(struct cgroup *cgrp)
+static void cgrp_css_free(struct cgroup_subsys_state *css)
 {
-        kfree(cgrp_cls_state(cgrp));
+        kfree(css_cls_state(css));
 }
 
 static int update_classid(const void *v, struct file *file, unsigned n)
@@ -67,12 +68,13 @@ static int update_classid(const void *v, struct file *file, unsigned n)
         return 0;
 }
 
-static void cgrp_attach(struct cgroup *cgrp, struct cgroup_taskset *tset)
+static void cgrp_attach(struct cgroup_subsys_state *css,
+                        struct cgroup_taskset *tset)
 {
         struct task_struct *p;
         void *v;
 
-        cgroup_taskset_for_each(p, cgrp, tset) {
+        cgroup_taskset_for_each(p, css, tset) {
                 task_lock(p);
                 v = (void *)(unsigned long)task_cls_classid(p);
                 iterate_fd(p->files, 0, update_classid, v);
@@ -80,14 +82,15 @@ static void cgrp_attach(struct cgroup *cgrp, struct cgroup_taskset *tset)
         }
 }
 
-static u64 read_classid(struct cgroup *cgrp, struct cftype *cft)
+static u64 read_classid(struct cgroup_subsys_state *css, struct cftype *cft)
 {
-        return cgrp_cls_state(cgrp)->classid;
+        return css_cls_state(css)->classid;
 }
 
-static int write_classid(struct cgroup *cgrp, struct cftype *cft, u64 value)
+static int write_classid(struct cgroup_subsys_state *css, struct cftype *cft,
+                         u64 value)
 {
-        cgrp_cls_state(cgrp)->classid = (u32) value;
+        css_cls_state(css)->classid = (u32) value;
         return 0;
 }
 
diff --git a/net/sched/sch_api.c b/net/sched/sch_api.c
index 2b935e7cfe7b..2adda7fa2d39 100644
--- a/net/sched/sch_api.c
+++ b/net/sched/sch_api.c
@@ -200,6 +200,58 @@ int unregister_qdisc(struct Qdisc_ops *qops)
 }
 EXPORT_SYMBOL(unregister_qdisc);
 
+/* Get default qdisc if not otherwise specified */
+void qdisc_get_default(char *name, size_t len)
+{
+        read_lock(&qdisc_mod_lock);
+        strlcpy(name, default_qdisc_ops->id, len);
+        read_unlock(&qdisc_mod_lock);
+}
+
+static struct Qdisc_ops *qdisc_lookup_default(const char *name)
+{
+        struct Qdisc_ops *q = NULL;
+
+        for (q = qdisc_base; q; q = q->next) {
+                if (!strcmp(name, q->id)) {
+                        if (!try_module_get(q->owner))
+                                q = NULL;
+                        break;
+                }
+        }
+
+        return q;
+}
+
+/* Set new default qdisc to use */
+int qdisc_set_default(const char *name)
+{
+        const struct Qdisc_ops *ops;
+
+        if (!capable(CAP_NET_ADMIN))
+                return -EPERM;
+
+        write_lock(&qdisc_mod_lock);
+        ops = qdisc_lookup_default(name);
+        if (!ops) {
+                /* Not found, drop lock and try to load module */
+                write_unlock(&qdisc_mod_lock);
+                request_module("sch_%s", name);
+                write_lock(&qdisc_mod_lock);
+
+                ops = qdisc_lookup_default(name);
+        }
+
+        if (ops) {
+                /* Set new default */
+                module_put(default_qdisc_ops->owner);
+                default_qdisc_ops = ops;
+        }
+        write_unlock(&qdisc_mod_lock);
+
+        return ops ? 0 : -ENOENT;
+}
+
 /* We know handle. Find qdisc among all qdisc's attached to device
    (root qdisc, all its children, children of children etc.)
  */
@@ -285,28 +337,70 @@ static struct Qdisc_ops *qdisc_lookup_ops(struct nlattr *kind)
         return q;
 }
 
+/* The linklayer setting were not transferred from iproute2, in older
+ * versions, and the rate tables lookup systems have been dropped in
+ * the kernel. To keep backward compatible with older iproute2 tc
+ * utils, we detect the linklayer setting by detecting if the rate
+ * table were modified.
+ *
+ * For linklayer ATM table entries, the rate table will be aligned to
+ * 48 bytes, thus some table entries will contain the same value.  The
+ * mpu (min packet unit) is also encoded into the old rate table, thus
+ * starting from the mpu, we find low and high table entries for
+ * mapping this cell.  If these entries contain the same value, when
+ * the rate tables have been modified for linklayer ATM.
+ *
+ * This is done by rounding mpu to the nearest 48 bytes cell/entry,
+ * and then roundup to the next cell, calc the table entry one below,
+ * and compare.
+ */
+static __u8 __detect_linklayer(struct tc_ratespec *r, __u32 *rtab)
+{
+        int low       = roundup(r->mpu, 48);
+        int high      = roundup(low+1, 48);
+        int cell_low  = low >> r->cell_log;
+        int cell_high = (high >> r->cell_log) - 1;
+
+        /* rtab is too inaccurate at rates > 100Mbit/s */
+        if ((r->rate > (100000000/8)) || (rtab[0] == 0)) {
+                pr_debug("TC linklayer: Giving up ATM detection\n");
+                return TC_LINKLAYER_ETHERNET;
+        }
+
+        if ((cell_high > cell_low) && (cell_high < 256)
+            && (rtab[cell_low] == rtab[cell_high])) {
+                pr_debug("TC linklayer: Detected ATM, low(%d)=high(%d)=%u\n",
+                         cell_low, cell_high, rtab[cell_high]);
+                return TC_LINKLAYER_ATM;
+        }
+        return TC_LINKLAYER_ETHERNET;
+}
+
 static struct qdisc_rate_table *qdisc_rtab_list;
 
 struct qdisc_rate_table *qdisc_get_rtab(struct tc_ratespec *r, struct nlattr *tab)
 {
         struct qdisc_rate_table *rtab;
 
+        if (tab == NULL || r->rate == 0 || r->cell_log == 0 ||
+            nla_len(tab) != TC_RTAB_SIZE)
+                return NULL;
+
         for (rtab = qdisc_rtab_list; rtab; rtab = rtab->next) {
-                if (memcmp(&rtab->rate, r, sizeof(struct tc_ratespec)) == 0) {
+                if (!memcmp(&rtab->rate, r, sizeof(struct tc_ratespec)) &&
+                    !memcmp(&rtab->data, nla_data(tab), 1024)) {
                         rtab->refcnt++;
                         return rtab;
                 }
         }
 
-        if (tab == NULL || r->rate == 0 || r->cell_log == 0 ||
-            nla_len(tab) != TC_RTAB_SIZE)
-                return NULL;
-
         rtab = kmalloc(sizeof(*rtab), GFP_KERNEL);
         if (rtab) {
                 rtab->rate = *r;
                 rtab->refcnt = 1;
                 memcpy(rtab->data, nla_data(tab), 1024);
+                if (r->linklayer == TC_LINKLAYER_UNAWARE)
+                        r->linklayer = __detect_linklayer(r, rtab->data);
                 rtab->next = qdisc_rtab_list;
                 qdisc_rtab_list = rtab;
         }
@@ -1812,6 +1906,7 @@ static int __init pktsched_init(void)
                 return err;
         }
 
+        register_qdisc(&pfifo_fast_ops);
         register_qdisc(&pfifo_qdisc_ops);
         register_qdisc(&bfifo_qdisc_ops);
         register_qdisc(&pfifo_head_drop_qdisc_ops);
diff --git a/net/sched/sch_atm.c b/net/sched/sch_atm.c
index ca8e0a57d945..1f9c31411f19 100644
--- a/net/sched/sch_atm.c
+++ b/net/sched/sch_atm.c
@@ -605,6 +605,7 @@ static int atm_tc_dump_class(struct Qdisc *sch, unsigned long cl,
                 struct sockaddr_atmpvc pvc;
                 int state;
 
+                memset(&pvc, 0, sizeof(pvc));
                 pvc.sap_family = AF_ATMPVC;
                 pvc.sap_addr.itf = flow->vcc->dev ? flow->vcc->dev->number : -1;
                 pvc.sap_addr.vpi = flow->vcc->vpi;
diff --git a/net/sched/sch_cbq.c b/net/sched/sch_cbq.c
index 1bc210ffcba2..7a42c81a19eb 100644
--- a/net/sched/sch_cbq.c
+++ b/net/sched/sch_cbq.c
@@ -130,7 +130,7 @@ struct cbq_class {
         psched_time_t           penalized;
         struct gnet_stats_basic_packed bstats;
         struct gnet_stats_queue qstats;
-        struct gnet_stats_rate_est rate_est;
+        struct gnet_stats_rate_est64 rate_est;
         struct tc_cbq_xstats    xstats;
 
         struct tcf_proto        *filter_list;
@@ -1465,6 +1465,7 @@ static int cbq_dump_wrr(struct sk_buff *skb, struct cbq_class *cl)
         unsigned char *b = skb_tail_pointer(skb);
         struct tc_cbq_wrropt opt;
 
+        memset(&opt, 0, sizeof(opt));
         opt.flags = 0;
         opt.allot = cl->allot;
         opt.priority = cl->priority + 1;
diff --git a/net/sched/sch_choke.c b/net/sched/sch_choke.c
index ef53ab8d0aae..ddd73cb2d7ba 100644
--- a/net/sched/sch_choke.c
+++ b/net/sched/sch_choke.c
@@ -438,7 +438,8 @@ static int choke_change(struct Qdisc *sch, struct nlattr *opt)
         if (mask != q->tab_mask) {
                 struct sk_buff **ntab;
 
-                ntab = kcalloc(mask + 1, sizeof(struct sk_buff *), GFP_KERNEL);
+                ntab = kcalloc(mask + 1, sizeof(struct sk_buff *),
+                               GFP_KERNEL | __GFP_NOWARN);
                 if (!ntab)
                         ntab = vzalloc((mask + 1) * sizeof(struct sk_buff *));
                 if (!ntab)
diff --git a/net/sched/sch_drr.c b/net/sched/sch_drr.c
index 759b308d1a8d..8302717ea303 100644
--- a/net/sched/sch_drr.c
+++ b/net/sched/sch_drr.c
@@ -25,7 +25,7 @@ struct drr_class {
 
         struct gnet_stats_basic_packed          bstats;
         struct gnet_stats_queue         qstats;
-        struct gnet_stats_rate_est      rate_est;
+        struct gnet_stats_rate_est64    rate_est;
         struct list_head                alist;
         struct Qdisc                    *qdisc;
 
diff --git a/net/sched/sch_fq.c b/net/sched/sch_fq.c
new file mode 100644
index 000000000000..a2fef8b10b96
--- /dev/null
+++ b/net/sched/sch_fq.c
@@ -0,0 +1,817 @@
+/*
+ * net/sched/sch_fq.c Fair Queue Packet Scheduler (per flow pacing)
+ *
+ *  Copyright (C) 2013 Eric Dumazet <edumazet@google.com>
+ *
+ *      This program is free software; you can redistribute it and/or
+ *      modify it under the terms of the GNU General Public License
+ *      as published by the Free Software Foundation; either version
+ *      2 of the License, or (at your option) any later version.
+ *
+ *  Meant to be mostly used for localy generated traffic :
+ *  Fast classification depends on skb->sk being set before reaching us.
+ *  If not, (router workload), we use rxhash as fallback, with 32 bits wide hash.
+ *  All packets belonging to a socket are considered as a 'flow'.
+ *
+ *  Flows are dynamically allocated and stored in a hash table of RB trees
+ *  They are also part of one Round Robin 'queues' (new or old flows)
+ *
+ *  Burst avoidance (aka pacing) capability :
+ *
+ *  Transport (eg TCP) can set in sk->sk_pacing_rate a rate, enqueue a
+ *  bunch of packets, and this packet scheduler adds delay between
+ *  packets to respect rate limitation.
+ *
+ *  enqueue() :
+ *   - lookup one RB tree (out of 1024 or more) to find the flow.
+ *     If non existent flow, create it, add it to the tree.
+ *     Add skb to the per flow list of skb (fifo).
+ *   - Use a special fifo for high prio packets
+ *
+ *  dequeue() : serves flows in Round Robin
+ *  Note : When a flow becomes empty, we do not immediately remove it from
+ *  rb trees, for performance reasons (its expected to send additional packets,
+ *  or SLAB cache will reuse socket for another flow)
+ */
+
+#include <linux/module.h>
+#include <linux/types.h>
+#include <linux/kernel.h>
+#include <linux/jiffies.h>
+#include <linux/string.h>
+#include <linux/in.h>
+#include <linux/errno.h>
+#include <linux/init.h>
+#include <linux/skbuff.h>
+#include <linux/slab.h>
+#include <linux/rbtree.h>
+#include <linux/hash.h>
+#include <linux/prefetch.h>
+#include <net/netlink.h>
+#include <net/pkt_sched.h>
+#include <net/sock.h>
+#include <net/tcp_states.h>
+
+/*
+ * Per flow structure, dynamically allocated
+ */
+struct fq_flow {
+        struct sk_buff  *head;          /* list of skbs for this flow : first skb */
+        union {
+                struct sk_buff *tail;   /* last skb in the list */
+                unsigned long  age;     /* jiffies when flow was emptied, for gc */
+        };
+        struct rb_node  fq_node;        /* anchor in fq_root[] trees */
+        struct sock     *sk;
+        int             qlen;           /* number of packets in flow queue */
+        int             credit;
+        u32             socket_hash;    /* sk_hash */
+        struct fq_flow *next;           /* next pointer in RR lists, or &detached */
+
+        struct rb_node  rate_node;      /* anchor in q->delayed tree */
+        u64             time_next_packet;
+};
+
+struct fq_flow_head {
+        struct fq_flow *first;
+        struct fq_flow *last;
+};
+
+struct fq_sched_data {
+        struct fq_flow_head new_flows;
+
+        struct fq_flow_head old_flows;
+
+        struct rb_root  delayed;        /* for rate limited flows */
+        u64             time_next_delayed_flow;
+
+        struct fq_flow  internal;       /* for non classified or high prio packets */
+        u32             quantum;
+        u32             initial_quantum;
+        u32             flow_default_rate;/* rate per flow : bytes per second */
+        u32             flow_max_rate;  /* optional max rate per flow */
+        u32             flow_plimit;    /* max packets per flow */
+        struct rb_root  *fq_root;
+        u8              rate_enable;
+        u8              fq_trees_log;
+
+        u32             flows;
+        u32             inactive_flows;
+        u32             throttled_flows;
+
+        u64             stat_gc_flows;
+        u64             stat_internal_packets;
+        u64             stat_tcp_retrans;
+        u64             stat_throttled;
+        u64             stat_flows_plimit;
+        u64             stat_pkts_too_long;
+        u64             stat_allocation_errors;
+        struct qdisc_watchdog watchdog;
+};
+
+/* special value to mark a detached flow (not on old/new list) */
+static struct fq_flow detached, throttled;
+
+static void fq_flow_set_detached(struct fq_flow *f)
+{
+        f->next = &detached;
+}
+
+static bool fq_flow_is_detached(const struct fq_flow *f)
+{
+        return f->next == &detached;
+}
+
+static void fq_flow_set_throttled(struct fq_sched_data *q, struct fq_flow *f)
+{
+        struct rb_node **p = &q->delayed.rb_node, *parent = NULL;
+
+        while (*p) {
+                struct fq_flow *aux;
+
+                parent = *p;
+                aux = container_of(parent, struct fq_flow, rate_node);
+                if (f->time_next_packet >= aux->time_next_packet)
+                        p = &parent->rb_right;
+                else
+                        p = &parent->rb_left;
+        }
+        rb_link_node(&f->rate_node, parent, p);
+        rb_insert_color(&f->rate_node, &q->delayed);
+        q->throttled_flows++;
+        q->stat_throttled++;
+
+        f->next = &throttled;
+        if (q->time_next_delayed_flow > f->time_next_packet)
+                q->time_next_delayed_flow = f->time_next_packet;
+}
+
+
+static struct kmem_cache *fq_flow_cachep __read_mostly;
+
+static void fq_flow_add_tail(struct fq_flow_head *head, struct fq_flow *flow)
+{
+        if (head->first)
+                head->last->next = flow;
+        else
+                head->first = flow;
+        head->last = flow;
+        flow->next = NULL;
+}
+
+/* limit number of collected flows per round */
+#define FQ_GC_MAX 8
+#define FQ_GC_AGE (3*HZ)
+
+static bool fq_gc_candidate(const struct fq_flow *f)
+{
+        return fq_flow_is_detached(f) &&
+               time_after(jiffies, f->age + FQ_GC_AGE);
+}
+
+static void fq_gc(struct fq_sched_data *q,
+                  struct rb_root *root,
+                  struct sock *sk)
+{
+        struct fq_flow *f, *tofree[FQ_GC_MAX];
+        struct rb_node **p, *parent;
+        int fcnt = 0;
+
+        p = &root->rb_node;
+        parent = NULL;
+        while (*p) {
+                parent = *p;
+
+                f = container_of(parent, struct fq_flow, fq_node);
+                if (f->sk == sk)
+                        break;
+
+                if (fq_gc_candidate(f)) {
+                        tofree[fcnt++] = f;
+                        if (fcnt == FQ_GC_MAX)
+                                break;
+                }
+
+                if (f->sk > sk)
+                        p = &parent->rb_right;
+                else
+                        p = &parent->rb_left;
+        }
+
+        q->flows -= fcnt;
+        q->inactive_flows -= fcnt;
+        q->stat_gc_flows += fcnt;
+        while (fcnt) {
+                struct fq_flow *f = tofree[--fcnt];
+
+                rb_erase(&f->fq_node, root);
+                kmem_cache_free(fq_flow_cachep, f);
+        }
+}
+
+static const u8 prio2band[TC_PRIO_MAX + 1] = {
+        1, 2, 2, 2, 1, 2, 0, 0 , 1, 1, 1, 1, 1, 1, 1, 1
+};
+
+static struct fq_flow *fq_classify(struct sk_buff *skb, struct fq_sched_data *q)
+{
+        struct rb_node **p, *parent;
+        struct sock *sk = skb->sk;
+        struct rb_root *root;
+        struct fq_flow *f;
+        int band;
+
+        /* warning: no starvation prevention... */
+        band = prio2band[skb->priority & TC_PRIO_MAX];
+        if (unlikely(band == 0))
+                return &q->internal;
+
+        if (unlikely(!sk)) {
+                /* By forcing low order bit to 1, we make sure to not
+                 * collide with a local flow (socket pointers are word aligned)
+                 */
+                sk = (struct sock *)(skb_get_rxhash(skb) | 1L);
+        }
+
+        root = &q->fq_root[hash_32((u32)(long)sk, q->fq_trees_log)];
+
+        if (q->flows >= (2U << q->fq_trees_log) &&
+            q->inactive_flows > q->flows/2)
+                fq_gc(q, root, sk);
+
+        p = &root->rb_node;
+        parent = NULL;
+        while (*p) {
+                parent = *p;
+
+                f = container_of(parent, struct fq_flow, fq_node);
+                if (f->sk == sk) {
+                        /* socket might have been reallocated, so check
+                         * if its sk_hash is the same.
+                         * It not, we need to refill credit with
+                         * initial quantum
+                         */
+                        if (unlikely(skb->sk &&
+                                     f->socket_hash != sk->sk_hash)) {
+                                f->credit = q->initial_quantum;
+                                f->socket_hash = sk->sk_hash;
+                        }
+                        return f;
+                }
+                if (f->sk > sk)
+                        p = &parent->rb_right;
+                else
+                        p = &parent->rb_left;
+        }
+
+        f = kmem_cache_zalloc(fq_flow_cachep, GFP_ATOMIC | __GFP_NOWARN);
+        if (unlikely(!f)) {
+                q->stat_allocation_errors++;
+                return &q->internal;
+        }
+        fq_flow_set_detached(f);
+        f->sk = sk;
+        if (skb->sk)
+                f->socket_hash = sk->sk_hash;
+        f->credit = q->initial_quantum;
+
+        rb_link_node(&f->fq_node, parent, p);
+        rb_insert_color(&f->fq_node, root);
+
+        q->flows++;
+        q->inactive_flows++;
+        return f;
+}
+
+
+/* remove one skb from head of flow queue */
+static struct sk_buff *fq_dequeue_head(struct Qdisc *sch, struct fq_flow *flow)
+{
+        struct sk_buff *skb = flow->head;
+
+        if (skb) {
+                flow->head = skb->next;
+                skb->next = NULL;
+                flow->qlen--;
+                sch->qstats.backlog -= qdisc_pkt_len(skb);
+                sch->q.qlen--;
+        }
+        return skb;
+}
+
+/* We might add in the future detection of retransmits
+ * For the time being, just return false
+ */
+static bool skb_is_retransmit(struct sk_buff *skb)
+{
+        return false;
+}
+
+/* add skb to flow queue
+ * flow queue is a linked list, kind of FIFO, except for TCP retransmits
+ * We special case tcp retransmits to be transmitted before other packets.
+ * We rely on fact that TCP retransmits are unlikely, so we do not waste
+ * a separate queue or a pointer.
+ * head->  [retrans pkt 1]
+ *         [retrans pkt 2]
+ *         [ normal pkt 1]
+ *         [ normal pkt 2]
+ *         [ normal pkt 3]
+ * tail->  [ normal pkt 4]
+ */
+static void flow_queue_add(struct fq_flow *flow, struct sk_buff *skb)
+{
+        struct sk_buff *prev, *head = flow->head;
+
+        skb->next = NULL;
+        if (!head) {
+                flow->head = skb;
+                flow->tail = skb;
+                return;
+        }
+        if (likely(!skb_is_retransmit(skb))) {
+                flow->tail->next = skb;
+                flow->tail = skb;
+                return;
+        }
+
+        /* This skb is a tcp retransmit,
+         * find the last retrans packet in the queue
+         */
+        prev = NULL;
+        while (skb_is_retransmit(head)) {
+                prev = head;
+                head = head->next;
+                if (!head)
+                        break;
+        }
+        if (!prev) { /* no rtx packet in queue, become the new head */
+                skb->next = flow->head;
+                flow->head = skb;
+        } else {
+                if (prev == flow->tail)
+                        flow->tail = skb;
+                else
+                        skb->next = prev->next;
+                prev->next = skb;
+        }
+}
+
+static int fq_enqueue(struct sk_buff *skb, struct Qdisc *sch)
+{
+        struct fq_sched_data *q = qdisc_priv(sch);
+        struct fq_flow *f;
+
+        if (unlikely(sch->q.qlen >= sch->limit))
+                return qdisc_drop(skb, sch);
+
+        f = fq_classify(skb, q);
+        if (unlikely(f->qlen >= q->flow_plimit && f != &q->internal)) {
+                q->stat_flows_plimit++;
+                return qdisc_drop(skb, sch);
+        }
+
+        f->qlen++;
+        flow_queue_add(f, skb);
+        if (skb_is_retransmit(skb))
+                q->stat_tcp_retrans++;
+        sch->qstats.backlog += qdisc_pkt_len(skb);
+        if (fq_flow_is_detached(f)) {
+                fq_flow_add_tail(&q->new_flows, f);
+                if (q->quantum > f->credit)
+                        f->credit = q->quantum;
+                q->inactive_flows--;
+                qdisc_unthrottled(sch);
+        }
+        if (unlikely(f == &q->internal)) {
+                q->stat_internal_packets++;
+                qdisc_unthrottled(sch);
+        }
+        sch->q.qlen++;
+
+        return NET_XMIT_SUCCESS;
+}
+
+static void fq_check_throttled(struct fq_sched_data *q, u64 now)
+{
+        struct rb_node *p;
+
+        if (q->time_next_delayed_flow > now)
+                return;
+
+        q->time_next_delayed_flow = ~0ULL;
+        while ((p = rb_first(&q->delayed)) != NULL) {
+                struct fq_flow *f = container_of(p, struct fq_flow, rate_node);
+
+                if (f->time_next_packet > now) {
+                        q->time_next_delayed_flow = f->time_next_packet;
+                        break;
+                }
+                rb_erase(p, &q->delayed);
+                q->throttled_flows--;
+                fq_flow_add_tail(&q->old_flows, f);
+        }
+}
+
+static struct sk_buff *fq_dequeue(struct Qdisc *sch)
+{
+        struct fq_sched_data *q = qdisc_priv(sch);
+        u64 now = ktime_to_ns(ktime_get());
+        struct fq_flow_head *head;
+        struct sk_buff *skb;
+        struct fq_flow *f;
+        u32 rate;
+
+        skb = fq_dequeue_head(sch, &q->internal);
+        if (skb)
+                goto out;
+        fq_check_throttled(q, now);
+begin:
+        head = &q->new_flows;
+        if (!head->first) {
+                head = &q->old_flows;
+                if (!head->first) {
+                        if (q->time_next_delayed_flow != ~0ULL)
+                                qdisc_watchdog_schedule_ns(&q->watchdog,
+                                                           q->time_next_delayed_flow);
+                        return NULL;
+                }
+        }
+        f = head->first;
+
+        if (f->credit <= 0) {
+                f->credit += q->quantum;
+                head->first = f->next;
+                fq_flow_add_tail(&q->old_flows, f);
+                goto begin;
+        }
+
+        if (unlikely(f->head && now < f->time_next_packet)) {
+                head->first = f->next;
+                fq_flow_set_throttled(q, f);
+                goto begin;
+        }
+
+        skb = fq_dequeue_head(sch, f);
+        if (!skb) {
+                head->first = f->next;
+                /* force a pass through old_flows to prevent starvation */
+                if ((head == &q->new_flows) && q->old_flows.first) {
+                        fq_flow_add_tail(&q->old_flows, f);
+                } else {
+                        fq_flow_set_detached(f);
+                        f->age = jiffies;
+                        q->inactive_flows++;
+                }
+                goto begin;
+        }
+        prefetch(&skb->end);
+        f->time_next_packet = now;
+        f->credit -= qdisc_pkt_len(skb);
+
+        if (f->credit > 0 || !q->rate_enable)
+                goto out;
+
+        if (skb->sk && skb->sk->sk_state != TCP_TIME_WAIT) {
+                rate = skb->sk->sk_pacing_rate ?: q->flow_default_rate;
+
+                rate = min(rate, q->flow_max_rate);
+        } else {
+                rate = q->flow_max_rate;
+                if (rate == ~0U)
+                        goto out;
+        }
+        if (rate) {
+                u32 plen = max(qdisc_pkt_len(skb), q->quantum);
+                u64 len = (u64)plen * NSEC_PER_SEC;
+
+                do_div(len, rate);
+                /* Since socket rate can change later,
+                 * clamp the delay to 125 ms.
+                 * TODO: maybe segment the too big skb, as in commit
+                 * e43ac79a4bc ("sch_tbf: segment too big GSO packets")
+                 */
+                if (unlikely(len > 125 * NSEC_PER_MSEC)) {
+                        len = 125 * NSEC_PER_MSEC;
+                        q->stat_pkts_too_long++;
+                }
+
+                f->time_next_packet = now + len;
+        }
+out:
+        qdisc_bstats_update(sch, skb);
+        qdisc_unthrottled(sch);
+        return skb;
+}
+
+static void fq_reset(struct Qdisc *sch)
+{
+        struct fq_sched_data *q = qdisc_priv(sch);
+        struct rb_root *root;
+        struct sk_buff *skb;
+        struct rb_node *p;
+        struct fq_flow *f;
+        unsigned int idx;
+
+        while ((skb = fq_dequeue_head(sch, &q->internal)) != NULL)
+                kfree_skb(skb);
+
+        if (!q->fq_root)
+                return;
+
+        for (idx = 0; idx < (1U << q->fq_trees_log); idx++) {
+                root = &q->fq_root[idx];
+                while ((p = rb_first(root)) != NULL) {
+                        f = container_of(p, struct fq_flow, fq_node);
+                        rb_erase(p, root);
+
+                        while ((skb = fq_dequeue_head(sch, f)) != NULL)
+                                kfree_skb(skb);
+
+                        kmem_cache_free(fq_flow_cachep, f);
+                }
+        }
+        q->new_flows.first      = NULL;
+        q->old_flows.first      = NULL;
+        q->delayed              = RB_ROOT;
+        q->flows                = 0;
+        q->inactive_flows       = 0;
+        q->throttled_flows      = 0;
+}
+
+static void fq_rehash(struct fq_sched_data *q,
+                      struct rb_root *old_array, u32 old_log,
+                      struct rb_root *new_array, u32 new_log)
+{
+        struct rb_node *op, **np, *parent;
+        struct rb_root *oroot, *nroot;
+        struct fq_flow *of, *nf;
+        int fcnt = 0;
+        u32 idx;
+
+        for (idx = 0; idx < (1U << old_log); idx++) {
+                oroot = &old_array[idx];
+                while ((op = rb_first(oroot)) != NULL) {
+                        rb_erase(op, oroot);
+                        of = container_of(op, struct fq_flow, fq_node);
+                        if (fq_gc_candidate(of)) {
+                                fcnt++;
+                                kmem_cache_free(fq_flow_cachep, of);
+                                continue;
+                        }
+                        nroot = &new_array[hash_32((u32)(long)of->sk, new_log)];
+
+                        np = &nroot->rb_node;
+                        parent = NULL;
+                        while (*np) {
+                                parent = *np;
+
+                                nf = container_of(parent, struct fq_flow, fq_node);
+                                BUG_ON(nf->sk == of->sk);
+
+                                if (nf->sk > of->sk)
+                                        np = &parent->rb_right;
+                                else
+                                        np = &parent->rb_left;
+                        }
+
+                        rb_link_node(&of->fq_node, parent, np);
+                        rb_insert_color(&of->fq_node, nroot);
+                }
+        }
+        q->flows -= fcnt;
+        q->inactive_flows -= fcnt;
+        q->stat_gc_flows += fcnt;
+}
+
+static int fq_resize(struct fq_sched_data *q, u32 log)
+{
+        struct rb_root *array;
+        u32 idx;
+
+        if (q->fq_root && log == q->fq_trees_log)
+                return 0;
+
+        array = kmalloc(sizeof(struct rb_root) << log, GFP_KERNEL);
+        if (!array)
+                return -ENOMEM;
+
+        for (idx = 0; idx < (1U << log); idx++)
+                array[idx] = RB_ROOT;
+
+        if (q->fq_root) {
+                fq_rehash(q, q->fq_root, q->fq_trees_log, array, log);
+                kfree(q->fq_root);
+        }
+        q->fq_root = array;
+        q->fq_trees_log = log;
+
+        return 0;
+}
+
+static const struct nla_policy fq_policy[TCA_FQ_MAX + 1] = {
+        [TCA_FQ_PLIMIT]                 = { .type = NLA_U32 },
+        [TCA_FQ_FLOW_PLIMIT]            = { .type = NLA_U32 },
+        [TCA_FQ_QUANTUM]                = { .type = NLA_U32 },
+        [TCA_FQ_INITIAL_QUANTUM]        = { .type = NLA_U32 },
+        [TCA_FQ_RATE_ENABLE]            = { .type = NLA_U32 },
+        [TCA_FQ_FLOW_DEFAULT_RATE]      = { .type = NLA_U32 },
+        [TCA_FQ_FLOW_MAX_RATE]          = { .type = NLA_U32 },
+        [TCA_FQ_BUCKETS_LOG]            = { .type = NLA_U32 },
+};
+
+static int fq_change(struct Qdisc *sch, struct nlattr *opt)
+{
+        struct fq_sched_data *q = qdisc_priv(sch);
+        struct nlattr *tb[TCA_FQ_MAX + 1];
+        int err, drop_count = 0;
+        u32 fq_log;
+
+        if (!opt)
+                return -EINVAL;
+
+        err = nla_parse_nested(tb, TCA_FQ_MAX, opt, fq_policy);
+        if (err < 0)
+                return err;
+
+        sch_tree_lock(sch);
+
+        fq_log = q->fq_trees_log;
+
+        if (tb[TCA_FQ_BUCKETS_LOG]) {
+                u32 nval = nla_get_u32(tb[TCA_FQ_BUCKETS_LOG]);
+
+                if (nval >= 1 && nval <= ilog2(256*1024))
+                        fq_log = nval;
+                else
+                        err = -EINVAL;
+        }
+        if (tb[TCA_FQ_PLIMIT])
+                sch->limit = nla_get_u32(tb[TCA_FQ_PLIMIT]);
+
+        if (tb[TCA_FQ_FLOW_PLIMIT])
+                q->flow_plimit = nla_get_u32(tb[TCA_FQ_FLOW_PLIMIT]);
+
+        if (tb[TCA_FQ_QUANTUM])
+                q->quantum = nla_get_u32(tb[TCA_FQ_QUANTUM]);
+
+        if (tb[TCA_FQ_INITIAL_QUANTUM])
+                q->quantum = nla_get_u32(tb[TCA_FQ_INITIAL_QUANTUM]);
+
+        if (tb[TCA_FQ_FLOW_DEFAULT_RATE])
+                q->flow_default_rate = nla_get_u32(tb[TCA_FQ_FLOW_DEFAULT_RATE]);
+
+        if (tb[TCA_FQ_FLOW_MAX_RATE])
+                q->flow_max_rate = nla_get_u32(tb[TCA_FQ_FLOW_MAX_RATE]);
+
+        if (tb[TCA_FQ_RATE_ENABLE]) {
+                u32 enable = nla_get_u32(tb[TCA_FQ_RATE_ENABLE]);
+
+                if (enable <= 1)
+                        q->rate_enable = enable;
+                else
+                        err = -EINVAL;
+        }
+
+        if (!err)
+                err = fq_resize(q, fq_log);
+
+        while (sch->q.qlen > sch->limit) {
+                struct sk_buff *skb = fq_dequeue(sch);
+
+                if (!skb)
+                        break;
+                kfree_skb(skb);
+                drop_count++;
+        }
+        qdisc_tree_decrease_qlen(sch, drop_count);
+
+        sch_tree_unlock(sch);
+        return err;
+}
+
+static void fq_destroy(struct Qdisc *sch)
+{
+        struct fq_sched_data *q = qdisc_priv(sch);
+
+        fq_reset(sch);
+        kfree(q->fq_root);
+        qdisc_watchdog_cancel(&q->watchdog);
+}
+
+static int fq_init(struct Qdisc *sch, struct nlattr *opt)
+{
+        struct fq_sched_data *q = qdisc_priv(sch);
+        int err;
+
+        sch->limit              = 10000;
+        q->flow_plimit          = 100;
+        q->quantum              = 2 * psched_mtu(qdisc_dev(sch));
+        q->initial_quantum      = 10 * psched_mtu(qdisc_dev(sch));
+        q->flow_default_rate    = 0;
+        q->flow_max_rate        = ~0U;
+        q->rate_enable          = 1;
+        q->new_flows.first      = NULL;
+        q->old_flows.first      = NULL;
+        q->delayed              = RB_ROOT;
+        q->fq_root              = NULL;
+        q->fq_trees_log         = ilog2(1024);
+        qdisc_watchdog_init(&q->watchdog, sch);
+
+        if (opt)
+                err = fq_change(sch, opt);
+        else
+                err = fq_resize(q, q->fq_trees_log);
+
+        return err;
+}
+
+static int fq_dump(struct Qdisc *sch, struct sk_buff *skb)
+{
+        struct fq_sched_data *q = qdisc_priv(sch);
+        struct nlattr *opts;
+
+        opts = nla_nest_start(skb, TCA_OPTIONS);
+        if (opts == NULL)
+                goto nla_put_failure;
+
+        if (nla_put_u32(skb, TCA_FQ_PLIMIT, sch->limit) ||
+            nla_put_u32(skb, TCA_FQ_FLOW_PLIMIT, q->flow_plimit) ||
+            nla_put_u32(skb, TCA_FQ_QUANTUM, q->quantum) ||
+            nla_put_u32(skb, TCA_FQ_INITIAL_QUANTUM, q->initial_quantum) ||
+            nla_put_u32(skb, TCA_FQ_RATE_ENABLE, q->rate_enable) ||
+            nla_put_u32(skb, TCA_FQ_FLOW_DEFAULT_RATE, q->flow_default_rate) ||
+            nla_put_u32(skb, TCA_FQ_FLOW_MAX_RATE, q->flow_max_rate) ||
+            nla_put_u32(skb, TCA_FQ_BUCKETS_LOG, q->fq_trees_log))
+                goto nla_put_failure;
+
+        nla_nest_end(skb, opts);
+        return skb->len;
+
+nla_put_failure:
+        return -1;
+}
+
+static int fq_dump_stats(struct Qdisc *sch, struct gnet_dump *d)
+{
+        struct fq_sched_data *q = qdisc_priv(sch);
+        u64 now = ktime_to_ns(ktime_get());
+        struct tc_fq_qd_stats st = {
+                .gc_flows               = q->stat_gc_flows,
+                .highprio_packets       = q->stat_internal_packets,
+                .tcp_retrans            = q->stat_tcp_retrans,
+                .throttled              = q->stat_throttled,
+                .flows_plimit           = q->stat_flows_plimit,
+                .pkts_too_long          = q->stat_pkts_too_long,
+                .allocation_errors      = q->stat_allocation_errors,
+                .flows                  = q->flows,
+                .inactive_flows         = q->inactive_flows,
+                .throttled_flows        = q->throttled_flows,
+                .time_next_delayed_flow = q->time_next_delayed_flow - now,
+        };
+
+        return gnet_stats_copy_app(d, &st, sizeof(st));
+}
+
+static struct Qdisc_ops fq_qdisc_ops __read_mostly = {
+        .id             =       "fq",
+        .priv_size      =       sizeof(struct fq_sched_data),
+
+        .enqueue        =       fq_enqueue,
+        .dequeue        =       fq_dequeue,
+        .peek           =       qdisc_peek_dequeued,
+        .init           =       fq_init,
+        .reset          =       fq_reset,
+        .destroy        =       fq_destroy,
+        .change         =       fq_change,
+        .dump           =       fq_dump,
+        .dump_stats     =       fq_dump_stats,
+        .owner          =       THIS_MODULE,
+};
+
+static int __init fq_module_init(void)
+{
+        int ret;
+
+        fq_flow_cachep = kmem_cache_create("fq_flow_cache",
+                                           sizeof(struct fq_flow),
+                                           0, 0, NULL);
+        if (!fq_flow_cachep)
+                return -ENOMEM;
+
+        ret = register_qdisc(&fq_qdisc_ops);
+        if (ret)
+                kmem_cache_destroy(fq_flow_cachep);
+        return ret;
+}
+
+static void __exit fq_module_exit(void)
+{
+        unregister_qdisc(&fq_qdisc_ops);
+        kmem_cache_destroy(fq_flow_cachep);
+}
+
+module_init(fq_module_init)
+module_exit(fq_module_exit)
+MODULE_AUTHOR("Eric Dumazet");
+MODULE_LICENSE("GPL");
diff --git a/net/sched/sch_generic.c b/net/sched/sch_generic.c
index 20224086cc28..a74e278654aa 100644
--- a/net/sched/sch_generic.c
+++ b/net/sched/sch_generic.c
@@ -25,10 +25,15 @@
 #include <linux/rcupdate.h>
 #include <linux/list.h>
 #include <linux/slab.h>
+#include <linux/if_vlan.h>
 #include <net/sch_generic.h>
 #include <net/pkt_sched.h>
 #include <net/dst.h>
 
+/* Qdisc to use by default */
+const struct Qdisc_ops *default_qdisc_ops = &pfifo_fast_ops;
+EXPORT_SYMBOL(default_qdisc_ops);
+
 /* Main transmission queue. */
 
 /* Modifications to data participating in scheduling must be protected with
@@ -207,15 +212,19 @@ void __qdisc_run(struct Qdisc *q)
 
 unsigned long dev_trans_start(struct net_device *dev)
 {
-        unsigned long val, res = dev->trans_start;
+        unsigned long val, res;
         unsigned int i;
 
+        if (is_vlan_dev(dev))
+                dev = vlan_dev_real_dev(dev);
+        res = dev->trans_start;
         for (i = 0; i < dev->num_tx_queues; i++) {
                 val = netdev_get_tx_queue(dev, i)->trans_start;
                 if (val && time_after(val, res))
                         res = val;
         }
         dev->trans_start = res;
+
         return res;
 }
 EXPORT_SYMBOL(dev_trans_start);
@@ -525,12 +534,11 @@ struct Qdisc_ops pfifo_fast_ops __read_mostly = {
         .dump           =       pfifo_fast_dump,
         .owner          =       THIS_MODULE,
 };
-EXPORT_SYMBOL(pfifo_fast_ops);
 
 static struct lock_class_key qdisc_tx_busylock;
 
 struct Qdisc *qdisc_alloc(struct netdev_queue *dev_queue,
-                          struct Qdisc_ops *ops)
+                          const struct Qdisc_ops *ops)
 {
         void *p;
         struct Qdisc *sch;
@@ -574,10 +582,14 @@ errout:
 }
 
 struct Qdisc *qdisc_create_dflt(struct netdev_queue *dev_queue,
-                                struct Qdisc_ops *ops, unsigned int parentid)
+                                const struct Qdisc_ops *ops,
+                                unsigned int parentid)
 {
         struct Qdisc *sch;
 
+        if (!try_module_get(ops->owner))
+                goto errout;
+
         sch = qdisc_alloc(dev_queue, ops);
         if (IS_ERR(sch))
                 goto errout;
@@ -681,7 +693,7 @@ static void attach_one_default_qdisc(struct net_device *dev,
 
         if (dev->tx_queue_len) {
                 qdisc = qdisc_create_dflt(dev_queue,
-                                          &pfifo_fast_ops, TC_H_ROOT);
+                                          default_qdisc_ops, TC_H_ROOT);
                 if (!qdisc) {
                         netdev_info(dev, "activation failed\n");
                         return;
@@ -734,9 +746,8 @@ void dev_activate(struct net_device *dev)
         int need_watchdog;
 
         /* No queueing discipline is attached to device;
-           create default one i.e. pfifo_fast for devices,
-           which need queueing and noqueue_qdisc for
-           virtual interfaces
+         * create default one for devices, which need queueing
+         * and noqueue_qdisc for virtual interfaces
          */
 
         if (dev->qdisc == &noop_qdisc)
@@ -901,37 +912,34 @@ void dev_shutdown(struct net_device *dev)
 void psched_ratecfg_precompute(struct psched_ratecfg *r,
                                const struct tc_ratespec *conf)
 {
-        u64 factor;
-        u64 mult;
-        int shift;
-
         memset(r, 0, sizeof(*r));
         r->overhead = conf->overhead;
-        r->rate_bps = (u64)conf->rate << 3;
+        r->rate_bytes_ps = conf->rate;
+        r->linklayer = (conf->linklayer & TC_LINKLAYER_MASK);
         r->mult = 1;
         /*
-         * Calibrate mult, shift so that token counting is accurate
-         * for smallest packet size (64 bytes).  Token (time in ns) is
-         * computed as (bytes * 8) * NSEC_PER_SEC / rate_bps.  It will
-         * work as long as the smallest packet transfer time can be
-         * accurately represented in nanosec.
+         * The deal here is to replace a divide by a reciprocal one
+         * in fast path (a reciprocal divide is a multiply and a shift)
+         *
+         * Normal formula would be :
+         *  time_in_ns = (NSEC_PER_SEC * len) / rate_bps
+         *
+         * We compute mult/shift to use instead :
+         *  time_in_ns = (len * mult) >> shift;
+         *
+         * We try to get the highest possible mult value for accuracy,
+         * but have to make sure no overflows will ever happen.
          */
-        if (r->rate_bps > 0) {
-                /*
-                 * Higher shift gives better accuracy.  Find the largest
-                 * shift such that mult fits in 32 bits.
-                 */
-                for (shift = 0; shift < 16; shift++) {
-                        r->shift = shift;
-                        factor = 8LLU * NSEC_PER_SEC * (1 << r->shift);
-                        mult = div64_u64(factor, r->rate_bps);
-                        if (mult > UINT_MAX)
+        if (r->rate_bytes_ps > 0) {
+                u64 factor = NSEC_PER_SEC;
+
+                for (;;) {
+                        r->mult = div64_u64(factor, r->rate_bytes_ps);
+                        if (r->mult & (1U << 31) || factor & (1ULL << 63))
                                 break;
+                        factor <<= 1;
+                        r->shift++;
                 }
-
-                r->shift = shift - 1;
-                factor = 8LLU * NSEC_PER_SEC * (1 << r->shift);
-                r->mult = div64_u64(factor, r->rate_bps);
         }
 }
 EXPORT_SYMBOL(psched_ratecfg_precompute);
diff --git a/net/sched/sch_hfsc.c b/net/sched/sch_hfsc.c
index 9facea03faeb..c4075610502c 100644
--- a/net/sched/sch_hfsc.c
+++ b/net/sched/sch_hfsc.c
@@ -114,7 +114,7 @@ struct hfsc_class {
 
         struct gnet_stats_basic_packed bstats;
         struct gnet_stats_queue qstats;
-        struct gnet_stats_rate_est rate_est;
+        struct gnet_stats_rate_est64 rate_est;
         unsigned int    level;          /* class level in hierarchy */
         struct tcf_proto *filter_list;  /* filter list */
         unsigned int    filter_cnt;     /* filter count */
diff --git a/net/sched/sch_htb.c b/net/sched/sch_htb.c
index adaedd79389c..863846cc5513 100644
--- a/net/sched/sch_htb.c
+++ b/net/sched/sch_htb.c
@@ -65,6 +65,10 @@ static int htb_hysteresis __read_mostly = 0; /* whether to use mode hysteresis f
 module_param    (htb_hysteresis, int, 0640);
 MODULE_PARM_DESC(htb_hysteresis, "Hysteresis mode, less CPU load, less accurate");
 
+static int htb_rate_est = 0; /* htb classes have a default rate estimator */
+module_param(htb_rate_est, int, 0640);
+MODULE_PARM_DESC(htb_rate_est, "setup a default rate estimator (4sec 16sec) for htb classes");
+
 /* used internaly to keep status of single class */
 enum htb_cmode {
         HTB_CANT_SEND,          /* class can't send and can't borrow */
@@ -72,95 +76,105 @@ enum htb_cmode {
         HTB_CAN_SEND            /* class can send */
 };
 
-/* interior & leaf nodes; props specific to leaves are marked L: */
+struct htb_prio {
+        union {
+                struct rb_root  row;
+                struct rb_root  feed;
+        };
+        struct rb_node  *ptr;
+        /* When class changes from state 1->2 and disconnects from
+         * parent's feed then we lost ptr value and start from the
+         * first child again. Here we store classid of the
+         * last valid ptr (used when ptr is NULL).
+         */
+        u32             last_ptr_id;
+};
+
+/* interior & leaf nodes; props specific to leaves are marked L:
+ * To reduce false sharing, place mostly read fields at beginning,
+ * and mostly written ones at the end.
+ */
 struct htb_class {
         struct Qdisc_class_common common;
-        /* general class parameters */
-        struct gnet_stats_basic_packed bstats;
-        struct gnet_stats_queue qstats;
-        struct gnet_stats_rate_est rate_est;
-        struct tc_htb_xstats xstats;    /* our special stats */
-        int refcnt;             /* usage count of this class */
+        struct psched_ratecfg   rate;
+        struct psched_ratecfg   ceil;
+        s64                     buffer, cbuffer;/* token bucket depth/rate */
+        s64                     mbuffer;        /* max wait time */
+        u32                     prio;           /* these two are used only by leaves... */
+        int                     quantum;        /* but stored for parent-to-leaf return */
+
+        struct tcf_proto        *filter_list;   /* class attached filters */
+        int                     filter_cnt;
+        int                     refcnt;         /* usage count of this class */
+
+        int                     level;          /* our level (see above) */
+        unsigned int            children;
+        struct htb_class        *parent;        /* parent class */
 
-        /* topology */
-        int level;              /* our level (see above) */
-        unsigned int children;
-        struct htb_class *parent;       /* parent class */
+        struct gnet_stats_rate_est64 rate_est;
 
-        int prio;               /* these two are used only by leaves... */
-        int quantum;            /* but stored for parent-to-leaf return */
+        /*
+         * Written often fields
+         */
+        struct gnet_stats_basic_packed bstats;
+        struct gnet_stats_queue qstats;
+        struct tc_htb_xstats    xstats; /* our special stats */
+
+        /* token bucket parameters */
+        s64                     tokens, ctokens;/* current number of tokens */
+        s64                     t_c;            /* checkpoint time */
 
         union {
                 struct htb_class_leaf {
-                        struct Qdisc *q;
-                        int deficit[TC_HTB_MAXDEPTH];
                         struct list_head drop_list;
+                        int             deficit[TC_HTB_MAXDEPTH];
+                        struct Qdisc    *q;
                 } leaf;
                 struct htb_class_inner {
-                        struct rb_root feed[TC_HTB_NUMPRIO];    /* feed trees */
-                        struct rb_node *ptr[TC_HTB_NUMPRIO];    /* current class ptr */
-                        /* When class changes from state 1->2 and disconnects from
-                         * parent's feed then we lost ptr value and start from the
-                         * first child again. Here we store classid of the
-                         * last valid ptr (used when ptr is NULL).
-                         */
-                        u32 last_ptr_id[TC_HTB_NUMPRIO];
+                        struct htb_prio clprio[TC_HTB_NUMPRIO];
                 } inner;
         } un;
-        struct rb_node node[TC_HTB_NUMPRIO];    /* node for self or feed tree */
-        struct rb_node pq_node; /* node for event queue */
-        s64     pq_key;
-
-        int prio_activity;      /* for which prios are we active */
-        enum htb_cmode cmode;   /* current mode of the class */
+        s64                     pq_key;
 
-        /* class attached filters */
-        struct tcf_proto *filter_list;
-        int filter_cnt;
+        int                     prio_activity;  /* for which prios are we active */
+        enum htb_cmode          cmode;          /* current mode of the class */
+        struct rb_node          pq_node;        /* node for event queue */
+        struct rb_node          node[TC_HTB_NUMPRIO];   /* node for self or feed tree */
+};
 
-        /* token bucket parameters */
-        struct psched_ratecfg rate;
-        struct psched_ratecfg ceil;
-        s64     buffer, cbuffer;        /* token bucket depth/rate */
-        s64     mbuffer;                /* max wait time */
-        s64     tokens, ctokens;        /* current number of tokens */
-        s64     t_c;                    /* checkpoint time */
+struct htb_level {
+        struct rb_root  wait_pq;
+        struct htb_prio hprio[TC_HTB_NUMPRIO];
 };
 
 struct htb_sched {
         struct Qdisc_class_hash clhash;
-        struct list_head drops[TC_HTB_NUMPRIO];/* active leaves (for drops) */
+        int                     defcls;         /* class where unclassified flows go to */
+        int                     rate2quantum;   /* quant = rate / rate2quantum */
 
-        /* self list - roots of self generating tree */
-        struct rb_root row[TC_HTB_MAXDEPTH][TC_HTB_NUMPRIO];
-        int row_mask[TC_HTB_MAXDEPTH];
-        struct rb_node *ptr[TC_HTB_MAXDEPTH][TC_HTB_NUMPRIO];
-        u32 last_ptr_id[TC_HTB_MAXDEPTH][TC_HTB_NUMPRIO];
+        /* filters for qdisc itself */
+        struct tcf_proto        *filter_list;
 
-        /* self wait list - roots of wait PQs per row */
-        struct rb_root wait_pq[TC_HTB_MAXDEPTH];
+#define HTB_WARN_TOOMANYEVENTS  0x1
+        unsigned int            warned; /* only one warning */
+        int                     direct_qlen;
+        struct work_struct      work;
 
-        /* time of nearest event per level (row) */
-        s64     near_ev_cache[TC_HTB_MAXDEPTH];
+        /* non shaped skbs; let them go directly thru */
+        struct sk_buff_head     direct_queue;
+        long                    direct_pkts;
 
-        int defcls;             /* class where unclassified flows go to */
+        struct qdisc_watchdog   watchdog;
 
-        /* filters for qdisc itself */
-        struct tcf_proto *filter_list;
+        s64                     now;    /* cached dequeue time */
+        struct list_head        drops[TC_HTB_NUMPRIO];/* active leaves (for drops) */
 
-        int     rate2quantum;   /* quant = rate / rate2quantum */
-        s64     now;    /* cached dequeue time */
-        struct qdisc_watchdog watchdog;
-
-        /* non shaped skbs; let them go directly thru */
-        struct sk_buff_head direct_queue;
-        int direct_qlen;        /* max qlen of above */
+        /* time of nearest event per level (row) */
+        s64                     near_ev_cache[TC_HTB_MAXDEPTH];
 
-        long direct_pkts;
+        int                     row_mask[TC_HTB_MAXDEPTH];
 
-#define HTB_WARN_TOOMANYEVENTS  0x1
-        unsigned int warned;    /* only one warning */
-        struct work_struct work;
+        struct htb_level        hlevel[TC_HTB_MAXDEPTH];
 };
 
 /* find class in global hash table using given handle */
@@ -276,7 +290,7 @@ static void htb_add_to_id_tree(struct rb_root *root,
 static void htb_add_to_wait_tree(struct htb_sched *q,
                                  struct htb_class *cl, s64 delay)
 {
-        struct rb_node **p = &q->wait_pq[cl->level].rb_node, *parent = NULL;
+        struct rb_node **p = &q->hlevel[cl->level].wait_pq.rb_node, *parent = NULL;
 
         cl->pq_key = q->now + delay;
         if (cl->pq_key == q->now)
@@ -296,7 +310,7 @@ static void htb_add_to_wait_tree(struct htb_sched *q,
                         p = &parent->rb_left;
         }
         rb_link_node(&cl->pq_node, parent, p);
-        rb_insert_color(&cl->pq_node, &q->wait_pq[cl->level]);
+        rb_insert_color(&cl->pq_node, &q->hlevel[cl->level].wait_pq);
 }
 
 /**
@@ -323,7 +337,7 @@ static inline void htb_add_class_to_row(struct htb_sched *q,
         while (mask) {
                 int prio = ffz(~mask);
                 mask &= ~(1 << prio);
-                htb_add_to_id_tree(q->row[cl->level] + prio, cl, prio);
+                htb_add_to_id_tree(&q->hlevel[cl->level].hprio[prio].row, cl, prio);
         }
 }
 
@@ -349,16 +363,18 @@ static inline void htb_remove_class_from_row(struct htb_sched *q,
                                                  struct htb_class *cl, int mask)
 {
         int m = 0;
+        struct htb_level *hlevel = &q->hlevel[cl->level];
 
         while (mask) {
                 int prio = ffz(~mask);
+                struct htb_prio *hprio = &hlevel->hprio[prio];
 
                 mask &= ~(1 << prio);
-                if (q->ptr[cl->level][prio] == cl->node + prio)
-                        htb_next_rb_node(q->ptr[cl->level] + prio);
+                if (hprio->ptr == cl->node + prio)
+                        htb_next_rb_node(&hprio->ptr);
 
-                htb_safe_rb_erase(cl->node + prio, q->row[cl->level] + prio);
-                if (!q->row[cl->level][prio].rb_node)
+                htb_safe_rb_erase(cl->node + prio, &hprio->row);
+                if (!hprio->row.rb_node)
                         m |= 1 << prio;
         }
         q->row_mask[cl->level] &= ~m;
@@ -382,13 +398,13 @@ static void htb_activate_prios(struct htb_sched *q, struct htb_class *cl)
                         int prio = ffz(~m);
                         m &= ~(1 << prio);
 
-                        if (p->un.inner.feed[prio].rb_node)
+                        if (p->un.inner.clprio[prio].feed.rb_node)
                                 /* parent already has its feed in use so that
                                  * reset bit in mask as parent is already ok
                                  */
                                 mask &= ~(1 << prio);
 
-                        htb_add_to_id_tree(p->un.inner.feed + prio, cl, prio);
+                        htb_add_to_id_tree(&p->un.inner.clprio[prio].feed, cl, prio);
                 }
                 p->prio_activity |= mask;
                 cl = p;
@@ -418,18 +434,19 @@ static void htb_deactivate_prios(struct htb_sched *q, struct htb_class *cl)
                         int prio = ffz(~m);
                         m &= ~(1 << prio);
 
-                        if (p->un.inner.ptr[prio] == cl->node + prio) {
+                        if (p->un.inner.clprio[prio].ptr == cl->node + prio) {
                                 /* we are removing child which is pointed to from
                                  * parent feed - forget the pointer but remember
                                  * classid
                                  */
-                                p->un.inner.last_ptr_id[prio] = cl->common.classid;
-                                p->un.inner.ptr[prio] = NULL;
+                                p->un.inner.clprio[prio].last_ptr_id = cl->common.classid;
+                                p->un.inner.clprio[prio].ptr = NULL;
                         }
 
-                        htb_safe_rb_erase(cl->node + prio, p->un.inner.feed + prio);
+                        htb_safe_rb_erase(cl->node + prio,
+                                          &p->un.inner.clprio[prio].feed);
 
-                        if (!p->un.inner.feed[prio].rb_node)
+                        if (!p->un.inner.clprio[prio].feed.rb_node)
                                 mask |= 1 << prio;
                 }
 
@@ -644,7 +661,7 @@ static void htb_charge_class(struct htb_sched *q, struct htb_class *cl,
                 htb_change_class_mode(q, cl, &diff);
                 if (old_mode != cl->cmode) {
                         if (old_mode != HTB_CAN_SEND)
-                                htb_safe_rb_erase(&cl->pq_node, q->wait_pq + cl->level);
+                                htb_safe_rb_erase(&cl->pq_node, &q->hlevel[cl->level].wait_pq);
                         if (cl->cmode != HTB_CAN_SEND)
                                 htb_add_to_wait_tree(q, cl, diff);
                 }
@@ -664,7 +681,7 @@ static void htb_charge_class(struct htb_sched *q, struct htb_class *cl,
  * next pending event (0 for no event in pq, q->now for too many events).
  * Note: Applied are events whose have cl->pq_key <= q->now.
  */
-static s64 htb_do_events(struct htb_sched *q, int level,
+static s64 htb_do_events(struct htb_sched *q, const int level,
                          unsigned long start)
 {
         /* don't run for longer than 2 jiffies; 2 is used instead of
@@ -672,10 +689,12 @@ static s64 htb_do_events(struct htb_sched *q, int level,
          * too soon
          */
         unsigned long stop_at = start + 2;
+        struct rb_root *wait_pq = &q->hlevel[level].wait_pq;
+
         while (time_before(jiffies, stop_at)) {
                 struct htb_class *cl;
                 s64 diff;
-                struct rb_node *p = rb_first(&q->wait_pq[level]);
+                struct rb_node *p = rb_first(wait_pq);
 
                 if (!p)
                         return 0;
@@ -684,7 +703,7 @@ static s64 htb_do_events(struct htb_sched *q, int level,
                 if (cl->pq_key > q->now)
                         return cl->pq_key;
 
-                htb_safe_rb_erase(p, q->wait_pq + level);
+                htb_safe_rb_erase(p, wait_pq);
                 diff = min_t(s64, q->now - cl->t_c, cl->mbuffer);
                 htb_change_class_mode(q, cl, &diff);
                 if (cl->cmode != HTB_CAN_SEND)
@@ -728,8 +747,7 @@ static struct rb_node *htb_id_find_next_upper(int prio, struct rb_node *n,
  *
  * Find leaf where current feed pointers points to.
  */
-static struct htb_class *htb_lookup_leaf(struct rb_root *tree, int prio,
-                                         struct rb_node **pptr, u32 * pid)
+static struct htb_class *htb_lookup_leaf(struct htb_prio *hprio, const int prio)
 {
         int i;
         struct {
@@ -738,10 +756,10 @@ static struct htb_class *htb_lookup_leaf(struct rb_root *tree, int prio,
                 u32 *pid;
         } stk[TC_HTB_MAXDEPTH], *sp = stk;
 
-        BUG_ON(!tree->rb_node);
-        sp->root = tree->rb_node;
-        sp->pptr = pptr;
-        sp->pid = pid;
+        BUG_ON(!hprio->row.rb_node);
+        sp->root = hprio->row.rb_node;
+        sp->pptr = &hprio->ptr;
+        sp->pid = &hprio->last_ptr_id;
 
         for (i = 0; i < 65535; i++) {
                 if (!*sp->pptr && *sp->pid) {
@@ -768,12 +786,15 @@ static struct htb_class *htb_lookup_leaf(struct rb_root *tree, int prio,
                         }
                 } else {
                         struct htb_class *cl;
+                        struct htb_prio *clp;
+
                         cl = rb_entry(*sp->pptr, struct htb_class, node[prio]);
                         if (!cl->level)
                                 return cl;
-                        (++sp)->root = cl->un.inner.feed[prio].rb_node;
-                        sp->pptr = cl->un.inner.ptr + prio;
-                        sp->pid = cl->un.inner.last_ptr_id + prio;
+                        clp = &cl->un.inner.clprio[prio];
+                        (++sp)->root = clp->feed.rb_node;
+                        sp->pptr = &clp->ptr;
+                        sp->pid = &clp->last_ptr_id;
                 }
         }
         WARN_ON(1);
@@ -783,15 +804,16 @@ static struct htb_class *htb_lookup_leaf(struct rb_root *tree, int prio,
 /* dequeues packet at given priority and level; call only if
  * you are sure that there is active class at prio/level
  */
-static struct sk_buff *htb_dequeue_tree(struct htb_sched *q, int prio,
-                                        int level)
+static struct sk_buff *htb_dequeue_tree(struct htb_sched *q, const int prio,
+                                        const int level)
 {
         struct sk_buff *skb = NULL;
         struct htb_class *cl, *start;
+        struct htb_level *hlevel = &q->hlevel[level];
+        struct htb_prio *hprio = &hlevel->hprio[prio];
+
         /* look initial class up in the row */
-        start = cl = htb_lookup_leaf(q->row[level] + prio, prio,
-                                     q->ptr[level] + prio,
-                                     q->last_ptr_id[level] + prio);
+        start = cl = htb_lookup_leaf(hprio, prio);
 
         do {
 next:
@@ -811,9 +833,7 @@ next:
                         if ((q->row_mask[level] & (1 << prio)) == 0)
                                 return NULL;
 
-                        next = htb_lookup_leaf(q->row[level] + prio,
-                                               prio, q->ptr[level] + prio,
-                                               q->last_ptr_id[level] + prio);
+                        next = htb_lookup_leaf(hprio, prio);
 
                         if (cl == start)        /* fix start if we just deleted it */
                                 start = next;
@@ -826,11 +846,9 @@ next:
                         break;
 
                 qdisc_warn_nonwc("htb", cl->un.leaf.q);
-                htb_next_rb_node((level ? cl->parent->un.inner.ptr : q->
-                                  ptr[0]) + prio);
-                cl = htb_lookup_leaf(q->row[level] + prio, prio,
-                                     q->ptr[level] + prio,
-                                     q->last_ptr_id[level] + prio);
+                htb_next_rb_node(level ? &cl->parent->un.inner.clprio[prio].ptr:
+                                         &q->hlevel[0].hprio[prio].ptr);
+                cl = htb_lookup_leaf(hprio, prio);
 
         } while (cl != start);
 
@@ -839,8 +857,8 @@ next:
                 cl->un.leaf.deficit[level] -= qdisc_pkt_len(skb);
                 if (cl->un.leaf.deficit[level] < 0) {
                         cl->un.leaf.deficit[level] += cl->quantum;
-                        htb_next_rb_node((level ? cl->parent->un.inner.ptr : q->
-                                          ptr[0]) + prio);
+                        htb_next_rb_node(level ? &cl->parent->un.inner.clprio[prio].ptr :
+                                                 &q->hlevel[0].hprio[prio].ptr);
                 }
                 /* this used to be after charge_class but this constelation
                  * gives us slightly better performance
@@ -880,15 +898,14 @@ ok:
         for (level = 0; level < TC_HTB_MAXDEPTH; level++) {
                 /* common case optimization - skip event handler quickly */
                 int m;
-                s64 event;
+                s64 event = q->near_ev_cache[level];
 
-                if (q->now >= q->near_ev_cache[level]) {
+                if (q->now >= event) {
                         event = htb_do_events(q, level, start_at);
                         if (!event)
                                 event = q->now + NSEC_PER_SEC;
                         q->near_ev_cache[level] = event;
-                } else
-                        event = q->near_ev_cache[level];
+                }
 
                 if (next_event > event)
                         next_event = event;
@@ -968,10 +985,8 @@ static void htb_reset(struct Qdisc *sch)
         qdisc_watchdog_cancel(&q->watchdog);
         __skb_queue_purge(&q->direct_queue);
         sch->q.qlen = 0;
-        memset(q->row, 0, sizeof(q->row));
+        memset(q->hlevel, 0, sizeof(q->hlevel));
         memset(q->row_mask, 0, sizeof(q->row_mask));
-        memset(q->wait_pq, 0, sizeof(q->wait_pq));
-        memset(q->ptr, 0, sizeof(q->ptr));
         for (i = 0; i < TC_HTB_NUMPRIO; i++)
                 INIT_LIST_HEAD(q->drops + i);
 }
@@ -1192,7 +1207,8 @@ static void htb_parent_to_leaf(struct htb_sched *q, struct htb_class *cl,
         WARN_ON(cl->level || !cl->un.leaf.q || cl->prio_activity);
 
         if (parent->cmode != HTB_CAN_SEND)
-                htb_safe_rb_erase(&parent->pq_node, q->wait_pq + parent->level);
+                htb_safe_rb_erase(&parent->pq_node,
+                                  &q->hlevel[parent->level].wait_pq);
 
         parent->level = 0;
         memset(&parent->un.inner, 0, sizeof(parent->un.inner));
@@ -1281,7 +1297,8 @@ static int htb_delete(struct Qdisc *sch, unsigned long arg)
                 htb_deactivate(q, cl);
 
         if (cl->cmode != HTB_CAN_SEND)
-                htb_safe_rb_erase(&cl->pq_node, q->wait_pq + cl->level);
+                htb_safe_rb_erase(&cl->pq_node,
+                                  &q->hlevel[cl->level].wait_pq);
 
         if (last_child)
                 htb_parent_to_leaf(q, cl, new_q);
@@ -1312,6 +1329,7 @@ static int htb_change_class(struct Qdisc *sch, u32 classid,
         struct htb_sched *q = qdisc_priv(sch);
         struct htb_class *cl = (struct htb_class *)*arg, *parent;
         struct nlattr *opt = tca[TCA_OPTIONS];
+        struct qdisc_rate_table *rtab = NULL, *ctab = NULL;
         struct nlattr *tb[TCA_HTB_MAX + 1];
         struct tc_htb_opt *hopt;
 
@@ -1333,6 +1351,18 @@ static int htb_change_class(struct Qdisc *sch, u32 classid,
         if (!hopt->rate.rate || !hopt->ceil.rate)
                 goto failure;
 
+        /* Keeping backward compatible with rate_table based iproute2 tc */
+        if (hopt->rate.linklayer == TC_LINKLAYER_UNAWARE) {
+                rtab = qdisc_get_rtab(&hopt->rate, tb[TCA_HTB_RTAB]);
+                if (rtab)
+                        qdisc_put_rtab(rtab);
+        }
+        if (hopt->ceil.linklayer == TC_LINKLAYER_UNAWARE) {
+                ctab = qdisc_get_rtab(&hopt->ceil, tb[TCA_HTB_CTAB]);
+                if (ctab)
+                        qdisc_put_rtab(ctab);
+        }
+
         if (!cl) {              /* new class */
                 struct Qdisc *new_q;
                 int prio;
@@ -1366,12 +1396,14 @@ static int htb_change_class(struct Qdisc *sch, u32 classid,
                 if (!cl)
                         goto failure;
 
-                err = gen_new_estimator(&cl->bstats, &cl->rate_est,
-                                        qdisc_root_sleeping_lock(sch),
-                                        tca[TCA_RATE] ? : &est.nla);
-                if (err) {
-                        kfree(cl);
-                        goto failure;
+                if (htb_rate_est || tca[TCA_RATE]) {
+                        err = gen_new_estimator(&cl->bstats, &cl->rate_est,
+                                                qdisc_root_sleeping_lock(sch),
+                                                tca[TCA_RATE] ? : &est.nla);
+                        if (err) {
+                                kfree(cl);
+                                goto failure;
+                        }
                 }
 
                 cl->refcnt = 1;
@@ -1401,7 +1433,7 @@ static int htb_change_class(struct Qdisc *sch, u32 classid,
 
                         /* remove from evt list because of level change */
                         if (parent->cmode != HTB_CAN_SEND) {
-                                htb_safe_rb_erase(&parent->pq_node, q->wait_pq);
+                                htb_safe_rb_erase(&parent->pq_node, &q->hlevel[0].wait_pq);
                                 parent->cmode = HTB_CAN_SEND;
                         }
                         parent->level = (parent->parent ? parent->parent->level
@@ -1463,7 +1495,7 @@ static int htb_change_class(struct Qdisc *sch, u32 classid,
         psched_ratecfg_precompute(&cl->ceil, &hopt->ceil);
 
         cl->buffer = PSCHED_TICKS2NS(hopt->buffer);
-        cl->cbuffer = PSCHED_TICKS2NS(hopt->buffer);
+        cl->cbuffer = PSCHED_TICKS2NS(hopt->cbuffer);
 
         sch_tree_unlock(sch);
 
diff --git a/net/sched/sch_mq.c b/net/sched/sch_mq.c
index 5da78a19ac9a..2e56185736d6 100644
--- a/net/sched/sch_mq.c
+++ b/net/sched/sch_mq.c
@@ -57,7 +57,7 @@ static int mq_init(struct Qdisc *sch, struct nlattr *opt)
 
         for (ntx = 0; ntx < dev->num_tx_queues; ntx++) {
                 dev_queue = netdev_get_tx_queue(dev, ntx);
-                qdisc = qdisc_create_dflt(dev_queue, &pfifo_fast_ops,
+                qdisc = qdisc_create_dflt(dev_queue, default_qdisc_ops,
                                           TC_H_MAKE(TC_H_MAJ(sch->handle),
                                                     TC_H_MIN(ntx + 1)));
                 if (qdisc == NULL)
diff --git a/net/sched/sch_mqprio.c b/net/sched/sch_mqprio.c
index accec33c454c..d44c868cb537 100644
--- a/net/sched/sch_mqprio.c
+++ b/net/sched/sch_mqprio.c
@@ -124,7 +124,7 @@ static int mqprio_init(struct Qdisc *sch, struct nlattr *opt)
 
         for (i = 0; i < dev->num_tx_queues; i++) {
                 dev_queue = netdev_get_tx_queue(dev, i);
-                qdisc = qdisc_create_dflt(dev_queue, &pfifo_fast_ops,
+                qdisc = qdisc_create_dflt(dev_queue, default_qdisc_ops,
                                           TC_H_MAKE(TC_H_MAJ(sch->handle),
                                                     TC_H_MIN(i + 1)));
                 if (qdisc == NULL) {
diff --git a/net/sched/sch_netem.c b/net/sched/sch_netem.c
index 3d2acc7a9c80..a6d788d45216 100644
--- a/net/sched/sch_netem.c
+++ b/net/sched/sch_netem.c
@@ -23,6 +23,7 @@
 #include <linux/vmalloc.h>
 #include <linux/rtnetlink.h>
 #include <linux/reciprocal_div.h>
+#include <linux/rbtree.h>
 
 #include <net/netlink.h>
 #include <net/pkt_sched.h>
@@ -68,7 +69,8 @@
 */
 
 struct netem_sched_data {
-        /* internal t(ime)fifo qdisc uses sch->q and sch->limit */
+        /* internal t(ime)fifo qdisc uses t_root and sch->limit */
+        struct rb_root t_root;
 
         /* optional qdisc for classful handling (NULL at netem init) */
         struct Qdisc    *qdisc;
@@ -128,10 +130,35 @@ struct netem_sched_data {
  */
 struct netem_skb_cb {
         psched_time_t   time_to_send;
+        ktime_t         tstamp_save;
 };
 
+/* Because space in skb->cb[] is tight, netem overloads skb->next/prev/tstamp
+ * to hold a rb_node structure.
+ *
+ * If struct sk_buff layout is changed, the following checks will complain.
+ */
+static struct rb_node *netem_rb_node(struct sk_buff *skb)
+{
+        BUILD_BUG_ON(offsetof(struct sk_buff, next) != 0);
+        BUILD_BUG_ON(offsetof(struct sk_buff, prev) !=
+                     offsetof(struct sk_buff, next) + sizeof(skb->next));
+        BUILD_BUG_ON(offsetof(struct sk_buff, tstamp) !=
+                     offsetof(struct sk_buff, prev) + sizeof(skb->prev));
+        BUILD_BUG_ON(sizeof(struct rb_node) > sizeof(skb->next) +
+                                              sizeof(skb->prev) +
+                                              sizeof(skb->tstamp));
+        return (struct rb_node *)&skb->next;
+}
+
+static struct sk_buff *netem_rb_to_skb(struct rb_node *rb)
+{
+        return (struct sk_buff *)rb;
+}
+
 static inline struct netem_skb_cb *netem_skb_cb(struct sk_buff *skb)
 {
+        /* we assume we can use skb next/prev/tstamp as storage for rb_node */
         qdisc_cb_private_validate(skb, sizeof(struct netem_skb_cb));
         return (struct netem_skb_cb *)qdisc_skb_cb(skb)->data;
 }
@@ -333,20 +360,23 @@ static psched_time_t packet_len_2_sched_time(unsigned int len, struct netem_sche
 
 static void tfifo_enqueue(struct sk_buff *nskb, struct Qdisc *sch)
 {
-        struct sk_buff_head *list = &sch->q;
+        struct netem_sched_data *q = qdisc_priv(sch);
         psched_time_t tnext = netem_skb_cb(nskb)->time_to_send;
-        struct sk_buff *skb = skb_peek_tail(list);
+        struct rb_node **p = &q->t_root.rb_node, *parent = NULL;
 
-        /* Optimize for add at tail */
-        if (likely(!skb || tnext >= netem_skb_cb(skb)->time_to_send))
-                return __skb_queue_tail(list, nskb);
+        while (*p) {
+                struct sk_buff *skb;
 
-        skb_queue_reverse_walk(list, skb) {
+                parent = *p;
+                skb = netem_rb_to_skb(parent);
                 if (tnext >= netem_skb_cb(skb)->time_to_send)
-                        break;
+                        p = &parent->rb_right;
+                else
+                        p = &parent->rb_left;
         }
-
-        __skb_queue_after(list, skb, nskb);
+        rb_link_node(netem_rb_node(nskb), parent, p);
+        rb_insert_color(netem_rb_node(nskb), &q->t_root);
+        sch->q.qlen++;
 }
 
 /*
@@ -382,12 +412,9 @@ static int netem_enqueue(struct sk_buff *skb, struct Qdisc *sch)
 
         /* If a delay is expected, orphan the skb. (orphaning usually takes
          * place at TX completion time, so _before_ the link transit delay)
-         * Ideally, this orphaning should be done after the rate limiting
-         * module, because this breaks TCP Small Queue, and other mechanisms
-         * based on socket sk_wmem_alloc.
          */
         if (q->latency || q->jitter)
-                skb_orphan(skb);
+                skb_orphan_partial(skb);
 
         /*
          * If we need to duplicate packet, then re-insert at top of the
@@ -436,23 +463,28 @@ static int netem_enqueue(struct sk_buff *skb, struct Qdisc *sch)
                 now = psched_get_time();
 
                 if (q->rate) {
-                        struct sk_buff_head *list = &sch->q;
+                        struct sk_buff *last;
 
-                        if (!skb_queue_empty(list)) {
+                        if (!skb_queue_empty(&sch->q))
+                                last = skb_peek_tail(&sch->q);
+                        else
+                                last = netem_rb_to_skb(rb_last(&q->t_root));
+                        if (last) {
                                 /*
                                  * Last packet in queue is reference point (now),
                                  * calculate this time bonus and subtract
                                  * from delay.
                                  */
-                                delay -= netem_skb_cb(skb_peek_tail(list))->time_to_send - now;
+                                delay -= netem_skb_cb(last)->time_to_send - now;
                                 delay = max_t(psched_tdiff_t, 0, delay);
-                                now = netem_skb_cb(skb_peek_tail(list))->time_to_send;
+                                now = netem_skb_cb(last)->time_to_send;
                         }
 
                         delay += packet_len_2_sched_time(skb->len, q);
                 }
 
                 cb->time_to_send = now + delay;
+                cb->tstamp_save = skb->tstamp;
                 ++q->counter;
                 tfifo_enqueue(skb, sch);
         } else {
@@ -476,6 +508,21 @@ static unsigned int netem_drop(struct Qdisc *sch)
         unsigned int len;
 
         len = qdisc_queue_drop(sch);
+
+        if (!len) {
+                struct rb_node *p = rb_first(&q->t_root);
+
+                if (p) {
+                        struct sk_buff *skb = netem_rb_to_skb(p);
+
+                        rb_erase(p, &q->t_root);
+                        sch->q.qlen--;
+                        skb->next = NULL;
+                        skb->prev = NULL;
+                        len = qdisc_pkt_len(skb);
+                        kfree_skb(skb);
+                }
+        }
         if (!len && q->qdisc && q->qdisc->ops->drop)
             len = q->qdisc->ops->drop(q->qdisc);
         if (len)
@@ -488,19 +535,35 @@ static struct sk_buff *netem_dequeue(struct Qdisc *sch)
 {
         struct netem_sched_data *q = qdisc_priv(sch);
         struct sk_buff *skb;
+        struct rb_node *p;
 
         if (qdisc_is_throttled(sch))
                 return NULL;
 
 tfifo_dequeue:
-        skb = qdisc_peek_head(sch);
+        skb = __skb_dequeue(&sch->q);
         if (skb) {
-                const struct netem_skb_cb *cb = netem_skb_cb(skb);
+deliver:
+                sch->qstats.backlog -= qdisc_pkt_len(skb);
+                qdisc_unthrottled(sch);
+                qdisc_bstats_update(sch, skb);
+                return skb;
+        }
+        p = rb_first(&q->t_root);
+        if (p) {
+                psched_time_t time_to_send;
+
+                skb = netem_rb_to_skb(p);
 
                 /* if more time remaining? */
-                if (cb->time_to_send <= psched_get_time()) {
-                        __skb_unlink(skb, &sch->q);
-                        sch->qstats.backlog -= qdisc_pkt_len(skb);
+                time_to_send = netem_skb_cb(skb)->time_to_send;
+                if (time_to_send <= psched_get_time()) {
+                        rb_erase(p, &q->t_root);
+
+                        sch->q.qlen--;
+                        skb->next = NULL;
+                        skb->prev = NULL;
+                        skb->tstamp = netem_skb_cb(skb)->tstamp_save;
 
 #ifdef CONFIG_NET_CLS_ACT
                         /*
@@ -522,10 +585,7 @@ tfifo_dequeue:
                                 }
                                 goto tfifo_dequeue;
                         }
-deliver:
-                        qdisc_unthrottled(sch);
-                        qdisc_bstats_update(sch, skb);
-                        return skb;
+                        goto deliver;
                 }
 
                 if (q->qdisc) {
@@ -533,7 +593,7 @@ deliver:
                         if (skb)
                                 goto deliver;
                 }
-                qdisc_watchdog_schedule(&q->watchdog, cb->time_to_send);
+                qdisc_watchdog_schedule(&q->watchdog, time_to_send);
         }
 
         if (q->qdisc) {
diff --git a/net/sched/sch_qfq.c b/net/sched/sch_qfq.c
index d51852bba01c..8056fb4e618a 100644
--- a/net/sched/sch_qfq.c
+++ b/net/sched/sch_qfq.c
@@ -113,7 +113,6 @@
 
 #define FRAC_BITS               30      /* fixed point arithmetic */
 #define ONE_FP                  (1UL << FRAC_BITS)
-#define IWSUM                   (ONE_FP/QFQ_MAX_WSUM)
 
 #define QFQ_MTU_SHIFT           16      /* to support TSO/GSO */
 #define QFQ_MIN_LMAX            512     /* see qfq_slot_insert */
@@ -138,7 +137,7 @@ struct qfq_class {
 
         struct gnet_stats_basic_packed bstats;
         struct gnet_stats_queue qstats;
-        struct gnet_stats_rate_est rate_est;
+        struct gnet_stats_rate_est64 rate_est;
         struct Qdisc *qdisc;
         struct list_head alist;         /* Link for active-classes list. */
         struct qfq_aggregate *agg;      /* Parent aggregate. */
@@ -189,6 +188,7 @@ struct qfq_sched {
         struct qfq_aggregate    *in_serv_agg;   /* Aggregate being served. */
         u32                     num_active_agg; /* Num. of active aggregates */
         u32                     wsum;           /* weight sum */
+        u32                     iwsum;          /* inverse weight sum */
 
         unsigned long bitmaps[QFQ_MAX_STATE];       /* Group bitmaps. */
         struct qfq_group groups[QFQ_MAX_INDEX + 1]; /* The groups. */
@@ -314,6 +314,7 @@ static void qfq_update_agg(struct qfq_sched *q, struct qfq_aggregate *agg,
 
         q->wsum +=
                 (int) agg->class_weight * (new_num_classes - agg->num_classes);
+        q->iwsum = ONE_FP / q->wsum;
 
         agg->num_classes = new_num_classes;
 }
@@ -340,6 +341,10 @@ static void qfq_destroy_agg(struct qfq_sched *q, struct qfq_aggregate *agg)
 {
         if (!hlist_unhashed(&agg->nonfull_next))
                 hlist_del_init(&agg->nonfull_next);
+        q->wsum -= agg->class_weight;
+        if (q->wsum != 0)
+                q->iwsum = ONE_FP / q->wsum;
+
         if (q->in_serv_agg == agg)
                 q->in_serv_agg = qfq_choose_next_agg(q);
         kfree(agg);
@@ -821,44 +826,73 @@ static void qfq_make_eligible(struct qfq_sched *q)
         unsigned long old_vslot = q->oldV >> q->min_slot_shift;
 
         if (vslot != old_vslot) {
-                unsigned long mask = (1ULL << fls(vslot ^ old_vslot)) - 1;
+                unsigned long mask;
+                int last_flip_pos = fls(vslot ^ old_vslot);
+
+                if (last_flip_pos > 31) /* higher than the number of groups */
+                        mask = ~0UL;    /* make all groups eligible */
+                else
+                        mask = (1UL << last_flip_pos) - 1;
+
                 qfq_move_groups(q, mask, IR, ER);
                 qfq_move_groups(q, mask, IB, EB);
         }
 }
 
-
 /*
- * The index of the slot in which the aggregate is to be inserted must
- * not be higher than QFQ_MAX_SLOTS-2. There is a '-2' and not a '-1'
- * because the start time of the group may be moved backward by one
- * slot after the aggregate has been inserted, and this would cause
- * non-empty slots to be right-shifted by one position.
+ * The index of the slot in which the input aggregate agg is to be
+ * inserted must not be higher than QFQ_MAX_SLOTS-2. There is a '-2'
+ * and not a '-1' because the start time of the group may be moved
+ * backward by one slot after the aggregate has been inserted, and
+ * this would cause non-empty slots to be right-shifted by one
+ * position.
  *
- * If the weight and lmax (max_pkt_size) of the classes do not change,
- * then QFQ+ does meet the above contraint according to the current
- * values of its parameters. In fact, if the weight and lmax of the
- * classes do not change, then, from the theory, QFQ+ guarantees that
- * the slot index is never higher than
- * 2 + QFQ_MAX_AGG_CLASSES * ((1<<QFQ_MTU_SHIFT)/QFQ_MIN_LMAX) *
- * (QFQ_MAX_WEIGHT/QFQ_MAX_WSUM) = 2 + 8 * 128 * (1 / 64) = 18
+ * QFQ+ fully satisfies this bound to the slot index if the parameters
+ * of the classes are not changed dynamically, and if QFQ+ never
+ * happens to postpone the service of agg unjustly, i.e., it never
+ * happens that the aggregate becomes backlogged and eligible, or just
+ * eligible, while an aggregate with a higher approximated finish time
+ * is being served. In particular, in this case QFQ+ guarantees that
+ * the timestamps of agg are low enough that the slot index is never
+ * higher than 2. Unfortunately, QFQ+ cannot provide the same
+ * guarantee if it happens to unjustly postpone the service of agg, or
+ * if the parameters of some class are changed.
  *
- * When the weight of a class is increased or the lmax of the class is
- * decreased, a new aggregate with smaller slot size than the original
- * parent aggregate of the class may happen to be activated. The
- * activation of this aggregate should be properly delayed to when the
- * service of the class has finished in the ideal system tracked by
- * QFQ+. If the activation of the aggregate is not delayed to this
- * reference time instant, then this aggregate may be unjustly served
- * before other aggregates waiting for service. This may cause the
- * above bound to the slot index to be violated for some of these
- * unlucky aggregates.
+ * As for the first event, i.e., an out-of-order service, the
+ * upper bound to the slot index guaranteed by QFQ+ grows to
+ * 2 +
+ * QFQ_MAX_AGG_CLASSES * ((1<<QFQ_MTU_SHIFT)/QFQ_MIN_LMAX) *
+ * (current_max_weight/current_wsum) <= 2 + 8 * 128 * 1.
+ *
+ * The following function deals with this problem by backward-shifting
+ * the timestamps of agg, if needed, so as to guarantee that the slot
+ * index is never higher than QFQ_MAX_SLOTS-2. This backward-shift may
+ * cause the service of other aggregates to be postponed, yet the
+ * worst-case guarantees of these aggregates are not violated.  In
+ * fact, in case of no out-of-order service, the timestamps of agg
+ * would have been even lower than they are after the backward shift,
+ * because QFQ+ would have guaranteed a maximum value equal to 2 for
+ * the slot index, and 2 < QFQ_MAX_SLOTS-2. Hence the aggregates whose
+ * service is postponed because of the backward-shift would have
+ * however waited for the service of agg before being served.
+ *
+ * The other event that may cause the slot index to be higher than 2
+ * for agg is a recent change of the parameters of some class. If the
+ * weight of a class is increased or the lmax (max_pkt_size) of the
+ * class is decreased, then a new aggregate with smaller slot size
+ * than the original parent aggregate of the class may happen to be
+ * activated. The activation of this aggregate should be properly
+ * delayed to when the service of the class has finished in the ideal
+ * system tracked by QFQ+. If the activation of the aggregate is not
+ * delayed to this reference time instant, then this aggregate may be
+ * unjustly served before other aggregates waiting for service. This
+ * may cause the above bound to the slot index to be violated for some
+ * of these unlucky aggregates.
  *
  * Instead of delaying the activation of the new aggregate, which is
- * quite complex, the following inaccurate but simple solution is used:
- * if the slot index is higher than QFQ_MAX_SLOTS-2, then the
- * timestamps of the aggregate are shifted backward so as to let the
- * slot index become equal to QFQ_MAX_SLOTS-2.
+ * quite complex, the above-discussed capping of the slot index is
+ * used to handle also the consequences of a change of the parameters
+ * of a class.
  */
 static void qfq_slot_insert(struct qfq_group *grp, struct qfq_aggregate *agg,
                             u64 roundedS)
@@ -1003,9 +1037,61 @@ static inline void charge_actual_service(struct qfq_aggregate *agg)
         agg->F = agg->S + (u64)service_received * agg->inv_w;
 }
 
-static inline void qfq_update_agg_ts(struct qfq_sched *q,
-                                     struct qfq_aggregate *agg,
-                                     enum update_reason reason);
+/* Assign a reasonable start time for a new aggregate in group i.
+ * Admissible values for \hat(F) are multiples of \sigma_i
+ * no greater than V+\sigma_i . Larger values mean that
+ * we had a wraparound so we consider the timestamp to be stale.
+ *
+ * If F is not stale and F >= V then we set S = F.
+ * Otherwise we should assign S = V, but this may violate
+ * the ordering in EB (see [2]). So, if we have groups in ER,
+ * set S to the F_j of the first group j which would be blocking us.
+ * We are guaranteed not to move S backward because
+ * otherwise our group i would still be blocked.
+ */
+static void qfq_update_start(struct qfq_sched *q, struct qfq_aggregate *agg)
+{
+        unsigned long mask;
+        u64 limit, roundedF;
+        int slot_shift = agg->grp->slot_shift;
+
+        roundedF = qfq_round_down(agg->F, slot_shift);
+        limit = qfq_round_down(q->V, slot_shift) + (1ULL << slot_shift);
+
+        if (!qfq_gt(agg->F, q->V) || qfq_gt(roundedF, limit)) {
+                /* timestamp was stale */
+                mask = mask_from(q->bitmaps[ER], agg->grp->index);
+                if (mask) {
+                        struct qfq_group *next = qfq_ffs(q, mask);
+                        if (qfq_gt(roundedF, next->F)) {
+                                if (qfq_gt(limit, next->F))
+                                        agg->S = next->F;
+                                else /* preserve timestamp correctness */
+                                        agg->S = limit;
+                                return;
+                        }
+                }
+                agg->S = q->V;
+        } else  /* timestamp is not stale */
+                agg->S = agg->F;
+}
+
+/* Update the timestamps of agg before scheduling/rescheduling it for
+ * service.  In particular, assign to agg->F its maximum possible
+ * value, i.e., the virtual finish time with which the aggregate
+ * should be labeled if it used all its budget once in service.
+ */
+static inline void
+qfq_update_agg_ts(struct qfq_sched *q,
+                    struct qfq_aggregate *agg, enum update_reason reason)
+{
+        if (reason != requeue)
+                qfq_update_start(q, agg);
+        else /* just charge agg for the service received */
+                agg->S = agg->F;
+
+        agg->F = agg->S + (u64)agg->budgetmax * agg->inv_w;
+}
 
 static void qfq_schedule_agg(struct qfq_sched *q, struct qfq_aggregate *agg);
 
@@ -1077,7 +1163,7 @@ static struct sk_buff *qfq_dequeue(struct Qdisc *sch)
         else
                 in_serv_agg->budget -= len;
 
-        q->V += (u64)len * IWSUM;
+        q->V += (u64)len * q->iwsum;
         pr_debug("qfq dequeue: len %u F %lld now %lld\n",
                  len, (unsigned long long) in_serv_agg->F,
                  (unsigned long long) q->V);
@@ -1128,66 +1214,6 @@ static struct qfq_aggregate *qfq_choose_next_agg(struct qfq_sched *q)
         return agg;
 }
 
-/*
- * Assign a reasonable start time for a new aggregate in group i.
- * Admissible values for \hat(F) are multiples of \sigma_i
- * no greater than V+\sigma_i . Larger values mean that
- * we had a wraparound so we consider the timestamp to be stale.
- *
- * If F is not stale and F >= V then we set S = F.
- * Otherwise we should assign S = V, but this may violate
- * the ordering in EB (see [2]). So, if we have groups in ER,
- * set S to the F_j of the first group j which would be blocking us.
- * We are guaranteed not to move S backward because
- * otherwise our group i would still be blocked.
- */
-static void qfq_update_start(struct qfq_sched *q, struct qfq_aggregate *agg)
-{
-        unsigned long mask;
-        u64 limit, roundedF;
-        int slot_shift = agg->grp->slot_shift;
-
-        roundedF = qfq_round_down(agg->F, slot_shift);
-        limit = qfq_round_down(q->V, slot_shift) + (1ULL << slot_shift);
-
-        if (!qfq_gt(agg->F, q->V) || qfq_gt(roundedF, limit)) {
-                /* timestamp was stale */
-                mask = mask_from(q->bitmaps[ER], agg->grp->index);
-                if (mask) {
-                        struct qfq_group *next = qfq_ffs(q, mask);
-                        if (qfq_gt(roundedF, next->F)) {
-                                if (qfq_gt(limit, next->F))
-                                        agg->S = next->F;
-                                else /* preserve timestamp correctness */
-                                        agg->S = limit;
-                                return;
-                        }
-                }
-                agg->S = q->V;
-        } else  /* timestamp is not stale */
-                agg->S = agg->F;
-}
-
-/*
- * Update the timestamps of agg before scheduling/rescheduling it for
- * service.  In particular, assign to agg->F its maximum possible
- * value, i.e., the virtual finish time with which the aggregate
- * should be labeled if it used all its budget once in service.
- */
-static inline void
-qfq_update_agg_ts(struct qfq_sched *q,
-                    struct qfq_aggregate *agg, enum update_reason reason)
-{
-        if (reason != requeue)
-                qfq_update_start(q, agg);
-        else /* just charge agg for the service received */
-                agg->S = agg->F;
-
-        agg->F = agg->S + (u64)agg->budgetmax * agg->inv_w;
-}
-
-static void qfq_schedule_agg(struct qfq_sched *, struct qfq_aggregate *);
-
 static int qfq_enqueue(struct sk_buff *skb, struct Qdisc *sch)
 {
         struct qfq_sched *q = qdisc_priv(sch);
diff --git a/net/sched/sch_tbf.c b/net/sched/sch_tbf.c
index e478d316602b..1aaf1b6e51a2 100644
--- a/net/sched/sch_tbf.c
+++ b/net/sched/sch_tbf.c
@@ -116,14 +116,57 @@ struct tbf_sched_data {
         struct qdisc_watchdog watchdog; /* Watchdog timer */
 };
 
+
+/* GSO packet is too big, segment it so that tbf can transmit
+ * each segment in time
+ */
+static int tbf_segment(struct sk_buff *skb, struct Qdisc *sch)
+{
+        struct tbf_sched_data *q = qdisc_priv(sch);
+        struct sk_buff *segs, *nskb;
+        netdev_features_t features = netif_skb_features(skb);
+        int ret, nb;
+
+        segs = skb_gso_segment(skb, features & ~NETIF_F_GSO_MASK);
+
+        if (IS_ERR_OR_NULL(segs))
+                return qdisc_reshape_fail(skb, sch);
+
+        nb = 0;
+        while (segs) {
+                nskb = segs->next;
+                segs->next = NULL;
+                if (likely(segs->len <= q->max_size)) {
+                        qdisc_skb_cb(segs)->pkt_len = segs->len;
+                        ret = qdisc_enqueue(segs, q->qdisc);
+                } else {
+                        ret = qdisc_reshape_fail(skb, sch);
+                }
+                if (ret != NET_XMIT_SUCCESS) {
+                        if (net_xmit_drop_count(ret))
+                                sch->qstats.drops++;
+                } else {
+                        nb++;
+                }
+                segs = nskb;
+        }
+        sch->q.qlen += nb;
+        if (nb > 1)
+                qdisc_tree_decrease_qlen(sch, 1 - nb);
+        consume_skb(skb);
+        return nb > 0 ? NET_XMIT_SUCCESS : NET_XMIT_DROP;
+}
+
 static int tbf_enqueue(struct sk_buff *skb, struct Qdisc *sch)
 {
         struct tbf_sched_data *q = qdisc_priv(sch);
         int ret;
 
-        if (qdisc_pkt_len(skb) > q->max_size)
+        if (qdisc_pkt_len(skb) > q->max_size) {
+                if (skb_is_gso(skb))
+                        return tbf_segment(skb, sch);
                 return qdisc_reshape_fail(skb, sch);
-
+        }
         ret = qdisc_enqueue(skb, q->qdisc);
         if (ret != NET_XMIT_SUCCESS) {
                 if (net_xmit_drop_count(ret))
diff --git a/net/sctp/Kconfig b/net/sctp/Kconfig
index cf4852814e0c..71c1a598d9bc 100644
--- a/net/sctp/Kconfig
+++ b/net/sctp/Kconfig
@@ -30,7 +30,8 @@ menuconfig IP_SCTP
           homing at either or both ends of an association."
 
           To compile this protocol support as a module, choose M here: the
-          module will be called sctp.
+          module will be called sctp. Debug messages are handeled by the
+          kernel's dynamic debugging framework.
 
           If in doubt, say N.
 
@@ -48,14 +49,6 @@ config NET_SCTPPROBE
         To compile this code as a module, choose M here: the
         module will be called sctp_probe.
 
-config SCTP_DBG_MSG
-        bool "SCTP: Debug messages"
-        help
-          If you say Y, this will enable verbose debugging messages. 
-
-          If unsure, say N.  However, if you are running into problems, use 
-          this option to gather detailed trace information
-
 config SCTP_DBG_OBJCNT
         bool "SCTP: Debug object counts"
         depends on PROC_FS
diff --git a/net/sctp/associola.c b/net/sctp/associola.c
index 91cfd8f94a19..cef509985192 100644
--- a/net/sctp/associola.c
+++ b/net/sctp/associola.c
@@ -28,10 +28,7 @@
  *
  * Please send any bug reports or fixes you make to the
  * email address(es):
- *    lksctp developers <lksctp-developers@lists.sourceforge.net>
- *
- * Or submit a bug report through the following website:
- *    http://www.sf.net/projects/lksctp
+ *    lksctp developers <linux-sctp@vger.kernel.org>
  *
  * Written or modified by:
  *    La Monte H.P. Yarroll <piggy@acm.org>
@@ -43,9 +40,6 @@
  *    Daisy Chang           <daisyc@us.ibm.com>
  *    Ryan Layer            <rmlayer@us.ibm.com>
  *    Kevin Gao             <kevin.gao@intel.com>
- *
- * Any bugs reported given to us we will try to fix... any fixes shared will
- * be incorporated into the next SCTP release.
  */
 
 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
@@ -86,10 +80,9 @@ static struct sctp_association *sctp_association_init(struct sctp_association *a
 
         /* Discarding const is appropriate here.  */
         asoc->ep = (struct sctp_endpoint *)ep;
-        sctp_endpoint_hold(asoc->ep);
-
-        /* Hold the sock.  */
         asoc->base.sk = (struct sock *)sk;
+
+        sctp_endpoint_hold(asoc->ep);
         sock_hold(asoc->base.sk);
 
         /* Initialize the common base substructure.  */
@@ -103,13 +96,7 @@ static struct sctp_association *sctp_association_init(struct sctp_association *a
         sctp_bind_addr_init(&asoc->base.bind_addr, ep->base.bind_addr.port);
 
         asoc->state = SCTP_STATE_CLOSED;
-
-        /* Set these values from the socket values, a conversion between
-         * millsecons to seconds/microseconds must also be done.
-         */
-        asoc->cookie_life.tv_sec = sp->assocparams.sasoc_cookie_life / 1000;
-        asoc->cookie_life.tv_usec = (sp->assocparams.sasoc_cookie_life % 1000)
-                                        * 1000;
+        asoc->cookie_life = ms_to_ktime(sp->assocparams.sasoc_cookie_life);
         asoc->frag_point = 0;
         asoc->user_frag = sp->user_frag;
 
@@ -343,8 +330,8 @@ static struct sctp_association *sctp_association_init(struct sctp_association *a
         return asoc;
 
 fail_init:
-        sctp_endpoint_put(asoc->ep);
         sock_put(asoc->base.sk);
+        sctp_endpoint_put(asoc->ep);
         return NULL;
 }
 
@@ -356,7 +343,7 @@ struct sctp_association *sctp_association_new(const struct sctp_endpoint *ep,
 {
         struct sctp_association *asoc;
 
-        asoc = t_new(struct sctp_association, gfp);
+        asoc = kzalloc(sizeof(*asoc), gfp);
         if (!asoc)
                 goto fail;
 
@@ -364,7 +351,8 @@ struct sctp_association *sctp_association_new(const struct sctp_endpoint *ep,
                 goto fail_init;
 
         SCTP_DBG_OBJCNT_INC(assoc);
-        SCTP_DEBUG_PRINTK("Created asoc %p\n", asoc);
+
+        pr_debug("Created asoc %p\n", asoc);
 
         return asoc;
 
@@ -462,7 +450,10 @@ void sctp_association_free(struct sctp_association *asoc)
 /* Cleanup and free up an association. */
 static void sctp_association_destroy(struct sctp_association *asoc)
 {
-        SCTP_ASSERT(asoc->base.dead, "Assoc is not dead", return);
+        if (unlikely(!asoc->base.dead)) {
+                WARN(1, "Attempt to destroy undead association %p!\n", asoc);
+                return;
+        }
 
         sctp_endpoint_put(asoc->ep);
         sock_put(asoc->base.sk);
@@ -543,11 +534,8 @@ void sctp_assoc_rm_peer(struct sctp_association *asoc,
         struct list_head        *pos;
         struct sctp_transport   *transport;
 
-        SCTP_DEBUG_PRINTK_IPADDR("sctp_assoc_rm_peer:association %p addr: ",
-                                 " port: %d\n",
-                                 asoc,
-                                 (&peer->ipaddr),
-                                 ntohs(peer->ipaddr.v4.sin_port));
+        pr_debug("%s: association:%p addr:%pISpc\n",
+                 __func__, asoc, &peer->ipaddr.sa);
 
         /* If we are to remove the current retran_path, update it
          * to the next peer before removing this peer from the list.
@@ -643,12 +631,8 @@ struct sctp_transport *sctp_assoc_add_peer(struct sctp_association *asoc,
         /* AF_INET and AF_INET6 share common port field. */
         port = ntohs(addr->v4.sin_port);
 
-        SCTP_DEBUG_PRINTK_IPADDR("sctp_assoc_add_peer:association %p addr: ",
-                                 " port: %d state:%d\n",
-                                 asoc,
-                                 addr,
-                                 port,
-                                 peer_state);
+        pr_debug("%s: association:%p addr:%pISpc state:%d\n", __func__,
+                 asoc, &addr->sa, peer_state);
 
         /* Set the port if it has not been set yet.  */
         if (0 == asoc->peer.port)
@@ -715,8 +699,9 @@ struct sctp_transport *sctp_assoc_add_peer(struct sctp_association *asoc,
         else
                 asoc->pathmtu = peer->pathmtu;
 
-        SCTP_DEBUG_PRINTK("sctp_assoc_add_peer:association %p PMTU set to "
-                          "%d\n", asoc, asoc->pathmtu);
+        pr_debug("%s: association:%p PMTU set to %d\n", __func__, asoc,
+                 asoc->pathmtu);
+
         peer->pmtu_pending = 0;
 
         asoc->frag_point = sctp_frag_point(asoc, asoc->pathmtu);
@@ -855,12 +840,12 @@ void sctp_assoc_control_transport(struct sctp_association *asoc,
                 else
                         spc_state = SCTP_ADDR_AVAILABLE;
                 /* Don't inform ULP about transition from PF to
-                 * active state and set cwnd to 1, see SCTP
+                 * active state and set cwnd to 1 MTU, see SCTP
                  * Quick failover draft section 5.1, point 5
                  */
                 if (transport->state == SCTP_PF) {
                         ulp_notify = false;
-                        transport->cwnd = 1;
+                        transport->cwnd = asoc->pathmtu;
                 }
                 transport->state = SCTP_ACTIVE;
                 break;
@@ -1356,12 +1341,8 @@ void sctp_assoc_update_retran_path(struct sctp_association *asoc)
         else
                 t = asoc->peer.retran_path;
 
-        SCTP_DEBUG_PRINTK_IPADDR("sctp_assoc_update_retran_path:association"
-                                 " %p addr: ",
-                                 " port: %d\n",
-                                 asoc,
-                                 (&t->ipaddr),
-                                 ntohs(t->ipaddr.v4.sin_port));
+        pr_debug("%s: association:%p addr:%pISpc\n", __func__, asoc,
+                 &t->ipaddr.sa);
 }
 
 /* Choose the transport for sending retransmit packet.  */
@@ -1408,8 +1389,8 @@ void sctp_assoc_sync_pmtu(struct sock *sk, struct sctp_association *asoc)
                 asoc->frag_point = sctp_frag_point(asoc, pmtu);
         }
 
-        SCTP_DEBUG_PRINTK("%s: asoc:%p, pmtu:%d, frag_point:%d\n",
-                          __func__, asoc, asoc->pathmtu, asoc->frag_point);
+        pr_debug("%s: asoc:%p, pmtu:%d, frag_point:%d\n", __func__, asoc,
+                 asoc->pathmtu, asoc->frag_point);
 }
 
 /* Should we send a SACK to update our peer? */
@@ -1461,9 +1442,9 @@ void sctp_assoc_rwnd_increase(struct sctp_association *asoc, unsigned int len)
                 asoc->rwnd_press -= change;
         }
 
-        SCTP_DEBUG_PRINTK("%s: asoc %p rwnd increased by %d to (%u, %u) "
-                          "- %u\n", __func__, asoc, len, asoc->rwnd,
-                          asoc->rwnd_over, asoc->a_rwnd);
+        pr_debug("%s: asoc:%p rwnd increased by %d to (%u, %u) - %u\n",
+                 __func__, asoc, len, asoc->rwnd, asoc->rwnd_over,
+                 asoc->a_rwnd);
 
         /* Send a window update SACK if the rwnd has increased by at least the
          * minimum of the association's PMTU and half of the receive buffer.
@@ -1472,9 +1453,11 @@ void sctp_assoc_rwnd_increase(struct sctp_association *asoc, unsigned int len)
          */
         if (sctp_peer_needs_update(asoc)) {
                 asoc->a_rwnd = asoc->rwnd;
-                SCTP_DEBUG_PRINTK("%s: Sending window update SACK- asoc: %p "
-                                  "rwnd: %u a_rwnd: %u\n", __func__,
-                                  asoc, asoc->rwnd, asoc->a_rwnd);
+
+                pr_debug("%s: sending window update SACK- asoc:%p rwnd:%u "
+                         "a_rwnd:%u\n", __func__, asoc, asoc->rwnd,
+                         asoc->a_rwnd);
+
                 sack = sctp_make_sack(asoc);
                 if (!sack)
                         return;
@@ -1496,8 +1479,10 @@ void sctp_assoc_rwnd_decrease(struct sctp_association *asoc, unsigned int len)
         int rx_count;
         int over = 0;
 
-        SCTP_ASSERT(asoc->rwnd, "rwnd zero", return);
-        SCTP_ASSERT(!asoc->rwnd_over, "rwnd_over not zero", return);
+        if (unlikely(!asoc->rwnd || asoc->rwnd_over))
+                pr_debug("%s: association:%p has asoc->rwnd:%u, "
+                         "asoc->rwnd_over:%u!\n", __func__, asoc,
+                         asoc->rwnd, asoc->rwnd_over);
 
         if (asoc->ep->rcvbuf_policy)
                 rx_count = atomic_read(&asoc->rmem_alloc);
@@ -1522,9 +1507,10 @@ void sctp_assoc_rwnd_decrease(struct sctp_association *asoc, unsigned int len)
                 asoc->rwnd_over = len - asoc->rwnd;
                 asoc->rwnd = 0;
         }
-        SCTP_DEBUG_PRINTK("%s: asoc %p rwnd decreased by %d to (%u, %u, %u)\n",
-                          __func__, asoc, len, asoc->rwnd,
-                          asoc->rwnd_over, asoc->rwnd_press);
+
+        pr_debug("%s: asoc:%p rwnd decreased by %d to (%u, %u, %u)\n",
+                 __func__, asoc, len, asoc->rwnd, asoc->rwnd_over,
+                 asoc->rwnd_press);
 }
 
 /* Build the bind address list for the association based on info from the
diff --git a/net/sctp/auth.c b/net/sctp/auth.c
index ba1dfc3f8def..8c4fa5dec824 100644
--- a/net/sctp/auth.c
+++ b/net/sctp/auth.c
@@ -22,16 +22,10 @@
  *
  * Please send any bug reports or fixes you make to the
  * email address(es):
- *    lksctp developers <lksctp-developers@lists.sourceforge.net>
- *
- * Or submit a bug report through the following website:
- *    http://www.sf.net/projects/lksctp
+ *    lksctp developers <linux-sctp@vger.kernel.org>
  *
  * Written or modified by:
  *   Vlad Yasevich     <vladislav.yasevich@hp.com>
- *
- * Any bugs reported given to us we will try to fix... any fixes shared will
- * be incorporated into the next SCTP release.
  */
 
 #include <linux/slab.h>
diff --git a/net/sctp/bind_addr.c b/net/sctp/bind_addr.c
index 41145fe31813..077bb070052b 100644
--- a/net/sctp/bind_addr.c
+++ b/net/sctp/bind_addr.c
@@ -27,19 +27,13 @@
  *
  * Please send any bug reports or fixes you make to the
  * email address(es):
- *    lksctp developers <lksctp-developers@lists.sourceforge.net>
- *
- * Or submit a bug report through the following website:
- *    http://www.sf.net/projects/lksctp
+ *    lksctp developers <linux-sctp@vger.kernel.org>
  *
  * Written or modified by:
  *    La Monte H.P. Yarroll <piggy@acm.org>
  *    Karl Knutson          <karl@athena.chicago.il.us>
  *    Jon Grimm             <jgrimm@us.ibm.com>
  *    Daisy Chang           <daisyc@us.ibm.com>
- *
- * Any bugs reported given to us we will try to fix... any fixes shared will
- * be incorporated into the next SCTP release.
  */
 
 #include <linux/types.h>
@@ -162,7 +156,7 @@ int sctp_add_bind_addr(struct sctp_bind_addr *bp, union sctp_addr *new,
         struct sctp_sockaddr_entry *addr;
 
         /* Add the address to the bind address list.  */
-        addr = t_new(struct sctp_sockaddr_entry, gfp);
+        addr = kzalloc(sizeof(*addr), gfp);
         if (!addr)
                 return -ENOMEM;
 
diff --git a/net/sctp/chunk.c b/net/sctp/chunk.c
index 69ce21e3716f..7bd5ed4a8657 100644
--- a/net/sctp/chunk.c
+++ b/net/sctp/chunk.c
@@ -24,17 +24,11 @@
  *
  * Please send any bug reports or fixes you make to the
  * email address(es):
- *    lksctp developers <lksctp-developers@lists.sourceforge.net>
- *
- * Or submit a bug report through the following website:
- *    http://www.sf.net/projects/lksctp
+ *    lksctp developers <linux-sctp@vger.kernel.org>
  *
  * Written or modified by:
  *    Jon Grimm             <jgrimm@us.ibm.com>
  *    Sridhar Samudrala     <sri@us.ibm.com>
- *
- * Any bugs reported given to us we will try to fix... any fixes shared will
- * be incorporated into the next SCTP release.
  */
 
 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
@@ -66,7 +60,7 @@ static void sctp_datamsg_init(struct sctp_datamsg *msg)
 }
 
 /* Allocate and initialize datamsg. */
-SCTP_STATIC struct sctp_datamsg *sctp_datamsg_new(gfp_t gfp)
+static struct sctp_datamsg *sctp_datamsg_new(gfp_t gfp)
 {
         struct sctp_datamsg *msg;
         msg = kmalloc(sizeof(struct sctp_datamsg), gfp);
@@ -193,16 +187,17 @@ struct sctp_datamsg *sctp_datamsg_from_user(struct sctp_association *asoc,
                 msg->expires_at = jiffies +
                                     msecs_to_jiffies(sinfo->sinfo_timetolive);
                 msg->can_abandon = 1;
-                SCTP_DEBUG_PRINTK("%s: msg:%p expires_at: %ld jiffies:%ld\n",
-                                  __func__, msg, msg->expires_at, jiffies);
+
+                pr_debug("%s: msg:%p expires_at:%ld jiffies:%ld\n", __func__,
+                         msg, msg->expires_at, jiffies);
         }
 
         /* This is the biggest possible DATA chunk that can fit into
          * the packet
          */
-        max_data = asoc->pathmtu -
+        max_data = (asoc->pathmtu -
                 sctp_sk(asoc->base.sk)->pf->af->net_header_len -
-                sizeof(struct sctphdr) - sizeof(struct sctp_data_chunk);
+                sizeof(struct sctphdr) - sizeof(struct sctp_data_chunk)) & ~3;
 
         max = asoc->frag_point;
         /* If the the peer requested that we authenticate DATA chunks
diff --git a/net/sctp/command.c b/net/sctp/command.c
index c0044019db9e..3d9a9ff69c03 100644
--- a/net/sctp/command.c
+++ b/net/sctp/command.c
@@ -25,17 +25,11 @@
  *
  * Please send any bug reports or fixes you make to the
  * email address(es):
- *    lksctp developers <lksctp-developers@lists.sourceforge.net>
- *
- * Or submit a bug report through the following website:
- *    http://www.sf.net/projects/lksctp
+ *    lksctp developers <linux-sctp@vger.kernel.org>
  *
  * Written or modified by:
  *    La Monte H.P. Yarroll <piggy@acm.org>
  *    Karl Knutson <karl@athena.chicago.il.us>
- *
- * Any bugs reported given to us we will try to fix... any fixes shared will
- * be incorporated into the next SCTP release.
  */
 
 #include <linux/types.h>
diff --git a/net/sctp/debug.c b/net/sctp/debug.c
index ec997cfe0a7e..e89015d8935a 100644
--- a/net/sctp/debug.c
+++ b/net/sctp/debug.c
@@ -28,10 +28,7 @@
  *
  * Please send any bug reports or fixes you make to the
  * email address(es):
- *    lksctp developers <lksctp-developers@lists.sourceforge.net>
- *
- * Or submit a bug report through the following website:
- *    http://www.sf.net/projects/lksctp
+ *    lksctp developers <linux-sctp@vger.kernel.org>
  *
  * Written or modified by:
  *    La Monte H.P. Yarroll <piggy@acm.org>
@@ -40,17 +37,10 @@
  *    Jon Grimm             <jgrimm@us.ibm.com>
  *    Daisy Chang           <daisyc@us.ibm.com>
  *    Sridhar Samudrala     <sri@us.ibm.com>
- *
- * Any bugs reported given to us we will try to fix... any fixes shared will
- * be incorporated into the next SCTP release.
  */
 
 #include <net/sctp/sctp.h>
 
-#if SCTP_DEBUG
-int sctp_debug_flag = 1;        /* Initially enable DEBUG */
-#endif  /* SCTP_DEBUG */
-
 /* These are printable forms of Chunk ID's from section 3.1.  */
 static const char *const sctp_cid_tbl[SCTP_NUM_BASE_CHUNK_TYPES] = {
         "DATA",
diff --git a/net/sctp/endpointola.c b/net/sctp/endpointola.c
index 5fbd7bc6bb11..09b8daac87c8 100644
--- a/net/sctp/endpointola.c
+++ b/net/sctp/endpointola.c
@@ -29,10 +29,7 @@
  *
  * Please send any bug reports or fixes you make to the
  * email address(es):
- *    lksctp developers <lksctp-developers@lists.sourceforge.net>
- *
- * Or submit a bug report through the following website:
- *    http://www.sf.net/projects/lksctp
+ *    lksctp developers <linux-sctp@vger.kernel.org>
  *
  * Written or modified by:
  *    La Monte H.P. Yarroll <piggy@acm.org>
@@ -40,9 +37,6 @@
  *    Jon Grimm <jgrimm@austin.ibm.com>
  *    Daisy Chang <daisyc@us.ibm.com>
  *    Dajiang Zhang <dajiang.zhang@nokia.com>
- *
- * Any bugs reported given to us we will try to fix... any fixes shared will
- * be incorporated into the next SCTP release.
  */
 
 #include <linux/types.h>
@@ -192,9 +186,10 @@ struct sctp_endpoint *sctp_endpoint_new(struct sock *sk, gfp_t gfp)
         struct sctp_endpoint *ep;
 
         /* Build a local endpoint. */
-        ep = t_new(struct sctp_endpoint, gfp);
+        ep = kzalloc(sizeof(*ep), gfp);
         if (!ep)
                 goto fail;
+
         if (!sctp_endpoint_init(ep, sk, gfp))
                 goto fail_init;
 
@@ -246,10 +241,12 @@ void sctp_endpoint_free(struct sctp_endpoint *ep)
 /* Final destructor for endpoint.  */
 static void sctp_endpoint_destroy(struct sctp_endpoint *ep)
 {
-        SCTP_ASSERT(ep->base.dead, "Endpoint is not dead", return);
+        struct sock *sk;
 
-        /* Free up the HMAC transform. */
-        crypto_free_hash(sctp_sk(ep->base.sk)->hmac);
+        if (unlikely(!ep->base.dead)) {
+                WARN(1, "Attempt to destroy undead endpoint %p!\n", ep);
+                return;
+        }
 
         /* Free the digest buffer */
         kfree(ep->digest);
@@ -270,13 +267,15 @@ static void sctp_endpoint_destroy(struct sctp_endpoint *ep)
 
         memset(ep->secret_key, 0, sizeof(ep->secret_key));
 
-        /* Remove and free the port */
-        if (sctp_sk(ep->base.sk)->bind_hash)
-                sctp_put_port(ep->base.sk);
-
         /* Give up our hold on the sock. */
-        if (ep->base.sk)
-                sock_put(ep->base.sk);
+        sk = ep->base.sk;
+        if (sk != NULL) {
+                /* Remove and free the port */
+                if (sctp_sk(sk)->bind_hash)
+                        sctp_put_port(sk);
+
+                sock_put(sk);
+        }
 
         kfree(ep);
         SCTP_DBG_OBJCNT_DEC(ep);
diff --git a/net/sctp/input.c b/net/sctp/input.c
index 4b2c83146aa7..98b69bbecdd9 100644
--- a/net/sctp/input.c
+++ b/net/sctp/input.c
@@ -29,10 +29,7 @@
  *
  * Please send any bug reports or fixes you make to the
  * email address(es):
- *    lksctp developers <lksctp-developers@lists.sourceforge.net>
- *
- * Or submit a bug report through the following website:
- *    http://www.sf.net/projects/lksctp
+ *    lksctp developers <linux-sctp@vger.kernel.org>
  *
  * Written or modified by:
  *    La Monte H.P. Yarroll <piggy@acm.org>
@@ -43,9 +40,6 @@
  *    Daisy Chang <daisyc@us.ibm.com>
  *    Sridhar Samudrala <sri@us.ibm.com>
  *    Ardelle Fan <ardelle.fan@intel.com>
- *
- * Any bugs reported given to us we will try to fix... any fixes shared will
- * be incorporated into the next SCTP release.
  */
 
 #include <linux/types.h>
@@ -87,15 +81,7 @@ static inline int sctp_rcv_checksum(struct net *net, struct sk_buff *skb)
 {
         struct sctphdr *sh = sctp_hdr(skb);
         __le32 cmp = sh->checksum;
-        struct sk_buff *list;
-        __le32 val;
-        __u32 tmp = sctp_start_cksum((__u8 *)sh, skb_headlen(skb));
-
-        skb_walk_frags(skb, list)
-                tmp = sctp_update_cksum((__u8 *)list->data, skb_headlen(list),
-                                        tmp);
-
-        val = sctp_end_cksum(tmp);
+        __le32 val = sctp_compute_cksum(skb, 0);
 
         if (val != cmp) {
                 /* CRC failure, dump it. */
@@ -454,8 +440,6 @@ void sctp_icmp_proto_unreachable(struct sock *sk,
                            struct sctp_association *asoc,
                            struct sctp_transport *t)
 {
-        SCTP_DEBUG_PRINTK("%s\n",  __func__);
-
         if (sock_owned_by_user(sk)) {
                 if (timer_pending(&t->proto_unreach_timer))
                         return;
@@ -464,10 +448,12 @@ void sctp_icmp_proto_unreachable(struct sock *sk,
                                                 jiffies + (HZ/20)))
                                 sctp_association_hold(asoc);
                 }
-                        
         } else {
                 struct net *net = sock_net(sk);
 
+                pr_debug("%s: unrecognized next header type "
+                         "encountered!\n", __func__);
+
                 if (del_timer(&t->proto_unreach_timer))
                         sctp_association_put(asoc);
 
@@ -589,7 +575,7 @@ void sctp_v4_err(struct sk_buff *skb, __u32 info)
         struct sctp_association *asoc = NULL;
         struct sctp_transport *transport;
         struct inet_sock *inet;
-        sk_buff_data_t saveip, savesctp;
+        __u16 saveip, savesctp;
         int err;
         struct net *net = dev_net(skb->dev);
 
@@ -648,8 +634,7 @@ void sctp_v4_err(struct sk_buff *skb, __u32 info)
                 break;
         case ICMP_REDIRECT:
                 sctp_icmp_redirect(sk, transport, skb);
-                err = 0;
-                break;
+                /* Fall through to out_unlock. */
         default:
                 goto out_unlock;
         }
@@ -903,11 +888,11 @@ hit:
 }
 
 /* Look up an association. BH-safe. */
-SCTP_STATIC
+static
 struct sctp_association *sctp_lookup_association(struct net *net,
                                                  const union sctp_addr *laddr,
                                                  const union sctp_addr *paddr,
-                                            struct sctp_transport **transportp)
+                                                 struct sctp_transport **transportp)
 {
         struct sctp_association *asoc;
 
diff --git a/net/sctp/inqueue.c b/net/sctp/inqueue.c
index 3221d073448c..5856932fdc38 100644
--- a/net/sctp/inqueue.c
+++ b/net/sctp/inqueue.c
@@ -30,17 +30,11 @@
  *
  * Please send any bug reports or fixes you make to the
  * email address(es):
- *    lksctp developers <lksctp-developers@lists.sourceforge.net>
- *
- * Or submit a bug report through the following website:
- *    http://www.sf.net/projects/lksctp
+ *    lksctp developers <linux-sctp@vger.kernel.org>
  *
  * Written or modified by:
  *    La Monte H.P. Yarroll <piggy@acm.org>
  *    Karl Knutson <karl@athena.chicago.il.us>
- *
- * Any bugs reported given to us we will try to fix... any fixes shared will
- * be incorporated into the next SCTP release.
  */
 
 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
@@ -219,10 +213,10 @@ struct sctp_chunk *sctp_inq_pop(struct sctp_inq *queue)
                 chunk->end_of_packet = 1;
         }
 
-        SCTP_DEBUG_PRINTK("+++sctp_inq_pop+++ chunk %p[%s],"
-                          " length %d, skb->len %d\n",chunk,
-                          sctp_cname(SCTP_ST_CHUNK(chunk->chunk_hdr->type)),
-                          ntohs(chunk->chunk_hdr->length), chunk->skb->len);
+        pr_debug("+++sctp_inq_pop+++ chunk:%p[%s], length:%d, skb->len:%d\n",
+                 chunk, sctp_cname(SCTP_ST_CHUNK(chunk->chunk_hdr->type)),
+                 ntohs(chunk->chunk_hdr->length), chunk->skb->len);
+
         return chunk;
 }
 
@@ -238,4 +232,3 @@ void sctp_inq_set_th_handler(struct sctp_inq *q, work_func_t callback)
 {
         INIT_WORK(&q->immediate, callback);
 }
-
diff --git a/net/sctp/ipv6.c b/net/sctp/ipv6.c
index 391a245d5203..e7b2d4fe2b6a 100644
--- a/net/sctp/ipv6.c
+++ b/net/sctp/ipv6.c
@@ -27,10 +27,7 @@
  *
  * Please send any bug reports or fixes you make to the
  * email address(es):
- *    lksctp developers <lksctp-developers@lists.sourceforge.net>
- *
- * Or submit a bug report through the following website:
- *    http://www.sf.net/projects/lksctp
+ *    lksctp developers <linux-sctp@vger.kernel.org>
  *
  * Written or modified by:
  *    Le Yanqun             <yanqun.le@nokia.com>
@@ -42,9 +39,6 @@
  *
  * Based on:
  *      linux/net/ipv6/tcp_ipv6.c
- *
- * Any bugs reported given to us we will try to fix... any fixes shared will
- * be incorporated into the next SCTP release.
  */
 
 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
@@ -145,15 +139,15 @@ static struct notifier_block sctp_inet6addr_notifier = {
 };
 
 /* ICMP error handler. */
-SCTP_STATIC void sctp_v6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
-                             u8 type, u8 code, int offset, __be32 info)
+static void sctp_v6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
+                        u8 type, u8 code, int offset, __be32 info)
 {
         struct inet6_dev *idev;
         struct sock *sk;
         struct sctp_association *asoc;
         struct sctp_transport *transport;
         struct ipv6_pinfo *np;
-        sk_buff_data_t saveip, savesctp;
+        __u16 saveip, savesctp;
         int err;
         struct net *net = dev_net(skb->dev);
 
@@ -189,7 +183,7 @@ SCTP_STATIC void sctp_v6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
                 break;
         case NDISC_REDIRECT:
                 sctp_icmp_redirect(sk, transport, skb);
-                break;
+                goto out_unlock;
         default:
                 break;
         }
@@ -210,45 +204,23 @@ out:
                 in6_dev_put(idev);
 }
 
-/* Based on tcp_v6_xmit() in tcp_ipv6.c. */
 static int sctp_v6_xmit(struct sk_buff *skb, struct sctp_transport *transport)
 {
         struct sock *sk = skb->sk;
         struct ipv6_pinfo *np = inet6_sk(sk);
-        struct flowi6 fl6;
+        struct flowi6 *fl6 = &transport->fl.u.ip6;
 
-        memset(&fl6, 0, sizeof(fl6));
+        pr_debug("%s: skb:%p, len:%d, src:%pI6 dst:%pI6\n", __func__, skb,
+                 skb->len, &fl6->saddr, &fl6->daddr);
 
-        fl6.flowi6_proto = sk->sk_protocol;
-
-        /* Fill in the dest address from the route entry passed with the skb
-         * and the source address from the transport.
-         */
-        fl6.daddr = transport->ipaddr.v6.sin6_addr;
-        fl6.saddr = transport->saddr.v6.sin6_addr;
-
-        fl6.flowlabel = np->flow_label;
-        IP6_ECN_flow_xmit(sk, fl6.flowlabel);
-        if (ipv6_addr_type(&fl6.saddr) & IPV6_ADDR_LINKLOCAL)
-                fl6.flowi6_oif = transport->saddr.v6.sin6_scope_id;
-        else
-                fl6.flowi6_oif = sk->sk_bound_dev_if;
-
-        if (np->opt && np->opt->srcrt) {
-                struct rt0_hdr *rt0 = (struct rt0_hdr *) np->opt->srcrt;
-                fl6.daddr = *rt0->addr;
-        }
-
-        SCTP_DEBUG_PRINTK("%s: skb:%p, len:%d, src:%pI6 dst:%pI6\n",
-                          __func__, skb, skb->len,
-                          &fl6.saddr, &fl6.daddr);
-
-        SCTP_INC_STATS(sock_net(sk), SCTP_MIB_OUTSCTPPACKS);
+        IP6_ECN_flow_xmit(sk, fl6->flowlabel);
 
         if (!(transport->param_flags & SPP_PMTUD_ENABLE))
                 skb->local_df = 1;
 
-        return ip6_xmit(sk, skb, &fl6, np->opt, np->tclass);
+        SCTP_INC_STATS(sock_net(sk), SCTP_MIB_OUTSCTPPACKS);
+
+        return ip6_xmit(sk, skb, fl6, np->opt, np->tclass);
 }
 
 /* Returns the dst cache entry for the given source and destination ip
@@ -261,10 +233,12 @@ static void sctp_v6_get_dst(struct sctp_transport *t, union sctp_addr *saddr,
         struct dst_entry *dst = NULL;
         struct flowi6 *fl6 = &fl->u.ip6;
         struct sctp_bind_addr *bp;
+        struct ipv6_pinfo *np = inet6_sk(sk);
         struct sctp_sockaddr_entry *laddr;
         union sctp_addr *baddr = NULL;
         union sctp_addr *daddr = &t->ipaddr;
         union sctp_addr dst_saddr;
+        struct in6_addr *final_p, final;
         __u8 matchlen = 0;
         __u8 bmatchlen;
         sctp_scope_t scope;
@@ -276,7 +250,7 @@ static void sctp_v6_get_dst(struct sctp_transport *t, union sctp_addr *saddr,
         if (ipv6_addr_type(&daddr->v6.sin6_addr) & IPV6_ADDR_LINKLOCAL)
                 fl6->flowi6_oif = daddr->v6.sin6_scope_id;
 
-        SCTP_DEBUG_PRINTK("%s: DST=%pI6 ", __func__, &fl6->daddr);
+        pr_debug("%s: dst=%pI6 ", __func__, &fl6->daddr);
 
         if (asoc)
                 fl6->fl6_sport = htons(asoc->base.bind_addr.port);
@@ -284,10 +258,12 @@ static void sctp_v6_get_dst(struct sctp_transport *t, union sctp_addr *saddr,
         if (saddr) {
                 fl6->saddr = saddr->v6.sin6_addr;
                 fl6->fl6_sport = saddr->v6.sin6_port;
-                SCTP_DEBUG_PRINTK("SRC=%pI6 - ", &fl6->saddr);
+
+                pr_debug("src=%pI6 - ", &fl6->saddr);
         }
 
-        dst = ip6_dst_lookup_flow(sk, fl6, NULL, false);
+        final_p = fl6_update_dst(fl6, np->opt, &final);
+        dst = ip6_dst_lookup_flow(sk, fl6, final_p, false);
         if (!asoc || saddr)
                 goto out;
 
@@ -339,22 +315,27 @@ static void sctp_v6_get_dst(struct sctp_transport *t, union sctp_addr *saddr,
                 }
         }
         rcu_read_unlock();
+
         if (baddr) {
                 fl6->saddr = baddr->v6.sin6_addr;
                 fl6->fl6_sport = baddr->v6.sin6_port;
-                dst = ip6_dst_lookup_flow(sk, fl6, NULL, false);
+                final_p = fl6_update_dst(fl6, np->opt, &final);
+                dst = ip6_dst_lookup_flow(sk, fl6, final_p, false);
         }
 
 out:
         if (!IS_ERR_OR_NULL(dst)) {
                 struct rt6_info *rt;
+
                 rt = (struct rt6_info *)dst;
                 t->dst = dst;
-                SCTP_DEBUG_PRINTK("rt6_dst:%pI6 rt6_src:%pI6\n",
-                        &rt->rt6i_dst.addr, &fl6->saddr);
+                t->dst_cookie = rt->rt6i_node ? rt->rt6i_node->fn_sernum : 0;
+                pr_debug("rt6_dst:%pI6 rt6_src:%pI6\n", &rt->rt6i_dst.addr,
+                         &fl6->saddr);
         } else {
                 t->dst = NULL;
-                SCTP_DEBUG_PRINTK("NO ROUTE\n");
+
+                pr_debug("no route\n");
         }
 }
 
@@ -377,7 +358,7 @@ static void sctp_v6_get_saddr(struct sctp_sock *sk,
         struct flowi6 *fl6 = &fl->u.ip6;
         union sctp_addr *saddr = &t->saddr;
 
-        SCTP_DEBUG_PRINTK("%s: asoc:%p dst:%p\n", __func__, t->asoc, t->dst);
+        pr_debug("%s: asoc:%p dst:%p\n", __func__, t->asoc, t->dst);
 
         if (t->dst) {
                 saddr->v6.sin6_family = AF_INET6;
@@ -402,7 +383,7 @@ static void sctp_v6_copy_addrlist(struct list_head *addrlist,
         read_lock_bh(&in6_dev->lock);
         list_for_each_entry(ifp, &in6_dev->addr_list, if_list) {
                 /* Add the address to the local list.  */
-                addr = t_new(struct sctp_sockaddr_entry, GFP_ATOMIC);
+                addr = kzalloc(sizeof(*addr), GFP_ATOMIC);
                 if (addr) {
                         addr->a.v6.sin6_family = AF_INET6;
                         addr->a.v6.sin6_port = 0;
diff --git a/net/sctp/objcnt.c b/net/sctp/objcnt.c
index fe012c44f8df..5ea573b37648 100644
--- a/net/sctp/objcnt.c
+++ b/net/sctp/objcnt.c
@@ -26,16 +26,10 @@
  *
  * Please send any bug reports or fixes you make to the
  * email address(es):
- *    lksctp developers <lksctp-developers@lists.sourceforge.net>
- *
- * Or submit a bug report through the following website:
- *    http://www.sf.net/projects/lksctp
+ *    lksctp developers <linux-sctp@vger.kernel.org>
  *
  * Written or modified by:
  *    Jon Grimm             <jgrimm@us.ibm.com>
- *
- * Any bugs reported given to us we will try to fix... any fixes shared will
- * be incorporated into the next SCTP release.
  */
 
 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
diff --git a/net/sctp/output.c b/net/sctp/output.c
index bbef4a7a9b56..0ac3a65daccb 100644
--- a/net/sctp/output.c
+++ b/net/sctp/output.c
@@ -26,19 +26,13 @@
  *
  * Please send any bug reports or fixes you make to the
  * email address(es):
- *    lksctp developers <lksctp-developers@lists.sourceforge.net>
- *
- * Or submit a bug report through the following website:
- *    http://www.sf.net/projects/lksctp
+ *    lksctp developers <linux-sctp@vger.kernel.org>
  *
  * Written or modified by:
  *    La Monte H.P. Yarroll <piggy@acm.org>
  *    Karl Knutson          <karl@athena.chicago.il.us>
  *    Jon Grimm             <jgrimm@austin.ibm.com>
  *    Sridhar Samudrala     <sri@us.ibm.com>
- *
- * Any bugs reported given to us we will try to fix... any fixes shared will
- * be incorporated into the next SCTP release.
  */
 
 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
@@ -93,8 +87,7 @@ struct sctp_packet *sctp_packet_config(struct sctp_packet *packet,
 {
         struct sctp_chunk *chunk = NULL;
 
-        SCTP_DEBUG_PRINTK("%s: packet:%p vtag:0x%x\n", __func__,
-                          packet, vtag);
+        pr_debug("%s: packet:%p vtag:0x%x\n", __func__, packet, vtag);
 
         packet->vtag = vtag;
 
@@ -119,8 +112,7 @@ struct sctp_packet *sctp_packet_init(struct sctp_packet *packet,
         struct sctp_association *asoc = transport->asoc;
         size_t overhead;
 
-        SCTP_DEBUG_PRINTK("%s: packet:%p transport:%p\n", __func__,
-                          packet, transport);
+        pr_debug("%s: packet:%p transport:%p\n", __func__, packet, transport);
 
         packet->transport = transport;
         packet->source_port = sport;
@@ -145,7 +137,7 @@ void sctp_packet_free(struct sctp_packet *packet)
 {
         struct sctp_chunk *chunk, *tmp;
 
-        SCTP_DEBUG_PRINTK("%s: packet:%p\n", __func__, packet);
+        pr_debug("%s: packet:%p\n", __func__, packet);
 
         list_for_each_entry_safe(chunk, tmp, &packet->chunk_list, list) {
                 list_del_init(&chunk->list);
@@ -167,8 +159,7 @@ sctp_xmit_t sctp_packet_transmit_chunk(struct sctp_packet *packet,
         sctp_xmit_t retval;
         int error = 0;
 
-        SCTP_DEBUG_PRINTK("%s: packet:%p chunk:%p\n", __func__,
-                          packet, chunk);
+        pr_debug("%s: packet:%p chunk:%p\n", __func__, packet, chunk);
 
         switch ((retval = (sctp_packet_append_chunk(packet, chunk)))) {
         case SCTP_XMIT_PMTU_FULL:
@@ -334,8 +325,7 @@ sctp_xmit_t sctp_packet_append_chunk(struct sctp_packet *packet,
 {
         sctp_xmit_t retval = SCTP_XMIT_OK;
 
-        SCTP_DEBUG_PRINTK("%s: packet:%p chunk:%p\n", __func__, packet,
-                          chunk);
+        pr_debug("%s: packet:%p chunk:%p\n", __func__, packet, chunk);
 
         /* Data chunks are special.  Before seeing what else we can
          * bundle into this packet, check to see if we are allowed to
@@ -402,7 +392,7 @@ int sctp_packet_transmit(struct sctp_packet *packet)
         unsigned char *auth = NULL;     /* pointer to auth in skb data */
         __u32 cksum_buf_len = sizeof(struct sctphdr);
 
-        SCTP_DEBUG_PRINTK("%s: packet:%p\n", __func__, packet);
+        pr_debug("%s: packet:%p\n", __func__, packet);
 
         /* Do NOT generate a chunkless packet. */
         if (list_empty(&packet->chunk_list))
@@ -472,7 +462,9 @@ int sctp_packet_transmit(struct sctp_packet *packet)
          *
          * [This whole comment explains WORD_ROUND() below.]
          */
-        SCTP_DEBUG_PRINTK("***sctp_transmit_packet***\n");
+
+        pr_debug("***sctp_transmit_packet***\n");
+
         list_for_each_entry_safe(chunk, tmp, &packet->chunk_list, list) {
                 list_del_init(&chunk->list);
                 if (sctp_chunk_is_data(chunk)) {
@@ -505,16 +497,13 @@ int sctp_packet_transmit(struct sctp_packet *packet)
                 memcpy(skb_put(nskb, chunk->skb->len),
                                chunk->skb->data, chunk->skb->len);
 
-                SCTP_DEBUG_PRINTK("%s %p[%s] %s 0x%x, %s %d, %s %d, %s %d\n",
-                                  "*** Chunk", chunk,
-                                  sctp_cname(SCTP_ST_CHUNK(
-                                          chunk->chunk_hdr->type)),
-                                  chunk->has_tsn ? "TSN" : "No TSN",
-                                  chunk->has_tsn ?
-                                  ntohl(chunk->subh.data_hdr->tsn) : 0,
-                                  "length", ntohs(chunk->chunk_hdr->length),
-                                  "chunk->skb->len", chunk->skb->len,
-                                  "rtt_in_progress", chunk->rtt_in_progress);
+                pr_debug("*** Chunk:%p[%s] %s 0x%x, length:%d, chunk->skb->len:%d, "
+                         "rtt_in_progress:%d\n", chunk,
+                         sctp_cname(SCTP_ST_CHUNK(chunk->chunk_hdr->type)),
+                         chunk->has_tsn ? "TSN" : "No TSN",
+                         chunk->has_tsn ? ntohl(chunk->subh.data_hdr->tsn) : 0,
+                         ntohs(chunk->chunk_hdr->length), chunk->skb->len,
+                         chunk->rtt_in_progress);
 
                 /*
                  * If this is a control chunk, this is our last
@@ -606,8 +595,7 @@ int sctp_packet_transmit(struct sctp_packet *packet)
                 }
         }
 
-        SCTP_DEBUG_PRINTK("***sctp_transmit_packet*** skb len %d\n",
-                          nskb->len);
+        pr_debug("***sctp_transmit_packet*** skb->len:%d\n", nskb->len);
 
         nskb->local_df = packet->ipfragok;
         (*tp->af_specific->sctp_xmit)(nskb, tp);
diff --git a/net/sctp/outqueue.c b/net/sctp/outqueue.c
index 32a4625fef77..94df75877869 100644
--- a/net/sctp/outqueue.c
+++ b/net/sctp/outqueue.c
@@ -28,10 +28,7 @@
  *
  * Please send any bug reports or fixes you make to the
  * email address(es):
- *    lksctp developers <lksctp-developers@lists.sourceforge.net>
- *
- * Or submit a bug report through the following website:
- *    http://www.sf.net/projects/lksctp
+ *    lksctp developers <linux-sctp@vger.kernel.org>
  *
  * Written or modified by:
  *    La Monte H.P. Yarroll <piggy@acm.org>
@@ -41,9 +38,6 @@
  *    Hui Huang             <hui.huang@nokia.com>
  *    Sridhar Samudrala     <sri@us.ibm.com>
  *    Jon Grimm             <jgrimm@us.ibm.com>
- *
- * Any bugs reported given to us we will try to fix... any fixes shared will
- * be incorporated into the next SCTP release.
  */
 
 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
@@ -206,6 +200,8 @@ static inline int sctp_cacc_skip(struct sctp_transport *primary,
  */
 void sctp_outq_init(struct sctp_association *asoc, struct sctp_outq *q)
 {
+        memset(q, 0, sizeof(struct sctp_outq));
+
         q->asoc = asoc;
         INIT_LIST_HEAD(&q->out_chunk_list);
         INIT_LIST_HEAD(&q->control_chunk_list);
@@ -213,11 +209,7 @@ void sctp_outq_init(struct sctp_association *asoc, struct sctp_outq *q)
         INIT_LIST_HEAD(&q->sacked);
         INIT_LIST_HEAD(&q->abandoned);
 
-        q->fast_rtx = 0;
-        q->outstanding_bytes = 0;
         q->empty = 1;
-        q->cork  = 0;
-        q->out_qlen = 0;
 }
 
 /* Free the outqueue structure and any related pending chunks.
@@ -301,10 +293,10 @@ int sctp_outq_tail(struct sctp_outq *q, struct sctp_chunk *chunk)
         struct net *net = sock_net(q->asoc->base.sk);
         int error = 0;
 
-        SCTP_DEBUG_PRINTK("sctp_outq_tail(%p, %p[%s])\n",
-                          q, chunk, chunk && chunk->chunk_hdr ?
-                          sctp_cname(SCTP_ST_CHUNK(chunk->chunk_hdr->type))
-                          : "Illegal Chunk");
+        pr_debug("%s: outq:%p, chunk:%p[%s]\n", __func__, q, chunk,
+                 chunk && chunk->chunk_hdr ?
+                 sctp_cname(SCTP_ST_CHUNK(chunk->chunk_hdr->type)) :
+                 "illegal chunk");
 
         /* If it is data, queue it up, otherwise, send it
          * immediately.
@@ -330,10 +322,10 @@ int sctp_outq_tail(struct sctp_outq *q, struct sctp_chunk *chunk)
                         break;
 
                 default:
-                        SCTP_DEBUG_PRINTK("outqueueing (%p, %p[%s])\n",
-                          q, chunk, chunk && chunk->chunk_hdr ?
-                          sctp_cname(SCTP_ST_CHUNK(chunk->chunk_hdr->type))
-                          : "Illegal Chunk");
+                        pr_debug("%s: outqueueing: outq:%p, chunk:%p[%s])\n",
+                                 __func__, q, chunk, chunk && chunk->chunk_hdr ?
+                                 sctp_cname(SCTP_ST_CHUNK(chunk->chunk_hdr->type)) :
+                                 "illegal chunk");
 
                         sctp_outq_tail_data(q, chunk);
                         if (chunk->chunk_hdr->flags & SCTP_DATA_UNORDERED)
@@ -462,14 +454,10 @@ void sctp_retransmit_mark(struct sctp_outq *q,
                 }
         }
 
-        SCTP_DEBUG_PRINTK("%s: transport: %p, reason: %d, "
-                          "cwnd: %d, ssthresh: %d, flight_size: %d, "
-                          "pba: %d\n", __func__,
-                          transport, reason,
-                          transport->cwnd, transport->ssthresh,
-                          transport->flight_size,
-                          transport->partial_bytes_acked);
-
+        pr_debug("%s: transport:%p, reason:%d, cwnd:%d, ssthresh:%d, "
+                 "flight_size:%d, pba:%d\n", __func__, transport, reason,
+                 transport->cwnd, transport->ssthresh, transport->flight_size,
+                 transport->partial_bytes_acked);
 }
 
 /* Mark all the eligible packets on a transport for retransmission and force
@@ -1016,19 +1004,13 @@ static int sctp_outq_flush(struct sctp_outq *q, int rtx_timeout)
                                 sctp_transport_burst_limited(transport);
                         }
 
-                        SCTP_DEBUG_PRINTK("sctp_outq_flush(%p, %p[%s]), ",
-                                          q, chunk,
-                                          chunk && chunk->chunk_hdr ?
-                                          sctp_cname(SCTP_ST_CHUNK(
-                                                  chunk->chunk_hdr->type))
-                                          : "Illegal Chunk");
-
-                        SCTP_DEBUG_PRINTK("TX TSN 0x%x skb->head "
-                                        "%p skb->users %d.\n",
-                                        ntohl(chunk->subh.data_hdr->tsn),
-                                        chunk->skb ?chunk->skb->head : NULL,
-                                        chunk->skb ?
-                                        atomic_read(&chunk->skb->users) : -1);
+                        pr_debug("%s: outq:%p, chunk:%p[%s], tx-tsn:0x%x skb->head:%p "
+                                 "skb->users:%d\n",
+                                 __func__, q, chunk, chunk && chunk->chunk_hdr ?
+                                 sctp_cname(SCTP_ST_CHUNK(chunk->chunk_hdr->type)) :
+                                 "illegal chunk", ntohl(chunk->subh.data_hdr->tsn),
+                                 chunk->skb ? chunk->skb->head : NULL, chunk->skb ?
+                                 atomic_read(&chunk->skb->users) : -1);
 
                         /* Add the chunk to the packet.  */
                         status = sctp_packet_transmit_chunk(packet, chunk, 0);
@@ -1040,10 +1022,10 @@ static int sctp_outq_flush(struct sctp_outq *q, int rtx_timeout)
                                 /* We could not append this chunk, so put
                                  * the chunk back on the output queue.
                                  */
-                                SCTP_DEBUG_PRINTK("sctp_outq_flush: could "
-                                        "not transmit TSN: 0x%x, status: %d\n",
-                                        ntohl(chunk->subh.data_hdr->tsn),
-                                        status);
+                                pr_debug("%s: could not transmit tsn:0x%x, status:%d\n",
+                                         __func__, ntohl(chunk->subh.data_hdr->tsn),
+                                         status);
+
                                 sctp_outq_head_data(q, chunk);
                                 goto sctp_flush_out;
                                 break;
@@ -1286,11 +1268,10 @@ int sctp_outq_sack(struct sctp_outq *q, struct sctp_chunk *chunk)
 
         sctp_generate_fwdtsn(q, sack_ctsn);
 
-        SCTP_DEBUG_PRINTK("%s: sack Cumulative TSN Ack is 0x%x.\n",
-                          __func__, sack_ctsn);
-        SCTP_DEBUG_PRINTK("%s: Cumulative TSN Ack of association, "
-                          "%p is 0x%x. Adv peer ack point: 0x%x\n",
-                          __func__, asoc, ctsn, asoc->adv_peer_ack_point);
+        pr_debug("%s: sack cumulative tsn ack:0x%x\n", __func__, sack_ctsn);
+        pr_debug("%s: cumulative tsn ack of assoc:%p is 0x%x, "
+                 "advertised peer ack point:0x%x\n", __func__, asoc, ctsn,
+                 asoc->adv_peer_ack_point);
 
         /* See if all chunks are acked.
          * Make sure the empty queue handler will get run later.
@@ -1306,7 +1287,7 @@ int sctp_outq_sack(struct sctp_outq *q, struct sctp_chunk *chunk)
                         goto finish;
         }
 
-        SCTP_DEBUG_PRINTK("sack queue is empty.\n");
+        pr_debug("%s: sack queue is empty\n", __func__);
 finish:
         return q->empty;
 }
@@ -1347,21 +1328,7 @@ static void sctp_check_transmitted(struct sctp_outq *q,
         __u8 restart_timer = 0;
         int bytes_acked = 0;
         int migrate_bytes = 0;
-
-        /* These state variables are for coherent debug output. --xguo */
-
-#if SCTP_DEBUG
-        __u32 dbg_ack_tsn = 0;  /* An ACKed TSN range starts here... */
-        __u32 dbg_last_ack_tsn = 0;  /* ...and finishes here.        */
-        __u32 dbg_kept_tsn = 0; /* An un-ACKed range starts here...  */
-        __u32 dbg_last_kept_tsn = 0; /* ...and finishes here.        */
-
-        /* 0 : The last TSN was ACKed.
-         * 1 : The last TSN was NOT ACKed (i.e. KEPT).
-         * -1: We need to initialize.
-         */
-        int dbg_prt_state = -1;
-#endif /* SCTP_DEBUG */
+        bool forward_progress = false;
 
         sack_ctsn = ntohl(sack->cum_tsn_ack);
 
@@ -1428,6 +1395,7 @@ static void sctp_check_transmitted(struct sctp_outq *q,
                                 bytes_acked += sctp_data_size(tchunk);
                                 if (!tchunk->transport)
                                         migrate_bytes += sctp_data_size(tchunk);
+                                forward_progress = true;
                         }
 
                         if (TSN_lte(tsn, sack_ctsn)) {
@@ -1441,6 +1409,7 @@ static void sctp_check_transmitted(struct sctp_outq *q,
                                  * current RTO.
                                  */
                                 restart_timer = 1;
+                                forward_progress = true;
 
                                 if (!tchunk->tsn_gap_acked) {
                                         /*
@@ -1484,57 +1453,11 @@ static void sctp_check_transmitted(struct sctp_outq *q,
                                  */
                                 list_add_tail(lchunk, &tlist);
                         }
-
-#if SCTP_DEBUG
-                        switch (dbg_prt_state) {
-                        case 0: /* last TSN was ACKed */
-                                if (dbg_last_ack_tsn + 1 == tsn) {
-                                        /* This TSN belongs to the
-                                         * current ACK range.
-                                         */
-                                        break;
-                                }
-
-                                if (dbg_last_ack_tsn != dbg_ack_tsn) {
-                                        /* Display the end of the
-                                         * current range.
-                                         */
-                                        SCTP_DEBUG_PRINTK_CONT("-%08x",
-                                                               dbg_last_ack_tsn);
-                                }
-
-                                /* Start a new range.  */
-                                SCTP_DEBUG_PRINTK_CONT(",%08x", tsn);
-                                dbg_ack_tsn = tsn;
-                                break;
-
-                        case 1: /* The last TSN was NOT ACKed. */
-                                if (dbg_last_kept_tsn != dbg_kept_tsn) {
-                                        /* Display the end of current range. */
-                                        SCTP_DEBUG_PRINTK_CONT("-%08x",
-                                                               dbg_last_kept_tsn);
-                                }
-
-                                SCTP_DEBUG_PRINTK_CONT("\n");
-
-                                /* FALL THROUGH... */
-                        default:
-                                /* This is the first-ever TSN we examined.  */
-                                /* Start a new range of ACK-ed TSNs.  */
-                                SCTP_DEBUG_PRINTK("ACKed: %08x", tsn);
-                                dbg_prt_state = 0;
-                                dbg_ack_tsn = tsn;
-                        }
-
-                        dbg_last_ack_tsn = tsn;
-#endif /* SCTP_DEBUG */
-
                 } else {
                         if (tchunk->tsn_gap_acked) {
-                                SCTP_DEBUG_PRINTK("%s: Receiver reneged on "
-                                                  "data TSN: 0x%x\n",
-                                                  __func__,
-                                                  tsn);
+                                pr_debug("%s: receiver reneged on data TSN:0x%x\n",
+                                         __func__, tsn);
+
                                 tchunk->tsn_gap_acked = 0;
 
                                 if (tchunk->transport)
@@ -1553,59 +1476,9 @@ static void sctp_check_transmitted(struct sctp_outq *q,
                         }
 
                         list_add_tail(lchunk, &tlist);
-
-#if SCTP_DEBUG
-                        /* See the above comments on ACK-ed TSNs. */
-                        switch (dbg_prt_state) {
-                        case 1:
-                                if (dbg_last_kept_tsn + 1 == tsn)
-                                        break;
-
-                                if (dbg_last_kept_tsn != dbg_kept_tsn)
-                                        SCTP_DEBUG_PRINTK_CONT("-%08x",
-                                                               dbg_last_kept_tsn);
-
-                                SCTP_DEBUG_PRINTK_CONT(",%08x", tsn);
-                                dbg_kept_tsn = tsn;
-                                break;
-
-                        case 0:
-                                if (dbg_last_ack_tsn != dbg_ack_tsn)
-                                        SCTP_DEBUG_PRINTK_CONT("-%08x",
-                                                               dbg_last_ack_tsn);
-                                SCTP_DEBUG_PRINTK_CONT("\n");
-
-                                /* FALL THROUGH... */
-                        default:
-                                SCTP_DEBUG_PRINTK("KEPT: %08x",tsn);
-                                dbg_prt_state = 1;
-                                dbg_kept_tsn = tsn;
-                        }
-
-                        dbg_last_kept_tsn = tsn;
-#endif /* SCTP_DEBUG */
                 }
         }
 
-#if SCTP_DEBUG
-        /* Finish off the last range, displaying its ending TSN.  */
-        switch (dbg_prt_state) {
-        case 0:
-                if (dbg_last_ack_tsn != dbg_ack_tsn) {
-                        SCTP_DEBUG_PRINTK_CONT("-%08x\n", dbg_last_ack_tsn);
-                } else {
-                        SCTP_DEBUG_PRINTK_CONT("\n");
-                }
-        break;
-
-        case 1:
-                if (dbg_last_kept_tsn != dbg_kept_tsn) {
-                        SCTP_DEBUG_PRINTK_CONT("-%08x\n", dbg_last_kept_tsn);
-                } else {
-                        SCTP_DEBUG_PRINTK_CONT("\n");
-                }
-        }
-#endif /* SCTP_DEBUG */
         if (transport) {
                 if (bytes_acked) {
                         struct sctp_association *asoc = transport->asoc;
@@ -1627,6 +1500,7 @@ static void sctp_check_transmitted(struct sctp_outq *q,
                          */
                         transport->error_count = 0;
                         transport->asoc->overall_error_count = 0;
+                        forward_progress = true;
 
                         /*
                          * While in SHUTDOWN PENDING, we may have started
@@ -1678,9 +1552,9 @@ static void sctp_check_transmitted(struct sctp_outq *q,
                             !list_empty(&tlist) &&
                             (sack_ctsn+2 == q->asoc->next_tsn) &&
                             q->asoc->state < SCTP_STATE_SHUTDOWN_PENDING) {
-                                SCTP_DEBUG_PRINTK("%s: SACK received for zero "
-                                                  "window probe: %u\n",
-                                                  __func__, sack_ctsn);
+                                pr_debug("%s: sack received for zero window "
+                                         "probe:%u\n", __func__, sack_ctsn);
+
                                 q->asoc->overall_error_count = 0;
                                 transport->error_count = 0;
                         }
@@ -1700,6 +1574,11 @@ static void sctp_check_transmitted(struct sctp_outq *q,
                                        jiffies + transport->rto))
                                 sctp_transport_hold(transport);
                 }
+
+                if (forward_progress) {
+                        if (transport->dst)
+                                dst_confirm(transport->dst);
+                }
         }
 
         list_splice(&tlist, transmitted_queue);
@@ -1741,10 +1620,8 @@ static void sctp_mark_missing(struct sctp_outq *q,
                                                 count_of_newacks, tsn)) {
                                 chunk->tsn_missing_report++;
 
-                                SCTP_DEBUG_PRINTK(
-                                        "%s: TSN 0x%x missing counter: %d\n",
-                                        __func__, tsn,
-                                        chunk->tsn_missing_report);
+                                pr_debug("%s: tsn:0x%x missing counter:%d\n",
+                                         __func__, tsn, chunk->tsn_missing_report);
                         }
                 }
                 /*
@@ -1764,11 +1641,10 @@ static void sctp_mark_missing(struct sctp_outq *q,
                 if (do_fast_retransmit)
                         sctp_retransmit(q, transport, SCTP_RTXR_FAST_RTX);
 
-                SCTP_DEBUG_PRINTK("%s: transport: %p, cwnd: %d, "
-                                  "ssthresh: %d, flight_size: %d, pba: %d\n",
-                                  __func__, transport, transport->cwnd,
-                                  transport->ssthresh, transport->flight_size,
-                                  transport->partial_bytes_acked);
+                pr_debug("%s: transport:%p, cwnd:%d, ssthresh:%d, "
+                         "flight_size:%d, pba:%d\n",  __func__, transport,
+                         transport->cwnd, transport->ssthresh,
+                         transport->flight_size, transport->partial_bytes_acked);
         }
 }
 
diff --git a/net/sctp/primitive.c b/net/sctp/primitive.c
index 794bb14decde..ce1ffd811775 100644
--- a/net/sctp/primitive.c
+++ b/net/sctp/primitive.c
@@ -29,10 +29,7 @@
  *
  * Please send any bug reports or fixes you make to the
  * email address(es):
- *    lksctp developers <lksctp-developers@lists.sourceforge.net>
- *
- * Or submit a bug report through the following website:
- *    http://www.sf.net/projects/lksctp
+ *    lksctp developers <linux-sctp@vger.kernel.org>
  *
  * Written or modified by:
  *    La Monte H.P. Yarroll <piggy@acm.org>
@@ -40,9 +37,6 @@
  *    Karl Knutson          <karl@athena.chicago.il.us>
  *    Ardelle Fan           <ardelle.fan@intel.com>
  *    Kevin Gao             <kevin.gao@intel.com>
- *
- * Any bugs reported given to us we will try to fix... any fixes shared will
- * be incorporated into the next SCTP release.
  */
 
 #include <linux/types.h>
diff --git a/net/sctp/probe.c b/net/sctp/probe.c
index e62c22535be4..53c452efb40b 100644
--- a/net/sctp/probe.c
+++ b/net/sctp/probe.c
@@ -46,6 +46,10 @@ static int port __read_mostly = 0;
 MODULE_PARM_DESC(port, "Port to match (0=all)");
 module_param(port, int, 0);
 
+static unsigned int fwmark __read_mostly = 0;
+MODULE_PARM_DESC(fwmark, "skb mark to match (0=no mark)");
+module_param(fwmark, uint, 0);
+
 static int bufsize __read_mostly = 64 * 1024;
 MODULE_PARM_DESC(bufsize, "Log buffer size (default 64k)");
 module_param(bufsize, int, 0);
@@ -129,15 +133,19 @@ static sctp_disposition_t jsctp_sf_eat_sack(struct net *net,
                                             void *arg,
                                             sctp_cmd_seq_t *commands)
 {
+        struct sctp_chunk *chunk = arg;
+        struct sk_buff *skb = chunk->skb;
         struct sctp_transport *sp;
         static __u32 lcwnd = 0;
         struct timespec now;
 
         sp = asoc->peer.primary_path;
 
-        if ((full || sp->cwnd != lcwnd) &&
-            (!port || asoc->peer.port == port ||
-             ep->base.bind_addr.port == port)) {
+        if (((port == 0 && fwmark == 0) ||
+             asoc->peer.port == port ||
+             ep->base.bind_addr.port == port ||
+             (fwmark > 0 && skb->mark == fwmark)) &&
+            (full || sp->cwnd != lcwnd)) {
                 lcwnd = sp->cwnd;
 
                 getnstimeofday(&now);
@@ -155,13 +163,8 @@ static sctp_disposition_t jsctp_sf_eat_sack(struct net *net,
                         if (sp == asoc->peer.primary_path)
                                 printl("*");
 
-                        if (sp->ipaddr.sa.sa_family == AF_INET)
-                                printl("%pI4 ", &sp->ipaddr.v4.sin_addr);
-                        else
-                                printl("%pI6 ", &sp->ipaddr.v6.sin6_addr);
-
-                        printl("%2u %8u %8u %8u %8u %8u ",
-                               sp->state, sp->cwnd, sp->ssthresh,
+                        printl("%pISc %2u %8u %8u %8u %8u %8u ",
+                               &sp->ipaddr, sp->state, sp->cwnd, sp->ssthresh,
                                sp->flight_size, sp->partial_bytes_acked,
                                sp->pathmtu);
                 }
@@ -203,8 +206,8 @@ static __init int sctpprobe_init(void)
         if (ret)
                 goto remove_proc;
 
-        pr_info("probe registered (port=%d)\n", port);
-
+        pr_info("probe registered (port=%d/fwmark=%u) bufsize=%u\n",
+                port, fwmark, bufsize);
         return 0;
 
 remove_proc:
diff --git a/net/sctp/proc.c b/net/sctp/proc.c
index 4e45ee35d0db..0c0642156842 100644
--- a/net/sctp/proc.c
+++ b/net/sctp/proc.c
@@ -22,16 +22,10 @@
  *
  * Please send any bug reports or fixes you make to the
  * email address(es):
- *    lksctp developers <lksctp-developers@lists.sourceforge.net>
- *
- * Or submit a bug report through the following website:
- *    http://www.sf.net/projects/lksctp
+ *    lksctp developers <linux-sctp@vger.kernel.org>
  *
  * Written or modified by:
  *    Sridhar Samudrala <sri@us.ibm.com>
- *
- * Any bugs reported given to us we will try to fix... any fixes shared will
- * be incorporated into the next SCTP release.
  */
 
 #include <linux/types.h>
@@ -134,9 +128,15 @@ static void sctp_seq_dump_local_addrs(struct seq_file *seq, struct sctp_ep_commo
         struct sctp_af *af;
 
         if (epb->type == SCTP_EP_TYPE_ASSOCIATION) {
-            asoc = sctp_assoc(epb);
-            peer = asoc->peer.primary_path;
-            primary = &peer->saddr;
+                asoc = sctp_assoc(epb);
+
+                peer = asoc->peer.primary_path;
+                if (unlikely(peer == NULL)) {
+                        WARN(1, "Association %p with NULL primary path!\n", asoc);
+                        return;
+                }
+
+                primary = &peer->saddr;
         }
 
         rcu_read_lock();
@@ -226,7 +226,7 @@ static int sctp_eps_seq_show(struct seq_file *seq, void *v)
                 sk = epb->sk;
                 if (!net_eq(sock_net(sk), seq_file_net(seq)))
                         continue;
-                seq_printf(seq, "%8pK %8pK %-3d %-3d %-4d %-5d %5d %5lu ", ep, sk,
+                seq_printf(seq, "%8pK %8pK %-3d %-3d %-4d %-5d %5u %5lu ", ep, sk,
                            sctp_sk(sk)->type, sk->sk_state, hash,
                            epb->bind_addr.port,
                            from_kuid_munged(seq_user_ns(seq), sock_i_uid(sk)),
@@ -336,7 +336,7 @@ static int sctp_assocs_seq_show(struct seq_file *seq, void *v)
                         continue;
                 seq_printf(seq,
                            "%8pK %8pK %-3d %-3d %-2d %-4d "
-                           "%4d %8d %8d %7d %5lu %-5d %5d ",
+                           "%4d %8d %8d %7u %5lu %-5d %5d ",
                            assoc, sk, sctp_sk(sk)->type, sk->sk_state,
                            assoc->state, hash,
                            assoc->assoc_id,
diff --git a/net/sctp/protocol.c b/net/sctp/protocol.c
index eaee00c61139..5e17092f4ada 100644
--- a/net/sctp/protocol.c
+++ b/net/sctp/protocol.c
@@ -29,10 +29,7 @@
  *
  * Please send any bug reports or fixes you make to the
  * email address(es):
- *    lksctp developers <lksctp-developers@lists.sourceforge.net>
- *
- * Or submit a bug report through the following website:
- *    http://www.sf.net/projects/lksctp
+ *    lksctp developers <linux-sctp@vger.kernel.org>
  *
  * Written or modified by:
  *    La Monte H.P. Yarroll <piggy@acm.org>
@@ -41,9 +38,6 @@
  *    Sridhar Samudrala <sri@us.ibm.com>
  *    Daisy Chang <daisyc@us.ibm.com>
  *    Ardelle Fan <ardelle.fan@intel.com>
- *
- * Any bugs reported given to us we will try to fix... any fixes shared will
- * be incorporated into the next SCTP release.
  */
 
 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
@@ -153,7 +147,7 @@ static void sctp_v4_copy_addrlist(struct list_head *addrlist,
 
         for (ifa = in_dev->ifa_list; ifa; ifa = ifa->ifa_next) {
                 /* Add the address to the local list.  */
-                addr = t_new(struct sctp_sockaddr_entry, GFP_ATOMIC);
+                addr = kzalloc(sizeof(*addr), GFP_ATOMIC);
                 if (addr) {
                         addr->a.v4.sin_family = AF_INET;
                         addr->a.v4.sin_port = 0;
@@ -178,7 +172,7 @@ static void sctp_get_local_addr_list(struct net *net)
 
         rcu_read_lock();
         for_each_netdev_rcu(net, dev) {
-                __list_for_each(pos, &sctp_address_families) {
+                list_for_each(pos, &sctp_address_families) {
                         af = list_entry(pos, struct sctp_af, list);
                         af->copy_addrlist(&net->sctp.local_addr_list, dev);
                 }
@@ -451,8 +445,8 @@ static void sctp_v4_get_dst(struct sctp_transport *t, union sctp_addr *saddr,
                 fl4->fl4_sport = saddr->v4.sin_port;
         }
 
-        SCTP_DEBUG_PRINTK("%s: DST:%pI4, SRC:%pI4 - ",
-                          __func__, &fl4->daddr, &fl4->saddr);
+        pr_debug("%s: dst:%pI4, src:%pI4 - ", __func__, &fl4->daddr,
+                 &fl4->saddr);
 
         rt = ip_route_output_key(sock_net(sk), fl4);
         if (!IS_ERR(rt))
@@ -513,10 +507,10 @@ out_unlock:
 out:
         t->dst = dst;
         if (dst)
-                SCTP_DEBUG_PRINTK("rt_dst:%pI4, rt_src:%pI4\n",
-                                  &fl4->daddr, &fl4->saddr);
+                pr_debug("rt_dst:%pI4, rt_src:%pI4\n",
+                         &fl4->daddr, &fl4->saddr);
         else
-                SCTP_DEBUG_PRINTK("NO ROUTE\n");
+                pr_debug("no route\n");
 }
 
 /* For v4, the source address is cached in the route entry(dst). So no need
@@ -604,9 +598,9 @@ static void sctp_addr_wq_timeout_handler(unsigned long arg)
         spin_lock_bh(&net->sctp.addr_wq_lock);
 
         list_for_each_entry_safe(addrw, temp, &net->sctp.addr_waitq, list) {
-                SCTP_DEBUG_PRINTK_IPADDR("sctp_addrwq_timo_handler: the first ent in wq %p is ",
-                    " for cmd %d at entry %p\n", &net->sctp.addr_waitq, &addrw->a, addrw->state,
-                    addrw);
+                pr_debug("%s: the first ent in wq:%p is addr:%pISc for cmd:%d at "
+                         "entry:%p\n", __func__, &net->sctp.addr_waitq, &addrw->a.sa,
+                         addrw->state, addrw);
 
 #if IS_ENABLED(CONFIG_IPV6)
                 /* Now we send an ASCONF for each association */
@@ -623,8 +617,10 @@ static void sctp_addr_wq_timeout_handler(unsigned long arg)
                             addrw->state == SCTP_ADDR_NEW) {
                                 unsigned long timeo_val;
 
-                                SCTP_DEBUG_PRINTK("sctp_timo_handler: this is on DAD, trying %d sec later\n",
-                                    SCTP_ADDRESS_TICK_DELAY);
+                                pr_debug("%s: this is on DAD, trying %d sec "
+                                         "later\n", __func__,
+                                         SCTP_ADDRESS_TICK_DELAY);
+
                                 timeo_val = jiffies;
                                 timeo_val += msecs_to_jiffies(SCTP_ADDRESS_TICK_DELAY);
                                 mod_timer(&net->sctp.addr_wq_timer, timeo_val);
@@ -641,7 +637,7 @@ static void sctp_addr_wq_timeout_handler(unsigned long arg)
                                 continue;
                         sctp_bh_lock_sock(sk);
                         if (sctp_asconf_mgmt(sp, addrw) < 0)
-                                SCTP_DEBUG_PRINTK("sctp_addrwq_timo_handler: sctp_asconf_mgmt failed\n");
+                                pr_debug("%s: sctp_asconf_mgmt failed\n", __func__);
                         sctp_bh_unlock_sock(sk);
                 }
 #if IS_ENABLED(CONFIG_IPV6)
@@ -707,9 +703,10 @@ void sctp_addr_wq_mgmt(struct net *net, struct sctp_sockaddr_entry *addr, int cm
         addrw = sctp_addr_wq_lookup(net, addr);
         if (addrw) {
                 if (addrw->state != cmd) {
-                        SCTP_DEBUG_PRINTK_IPADDR("sctp_addr_wq_mgmt offsets existing entry for %d ",
-                            " in wq %p\n", addrw->state, &addrw->a,
-                            &net->sctp.addr_waitq);
+                        pr_debug("%s: offsets existing entry for %d, addr:%pISc "
+                                 "in wq:%p\n", __func__, addrw->state, &addrw->a.sa,
+                                 &net->sctp.addr_waitq);
+
                         list_del(&addrw->list);
                         kfree(addrw);
                 }
@@ -725,8 +722,9 @@ void sctp_addr_wq_mgmt(struct net *net, struct sctp_sockaddr_entry *addr, int cm
         }
         addrw->state = cmd;
         list_add_tail(&addrw->list, &net->sctp.addr_waitq);
-        SCTP_DEBUG_PRINTK_IPADDR("sctp_addr_wq_mgmt add new entry for cmd:%d ",
-            " in wq %p\n", addrw->state, &addrw->a, &net->sctp.addr_waitq);
+
+        pr_debug("%s: add new entry for cmd:%d, addr:%pISc in wq:%p\n",
+                 __func__, addrw->state, &addrw->a.sa, &net->sctp.addr_waitq);
 
         if (!timer_pending(&net->sctp.addr_wq_timer)) {
                 timeo_val = jiffies;
@@ -952,15 +950,14 @@ static inline int sctp_v4_xmit(struct sk_buff *skb,
 {
         struct inet_sock *inet = inet_sk(skb->sk);
 
-        SCTP_DEBUG_PRINTK("%s: skb:%p, len:%d, src:%pI4, dst:%pI4\n",
-                          __func__, skb, skb->len,
-                          &transport->fl.u.ip4.saddr,
-                          &transport->fl.u.ip4.daddr);
+        pr_debug("%s: skb:%p, len:%d, src:%pI4, dst:%pI4\n", __func__, skb,
+                 skb->len, &transport->fl.u.ip4.saddr, &transport->fl.u.ip4.daddr);
 
         inet->pmtudisc = transport->param_flags & SPP_PMTUD_ENABLE ?
                          IP_PMTUDISC_DO : IP_PMTUDISC_DONT;
 
         SCTP_INC_STATS(sock_net(&inet->sk), SCTP_MIB_OUTSCTPPACKS);
+
         return ip_queue_xmit(skb, &transport->fl);
 }
 
@@ -1312,7 +1309,7 @@ static struct pernet_operations sctp_net_ops = {
 };
 
 /* Initialize the universe into something sensible.  */
-SCTP_STATIC __init int sctp_init(void)
+static __init int sctp_init(void)
 {
         int i;
         int status = -EINVAL;
@@ -1321,9 +1318,8 @@ SCTP_STATIC __init int sctp_init(void)
         int max_share;
         int order;
 
-        /* SCTP_DEBUG sanity check. */
-        if (!sctp_sanity_check())
-                goto out;
+        BUILD_BUG_ON(sizeof(struct sctp_ulpevent) >
+                     sizeof(((struct sk_buff *) 0)->cb));
 
         /* Allocate bind_bucket and chunk caches. */
         status = -ENOBUFS;
@@ -1499,7 +1495,7 @@ err_chunk_cachep:
 }
 
 /* Exit handler for the SCTP protocol.  */
-SCTP_STATIC __exit void sctp_exit(void)
+static __exit void sctp_exit(void)
 {
         /* BUG.  This should probably do something useful like clean
          * up all the remaining associations and all that memory.
@@ -1545,7 +1541,7 @@ module_exit(sctp_exit);
  */
 MODULE_ALIAS("net-pf-" __stringify(PF_INET) "-proto-132");
 MODULE_ALIAS("net-pf-" __stringify(PF_INET6) "-proto-132");
-MODULE_AUTHOR("Linux Kernel SCTP developers <lksctp-developers@lists.sourceforge.net>");
+MODULE_AUTHOR("Linux Kernel SCTP developers <linux-sctp@vger.kernel.org>");
 MODULE_DESCRIPTION("Support for the SCTP protocol (RFC2960)");
 module_param_named(no_checksums, sctp_checksum_disable, bool, 0644);
 MODULE_PARM_DESC(no_checksums, "Disable checksums computing and verification");
diff --git a/net/sctp/sm_make_chunk.c b/net/sctp/sm_make_chunk.c
index cf579e71cff0..d244a23ab8d3 100644
--- a/net/sctp/sm_make_chunk.c
+++ b/net/sctp/sm_make_chunk.c
@@ -29,10 +29,7 @@
  *
  * Please send any bug reports or fixes you make to the
  * email address(es):
- *    lksctp developers <lksctp-developers@lists.sourceforge.net>
- *
- * Or submit a bug report through the following website:
- *    http://www.sf.net/projects/lksctp
+ *    lksctp developers <linux-sctp@vger.kernel.org>
  *
  * Written or modified by:
  *    La Monte H.P. Yarroll <piggy@acm.org>
@@ -45,9 +42,6 @@
  *    Daisy Chang           <daisyc@us.ibm.com>
  *    Ardelle Fan           <ardelle.fan@intel.com>
  *    Kevin Gao             <kevin.gao@intel.com>
- *
- * Any bugs reported given to us we will try to fix... any fixes shared will
- * be incorporated into the next SCTP release.
  */
 
 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
@@ -68,9 +62,12 @@
 #include <net/sctp/sctp.h>
 #include <net/sctp/sm.h>
 
-SCTP_STATIC
-struct sctp_chunk *sctp_make_chunk(const struct sctp_association *asoc,
-                                   __u8 type, __u8 flags, int paylen);
+static struct sctp_chunk *sctp_make_control(const struct sctp_association *asoc,
+                                            __u8 type, __u8 flags, int paylen);
+static struct sctp_chunk *sctp_make_data(const struct sctp_association *asoc,
+                                         __u8 flags, int paylen);
+static struct sctp_chunk *_sctp_make_chunk(const struct sctp_association *asoc,
+                                           __u8 type, __u8 flags, int paylen);
 static sctp_cookie_param_t *sctp_pack_cookie(const struct sctp_endpoint *ep,
                                         const struct sctp_association *asoc,
                                         const struct sctp_chunk *init_chunk,
@@ -83,6 +80,28 @@ static int sctp_process_param(struct sctp_association *asoc,
 static void *sctp_addto_param(struct sctp_chunk *chunk, int len,
                               const void *data);
 
+/* Control chunk destructor */
+static void sctp_control_release_owner(struct sk_buff *skb)
+{
+        /*TODO: do memory release */
+}
+
+static void sctp_control_set_owner_w(struct sctp_chunk *chunk)
+{
+        struct sctp_association *asoc = chunk->asoc;
+        struct sk_buff *skb = chunk->skb;
+
+        /* TODO: properly account for control chunks.
+         * To do it right we'll need:
+         *  1) endpoint if association isn't known.
+         *  2) proper memory accounting.
+         *
+         *  For now don't do anything for now.
+         */
+        skb->sk = asoc ? asoc->base.sk : NULL;
+        skb->destructor = sctp_control_release_owner;
+}
+
 /* What was the inbound interface for this chunk? */
 int sctp_chunk_iif(const struct sctp_chunk *chunk)
 {
@@ -297,7 +316,7 @@ struct sctp_chunk *sctp_make_init(const struct sctp_association *asoc,
          * PLEASE DO NOT FIXME [This version does not support Host Name.]
          */
 
-        retval = sctp_make_chunk(asoc, SCTP_CID_INIT, 0, chunksize);
+        retval = sctp_make_control(asoc, SCTP_CID_INIT, 0, chunksize);
         if (!retval)
                 goto nodata;
 
@@ -444,7 +463,7 @@ struct sctp_chunk *sctp_make_init_ack(const struct sctp_association *asoc,
                                         num_ext);
 
         /* Now allocate and fill out the chunk.  */
-        retval = sctp_make_chunk(asoc, SCTP_CID_INIT_ACK, 0, chunksize);
+        retval = sctp_make_control(asoc, SCTP_CID_INIT_ACK, 0, chunksize);
         if (!retval)
                 goto nomem_chunk;
 
@@ -549,7 +568,7 @@ struct sctp_chunk *sctp_make_cookie_echo(const struct sctp_association *asoc,
         cookie_len = asoc->peer.cookie_len;
 
         /* Build a cookie echo chunk.  */
-        retval = sctp_make_chunk(asoc, SCTP_CID_COOKIE_ECHO, 0, cookie_len);
+        retval = sctp_make_control(asoc, SCTP_CID_COOKIE_ECHO, 0, cookie_len);
         if (!retval)
                 goto nodata;
         retval->subh.cookie_hdr =
@@ -594,7 +613,7 @@ struct sctp_chunk *sctp_make_cookie_ack(const struct sctp_association *asoc,
 {
         struct sctp_chunk *retval;
 
-        retval = sctp_make_chunk(asoc, SCTP_CID_COOKIE_ACK, 0, 0);
+        retval = sctp_make_control(asoc, SCTP_CID_COOKIE_ACK, 0, 0);
 
         /* RFC 2960 6.4 Multi-homed SCTP Endpoints
          *
@@ -642,8 +661,8 @@ struct sctp_chunk *sctp_make_cwr(const struct sctp_association *asoc,
         sctp_cwrhdr_t cwr;
 
         cwr.lowest_tsn = htonl(lowest_tsn);
-        retval = sctp_make_chunk(asoc, SCTP_CID_ECN_CWR, 0,
-                                 sizeof(sctp_cwrhdr_t));
+        retval = sctp_make_control(asoc, SCTP_CID_ECN_CWR, 0,
+                                   sizeof(sctp_cwrhdr_t));
 
         if (!retval)
                 goto nodata;
@@ -676,8 +695,8 @@ struct sctp_chunk *sctp_make_ecne(const struct sctp_association *asoc,
         sctp_ecnehdr_t ecne;
 
         ecne.lowest_tsn = htonl(lowest_tsn);
-        retval = sctp_make_chunk(asoc, SCTP_CID_ECN_ECNE, 0,
-                                 sizeof(sctp_ecnehdr_t));
+        retval = sctp_make_control(asoc, SCTP_CID_ECN_ECNE, 0,
+                                   sizeof(sctp_ecnehdr_t));
         if (!retval)
                 goto nodata;
         retval->subh.ecne_hdr =
@@ -713,7 +732,7 @@ struct sctp_chunk *sctp_make_datafrag_empty(struct sctp_association *asoc,
                 dp.ssn = htons(ssn);
 
         chunk_len = sizeof(dp) + data_len;
-        retval = sctp_make_chunk(asoc, SCTP_CID_DATA, flags, chunk_len);
+        retval = sctp_make_data(asoc, flags, chunk_len);
         if (!retval)
                 goto nodata;
 
@@ -742,7 +761,8 @@ struct sctp_chunk *sctp_make_sack(const struct sctp_association *asoc)
 
         memset(gabs, 0, sizeof(gabs));
         ctsn = sctp_tsnmap_get_ctsn(map);
-        SCTP_DEBUG_PRINTK("sackCTSNAck sent:  0x%x.\n", ctsn);
+
+        pr_debug("%s: sackCTSNAck sent:0x%x\n", __func__, ctsn);
 
         /* How much room is needed in the chunk? */
         num_gabs = sctp_tsnmap_num_gabs(map, gabs);
@@ -759,7 +779,7 @@ struct sctp_chunk *sctp_make_sack(const struct sctp_association *asoc)
                 + sizeof(__u32) * num_dup_tsns;
 
         /* Create the chunk.  */
-        retval = sctp_make_chunk(asoc, SCTP_CID_SACK, 0, len);
+        retval = sctp_make_control(asoc, SCTP_CID_SACK, 0, len);
         if (!retval)
                 goto nodata;
 
@@ -838,8 +858,8 @@ struct sctp_chunk *sctp_make_shutdown(const struct sctp_association *asoc,
         ctsn = sctp_tsnmap_get_ctsn(&asoc->peer.tsn_map);
         shut.cum_tsn_ack = htonl(ctsn);
 
-        retval = sctp_make_chunk(asoc, SCTP_CID_SHUTDOWN, 0,
-                                 sizeof(sctp_shutdownhdr_t));
+        retval = sctp_make_control(asoc, SCTP_CID_SHUTDOWN, 0,
+                                   sizeof(sctp_shutdownhdr_t));
         if (!retval)
                 goto nodata;
 
@@ -857,7 +877,7 @@ struct sctp_chunk *sctp_make_shutdown_ack(const struct sctp_association *asoc,
 {
         struct sctp_chunk *retval;
 
-        retval = sctp_make_chunk(asoc, SCTP_CID_SHUTDOWN_ACK, 0, 0);
+        retval = sctp_make_control(asoc, SCTP_CID_SHUTDOWN_ACK, 0, 0);
 
         /* RFC 2960 6.4 Multi-homed SCTP Endpoints
          *
@@ -886,7 +906,7 @@ struct sctp_chunk *sctp_make_shutdown_complete(
          */
         flags |= asoc ? 0 : SCTP_CHUNK_FLAG_T;
 
-        retval = sctp_make_chunk(asoc, SCTP_CID_SHUTDOWN_COMPLETE, flags, 0);
+        retval = sctp_make_control(asoc, SCTP_CID_SHUTDOWN_COMPLETE, flags, 0);
 
         /* RFC 2960 6.4 Multi-homed SCTP Endpoints
          *
@@ -925,7 +945,7 @@ struct sctp_chunk *sctp_make_abort(const struct sctp_association *asoc,
                         flags = SCTP_CHUNK_FLAG_T;
         }
 
-        retval = sctp_make_chunk(asoc, SCTP_CID_ABORT, flags, hint);
+        retval = sctp_make_control(asoc, SCTP_CID_ABORT, flags, hint);
 
         /* RFC 2960 6.4 Multi-homed SCTP Endpoints
          *
@@ -1117,7 +1137,7 @@ struct sctp_chunk *sctp_make_heartbeat(const struct sctp_association *asoc,
         struct sctp_chunk *retval;
         sctp_sender_hb_info_t hbinfo;
 
-        retval = sctp_make_chunk(asoc, SCTP_CID_HEARTBEAT, 0, sizeof(hbinfo));
+        retval = sctp_make_control(asoc, SCTP_CID_HEARTBEAT, 0, sizeof(hbinfo));
 
         if (!retval)
                 goto nodata;
@@ -1145,7 +1165,7 @@ struct sctp_chunk *sctp_make_heartbeat_ack(const struct sctp_association *asoc,
 {
         struct sctp_chunk *retval;
 
-        retval  = sctp_make_chunk(asoc, SCTP_CID_HEARTBEAT_ACK, 0, paylen);
+        retval  = sctp_make_control(asoc, SCTP_CID_HEARTBEAT_ACK, 0, paylen);
         if (!retval)
                 goto nodata;
 
@@ -1177,8 +1197,8 @@ static struct sctp_chunk *sctp_make_op_error_space(
 {
         struct sctp_chunk *retval;
 
-        retval = sctp_make_chunk(asoc, SCTP_CID_ERROR, 0,
-                                 sizeof(sctp_errhdr_t) + size);
+        retval = sctp_make_control(asoc, SCTP_CID_ERROR, 0,
+                                   sizeof(sctp_errhdr_t) + size);
         if (!retval)
                 goto nodata;
 
@@ -1248,7 +1268,7 @@ struct sctp_chunk *sctp_make_auth(const struct sctp_association *asoc)
         if (unlikely(!hmac_desc))
                 return NULL;
 
-        retval = sctp_make_chunk(asoc, SCTP_CID_AUTH, 0,
+        retval = sctp_make_control(asoc, SCTP_CID_AUTH, 0,
                         hmac_desc->hmac_len + sizeof(sctp_authhdr_t));
         if (!retval)
                 return NULL;
@@ -1288,10 +1308,8 @@ struct sctp_chunk *sctp_chunkify(struct sk_buff *skb,
 
         if (!retval)
                 goto nodata;
-
-        if (!sk) {
-                SCTP_DEBUG_PRINTK("chunkifying skb %p w/o an sk\n", skb);
-        }
+        if (!sk)
+                pr_debug("%s: chunkifying skb:%p w/o an sk\n", __func__, skb);
 
         INIT_LIST_HEAD(&retval->list);
         retval->skb             = skb;
@@ -1353,9 +1371,8 @@ const union sctp_addr *sctp_source(const struct sctp_chunk *chunk)
 /* Create a new chunk, setting the type and flags headers from the
  * arguments, reserving enough space for a 'paylen' byte payload.
  */
-SCTP_STATIC
-struct sctp_chunk *sctp_make_chunk(const struct sctp_association *asoc,
-                                   __u8 type, __u8 flags, int paylen)
+static struct sctp_chunk *_sctp_make_chunk(const struct sctp_association *asoc,
+                                            __u8 type, __u8 flags, int paylen)
 {
         struct sctp_chunk *retval;
         sctp_chunkhdr_t *chunk_hdr;
@@ -1388,14 +1405,27 @@ struct sctp_chunk *sctp_make_chunk(const struct sctp_association *asoc,
         if (sctp_auth_send_cid(type, asoc))
                 retval->auth = 1;
 
-        /* Set the skb to the belonging sock for accounting.  */
-        skb->sk = sk;
-
         return retval;
 nodata:
         return NULL;
 }
 
+static struct sctp_chunk *sctp_make_data(const struct sctp_association *asoc,
+                                         __u8 flags, int paylen)
+{
+        return _sctp_make_chunk(asoc, SCTP_CID_DATA, flags, paylen);
+}
+
+static struct sctp_chunk *sctp_make_control(const struct sctp_association *asoc,
+                                            __u8 type, __u8 flags, int paylen)
+{
+        struct sctp_chunk *chunk = _sctp_make_chunk(asoc, type, flags, paylen);
+
+        if (chunk)
+                sctp_control_set_owner_w(chunk);
+
+        return chunk;
+}
 
 /* Release the memory occupied by a chunk.  */
 static void sctp_chunk_destroy(struct sctp_chunk *chunk)
@@ -1632,8 +1662,8 @@ static sctp_cookie_param_t *sctp_pack_cookie(const struct sctp_endpoint *ep,
         cookie->c.adaptation_ind = asoc->peer.adaptation_ind;
 
         /* Set an expiration time for the cookie.  */
-        do_gettimeofday(&cookie->c.expiration);
-        TIMEVAL_ADD(asoc->cookie_life, cookie->c.expiration);
+        cookie->c.expiration = ktime_add(asoc->cookie_life,
+                                         ktime_get());
 
         /* Copy the peer's init packet.  */
         memcpy(&cookie->c.peer_init[0], init_chunk->chunk_hdr,
@@ -1682,7 +1712,7 @@ struct sctp_association *sctp_unpack_cookie(
         unsigned int len;
         sctp_scope_t scope;
         struct sk_buff *skb = chunk->skb;
-        struct timeval tv;
+        ktime_t kt;
         struct hash_desc desc;
 
         /* Header size is static data prior to the actual cookie, including
@@ -1759,11 +1789,11 @@ no_hmac:
          * down the new association establishment instead of every packet.
          */
         if (sock_flag(ep->base.sk, SOCK_TIMESTAMP))
-                skb_get_timestamp(skb, &tv);
+                kt = skb_get_ktime(skb);
         else
-                do_gettimeofday(&tv);
+                kt = ktime_get();
 
-        if (!asoc && tv_lt(bear_cookie->expiration, tv)) {
+        if (!asoc && ktime_compare(bear_cookie->expiration, kt) < 0) {
                 /*
                  * Section 3.3.10.3 Stale Cookie Error (3)
                  *
@@ -1775,9 +1805,7 @@ no_hmac:
                 len = ntohs(chunk->chunk_hdr->length);
                 *errp = sctp_make_op_error_space(asoc, chunk, len);
                 if (*errp) {
-                        suseconds_t usecs = (tv.tv_sec -
-                                bear_cookie->expiration.tv_sec) * 1000000L +
-                                tv.tv_usec - bear_cookie->expiration.tv_usec;
+                        suseconds_t usecs = ktime_to_us(ktime_sub(kt, bear_cookie->expiration));
                         __be32 n = htonl(usecs);
 
                         sctp_init_cause(*errp, SCTP_ERROR_STALE_COOKIE,
@@ -2195,8 +2223,9 @@ static sctp_ierror_t sctp_verify_param(struct net *net,
                 break;
 fallthrough:
         default:
-                SCTP_DEBUG_PRINTK("Unrecognized param: %d for chunk %d.\n",
-                                ntohs(param.p->type), cid);
+                pr_debug("%s: unrecognized param:%d for chunk:%d\n",
+                         __func__, ntohs(param.p->type), cid);
+
                 retval = sctp_process_unk_param(asoc, param, chunk, err_chunk);
                 break;
         }
@@ -2211,25 +2240,23 @@ int sctp_verify_init(struct net *net, const struct sctp_association *asoc,
                      struct sctp_chunk **errp)
 {
         union sctp_params param;
-        int has_cookie = 0;
+        bool has_cookie = false;
         int result;
 
-        /* Verify stream values are non-zero. */
-        if ((0 == peer_init->init_hdr.num_outbound_streams) ||
-            (0 == peer_init->init_hdr.num_inbound_streams) ||
-            (0 == peer_init->init_hdr.init_tag) ||
-            (SCTP_DEFAULT_MINWINDOW > ntohl(peer_init->init_hdr.a_rwnd))) {
-
+        /* Check for missing mandatory parameters. Note: Initial TSN is
+         * also mandatory, but is not checked here since the valid range
+         * is 0..2**32-1. RFC4960, section 3.3.3.
+         */
+        if (peer_init->init_hdr.num_outbound_streams == 0 ||
+            peer_init->init_hdr.num_inbound_streams == 0 ||
+            peer_init->init_hdr.init_tag == 0 ||
+            ntohl(peer_init->init_hdr.a_rwnd) < SCTP_DEFAULT_MINWINDOW)
                 return sctp_process_inv_mandatory(asoc, chunk, errp);
-        }
 
-        /* Check for missing mandatory parameters.  */
         sctp_walk_params(param, peer_init, init_hdr.params) {
-
-                if (SCTP_PARAM_STATE_COOKIE == param.p->type)
-                        has_cookie = 1;
-
-        } /* for (loop through all parameters) */
+                if (param.p->type == SCTP_PARAM_STATE_COOKIE)
+                        has_cookie = true;
+        }
 
         /* There is a possibility that a parameter length was bad and
          * in that case we would have stoped walking the parameters.
@@ -2516,12 +2543,11 @@ do_addr_param:
                 /* Suggested Cookie Life span increment's unit is msec,
                  * (1/1000sec).
                  */
-                asoc->cookie_life.tv_sec += stale / 1000;
-                asoc->cookie_life.tv_usec += (stale % 1000) * 1000;
+                asoc->cookie_life = ktime_add_ms(asoc->cookie_life, stale);
                 break;
 
         case SCTP_PARAM_HOST_NAME_ADDRESS:
-                SCTP_DEBUG_PRINTK("unimplemented SCTP_HOST_NAME_ADDRESS\n");
+                pr_debug("%s: unimplemented SCTP_HOST_NAME_ADDRESS\n", __func__);
                 break;
 
         case SCTP_PARAM_SUPPORTED_ADDRESS_TYPES:
@@ -2667,8 +2693,8 @@ fall_through:
                  * called prior to this routine.  Simply log the error
                  * here.
                  */
-                SCTP_DEBUG_PRINTK("Ignoring param: %d for association %p.\n",
-                                  ntohs(param.p->type), asoc);
+                pr_debug("%s: ignoring param:%d for association:%p.\n",
+                         __func__, ntohs(param.p->type), asoc);
                 break;
         }
 
@@ -2738,7 +2764,7 @@ static struct sctp_chunk *sctp_make_asconf(struct sctp_association *asoc,
         length += addrlen;
 
         /* Create the chunk.  */
-        retval = sctp_make_chunk(asoc, SCTP_CID_ASCONF, 0, length);
+        retval = sctp_make_control(asoc, SCTP_CID_ASCONF, 0, length);
         if (!retval)
                 return NULL;
 
@@ -2810,7 +2836,10 @@ struct sctp_chunk *sctp_make_asconf_update_ip(struct sctp_association *asoc,
                         totallen += paramlen;
                         totallen += addr_param_len;
                         del_pickup = 1;
-                        SCTP_DEBUG_PRINTK("mkasconf_update_ip: picked same-scope del_pending addr, totallen for all addresses is %d\n", totallen);
+
+                        pr_debug("%s: picked same-scope del_pending addr, "
+                                 "totallen for all addresses is %d\n",
+                                 __func__, totallen);
                 }
         }
 
@@ -2919,7 +2948,7 @@ static struct sctp_chunk *sctp_make_asconf_ack(const struct sctp_association *as
         int                     length = sizeof(asconf) + vparam_len;
 
         /* Create the chunk.  */
-        retval = sctp_make_chunk(asoc, SCTP_CID_ASCONF_ACK, 0, length);
+        retval = sctp_make_control(asoc, SCTP_CID_ASCONF_ACK, 0, length);
         if (!retval)
                 return NULL;
 
@@ -3450,7 +3479,7 @@ struct sctp_chunk *sctp_make_fwdtsn(const struct sctp_association *asoc,
 
         hint = (nstreams + 1) * sizeof(__u32);
 
-        retval = sctp_make_chunk(asoc, SCTP_CID_FWD_TSN, 0, hint);
+        retval = sctp_make_control(asoc, SCTP_CID_FWD_TSN, 0, hint);
 
         if (!retval)
                 return NULL;
diff --git a/net/sctp/sm_sideeffect.c b/net/sctp/sm_sideeffect.c
index 8aab894aeabe..666c66842799 100644
--- a/net/sctp/sm_sideeffect.c
+++ b/net/sctp/sm_sideeffect.c
@@ -28,10 +28,7 @@
  *
  * Please send any bug reports or fixes you make to the
  * email address(es):
- *    lksctp developers <lksctp-developers@lists.sourceforge.net>
- *
- * Or submit a bug report through the following website:
- *    http://www.sf.net/projects/lksctp
+ *    lksctp developers <linux-sctp@vger.kernel.org>
  *
  * Written or modified by:
  *    La Monte H.P. Yarroll <piggy@acm.org>
@@ -42,9 +39,6 @@
  *    Daisy Chang           <daisyc@us.ibm.com>
  *    Sridhar Samudrala     <sri@us.ibm.com>
  *    Ardelle Fan           <ardelle.fan@intel.com>
- *
- * Any bugs reported given to us we will try to fix... any fixes shared will
- * be incorporated into the next SCTP release.
  */
 
 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
@@ -257,7 +251,7 @@ void sctp_generate_t3_rtx_event(unsigned long peer)
 
         sctp_bh_lock_sock(asoc->base.sk);
         if (sock_owned_by_user(asoc->base.sk)) {
-                SCTP_DEBUG_PRINTK("%s:Sock is busy.\n", __func__);
+                pr_debug("%s: sock is busy\n", __func__);
 
                 /* Try again later.  */
                 if (!mod_timer(&transport->T3_rtx_timer, jiffies + (HZ/20)))
@@ -297,9 +291,8 @@ static void sctp_generate_timeout_event(struct sctp_association *asoc,
 
         sctp_bh_lock_sock(asoc->base.sk);
         if (sock_owned_by_user(asoc->base.sk)) {
-                SCTP_DEBUG_PRINTK("%s:Sock is busy: timer %d\n",
-                                  __func__,
-                                  timeout_type);
+                pr_debug("%s: sock is busy: timer %d\n", __func__,
+                         timeout_type);
 
                 /* Try again later.  */
                 if (!mod_timer(&asoc->timers[timeout_type], jiffies + (HZ/20)))
@@ -377,7 +370,7 @@ void sctp_generate_heartbeat_event(unsigned long data)
 
         sctp_bh_lock_sock(asoc->base.sk);
         if (sock_owned_by_user(asoc->base.sk)) {
-                SCTP_DEBUG_PRINTK("%s:Sock is busy.\n", __func__);
+                pr_debug("%s: sock is busy\n", __func__);
 
                 /* Try again later.  */
                 if (!mod_timer(&transport->hb_timer, jiffies + (HZ/20)))
@@ -415,7 +408,7 @@ void sctp_generate_proto_unreach_event(unsigned long data)
         
         sctp_bh_lock_sock(asoc->base.sk);
         if (sock_owned_by_user(asoc->base.sk)) {
-                SCTP_DEBUG_PRINTK("%s:Sock is busy.\n", __func__);
+                pr_debug("%s: sock is busy\n", __func__);
 
                 /* Try again later.  */
                 if (!mod_timer(&transport->proto_unreach_timer,
@@ -521,11 +514,9 @@ static void sctp_do_8_2_transport_strike(sctp_cmd_seq_t *commands,
 
         if (transport->state != SCTP_INACTIVE &&
             (transport->error_count > transport->pathmaxrxt)) {
-                SCTP_DEBUG_PRINTK_IPADDR("transport_strike:association %p",
-                                         " transport IP: port:%d failed.\n",
-                                         asoc,
-                                         (&transport->ipaddr),
-                                         ntohs(transport->ipaddr.v4.sin_port));
+                pr_debug("%s: association:%p transport addr:%pISpc failed\n",
+                         __func__, asoc, &transport->ipaddr.sa);
+
                 sctp_assoc_control_transport(asoc, transport,
                                              SCTP_TRANSPORT_DOWN,
                                              SCTP_FAILED_THRESHOLD);
@@ -733,6 +724,12 @@ static void sctp_cmd_transport_on(sctp_cmd_seq_t *cmds,
                 sctp_assoc_control_transport(asoc, t, SCTP_TRANSPORT_UP,
                                              SCTP_HEARTBEAT_SUCCESS);
 
+        /* HB-ACK was received for a the proper HB.  Consider this
+         * forward progress.
+         */
+        if (t->dst)
+                dst_confirm(t->dst);
+
         /* The receiver of the HEARTBEAT ACK should also perform an
          * RTT measurement for that destination transport address
          * using the time value carried in the HEARTBEAT ACK chunk.
@@ -804,8 +801,7 @@ static void sctp_cmd_new_state(sctp_cmd_seq_t *cmds,
 
         asoc->state = state;
 
-        SCTP_DEBUG_PRINTK("sctp_cmd_new_state: asoc %p[%s]\n",
-                          asoc, sctp_state_tbl[state]);
+        pr_debug("%s: asoc:%p[%s]\n", __func__, asoc, sctp_state_tbl[state]);
 
         if (sctp_style(sk, TCP)) {
                 /* Change the sk->sk_state of a TCP-style socket that has
@@ -864,6 +860,7 @@ static void sctp_cmd_delete_tcb(sctp_cmd_seq_t *cmds,
             (!asoc->temp) && (sk->sk_shutdown != SHUTDOWN_MASK))
                 return;
 
+        BUG_ON(asoc->peer.primary_path == NULL);
         sctp_unhash_established(asoc);
         sctp_association_free(asoc);
 }
@@ -1016,15 +1013,11 @@ static void sctp_cmd_t1_timer_update(struct sctp_association *asoc,
                         asoc->timeouts[timer] = asoc->max_init_timeo;
                 }
                 asoc->init_cycle++;
-                SCTP_DEBUG_PRINTK(
-                        "T1 %s Timeout adjustment"
-                        " init_err_counter: %d"
-                        " cycle: %d"
-                        " timeout: %ld\n",
-                        name,
-                        asoc->init_err_counter,
-                        asoc->init_cycle,
-                        asoc->timeouts[timer]);
+
+                pr_debug("%s: T1[%s] timeout adjustment init_err_counter:%d"
+                         " cycle:%d timeout:%ld\n", __func__, name,
+                         asoc->init_err_counter, asoc->init_cycle,
+                         asoc->timeouts[timer]);
         }
 
 }
@@ -1079,23 +1072,19 @@ static void sctp_cmd_send_asconf(struct sctp_association *asoc)
  * main flow of sctp_do_sm() to keep attention focused on the real
  * functionality there.
  */
-#define DEBUG_PRE \
-        SCTP_DEBUG_PRINTK("sctp_do_sm prefn: " \
-                          "ep %p, %s, %s, asoc %p[%s], %s\n", \
-                          ep, sctp_evttype_tbl[event_type], \
-                          (*debug_fn)(subtype), asoc, \
-                          sctp_state_tbl[state], state_fn->name)
-
-#define DEBUG_POST \
-        SCTP_DEBUG_PRINTK("sctp_do_sm postfn: " \
-                          "asoc %p, status: %s\n", \
-                          asoc, sctp_status_tbl[status])
-
-#define DEBUG_POST_SFX \
-        SCTP_DEBUG_PRINTK("sctp_do_sm post sfx: error %d, asoc %p[%s]\n", \
-                          error, asoc, \
-                          sctp_state_tbl[(asoc && sctp_id2assoc(ep->base.sk, \
-                          sctp_assoc2id(asoc)))?asoc->state:SCTP_STATE_CLOSED])
+#define debug_pre_sfn() \
+        pr_debug("%s[pre-fn]: ep:%p, %s, %s, asoc:%p[%s], %s\n", __func__, \
+                 ep, sctp_evttype_tbl[event_type], (*debug_fn)(subtype),   \
+                 asoc, sctp_state_tbl[state], state_fn->name)
+
+#define debug_post_sfn() \
+        pr_debug("%s[post-fn]: asoc:%p, status:%s\n", __func__, asoc, \
+                 sctp_status_tbl[status])
+
+#define debug_post_sfx() \
+        pr_debug("%s[post-sfx]: error:%d, asoc:%p[%s]\n", __func__, error, \
+                 asoc, sctp_state_tbl[(asoc && sctp_id2assoc(ep->base.sk, \
+                 sctp_assoc2id(asoc))) ? asoc->state : SCTP_STATE_CLOSED])
 
 /*
  * This is the master state machine processing function.
@@ -1115,7 +1104,6 @@ int sctp_do_sm(struct net *net, sctp_event_t event_type, sctp_subtype_t subtype,
         sctp_disposition_t status;
         int error = 0;
         typedef const char *(printfn_t)(sctp_subtype_t);
-
         static printfn_t *table[] = {
                 NULL, sctp_cname, sctp_tname, sctp_oname, sctp_pname,
         };
@@ -1128,21 +1116,18 @@ int sctp_do_sm(struct net *net, sctp_event_t event_type, sctp_subtype_t subtype,
 
         sctp_init_cmd_seq(&commands);
 
-        DEBUG_PRE;
+        debug_pre_sfn();
         status = (*state_fn->fn)(net, ep, asoc, subtype, event_arg, &commands);
-        DEBUG_POST;
+        debug_post_sfn();
 
         error = sctp_side_effects(event_type, subtype, state,
                                   ep, asoc, event_arg, status,
                                   &commands, gfp);
-        DEBUG_POST_SFX;
+        debug_post_sfx();
 
         return error;
 }
 
-#undef DEBUG_PRE
-#undef DEBUG_POST
-
 /*****************************************************************
  * This the master state function side effect processing function.
  *****************************************************************/
@@ -1171,9 +1156,9 @@ static int sctp_side_effects(sctp_event_t event_type, sctp_subtype_t subtype,
 
         switch (status) {
         case SCTP_DISPOSITION_DISCARD:
-                SCTP_DEBUG_PRINTK("Ignored sctp protocol event - state %d, "
-                                  "event_type %d, event_id %d\n",
-                                  state, event_type, subtype.chunk);
+                pr_debug("%s: ignored sctp protocol event - state:%d, "
+                         "event_type:%d, event_id:%d\n", __func__, state,
+                         event_type, subtype.chunk);
                 break;
 
         case SCTP_DISPOSITION_NOMEM:
@@ -1274,8 +1259,10 @@ static int sctp_cmd_interpreter(sctp_event_t event_type,
                                 sctp_outq_uncork(&asoc->outqueue);
                                 local_cork = 0;
                         }
-                        asoc = cmd->obj.asoc;
+
                         /* Register with the endpoint.  */
+                        asoc = cmd->obj.asoc;
+                        BUG_ON(asoc->peer.primary_path == NULL);
                         sctp_endpoint_add_asoc(ep, asoc);
                         sctp_hash_established(asoc);
                         break;
@@ -1422,18 +1409,18 @@ static int sctp_cmd_interpreter(sctp_event_t event_type,
 
                 case SCTP_CMD_CHUNK_ULP:
                         /* Send a chunk to the sockets layer.  */
-                        SCTP_DEBUG_PRINTK("sm_sideff: %s %p, %s %p.\n",
-                                          "chunk_up:", cmd->obj.chunk,
-                                          "ulpq:", &asoc->ulpq);
+                        pr_debug("%s: sm_sideff: chunk_up:%p, ulpq:%p\n",
+                                 __func__, cmd->obj.chunk, &asoc->ulpq);
+
                         sctp_ulpq_tail_data(&asoc->ulpq, cmd->obj.chunk,
                                             GFP_ATOMIC);
                         break;
 
                 case SCTP_CMD_EVENT_ULP:
                         /* Send a notification to the sockets layer.  */
-                        SCTP_DEBUG_PRINTK("sm_sideff: %s %p, %s %p.\n",
-                                          "event_up:",cmd->obj.ulpevent,
-                                          "ulpq:",&asoc->ulpq);
+                        pr_debug("%s: sm_sideff: event_up:%p, ulpq:%p\n",
+                                 __func__, cmd->obj.ulpevent, &asoc->ulpq);
+
                         sctp_ulpq_tail_event(&asoc->ulpq, cmd->obj.ulpevent);
                         break;
 
@@ -1598,7 +1585,7 @@ static int sctp_cmd_interpreter(sctp_event_t event_type,
                         break;
 
                 case SCTP_CMD_REPORT_BAD_TAG:
-                        SCTP_DEBUG_PRINTK("vtag mismatch!\n");
+                        pr_debug("%s: vtag mismatch!\n", __func__);
                         break;
 
                 case SCTP_CMD_STRIKE:
diff --git a/net/sctp/sm_statefuns.c b/net/sctp/sm_statefuns.c
index de1a0138317f..dfe3f36ff2aa 100644
--- a/net/sctp/sm_statefuns.c
+++ b/net/sctp/sm_statefuns.c
@@ -28,10 +28,7 @@
  *
  * Please send any bug reports or fixes you make to the
  * email address(es):
- *    lksctp developers <lksctp-developers@lists.sourceforge.net>
- *
- * Or submit a bug report through the following website:
- *    http://www.sf.net/projects/lksctp
+ *    lksctp developers <linux-sctp@vger.kernel.org>
  *
  * Written or modified by:
  *    La Monte H.P. Yarroll <piggy@acm.org>
@@ -45,9 +42,6 @@
  *    Ardelle Fan           <ardelle.fan@intel.com>
  *    Ryan Layer            <rmlayer@us.ibm.com>
  *    Kevin Gao             <kevin.gao@intel.com>
- *
- * Any bugs reported given to us we will try to fix... any fixes shared will
- * be incorporated into the next SCTP release.
  */
 
 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
@@ -1179,9 +1173,9 @@ sctp_disposition_t sctp_sf_backbeat_8_3(struct net *net,
         /* Check if the timestamp looks valid.  */
         if (time_after(hbinfo->sent_at, jiffies) ||
             time_after(jiffies, hbinfo->sent_at + max_interval)) {
-                SCTP_DEBUG_PRINTK("%s: HEARTBEAT ACK with invalid timestamp "
-                                  "received for transport: %p\n",
-                                   __func__, link);
+                pr_debug("%s: HEARTBEAT ACK with invalid timestamp received "
+                         "for transport:%p\n", __func__, link);
+
                 return SCTP_DISPOSITION_DISCARD;
         }
 
@@ -2562,7 +2556,8 @@ static sctp_disposition_t sctp_stop_t1_and_abort(struct net *net,
                                            const struct sctp_association *asoc,
                                            struct sctp_transport *transport)
 {
-        SCTP_DEBUG_PRINTK("ABORT received (INIT).\n");
+        pr_debug("%s: ABORT received (INIT)\n", __func__);
+
         sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE,
                         SCTP_STATE(SCTP_STATE_CLOSED));
         SCTP_INC_STATS(net, SCTP_MIB_ABORTEDS);
@@ -2572,6 +2567,7 @@ static sctp_disposition_t sctp_stop_t1_and_abort(struct net *net,
         /* CMD_INIT_FAILED will DELETE_TCB. */
         sctp_add_cmd_sf(commands, SCTP_CMD_INIT_FAILED,
                         SCTP_PERR(error));
+
         return SCTP_DISPOSITION_ABORT;
 }
 
@@ -2637,8 +2633,9 @@ sctp_disposition_t sctp_sf_do_9_2_shutdown(struct net *net,
         ctsn = ntohl(sdh->cum_tsn_ack);
 
         if (TSN_lt(ctsn, asoc->ctsn_ack_point)) {
-                SCTP_DEBUG_PRINTK("ctsn %x\n", ctsn);
-                SCTP_DEBUG_PRINTK("ctsn_ack_point %x\n", asoc->ctsn_ack_point);
+                pr_debug("%s: ctsn:%x, ctsn_ack_point:%x\n", __func__, ctsn,
+                         asoc->ctsn_ack_point);
+
                 return SCTP_DISPOSITION_DISCARD;
         }
 
@@ -2721,8 +2718,9 @@ sctp_disposition_t sctp_sf_do_9_2_shut_ctsn(struct net *net,
         ctsn = ntohl(sdh->cum_tsn_ack);
 
         if (TSN_lt(ctsn, asoc->ctsn_ack_point)) {
-                SCTP_DEBUG_PRINTK("ctsn %x\n", ctsn);
-                SCTP_DEBUG_PRINTK("ctsn_ack_point %x\n", asoc->ctsn_ack_point);
+                pr_debug("%s: ctsn:%x, ctsn_ack_point:%x\n", __func__, ctsn,
+                         asoc->ctsn_ack_point);
+
                 return SCTP_DISPOSITION_DISCARD;
         }
 
@@ -3174,8 +3172,9 @@ sctp_disposition_t sctp_sf_eat_sack_6_2(struct net *net,
          *     Point indicates an out-of-order SACK.
          */
         if (TSN_lt(ctsn, asoc->ctsn_ack_point)) {
-                SCTP_DEBUG_PRINTK("ctsn %x\n", ctsn);
-                SCTP_DEBUG_PRINTK("ctsn_ack_point %x\n", asoc->ctsn_ack_point);
+                pr_debug("%s: ctsn:%x, ctsn_ack_point:%x\n", __func__, ctsn,
+                         asoc->ctsn_ack_point);
+
                 return SCTP_DISPOSITION_DISCARD;
         }
 
@@ -3859,7 +3858,7 @@ sctp_disposition_t sctp_sf_eat_fwd_tsn(struct net *net,
         skb_pull(chunk->skb, len);
 
         tsn = ntohl(fwdtsn_hdr->new_cum_tsn);
-        SCTP_DEBUG_PRINTK("%s: TSN 0x%x.\n", __func__, tsn);
+        pr_debug("%s: TSN 0x%x\n", __func__, tsn);
 
         /* The TSN is too high--silently discard the chunk and count on it
          * getting retransmitted later.
@@ -3927,7 +3926,7 @@ sctp_disposition_t sctp_sf_eat_fwd_tsn_fast(
         skb_pull(chunk->skb, len);
 
         tsn = ntohl(fwdtsn_hdr->new_cum_tsn);
-        SCTP_DEBUG_PRINTK("%s: TSN 0x%x.\n", __func__, tsn);
+        pr_debug("%s: TSN 0x%x\n", __func__, tsn);
 
         /* The TSN is too high--silently discard the chunk and count on it
          * getting retransmitted later.
@@ -4166,7 +4165,7 @@ sctp_disposition_t sctp_sf_unk_chunk(struct net *net,
         struct sctp_chunk *err_chunk;
         sctp_chunkhdr_t *hdr;
 
-        SCTP_DEBUG_PRINTK("Processing the unknown chunk id %d.\n", type.chunk);
+        pr_debug("%s: processing unknown chunk id:%d\n", __func__, type.chunk);
 
         if (!sctp_vtag_verify(unk_chunk, asoc))
                 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
@@ -4256,7 +4255,8 @@ sctp_disposition_t sctp_sf_discard_chunk(struct net *net,
                 return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
                                                   commands);
 
-        SCTP_DEBUG_PRINTK("Chunk %d is discarded\n", type.chunk);
+        pr_debug("%s: chunk:%d is discarded\n", __func__, type.chunk);
+
         return SCTP_DISPOSITION_DISCARD;
 }
 
@@ -4632,16 +4632,16 @@ sctp_disposition_t sctp_sf_do_prm_asoc(struct net *net,
         if (!repl)
                 goto nomem;
 
+        /* Choose transport for INIT. */
+        sctp_add_cmd_sf(commands, SCTP_CMD_INIT_CHOOSE_TRANSPORT,
+                        SCTP_CHUNK(repl));
+
         /* Cast away the const modifier, as we want to just
          * rerun it through as a sideffect.
          */
         my_asoc = (struct sctp_association *)asoc;
         sctp_add_cmd_sf(commands, SCTP_CMD_NEW_ASOC, SCTP_ASOC(my_asoc));
 
-        /* Choose transport for INIT. */
-        sctp_add_cmd_sf(commands, SCTP_CMD_INIT_CHOOSE_TRANSPORT,
-                        SCTP_CHUNK(repl));
-
         /* After sending the INIT, "A" starts the T1-init timer and
          * enters the COOKIE-WAIT state.
          */
@@ -5184,7 +5184,9 @@ sctp_disposition_t sctp_sf_ignore_primitive(
         void *arg,
         sctp_cmd_seq_t *commands)
 {
-        SCTP_DEBUG_PRINTK("Primitive type %d is ignored.\n", type.primitive);
+        pr_debug("%s: primitive type:%d is ignored\n", __func__,
+                 type.primitive);
+
         return SCTP_DISPOSITION_DISCARD;
 }
 
@@ -5379,7 +5381,9 @@ sctp_disposition_t sctp_sf_ignore_other(struct net *net,
                                         void *arg,
                                         sctp_cmd_seq_t *commands)
 {
-        SCTP_DEBUG_PRINTK("The event other type %d is ignored\n", type.other);
+        pr_debug("%s: the event other type:%d is ignored\n",
+                 __func__, type.other);
+
         return SCTP_DISPOSITION_DISCARD;
 }
 
@@ -5527,7 +5531,8 @@ sctp_disposition_t sctp_sf_t1_init_timer_expire(struct net *net,
         struct sctp_bind_addr *bp;
         int attempts = asoc->init_err_counter + 1;
 
-        SCTP_DEBUG_PRINTK("Timer T1 expired (INIT).\n");
+        pr_debug("%s: timer T1 expired (INIT)\n", __func__);
+
         SCTP_INC_STATS(net, SCTP_MIB_T1_INIT_EXPIREDS);
 
         if (attempts <= asoc->max_init_attempts) {
@@ -5546,9 +5551,10 @@ sctp_disposition_t sctp_sf_t1_init_timer_expire(struct net *net,
 
                 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(repl));
         } else {
-                SCTP_DEBUG_PRINTK("Giving up on INIT, attempts: %d"
-                                  " max_init_attempts: %d\n",
-                                  attempts, asoc->max_init_attempts);
+                pr_debug("%s: giving up on INIT, attempts:%d "
+                         "max_init_attempts:%d\n", __func__, attempts,
+                         asoc->max_init_attempts);
+
                 sctp_add_cmd_sf(commands, SCTP_CMD_SET_SK_ERR,
                                 SCTP_ERROR(ETIMEDOUT));
                 sctp_add_cmd_sf(commands, SCTP_CMD_INIT_FAILED,
@@ -5588,7 +5594,8 @@ sctp_disposition_t sctp_sf_t1_cookie_timer_expire(struct net *net,
         struct sctp_chunk *repl = NULL;
         int attempts = asoc->init_err_counter + 1;
 
-        SCTP_DEBUG_PRINTK("Timer T1 expired (COOKIE-ECHO).\n");
+        pr_debug("%s: timer T1 expired (COOKIE-ECHO)\n", __func__);
+
         SCTP_INC_STATS(net, SCTP_MIB_T1_COOKIE_EXPIREDS);
 
         if (attempts <= asoc->max_init_attempts) {
@@ -5636,7 +5643,8 @@ sctp_disposition_t sctp_sf_t2_timer_expire(struct net *net,
 {
         struct sctp_chunk *reply = NULL;
 
-        SCTP_DEBUG_PRINTK("Timer T2 expired.\n");
+        pr_debug("%s: timer T2 expired\n", __func__);
+
         SCTP_INC_STATS(net, SCTP_MIB_T2_SHUTDOWN_EXPIREDS);
 
         ((struct sctp_association *)asoc)->shutdown_retries++;
@@ -5777,7 +5785,8 @@ sctp_disposition_t sctp_sf_t5_timer_expire(struct net *net,
 {
         struct sctp_chunk *reply = NULL;
 
-        SCTP_DEBUG_PRINTK("Timer T5 expired.\n");
+        pr_debug("%s: timer T5 expired\n", __func__);
+
         SCTP_INC_STATS(net, SCTP_MIB_T5_SHUTDOWN_GUARD_EXPIREDS);
 
         reply = sctp_make_abort(asoc, NULL, 0);
@@ -5892,7 +5901,8 @@ sctp_disposition_t sctp_sf_timer_ignore(struct net *net,
                                         void *arg,
                                         sctp_cmd_seq_t *commands)
 {
-        SCTP_DEBUG_PRINTK("Timer %d ignored.\n", type.chunk);
+        pr_debug("%s: timer %d ignored\n", __func__, type.chunk);
+
         return SCTP_DISPOSITION_CONSUME;
 }
 
@@ -6102,7 +6112,7 @@ static int sctp_eat_data(const struct sctp_association *asoc,
         skb_pull(chunk->skb, sizeof(sctp_datahdr_t));
 
         tsn = ntohl(data_hdr->tsn);
-        SCTP_DEBUG_PRINTK("eat_data: TSN 0x%x.\n", tsn);
+        pr_debug("%s: TSN 0x%x\n", __func__, tsn);
 
         /* ASSERT:  Now skb->data is really the user data.  */
 
@@ -6179,12 +6189,12 @@ static int sctp_eat_data(const struct sctp_association *asoc,
                  */
                 if (sctp_tsnmap_has_gap(map) &&
                     (sctp_tsnmap_get_ctsn(map) + 1) == tsn) {
-                        SCTP_DEBUG_PRINTK("Reneging for tsn:%u\n", tsn);
+                        pr_debug("%s: reneging for tsn:%u\n", __func__, tsn);
                         deliver = SCTP_CMD_RENEGE;
                 } else {
-                        SCTP_DEBUG_PRINTK("Discard tsn: %u len: %Zd, "
-                                          "rwnd: %d\n", tsn, datalen,
-                                          asoc->rwnd);
+                        pr_debug("%s: discard tsn:%u len:%zu, rwnd:%d\n",
+                                 __func__, tsn, datalen, asoc->rwnd);
+
                         return SCTP_IERROR_IGNORE_TSN;
                 }
         }
@@ -6199,7 +6209,8 @@ static int sctp_eat_data(const struct sctp_association *asoc,
         if (*sk->sk_prot_creator->memory_pressure) {
                 if (sctp_tsnmap_has_gap(map) &&
                    (sctp_tsnmap_get_ctsn(map) + 1) == tsn) {
-                        SCTP_DEBUG_PRINTK("Under Pressure! Reneging for tsn:%u\n", tsn);
+                        pr_debug("%s: under pressure, reneging for tsn:%u\n",
+                                 __func__, tsn);
                         deliver = SCTP_CMD_RENEGE;
                  }
         }
diff --git a/net/sctp/sm_statetable.c b/net/sctp/sm_statetable.c
index 84d98d8a5a74..c5999b2dde7d 100644
--- a/net/sctp/sm_statetable.c
+++ b/net/sctp/sm_statetable.c
@@ -28,10 +28,7 @@
  *
  * Please send any bug reports or fixes you make to the
  * email address(es):
- *    lksctp developers <lksctp-developers@lists.sourceforge.net>
- *
- * Or submit a bug report through the following website:
- *    http://www.sf.net/projects/lksctp
+ *    lksctp developers <linux-sctp@vger.kernel.org>
  *
  * Written or modified by:
  *    La Monte H.P. Yarroll <piggy@acm.org>
@@ -41,9 +38,6 @@
  *    Daisy Chang           <daisyc@us.ibm.com>
  *    Ardelle Fan           <ardelle.fan@intel.com>
  *    Sridhar Samudrala     <sri@us.ibm.com>
- *
- * Any bugs reported given to us we will try to fix... any fixes shared will
- * be incorporated into the next SCTP release.
  */
 
 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
diff --git a/net/sctp/socket.c b/net/sctp/socket.c
index f631c5ff4dbf..911b71b26b0e 100644
--- a/net/sctp/socket.c
+++ b/net/sctp/socket.c
@@ -34,10 +34,7 @@
  *
  * Please send any bug reports or fixes you make to the
  * email address(es):
- *    lksctp developers <lksctp-developers@lists.sourceforge.net>
- *
- * Or submit a bug report through the following website:
- *    http://www.sf.net/projects/lksctp
+ *    lksctp developers <linux-sctp@vger.kernel.org>
  *
  * Written or modified by:
  *    La Monte H.P. Yarroll <piggy@acm.org>
@@ -52,9 +49,6 @@
  *    Ryan Layer            <rmlayer@us.ibm.com>
  *    Anup Pemmaiah         <pemmaiah@cc.usu.edu>
  *    Kevin Gao             <kevin.gao@intel.com>
- *
- * Any bugs reported given to us we will try to fix... any fixes shared will
- * be incorporated into the next SCTP release.
  */
 
 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
@@ -84,11 +78,6 @@
 #include <net/sctp/sctp.h>
 #include <net/sctp/sm.h>
 
-/* WARNING:  Please do not remove the SCTP_STATIC attribute to
- * any of the functions below as they are used to export functions
- * used by a project regression testsuite.
- */
-
 /* Forward declarations for internal helper functions. */
 static int sctp_writeable(struct sock *sk);
 static void sctp_wfree(struct sk_buff *skb);
@@ -98,6 +87,7 @@ static int sctp_wait_for_packet(struct sock * sk, int *err, long *timeo_p);
 static int sctp_wait_for_connect(struct sctp_association *, long *timeo_p);
 static int sctp_wait_for_accept(struct sock *sk, long timeo);
 static void sctp_wait_for_close(struct sock *sk, long timeo);
+static void sctp_destruct_sock(struct sock *sk);
 static struct sctp_af *sctp_sockaddr_af(struct sctp_sock *opt,
                                         union sctp_addr *addr, int len);
 static int sctp_bindx_add(struct sock *, struct sockaddr *, int);
@@ -279,14 +269,14 @@ static struct sctp_transport *sctp_addr_id2transport(struct sock *sk,
  *             sockaddr_in6 [RFC 2553]),
  *   addr_len - the size of the address structure.
  */
-SCTP_STATIC int sctp_bind(struct sock *sk, struct sockaddr *addr, int addr_len)
+static int sctp_bind(struct sock *sk, struct sockaddr *addr, int addr_len)
 {
         int retval = 0;
 
         sctp_lock_sock(sk);
 
-        SCTP_DEBUG_PRINTK("sctp_bind(sk: %p, addr: %p, addr_len: %d)\n",
-                          sk, addr, addr_len);
+        pr_debug("%s: sk:%p, addr:%p, addr_len:%d\n", __func__, sk,
+                 addr, addr_len);
 
         /* Disallow binding twice. */
         if (!sctp_sk(sk)->ep->base.bind_addr.port)
@@ -333,7 +323,7 @@ static struct sctp_af *sctp_sockaddr_af(struct sctp_sock *opt,
 }
 
 /* Bind a local address either to an endpoint or to an association.  */
-SCTP_STATIC int sctp_do_bind(struct sock *sk, union sctp_addr *addr, int len)
+static int sctp_do_bind(struct sock *sk, union sctp_addr *addr, int len)
 {
         struct net *net = sock_net(sk);
         struct sctp_sock *sp = sctp_sk(sk);
@@ -346,19 +336,15 @@ SCTP_STATIC int sctp_do_bind(struct sock *sk, union sctp_addr *addr, int len)
         /* Common sockaddr verification. */
         af = sctp_sockaddr_af(sp, addr, len);
         if (!af) {
-                SCTP_DEBUG_PRINTK("sctp_do_bind(sk: %p, newaddr: %p, len: %d) EINVAL\n",
-                                  sk, addr, len);
+                pr_debug("%s: sk:%p, newaddr:%p, len:%d EINVAL\n",
+                         __func__, sk, addr, len);
                 return -EINVAL;
         }
 
         snum = ntohs(addr->v4.sin_port);
 
-        SCTP_DEBUG_PRINTK_IPADDR("sctp_do_bind(sk: %p, new addr: ",
-                                 ", port: %d, new port: %d, len: %d)\n",
-                                 sk,
-                                 addr,
-                                 bp->port, snum,
-                                 len);
+        pr_debug("%s: sk:%p, new addr:%pISc, port:%d, new port:%d, len:%d\n",
+                 __func__, sk, &addr->sa, bp->port, snum, len);
 
         /* PF specific bind() address verification. */
         if (!sp->pf->bind_verify(sp, addr))
@@ -372,9 +358,8 @@ SCTP_STATIC int sctp_do_bind(struct sock *sk, union sctp_addr *addr, int len)
                 if (!snum)
                         snum = bp->port;
                 else if (snum != bp->port) {
-                        SCTP_DEBUG_PRINTK("sctp_do_bind:"
-                                  " New port %d does not match existing port "
-                                  "%d.\n", snum, bp->port);
+                        pr_debug("%s: new port %d doesn't match existing port "
+                                 "%d\n", __func__, snum, bp->port);
                         return -EINVAL;
                 }
         }
@@ -472,8 +457,8 @@ static int sctp_bindx_add(struct sock *sk, struct sockaddr *addrs, int addrcnt)
         struct sockaddr *sa_addr;
         struct sctp_af *af;
 
-        SCTP_DEBUG_PRINTK("sctp_bindx_add (sk: %p, addrs: %p, addrcnt: %d)\n",
-                          sk, addrs, addrcnt);
+        pr_debug("%s: sk:%p, addrs:%p, addrcnt:%d\n", __func__, sk,
+                 addrs, addrcnt);
 
         addr_buf = addrs;
         for (cnt = 0; cnt < addrcnt; cnt++) {
@@ -539,11 +524,10 @@ static int sctp_send_asconf_add_ip(struct sock		*sk,
         sp = sctp_sk(sk);
         ep = sp->ep;
 
-        SCTP_DEBUG_PRINTK("%s: (sk: %p, addrs: %p, addrcnt: %d)\n",
-                          __func__, sk, addrs, addrcnt);
+        pr_debug("%s: sk:%p, addrs:%p, addrcnt:%d\n",
+                 __func__, sk, addrs, addrcnt);
 
         list_for_each_entry(asoc, &ep->asocs, asocs) {
-
                 if (!asoc->peer.asconf_capable)
                         continue;
 
@@ -650,8 +634,8 @@ static int sctp_bindx_rem(struct sock *sk, struct sockaddr *addrs, int addrcnt)
         union sctp_addr *sa_addr;
         struct sctp_af *af;
 
-        SCTP_DEBUG_PRINTK("sctp_bindx_rem (sk: %p, addrs: %p, addrcnt: %d)\n",
-                          sk, addrs, addrcnt);
+        pr_debug("%s: sk:%p, addrs:%p, addrcnt:%d\n",
+                 __func__, sk, addrs, addrcnt);
 
         addr_buf = addrs;
         for (cnt = 0; cnt < addrcnt; cnt++) {
@@ -744,8 +728,8 @@ static int sctp_send_asconf_del_ip(struct sock		*sk,
         sp = sctp_sk(sk);
         ep = sp->ep;
 
-        SCTP_DEBUG_PRINTK("%s: (sk: %p, addrs: %p, addrcnt: %d)\n",
-                          __func__, sk, addrs, addrcnt);
+        pr_debug("%s: sk:%p, addrs:%p, addrcnt:%d\n",
+                 __func__, sk, addrs, addrcnt);
 
         list_for_each_entry(asoc, &ep->asocs, asocs) {
 
@@ -812,14 +796,19 @@ static int sctp_send_asconf_del_ip(struct sock		*sk,
                                 sin6 = (struct sockaddr_in6 *)addrs;
                                 asoc->asconf_addr_del_pending->v6.sin6_addr = sin6->sin6_addr;
                         }
-                        SCTP_DEBUG_PRINTK_IPADDR("send_asconf_del_ip: keep the last address asoc: %p ",
-                            " at %p\n", asoc, asoc->asconf_addr_del_pending,
-                            asoc->asconf_addr_del_pending);
+
+                        pr_debug("%s: keep the last address asoc:%p %pISc at %p\n",
+                                 __func__, asoc, &asoc->asconf_addr_del_pending->sa,
+                                 asoc->asconf_addr_del_pending);
+
                         asoc->src_out_of_asoc_ok = 1;
                         stored = 1;
                         goto skip_mkasconf;
                 }
 
+                if (laddr == NULL)
+                        return -EINVAL;
+
                 /* We do not need RCU protection throughout this loop
                  * because this is done under a socket lock from the
                  * setsockopt call.
@@ -964,9 +953,9 @@ int sctp_asconf_mgmt(struct sctp_sock *sp, struct sctp_sockaddr_entry *addrw)
  *
  * Returns 0 if ok, <0 errno code on error.
  */
-SCTP_STATIC int sctp_setsockopt_bindx(struct sock* sk,
-                                      struct sockaddr __user *addrs,
-                                      int addrs_size, int op)
+static int sctp_setsockopt_bindx(struct sock* sk,
+                                 struct sockaddr __user *addrs,
+                                 int addrs_size, int op)
 {
         struct sockaddr *kaddrs;
         int err;
@@ -976,8 +965,8 @@ SCTP_STATIC int sctp_setsockopt_bindx(struct sock* sk,
         void *addr_buf;
         struct sctp_af *af;
 
-        SCTP_DEBUG_PRINTK("sctp_setsockopt_bindx: sk %p addrs %p"
-                          " addrs_size %d opt %d\n", sk, addrs, addrs_size, op);
+        pr_debug("%s: sk:%p addrs:%p addrs_size:%d opt:%d\n",
+                 __func__, sk, addrs, addrs_size, op);
 
         if (unlikely(addrs_size <= 0))
                 return -EINVAL;
@@ -1235,10 +1224,9 @@ static int __sctp_connect(struct sock* sk,
         asoc = NULL;
 
 out_free:
+        pr_debug("%s: took out_free path with asoc:%p kaddrs:%p err:%d\n",
+                 __func__, asoc, kaddrs, err);
 
-        SCTP_DEBUG_PRINTK("About to exit __sctp_connect() free asoc: %p"
-                          " kaddrs: %p err: %d\n",
-                          asoc, kaddrs, err);
         if (asoc) {
                 /* sctp_primitive_ASSOCIATE may have added this association
                  * To the hash table, try to unhash it, just in case, its a noop
@@ -1312,7 +1300,7 @@ out_free:
  *
  * Returns >=0 if ok, <0 errno code on error.
  */
-SCTP_STATIC int __sctp_setsockopt_connectx(struct sock* sk,
+static int __sctp_setsockopt_connectx(struct sock* sk,
                                       struct sockaddr __user *addrs,
                                       int addrs_size,
                                       sctp_assoc_t *assoc_id)
@@ -1320,8 +1308,8 @@ SCTP_STATIC int __sctp_setsockopt_connectx(struct sock* sk,
         int err = 0;
         struct sockaddr *kaddrs;
 
-        SCTP_DEBUG_PRINTK("%s - sk %p addrs %p addrs_size %d\n",
-                          __func__, sk, addrs, addrs_size);
+        pr_debug("%s: sk:%p addrs:%p addrs_size:%d\n",
+                 __func__, sk, addrs, addrs_size);
 
         if (unlikely(addrs_size <= 0))
                 return -EINVAL;
@@ -1350,9 +1338,9 @@ SCTP_STATIC int __sctp_setsockopt_connectx(struct sock* sk,
  * This is an older interface.  It's kept for backward compatibility
  * to the option that doesn't provide association id.
  */
-SCTP_STATIC int sctp_setsockopt_connectx_old(struct sock* sk,
-                                      struct sockaddr __user *addrs,
-                                      int addrs_size)
+static int sctp_setsockopt_connectx_old(struct sock* sk,
+                                        struct sockaddr __user *addrs,
+                                        int addrs_size)
 {
         return __sctp_setsockopt_connectx(sk, addrs, addrs_size, NULL);
 }
@@ -1363,9 +1351,9 @@ SCTP_STATIC int sctp_setsockopt_connectx_old(struct sock* sk,
  * indication to the call.  Error is always negative and association id is
  * always positive.
  */
-SCTP_STATIC int sctp_setsockopt_connectx(struct sock* sk,
-                                      struct sockaddr __user *addrs,
-                                      int addrs_size)
+static int sctp_setsockopt_connectx(struct sock* sk,
+                                    struct sockaddr __user *addrs,
+                                    int addrs_size)
 {
         sctp_assoc_t assoc_id = 0;
         int err = 0;
@@ -1386,9 +1374,9 @@ SCTP_STATIC int sctp_setsockopt_connectx(struct sock* sk,
  * addrs_num structure member.  That way we can re-use the existing
  * code.
  */
-SCTP_STATIC int sctp_getsockopt_connectx3(struct sock* sk, int len,
-                                        char __user *optval,
-                                        int __user *optlen)
+static int sctp_getsockopt_connectx3(struct sock* sk, int len,
+                                     char __user *optval,
+                                     int __user *optlen)
 {
         struct sctp_getaddrs_old param;
         sctp_assoc_t assoc_id = 0;
@@ -1464,7 +1452,7 @@ SCTP_STATIC int sctp_getsockopt_connectx3(struct sock* sk, int len,
  * shutdown phase does not finish during this period, close() will
  * return but the graceful shutdown phase continues in the system.
  */
-SCTP_STATIC void sctp_close(struct sock *sk, long timeout)
+static void sctp_close(struct sock *sk, long timeout)
 {
         struct net *net = sock_net(sk);
         struct sctp_endpoint *ep;
@@ -1472,7 +1460,7 @@ SCTP_STATIC void sctp_close(struct sock *sk, long timeout)
         struct list_head *pos, *temp;
         unsigned int data_was_unread;
 
-        SCTP_DEBUG_PRINTK("sctp_close(sk: 0x%p, timeout:%ld)\n", sk, timeout);
+        pr_debug("%s: sk:%p, timeout:%ld\n", __func__, sk, timeout);
 
         sctp_lock_sock(sk);
         sk->sk_shutdown = SHUTDOWN_MASK;
@@ -1573,10 +1561,10 @@ static int sctp_error(struct sock *sk, int flags, int err)
  */
 /* BUG:  We do not implement the equivalent of sk_stream_wait_memory(). */
 
-SCTP_STATIC int sctp_msghdr_parse(const struct msghdr *, sctp_cmsgs_t *);
+static int sctp_msghdr_parse(const struct msghdr *, sctp_cmsgs_t *);
 
-SCTP_STATIC int sctp_sendmsg(struct kiocb *iocb, struct sock *sk,
-                             struct msghdr *msg, size_t msg_len)
+static int sctp_sendmsg(struct kiocb *iocb, struct sock *sk,
+                        struct msghdr *msg, size_t msg_len)
 {
         struct net *net = sock_net(sk);
         struct sctp_sock *sp;
@@ -1598,14 +1586,12 @@ SCTP_STATIC int sctp_sendmsg(struct kiocb *iocb, struct sock *sk,
         struct sctp_datamsg *datamsg;
         int msg_flags = msg->msg_flags;
 
-        SCTP_DEBUG_PRINTK("sctp_sendmsg(sk: %p, msg: %p, msg_len: %zu)\n",
-                          sk, msg, msg_len);
-
         err = 0;
         sp = sctp_sk(sk);
         ep = sp->ep;
 
-        SCTP_DEBUG_PRINTK("Using endpoint: %p.\n", ep);
+        pr_debug("%s: sk:%p, msg:%p, msg_len:%zu ep:%p\n", __func__, sk,
+                 msg, msg_len, ep);
 
         /* We cannot send a message over a TCP-style listening socket. */
         if (sctp_style(sk, TCP) && sctp_sstate(sk, LISTENING)) {
@@ -1615,9 +1601,8 @@ SCTP_STATIC int sctp_sendmsg(struct kiocb *iocb, struct sock *sk,
 
         /* Parse out the SCTP CMSGs.  */
         err = sctp_msghdr_parse(msg, &cmsgs);
-
         if (err) {
-                SCTP_DEBUG_PRINTK("msghdr parse err = %x\n", err);
+                pr_debug("%s: msghdr parse err:%x\n", __func__, err);
                 goto out_nounlock;
         }
 
@@ -1649,8 +1634,8 @@ SCTP_STATIC int sctp_sendmsg(struct kiocb *iocb, struct sock *sk,
                 associd = sinfo->sinfo_assoc_id;
         }
 
-        SCTP_DEBUG_PRINTK("msg_len: %zu, sinfo_flags: 0x%x\n",
-                          msg_len, sinfo_flags);
+        pr_debug("%s: msg_len:%zu, sinfo_flags:0x%x\n", __func__,
+                 msg_len, sinfo_flags);
 
         /* SCTP_EOF or SCTP_ABORT cannot be set on a TCP-style socket. */
         if (sctp_style(sk, TCP) && (sinfo_flags & (SCTP_EOF | SCTP_ABORT))) {
@@ -1679,7 +1664,7 @@ SCTP_STATIC int sctp_sendmsg(struct kiocb *iocb, struct sock *sk,
 
         transport = NULL;
 
-        SCTP_DEBUG_PRINTK("About to look up association.\n");
+        pr_debug("%s: about to look up association\n", __func__);
 
         sctp_lock_sock(sk);
 
@@ -1709,7 +1694,7 @@ SCTP_STATIC int sctp_sendmsg(struct kiocb *iocb, struct sock *sk,
         }
 
         if (asoc) {
-                SCTP_DEBUG_PRINTK("Just looked up association: %p.\n", asoc);
+                pr_debug("%s: just looked up association:%p\n", __func__, asoc);
 
                 /* We cannot send a message on a TCP-style SCTP_SS_ESTABLISHED
                  * socket that has an association in CLOSED state. This can
@@ -1722,8 +1707,9 @@ SCTP_STATIC int sctp_sendmsg(struct kiocb *iocb, struct sock *sk,
                 }
 
                 if (sinfo_flags & SCTP_EOF) {
-                        SCTP_DEBUG_PRINTK("Shutting down association: %p\n",
-                                          asoc);
+                        pr_debug("%s: shutting down association:%p\n",
+                                 __func__, asoc);
+
                         sctp_primitive_SHUTDOWN(net, asoc, NULL);
                         err = 0;
                         goto out_unlock;
@@ -1736,7 +1722,9 @@ SCTP_STATIC int sctp_sendmsg(struct kiocb *iocb, struct sock *sk,
                                 goto out_unlock;
                         }
 
-                        SCTP_DEBUG_PRINTK("Aborting association: %p\n", asoc);
+                        pr_debug("%s: aborting association:%p\n",
+                                 __func__, asoc);
+
                         sctp_primitive_ABORT(net, asoc, chunk);
                         err = 0;
                         goto out_unlock;
@@ -1745,7 +1733,7 @@ SCTP_STATIC int sctp_sendmsg(struct kiocb *iocb, struct sock *sk,
 
         /* Do we need to create the association?  */
         if (!asoc) {
-                SCTP_DEBUG_PRINTK("There is no association yet.\n");
+                pr_debug("%s: there is no association yet\n", __func__);
 
                 if (sinfo_flags & (SCTP_EOF | SCTP_ABORT)) {
                         err = -EINVAL;
@@ -1844,7 +1832,7 @@ SCTP_STATIC int sctp_sendmsg(struct kiocb *iocb, struct sock *sk,
         }
 
         /* ASSERT: we have a valid association at this point.  */
-        SCTP_DEBUG_PRINTK("We have a valid association.\n");
+        pr_debug("%s: we have a valid association\n", __func__);
 
         if (!sinfo) {
                 /* If the user didn't specify SNDRCVINFO, make up one with
@@ -1913,7 +1901,8 @@ SCTP_STATIC int sctp_sendmsg(struct kiocb *iocb, struct sock *sk,
                 err = sctp_primitive_ASSOCIATE(net, asoc, NULL);
                 if (err < 0)
                         goto out_free;
-                SCTP_DEBUG_PRINTK("We associated primitively.\n");
+
+                pr_debug("%s: we associated primitively\n", __func__);
         }
 
         /* Break the message into multiple chunks of maximum size. */
@@ -1940,17 +1929,15 @@ SCTP_STATIC int sctp_sendmsg(struct kiocb *iocb, struct sock *sk,
          */
         err = sctp_primitive_SEND(net, asoc, datamsg);
         /* Did the lower layer accept the chunk? */
-        if (err)
+        if (err) {
                 sctp_datamsg_free(datamsg);
-        else
-                sctp_datamsg_put(datamsg);
+                goto out_free;
+        }
 
-        SCTP_DEBUG_PRINTK("We sent primitively.\n");
+        pr_debug("%s: we sent primitively\n", __func__);
 
-        if (err)
-                goto out_free;
-        else
-                err = msg_len;
+        sctp_datamsg_put(datamsg);
+        err = msg_len;
 
         /* If we are already past ASSOCIATE, the lower
          * layers are responsible for association cleanup.
@@ -2034,9 +2021,9 @@ static int sctp_skb_pull(struct sk_buff *skb, int len)
  */
 static struct sk_buff *sctp_skb_recv_datagram(struct sock *, int, int, int *);
 
-SCTP_STATIC int sctp_recvmsg(struct kiocb *iocb, struct sock *sk,
-                             struct msghdr *msg, size_t len, int noblock,
-                             int flags, int *addr_len)
+static int sctp_recvmsg(struct kiocb *iocb, struct sock *sk,
+                        struct msghdr *msg, size_t len, int noblock,
+                        int flags, int *addr_len)
 {
         struct sctp_ulpevent *event = NULL;
         struct sctp_sock *sp = sctp_sk(sk);
@@ -2045,10 +2032,9 @@ SCTP_STATIC int sctp_recvmsg(struct kiocb *iocb, struct sock *sk,
         int err = 0;
         int skb_len;
 
-        SCTP_DEBUG_PRINTK("sctp_recvmsg(%s: %p, %s: %p, %s: %zd, %s: %d, %s: "
-                          "0x%x, %s: %p)\n", "sk", sk, "msghdr", msg,
-                          "len", len, "knoblauch", noblock,
-                          "flags", flags, "addr_len", addr_len);
+        pr_debug("%s: sk:%p, msghdr:%p, len:%zd, noblock:%d, flags:0x%x, "
+                 "addr_len:%p)\n", __func__, sk, msg, len, noblock, flags,
+                 addr_len);
 
         sctp_lock_sock(sk);
 
@@ -2915,13 +2901,8 @@ static int sctp_setsockopt_associnfo(struct sock *sk, char __user *optval, unsig
                         asoc->max_retrans = assocparams.sasoc_asocmaxrxt;
                 }
 
-                if (assocparams.sasoc_cookie_life != 0) {
-                        asoc->cookie_life.tv_sec =
-                                        assocparams.sasoc_cookie_life / 1000;
-                        asoc->cookie_life.tv_usec =
-                                        (assocparams.sasoc_cookie_life % 1000)
-                                        * 1000;
-                }
+                if (assocparams.sasoc_cookie_life != 0)
+                        asoc->cookie_life = ms_to_ktime(assocparams.sasoc_cookie_life);
         } else {
                 /* Set the values to the endpoint */
                 struct sctp_sock *sp = sctp_sk(sk);
@@ -3095,7 +3076,7 @@ static int sctp_setsockopt_peer_primary_addr(struct sock *sk, char __user *optva
 
         err = sctp_send_asconf(asoc, chunk);
 
-        SCTP_DEBUG_PRINTK("We set peer primary addr primitively.\n");
+        pr_debug("%s: we set peer primary addr primitively\n", __func__);
 
         return err;
 }
@@ -3565,13 +3546,12 @@ static int sctp_setsockopt_paddr_thresholds(struct sock *sk,
  *   optval  - the buffer to store the value of the option.
  *   optlen  - the size of the buffer.
  */
-SCTP_STATIC int sctp_setsockopt(struct sock *sk, int level, int optname,
-                                char __user *optval, unsigned int optlen)
+static int sctp_setsockopt(struct sock *sk, int level, int optname,
+                           char __user *optval, unsigned int optlen)
 {
         int retval = 0;
 
-        SCTP_DEBUG_PRINTK("sctp_setsockopt(sk: %p... optname: %d)\n",
-                          sk, optname);
+        pr_debug("%s: sk:%p, optname:%d\n", __func__, sk, optname);
 
         /* I can hardly begin to describe how wrong this is.  This is
          * so broken as to be worse than useless.  The API draft
@@ -3725,16 +3705,16 @@ out_nounlock:
  *
  * len: the size of the address.
  */
-SCTP_STATIC int sctp_connect(struct sock *sk, struct sockaddr *addr,
-                             int addr_len)
+static int sctp_connect(struct sock *sk, struct sockaddr *addr,
+                        int addr_len)
 {
         int err = 0;
         struct sctp_af *af;
 
         sctp_lock_sock(sk);
 
-        SCTP_DEBUG_PRINTK("%s - sk: %p, sockaddr: %p, addr_len: %d\n",
-                          __func__, sk, addr, addr_len);
+        pr_debug("%s: sk:%p, sockaddr:%p, addr_len:%d\n", __func__, sk,
+                 addr, addr_len);
 
         /* Validate addr_len before calling common connect/connectx routine. */
         af = sctp_get_af_specific(addr->sa_family);
@@ -3752,7 +3732,7 @@ SCTP_STATIC int sctp_connect(struct sock *sk, struct sockaddr *addr,
 }
 
 /* FIXME: Write comments. */
-SCTP_STATIC int sctp_disconnect(struct sock *sk, int flags)
+static int sctp_disconnect(struct sock *sk, int flags)
 {
         return -EOPNOTSUPP; /* STUB */
 }
@@ -3764,7 +3744,7 @@ SCTP_STATIC int sctp_disconnect(struct sock *sk, int flags)
  * descriptor will be returned from accept() to represent the newly
  * formed association.
  */
-SCTP_STATIC struct sock *sctp_accept(struct sock *sk, int flags, int *err)
+static struct sock *sctp_accept(struct sock *sk, int flags, int *err)
 {
         struct sctp_sock *sp;
         struct sctp_endpoint *ep;
@@ -3817,7 +3797,7 @@ out:
 }
 
 /* The SCTP ioctl handler. */
-SCTP_STATIC int sctp_ioctl(struct sock *sk, int cmd, unsigned long arg)
+static int sctp_ioctl(struct sock *sk, int cmd, unsigned long arg)
 {
         int rc = -ENOTCONN;
 
@@ -3859,13 +3839,12 @@ out:
  * initialized the SCTP-specific portion of the sock.
  * The sock structure should already be zero-filled memory.
  */
-SCTP_STATIC int sctp_init_sock(struct sock *sk)
+static int sctp_init_sock(struct sock *sk)
 {
         struct net *net = sock_net(sk);
-        struct sctp_endpoint *ep;
         struct sctp_sock *sp;
 
-        SCTP_DEBUG_PRINTK("sctp_init_sock(sk: %p)\n", sk);
+        pr_debug("%s: sk:%p\n", __func__, sk);
 
         sp = sctp_sk(sk);
 
@@ -3971,13 +3950,14 @@ SCTP_STATIC int sctp_init_sock(struct sock *sk)
          * change the data structure relationships, this may still
          * be useful for storing pre-connect address information.
          */
-        ep = sctp_endpoint_new(sk, GFP_KERNEL);
-        if (!ep)
+        sp->ep = sctp_endpoint_new(sk, GFP_KERNEL);
+        if (!sp->ep)
                 return -ENOMEM;
 
-        sp->ep = ep;
         sp->hmac = NULL;
 
+        sk->sk_destruct = sctp_destruct_sock;
+
         SCTP_DBG_OBJCNT_INC(sock);
 
         local_bh_disable();
@@ -3995,14 +3975,20 @@ SCTP_STATIC int sctp_init_sock(struct sock *sk)
 }
 
 /* Cleanup any SCTP per socket resources.  */
-SCTP_STATIC void sctp_destroy_sock(struct sock *sk)
+static void sctp_destroy_sock(struct sock *sk)
 {
         struct sctp_sock *sp;
 
-        SCTP_DEBUG_PRINTK("sctp_destroy_sock(sk: %p)\n", sk);
+        pr_debug("%s: sk:%p\n", __func__, sk);
 
         /* Release our hold on the endpoint. */
         sp = sctp_sk(sk);
+        /* This could happen during socket init, thus we bail out
+         * early, since the rest of the below is not setup either.
+         */
+        if (sp->ep == NULL)
+                return;
+
         if (sp->do_auto_asconf) {
                 sp->do_auto_asconf = 0;
                 list_del(&sp->auto_asconf_list);
@@ -4014,6 +4000,17 @@ SCTP_STATIC void sctp_destroy_sock(struct sock *sk)
         local_bh_enable();
 }
 
+/* Triggered when there are no references on the socket anymore */
+static void sctp_destruct_sock(struct sock *sk)
+{
+        struct sctp_sock *sp = sctp_sk(sk);
+
+        /* Free up the HMAC transform. */
+        crypto_free_hash(sp->hmac);
+
+        inet_sock_destruct(sk);
+}
+
 /* API 4.1.7 shutdown() - TCP Style Syntax
  *     int shutdown(int socket, int how);
  *
@@ -4030,7 +4027,7 @@ SCTP_STATIC void sctp_destroy_sock(struct sock *sk)
  *                     Disables further send  and  receive  operations
  *                     and initiates the SCTP shutdown sequence.
  */
-SCTP_STATIC void sctp_shutdown(struct sock *sk, int how)
+static void sctp_shutdown(struct sock *sk, int how)
 {
         struct net *net = sock_net(sk);
         struct sctp_endpoint *ep;
@@ -4115,9 +4112,9 @@ static int sctp_getsockopt_sctp_status(struct sock *sk, int len,
                 goto out;
         }
 
-        SCTP_DEBUG_PRINTK("sctp_getsockopt_sctp_status(%d): %d %d %d\n",
-                          len, status.sstat_state, status.sstat_rwnd,
-                          status.sstat_assoc_id);
+        pr_debug("%s: len:%d, state:%d, rwnd:%d, assoc_id:%d\n",
+                 __func__, len, status.sstat_state, status.sstat_rwnd,
+                 status.sstat_assoc_id);
 
         if (copy_to_user(optval, &status, len)) {
                 retval = -EFAULT;
@@ -4312,7 +4309,7 @@ static int sctp_getsockopt_peeloff(struct sock *sk, int len, char __user *optval
                 goto out;
 
         /* Map the socket to an unused fd that can be returned to the user.  */
-        retval = get_unused_fd();
+        retval = get_unused_fd_flags(0);
         if (retval < 0) {
                 sock_release(newsock);
                 goto out;
@@ -4325,8 +4322,8 @@ static int sctp_getsockopt_peeloff(struct sock *sk, int len, char __user *optval
                 return PTR_ERR(newfile);
         }
 
-        SCTP_DEBUG_PRINTK("%s: sk: %p newsk: %p sd: %d\n",
-                          __func__, sk, newsock->sk, retval);
+        pr_debug("%s: sk:%p, newsk:%p, sd:%d\n", __func__, sk, newsock->sk,
+                 retval);
 
         /* Return the fd mapped to the new socket.  */
         if (put_user(len, optlen)) {
@@ -4459,7 +4456,7 @@ static int sctp_getsockopt_peer_addr_params(struct sock *sk, int len,
                 trans = sctp_addr_id2transport(sk, &params.spp_address,
                                                params.spp_assoc_id);
                 if (!trans) {
-                        SCTP_DEBUG_PRINTK("Failed no transport\n");
+                        pr_debug("%s: failed no transport\n", __func__);
                         return -EINVAL;
                 }
         }
@@ -4470,7 +4467,7 @@ static int sctp_getsockopt_peer_addr_params(struct sock *sk, int len,
          */
         asoc = sctp_id2assoc(sk, params.spp_assoc_id);
         if (!asoc && params.spp_assoc_id && sctp_style(sk, UDP)) {
-                SCTP_DEBUG_PRINTK("Failed no association\n");
+                pr_debug("%s: failed no association\n", __func__);
                 return -EINVAL;
         }
 
@@ -5075,10 +5072,7 @@ static int sctp_getsockopt_associnfo(struct sock *sk, int len,
                 assocparams.sasoc_asocmaxrxt = asoc->max_retrans;
                 assocparams.sasoc_peer_rwnd = asoc->peer.rwnd;
                 assocparams.sasoc_local_rwnd = asoc->a_rwnd;
-                assocparams.sasoc_cookie_life = (asoc->cookie_life.tv_sec
-                                                * 1000) +
-                                                (asoc->cookie_life.tv_usec
-                                                / 1000);
+                assocparams.sasoc_cookie_life = ktime_to_ms(asoc->cookie_life);
 
                 list_for_each(pos, &asoc->peer.transport_addr_list) {
                         cnt ++;
@@ -5693,8 +5687,7 @@ static int sctp_getsockopt_assoc_stats(struct sock *sk, int len,
         if (put_user(len, optlen))
                 return -EFAULT;
 
-        SCTP_DEBUG_PRINTK("sctp_getsockopt_assoc_stat(%d): %d\n",
-                          len, sas.sas_assoc_id);
+        pr_debug("%s: len:%d, assoc_id:%d\n", __func__, len, sas.sas_assoc_id);
 
         if (copy_to_user(optval, &sas, len))
                 return -EFAULT;
@@ -5702,14 +5695,13 @@ static int sctp_getsockopt_assoc_stats(struct sock *sk, int len,
         return 0;
 }
 
-SCTP_STATIC int sctp_getsockopt(struct sock *sk, int level, int optname,
-                                char __user *optval, int __user *optlen)
+static int sctp_getsockopt(struct sock *sk, int level, int optname,
+                           char __user *optval, int __user *optlen)
 {
         int retval = 0;
         int len;
 
-        SCTP_DEBUG_PRINTK("sctp_getsockopt(sk: %p... optname: %d)\n",
-                          sk, optname);
+        pr_debug("%s: sk:%p, optname:%d\n", __func__, sk, optname);
 
         /* I can hardly begin to describe how wrong this is.  This is
          * so broken as to be worse than useless.  The API draft
@@ -5889,7 +5881,8 @@ static long sctp_get_port_local(struct sock *sk, union sctp_addr *addr)
 
         snum = ntohs(addr->v4.sin_port);
 
-        SCTP_DEBUG_PRINTK("sctp_get_port() begins, snum=%d\n", snum);
+        pr_debug("%s: begins, snum:%d\n", __func__, snum);
+
         sctp_local_bh_disable();
 
         if (snum == 0) {
@@ -5955,7 +5948,8 @@ pp_found:
                 int reuse = sk->sk_reuse;
                 struct sock *sk2;
 
-                SCTP_DEBUG_PRINTK("sctp_get_port() found a possible match\n");
+                pr_debug("%s: found a possible match\n", __func__);
+
                 if (pp->fastreuse && sk->sk_reuse &&
                         sk->sk_state != SCTP_SS_LISTENING)
                         goto success;
@@ -5985,7 +5979,8 @@ pp_found:
                                 goto fail_unlock;
                         }
                 }
-                SCTP_DEBUG_PRINTK("sctp_get_port(): Found a match\n");
+
+                pr_debug("%s: found a match\n", __func__);
         }
 pp_not_found:
         /* If there was a hash table miss, create a new port.  */
@@ -6031,7 +6026,6 @@ fail:
  */
 static int sctp_get_port(struct sock *sk, unsigned short snum)
 {
-        long ret;
         union sctp_addr addr;
         struct sctp_af *af = sctp_sk(sk)->pf->af;
 
@@ -6040,15 +6034,13 @@ static int sctp_get_port(struct sock *sk, unsigned short snum)
         addr.v4.sin_port = htons(snum);
 
         /* Note: sk->sk_num gets filled in if ephemeral port request. */
-        ret = sctp_get_port_local(sk, &addr);
-
-        return ret ? 1 : 0;
+        return !!sctp_get_port_local(sk, &addr);
 }
 
 /*
  *  Move a socket to LISTENING state.
  */
-SCTP_STATIC int sctp_listen_start(struct sock *sk, int backlog)
+static int sctp_listen_start(struct sock *sk, int backlog)
 {
         struct sctp_sock *sp = sctp_sk(sk);
         struct sctp_endpoint *ep = sp->ep;
@@ -6187,7 +6179,7 @@ unsigned int sctp_poll(struct file *file, struct socket *sock, poll_table *wait)
         /* Is there any exceptional events?  */
         if (sk->sk_err || !skb_queue_empty(&sk->sk_error_queue))
                 mask |= POLLERR |
-                        sock_flag(sk, SOCK_SELECT_ERR_QUEUE) ? POLLPRI : 0;
+                        (sock_flag(sk, SOCK_SELECT_ERR_QUEUE) ? POLLPRI : 0);
         if (sk->sk_shutdown & RCV_SHUTDOWN)
                 mask |= POLLRDHUP | POLLIN | POLLRDNORM;
         if (sk->sk_shutdown == SHUTDOWN_MASK)
@@ -6335,8 +6327,7 @@ static int sctp_autobind(struct sock *sk)
  * msg_control
  * points here
  */
-SCTP_STATIC int sctp_msghdr_parse(const struct msghdr *msg,
-                                  sctp_cmsgs_t *cmsgs)
+static int sctp_msghdr_parse(const struct msghdr *msg, sctp_cmsgs_t *cmsgs)
 {
         struct cmsghdr *cmsg;
         struct msghdr *my_msg = (struct msghdr *)msg;
@@ -6478,8 +6469,8 @@ static struct sk_buff *sctp_skb_recv_datagram(struct sock *sk, int flags,
 
         timeo = sock_rcvtimeo(sk, noblock);
 
-        SCTP_DEBUG_PRINTK("Timeout: timeo: %ld, MAX: %ld.\n",
-                          timeo, MAX_SCHEDULE_TIMEOUT);
+        pr_debug("%s: timeo:%ld, max:%ld\n", __func__, timeo,
+                 MAX_SCHEDULE_TIMEOUT);
 
         do {
                 /* Again only user level code calls this function,
@@ -6610,8 +6601,8 @@ static int sctp_wait_for_sndbuf(struct sctp_association *asoc, long *timeo_p,
         long current_timeo = *timeo_p;
         DEFINE_WAIT(wait);
 
-        SCTP_DEBUG_PRINTK("wait_for_sndbuf: asoc=%p, timeo=%ld, msg_len=%zu\n",
-                          asoc, (long)(*timeo_p), msg_len);
+        pr_debug("%s: asoc:%p, timeo:%ld, msg_len:%zu\n", __func__, asoc,
+                 *timeo_p, msg_len);
 
         /* Increment the association's refcnt.  */
         sctp_association_hold(asoc);
@@ -6717,8 +6708,7 @@ static int sctp_wait_for_connect(struct sctp_association *asoc, long *timeo_p)
         long current_timeo = *timeo_p;
         DEFINE_WAIT(wait);
 
-        SCTP_DEBUG_PRINTK("%s: asoc=%p, timeo=%ld\n", __func__, asoc,
-                          (long)(*timeo_p));
+        pr_debug("%s: asoc:%p, timeo:%ld\n", __func__, asoc, *timeo_p);
 
         /* Increment the association's refcnt.  */
         sctp_association_hold(asoc);
@@ -6858,7 +6848,7 @@ void sctp_copy_sock(struct sock *newsk, struct sock *sk,
         newsk->sk_reuse = sk->sk_reuse;
 
         newsk->sk_shutdown = sk->sk_shutdown;
-        newsk->sk_destruct = inet_sock_destruct;
+        newsk->sk_destruct = sctp_destruct_sock;
         newsk->sk_family = sk->sk_family;
         newsk->sk_protocol = IPPROTO_SCTP;
         newsk->sk_backlog_rcv = sk->sk_prot->backlog_rcv;
diff --git a/net/sctp/ssnmap.c b/net/sctp/ssnmap.c
index da8603523808..6007124aefa0 100644
--- a/net/sctp/ssnmap.c
+++ b/net/sctp/ssnmap.c
@@ -24,16 +24,10 @@
  *
  * Please send any bug reports or fixes you make to the
  * email address(es):
- *    lksctp developers <lksctp-developers@lists.sourceforge.net>
- *
- * Or submit a bug report through the following website:
- *    http://www.sf.net/projects/lksctp
+ *    lksctp developers <linux-sctp@vger.kernel.org>
  *
  * Written or modified by:
  *    Jon Grimm             <jgrimm@us.ibm.com>
- *
- * Any bugs reported given to us we will try to fix... any fixes shared will
- * be incorporated into the next SCTP release.
  */
 
 #include <linux/types.h>
diff --git a/net/sctp/sysctl.c b/net/sctp/sysctl.c
index bf3c6e8fc401..6b36561a1b3b 100644
--- a/net/sctp/sysctl.c
+++ b/net/sctp/sysctl.c
@@ -25,10 +25,7 @@
  *
  * Please send any bug reports or fixes you make to the
  * email address(es):
- *    lksctp developers <lksctp-developers@lists.sourceforge.net>
- *
- * Or submit a bug report through the following website:
- *    http://www.sf.net/projects/lksctp
+ *    lksctp developers <linux-sctp@vger.kernel.org>
  *
  * Written or modified by:
  *    Mingqin Liu           <liuming@us.ibm.com>
@@ -36,9 +33,6 @@
  *    Ardelle Fan           <ardelle.fan@intel.com>
  *    Ryan Layer            <rmlayer@us.ibm.com>
  *    Sridhar Samudrala     <sri@us.ibm.com>
- *
- * Any bugs reported given to us we will try to fix... any fixes shared will
- * be incorporated into the next SCTP release.
  */
 
 #include <net/sctp/structs.h>
@@ -62,12 +56,12 @@ extern long sysctl_sctp_mem[3];
 extern int sysctl_sctp_rmem[3];
 extern int sysctl_sctp_wmem[3];
 
-static int proc_sctp_do_hmac_alg(ctl_table *ctl,
+static int proc_sctp_do_hmac_alg(struct ctl_table *ctl,
                                 int write,
                                 void __user *buffer, size_t *lenp,
 
                                 loff_t *ppos);
-static ctl_table sctp_table[] = {
+static struct ctl_table sctp_table[] = {
         {
                 .procname       = "sctp_mem",
                 .data           = &sysctl_sctp_mem,
@@ -93,7 +87,7 @@ static ctl_table sctp_table[] = {
         { /* sentinel */ }
 };
 
-static ctl_table sctp_net_table[] = {
+static struct ctl_table sctp_net_table[] = {
         {
                 .procname       = "rto_initial",
                 .data           = &init_net.sctp.rto_initial,
@@ -300,14 +294,14 @@ static ctl_table sctp_net_table[] = {
         { /* sentinel */ }
 };
 
-static int proc_sctp_do_hmac_alg(ctl_table *ctl,
+static int proc_sctp_do_hmac_alg(struct ctl_table *ctl,
                                 int write,
                                 void __user *buffer, size_t *lenp,
                                 loff_t *ppos)
 {
         struct net *net = current->nsproxy->net_ns;
         char tmp[8];
-        ctl_table tbl;
+        struct ctl_table tbl;
         int ret;
         int changed = 0;
         char *none = "none";
diff --git a/net/sctp/transport.c b/net/sctp/transport.c
index 098f1d5f769e..e332efb124cc 100644
--- a/net/sctp/transport.c
+++ b/net/sctp/transport.c
@@ -30,10 +30,7 @@
  *
  * Please send any bug reports or fixes you make to the
  * email address(es):
- *    lksctp developers <lksctp-developers@lists.sourceforge.net>
- *
- * Or submit a bug report through the following website:
- *    http://www.sf.net/projects/lksctp
+ *    lksctp developers <linux-sctp@vger.kernel.org>
  *
  * Written or modified by:
  *    La Monte H.P. Yarroll <piggy@acm.org>
@@ -43,9 +40,6 @@
  *    Hui Huang             <hui.huang@nokia.com>
  *    Sridhar Samudrala     <sri@us.ibm.com>
  *    Ardelle Fan           <ardelle.fan@intel.com>
- *
- * Any bugs reported given to us we will try to fix... any fixes shared will
- * be incorporated into the next SCTP release.
  */
 
 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
@@ -116,7 +110,7 @@ struct sctp_transport *sctp_transport_new(struct net *net,
 {
         struct sctp_transport *transport;
 
-        transport = t_new(struct sctp_transport, gfp);
+        transport = kzalloc(sizeof(*transport), gfp);
         if (!transport)
                 goto fail;
 
@@ -176,14 +170,17 @@ static void sctp_transport_destroy_rcu(struct rcu_head *head)
  */
 static void sctp_transport_destroy(struct sctp_transport *transport)
 {
-        SCTP_ASSERT(transport->dead, "Transport is not dead", return);
-
-        call_rcu(&transport->rcu, sctp_transport_destroy_rcu);
+        if (unlikely(!transport->dead)) {
+                WARN(1, "Attempt to destroy undead transport %p!\n", transport);
+                return;
+        }
 
         sctp_packet_free(&transport->packet);
 
         if (transport->asoc)
                 sctp_association_put(transport->asoc);
+
+        call_rcu(&transport->rcu, sctp_transport_destroy_rcu);
 }
 
 /* Start T3_rtx timer if it is not already running and update the heartbeat
@@ -317,11 +314,9 @@ void sctp_transport_put(struct sctp_transport *transport)
 /* Update transport's RTO based on the newly calculated RTT. */
 void sctp_transport_update_rto(struct sctp_transport *tp, __u32 rtt)
 {
-        /* Check for valid transport.  */
-        SCTP_ASSERT(tp, "NULL transport", return);
-
-        /* We should not be doing any RTO updates unless rto_pending is set.  */
-        SCTP_ASSERT(tp->rto_pending, "rto_pending not set", return);
+        if (unlikely(!tp->rto_pending))
+                /* We should not be doing any RTO updates unless rto_pending is set.  */
+                pr_debug("%s: rto_pending not set on transport %p!\n", __func__, tp);
 
         if (tp->rttvar || tp->srtt) {
                 struct net *net = sock_net(tp->asoc->base.sk);
@@ -377,9 +372,8 @@ void sctp_transport_update_rto(struct sctp_transport *tp, __u32 rtt)
          */
         tp->rto_pending = 0;
 
-        SCTP_DEBUG_PRINTK("%s: transport: %p, rtt: %d, srtt: %d "
-                          "rttvar: %d, rto: %ld\n", __func__,
-                          tp, rtt, tp->srtt, tp->rttvar, tp->rto);
+        pr_debug("%s: transport:%p, rtt:%d, srtt:%d rttvar:%d, rto:%ld\n",
+                 __func__, tp, rtt, tp->srtt, tp->rttvar, tp->rto);
 }
 
 /* This routine updates the transport's cwnd and partial_bytes_acked
@@ -433,12 +427,11 @@ void sctp_transport_raise_cwnd(struct sctp_transport *transport,
                         cwnd += pmtu;
                 else
                         cwnd += bytes_acked;
-                SCTP_DEBUG_PRINTK("%s: SLOW START: transport: %p, "
-                                  "bytes_acked: %d, cwnd: %d, ssthresh: %d, "
-                                  "flight_size: %d, pba: %d\n",
-                                  __func__,
-                                  transport, bytes_acked, cwnd,
-                                  ssthresh, flight_size, pba);
+
+                pr_debug("%s: slow start: transport:%p, bytes_acked:%d, "
+                         "cwnd:%d, ssthresh:%d, flight_size:%d, pba:%d\n",
+                         __func__, transport, bytes_acked, cwnd, ssthresh,
+                         flight_size, pba);
         } else {
                 /* RFC 2960 7.2.2 Whenever cwnd is greater than ssthresh,
                  * upon each SACK arrival that advances the Cumulative TSN Ack
@@ -459,12 +452,12 @@ void sctp_transport_raise_cwnd(struct sctp_transport *transport,
                         cwnd += pmtu;
                         pba = ((cwnd < pba) ? (pba - cwnd) : 0);
                 }
-                SCTP_DEBUG_PRINTK("%s: CONGESTION AVOIDANCE: "
-                                  "transport: %p, bytes_acked: %d, cwnd: %d, "
-                                  "ssthresh: %d, flight_size: %d, pba: %d\n",
-                                  __func__,
-                                  transport, bytes_acked, cwnd,
-                                  ssthresh, flight_size, pba);
+
+                pr_debug("%s: congestion avoidance: transport:%p, "
+                         "bytes_acked:%d, cwnd:%d, ssthresh:%d, "
+                         "flight_size:%d, pba:%d\n", __func__,
+                         transport, bytes_acked, cwnd, ssthresh,
+                         flight_size, pba);
         }
 
         transport->cwnd = cwnd;
@@ -558,10 +551,10 @@ void sctp_transport_lower_cwnd(struct sctp_transport *transport,
         }
 
         transport->partial_bytes_acked = 0;
-        SCTP_DEBUG_PRINTK("%s: transport: %p reason: %d cwnd: "
-                          "%d ssthresh: %d\n", __func__,
-                          transport, reason,
-                          transport->cwnd, transport->ssthresh);
+
+        pr_debug("%s: transport:%p, reason:%d, cwnd:%d, ssthresh:%d\n",
+                 __func__, transport, reason, transport->cwnd,
+                 transport->ssthresh);
 }
 
 /* Apply Max.Burst limit to the congestion window:
diff --git a/net/sctp/tsnmap.c b/net/sctp/tsnmap.c
index 396c45174e5b..fbda20028285 100644
--- a/net/sctp/tsnmap.c
+++ b/net/sctp/tsnmap.c
@@ -27,19 +27,13 @@
  *
  * Please send any bug reports or fixes you make to the
  * email address(es):
- *    lksctp developers <lksctp-developers@lists.sourceforge.net>
- *
- * Or submit a bug report through the following website:
- *    http://www.sf.net/projects/lksctp
+ *    lksctp developers <linux-sctp@vger.kernel.org>
  *
  * Written or modified by:
  *    La Monte H.P. Yarroll <piggy@acm.org>
  *    Jon Grimm             <jgrimm@us.ibm.com>
  *    Karl Knutson          <karl@athena.chicago.il.us>
  *    Sridhar Samudrala     <sri@us.ibm.com>
- *
- * Any bugs reported given to us we will try to fix... any fixes shared will
- * be incorporated into the next SCTP release.
  */
 
 #include <linux/slab.h>
@@ -161,8 +155,8 @@ int sctp_tsnmap_mark(struct sctp_tsnmap *map, __u32 tsn,
 
 
 /* Initialize a Gap Ack Block iterator from memory being provided.  */
-SCTP_STATIC void sctp_tsnmap_iter_init(const struct sctp_tsnmap *map,
-                                       struct sctp_tsnmap_iter *iter)
+static void sctp_tsnmap_iter_init(const struct sctp_tsnmap *map,
+                                  struct sctp_tsnmap_iter *iter)
 {
         /* Only start looking one past the Cumulative TSN Ack Point.  */
         iter->start = map->cumulative_tsn_ack_point + 1;
@@ -171,9 +165,9 @@ SCTP_STATIC void sctp_tsnmap_iter_init(const struct sctp_tsnmap *map,
 /* Get the next Gap Ack Blocks. Returns 0 if there was not another block
  * to get.
  */
-SCTP_STATIC int sctp_tsnmap_next_gap_ack(const struct sctp_tsnmap *map,
-                                         struct sctp_tsnmap_iter *iter,
-                                         __u16 *start, __u16 *end)
+static int sctp_tsnmap_next_gap_ack(const struct sctp_tsnmap *map,
+                                    struct sctp_tsnmap_iter *iter,
+                                    __u16 *start, __u16 *end)
 {
         int ended = 0;
         __u16 start_ = 0, end_ = 0, offset;
diff --git a/net/sctp/ulpevent.c b/net/sctp/ulpevent.c
index 10c018a5b9fe..81089ed65456 100644
--- a/net/sctp/ulpevent.c
+++ b/net/sctp/ulpevent.c
@@ -28,19 +28,13 @@
  *
  * Please send any bug reports or fixes you make to the
  * email address(es):
- *    lksctp developers <lksctp-developers@lists.sourceforge.net>
- *
- * Or submit a bug report through the following website:
- *    http://www.sf.net/projects/lksctp
+ *    lksctp developers <linux-sctp@vger.kernel.org>
  *
  * Written or modified by:
  *    Jon Grimm             <jgrimm@us.ibm.com>
  *    La Monte H.P. Yarroll <piggy@acm.org>
  *    Ardelle Fan           <ardelle.fan@intel.com>
  *    Sridhar Samudrala     <sri@us.ibm.com>
- *
- * Any bugs reported given to us we will try to fix... any fixes shared will
- * be incorporated into the next SCTP release.
  */
 
 #include <linux/slab.h>
@@ -57,9 +51,9 @@ static void sctp_ulpevent_release_frag_data(struct sctp_ulpevent *event);
 
 
 /* Initialize an ULP event from an given skb.  */
-SCTP_STATIC void sctp_ulpevent_init(struct sctp_ulpevent *event,
-                                    int msg_flags,
-                                    unsigned int len)
+static void sctp_ulpevent_init(struct sctp_ulpevent *event,
+                               int msg_flags,
+                               unsigned int len)
 {
         memset(event, 0, sizeof(struct sctp_ulpevent));
         event->msg_flags = msg_flags;
@@ -67,8 +61,8 @@ SCTP_STATIC void sctp_ulpevent_init(struct sctp_ulpevent *event,
 }
 
 /* Create a new sctp_ulpevent.  */
-SCTP_STATIC struct sctp_ulpevent *sctp_ulpevent_new(int size, int msg_flags,
-                                                    gfp_t gfp)
+static struct sctp_ulpevent *sctp_ulpevent_new(int size, int msg_flags,
+                                               gfp_t gfp)
 {
         struct sctp_ulpevent *event;
         struct sk_buff *skb;
diff --git a/net/sctp/ulpqueue.c b/net/sctp/ulpqueue.c
index 04e3d470f877..1c1484ed605d 100644
--- a/net/sctp/ulpqueue.c
+++ b/net/sctp/ulpqueue.c
@@ -27,18 +27,12 @@
  *
  * Please send any bug reports or fixes you make to the
  * email address(es):
- *    lksctp developers <lksctp-developers@lists.sourceforge.net>
- *
- * Or submit a bug report through the following website:
- *    http://www.sf.net/projects/lksctp
+ *    lksctp developers <linux-sctp@vger.kernel.org>
  *
  * Written or modified by:
  *    Jon Grimm             <jgrimm@us.ibm.com>
  *    La Monte H.P. Yarroll <piggy@acm.org>
  *    Sridhar Samudrala     <sri@us.ibm.com>
- *
- * Any bugs reported given to us we will try to fix... any fixes shared will
- * be incorporated into the next SCTP release.
  */
 
 #include <linux/slab.h>
diff --git a/net/socket.c b/net/socket.c
index 4ca1526db756..ebed4b68f768 100644
--- a/net/socket.c
+++ b/net/socket.c
@@ -104,6 +104,12 @@
 #include <linux/route.h>
 #include <linux/sockios.h>
 #include <linux/atalk.h>
+#include <net/busy_poll.h>
+
+#ifdef CONFIG_NET_RX_BUSY_POLL
+unsigned int sysctl_net_busy_read __read_mostly;
+unsigned int sysctl_net_busy_poll __read_mostly;
+#endif
 
 static int sock_no_open(struct inode *irrelevant, struct file *dontcare);
 static ssize_t sock_aio_read(struct kiocb *iocb, const struct iovec *iov,
@@ -848,11 +854,6 @@ int kernel_recvmsg(struct socket *sock, struct msghdr *msg,
 }
 EXPORT_SYMBOL(kernel_recvmsg);
 
-static void sock_aio_dtor(struct kiocb *iocb)
-{
-        kfree(iocb->private);
-}
-
 static ssize_t sock_sendpage(struct file *file, struct page *page,
                              int offset, size_t size, loff_t *ppos, int more)
 {
@@ -883,12 +884,8 @@ static ssize_t sock_splice_read(struct file *file, loff_t *ppos,
 static struct sock_iocb *alloc_sock_iocb(struct kiocb *iocb,
                                          struct sock_iocb *siocb)
 {
-        if (!is_sync_kiocb(iocb)) {
-                siocb = kmalloc(sizeof(*siocb), GFP_KERNEL);
-                if (!siocb)
-                        return NULL;
-                iocb->ki_dtor = sock_aio_dtor;
-        }
+        if (!is_sync_kiocb(iocb))
+                BUG();
 
         siocb->kiocb = iocb;
         iocb->private = siocb;
@@ -925,7 +922,7 @@ static ssize_t sock_aio_read(struct kiocb *iocb, const struct iovec *iov,
         if (pos != 0)
                 return -ESPIPE;
 
-        if (iocb->ki_left == 0) /* Match SYS5 behaviour */
+        if (iocb->ki_nbytes == 0)       /* Match SYS5 behaviour */
                 return 0;
 
 
@@ -1142,13 +1139,24 @@ EXPORT_SYMBOL(sock_create_lite);
 /* No kernel lock held - perfect */
 static unsigned int sock_poll(struct file *file, poll_table *wait)
 {
+        unsigned int busy_flag = 0;
         struct socket *sock;
 
         /*
          *      We can't return errors to poll, so it's either yes or no.
          */
         sock = file->private_data;
-        return sock->ops->poll(file, sock, wait);
+
+        if (sk_can_busy_loop(sock->sk)) {
+                /* this socket can poll_ll so tell the system call */
+                busy_flag = POLL_BUSY_LOOP;
+
+                /* once, only if requested by syscall */
+                if (wait && (wait->_key & POLL_BUSY_LOOP))
+                        sk_busy_loop(sock->sk, 1);
+        }
+
+        return busy_flag | sock->ops->poll(file, sock, wait);
 }
 
 static int sock_mmap(struct file *file, struct vm_area_struct *vma)
@@ -2635,7 +2643,9 @@ static int __init sock_init(void)
          */
 
 #ifdef CONFIG_NETFILTER
-        netfilter_init();
+        err = netfilter_init();
+        if (err)
+                goto out;
 #endif
 
 #ifdef CONFIG_NETWORK_PHY_TIMESTAMPING
@@ -3053,12 +3063,12 @@ static int compat_sioc_ifmap(struct net *net, unsigned int cmd,
 
         uifmap32 = &uifr32->ifr_ifru.ifru_map;
         err = copy_from_user(&ifr, uifr32, sizeof(ifr.ifr_name));
-        err |= __get_user(ifr.ifr_map.mem_start, &uifmap32->mem_start);
-        err |= __get_user(ifr.ifr_map.mem_end, &uifmap32->mem_end);
-        err |= __get_user(ifr.ifr_map.base_addr, &uifmap32->base_addr);
-        err |= __get_user(ifr.ifr_map.irq, &uifmap32->irq);
-        err |= __get_user(ifr.ifr_map.dma, &uifmap32->dma);
-        err |= __get_user(ifr.ifr_map.port, &uifmap32->port);
+        err |= get_user(ifr.ifr_map.mem_start, &uifmap32->mem_start);
+        err |= get_user(ifr.ifr_map.mem_end, &uifmap32->mem_end);
+        err |= get_user(ifr.ifr_map.base_addr, &uifmap32->base_addr);
+        err |= get_user(ifr.ifr_map.irq, &uifmap32->irq);
+        err |= get_user(ifr.ifr_map.dma, &uifmap32->dma);
+        err |= get_user(ifr.ifr_map.port, &uifmap32->port);
         if (err)
                 return -EFAULT;
 
@@ -3069,12 +3079,12 @@ static int compat_sioc_ifmap(struct net *net, unsigned int cmd,
 
         if (cmd == SIOCGIFMAP && !err) {
                 err = copy_to_user(uifr32, &ifr, sizeof(ifr.ifr_name));
-                err |= __put_user(ifr.ifr_map.mem_start, &uifmap32->mem_start);
-                err |= __put_user(ifr.ifr_map.mem_end, &uifmap32->mem_end);
-                err |= __put_user(ifr.ifr_map.base_addr, &uifmap32->base_addr);
-                err |= __put_user(ifr.ifr_map.irq, &uifmap32->irq);
-                err |= __put_user(ifr.ifr_map.dma, &uifmap32->dma);
-                err |= __put_user(ifr.ifr_map.port, &uifmap32->port);
+                err |= put_user(ifr.ifr_map.mem_start, &uifmap32->mem_start);
+                err |= put_user(ifr.ifr_map.mem_end, &uifmap32->mem_end);
+                err |= put_user(ifr.ifr_map.base_addr, &uifmap32->base_addr);
+                err |= put_user(ifr.ifr_map.irq, &uifmap32->irq);
+                err |= put_user(ifr.ifr_map.dma, &uifmap32->dma);
+                err |= put_user(ifr.ifr_map.port, &uifmap32->port);
                 if (err)
                         err = -EFAULT;
         }
@@ -3148,25 +3158,25 @@ static int routing_ioctl(struct net *net, struct socket *sock,
                 struct in6_rtmsg32 __user *ur6 = argp;
                 ret = copy_from_user(&r6.rtmsg_dst, &(ur6->rtmsg_dst),
                         3 * sizeof(struct in6_addr));
-                ret |= __get_user(r6.rtmsg_type, &(ur6->rtmsg_type));
-                ret |= __get_user(r6.rtmsg_dst_len, &(ur6->rtmsg_dst_len));
-                ret |= __get_user(r6.rtmsg_src_len, &(ur6->rtmsg_src_len));
-                ret |= __get_user(r6.rtmsg_metric, &(ur6->rtmsg_metric));
-                ret |= __get_user(r6.rtmsg_info, &(ur6->rtmsg_info));
-                ret |= __get_user(r6.rtmsg_flags, &(ur6->rtmsg_flags));
-                ret |= __get_user(r6.rtmsg_ifindex, &(ur6->rtmsg_ifindex));
+                ret |= get_user(r6.rtmsg_type, &(ur6->rtmsg_type));
+                ret |= get_user(r6.rtmsg_dst_len, &(ur6->rtmsg_dst_len));
+                ret |= get_user(r6.rtmsg_src_len, &(ur6->rtmsg_src_len));
+                ret |= get_user(r6.rtmsg_metric, &(ur6->rtmsg_metric));
+                ret |= get_user(r6.rtmsg_info, &(ur6->rtmsg_info));
+                ret |= get_user(r6.rtmsg_flags, &(ur6->rtmsg_flags));
+                ret |= get_user(r6.rtmsg_ifindex, &(ur6->rtmsg_ifindex));
 
                 r = (void *) &r6;
         } else { /* ipv4 */
                 struct rtentry32 __user *ur4 = argp;
                 ret = copy_from_user(&r4.rt_dst, &(ur4->rt_dst),
                                         3 * sizeof(struct sockaddr));
-                ret |= __get_user(r4.rt_flags, &(ur4->rt_flags));
-                ret |= __get_user(r4.rt_metric, &(ur4->rt_metric));
-                ret |= __get_user(r4.rt_mtu, &(ur4->rt_mtu));
-                ret |= __get_user(r4.rt_window, &(ur4->rt_window));
-                ret |= __get_user(r4.rt_irtt, &(ur4->rt_irtt));
-                ret |= __get_user(rtdev, &(ur4->rt_dev));
+                ret |= get_user(r4.rt_flags, &(ur4->rt_flags));
+                ret |= get_user(r4.rt_metric, &(ur4->rt_metric));
+                ret |= get_user(r4.rt_mtu, &(ur4->rt_mtu));
+                ret |= get_user(r4.rt_window, &(ur4->rt_window));
+                ret |= get_user(r4.rt_irtt, &(ur4->rt_irtt));
+                ret |= get_user(rtdev, &(ur4->rt_dev));
                 if (rtdev) {
                         ret |= copy_from_user(devname, compat_ptr(rtdev), 15);
                         r4.rt_dev = (char __user __force *)devname;
diff --git a/net/sunrpc/auth.c b/net/sunrpc/auth.c
index ed2fdd210c0b..5285ead196c0 100644
--- a/net/sunrpc/auth.c
+++ b/net/sunrpc/auth.c
@@ -250,11 +250,11 @@ rpcauth_list_flavors(rpc_authflavor_t *array, int size)
 EXPORT_SYMBOL_GPL(rpcauth_list_flavors);
 
 struct rpc_auth *
-rpcauth_create(rpc_authflavor_t pseudoflavor, struct rpc_clnt *clnt)
+rpcauth_create(struct rpc_auth_create_args *args, struct rpc_clnt *clnt)
 {
         struct rpc_auth         *auth;
         const struct rpc_authops *ops;
-        u32                     flavor = pseudoflavor_to_flavor(pseudoflavor);
+        u32                     flavor = pseudoflavor_to_flavor(args->pseudoflavor);
 
         auth = ERR_PTR(-EINVAL);
         if (flavor >= RPC_AUTH_MAXFLAVOR)
@@ -269,7 +269,7 @@ rpcauth_create(rpc_authflavor_t pseudoflavor, struct rpc_clnt *clnt)
                 goto out;
         }
         spin_unlock(&rpc_authflavor_lock);
-        auth = ops->create(clnt, pseudoflavor);
+        auth = ops->create(args, clnt);
         module_put(ops->owner);
         if (IS_ERR(auth))
                 return auth;
@@ -343,6 +343,27 @@ out_nocache:
 EXPORT_SYMBOL_GPL(rpcauth_init_credcache);
 
 /*
+ * Setup a credential key lifetime timeout notification
+ */
+int
+rpcauth_key_timeout_notify(struct rpc_auth *auth, struct rpc_cred *cred)
+{
+        if (!cred->cr_auth->au_ops->key_timeout)
+                return 0;
+        return cred->cr_auth->au_ops->key_timeout(auth, cred);
+}
+EXPORT_SYMBOL_GPL(rpcauth_key_timeout_notify);
+
+bool
+rpcauth_cred_key_to_expire(struct rpc_cred *cred)
+{
+        if (!cred->cr_ops->crkey_to_expire)
+                return false;
+        return cred->cr_ops->crkey_to_expire(cred);
+}
+EXPORT_SYMBOL_GPL(rpcauth_cred_key_to_expire);
+
+/*
  * Destroy a list of credentials
  */
 static inline
@@ -413,12 +434,13 @@ EXPORT_SYMBOL_GPL(rpcauth_destroy_credcache);
 /*
  * Remove stale credentials. Avoid sleeping inside the loop.
  */
-static int
+static long
 rpcauth_prune_expired(struct list_head *free, int nr_to_scan)
 {
         spinlock_t *cache_lock;
         struct rpc_cred *cred, *next;
         unsigned long expired = jiffies - RPC_AUTH_EXPIRY_MORATORIUM;
+        long freed = 0;
 
         list_for_each_entry_safe(cred, next, &cred_unused, cr_lru) {
 
@@ -430,10 +452,11 @@ rpcauth_prune_expired(struct list_head *free, int nr_to_scan)
                  */
                 if (time_in_range(cred->cr_expire, expired, jiffies) &&
                     test_bit(RPCAUTH_CRED_HASHED, &cred->cr_flags) != 0)
-                        return 0;
+                        break;
 
                 list_del_init(&cred->cr_lru);
                 number_cred_unused--;
+                freed++;
                 if (atomic_read(&cred->cr_count) != 0)
                         continue;
 
@@ -446,29 +469,39 @@ rpcauth_prune_expired(struct list_head *free, int nr_to_scan)
                 }
                 spin_unlock(cache_lock);
         }
-        return (number_cred_unused / 100) * sysctl_vfs_cache_pressure;
+        return freed;
 }
 
 /*
  * Run memory cache shrinker.
  */
-static int
-rpcauth_cache_shrinker(struct shrinker *shrink, struct shrink_control *sc)
+static unsigned long
+rpcauth_cache_shrink_scan(struct shrinker *shrink, struct shrink_control *sc)
+
 {
         LIST_HEAD(free);
-        int res;
-        int nr_to_scan = sc->nr_to_scan;
-        gfp_t gfp_mask = sc->gfp_mask;
+        unsigned long freed;
 
-        if ((gfp_mask & GFP_KERNEL) != GFP_KERNEL)
-                return (nr_to_scan == 0) ? 0 : -1;
+        if ((sc->gfp_mask & GFP_KERNEL) != GFP_KERNEL)
+                return SHRINK_STOP;
+
+        /* nothing left, don't come back */
         if (list_empty(&cred_unused))
-                return 0;
+                return SHRINK_STOP;
+
         spin_lock(&rpc_credcache_lock);
-        res = rpcauth_prune_expired(&free, nr_to_scan);
+        freed = rpcauth_prune_expired(&free, sc->nr_to_scan);
         spin_unlock(&rpc_credcache_lock);
         rpcauth_destroy_credlist(&free);
-        return res;
+
+        return freed;
+}
+
+static unsigned long
+rpcauth_cache_shrink_count(struct shrinker *shrink, struct shrink_control *sc)
+
+{
+        return (number_cred_unused / 100) * sysctl_vfs_cache_pressure;
 }
 
 /*
@@ -784,7 +817,8 @@ rpcauth_uptodatecred(struct rpc_task *task)
 }
 
 static struct shrinker rpc_cred_shrinker = {
-        .shrink = rpcauth_cache_shrinker,
+        .count_objects = rpcauth_cache_shrink_count,
+        .scan_objects = rpcauth_cache_shrink_scan,
         .seeks = DEFAULT_SEEKS,
 };
 
diff --git a/net/sunrpc/auth_generic.c b/net/sunrpc/auth_generic.c
index b6badafc6494..ed04869b2d4f 100644
--- a/net/sunrpc/auth_generic.c
+++ b/net/sunrpc/auth_generic.c
@@ -89,6 +89,7 @@ generic_create_cred(struct rpc_auth *auth, struct auth_cred *acred, int flags)
         gcred->acred.uid = acred->uid;
         gcred->acred.gid = acred->gid;
         gcred->acred.group_info = acred->group_info;
+        gcred->acred.ac_flags = 0;
         if (gcred->acred.group_info != NULL)
                 get_group_info(gcred->acred.group_info);
         gcred->acred.machine_cred = acred->machine_cred;
@@ -182,11 +183,78 @@ void rpc_destroy_generic_auth(void)
         rpcauth_destroy_credcache(&generic_auth);
 }
 
+/*
+ * Test the the current time (now) against the underlying credential key expiry
+ * minus a timeout and setup notification.
+ *
+ * The normal case:
+ * If 'now' is before the key expiry minus RPC_KEY_EXPIRE_TIMEO, set
+ * the RPC_CRED_NOTIFY_TIMEOUT flag to setup the underlying credential
+ * rpc_credops crmatch routine to notify this generic cred when it's key
+ * expiration is within RPC_KEY_EXPIRE_TIMEO, and return 0.
+ *
+ * The error case:
+ * If the underlying cred lookup fails, return -EACCES.
+ *
+ * The 'almost' error case:
+ * If 'now' is within key expiry minus RPC_KEY_EXPIRE_TIMEO, but not within
+ * key expiry minus RPC_KEY_EXPIRE_FAIL, set the RPC_CRED_EXPIRE_SOON bit
+ * on the acred ac_flags and return 0.
+ */
+static int
+generic_key_timeout(struct rpc_auth *auth, struct rpc_cred *cred)
+{
+        struct auth_cred *acred = &container_of(cred, struct generic_cred,
+                                                gc_base)->acred;
+        struct rpc_cred *tcred;
+        int ret = 0;
+
+
+        /* Fast track for non crkey_timeout (no key) underlying credentials */
+        if (test_bit(RPC_CRED_NO_CRKEY_TIMEOUT, &acred->ac_flags))
+                return 0;
+
+        /* Fast track for the normal case */
+        if (test_bit(RPC_CRED_NOTIFY_TIMEOUT, &acred->ac_flags))
+                return 0;
+
+        /* lookup_cred either returns a valid referenced rpc_cred, or PTR_ERR */
+        tcred = auth->au_ops->lookup_cred(auth, acred, 0);
+        if (IS_ERR(tcred))
+                return -EACCES;
+
+        if (!tcred->cr_ops->crkey_timeout) {
+                set_bit(RPC_CRED_NO_CRKEY_TIMEOUT, &acred->ac_flags);
+                ret = 0;
+                goto out_put;
+        }
+
+        /* Test for the almost error case */
+        ret = tcred->cr_ops->crkey_timeout(tcred);
+        if (ret != 0) {
+                set_bit(RPC_CRED_KEY_EXPIRE_SOON, &acred->ac_flags);
+                ret = 0;
+        } else {
+                /* In case underlying cred key has been reset */
+                if (test_and_clear_bit(RPC_CRED_KEY_EXPIRE_SOON,
+                                        &acred->ac_flags))
+                        dprintk("RPC:        UID %d Credential key reset\n",
+                                from_kuid(&init_user_ns, tcred->cr_uid));
+                /* set up fasttrack for the normal case */
+                set_bit(RPC_CRED_NOTIFY_TIMEOUT, &acred->ac_flags);
+        }
+
+out_put:
+        put_rpccred(tcred);
+        return ret;
+}
+
 static const struct rpc_authops generic_auth_ops = {
         .owner = THIS_MODULE,
         .au_name = "Generic",
         .lookup_cred = generic_lookup_cred,
         .crcreate = generic_create_cred,
+        .key_timeout = generic_key_timeout,
 };
 
 static struct rpc_auth generic_auth = {
@@ -194,9 +262,23 @@ static struct rpc_auth generic_auth = {
         .au_count = ATOMIC_INIT(0),
 };
 
+static bool generic_key_to_expire(struct rpc_cred *cred)
+{
+        struct auth_cred *acred = &container_of(cred, struct generic_cred,
+                                                gc_base)->acred;
+        bool ret;
+
+        get_rpccred(cred);
+        ret = test_bit(RPC_CRED_KEY_EXPIRE_SOON, &acred->ac_flags);
+        put_rpccred(cred);
+
+        return ret;
+}
+
 static const struct rpc_credops generic_credops = {
         .cr_name = "Generic cred",
         .crdestroy = generic_destroy_cred,
         .crbind = generic_bind_cred,
         .crmatch = generic_match,
+        .crkey_to_expire = generic_key_to_expire,
 };
diff --git a/net/sunrpc/auth_gss/auth_gss.c b/net/sunrpc/auth_gss/auth_gss.c
index fc2f78d6a9b4..084656671d6e 100644
--- a/net/sunrpc/auth_gss/auth_gss.c
+++ b/net/sunrpc/auth_gss/auth_gss.c
@@ -51,6 +51,7 @@
 #include <linux/sunrpc/rpc_pipe_fs.h>
 #include <linux/sunrpc/gss_api.h>
 #include <asm/uaccess.h>
+#include <linux/hashtable.h>
 
 #include "../netns.h"
 
@@ -62,6 +63,9 @@ static const struct rpc_credops gss_nullops;
 #define GSS_RETRY_EXPIRED 5
 static unsigned int gss_expired_cred_retry_delay = GSS_RETRY_EXPIRED;
 
+#define GSS_KEY_EXPIRE_TIMEO 240
+static unsigned int gss_key_expire_timeo = GSS_KEY_EXPIRE_TIMEO;
+
 #ifdef RPC_DEBUG
 # define RPCDBG_FACILITY        RPCDBG_AUTH
 #endif
@@ -71,19 +75,33 @@ static unsigned int gss_expired_cred_retry_delay = GSS_RETRY_EXPIRED;
  * using integrity (two 4-byte integers): */
 #define GSS_VERF_SLACK          100
 
+static DEFINE_HASHTABLE(gss_auth_hash_table, 4);
+static DEFINE_SPINLOCK(gss_auth_hash_lock);
+
+struct gss_pipe {
+        struct rpc_pipe_dir_object pdo;
+        struct rpc_pipe *pipe;
+        struct rpc_clnt *clnt;
+        const char *name;
+        struct kref kref;
+};
+
 struct gss_auth {
         struct kref kref;
+        struct hlist_node hash;
         struct rpc_auth rpc_auth;
         struct gss_api_mech *mech;
         enum rpc_gss_svc service;
         struct rpc_clnt *client;
+        struct net *net;
         /*
          * There are two upcall pipes; dentry[1], named "gssd", is used
          * for the new text-based upcall; dentry[0] is named after the
          * mechanism (for example, "krb5") and exists for
          * backwards-compatibility with older gssd's.
          */
-        struct rpc_pipe *pipe[2];
+        struct gss_pipe *gss_pipe[2];
+        const char *target_name;
 };
 
 /* pipe_version >= 0 if and only if someone has a pipe open. */
@@ -294,7 +312,7 @@ static void put_pipe_version(struct net *net)
 static void
 gss_release_msg(struct gss_upcall_msg *gss_msg)
 {
-        struct net *net = rpc_net_ns(gss_msg->auth->client);
+        struct net *net = gss_msg->auth->net;
         if (!atomic_dec_and_test(&gss_msg->count))
                 return;
         put_pipe_version(net);
@@ -406,8 +424,8 @@ static void gss_encode_v0_msg(struct gss_upcall_msg *gss_msg)
 }
 
 static void gss_encode_v1_msg(struct gss_upcall_msg *gss_msg,
-                                struct rpc_clnt *clnt,
-                                const char *service_name)
+                                const char *service_name,
+                                const char *target_name)
 {
         struct gss_api_mech *mech = gss_msg->auth->mech;
         char *p = gss_msg->databuf;
@@ -417,8 +435,8 @@ static void gss_encode_v1_msg(struct gss_upcall_msg *gss_msg,
                                    mech->gm_name,
                                    from_kuid(&init_user_ns, gss_msg->uid));
         p += gss_msg->msg.len;
-        if (clnt->cl_principal) {
-                len = sprintf(p, "target=%s ", clnt->cl_principal);
+        if (target_name) {
+                len = sprintf(p, "target=%s ", target_name);
                 p += len;
                 gss_msg->msg.len += len;
         }
@@ -439,21 +457,8 @@ static void gss_encode_v1_msg(struct gss_upcall_msg *gss_msg,
         BUG_ON(gss_msg->msg.len > UPCALL_BUF_LEN);
 }
 
-static void gss_encode_msg(struct gss_upcall_msg *gss_msg,
-                                struct rpc_clnt *clnt,
-                                const char *service_name)
-{
-        struct net *net = rpc_net_ns(clnt);
-        struct sunrpc_net *sn = net_generic(net, sunrpc_net_id);
-
-        if (sn->pipe_version == 0)
-                gss_encode_v0_msg(gss_msg);
-        else /* pipe_version == 1 */
-                gss_encode_v1_msg(gss_msg, clnt, service_name);
-}
-
 static struct gss_upcall_msg *
-gss_alloc_msg(struct gss_auth *gss_auth, struct rpc_clnt *clnt,
+gss_alloc_msg(struct gss_auth *gss_auth,
                 kuid_t uid, const char *service_name)
 {
         struct gss_upcall_msg *gss_msg;
@@ -462,31 +467,36 @@ gss_alloc_msg(struct gss_auth *gss_auth, struct rpc_clnt *clnt,
         gss_msg = kzalloc(sizeof(*gss_msg), GFP_NOFS);
         if (gss_msg == NULL)
                 return ERR_PTR(-ENOMEM);
-        vers = get_pipe_version(rpc_net_ns(clnt));
+        vers = get_pipe_version(gss_auth->net);
         if (vers < 0) {
                 kfree(gss_msg);
                 return ERR_PTR(vers);
         }
-        gss_msg->pipe = gss_auth->pipe[vers];
+        gss_msg->pipe = gss_auth->gss_pipe[vers]->pipe;
         INIT_LIST_HEAD(&gss_msg->list);
         rpc_init_wait_queue(&gss_msg->rpc_waitqueue, "RPCSEC_GSS upcall waitq");
         init_waitqueue_head(&gss_msg->waitqueue);
         atomic_set(&gss_msg->count, 1);
         gss_msg->uid = uid;
         gss_msg->auth = gss_auth;
-        gss_encode_msg(gss_msg, clnt, service_name);
+        switch (vers) {
+        case 0:
+                gss_encode_v0_msg(gss_msg);
+        default:
+                gss_encode_v1_msg(gss_msg, service_name, gss_auth->target_name);
+        };
         return gss_msg;
 }
 
 static struct gss_upcall_msg *
-gss_setup_upcall(struct rpc_clnt *clnt, struct gss_auth *gss_auth, struct rpc_cred *cred)
+gss_setup_upcall(struct gss_auth *gss_auth, struct rpc_cred *cred)
 {
         struct gss_cred *gss_cred = container_of(cred,
                         struct gss_cred, gc_base);
         struct gss_upcall_msg *gss_new, *gss_msg;
         kuid_t uid = cred->cr_uid;
 
-        gss_new = gss_alloc_msg(gss_auth, clnt, uid, gss_cred->gc_principal);
+        gss_new = gss_alloc_msg(gss_auth, uid, gss_cred->gc_principal);
         if (IS_ERR(gss_new))
                 return gss_new;
         gss_msg = gss_add_msg(gss_new);
@@ -527,7 +537,7 @@ gss_refresh_upcall(struct rpc_task *task)
 
         dprintk("RPC: %5u %s for uid %u\n",
                 task->tk_pid, __func__, from_kuid(&init_user_ns, cred->cr_uid));
-        gss_msg = gss_setup_upcall(task->tk_client, gss_auth, cred);
+        gss_msg = gss_setup_upcall(gss_auth, cred);
         if (PTR_ERR(gss_msg) == -EAGAIN) {
                 /* XXX: warning on the first, under the assumption we
                  * shouldn't normally hit this case on a refresh. */
@@ -566,7 +576,7 @@ out:
 static inline int
 gss_create_upcall(struct gss_auth *gss_auth, struct gss_cred *gss_cred)
 {
-        struct net *net = rpc_net_ns(gss_auth->client);
+        struct net *net = gss_auth->net;
         struct sunrpc_net *sn = net_generic(net, sunrpc_net_id);
         struct rpc_pipe *pipe;
         struct rpc_cred *cred = &gss_cred->gc_base;
@@ -583,7 +593,7 @@ retry:
         timeout = 15 * HZ;
         if (!sn->gssd_running)
                 timeout = HZ >> 2;
-        gss_msg = gss_setup_upcall(gss_auth->client, gss_auth, cred);
+        gss_msg = gss_setup_upcall(gss_auth, cred);
         if (PTR_ERR(gss_msg) == -EAGAIN) {
                 err = wait_event_interruptible_timeout(pipe_version_waitqueue,
                                 sn->pipe_version >= 0, timeout);
@@ -797,83 +807,153 @@ gss_pipe_destroy_msg(struct rpc_pipe_msg *msg)
         }
 }
 
-static void gss_pipes_dentries_destroy(struct rpc_auth *auth)
+static void gss_pipe_dentry_destroy(struct dentry *dir,
+                struct rpc_pipe_dir_object *pdo)
 {
-        struct gss_auth *gss_auth;
+        struct gss_pipe *gss_pipe = pdo->pdo_data;
+        struct rpc_pipe *pipe = gss_pipe->pipe;
 
-        gss_auth = container_of(auth, struct gss_auth, rpc_auth);
-        if (gss_auth->pipe[0]->dentry)
-                rpc_unlink(gss_auth->pipe[0]->dentry);
-        if (gss_auth->pipe[1]->dentry)
-                rpc_unlink(gss_auth->pipe[1]->dentry);
+        if (pipe->dentry != NULL) {
+                rpc_unlink(pipe->dentry);
+                pipe->dentry = NULL;
+        }
 }
 
-static int gss_pipes_dentries_create(struct rpc_auth *auth)
+static int gss_pipe_dentry_create(struct dentry *dir,
+                struct rpc_pipe_dir_object *pdo)
 {
-        int err;
-        struct gss_auth *gss_auth;
-        struct rpc_clnt *clnt;
+        struct gss_pipe *p = pdo->pdo_data;
+        struct dentry *dentry;
 
-        gss_auth = container_of(auth, struct gss_auth, rpc_auth);
-        clnt = gss_auth->client;
-
-        gss_auth->pipe[1]->dentry = rpc_mkpipe_dentry(clnt->cl_dentry,
-                                                      "gssd",
-                                                      clnt, gss_auth->pipe[1]);
-        if (IS_ERR(gss_auth->pipe[1]->dentry))
-                return PTR_ERR(gss_auth->pipe[1]->dentry);
-        gss_auth->pipe[0]->dentry = rpc_mkpipe_dentry(clnt->cl_dentry,
-                                                      gss_auth->mech->gm_name,
-                                                      clnt, gss_auth->pipe[0]);
-        if (IS_ERR(gss_auth->pipe[0]->dentry)) {
-                err = PTR_ERR(gss_auth->pipe[0]->dentry);
-                goto err_unlink_pipe_1;
-        }
+        dentry = rpc_mkpipe_dentry(dir, p->name, p->clnt, p->pipe);
+        if (IS_ERR(dentry))
+                return PTR_ERR(dentry);
+        p->pipe->dentry = dentry;
         return 0;
+}
 
-err_unlink_pipe_1:
-        rpc_unlink(gss_auth->pipe[1]->dentry);
-        return err;
+static const struct rpc_pipe_dir_object_ops gss_pipe_dir_object_ops = {
+        .create = gss_pipe_dentry_create,
+        .destroy = gss_pipe_dentry_destroy,
+};
+
+static struct gss_pipe *gss_pipe_alloc(struct rpc_clnt *clnt,
+                const char *name,
+                const struct rpc_pipe_ops *upcall_ops)
+{
+        struct gss_pipe *p;
+        int err = -ENOMEM;
+
+        p = kmalloc(sizeof(*p), GFP_KERNEL);
+        if (p == NULL)
+                goto err;
+        p->pipe = rpc_mkpipe_data(upcall_ops, RPC_PIPE_WAIT_FOR_OPEN);
+        if (IS_ERR(p->pipe)) {
+                err = PTR_ERR(p->pipe);
+                goto err_free_gss_pipe;
+        }
+        p->name = name;
+        p->clnt = clnt;
+        kref_init(&p->kref);
+        rpc_init_pipe_dir_object(&p->pdo,
+                        &gss_pipe_dir_object_ops,
+                        p);
+        return p;
+err_free_gss_pipe:
+        kfree(p);
+err:
+        return ERR_PTR(err);
+}
+
+struct gss_alloc_pdo {
+        struct rpc_clnt *clnt;
+        const char *name;
+        const struct rpc_pipe_ops *upcall_ops;
+};
+
+static int gss_pipe_match_pdo(struct rpc_pipe_dir_object *pdo, void *data)
+{
+        struct gss_pipe *gss_pipe;
+        struct gss_alloc_pdo *args = data;
+
+        if (pdo->pdo_ops != &gss_pipe_dir_object_ops)
+                return 0;
+        gss_pipe = container_of(pdo, struct gss_pipe, pdo);
+        if (strcmp(gss_pipe->name, args->name) != 0)
+                return 0;
+        if (!kref_get_unless_zero(&gss_pipe->kref))
+                return 0;
+        return 1;
+}
+
+static struct rpc_pipe_dir_object *gss_pipe_alloc_pdo(void *data)
+{
+        struct gss_pipe *gss_pipe;
+        struct gss_alloc_pdo *args = data;
+
+        gss_pipe = gss_pipe_alloc(args->clnt, args->name, args->upcall_ops);
+        if (!IS_ERR(gss_pipe))
+                return &gss_pipe->pdo;
+        return NULL;
 }
 
-static void gss_pipes_dentries_destroy_net(struct rpc_clnt *clnt,
-                                           struct rpc_auth *auth)
+static struct gss_pipe *gss_pipe_get(struct rpc_clnt *clnt,
+                const char *name,
+                const struct rpc_pipe_ops *upcall_ops)
 {
         struct net *net = rpc_net_ns(clnt);
-        struct super_block *sb;
+        struct rpc_pipe_dir_object *pdo;
+        struct gss_alloc_pdo args = {
+                .clnt = clnt,
+                .name = name,
+                .upcall_ops = upcall_ops,
+        };
 
-        sb = rpc_get_sb_net(net);
-        if (sb) {
-                if (clnt->cl_dentry)
-                        gss_pipes_dentries_destroy(auth);
-                rpc_put_sb_net(net);
-        }
+        pdo = rpc_find_or_alloc_pipe_dir_object(net,
+                        &clnt->cl_pipedir_objects,
+                        gss_pipe_match_pdo,
+                        gss_pipe_alloc_pdo,
+                        &args);
+        if (pdo != NULL)
+                return container_of(pdo, struct gss_pipe, pdo);
+        return ERR_PTR(-ENOMEM);
 }
 
-static int gss_pipes_dentries_create_net(struct rpc_clnt *clnt,
-                                         struct rpc_auth *auth)
+static void __gss_pipe_free(struct gss_pipe *p)
 {
+        struct rpc_clnt *clnt = p->clnt;
         struct net *net = rpc_net_ns(clnt);
-        struct super_block *sb;
-        int err = 0;
 
-        sb = rpc_get_sb_net(net);
-        if (sb) {
-                if (clnt->cl_dentry)
-                        err = gss_pipes_dentries_create(auth);
-                rpc_put_sb_net(net);
-        }
-        return err;
+        rpc_remove_pipe_dir_object(net,
+                        &clnt->cl_pipedir_objects,
+                        &p->pdo);
+        rpc_destroy_pipe_data(p->pipe);
+        kfree(p);
+}
+
+static void __gss_pipe_release(struct kref *kref)
+{
+        struct gss_pipe *p = container_of(kref, struct gss_pipe, kref);
+
+        __gss_pipe_free(p);
+}
+
+static void gss_pipe_free(struct gss_pipe *p)
+{
+        if (p != NULL)
+                kref_put(&p->kref, __gss_pipe_release);
 }
 
 /*
  * NOTE: we have the opportunity to use different
  * parameters based on the input flavor (which must be a pseudoflavor)
  */
-static struct rpc_auth *
-gss_create(struct rpc_clnt *clnt, rpc_authflavor_t flavor)
+static struct gss_auth *
+gss_create_new(struct rpc_auth_create_args *args, struct rpc_clnt *clnt)
 {
+        rpc_authflavor_t flavor = args->pseudoflavor;
         struct gss_auth *gss_auth;
+        struct gss_pipe *gss_pipe;
         struct rpc_auth * auth;
         int err = -ENOMEM; /* XXX? */
 
@@ -883,12 +963,20 @@ gss_create(struct rpc_clnt *clnt, rpc_authflavor_t flavor)
                 return ERR_PTR(err);
         if (!(gss_auth = kmalloc(sizeof(*gss_auth), GFP_KERNEL)))
                 goto out_dec;
+        INIT_HLIST_NODE(&gss_auth->hash);
+        gss_auth->target_name = NULL;
+        if (args->target_name) {
+                gss_auth->target_name = kstrdup(args->target_name, GFP_KERNEL);
+                if (gss_auth->target_name == NULL)
+                        goto err_free;
+        }
         gss_auth->client = clnt;
+        gss_auth->net = get_net(rpc_net_ns(clnt));
         err = -EINVAL;
         gss_auth->mech = gss_mech_get_by_pseudoflavor(flavor);
         if (!gss_auth->mech) {
                 dprintk("RPC:       Pseudoflavor %d not found!\n", flavor);
-                goto err_free;
+                goto err_put_net;
         }
         gss_auth->service = gss_pseudoflavor_to_service(gss_auth->mech, flavor);
         if (gss_auth->service == 0)
@@ -901,42 +989,41 @@ gss_create(struct rpc_clnt *clnt, rpc_authflavor_t flavor)
         atomic_set(&auth->au_count, 1);
         kref_init(&gss_auth->kref);
 
+        err = rpcauth_init_credcache(auth);
+        if (err)
+                goto err_put_mech;
         /*
          * Note: if we created the old pipe first, then someone who
          * examined the directory at the right moment might conclude
          * that we supported only the old pipe.  So we instead create
          * the new pipe first.
          */
-        gss_auth->pipe[1] = rpc_mkpipe_data(&gss_upcall_ops_v1,
-                                            RPC_PIPE_WAIT_FOR_OPEN);
-        if (IS_ERR(gss_auth->pipe[1])) {
-                err = PTR_ERR(gss_auth->pipe[1]);
-                goto err_put_mech;
+        gss_pipe = gss_pipe_get(clnt, "gssd", &gss_upcall_ops_v1);
+        if (IS_ERR(gss_pipe)) {
+                err = PTR_ERR(gss_pipe);
+                goto err_destroy_credcache;
         }
+        gss_auth->gss_pipe[1] = gss_pipe;
 
-        gss_auth->pipe[0] = rpc_mkpipe_data(&gss_upcall_ops_v0,
-                                            RPC_PIPE_WAIT_FOR_OPEN);
-        if (IS_ERR(gss_auth->pipe[0])) {
-                err = PTR_ERR(gss_auth->pipe[0]);
+        gss_pipe = gss_pipe_get(clnt, gss_auth->mech->gm_name,
+                        &gss_upcall_ops_v0);
+        if (IS_ERR(gss_pipe)) {
+                err = PTR_ERR(gss_pipe);
                 goto err_destroy_pipe_1;
         }
-        err = gss_pipes_dentries_create_net(clnt, auth);
-        if (err)
-                goto err_destroy_pipe_0;
-        err = rpcauth_init_credcache(auth);
-        if (err)
-                goto err_unlink_pipes;
+        gss_auth->gss_pipe[0] = gss_pipe;
 
-        return auth;
-err_unlink_pipes:
-        gss_pipes_dentries_destroy_net(clnt, auth);
-err_destroy_pipe_0:
-        rpc_destroy_pipe_data(gss_auth->pipe[0]);
+        return gss_auth;
 err_destroy_pipe_1:
-        rpc_destroy_pipe_data(gss_auth->pipe[1]);
+        gss_pipe_free(gss_auth->gss_pipe[1]);
+err_destroy_credcache:
+        rpcauth_destroy_credcache(auth);
 err_put_mech:
         gss_mech_put(gss_auth->mech);
+err_put_net:
+        put_net(gss_auth->net);
 err_free:
+        kfree(gss_auth->target_name);
         kfree(gss_auth);
 out_dec:
         module_put(THIS_MODULE);
@@ -946,10 +1033,11 @@ out_dec:
 static void
 gss_free(struct gss_auth *gss_auth)
 {
-        gss_pipes_dentries_destroy_net(gss_auth->client, &gss_auth->rpc_auth);
-        rpc_destroy_pipe_data(gss_auth->pipe[0]);
-        rpc_destroy_pipe_data(gss_auth->pipe[1]);
+        gss_pipe_free(gss_auth->gss_pipe[0]);
+        gss_pipe_free(gss_auth->gss_pipe[1]);
         gss_mech_put(gss_auth->mech);
+        put_net(gss_auth->net);
+        kfree(gss_auth->target_name);
 
         kfree(gss_auth);
         module_put(THIS_MODULE);
@@ -966,18 +1054,113 @@ gss_free_callback(struct kref *kref)
 static void
 gss_destroy(struct rpc_auth *auth)
 {
-        struct gss_auth *gss_auth;
+        struct gss_auth *gss_auth = container_of(auth,
+                        struct gss_auth, rpc_auth);
 
         dprintk("RPC:       destroying GSS authenticator %p flavor %d\n",
                         auth, auth->au_flavor);
 
+        if (hash_hashed(&gss_auth->hash)) {
+                spin_lock(&gss_auth_hash_lock);
+                hash_del(&gss_auth->hash);
+                spin_unlock(&gss_auth_hash_lock);
+        }
+
+        gss_pipe_free(gss_auth->gss_pipe[0]);
+        gss_auth->gss_pipe[0] = NULL;
+        gss_pipe_free(gss_auth->gss_pipe[1]);
+        gss_auth->gss_pipe[1] = NULL;
         rpcauth_destroy_credcache(auth);
 
-        gss_auth = container_of(auth, struct gss_auth, rpc_auth);
         kref_put(&gss_auth->kref, gss_free_callback);
 }
 
 /*
+ * Auths may be shared between rpc clients that were cloned from a
+ * common client with the same xprt, if they also share the flavor and
+ * target_name.
+ *
+ * The auth is looked up from the oldest parent sharing the same
+ * cl_xprt, and the auth itself references only that common parent
+ * (which is guaranteed to last as long as any of its descendants).
+ */
+static struct gss_auth *
+gss_auth_find_or_add_hashed(struct rpc_auth_create_args *args,
+                struct rpc_clnt *clnt,
+                struct gss_auth *new)
+{
+        struct gss_auth *gss_auth;
+        unsigned long hashval = (unsigned long)clnt;
+
+        spin_lock(&gss_auth_hash_lock);
+        hash_for_each_possible(gss_auth_hash_table,
+                        gss_auth,
+                        hash,
+                        hashval) {
+                if (gss_auth->client != clnt)
+                        continue;
+                if (gss_auth->rpc_auth.au_flavor != args->pseudoflavor)
+                        continue;
+                if (gss_auth->target_name != args->target_name) {
+                        if (gss_auth->target_name == NULL)
+                                continue;
+                        if (args->target_name == NULL)
+                                continue;
+                        if (strcmp(gss_auth->target_name, args->target_name))
+                                continue;
+                }
+                if (!atomic_inc_not_zero(&gss_auth->rpc_auth.au_count))
+                        continue;
+                goto out;
+        }
+        if (new)
+                hash_add(gss_auth_hash_table, &new->hash, hashval);
+        gss_auth = new;
+out:
+        spin_unlock(&gss_auth_hash_lock);
+        return gss_auth;
+}
+
+static struct gss_auth *
+gss_create_hashed(struct rpc_auth_create_args *args, struct rpc_clnt *clnt)
+{
+        struct gss_auth *gss_auth;
+        struct gss_auth *new;
+
+        gss_auth = gss_auth_find_or_add_hashed(args, clnt, NULL);
+        if (gss_auth != NULL)
+                goto out;
+        new = gss_create_new(args, clnt);
+        if (IS_ERR(new))
+                return new;
+        gss_auth = gss_auth_find_or_add_hashed(args, clnt, new);
+        if (gss_auth != new)
+                gss_destroy(&new->rpc_auth);
+out:
+        return gss_auth;
+}
+
+static struct rpc_auth *
+gss_create(struct rpc_auth_create_args *args, struct rpc_clnt *clnt)
+{
+        struct gss_auth *gss_auth;
+        struct rpc_xprt *xprt = rcu_access_pointer(clnt->cl_xprt);
+
+        while (clnt != clnt->cl_parent) {
+                struct rpc_clnt *parent = clnt->cl_parent;
+                /* Find the original parent for this transport */
+                if (rcu_access_pointer(parent->cl_xprt) != xprt)
+                        break;
+                clnt = parent;
+        }
+
+        gss_auth = gss_create_hashed(args, clnt);
+        if (IS_ERR(gss_auth))
+                return ERR_CAST(gss_auth);
+        return &gss_auth->rpc_auth;
+}
+
+/*
  * gss_destroying_context will cause the RPCSEC_GSS to send a NULL RPC call
  * to the server with the GSS control procedure field set to
  * RPC_GSS_PROC_DESTROY. This should normally cause the server to release
@@ -1126,10 +1309,32 @@ gss_cred_init(struct rpc_auth *auth, struct rpc_cred *cred)
         return err;
 }
 
+/*
+ * Returns -EACCES if GSS context is NULL or will expire within the
+ * timeout (miliseconds)
+ */
+static int
+gss_key_timeout(struct rpc_cred *rc)
+{
+        struct gss_cred *gss_cred = container_of(rc, struct gss_cred, gc_base);
+        unsigned long now = jiffies;
+        unsigned long expire;
+
+        if (gss_cred->gc_ctx == NULL)
+                return -EACCES;
+
+        expire = gss_cred->gc_ctx->gc_expiry - (gss_key_expire_timeo * HZ);
+
+        if (time_after(now, expire))
+                return -EACCES;
+        return 0;
+}
+
 static int
 gss_match(struct auth_cred *acred, struct rpc_cred *rc, int flags)
 {
         struct gss_cred *gss_cred = container_of(rc, struct gss_cred, gc_base);
+        int ret;
 
         if (test_bit(RPCAUTH_CRED_NEW, &rc->cr_flags))
                 goto out;
@@ -1142,11 +1347,26 @@ out:
         if (acred->principal != NULL) {
                 if (gss_cred->gc_principal == NULL)
                         return 0;
-                return strcmp(acred->principal, gss_cred->gc_principal) == 0;
+                ret = strcmp(acred->principal, gss_cred->gc_principal) == 0;
+                goto check_expire;
         }
         if (gss_cred->gc_principal != NULL)
                 return 0;
-        return uid_eq(rc->cr_uid, acred->uid);
+        ret = uid_eq(rc->cr_uid, acred->uid);
+
+check_expire:
+        if (ret == 0)
+                return ret;
+
+        /* Notify acred users of GSS context expiration timeout */
+        if (test_bit(RPC_CRED_NOTIFY_TIMEOUT, &acred->ac_flags) &&
+            (gss_key_timeout(rc) != 0)) {
+                /* test will now be done from generic cred */
+                test_and_clear_bit(RPC_CRED_NOTIFY_TIMEOUT, &acred->ac_flags);
+                /* tell NFS layer that key will expire soon */
+                set_bit(RPC_CRED_KEY_EXPIRE_SOON, &acred->ac_flags);
+        }
+        return ret;
 }
 
 /*
@@ -1292,6 +1512,7 @@ gss_validate(struct rpc_task *task, __be32 *p)
         struct xdr_netobj mic;
         u32             flav,len;
         u32             maj_stat;
+        __be32          *ret = ERR_PTR(-EIO);
 
         dprintk("RPC: %5u %s\n", task->tk_pid, __func__);
 
@@ -1307,6 +1528,7 @@ gss_validate(struct rpc_task *task, __be32 *p)
         mic.data = (u8 *)p;
         mic.len = len;
 
+        ret = ERR_PTR(-EACCES);
         maj_stat = gss_verify_mic(ctx->gc_gss_ctx, &verf_buf, &mic);
         if (maj_stat == GSS_S_CONTEXT_EXPIRED)
                 clear_bit(RPCAUTH_CRED_UPTODATE, &cred->cr_flags);
@@ -1324,8 +1546,9 @@ gss_validate(struct rpc_task *task, __be32 *p)
         return p + XDR_QUADLEN(len);
 out_bad:
         gss_put_ctx(ctx);
-        dprintk("RPC: %5u %s failed.\n", task->tk_pid, __func__);
-        return NULL;
+        dprintk("RPC: %5u %s failed ret %ld.\n", task->tk_pid, __func__,
+                PTR_ERR(ret));
+        return ret;
 }
 
 static void gss_wrap_req_encode(kxdreproc_t encode, struct rpc_rqst *rqstp,
@@ -1657,8 +1880,6 @@ static const struct rpc_authops authgss_ops = {
         .destroy        = gss_destroy,
         .lookup_cred    = gss_lookup_cred,
         .crcreate       = gss_create_cred,
-        .pipes_create   = gss_pipes_dentries_create,
-        .pipes_destroy  = gss_pipes_dentries_destroy,
         .list_pseudoflavors = gss_mech_list_pseudoflavors,
         .info2flavor    = gss_mech_info2flavor,
         .flavor2info    = gss_mech_flavor2info,
@@ -1675,6 +1896,7 @@ static const struct rpc_credops gss_credops = {
         .crvalidate     = gss_validate,
         .crwrap_req     = gss_wrap_req,
         .crunwrap_resp  = gss_unwrap_resp,
+        .crkey_timeout  = gss_key_timeout,
 };
 
 static const struct rpc_credops gss_nullops = {
@@ -1762,5 +1984,12 @@ module_param_named(expired_cred_retry_delay,
 MODULE_PARM_DESC(expired_cred_retry_delay, "Timeout (in seconds) until "
                 "the RPC engine retries an expired credential");
 
+module_param_named(key_expire_timeo,
+                   gss_key_expire_timeo,
+                   uint, 0644);
+MODULE_PARM_DESC(key_expire_timeo, "Time (in seconds) at the end of a "
+                "credential keys lifetime where the NFS layer cleans up "
+                "prior to key expiration");
+
 module_init(init_rpcsec_gss)
 module_exit(exit_rpcsec_gss)
diff --git a/net/sunrpc/auth_gss/gss_mech_switch.c b/net/sunrpc/auth_gss/gss_mech_switch.c
index defa9d33925c..27ce26240932 100644
--- a/net/sunrpc/auth_gss/gss_mech_switch.c
+++ b/net/sunrpc/auth_gss/gss_mech_switch.c
@@ -139,11 +139,12 @@ void gss_mech_unregister(struct gss_api_mech *gm)
 }
 EXPORT_SYMBOL_GPL(gss_mech_unregister);
 
-static struct gss_api_mech *gss_mech_get(struct gss_api_mech *gm)
+struct gss_api_mech *gss_mech_get(struct gss_api_mech *gm)
 {
         __module_get(gm->gm_owner);
         return gm;
 }
+EXPORT_SYMBOL(gss_mech_get);
 
 static struct gss_api_mech *
 _gss_mech_get_by_name(const char *name)
@@ -360,6 +361,7 @@ gss_pseudoflavor_to_service(struct gss_api_mech *gm, u32 pseudoflavor)
         }
         return 0;
 }
+EXPORT_SYMBOL(gss_pseudoflavor_to_service);
 
 char *
 gss_service_to_auth_domain_name(struct gss_api_mech *gm, u32 service)
@@ -379,6 +381,7 @@ gss_mech_put(struct gss_api_mech * gm)
         if (gm)
                 module_put(gm->gm_owner);
 }
+EXPORT_SYMBOL(gss_mech_put);
 
 /* The mech could probably be determined from the token instead, but it's just
  * as easy for now to pass it in. */
diff --git a/net/sunrpc/auth_gss/gss_rpc_upcall.c b/net/sunrpc/auth_gss/gss_rpc_upcall.c
index d304f41260f2..f1eb0d16666c 100644
--- a/net/sunrpc/auth_gss/gss_rpc_upcall.c
+++ b/net/sunrpc/auth_gss/gss_rpc_upcall.c
@@ -120,7 +120,7 @@ static int gssp_rpc_create(struct net *net, struct rpc_clnt **_clnt)
         if (IS_ERR(clnt)) {
                 dprintk("RPC:       failed to create AF_LOCAL gssproxy "
                                 "client (errno %ld).\n", PTR_ERR(clnt));
-                result = -PTR_ERR(clnt);
+                result = PTR_ERR(clnt);
                 *_clnt = NULL;
                 goto out;
         }
@@ -213,6 +213,26 @@ static int gssp_call(struct net *net, struct rpc_message *msg)
         return status;
 }
 
+static void gssp_free_receive_pages(struct gssx_arg_accept_sec_context *arg)
+{
+        int i;
+
+        for (i = 0; i < arg->npages && arg->pages[i]; i++)
+                __free_page(arg->pages[i]);
+}
+
+static int gssp_alloc_receive_pages(struct gssx_arg_accept_sec_context *arg)
+{
+        arg->npages = DIV_ROUND_UP(NGROUPS_MAX * 4, PAGE_SIZE);
+        arg->pages = kzalloc(arg->npages * sizeof(struct page *), GFP_KERNEL);
+        /*
+         * XXX: actual pages are allocated by xdr layer in
+         * xdr_partial_copy_from_skb.
+         */
+        if (!arg->pages)
+                return -ENOMEM;
+        return 0;
+}
 
 /*
  * Public functions
@@ -261,10 +281,16 @@ int gssp_accept_sec_context_upcall(struct net *net,
                 arg.context_handle = &ctxh;
         res.output_token->len = GSSX_max_output_token_sz;
 
+        ret = gssp_alloc_receive_pages(&arg);
+        if (ret)
+                return ret;
+
         /* use nfs/ for targ_name ? */
 
         ret = gssp_call(net, &msg);
 
+        gssp_free_receive_pages(&arg);
+
         /* we need to fetch all data even in case of error so
          * that we can free special strctures is they have been allocated */
         data->major_status = res.status.major_status;
@@ -328,7 +354,6 @@ void gssp_free_upcall_data(struct gssp_upcall_data *data)
         kfree(data->in_handle.data);
         kfree(data->out_handle.data);
         kfree(data->out_token.data);
-        kfree(data->mech_oid.data);
         free_svc_cred(&data->creds);
 }
 
diff --git a/net/sunrpc/auth_gss/gss_rpc_xdr.c b/net/sunrpc/auth_gss/gss_rpc_xdr.c
index 357f613df7ff..f0f78c5f1c7d 100644
--- a/net/sunrpc/auth_gss/gss_rpc_xdr.c
+++ b/net/sunrpc/auth_gss/gss_rpc_xdr.c
@@ -166,14 +166,15 @@ static int dummy_dec_opt_array(struct xdr_stream *xdr,
         return 0;
 }
 
-static int get_s32(void **p, void *max, s32 *res)
+static int get_host_u32(struct xdr_stream *xdr, u32 *res)
 {
-        void *base = *p;
-        void *next = (void *)((char *)base + sizeof(s32));
-        if (unlikely(next > max || next < base))
+        __be32 *p;
+
+        p = xdr_inline_decode(xdr, 4);
+        if (!p)
                 return -EINVAL;
-        memcpy(res, base, sizeof(s32));
-        *p = next;
+        /* Contents of linux creds are all host-endian: */
+        memcpy(res, p, sizeof(u32));
         return 0;
 }
 
@@ -182,9 +183,9 @@ static int gssx_dec_linux_creds(struct xdr_stream *xdr,
 {
         u32 length;
         __be32 *p;
-        void *q, *end;
-        s32 tmp;
-        int N, i, err;
+        u32 tmp;
+        u32 N;
+        int i, err;
 
         p = xdr_inline_decode(xdr, 4);
         if (unlikely(p == NULL))
@@ -192,33 +193,28 @@ static int gssx_dec_linux_creds(struct xdr_stream *xdr,
 
         length = be32_to_cpup(p);
 
-        /* FIXME: we do not want to use the scratch buffer for this one
-         * may need to use functions that allows us to access an io vector
-         * directly */
-        p = xdr_inline_decode(xdr, length);
-        if (unlikely(p == NULL))
+        if (length > (3 + NGROUPS_MAX) * sizeof(u32))
                 return -ENOSPC;
 
-        q = p;
-        end = q + length;
-
         /* uid */
-        err = get_s32(&q, end, &tmp);
+        err = get_host_u32(xdr, &tmp);
         if (err)
                 return err;
         creds->cr_uid = make_kuid(&init_user_ns, tmp);
 
         /* gid */
-        err = get_s32(&q, end, &tmp);
+        err = get_host_u32(xdr, &tmp);
         if (err)
                 return err;
         creds->cr_gid = make_kgid(&init_user_ns, tmp);
 
         /* number of additional gid's */
-        err = get_s32(&q, end, &tmp);
+        err = get_host_u32(xdr, &tmp);
         if (err)
                 return err;
         N = tmp;
+        if ((3 + N) * sizeof(u32) != length)
+                return -EINVAL;
         creds->cr_group_info = groups_alloc(N);
         if (creds->cr_group_info == NULL)
                 return -ENOMEM;
@@ -226,7 +222,7 @@ static int gssx_dec_linux_creds(struct xdr_stream *xdr,
         /* gid's */
         for (i = 0; i < N; i++) {
                 kgid_t kgid;
-                err = get_s32(&q, end, &tmp);
+                err = get_host_u32(xdr, &tmp);
                 if (err)
                         goto out_free_groups;
                 err = -EINVAL;
@@ -430,7 +426,7 @@ static int dummy_enc_nameattr_array(struct xdr_stream *xdr,
 static int dummy_dec_nameattr_array(struct xdr_stream *xdr,
                                     struct gssx_name_attr_array *naa)
 {
-        struct gssx_name_attr dummy;
+        struct gssx_name_attr dummy = { .attr = {.len = 0} };
         u32 count, i;
         __be32 *p;
 
@@ -493,12 +489,13 @@ static int gssx_enc_name(struct xdr_stream *xdr,
         return err;
 }
 
+
 static int gssx_dec_name(struct xdr_stream *xdr,
                          struct gssx_name *name)
 {
-        struct xdr_netobj dummy_netobj;
-        struct gssx_name_attr_array dummy_name_attr_array;
-        struct gssx_option_array dummy_option_array;
+        struct xdr_netobj dummy_netobj = { .len = 0 };
+        struct gssx_name_attr_array dummy_name_attr_array = { .count = 0 };
+        struct gssx_option_array dummy_option_array = { .count = 0 };
         int err;
 
         /* name->display_name */
@@ -783,6 +780,9 @@ void gssx_enc_accept_sec_context(struct rpc_rqst *req,
         /* arg->options */
         err = dummy_enc_opt_array(xdr, &arg->options);
 
+        xdr_inline_pages(&req->rq_rcv_buf,
+                PAGE_SIZE/2 /* pretty arbitrary */,
+                arg->pages, 0 /* page base */, arg->npages * PAGE_SIZE);
 done:
         if (err)
                 dprintk("RPC:       gssx_enc_accept_sec_context: %d\n", err);
diff --git a/net/sunrpc/auth_gss/gss_rpc_xdr.h b/net/sunrpc/auth_gss/gss_rpc_xdr.h
index 1c98b27d870c..685a688f3d8a 100644
--- a/net/sunrpc/auth_gss/gss_rpc_xdr.h
+++ b/net/sunrpc/auth_gss/gss_rpc_xdr.h
@@ -147,6 +147,8 @@ struct gssx_arg_accept_sec_context {
         struct gssx_cb *input_cb;
         u32 ret_deleg_cred;
         struct gssx_option_array options;
+        struct page **pages;
+        unsigned int npages;
 };
 
 struct gssx_res_accept_sec_context {
@@ -240,7 +242,8 @@ int gssx_dec_accept_sec_context(struct rpc_rqst *rqstp,
                              2 * GSSX_max_princ_sz + \
                              8 + 8 + 4 + 4 + 4)
 #define GSSX_max_output_token_sz 1024
-#define GSSX_max_creds_sz (4 + 4 + 4 + NGROUPS_MAX * 4)
+/* grouplist not included; we allocate separate pages for that: */
+#define GSSX_max_creds_sz (4 + 4 + 4 /* + NGROUPS_MAX*4 */)
 #define GSSX_RES_accept_sec_context_sz (GSSX_default_status_sz + \
                                         GSSX_default_ctx_sz + \
                                         GSSX_max_output_token_sz + \
diff --git a/net/sunrpc/auth_gss/svcauth_gss.c b/net/sunrpc/auth_gss/svcauth_gss.c
index 29b4ba93ab3c..09fb638bcaa4 100644
--- a/net/sunrpc/auth_gss/svcauth_gss.c
+++ b/net/sunrpc/auth_gss/svcauth_gss.c
@@ -377,8 +377,7 @@ rsc_init(struct cache_head *cnew, struct cache_head *ctmp)
         new->handle.data = tmp->handle.data;
         tmp->handle.data = NULL;
         new->mechctx = NULL;
-        new->cred.cr_group_info = NULL;
-        new->cred.cr_principal = NULL;
+        init_svc_cred(&new->cred);
 }
 
 static void
@@ -392,9 +391,7 @@ update_rsc(struct cache_head *cnew, struct cache_head *ctmp)
         memset(&new->seqdata, 0, sizeof(new->seqdata));
         spin_lock_init(&new->seqdata.sd_lock);
         new->cred = tmp->cred;
-        tmp->cred.cr_group_info = NULL;
-        new->cred.cr_principal = tmp->cred.cr_principal;
-        tmp->cred.cr_principal = NULL;
+        init_svc_cred(&tmp->cred);
 }
 
 static struct cache_head *
@@ -487,7 +484,7 @@ static int rsc_parse(struct cache_detail *cd,
                 len = qword_get(&mesg, buf, mlen);
                 if (len < 0)
                         goto out;
-                gm = gss_mech_get_by_name(buf);
+                gm = rsci.cred.cr_gss_mech = gss_mech_get_by_name(buf);
                 status = -EOPNOTSUPP;
                 if (!gm)
                         goto out;
@@ -517,7 +514,6 @@ static int rsc_parse(struct cache_detail *cd,
         rscp = rsc_update(cd, &rsci, rscp);
         status = 0;
 out:
-        gss_mech_put(gm);
         rsc_free(&rsci);
         if (rscp)
                 cache_put(&rscp->h, cd);
@@ -1184,6 +1180,7 @@ static int gss_proxy_save_rsc(struct cache_detail *cd,
                 gm = gss_mech_get_by_OID(&ud->mech_oid);
                 if (!gm)
                         goto out;
+                rsci.cred.cr_gss_mech = gm;
 
                 status = -EINVAL;
                 /* mech-specific data: */
@@ -1199,7 +1196,6 @@ static int gss_proxy_save_rsc(struct cache_detail *cd,
         rscp = rsc_update(cd, &rsci, rscp);
         status = 0;
 out:
-        gss_mech_put(gm);
         rsc_free(&rsci);
         if (rscp)
                 cache_put(&rscp->h, cd);
@@ -1330,7 +1326,7 @@ static int wait_for_gss_proxy(struct net *net, struct file *file)
 static ssize_t write_gssp(struct file *file, const char __user *buf,
                          size_t count, loff_t *ppos)
 {
-        struct net *net = PDE_DATA(file->f_path.dentry->d_inode);
+        struct net *net = PDE_DATA(file_inode(file));
         char tbuf[20];
         unsigned long i;
         int res;
@@ -1358,7 +1354,7 @@ static ssize_t write_gssp(struct file *file, const char __user *buf,
 static ssize_t read_gssp(struct file *file, char __user *buf,
                          size_t count, loff_t *ppos)
 {
-        struct net *net = PDE_DATA(file->f_path.dentry->d_inode);
+        struct net *net = PDE_DATA(file_inode(file));
         unsigned long p = *ppos;
         char tbuf[10];
         size_t len;
diff --git a/net/sunrpc/auth_null.c b/net/sunrpc/auth_null.c
index a5c36c01707b..f0ebe07978a2 100644
--- a/net/sunrpc/auth_null.c
+++ b/net/sunrpc/auth_null.c
@@ -18,7 +18,7 @@ static struct rpc_auth null_auth;
 static struct rpc_cred null_cred;
 
 static struct rpc_auth *
-nul_create(struct rpc_clnt *clnt, rpc_authflavor_t flavor)
+nul_create(struct rpc_auth_create_args *args, struct rpc_clnt *clnt)
 {
         atomic_inc(&null_auth.au_count);
         return &null_auth;
@@ -88,13 +88,13 @@ nul_validate(struct rpc_task *task, __be32 *p)
         flavor = ntohl(*p++);
         if (flavor != RPC_AUTH_NULL) {
                 printk("RPC: bad verf flavor: %u\n", flavor);
-                return NULL;
+                return ERR_PTR(-EIO);
         }
 
         size = ntohl(*p++);
         if (size != 0) {
                 printk("RPC: bad verf size: %u\n", size);
-                return NULL;
+                return ERR_PTR(-EIO);
         }
 
         return p;
diff --git a/net/sunrpc/auth_unix.c b/net/sunrpc/auth_unix.c
index dc37021fc3e5..d5d692366294 100644
--- a/net/sunrpc/auth_unix.c
+++ b/net/sunrpc/auth_unix.c
@@ -33,7 +33,7 @@ static struct rpc_auth		unix_auth;
 static const struct rpc_credops unix_credops;
 
 static struct rpc_auth *
-unx_create(struct rpc_clnt *clnt, rpc_authflavor_t flavor)
+unx_create(struct rpc_auth_create_args *args, struct rpc_clnt *clnt)
 {
         dprintk("RPC:       creating UNIX authenticator for client %p\n",
                         clnt);
@@ -192,13 +192,13 @@ unx_validate(struct rpc_task *task, __be32 *p)
             flavor != RPC_AUTH_UNIX &&
             flavor != RPC_AUTH_SHORT) {
                 printk("RPC: bad verf flavor: %u\n", flavor);
-                return NULL;
+                return ERR_PTR(-EIO);
         }
 
         size = ntohl(*p++);
         if (size > RPC_MAX_AUTH_SIZE) {
                 printk("RPC: giant verf size: %u\n", size);
-                return NULL;
+                return ERR_PTR(-EIO);
         }
         task->tk_rqstp->rq_cred->cr_auth->au_rslack = (size >> 2) + 2;
         p += (size >> 2);
diff --git a/net/sunrpc/cache.c b/net/sunrpc/cache.c
index 80fe5c86efd1..a72de074172d 100644
--- a/net/sunrpc/cache.c
+++ b/net/sunrpc/cache.c
@@ -50,12 +50,6 @@ static void cache_init(struct cache_head *h)
         h->last_refresh = now;
 }
 
-static inline int cache_is_expired(struct cache_detail *detail, struct cache_head *h)
-{
-        return  (h->expiry_time < seconds_since_boot()) ||
-                (detail->flush_time > h->last_refresh);
-}
-
 struct cache_head *sunrpc_cache_lookup(struct cache_detail *detail,
                                        struct cache_head *key, int hash)
 {
@@ -201,7 +195,7 @@ static int cache_make_upcall(struct cache_detail *cd, struct cache_head *h)
         return sunrpc_cache_pipe_upcall(cd, h);
 }
 
-static inline int cache_is_valid(struct cache_detail *detail, struct cache_head *h)
+static inline int cache_is_valid(struct cache_head *h)
 {
         if (!test_bit(CACHE_VALID, &h->flags))
                 return -EAGAIN;
@@ -227,16 +221,15 @@ static int try_to_negate_entry(struct cache_detail *detail, struct cache_head *h
         int rv;
 
         write_lock(&detail->hash_lock);
-        rv = cache_is_valid(detail, h);
-        if (rv != -EAGAIN) {
-                write_unlock(&detail->hash_lock);
-                return rv;
+        rv = cache_is_valid(h);
+        if (rv == -EAGAIN) {
+                set_bit(CACHE_NEGATIVE, &h->flags);
+                cache_fresh_locked(h, seconds_since_boot()+CACHE_NEW_EXPIRY);
+                rv = -ENOENT;
         }
-        set_bit(CACHE_NEGATIVE, &h->flags);
-        cache_fresh_locked(h, seconds_since_boot()+CACHE_NEW_EXPIRY);
         write_unlock(&detail->hash_lock);
         cache_fresh_unlocked(h, detail);
-        return -ENOENT;
+        return rv;
 }
 
 /*
@@ -260,7 +253,7 @@ int cache_check(struct cache_detail *detail,
         long refresh_age, age;
 
         /* First decide return status as best we can */
-        rv = cache_is_valid(detail, h);
+        rv = cache_is_valid(h);
 
         /* now see if we want to start an upcall */
         refresh_age = (h->expiry_time - h->last_refresh);
@@ -269,19 +262,17 @@ int cache_check(struct cache_detail *detail,
         if (rqstp == NULL) {
                 if (rv == -EAGAIN)
                         rv = -ENOENT;
-        } else if (rv == -EAGAIN || age > refresh_age/2) {
+        } else if (rv == -EAGAIN ||
+                   (h->expiry_time != 0 && age > refresh_age/2)) {
                 dprintk("RPC:       Want update, refage=%ld, age=%ld\n",
                                 refresh_age, age);
                 if (!test_and_set_bit(CACHE_PENDING, &h->flags)) {
                         switch (cache_make_upcall(detail, h)) {
                         case -EINVAL:
-                                clear_bit(CACHE_PENDING, &h->flags);
-                                cache_revisit_request(h);
                                 rv = try_to_negate_entry(detail, h);
                                 break;
                         case -EAGAIN:
-                                clear_bit(CACHE_PENDING, &h->flags);
-                                cache_revisit_request(h);
+                                cache_fresh_unlocked(h, detail);
                                 break;
                         }
                 }
@@ -293,7 +284,7 @@ int cache_check(struct cache_detail *detail,
                          * Request was not deferred; handle it as best
                          * we can ourselves:
                          */
-                        rv = cache_is_valid(detail, h);
+                        rv = cache_is_valid(h);
                         if (rv == -EAGAIN)
                                 rv = -ETIMEDOUT;
                 }
@@ -310,7 +301,7 @@ EXPORT_SYMBOL_GPL(cache_check);
  * a current pointer into that list and into the table
  * for that entry.
  *
- * Each time clean_cache is called it finds the next non-empty entry
+ * Each time cache_clean is called it finds the next non-empty entry
  * in the current table and walks the list in that entry
  * looking for entries that can be removed.
  *
@@ -457,9 +448,8 @@ static int cache_clean(void)
                         current_index ++;
                 spin_unlock(&cache_list_lock);
                 if (ch) {
-                        if (test_and_clear_bit(CACHE_PENDING, &ch->flags))
-                                cache_dequeue(current_detail, ch);
-                        cache_revisit_request(ch);
+                        set_bit(CACHE_CLEANED, &ch->flags);
+                        cache_fresh_unlocked(ch, d);
                         cache_put(ch, d);
                 }
         } else
@@ -1036,23 +1026,32 @@ static int cache_release(struct inode *inode, struct file *filp,
 
 static void cache_dequeue(struct cache_detail *detail, struct cache_head *ch)
 {
-        struct cache_queue *cq;
+        struct cache_queue *cq, *tmp;
+        struct cache_request *cr;
+        struct list_head dequeued;
+
+        INIT_LIST_HEAD(&dequeued);
         spin_lock(&queue_lock);
-        list_for_each_entry(cq, &detail->queue, list)
+        list_for_each_entry_safe(cq, tmp, &detail->queue, list)
                 if (!cq->reader) {
-                        struct cache_request *cr = container_of(cq, struct cache_request, q);
+                        cr = container_of(cq, struct cache_request, q);
                         if (cr->item != ch)
                                 continue;
+                        if (test_bit(CACHE_PENDING, &ch->flags))
+                                /* Lost a race and it is pending again */
+                                break;
                         if (cr->readers != 0)
                                 continue;
-                        list_del(&cr->q.list);
-                        spin_unlock(&queue_lock);
-                        cache_put(cr->item, detail);
-                        kfree(cr->buf);
-                        kfree(cr);
-                        return;
+                        list_move(&cr->q.list, &dequeued);
                 }
         spin_unlock(&queue_lock);
+        while (!list_empty(&dequeued)) {
+                cr = list_entry(dequeued.next, struct cache_request, q.list);
+                list_del(&cr->q.list);
+                cache_put(cr->item, detail);
+                kfree(cr->buf);
+                kfree(cr);
+        }
 }
 
 /*
@@ -1166,6 +1165,7 @@ int sunrpc_cache_pipe_upcall(struct cache_detail *detail, struct cache_head *h)
 
         char *buf;
         struct cache_request *crq;
+        int ret = 0;
 
         if (!detail->cache_request)
                 return -EINVAL;
@@ -1174,6 +1174,9 @@ int sunrpc_cache_pipe_upcall(struct cache_detail *detail, struct cache_head *h)
                 warn_no_listener(detail);
                 return -EINVAL;
         }
+        if (test_bit(CACHE_CLEANED, &h->flags))
+                /* Too late to make an upcall */
+                return -EAGAIN;
 
         buf = kmalloc(PAGE_SIZE, GFP_KERNEL);
         if (!buf)
@@ -1191,10 +1194,18 @@ int sunrpc_cache_pipe_upcall(struct cache_detail *detail, struct cache_head *h)
         crq->len = 0;
         crq->readers = 0;
         spin_lock(&queue_lock);
-        list_add_tail(&crq->q.list, &detail->queue);
+        if (test_bit(CACHE_PENDING, &h->flags))
+                list_add_tail(&crq->q.list, &detail->queue);
+        else
+                /* Lost a race, no longer PENDING, so don't enqueue */
+                ret = -EAGAIN;
         spin_unlock(&queue_lock);
         wake_up(&queue_wait);
-        return 0;
+        if (ret == -EAGAIN) {
+                kfree(buf);
+                kfree(crq);
+        }
+        return ret;
 }
 EXPORT_SYMBOL_GPL(sunrpc_cache_pipe_upcall);
 
@@ -1812,19 +1823,11 @@ int sunrpc_cache_register_pipefs(struct dentry *parent,
                                  const char *name, umode_t umode,
                                  struct cache_detail *cd)
 {
-        struct qstr q;
-        struct dentry *dir;
-        int ret = 0;
-
-        q.name = name;
-        q.len = strlen(name);
-        q.hash = full_name_hash(q.name, q.len);
-        dir = rpc_create_cache_dir(parent, &q, umode, cd);
-        if (!IS_ERR(dir))
-                cd->u.pipefs.dir = dir;
-        else
-                ret = PTR_ERR(dir);
-        return ret;
+        struct dentry *dir = rpc_create_cache_dir(parent, name, umode, cd);
+        if (IS_ERR(dir))
+                return PTR_ERR(dir);
+        cd->u.pipefs.dir = dir;
+        return 0;
 }
 EXPORT_SYMBOL_GPL(sunrpc_cache_register_pipefs);
 
diff --git a/net/sunrpc/clnt.c b/net/sunrpc/clnt.c
index 5a750b9c3640..77479606a971 100644
--- a/net/sunrpc/clnt.c
+++ b/net/sunrpc/clnt.c
@@ -102,12 +102,7 @@ static void rpc_unregister_client(struct rpc_clnt *clnt)
 
 static void __rpc_clnt_remove_pipedir(struct rpc_clnt *clnt)
 {
-        if (clnt->cl_dentry) {
-                if (clnt->cl_auth && clnt->cl_auth->au_ops->pipes_destroy)
-                        clnt->cl_auth->au_ops->pipes_destroy(clnt->cl_auth);
-                rpc_remove_client_dir(clnt->cl_dentry);
-        }
-        clnt->cl_dentry = NULL;
+        rpc_remove_client_dir(clnt);
 }
 
 static void rpc_clnt_remove_pipedir(struct rpc_clnt *clnt)
@@ -123,14 +118,12 @@ static void rpc_clnt_remove_pipedir(struct rpc_clnt *clnt)
 }
 
 static struct dentry *rpc_setup_pipedir_sb(struct super_block *sb,
-                                    struct rpc_clnt *clnt,
-                                    const char *dir_name)
+                                    struct rpc_clnt *clnt)
 {
         static uint32_t clntid;
+        const char *dir_name = clnt->cl_program->pipe_dir_name;
         char name[15];
-        struct qstr q = { .name = name };
         struct dentry *dir, *dentry;
-        int error;
 
         dir = rpc_d_lookup_sb(sb, dir_name);
         if (dir == NULL) {
@@ -138,50 +131,52 @@ static struct dentry *rpc_setup_pipedir_sb(struct super_block *sb,
                 return dir;
         }
         for (;;) {
-                q.len = snprintf(name, sizeof(name), "clnt%x", (unsigned int)clntid++);
+                snprintf(name, sizeof(name), "clnt%x", (unsigned int)clntid++);
                 name[sizeof(name) - 1] = '\0';
-                q.hash = full_name_hash(q.name, q.len);
-                dentry = rpc_create_client_dir(dir, &q, clnt);
+                dentry = rpc_create_client_dir(dir, name, clnt);
                 if (!IS_ERR(dentry))
                         break;
-                error = PTR_ERR(dentry);
-                if (error != -EEXIST) {
-                        printk(KERN_INFO "RPC: Couldn't create pipefs entry"
-                                        " %s/%s, error %d\n",
-                                        dir_name, name, error);
-                        break;
-                }
+                if (dentry == ERR_PTR(-EEXIST))
+                        continue;
+                printk(KERN_INFO "RPC: Couldn't create pipefs entry"
+                                " %s/%s, error %ld\n",
+                                dir_name, name, PTR_ERR(dentry));
+                break;
         }
         dput(dir);
         return dentry;
 }
 
 static int
-rpc_setup_pipedir(struct rpc_clnt *clnt, const char *dir_name)
+rpc_setup_pipedir(struct super_block *pipefs_sb, struct rpc_clnt *clnt)
 {
-        struct net *net = rpc_net_ns(clnt);
-        struct super_block *pipefs_sb;
         struct dentry *dentry;
 
-        clnt->cl_dentry = NULL;
-        if (dir_name == NULL)
-                return 0;
-        pipefs_sb = rpc_get_sb_net(net);
-        if (!pipefs_sb)
-                return 0;
-        dentry = rpc_setup_pipedir_sb(pipefs_sb, clnt, dir_name);
-        rpc_put_sb_net(net);
-        if (IS_ERR(dentry))
-                return PTR_ERR(dentry);
-        clnt->cl_dentry = dentry;
+        if (clnt->cl_program->pipe_dir_name != NULL) {
+                dentry = rpc_setup_pipedir_sb(pipefs_sb, clnt);
+                if (IS_ERR(dentry))
+                        return PTR_ERR(dentry);
+        }
         return 0;
 }
 
-static inline int rpc_clnt_skip_event(struct rpc_clnt *clnt, unsigned long event)
+static int rpc_clnt_skip_event(struct rpc_clnt *clnt, unsigned long event)
 {
-        if (((event == RPC_PIPEFS_MOUNT) && clnt->cl_dentry) ||
-            ((event == RPC_PIPEFS_UMOUNT) && !clnt->cl_dentry))
+        if (clnt->cl_program->pipe_dir_name == NULL)
                 return 1;
+
+        switch (event) {
+        case RPC_PIPEFS_MOUNT:
+                if (clnt->cl_pipedir_objects.pdh_dentry != NULL)
+                        return 1;
+                if (atomic_read(&clnt->cl_count) == 0)
+                        return 1;
+                break;
+        case RPC_PIPEFS_UMOUNT:
+                if (clnt->cl_pipedir_objects.pdh_dentry == NULL)
+                        return 1;
+                break;
+        }
         return 0;
 }
 
@@ -193,18 +188,11 @@ static int __rpc_clnt_handle_event(struct rpc_clnt *clnt, unsigned long event,
 
         switch (event) {
         case RPC_PIPEFS_MOUNT:
-                dentry = rpc_setup_pipedir_sb(sb, clnt,
-                                              clnt->cl_program->pipe_dir_name);
+                dentry = rpc_setup_pipedir_sb(sb, clnt);
                 if (!dentry)
                         return -ENOENT;
                 if (IS_ERR(dentry))
                         return PTR_ERR(dentry);
-                clnt->cl_dentry = dentry;
-                if (clnt->cl_auth->au_ops->pipes_create) {
-                        err = clnt->cl_auth->au_ops->pipes_create(clnt->cl_auth);
-                        if (err)
-                                __rpc_clnt_remove_pipedir(clnt);
-                }
                 break;
         case RPC_PIPEFS_UMOUNT:
                 __rpc_clnt_remove_pipedir(clnt);
@@ -237,12 +225,8 @@ static struct rpc_clnt *rpc_get_client_for_event(struct net *net, int event)
 
         spin_lock(&sn->rpc_client_lock);
         list_for_each_entry(clnt, &sn->all_clients, cl_clients) {
-                if (clnt->cl_program->pipe_dir_name == NULL)
-                        continue;
                 if (rpc_clnt_skip_event(clnt, event))
                         continue;
-                if (atomic_inc_not_zero(&clnt->cl_count) == 0)
-                        continue;
                 spin_unlock(&sn->rpc_client_lock);
                 return clnt;
         }
@@ -259,7 +243,6 @@ static int rpc_pipefs_event(struct notifier_block *nb, unsigned long event,
 
         while ((clnt = rpc_get_client_for_event(sb->s_fs_info, event))) {
                 error = __rpc_pipefs_event(clnt, event, sb);
-                rpc_release_client(clnt);
                 if (error)
                         break;
         }
@@ -289,12 +272,72 @@ static void rpc_clnt_set_nodename(struct rpc_clnt *clnt, const char *nodename)
         memcpy(clnt->cl_nodename, nodename, clnt->cl_nodelen);
 }
 
-static struct rpc_clnt * rpc_new_client(const struct rpc_create_args *args, struct rpc_xprt *xprt)
+static int rpc_client_register(const struct rpc_create_args *args,
+                               struct rpc_clnt *clnt)
+{
+        struct rpc_auth_create_args auth_args = {
+                .pseudoflavor = args->authflavor,
+                .target_name = args->client_name,
+        };
+        struct rpc_auth *auth;
+        struct net *net = rpc_net_ns(clnt);
+        struct super_block *pipefs_sb;
+        int err;
+
+        pipefs_sb = rpc_get_sb_net(net);
+        if (pipefs_sb) {
+                err = rpc_setup_pipedir(pipefs_sb, clnt);
+                if (err)
+                        goto out;
+        }
+
+        rpc_register_client(clnt);
+        if (pipefs_sb)
+                rpc_put_sb_net(net);
+
+        auth = rpcauth_create(&auth_args, clnt);
+        if (IS_ERR(auth)) {
+                dprintk("RPC:       Couldn't create auth handle (flavor %u)\n",
+                                args->authflavor);
+                err = PTR_ERR(auth);
+                goto err_auth;
+        }
+        return 0;
+err_auth:
+        pipefs_sb = rpc_get_sb_net(net);
+        rpc_unregister_client(clnt);
+        __rpc_clnt_remove_pipedir(clnt);
+out:
+        if (pipefs_sb)
+                rpc_put_sb_net(net);
+        return err;
+}
+
+static DEFINE_IDA(rpc_clids);
+
+static int rpc_alloc_clid(struct rpc_clnt *clnt)
+{
+        int clid;
+
+        clid = ida_simple_get(&rpc_clids, 0, 0, GFP_KERNEL);
+        if (clid < 0)
+                return clid;
+        clnt->cl_clid = clid;
+        return 0;
+}
+
+static void rpc_free_clid(struct rpc_clnt *clnt)
+{
+        ida_simple_remove(&rpc_clids, clnt->cl_clid);
+}
+
+static struct rpc_clnt * rpc_new_client(const struct rpc_create_args *args,
+                struct rpc_xprt *xprt,
+                struct rpc_clnt *parent)
 {
         const struct rpc_program *program = args->program;
         const struct rpc_version *version;
         struct rpc_clnt         *clnt = NULL;
-        struct rpc_auth         *auth;
         int err;
 
         /* sanity check the name before trying to print it */
@@ -316,16 +359,20 @@ static struct rpc_clnt * rpc_new_client(const struct rpc_create_args *args, stru
         clnt = kzalloc(sizeof(*clnt), GFP_KERNEL);
         if (!clnt)
                 goto out_err;
-        clnt->cl_parent = clnt;
+        clnt->cl_parent = parent ? : clnt;
+
+        err = rpc_alloc_clid(clnt);
+        if (err)
+                goto out_no_clid;
 
         rcu_assign_pointer(clnt->cl_xprt, xprt);
         clnt->cl_procinfo = version->procs;
         clnt->cl_maxproc  = version->nrprocs;
-        clnt->cl_protname = program->name;
         clnt->cl_prog     = args->prognumber ? : program->number;
         clnt->cl_vers     = version->number;
         clnt->cl_stats    = program->stats;
         clnt->cl_metrics  = rpc_alloc_iostats(clnt);
+        rpc_init_pipe_dir_head(&clnt->cl_pipedir_objects);
         err = -ENOMEM;
         if (clnt->cl_metrics == NULL)
                 goto out_no_stats;
@@ -345,39 +392,24 @@ static struct rpc_clnt * rpc_new_client(const struct rpc_create_args *args, stru
 
         clnt->cl_rtt = &clnt->cl_rtt_default;
         rpc_init_rtt(&clnt->cl_rtt_default, clnt->cl_timeout->to_initval);
-        clnt->cl_principal = NULL;
-        if (args->client_name) {
-                clnt->cl_principal = kstrdup(args->client_name, GFP_KERNEL);
-                if (!clnt->cl_principal)
-                        goto out_no_principal;
-        }
 
         atomic_set(&clnt->cl_count, 1);
 
-        err = rpc_setup_pipedir(clnt, program->pipe_dir_name);
-        if (err < 0)
-                goto out_no_path;
-
-        auth = rpcauth_create(args->authflavor, clnt);
-        if (IS_ERR(auth)) {
-                dprintk("RPC:       Couldn't create auth handle (flavor %u)\n",
-                                args->authflavor);
-                err = PTR_ERR(auth);
-                goto out_no_auth;
-        }
-
         /* save the nodename */
         rpc_clnt_set_nodename(clnt, utsname()->nodename);
-        rpc_register_client(clnt);
+
+        err = rpc_client_register(args, clnt);
+        if (err)
+                goto out_no_path;
+        if (parent)
+                atomic_inc(&parent->cl_count);
         return clnt;
 
-out_no_auth:
-        rpc_clnt_remove_pipedir(clnt);
 out_no_path:
-        kfree(clnt->cl_principal);
-out_no_principal:
         rpc_free_iostats(clnt->cl_metrics);
 out_no_stats:
+        rpc_free_clid(clnt);
+out_no_clid:
         kfree(clnt);
 out_err:
         rpciod_down();
@@ -463,7 +495,7 @@ struct rpc_clnt *rpc_create(struct rpc_create_args *args)
         if (args->flags & RPC_CLNT_CREATE_NONPRIVPORT)
                 xprt->resvport = 0;
 
-        clnt = rpc_new_client(args, xprt);
+        clnt = rpc_new_client(args, xprt, NULL);
         if (IS_ERR(clnt))
                 return clnt;
 
@@ -510,15 +542,12 @@ static struct rpc_clnt *__rpc_clone_client(struct rpc_create_args *args,
                 goto out_err;
         args->servername = xprt->servername;
 
-        new = rpc_new_client(args, xprt);
+        new = rpc_new_client(args, xprt, clnt);
         if (IS_ERR(new)) {
                 err = PTR_ERR(new);
                 goto out_err;
         }
 
-        atomic_inc(&clnt->cl_count);
-        new->cl_parent = clnt;
-
         /* Turn off autobind on clones */
         new->cl_autobind = 0;
         new->cl_softrtry = clnt->cl_softrtry;
@@ -545,7 +574,6 @@ struct rpc_clnt *rpc_clone_client(struct rpc_clnt *clnt)
                 .prognumber     = clnt->cl_prog,
                 .version        = clnt->cl_vers,
                 .authflavor     = clnt->cl_auth->au_flavor,
-                .client_name    = clnt->cl_principal,
         };
         return __rpc_clone_client(&args, clnt);
 }
@@ -567,7 +595,6 @@ rpc_clone_client_set_auth(struct rpc_clnt *clnt, rpc_authflavor_t flavor)
                 .prognumber     = clnt->cl_prog,
                 .version        = clnt->cl_vers,
                 .authflavor     = flavor,
-                .client_name    = clnt->cl_principal,
         };
         return __rpc_clone_client(&args, clnt);
 }
@@ -613,7 +640,7 @@ void rpc_shutdown_client(struct rpc_clnt *clnt)
         might_sleep();
 
         dprintk_rcu("RPC:       shutting down %s client for %s\n",
-                        clnt->cl_protname,
+                        clnt->cl_program->name,
                         rcu_dereference(clnt->cl_xprt)->servername);
 
         while (!list_empty(&clnt->cl_tasks)) {
@@ -633,17 +660,17 @@ static void
 rpc_free_client(struct rpc_clnt *clnt)
 {
         dprintk_rcu("RPC:       destroying %s client for %s\n",
-                        clnt->cl_protname,
+                        clnt->cl_program->name,
                         rcu_dereference(clnt->cl_xprt)->servername);
         if (clnt->cl_parent != clnt)
                 rpc_release_client(clnt->cl_parent);
-        rpc_unregister_client(clnt);
         rpc_clnt_remove_pipedir(clnt);
+        rpc_unregister_client(clnt);
         rpc_free_iostats(clnt->cl_metrics);
-        kfree(clnt->cl_principal);
         clnt->cl_metrics = NULL;
         xprt_put(rcu_dereference_raw(clnt->cl_xprt));
         rpciod_down();
+        rpc_free_clid(clnt);
         kfree(clnt);
 }
 
@@ -704,7 +731,6 @@ struct rpc_clnt *rpc_bind_new_program(struct rpc_clnt *old,
                 .prognumber     = program->number,
                 .version        = vers,
                 .authflavor     = old->cl_auth->au_flavor,
-                .client_name    = old->cl_principal,
         };
         struct rpc_clnt *clnt;
         int err;
@@ -1283,7 +1309,7 @@ call_start(struct rpc_task *task)
         struct rpc_clnt *clnt = task->tk_client;
 
         dprintk("RPC: %5u call_start %s%d proc %s (%s)\n", task->tk_pid,
-                        clnt->cl_protname, clnt->cl_vers,
+                        clnt->cl_program->name, clnt->cl_vers,
                         rpc_proc_name(task),
                         (RPC_IS_ASYNC(task) ? "async" : "sync"));
 
@@ -1407,9 +1433,9 @@ call_refreshresult(struct rpc_task *task)
                 return;
         case -ETIMEDOUT:
                 rpc_delay(task, 3*HZ);
-        case -EKEYEXPIRED:
         case -EAGAIN:
                 status = -EACCES;
+        case -EKEYEXPIRED:
                 if (!task->tk_cred_retry)
                         break;
                 task->tk_cred_retry--;
@@ -1644,6 +1670,10 @@ call_connect(struct rpc_task *task)
                 task->tk_action = call_connect_status;
                 if (task->tk_status < 0)
                         return;
+                if (task->tk_flags & RPC_TASK_NOCONNECT) {
+                        rpc_exit(task, -ENOTCONN);
+                        return;
+                }
                 xprt_connect(task);
         }
 }
@@ -1892,7 +1922,7 @@ call_status(struct rpc_task *task)
         default:
                 if (clnt->cl_chatty)
                         printk("%s: RPC call returned error %d\n",
-                               clnt->cl_protname, -status);
+                               clnt->cl_program->name, -status);
                 rpc_exit(task, status);
         }
 }
@@ -1923,7 +1953,7 @@ call_timeout(struct rpc_task *task)
                 if (clnt->cl_chatty) {
                         rcu_read_lock();
                         printk(KERN_NOTICE "%s: server %s not responding, timed out\n",
-                                clnt->cl_protname,
+                                clnt->cl_program->name,
                                 rcu_dereference(clnt->cl_xprt)->servername);
                         rcu_read_unlock();
                 }
@@ -1939,7 +1969,7 @@ call_timeout(struct rpc_task *task)
                 if (clnt->cl_chatty) {
                         rcu_read_lock();
                         printk(KERN_NOTICE "%s: server %s not responding, still trying\n",
-                        clnt->cl_protname,
+                        clnt->cl_program->name,
                         rcu_dereference(clnt->cl_xprt)->servername);
                         rcu_read_unlock();
                 }
@@ -1974,7 +2004,7 @@ call_decode(struct rpc_task *task)
                 if (clnt->cl_chatty) {
                         rcu_read_lock();
                         printk(KERN_NOTICE "%s: server %s OK\n",
-                                clnt->cl_protname,
+                                clnt->cl_program->name,
                                 rcu_dereference(clnt->cl_xprt)->servername);
                         rcu_read_unlock();
                 }
@@ -1999,7 +2029,7 @@ call_decode(struct rpc_task *task)
                         goto out_retry;
                 }
                 dprintk("RPC:       %s: too small RPC reply size (%d bytes)\n",
-                                clnt->cl_protname, task->tk_status);
+                                clnt->cl_program->name, task->tk_status);
                 task->tk_action = call_timeout;
                 goto out_retry;
         }
@@ -2071,7 +2101,8 @@ rpc_verify_header(struct rpc_task *task)
                 dprintk("RPC: %5u %s: XDR representation not a multiple of"
                        " 4 bytes: 0x%x\n", task->tk_pid, __func__,
                        task->tk_rqstp->rq_rcv_buf.len);
-                goto out_eio;
+                error = -EIO;
+                goto out_err;
         }
         if ((len -= 3) < 0)
                 goto out_overflow;
@@ -2080,6 +2111,7 @@ rpc_verify_header(struct rpc_task *task)
         if ((n = ntohl(*p++)) != RPC_REPLY) {
                 dprintk("RPC: %5u %s: not an RPC reply: %x\n",
                         task->tk_pid, __func__, n);
+                error = -EIO;
                 goto out_garbage;
         }
 
@@ -2098,7 +2130,8 @@ rpc_verify_header(struct rpc_task *task)
                         dprintk("RPC: %5u %s: RPC call rejected, "
                                 "unknown error: %x\n",
                                 task->tk_pid, __func__, n);
-                        goto out_eio;
+                        error = -EIO;
+                        goto out_err;
                 }
                 if (--len < 0)
                         goto out_overflow;
@@ -2143,9 +2176,11 @@ rpc_verify_header(struct rpc_task *task)
                                 task->tk_pid, __func__, n);
                 goto out_err;
         }
-        if (!(p = rpcauth_checkverf(task, p))) {
-                dprintk("RPC: %5u %s: auth check failed\n",
-                                task->tk_pid, __func__);
+        p = rpcauth_checkverf(task, p);
+        if (IS_ERR(p)) {
+                error = PTR_ERR(p);
+                dprintk("RPC: %5u %s: auth check failed with %d\n",
+                                task->tk_pid, __func__, error);
                 goto out_garbage;               /* bad verifier, retry */
         }
         len = p - (__be32 *)iov->iov_base - 1;
@@ -2198,8 +2233,6 @@ out_garbage:
 out_retry:
                 return ERR_PTR(-EAGAIN);
         }
-out_eio:
-        error = -EIO;
 out_err:
         rpc_exit(task, error);
         dprintk("RPC: %5u %s: call failed with error %d\n", task->tk_pid,
@@ -2271,7 +2304,7 @@ static void rpc_show_task(const struct rpc_clnt *clnt,
         printk(KERN_INFO "%5u %04x %6d %8p %8p %8ld %8p %sv%u %s a:%ps q:%s\n",
                 task->tk_pid, task->tk_flags, task->tk_status,
                 clnt, task->tk_rqstp, task->tk_timeout, task->tk_ops,
-                clnt->cl_protname, clnt->cl_vers, rpc_proc_name(task),
+                clnt->cl_program->name, clnt->cl_vers, rpc_proc_name(task),
                 task->tk_action, rpc_waitq);
 }
 
diff --git a/net/sunrpc/netns.h b/net/sunrpc/netns.h
index 74d948f5d5a1..779742cfc1ff 100644
--- a/net/sunrpc/netns.h
+++ b/net/sunrpc/netns.h
@@ -23,6 +23,7 @@ struct sunrpc_net {
         struct rpc_clnt *rpcb_local_clnt4;
         spinlock_t rpcb_clnt_lock;
         unsigned int rpcb_users;
+        unsigned int rpcb_is_af_local : 1;
 
         struct mutex gssp_lock;
         wait_queue_head_t gssp_wq;
diff --git a/net/sunrpc/rpc_pipe.c b/net/sunrpc/rpc_pipe.c
index e7ce4b3eb0bd..f94567b45bb3 100644
--- a/net/sunrpc/rpc_pipe.c
+++ b/net/sunrpc/rpc_pipe.c
@@ -409,7 +409,7 @@ rpc_show_info(struct seq_file *m, void *v)
         rcu_read_lock();
         seq_printf(m, "RPC server: %s\n",
                         rcu_dereference(clnt->cl_xprt)->servername);
-        seq_printf(m, "service: %s (%d) version %d\n", clnt->cl_protname,
+        seq_printf(m, "service: %s (%d) version %d\n", clnt->cl_program->name,
                         clnt->cl_prog, clnt->cl_vers);
         seq_printf(m, "address: %s\n", rpc_peeraddr2str(clnt, RPC_DISPLAY_ADDR));
         seq_printf(m, "protocol: %s\n", rpc_peeraddr2str(clnt, RPC_DISPLAY_PROTO));
@@ -656,20 +656,17 @@ static int __rpc_rmpipe(struct inode *dir, struct dentry *dentry)
 }
 
 static struct dentry *__rpc_lookup_create_exclusive(struct dentry *parent,
-                                          struct qstr *name)
+                                          const char *name)
 {
-        struct dentry *dentry;
-
-        dentry = d_lookup(parent, name);
+        struct qstr q = QSTR_INIT(name, strlen(name));
+        struct dentry *dentry = d_hash_and_lookup(parent, &q);
         if (!dentry) {
-                dentry = d_alloc(parent, name);
+                dentry = d_alloc(parent, &q);
                 if (!dentry)
                         return ERR_PTR(-ENOMEM);
         }
-        if (dentry->d_inode == NULL) {
-                d_set_d_op(dentry, &rpc_dentry_operations);
+        if (dentry->d_inode == NULL)
                 return dentry;
-        }
         dput(dentry);
         return ERR_PTR(-EEXIST);
 }
@@ -689,8 +686,7 @@ static void __rpc_depopulate(struct dentry *parent,
         for (i = start; i < eof; i++) {
                 name.name = files[i].name;
                 name.len = strlen(files[i].name);
-                name.hash = full_name_hash(name.name, name.len);
-                dentry = d_lookup(parent, &name);
+                dentry = d_hash_and_lookup(parent, &name);
 
                 if (dentry == NULL)
                         continue;
@@ -732,12 +728,7 @@ static int rpc_populate(struct dentry *parent,
 
         mutex_lock(&dir->i_mutex);
         for (i = start; i < eof; i++) {
-                struct qstr q;
-
-                q.name = files[i].name;
-                q.len = strlen(files[i].name);
-                q.hash = full_name_hash(q.name, q.len);
-                dentry = __rpc_lookup_create_exclusive(parent, &q);
+                dentry = __rpc_lookup_create_exclusive(parent, files[i].name);
                 err = PTR_ERR(dentry);
                 if (IS_ERR(dentry))
                         goto out_bad;
@@ -770,7 +761,7 @@ out_bad:
 }
 
 static struct dentry *rpc_mkdir_populate(struct dentry *parent,
-                struct qstr *name, umode_t mode, void *private,
+                const char *name, umode_t mode, void *private,
                 int (*populate)(struct dentry *, void *), void *args_populate)
 {
         struct dentry *dentry;
@@ -841,7 +832,6 @@ struct dentry *rpc_mkpipe_dentry(struct dentry *parent, const char *name,
         struct dentry *dentry;
         struct inode *dir = parent->d_inode;
         umode_t umode = S_IFIFO | S_IRUSR | S_IWUSR;
-        struct qstr q;
         int err;
 
         if (pipe->ops->upcall == NULL)
@@ -849,12 +839,8 @@ struct dentry *rpc_mkpipe_dentry(struct dentry *parent, const char *name,
         if (pipe->ops->downcall == NULL)
                 umode &= ~S_IWUGO;
 
-        q.name = name;
-        q.len = strlen(name);
-        q.hash = full_name_hash(q.name, q.len),
-
         mutex_lock_nested(&dir->i_mutex, I_MUTEX_PARENT);
-        dentry = __rpc_lookup_create_exclusive(parent, &q);
+        dentry = __rpc_lookup_create_exclusive(parent, name);
         if (IS_ERR(dentry))
                 goto out;
         err = __rpc_mkpipe_dentry(dir, dentry, umode, &rpc_pipe_fops,
@@ -898,6 +884,159 @@ rpc_unlink(struct dentry *dentry)
 }
 EXPORT_SYMBOL_GPL(rpc_unlink);
 
+/**
+ * rpc_init_pipe_dir_head - initialise a struct rpc_pipe_dir_head
+ * @pdh: pointer to struct rpc_pipe_dir_head
+ */
+void rpc_init_pipe_dir_head(struct rpc_pipe_dir_head *pdh)
+{
+        INIT_LIST_HEAD(&pdh->pdh_entries);
+        pdh->pdh_dentry = NULL;
+}
+EXPORT_SYMBOL_GPL(rpc_init_pipe_dir_head);
+
+/**
+ * rpc_init_pipe_dir_object - initialise a struct rpc_pipe_dir_object
+ * @pdo: pointer to struct rpc_pipe_dir_object
+ * @pdo_ops: pointer to const struct rpc_pipe_dir_object_ops
+ * @pdo_data: pointer to caller-defined data
+ */
+void rpc_init_pipe_dir_object(struct rpc_pipe_dir_object *pdo,
+                const struct rpc_pipe_dir_object_ops *pdo_ops,
+                void *pdo_data)
+{
+        INIT_LIST_HEAD(&pdo->pdo_head);
+        pdo->pdo_ops = pdo_ops;
+        pdo->pdo_data = pdo_data;
+}
+EXPORT_SYMBOL_GPL(rpc_init_pipe_dir_object);
+
+static int
+rpc_add_pipe_dir_object_locked(struct net *net,
+                struct rpc_pipe_dir_head *pdh,
+                struct rpc_pipe_dir_object *pdo)
+{
+        int ret = 0;
+
+        if (pdh->pdh_dentry)
+                ret = pdo->pdo_ops->create(pdh->pdh_dentry, pdo);
+        if (ret == 0)
+                list_add_tail(&pdo->pdo_head, &pdh->pdh_entries);
+        return ret;
+}
+
+static void
+rpc_remove_pipe_dir_object_locked(struct net *net,
+                struct rpc_pipe_dir_head *pdh,
+                struct rpc_pipe_dir_object *pdo)
+{
+        if (pdh->pdh_dentry)
+                pdo->pdo_ops->destroy(pdh->pdh_dentry, pdo);
+        list_del_init(&pdo->pdo_head);
+}
+
+/**
+ * rpc_add_pipe_dir_object - associate a rpc_pipe_dir_object to a directory
+ * @net: pointer to struct net
+ * @pdh: pointer to struct rpc_pipe_dir_head
+ * @pdo: pointer to struct rpc_pipe_dir_object
+ *
+ */
+int
+rpc_add_pipe_dir_object(struct net *net,
+                struct rpc_pipe_dir_head *pdh,
+                struct rpc_pipe_dir_object *pdo)
+{
+        int ret = 0;
+
+        if (list_empty(&pdo->pdo_head)) {
+                struct sunrpc_net *sn = net_generic(net, sunrpc_net_id);
+
+                mutex_lock(&sn->pipefs_sb_lock);
+                ret = rpc_add_pipe_dir_object_locked(net, pdh, pdo);
+                mutex_unlock(&sn->pipefs_sb_lock);
+        }
+        return ret;
+}
+EXPORT_SYMBOL_GPL(rpc_add_pipe_dir_object);
+
+/**
+ * rpc_remove_pipe_dir_object - remove a rpc_pipe_dir_object from a directory
+ * @net: pointer to struct net
+ * @pdh: pointer to struct rpc_pipe_dir_head
+ * @pdo: pointer to struct rpc_pipe_dir_object
+ *
+ */
+void
+rpc_remove_pipe_dir_object(struct net *net,
+                struct rpc_pipe_dir_head *pdh,
+                struct rpc_pipe_dir_object *pdo)
+{
+        if (!list_empty(&pdo->pdo_head)) {
+                struct sunrpc_net *sn = net_generic(net, sunrpc_net_id);
+
+                mutex_lock(&sn->pipefs_sb_lock);
+                rpc_remove_pipe_dir_object_locked(net, pdh, pdo);
+                mutex_unlock(&sn->pipefs_sb_lock);
+        }
+}
+EXPORT_SYMBOL_GPL(rpc_remove_pipe_dir_object);
+
+/**
+ * rpc_find_or_alloc_pipe_dir_object
+ * @net: pointer to struct net
+ * @pdh: pointer to struct rpc_pipe_dir_head
+ * @match: match struct rpc_pipe_dir_object to data
+ * @alloc: allocate a new struct rpc_pipe_dir_object
+ * @data: user defined data for match() and alloc()
+ *
+ */
+struct rpc_pipe_dir_object *
+rpc_find_or_alloc_pipe_dir_object(struct net *net,
+                struct rpc_pipe_dir_head *pdh,
+                int (*match)(struct rpc_pipe_dir_object *, void *),
+                struct rpc_pipe_dir_object *(*alloc)(void *),
+                void *data)
+{
+        struct sunrpc_net *sn = net_generic(net, sunrpc_net_id);
+        struct rpc_pipe_dir_object *pdo;
+
+        mutex_lock(&sn->pipefs_sb_lock);
+        list_for_each_entry(pdo, &pdh->pdh_entries, pdo_head) {
+                if (!match(pdo, data))
+                        continue;
+                goto out;
+        }
+        pdo = alloc(data);
+        if (!pdo)
+                goto out;
+        rpc_add_pipe_dir_object_locked(net, pdh, pdo);
+out:
+        mutex_unlock(&sn->pipefs_sb_lock);
+        return pdo;
+}
+EXPORT_SYMBOL_GPL(rpc_find_or_alloc_pipe_dir_object);
+
+static void
+rpc_create_pipe_dir_objects(struct rpc_pipe_dir_head *pdh)
+{
+        struct rpc_pipe_dir_object *pdo;
+        struct dentry *dir = pdh->pdh_dentry;
+
+        list_for_each_entry(pdo, &pdh->pdh_entries, pdo_head)
+                pdo->pdo_ops->create(dir, pdo);
+}
+
+static void
+rpc_destroy_pipe_dir_objects(struct rpc_pipe_dir_head *pdh)
+{
+        struct rpc_pipe_dir_object *pdo;
+        struct dentry *dir = pdh->pdh_dentry;
+
+        list_for_each_entry(pdo, &pdh->pdh_entries, pdo_head)
+                pdo->pdo_ops->destroy(dir, pdo);
+}
+
 enum {
         RPCAUTH_info,
         RPCAUTH_EOF
@@ -925,8 +1064,8 @@ static void rpc_clntdir_depopulate(struct dentry *dentry)
 
 /**
  * rpc_create_client_dir - Create a new rpc_client directory in rpc_pipefs
- * @dentry: dentry from the rpc_pipefs root to the new directory
- * @name: &struct qstr for the name
+ * @dentry: the parent of new directory
+ * @name: the name of new directory
  * @rpc_client: rpc client to associate with this directory
  *
  * This creates a directory at the given @path associated with
@@ -935,19 +1074,32 @@ static void rpc_clntdir_depopulate(struct dentry *dentry)
  * later be created using rpc_mkpipe().
  */
 struct dentry *rpc_create_client_dir(struct dentry *dentry,
-                                   struct qstr *name,
+                                   const char *name,
                                    struct rpc_clnt *rpc_client)
 {
-        return rpc_mkdir_populate(dentry, name, S_IRUGO | S_IXUGO, NULL,
+        struct dentry *ret;
+
+        ret = rpc_mkdir_populate(dentry, name, S_IRUGO | S_IXUGO, NULL,
                         rpc_clntdir_populate, rpc_client);
+        if (!IS_ERR(ret)) {
+                rpc_client->cl_pipedir_objects.pdh_dentry = ret;
+                rpc_create_pipe_dir_objects(&rpc_client->cl_pipedir_objects);
+        }
+        return ret;
 }
 
 /**
  * rpc_remove_client_dir - Remove a directory created with rpc_create_client_dir()
- * @dentry: dentry for the pipe
+ * @rpc_client: rpc_client for the pipe
  */
-int rpc_remove_client_dir(struct dentry *dentry)
+int rpc_remove_client_dir(struct rpc_clnt *rpc_client)
 {
+        struct dentry *dentry = rpc_client->cl_pipedir_objects.pdh_dentry;
+
+        if (dentry == NULL)
+                return 0;
+        rpc_destroy_pipe_dir_objects(&rpc_client->cl_pipedir_objects);
+        rpc_client->cl_pipedir_objects.pdh_dentry = NULL;
         return rpc_rmdir_depopulate(dentry, rpc_clntdir_depopulate);
 }
 
@@ -981,7 +1133,7 @@ static void rpc_cachedir_depopulate(struct dentry *dentry)
         rpc_depopulate(dentry, cache_pipefs_files, 0, 3);
 }
 
-struct dentry *rpc_create_cache_dir(struct dentry *parent, struct qstr *name,
+struct dentry *rpc_create_cache_dir(struct dentry *parent, const char *name,
                                     umode_t umode, struct cache_detail *cd)
 {
         return rpc_mkdir_populate(parent, name, umode, NULL,
@@ -1061,9 +1213,7 @@ struct dentry *rpc_d_lookup_sb(const struct super_block *sb,
                                const unsigned char *dir_name)
 {
         struct qstr dir = QSTR_INIT(dir_name, strlen(dir_name));
-
-        dir.hash = full_name_hash(dir.name, dir.len);
-        return d_lookup(sb->s_root, &dir);
+        return d_hash_and_lookup(sb->s_root, &dir);
 }
 EXPORT_SYMBOL_GPL(rpc_d_lookup_sb);
 
@@ -1116,6 +1266,7 @@ rpc_fill_super(struct super_block *sb, void *data, int silent)
         sb->s_blocksize_bits = PAGE_CACHE_SHIFT;
         sb->s_magic = RPCAUTH_GSSMAGIC;
         sb->s_op = &s_ops;
+        sb->s_d_op = &rpc_dentry_operations;
         sb->s_time_gran = 1;
 
         inode = rpc_get_inode(sb, S_IFDIR | S_IRUGO | S_IXUGO);
@@ -1126,6 +1277,7 @@ rpc_fill_super(struct super_block *sb, void *data, int silent)
                 return -ENOMEM;
         dprintk("RPC:       sending pipefs MOUNT notification for net %p%s\n",
                 net, NET_NAME(net));
+        mutex_lock(&sn->pipefs_sb_lock);
         sn->pipefs_sb = sb;
         err = blocking_notifier_call_chain(&rpc_pipefs_notifier_list,
                                            RPC_PIPEFS_MOUNT,
@@ -1133,6 +1285,7 @@ rpc_fill_super(struct super_block *sb, void *data, int silent)
         if (err)
                 goto err_depopulate;
         sb->s_fs_info = get_net(net);
+        mutex_unlock(&sn->pipefs_sb_lock);
         return 0;
 
 err_depopulate:
@@ -1141,6 +1294,7 @@ err_depopulate:
                                            sb);
         sn->pipefs_sb = NULL;
         __rpc_depopulate(root, files, RPCAUTH_lockd, RPCAUTH_RootEOF);
+        mutex_unlock(&sn->pipefs_sb_lock);
         return err;
 }
 
@@ -1162,12 +1316,12 @@ static void rpc_kill_sb(struct super_block *sb)
                 goto out;
         }
         sn->pipefs_sb = NULL;
-        mutex_unlock(&sn->pipefs_sb_lock);
         dprintk("RPC:       sending pipefs UMOUNT notification for net %p%s\n",
                 net, NET_NAME(net));
         blocking_notifier_call_chain(&rpc_pipefs_notifier_list,
                                            RPC_PIPEFS_UMOUNT,
                                            sb);
+        mutex_unlock(&sn->pipefs_sb_lock);
         put_net(net);
 out:
         kill_litter_super(sb);
diff --git a/net/sunrpc/rpcb_clnt.c b/net/sunrpc/rpcb_clnt.c
index 3df764dc330c..1891a1022c17 100644
--- a/net/sunrpc/rpcb_clnt.c
+++ b/net/sunrpc/rpcb_clnt.c
@@ -204,13 +204,15 @@ void rpcb_put_local(struct net *net)
 }
 
 static void rpcb_set_local(struct net *net, struct rpc_clnt *clnt,
-                        struct rpc_clnt *clnt4)
+                        struct rpc_clnt *clnt4,
+                        bool is_af_local)
 {
         struct sunrpc_net *sn = net_generic(net, sunrpc_net_id);
 
         /* Protected by rpcb_create_local_mutex */
         sn->rpcb_local_clnt = clnt;
         sn->rpcb_local_clnt4 = clnt4;
+        sn->rpcb_is_af_local = is_af_local ? 1 : 0;
         smp_wmb(); 
         sn->rpcb_users = 1;
         dprintk("RPC:       created new rpcb local clients (rpcb_local_clnt: "
@@ -238,6 +240,14 @@ static int rpcb_create_local_unix(struct net *net)
                 .program        = &rpcb_program,
                 .version        = RPCBVERS_2,
                 .authflavor     = RPC_AUTH_NULL,
+                /*
+                 * We turn off the idle timeout to prevent the kernel
+                 * from automatically disconnecting the socket.
+                 * Otherwise, we'd have to cache the mount namespace
+                 * of the caller and somehow pass that to the socket
+                 * reconnect code.
+                 */
+                .flags          = RPC_CLNT_CREATE_NO_IDLE_TIMEOUT,
         };
         struct rpc_clnt *clnt, *clnt4;
         int result = 0;
@@ -263,7 +273,7 @@ static int rpcb_create_local_unix(struct net *net)
                 clnt4 = NULL;
         }
 
-        rpcb_set_local(net, clnt, clnt4);
+        rpcb_set_local(net, clnt, clnt4, true);
 
 out:
         return result;
@@ -315,7 +325,7 @@ static int rpcb_create_local_net(struct net *net)
                 clnt4 = NULL;
         }
 
-        rpcb_set_local(net, clnt, clnt4);
+        rpcb_set_local(net, clnt, clnt4, false);
 
 out:
         return result;
@@ -376,13 +386,16 @@ static struct rpc_clnt *rpcb_create(struct net *net, const char *hostname,
         return rpc_create(&args);
 }
 
-static int rpcb_register_call(struct rpc_clnt *clnt, struct rpc_message *msg)
+static int rpcb_register_call(struct sunrpc_net *sn, struct rpc_clnt *clnt, struct rpc_message *msg, bool is_set)
 {
-        int result, error = 0;
+        int flags = RPC_TASK_NOCONNECT;
+        int error, result = 0;
 
+        if (is_set || !sn->rpcb_is_af_local)
+                flags = RPC_TASK_SOFTCONN;
         msg->rpc_resp = &result;
 
-        error = rpc_call_sync(clnt, msg, RPC_TASK_SOFTCONN);
+        error = rpc_call_sync(clnt, msg, flags);
         if (error < 0) {
                 dprintk("RPC:       failed to contact local rpcbind "
                                 "server (errno %d).\n", -error);
@@ -439,16 +452,19 @@ int rpcb_register(struct net *net, u32 prog, u32 vers, int prot, unsigned short
                 .rpc_argp       = &map,
         };
         struct sunrpc_net *sn = net_generic(net, sunrpc_net_id);
+        bool is_set = false;
 
         dprintk("RPC:       %sregistering (%u, %u, %d, %u) with local "
                         "rpcbind\n", (port ? "" : "un"),
                         prog, vers, prot, port);
 
         msg.rpc_proc = &rpcb_procedures2[RPCBPROC_UNSET];
-        if (port)
+        if (port != 0) {
                 msg.rpc_proc = &rpcb_procedures2[RPCBPROC_SET];
+                is_set = true;
+        }
 
-        return rpcb_register_call(sn->rpcb_local_clnt, &msg);
+        return rpcb_register_call(sn, sn->rpcb_local_clnt, &msg, is_set);
 }
 
 /*
@@ -461,6 +477,7 @@ static int rpcb_register_inet4(struct sunrpc_net *sn,
         const struct sockaddr_in *sin = (const struct sockaddr_in *)sap;
         struct rpcbind_args *map = msg->rpc_argp;
         unsigned short port = ntohs(sin->sin_port);
+        bool is_set = false;
         int result;
 
         map->r_addr = rpc_sockaddr2uaddr(sap, GFP_KERNEL);
@@ -471,10 +488,12 @@ static int rpcb_register_inet4(struct sunrpc_net *sn,
                         map->r_addr, map->r_netid);
 
         msg->rpc_proc = &rpcb_procedures4[RPCBPROC_UNSET];
-        if (port)
+        if (port != 0) {
                 msg->rpc_proc = &rpcb_procedures4[RPCBPROC_SET];
+                is_set = true;
+        }
 
-        result = rpcb_register_call(sn->rpcb_local_clnt4, msg);
+        result = rpcb_register_call(sn, sn->rpcb_local_clnt4, msg, is_set);
         kfree(map->r_addr);
         return result;
 }
@@ -489,6 +508,7 @@ static int rpcb_register_inet6(struct sunrpc_net *sn,
         const struct sockaddr_in6 *sin6 = (const struct sockaddr_in6 *)sap;
         struct rpcbind_args *map = msg->rpc_argp;
         unsigned short port = ntohs(sin6->sin6_port);
+        bool is_set = false;
         int result;
 
         map->r_addr = rpc_sockaddr2uaddr(sap, GFP_KERNEL);
@@ -499,10 +519,12 @@ static int rpcb_register_inet6(struct sunrpc_net *sn,
                         map->r_addr, map->r_netid);
 
         msg->rpc_proc = &rpcb_procedures4[RPCBPROC_UNSET];
-        if (port)
+        if (port != 0) {
                 msg->rpc_proc = &rpcb_procedures4[RPCBPROC_SET];
+                is_set = true;
+        }
 
-        result = rpcb_register_call(sn->rpcb_local_clnt4, msg);
+        result = rpcb_register_call(sn, sn->rpcb_local_clnt4, msg, is_set);
         kfree(map->r_addr);
         return result;
 }
@@ -519,7 +541,7 @@ static int rpcb_unregister_all_protofamilies(struct sunrpc_net *sn,
         map->r_addr = "";
         msg->rpc_proc = &rpcb_procedures4[RPCBPROC_UNSET];
 
-        return rpcb_register_call(sn->rpcb_local_clnt4, msg);
+        return rpcb_register_call(sn, sn->rpcb_local_clnt4, msg, false);
 }
 
 /**
diff --git a/net/sunrpc/sched.c b/net/sunrpc/sched.c
index 5356b120dbf8..ff3cc4bf4b24 100644
--- a/net/sunrpc/sched.c
+++ b/net/sunrpc/sched.c
@@ -254,11 +254,11 @@ static int rpc_wait_bit_killable(void *word)
 {
         if (fatal_signal_pending(current))
                 return -ERESTARTSYS;
-        freezable_schedule();
+        freezable_schedule_unsafe();
         return 0;
 }
 
-#ifdef RPC_DEBUG
+#if defined(RPC_DEBUG) || defined(RPC_TRACEPOINTS)
 static void rpc_task_set_debuginfo(struct rpc_task *task)
 {
         static atomic_t rpc_pid;
@@ -446,20 +446,6 @@ static void rpc_wake_up_task_queue_locked(struct rpc_wait_queue *queue, struct r
 }
 
 /*
- * Tests whether rpc queue is empty
- */
-int rpc_queue_empty(struct rpc_wait_queue *queue)
-{
-        int res;
-
-        spin_lock_bh(&queue->lock);
-        res = queue->qlen;
-        spin_unlock_bh(&queue->lock);
-        return res == 0;
-}
-EXPORT_SYMBOL_GPL(rpc_queue_empty);
-
-/*
  * Wake up a task on a specific queue
  */
 void rpc_wake_up_queued_task(struct rpc_wait_queue *queue, struct rpc_task *task)
@@ -804,7 +790,6 @@ static void __rpc_execute(struct rpc_task *task)
                         task->tk_flags |= RPC_TASK_KILLED;
                         rpc_exit(task, -ERESTARTSYS);
                 }
-                rpc_set_running(task);
                 dprintk("RPC: %5u sync task resuming\n", task->tk_pid);
         }
 
@@ -825,9 +810,11 @@ static void __rpc_execute(struct rpc_task *task)
  */
 void rpc_execute(struct rpc_task *task)
 {
+        bool is_async = RPC_IS_ASYNC(task);
+
         rpc_set_active(task);
         rpc_make_runnable(task);
-        if (!RPC_IS_ASYNC(task))
+        if (!is_async)
                 __rpc_execute(task);
 }
 
diff --git a/net/sunrpc/stats.c b/net/sunrpc/stats.c
index 21b75cb08c03..54530490944e 100644
--- a/net/sunrpc/stats.c
+++ b/net/sunrpc/stats.c
@@ -188,7 +188,7 @@ void rpc_print_iostats(struct seq_file *seq, struct rpc_clnt *clnt)
 
         seq_printf(seq, "\tRPC iostats version: %s  ", RPC_IOSTATS_VERS);
         seq_printf(seq, "p/v: %u/%u (%s)\n",
-                        clnt->cl_prog, clnt->cl_vers, clnt->cl_protname);
+                        clnt->cl_prog, clnt->cl_vers, clnt->cl_program->name);
 
         rcu_read_lock();
         xprt = rcu_dereference(clnt->cl_xprt);
diff --git a/net/sunrpc/svc.c b/net/sunrpc/svc.c
index 89a588b4478b..b974571126fe 100644
--- a/net/sunrpc/svc.c
+++ b/net/sunrpc/svc.c
@@ -740,7 +740,7 @@ svc_set_num_threads(struct svc_serv *serv, struct svc_pool *pool, int nrservs)
 
                 __module_get(serv->sv_module);
                 task = kthread_create_on_node(serv->sv_function, rqstp,
-                                              node, serv->sv_name);
+                                              node, "%s", serv->sv_name);
                 if (IS_ERR(task)) {
                         error = PTR_ERR(task);
                         module_put(serv->sv_module);
diff --git a/net/sunrpc/svcauth_unix.c b/net/sunrpc/svcauth_unix.c
index 06bdf5a1082c..621ca7b4a155 100644
--- a/net/sunrpc/svcauth_unix.c
+++ b/net/sunrpc/svcauth_unix.c
@@ -347,13 +347,13 @@ ip_map_cached_get(struct svc_xprt *xprt)
                 spin_lock(&xprt->xpt_lock);
                 ipm = xprt->xpt_auth_cache;
                 if (ipm != NULL) {
-                        if (!cache_valid(&ipm->h)) {
+                        sn = net_generic(xprt->xpt_net, sunrpc_net_id);
+                        if (cache_is_expired(sn->ip_map_cache, &ipm->h)) {
                                 /*
                                  * The entry has been invalidated since it was
                                  * remembered, e.g. by a second mount from the
                                  * same IP address.
                                  */
-                                sn = net_generic(xprt->xpt_net, sunrpc_net_id);
                                 xprt->xpt_auth_cache = NULL;
                                 spin_unlock(&xprt->xpt_lock);
                                 cache_put(&ipm->h, sn->ip_map_cache);
@@ -493,8 +493,6 @@ static int unix_gid_parse(struct cache_detail *cd,
         if (rv)
                 return -EINVAL;
         uid = make_kuid(&init_user_ns, id);
-        if (!uid_valid(uid))
-                return -EINVAL;
         ug.uid = uid;
 
         expiry = get_expiry(&mesg);
diff --git a/net/sunrpc/svcsock.c b/net/sunrpc/svcsock.c
index 0f679df7d072..9c9caaa5e0d3 100644
--- a/net/sunrpc/svcsock.c
+++ b/net/sunrpc/svcsock.c
@@ -442,7 +442,7 @@ static void svc_tcp_write_space(struct sock *sk)
 {
         struct socket *sock = sk->sk_socket;
 
-        if (sk_stream_wspace(sk) >= sk_stream_min_wspace(sk) && sock)
+        if (sk_stream_is_writeable(sk) && sock)
                 clear_bit(SOCK_NOSPACE, &sock->flags);
         svc_write_space(sk);
 }
@@ -917,7 +917,10 @@ static void svc_tcp_clear_pages(struct svc_sock *svsk)
         len = svsk->sk_datalen;
         npages = (len + PAGE_SIZE - 1) >> PAGE_SHIFT;
         for (i = 0; i < npages; i++) {
-                BUG_ON(svsk->sk_pages[i] == NULL);
+                if (svsk->sk_pages[i] == NULL) {
+                        WARN_ON_ONCE(1);
+                        continue;
+                }
                 put_page(svsk->sk_pages[i]);
                 svsk->sk_pages[i] = NULL;
         }
@@ -1092,8 +1095,10 @@ static int svc_tcp_recvfrom(struct svc_rqst *rqstp)
                 goto err_noclose;
         }
 
-        if (svc_sock_reclen(svsk) < 8)
+        if (svsk->sk_datalen < 8) {
+                svsk->sk_datalen = 0;
                 goto err_delete; /* client is nuts. */
+        }
 
         rqstp->rq_arg.len = svsk->sk_datalen;
         rqstp->rq_arg.page_base = 0;
@@ -1188,7 +1193,9 @@ static int svc_tcp_has_wspace(struct svc_xprt *xprt)
         if (test_bit(XPT_LISTENER, &xprt->xpt_flags))
                 return 1;
         required = atomic_read(&xprt->xpt_reserved) + serv->sv_max_mesg;
-        if (sk_stream_wspace(svsk->sk_sk) >= required)
+        if (sk_stream_wspace(svsk->sk_sk) >= required ||
+            (sk_stream_min_wspace(svsk->sk_sk) == 0 &&
+             atomic_read(&xprt->xpt_reserved) == 0))
                 return 1;
         set_bit(SOCK_NOSPACE, &svsk->sk_sock->flags);
         return 0;
diff --git a/net/sunrpc/sysctl.c b/net/sunrpc/sysctl.c
index af7d339add9d..c99c58e2ee66 100644
--- a/net/sunrpc/sysctl.c
+++ b/net/sunrpc/sysctl.c
@@ -40,7 +40,7 @@ EXPORT_SYMBOL_GPL(nlm_debug);
 #ifdef RPC_DEBUG
 
 static struct ctl_table_header *sunrpc_table_header;
-static ctl_table                sunrpc_table[];
+static struct ctl_table sunrpc_table[];
 
 void
 rpc_register_sysctl(void)
@@ -58,7 +58,7 @@ rpc_unregister_sysctl(void)
         }
 }
 
-static int proc_do_xprt(ctl_table *table, int write,
+static int proc_do_xprt(struct ctl_table *table, int write,
                         void __user *buffer, size_t *lenp, loff_t *ppos)
 {
         char tmpbuf[256];
@@ -73,7 +73,7 @@ static int proc_do_xprt(ctl_table *table, int write,
 }
 
 static int
-proc_dodebug(ctl_table *table, int write,
+proc_dodebug(struct ctl_table *table, int write,
                                 void __user *buffer, size_t *lenp, loff_t *ppos)
 {
         char            tmpbuf[20], c, *s;
@@ -135,7 +135,7 @@ done:
 }
 
 
-static ctl_table debug_table[] = {
+static struct ctl_table debug_table[] = {
         {
                 .procname       = "rpc_debug",
                 .data           = &rpc_debug,
@@ -173,7 +173,7 @@ static ctl_table debug_table[] = {
         { }
 };
 
-static ctl_table sunrpc_table[] = {
+static struct ctl_table sunrpc_table[] = {
         {
                 .procname       = "sunrpc",
                 .mode           = 0555,
diff --git a/net/sunrpc/xdr.c b/net/sunrpc/xdr.c
index 75edcfad6e26..1504bb11e4f3 100644
--- a/net/sunrpc/xdr.c
+++ b/net/sunrpc/xdr.c
@@ -207,10 +207,13 @@ _shift_data_right_pages(struct page **pages, size_t pgto_base,
                 pgfrom_base -= copy;
 
                 vto = kmap_atomic(*pgto);
-                vfrom = kmap_atomic(*pgfrom);
-                memmove(vto + pgto_base, vfrom + pgfrom_base, copy);
+                if (*pgto != *pgfrom) {
+                        vfrom = kmap_atomic(*pgfrom);
+                        memcpy(vto + pgto_base, vfrom + pgfrom_base, copy);
+                        kunmap_atomic(vfrom);
+                } else
+                        memmove(vto + pgto_base, vto + pgfrom_base, copy);
                 flush_dcache_page(*pgto);
-                kunmap_atomic(vfrom);
                 kunmap_atomic(vto);
 
         } while ((len -= copy) != 0);
diff --git a/net/sunrpc/xprtrdma/svc_rdma.c b/net/sunrpc/xprtrdma/svc_rdma.c
index 8343737e85f4..c1b6270262c2 100644
--- a/net/sunrpc/xprtrdma/svc_rdma.c
+++ b/net/sunrpc/xprtrdma/svc_rdma.c
@@ -84,7 +84,7 @@ struct workqueue_struct *svc_rdma_wq;
  * resets the associated statistic to zero. Any read returns it's
  * current value.
  */
-static int read_reset_stat(ctl_table *table, int write,
+static int read_reset_stat(struct ctl_table *table, int write,
                            void __user *buffer, size_t *lenp,
                            loff_t *ppos)
 {
@@ -119,7 +119,7 @@ static int read_reset_stat(ctl_table *table, int write,
 }
 
 static struct ctl_table_header *svcrdma_table_header;
-static ctl_table svcrdma_parm_table[] = {
+static struct ctl_table svcrdma_parm_table[] = {
         {
                 .procname       = "max_requests",
                 .data           = &svcrdma_max_requests,
@@ -214,7 +214,7 @@ static ctl_table svcrdma_parm_table[] = {
         { },
 };
 
-static ctl_table svcrdma_table[] = {
+static struct ctl_table svcrdma_table[] = {
         {
                 .procname       = "svc_rdma",
                 .mode           = 0555,
@@ -223,7 +223,7 @@ static ctl_table svcrdma_table[] = {
         { },
 };
 
-static ctl_table svcrdma_root_table[] = {
+static struct ctl_table svcrdma_root_table[] = {
         {
                 .procname       = "sunrpc",
                 .mode           = 0555,
diff --git a/net/sunrpc/xprtrdma/svc_rdma_marshal.c b/net/sunrpc/xprtrdma/svc_rdma_marshal.c
index 8d2edddf48cf..65b146297f5a 100644
--- a/net/sunrpc/xprtrdma/svc_rdma_marshal.c
+++ b/net/sunrpc/xprtrdma/svc_rdma_marshal.c
@@ -98,6 +98,7 @@ void svc_rdma_rcl_chunk_counts(struct rpcrdma_read_chunk *ch,
  */
 static u32 *decode_write_list(u32 *va, u32 *vaend)
 {
+        unsigned long start, end;
         int nchunks;
 
         struct rpcrdma_write_array *ary =
@@ -113,9 +114,12 @@ static u32 *decode_write_list(u32 *va, u32 *vaend)
                 return NULL;
         }
         nchunks = ntohl(ary->wc_nchunks);
-        if (((unsigned long)&ary->wc_array[0] +
-             (sizeof(struct rpcrdma_write_chunk) * nchunks)) >
-            (unsigned long)vaend) {
+
+        start = (unsigned long)&ary->wc_array[0];
+        end = (unsigned long)vaend;
+        if (nchunks < 0 ||
+            nchunks > (SIZE_MAX - start) / sizeof(struct rpcrdma_write_chunk) ||
+            (start + (sizeof(struct rpcrdma_write_chunk) * nchunks)) > end) {
                 dprintk("svcrdma: ary=%p, wc_nchunks=%d, vaend=%p\n",
                         ary, nchunks, vaend);
                 return NULL;
@@ -129,6 +133,7 @@ static u32 *decode_write_list(u32 *va, u32 *vaend)
 
 static u32 *decode_reply_array(u32 *va, u32 *vaend)
 {
+        unsigned long start, end;
         int nchunks;
         struct rpcrdma_write_array *ary =
                 (struct rpcrdma_write_array *)va;
@@ -143,9 +148,12 @@ static u32 *decode_reply_array(u32 *va, u32 *vaend)
                 return NULL;
         }
         nchunks = ntohl(ary->wc_nchunks);
-        if (((unsigned long)&ary->wc_array[0] +
-             (sizeof(struct rpcrdma_write_chunk) * nchunks)) >
-            (unsigned long)vaend) {
+
+        start = (unsigned long)&ary->wc_array[0];
+        end = (unsigned long)vaend;
+        if (nchunks < 0 ||
+            nchunks > (SIZE_MAX - start) / sizeof(struct rpcrdma_write_chunk) ||
+            (start + (sizeof(struct rpcrdma_write_chunk) * nchunks)) > end) {
                 dprintk("svcrdma: ary=%p, wc_nchunks=%d, vaend=%p\n",
                         ary, nchunks, vaend);
                 return NULL;
diff --git a/net/sunrpc/xprtrdma/transport.c b/net/sunrpc/xprtrdma/transport.c
index 794312f22b9b..285dc0884115 100644
--- a/net/sunrpc/xprtrdma/transport.c
+++ b/net/sunrpc/xprtrdma/transport.c
@@ -86,7 +86,7 @@ static unsigned int max_memreg = RPCRDMA_LAST - 1;
 
 static struct ctl_table_header *sunrpc_table_header;
 
-static ctl_table xr_tunables_table[] = {
+static struct ctl_table xr_tunables_table[] = {
         {
                 .procname       = "rdma_slot_table_entries",
                 .data           = &xprt_rdma_slot_table_entries,
@@ -138,7 +138,7 @@ static ctl_table xr_tunables_table[] = {
         { },
 };
 
-static ctl_table sunrpc_table[] = {
+static struct ctl_table sunrpc_table[] = {
         {
                 .procname       = "sunrpc",
                 .mode           = 0555,
diff --git a/net/sunrpc/xprtsock.c b/net/sunrpc/xprtsock.c
index ffd50348a509..ee03d35677d9 100644
--- a/net/sunrpc/xprtsock.c
+++ b/net/sunrpc/xprtsock.c
@@ -47,6 +47,8 @@
 #include <net/udp.h>
 #include <net/tcp.h>
 
+#include <trace/events/sunrpc.h>
+
 #include "sunrpc.h"
 
 static void xs_close(struct rpc_xprt *xprt);
@@ -87,7 +89,7 @@ static struct ctl_table_header *sunrpc_table_header;
  * FIXME: changing the UDP slot table size should also resize the UDP
  *        socket buffers for existing UDP transports
  */
-static ctl_table xs_tunables_table[] = {
+static struct ctl_table xs_tunables_table[] = {
         {
                 .procname       = "udp_slot_table_entries",
                 .data           = &xprt_udp_slot_table_entries,
@@ -143,7 +145,7 @@ static ctl_table xs_tunables_table[] = {
         { },
 };
 
-static ctl_table sunrpc_table[] = {
+static struct ctl_table sunrpc_table[] = {
         {
                 .procname       = "sunrpc",
                 .mode           = 0555,
@@ -665,8 +667,10 @@ static void xs_tcp_shutdown(struct rpc_xprt *xprt)
         struct sock_xprt *transport = container_of(xprt, struct sock_xprt, xprt);
         struct socket *sock = transport->sock;
 
-        if (sock != NULL)
+        if (sock != NULL) {
                 kernel_sock_shutdown(sock, SHUT_WR);
+                trace_rpc_socket_shutdown(xprt, sock);
+        }
 }
 
 /**
@@ -811,6 +815,7 @@ static void xs_reset_transport(struct sock_xprt *transport)
 
         sk->sk_no_check = 0;
 
+        trace_rpc_socket_close(&transport->xprt, sock);
         sock_release(sock);
 }
 
@@ -1492,6 +1497,7 @@ static void xs_tcp_state_change(struct sock *sk)
                         sock_flag(sk, SOCK_ZAPPED),
                         sk->sk_shutdown);
 
+        trace_rpc_socket_state_change(xprt, sk->sk_socket);
         switch (sk->sk_state) {
         case TCP_ESTABLISHED:
                 spin_lock(&xprt->transport_lock);
@@ -1602,7 +1608,7 @@ static void xs_tcp_write_space(struct sock *sk)
         read_lock_bh(&sk->sk_callback_lock);
 
         /* from net/core/stream.c:sk_stream_write_space */
-        if (sk_stream_wspace(sk) >= sk_stream_min_wspace(sk))
+        if (sk_stream_is_writeable(sk))
                 xs_write_space(sk);
 
         read_unlock_bh(&sk->sk_callback_lock);
@@ -1896,6 +1902,7 @@ static int xs_local_setup_socket(struct sock_xprt *transport)
                         xprt, xprt->address_strings[RPC_DISPLAY_ADDR]);
 
         status = xs_local_finish_connecting(xprt, sock);
+        trace_rpc_socket_connect(xprt, sock, status);
         switch (status) {
         case 0:
                 dprintk("RPC:       xprt %p connected to %s\n",
@@ -2039,6 +2046,7 @@ static void xs_udp_setup_socket(struct work_struct *work)
                         xprt->address_strings[RPC_DISPLAY_PORT]);
 
         xs_udp_finish_connecting(xprt, sock);
+        trace_rpc_socket_connect(xprt, sock, 0);
         status = 0;
 out:
         xprt_clear_connecting(xprt);
@@ -2064,6 +2072,8 @@ static void xs_abort_connection(struct sock_xprt *transport)
         memset(&any, 0, sizeof(any));
         any.sa_family = AF_UNSPEC;
         result = kernel_connect(transport->sock, &any, sizeof(any), 0);
+        trace_rpc_socket_reset_connection(&transport->xprt,
+                        transport->sock, result);
         if (!result)
                 xs_sock_reset_connection_flags(&transport->xprt);
         dprintk("RPC:       AF_UNSPEC connect return code %d\n", result);
@@ -2194,6 +2204,7 @@ static void xs_tcp_setup_socket(struct work_struct *work)
                         xprt->address_strings[RPC_DISPLAY_PORT]);
 
         status = xs_tcp_finish_connecting(xprt, sock);
+        trace_rpc_socket_connect(xprt, sock, status);
         dprintk("RPC:       %p connect status %d connected %d sock state %d\n",
                         xprt, -status, xprt_connected(xprt),
                         sock->sk->sk_state);
@@ -2534,7 +2545,6 @@ static struct rpc_xprt_ops bc_tcp_ops = {
         .reserve_xprt           = xprt_reserve_xprt,
         .release_xprt           = xprt_release_xprt,
         .alloc_slot             = xprt_alloc_slot,
-        .rpcbind                = xs_local_rpcbind,
         .buf_alloc              = bc_malloc,
         .buf_free               = bc_free,
         .send_request           = bc_send_request,
diff --git a/net/sysctl_net.c b/net/sysctl_net.c
index 9bc6db04be3e..e7000be321b0 100644
--- a/net/sysctl_net.c
+++ b/net/sysctl_net.c
@@ -47,12 +47,12 @@ static int net_ctl_permissions(struct ctl_table_header *head,
 
         /* Allow network administrator to have same access as root. */
         if (ns_capable(net->user_ns, CAP_NET_ADMIN) ||
-            uid_eq(root_uid, current_uid())) {
+            uid_eq(root_uid, current_euid())) {
                 int mode = (table->mode >> 6) & 7;
                 return (mode << 6) | (mode << 3) | mode;
         }
         /* Allow netns root group to have the same access as the root group */
-        if (gid_eq(root_gid, current_gid())) {
+        if (in_egroup_p(root_gid)) {
                 int mode = (table->mode >> 3) & 7;
                 return (mode << 3) | mode;
         }
diff --git a/net/tipc/Makefile b/net/tipc/Makefile
index 4df8e02d9008..b282f7130d2b 100644
--- a/net/tipc/Makefile
+++ b/net/tipc/Makefile
@@ -8,6 +8,7 @@ tipc-y	+= addr.o bcast.o bearer.o config.o \
            core.o handler.o link.o discover.o msg.o  \
            name_distr.o  subscr.o name_table.o net.o  \
            netlink.o node.o node_subscr.o port.o ref.o  \
-           socket.o log.o eth_media.o
+           socket.o log.o eth_media.o server.o
 
 tipc-$(CONFIG_TIPC_MEDIA_IB)    += ib_media.o
+tipc-$(CONFIG_SYSCTL)           += sysctl.o
diff --git a/net/tipc/bcast.c b/net/tipc/bcast.c
index e5f3da507823..716de1ac6cb5 100644
--- a/net/tipc/bcast.c
+++ b/net/tipc/bcast.c
@@ -578,8 +578,7 @@ u32 tipc_bclink_acks_missing(struct tipc_node *n_ptr)
  * Returns 0 (packet sent successfully) under all circumstances,
  * since the broadcast link's pseudo-bearer never blocks
  */
-static int tipc_bcbearer_send(struct sk_buff *buf,
-                              struct tipc_bearer *unused1,
+static int tipc_bcbearer_send(struct sk_buff *buf, struct tipc_bearer *unused1,
                               struct tipc_media_addr *unused2)
 {
         int bp_index;
diff --git a/net/tipc/bcast.h b/net/tipc/bcast.h
index a93306557e00..6ee587b469fd 100644
--- a/net/tipc/bcast.h
+++ b/net/tipc/bcast.h
@@ -75,7 +75,8 @@ void tipc_nmap_remove(struct tipc_node_map *nm_ptr, u32 node);
 /**
  * tipc_nmap_equal - test for equality of node maps
  */
-static inline int tipc_nmap_equal(struct tipc_node_map *nm_a, struct tipc_node_map *nm_b)
+static inline int tipc_nmap_equal(struct tipc_node_map *nm_a,
+                                  struct tipc_node_map *nm_b)
 {
         return !memcmp(nm_a, nm_b, sizeof(*nm_a));
 }
diff --git a/net/tipc/bearer.c b/net/tipc/bearer.c
index cb29ef7ba2f0..609c30c80816 100644
--- a/net/tipc/bearer.c
+++ b/net/tipc/bearer.c
@@ -460,6 +460,7 @@ static void bearer_disable(struct tipc_bearer *b_ptr)
 {
         struct tipc_link *l_ptr;
         struct tipc_link *temp_l_ptr;
+        struct tipc_link_req *temp_req;
 
         pr_info("Disabling bearer <%s>\n", b_ptr->name);
         spin_lock_bh(&b_ptr->lock);
@@ -468,9 +469,13 @@ static void bearer_disable(struct tipc_bearer *b_ptr)
         list_for_each_entry_safe(l_ptr, temp_l_ptr, &b_ptr->links, link_list) {
                 tipc_link_delete(l_ptr);
         }
-        if (b_ptr->link_req)
-                tipc_disc_delete(b_ptr->link_req);
+        temp_req = b_ptr->link_req;
+        b_ptr->link_req = NULL;
         spin_unlock_bh(&b_ptr->lock);
+
+        if (temp_req)
+                tipc_disc_delete(temp_req);
+
         memset(b_ptr, 0, sizeof(struct tipc_bearer));
 }
 
diff --git a/net/tipc/config.c b/net/tipc/config.c
index f67866c765dd..c301a9a592d8 100644
--- a/net/tipc/config.c
+++ b/net/tipc/config.c
@@ -2,7 +2,7 @@
  * net/tipc/config.c: TIPC configuration management code
  *
  * Copyright (c) 2002-2006, Ericsson AB
- * Copyright (c) 2004-2007, 2010-2012, Wind River Systems
+ * Copyright (c) 2004-2007, 2010-2013, Wind River Systems
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -38,12 +38,12 @@
 #include "port.h"
 #include "name_table.h"
 #include "config.h"
+#include "server.h"
 
 #define REPLY_TRUNCATED "<truncated>\n"
 
-static u32 config_port_ref;
-
-static DEFINE_SPINLOCK(config_lock);
+static DEFINE_MUTEX(config_mutex);
+static struct tipc_server cfgsrv;
 
 static const void *req_tlv_area;        /* request message TLV area */
 static int req_tlv_space;               /* request message TLV area size */
@@ -181,18 +181,7 @@ static struct sk_buff *cfg_set_own_addr(void)
         if (tipc_own_addr)
                 return tipc_cfg_reply_error_string(TIPC_CFG_NOT_SUPPORTED
                                                    " (cannot change node address once assigned)");
-
-        /*
-         * Must temporarily release configuration spinlock while switching into
-         * networking mode as it calls tipc_eth_media_start(), which may sleep.
-         * Releasing the lock is harmless as other locally-issued configuration
-         * commands won't occur until this one completes, and remotely-issued
-         * configuration commands can't be received until a local configuration
-         * command to enable the first bearer is received and processed.
-         */
-        spin_unlock_bh(&config_lock);
         tipc_core_start_net(addr);
-        spin_lock_bh(&config_lock);
         return tipc_cfg_reply_none();
 }
 
@@ -248,7 +237,7 @@ struct sk_buff *tipc_cfg_do_cmd(u32 orig_node, u16 cmd, const void *request_area
 {
         struct sk_buff *rep_tlv_buf;
 
-        spin_lock_bh(&config_lock);
+        mutex_lock(&config_mutex);
 
         /* Save request and reply details in a well-known location */
         req_tlv_area = request_area;
@@ -377,37 +366,31 @@ struct sk_buff *tipc_cfg_do_cmd(u32 orig_node, u16 cmd, const void *request_area
 
         /* Return reply buffer */
 exit:
-        spin_unlock_bh(&config_lock);
+        mutex_unlock(&config_mutex);
         return rep_tlv_buf;
 }
 
-static void cfg_named_msg_event(void *userdata,
-                                u32 port_ref,
-                                struct sk_buff **buf,
-                                const unchar *msg,
-                                u32 size,
-                                u32 importance,
-                                struct tipc_portid const *orig,
-                                struct tipc_name_seq const *dest)
+static void cfg_conn_msg_event(int conid, struct sockaddr_tipc *addr,
+                               void *usr_data, void *buf, size_t len)
 {
         struct tipc_cfg_msg_hdr *req_hdr;
         struct tipc_cfg_msg_hdr *rep_hdr;
         struct sk_buff *rep_buf;
+        int ret;
 
         /* Validate configuration message header (ignore invalid message) */
-        req_hdr = (struct tipc_cfg_msg_hdr *)msg;
-        if ((size < sizeof(*req_hdr)) ||
-            (size != TCM_ALIGN(ntohl(req_hdr->tcm_len))) ||
+        req_hdr = (struct tipc_cfg_msg_hdr *)buf;
+        if ((len < sizeof(*req_hdr)) ||
+            (len != TCM_ALIGN(ntohl(req_hdr->tcm_len))) ||
             (ntohs(req_hdr->tcm_flags) != TCM_F_REQUEST)) {
                 pr_warn("Invalid configuration message discarded\n");
                 return;
         }
 
         /* Generate reply for request (if can't, return request) */
-        rep_buf = tipc_cfg_do_cmd(orig->node,
-                                  ntohs(req_hdr->tcm_type),
-                                  msg + sizeof(*req_hdr),
-                                  size - sizeof(*req_hdr),
+        rep_buf = tipc_cfg_do_cmd(addr->addr.id.node, ntohs(req_hdr->tcm_type),
+                                  buf + sizeof(*req_hdr),
+                                  len - sizeof(*req_hdr),
                                   BUF_HEADROOM + MAX_H_SIZE + sizeof(*rep_hdr));
         if (rep_buf) {
                 skb_push(rep_buf, sizeof(*rep_hdr));
@@ -415,57 +398,51 @@ static void cfg_named_msg_event(void *userdata,
                 memcpy(rep_hdr, req_hdr, sizeof(*rep_hdr));
                 rep_hdr->tcm_len = htonl(rep_buf->len);
                 rep_hdr->tcm_flags &= htons(~TCM_F_REQUEST);
-        } else {
-                rep_buf = *buf;
-                *buf = NULL;
-        }
 
-        /* NEED TO ADD CODE TO HANDLE FAILED SEND (SUCH AS CONGESTION) */
-        tipc_send_buf2port(port_ref, orig, rep_buf, rep_buf->len);
+                ret = tipc_conn_sendmsg(&cfgsrv, conid, addr, rep_buf->data,
+                                        rep_buf->len);
+                if (ret < 0)
+                        pr_err("Sending cfg reply message failed, no memory\n");
+
+                kfree_skb(rep_buf);
+        }
 }
 
+static struct sockaddr_tipc cfgsrv_addr __read_mostly = {
+        .family                 = AF_TIPC,
+        .addrtype               = TIPC_ADDR_NAMESEQ,
+        .addr.nameseq.type      = TIPC_CFG_SRV,
+        .addr.nameseq.lower     = 0,
+        .addr.nameseq.upper     = 0,
+        .scope                  = TIPC_ZONE_SCOPE
+};
+
+static struct tipc_server cfgsrv __read_mostly = {
+        .saddr                  = &cfgsrv_addr,
+        .imp                    = TIPC_CRITICAL_IMPORTANCE,
+        .type                   = SOCK_RDM,
+        .max_rcvbuf_size        = 64 * 1024,
+        .name                   = "cfg_server",
+        .tipc_conn_recvmsg      = cfg_conn_msg_event,
+        .tipc_conn_new          = NULL,
+        .tipc_conn_shutdown     = NULL
+};
+
 int tipc_cfg_init(void)
 {
-        struct tipc_name_seq seq;
-        int res;
-
-        res = tipc_createport(NULL, TIPC_CRITICAL_IMPORTANCE,
-                              NULL, NULL, NULL,
-                              NULL, cfg_named_msg_event, NULL,
-                              NULL, &config_port_ref);
-        if (res)
-                goto failed;
-
-        seq.type = TIPC_CFG_SRV;
-        seq.lower = seq.upper = tipc_own_addr;
-        res = tipc_publish(config_port_ref, TIPC_ZONE_SCOPE, &seq);
-        if (res)
-                goto failed;
-
-        return 0;
-
-failed:
-        pr_err("Unable to create configuration service\n");
-        return res;
+        return tipc_server_start(&cfgsrv);
 }
 
 void tipc_cfg_reinit(void)
 {
-        struct tipc_name_seq seq;
-        int res;
-
-        seq.type = TIPC_CFG_SRV;
-        seq.lower = seq.upper = 0;
-        tipc_withdraw(config_port_ref, TIPC_ZONE_SCOPE, &seq);
+        tipc_server_stop(&cfgsrv);
 
-        seq.lower = seq.upper = tipc_own_addr;
-        res = tipc_publish(config_port_ref, TIPC_ZONE_SCOPE, &seq);
-        if (res)
-                pr_err("Unable to reinitialize configuration service\n");
+        cfgsrv_addr.addr.nameseq.lower = tipc_own_addr;
+        cfgsrv_addr.addr.nameseq.upper = tipc_own_addr;
+        tipc_server_start(&cfgsrv);
 }
 
 void tipc_cfg_stop(void)
 {
-        tipc_deleteport(config_port_ref);
-        config_port_ref = 0;
+        tipc_server_stop(&cfgsrv);
 }
diff --git a/net/tipc/core.c b/net/tipc/core.c
index 7ec2c1eb94f1..fd4eeeaa972a 100644
--- a/net/tipc/core.c
+++ b/net/tipc/core.c
@@ -2,7 +2,7 @@
  * net/tipc/core.c: TIPC module code
  *
  * Copyright (c) 2003-2006, Ericsson AB
- * Copyright (c) 2005-2006, 2010-2011, Wind River Systems
+ * Copyright (c) 2005-2006, 2010-2013, Wind River Systems
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -39,6 +39,7 @@
 #include "name_table.h"
 #include "subscr.h"
 #include "config.h"
+#include "port.h"
 
 #include <linux/module.h>
 
@@ -50,7 +51,7 @@ u32 tipc_own_addr __read_mostly;
 int tipc_max_ports __read_mostly;
 int tipc_net_id __read_mostly;
 int tipc_remote_management __read_mostly;
-
+int sysctl_tipc_rmem[3] __read_mostly;  /* min/default/max */
 
 /**
  * tipc_buf_acquire - creates a TIPC message buffer
@@ -118,6 +119,7 @@ static void tipc_core_stop(void)
         tipc_nametbl_stop();
         tipc_ref_table_stop();
         tipc_socket_stop();
+        tipc_unregister_sysctl();
 }
 
 /**
@@ -135,20 +137,21 @@ static int tipc_core_start(void)
         if (!res)
                 res = tipc_nametbl_init();
         if (!res)
-                res = tipc_subscr_start();
-        if (!res)
-                res = tipc_cfg_init();
-        if (!res)
                 res = tipc_netlink_start();
         if (!res)
                 res = tipc_socket_init();
+        if (!res)
+                res = tipc_register_sysctl();
+        if (!res)
+                res = tipc_subscr_start();
+        if (!res)
+                res = tipc_cfg_init();
         if (res)
                 tipc_core_stop();
 
         return res;
 }
 
-
 static int __init tipc_init(void)
 {
         int res;
@@ -160,6 +163,11 @@ static int __init tipc_init(void)
         tipc_max_ports = CONFIG_TIPC_PORTS;
         tipc_net_id = 4711;
 
+        sysctl_tipc_rmem[0] = CONN_OVERLOAD_LIMIT >> 4 << TIPC_LOW_IMPORTANCE;
+        sysctl_tipc_rmem[1] = CONN_OVERLOAD_LIMIT >> 4 <<
+                              TIPC_CRITICAL_IMPORTANCE;
+        sysctl_tipc_rmem[2] = CONN_OVERLOAD_LIMIT;
+
         res = tipc_core_start();
         if (res)
                 pr_err("Unable to start in single node mode\n");
diff --git a/net/tipc/core.h b/net/tipc/core.h
index 0207db04179a..be72f8cebc53 100644
--- a/net/tipc/core.h
+++ b/net/tipc/core.h
@@ -1,8 +1,8 @@
 /*
  * net/tipc/core.h: Include file for TIPC global declarations
  *
- * Copyright (c) 2005-2006, Ericsson AB
- * Copyright (c) 2005-2007, 2010-2011, Wind River Systems
+ * Copyright (c) 2005-2006, 2013 Ericsson AB
+ * Copyright (c) 2005-2007, 2010-2013, Wind River Systems
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -80,6 +80,7 @@ extern u32 tipc_own_addr __read_mostly;
 extern int tipc_max_ports __read_mostly;
 extern int tipc_net_id __read_mostly;
 extern int tipc_remote_management __read_mostly;
+extern int sysctl_tipc_rmem[3] __read_mostly;
 
 /*
  * Other global variables
@@ -96,6 +97,18 @@ extern int  tipc_netlink_start(void);
 extern void tipc_netlink_stop(void);
 extern int  tipc_socket_init(void);
 extern void tipc_socket_stop(void);
+extern int tipc_sock_create_local(int type, struct socket **res);
+extern void tipc_sock_release_local(struct socket *sock);
+extern int tipc_sock_accept_local(struct socket *sock,
+                                  struct socket **newsock, int flags);
+
+#ifdef CONFIG_SYSCTL
+extern int tipc_register_sysctl(void);
+extern void tipc_unregister_sysctl(void);
+#else
+#define tipc_register_sysctl() 0
+#define tipc_unregister_sysctl()
+#endif
 
 /*
  * TIPC timer and signal code
diff --git a/net/tipc/discover.c b/net/tipc/discover.c
index eedff58d0387..ecc758c6eacf 100644
--- a/net/tipc/discover.c
+++ b/net/tipc/discover.c
@@ -70,8 +70,7 @@ struct tipc_link_req {
  * @dest_domain: network domain of node(s) which should respond to message
  * @b_ptr: ptr to bearer issuing message
  */
-static struct sk_buff *tipc_disc_init_msg(u32 type,
-                                          u32 dest_domain,
+static struct sk_buff *tipc_disc_init_msg(u32 type, u32 dest_domain,
                                           struct tipc_bearer *b_ptr)
 {
         struct sk_buff *buf = tipc_buf_acquire(INT_H_SIZE);
@@ -346,8 +345,8 @@ exit:
  *
  * Returns 0 if successful, otherwise -errno.
  */
-int tipc_disc_create(struct tipc_bearer *b_ptr,
-                     struct tipc_media_addr *dest, u32 dest_domain)
+int tipc_disc_create(struct tipc_bearer *b_ptr, struct tipc_media_addr *dest,
+                     u32 dest_domain)
 {
         struct tipc_link_req *req;
 
diff --git a/net/tipc/eth_media.c b/net/tipc/eth_media.c
index 120a676a3360..40ea40cf6204 100644
--- a/net/tipc/eth_media.c
+++ b/net/tipc/eth_media.c
@@ -62,7 +62,7 @@ static struct eth_bearer eth_bearers[MAX_ETH_BEARERS];
 static int eth_started;
 
 static int recv_notification(struct notifier_block *nb, unsigned long evt,
-                              void *dv);
+                             void *dv);
 /*
  * Network device notifier info
  */
@@ -162,8 +162,7 @@ static void setup_bearer(struct work_struct *work)
  */
 static int enable_bearer(struct tipc_bearer *tb_ptr)
 {
-        struct net_device *dev = NULL;
-        struct net_device *pdev = NULL;
+        struct net_device *dev;
         struct eth_bearer *eb_ptr = &eth_bearers[0];
         struct eth_bearer *stop = &eth_bearers[MAX_ETH_BEARERS];
         char *driver_name = strchr((const char *)tb_ptr->name, ':') + 1;
@@ -178,15 +177,7 @@ static int enable_bearer(struct tipc_bearer *tb_ptr)
         }
 
         /* Find device with specified name */
-        read_lock(&dev_base_lock);
-        for_each_netdev(&init_net, pdev) {
-                if (!strncmp(pdev->name, driver_name, IFNAMSIZ)) {
-                        dev = pdev;
-                        dev_hold(dev);
-                        break;
-                }
-        }
-        read_unlock(&dev_base_lock);
+        dev = dev_get_by_name(&init_net, driver_name);
         if (!dev)
                 return -ENODEV;
 
@@ -251,9 +242,9 @@ static void disable_bearer(struct tipc_bearer *tb_ptr)
  * specified device.
  */
 static int recv_notification(struct notifier_block *nb, unsigned long evt,
-                             void *dv)
+                             void *ptr)
 {
-        struct net_device *dev = (struct net_device *)dv;
+        struct net_device *dev = netdev_notifier_info_to_dev(ptr);
         struct eth_bearer *eb_ptr = &eth_bearers[0];
         struct eth_bearer *stop = &eth_bearers[MAX_ETH_BEARERS];
 
diff --git a/net/tipc/ib_media.c b/net/tipc/ib_media.c
index 2a2864c25e15..9934a32bfa87 100644
--- a/net/tipc/ib_media.c
+++ b/net/tipc/ib_media.c
@@ -155,8 +155,7 @@ static void setup_bearer(struct work_struct *work)
  */
 static int enable_bearer(struct tipc_bearer *tb_ptr)
 {
-        struct net_device *dev = NULL;
-        struct net_device *pdev = NULL;
+        struct net_device *dev;
         struct ib_bearer *ib_ptr = &ib_bearers[0];
         struct ib_bearer *stop = &ib_bearers[MAX_IB_BEARERS];
         char *driver_name = strchr((const char *)tb_ptr->name, ':') + 1;
@@ -171,15 +170,7 @@ static int enable_bearer(struct tipc_bearer *tb_ptr)
         }
 
         /* Find device with specified name */
-        read_lock(&dev_base_lock);
-        for_each_netdev(&init_net, pdev) {
-                if (!strncmp(pdev->name, driver_name, IFNAMSIZ)) {
-                        dev = pdev;
-                        dev_hold(dev);
-                        break;
-                }
-        }
-        read_unlock(&dev_base_lock);
+        dev = dev_get_by_name(&init_net, driver_name);
         if (!dev)
                 return -ENODEV;
 
@@ -244,9 +235,9 @@ static void disable_bearer(struct tipc_bearer *tb_ptr)
  * specified device.
  */
 static int recv_notification(struct notifier_block *nb, unsigned long evt,
-                             void *dv)
+                             void *ptr)
 {
-        struct net_device *dev = (struct net_device *)dv;
+        struct net_device *dev = netdev_notifier_info_to_dev(ptr);
         struct ib_bearer *ib_ptr = &ib_bearers[0];
         struct ib_bearer *stop = &ib_bearers[MAX_IB_BEARERS];
 
@@ -301,13 +292,7 @@ static int ib_addr2str(struct tipc_media_addr *a, char *str_buf, int str_size)
         if (str_size < 60)      /* 60 = 19 * strlen("xx:") + strlen("xx\0") */
                 return 1;
 
-        sprintf(str_buf, "%02x:%02x:%02x:%02x:%02x:%02x:%02x:%02x:%02x:%02x:"
-                         "%02x:%02x:%02x:%02x:%02x:%02x:%02x:%02x:%02x:%02x",
-                a->value[0], a->value[1], a->value[2], a->value[3],
-                a->value[4], a->value[5], a->value[6], a->value[7],
-                a->value[8], a->value[9], a->value[10], a->value[11],
-                a->value[12], a->value[13], a->value[14], a->value[15],
-                a->value[16], a->value[17], a->value[18], a->value[19]);
+        sprintf(str_buf, "%20phC", a->value);
 
         return 0;
 }
diff --git a/net/tipc/link.c b/net/tipc/link.c
index a80feee5197a..0cc3d9015c5d 100644
--- a/net/tipc/link.c
+++ b/net/tipc/link.c
@@ -2,7 +2,7 @@
  * net/tipc/link.c: TIPC link code
  *
  * Copyright (c) 1996-2007, 2012, Ericsson AB
- * Copyright (c) 2004-2007, 2010-2011, Wind River Systems
+ * Copyright (c) 2004-2007, 2010-2013, Wind River Systems
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -41,6 +41,8 @@
 #include "discover.h"
 #include "config.h"
 
+#include <linux/pkt_sched.h>
+
 /*
  * Error message prefixes
  */
@@ -771,8 +773,7 @@ static void link_state_event(struct tipc_link *l_ptr, unsigned int event)
  * link_bundle_buf(): Append contents of a buffer to
  * the tail of an existing one.
  */
-static int link_bundle_buf(struct tipc_link *l_ptr,
-                           struct sk_buff *bundler,
+static int link_bundle_buf(struct tipc_link *l_ptr, struct sk_buff *bundler,
                            struct sk_buff *buf)
 {
         struct tipc_msg *bundler_msg = buf_msg(bundler);
@@ -1057,40 +1058,6 @@ static int link_send_buf_fast(struct tipc_link *l_ptr, struct sk_buff *buf,
 }
 
 /*
- * tipc_send_buf_fast: Entry for data messages where the
- * destination node is known and the header is complete,
- * inclusive total message length.
- * Returns user data length.
- */
-int tipc_send_buf_fast(struct sk_buff *buf, u32 destnode)
-{
-        struct tipc_link *l_ptr;
-        struct tipc_node *n_ptr;
-        int res;
-        u32 selector = msg_origport(buf_msg(buf)) & 1;
-        u32 dummy;
-
-        read_lock_bh(&tipc_net_lock);
-        n_ptr = tipc_node_find(destnode);
-        if (likely(n_ptr)) {
-                tipc_node_lock(n_ptr);
-                l_ptr = n_ptr->active_links[selector];
-                if (likely(l_ptr)) {
-                        res = link_send_buf_fast(l_ptr, buf, &dummy);
-                        tipc_node_unlock(n_ptr);
-                        read_unlock_bh(&tipc_net_lock);
-                        return res;
-                }
-                tipc_node_unlock(n_ptr);
-        }
-        read_unlock_bh(&tipc_net_lock);
-        res = msg_data_sz(buf_msg(buf));
-        tipc_reject_msg(buf, TIPC_ERR_NO_NODE);
-        return res;
-}
-
-
-/*
  * tipc_link_send_sections_fast: Entry for messages where the
  * destination processor is known and the header is complete,
  * except for total message length.
@@ -1098,8 +1065,7 @@ int tipc_send_buf_fast(struct sk_buff *buf, u32 destnode)
  */
 int tipc_link_send_sections_fast(struct tipc_port *sender,
                                  struct iovec const *msg_sect,
-                                 const u32 num_sect,
-                                 unsigned int total_len,
+                                 const u32 num_sect, unsigned int total_len,
                                  u32 destaddr)
 {
         struct tipc_msg *hdr = &sender->phdr;
@@ -1115,7 +1081,10 @@ again:
          * (Must not hold any locks while building message.)
          */
         res = tipc_msg_build(hdr, msg_sect, num_sect, total_len,
-                             sender->max_pkt, !sender->user_port, &buf);
+                             sender->max_pkt, &buf);
+        /* Exit if build request was invalid */
+        if (unlikely(res < 0))
+                return res;
 
         read_lock_bh(&tipc_net_lock);
         node = tipc_node_find(destaddr);
@@ -1132,10 +1101,6 @@ exit:
                                 return res;
                         }
 
-                        /* Exit if build request was invalid */
-                        if (unlikely(res < 0))
-                                goto exit;
-
                         /* Exit if link (or bearer) is congested */
                         if (link_congested(l_ptr) ||
                             tipc_bearer_blocked(l_ptr->b_ptr)) {
@@ -1189,8 +1154,7 @@ exit:
  */
 static int link_send_sections_long(struct tipc_port *sender,
                                    struct iovec const *msg_sect,
-                                   u32 num_sect,
-                                   unsigned int total_len,
+                                   u32 num_sect, unsigned int total_len,
                                    u32 destaddr)
 {
         struct tipc_link *l_ptr;
@@ -1204,6 +1168,7 @@ static int link_send_sections_long(struct tipc_port *sender,
         const unchar *sect_crs;
         int curr_sect;
         u32 fragm_no;
+        int res = 0;
 
 again:
         fragm_no = 1;
@@ -1250,18 +1215,15 @@ again:
                 else
                         sz = fragm_rest;
 
-                if (likely(!sender->user_port)) {
-                        if (copy_from_user(buf->data + fragm_crs, sect_crs, sz)) {
+                if (copy_from_user(buf->data + fragm_crs, sect_crs, sz)) {
+                        res = -EFAULT;
 error:
-                                for (; buf_chain; buf_chain = buf) {
-                                        buf = buf_chain->next;
-                                        kfree_skb(buf_chain);
-                                }
-                                return -EFAULT;
+                        for (; buf_chain; buf_chain = buf) {
+                                buf = buf_chain->next;
+                                kfree_skb(buf_chain);
                         }
-                } else
-                        skb_copy_to_linear_data_offset(buf, fragm_crs,
-                                                       sect_crs, sz);
+                        return res;
+                }
                 sect_crs += sz;
                 sect_rest -= sz;
                 fragm_crs += sz;
@@ -1281,8 +1243,10 @@ error:
                         msg_set_fragm_no(&fragm_hdr, ++fragm_no);
                         prev = buf;
                         buf = tipc_buf_acquire(fragm_sz + INT_H_SIZE);
-                        if (!buf)
+                        if (!buf) {
+                                res = -ENOMEM;
                                 goto error;
+                        }
 
                         buf->next = NULL;
                         prev->next = buf;
@@ -1446,7 +1410,7 @@ static void link_reset_all(unsigned long addr)
 }
 
 static void link_retransmit_failure(struct tipc_link *l_ptr,
-                                        struct sk_buff *buf)
+                                    struct sk_buff *buf)
 {
         struct tipc_msg *msg = buf_msg(buf);
 
@@ -1901,8 +1865,8 @@ static void link_handle_out_of_seq_msg(struct tipc_link *l_ptr,
  * Send protocol message to the other endpoint.
  */
 void tipc_link_send_proto_msg(struct tipc_link *l_ptr, u32 msg_typ,
-                                int probe_msg, u32 gap, u32 tolerance,
-                                u32 priority, u32 ack_mtu)
+                              int probe_msg, u32 gap, u32 tolerance,
+                              u32 priority, u32 ack_mtu)
 {
         struct sk_buff *buf = NULL;
         struct tipc_msg *msg = l_ptr->pmsg;
@@ -1988,6 +1952,7 @@ void tipc_link_send_proto_msg(struct tipc_link *l_ptr, u32 msg_typ,
                 return;
 
         skb_copy_to_linear_data(buf, msg, sizeof(l_ptr->proto_msg));
+        buf->priority = TC_PRIO_CONTROL;
 
         /* Defer message if bearer is already blocked */
         if (tipc_bearer_blocked(l_ptr->b_ptr)) {
@@ -2145,8 +2110,7 @@ exit:
  * another bearer. Owner node is locked.
  */
 static void tipc_link_tunnel(struct tipc_link *l_ptr,
-                             struct tipc_msg *tunnel_hdr,
-                             struct tipc_msg  *msg,
+                             struct tipc_msg *tunnel_hdr, struct tipc_msg *msg,
                              u32 selector)
 {
         struct tipc_link *tunnel;
diff --git a/net/tipc/msg.c b/net/tipc/msg.c
index f2db8a87d9c5..ced60e2fc4f7 100644
--- a/net/tipc/msg.c
+++ b/net/tipc/msg.c
@@ -51,8 +51,8 @@ u32 tipc_msg_tot_importance(struct tipc_msg *m)
 }
 
 
-void tipc_msg_init(struct tipc_msg *m, u32 user, u32 type,
-                            u32 hsize, u32 destnode)
+void tipc_msg_init(struct tipc_msg *m, u32 user, u32 type, u32 hsize,
+                   u32 destnode)
 {
         memset(m, 0, hsize);
         msg_set_version(m);
@@ -73,8 +73,8 @@ void tipc_msg_init(struct tipc_msg *m, u32 user, u32 type,
  * Returns message data size or errno
  */
 int tipc_msg_build(struct tipc_msg *hdr, struct iovec const *msg_sect,
-                   u32 num_sect, unsigned int total_len,
-                            int max_size, int usrmem, struct sk_buff **buf)
+                   u32 num_sect, unsigned int total_len, int max_size,
+                   struct sk_buff **buf)
 {
         int dsz, sz, hsz, pos, res, cnt;
 
@@ -92,14 +92,9 @@ int tipc_msg_build(struct tipc_msg *hdr, struct iovec const *msg_sect,
                 return -ENOMEM;
         skb_copy_to_linear_data(*buf, hdr, hsz);
         for (res = 1, cnt = 0; res && (cnt < num_sect); cnt++) {
-                if (likely(usrmem))
-                        res = !copy_from_user((*buf)->data + pos,
-                                              msg_sect[cnt].iov_base,
-                                              msg_sect[cnt].iov_len);
-                else
-                        skb_copy_to_linear_data_offset(*buf, pos,
-                                                       msg_sect[cnt].iov_base,
-                                                       msg_sect[cnt].iov_len);
+                skb_copy_to_linear_data_offset(*buf, pos,
+                                               msg_sect[cnt].iov_base,
+                                               msg_sect[cnt].iov_len);
                 pos += msg_sect[cnt].iov_len;
         }
         if (likely(res))
diff --git a/net/tipc/msg.h b/net/tipc/msg.h
index ba2a72beea68..5e4ccf5c27df 100644
--- a/net/tipc/msg.h
+++ b/net/tipc/msg.h
@@ -719,9 +719,9 @@ static inline void msg_set_link_tolerance(struct tipc_msg *m, u32 n)
 }
 
 u32 tipc_msg_tot_importance(struct tipc_msg *m);
-void tipc_msg_init(struct tipc_msg *m, u32 user, u32 type,
-                            u32 hsize, u32 destnode);
+void tipc_msg_init(struct tipc_msg *m, u32 user, u32 type, u32 hsize,
+                   u32 destnode);
 int tipc_msg_build(struct tipc_msg *hdr, struct iovec const *msg_sect,
-                   u32 num_sect, unsigned int total_len,
-                            int max_size, int usrmem, struct sk_buff **buf);
+                   u32 num_sect, unsigned int total_len, int max_size,
+                   struct sk_buff **buf);
 #endif
diff --git a/net/tipc/name_table.c b/net/tipc/name_table.c
index 24b167914311..09dcd54b04e1 100644
--- a/net/tipc/name_table.c
+++ b/net/tipc/name_table.c
@@ -440,7 +440,7 @@ found:
  * sequence overlapping with the requested sequence
  */
 static void tipc_nameseq_subscribe(struct name_seq *nseq,
-                                        struct tipc_subscription *s)
+                                   struct tipc_subscription *s)
 {
         struct sub_seq *sseq = nseq->sseqs;
 
@@ -662,7 +662,7 @@ exit:
  * tipc_nametbl_publish - add name publication to network name tables
  */
 struct publication *tipc_nametbl_publish(u32 type, u32 lower, u32 upper,
-                                    u32 scope, u32 port_ref, u32 key)
+                                         u32 scope, u32 port_ref, u32 key)
 {
         struct publication *publ;
 
@@ -753,7 +753,7 @@ void tipc_nametbl_unsubscribe(struct tipc_subscription *s)
  * subseq_list - print specified sub-sequence contents into the given buffer
  */
 static int subseq_list(struct sub_seq *sseq, char *buf, int len, u32 depth,
-                        u32 index)
+                       u32 index)
 {
         char portIdStr[27];
         const char *scope_str[] = {"", " zone", " cluster", " node"};
@@ -792,7 +792,7 @@ static int subseq_list(struct sub_seq *sseq, char *buf, int len, u32 depth,
  * nameseq_list - print specified name sequence contents into the given buffer
  */
 static int nameseq_list(struct name_seq *seq, char *buf, int len, u32 depth,
-                         u32 type, u32 lowbound, u32 upbound, u32 index)
+                        u32 type, u32 lowbound, u32 upbound, u32 index)
 {
         struct sub_seq *sseq;
         char typearea[11];
@@ -849,7 +849,7 @@ static int nametbl_header(char *buf, int len, u32 depth)
  * nametbl_list - print specified name table contents into the given buffer
  */
 static int nametbl_list(char *buf, int len, u32 depth_info,
-                         u32 type, u32 lowbound, u32 upbound)
+                        u32 type, u32 lowbound, u32 upbound)
 {
         struct hlist_head *seq_head;
         struct name_seq *seq;
diff --git a/net/tipc/name_table.h b/net/tipc/name_table.h
index 71cb4dc712df..f02f48b9a216 100644
--- a/net/tipc/name_table.h
+++ b/net/tipc/name_table.h
@@ -87,14 +87,15 @@ extern rwlock_t tipc_nametbl_lock;
 struct sk_buff *tipc_nametbl_get(const void *req_tlv_area, int req_tlv_space);
 u32 tipc_nametbl_translate(u32 type, u32 instance, u32 *node);
 int tipc_nametbl_mc_translate(u32 type, u32 lower, u32 upper, u32 limit,
-                         struct tipc_port_list *dports);
+                              struct tipc_port_list *dports);
 struct publication *tipc_nametbl_publish(u32 type, u32 lower, u32 upper,
-                                    u32 scope, u32 port_ref, u32 key);
+                                         u32 scope, u32 port_ref, u32 key);
 int tipc_nametbl_withdraw(u32 type, u32 lower, u32 ref, u32 key);
 struct publication *tipc_nametbl_insert_publ(u32 type, u32 lower, u32 upper,
-                                        u32 scope, u32 node, u32 ref, u32 key);
-struct publication *tipc_nametbl_remove_publ(u32 type, u32 lower,
-                                        u32 node, u32 ref, u32 key);
+                                             u32 scope, u32 node, u32 ref,
+                                             u32 key);
+struct publication *tipc_nametbl_remove_publ(u32 type, u32 lower, u32 node,
+                                             u32 ref, u32 key);
 void tipc_nametbl_subscribe(struct tipc_subscription *s);
 void tipc_nametbl_unsubscribe(struct tipc_subscription *s);
 int tipc_nametbl_init(void);
diff --git a/net/tipc/node_subscr.c b/net/tipc/node_subscr.c
index 5e34b015da45..8a7384c04add 100644
--- a/net/tipc/node_subscr.c
+++ b/net/tipc/node_subscr.c
@@ -42,7 +42,7 @@
  * tipc_nodesub_subscribe - create "node down" subscription for specified node
  */
 void tipc_nodesub_subscribe(struct tipc_node_subscr *node_sub, u32 addr,
-                       void *usr_handle, net_ev_handler handle_down)
+                            void *usr_handle, net_ev_handler handle_down)
 {
         if (in_own_node(addr)) {
                 node_sub->node = NULL;
diff --git a/net/tipc/port.c b/net/tipc/port.c
index 18098cac62f2..b3ed2fcab4fb 100644
--- a/net/tipc/port.c
+++ b/net/tipc/port.c
@@ -2,7 +2,7 @@
  * net/tipc/port.c: TIPC port code
  *
  * Copyright (c) 1992-2007, Ericsson AB
- * Copyright (c) 2004-2008, 2010-2011, Wind River Systems
+ * Copyright (c) 2004-2008, 2010-2013, Wind River Systems
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -46,11 +46,7 @@
 
 #define MAX_REJECT_SIZE 1024
 
-static struct sk_buff *msg_queue_head;
-static struct sk_buff *msg_queue_tail;
-
 DEFINE_SPINLOCK(tipc_port_list_lock);
-static DEFINE_SPINLOCK(queue_lock);
 
 static LIST_HEAD(ports);
 static void port_handle_node_down(unsigned long ref);
@@ -119,7 +115,7 @@ int tipc_multicast(u32 ref, struct tipc_name_seq const *seq,
         msg_set_nameupper(hdr, seq->upper);
         msg_set_hdr_sz(hdr, MCAST_H_SIZE);
         res = tipc_msg_build(hdr, msg_sect, num_sect, total_len, MAX_MSG_SIZE,
-                        !oport->user_port, &buf);
+                             &buf);
         if (unlikely(!buf))
                 return res;
 
@@ -206,14 +202,15 @@ exit:
 }
 
 /**
- * tipc_createport_raw - create a generic TIPC port
+ * tipc_createport - create a generic TIPC port
  *
  * Returns pointer to (locked) TIPC port, or NULL if unable to create it
  */
-struct tipc_port *tipc_createport_raw(void *usr_handle,
-                        u32 (*dispatcher)(struct tipc_port *, struct sk_buff *),
-                        void (*wakeup)(struct tipc_port *),
-                        const u32 importance)
+struct tipc_port *tipc_createport(struct sock *sk,
+                                  u32 (*dispatcher)(struct tipc_port *,
+                                  struct sk_buff *),
+                                  void (*wakeup)(struct tipc_port *),
+                                  const u32 importance)
 {
         struct tipc_port *p_ptr;
         struct tipc_msg *msg;
@@ -231,14 +228,13 @@ struct tipc_port *tipc_createport_raw(void *usr_handle,
                 return NULL;
         }
 
-        p_ptr->usr_handle = usr_handle;
+        p_ptr->sk = sk;
         p_ptr->max_pkt = MAX_PKT_DEFAULT;
         p_ptr->ref = ref;
         INIT_LIST_HEAD(&p_ptr->wait_list);
         INIT_LIST_HEAD(&p_ptr->subscription.nodesub_list);
         p_ptr->dispatcher = dispatcher;
         p_ptr->wakeup = wakeup;
-        p_ptr->user_port = NULL;
         k_init_timer(&p_ptr->timer, (Handler)port_timeout, ref);
         INIT_LIST_HEAD(&p_ptr->publications);
         INIT_LIST_HEAD(&p_ptr->port_list);
@@ -275,7 +271,6 @@ int tipc_deleteport(u32 ref)
                 buf = port_build_peer_abort_msg(p_ptr, TIPC_ERR_NO_PORT);
                 tipc_nodesub_unsubscribe(&p_ptr->subscription);
         }
-        kfree(p_ptr->user_port);
 
         spin_lock_bh(&tipc_port_list_lock);
         list_del(&p_ptr->port_list);
@@ -448,7 +443,7 @@ int tipc_port_reject_sections(struct tipc_port *p_ptr, struct tipc_msg *hdr,
         int res;
 
         res = tipc_msg_build(hdr, msg_sect, num_sect, total_len, MAX_MSG_SIZE,
-                        !p_ptr->user_port, &buf);
+                             &buf);
         if (!buf)
                 return res;
 
@@ -668,215 +663,6 @@ void tipc_port_reinit(void)
         spin_unlock_bh(&tipc_port_list_lock);
 }
 
-
-/*
- *  port_dispatcher_sigh(): Signal handler for messages destinated
- *                          to the tipc_port interface.
- */
-static void port_dispatcher_sigh(void *dummy)
-{
-        struct sk_buff *buf;
-
-        spin_lock_bh(&queue_lock);
-        buf = msg_queue_head;
-        msg_queue_head = NULL;
-        spin_unlock_bh(&queue_lock);
-
-        while (buf) {
-                struct tipc_port *p_ptr;
-                struct user_port *up_ptr;
-                struct tipc_portid orig;
-                struct tipc_name_seq dseq;
-                void *usr_handle;
-                int connected;
-                int peer_invalid;
-                int published;
-                u32 message_type;
-
-                struct sk_buff *next = buf->next;
-                struct tipc_msg *msg = buf_msg(buf);
-                u32 dref = msg_destport(msg);
-
-                message_type = msg_type(msg);
-                if (message_type > TIPC_DIRECT_MSG)
-                        goto reject;    /* Unsupported message type */
-
-                p_ptr = tipc_port_lock(dref);
-                if (!p_ptr)
-                        goto reject;    /* Port deleted while msg in queue */
-
-                orig.ref = msg_origport(msg);
-                orig.node = msg_orignode(msg);
-                up_ptr = p_ptr->user_port;
-                usr_handle = up_ptr->usr_handle;
-                connected = p_ptr->connected;
-                peer_invalid = connected && !tipc_port_peer_msg(p_ptr, msg);
-                published = p_ptr->published;
-
-                if (unlikely(msg_errcode(msg)))
-                        goto err;
-
-                switch (message_type) {
-
-                case TIPC_CONN_MSG:{
-                                tipc_conn_msg_event cb = up_ptr->conn_msg_cb;
-                                u32 dsz;
-
-                                tipc_port_unlock(p_ptr);
-                                if (unlikely(!cb))
-                                        goto reject;
-                                if (unlikely(!connected)) {
-                                        if (tipc_connect(dref, &orig))
-                                                goto reject;
-                                } else if (peer_invalid)
-                                        goto reject;
-                                dsz = msg_data_sz(msg);
-                                if (unlikely(dsz &&
-                                             (++p_ptr->conn_unacked >=
-                                              TIPC_FLOW_CONTROL_WIN)))
-                                        tipc_acknowledge(dref,
-                                                         p_ptr->conn_unacked);
-                                skb_pull(buf, msg_hdr_sz(msg));
-                                cb(usr_handle, dref, &buf, msg_data(msg), dsz);
-                                break;
-                        }
-                case TIPC_DIRECT_MSG:{
-                                tipc_msg_event cb = up_ptr->msg_cb;
-
-                                tipc_port_unlock(p_ptr);
-                                if (unlikely(!cb || connected))
-                                        goto reject;
-                                skb_pull(buf, msg_hdr_sz(msg));
-                                cb(usr_handle, dref, &buf, msg_data(msg),
-                                   msg_data_sz(msg), msg_importance(msg),
-                                   &orig);
-                                break;
-                        }
-                case TIPC_MCAST_MSG:
-                case TIPC_NAMED_MSG:{
-                                tipc_named_msg_event cb = up_ptr->named_msg_cb;
-
-                                tipc_port_unlock(p_ptr);
-                                if (unlikely(!cb || connected || !published))
-                                        goto reject;
-                                dseq.type =  msg_nametype(msg);
-                                dseq.lower = msg_nameinst(msg);
-                                dseq.upper = (message_type == TIPC_NAMED_MSG)
-                                        ? dseq.lower : msg_nameupper(msg);
-                                skb_pull(buf, msg_hdr_sz(msg));
-                                cb(usr_handle, dref, &buf, msg_data(msg),
-                                   msg_data_sz(msg), msg_importance(msg),
-                                   &orig, &dseq);
-                                break;
-                        }
-                }
-                if (buf)
-                        kfree_skb(buf);
-                buf = next;
-                continue;
-err:
-                switch (message_type) {
-
-                case TIPC_CONN_MSG:{
-                                tipc_conn_shutdown_event cb =
-                                        up_ptr->conn_err_cb;
-
-                                tipc_port_unlock(p_ptr);
-                                if (!cb || !connected || peer_invalid)
-                                        break;
-                                tipc_disconnect(dref);
-                                skb_pull(buf, msg_hdr_sz(msg));
-                                cb(usr_handle, dref, &buf, msg_data(msg),
-                                   msg_data_sz(msg), msg_errcode(msg));
-                                break;
-                        }
-                case TIPC_DIRECT_MSG:{
-                                tipc_msg_err_event cb = up_ptr->err_cb;
-
-                                tipc_port_unlock(p_ptr);
-                                if (!cb || connected)
-                                        break;
-                                skb_pull(buf, msg_hdr_sz(msg));
-                                cb(usr_handle, dref, &buf, msg_data(msg),
-                                   msg_data_sz(msg), msg_errcode(msg), &orig);
-                                break;
-                        }
-                case TIPC_MCAST_MSG:
-                case TIPC_NAMED_MSG:{
-                                tipc_named_msg_err_event cb =
-                                        up_ptr->named_err_cb;
-
-                                tipc_port_unlock(p_ptr);
-                                if (!cb || connected)
-                                        break;
-                                dseq.type =  msg_nametype(msg);
-                                dseq.lower = msg_nameinst(msg);
-                                dseq.upper = (message_type == TIPC_NAMED_MSG)
-                                        ? dseq.lower : msg_nameupper(msg);
-                                skb_pull(buf, msg_hdr_sz(msg));
-                                cb(usr_handle, dref, &buf, msg_data(msg),
-                                   msg_data_sz(msg), msg_errcode(msg), &dseq);
-                                break;
-                        }
-                }
-                if (buf)
-                        kfree_skb(buf);
-                buf = next;
-                continue;
-reject:
-                tipc_reject_msg(buf, TIPC_ERR_NO_PORT);
-                buf = next;
-        }
-}
-
-/*
- *  port_dispatcher(): Dispatcher for messages destinated
- *  to the tipc_port interface. Called with port locked.
- */
-static u32 port_dispatcher(struct tipc_port *dummy, struct sk_buff *buf)
-{
-        buf->next = NULL;
-        spin_lock_bh(&queue_lock);
-        if (msg_queue_head) {
-                msg_queue_tail->next = buf;
-                msg_queue_tail = buf;
-        } else {
-                msg_queue_tail = msg_queue_head = buf;
-                tipc_k_signal((Handler)port_dispatcher_sigh, 0);
-        }
-        spin_unlock_bh(&queue_lock);
-        return 0;
-}
-
-/*
- * Wake up port after congestion: Called with port locked
- */
-static void port_wakeup_sh(unsigned long ref)
-{
-        struct tipc_port *p_ptr;
-        struct user_port *up_ptr;
-        tipc_continue_event cb = NULL;
-        void *uh = NULL;
-
-        p_ptr = tipc_port_lock(ref);
-        if (p_ptr) {
-                up_ptr = p_ptr->user_port;
-                if (up_ptr) {
-                        cb = up_ptr->continue_event_cb;
-                        uh = up_ptr->usr_handle;
-                }
-                tipc_port_unlock(p_ptr);
-        }
-        if (cb)
-                cb(uh, ref);
-}
-
-
-static void port_wakeup(struct tipc_port *p_ptr)
-{
-        tipc_k_signal((Handler)port_wakeup_sh, p_ptr->ref);
-}
-
 void tipc_acknowledge(u32 ref, u32 ack)
 {
         struct tipc_port *p_ptr;
@@ -893,50 +679,6 @@ void tipc_acknowledge(u32 ref, u32 ack)
         tipc_net_route_msg(buf);
 }
 
-/*
- * tipc_createport(): user level call.
- */
-int tipc_createport(void *usr_handle,
-                    unsigned int importance,
-                    tipc_msg_err_event error_cb,
-                    tipc_named_msg_err_event named_error_cb,
-                    tipc_conn_shutdown_event conn_error_cb,
-                    tipc_msg_event msg_cb,
-                    tipc_named_msg_event named_msg_cb,
-                    tipc_conn_msg_event conn_msg_cb,
-                    tipc_continue_event continue_event_cb, /* May be zero */
-                    u32 *portref)
-{
-        struct user_port *up_ptr;
-        struct tipc_port *p_ptr;
-
-        up_ptr = kmalloc(sizeof(*up_ptr), GFP_ATOMIC);
-        if (!up_ptr) {
-                pr_warn("Port creation failed, no memory\n");
-                return -ENOMEM;
-        }
-        p_ptr = tipc_createport_raw(NULL, port_dispatcher, port_wakeup,
-                                    importance);
-        if (!p_ptr) {
-                kfree(up_ptr);
-                return -ENOMEM;
-        }
-
-        p_ptr->user_port = up_ptr;
-        up_ptr->usr_handle = usr_handle;
-        up_ptr->ref = p_ptr->ref;
-        up_ptr->err_cb = error_cb;
-        up_ptr->named_err_cb = named_error_cb;
-        up_ptr->conn_err_cb = conn_error_cb;
-        up_ptr->msg_cb = msg_cb;
-        up_ptr->named_msg_cb = named_msg_cb;
-        up_ptr->conn_msg_cb = conn_msg_cb;
-        up_ptr->continue_event_cb = continue_event_cb;
-        *portref = p_ptr->ref;
-        tipc_port_unlock(p_ptr);
-        return 0;
-}
-
 int tipc_portimportance(u32 ref, unsigned int *importance)
 {
         struct tipc_port *p_ptr;
@@ -1184,7 +926,7 @@ static int tipc_port_recv_sections(struct tipc_port *sender, unsigned int num_se
         int res;
 
         res = tipc_msg_build(&sender->phdr, msg_sect, num_sect, total_len,
-                        MAX_MSG_SIZE, !sender->user_port, &buf);
+                             MAX_MSG_SIZE, &buf);
         if (likely(buf))
                 tipc_port_recv_msg(buf);
         return res;
@@ -1322,43 +1064,3 @@ int tipc_send2port(u32 ref, struct tipc_portid const *dest,
         }
         return -ELINKCONG;
 }
-
-/**
- * tipc_send_buf2port - send message buffer to port identity
- */
-int tipc_send_buf2port(u32 ref, struct tipc_portid const *dest,
-               struct sk_buff *buf, unsigned int dsz)
-{
-        struct tipc_port *p_ptr;
-        struct tipc_msg *msg;
-        int res;
-
-        p_ptr = (struct tipc_port *)tipc_ref_deref(ref);
-        if (!p_ptr || p_ptr->connected)
-                return -EINVAL;
-
-        msg = &p_ptr->phdr;
-        msg_set_type(msg, TIPC_DIRECT_MSG);
-        msg_set_destnode(msg, dest->node);
-        msg_set_destport(msg, dest->ref);
-        msg_set_hdr_sz(msg, BASIC_H_SIZE);
-        msg_set_size(msg, BASIC_H_SIZE + dsz);
-        if (skb_cow(buf, BASIC_H_SIZE))
-                return -ENOMEM;
-
-        skb_push(buf, BASIC_H_SIZE);
-        skb_copy_to_linear_data(buf, msg, BASIC_H_SIZE);
-
-        if (in_own_node(dest->node))
-                res = tipc_port_recv_msg(buf);
-        else
-                res = tipc_send_buf_fast(buf, dest->node);
-        if (likely(res != -ELINKCONG)) {
-                if (res > 0)
-                        p_ptr->sent++;
-                return res;
-        }
-        if (port_unreliable(p_ptr))
-                return dsz;
-        return -ELINKCONG;
-}
diff --git a/net/tipc/port.h b/net/tipc/port.h
index fb66e2e5f4d1..5a7026b9c345 100644
--- a/net/tipc/port.h
+++ b/net/tipc/port.h
@@ -2,7 +2,7 @@
  * net/tipc/port.h: Include file for TIPC port code
  *
  * Copyright (c) 1994-2007, Ericsson AB
- * Copyright (c) 2004-2007, 2010-2011, Wind River Systems
+ * Copyright (c) 2004-2007, 2010-2013, Wind River Systems
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -43,60 +43,12 @@
 #include "node_subscr.h"
 
 #define TIPC_FLOW_CONTROL_WIN 512
-
-typedef void (*tipc_msg_err_event) (void *usr_handle, u32 portref,
-                struct sk_buff **buf, unsigned char const *data,
-                unsigned int size, int reason,
-                struct tipc_portid const *attmpt_destid);
-
-typedef void (*tipc_named_msg_err_event) (void *usr_handle, u32 portref,
-                struct sk_buff **buf, unsigned char const *data,
-                unsigned int size, int reason,
-                struct tipc_name_seq const *attmpt_dest);
-
-typedef void (*tipc_conn_shutdown_event) (void *usr_handle, u32 portref,
-                struct sk_buff **buf, unsigned char const *data,
-                unsigned int size, int reason);
-
-typedef void (*tipc_msg_event) (void *usr_handle, u32 portref,
-                struct sk_buff **buf, unsigned char const *data,
-                unsigned int size, unsigned int importance,
-                struct tipc_portid const *origin);
-
-typedef void (*tipc_named_msg_event) (void *usr_handle, u32 portref,
-                struct sk_buff **buf, unsigned char const *data,
-                unsigned int size, unsigned int importance,
-                struct tipc_portid const *orig,
-                struct tipc_name_seq const *dest);
-
-typedef void (*tipc_conn_msg_event) (void *usr_handle, u32 portref,
-                struct sk_buff **buf, unsigned char const *data,
-                unsigned int size);
-
-typedef void (*tipc_continue_event) (void *usr_handle, u32 portref);
-
-/**
- * struct user_port - TIPC user port (used with native API)
- * @usr_handle: user-specified field
- * @ref: object reference to associated TIPC port
- *
- * <various callback routines>
- */
-struct user_port {
-        void *usr_handle;
-        u32 ref;
-        tipc_msg_err_event err_cb;
-        tipc_named_msg_err_event named_err_cb;
-        tipc_conn_shutdown_event conn_err_cb;
-        tipc_msg_event msg_cb;
-        tipc_named_msg_event named_msg_cb;
-        tipc_conn_msg_event conn_msg_cb;
-        tipc_continue_event continue_event_cb;
-};
+#define CONN_OVERLOAD_LIMIT     ((TIPC_FLOW_CONTROL_WIN * 2 + 1) * \
+                                SKB_TRUESIZE(TIPC_MAX_USER_MSG_SIZE))
 
 /**
  * struct tipc_port - TIPC port structure
- * @usr_handle: pointer to additional user-defined information about port
+ * @sk: pointer to socket handle
  * @lock: pointer to spinlock for controlling access to port
  * @connected: non-zero if port is currently connected to a peer port
  * @conn_type: TIPC type used when connection was established
@@ -110,7 +62,6 @@ struct user_port {
  * @port_list: adjacent ports in TIPC's global list of ports
  * @dispatcher: ptr to routine which handles received messages
  * @wakeup: ptr to routine to call when port is no longer congested
- * @user_port: ptr to user port associated with port (if any)
  * @wait_list: adjacent ports in list of ports waiting on link congestion
  * @waiting_pkts:
  * @sent: # of non-empty messages sent by port
@@ -123,7 +74,7 @@ struct user_port {
  * @subscription: "node down" subscription used to terminate failed connections
  */
 struct tipc_port {
-        void *usr_handle;
+        struct sock *sk;
         spinlock_t *lock;
         int connected;
         u32 conn_type;
@@ -137,7 +88,6 @@ struct tipc_port {
         struct list_head port_list;
         u32 (*dispatcher)(struct tipc_port *, struct sk_buff *);
         void (*wakeup)(struct tipc_port *);
-        struct user_port *user_port;
         struct list_head wait_list;
         u32 waiting_pkts;
         u32 sent;
@@ -156,24 +106,16 @@ struct tipc_port_list;
 /*
  * TIPC port manipulation routines
  */
-struct tipc_port *tipc_createport_raw(void *usr_handle,
-                u32 (*dispatcher)(struct tipc_port *, struct sk_buff *),
-                void (*wakeup)(struct tipc_port *), const u32 importance);
+struct tipc_port *tipc_createport(struct sock *sk,
+                                  u32 (*dispatcher)(struct tipc_port *,
+                                  struct sk_buff *),
+                                  void (*wakeup)(struct tipc_port *),
+                                  const u32 importance);
 
 int tipc_reject_msg(struct sk_buff *buf, u32 err);
 
-int tipc_send_buf_fast(struct sk_buff *buf, u32 destnode);
-
 void tipc_acknowledge(u32 port_ref, u32 ack);
 
-int tipc_createport(void *usr_handle,
-                unsigned int importance, tipc_msg_err_event error_cb,
-                tipc_named_msg_err_event named_error_cb,
-                tipc_conn_shutdown_event conn_error_cb, tipc_msg_event msg_cb,
-                tipc_named_msg_event named_msg_cb,
-                tipc_conn_msg_event conn_msg_cb,
-                tipc_continue_event continue_event_cb, u32 *portref);
-
 int tipc_deleteport(u32 portref);
 
 int tipc_portimportance(u32 portref, unsigned int *importance);
@@ -186,9 +128,9 @@ int tipc_portunreturnable(u32 portref, unsigned int *isunreturnable);
 int tipc_set_portunreturnable(u32 portref, unsigned int isunreturnable);
 
 int tipc_publish(u32 portref, unsigned int scope,
-                struct tipc_name_seq const *name_seq);
+                 struct tipc_name_seq const *name_seq);
 int tipc_withdraw(u32 portref, unsigned int scope,
-                struct tipc_name_seq const *name_seq);
+                  struct tipc_name_seq const *name_seq);
 
 int tipc_connect(u32 portref, struct tipc_portid const *port);
 
@@ -220,9 +162,6 @@ int tipc_send2port(u32 portref, struct tipc_portid const *dest,
                    unsigned int num_sect, struct iovec const *msg_sect,
                    unsigned int total_len);
 
-int tipc_send_buf2port(u32 portref, struct tipc_portid const *dest,
-                struct sk_buff *buf, unsigned int dsz);
-
 int tipc_multicast(u32 portref, struct tipc_name_seq const *seq,
                    unsigned int section_count, struct iovec const *msg,
                    unsigned int total_len);
diff --git a/net/tipc/server.c b/net/tipc/server.c
new file mode 100644
index 000000000000..fd3fa57a410e
--- /dev/null
+++ b/net/tipc/server.c
@@ -0,0 +1,605 @@
+/*
+ * net/tipc/server.c: TIPC server infrastructure
+ *
+ * Copyright (c) 2012-2013, Wind River Systems
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. Neither the names of the copyright holders nor the names of its
+ *    contributors may be used to endorse or promote products derived from
+ *    this software without specific prior written permission.
+ *
+ * Alternatively, this software may be distributed under the terms of the
+ * GNU General Public License ("GPL") version 2 as published by the Free
+ * Software Foundation.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE
+ * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "server.h"
+#include "core.h"
+#include <net/sock.h>
+
+/* Number of messages to send before rescheduling */
+#define MAX_SEND_MSG_COUNT      25
+#define MAX_RECV_MSG_COUNT      25
+#define CF_CONNECTED            1
+
+#define sock2con(x) ((struct tipc_conn *)(x)->sk_user_data)
+
+/**
+ * struct tipc_conn - TIPC connection structure
+ * @kref: reference counter to connection object
+ * @conid: connection identifier
+ * @sock: socket handler associated with connection
+ * @flags: indicates connection state
+ * @server: pointer to connected server
+ * @rwork: receive work item
+ * @usr_data: user-specified field
+ * @rx_action: what to do when connection socket is active
+ * @outqueue: pointer to first outbound message in queue
+ * @outqueue_lock: controll access to the outqueue
+ * @outqueue: list of connection objects for its server
+ * @swork: send work item
+ */
+struct tipc_conn {
+        struct kref kref;
+        int conid;
+        struct socket *sock;
+        unsigned long flags;
+        struct tipc_server *server;
+        struct work_struct rwork;
+        int (*rx_action) (struct tipc_conn *con);
+        void *usr_data;
+        struct list_head outqueue;
+        spinlock_t outqueue_lock;
+        struct work_struct swork;
+};
+
+/* An entry waiting to be sent */
+struct outqueue_entry {
+        struct list_head list;
+        struct kvec iov;
+        struct sockaddr_tipc dest;
+};
+
+static void tipc_recv_work(struct work_struct *work);
+static void tipc_send_work(struct work_struct *work);
+static void tipc_clean_outqueues(struct tipc_conn *con);
+
+static void tipc_conn_kref_release(struct kref *kref)
+{
+        struct tipc_conn *con = container_of(kref, struct tipc_conn, kref);
+        struct tipc_server *s = con->server;
+
+        if (con->sock) {
+                tipc_sock_release_local(con->sock);
+                con->sock = NULL;
+        }
+
+        tipc_clean_outqueues(con);
+
+        if (con->conid)
+                s->tipc_conn_shutdown(con->conid, con->usr_data);
+
+        kfree(con);
+}
+
+static void conn_put(struct tipc_conn *con)
+{
+        kref_put(&con->kref, tipc_conn_kref_release);
+}
+
+static void conn_get(struct tipc_conn *con)
+{
+        kref_get(&con->kref);
+}
+
+static struct tipc_conn *tipc_conn_lookup(struct tipc_server *s, int conid)
+{
+        struct tipc_conn *con;
+
+        spin_lock_bh(&s->idr_lock);
+        con = idr_find(&s->conn_idr, conid);
+        if (con)
+                conn_get(con);
+        spin_unlock_bh(&s->idr_lock);
+        return con;
+}
+
+static void sock_data_ready(struct sock *sk, int unused)
+{
+        struct tipc_conn *con;
+
+        read_lock(&sk->sk_callback_lock);
+        con = sock2con(sk);
+        if (con && test_bit(CF_CONNECTED, &con->flags)) {
+                conn_get(con);
+                if (!queue_work(con->server->rcv_wq, &con->rwork))
+                        conn_put(con);
+        }
+        read_unlock(&sk->sk_callback_lock);
+}
+
+static void sock_write_space(struct sock *sk)
+{
+        struct tipc_conn *con;
+
+        read_lock(&sk->sk_callback_lock);
+        con = sock2con(sk);
+        if (con && test_bit(CF_CONNECTED, &con->flags)) {
+                conn_get(con);
+                if (!queue_work(con->server->send_wq, &con->swork))
+                        conn_put(con);
+        }
+        read_unlock(&sk->sk_callback_lock);
+}
+
+static void tipc_register_callbacks(struct socket *sock, struct tipc_conn *con)
+{
+        struct sock *sk = sock->sk;
+
+        write_lock_bh(&sk->sk_callback_lock);
+
+        sk->sk_data_ready = sock_data_ready;
+        sk->sk_write_space = sock_write_space;
+        sk->sk_user_data = con;
+
+        con->sock = sock;
+
+        write_unlock_bh(&sk->sk_callback_lock);
+}
+
+static void tipc_unregister_callbacks(struct tipc_conn *con)
+{
+        struct sock *sk = con->sock->sk;
+
+        write_lock_bh(&sk->sk_callback_lock);
+        sk->sk_user_data = NULL;
+        write_unlock_bh(&sk->sk_callback_lock);
+}
+
+static void tipc_close_conn(struct tipc_conn *con)
+{
+        struct tipc_server *s = con->server;
+
+        if (test_and_clear_bit(CF_CONNECTED, &con->flags)) {
+                spin_lock_bh(&s->idr_lock);
+                idr_remove(&s->conn_idr, con->conid);
+                s->idr_in_use--;
+                spin_unlock_bh(&s->idr_lock);
+
+                tipc_unregister_callbacks(con);
+
+                /* We shouldn't flush pending works as we may be in the
+                 * thread. In fact the races with pending rx/tx work structs
+                 * are harmless for us here as we have already deleted this
+                 * connection from server connection list and set
+                 * sk->sk_user_data to 0 before releasing connection object.
+                 */
+                kernel_sock_shutdown(con->sock, SHUT_RDWR);
+
+                conn_put(con);
+        }
+}
+
+static struct tipc_conn *tipc_alloc_conn(struct tipc_server *s)
+{
+        struct tipc_conn *con;
+        int ret;
+
+        con = kzalloc(sizeof(struct tipc_conn), GFP_ATOMIC);
+        if (!con)
+                return ERR_PTR(-ENOMEM);
+
+        kref_init(&con->kref);
+        INIT_LIST_HEAD(&con->outqueue);
+        spin_lock_init(&con->outqueue_lock);
+        INIT_WORK(&con->swork, tipc_send_work);
+        INIT_WORK(&con->rwork, tipc_recv_work);
+
+        spin_lock_bh(&s->idr_lock);
+        ret = idr_alloc(&s->conn_idr, con, 0, 0, GFP_ATOMIC);
+        if (ret < 0) {
+                kfree(con);
+                spin_unlock_bh(&s->idr_lock);
+                return ERR_PTR(-ENOMEM);
+        }
+        con->conid = ret;
+        s->idr_in_use++;
+        spin_unlock_bh(&s->idr_lock);
+
+        set_bit(CF_CONNECTED, &con->flags);
+        con->server = s;
+
+        return con;
+}
+
+static int tipc_receive_from_sock(struct tipc_conn *con)
+{
+        struct msghdr msg = {};
+        struct tipc_server *s = con->server;
+        struct sockaddr_tipc addr;
+        struct kvec iov;
+        void *buf;
+        int ret;
+
+        buf = kmem_cache_alloc(s->rcvbuf_cache, GFP_ATOMIC);
+        if (!buf) {
+                ret = -ENOMEM;
+                goto out_close;
+        }
+
+        iov.iov_base = buf;
+        iov.iov_len = s->max_rcvbuf_size;
+        msg.msg_name = &addr;
+        ret = kernel_recvmsg(con->sock, &msg, &iov, 1, iov.iov_len,
+                             MSG_DONTWAIT);
+        if (ret <= 0) {
+                kmem_cache_free(s->rcvbuf_cache, buf);
+                goto out_close;
+        }
+
+        s->tipc_conn_recvmsg(con->conid, &addr, con->usr_data, buf, ret);
+
+        kmem_cache_free(s->rcvbuf_cache, buf);
+
+        return 0;
+
+out_close:
+        if (ret != -EWOULDBLOCK)
+                tipc_close_conn(con);
+        else if (ret == 0)
+                /* Don't return success if we really got EOF */
+                ret = -EAGAIN;
+
+        return ret;
+}
+
+static int tipc_accept_from_sock(struct tipc_conn *con)
+{
+        struct tipc_server *s = con->server;
+        struct socket *sock = con->sock;
+        struct socket *newsock;
+        struct tipc_conn *newcon;
+        int ret;
+
+        ret = tipc_sock_accept_local(sock, &newsock, O_NONBLOCK);
+        if (ret < 0)
+                return ret;
+
+        newcon = tipc_alloc_conn(con->server);
+        if (IS_ERR(newcon)) {
+                ret = PTR_ERR(newcon);
+                sock_release(newsock);
+                return ret;
+        }
+
+        newcon->rx_action = tipc_receive_from_sock;
+        tipc_register_callbacks(newsock, newcon);
+
+        /* Notify that new connection is incoming */
+        newcon->usr_data = s->tipc_conn_new(newcon->conid);
+
+        /* Wake up receive process in case of 'SYN+' message */
+        newsock->sk->sk_data_ready(newsock->sk, 0);
+        return ret;
+}
+
+static struct socket *tipc_create_listen_sock(struct tipc_conn *con)
+{
+        struct tipc_server *s = con->server;
+        struct socket *sock = NULL;
+        int ret;
+
+        ret = tipc_sock_create_local(s->type, &sock);
+        if (ret < 0)
+                return NULL;
+        ret = kernel_setsockopt(sock, SOL_TIPC, TIPC_IMPORTANCE,
+                                (char *)&s->imp, sizeof(s->imp));
+        if (ret < 0)
+                goto create_err;
+        ret = kernel_bind(sock, (struct sockaddr *)s->saddr, sizeof(*s->saddr));
+        if (ret < 0)
+                goto create_err;
+
+        switch (s->type) {
+        case SOCK_STREAM:
+        case SOCK_SEQPACKET:
+                con->rx_action = tipc_accept_from_sock;
+
+                ret = kernel_listen(sock, 0);
+                if (ret < 0)
+                        goto create_err;
+                break;
+        case SOCK_DGRAM:
+        case SOCK_RDM:
+                con->rx_action = tipc_receive_from_sock;
+                break;
+        default:
+                pr_err("Unknown socket type %d\n", s->type);
+                goto create_err;
+        }
+        return sock;
+
+create_err:
+        sock_release(sock);
+        con->sock = NULL;
+        return NULL;
+}
+
+static int tipc_open_listening_sock(struct tipc_server *s)
+{
+        struct socket *sock;
+        struct tipc_conn *con;
+
+        con = tipc_alloc_conn(s);
+        if (IS_ERR(con))
+                return PTR_ERR(con);
+
+        sock = tipc_create_listen_sock(con);
+        if (!sock) {
+                idr_remove(&s->conn_idr, con->conid);
+                s->idr_in_use--;
+                kfree(con);
+                return -EINVAL;
+        }
+
+        tipc_register_callbacks(sock, con);
+        return 0;
+}
+
+static struct outqueue_entry *tipc_alloc_entry(void *data, int len)
+{
+        struct outqueue_entry *entry;
+        void *buf;
+
+        entry = kmalloc(sizeof(struct outqueue_entry), GFP_ATOMIC);
+        if (!entry)
+                return NULL;
+
+        buf = kmalloc(len, GFP_ATOMIC);
+        if (!buf) {
+                kfree(entry);
+                return NULL;
+        }
+
+        memcpy(buf, data, len);
+        entry->iov.iov_base = buf;
+        entry->iov.iov_len = len;
+
+        return entry;
+}
+
+static void tipc_free_entry(struct outqueue_entry *e)
+{
+        kfree(e->iov.iov_base);
+        kfree(e);
+}
+
+static void tipc_clean_outqueues(struct tipc_conn *con)
+{
+        struct outqueue_entry *e, *safe;
+
+        spin_lock_bh(&con->outqueue_lock);
+        list_for_each_entry_safe(e, safe, &con->outqueue, list) {
+                list_del(&e->list);
+                tipc_free_entry(e);
+        }
+        spin_unlock_bh(&con->outqueue_lock);
+}
+
+int tipc_conn_sendmsg(struct tipc_server *s, int conid,
+                      struct sockaddr_tipc *addr, void *data, size_t len)
+{
+        struct outqueue_entry *e;
+        struct tipc_conn *con;
+
+        con = tipc_conn_lookup(s, conid);
+        if (!con)
+                return -EINVAL;
+
+        e = tipc_alloc_entry(data, len);
+        if (!e) {
+                conn_put(con);
+                return -ENOMEM;
+        }
+
+        if (addr)
+                memcpy(&e->dest, addr, sizeof(struct sockaddr_tipc));
+
+        spin_lock_bh(&con->outqueue_lock);
+        list_add_tail(&e->list, &con->outqueue);
+        spin_unlock_bh(&con->outqueue_lock);
+
+        if (test_bit(CF_CONNECTED, &con->flags))
+                if (!queue_work(s->send_wq, &con->swork))
+                        conn_put(con);
+
+        return 0;
+}
+
+void tipc_conn_terminate(struct tipc_server *s, int conid)
+{
+        struct tipc_conn *con;
+
+        con = tipc_conn_lookup(s, conid);
+        if (con) {
+                tipc_close_conn(con);
+                conn_put(con);
+        }
+}
+
+static void tipc_send_to_sock(struct tipc_conn *con)
+{
+        int count = 0;
+        struct tipc_server *s = con->server;
+        struct outqueue_entry *e;
+        struct msghdr msg;
+        int ret;
+
+        spin_lock_bh(&con->outqueue_lock);
+        while (1) {
+                e = list_entry(con->outqueue.next, struct outqueue_entry,
+                               list);
+                if ((struct list_head *) e == &con->outqueue)
+                        break;
+                spin_unlock_bh(&con->outqueue_lock);
+
+                memset(&msg, 0, sizeof(msg));
+                msg.msg_flags = MSG_DONTWAIT;
+
+                if (s->type == SOCK_DGRAM || s->type == SOCK_RDM) {
+                        msg.msg_name = &e->dest;
+                        msg.msg_namelen = sizeof(struct sockaddr_tipc);
+                }
+                ret = kernel_sendmsg(con->sock, &msg, &e->iov, 1,
+                                     e->iov.iov_len);
+                if (ret == -EWOULDBLOCK || ret == 0) {
+                        cond_resched();
+                        goto out;
+                } else if (ret < 0) {
+                        goto send_err;
+                }
+
+                /* Don't starve users filling buffers */
+                if (++count >= MAX_SEND_MSG_COUNT) {
+                        cond_resched();
+                        count = 0;
+                }
+
+                spin_lock_bh(&con->outqueue_lock);
+                list_del(&e->list);
+                tipc_free_entry(e);
+        }
+        spin_unlock_bh(&con->outqueue_lock);
+out:
+        return;
+
+send_err:
+        tipc_close_conn(con);
+}
+
+static void tipc_recv_work(struct work_struct *work)
+{
+        struct tipc_conn *con = container_of(work, struct tipc_conn, rwork);
+        int count = 0;
+
+        while (test_bit(CF_CONNECTED, &con->flags)) {
+                if (con->rx_action(con))
+                        break;
+
+                /* Don't flood Rx machine */
+                if (++count >= MAX_RECV_MSG_COUNT) {
+                        cond_resched();
+                        count = 0;
+                }
+        }
+        conn_put(con);
+}
+
+static void tipc_send_work(struct work_struct *work)
+{
+        struct tipc_conn *con = container_of(work, struct tipc_conn, swork);
+
+        if (test_bit(CF_CONNECTED, &con->flags))
+                tipc_send_to_sock(con);
+
+        conn_put(con);
+}
+
+static void tipc_work_stop(struct tipc_server *s)
+{
+        destroy_workqueue(s->rcv_wq);
+        destroy_workqueue(s->send_wq);
+}
+
+static int tipc_work_start(struct tipc_server *s)
+{
+        s->rcv_wq = alloc_workqueue("tipc_rcv", WQ_UNBOUND, 1);
+        if (!s->rcv_wq) {
+                pr_err("can't start tipc receive workqueue\n");
+                return -ENOMEM;
+        }
+
+        s->send_wq = alloc_workqueue("tipc_send", WQ_UNBOUND, 1);
+        if (!s->send_wq) {
+                pr_err("can't start tipc send workqueue\n");
+                destroy_workqueue(s->rcv_wq);
+                return -ENOMEM;
+        }
+
+        return 0;
+}
+
+int tipc_server_start(struct tipc_server *s)
+{
+        int ret;
+
+        spin_lock_init(&s->idr_lock);
+        idr_init(&s->conn_idr);
+        s->idr_in_use = 0;
+
+        s->rcvbuf_cache = kmem_cache_create(s->name, s->max_rcvbuf_size,
+                                            0, SLAB_HWCACHE_ALIGN, NULL);
+        if (!s->rcvbuf_cache)
+                return -ENOMEM;
+
+        ret = tipc_work_start(s);
+        if (ret < 0) {
+                kmem_cache_destroy(s->rcvbuf_cache);
+                return ret;
+        }
+        ret = tipc_open_listening_sock(s);
+        if (ret < 0) {
+                tipc_work_stop(s);
+                kmem_cache_destroy(s->rcvbuf_cache);
+                return ret;
+        }
+        s->enabled = 1;
+        return ret;
+}
+
+void tipc_server_stop(struct tipc_server *s)
+{
+        struct tipc_conn *con;
+        int total = 0;
+        int id;
+
+        if (!s->enabled)
+                return;
+
+        s->enabled = 0;
+        spin_lock_bh(&s->idr_lock);
+        for (id = 0; total < s->idr_in_use; id++) {
+                con = idr_find(&s->conn_idr, id);
+                if (con) {
+                        total++;
+                        spin_unlock_bh(&s->idr_lock);
+                        tipc_close_conn(con);
+                        spin_lock_bh(&s->idr_lock);
+                }
+        }
+        spin_unlock_bh(&s->idr_lock);
+
+        tipc_work_stop(s);
+        kmem_cache_destroy(s->rcvbuf_cache);
+        idr_destroy(&s->conn_idr);
+}
diff --git a/net/tipc/server.h b/net/tipc/server.h
new file mode 100644
index 000000000000..98b23f20bc0f
--- /dev/null
+++ b/net/tipc/server.h
@@ -0,0 +1,94 @@
+/*
+ * net/tipc/server.h: Include file for TIPC server code
+ *
+ * Copyright (c) 2012-2013, Wind River Systems
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. Neither the names of the copyright holders nor the names of its
+ *    contributors may be used to endorse or promote products derived from
+ *    this software without specific prior written permission.
+ *
+ * Alternatively, this software may be distributed under the terms of the
+ * GNU General Public License ("GPL") version 2 as published by the Free
+ * Software Foundation.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE
+ * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef _TIPC_SERVER_H
+#define _TIPC_SERVER_H
+
+#include "core.h"
+
+#define TIPC_SERVER_NAME_LEN    32
+
+/**
+ * struct tipc_server - TIPC server structure
+ * @conn_idr: identifier set of connection
+ * @idr_lock: protect the connection identifier set
+ * @idr_in_use: amount of allocated identifier entry
+ * @rcvbuf_cache: memory cache of server receive buffer
+ * @rcv_wq: receive workqueue
+ * @send_wq: send workqueue
+ * @max_rcvbuf_size: maximum permitted receive message length
+ * @tipc_conn_new: callback will be called when new connection is incoming
+ * @tipc_conn_shutdown: callback will be called when connection is shut down
+ * @tipc_conn_recvmsg: callback will be called when message arrives
+ * @saddr: TIPC server address
+ * @name: server name
+ * @imp: message importance
+ * @type: socket type
+ * @enabled: identify whether server is launched or not
+ */
+struct tipc_server {
+        struct idr conn_idr;
+        spinlock_t idr_lock;
+        int idr_in_use;
+        struct kmem_cache *rcvbuf_cache;
+        struct workqueue_struct *rcv_wq;
+        struct workqueue_struct *send_wq;
+        int max_rcvbuf_size;
+        void *(*tipc_conn_new) (int conid);
+        void (*tipc_conn_shutdown) (int conid, void *usr_data);
+        void (*tipc_conn_recvmsg) (int conid, struct sockaddr_tipc *addr,
+                                   void *usr_data, void *buf, size_t len);
+        struct sockaddr_tipc *saddr;
+        const char name[TIPC_SERVER_NAME_LEN];
+        int imp;
+        int type;
+        int enabled;
+};
+
+int tipc_conn_sendmsg(struct tipc_server *s, int conid,
+                      struct sockaddr_tipc *addr, void *data, size_t len);
+
+/**
+ * tipc_conn_terminate - terminate connection with server
+ *
+ * Note: Must call it in process context since it might sleep
+ */
+void tipc_conn_terminate(struct tipc_server *s, int conid);
+
+int tipc_server_start(struct tipc_server *s);
+
+void tipc_server_stop(struct tipc_server *s);
+
+#endif
diff --git a/net/tipc/socket.c b/net/tipc/socket.c
index 515ce38e4f4c..6cc7ddd2fb7c 100644
--- a/net/tipc/socket.c
+++ b/net/tipc/socket.c
@@ -2,7 +2,7 @@
  * net/tipc/socket.c: TIPC socket API
  *
  * Copyright (c) 2001-2007, 2012 Ericsson AB
- * Copyright (c) 2004-2008, 2010-2012, Wind River Systems
+ * Copyright (c) 2004-2008, 2010-2013, Wind River Systems
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -43,8 +43,6 @@
 #define SS_LISTENING    -1      /* socket is listening */
 #define SS_READY        -2      /* socket is connectionless */
 
-#define CONN_OVERLOAD_LIMIT     ((TIPC_FLOW_CONTROL_WIN * 2 + 1) * \
-                                SKB_TRUESIZE(TIPC_MAX_USER_MSG_SIZE))
 #define CONN_TIMEOUT_DEFAULT    8000    /* default connect timeout = 8s */
 
 struct tipc_sock {
@@ -65,12 +63,15 @@ static u32 dispatch(struct tipc_port *tport, struct sk_buff *buf);
 static void wakeupdispatch(struct tipc_port *tport);
 static void tipc_data_ready(struct sock *sk, int len);
 static void tipc_write_space(struct sock *sk);
+static int release(struct socket *sock);
+static int accept(struct socket *sock, struct socket *new_sock, int flags);
 
 static const struct proto_ops packet_ops;
 static const struct proto_ops stream_ops;
 static const struct proto_ops msg_ops;
 
 static struct proto tipc_proto;
+static struct proto tipc_proto_kern;
 
 static int sockets_enabled;
 
@@ -143,7 +144,7 @@ static void reject_rx_queue(struct sock *sk)
 }
 
 /**
- * tipc_create - create a TIPC socket
+ * tipc_sk_create - create a TIPC socket
  * @net: network namespace (must be default network)
  * @sock: pre-allocated socket structure
  * @protocol: protocol indicator (must be 0)
@@ -154,8 +155,8 @@ static void reject_rx_queue(struct sock *sk)
  *
  * Returns 0 on success, errno otherwise
  */
-static int tipc_create(struct net *net, struct socket *sock, int protocol,
-                       int kern)
+static int tipc_sk_create(struct net *net, struct socket *sock, int protocol,
+                          int kern)
 {
         const struct proto_ops *ops;
         socket_state state;
@@ -185,13 +186,17 @@ static int tipc_create(struct net *net, struct socket *sock, int protocol,
         }
 
         /* Allocate socket's protocol area */
-        sk = sk_alloc(net, AF_TIPC, GFP_KERNEL, &tipc_proto);
+        if (!kern)
+                sk = sk_alloc(net, AF_TIPC, GFP_KERNEL, &tipc_proto);
+        else
+                sk = sk_alloc(net, AF_TIPC, GFP_KERNEL, &tipc_proto_kern);
+
         if (sk == NULL)
                 return -ENOMEM;
 
         /* Allocate TIPC port for socket to use */
-        tp_ptr = tipc_createport_raw(sk, &dispatch, &wakeupdispatch,
-                                     TIPC_LOW_IMPORTANCE);
+        tp_ptr = tipc_createport(sk, &dispatch, &wakeupdispatch,
+                                 TIPC_LOW_IMPORTANCE);
         if (unlikely(!tp_ptr)) {
                 sk_free(sk);
                 return -ENOMEM;
@@ -203,6 +208,7 @@ static int tipc_create(struct net *net, struct socket *sock, int protocol,
 
         sock_init_data(sock, sk);
         sk->sk_backlog_rcv = backlog_rcv;
+        sk->sk_rcvbuf = sysctl_tipc_rmem[1];
         sk->sk_data_ready = tipc_data_ready;
         sk->sk_write_space = tipc_write_space;
         tipc_sk(sk)->p = tp_ptr;
@@ -220,6 +226,78 @@ static int tipc_create(struct net *net, struct socket *sock, int protocol,
 }
 
 /**
+ * tipc_sock_create_local - create TIPC socket from inside TIPC module
+ * @type: socket type - SOCK_RDM or SOCK_SEQPACKET
+ *
+ * We cannot use sock_creat_kern here because it bumps module user count.
+ * Since socket owner and creator is the same module we must make sure
+ * that module count remains zero for module local sockets, otherwise
+ * we cannot do rmmod.
+ *
+ * Returns 0 on success, errno otherwise
+ */
+int tipc_sock_create_local(int type, struct socket **res)
+{
+        int rc;
+        struct sock *sk;
+
+        rc = sock_create_lite(AF_TIPC, type, 0, res);
+        if (rc < 0) {
+                pr_err("Failed to create kernel socket\n");
+                return rc;
+        }
+        tipc_sk_create(&init_net, *res, 0, 1);
+
+        sk = (*res)->sk;
+
+        return 0;
+}
+
+/**
+ * tipc_sock_release_local - release socket created by tipc_sock_create_local
+ * @sock: the socket to be released.
+ *
+ * Module reference count is not incremented when such sockets are created,
+ * so we must keep it from being decremented when they are released.
+ */
+void tipc_sock_release_local(struct socket *sock)
+{
+        release(sock);
+        sock->ops = NULL;
+        sock_release(sock);
+}
+
+/**
+ * tipc_sock_accept_local - accept a connection on a socket created
+ * with tipc_sock_create_local. Use this function to avoid that
+ * module reference count is inadvertently incremented.
+ *
+ * @sock:    the accepting socket
+ * @newsock: reference to the new socket to be created
+ * @flags:   socket flags
+ */
+
+int tipc_sock_accept_local(struct socket *sock, struct socket **newsock,
+                           int flags)
+{
+        struct sock *sk = sock->sk;
+        int ret;
+
+        ret = sock_create_lite(sk->sk_family, sk->sk_type,
+                               sk->sk_protocol, newsock);
+        if (ret < 0)
+                return ret;
+
+        ret = accept(sock, *newsock, flags);
+        if (ret < 0) {
+                sock_release(*newsock);
+                return ret;
+        }
+        (*newsock)->ops = sock->ops;
+        return ret;
+}
+
+/**
  * release - destroy a TIPC socket
  * @sock: socket to destroy
  *
@@ -324,7 +402,9 @@ static int bind(struct socket *sock, struct sockaddr *uaddr, int uaddr_len)
         else if (addr->addrtype != TIPC_ADDR_NAMESEQ)
                 return -EAFNOSUPPORT;
 
-        if (addr->addr.nameseq.type < TIPC_RESERVED_TYPES)
+        if ((addr->addr.nameseq.type < TIPC_RESERVED_TYPES) &&
+            (addr->addr.nameseq.type != TIPC_TOP_SRV) &&
+            (addr->addr.nameseq.type != TIPC_CFG_SRV))
                 return -EACCES;
 
         return (addr->scope > 0) ?
@@ -519,8 +599,7 @@ static int send_msg(struct kiocb *iocb, struct socket *sock,
                         res = -EISCONN;
                         goto exit;
                 }
-                if ((tport->published) ||
-                    ((sock->type == SOCK_STREAM) && (total_len != 0))) {
+                if (tport->published) {
                         res = -EOPNOTSUPP;
                         goto exit;
                 }
@@ -810,7 +889,7 @@ static void set_orig_addr(struct msghdr *m, struct tipc_msg *msg)
  * Returns 0 if successful, otherwise errno
  */
 static int anc_data_recv(struct msghdr *m, struct tipc_msg *msg,
-                                struct tipc_port *tport)
+                         struct tipc_port *tport)
 {
         u32 anc_data[3];
         u32 err;
@@ -1011,8 +1090,7 @@ static int recv_stream(struct kiocb *iocb, struct socket *sock,
 
         lock_sock(sk);
 
-        if (unlikely((sock->state == SS_UNCONNECTED) ||
-                     (sock->state == SS_CONNECTING))) {
+        if (unlikely((sock->state == SS_UNCONNECTED))) {
                 res = -ENOTCONN;
                 goto exit;
         }
@@ -1179,7 +1257,7 @@ static u32 filter_connect(struct tipc_sock *tsock, struct sk_buff **buf)
                 /* Accept only ACK or NACK message */
                 if (unlikely(msg_errcode(msg))) {
                         sock->state = SS_DISCONNECTING;
-                        sk->sk_err = -ECONNREFUSED;
+                        sk->sk_err = ECONNREFUSED;
                         retval = TIPC_OK;
                         break;
                 }
@@ -1190,7 +1268,7 @@ static u32 filter_connect(struct tipc_sock *tsock, struct sk_buff **buf)
                 res = auto_connect(sock, msg);
                 if (res) {
                         sock->state = SS_DISCONNECTING;
-                        sk->sk_err = res;
+                        sk->sk_err = -res;
                         retval = TIPC_OK;
                         break;
                 }
@@ -1233,10 +1311,10 @@ static u32 filter_connect(struct tipc_sock *tsock, struct sk_buff **buf)
  * For all connectionless messages, by default new queue limits are
  * as belows:
  *
- * TIPC_LOW_IMPORTANCE       (5MB)
- * TIPC_MEDIUM_IMPORTANCE    (10MB)
- * TIPC_HIGH_IMPORTANCE      (20MB)
- * TIPC_CRITICAL_IMPORTANCE  (40MB)
+ * TIPC_LOW_IMPORTANCE       (4 MB)
+ * TIPC_MEDIUM_IMPORTANCE    (8 MB)
+ * TIPC_HIGH_IMPORTANCE      (16 MB)
+ * TIPC_CRITICAL_IMPORTANCE  (32 MB)
  *
  * Returns overload limit according to corresponding message importance
  */
@@ -1246,9 +1324,10 @@ static unsigned int rcvbuf_limit(struct sock *sk, struct sk_buff *buf)
         unsigned int limit;
 
         if (msg_connected(msg))
-                limit = CONN_OVERLOAD_LIMIT;
+                limit = sysctl_tipc_rmem[2];
         else
-                limit = sk->sk_rcvbuf << (msg_importance(msg) + 5);
+                limit = sk->sk_rcvbuf >> TIPC_CRITICAL_IMPORTANCE <<
+                        msg_importance(msg);
         return limit;
 }
 
@@ -1327,7 +1406,7 @@ static int backlog_rcv(struct sock *sk, struct sk_buff *buf)
  */
 static u32 dispatch(struct tipc_port *tport, struct sk_buff *buf)
 {
-        struct sock *sk = (struct sock *)tport->usr_handle;
+        struct sock *sk = tport->sk;
         u32 res;
 
         /*
@@ -1358,7 +1437,7 @@ static u32 dispatch(struct tipc_port *tport, struct sk_buff *buf)
  */
 static void wakeupdispatch(struct tipc_port *tport)
 {
-        struct sock *sk = (struct sock *)tport->usr_handle;
+        struct sock *sk = tport->sk;
 
         sk->sk_write_space(sk);
 }
@@ -1531,7 +1610,7 @@ static int accept(struct socket *sock, struct socket *new_sock, int flags)
 
         buf = skb_peek(&sk->sk_receive_queue);
 
-        res = tipc_create(sock_net(sock->sk), new_sock, 0, 0);
+        res = tipc_sk_create(sock_net(sock->sk), new_sock, 0, 1);
         if (res)
                 goto exit;
 
@@ -1657,8 +1736,8 @@ restart:
  *
  * Returns 0 on success, errno otherwise
  */
-static int setsockopt(struct socket *sock,
-                      int lvl, int opt, char __user *ov, unsigned int ol)
+static int setsockopt(struct socket *sock, int lvl, int opt, char __user *ov,
+                      unsigned int ol)
 {
         struct sock *sk = sock->sk;
         struct tipc_port *tport = tipc_sk_port(sk);
@@ -1716,8 +1795,8 @@ static int setsockopt(struct socket *sock,
  *
  * Returns 0 on success, errno otherwise
  */
-static int getsockopt(struct socket *sock,
-                      int lvl, int opt, char __user *ov, int __user *ol)
+static int getsockopt(struct socket *sock, int lvl, int opt, char __user *ov,
+                      int __user *ol)
 {
         struct sock *sk = sock->sk;
         struct tipc_port *tport = tipc_sk_port(sk);
@@ -1841,13 +1920,20 @@ static const struct proto_ops stream_ops = {
 static const struct net_proto_family tipc_family_ops = {
         .owner          = THIS_MODULE,
         .family         = AF_TIPC,
-        .create         = tipc_create
+        .create         = tipc_sk_create
 };
 
 static struct proto tipc_proto = {
         .name           = "TIPC",
         .owner          = THIS_MODULE,
-        .obj_size       = sizeof(struct tipc_sock)
+        .obj_size       = sizeof(struct tipc_sock),
+        .sysctl_rmem    = sysctl_tipc_rmem
+};
+
+static struct proto tipc_proto_kern = {
+        .name           = "TIPC",
+        .obj_size       = sizeof(struct tipc_sock),
+        .sysctl_rmem    = sysctl_tipc_rmem
 };
 
 /**
diff --git a/net/tipc/subscr.c b/net/tipc/subscr.c
index 6b42d47029af..d38bb45d82e9 100644
--- a/net/tipc/subscr.c
+++ b/net/tipc/subscr.c
@@ -2,7 +2,7 @@
  * net/tipc/subscr.c: TIPC network topology service
  *
  * Copyright (c) 2000-2006, Ericsson AB
- * Copyright (c) 2005-2007, 2010-2011, Wind River Systems
+ * Copyright (c) 2005-2007, 2010-2013, Wind River Systems
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -41,33 +41,42 @@
 
 /**
  * struct tipc_subscriber - TIPC network topology subscriber
- * @port_ref: object reference to server port connecting to subscriber
- * @lock: pointer to spinlock controlling access to subscriber's server port
- * @subscriber_list: adjacent subscribers in top. server's list of subscribers
+ * @conid: connection identifier to server connecting to subscriber
+ * @lock: controll access to subscriber
  * @subscription_list: list of subscription objects for this subscriber
  */
 struct tipc_subscriber {
-        u32 port_ref;
-        spinlock_t *lock;
-        struct list_head subscriber_list;
+        int conid;
+        spinlock_t lock;
         struct list_head subscription_list;
 };
 
-/**
- * struct top_srv - TIPC network topology subscription service
- * @setup_port: reference to TIPC port that handles subscription requests
- * @subscription_count: number of active subscriptions (not subscribers!)
- * @subscriber_list: list of ports subscribing to service
- * @lock: spinlock govering access to subscriber list
- */
-struct top_srv {
-        u32 setup_port;
-        atomic_t subscription_count;
-        struct list_head subscriber_list;
-        spinlock_t lock;
+static void subscr_conn_msg_event(int conid, struct sockaddr_tipc *addr,
+                                  void *usr_data, void *buf, size_t len);
+static void *subscr_named_msg_event(int conid);
+static void subscr_conn_shutdown_event(int conid, void *usr_data);
+
+static atomic_t subscription_count = ATOMIC_INIT(0);
+
+static struct sockaddr_tipc topsrv_addr __read_mostly = {
+        .family                 = AF_TIPC,
+        .addrtype               = TIPC_ADDR_NAMESEQ,
+        .addr.nameseq.type      = TIPC_TOP_SRV,
+        .addr.nameseq.lower     = TIPC_TOP_SRV,
+        .addr.nameseq.upper     = TIPC_TOP_SRV,
+        .scope                  = TIPC_NODE_SCOPE
 };
 
-static struct top_srv topsrv;
+static struct tipc_server topsrv __read_mostly = {
+        .saddr                  = &topsrv_addr,
+        .imp                    = TIPC_CRITICAL_IMPORTANCE,
+        .type                   = SOCK_SEQPACKET,
+        .max_rcvbuf_size        = sizeof(struct tipc_subscr),
+        .name                   = "topology_server",
+        .tipc_conn_recvmsg      = subscr_conn_msg_event,
+        .tipc_conn_new          = subscr_named_msg_event,
+        .tipc_conn_shutdown     = subscr_conn_shutdown_event,
+};
 
 /**
  * htohl - convert value to endianness used by destination
@@ -81,20 +90,13 @@ static u32 htohl(u32 in, int swap)
         return swap ? swab32(in) : in;
 }
 
-/**
- * subscr_send_event - send a message containing a tipc_event to the subscriber
- *
- * Note: Must not hold subscriber's server port lock, since tipc_send() will
- *       try to take the lock if the message is rejected and returned!
- */
-static void subscr_send_event(struct tipc_subscription *sub,
-                              u32 found_lower,
-                              u32 found_upper,
-                              u32 event,
-                              u32 port_ref,
+static void subscr_send_event(struct tipc_subscription *sub, u32 found_lower,
+                              u32 found_upper, u32 event, u32 port_ref,
                               u32 node)
 {
-        struct iovec msg_sect;
+        struct tipc_subscriber *subscriber = sub->subscriber;
+        struct kvec msg_sect;
+        int ret;
 
         msg_sect.iov_base = (void *)&sub->evt;
         msg_sect.iov_len = sizeof(struct tipc_event);
@@ -104,7 +106,10 @@ static void subscr_send_event(struct tipc_subscription *sub,
         sub->evt.found_upper = htohl(found_upper, sub->swap);
         sub->evt.port.ref = htohl(port_ref, sub->swap);
         sub->evt.port.node = htohl(node, sub->swap);
-        tipc_send(sub->server_ref, 1, &msg_sect, msg_sect.iov_len);
+        ret = tipc_conn_sendmsg(&topsrv, subscriber->conid, NULL,
+                                msg_sect.iov_base, msg_sect.iov_len);
+        if (ret < 0)
+                pr_err("Sending subscription event failed, no memory\n");
 }
 
 /**
@@ -112,10 +117,8 @@ static void subscr_send_event(struct tipc_subscription *sub,
  *
  * Returns 1 if there is overlap, otherwise 0.
  */
-int tipc_subscr_overlap(struct tipc_subscription *sub,
-                        u32 found_lower,
+int tipc_subscr_overlap(struct tipc_subscription *sub, u32 found_lower,
                         u32 found_upper)
-
 {
         if (found_lower < sub->seq.lower)
                 found_lower = sub->seq.lower;
@@ -131,13 +134,9 @@ int tipc_subscr_overlap(struct tipc_subscription *sub,
  *
  * Protected by nameseq.lock in name_table.c
  */
-void tipc_subscr_report_overlap(struct tipc_subscription *sub,
-                                u32 found_lower,
-                                u32 found_upper,
-                                u32 event,
-                                u32 port_ref,
-                                u32 node,
-                                int must)
+void tipc_subscr_report_overlap(struct tipc_subscription *sub, u32 found_lower,
+                                u32 found_upper, u32 event, u32 port_ref,
+                                u32 node, int must)
 {
         if (!tipc_subscr_overlap(sub, found_lower, found_upper))
                 return;
@@ -147,21 +146,24 @@ void tipc_subscr_report_overlap(struct tipc_subscription *sub,
         subscr_send_event(sub, found_lower, found_upper, event, port_ref, node);
 }
 
-/**
- * subscr_timeout - subscription timeout has occurred
- */
 static void subscr_timeout(struct tipc_subscription *sub)
 {
-        struct tipc_port *server_port;
+        struct tipc_subscriber *subscriber = sub->subscriber;
+
+        /* The spin lock per subscriber is used to protect its members */
+        spin_lock_bh(&subscriber->lock);
 
-        /* Validate server port reference (in case subscriber is terminating) */
-        server_port = tipc_port_lock(sub->server_ref);
-        if (server_port == NULL)
+        /* Validate if the connection related to the subscriber is
+         * closed (in case subscriber is terminating)
+         */
+        if (subscriber->conid == 0) {
+                spin_unlock_bh(&subscriber->lock);
                 return;
+        }
 
         /* Validate timeout (in case subscription is being cancelled) */
         if (sub->timeout == TIPC_WAIT_FOREVER) {
-                tipc_port_unlock(server_port);
+                spin_unlock_bh(&subscriber->lock);
                 return;
         }
 
@@ -171,8 +173,7 @@ static void subscr_timeout(struct tipc_subscription *sub)
         /* Unlink subscription from subscriber */
         list_del(&sub->subscription_list);
 
-        /* Release subscriber's server port */
-        tipc_port_unlock(server_port);
+        spin_unlock_bh(&subscriber->lock);
 
         /* Notify subscriber of timeout */
         subscr_send_event(sub, sub->evt.s.seq.lower, sub->evt.s.seq.upper,
@@ -181,64 +182,54 @@ static void subscr_timeout(struct tipc_subscription *sub)
         /* Now destroy subscription */
         k_term_timer(&sub->timer);
         kfree(sub);
-        atomic_dec(&topsrv.subscription_count);
+        atomic_dec(&subscription_count);
 }
 
 /**
  * subscr_del - delete a subscription within a subscription list
  *
- * Called with subscriber port locked.
+ * Called with subscriber lock held.
  */
 static void subscr_del(struct tipc_subscription *sub)
 {
         tipc_nametbl_unsubscribe(sub);
         list_del(&sub->subscription_list);
         kfree(sub);
-        atomic_dec(&topsrv.subscription_count);
+        atomic_dec(&subscription_count);
 }
 
 /**
  * subscr_terminate - terminate communication with a subscriber
  *
- * Called with subscriber port locked.  Routine must temporarily release lock
- * to enable subscription timeout routine(s) to finish without deadlocking;
- * the lock is then reclaimed to allow caller to release it upon return.
- * (This should work even in the unlikely event some other thread creates
- * a new object reference in the interim that uses this lock; this routine will
- * simply wait for it to be released, then claim it.)
+ * Note: Must call it in process context since it might sleep.
  */
 static void subscr_terminate(struct tipc_subscriber *subscriber)
 {
-        u32 port_ref;
+        tipc_conn_terminate(&topsrv, subscriber->conid);
+}
+
+static void subscr_release(struct tipc_subscriber *subscriber)
+{
         struct tipc_subscription *sub;
         struct tipc_subscription *sub_temp;
 
-        /* Invalidate subscriber reference */
-        port_ref = subscriber->port_ref;
-        subscriber->port_ref = 0;
-        spin_unlock_bh(subscriber->lock);
+        spin_lock_bh(&subscriber->lock);
 
-        /* Sever connection to subscriber */
-        tipc_shutdown(port_ref);
-        tipc_deleteport(port_ref);
+        /* Invalidate subscriber reference */
+        subscriber->conid = 0;
 
         /* Destroy any existing subscriptions for subscriber */
         list_for_each_entry_safe(sub, sub_temp, &subscriber->subscription_list,
                                  subscription_list) {
                 if (sub->timeout != TIPC_WAIT_FOREVER) {
+                        spin_unlock_bh(&subscriber->lock);
                         k_cancel_timer(&sub->timer);
                         k_term_timer(&sub->timer);
+                        spin_lock_bh(&subscriber->lock);
                 }
                 subscr_del(sub);
         }
-
-        /* Remove subscriber from topology server's subscriber list */
-        spin_lock_bh(&topsrv.lock);
-        list_del(&subscriber->subscriber_list);
-        spin_unlock_bh(&topsrv.lock);
-
-        /* Reclaim subscriber lock */
-        spin_lock_bh(subscriber->lock);
+        spin_unlock_bh(&subscriber->lock);
 
         /* Now destroy subscriber */
         kfree(subscriber);
@@ -247,7 +238,7 @@ static void subscr_terminate(struct tipc_subscriber *subscriber)
 /**
  * subscr_cancel - handle subscription cancellation request
  *
- * Called with subscriber port locked.  Routine must temporarily release lock
+ * Called with subscriber lock held. Routine must temporarily release lock
  * to enable the subscription timeout routine to finish without deadlocking;
  * the lock is then reclaimed to allow caller to release it upon return.
  *
@@ -274,10 +265,10 @@ static void subscr_cancel(struct tipc_subscr *s,
         /* Cancel subscription timer (if used), then delete subscription */
         if (sub->timeout != TIPC_WAIT_FOREVER) {
                 sub->timeout = TIPC_WAIT_FOREVER;
-                spin_unlock_bh(subscriber->lock);
+                spin_unlock_bh(&subscriber->lock);
                 k_cancel_timer(&sub->timer);
                 k_term_timer(&sub->timer);
-                spin_lock_bh(subscriber->lock);
+                spin_lock_bh(&subscriber->lock);
         }
         subscr_del(sub);
 }
@@ -285,7 +276,7 @@ static void subscr_cancel(struct tipc_subscr *s,
 /**
  * subscr_subscribe - create subscription for subscriber
  *
- * Called with subscriber port locked.
+ * Called with subscriber lock held.
  */
 static struct tipc_subscription *subscr_subscribe(struct tipc_subscr *s,
                                              struct tipc_subscriber *subscriber)
@@ -304,7 +295,7 @@ static struct tipc_subscription *subscr_subscribe(struct tipc_subscr *s,
         }
 
         /* Refuse subscription if global limit exceeded */
-        if (atomic_read(&topsrv.subscription_count) >= TIPC_MAX_SUBSCRIPTIONS) {
+        if (atomic_read(&subscription_count) >= TIPC_MAX_SUBSCRIPTIONS) {
                 pr_warn("Subscription rejected, limit reached (%u)\n",
                         TIPC_MAX_SUBSCRIPTIONS);
                 subscr_terminate(subscriber);
@@ -335,10 +326,10 @@ static struct tipc_subscription *subscr_subscribe(struct tipc_subscr *s,
         }
         INIT_LIST_HEAD(&sub->nameseq_list);
         list_add(&sub->subscription_list, &subscriber->subscription_list);
-        sub->server_ref = subscriber->port_ref;
+        sub->subscriber = subscriber;
         sub->swap = swap;
         memcpy(&sub->evt.s, s, sizeof(struct tipc_subscr));
-        atomic_inc(&topsrv.subscription_count);
+        atomic_inc(&subscription_count);
         if (sub->timeout != TIPC_WAIT_FOREVER) {
                 k_init_timer(&sub->timer,
                              (Handler)subscr_timeout, (unsigned long)sub);
@@ -348,196 +339,51 @@ static struct tipc_subscription *subscr_subscribe(struct tipc_subscr *s,
         return sub;
 }
 
-/**
- * subscr_conn_shutdown_event - handle termination request from subscriber
- *
- * Called with subscriber's server port unlocked.
- */
-static void subscr_conn_shutdown_event(void *usr_handle,
-                                       u32 port_ref,
-                                       struct sk_buff **buf,
-                                       unsigned char const *data,
-                                       unsigned int size,
-                                       int reason)
+/* Handle one termination request for the subscriber */
+static void subscr_conn_shutdown_event(int conid, void *usr_data)
 {
-        struct tipc_subscriber *subscriber = usr_handle;
-        spinlock_t *subscriber_lock;
-
-        if (tipc_port_lock(port_ref) == NULL)
-                return;
-
-        subscriber_lock = subscriber->lock;
-        subscr_terminate(subscriber);
-        spin_unlock_bh(subscriber_lock);
+        subscr_release((struct tipc_subscriber *)usr_data);
 }
 
-/**
- * subscr_conn_msg_event - handle new subscription request from subscriber
- *
- * Called with subscriber's server port unlocked.
- */
-static void subscr_conn_msg_event(void *usr_handle,
-                                  u32 port_ref,
-                                  struct sk_buff **buf,
-                                  const unchar *data,
-                                  u32 size)
+/* Handle one request to create a new subscription for the subscriber */
+static void subscr_conn_msg_event(int conid, struct sockaddr_tipc *addr,
+                                  void *usr_data, void *buf, size_t len)
 {
-        struct tipc_subscriber *subscriber = usr_handle;
-        spinlock_t *subscriber_lock;
+        struct tipc_subscriber *subscriber = usr_data;
         struct tipc_subscription *sub;
 
-        /*
-         * Lock subscriber's server port (& make a local copy of lock pointer,
-         * in case subscriber is deleted while processing subscription request)
-         */
-        if (tipc_port_lock(port_ref) == NULL)
-                return;
-
-        subscriber_lock = subscriber->lock;
-
-        if (size != sizeof(struct tipc_subscr)) {
-                subscr_terminate(subscriber);
-                spin_unlock_bh(subscriber_lock);
-        } else {
-                sub = subscr_subscribe((struct tipc_subscr *)data, subscriber);
-                spin_unlock_bh(subscriber_lock);
-                if (sub != NULL) {
-
-                        /*
-                         * We must release the server port lock before adding a
-                         * subscription to the name table since TIPC needs to be
-                         * able to (re)acquire the port lock if an event message
-                         * issued by the subscription process is rejected and
-                         * returned.  The subscription cannot be deleted while
-                         * it is being added to the name table because:
-                         * a) the single-threading of the native API port code
-                         *    ensures the subscription cannot be cancelled and
-                         *    the subscriber connection cannot be broken, and
-                         * b) the name table lock ensures the subscription
-                         *    timeout code cannot delete the subscription,
-                         * so the subscription object is still protected.
-                         */
-                        tipc_nametbl_subscribe(sub);
-                }
-        }
+        spin_lock_bh(&subscriber->lock);
+        sub = subscr_subscribe((struct tipc_subscr *)buf, subscriber);
+        if (sub)
+                tipc_nametbl_subscribe(sub);
+        spin_unlock_bh(&subscriber->lock);
 }
 
-/**
- * subscr_named_msg_event - handle request to establish a new subscriber
- */
-static void subscr_named_msg_event(void *usr_handle,
-                                   u32 port_ref,
-                                   struct sk_buff **buf,
-                                   const unchar *data,
-                                   u32 size,
-                                   u32 importance,
-                                   struct tipc_portid const *orig,
-                                   struct tipc_name_seq const *dest)
+
+/* Handle one request to establish a new subscriber */
+static void *subscr_named_msg_event(int conid)
 {
         struct tipc_subscriber *subscriber;
-        u32 server_port_ref;
 
         /* Create subscriber object */
         subscriber = kzalloc(sizeof(struct tipc_subscriber), GFP_ATOMIC);
         if (subscriber == NULL) {
                 pr_warn("Subscriber rejected, no memory\n");
-                return;
+                return NULL;
         }
         INIT_LIST_HEAD(&subscriber->subscription_list);
-        INIT_LIST_HEAD(&subscriber->subscriber_list);
-
-        /* Create server port & establish connection to subscriber */
-        tipc_createport(subscriber,
-                        importance,
-                        NULL,
-                        NULL,
-                        subscr_conn_shutdown_event,
-                        NULL,
-                        NULL,
-                        subscr_conn_msg_event,
-                        NULL,
-                        &subscriber->port_ref);
-        if (subscriber->port_ref == 0) {
-                pr_warn("Subscriber rejected, unable to create port\n");
-                kfree(subscriber);
-                return;
-        }
-        tipc_connect(subscriber->port_ref, orig);
-
-        /* Lock server port (& save lock address for future use) */
-        subscriber->lock = tipc_port_lock(subscriber->port_ref)->lock;
-
-        /* Add subscriber to topology server's subscriber list */
-        spin_lock_bh(&topsrv.lock);
-        list_add(&subscriber->subscriber_list, &topsrv.subscriber_list);
-        spin_unlock_bh(&topsrv.lock);
-
-        /* Unlock server port */
-        server_port_ref = subscriber->port_ref;
-        spin_unlock_bh(subscriber->lock);
-
-        /* Send an ACK- to complete connection handshaking */
-        tipc_send(server_port_ref, 0, NULL, 0);
+        subscriber->conid = conid;
+        spin_lock_init(&subscriber->lock);
 
-        /* Handle optional subscription request */
-        if (size != 0) {
-                subscr_conn_msg_event(subscriber, server_port_ref,
-                                      buf, data, size);
-        }
+        return (void *)subscriber;
 }
 
 int tipc_subscr_start(void)
 {
-        struct tipc_name_seq seq = {TIPC_TOP_SRV, TIPC_TOP_SRV, TIPC_TOP_SRV};
-        int res;
-
-        spin_lock_init(&topsrv.lock);
-        INIT_LIST_HEAD(&topsrv.subscriber_list);
-
-        res = tipc_createport(NULL,
-                              TIPC_CRITICAL_IMPORTANCE,
-                              NULL,
-                              NULL,
-                              NULL,
-                              NULL,
-                              subscr_named_msg_event,
-                              NULL,
-                              NULL,
-                              &topsrv.setup_port);
-        if (res)
-                goto failed;
-
-        res = tipc_publish(topsrv.setup_port, TIPC_NODE_SCOPE, &seq);
-        if (res) {
-                tipc_deleteport(topsrv.setup_port);
-                topsrv.setup_port = 0;
-                goto failed;
-        }
-
-        return 0;
-
-failed:
-        pr_err("Failed to create subscription service\n");
-        return res;
+        return tipc_server_start(&topsrv);
 }
 
 void tipc_subscr_stop(void)
 {
-        struct tipc_subscriber *subscriber;
-        struct tipc_subscriber *subscriber_temp;
-        spinlock_t *subscriber_lock;
-
-        if (topsrv.setup_port) {
-                tipc_deleteport(topsrv.setup_port);
-                topsrv.setup_port = 0;
-
-                list_for_each_entry_safe(subscriber, subscriber_temp,
-                                         &topsrv.subscriber_list,
-                                         subscriber_list) {
-                        subscriber_lock = subscriber->lock;
-                        spin_lock_bh(subscriber_lock);
-                        subscr_terminate(subscriber);
-                        spin_unlock_bh(subscriber_lock);
-                }
-        }
+        tipc_server_stop(&topsrv);
 }
diff --git a/net/tipc/subscr.h b/net/tipc/subscr.h
index 218d2e07f0cc..393e417bee3f 100644
--- a/net/tipc/subscr.h
+++ b/net/tipc/subscr.h
@@ -2,7 +2,7 @@
  * net/tipc/subscr.h: Include file for TIPC network topology service
  *
  * Copyright (c) 2003-2006, Ericsson AB
- * Copyright (c) 2005-2007, Wind River Systems
+ * Copyright (c) 2005-2007, 2012-2013, Wind River Systems
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -37,10 +37,14 @@
 #ifndef _TIPC_SUBSCR_H
 #define _TIPC_SUBSCR_H
 
+#include "server.h"
+
 struct tipc_subscription;
+struct tipc_subscriber;
 
 /**
  * struct tipc_subscription - TIPC network topology subscription object
+ * @subscriber: pointer to its subscriber
  * @seq: name sequence associated with subscription
  * @timeout: duration of subscription (in ms)
  * @filter: event filtering to be done for subscription
@@ -52,28 +56,23 @@ struct tipc_subscription;
  * @evt: template for events generated by subscription
  */
 struct tipc_subscription {
+        struct tipc_subscriber *subscriber;
         struct tipc_name_seq seq;
         u32 timeout;
         u32 filter;
         struct timer_list timer;
         struct list_head nameseq_list;
         struct list_head subscription_list;
-        u32 server_ref;
         int swap;
         struct tipc_event evt;
 };
 
-int tipc_subscr_overlap(struct tipc_subscription *sub,
-                        u32 found_lower,
+int tipc_subscr_overlap(struct tipc_subscription *sub, u32 found_lower,
                         u32 found_upper);
 
-void tipc_subscr_report_overlap(struct tipc_subscription *sub,
-                                u32 found_lower,
-                                u32 found_upper,
-                                u32 event,
-                                u32 port_ref,
-                                u32 node,
-                                int must_report);
+void tipc_subscr_report_overlap(struct tipc_subscription *sub, u32 found_lower,
+                                u32 found_upper, u32 event, u32 port_ref,
+                                u32 node, int must);
 
 int tipc_subscr_start(void);
 
diff --git a/net/tipc/sysctl.c b/net/tipc/sysctl.c
new file mode 100644
index 000000000000..f3fef93325a8
--- /dev/null
+++ b/net/tipc/sysctl.c
@@ -0,0 +1,64 @@
+/*
+ * net/tipc/sysctl.c: sysctl interface to TIPC subsystem
+ *
+ * Copyright (c) 2013, Wind River Systems
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. Neither the names of the copyright holders nor the names of its
+ *    contributors may be used to endorse or promote products derived from
+ *    this software without specific prior written permission.
+ *
+ * Alternatively, this software may be distributed under the terms of the
+ * GNU General Public License ("GPL") version 2 as published by the Free
+ * Software Foundation.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE
+ * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "core.h"
+
+#include <linux/sysctl.h>
+
+static struct ctl_table_header *tipc_ctl_hdr;
+
+static struct ctl_table tipc_table[] = {
+        {
+                .procname       = "tipc_rmem",
+                .data           = &sysctl_tipc_rmem,
+                .maxlen         = sizeof(sysctl_tipc_rmem),
+                .mode           = 0644,
+                .proc_handler   = proc_dointvec,
+        },
+        {}
+};
+
+int tipc_register_sysctl(void)
+{
+        tipc_ctl_hdr = register_net_sysctl(&init_net, "net/tipc", tipc_table);
+        if (tipc_ctl_hdr == NULL)
+                return -ENOMEM;
+        return 0;
+}
+
+void tipc_unregister_sysctl(void)
+{
+        unregister_net_sysctl_table(tipc_ctl_hdr);
+}
diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
index 826e09938bff..86de99ad2976 100644
--- a/net/unix/af_unix.c
+++ b/net/unix/af_unix.c
@@ -114,6 +114,7 @@
 #include <linux/mount.h>
 #include <net/checksum.h>
 #include <linux/security.h>
+#include <linux/freezer.h>
 
 struct hlist_head unix_socket_table[2 * UNIX_HASH_SIZE];
 EXPORT_SYMBOL_GPL(unix_socket_table);
@@ -1478,7 +1479,8 @@ static int unix_dgram_sendmsg(struct kiocb *kiocb, struct socket *sock,
                                  MAX_SKB_FRAGS * PAGE_SIZE);
 
         skb = sock_alloc_send_pskb(sk, len - data_len, data_len,
-                                   msg->msg_flags & MSG_DONTWAIT, &err);
+                                   msg->msg_flags & MSG_DONTWAIT, &err,
+                                   PAGE_ALLOC_COSTLY_ORDER);
         if (skb == NULL)
                 goto out;
 
@@ -1595,6 +1597,10 @@ out:
         return err;
 }
 
+/* We use paged skbs for stream sockets, and limit occupancy to 32768
+ * bytes, and a minimun of a full page.
+ */
+#define UNIX_SKB_FRAGS_SZ (PAGE_SIZE << get_order(32768))
 
 static int unix_stream_sendmsg(struct kiocb *kiocb, struct socket *sock,
                                struct msghdr *msg, size_t len)
@@ -1608,6 +1614,7 @@ static int unix_stream_sendmsg(struct kiocb *kiocb, struct socket *sock,
         struct scm_cookie tmp_scm;
         bool fds_sent = false;
         int max_level;
+        int data_len;
 
         if (NULL == siocb->scm)
                 siocb->scm = &tmp_scm;
@@ -1634,40 +1641,22 @@ static int unix_stream_sendmsg(struct kiocb *kiocb, struct socket *sock,
                 goto pipe_err;
 
         while (sent < len) {
-                /*
-                 *      Optimisation for the fact that under 0.01% of X
-                 *      messages typically need breaking up.
-                 */
-
-                size = len-sent;
+                size = len - sent;
 
                 /* Keep two messages in the pipe so it schedules better */
-                if (size > ((sk->sk_sndbuf >> 1) - 64))
-                        size = (sk->sk_sndbuf >> 1) - 64;
+                size = min_t(int, size, (sk->sk_sndbuf >> 1) - 64);
 
-                if (size > SKB_MAX_ALLOC)
-                        size = SKB_MAX_ALLOC;
+                /* allow fallback to order-0 allocations */
+                size = min_t(int, size, SKB_MAX_HEAD(0) + UNIX_SKB_FRAGS_SZ);
 
-                /*
-                 *      Grab a buffer
-                 */
+                data_len = max_t(int, 0, size - SKB_MAX_HEAD(0));
 
-                skb = sock_alloc_send_skb(sk, size, msg->msg_flags&MSG_DONTWAIT,
-                                          &err);
-
-                if (skb == NULL)
+                skb = sock_alloc_send_pskb(sk, size - data_len, data_len,
+                                           msg->msg_flags & MSG_DONTWAIT, &err,
+                                           get_order(UNIX_SKB_FRAGS_SZ));
+                if (!skb)
                         goto out_err;
 
-                /*
-                 *      If you pass two values to the sock_alloc_send_skb
-                 *      it tries to grab the large buffer with GFP_NOFS
-                 *      (which can fail easily), and if it fails grab the
-                 *      fallback size buffer which is under a page and will
-                 *      succeed. [Alan]
-                 */
-                size = min_t(int, size, skb_tailroom(skb));
-
-
                 /* Only send the fds in the first buffer */
                 err = unix_scm_to_skb(siocb->scm, skb, !fds_sent);
                 if (err < 0) {
@@ -1677,7 +1666,11 @@ static int unix_stream_sendmsg(struct kiocb *kiocb, struct socket *sock,
                 max_level = err + 1;
                 fds_sent = true;
 
-                err = memcpy_fromiovec(skb_put(skb, size), msg->msg_iov, size);
+                skb_put(skb, size - data_len);
+                skb->data_len = data_len;
+                skb->len = size;
+                err = skb_copy_datagram_from_iovec(skb, 0, msg->msg_iov,
+                                                   sent, size);
                 if (err) {
                         kfree_skb(skb);
                         goto out_err;
@@ -1879,7 +1872,7 @@ static long unix_stream_data_wait(struct sock *sk, long timeo,
 
                 set_bit(SOCK_ASYNC_WAITDATA, &sk->sk_socket->flags);
                 unix_state_unlock(sk);
-                timeo = schedule_timeout(timeo);
+                timeo = freezable_schedule_timeout(timeo);
                 unix_state_lock(sk);
                 clear_bit(SOCK_ASYNC_WAITDATA, &sk->sk_socket->flags);
         }
@@ -1889,6 +1882,11 @@ static long unix_stream_data_wait(struct sock *sk, long timeo,
         return timeo;
 }
 
+static unsigned int unix_skb_len(const struct sk_buff *skb)
+{
+        return skb->len - UNIXCB(skb).consumed;
+}
+
 static int unix_stream_recvmsg(struct kiocb *iocb, struct socket *sock,
                                struct msghdr *msg, size_t size,
                                int flags)
@@ -1976,8 +1974,8 @@ again:
                 }
 
                 skip = sk_peek_offset(sk, flags);
-                while (skip >= skb->len) {
-                        skip -= skb->len;
+                while (skip >= unix_skb_len(skb)) {
+                        skip -= unix_skb_len(skb);
                         last = skb;
                         skb = skb_peek_next(skb, &sk->sk_receive_queue);
                         if (!skb)
@@ -2004,8 +2002,9 @@ again:
                         sunaddr = NULL;
                 }
 
-                chunk = min_t(unsigned int, skb->len - skip, size);
-                if (memcpy_toiovec(msg->msg_iov, skb->data + skip, chunk)) {
+                chunk = min_t(unsigned int, unix_skb_len(skb) - skip, size);
+                if (skb_copy_datagram_iovec(skb, UNIXCB(skb).consumed + skip,
+                                            msg->msg_iov, chunk)) {
                         if (copied == 0)
                                 copied = -EFAULT;
                         break;
@@ -2015,14 +2014,14 @@ again:
 
                 /* Mark read part of skb as used */
                 if (!(flags & MSG_PEEK)) {
-                        skb_pull(skb, chunk);
+                        UNIXCB(skb).consumed += chunk;
 
                         sk_peek_offset_bwd(sk, chunk);
 
                         if (UNIXCB(skb).fp)
                                 unix_detach_fds(siocb->scm, skb);
 
-                        if (skb->len)
+                        if (unix_skb_len(skb))
                                 break;
 
                         skb_unlink(skb, &sk->sk_receive_queue);
@@ -2106,7 +2105,7 @@ long unix_inq_len(struct sock *sk)
         if (sk->sk_type == SOCK_STREAM ||
             sk->sk_type == SOCK_SEQPACKET) {
                 skb_queue_walk(&sk->sk_receive_queue, skb)
-                        amount += skb->len;
+                        amount += unix_skb_len(skb);
         } else {
                 skb = skb_peek(&sk->sk_receive_queue);
                 if (skb)
diff --git a/net/unix/sysctl_net_unix.c b/net/unix/sysctl_net_unix.c
index 8800604c93f4..b3d515021b74 100644
--- a/net/unix/sysctl_net_unix.c
+++ b/net/unix/sysctl_net_unix.c
@@ -15,7 +15,7 @@
 
 #include <net/af_unix.h>
 
-static ctl_table unix_table[] = {
+static struct ctl_table unix_table[] = {
         {
                 .procname       = "max_dgram_qlen",
                 .data           = &init_net.unx.sysctl_max_dgram_qlen,
diff --git a/net/vmw_vsock/af_vsock.c b/net/vmw_vsock/af_vsock.c
index 3f77f42a3b58..545c08b8a1d4 100644
--- a/net/vmw_vsock/af_vsock.c
+++ b/net/vmw_vsock/af_vsock.c
@@ -96,8 +96,7 @@
 #include <linux/wait.h>
 #include <linux/workqueue.h>
 #include <net/sock.h>
-
-#include "af_vsock.h"
+#include <net/af_vsock.h>
 
 static int __vsock_bind(struct sock *sk, struct sockaddr_vm *addr);
 static void vsock_sk_destruct(struct sock *sk);
@@ -144,18 +143,18 @@ EXPORT_SYMBOL_GPL(vm_sockets_get_local_cid);
  * VSOCK_HASH_SIZE + 1 so that vsock_bind_table[0] through
  * vsock_bind_table[VSOCK_HASH_SIZE - 1] are for bound sockets and
  * vsock_bind_table[VSOCK_HASH_SIZE] is for unbound sockets.  The hash function
- * mods with VSOCK_HASH_SIZE - 1 to ensure this.
+ * mods with VSOCK_HASH_SIZE to ensure this.
  */
 #define VSOCK_HASH_SIZE         251
 #define MAX_PORT_RETRIES        24
 
-#define VSOCK_HASH(addr)        ((addr)->svm_port % (VSOCK_HASH_SIZE - 1))
+#define VSOCK_HASH(addr)        ((addr)->svm_port % VSOCK_HASH_SIZE)
 #define vsock_bound_sockets(addr) (&vsock_bind_table[VSOCK_HASH(addr)])
 #define vsock_unbound_sockets     (&vsock_bind_table[VSOCK_HASH_SIZE])
 
 /* XXX This can probably be implemented in a better way. */
 #define VSOCK_CONN_HASH(src, dst)                               \
-        (((src)->svm_cid ^ (dst)->svm_port) % (VSOCK_HASH_SIZE - 1))
+        (((src)->svm_cid ^ (dst)->svm_port) % VSOCK_HASH_SIZE)
 #define vsock_connected_sockets(src, dst)               \
         (&vsock_connected_table[VSOCK_CONN_HASH(src, dst)])
 #define vsock_connected_sockets_vsk(vsk)                                \
@@ -165,6 +164,18 @@ static struct list_head vsock_bind_table[VSOCK_HASH_SIZE + 1];
 static struct list_head vsock_connected_table[VSOCK_HASH_SIZE];
 static DEFINE_SPINLOCK(vsock_table_lock);
 
+/* Autobind this socket to the local address if necessary. */
+static int vsock_auto_bind(struct vsock_sock *vsk)
+{
+        struct sock *sk = sk_vsock(vsk);
+        struct sockaddr_vm local_addr;
+
+        if (vsock_addr_bound(&vsk->local_addr))
+                return 0;
+        vsock_addr_init(&local_addr, VMADDR_CID_ANY, VMADDR_PORT_ANY);
+        return __vsock_bind(sk, &local_addr);
+}
+
 static void vsock_init_tables(void)
 {
         int i;
@@ -335,7 +346,7 @@ void vsock_for_each_connected_socket(void (*fn)(struct sock *sk))
         for (i = 0; i < ARRAY_SIZE(vsock_connected_table); i++) {
                 struct vsock_sock *vsk;
                 list_for_each_entry(vsk, &vsock_connected_table[i],
-                                    connected_table);
+                                    connected_table)
                         fn(sk_vsock(vsk));
         }
 
@@ -956,15 +967,10 @@ static int vsock_dgram_sendmsg(struct kiocb *kiocb, struct socket *sock,
 
         lock_sock(sk);
 
-        if (!vsock_addr_bound(&vsk->local_addr)) {
-                struct sockaddr_vm local_addr;
-
-                vsock_addr_init(&local_addr, VMADDR_CID_ANY, VMADDR_PORT_ANY);
-                err = __vsock_bind(sk, &local_addr);
-                if (err != 0)
-                        goto out;
+        err = vsock_auto_bind(vsk);
+        if (err)
+                goto out;
 
-        }
 
         /* If the provided message contains an address, use that.  Otherwise
          * fall back on the socket's remote handle (if it has been connected).
@@ -1038,15 +1044,9 @@ static int vsock_dgram_connect(struct socket *sock,
 
         lock_sock(sk);
 
-        if (!vsock_addr_bound(&vsk->local_addr)) {
-                struct sockaddr_vm local_addr;
-
-                vsock_addr_init(&local_addr, VMADDR_CID_ANY, VMADDR_PORT_ANY);
-                err = __vsock_bind(sk, &local_addr);
-                if (err != 0)
-                        goto out;
-
-        }
+        err = vsock_auto_bind(vsk);
+        if (err)
+                goto out;
 
         if (!transport->dgram_allow(remote_addr->svm_cid,
                                     remote_addr->svm_port)) {
@@ -1163,17 +1163,9 @@ static int vsock_stream_connect(struct socket *sock, struct sockaddr *addr,
                 memcpy(&vsk->remote_addr, remote_addr,
                        sizeof(vsk->remote_addr));
 
-                /* Autobind this socket to the local address if necessary. */
-                if (!vsock_addr_bound(&vsk->local_addr)) {
-                        struct sockaddr_vm local_addr;
-
-                        vsock_addr_init(&local_addr, VMADDR_CID_ANY,
-                                        VMADDR_PORT_ANY);
-                        err = __vsock_bind(sk, &local_addr);
-                        if (err != 0)
-                                goto out;
-
-                }
+                err = vsock_auto_bind(vsk);
+                if (err)
+                        goto out;
 
                 sk->sk_state = SS_CONNECTING;
 
diff --git a/net/vmw_vsock/af_vsock.h b/net/vmw_vsock/af_vsock.h
deleted file mode 100644
index 7d64d3609ec9..000000000000
--- a/net/vmw_vsock/af_vsock.h
+++ /dev/null
@@ -1,175 +0,0 @@
-/*
- * VMware vSockets Driver
- *
- * Copyright (C) 2007-2013 VMware, Inc. All rights reserved.
- *
- * This program is free software; you can redistribute it and/or modify it
- * under the terms of the GNU General Public License as published by the Free
- * Software Foundation version 2 and no later version.
- *
- * This program is distributed in the hope that it will be useful, but WITHOUT
- * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
- * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
- * more details.
- */
-
-#ifndef __AF_VSOCK_H__
-#define __AF_VSOCK_H__
-
-#include <linux/kernel.h>
-#include <linux/workqueue.h>
-#include <linux/vm_sockets.h>
-
-#include "vsock_addr.h"
-
-#define LAST_RESERVED_PORT 1023
-
-#define vsock_sk(__sk)    ((struct vsock_sock *)__sk)
-#define sk_vsock(__vsk)   (&(__vsk)->sk)
-
-struct vsock_sock {
-        /* sk must be the first member. */
-        struct sock sk;
-        struct sockaddr_vm local_addr;
-        struct sockaddr_vm remote_addr;
-        /* Links for the global tables of bound and connected sockets. */
-        struct list_head bound_table;
-        struct list_head connected_table;
-        /* Accessed without the socket lock held. This means it can never be
-         * modified outsided of socket create or destruct.
-         */
-        bool trusted;
-        bool cached_peer_allow_dgram;   /* Dgram communication allowed to
-                                         * cached peer?
-                                         */
-        u32 cached_peer;  /* Context ID of last dgram destination check. */
-        const struct cred *owner;
-        /* Rest are SOCK_STREAM only. */
-        long connect_timeout;
-        /* Listening socket that this came from. */
-        struct sock *listener;
-        /* Used for pending list and accept queue during connection handshake.
-         * The listening socket is the head for both lists.  Sockets created
-         * for connection requests are placed in the pending list until they
-         * are connected, at which point they are put in the accept queue list
-         * so they can be accepted in accept().  If accept() cannot accept the
-         * connection, it is marked as rejected so the cleanup function knows
-         * to clean up the socket.
-         */
-        struct list_head pending_links;
-        struct list_head accept_queue;
-        bool rejected;
-        struct delayed_work dwork;
-        u32 peer_shutdown;
-        bool sent_request;
-        bool ignore_connecting_rst;
-
-        /* Private to transport. */
-        void *trans;
-};
-
-s64 vsock_stream_has_data(struct vsock_sock *vsk);
-s64 vsock_stream_has_space(struct vsock_sock *vsk);
-void vsock_pending_work(struct work_struct *work);
-struct sock *__vsock_create(struct net *net,
-                            struct socket *sock,
-                            struct sock *parent,
-                            gfp_t priority, unsigned short type);
-
-/**** TRANSPORT ****/
-
-struct vsock_transport_recv_notify_data {
-        u64 data1; /* Transport-defined. */
-        u64 data2; /* Transport-defined. */
-        bool notify_on_block;
-};
-
-struct vsock_transport_send_notify_data {
-        u64 data1; /* Transport-defined. */
-        u64 data2; /* Transport-defined. */
-};
-
-struct vsock_transport {
-        /* Initialize/tear-down socket. */
-        int (*init)(struct vsock_sock *, struct vsock_sock *);
-        void (*destruct)(struct vsock_sock *);
-        void (*release)(struct vsock_sock *);
-
-        /* Connections. */
-        int (*connect)(struct vsock_sock *);
-
-        /* DGRAM. */
-        int (*dgram_bind)(struct vsock_sock *, struct sockaddr_vm *);
-        int (*dgram_dequeue)(struct kiocb *kiocb, struct vsock_sock *vsk,
-                             struct msghdr *msg, size_t len, int flags);
-        int (*dgram_enqueue)(struct vsock_sock *, struct sockaddr_vm *,
-                             struct iovec *, size_t len);
-        bool (*dgram_allow)(u32 cid, u32 port);
-
-        /* STREAM. */
-        /* TODO: stream_bind() */
-        ssize_t (*stream_dequeue)(struct vsock_sock *, struct iovec *,
-                                  size_t len, int flags);
-        ssize_t (*stream_enqueue)(struct vsock_sock *, struct iovec *,
-                                  size_t len);
-        s64 (*stream_has_data)(struct vsock_sock *);
-        s64 (*stream_has_space)(struct vsock_sock *);
-        u64 (*stream_rcvhiwat)(struct vsock_sock *);
-        bool (*stream_is_active)(struct vsock_sock *);
-        bool (*stream_allow)(u32 cid, u32 port);
-
-        /* Notification. */
-        int (*notify_poll_in)(struct vsock_sock *, size_t, bool *);
-        int (*notify_poll_out)(struct vsock_sock *, size_t, bool *);
-        int (*notify_recv_init)(struct vsock_sock *, size_t,
-                struct vsock_transport_recv_notify_data *);
-        int (*notify_recv_pre_block)(struct vsock_sock *, size_t,
-                struct vsock_transport_recv_notify_data *);
-        int (*notify_recv_pre_dequeue)(struct vsock_sock *, size_t,
-                struct vsock_transport_recv_notify_data *);
-        int (*notify_recv_post_dequeue)(struct vsock_sock *, size_t,
-                ssize_t, bool, struct vsock_transport_recv_notify_data *);
-        int (*notify_send_init)(struct vsock_sock *,
-                struct vsock_transport_send_notify_data *);
-        int (*notify_send_pre_block)(struct vsock_sock *,
-                struct vsock_transport_send_notify_data *);
-        int (*notify_send_pre_enqueue)(struct vsock_sock *,
-                struct vsock_transport_send_notify_data *);
-        int (*notify_send_post_enqueue)(struct vsock_sock *, ssize_t,
-                struct vsock_transport_send_notify_data *);
-
-        /* Shutdown. */
-        int (*shutdown)(struct vsock_sock *, int);
-
-        /* Buffer sizes. */
-        void (*set_buffer_size)(struct vsock_sock *, u64);
-        void (*set_min_buffer_size)(struct vsock_sock *, u64);
-        void (*set_max_buffer_size)(struct vsock_sock *, u64);
-        u64 (*get_buffer_size)(struct vsock_sock *);
-        u64 (*get_min_buffer_size)(struct vsock_sock *);
-        u64 (*get_max_buffer_size)(struct vsock_sock *);
-
-        /* Addressing. */
-        u32 (*get_local_cid)(void);
-};
-
-/**** CORE ****/
-
-int vsock_core_init(const struct vsock_transport *t);
-void vsock_core_exit(void);
-
-/**** UTILS ****/
-
-void vsock_release_pending(struct sock *pending);
-void vsock_add_pending(struct sock *listener, struct sock *pending);
-void vsock_remove_pending(struct sock *listener, struct sock *pending);
-void vsock_enqueue_accept(struct sock *listener, struct sock *connected);
-void vsock_insert_connected(struct vsock_sock *vsk);
-void vsock_remove_bound(struct vsock_sock *vsk);
-void vsock_remove_connected(struct vsock_sock *vsk);
-struct sock *vsock_find_bound_socket(struct sockaddr_vm *addr);
-struct sock *vsock_find_connected_socket(struct sockaddr_vm *src,
-                                         struct sockaddr_vm *dst);
-void vsock_for_each_connected_socket(void (*fn)(struct sock *sk));
-
-#endif /* __AF_VSOCK_H__ */
diff --git a/net/vmw_vsock/vmci_transport.c b/net/vmw_vsock/vmci_transport.c
index daff75200e25..9d6986634e0b 100644
--- a/net/vmw_vsock/vmci_transport.c
+++ b/net/vmw_vsock/vmci_transport.c
@@ -34,8 +34,8 @@
 #include <linux/wait.h>
 #include <linux/workqueue.h>
 #include <net/sock.h>
+#include <net/af_vsock.h>
 
-#include "af_vsock.h"
 #include "vmci_transport_notify.h"
 
 static int vmci_transport_recv_dgram_cb(void *data, struct vmci_datagram *dg);
@@ -625,13 +625,14 @@ static int vmci_transport_recv_dgram_cb(void *data, struct vmci_datagram *dg)
 
         /* Attach the packet to the socket's receive queue as an sk_buff. */
         skb = alloc_skb(size, GFP_ATOMIC);
-        if (skb) {
-                /* sk_receive_skb() will do a sock_put(), so hold here. */
-                sock_hold(sk);
-                skb_put(skb, size);
-                memcpy(skb->data, dg, size);
-                sk_receive_skb(sk, skb, 0);
-        }
+        if (!skb)
+                return VMCI_ERROR_NO_MEM;
+
+        /* sk_receive_skb() will do a sock_put(), so hold here. */
+        sock_hold(sk);
+        skb_put(skb, size);
+        memcpy(skb->data, dg, size);
+        sk_receive_skb(sk, skb, 0);
 
         return VMCI_SUCCESS;
 }
@@ -939,10 +940,9 @@ static void vmci_transport_recv_pkt_work(struct work_struct *work)
                  * reset to prevent that.
                  */
                 vmci_transport_send_reset(sk, pkt);
-                goto out;
+                break;
         }
 
-out:
         release_sock(sk);
         kfree(recv_pkt_info);
         /* Release reference obtained in the stream callback when we fetched
diff --git a/net/vmw_vsock/vmci_transport.h b/net/vmw_vsock/vmci_transport.h
index fd88ea8924e4..ce6c9623d5f0 100644
--- a/net/vmw_vsock/vmci_transport.h
+++ b/net/vmw_vsock/vmci_transport.h
@@ -19,8 +19,8 @@
 #include <linux/vmw_vmci_defs.h>
 #include <linux/vmw_vmci_api.h>
 
-#include "vsock_addr.h"
-#include "af_vsock.h"
+#include <net/vsock_addr.h>
+#include <net/af_vsock.h>
 
 /* If the packet format changes in a release then this should change too. */
 #define VMCI_TRANSPORT_PACKET_VERSION 1
diff --git a/net/vmw_vsock/vsock_addr.c b/net/vmw_vsock/vsock_addr.c
index ec2611b4ea0e..82486ee55eac 100644
--- a/net/vmw_vsock/vsock_addr.c
+++ b/net/vmw_vsock/vsock_addr.c
@@ -17,8 +17,7 @@
 #include <linux/socket.h>
 #include <linux/stddef.h>
 #include <net/sock.h>
-
-#include "vsock_addr.h"
+#include <net/vsock_addr.h>
 
 void vsock_addr_init(struct sockaddr_vm *addr, u32 cid, u32 port)
 {
diff --git a/net/vmw_vsock/vsock_addr.h b/net/vmw_vsock/vsock_addr.h
deleted file mode 100644
index 9ccd5316eac0..000000000000
--- a/net/vmw_vsock/vsock_addr.h
+++ /dev/null
@@ -1,30 +0,0 @@
-/*
- * VMware vSockets Driver
- *
- * Copyright (C) 2007-2013 VMware, Inc. All rights reserved.
- *
- * This program is free software; you can redistribute it and/or modify it
- * under the terms of the GNU General Public License as published by the Free
- * Software Foundation version 2 and no later version.
- *
- * This program is distributed in the hope that it will be useful, but WITHOUT
- * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
- * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
- * more details.
- */
-
-#ifndef _VSOCK_ADDR_H_
-#define _VSOCK_ADDR_H_
-
-#include <linux/vm_sockets.h>
-
-void vsock_addr_init(struct sockaddr_vm *addr, u32 cid, u32 port);
-int vsock_addr_validate(const struct sockaddr_vm *addr);
-bool vsock_addr_bound(const struct sockaddr_vm *addr);
-void vsock_addr_unbind(struct sockaddr_vm *addr);
-bool vsock_addr_equals_addr(const struct sockaddr_vm *addr,
-                            const struct sockaddr_vm *other);
-int vsock_addr_cast(const struct sockaddr *addr, size_t len,
-                    struct sockaddr_vm **out_addr);
-
-#endif
diff --git a/net/wireless/chan.c b/net/wireless/chan.c
index fd556ac05fdb..50f6195c8b70 100644
--- a/net/wireless/chan.c
+++ b/net/wireless/chan.c
@@ -54,6 +54,8 @@ bool cfg80211_chandef_valid(const struct cfg80211_chan_def *chandef)
         control_freq = chandef->chan->center_freq;
 
         switch (chandef->width) {
+        case NL80211_CHAN_WIDTH_5:
+        case NL80211_CHAN_WIDTH_10:
         case NL80211_CHAN_WIDTH_20:
         case NL80211_CHAN_WIDTH_20_NOHT:
                 if (chandef->center_freq1 != control_freq)
@@ -152,6 +154,12 @@ static int cfg80211_chandef_get_width(const struct cfg80211_chan_def *c)
         int width;
 
         switch (c->width) {
+        case NL80211_CHAN_WIDTH_5:
+                width = 5;
+                break;
+        case NL80211_CHAN_WIDTH_10:
+                width = 10;
+                break;
         case NL80211_CHAN_WIDTH_20:
         case NL80211_CHAN_WIDTH_20_NOHT:
                 width = 20;
@@ -194,6 +202,16 @@ cfg80211_chandef_compatible(const struct cfg80211_chan_def *c1,
         if (c1->width == c2->width)
                 return NULL;
 
+        /*
+         * can't be compatible if one of them is 5 or 10 MHz,
+         * but they don't have the same width.
+         */
+        if (c1->width == NL80211_CHAN_WIDTH_5 ||
+            c1->width == NL80211_CHAN_WIDTH_10 ||
+            c2->width == NL80211_CHAN_WIDTH_5 ||
+            c2->width == NL80211_CHAN_WIDTH_10)
+                return NULL;
+
         if (c1->width == NL80211_CHAN_WIDTH_20_NOHT ||
             c1->width == NL80211_CHAN_WIDTH_20)
                 return c2;
@@ -264,11 +282,17 @@ static int cfg80211_get_chans_dfs_required(struct wiphy *wiphy,
                                             u32 bandwidth)
 {
         struct ieee80211_channel *c;
-        u32 freq;
+        u32 freq, start_freq, end_freq;
+
+        if (bandwidth <= 20) {
+                start_freq = center_freq;
+                end_freq = center_freq;
+        } else {
+                start_freq = center_freq - bandwidth/2 + 10;
+                end_freq = center_freq + bandwidth/2 - 10;
+        }
 
-        for (freq = center_freq - bandwidth/2 + 10;
-             freq <= center_freq + bandwidth/2 - 10;
-             freq += 20) {
+        for (freq = start_freq; freq <= end_freq; freq += 20) {
                 c = ieee80211_get_channel(wiphy, freq);
                 if (!c)
                         return -EINVAL;
@@ -310,11 +334,17 @@ static bool cfg80211_secondary_chans_ok(struct wiphy *wiphy,
                                         u32 prohibited_flags)
 {
         struct ieee80211_channel *c;
-        u32 freq;
+        u32 freq, start_freq, end_freq;
+
+        if (bandwidth <= 20) {
+                start_freq = center_freq;
+                end_freq = center_freq;
+        } else {
+                start_freq = center_freq - bandwidth/2 + 10;
+                end_freq = center_freq + bandwidth/2 - 10;
+        }
 
-        for (freq = center_freq - bandwidth/2 + 10;
-             freq <= center_freq + bandwidth/2 - 10;
-             freq += 20) {
+        for (freq = start_freq; freq <= end_freq; freq += 20) {
                 c = ieee80211_get_channel(wiphy, freq);
                 if (!c)
                         return false;
@@ -349,6 +379,12 @@ bool cfg80211_chandef_usable(struct wiphy *wiphy,
         control_freq = chandef->chan->center_freq;
 
         switch (chandef->width) {
+        case NL80211_CHAN_WIDTH_5:
+                width = 5;
+                break;
+        case NL80211_CHAN_WIDTH_10:
+                width = 10;
+                break;
         case NL80211_CHAN_WIDTH_20:
                 if (!ht_cap->ht_supported)
                         return false;
@@ -405,6 +441,11 @@ bool cfg80211_chandef_usable(struct wiphy *wiphy,
         if (width > 20)
                 prohibited_flags |= IEEE80211_CHAN_NO_OFDM;
 
+        /* 5 and 10 MHz are only defined for the OFDM PHY */
+        if (width < 20)
+                prohibited_flags |= IEEE80211_CHAN_NO_OFDM;
+
+
         if (!cfg80211_secondary_chans_ok(wiphy, chandef->center_freq1,
                                          width, prohibited_flags))
                 return false;
diff --git a/net/wireless/core.c b/net/wireless/core.c
index 73405e00c800..67153964aad2 100644
--- a/net/wireless/core.c
+++ b/net/wireless/core.c
@@ -34,13 +34,12 @@
 MODULE_AUTHOR("Johannes Berg");
 MODULE_LICENSE("GPL");
 MODULE_DESCRIPTION("wireless configuration support");
+MODULE_ALIAS_GENL_FAMILY(NL80211_GENL_NAME);
 
-/* RCU-protected (and cfg80211_mutex for writers) */
+/* RCU-protected (and RTNL for writers) */
 LIST_HEAD(cfg80211_rdev_list);
 int cfg80211_rdev_list_generation;
 
-DEFINE_MUTEX(cfg80211_mutex);
-
 /* for debugfs */
 static struct dentry *ieee80211_debugfs_dir;
 
@@ -52,12 +51,11 @@ module_param(cfg80211_disable_40mhz_24ghz, bool, 0644);
 MODULE_PARM_DESC(cfg80211_disable_40mhz_24ghz,
                  "Disable 40MHz support in the 2.4GHz band");
 
-/* requires cfg80211_mutex to be held! */
 struct cfg80211_registered_device *cfg80211_rdev_by_wiphy_idx(int wiphy_idx)
 {
         struct cfg80211_registered_device *result = NULL, *rdev;
 
-        assert_cfg80211_lock();
+        ASSERT_RTNL();
 
         list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
                 if (rdev->wiphy_idx == wiphy_idx) {
@@ -76,12 +74,11 @@ int get_wiphy_idx(struct wiphy *wiphy)
         return rdev->wiphy_idx;
 }
 
-/* requires cfg80211_rdev_mutex to be held! */
 struct wiphy *wiphy_idx_to_wiphy(int wiphy_idx)
 {
         struct cfg80211_registered_device *rdev;
 
-        assert_cfg80211_lock();
+        ASSERT_RTNL();
 
         rdev = cfg80211_rdev_by_wiphy_idx(wiphy_idx);
         if (!rdev)
@@ -89,35 +86,13 @@ struct wiphy *wiphy_idx_to_wiphy(int wiphy_idx)
         return &rdev->wiphy;
 }
 
-struct cfg80211_registered_device *
-cfg80211_get_dev_from_ifindex(struct net *net, int ifindex)
-{
-        struct cfg80211_registered_device *rdev = ERR_PTR(-ENODEV);
-        struct net_device *dev;
-
-        mutex_lock(&cfg80211_mutex);
-        dev = dev_get_by_index(net, ifindex);
-        if (!dev)
-                goto out;
-        if (dev->ieee80211_ptr) {
-                rdev = wiphy_to_dev(dev->ieee80211_ptr->wiphy);
-                mutex_lock(&rdev->mtx);
-        } else
-                rdev = ERR_PTR(-ENODEV);
-        dev_put(dev);
- out:
-        mutex_unlock(&cfg80211_mutex);
-        return rdev;
-}
-
-/* requires cfg80211_mutex to be held */
 int cfg80211_dev_rename(struct cfg80211_registered_device *rdev,
                         char *newname)
 {
         struct cfg80211_registered_device *rdev2;
         int wiphy_idx, taken = -1, result, digits;
 
-        assert_cfg80211_lock();
+        ASSERT_RTNL();
 
         /* prohibit calling the thing phy%d when %d is not its number */
         sscanf(newname, PHY_NAME "%d%n", &wiphy_idx, &taken);
@@ -215,8 +190,7 @@ static void cfg80211_rfkill_poll(struct rfkill *rfkill, void *data)
 void cfg80211_stop_p2p_device(struct cfg80211_registered_device *rdev,
                               struct wireless_dev *wdev)
 {
-        lockdep_assert_held(&rdev->devlist_mtx);
-        lockdep_assert_held(&rdev->sched_scan_mtx);
+        ASSERT_RTNL();
 
         if (WARN_ON(wdev->iftype != NL80211_IFTYPE_P2P_DEVICE))
                 return;
@@ -230,18 +204,15 @@ void cfg80211_stop_p2p_device(struct cfg80211_registered_device *rdev,
         rdev->opencount--;
 
         if (rdev->scan_req && rdev->scan_req->wdev == wdev) {
-                bool busy = work_busy(&rdev->scan_done_wk);
-
                 /*
-                 * If the work isn't pending or running (in which case it would
-                 * be waiting for the lock we hold) the driver didn't properly
-                 * cancel the scan when the interface was removed. In this case
-                 * warn and leak the scan request object to not crash later.
+                 * If the scan request wasn't notified as done, set it
+                 * to aborted and leak it after a warning. The driver
+                 * should have notified us that it ended at the latest
+                 * during rdev_stop_p2p_device().
                  */
-                WARN_ON(!busy);
-
-                rdev->scan_req->aborted = true;
-                ___cfg80211_scan_done(rdev, !busy);
+                if (WARN_ON(!rdev->scan_req->notified))
+                        rdev->scan_req->aborted = true;
+                ___cfg80211_scan_done(rdev, !rdev->scan_req->notified);
         }
 }
 
@@ -255,8 +226,6 @@ static int cfg80211_rfkill_set_block(void *data, bool blocked)
 
         rtnl_lock();
 
-        /* read-only iteration need not hold the devlist_mtx */
-
         list_for_each_entry(wdev, &rdev->wdev_list, list) {
                 if (wdev->netdev) {
                         dev_close(wdev->netdev);
@@ -265,12 +234,7 @@ static int cfg80211_rfkill_set_block(void *data, bool blocked)
                 /* otherwise, check iftype */
                 switch (wdev->iftype) {
                 case NL80211_IFTYPE_P2P_DEVICE:
-                        /* but this requires it */
-                        mutex_lock(&rdev->devlist_mtx);
-                        mutex_lock(&rdev->sched_scan_mtx);
                         cfg80211_stop_p2p_device(rdev, wdev);
-                        mutex_unlock(&rdev->sched_scan_mtx);
-                        mutex_unlock(&rdev->devlist_mtx);
                         break;
                 default:
                         break;
@@ -298,10 +262,7 @@ static void cfg80211_event_work(struct work_struct *work)
                             event_work);
 
         rtnl_lock();
-        cfg80211_lock_rdev(rdev);
-
         cfg80211_process_rdev_events(rdev);
-        cfg80211_unlock_rdev(rdev);
         rtnl_unlock();
 }
 
@@ -309,7 +270,7 @@ static void cfg80211_event_work(struct work_struct *work)
 
 struct wiphy *wiphy_new(const struct cfg80211_ops *ops, int sizeof_priv)
 {
-        static int wiphy_counter;
+        static atomic_t wiphy_counter = ATOMIC_INIT(0);
 
         struct cfg80211_registered_device *rdev;
         int alloc_size;
@@ -331,26 +292,21 @@ struct wiphy *wiphy_new(const struct cfg80211_ops *ops, int sizeof_priv)
 
         rdev->ops = ops;
 
-        mutex_lock(&cfg80211_mutex);
-
-        rdev->wiphy_idx = wiphy_counter++;
+        rdev->wiphy_idx = atomic_inc_return(&wiphy_counter);
 
         if (unlikely(rdev->wiphy_idx < 0)) {
-                wiphy_counter--;
-                mutex_unlock(&cfg80211_mutex);
                 /* ugh, wrapped! */
+                atomic_dec(&wiphy_counter);
                 kfree(rdev);
                 return NULL;
         }
 
-        mutex_unlock(&cfg80211_mutex);
+        /* atomic_inc_return makes it start at 1, make it start at 0 */
+        rdev->wiphy_idx--;
 
         /* give it a proper name */
         dev_set_name(&rdev->wiphy.dev, PHY_NAME "%d", rdev->wiphy_idx);
 
-        mutex_init(&rdev->mtx);
-        mutex_init(&rdev->devlist_mtx);
-        mutex_init(&rdev->sched_scan_mtx);
         INIT_LIST_HEAD(&rdev->wdev_list);
         INIT_LIST_HEAD(&rdev->beacon_registrations);
         spin_lock_init(&rdev->beacon_registrations_lock);
@@ -496,11 +452,24 @@ int wiphy_register(struct wiphy *wiphy)
         u16 ifmodes = wiphy->interface_modes;
 
 #ifdef CONFIG_PM
-        if (WARN_ON((wiphy->wowlan.flags & WIPHY_WOWLAN_GTK_REKEY_FAILURE) &&
-                    !(wiphy->wowlan.flags & WIPHY_WOWLAN_SUPPORTS_GTK_REKEY)))
+        if (WARN_ON(wiphy->wowlan &&
+                    (wiphy->wowlan->flags & WIPHY_WOWLAN_GTK_REKEY_FAILURE) &&
+                    !(wiphy->wowlan->flags & WIPHY_WOWLAN_SUPPORTS_GTK_REKEY)))
+                return -EINVAL;
+        if (WARN_ON(wiphy->wowlan &&
+                    !wiphy->wowlan->flags && !wiphy->wowlan->n_patterns &&
+                    !wiphy->wowlan->tcp))
                 return -EINVAL;
 #endif
 
+        if (WARN_ON(wiphy->coalesce &&
+                    (!wiphy->coalesce->n_rules ||
+                     !wiphy->coalesce->n_patterns) &&
+                    (!wiphy->coalesce->pattern_min_len ||
+                     wiphy->coalesce->pattern_min_len >
+                        wiphy->coalesce->pattern_max_len)))
+                return -EINVAL;
+
         if (WARN_ON(wiphy->ap_sme_capa &&
                     !(wiphy->flags & WIPHY_FLAG_HAVE_AP_SME)))
                 return -EINVAL;
@@ -587,25 +556,28 @@ int wiphy_register(struct wiphy *wiphy)
         }
 
 #ifdef CONFIG_PM
-        if (rdev->wiphy.wowlan.n_patterns) {
-                if (WARN_ON(!rdev->wiphy.wowlan.pattern_min_len ||
-                            rdev->wiphy.wowlan.pattern_min_len >
-                            rdev->wiphy.wowlan.pattern_max_len))
-                        return -EINVAL;
-        }
+        if (WARN_ON(rdev->wiphy.wowlan && rdev->wiphy.wowlan->n_patterns &&
+                    (!rdev->wiphy.wowlan->pattern_min_len ||
+                     rdev->wiphy.wowlan->pattern_min_len >
+                                rdev->wiphy.wowlan->pattern_max_len)))
+                return -EINVAL;
 #endif
 
         /* check and set up bitrates */
         ieee80211_set_bitrate_flags(wiphy);
 
-        mutex_lock(&cfg80211_mutex);
 
         res = device_add(&rdev->wiphy.dev);
+        if (res)
+                return res;
+
+        res = rfkill_register(rdev->rfkill);
         if (res) {
-                mutex_unlock(&cfg80211_mutex);
+                device_del(&rdev->wiphy.dev);
                 return res;
         }
 
+        rtnl_lock();
         /* set up regulatory info */
         wiphy_regulatory_register(wiphy);
 
@@ -631,25 +603,7 @@ int wiphy_register(struct wiphy *wiphy)
         }
 
         cfg80211_debugfs_rdev_add(rdev);
-        mutex_unlock(&cfg80211_mutex);
 
-        /*
-         * due to a locking dependency this has to be outside of the
-         * cfg80211_mutex lock
-         */
-        res = rfkill_register(rdev->rfkill);
-        if (res) {
-                device_del(&rdev->wiphy.dev);
-
-                mutex_lock(&cfg80211_mutex);
-                debugfs_remove_recursive(rdev->wiphy.debugfsdir);
-                list_del_rcu(&rdev->list);
-                wiphy_regulatory_deregister(wiphy);
-                mutex_unlock(&cfg80211_mutex);
-                return res;
-        }
-
-        rtnl_lock();
         rdev->wiphy.registered = true;
         rtnl_unlock();
         return 0;
@@ -679,25 +633,19 @@ void wiphy_unregister(struct wiphy *wiphy)
 {
         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
 
-        rtnl_lock();
-        rdev->wiphy.registered = false;
-        rtnl_unlock();
-
-        rfkill_unregister(rdev->rfkill);
-
-        /* protect the device list */
-        mutex_lock(&cfg80211_mutex);
-
         wait_event(rdev->dev_wait, ({
                 int __count;
-                mutex_lock(&rdev->devlist_mtx);
+                rtnl_lock();
                 __count = rdev->opencount;
-                mutex_unlock(&rdev->devlist_mtx);
+                rtnl_unlock();
                 __count == 0; }));
 
-        mutex_lock(&rdev->devlist_mtx);
+        rfkill_unregister(rdev->rfkill);
+
+        rtnl_lock();
+        rdev->wiphy.registered = false;
+
         BUG_ON(!list_empty(&rdev->wdev_list));
-        mutex_unlock(&rdev->devlist_mtx);
 
         /*
          * First remove the hardware from everywhere, this makes
@@ -708,20 +656,6 @@ void wiphy_unregister(struct wiphy *wiphy)
         synchronize_rcu();
 
         /*
-         * Try to grab rdev->mtx. If a command is still in progress,
-         * hopefully the driver will refuse it since it's tearing
-         * down the device already. We wait for this command to complete
-         * before unlinking the item from the list.
-         * Note: as codified by the BUG_ON above we cannot get here if
-         * a virtual interface is still present. Hence, we can only get
-         * to lock contention here if userspace issues a command that
-         * identified the hardware by wiphy index.
-         */
-        cfg80211_lock_rdev(rdev);
-        /* nothing */
-        cfg80211_unlock_rdev(rdev);
-
-        /*
          * If this device got a regulatory hint tell core its
          * free to listen now to a new shiny device regulatory hint
          */
@@ -730,16 +664,19 @@ void wiphy_unregister(struct wiphy *wiphy)
         cfg80211_rdev_list_generation++;
         device_del(&rdev->wiphy.dev);
 
-        mutex_unlock(&cfg80211_mutex);
+        rtnl_unlock();
 
         flush_work(&rdev->scan_done_wk);
         cancel_work_sync(&rdev->conn_work);
         flush_work(&rdev->event_work);
         cancel_delayed_work_sync(&rdev->dfs_update_channels_wk);
 
-        if (rdev->wowlan && rdev->ops->set_wakeup)
+#ifdef CONFIG_PM
+        if (rdev->wiphy.wowlan_config && rdev->ops->set_wakeup)
                 rdev_set_wakeup(rdev, false);
+#endif
         cfg80211_rdev_free_wowlan(rdev);
+        cfg80211_rdev_free_coalesce(rdev);
 }
 EXPORT_SYMBOL(wiphy_unregister);
 
@@ -748,9 +685,6 @@ void cfg80211_dev_free(struct cfg80211_registered_device *rdev)
         struct cfg80211_internal_bss *scan, *tmp;
         struct cfg80211_beacon_registration *reg, *treg;
         rfkill_destroy(rdev->rfkill);
-        mutex_destroy(&rdev->mtx);
-        mutex_destroy(&rdev->devlist_mtx);
-        mutex_destroy(&rdev->sched_scan_mtx);
         list_for_each_entry_safe(reg, treg, &rdev->beacon_registrations, list) {
                 list_del(&reg->list);
                 kfree(reg);
@@ -775,36 +709,6 @@ void wiphy_rfkill_set_hw_state(struct wiphy *wiphy, bool blocked)
 }
 EXPORT_SYMBOL(wiphy_rfkill_set_hw_state);
 
-static void wdev_cleanup_work(struct work_struct *work)
-{
-        struct wireless_dev *wdev;
-        struct cfg80211_registered_device *rdev;
-
-        wdev = container_of(work, struct wireless_dev, cleanup_work);
-        rdev = wiphy_to_dev(wdev->wiphy);
-
-        mutex_lock(&rdev->sched_scan_mtx);
-
-        if (WARN_ON(rdev->scan_req && rdev->scan_req->wdev == wdev)) {
-                rdev->scan_req->aborted = true;
-                ___cfg80211_scan_done(rdev, true);
-        }
-
-        if (WARN_ON(rdev->sched_scan_req &&
-                    rdev->sched_scan_req->dev == wdev->netdev)) {
-                __cfg80211_stop_sched_scan(rdev, false);
-        }
-
-        mutex_unlock(&rdev->sched_scan_mtx);
-
-        mutex_lock(&rdev->devlist_mtx);
-        rdev->opencount--;
-        mutex_unlock(&rdev->devlist_mtx);
-        wake_up(&rdev->dev_wait);
-
-        dev_put(wdev->netdev);
-}
-
 void cfg80211_unregister_wdev(struct wireless_dev *wdev)
 {
         struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
@@ -814,8 +718,6 @@ void cfg80211_unregister_wdev(struct wireless_dev *wdev)
         if (WARN_ON(wdev->netdev))
                 return;
 
-        mutex_lock(&rdev->devlist_mtx);
-        mutex_lock(&rdev->sched_scan_mtx);
         list_del_rcu(&wdev->list);
         rdev->devlist_generation++;
 
@@ -827,8 +729,6 @@ void cfg80211_unregister_wdev(struct wireless_dev *wdev)
                 WARN_ON_ONCE(1);
                 break;
         }
-        mutex_unlock(&rdev->sched_scan_mtx);
-        mutex_unlock(&rdev->devlist_mtx);
 }
 EXPORT_SYMBOL(cfg80211_unregister_wdev);
 
@@ -847,7 +747,7 @@ void cfg80211_update_iface_num(struct cfg80211_registered_device *rdev,
 }
 
 void cfg80211_leave(struct cfg80211_registered_device *rdev,
-                   struct wireless_dev *wdev)
+                    struct wireless_dev *wdev)
 {
         struct net_device *dev = wdev->netdev;
 
@@ -857,9 +757,7 @@ void cfg80211_leave(struct cfg80211_registered_device *rdev,
                 break;
         case NL80211_IFTYPE_P2P_CLIENT:
         case NL80211_IFTYPE_STATION:
-                mutex_lock(&rdev->sched_scan_mtx);
                 __cfg80211_stop_sched_scan(rdev, false);
-                mutex_unlock(&rdev->sched_scan_mtx);
 
                 wdev_lock(wdev);
 #ifdef CONFIG_CFG80211_WEXT
@@ -868,14 +766,15 @@ void cfg80211_leave(struct cfg80211_registered_device *rdev,
                 wdev->wext.ie_len = 0;
                 wdev->wext.connect.auth_type = NL80211_AUTHTYPE_AUTOMATIC;
 #endif
-                __cfg80211_disconnect(rdev, dev,
-                                      WLAN_REASON_DEAUTH_LEAVING, true);
+                cfg80211_disconnect(rdev, dev,
+                                    WLAN_REASON_DEAUTH_LEAVING, true);
                 wdev_unlock(wdev);
                 break;
         case NL80211_IFTYPE_MESH_POINT:
                 cfg80211_leave_mesh(rdev, dev);
                 break;
         case NL80211_IFTYPE_AP:
+        case NL80211_IFTYPE_P2P_GO:
                 cfg80211_stop_ap(rdev, dev);
                 break;
         default:
@@ -886,10 +785,9 @@ void cfg80211_leave(struct cfg80211_registered_device *rdev,
 }
 
 static int cfg80211_netdev_notifier_call(struct notifier_block *nb,
-                                         unsigned long state,
-                                         void *ndev)
+                                         unsigned long state, void *ptr)
 {
-        struct net_device *dev = ndev;
+        struct net_device *dev = netdev_notifier_info_to_dev(ptr);
         struct wireless_dev *wdev = dev->ieee80211_ptr;
         struct cfg80211_registered_device *rdev;
         int ret;
@@ -912,13 +810,11 @@ static int cfg80211_netdev_notifier_call(struct notifier_block *nb,
                  * are added with nl80211.
                  */
                 mutex_init(&wdev->mtx);
-                INIT_WORK(&wdev->cleanup_work, wdev_cleanup_work);
                 INIT_LIST_HEAD(&wdev->event_list);
                 spin_lock_init(&wdev->event_lock);
                 INIT_LIST_HEAD(&wdev->mgmt_registrations);
                 spin_lock_init(&wdev->mgmt_registrations_lock);
 
-                mutex_lock(&rdev->devlist_mtx);
                 wdev->identifier = ++rdev->wdev_id;
                 list_add_rcu(&wdev->list, &rdev->wdev_list);
                 rdev->devlist_generation++;
@@ -930,8 +826,6 @@ static int cfg80211_netdev_notifier_call(struct notifier_block *nb,
                         pr_err("failed to add phy80211 symlink to netdev!\n");
                 }
                 wdev->netdev = dev;
-                wdev->sme_state = CFG80211_SME_IDLE;
-                mutex_unlock(&rdev->devlist_mtx);
 #ifdef CONFIG_CFG80211_WEXT
                 wdev->wext.default_key = -1;
                 wdev->wext.default_mgmt_key = -1;
@@ -957,26 +851,22 @@ static int cfg80211_netdev_notifier_call(struct notifier_block *nb,
                 break;
         case NETDEV_DOWN:
                 cfg80211_update_iface_num(rdev, wdev->iftype, -1);
-                dev_hold(dev);
-                queue_work(cfg80211_wq, &wdev->cleanup_work);
+                if (rdev->scan_req && rdev->scan_req->wdev == wdev) {
+                        if (WARN_ON(!rdev->scan_req->notified))
+                                rdev->scan_req->aborted = true;
+                        ___cfg80211_scan_done(rdev, true);
+                }
+
+                if (WARN_ON(rdev->sched_scan_req &&
+                            rdev->sched_scan_req->dev == wdev->netdev)) {
+                        __cfg80211_stop_sched_scan(rdev, false);
+                }
+
+                rdev->opencount--;
+                wake_up(&rdev->dev_wait);
                 break;
         case NETDEV_UP:
-                /*
-                 * If we have a really quick DOWN/UP succession we may
-                 * have this work still pending ... cancel it and see
-                 * if it was pending, in which case we need to account
-                 * for some of the work it would have done.
-                 */
-                if (cancel_work_sync(&wdev->cleanup_work)) {
-                        mutex_lock(&rdev->devlist_mtx);
-                        rdev->opencount--;
-                        mutex_unlock(&rdev->devlist_mtx);
-                        dev_put(dev);
-                }
                 cfg80211_update_iface_num(rdev, wdev->iftype, 1);
-                cfg80211_lock_rdev(rdev);
-                mutex_lock(&rdev->devlist_mtx);
-                mutex_lock(&rdev->sched_scan_mtx);
                 wdev_lock(wdev);
                 switch (wdev->iftype) {
 #ifdef CONFIG_CFG80211_WEXT
@@ -1008,10 +898,7 @@ static int cfg80211_netdev_notifier_call(struct notifier_block *nb,
                         break;
                 }
                 wdev_unlock(wdev);
-                mutex_unlock(&rdev->sched_scan_mtx);
                 rdev->opencount++;
-                mutex_unlock(&rdev->devlist_mtx);
-                cfg80211_unlock_rdev(rdev);
 
                 /*
                  * Configure power management to the driver here so that its
@@ -1028,12 +915,6 @@ static int cfg80211_netdev_notifier_call(struct notifier_block *nb,
                 break;
         case NETDEV_UNREGISTER:
                 /*
-                 * NB: cannot take rdev->mtx here because this may be
-                 * called within code protected by it when interfaces
-                 * are removed with nl80211.
-                 */
-                mutex_lock(&rdev->devlist_mtx);
-                /*
                  * It is possible to get NETDEV_UNREGISTER
                  * multiple times. To detect that, check
                  * that the interface is still on the list
@@ -1049,7 +930,6 @@ static int cfg80211_netdev_notifier_call(struct notifier_block *nb,
                         kfree(wdev->wext.keys);
 #endif
                 }
-                mutex_unlock(&rdev->devlist_mtx);
                 /*
                  * synchronise (so that we won't find this netdev
                  * from other code any more) and then clear the list
@@ -1063,15 +943,19 @@ static int cfg80211_netdev_notifier_call(struct notifier_block *nb,
                  * freed.
                  */
                 cfg80211_process_wdev_events(wdev);
+
+                if (WARN_ON(wdev->current_bss)) {
+                        cfg80211_unhold_bss(wdev->current_bss);
+                        cfg80211_put_bss(wdev->wiphy, &wdev->current_bss->pub);
+                        wdev->current_bss = NULL;
+                }
                 break;
         case NETDEV_PRE_UP:
                 if (!(wdev->wiphy->interface_modes & BIT(wdev->iftype)))
                         return notifier_from_errno(-EOPNOTSUPP);
                 if (rfkill_blocked(rdev->rfkill))
                         return notifier_from_errno(-ERFKILL);
-                mutex_lock(&rdev->devlist_mtx);
                 ret = cfg80211_can_add_interface(rdev, wdev->iftype);
-                mutex_unlock(&rdev->devlist_mtx);
                 if (ret)
                         return notifier_from_errno(ret);
                 break;
@@ -1089,12 +973,10 @@ static void __net_exit cfg80211_pernet_exit(struct net *net)
         struct cfg80211_registered_device *rdev;
 
         rtnl_lock();
-        mutex_lock(&cfg80211_mutex);
         list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
                 if (net_eq(wiphy_net(&rdev->wiphy), net))
                         WARN_ON(cfg80211_switch_netns(rdev, &init_net));
         }
-        mutex_unlock(&cfg80211_mutex);
         rtnl_unlock();
 }
 
diff --git a/net/wireless/core.h b/net/wireless/core.h
index fd35dae547c4..9ad43c619c54 100644
--- a/net/wireless/core.h
+++ b/net/wireless/core.h
@@ -5,7 +5,6 @@
  */
 #ifndef __NET_WIRELESS_CORE_H
 #define __NET_WIRELESS_CORE_H
-#include <linux/mutex.h>
 #include <linux/list.h>
 #include <linux/netdevice.h>
 #include <linux/rbtree.h>
@@ -23,11 +22,6 @@
 struct cfg80211_registered_device {
         const struct cfg80211_ops *ops;
         struct list_head list;
-        /* we hold this mutex during any call so that
-         * we cannot do multiple calls at once, and also
-         * to avoid the deregister call to proceed while
-         * any call is in progress */
-        struct mutex mtx;
 
         /* rfkill support */
         struct rfkill_ops rfkill_ops;
@@ -49,9 +43,7 @@ struct cfg80211_registered_device {
         /* wiphy index, internal only */
         int wiphy_idx;
 
-        /* associated wireless interfaces */
-        struct mutex devlist_mtx;
-        /* protected by devlist_mtx or RCU */
+        /* associated wireless interfaces, protected by rtnl or RCU */
         struct list_head wdev_list;
         int devlist_generation, wdev_id;
         int opencount; /* also protected by devlist_mtx */
@@ -75,8 +67,6 @@ struct cfg80211_registered_device {
         struct work_struct scan_done_wk;
         struct work_struct sched_scan_results_wk;
 
-        struct mutex sched_scan_mtx;
-
 #ifdef CONFIG_NL80211_TESTMODE
         struct genl_info *testmode_info;
 #endif
@@ -84,13 +74,13 @@ struct cfg80211_registered_device {
         struct work_struct conn_work;
         struct work_struct event_work;
 
-        struct cfg80211_wowlan *wowlan;
-
         struct delayed_work dfs_update_channels_wk;
 
         /* netlink port which started critical protocol (0 means not started) */
         u32 crit_proto_nlportid;
 
+        struct cfg80211_coalesce *coalesce;
+
         /* must be last because of the way we do wiphy_priv(),
          * and it should at least be aligned to NETDEV_ALIGN */
         struct wiphy wiphy __aligned(NETDEV_ALIGN);
@@ -106,29 +96,26 @@ struct cfg80211_registered_device *wiphy_to_dev(struct wiphy *wiphy)
 static inline void
 cfg80211_rdev_free_wowlan(struct cfg80211_registered_device *rdev)
 {
+#ifdef CONFIG_PM
         int i;
 
-        if (!rdev->wowlan)
+        if (!rdev->wiphy.wowlan_config)
                 return;
-        for (i = 0; i < rdev->wowlan->n_patterns; i++)
-                kfree(rdev->wowlan->patterns[i].mask);
-        kfree(rdev->wowlan->patterns);
-        if (rdev->wowlan->tcp && rdev->wowlan->tcp->sock)
-                sock_release(rdev->wowlan->tcp->sock);
-        kfree(rdev->wowlan->tcp);
-        kfree(rdev->wowlan);
+        for (i = 0; i < rdev->wiphy.wowlan_config->n_patterns; i++)
+                kfree(rdev->wiphy.wowlan_config->patterns[i].mask);
+        kfree(rdev->wiphy.wowlan_config->patterns);
+        if (rdev->wiphy.wowlan_config->tcp &&
+            rdev->wiphy.wowlan_config->tcp->sock)
+                sock_release(rdev->wiphy.wowlan_config->tcp->sock);
+        kfree(rdev->wiphy.wowlan_config->tcp);
+        kfree(rdev->wiphy.wowlan_config);
+#endif
 }
 
 extern struct workqueue_struct *cfg80211_wq;
-extern struct mutex cfg80211_mutex;
 extern struct list_head cfg80211_rdev_list;
 extern int cfg80211_rdev_list_generation;
 
-static inline void assert_cfg80211_lock(void)
-{
-        lockdep_assert_held(&cfg80211_mutex);
-}
-
 struct cfg80211_internal_bss {
         struct list_head list;
         struct list_head hidden_list;
@@ -161,27 +148,11 @@ static inline void cfg80211_unhold_bss(struct cfg80211_internal_bss *bss)
 struct cfg80211_registered_device *cfg80211_rdev_by_wiphy_idx(int wiphy_idx);
 int get_wiphy_idx(struct wiphy *wiphy);
 
-/* requires cfg80211_rdev_mutex to be held! */
 struct wiphy *wiphy_idx_to_wiphy(int wiphy_idx);
 
-/* identical to cfg80211_get_dev_from_info but only operate on ifindex */
-extern struct cfg80211_registered_device *
-cfg80211_get_dev_from_ifindex(struct net *net, int ifindex);
-
 int cfg80211_switch_netns(struct cfg80211_registered_device *rdev,
                           struct net *net);
 
-static inline void cfg80211_lock_rdev(struct cfg80211_registered_device *rdev)
-{
-        mutex_lock(&rdev->mtx);
-}
-
-static inline void cfg80211_unlock_rdev(struct cfg80211_registered_device *rdev)
-{
-        BUG_ON(IS_ERR(rdev) || !rdev);
-        mutex_unlock(&rdev->mtx);
-}
-
 static inline void wdev_lock(struct wireless_dev *wdev)
         __acquires(wdev)
 {
@@ -196,7 +167,7 @@ static inline void wdev_unlock(struct wireless_dev *wdev)
         mutex_unlock(&wdev->mtx);
 }
 
-#define ASSERT_RDEV_LOCK(rdev) lockdep_assert_held(&(rdev)->mtx)
+#define ASSERT_RDEV_LOCK(rdev) ASSERT_RTNL()
 #define ASSERT_WDEV_LOCK(wdev) lockdep_assert_held(&(wdev)->mtx)
 
 static inline bool cfg80211_has_monitors_only(struct cfg80211_registered_device *rdev)
@@ -314,38 +285,21 @@ int cfg80211_stop_ap(struct cfg80211_registered_device *rdev,
                      struct net_device *dev);
 
 /* MLME */
-int __cfg80211_mlme_auth(struct cfg80211_registered_device *rdev,
-                         struct net_device *dev,
-                         struct ieee80211_channel *chan,
-                         enum nl80211_auth_type auth_type,
-                         const u8 *bssid,
-                         const u8 *ssid, int ssid_len,
-                         const u8 *ie, int ie_len,
-                         const u8 *key, int key_len, int key_idx,
-                         const u8 *sae_data, int sae_data_len);
 int cfg80211_mlme_auth(struct cfg80211_registered_device *rdev,
-                       struct net_device *dev, struct ieee80211_channel *chan,
-                       enum nl80211_auth_type auth_type, const u8 *bssid,
+                       struct net_device *dev,
+                       struct ieee80211_channel *chan,
+                       enum nl80211_auth_type auth_type,
+                       const u8 *bssid,
                        const u8 *ssid, int ssid_len,
                        const u8 *ie, int ie_len,
                        const u8 *key, int key_len, int key_idx,
                        const u8 *sae_data, int sae_data_len);
-int __cfg80211_mlme_assoc(struct cfg80211_registered_device *rdev,
-                          struct net_device *dev,
-                          struct ieee80211_channel *chan,
-                          const u8 *bssid,
-                          const u8 *ssid, int ssid_len,
-                          struct cfg80211_assoc_request *req);
 int cfg80211_mlme_assoc(struct cfg80211_registered_device *rdev,
                         struct net_device *dev,
                         struct ieee80211_channel *chan,
                         const u8 *bssid,
                         const u8 *ssid, int ssid_len,
                         struct cfg80211_assoc_request *req);
-int __cfg80211_mlme_deauth(struct cfg80211_registered_device *rdev,
-                           struct net_device *dev, const u8 *bssid,
-                           const u8 *ie, int ie_len, u16 reason,
-                           bool local_state_change);
 int cfg80211_mlme_deauth(struct cfg80211_registered_device *rdev,
                          struct net_device *dev, const u8 *bssid,
                          const u8 *ie, int ie_len, u16 reason,
@@ -356,11 +310,6 @@ int cfg80211_mlme_disassoc(struct cfg80211_registered_device *rdev,
                            bool local_state_change);
 void cfg80211_mlme_down(struct cfg80211_registered_device *rdev,
                         struct net_device *dev);
-void __cfg80211_connect_result(struct net_device *dev, const u8 *bssid,
-                               const u8 *req_ie, size_t req_ie_len,
-                               const u8 *resp_ie, size_t resp_ie_len,
-                               u16 status, bool wextev,
-                               struct cfg80211_bss *bss);
 int cfg80211_mlme_register_mgmt(struct wireless_dev *wdev, u32 snd_pid,
                                 u16 frame_type, const u8 *match_data,
                                 int match_len);
@@ -376,19 +325,19 @@ void cfg80211_oper_and_ht_capa(struct ieee80211_ht_cap *ht_capa,
 void cfg80211_oper_and_vht_capa(struct ieee80211_vht_cap *vht_capa,
                                 const struct ieee80211_vht_cap *vht_capa_mask);
 
-/* SME */
-int __cfg80211_connect(struct cfg80211_registered_device *rdev,
-                       struct net_device *dev,
-                       struct cfg80211_connect_params *connect,
-                       struct cfg80211_cached_keys *connkeys,
-                       const u8 *prev_bssid);
+/* SME events */
 int cfg80211_connect(struct cfg80211_registered_device *rdev,
                      struct net_device *dev,
                      struct cfg80211_connect_params *connect,
-                     struct cfg80211_cached_keys *connkeys);
-int __cfg80211_disconnect(struct cfg80211_registered_device *rdev,
-                          struct net_device *dev, u16 reason,
-                          bool wextev);
+                     struct cfg80211_cached_keys *connkeys,
+                     const u8 *prev_bssid);
+void __cfg80211_connect_result(struct net_device *dev, const u8 *bssid,
+                               const u8 *req_ie, size_t req_ie_len,
+                               const u8 *resp_ie, size_t resp_ie_len,
+                               u16 status, bool wextev,
+                               struct cfg80211_bss *bss);
+void __cfg80211_disconnected(struct net_device *dev, const u8 *ie,
+                             size_t ie_len, u16 reason, bool from_ap);
 int cfg80211_disconnect(struct cfg80211_registered_device *rdev,
                         struct net_device *dev, u16 reason,
                         bool wextev);
@@ -399,21 +348,21 @@ void __cfg80211_roamed(struct wireless_dev *wdev,
 int cfg80211_mgd_wext_connect(struct cfg80211_registered_device *rdev,
                               struct wireless_dev *wdev);
 
+/* SME implementation */
 void cfg80211_conn_work(struct work_struct *work);
-void cfg80211_sme_failed_assoc(struct wireless_dev *wdev);
-bool cfg80211_sme_failed_reassoc(struct wireless_dev *wdev);
+void cfg80211_sme_scan_done(struct net_device *dev);
+bool cfg80211_sme_rx_assoc_resp(struct wireless_dev *wdev, u16 status);
+void cfg80211_sme_rx_auth(struct wireless_dev *wdev, const u8 *buf, size_t len);
+void cfg80211_sme_disassoc(struct wireless_dev *wdev);
+void cfg80211_sme_deauth(struct wireless_dev *wdev);
+void cfg80211_sme_auth_timeout(struct wireless_dev *wdev);
+void cfg80211_sme_assoc_timeout(struct wireless_dev *wdev);
 
 /* internal helpers */
 bool cfg80211_supported_cipher_suite(struct wiphy *wiphy, u32 cipher);
 int cfg80211_validate_key_settings(struct cfg80211_registered_device *rdev,
                                    struct key_params *params, int key_idx,
                                    bool pairwise, const u8 *mac_addr);
-void __cfg80211_disconnected(struct net_device *dev, const u8 *ie,
-                             size_t ie_len, u16 reason, bool from_ap);
-void cfg80211_sme_scan_done(struct net_device *dev);
-void cfg80211_sme_rx_auth(struct net_device *dev, const u8 *buf, size_t len);
-void cfg80211_sme_disassoc(struct net_device *dev,
-                           struct cfg80211_internal_bss *bss);
 void __cfg80211_scan_done(struct work_struct *wk);
 void ___cfg80211_scan_done(struct cfg80211_registered_device *rdev, bool leak);
 void __cfg80211_sched_scan_results(struct work_struct *wk);
diff --git a/net/wireless/debugfs.c b/net/wireless/debugfs.c
index 920cabe0461b..90d050036624 100644
--- a/net/wireless/debugfs.c
+++ b/net/wireless/debugfs.c
@@ -74,7 +74,7 @@ static ssize_t ht40allow_map_read(struct file *file,
         if (!buf)
                 return -ENOMEM;
 
-        mutex_lock(&cfg80211_mutex);
+        rtnl_lock();
 
         for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
                 sband = wiphy->bands[band];
@@ -85,7 +85,7 @@ static ssize_t ht40allow_map_read(struct file *file,
                                                 buf, buf_size, offset);
         }
 
-        mutex_unlock(&cfg80211_mutex);
+        rtnl_unlock();
 
         r = simple_read_from_buffer(user_buf, count, ppos, buf, offset);
 
diff --git a/net/wireless/ibss.c b/net/wireless/ibss.c
index d80e47194d49..39bff7d36768 100644
--- a/net/wireless/ibss.c
+++ b/net/wireless/ibss.c
@@ -43,7 +43,6 @@ void __cfg80211_ibss_joined(struct net_device *dev, const u8 *bssid)
         cfg80211_hold_bss(bss_from_pub(bss));
         wdev->current_bss = bss_from_pub(bss);
 
-        wdev->sme_state = CFG80211_SME_CONNECTED;
         cfg80211_upload_connect_keys(wdev);
 
         nl80211_send_ibss_bssid(wiphy_to_dev(wdev->wiphy), dev, bssid,
@@ -64,8 +63,6 @@ void cfg80211_ibss_joined(struct net_device *dev, const u8 *bssid, gfp_t gfp)
 
         trace_cfg80211_ibss_joined(dev, bssid);
 
-        CFG80211_DEV_WARN_ON(wdev->sme_state != CFG80211_SME_CONNECTING);
-
         ev = kzalloc(sizeof(*ev), gfp);
         if (!ev)
                 return;
@@ -120,7 +117,6 @@ int __cfg80211_join_ibss(struct cfg80211_registered_device *rdev,
 #ifdef CONFIG_CFG80211_WEXT
         wdev->wext.ibss.chandef = params->chandef;
 #endif
-        wdev->sme_state = CFG80211_SME_CONNECTING;
 
         err = cfg80211_can_use_chan(rdev, wdev, params->chandef.chan,
                                     params->channel_fixed
@@ -134,7 +130,6 @@ int __cfg80211_join_ibss(struct cfg80211_registered_device *rdev,
         err = rdev_join_ibss(rdev, dev, params);
         if (err) {
                 wdev->connect_keys = NULL;
-                wdev->sme_state = CFG80211_SME_IDLE;
                 return err;
         }
 
@@ -152,11 +147,11 @@ int cfg80211_join_ibss(struct cfg80211_registered_device *rdev,
         struct wireless_dev *wdev = dev->ieee80211_ptr;
         int err;
 
-        mutex_lock(&rdev->devlist_mtx);
+        ASSERT_RTNL();
+
         wdev_lock(wdev);
         err = __cfg80211_join_ibss(rdev, dev, params, connkeys);
         wdev_unlock(wdev);
-        mutex_unlock(&rdev->devlist_mtx);
 
         return err;
 }
@@ -186,7 +181,6 @@ static void __cfg80211_clear_ibss(struct net_device *dev, bool nowext)
         }
 
         wdev->current_bss = NULL;
-        wdev->sme_state = CFG80211_SME_IDLE;
         wdev->ssid_len = 0;
 #ifdef CONFIG_CFG80211_WEXT
         if (!nowext)
@@ -359,11 +353,9 @@ int cfg80211_ibss_wext_siwfreq(struct net_device *dev,
                 wdev->wext.ibss.channel_fixed = false;
         }
 
-        mutex_lock(&rdev->devlist_mtx);
         wdev_lock(wdev);
         err = cfg80211_ibss_wext_join(rdev, wdev);
         wdev_unlock(wdev);
-        mutex_unlock(&rdev->devlist_mtx);
 
         return err;
 }
@@ -429,11 +421,9 @@ int cfg80211_ibss_wext_siwessid(struct net_device *dev,
         memcpy(wdev->wext.ibss.ssid, ssid, len);
         wdev->wext.ibss.ssid_len = len;
 
-        mutex_lock(&rdev->devlist_mtx);
         wdev_lock(wdev);
         err = cfg80211_ibss_wext_join(rdev, wdev);
         wdev_unlock(wdev);
-        mutex_unlock(&rdev->devlist_mtx);
 
         return err;
 }
@@ -512,11 +502,9 @@ int cfg80211_ibss_wext_siwap(struct net_device *dev,
         } else
                 wdev->wext.ibss.bssid = NULL;
 
-        mutex_lock(&rdev->devlist_mtx);
         wdev_lock(wdev);
         err = cfg80211_ibss_wext_join(rdev, wdev);
         wdev_unlock(wdev);
-        mutex_unlock(&rdev->devlist_mtx);
 
         return err;
 }
diff --git a/net/wireless/mesh.c b/net/wireless/mesh.c
index 0bb93f3061a4..0553fd4d85ae 100644
--- a/net/wireless/mesh.c
+++ b/net/wireless/mesh.c
@@ -18,6 +18,7 @@
 #define MESH_PATH_TO_ROOT_TIMEOUT      6000
 #define MESH_ROOT_INTERVAL     5000
 #define MESH_ROOT_CONFIRMATION_INTERVAL 2000
+#define MESH_DEFAULT_PLINK_TIMEOUT      1800 /* timeout in seconds */
 
 /*
  * Minimum interval between two consecutive PREQs originated by the same
@@ -75,6 +76,7 @@ const struct mesh_config default_mesh_config = {
         .dot11MeshHWMPconfirmationInterval = MESH_ROOT_CONFIRMATION_INTERVAL,
         .power_mode = NL80211_MESH_POWER_ACTIVE,
         .dot11MeshAwakeWindowDuration = MESH_DEFAULT_AWAKE_WINDOW,
+        .plink_timeout = MESH_DEFAULT_PLINK_TIMEOUT,
 };
 
 const struct mesh_setup default_mesh_setup = {
@@ -82,6 +84,7 @@ const struct mesh_setup default_mesh_setup = {
         .sync_method = IEEE80211_SYNC_METHOD_NEIGHBOR_OFFSET,
         .path_sel_proto = IEEE80211_PATH_PROTOCOL_HWMP,
         .path_metric = IEEE80211_PATH_METRIC_AIRTIME,
+        .auth_id = 0, /* open */
         .ie = NULL,
         .ie_len = 0,
         .is_secure = false,
@@ -159,6 +162,19 @@ int __cfg80211_join_mesh(struct cfg80211_registered_device *rdev,
                 setup->chandef.center_freq1 = setup->chandef.chan->center_freq;
         }
 
+        /*
+         * check if basic rates are available otherwise use mandatory rates as
+         * basic rates
+         */
+        if (!setup->basic_rates) {
+                enum nl80211_bss_scan_width scan_width;
+                struct ieee80211_supported_band *sband =
+                                rdev->wiphy.bands[setup->chandef.chan->band];
+                scan_width = cfg80211_chandef_to_scan_width(&setup->chandef);
+                setup->basic_rates = ieee80211_mandatory_rates(sband,
+                                                               scan_width);
+        }
+
         if (!cfg80211_reg_can_beacon(&rdev->wiphy, &setup->chandef))
                 return -EINVAL;
 
@@ -185,11 +201,9 @@ int cfg80211_join_mesh(struct cfg80211_registered_device *rdev,
         struct wireless_dev *wdev = dev->ieee80211_ptr;
         int err;
 
-        mutex_lock(&rdev->devlist_mtx);
         wdev_lock(wdev);
         err = __cfg80211_join_mesh(rdev, dev, setup, conf);
         wdev_unlock(wdev);
-        mutex_unlock(&rdev->devlist_mtx);
 
         return err;
 }
diff --git a/net/wireless/mlme.c b/net/wireless/mlme.c
index 0c7b7dd855f6..8d49c1ce3dea 100644
--- a/net/wireless/mlme.c
+++ b/net/wireless/mlme.c
@@ -18,37 +18,18 @@
 #include "rdev-ops.h"
 
 
-void cfg80211_send_rx_auth(struct net_device *dev, const u8 *buf, size_t len)
-{
-        struct wireless_dev *wdev = dev->ieee80211_ptr;
-        struct wiphy *wiphy = wdev->wiphy;
-        struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
-
-        trace_cfg80211_send_rx_auth(dev);
-        wdev_lock(wdev);
-
-        nl80211_send_rx_auth(rdev, dev, buf, len, GFP_KERNEL);
-        cfg80211_sme_rx_auth(dev, buf, len);
-
-        wdev_unlock(wdev);
-}
-EXPORT_SYMBOL(cfg80211_send_rx_auth);
-
-void cfg80211_send_rx_assoc(struct net_device *dev, struct cfg80211_bss *bss,
+void cfg80211_rx_assoc_resp(struct net_device *dev, struct cfg80211_bss *bss,
                             const u8 *buf, size_t len)
 {
-        u16 status_code;
         struct wireless_dev *wdev = dev->ieee80211_ptr;
         struct wiphy *wiphy = wdev->wiphy;
         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
         struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *)buf;
         u8 *ie = mgmt->u.assoc_resp.variable;
         int ieoffs = offsetof(struct ieee80211_mgmt, u.assoc_resp.variable);
+        u16 status_code = le16_to_cpu(mgmt->u.assoc_resp.status_code);
 
         trace_cfg80211_send_rx_assoc(dev, bss);
-        wdev_lock(wdev);
-
-        status_code = le16_to_cpu(mgmt->u.assoc_resp.status_code);
 
         /*
          * This is a bit of a hack, we don't notify userspace of
@@ -56,174 +37,135 @@ void cfg80211_send_rx_assoc(struct net_device *dev, struct cfg80211_bss *bss,
          * and got a reject -- we only try again with an assoc
          * frame instead of reassoc.
          */
-        if (status_code != WLAN_STATUS_SUCCESS && wdev->conn &&
-            cfg80211_sme_failed_reassoc(wdev)) {
+        if (cfg80211_sme_rx_assoc_resp(wdev, status_code)) {
+                cfg80211_unhold_bss(bss_from_pub(bss));
                 cfg80211_put_bss(wiphy, bss);
-                goto out;
+                return;
         }
 
         nl80211_send_rx_assoc(rdev, dev, buf, len, GFP_KERNEL);
-
-        if (status_code != WLAN_STATUS_SUCCESS && wdev->conn) {
-                cfg80211_sme_failed_assoc(wdev);
-                /*
-                 * do not call connect_result() now because the
-                 * sme will schedule work that does it later.
-                 */
-                cfg80211_put_bss(wiphy, bss);
-                goto out;
-        }
-
-        if (!wdev->conn && wdev->sme_state == CFG80211_SME_IDLE) {
-                /*
-                 * This is for the userspace SME, the CONNECTING
-                 * state will be changed to CONNECTED by
-                 * __cfg80211_connect_result() below.
-                 */
-                wdev->sme_state = CFG80211_SME_CONNECTING;
-        }
-
-        /* this consumes the bss reference */
+        /* update current_bss etc., consumes the bss reference */
         __cfg80211_connect_result(dev, mgmt->bssid, NULL, 0, ie, len - ieoffs,
                                   status_code,
                                   status_code == WLAN_STATUS_SUCCESS, bss);
- out:
-        wdev_unlock(wdev);
 }
-EXPORT_SYMBOL(cfg80211_send_rx_assoc);
+EXPORT_SYMBOL(cfg80211_rx_assoc_resp);
 
-void __cfg80211_send_deauth(struct net_device *dev,
-                                   const u8 *buf, size_t len)
+static void cfg80211_process_auth(struct wireless_dev *wdev,
+                                  const u8 *buf, size_t len)
 {
-        struct wireless_dev *wdev = dev->ieee80211_ptr;
-        struct wiphy *wiphy = wdev->wiphy;
-        struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
-        struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *)buf;
-        const u8 *bssid = mgmt->bssid;
-        bool was_current = false;
+        struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
 
-        trace___cfg80211_send_deauth(dev);
-        ASSERT_WDEV_LOCK(wdev);
-
-        if (wdev->current_bss &&
-            ether_addr_equal(wdev->current_bss->pub.bssid, bssid)) {
-                cfg80211_unhold_bss(wdev->current_bss);
-                cfg80211_put_bss(wiphy, &wdev->current_bss->pub);
-                wdev->current_bss = NULL;
-                was_current = true;
-        }
+        nl80211_send_rx_auth(rdev, wdev->netdev, buf, len, GFP_KERNEL);
+        cfg80211_sme_rx_auth(wdev, buf, len);
+}
 
-        nl80211_send_deauth(rdev, dev, buf, len, GFP_KERNEL);
+static void cfg80211_process_deauth(struct wireless_dev *wdev,
+                                    const u8 *buf, size_t len)
+{
+        struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
+        struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *)buf;
+        const u8 *bssid = mgmt->bssid;
+        u16 reason_code = le16_to_cpu(mgmt->u.deauth.reason_code);
+        bool from_ap = !ether_addr_equal(mgmt->sa, wdev->netdev->dev_addr);
 
-        if (wdev->sme_state == CFG80211_SME_CONNECTED && was_current) {
-                u16 reason_code;
-                bool from_ap;
+        nl80211_send_deauth(rdev, wdev->netdev, buf, len, GFP_KERNEL);
 
-                reason_code = le16_to_cpu(mgmt->u.deauth.reason_code);
+        if (!wdev->current_bss ||
+            !ether_addr_equal(wdev->current_bss->pub.bssid, bssid))
+                return;
 
-                from_ap = !ether_addr_equal(mgmt->sa, dev->dev_addr);
-                __cfg80211_disconnected(dev, NULL, 0, reason_code, from_ap);
-        } else if (wdev->sme_state == CFG80211_SME_CONNECTING) {
-                __cfg80211_connect_result(dev, mgmt->bssid, NULL, 0, NULL, 0,
-                                          WLAN_STATUS_UNSPECIFIED_FAILURE,
-                                          false, NULL);
-        }
+        __cfg80211_disconnected(wdev->netdev, NULL, 0, reason_code, from_ap);
+        cfg80211_sme_deauth(wdev);
 }
-EXPORT_SYMBOL(__cfg80211_send_deauth);
 
-void cfg80211_send_deauth(struct net_device *dev, const u8 *buf, size_t len)
+static void cfg80211_process_disassoc(struct wireless_dev *wdev,
+                                      const u8 *buf, size_t len)
 {
-        struct wireless_dev *wdev = dev->ieee80211_ptr;
+        struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
+        struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *)buf;
+        const u8 *bssid = mgmt->bssid;
+        u16 reason_code = le16_to_cpu(mgmt->u.disassoc.reason_code);
+        bool from_ap = !ether_addr_equal(mgmt->sa, wdev->netdev->dev_addr);
 
-        wdev_lock(wdev);
-        __cfg80211_send_deauth(dev, buf, len);
-        wdev_unlock(wdev);
+        nl80211_send_disassoc(rdev, wdev->netdev, buf, len, GFP_KERNEL);
+
+        if (WARN_ON(!wdev->current_bss ||
+                    !ether_addr_equal(wdev->current_bss->pub.bssid, bssid)))
+                return;
+
+        __cfg80211_disconnected(wdev->netdev, NULL, 0, reason_code, from_ap);
+        cfg80211_sme_disassoc(wdev);
 }
-EXPORT_SYMBOL(cfg80211_send_deauth);
 
-void __cfg80211_send_disassoc(struct net_device *dev,
-                                     const u8 *buf, size_t len)
+void cfg80211_rx_mlme_mgmt(struct net_device *dev, const u8 *buf, size_t len)
 {
         struct wireless_dev *wdev = dev->ieee80211_ptr;
-        struct wiphy *wiphy = wdev->wiphy;
-        struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
-        struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *)buf;
-        const u8 *bssid = mgmt->bssid;
-        u16 reason_code;
-        bool from_ap;
+        struct ieee80211_mgmt *mgmt = (void *)buf;
 
-        trace___cfg80211_send_disassoc(dev);
         ASSERT_WDEV_LOCK(wdev);
 
-        nl80211_send_disassoc(rdev, dev, buf, len, GFP_KERNEL);
+        trace_cfg80211_rx_mlme_mgmt(dev, buf, len);
 
-        if (wdev->sme_state != CFG80211_SME_CONNECTED)
+        if (WARN_ON(len < 2))
                 return;
 
-        if (wdev->current_bss &&
-            ether_addr_equal(wdev->current_bss->pub.bssid, bssid)) {
-                cfg80211_sme_disassoc(dev, wdev->current_bss);
-                cfg80211_unhold_bss(wdev->current_bss);
-                cfg80211_put_bss(wiphy, &wdev->current_bss->pub);
-                wdev->current_bss = NULL;
-        } else
-                WARN_ON(1);
-
-
-        reason_code = le16_to_cpu(mgmt->u.disassoc.reason_code);
-
-        from_ap = !ether_addr_equal(mgmt->sa, dev->dev_addr);
-        __cfg80211_disconnected(dev, NULL, 0, reason_code, from_ap);
+        if (ieee80211_is_auth(mgmt->frame_control))
+                cfg80211_process_auth(wdev, buf, len);
+        else if (ieee80211_is_deauth(mgmt->frame_control))
+                cfg80211_process_deauth(wdev, buf, len);
+        else if (ieee80211_is_disassoc(mgmt->frame_control))
+                cfg80211_process_disassoc(wdev, buf, len);
 }
-EXPORT_SYMBOL(__cfg80211_send_disassoc);
+EXPORT_SYMBOL(cfg80211_rx_mlme_mgmt);
 
-void cfg80211_send_disassoc(struct net_device *dev, const u8 *buf, size_t len)
+void cfg80211_auth_timeout(struct net_device *dev, const u8 *addr)
 {
         struct wireless_dev *wdev = dev->ieee80211_ptr;
+        struct wiphy *wiphy = wdev->wiphy;
+        struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
+
+        trace_cfg80211_send_auth_timeout(dev, addr);
 
-        wdev_lock(wdev);
-        __cfg80211_send_disassoc(dev, buf, len);
-        wdev_unlock(wdev);
+        nl80211_send_auth_timeout(rdev, dev, addr, GFP_KERNEL);
+        cfg80211_sme_auth_timeout(wdev);
 }
-EXPORT_SYMBOL(cfg80211_send_disassoc);
+EXPORT_SYMBOL(cfg80211_auth_timeout);
 
-void cfg80211_send_auth_timeout(struct net_device *dev, const u8 *addr)
+void cfg80211_assoc_timeout(struct net_device *dev, struct cfg80211_bss *bss)
 {
         struct wireless_dev *wdev = dev->ieee80211_ptr;
         struct wiphy *wiphy = wdev->wiphy;
         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
 
-        trace_cfg80211_send_auth_timeout(dev, addr);
-        wdev_lock(wdev);
+        trace_cfg80211_send_assoc_timeout(dev, bss->bssid);
 
-        nl80211_send_auth_timeout(rdev, dev, addr, GFP_KERNEL);
-        if (wdev->sme_state == CFG80211_SME_CONNECTING)
-                __cfg80211_connect_result(dev, addr, NULL, 0, NULL, 0,
-                                          WLAN_STATUS_UNSPECIFIED_FAILURE,
-                                          false, NULL);
+        nl80211_send_assoc_timeout(rdev, dev, bss->bssid, GFP_KERNEL);
+        cfg80211_sme_assoc_timeout(wdev);
 
-        wdev_unlock(wdev);
+        cfg80211_unhold_bss(bss_from_pub(bss));
+        cfg80211_put_bss(wiphy, bss);
 }
-EXPORT_SYMBOL(cfg80211_send_auth_timeout);
+EXPORT_SYMBOL(cfg80211_assoc_timeout);
 
-void cfg80211_send_assoc_timeout(struct net_device *dev, const u8 *addr)
+void cfg80211_tx_mlme_mgmt(struct net_device *dev, const u8 *buf, size_t len)
 {
         struct wireless_dev *wdev = dev->ieee80211_ptr;
-        struct wiphy *wiphy = wdev->wiphy;
-        struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
+        struct ieee80211_mgmt *mgmt = (void *)buf;
 
-        trace_cfg80211_send_assoc_timeout(dev, addr);
-        wdev_lock(wdev);
+        ASSERT_WDEV_LOCK(wdev);
 
-        nl80211_send_assoc_timeout(rdev, dev, addr, GFP_KERNEL);
-        if (wdev->sme_state == CFG80211_SME_CONNECTING)
-                __cfg80211_connect_result(dev, addr, NULL, 0, NULL, 0,
-                                          WLAN_STATUS_UNSPECIFIED_FAILURE,
-                                          false, NULL);
+        trace_cfg80211_tx_mlme_mgmt(dev, buf, len);
 
-        wdev_unlock(wdev);
+        if (WARN_ON(len < 2))
+                return;
+
+        if (ieee80211_is_deauth(mgmt->frame_control))
+                cfg80211_process_deauth(wdev, buf, len);
+        else
+                cfg80211_process_disassoc(wdev, buf, len);
 }
-EXPORT_SYMBOL(cfg80211_send_assoc_timeout);
+EXPORT_SYMBOL(cfg80211_tx_mlme_mgmt);
 
 void cfg80211_michael_mic_failure(struct net_device *dev, const u8 *addr,
                                   enum nl80211_key_type key_type, int key_id,
@@ -253,18 +195,27 @@ void cfg80211_michael_mic_failure(struct net_device *dev, const u8 *addr,
 EXPORT_SYMBOL(cfg80211_michael_mic_failure);
 
 /* some MLME handling for userspace SME */
-int __cfg80211_mlme_auth(struct cfg80211_registered_device *rdev,
-                         struct net_device *dev,
-                         struct ieee80211_channel *chan,
-                         enum nl80211_auth_type auth_type,
-                         const u8 *bssid,
-                         const u8 *ssid, int ssid_len,
-                         const u8 *ie, int ie_len,
-                         const u8 *key, int key_len, int key_idx,
-                         const u8 *sae_data, int sae_data_len)
+int cfg80211_mlme_auth(struct cfg80211_registered_device *rdev,
+                       struct net_device *dev,
+                       struct ieee80211_channel *chan,
+                       enum nl80211_auth_type auth_type,
+                       const u8 *bssid,
+                       const u8 *ssid, int ssid_len,
+                       const u8 *ie, int ie_len,
+                       const u8 *key, int key_len, int key_idx,
+                       const u8 *sae_data, int sae_data_len)
 {
         struct wireless_dev *wdev = dev->ieee80211_ptr;
-        struct cfg80211_auth_request req;
+        struct cfg80211_auth_request req = {
+                .ie = ie,
+                .ie_len = ie_len,
+                .sae_data = sae_data,
+                .sae_data_len = sae_data_len,
+                .auth_type = auth_type,
+                .key = key,
+                .key_len = key_len,
+                .key_idx = key_idx,
+        };
         int err;
 
         ASSERT_WDEV_LOCK(wdev);
@@ -277,18 +228,8 @@ int __cfg80211_mlme_auth(struct cfg80211_registered_device *rdev,
             ether_addr_equal(bssid, wdev->current_bss->pub.bssid))
                 return -EALREADY;
 
-        memset(&req, 0, sizeof(req));
-
-        req.ie = ie;
-        req.ie_len = ie_len;
-        req.sae_data = sae_data;
-        req.sae_data_len = sae_data_len;
-        req.auth_type = auth_type;
         req.bss = cfg80211_get_bss(&rdev->wiphy, chan, bssid, ssid, ssid_len,
                                    WLAN_CAPABILITY_ESS, WLAN_CAPABILITY_ESS);
-        req.key = key;
-        req.key_len = key_len;
-        req.key_idx = key_idx;
         if (!req.bss)
                 return -ENOENT;
 
@@ -304,28 +245,6 @@ out:
         return err;
 }
 
-int cfg80211_mlme_auth(struct cfg80211_registered_device *rdev,
-                       struct net_device *dev, struct ieee80211_channel *chan,
-                       enum nl80211_auth_type auth_type, const u8 *bssid,
-                       const u8 *ssid, int ssid_len,
-                       const u8 *ie, int ie_len,
-                       const u8 *key, int key_len, int key_idx,
-                       const u8 *sae_data, int sae_data_len)
-{
-        int err;
-
-        mutex_lock(&rdev->devlist_mtx);
-        wdev_lock(dev->ieee80211_ptr);
-        err = __cfg80211_mlme_auth(rdev, dev, chan, auth_type, bssid,
-                                   ssid, ssid_len, ie, ie_len,
-                                   key, key_len, key_idx,
-                                   sae_data, sae_data_len);
-        wdev_unlock(dev->ieee80211_ptr);
-        mutex_unlock(&rdev->devlist_mtx);
-
-        return err;
-}
-
 /*  Do a logical ht_capa &= ht_capa_mask.  */
 void cfg80211_oper_and_ht_capa(struct ieee80211_ht_cap *ht_capa,
                                const struct ieee80211_ht_cap *ht_capa_mask)
@@ -360,30 +279,21 @@ void cfg80211_oper_and_vht_capa(struct ieee80211_vht_cap *vht_capa,
                 p1[i] &= p2[i];
 }
 
-int __cfg80211_mlme_assoc(struct cfg80211_registered_device *rdev,
-                          struct net_device *dev,
-                          struct ieee80211_channel *chan,
-                          const u8 *bssid,
-                          const u8 *ssid, int ssid_len,
-                          struct cfg80211_assoc_request *req)
+int cfg80211_mlme_assoc(struct cfg80211_registered_device *rdev,
+                        struct net_device *dev,
+                        struct ieee80211_channel *chan,
+                        const u8 *bssid,
+                        const u8 *ssid, int ssid_len,
+                        struct cfg80211_assoc_request *req)
 {
         struct wireless_dev *wdev = dev->ieee80211_ptr;
         int err;
-        bool was_connected = false;
 
         ASSERT_WDEV_LOCK(wdev);
 
-        if (wdev->current_bss && req->prev_bssid &&
-            ether_addr_equal(wdev->current_bss->pub.bssid, req->prev_bssid)) {
-                /*
-                 * Trying to reassociate: Allow this to proceed and let the old
-                 * association to be dropped when the new one is completed.
-                 */
-                if (wdev->sme_state == CFG80211_SME_CONNECTED) {
-                        was_connected = true;
-                        wdev->sme_state = CFG80211_SME_CONNECTING;
-                }
-        } else if (wdev->current_bss)
+        if (wdev->current_bss &&
+            (!req->prev_bssid || !ether_addr_equal(wdev->current_bss->pub.bssid,
+                                                   req->prev_bssid)))
                 return -EALREADY;
 
         cfg80211_oper_and_ht_capa(&req->ht_capa_mask,
@@ -393,52 +303,28 @@ int __cfg80211_mlme_assoc(struct cfg80211_registered_device *rdev,
 
         req->bss = cfg80211_get_bss(&rdev->wiphy, chan, bssid, ssid, ssid_len,
                                     WLAN_CAPABILITY_ESS, WLAN_CAPABILITY_ESS);
-        if (!req->bss) {
-                if (was_connected)
-                        wdev->sme_state = CFG80211_SME_CONNECTED;
+        if (!req->bss)
                 return -ENOENT;
-        }
 
         err = cfg80211_can_use_chan(rdev, wdev, chan, CHAN_MODE_SHARED);
         if (err)
                 goto out;
 
         err = rdev_assoc(rdev, dev, req);
+        if (!err)
+                cfg80211_hold_bss(bss_from_pub(req->bss));
 
 out:
-        if (err) {
-                if (was_connected)
-                        wdev->sme_state = CFG80211_SME_CONNECTED;
+        if (err)
                 cfg80211_put_bss(&rdev->wiphy, req->bss);
-        }
 
         return err;
 }
 
-int cfg80211_mlme_assoc(struct cfg80211_registered_device *rdev,
-                        struct net_device *dev,
-                        struct ieee80211_channel *chan,
-                        const u8 *bssid,
-                        const u8 *ssid, int ssid_len,
-                        struct cfg80211_assoc_request *req)
-{
-        struct wireless_dev *wdev = dev->ieee80211_ptr;
-        int err;
-
-        mutex_lock(&rdev->devlist_mtx);
-        wdev_lock(wdev);
-        err = __cfg80211_mlme_assoc(rdev, dev, chan, bssid,
-                                    ssid, ssid_len, req);
-        wdev_unlock(wdev);
-        mutex_unlock(&rdev->devlist_mtx);
-
-        return err;
-}
-
-int __cfg80211_mlme_deauth(struct cfg80211_registered_device *rdev,
-                           struct net_device *dev, const u8 *bssid,
-                           const u8 *ie, int ie_len, u16 reason,
-                           bool local_state_change)
+int cfg80211_mlme_deauth(struct cfg80211_registered_device *rdev,
+                         struct net_device *dev, const u8 *bssid,
+                         const u8 *ie, int ie_len, u16 reason,
+                         bool local_state_change)
 {
         struct wireless_dev *wdev = dev->ieee80211_ptr;
         struct cfg80211_deauth_request req = {
@@ -451,79 +337,51 @@ int __cfg80211_mlme_deauth(struct cfg80211_registered_device *rdev,
 
         ASSERT_WDEV_LOCK(wdev);
 
-        if (local_state_change && (!wdev->current_bss ||
-            !ether_addr_equal(wdev->current_bss->pub.bssid, bssid)))
+        if (local_state_change &&
+            (!wdev->current_bss ||
+             !ether_addr_equal(wdev->current_bss->pub.bssid, bssid)))
                 return 0;
 
         return rdev_deauth(rdev, dev, &req);
 }
 
-int cfg80211_mlme_deauth(struct cfg80211_registered_device *rdev,
-                         struct net_device *dev, const u8 *bssid,
-                         const u8 *ie, int ie_len, u16 reason,
-                         bool local_state_change)
+int cfg80211_mlme_disassoc(struct cfg80211_registered_device *rdev,
+                           struct net_device *dev, const u8 *bssid,
+                           const u8 *ie, int ie_len, u16 reason,
+                           bool local_state_change)
 {
         struct wireless_dev *wdev = dev->ieee80211_ptr;
+        struct cfg80211_disassoc_request req = {
+                .reason_code = reason,
+                .local_state_change = local_state_change,
+                .ie = ie,
+                .ie_len = ie_len,
+        };
         int err;
 
-        wdev_lock(wdev);
-        err = __cfg80211_mlme_deauth(rdev, dev, bssid, ie, ie_len, reason,
-                                     local_state_change);
-        wdev_unlock(wdev);
-
-        return err;
-}
-
-static int __cfg80211_mlme_disassoc(struct cfg80211_registered_device *rdev,
-                                    struct net_device *dev, const u8 *bssid,
-                                    const u8 *ie, int ie_len, u16 reason,
-                                    bool local_state_change)
-{
-        struct wireless_dev *wdev = dev->ieee80211_ptr;
-        struct cfg80211_disassoc_request req;
-
         ASSERT_WDEV_LOCK(wdev);
 
-        if (wdev->sme_state != CFG80211_SME_CONNECTED)
-                return -ENOTCONN;
-
-        if (WARN(!wdev->current_bss, "sme_state=%d\n", wdev->sme_state))
+        if (!wdev->current_bss)
                 return -ENOTCONN;
 
-        memset(&req, 0, sizeof(req));
-        req.reason_code = reason;
-        req.local_state_change = local_state_change;
-        req.ie = ie;
-        req.ie_len = ie_len;
         if (ether_addr_equal(wdev->current_bss->pub.bssid, bssid))
                 req.bss = &wdev->current_bss->pub;
         else
                 return -ENOTCONN;
 
-        return rdev_disassoc(rdev, dev, &req);
-}
-
-int cfg80211_mlme_disassoc(struct cfg80211_registered_device *rdev,
-                           struct net_device *dev, const u8 *bssid,
-                           const u8 *ie, int ie_len, u16 reason,
-                           bool local_state_change)
-{
-        struct wireless_dev *wdev = dev->ieee80211_ptr;
-        int err;
-
-        wdev_lock(wdev);
-        err = __cfg80211_mlme_disassoc(rdev, dev, bssid, ie, ie_len, reason,
-                                       local_state_change);
-        wdev_unlock(wdev);
+        err = rdev_disassoc(rdev, dev, &req);
+        if (err)
+                return err;
 
-        return err;
+        /* driver should have reported the disassoc */
+        WARN_ON(wdev->current_bss);
+        return 0;
 }
 
 void cfg80211_mlme_down(struct cfg80211_registered_device *rdev,
                         struct net_device *dev)
 {
         struct wireless_dev *wdev = dev->ieee80211_ptr;
-        struct cfg80211_deauth_request req;
         u8 bssid[ETH_ALEN];
 
         ASSERT_WDEV_LOCK(wdev);
@@ -531,23 +389,12 @@ void cfg80211_mlme_down(struct cfg80211_registered_device *rdev,
         if (!rdev->ops->deauth)
                 return;
 
-        memset(&req, 0, sizeof(req));
-        req.reason_code = WLAN_REASON_DEAUTH_LEAVING;
-        req.ie = NULL;
-        req.ie_len = 0;
-
         if (!wdev->current_bss)
                 return;
 
         memcpy(bssid, wdev->current_bss->pub.bssid, ETH_ALEN);
-        req.bssid = bssid;
-        rdev_deauth(rdev, dev, &req);
-
-        if (wdev->current_bss) {
-                cfg80211_unhold_bss(wdev->current_bss);
-                cfg80211_put_bss(&rdev->wiphy, &wdev->current_bss->pub);
-                wdev->current_bss = NULL;
-        }
+        cfg80211_mlme_deauth(rdev, dev, bssid, NULL, 0,
+                             WLAN_REASON_DEAUTH_LEAVING, false);
 }
 
 struct cfg80211_mgmt_registration {
@@ -774,7 +621,7 @@ int cfg80211_mlme_mgmt_tx(struct cfg80211_registered_device *rdev,
 }
 
 bool cfg80211_rx_mgmt(struct wireless_dev *wdev, int freq, int sig_mbm,
-                      const u8 *buf, size_t len, gfp_t gfp)
+                      const u8 *buf, size_t len, u32 flags, gfp_t gfp)
 {
         struct wiphy *wiphy = wdev->wiphy;
         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
@@ -817,7 +664,7 @@ bool cfg80211_rx_mgmt(struct wireless_dev *wdev, int freq, int sig_mbm,
                 /* Indicate the received Action frame to user space */
                 if (nl80211_send_mgmt(rdev, wdev, reg->nlportid,
                                       freq, sig_mbm,
-                                      buf, len, gfp))
+                                      buf, len, flags, gfp))
                         continue;
 
                 result = true;
@@ -848,7 +695,7 @@ void cfg80211_dfs_channels_update_work(struct work_struct *work)
                             dfs_update_channels_wk);
         wiphy = &rdev->wiphy;
 
-        mutex_lock(&cfg80211_mutex);
+        rtnl_lock();
         for (bandid = 0; bandid < IEEE80211_NUM_BANDS; bandid++) {
                 sband = wiphy->bands[bandid];
                 if (!sband)
@@ -881,7 +728,7 @@ void cfg80211_dfs_channels_update_work(struct work_struct *work)
                         check_again = true;
                 }
         }
-        mutex_unlock(&cfg80211_mutex);
+        rtnl_unlock();
 
         /* reschedule if there are other channels waiting to be cleared again */
         if (check_again)
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index d5aed3bb3945..af8d84a4a5b2 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -37,10 +37,10 @@ static void nl80211_post_doit(struct genl_ops *ops, struct sk_buff *skb,
 
 /* the netlink family */
 static struct genl_family nl80211_fam = {
-        .id = GENL_ID_GENERATE, /* don't bother with a hardcoded ID */
-        .name = "nl80211",      /* have users key off the name instead */
-        .hdrsize = 0,           /* no private header */
-        .version = 1,           /* no particular meaning now */
+        .id = GENL_ID_GENERATE,         /* don't bother with a hardcoded ID */
+        .name = NL80211_GENL_NAME,      /* have users key off the name instead */
+        .hdrsize = 0,                   /* no private header */
+        .version = 1,                   /* no particular meaning now */
         .maxattr = NL80211_ATTR_MAX,
         .netnsok = true,
         .pre_doit = nl80211_pre_doit,
@@ -59,7 +59,7 @@ __cfg80211_wdev_from_attrs(struct net *netns, struct nlattr **attrs)
         int wiphy_idx = -1;
         int ifidx = -1;
 
-        assert_cfg80211_lock();
+        ASSERT_RTNL();
 
         if (!have_ifidx && !have_wdev_id)
                 return ERR_PTR(-EINVAL);
@@ -80,7 +80,6 @@ __cfg80211_wdev_from_attrs(struct net *netns, struct nlattr **attrs)
                 if (have_wdev_id && rdev->wiphy_idx != wiphy_idx)
                         continue;
 
-                mutex_lock(&rdev->devlist_mtx);
                 list_for_each_entry(wdev, &rdev->wdev_list, list) {
                         if (have_ifidx && wdev->netdev &&
                             wdev->netdev->ifindex == ifidx) {
@@ -92,7 +91,6 @@ __cfg80211_wdev_from_attrs(struct net *netns, struct nlattr **attrs)
                                 break;
                         }
                 }
-                mutex_unlock(&rdev->devlist_mtx);
 
                 if (result)
                         break;
@@ -109,7 +107,7 @@ __cfg80211_rdev_from_attrs(struct net *netns, struct nlattr **attrs)
         struct cfg80211_registered_device *rdev = NULL, *tmp;
         struct net_device *netdev;
 
-        assert_cfg80211_lock();
+        ASSERT_RTNL();
 
         if (!attrs[NL80211_ATTR_WIPHY] &&
             !attrs[NL80211_ATTR_IFINDEX] &&
@@ -128,14 +126,12 @@ __cfg80211_rdev_from_attrs(struct net *netns, struct nlattr **attrs)
                 tmp = cfg80211_rdev_by_wiphy_idx(wdev_id >> 32);
                 if (tmp) {
                         /* make sure wdev exists */
-                        mutex_lock(&tmp->devlist_mtx);
                         list_for_each_entry(wdev, &tmp->wdev_list, list) {
                                 if (wdev->identifier != (u32)wdev_id)
                                         continue;
                                 found = true;
                                 break;
                         }
-                        mutex_unlock(&tmp->devlist_mtx);
 
                         if (!found)
                                 tmp = NULL;
@@ -182,19 +178,6 @@ __cfg80211_rdev_from_attrs(struct net *netns, struct nlattr **attrs)
 /*
  * This function returns a pointer to the driver
  * that the genl_info item that is passed refers to.
- * If successful, it returns non-NULL and also locks
- * the driver's mutex!
- *
- * This means that you need to call cfg80211_unlock_rdev()
- * before being allowed to acquire &cfg80211_mutex!
- *
- * This is necessary because we need to lock the global
- * mutex to get an item off the list safely, and then
- * we lock the rdev mutex so it doesn't go away under us.
- *
- * We don't want to keep cfg80211_mutex locked
- * for all the time in order to allow requests on
- * other interfaces to go through at the same time.
  *
  * The result of this can be a PTR_ERR and hence must
  * be checked with IS_ERR() for errors.
@@ -202,20 +185,7 @@ __cfg80211_rdev_from_attrs(struct net *netns, struct nlattr **attrs)
 static struct cfg80211_registered_device *
 cfg80211_get_dev_from_info(struct net *netns, struct genl_info *info)
 {
-        struct cfg80211_registered_device *rdev;
-
-        mutex_lock(&cfg80211_mutex);
-        rdev = __cfg80211_rdev_from_attrs(netns, info->attrs);
-
-        /* if it is not an error we grab the lock on
-         * it to assure it won't be going away while
-         * we operate on it */
-        if (!IS_ERR(rdev))
-                mutex_lock(&rdev->mtx);
-
-        mutex_unlock(&cfg80211_mutex);
-
-        return rdev;
+        return __cfg80211_rdev_from_attrs(netns, info->attrs);
 }
 
 /* policy for the attributes */
@@ -378,6 +348,12 @@ static const struct nla_policy nl80211_policy[NL80211_ATTR_MAX+1] = {
         [NL80211_ATTR_MDID] = { .type = NLA_U16 },
         [NL80211_ATTR_IE_RIC] = { .type = NLA_BINARY,
                                   .len = IEEE80211_MAX_DATA_LEN },
+        [NL80211_ATTR_PEER_AID] = { .type = NLA_U16 },
+        [NL80211_ATTR_CH_SWITCH_COUNT] = { .type = NLA_U32 },
+        [NL80211_ATTR_CH_SWITCH_BLOCK_TX] = { .type = NLA_FLAG },
+        [NL80211_ATTR_CSA_IES] = { .type = NLA_NESTED },
+        [NL80211_ATTR_CSA_C_OFF_BEACON] = { .type = NLA_U16 },
+        [NL80211_ATTR_CSA_C_OFF_PRESP] = { .type = NLA_U16 },
 };
 
 /* policy for the key attributes */
@@ -432,6 +408,14 @@ nl80211_wowlan_tcp_policy[NUM_NL80211_WOWLAN_TCP] = {
         [NL80211_WOWLAN_TCP_WAKE_MASK] = { .len = 1 },
 };
 
+/* policy for coalesce rule attributes */
+static const struct nla_policy
+nl80211_coalesce_policy[NUM_NL80211_ATTR_COALESCE_RULE] = {
+        [NL80211_ATTR_COALESCE_RULE_DELAY] = { .type = NLA_U32 },
+        [NL80211_ATTR_COALESCE_RULE_CONDITION] = { .type = NLA_U32 },
+        [NL80211_ATTR_COALESCE_RULE_PKT_PATTERN] = { .type = NLA_NESTED },
+};
+
 /* policy for GTK rekey offload attributes */
 static const struct nla_policy
 nl80211_rekey_policy[NUM_NL80211_REKEY_DATA] = {
@@ -455,7 +439,6 @@ static int nl80211_prepare_wdev_dump(struct sk_buff *skb,
         int err;
 
         rtnl_lock();
-        mutex_lock(&cfg80211_mutex);
 
         if (!cb->args[0]) {
                 err = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
@@ -471,10 +454,12 @@ static int nl80211_prepare_wdev_dump(struct sk_buff *skb,
                         goto out_unlock;
                 }
                 *rdev = wiphy_to_dev((*wdev)->wiphy);
-                cb->args[0] = (*rdev)->wiphy_idx;
+                /* 0 is the first index - add 1 to parse only once */
+                cb->args[0] = (*rdev)->wiphy_idx + 1;
                 cb->args[1] = (*wdev)->identifier;
         } else {
-                struct wiphy *wiphy = wiphy_idx_to_wiphy(cb->args[0]);
+                /* subtract the 1 again here */
+                struct wiphy *wiphy = wiphy_idx_to_wiphy(cb->args[0] - 1);
                 struct wireless_dev *tmp;
 
                 if (!wiphy) {
@@ -484,14 +469,12 @@ static int nl80211_prepare_wdev_dump(struct sk_buff *skb,
                 *rdev = wiphy_to_dev(wiphy);
                 *wdev = NULL;
 
-                mutex_lock(&(*rdev)->devlist_mtx);
                 list_for_each_entry(tmp, &(*rdev)->wdev_list, list) {
                         if (tmp->identifier == cb->args[1]) {
                                 *wdev = tmp;
                                 break;
                         }
                 }
-                mutex_unlock(&(*rdev)->devlist_mtx);
 
                 if (!*wdev) {
                         err = -ENODEV;
@@ -499,19 +482,14 @@ static int nl80211_prepare_wdev_dump(struct sk_buff *skb,
                 }
         }
 
-        cfg80211_lock_rdev(*rdev);
-
-        mutex_unlock(&cfg80211_mutex);
         return 0;
  out_unlock:
-        mutex_unlock(&cfg80211_mutex);
         rtnl_unlock();
         return err;
 }
 
 static void nl80211_finish_wdev_dump(struct cfg80211_registered_device *rdev)
 {
-        cfg80211_unlock_rdev(rdev);
         rtnl_unlock();
 }
 
@@ -837,12 +815,9 @@ static int nl80211_key_allowed(struct wireless_dev *wdev)
         case NL80211_IFTYPE_MESH_POINT:
                 break;
         case NL80211_IFTYPE_ADHOC:
-                if (!wdev->current_bss)
-                        return -ENOLINK;
-                break;
         case NL80211_IFTYPE_STATION:
         case NL80211_IFTYPE_P2P_CLIENT:
-                if (wdev->sme_state != CFG80211_SME_CONNECTED)
+                if (!wdev->current_bss)
                         return -ENOLINK;
                 break;
         default:
@@ -945,7 +920,7 @@ nla_put_failure:
 static int nl80211_send_wowlan_tcp_caps(struct cfg80211_registered_device *rdev,
                                         struct sk_buff *msg)
 {
-        const struct wiphy_wowlan_tcp_support *tcp = rdev->wiphy.wowlan.tcp;
+        const struct wiphy_wowlan_tcp_support *tcp = rdev->wiphy.wowlan->tcp;
         struct nlattr *nl_tcp;
 
         if (!tcp)
@@ -988,37 +963,37 @@ static int nl80211_send_wowlan(struct sk_buff *msg,
 {
         struct nlattr *nl_wowlan;
 
-        if (!dev->wiphy.wowlan.flags && !dev->wiphy.wowlan.n_patterns)
+        if (!dev->wiphy.wowlan)
                 return 0;
 
         nl_wowlan = nla_nest_start(msg, NL80211_ATTR_WOWLAN_TRIGGERS_SUPPORTED);
         if (!nl_wowlan)
                 return -ENOBUFS;
 
-        if (((dev->wiphy.wowlan.flags & WIPHY_WOWLAN_ANY) &&
+        if (((dev->wiphy.wowlan->flags & WIPHY_WOWLAN_ANY) &&
              nla_put_flag(msg, NL80211_WOWLAN_TRIG_ANY)) ||
-            ((dev->wiphy.wowlan.flags & WIPHY_WOWLAN_DISCONNECT) &&
+            ((dev->wiphy.wowlan->flags & WIPHY_WOWLAN_DISCONNECT) &&
              nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT)) ||
-            ((dev->wiphy.wowlan.flags & WIPHY_WOWLAN_MAGIC_PKT) &&
+            ((dev->wiphy.wowlan->flags & WIPHY_WOWLAN_MAGIC_PKT) &&
              nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT)) ||
-            ((dev->wiphy.wowlan.flags & WIPHY_WOWLAN_SUPPORTS_GTK_REKEY) &&
+            ((dev->wiphy.wowlan->flags & WIPHY_WOWLAN_SUPPORTS_GTK_REKEY) &&
              nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_SUPPORTED)) ||
-            ((dev->wiphy.wowlan.flags & WIPHY_WOWLAN_GTK_REKEY_FAILURE) &&
+            ((dev->wiphy.wowlan->flags & WIPHY_WOWLAN_GTK_REKEY_FAILURE) &&
              nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE)) ||
-            ((dev->wiphy.wowlan.flags & WIPHY_WOWLAN_EAP_IDENTITY_REQ) &&
+            ((dev->wiphy.wowlan->flags & WIPHY_WOWLAN_EAP_IDENTITY_REQ) &&
              nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST)) ||
-            ((dev->wiphy.wowlan.flags & WIPHY_WOWLAN_4WAY_HANDSHAKE) &&
+            ((dev->wiphy.wowlan->flags & WIPHY_WOWLAN_4WAY_HANDSHAKE) &&
              nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE)) ||
-            ((dev->wiphy.wowlan.flags & WIPHY_WOWLAN_RFKILL_RELEASE) &&
+            ((dev->wiphy.wowlan->flags & WIPHY_WOWLAN_RFKILL_RELEASE) &&
              nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE)))
                 return -ENOBUFS;
 
-        if (dev->wiphy.wowlan.n_patterns) {
-                struct nl80211_wowlan_pattern_support pat = {
-                        .max_patterns = dev->wiphy.wowlan.n_patterns,
-                        .min_pattern_len = dev->wiphy.wowlan.pattern_min_len,
-                        .max_pattern_len = dev->wiphy.wowlan.pattern_max_len,
-                        .max_pkt_offset = dev->wiphy.wowlan.max_pkt_offset,
+        if (dev->wiphy.wowlan->n_patterns) {
+                struct nl80211_pattern_support pat = {
+                        .max_patterns = dev->wiphy.wowlan->n_patterns,
+                        .min_pattern_len = dev->wiphy.wowlan->pattern_min_len,
+                        .max_pattern_len = dev->wiphy.wowlan->pattern_max_len,
+                        .max_pkt_offset = dev->wiphy.wowlan->max_pkt_offset,
                 };
 
                 if (nla_put(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN,
@@ -1035,6 +1010,27 @@ static int nl80211_send_wowlan(struct sk_buff *msg,
 }
 #endif
 
+static int nl80211_send_coalesce(struct sk_buff *msg,
+                                 struct cfg80211_registered_device *dev)
+{
+        struct nl80211_coalesce_rule_support rule;
+
+        if (!dev->wiphy.coalesce)
+                return 0;
+
+        rule.max_rules = dev->wiphy.coalesce->n_rules;
+        rule.max_delay = dev->wiphy.coalesce->max_delay;
+        rule.pat.max_patterns = dev->wiphy.coalesce->n_patterns;
+        rule.pat.min_pattern_len = dev->wiphy.coalesce->pattern_min_len;
+        rule.pat.max_pattern_len = dev->wiphy.coalesce->pattern_max_len;
+        rule.pat.max_pkt_offset = dev->wiphy.coalesce->max_pkt_offset;
+
+        if (nla_put(msg, NL80211_ATTR_COALESCE_RULE, sizeof(rule), &rule))
+                return -ENOBUFS;
+
+        return 0;
+}
+
 static int nl80211_send_band_rateinfo(struct sk_buff *msg,
                                       struct ieee80211_supported_band *sband)
 {
@@ -1151,10 +1147,16 @@ nl80211_send_mgmt_stypes(struct sk_buff *msg,
         return 0;
 }
 
+struct nl80211_dump_wiphy_state {
+        s64 filter_wiphy;
+        long start;
+        long split_start, band_start, chan_start;
+        bool split;
+};
+
 static int nl80211_send_wiphy(struct cfg80211_registered_device *dev,
                               struct sk_buff *msg, u32 portid, u32 seq,
-                              int flags, bool split, long *split_start,
-                              long *band_start, long *chan_start)
+                              int flags, struct nl80211_dump_wiphy_state *state)
 {
         void *hdr;
         struct nlattr *nl_bands, *nl_band;
@@ -1165,19 +1167,14 @@ static int nl80211_send_wiphy(struct cfg80211_registered_device *dev,
         int i;
         const struct ieee80211_txrx_stypes *mgmt_stypes =
                                 dev->wiphy.mgmt_stypes;
-        long start = 0, start_chan = 0, start_band = 0;
         u32 features;
 
         hdr = nl80211hdr_put(msg, portid, seq, flags, NL80211_CMD_NEW_WIPHY);
         if (!hdr)
                 return -ENOBUFS;
 
-        /* allow always using the variables */
-        if (!split) {
-                split_start = &start;
-                band_start = &start_band;
-                chan_start = &start_chan;
-        }
+        if (WARN_ON(!state))
+                return -EINVAL;
 
         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, dev->wiphy_idx) ||
             nla_put_string(msg, NL80211_ATTR_WIPHY_NAME,
@@ -1186,7 +1183,7 @@ static int nl80211_send_wiphy(struct cfg80211_registered_device *dev,
                         cfg80211_rdev_list_generation))
                 goto nla_put_failure;
 
-        switch (*split_start) {
+        switch (state->split_start) {
         case 0:
                 if (nla_put_u8(msg, NL80211_ATTR_WIPHY_RETRY_SHORT,
                                dev->wiphy.retry_short) ||
@@ -1228,9 +1225,12 @@ static int nl80211_send_wiphy(struct cfg80211_registered_device *dev,
                 if ((dev->wiphy.flags & WIPHY_FLAG_TDLS_EXTERNAL_SETUP) &&
                     nla_put_flag(msg, NL80211_ATTR_TDLS_EXTERNAL_SETUP))
                         goto nla_put_failure;
+                if ((dev->wiphy.flags & WIPHY_FLAG_SUPPORTS_5_10_MHZ) &&
+                    nla_put_flag(msg, WIPHY_FLAG_SUPPORTS_5_10_MHZ))
+                        goto nla_put_failure;
 
-                (*split_start)++;
-                if (split)
+                state->split_start++;
+                if (state->split)
                         break;
         case 1:
                 if (nla_put(msg, NL80211_ATTR_CIPHER_SUITES,
@@ -1274,22 +1274,23 @@ static int nl80211_send_wiphy(struct cfg80211_registered_device *dev,
                         }
                 }
 
-                (*split_start)++;
-                if (split)
+                state->split_start++;
+                if (state->split)
                         break;
         case 2:
                 if (nl80211_put_iftypes(msg, NL80211_ATTR_SUPPORTED_IFTYPES,
                                         dev->wiphy.interface_modes))
                                 goto nla_put_failure;
-                (*split_start)++;
-                if (split)
+                state->split_start++;
+                if (state->split)
                         break;
         case 3:
                 nl_bands = nla_nest_start(msg, NL80211_ATTR_WIPHY_BANDS);
                 if (!nl_bands)
                         goto nla_put_failure;
 
-                for (band = *band_start; band < IEEE80211_NUM_BANDS; band++) {
+                for (band = state->band_start;
+                     band < IEEE80211_NUM_BANDS; band++) {
                         struct ieee80211_supported_band *sband;
 
                         sband = dev->wiphy.bands[band];
@@ -1301,12 +1302,12 @@ static int nl80211_send_wiphy(struct cfg80211_registered_device *dev,
                         if (!nl_band)
                                 goto nla_put_failure;
 
-                        switch (*chan_start) {
+                        switch (state->chan_start) {
                         case 0:
                                 if (nl80211_send_band_rateinfo(msg, sband))
                                         goto nla_put_failure;
-                                (*chan_start)++;
-                                if (split)
+                                state->chan_start++;
+                                if (state->split)
                                         break;
                         default:
                                 /* add frequencies */
@@ -1315,7 +1316,7 @@ static int nl80211_send_wiphy(struct cfg80211_registered_device *dev,
                                 if (!nl_freqs)
                                         goto nla_put_failure;
 
-                                for (i = *chan_start - 1;
+                                for (i = state->chan_start - 1;
                                      i < sband->n_channels;
                                      i++) {
                                         nl_freq = nla_nest_start(msg, i);
@@ -1324,26 +1325,27 @@ static int nl80211_send_wiphy(struct cfg80211_registered_device *dev,
 
                                         chan = &sband->channels[i];
 
-                                        if (nl80211_msg_put_channel(msg, chan,
-                                                                    split))
+                                        if (nl80211_msg_put_channel(
+                                                        msg, chan,
+                                                        state->split))
                                                 goto nla_put_failure;
 
                                         nla_nest_end(msg, nl_freq);
-                                        if (split)
+                                        if (state->split)
                                                 break;
                                 }
                                 if (i < sband->n_channels)
-                                        *chan_start = i + 2;
+                                        state->chan_start = i + 2;
                                 else
-                                        *chan_start = 0;
+                                        state->chan_start = 0;
                                 nla_nest_end(msg, nl_freqs);
                         }
 
                         nla_nest_end(msg, nl_band);
 
-                        if (split) {
+                        if (state->split) {
                                 /* start again here */
-                                if (*chan_start)
+                                if (state->chan_start)
                                         band--;
                                 break;
                         }
@@ -1351,14 +1353,14 @@ static int nl80211_send_wiphy(struct cfg80211_registered_device *dev,
                 nla_nest_end(msg, nl_bands);
 
                 if (band < IEEE80211_NUM_BANDS)
-                        *band_start = band + 1;
+                        state->band_start = band + 1;
                 else
-                        *band_start = 0;
+                        state->band_start = 0;
 
                 /* if bands & channels are done, continue outside */
-                if (*band_start == 0 && *chan_start == 0)
-                        (*split_start)++;
-                if (split)
+                if (state->band_start == 0 && state->chan_start == 0)
+                        state->split_start++;
+                if (state->split)
                         break;
         case 4:
                 nl_cmds = nla_nest_start(msg, NL80211_ATTR_SUPPORTED_COMMANDS);
@@ -1424,9 +1426,11 @@ static int nl80211_send_wiphy(struct cfg80211_registered_device *dev,
                 }
                 CMD(start_p2p_device, START_P2P_DEVICE);
                 CMD(set_mcast_rate, SET_MCAST_RATE);
-                if (split) {
+                if (state->split) {
                         CMD(crit_proto_start, CRIT_PROTOCOL_START);
                         CMD(crit_proto_stop, CRIT_PROTOCOL_STOP);
+                        if (dev->wiphy.flags & WIPHY_FLAG_HAS_CHANNEL_SWITCH)
+                                CMD(channel_switch, CHANNEL_SWITCH);
                 }
 
 #ifdef CONFIG_NL80211_TESTMODE
@@ -1448,8 +1452,8 @@ static int nl80211_send_wiphy(struct cfg80211_registered_device *dev,
                 }
 
                 nla_nest_end(msg, nl_cmds);
-                (*split_start)++;
-                if (split)
+                state->split_start++;
+                if (state->split)
                         break;
         case 5:
                 if (dev->ops->remain_on_channel &&
@@ -1465,29 +1469,30 @@ static int nl80211_send_wiphy(struct cfg80211_registered_device *dev,
 
                 if (nl80211_send_mgmt_stypes(msg, mgmt_stypes))
                         goto nla_put_failure;
-                (*split_start)++;
-                if (split)
+                state->split_start++;
+                if (state->split)
                         break;
         case 6:
 #ifdef CONFIG_PM
-                if (nl80211_send_wowlan(msg, dev, split))
+                if (nl80211_send_wowlan(msg, dev, state->split))
                         goto nla_put_failure;
-                (*split_start)++;
-                if (split)
+                state->split_start++;
+                if (state->split)
                         break;
 #else
-                (*split_start)++;
+                state->split_start++;
 #endif
         case 7:
                 if (nl80211_put_iftypes(msg, NL80211_ATTR_SOFTWARE_IFTYPES,
                                         dev->wiphy.software_iftypes))
                         goto nla_put_failure;
 
-                if (nl80211_put_iface_combinations(&dev->wiphy, msg, split))
+                if (nl80211_put_iface_combinations(&dev->wiphy, msg,
+                                                   state->split))
                         goto nla_put_failure;
 
-                (*split_start)++;
-                if (split)
+                state->split_start++;
+                if (state->split)
                         break;
         case 8:
                 if ((dev->wiphy.flags & WIPHY_FLAG_HAVE_AP_SME) &&
@@ -1501,7 +1506,7 @@ static int nl80211_send_wiphy(struct cfg80211_registered_device *dev,
                  * dump is split, otherwise it makes it too big. Therefore
                  * only advertise it in that case.
                  */
-                if (split)
+                if (state->split)
                         features |= NL80211_FEATURE_ADVERTISE_CHAN_LIMITS;
                 if (nla_put_u32(msg, NL80211_ATTR_FEATURE_FLAGS, features))
                         goto nla_put_failure;
@@ -1528,7 +1533,7 @@ static int nl80211_send_wiphy(struct cfg80211_registered_device *dev,
                  * case we'll continue with more data in the next round,
                  * but break unconditionally so unsplit data stops here.
                  */
-                (*split_start)++;
+                state->split_start++;
                 break;
         case 9:
                 if (dev->wiphy.extended_capabilities &&
@@ -1546,8 +1551,14 @@ static int nl80211_send_wiphy(struct cfg80211_registered_device *dev,
                             dev->wiphy.vht_capa_mod_mask))
                         goto nla_put_failure;
 
+                state->split_start++;
+                break;
+        case 10:
+                if (nl80211_send_coalesce(msg, dev))
+                        goto nla_put_failure;
+
                 /* done */
-                *split_start = 0;
+                state->split_start = 0;
                 break;
         }
         return genlmsg_end(msg, hdr);
@@ -1557,59 +1568,78 @@ static int nl80211_send_wiphy(struct cfg80211_registered_device *dev,
         return -EMSGSIZE;
 }
 
+static int nl80211_dump_wiphy_parse(struct sk_buff *skb,
+                                    struct netlink_callback *cb,
+                                    struct nl80211_dump_wiphy_state *state)
+{
+        struct nlattr **tb = nl80211_fam.attrbuf;
+        int ret = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
+                              tb, nl80211_fam.maxattr, nl80211_policy);
+        /* ignore parse errors for backward compatibility */
+        if (ret)
+                return 0;
+
+        state->split = tb[NL80211_ATTR_SPLIT_WIPHY_DUMP];
+        if (tb[NL80211_ATTR_WIPHY])
+                state->filter_wiphy = nla_get_u32(tb[NL80211_ATTR_WIPHY]);
+        if (tb[NL80211_ATTR_WDEV])
+                state->filter_wiphy = nla_get_u64(tb[NL80211_ATTR_WDEV]) >> 32;
+        if (tb[NL80211_ATTR_IFINDEX]) {
+                struct net_device *netdev;
+                struct cfg80211_registered_device *rdev;
+                int ifidx = nla_get_u32(tb[NL80211_ATTR_IFINDEX]);
+
+                netdev = dev_get_by_index(sock_net(skb->sk), ifidx);
+                if (!netdev)
+                        return -ENODEV;
+                if (netdev->ieee80211_ptr) {
+                        rdev = wiphy_to_dev(
+                                netdev->ieee80211_ptr->wiphy);
+                        state->filter_wiphy = rdev->wiphy_idx;
+                }
+                dev_put(netdev);
+        }
+
+        return 0;
+}
+
 static int nl80211_dump_wiphy(struct sk_buff *skb, struct netlink_callback *cb)
 {
         int idx = 0, ret;
-        int start = cb->args[0];
+        struct nl80211_dump_wiphy_state *state = (void *)cb->args[0];
         struct cfg80211_registered_device *dev;
-        s64 filter_wiphy = -1;
-        bool split = false;
-        struct nlattr **tb = nl80211_fam.attrbuf;
-        int res;
 
-        mutex_lock(&cfg80211_mutex);
-        res = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
-                          tb, nl80211_fam.maxattr, nl80211_policy);
-        if (res == 0) {
-                split = tb[NL80211_ATTR_SPLIT_WIPHY_DUMP];
-                if (tb[NL80211_ATTR_WIPHY])
-                        filter_wiphy = nla_get_u32(tb[NL80211_ATTR_WIPHY]);
-                if (tb[NL80211_ATTR_WDEV])
-                        filter_wiphy = nla_get_u64(tb[NL80211_ATTR_WDEV]) >> 32;
-                if (tb[NL80211_ATTR_IFINDEX]) {
-                        struct net_device *netdev;
-                        int ifidx = nla_get_u32(tb[NL80211_ATTR_IFINDEX]);
-
-                        netdev = dev_get_by_index(sock_net(skb->sk), ifidx);
-                        if (!netdev) {
-                                mutex_unlock(&cfg80211_mutex);
-                                return -ENODEV;
-                        }
-                        if (netdev->ieee80211_ptr) {
-                                dev = wiphy_to_dev(
-                                        netdev->ieee80211_ptr->wiphy);
-                                filter_wiphy = dev->wiphy_idx;
-                        }
-                        dev_put(netdev);
+        rtnl_lock();
+        if (!state) {
+                state = kzalloc(sizeof(*state), GFP_KERNEL);
+                if (!state) {
+                        rtnl_unlock();
+                        return -ENOMEM;
+                }
+                state->filter_wiphy = -1;
+                ret = nl80211_dump_wiphy_parse(skb, cb, state);
+                if (ret) {
+                        kfree(state);
+                        rtnl_unlock();
+                        return ret;
                 }
+                cb->args[0] = (long)state;
         }
 
         list_for_each_entry(dev, &cfg80211_rdev_list, list) {
                 if (!net_eq(wiphy_net(&dev->wiphy), sock_net(skb->sk)))
                         continue;
-                if (++idx <= start)
+                if (++idx <= state->start)
                         continue;
-                if (filter_wiphy != -1 && dev->wiphy_idx != filter_wiphy)
+                if (state->filter_wiphy != -1 &&
+                    state->filter_wiphy != dev->wiphy_idx)
                         continue;
                 /* attempt to fit multiple wiphy data chunks into the skb */
                 do {
                         ret = nl80211_send_wiphy(dev, skb,
                                                  NETLINK_CB(cb->skb).portid,
                                                  cb->nlh->nlmsg_seq,
-                                                 NLM_F_MULTI,
-                                                 split, &cb->args[1],
-                                                 &cb->args[2],
-                                                 &cb->args[3]);
+                                                 NLM_F_MULTI, state);
                         if (ret < 0) {
                                 /*
                                  * If sending the wiphy data didn't fit (ENOBUFS
@@ -1628,33 +1658,40 @@ static int nl80211_dump_wiphy(struct sk_buff *skb, struct netlink_callback *cb)
                                     !skb->len &&
                                     cb->min_dump_alloc < 4096) {
                                         cb->min_dump_alloc = 4096;
-                                        mutex_unlock(&cfg80211_mutex);
+                                        rtnl_unlock();
                                         return 1;
                                 }
                                 idx--;
                                 break;
                         }
-                } while (cb->args[1] > 0);
+                } while (state->split_start > 0);
                 break;
         }
-        mutex_unlock(&cfg80211_mutex);
+        rtnl_unlock();
 
-        cb->args[0] = idx;
+        state->start = idx;
 
         return skb->len;
 }
 
+static int nl80211_dump_wiphy_done(struct netlink_callback *cb)
+{
+        kfree((void *)cb->args[0]);
+        return 0;
+}
+
 static int nl80211_get_wiphy(struct sk_buff *skb, struct genl_info *info)
 {
         struct sk_buff *msg;
         struct cfg80211_registered_device *dev = info->user_ptr[0];
+        struct nl80211_dump_wiphy_state state = {};
 
         msg = nlmsg_new(4096, GFP_KERNEL);
         if (!msg)
                 return -ENOMEM;
 
         if (nl80211_send_wiphy(dev, msg, info->snd_portid, info->snd_seq, 0,
-                               false, NULL, NULL, NULL) < 0) {
+                               &state) < 0) {
                 nlmsg_free(msg);
                 return -ENOBUFS;
         }
@@ -1771,6 +1808,11 @@ static int nl80211_parse_chandef(struct cfg80211_registered_device *rdev,
                                      IEEE80211_CHAN_DISABLED))
                 return -EINVAL;
 
+        if ((chandef->width == NL80211_CHAN_WIDTH_5 ||
+             chandef->width == NL80211_CHAN_WIDTH_10) &&
+            !(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_5_10_MHZ))
+                return -EINVAL;
+
         return 0;
 }
 
@@ -1792,7 +1834,6 @@ static int __nl80211_set_channel(struct cfg80211_registered_device *rdev,
         if (result)
                 return result;
 
-        mutex_lock(&rdev->devlist_mtx);
         switch (iftype) {
         case NL80211_IFTYPE_AP:
         case NL80211_IFTYPE_P2P_GO:
@@ -1816,7 +1857,6 @@ static int __nl80211_set_channel(struct cfg80211_registered_device *rdev,
         default:
                 result = -EINVAL;
         }
-        mutex_unlock(&rdev->devlist_mtx);
 
         return result;
 }
@@ -1865,6 +1905,8 @@ static int nl80211_set_wiphy(struct sk_buff *skb, struct genl_info *info)
         u32 frag_threshold = 0, rts_threshold = 0;
         u8 coverage_class = 0;
 
+        ASSERT_RTNL();
+
         /*
          * Try to find the wiphy and netdev. Normally this
          * function shouldn't need the netdev, but this is
@@ -1874,31 +1916,25 @@ static int nl80211_set_wiphy(struct sk_buff *skb, struct genl_info *info)
          * also passed a netdev to set_wiphy, so that it is
          * possible to let that go to the right netdev!
          */
-        mutex_lock(&cfg80211_mutex);
 
         if (info->attrs[NL80211_ATTR_IFINDEX]) {
                 int ifindex = nla_get_u32(info->attrs[NL80211_ATTR_IFINDEX]);
 
                 netdev = dev_get_by_index(genl_info_net(info), ifindex);
-                if (netdev && netdev->ieee80211_ptr) {
+                if (netdev && netdev->ieee80211_ptr)
                         rdev = wiphy_to_dev(netdev->ieee80211_ptr->wiphy);
-                        mutex_lock(&rdev->mtx);
-                } else
+                else
                         netdev = NULL;
         }
 
         if (!netdev) {
                 rdev = __cfg80211_rdev_from_attrs(genl_info_net(info),
                                                   info->attrs);
-                if (IS_ERR(rdev)) {
-                        mutex_unlock(&cfg80211_mutex);
+                if (IS_ERR(rdev))
                         return PTR_ERR(rdev);
-                }
                 wdev = NULL;
                 netdev = NULL;
                 result = 0;
-
-                mutex_lock(&rdev->mtx);
         } else
                 wdev = netdev->ieee80211_ptr;
 
@@ -1911,8 +1947,6 @@ static int nl80211_set_wiphy(struct sk_buff *skb, struct genl_info *info)
                 result = cfg80211_dev_rename(
                         rdev, nla_data(info->attrs[NL80211_ATTR_WIPHY_NAME]));
 
-        mutex_unlock(&cfg80211_mutex);
-
         if (result)
                 goto bad_res;
 
@@ -2119,7 +2153,6 @@ static int nl80211_set_wiphy(struct sk_buff *skb, struct genl_info *info)
         }
 
  bad_res:
-        mutex_unlock(&rdev->mtx);
         if (netdev)
                 dev_put(netdev);
         return result;
@@ -2217,7 +2250,7 @@ static int nl80211_dump_interface(struct sk_buff *skb, struct netlink_callback *
         struct cfg80211_registered_device *rdev;
         struct wireless_dev *wdev;
 
-        mutex_lock(&cfg80211_mutex);
+        rtnl_lock();
         list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
                 if (!net_eq(wiphy_net(&rdev->wiphy), sock_net(skb->sk)))
                         continue;
@@ -2227,7 +2260,6 @@ static int nl80211_dump_interface(struct sk_buff *skb, struct netlink_callback *
                 }
                 if_idx = 0;
 
-                mutex_lock(&rdev->devlist_mtx);
                 list_for_each_entry(wdev, &rdev->wdev_list, list) {
                         if (if_idx < if_start) {
                                 if_idx++;
@@ -2236,17 +2268,15 @@ static int nl80211_dump_interface(struct sk_buff *skb, struct netlink_callback *
                         if (nl80211_send_iface(skb, NETLINK_CB(cb->skb).portid,
                                                cb->nlh->nlmsg_seq, NLM_F_MULTI,
                                                rdev, wdev) < 0) {
-                                mutex_unlock(&rdev->devlist_mtx);
                                 goto out;
                         }
                         if_idx++;
                 }
-                mutex_unlock(&rdev->devlist_mtx);
 
                 wp_idx++;
         }
  out:
-        mutex_unlock(&cfg80211_mutex);
+        rtnl_unlock();
 
         cb->args[0] = wp_idx;
         cb->args[1] = if_idx;
@@ -2279,6 +2309,7 @@ static const struct nla_policy mntr_flags_policy[NL80211_MNTR_FLAG_MAX + 1] = {
         [NL80211_MNTR_FLAG_CONTROL] = { .type = NLA_FLAG },
         [NL80211_MNTR_FLAG_OTHER_BSS] = { .type = NLA_FLAG },
         [NL80211_MNTR_FLAG_COOK_FRAMES] = { .type = NLA_FLAG },
+        [NL80211_MNTR_FLAG_ACTIVE] = { .type = NLA_FLAG },
 };
 
 static int parse_monitor_flags(struct nlattr *nla, u32 *mntrflags)
@@ -2390,6 +2421,10 @@ static int nl80211_set_interface(struct sk_buff *skb, struct genl_info *info)
                 change = true;
         }
 
+        if (flags && (*flags & NL80211_MNTR_FLAG_ACTIVE) &&
+            !(rdev->wiphy.features & NL80211_FEATURE_ACTIVE_MONITOR))
+                return -EOPNOTSUPP;
+
         if (change)
                 err = cfg80211_change_iface(rdev, dev, ntype, flags, &params);
         else
@@ -2447,6 +2482,11 @@ static int nl80211_new_interface(struct sk_buff *skb, struct genl_info *info)
         err = parse_monitor_flags(type == NL80211_IFTYPE_MONITOR ?
                                   info->attrs[NL80211_ATTR_MNTR_FLAGS] : NULL,
                                   &flags);
+
+        if (!err && (flags & NL80211_MNTR_FLAG_ACTIVE) &&
+            !(rdev->wiphy.features & NL80211_FEATURE_ACTIVE_MONITOR))
+                return -EOPNOTSUPP;
+
         wdev = rdev_add_virtual_intf(rdev,
                                 nla_data(info->attrs[NL80211_ATTR_IFNAME]),
                                 type, err ? NULL : &flags, &params);
@@ -2479,11 +2519,9 @@ static int nl80211_new_interface(struct sk_buff *skb, struct genl_info *info)
                 INIT_LIST_HEAD(&wdev->mgmt_registrations);
                 spin_lock_init(&wdev->mgmt_registrations_lock);
 
-                mutex_lock(&rdev->devlist_mtx);
                 wdev->identifier = ++rdev->wdev_id;
                 list_add_rcu(&wdev->list, &rdev->wdev_list);
                 rdev->devlist_generation++;
-                mutex_unlock(&rdev->devlist_mtx);
                 break;
         default:
                 break;
@@ -2626,8 +2664,8 @@ static int nl80211_get_key(struct sk_buff *skb, struct genl_info *info)
 
         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
                              NL80211_CMD_NEW_KEY);
-        if (IS_ERR(hdr))
-                return PTR_ERR(hdr);
+        if (!hdr)
+                return -ENOBUFS;
 
         cookie.msg = msg;
         cookie.idx = key_idx;
@@ -2926,61 +2964,58 @@ static int nl80211_set_mac_acl(struct sk_buff *skb, struct genl_info *info)
         return err;
 }
 
-static int nl80211_parse_beacon(struct genl_info *info,
+static int nl80211_parse_beacon(struct nlattr *attrs[],
                                 struct cfg80211_beacon_data *bcn)
 {
         bool haveinfo = false;
 
-        if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_BEACON_TAIL]) ||
-            !is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]) ||
-            !is_valid_ie_attr(info->attrs[NL80211_ATTR_IE_PROBE_RESP]) ||
-            !is_valid_ie_attr(info->attrs[NL80211_ATTR_IE_ASSOC_RESP]))
+        if (!is_valid_ie_attr(attrs[NL80211_ATTR_BEACON_TAIL]) ||
+            !is_valid_ie_attr(attrs[NL80211_ATTR_IE]) ||
+            !is_valid_ie_attr(attrs[NL80211_ATTR_IE_PROBE_RESP]) ||
+            !is_valid_ie_attr(attrs[NL80211_ATTR_IE_ASSOC_RESP]))
                 return -EINVAL;
 
         memset(bcn, 0, sizeof(*bcn));
 
-        if (info->attrs[NL80211_ATTR_BEACON_HEAD]) {
-                bcn->head = nla_data(info->attrs[NL80211_ATTR_BEACON_HEAD]);
-                bcn->head_len = nla_len(info->attrs[NL80211_ATTR_BEACON_HEAD]);
+        if (attrs[NL80211_ATTR_BEACON_HEAD]) {
+                bcn->head = nla_data(attrs[NL80211_ATTR_BEACON_HEAD]);
+                bcn->head_len = nla_len(attrs[NL80211_ATTR_BEACON_HEAD]);
                 if (!bcn->head_len)
                         return -EINVAL;
                 haveinfo = true;
         }
 
-        if (info->attrs[NL80211_ATTR_BEACON_TAIL]) {
-                bcn->tail = nla_data(info->attrs[NL80211_ATTR_BEACON_TAIL]);
-                bcn->tail_len =
-                    nla_len(info->attrs[NL80211_ATTR_BEACON_TAIL]);
+        if (attrs[NL80211_ATTR_BEACON_TAIL]) {
+                bcn->tail = nla_data(attrs[NL80211_ATTR_BEACON_TAIL]);
+                bcn->tail_len = nla_len(attrs[NL80211_ATTR_BEACON_TAIL]);
                 haveinfo = true;
         }
 
         if (!haveinfo)
                 return -EINVAL;
 
-        if (info->attrs[NL80211_ATTR_IE]) {
-                bcn->beacon_ies = nla_data(info->attrs[NL80211_ATTR_IE]);
-                bcn->beacon_ies_len = nla_len(info->attrs[NL80211_ATTR_IE]);
+        if (attrs[NL80211_ATTR_IE]) {
+                bcn->beacon_ies = nla_data(attrs[NL80211_ATTR_IE]);
+                bcn->beacon_ies_len = nla_len(attrs[NL80211_ATTR_IE]);
         }
 
-        if (info->attrs[NL80211_ATTR_IE_PROBE_RESP]) {
+        if (attrs[NL80211_ATTR_IE_PROBE_RESP]) {
                 bcn->proberesp_ies =
-                        nla_data(info->attrs[NL80211_ATTR_IE_PROBE_RESP]);
+                        nla_data(attrs[NL80211_ATTR_IE_PROBE_RESP]);
                 bcn->proberesp_ies_len =
-                        nla_len(info->attrs[NL80211_ATTR_IE_PROBE_RESP]);
+                        nla_len(attrs[NL80211_ATTR_IE_PROBE_RESP]);
         }
 
-        if (info->attrs[NL80211_ATTR_IE_ASSOC_RESP]) {
+        if (attrs[NL80211_ATTR_IE_ASSOC_RESP]) {
                 bcn->assocresp_ies =
-                        nla_data(info->attrs[NL80211_ATTR_IE_ASSOC_RESP]);
+                        nla_data(attrs[NL80211_ATTR_IE_ASSOC_RESP]);
                 bcn->assocresp_ies_len =
-                        nla_len(info->attrs[NL80211_ATTR_IE_ASSOC_RESP]);
+                        nla_len(attrs[NL80211_ATTR_IE_ASSOC_RESP]);
         }
 
-        if (info->attrs[NL80211_ATTR_PROBE_RESP]) {
-                bcn->probe_resp =
-                        nla_data(info->attrs[NL80211_ATTR_PROBE_RESP]);
-                bcn->probe_resp_len =
-                        nla_len(info->attrs[NL80211_ATTR_PROBE_RESP]);
+        if (attrs[NL80211_ATTR_PROBE_RESP]) {
+                bcn->probe_resp = nla_data(attrs[NL80211_ATTR_PROBE_RESP]);
+                bcn->probe_resp_len = nla_len(attrs[NL80211_ATTR_PROBE_RESP]);
         }
 
         return 0;
@@ -2992,8 +3027,6 @@ static bool nl80211_get_ap_channel(struct cfg80211_registered_device *rdev,
         struct wireless_dev *wdev;
         bool ret = false;
 
-        mutex_lock(&rdev->devlist_mtx);
-
         list_for_each_entry(wdev, &rdev->wdev_list, list) {
                 if (wdev->iftype != NL80211_IFTYPE_AP &&
                     wdev->iftype != NL80211_IFTYPE_P2P_GO)
@@ -3007,8 +3040,6 @@ static bool nl80211_get_ap_channel(struct cfg80211_registered_device *rdev,
                 break;
         }
 
-        mutex_unlock(&rdev->devlist_mtx);
-
         return ret;
 }
 
@@ -3063,7 +3094,7 @@ static int nl80211_start_ap(struct sk_buff *skb, struct genl_info *info)
             !info->attrs[NL80211_ATTR_BEACON_HEAD])
                 return -EINVAL;
 
-        err = nl80211_parse_beacon(info, &params.beacon);
+        err = nl80211_parse_beacon(info->attrs, &params.beacon);
         if (err)
                 return err;
 
@@ -3170,13 +3201,10 @@ static int nl80211_start_ap(struct sk_buff *skb, struct genl_info *info)
                 params.radar_required = true;
         }
 
-        mutex_lock(&rdev->devlist_mtx);
         err = cfg80211_can_use_iftype_chan(rdev, wdev, wdev->iftype,
                                            params.chandef.chan,
                                            CHAN_MODE_SHARED,
                                            radar_detect_width);
-        mutex_unlock(&rdev->devlist_mtx);
-
         if (err)
                 return err;
 
@@ -3218,7 +3246,7 @@ static int nl80211_set_beacon(struct sk_buff *skb, struct genl_info *info)
         if (!wdev->beacon_interval)
                 return -EINVAL;
 
-        err = nl80211_parse_beacon(info, &params);
+        err = nl80211_parse_beacon(info->attrs, &params);
         if (err)
                 return err;
 
@@ -3376,6 +3404,32 @@ static bool nl80211_put_sta_rate(struct sk_buff *msg, struct rate_info *info,
         return true;
 }
 
+static bool nl80211_put_signal(struct sk_buff *msg, u8 mask, s8 *signal,
+                               int id)
+{
+        void *attr;
+        int i = 0;
+
+        if (!mask)
+                return true;
+
+        attr = nla_nest_start(msg, id);
+        if (!attr)
+                return false;
+
+        for (i = 0; i < IEEE80211_MAX_CHAINS; i++) {
+                if (!(mask & BIT(i)))
+                        continue;
+
+                if (nla_put_u8(msg, i, signal[i]))
+                        return false;
+        }
+
+        nla_nest_end(msg, attr);
+
+        return true;
+}
+
 static int nl80211_send_station(struct sk_buff *msg, u32 portid, u32 seq,
                                 int flags,
                                 struct cfg80211_registered_device *rdev,
@@ -3447,6 +3501,18 @@ static int nl80211_send_station(struct sk_buff *msg, u32 portid, u32 seq,
         default:
                 break;
         }
+        if (sinfo->filled & STATION_INFO_CHAIN_SIGNAL) {
+                if (!nl80211_put_signal(msg, sinfo->chains,
+                                        sinfo->chain_signal,
+                                        NL80211_STA_INFO_CHAIN_SIGNAL))
+                        goto nla_put_failure;
+        }
+        if (sinfo->filled & STATION_INFO_CHAIN_SIGNAL_AVG) {
+                if (!nl80211_put_signal(msg, sinfo->chains,
+                                        sinfo->chain_signal_avg,
+                                        NL80211_STA_INFO_CHAIN_SIGNAL_AVG))
+                        goto nla_put_failure;
+        }
         if (sinfo->filled & STATION_INFO_TX_BITRATE) {
                 if (!nl80211_put_sta_rate(msg, &sinfo->txrate,
                                           NL80211_STA_INFO_TX_BITRATE))
@@ -3834,6 +3900,8 @@ static int nl80211_set_station_tdls(struct genl_info *info,
                                     struct station_parameters *params)
 {
         /* Dummy STA entry gets updated once the peer capabilities are known */
+        if (info->attrs[NL80211_ATTR_PEER_AID])
+                params->aid = nla_get_u16(info->attrs[NL80211_ATTR_PEER_AID]);
         if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
                 params->ht_capa =
                         nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
@@ -3974,7 +4042,8 @@ static int nl80211_new_station(struct sk_buff *skb, struct genl_info *info)
         if (!info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES])
                 return -EINVAL;
 
-        if (!info->attrs[NL80211_ATTR_STA_AID])
+        if (!info->attrs[NL80211_ATTR_STA_AID] &&
+            !info->attrs[NL80211_ATTR_PEER_AID])
                 return -EINVAL;
 
         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
@@ -3985,7 +4054,10 @@ static int nl80211_new_station(struct sk_buff *skb, struct genl_info *info)
         params.listen_interval =
                 nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]);
 
-        params.aid = nla_get_u16(info->attrs[NL80211_ATTR_STA_AID]);
+        if (info->attrs[NL80211_ATTR_PEER_AID])
+                params.aid = nla_get_u16(info->attrs[NL80211_ATTR_PEER_AID]);
+        else
+                params.aid = nla_get_u16(info->attrs[NL80211_ATTR_STA_AID]);
         if (!params.aid || params.aid > IEEE80211_MAX_AID)
                 return -EINVAL;
 
@@ -4037,7 +4109,8 @@ static int nl80211_new_station(struct sk_buff *skb, struct genl_info *info)
                         params.sta_modify_mask &= ~STATION_PARAM_APPLY_UAPSD;
 
                 /* TDLS peers cannot be added */
-                if (params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER))
+                if ((params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)) ||
+                    info->attrs[NL80211_ATTR_PEER_AID])
                         return -EINVAL;
                 /* but don't bother the driver with it */
                 params.sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
@@ -4063,7 +4136,8 @@ static int nl80211_new_station(struct sk_buff *skb, struct genl_info *info)
                 if (params.sta_flags_mask & BIT(NL80211_STA_FLAG_ASSOCIATED))
                         return -EINVAL;
                 /* TDLS peers cannot be added */
-                if (params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER))
+                if ((params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)) ||
+                    info->attrs[NL80211_ATTR_PEER_AID])
                         return -EINVAL;
                 break;
         case NL80211_IFTYPE_STATION:
@@ -4585,7 +4659,9 @@ static int nl80211_get_mesh_config(struct sk_buff *skb,
             nla_put_u32(msg, NL80211_MESHCONF_POWER_MODE,
                         cur_params.power_mode) ||
             nla_put_u16(msg, NL80211_MESHCONF_AWAKE_WINDOW,
-                        cur_params.dot11MeshAwakeWindowDuration))
+                        cur_params.dot11MeshAwakeWindowDuration) ||
+            nla_put_u32(msg, NL80211_MESHCONF_PLINK_TIMEOUT,
+                        cur_params.plink_timeout))
                 goto nla_put_failure;
         nla_nest_end(msg, pinfoattr);
         genlmsg_end(msg, hdr);
@@ -4626,6 +4702,7 @@ static const struct nla_policy nl80211_meshconf_params_policy[NL80211_MESHCONF_A
         [NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL] = { .type = NLA_U16 },
         [NL80211_MESHCONF_POWER_MODE] = { .type = NLA_U32 },
         [NL80211_MESHCONF_AWAKE_WINDOW] = { .type = NLA_U16 },
+        [NL80211_MESHCONF_PLINK_TIMEOUT] = { .type = NLA_U32 },
 };
 
 static const struct nla_policy
@@ -4634,6 +4711,7 @@ static const struct nla_policy
         [NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL] = { .type = NLA_U8 },
         [NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC] = { .type = NLA_U8 },
         [NL80211_MESH_SETUP_USERSPACE_AUTH] = { .type = NLA_FLAG },
+        [NL80211_MESH_SETUP_AUTH_PROTOCOL] = { .type = NLA_U8 },
         [NL80211_MESH_SETUP_USERSPACE_MPM] = { .type = NLA_FLAG },
         [NL80211_MESH_SETUP_IE] = { .type = NLA_BINARY,
                                     .len = IEEE80211_MAX_DATA_LEN },
@@ -4736,9 +4814,9 @@ do {									    \
         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshForwarding, 0, 1,
                                   mask, NL80211_MESHCONF_FORWARDING,
                                   nla_get_u8);
-        FILL_IN_MESH_PARAM_IF_SET(tb, cfg, rssi_threshold, 1, 255,
+        FILL_IN_MESH_PARAM_IF_SET(tb, cfg, rssi_threshold, -255, 0,
                                   mask, NL80211_MESHCONF_RSSI_THRESHOLD,
-                                  nla_get_u32);
+                                  nla_get_s32);
         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, ht_opmode, 0, 16,
                                   mask, NL80211_MESHCONF_HT_OPMODE,
                                   nla_get_u16);
@@ -4762,6 +4840,9 @@ do {									    \
         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshAwakeWindowDuration,
                                   0, 65535, mask,
                                   NL80211_MESHCONF_AWAKE_WINDOW, nla_get_u16);
+        FILL_IN_MESH_PARAM_IF_SET(tb, cfg, plink_timeout, 1, 0xffffffff,
+                                  mask, NL80211_MESHCONF_PLINK_TIMEOUT,
+                                  nla_get_u32);
         if (mask_out)
                 *mask_out = mask;
 
@@ -4819,6 +4900,13 @@ static int nl80211_parse_mesh_setup(struct genl_info *info,
         if (setup->is_secure)
                 setup->user_mpm = true;
 
+        if (tb[NL80211_MESH_SETUP_AUTH_PROTOCOL]) {
+                if (!setup->user_mpm)
+                        return -EINVAL;
+                setup->auth_id =
+                        nla_get_u8(tb[NL80211_MESH_SETUP_AUTH_PROTOCOL]);
+        }
+
         return 0;
 }
 
@@ -4861,18 +4949,13 @@ static int nl80211_get_reg(struct sk_buff *skb, struct genl_info *info)
         void *hdr = NULL;
         struct nlattr *nl_reg_rules;
         unsigned int i;
-        int err = -EINVAL;
-
-        mutex_lock(&cfg80211_mutex);
 
         if (!cfg80211_regdomain)
-                goto out;
+                return -EINVAL;
 
         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
-        if (!msg) {
-                err = -ENOBUFS;
-                goto out;
-        }
+        if (!msg)
+                return -ENOBUFS;
 
         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
                              NL80211_CMD_GET_REG);
@@ -4931,8 +5014,7 @@ static int nl80211_get_reg(struct sk_buff *skb, struct genl_info *info)
         nla_nest_end(msg, nl_reg_rules);
 
         genlmsg_end(msg, hdr);
-        err = genlmsg_reply(msg, info);
-        goto out;
+        return genlmsg_reply(msg, info);
 
 nla_put_failure_rcu:
         rcu_read_unlock();
@@ -4940,10 +5022,7 @@ nla_put_failure:
         genlmsg_cancel(msg, hdr);
 put_failure:
         nlmsg_free(msg);
-        err = -EMSGSIZE;
-out:
-        mutex_unlock(&cfg80211_mutex);
-        return err;
+        return -EMSGSIZE;
 }
 
 static int nl80211_set_reg(struct sk_buff *skb, struct genl_info *info)
@@ -5009,12 +5088,9 @@ static int nl80211_set_reg(struct sk_buff *skb, struct genl_info *info)
                 }
         }
 
-        mutex_lock(&cfg80211_mutex);
-
         r = set_regdom(rd);
         /* set_regdom took ownership */
         rd = NULL;
-        mutex_unlock(&cfg80211_mutex);
 
  bad_reg:
         kfree(rd);
@@ -5064,7 +5140,6 @@ static int nl80211_trigger_scan(struct sk_buff *skb, struct genl_info *info)
         if (!rdev->ops->scan)
                 return -EOPNOTSUPP;
 
-        mutex_lock(&rdev->sched_scan_mtx);
         if (rdev->scan_req) {
                 err = -EBUSY;
                 goto unlock;
@@ -5250,7 +5325,6 @@ static int nl80211_trigger_scan(struct sk_buff *skb, struct genl_info *info)
         }
 
  unlock:
-        mutex_unlock(&rdev->sched_scan_mtx);
         return err;
 }
 
@@ -5322,8 +5396,6 @@ static int nl80211_start_sched_scan(struct sk_buff *skb,
         if (ie_len > wiphy->max_sched_scan_ie_len)
                 return -EINVAL;
 
-        mutex_lock(&rdev->sched_scan_mtx);
-
         if (rdev->sched_scan_req) {
                 err = -EINPROGRESS;
                 goto out;
@@ -5491,7 +5563,6 @@ static int nl80211_start_sched_scan(struct sk_buff *skb,
 out_free:
         kfree(request);
 out:
-        mutex_unlock(&rdev->sched_scan_mtx);
         return err;
 }
 
@@ -5499,17 +5570,12 @@ static int nl80211_stop_sched_scan(struct sk_buff *skb,
                                    struct genl_info *info)
 {
         struct cfg80211_registered_device *rdev = info->user_ptr[0];
-        int err;
 
         if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_SCHED_SCAN) ||
             !rdev->ops->sched_scan_stop)
                 return -EOPNOTSUPP;
 
-        mutex_lock(&rdev->sched_scan_mtx);
-        err = __cfg80211_stop_sched_scan(rdev, false);
-        mutex_unlock(&rdev->sched_scan_mtx);
-
-        return err;
+        return __cfg80211_stop_sched_scan(rdev, false);
 }
 
 static int nl80211_start_radar_detection(struct sk_buff *skb,
@@ -5541,12 +5607,11 @@ static int nl80211_start_radar_detection(struct sk_buff *skb,
         if (!rdev->ops->start_radar_detection)
                 return -EOPNOTSUPP;
 
-        mutex_lock(&rdev->devlist_mtx);
         err = cfg80211_can_use_iftype_chan(rdev, wdev, wdev->iftype,
                                            chandef.chan, CHAN_MODE_SHARED,
                                            BIT(chandef.width));
         if (err)
-                goto err_locked;
+                return err;
 
         err = rdev->ops->start_radar_detection(&rdev->wiphy, dev, &chandef);
         if (!err) {
@@ -5554,12 +5619,114 @@ static int nl80211_start_radar_detection(struct sk_buff *skb,
                 wdev->cac_started = true;
                 wdev->cac_start_time = jiffies;
         }
-err_locked:
-        mutex_unlock(&rdev->devlist_mtx);
-
         return err;
 }
 
+static int nl80211_channel_switch(struct sk_buff *skb, struct genl_info *info)
+{
+        struct cfg80211_registered_device *rdev = info->user_ptr[0];
+        struct net_device *dev = info->user_ptr[1];
+        struct wireless_dev *wdev = dev->ieee80211_ptr;
+        struct cfg80211_csa_settings params;
+        /* csa_attrs is defined static to avoid waste of stack size - this
+         * function is called under RTNL lock, so this should not be a problem.
+         */
+        static struct nlattr *csa_attrs[NL80211_ATTR_MAX+1];
+        u8 radar_detect_width = 0;
+        int err;
+
+        if (!rdev->ops->channel_switch ||
+            !(rdev->wiphy.flags & WIPHY_FLAG_HAS_CHANNEL_SWITCH))
+                return -EOPNOTSUPP;
+
+        /* may add IBSS support later */
+        if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
+            dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
+                return -EOPNOTSUPP;
+
+        memset(&params, 0, sizeof(params));
+
+        if (!info->attrs[NL80211_ATTR_WIPHY_FREQ] ||
+            !info->attrs[NL80211_ATTR_CH_SWITCH_COUNT])
+                return -EINVAL;
+
+        /* only important for AP, IBSS and mesh create IEs internally */
+        if (!info->attrs[NL80211_ATTR_CSA_IES])
+                return -EINVAL;
+
+        /* useless if AP is not running */
+        if (!wdev->beacon_interval)
+                return -EINVAL;
+
+        params.count = nla_get_u32(info->attrs[NL80211_ATTR_CH_SWITCH_COUNT]);
+
+        err = nl80211_parse_beacon(info->attrs, &params.beacon_after);
+        if (err)
+                return err;
+
+        err = nla_parse_nested(csa_attrs, NL80211_ATTR_MAX,
+                               info->attrs[NL80211_ATTR_CSA_IES],
+                               nl80211_policy);
+        if (err)
+                return err;
+
+        err = nl80211_parse_beacon(csa_attrs, &params.beacon_csa);
+        if (err)
+                return err;
+
+        if (!csa_attrs[NL80211_ATTR_CSA_C_OFF_BEACON])
+                return -EINVAL;
+
+        params.counter_offset_beacon =
+                nla_get_u16(csa_attrs[NL80211_ATTR_CSA_C_OFF_BEACON]);
+        if (params.counter_offset_beacon >= params.beacon_csa.tail_len)
+                return -EINVAL;
+
+        /* sanity check - counters should be the same */
+        if (params.beacon_csa.tail[params.counter_offset_beacon] !=
+            params.count)
+                return -EINVAL;
+
+        if (csa_attrs[NL80211_ATTR_CSA_C_OFF_PRESP]) {
+                params.counter_offset_presp =
+                        nla_get_u16(csa_attrs[NL80211_ATTR_CSA_C_OFF_PRESP]);
+                if (params.counter_offset_presp >=
+                    params.beacon_csa.probe_resp_len)
+                        return -EINVAL;
+
+                if (params.beacon_csa.probe_resp[params.counter_offset_presp] !=
+                    params.count)
+                        return -EINVAL;
+        }
+
+        err = nl80211_parse_chandef(rdev, info, &params.chandef);
+        if (err)
+                return err;
+
+        if (!cfg80211_reg_can_beacon(&rdev->wiphy, &params.chandef))
+                return -EINVAL;
+
+        err = cfg80211_chandef_dfs_required(wdev->wiphy, &params.chandef);
+        if (err < 0) {
+                return err;
+        } else if (err) {
+                radar_detect_width = BIT(params.chandef.width);
+                params.radar_required = true;
+        }
+
+        err = cfg80211_can_use_iftype_chan(rdev, wdev, wdev->iftype,
+                                           params.chandef.chan,
+                                           CHAN_MODE_SHARED,
+                                           radar_detect_width);
+        if (err)
+                return err;
+
+        if (info->attrs[NL80211_ATTR_CH_SWITCH_BLOCK_TX])
+                params.block_tx = true;
+
+        return rdev_channel_switch(rdev, dev, &params);
+}
+
 static int nl80211_send_bss(struct sk_buff *msg, struct netlink_callback *cb,
                             u32 seq, int flags,
                             struct cfg80211_registered_device *rdev,
@@ -5621,6 +5788,7 @@ static int nl80211_send_bss(struct sk_buff *msg, struct netlink_callback *cb,
                 goto nla_put_failure;
         if (nla_put_u16(msg, NL80211_BSS_CAPABILITY, res->capability) ||
             nla_put_u32(msg, NL80211_BSS_FREQUENCY, res->channel->center_freq) ||
+            nla_put_u32(msg, NL80211_BSS_CHAN_WIDTH, res->scan_width) ||
             nla_put_u32(msg, NL80211_BSS_SEEN_MS_AGO,
                         jiffies_to_msecs(jiffies - intbss->ts)))
                 goto nla_put_failure;
@@ -5939,10 +6107,13 @@ static int nl80211_authenticate(struct sk_buff *skb, struct genl_info *info)
         if (local_state_change)
                 return 0;
 
-        return cfg80211_mlme_auth(rdev, dev, chan, auth_type, bssid,
-                                  ssid, ssid_len, ie, ie_len,
-                                  key.p.key, key.p.key_len, key.idx,
-                                  sae_data, sae_data_len);
+        wdev_lock(dev->ieee80211_ptr);
+        err = cfg80211_mlme_auth(rdev, dev, chan, auth_type, bssid,
+                                 ssid, ssid_len, ie, ie_len,
+                                 key.p.key, key.p.key_len, key.idx,
+                                 sae_data, sae_data_len);
+        wdev_unlock(dev->ieee80211_ptr);
+        return err;
 }
 
 static int nl80211_crypto_settings(struct cfg80211_registered_device *rdev,
@@ -6109,9 +6280,12 @@ static int nl80211_associate(struct sk_buff *skb, struct genl_info *info)
         }
 
         err = nl80211_crypto_settings(rdev, info, &req.crypto, 1);
-        if (!err)
+        if (!err) {
+                wdev_lock(dev->ieee80211_ptr);
                 err = cfg80211_mlme_assoc(rdev, dev, chan, bssid,
                                           ssid, ssid_len, &req);
+                wdev_unlock(dev->ieee80211_ptr);
+        }
 
         return err;
 }
@@ -6121,7 +6295,7 @@ static int nl80211_deauthenticate(struct sk_buff *skb, struct genl_info *info)
         struct cfg80211_registered_device *rdev = info->user_ptr[0];
         struct net_device *dev = info->user_ptr[1];
         const u8 *ie = NULL, *bssid;
-        int ie_len = 0;
+        int ie_len = 0, err;
         u16 reason_code;
         bool local_state_change;
 
@@ -6156,8 +6330,11 @@ static int nl80211_deauthenticate(struct sk_buff *skb, struct genl_info *info)
 
         local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
 
-        return cfg80211_mlme_deauth(rdev, dev, bssid, ie, ie_len, reason_code,
-                                    local_state_change);
+        wdev_lock(dev->ieee80211_ptr);
+        err = cfg80211_mlme_deauth(rdev, dev, bssid, ie, ie_len, reason_code,
+                                   local_state_change);
+        wdev_unlock(dev->ieee80211_ptr);
+        return err;
 }
 
 static int nl80211_disassociate(struct sk_buff *skb, struct genl_info *info)
@@ -6165,7 +6342,7 @@ static int nl80211_disassociate(struct sk_buff *skb, struct genl_info *info)
         struct cfg80211_registered_device *rdev = info->user_ptr[0];
         struct net_device *dev = info->user_ptr[1];
         const u8 *ie = NULL, *bssid;
-        int ie_len = 0;
+        int ie_len = 0, err;
         u16 reason_code;
         bool local_state_change;
 
@@ -6200,8 +6377,11 @@ static int nl80211_disassociate(struct sk_buff *skb, struct genl_info *info)
 
         local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
 
-        return cfg80211_mlme_disassoc(rdev, dev, bssid, ie, ie_len, reason_code,
-                                      local_state_change);
+        wdev_lock(dev->ieee80211_ptr);
+        err = cfg80211_mlme_disassoc(rdev, dev, bssid, ie, ie_len, reason_code,
+                                     local_state_change);
+        wdev_unlock(dev->ieee80211_ptr);
+        return err;
 }
 
 static bool
@@ -6288,11 +6468,18 @@ static int nl80211_join_ibss(struct sk_buff *skb, struct genl_info *info)
         if (!cfg80211_reg_can_beacon(&rdev->wiphy, &ibss.chandef))
                 return -EINVAL;
 
-        if (ibss.chandef.width > NL80211_CHAN_WIDTH_40)
-                return -EINVAL;
-        if (ibss.chandef.width != NL80211_CHAN_WIDTH_20_NOHT &&
-            !(rdev->wiphy.features & NL80211_FEATURE_HT_IBSS))
+        switch (ibss.chandef.width) {
+        case NL80211_CHAN_WIDTH_5:
+        case NL80211_CHAN_WIDTH_10:
+        case NL80211_CHAN_WIDTH_20_NOHT:
+                break;
+        case NL80211_CHAN_WIDTH_20:
+        case NL80211_CHAN_WIDTH_40:
+                if (rdev->wiphy.features & NL80211_FEATURE_HT_IBSS)
+                        break;
+        default:
                 return -EINVAL;
+        }
 
         ibss.channel_fixed = !!info->attrs[NL80211_ATTR_FREQ_FIXED];
         ibss.privacy = !!info->attrs[NL80211_ATTR_PRIVACY];
@@ -6311,6 +6498,19 @@ static int nl80211_join_ibss(struct sk_buff *skb, struct genl_info *info)
                         return err;
         }
 
+        if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
+                memcpy(&ibss.ht_capa_mask,
+                       nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]),
+                       sizeof(ibss.ht_capa_mask));
+
+        if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) {
+                if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
+                        return -EINVAL;
+                memcpy(&ibss.ht_capa,
+                       nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]),
+                       sizeof(ibss.ht_capa));
+        }
+
         if (info->attrs[NL80211_ATTR_MCAST_RATE] &&
             !nl80211_parse_mcast_rate(rdev, ibss.mcast_rate,
                         nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE])))
@@ -6393,19 +6593,30 @@ static struct genl_multicast_group nl80211_testmode_mcgrp = {
 static int nl80211_testmode_do(struct sk_buff *skb, struct genl_info *info)
 {
         struct cfg80211_registered_device *rdev = info->user_ptr[0];
+        struct wireless_dev *wdev =
+                __cfg80211_wdev_from_attrs(genl_info_net(info), info->attrs);
         int err;
 
+        if (!rdev->ops->testmode_cmd)
+                return -EOPNOTSUPP;
+
+        if (IS_ERR(wdev)) {
+                err = PTR_ERR(wdev);
+                if (err != -EINVAL)
+                        return err;
+                wdev = NULL;
+        } else if (wdev->wiphy != &rdev->wiphy) {
+                return -EINVAL;
+        }
+
         if (!info->attrs[NL80211_ATTR_TESTDATA])
                 return -EINVAL;
 
-        err = -EOPNOTSUPP;
-        if (rdev->ops->testmode_cmd) {
-                rdev->testmode_info = info;
-                err = rdev_testmode_cmd(rdev,
+        rdev->testmode_info = info;
+        err = rdev_testmode_cmd(rdev, wdev,
                                 nla_data(info->attrs[NL80211_ATTR_TESTDATA]),
                                 nla_len(info->attrs[NL80211_ATTR_TESTDATA]));
-                rdev->testmode_info = NULL;
-        }
+        rdev->testmode_info = NULL;
 
         return err;
 }
@@ -6419,6 +6630,8 @@ static int nl80211_testmode_dump(struct sk_buff *skb,
         void *data = NULL;
         int data_len = 0;
 
+        rtnl_lock();
+
         if (cb->args[0]) {
                 /*
                  * 0 is a valid index, but not valid for args[0],
@@ -6430,18 +6643,16 @@ static int nl80211_testmode_dump(struct sk_buff *skb,
                                   nl80211_fam.attrbuf, nl80211_fam.maxattr,
                                   nl80211_policy);
                 if (err)
-                        return err;
+                        goto out_err;
 
-                mutex_lock(&cfg80211_mutex);
                 rdev = __cfg80211_rdev_from_attrs(sock_net(skb->sk),
                                                   nl80211_fam.attrbuf);
                 if (IS_ERR(rdev)) {
-                        mutex_unlock(&cfg80211_mutex);
-                        return PTR_ERR(rdev);
+                        err = PTR_ERR(rdev);
+                        goto out_err;
                 }
                 phy_idx = rdev->wiphy_idx;
                 rdev = NULL;
-                mutex_unlock(&cfg80211_mutex);
 
                 if (nl80211_fam.attrbuf[NL80211_ATTR_TESTDATA])
                         cb->args[1] =
@@ -6453,14 +6664,11 @@ static int nl80211_testmode_dump(struct sk_buff *skb,
                 data_len = nla_len((void *)cb->args[1]);
         }
 
-        mutex_lock(&cfg80211_mutex);
         rdev = cfg80211_rdev_by_wiphy_idx(phy_idx);
         if (!rdev) {
-                mutex_unlock(&cfg80211_mutex);
-                return -ENOENT;
+                err = -ENOENT;
+                goto out_err;
         }
-        cfg80211_lock_rdev(rdev);
-        mutex_unlock(&cfg80211_mutex);
 
         if (!rdev->ops->testmode_dump) {
                 err = -EOPNOTSUPP;
@@ -6473,6 +6681,9 @@ static int nl80211_testmode_dump(struct sk_buff *skb,
                                            NL80211_CMD_TESTMODE);
                 struct nlattr *tmdata;
 
+                if (!hdr)
+                        break;
+
                 if (nla_put_u32(skb, NL80211_ATTR_WIPHY, phy_idx)) {
                         genlmsg_cancel(skb, hdr);
                         break;
@@ -6501,7 +6712,7 @@ static int nl80211_testmode_dump(struct sk_buff *skb,
         /* see above */
         cb->args[0] = phy_idx + 1;
  out_err:
-        cfg80211_unlock_rdev(rdev);
+        rtnl_unlock();
         return err;
 }
 
@@ -6581,12 +6792,14 @@ EXPORT_SYMBOL(cfg80211_testmode_alloc_event_skb);
 
 void cfg80211_testmode_event(struct sk_buff *skb, gfp_t gfp)
 {
+        struct cfg80211_registered_device *rdev = ((void **)skb->cb)[0];
         void *hdr = ((void **)skb->cb)[1];
         struct nlattr *data = ((void **)skb->cb)[2];
 
         nla_nest_end(skb, data);
         genlmsg_end(skb, hdr);
-        genlmsg_multicast(skb, 0, nl80211_testmode_mcgrp.id, gfp);
+        genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), skb, 0,
+                                nl80211_testmode_mcgrp.id, gfp);
 }
 EXPORT_SYMBOL(cfg80211_testmode_event);
 #endif
@@ -6709,7 +6922,9 @@ static int nl80211_connect(struct sk_buff *skb, struct genl_info *info)
                        sizeof(connect.vht_capa));
         }
 
-        err = cfg80211_connect(rdev, dev, &connect, connkeys);
+        wdev_lock(dev->ieee80211_ptr);
+        err = cfg80211_connect(rdev, dev, &connect, connkeys, NULL);
+        wdev_unlock(dev->ieee80211_ptr);
         if (err)
                 kfree(connkeys);
         return err;
@@ -6720,6 +6935,7 @@ static int nl80211_disconnect(struct sk_buff *skb, struct genl_info *info)
         struct cfg80211_registered_device *rdev = info->user_ptr[0];
         struct net_device *dev = info->user_ptr[1];
         u16 reason;
+        int ret;
 
         if (!info->attrs[NL80211_ATTR_REASON_CODE])
                 reason = WLAN_REASON_DEAUTH_LEAVING;
@@ -6733,7 +6949,10 @@ static int nl80211_disconnect(struct sk_buff *skb, struct genl_info *info)
             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
                 return -EOPNOTSUPP;
 
-        return cfg80211_disconnect(rdev, dev, reason, true);
+        wdev_lock(dev->ieee80211_ptr);
+        ret = cfg80211_disconnect(rdev, dev, reason, true);
+        wdev_unlock(dev->ieee80211_ptr);
+        return ret;
 }
 
 static int nl80211_wiphy_netns(struct sk_buff *skb, struct genl_info *info)
@@ -6909,9 +7128,8 @@ static int nl80211_remain_on_channel(struct sk_buff *skb,
 
         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
                              NL80211_CMD_REMAIN_ON_CHANNEL);
-
-        if (IS_ERR(hdr)) {
-                err = PTR_ERR(hdr);
+        if (!hdr) {
+                err = -ENOBUFS;
                 goto free_msg;
         }
 
@@ -7152,6 +7370,9 @@ static int nl80211_tx_mgmt(struct sk_buff *skb, struct genl_info *info)
                 return -EOPNOTSUPP;
 
         switch (wdev->iftype) {
+        case NL80211_IFTYPE_P2P_DEVICE:
+                if (!info->attrs[NL80211_ATTR_WIPHY_FREQ])
+                        return -EINVAL;
         case NL80211_IFTYPE_STATION:
         case NL80211_IFTYPE_ADHOC:
         case NL80211_IFTYPE_P2P_CLIENT:
@@ -7159,7 +7380,6 @@ static int nl80211_tx_mgmt(struct sk_buff *skb, struct genl_info *info)
         case NL80211_IFTYPE_AP_VLAN:
         case NL80211_IFTYPE_MESH_POINT:
         case NL80211_IFTYPE_P2P_GO:
-        case NL80211_IFTYPE_P2P_DEVICE:
                 break;
         default:
                 return -EOPNOTSUPP;
@@ -7187,9 +7407,18 @@ static int nl80211_tx_mgmt(struct sk_buff *skb, struct genl_info *info)
 
         no_cck = nla_get_flag(info->attrs[NL80211_ATTR_TX_NO_CCK_RATE]);
 
-        err = nl80211_parse_chandef(rdev, info, &chandef);
-        if (err)
-                return err;
+        /* get the channel if any has been specified, otherwise pass NULL to
+         * the driver. The latter will use the current one
+         */
+        chandef.chan = NULL;
+        if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
+                err = nl80211_parse_chandef(rdev, info, &chandef);
+                if (err)
+                        return err;
+        }
+
+        if (!chandef.chan && offchan)
+                return -EINVAL;
 
         if (!dont_wait_for_ack) {
                 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
@@ -7198,9 +7427,8 @@ static int nl80211_tx_mgmt(struct sk_buff *skb, struct genl_info *info)
 
                 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
                                      NL80211_CMD_FRAME);
-
-                if (IS_ERR(hdr)) {
-                        err = PTR_ERR(hdr);
+                if (!hdr) {
+                        err = -ENOBUFS;
                         goto free_msg;
                 }
         }
@@ -7350,14 +7578,12 @@ static int nl80211_set_cqm_txe(struct genl_info *info,
                                u32 rate, u32 pkts, u32 intvl)
 {
         struct cfg80211_registered_device *rdev = info->user_ptr[0];
-        struct wireless_dev *wdev;
         struct net_device *dev = info->user_ptr[1];
+        struct wireless_dev *wdev = dev->ieee80211_ptr;
 
         if (rate > 100 || intvl > NL80211_CQM_TXE_MAX_INTVL)
                 return -EINVAL;
 
-        wdev = dev->ieee80211_ptr;
-
         if (!rdev->ops->set_cqm_txe_config)
                 return -EOPNOTSUPP;
 
@@ -7372,13 +7598,15 @@ static int nl80211_set_cqm_rssi(struct genl_info *info,
                                 s32 threshold, u32 hysteresis)
 {
         struct cfg80211_registered_device *rdev = info->user_ptr[0];
-        struct wireless_dev *wdev;
         struct net_device *dev = info->user_ptr[1];
+        struct wireless_dev *wdev = dev->ieee80211_ptr;
 
         if (threshold > 0)
                 return -EINVAL;
 
-        wdev = dev->ieee80211_ptr;
+        /* disabling - hysteresis should also be zero then */
+        if (threshold == 0)
+                hysteresis = 0;
 
         if (!rdev->ops->set_cqm_rssi_config)
                 return -EOPNOTSUPP;
@@ -7397,36 +7625,33 @@ static int nl80211_set_cqm(struct sk_buff *skb, struct genl_info *info)
         int err;
 
         cqm = info->attrs[NL80211_ATTR_CQM];
-        if (!cqm) {
-                err = -EINVAL;
-                goto out;
-        }
+        if (!cqm)
+                return -EINVAL;
 
         err = nla_parse_nested(attrs, NL80211_ATTR_CQM_MAX, cqm,
                                nl80211_attr_cqm_policy);
         if (err)
-                goto out;
+                return err;
 
         if (attrs[NL80211_ATTR_CQM_RSSI_THOLD] &&
             attrs[NL80211_ATTR_CQM_RSSI_HYST]) {
-                s32 threshold;
-                u32 hysteresis;
-                threshold = nla_get_u32(attrs[NL80211_ATTR_CQM_RSSI_THOLD]);
-                hysteresis = nla_get_u32(attrs[NL80211_ATTR_CQM_RSSI_HYST]);
-                err = nl80211_set_cqm_rssi(info, threshold, hysteresis);
-        } else if (attrs[NL80211_ATTR_CQM_TXE_RATE] &&
-                   attrs[NL80211_ATTR_CQM_TXE_PKTS] &&
-                   attrs[NL80211_ATTR_CQM_TXE_INTVL]) {
-                u32 rate, pkts, intvl;
-                rate = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_RATE]);
-                pkts = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_PKTS]);
-                intvl = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_INTVL]);
-                err = nl80211_set_cqm_txe(info, rate, pkts, intvl);
-        } else
-                err = -EINVAL;
+                s32 threshold = nla_get_s32(attrs[NL80211_ATTR_CQM_RSSI_THOLD]);
+                u32 hysteresis = nla_get_u32(attrs[NL80211_ATTR_CQM_RSSI_HYST]);
 
-out:
-        return err;
+                return nl80211_set_cqm_rssi(info, threshold, hysteresis);
+        }
+
+        if (attrs[NL80211_ATTR_CQM_TXE_RATE] &&
+            attrs[NL80211_ATTR_CQM_TXE_PKTS] &&
+            attrs[NL80211_ATTR_CQM_TXE_INTVL]) {
+                u32 rate = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_RATE]);
+                u32 pkts = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_PKTS]);
+                u32 intvl = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_INTVL]);
+
+                return nl80211_set_cqm_txe(info, rate, pkts, intvl);
+        }
+
+        return -EINVAL;
 }
 
 static int nl80211_join_mesh(struct sk_buff *skb, struct genl_info *info)
@@ -7494,6 +7719,23 @@ static int nl80211_join_mesh(struct sk_buff *skb, struct genl_info *info)
                 setup.chandef.chan = NULL;
         }
 
+        if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
+                u8 *rates = nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
+                int n_rates =
+                        nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
+                struct ieee80211_supported_band *sband;
+
+                if (!setup.chandef.chan)
+                        return -EINVAL;
+
+                sband = rdev->wiphy.bands[setup.chandef.chan->band];
+
+                err = ieee80211_get_ratemask(sband, rates, n_rates,
+                                             &setup.basic_rates);
+                if (err)
+                        return err;
+        }
+
         return cfg80211_join_mesh(rdev, dev, &setup, &cfg);
 }
 
@@ -7509,28 +7751,28 @@ static int nl80211_leave_mesh(struct sk_buff *skb, struct genl_info *info)
 static int nl80211_send_wowlan_patterns(struct sk_buff *msg,
                                         struct cfg80211_registered_device *rdev)
 {
+        struct cfg80211_wowlan *wowlan = rdev->wiphy.wowlan_config;
         struct nlattr *nl_pats, *nl_pat;
         int i, pat_len;
 
-        if (!rdev->wowlan->n_patterns)
+        if (!wowlan->n_patterns)
                 return 0;
 
         nl_pats = nla_nest_start(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN);
         if (!nl_pats)
                 return -ENOBUFS;
 
-        for (i = 0; i < rdev->wowlan->n_patterns; i++) {
+        for (i = 0; i < wowlan->n_patterns; i++) {
                 nl_pat = nla_nest_start(msg, i + 1);
                 if (!nl_pat)
                         return -ENOBUFS;
-                pat_len = rdev->wowlan->patterns[i].pattern_len;
-                if (nla_put(msg, NL80211_WOWLAN_PKTPAT_MASK,
-                            DIV_ROUND_UP(pat_len, 8),
-                            rdev->wowlan->patterns[i].mask) ||
-                    nla_put(msg, NL80211_WOWLAN_PKTPAT_PATTERN,
-                            pat_len, rdev->wowlan->patterns[i].pattern) ||
-                    nla_put_u32(msg, NL80211_WOWLAN_PKTPAT_OFFSET,
-                                rdev->wowlan->patterns[i].pkt_offset))
+                pat_len = wowlan->patterns[i].pattern_len;
+                if (nla_put(msg, NL80211_PKTPAT_MASK, DIV_ROUND_UP(pat_len, 8),
+                            wowlan->patterns[i].mask) ||
+                    nla_put(msg, NL80211_PKTPAT_PATTERN, pat_len,
+                            wowlan->patterns[i].pattern) ||
+                    nla_put_u32(msg, NL80211_PKTPAT_OFFSET,
+                                wowlan->patterns[i].pkt_offset))
                         return -ENOBUFS;
                 nla_nest_end(msg, nl_pat);
         }
@@ -7589,16 +7831,15 @@ static int nl80211_get_wowlan(struct sk_buff *skb, struct genl_info *info)
         void *hdr;
         u32 size = NLMSG_DEFAULT_SIZE;
 
-        if (!rdev->wiphy.wowlan.flags && !rdev->wiphy.wowlan.n_patterns &&
-            !rdev->wiphy.wowlan.tcp)
+        if (!rdev->wiphy.wowlan)
                 return -EOPNOTSUPP;
 
-        if (rdev->wowlan && rdev->wowlan->tcp) {
+        if (rdev->wiphy.wowlan_config && rdev->wiphy.wowlan_config->tcp) {
                 /* adjust size to have room for all the data */
-                size += rdev->wowlan->tcp->tokens_size +
-                        rdev->wowlan->tcp->payload_len +
-                        rdev->wowlan->tcp->wake_len +
-                        rdev->wowlan->tcp->wake_len / 8;
+                size += rdev->wiphy.wowlan_config->tcp->tokens_size +
+                        rdev->wiphy.wowlan_config->tcp->payload_len +
+                        rdev->wiphy.wowlan_config->tcp->wake_len +
+                        rdev->wiphy.wowlan_config->tcp->wake_len / 8;
         }
 
         msg = nlmsg_new(size, GFP_KERNEL);
@@ -7610,33 +7851,34 @@ static int nl80211_get_wowlan(struct sk_buff *skb, struct genl_info *info)
         if (!hdr)
                 goto nla_put_failure;
 
-        if (rdev->wowlan) {
+        if (rdev->wiphy.wowlan_config) {
                 struct nlattr *nl_wowlan;
 
                 nl_wowlan = nla_nest_start(msg, NL80211_ATTR_WOWLAN_TRIGGERS);
                 if (!nl_wowlan)
                         goto nla_put_failure;
 
-                if ((rdev->wowlan->any &&
+                if ((rdev->wiphy.wowlan_config->any &&
                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_ANY)) ||
-                    (rdev->wowlan->disconnect &&
+                    (rdev->wiphy.wowlan_config->disconnect &&
                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT)) ||
-                    (rdev->wowlan->magic_pkt &&
+                    (rdev->wiphy.wowlan_config->magic_pkt &&
                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT)) ||
-                    (rdev->wowlan->gtk_rekey_failure &&
+                    (rdev->wiphy.wowlan_config->gtk_rekey_failure &&
                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE)) ||
-                    (rdev->wowlan->eap_identity_req &&
+                    (rdev->wiphy.wowlan_config->eap_identity_req &&
                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST)) ||
-                    (rdev->wowlan->four_way_handshake &&
+                    (rdev->wiphy.wowlan_config->four_way_handshake &&
                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE)) ||
-                    (rdev->wowlan->rfkill_release &&
+                    (rdev->wiphy.wowlan_config->rfkill_release &&
                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE)))
                         goto nla_put_failure;
 
                 if (nl80211_send_wowlan_patterns(msg, rdev))
                         goto nla_put_failure;
 
-                if (nl80211_send_wowlan_tcp(msg, rdev->wowlan->tcp))
+                if (nl80211_send_wowlan_tcp(msg,
+                                            rdev->wiphy.wowlan_config->tcp))
                         goto nla_put_failure;
 
                 nla_nest_end(msg, nl_wowlan);
@@ -7662,7 +7904,7 @@ static int nl80211_parse_wowlan_tcp(struct cfg80211_registered_device *rdev,
         u32 data_size, wake_size, tokens_size = 0, wake_mask_size;
         int err, port;
 
-        if (!rdev->wiphy.wowlan.tcp)
+        if (!rdev->wiphy.wowlan->tcp)
                 return -EINVAL;
 
         err = nla_parse(tb, MAX_NL80211_WOWLAN_TCP,
@@ -7682,16 +7924,16 @@ static int nl80211_parse_wowlan_tcp(struct cfg80211_registered_device *rdev,
                 return -EINVAL;
 
         data_size = nla_len(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD]);
-        if (data_size > rdev->wiphy.wowlan.tcp->data_payload_max)
+        if (data_size > rdev->wiphy.wowlan->tcp->data_payload_max)
                 return -EINVAL;
 
         if (nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]) >
-                        rdev->wiphy.wowlan.tcp->data_interval_max ||
+                        rdev->wiphy.wowlan->tcp->data_interval_max ||
             nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]) == 0)
                 return -EINVAL;
 
         wake_size = nla_len(tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD]);
-        if (wake_size > rdev->wiphy.wowlan.tcp->wake_payload_max)
+        if (wake_size > rdev->wiphy.wowlan->tcp->wake_payload_max)
                 return -EINVAL;
 
         wake_mask_size = nla_len(tb[NL80211_WOWLAN_TCP_WAKE_MASK]);
@@ -7706,13 +7948,13 @@ static int nl80211_parse_wowlan_tcp(struct cfg80211_registered_device *rdev,
 
                 if (!tok->len || tokens_size % tok->len)
                         return -EINVAL;
-                if (!rdev->wiphy.wowlan.tcp->tok)
+                if (!rdev->wiphy.wowlan->tcp->tok)
                         return -EINVAL;
-                if (tok->len > rdev->wiphy.wowlan.tcp->tok->max_len)
+                if (tok->len > rdev->wiphy.wowlan->tcp->tok->max_len)
                         return -EINVAL;
-                if (tok->len < rdev->wiphy.wowlan.tcp->tok->min_len)
+                if (tok->len < rdev->wiphy.wowlan->tcp->tok->min_len)
                         return -EINVAL;
-                if (tokens_size > rdev->wiphy.wowlan.tcp->tok->bufsize)
+                if (tokens_size > rdev->wiphy.wowlan->tcp->tok->bufsize)
                         return -EINVAL;
                 if (tok->offset + tok->len > data_size)
                         return -EINVAL;
@@ -7720,7 +7962,7 @@ static int nl80211_parse_wowlan_tcp(struct cfg80211_registered_device *rdev,
 
         if (tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ]) {
                 seq = nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ]);
-                if (!rdev->wiphy.wowlan.tcp->seq)
+                if (!rdev->wiphy.wowlan->tcp->seq)
                         return -EINVAL;
                 if (seq->len == 0 || seq->len > 4)
                         return -EINVAL;
@@ -7801,17 +8043,16 @@ static int nl80211_set_wowlan(struct sk_buff *skb, struct genl_info *info)
         struct nlattr *tb[NUM_NL80211_WOWLAN_TRIG];
         struct cfg80211_wowlan new_triggers = {};
         struct cfg80211_wowlan *ntrig;
-        struct wiphy_wowlan_support *wowlan = &rdev->wiphy.wowlan;
+        const struct wiphy_wowlan_support *wowlan = rdev->wiphy.wowlan;
         int err, i;
-        bool prev_enabled = rdev->wowlan;
+        bool prev_enabled = rdev->wiphy.wowlan_config;
 
-        if (!rdev->wiphy.wowlan.flags && !rdev->wiphy.wowlan.n_patterns &&
-            !rdev->wiphy.wowlan.tcp)
+        if (!wowlan)
                 return -EOPNOTSUPP;
 
         if (!info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS]) {
                 cfg80211_rdev_free_wowlan(rdev);
-                rdev->wowlan = NULL;
+                rdev->wiphy.wowlan_config = NULL;
                 goto set_wakeup;
         }
 
@@ -7871,7 +8112,7 @@ static int nl80211_set_wowlan(struct sk_buff *skb, struct genl_info *info)
                 struct nlattr *pat;
                 int n_patterns = 0;
                 int rem, pat_len, mask_len, pkt_offset;
-                struct nlattr *pat_tb[NUM_NL80211_WOWLAN_PKTPAT];
+                struct nlattr *pat_tb[NUM_NL80211_PKTPAT];
 
                 nla_for_each_nested(pat, tb[NL80211_WOWLAN_TRIG_PKT_PATTERN],
                                     rem)
@@ -7890,26 +8131,25 @@ static int nl80211_set_wowlan(struct sk_buff *skb, struct genl_info *info)
 
                 nla_for_each_nested(pat, tb[NL80211_WOWLAN_TRIG_PKT_PATTERN],
                                     rem) {
-                        nla_parse(pat_tb, MAX_NL80211_WOWLAN_PKTPAT,
-                                  nla_data(pat), nla_len(pat), NULL);
+                        nla_parse(pat_tb, MAX_NL80211_PKTPAT, nla_data(pat),
+                                  nla_len(pat), NULL);
                         err = -EINVAL;
-                        if (!pat_tb[NL80211_WOWLAN_PKTPAT_MASK] ||
-                            !pat_tb[NL80211_WOWLAN_PKTPAT_PATTERN])
+                        if (!pat_tb[NL80211_PKTPAT_MASK] ||
+                            !pat_tb[NL80211_PKTPAT_PATTERN])
                                 goto error;
-                        pat_len = nla_len(pat_tb[NL80211_WOWLAN_PKTPAT_PATTERN]);
+                        pat_len = nla_len(pat_tb[NL80211_PKTPAT_PATTERN]);
                         mask_len = DIV_ROUND_UP(pat_len, 8);
-                        if (nla_len(pat_tb[NL80211_WOWLAN_PKTPAT_MASK]) !=
-                            mask_len)
+                        if (nla_len(pat_tb[NL80211_PKTPAT_MASK]) != mask_len)
                                 goto error;
                         if (pat_len > wowlan->pattern_max_len ||
                             pat_len < wowlan->pattern_min_len)
                                 goto error;
 
-                        if (!pat_tb[NL80211_WOWLAN_PKTPAT_OFFSET])
+                        if (!pat_tb[NL80211_PKTPAT_OFFSET])
                                 pkt_offset = 0;
                         else
                                 pkt_offset = nla_get_u32(
-                                        pat_tb[NL80211_WOWLAN_PKTPAT_OFFSET]);
+                                        pat_tb[NL80211_PKTPAT_OFFSET]);
                         if (pkt_offset > wowlan->max_pkt_offset)
                                 goto error;
                         new_triggers.patterns[i].pkt_offset = pkt_offset;
@@ -7923,11 +8163,11 @@ static int nl80211_set_wowlan(struct sk_buff *skb, struct genl_info *info)
                         new_triggers.patterns[i].pattern =
                                 new_triggers.patterns[i].mask + mask_len;
                         memcpy(new_triggers.patterns[i].mask,
-                               nla_data(pat_tb[NL80211_WOWLAN_PKTPAT_MASK]),
+                               nla_data(pat_tb[NL80211_PKTPAT_MASK]),
                                mask_len);
                         new_triggers.patterns[i].pattern_len = pat_len;
                         memcpy(new_triggers.patterns[i].pattern,
-                               nla_data(pat_tb[NL80211_WOWLAN_PKTPAT_PATTERN]),
+                               nla_data(pat_tb[NL80211_PKTPAT_PATTERN]),
                                pat_len);
                         i++;
                 }
@@ -7947,11 +8187,12 @@ static int nl80211_set_wowlan(struct sk_buff *skb, struct genl_info *info)
                 goto error;
         }
         cfg80211_rdev_free_wowlan(rdev);
-        rdev->wowlan = ntrig;
+        rdev->wiphy.wowlan_config = ntrig;
 
  set_wakeup:
-        if (rdev->ops->set_wakeup && prev_enabled != !!rdev->wowlan)
-                rdev_set_wakeup(rdev, rdev->wowlan);
+        if (rdev->ops->set_wakeup &&
+            prev_enabled != !!rdev->wiphy.wowlan_config)
+                rdev_set_wakeup(rdev, rdev->wiphy.wowlan_config);
 
         return 0;
  error:
@@ -7965,6 +8206,264 @@ static int nl80211_set_wowlan(struct sk_buff *skb, struct genl_info *info)
 }
 #endif
 
+static int nl80211_send_coalesce_rules(struct sk_buff *msg,
+                                       struct cfg80211_registered_device *rdev)
+{
+        struct nlattr *nl_pats, *nl_pat, *nl_rule, *nl_rules;
+        int i, j, pat_len;
+        struct cfg80211_coalesce_rules *rule;
+
+        if (!rdev->coalesce->n_rules)
+                return 0;
+
+        nl_rules = nla_nest_start(msg, NL80211_ATTR_COALESCE_RULE);
+        if (!nl_rules)
+                return -ENOBUFS;
+
+        for (i = 0; i < rdev->coalesce->n_rules; i++) {
+                nl_rule = nla_nest_start(msg, i + 1);
+                if (!nl_rule)
+                        return -ENOBUFS;
+
+                rule = &rdev->coalesce->rules[i];
+                if (nla_put_u32(msg, NL80211_ATTR_COALESCE_RULE_DELAY,
+                                rule->delay))
+                        return -ENOBUFS;
+
+                if (nla_put_u32(msg, NL80211_ATTR_COALESCE_RULE_CONDITION,
+                                rule->condition))
+                        return -ENOBUFS;
+
+                nl_pats = nla_nest_start(msg,
+                                NL80211_ATTR_COALESCE_RULE_PKT_PATTERN);
+                if (!nl_pats)
+                        return -ENOBUFS;
+
+                for (j = 0; j < rule->n_patterns; j++) {
+                        nl_pat = nla_nest_start(msg, j + 1);
+                        if (!nl_pat)
+                                return -ENOBUFS;
+                        pat_len = rule->patterns[j].pattern_len;
+                        if (nla_put(msg, NL80211_PKTPAT_MASK,
+                                    DIV_ROUND_UP(pat_len, 8),
+                                    rule->patterns[j].mask) ||
+                            nla_put(msg, NL80211_PKTPAT_PATTERN, pat_len,
+                                    rule->patterns[j].pattern) ||
+                            nla_put_u32(msg, NL80211_PKTPAT_OFFSET,
+                                        rule->patterns[j].pkt_offset))
+                                return -ENOBUFS;
+                        nla_nest_end(msg, nl_pat);
+                }
+                nla_nest_end(msg, nl_pats);
+                nla_nest_end(msg, nl_rule);
+        }
+        nla_nest_end(msg, nl_rules);
+
+        return 0;
+}
+
+static int nl80211_get_coalesce(struct sk_buff *skb, struct genl_info *info)
+{
+        struct cfg80211_registered_device *rdev = info->user_ptr[0];
+        struct sk_buff *msg;
+        void *hdr;
+
+        if (!rdev->wiphy.coalesce)
+                return -EOPNOTSUPP;
+
+        msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
+        if (!msg)
+                return -ENOMEM;
+
+        hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
+                             NL80211_CMD_GET_COALESCE);
+        if (!hdr)
+                goto nla_put_failure;
+
+        if (rdev->coalesce && nl80211_send_coalesce_rules(msg, rdev))
+                goto nla_put_failure;
+
+        genlmsg_end(msg, hdr);
+        return genlmsg_reply(msg, info);
+
+nla_put_failure:
+        nlmsg_free(msg);
+        return -ENOBUFS;
+}
+
+void cfg80211_rdev_free_coalesce(struct cfg80211_registered_device *rdev)
+{
+        struct cfg80211_coalesce *coalesce = rdev->coalesce;
+        int i, j;
+        struct cfg80211_coalesce_rules *rule;
+
+        if (!coalesce)
+                return;
+
+        for (i = 0; i < coalesce->n_rules; i++) {
+                rule = &coalesce->rules[i];
+                for (j = 0; j < rule->n_patterns; j++)
+                        kfree(rule->patterns[j].mask);
+                kfree(rule->patterns);
+        }
+        kfree(coalesce->rules);
+        kfree(coalesce);
+        rdev->coalesce = NULL;
+}
+
+static int nl80211_parse_coalesce_rule(struct cfg80211_registered_device *rdev,
+                                       struct nlattr *rule,
+                                       struct cfg80211_coalesce_rules *new_rule)
+{
+        int err, i;
+        const struct wiphy_coalesce_support *coalesce = rdev->wiphy.coalesce;
+        struct nlattr *tb[NUM_NL80211_ATTR_COALESCE_RULE], *pat;
+        int rem, pat_len, mask_len, pkt_offset, n_patterns = 0;
+        struct nlattr *pat_tb[NUM_NL80211_PKTPAT];
+
+        err = nla_parse(tb, NL80211_ATTR_COALESCE_RULE_MAX, nla_data(rule),
+                        nla_len(rule), nl80211_coalesce_policy);
+        if (err)
+                return err;
+
+        if (tb[NL80211_ATTR_COALESCE_RULE_DELAY])
+                new_rule->delay =
+                        nla_get_u32(tb[NL80211_ATTR_COALESCE_RULE_DELAY]);
+        if (new_rule->delay > coalesce->max_delay)
+                return -EINVAL;
+
+        if (tb[NL80211_ATTR_COALESCE_RULE_CONDITION])
+                new_rule->condition =
+                        nla_get_u32(tb[NL80211_ATTR_COALESCE_RULE_CONDITION]);
+        if (new_rule->condition != NL80211_COALESCE_CONDITION_MATCH &&
+            new_rule->condition != NL80211_COALESCE_CONDITION_NO_MATCH)
+                return -EINVAL;
+
+        if (!tb[NL80211_ATTR_COALESCE_RULE_PKT_PATTERN])
+                return -EINVAL;
+
+        nla_for_each_nested(pat, tb[NL80211_ATTR_COALESCE_RULE_PKT_PATTERN],
+                            rem)
+                n_patterns++;
+        if (n_patterns > coalesce->n_patterns)
+                return -EINVAL;
+
+        new_rule->patterns = kcalloc(n_patterns, sizeof(new_rule->patterns[0]),
+                                     GFP_KERNEL);
+        if (!new_rule->patterns)
+                return -ENOMEM;
+
+        new_rule->n_patterns = n_patterns;
+        i = 0;
+
+        nla_for_each_nested(pat, tb[NL80211_ATTR_COALESCE_RULE_PKT_PATTERN],
+                            rem) {
+                nla_parse(pat_tb, MAX_NL80211_PKTPAT, nla_data(pat),
+                          nla_len(pat), NULL);
+                if (!pat_tb[NL80211_PKTPAT_MASK] ||
+                    !pat_tb[NL80211_PKTPAT_PATTERN])
+                        return -EINVAL;
+                pat_len = nla_len(pat_tb[NL80211_PKTPAT_PATTERN]);
+                mask_len = DIV_ROUND_UP(pat_len, 8);
+                if (nla_len(pat_tb[NL80211_PKTPAT_MASK]) != mask_len)
+                        return -EINVAL;
+                if (pat_len > coalesce->pattern_max_len ||
+                    pat_len < coalesce->pattern_min_len)
+                        return -EINVAL;
+
+                if (!pat_tb[NL80211_PKTPAT_OFFSET])
+                        pkt_offset = 0;
+                else
+                        pkt_offset = nla_get_u32(pat_tb[NL80211_PKTPAT_OFFSET]);
+                if (pkt_offset > coalesce->max_pkt_offset)
+                        return -EINVAL;
+                new_rule->patterns[i].pkt_offset = pkt_offset;
+
+                new_rule->patterns[i].mask =
+                        kmalloc(mask_len + pat_len, GFP_KERNEL);
+                if (!new_rule->patterns[i].mask)
+                        return -ENOMEM;
+                new_rule->patterns[i].pattern =
+                        new_rule->patterns[i].mask + mask_len;
+                memcpy(new_rule->patterns[i].mask,
+                       nla_data(pat_tb[NL80211_PKTPAT_MASK]), mask_len);
+                new_rule->patterns[i].pattern_len = pat_len;
+                memcpy(new_rule->patterns[i].pattern,
+                       nla_data(pat_tb[NL80211_PKTPAT_PATTERN]), pat_len);
+                i++;
+        }
+
+        return 0;
+}
+
+static int nl80211_set_coalesce(struct sk_buff *skb, struct genl_info *info)
+{
+        struct cfg80211_registered_device *rdev = info->user_ptr[0];
+        const struct wiphy_coalesce_support *coalesce = rdev->wiphy.coalesce;
+        struct cfg80211_coalesce new_coalesce = {};
+        struct cfg80211_coalesce *n_coalesce;
+        int err, rem_rule, n_rules = 0, i, j;
+        struct nlattr *rule;
+        struct cfg80211_coalesce_rules *tmp_rule;
+
+        if (!rdev->wiphy.coalesce || !rdev->ops->set_coalesce)
+                return -EOPNOTSUPP;
+
+        if (!info->attrs[NL80211_ATTR_COALESCE_RULE]) {
+                cfg80211_rdev_free_coalesce(rdev);
+                rdev->ops->set_coalesce(&rdev->wiphy, NULL);
+                return 0;
+        }
+
+        nla_for_each_nested(rule, info->attrs[NL80211_ATTR_COALESCE_RULE],
+                            rem_rule)
+                n_rules++;
+        if (n_rules > coalesce->n_rules)
+                return -EINVAL;
+
+        new_coalesce.rules = kcalloc(n_rules, sizeof(new_coalesce.rules[0]),
+                                     GFP_KERNEL);
+        if (!new_coalesce.rules)
+                return -ENOMEM;
+
+        new_coalesce.n_rules = n_rules;
+        i = 0;
+
+        nla_for_each_nested(rule, info->attrs[NL80211_ATTR_COALESCE_RULE],
+                            rem_rule) {
+                err = nl80211_parse_coalesce_rule(rdev, rule,
+                                                  &new_coalesce.rules[i]);
+                if (err)
+                        goto error;
+
+                i++;
+        }
+
+        err = rdev->ops->set_coalesce(&rdev->wiphy, &new_coalesce);
+        if (err)
+                goto error;
+
+        n_coalesce = kmemdup(&new_coalesce, sizeof(new_coalesce), GFP_KERNEL);
+        if (!n_coalesce) {
+                err = -ENOMEM;
+                goto error;
+        }
+        cfg80211_rdev_free_coalesce(rdev);
+        rdev->coalesce = n_coalesce;
+
+        return 0;
+error:
+        for (i = 0; i < new_coalesce.n_rules; i++) {
+                tmp_rule = &new_coalesce.rules[i];
+                for (j = 0; j < tmp_rule->n_patterns; j++)
+                        kfree(tmp_rule->patterns[j].mask);
+                kfree(tmp_rule->patterns);
+        }
+        kfree(new_coalesce.rules);
+
+        return err;
+}
+
 static int nl80211_set_rekey_data(struct sk_buff *skb, struct genl_info *info)
 {
         struct cfg80211_registered_device *rdev = info->user_ptr[0];
@@ -8061,9 +8560,8 @@ static int nl80211_probe_client(struct sk_buff *skb,
 
         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
                              NL80211_CMD_PROBE_CLIENT);
-
-        if (IS_ERR(hdr)) {
-                err = PTR_ERR(hdr);
+        if (!hdr) {
+                err = -ENOBUFS;
                 goto free_msg;
         }
 
@@ -8136,9 +8634,7 @@ static int nl80211_start_p2p_device(struct sk_buff *skb, struct genl_info *info)
         if (wdev->p2p_started)
                 return 0;
 
-        mutex_lock(&rdev->devlist_mtx);
         err = cfg80211_can_add_interface(rdev, wdev->iftype);
-        mutex_unlock(&rdev->devlist_mtx);
         if (err)
                 return err;
 
@@ -8147,9 +8643,7 @@ static int nl80211_start_p2p_device(struct sk_buff *skb, struct genl_info *info)
                 return err;
 
         wdev->p2p_started = true;
-        mutex_lock(&rdev->devlist_mtx);
         rdev->opencount++;
-        mutex_unlock(&rdev->devlist_mtx);
 
         return 0;
 }
@@ -8165,11 +8659,7 @@ static int nl80211_stop_p2p_device(struct sk_buff *skb, struct genl_info *info)
         if (!rdev->ops->stop_p2p_device)
                 return -EOPNOTSUPP;
 
-        mutex_lock(&rdev->devlist_mtx);
-        mutex_lock(&rdev->sched_scan_mtx);
         cfg80211_stop_p2p_device(rdev, wdev);
-        mutex_unlock(&rdev->sched_scan_mtx);
-        mutex_unlock(&rdev->devlist_mtx);
 
         return 0;
 }
@@ -8312,11 +8802,11 @@ static int nl80211_pre_doit(struct genl_ops *ops, struct sk_buff *skb,
                 info->user_ptr[0] = rdev;
         } else if (ops->internal_flags & NL80211_FLAG_NEED_NETDEV ||
                    ops->internal_flags & NL80211_FLAG_NEED_WDEV) {
-                mutex_lock(&cfg80211_mutex);
+                ASSERT_RTNL();
+
                 wdev = __cfg80211_wdev_from_attrs(genl_info_net(info),
                                                   info->attrs);
                 if (IS_ERR(wdev)) {
-                        mutex_unlock(&cfg80211_mutex);
                         if (rtnl)
                                 rtnl_unlock();
                         return PTR_ERR(wdev);
@@ -8327,7 +8817,6 @@ static int nl80211_pre_doit(struct genl_ops *ops, struct sk_buff *skb,
 
                 if (ops->internal_flags & NL80211_FLAG_NEED_NETDEV) {
                         if (!dev) {
-                                mutex_unlock(&cfg80211_mutex);
                                 if (rtnl)
                                         rtnl_unlock();
                                 return -EINVAL;
@@ -8341,7 +8830,6 @@ static int nl80211_pre_doit(struct genl_ops *ops, struct sk_buff *skb,
                 if (dev) {
                         if (ops->internal_flags & NL80211_FLAG_CHECK_NETDEV_UP &&
                             !netif_running(dev)) {
-                                mutex_unlock(&cfg80211_mutex);
                                 if (rtnl)
                                         rtnl_unlock();
                                 return -ENETDOWN;
@@ -8350,17 +8838,12 @@ static int nl80211_pre_doit(struct genl_ops *ops, struct sk_buff *skb,
                         dev_hold(dev);
                 } else if (ops->internal_flags & NL80211_FLAG_CHECK_NETDEV_UP) {
                         if (!wdev->p2p_started) {
-                                mutex_unlock(&cfg80211_mutex);
                                 if (rtnl)
                                         rtnl_unlock();
                                 return -ENETDOWN;
                         }
                 }
 
-                cfg80211_lock_rdev(rdev);
-
-                mutex_unlock(&cfg80211_mutex);
-
                 info->user_ptr[0] = rdev;
         }
 
@@ -8370,8 +8853,6 @@ static int nl80211_pre_doit(struct genl_ops *ops, struct sk_buff *skb,
 static void nl80211_post_doit(struct genl_ops *ops, struct sk_buff *skb,
                               struct genl_info *info)
 {
-        if (info->user_ptr[0])
-                cfg80211_unlock_rdev(info->user_ptr[0]);
         if (info->user_ptr[1]) {
                 if (ops->internal_flags & NL80211_FLAG_NEED_WDEV) {
                         struct wireless_dev *wdev = info->user_ptr[1];
@@ -8391,9 +8872,11 @@ static struct genl_ops nl80211_ops[] = {
                 .cmd = NL80211_CMD_GET_WIPHY,
                 .doit = nl80211_get_wiphy,
                 .dumpit = nl80211_dump_wiphy,
+                .done = nl80211_dump_wiphy_done,
                 .policy = nl80211_policy,
                 /* can be retrieved by unprivileged users */
-                .internal_flags = NL80211_FLAG_NEED_WIPHY,
+                .internal_flags = NL80211_FLAG_NEED_WIPHY |
+                                  NL80211_FLAG_NEED_RTNL,
         },
         {
                 .cmd = NL80211_CMD_SET_WIPHY,
@@ -8408,7 +8891,8 @@ static struct genl_ops nl80211_ops[] = {
                 .dumpit = nl80211_dump_interface,
                 .policy = nl80211_policy,
                 /* can be retrieved by unprivileged users */
-                .internal_flags = NL80211_FLAG_NEED_WDEV,
+                .internal_flags = NL80211_FLAG_NEED_WDEV |
+                                  NL80211_FLAG_NEED_RTNL,
         },
         {
                 .cmd = NL80211_CMD_SET_INTERFACE,
@@ -8567,6 +9051,7 @@ static struct genl_ops nl80211_ops[] = {
                 .cmd = NL80211_CMD_GET_REG,
                 .doit = nl80211_get_reg,
                 .policy = nl80211_policy,
+                .internal_flags = NL80211_FLAG_NEED_RTNL,
                 /* can be retrieved by unprivileged users */
         },
         {
@@ -8574,6 +9059,7 @@ static struct genl_ops nl80211_ops[] = {
                 .doit = nl80211_set_reg,
                 .policy = nl80211_policy,
                 .flags = GENL_ADMIN_PERM,
+                .internal_flags = NL80211_FLAG_NEED_RTNL,
         },
         {
                 .cmd = NL80211_CMD_REQ_SET_REG,
@@ -8984,7 +9470,30 @@ static struct genl_ops nl80211_ops[] = {
                 .flags = GENL_ADMIN_PERM,
                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
                                   NL80211_FLAG_NEED_RTNL,
-        }
+        },
+        {
+                .cmd = NL80211_CMD_GET_COALESCE,
+                .doit = nl80211_get_coalesce,
+                .policy = nl80211_policy,
+                .internal_flags = NL80211_FLAG_NEED_WIPHY |
+                                  NL80211_FLAG_NEED_RTNL,
+        },
+        {
+                .cmd = NL80211_CMD_SET_COALESCE,
+                .doit = nl80211_set_coalesce,
+                .policy = nl80211_policy,
+                .flags = GENL_ADMIN_PERM,
+                .internal_flags = NL80211_FLAG_NEED_WIPHY |
+                                  NL80211_FLAG_NEED_RTNL,
+        },
+        {
+                .cmd = NL80211_CMD_CHANNEL_SWITCH,
+                .doit = nl80211_channel_switch,
+                .policy = nl80211_policy,
+                .flags = GENL_ADMIN_PERM,
+                .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
+                                  NL80211_FLAG_NEED_RTNL,
+        },
 };
 
 static struct genl_multicast_group nl80211_mlme_mcgrp = {
@@ -9007,13 +9516,13 @@ static struct genl_multicast_group nl80211_regulatory_mcgrp = {
 void nl80211_notify_dev_rename(struct cfg80211_registered_device *rdev)
 {
         struct sk_buff *msg;
+        struct nl80211_dump_wiphy_state state = {};
 
         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
         if (!msg)
                 return;
 
-        if (nl80211_send_wiphy(rdev, msg, 0, 0, 0,
-                               false, NULL, NULL, NULL) < 0) {
+        if (nl80211_send_wiphy(rdev, msg, 0, 0, 0, &state) < 0) {
                 nlmsg_free(msg);
                 return;
         }
@@ -9029,8 +9538,6 @@ static int nl80211_add_scan_req(struct sk_buff *msg,
         struct nlattr *nest;
         int i;
 
-        lockdep_assert_held(&rdev->sched_scan_mtx);
-
         if (WARN_ON(!req))
                 return 0;
 
@@ -9337,31 +9844,27 @@ void nl80211_send_disassoc(struct cfg80211_registered_device *rdev,
                                 NL80211_CMD_DISASSOCIATE, gfp);
 }
 
-void cfg80211_send_unprot_deauth(struct net_device *dev, const u8 *buf,
-                                 size_t len)
+void cfg80211_rx_unprot_mlme_mgmt(struct net_device *dev, const u8 *buf,
+                                  size_t len)
 {
         struct wireless_dev *wdev = dev->ieee80211_ptr;
         struct wiphy *wiphy = wdev->wiphy;
         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
+        const struct ieee80211_mgmt *mgmt = (void *)buf;
+        u32 cmd;
 
-        trace_cfg80211_send_unprot_deauth(dev);
-        nl80211_send_mlme_event(rdev, dev, buf, len,
-                                NL80211_CMD_UNPROT_DEAUTHENTICATE, GFP_ATOMIC);
-}
-EXPORT_SYMBOL(cfg80211_send_unprot_deauth);
+        if (WARN_ON(len < 2))
+                return;
 
-void cfg80211_send_unprot_disassoc(struct net_device *dev, const u8 *buf,
-                                   size_t len)
-{
-        struct wireless_dev *wdev = dev->ieee80211_ptr;
-        struct wiphy *wiphy = wdev->wiphy;
-        struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
+        if (ieee80211_is_deauth(mgmt->frame_control))
+                cmd = NL80211_CMD_UNPROT_DEAUTHENTICATE;
+        else
+                cmd = NL80211_CMD_UNPROT_DISASSOCIATE;
 
-        trace_cfg80211_send_unprot_disassoc(dev);
-        nl80211_send_mlme_event(rdev, dev, buf, len,
-                                NL80211_CMD_UNPROT_DISASSOCIATE, GFP_ATOMIC);
+        trace_cfg80211_rx_unprot_mlme_mgmt(dev, buf, len);
+        nl80211_send_mlme_event(rdev, dev, buf, len, cmd, GFP_ATOMIC);
 }
-EXPORT_SYMBOL(cfg80211_send_unprot_disassoc);
+EXPORT_SYMBOL(cfg80211_rx_unprot_mlme_mgmt);
 
 static void nl80211_send_mlme_timeout(struct cfg80211_registered_device *rdev,
                                       struct net_device *netdev, int cmd,
@@ -9872,7 +10375,6 @@ static bool __nl80211_unexpected_frame(struct net_device *dev, u8 cmd,
         struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
         struct sk_buff *msg;
         void *hdr;
-        int err;
         u32 nlportid = ACCESS_ONCE(wdev->ap_unexpected_nlportid);
 
         if (!nlportid)
@@ -9893,12 +10395,7 @@ static bool __nl80211_unexpected_frame(struct net_device *dev, u8 cmd,
             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr))
                 goto nla_put_failure;
 
-        err = genlmsg_end(msg, hdr);
-        if (err < 0) {
-                nlmsg_free(msg);
-                return true;
-        }
-
+        genlmsg_end(msg, hdr);
         genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
         return true;
 
@@ -9953,7 +10450,7 @@ EXPORT_SYMBOL(cfg80211_rx_unexpected_4addr_frame);
 int nl80211_send_mgmt(struct cfg80211_registered_device *rdev,
                       struct wireless_dev *wdev, u32 nlportid,
                       int freq, int sig_dbm,
-                      const u8 *buf, size_t len, gfp_t gfp)
+                      const u8 *buf, size_t len, u32 flags, gfp_t gfp)
 {
         struct net_device *netdev = wdev->netdev;
         struct sk_buff *msg;
@@ -9976,7 +10473,9 @@ int nl80211_send_mgmt(struct cfg80211_registered_device *rdev,
             nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, freq) ||
             (sig_dbm &&
              nla_put_u32(msg, NL80211_ATTR_RX_SIGNAL_DBM, sig_dbm)) ||
-            nla_put(msg, NL80211_ATTR_FRAME, len, buf))
+            nla_put(msg, NL80211_ATTR_FRAME, len, buf) ||
+            (flags &&
+             nla_put_u32(msg, NL80211_ATTR_RXMGMT_FLAGS, flags)))
                 goto nla_put_failure;
 
         genlmsg_end(msg, hdr);
@@ -10021,7 +10520,8 @@ void cfg80211_mgmt_tx_status(struct wireless_dev *wdev, u64 cookie,
 
         genlmsg_end(msg, hdr);
 
-        genlmsg_multicast(msg, 0, nl80211_mlme_mcgrp.id, gfp);
+        genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
+                                nl80211_mlme_mcgrp.id, gfp);
         return;
 
  nla_put_failure:
@@ -10341,10 +10841,7 @@ nl80211_radar_notify(struct cfg80211_registered_device *rdev,
         if (nl80211_send_chandef(msg, chandef))
                 goto nla_put_failure;
 
-        if (genlmsg_end(msg, hdr) < 0) {
-                nlmsg_free(msg);
-                return;
-        }
+        genlmsg_end(msg, hdr);
 
         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
                                 nl80211_mlme_mcgrp.id, gfp);
@@ -10410,7 +10907,6 @@ void cfg80211_probe_status(struct net_device *dev, const u8 *addr,
         struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
         struct sk_buff *msg;
         void *hdr;
-        int err;
 
         trace_cfg80211_probe_status(dev, addr, cookie, acked);
 
@@ -10432,11 +10928,7 @@ void cfg80211_probe_status(struct net_device *dev, const u8 *addr,
             (acked && nla_put_flag(msg, NL80211_ATTR_ACK)))
                 goto nla_put_failure;
 
-        err = genlmsg_end(msg, hdr);
-        if (err < 0) {
-                nlmsg_free(msg);
-                return;
-        }
+        genlmsg_end(msg, hdr);
 
         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
                                 nl80211_mlme_mcgrp.id, gfp);
@@ -10502,7 +10994,7 @@ void cfg80211_report_wowlan_wakeup(struct wireless_dev *wdev,
         struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
         struct sk_buff *msg;
         void *hdr;
-        int err, size = 200;
+        int size = 200;
 
         trace_cfg80211_report_wowlan_wakeup(wdev->wiphy, wdev, wakeup);
 
@@ -10588,9 +11080,7 @@ void cfg80211_report_wowlan_wakeup(struct wireless_dev *wdev,
                 nla_nest_end(msg, reasons);
         }
 
-        err = genlmsg_end(msg, hdr);
-        if (err < 0)
-                goto free_msg;
+        genlmsg_end(msg, hdr);
 
         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
                                 nl80211_mlme_mcgrp.id, gfp);
@@ -10610,7 +11100,6 @@ void cfg80211_tdls_oper_request(struct net_device *dev, const u8 *peer,
         struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
         struct sk_buff *msg;
         void *hdr;
-        int err;
 
         trace_cfg80211_tdls_oper_request(wdev->wiphy, dev, peer, oper,
                                          reason_code);
@@ -10633,11 +11122,7 @@ void cfg80211_tdls_oper_request(struct net_device *dev, const u8 *peer,
              nla_put_u16(msg, NL80211_ATTR_REASON_CODE, reason_code)))
                 goto nla_put_failure;
 
-        err = genlmsg_end(msg, hdr);
-        if (err < 0) {
-                nlmsg_free(msg);
-                return;
-        }
+        genlmsg_end(msg, hdr);
 
         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
                                 nl80211_mlme_mcgrp.id, gfp);
@@ -10695,7 +11180,6 @@ void cfg80211_ft_event(struct net_device *netdev,
         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
         struct sk_buff *msg;
         void *hdr;
-        int err;
 
         trace_cfg80211_ft_event(wiphy, netdev, ft_event);
 
@@ -10721,11 +11205,7 @@ void cfg80211_ft_event(struct net_device *netdev,
                 nla_put(msg, NL80211_ATTR_IE_RIC, ft_event->ric_ies_len,
                         ft_event->ric_ies);
 
-        err = genlmsg_end(msg, hdr);
-        if (err < 0) {
-                nlmsg_free(msg);
-                return;
-        }
+        genlmsg_end(msg, hdr);
 
         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
                                 nl80211_mlme_mcgrp.id, GFP_KERNEL);
diff --git a/net/wireless/nl80211.h b/net/wireless/nl80211.h
index a4073e808c13..2c0f2b3c07cb 100644
--- a/net/wireless/nl80211.h
+++ b/net/wireless/nl80211.h
@@ -66,7 +66,7 @@ void nl80211_send_ibss_bssid(struct cfg80211_registered_device *rdev,
 int nl80211_send_mgmt(struct cfg80211_registered_device *rdev,
                       struct wireless_dev *wdev, u32 nlpid,
                       int freq, int sig_dbm,
-                      const u8 *buf, size_t len, gfp_t gfp);
+                      const u8 *buf, size_t len, u32 flags, gfp_t gfp);
 
 void
 nl80211_radar_notify(struct cfg80211_registered_device *rdev,
@@ -74,4 +74,6 @@ nl80211_radar_notify(struct cfg80211_registered_device *rdev,
                      enum nl80211_radar_event event,
                      struct net_device *netdev, gfp_t gfp);
 
+void cfg80211_rdev_free_coalesce(struct cfg80211_registered_device *rdev);
+
 #endif /* __NET_WIRELESS_NL80211_H */
diff --git a/net/wireless/rdev-ops.h b/net/wireless/rdev-ops.h
index 9f15f0ac824d..37ce9fdfe934 100644
--- a/net/wireless/rdev-ops.h
+++ b/net/wireless/rdev-ops.h
@@ -516,11 +516,12 @@ static inline void rdev_rfkill_poll(struct cfg80211_registered_device *rdev)
 
 #ifdef CONFIG_NL80211_TESTMODE
 static inline int rdev_testmode_cmd(struct cfg80211_registered_device *rdev,
+                                    struct wireless_dev *wdev,
                                     void *data, int len)
 {
         int ret;
-        trace_rdev_testmode_cmd(&rdev->wiphy);
-        ret = rdev->ops->testmode_cmd(&rdev->wiphy, data, len);
+        trace_rdev_testmode_cmd(&rdev->wiphy, wdev);
+        ret = rdev->ops->testmode_cmd(&rdev->wiphy, wdev, data, len);
         trace_rdev_return_int(&rdev->wiphy, ret);
         return ret;
 }
@@ -923,4 +924,16 @@ static inline void rdev_crit_proto_stop(struct cfg80211_registered_device *rdev,
         trace_rdev_return_void(&rdev->wiphy);
 }
 
+static inline int rdev_channel_switch(struct cfg80211_registered_device *rdev,
+                                      struct net_device *dev,
+                                      struct cfg80211_csa_settings *params)
+{
+        int ret;
+
+        trace_rdev_channel_switch(&rdev->wiphy, dev, params);
+        ret = rdev->ops->channel_switch(&rdev->wiphy, dev, params);
+        trace_rdev_return_int(&rdev->wiphy, ret);
+        return ret;
+}
+
 #endif /* __CFG80211_RDEV_OPS */
diff --git a/net/wireless/reg.c b/net/wireless/reg.c
index cc35fbaa4578..de06d5d1287f 100644
--- a/net/wireless/reg.c
+++ b/net/wireless/reg.c
@@ -81,7 +81,10 @@ static struct regulatory_request core_request_world = {
         .country_ie_env = ENVIRON_ANY,
 };
 
-/* Receipt of information from last regulatory request */
+/*
+ * Receipt of information from last regulatory request,
+ * protected by RTNL (and can be accessed with RCU protection)
+ */
 static struct regulatory_request __rcu *last_request =
         (void __rcu *)&core_request_world;
 
@@ -96,39 +99,25 @@ static struct device_type reg_device_type = {
  * Central wireless core regulatory domains, we only need two,
  * the current one and a world regulatory domain in case we have no
  * information to give us an alpha2.
+ * (protected by RTNL, can be read under RCU)
  */
 const struct ieee80211_regdomain __rcu *cfg80211_regdomain;
 
 /*
- * Protects static reg.c components:
- *      - cfg80211_regdomain (if not used with RCU)
- *      - cfg80211_world_regdom
- *      - last_request (if not used with RCU)
- *      - reg_num_devs_support_basehint
- */
-static DEFINE_MUTEX(reg_mutex);
-
-/*
  * Number of devices that registered to the core
  * that support cellular base station regulatory hints
+ * (protected by RTNL)
  */
 static int reg_num_devs_support_basehint;
 
-static inline void assert_reg_lock(void)
-{
-        lockdep_assert_held(&reg_mutex);
-}
-
 static const struct ieee80211_regdomain *get_cfg80211_regdom(void)
 {
-        return rcu_dereference_protected(cfg80211_regdomain,
-                                         lockdep_is_held(&reg_mutex));
+        return rtnl_dereference(cfg80211_regdomain);
 }
 
 static const struct ieee80211_regdomain *get_wiphy_regdom(struct wiphy *wiphy)
 {
-        return rcu_dereference_protected(wiphy->regd,
-                                         lockdep_is_held(&reg_mutex));
+        return rtnl_dereference(wiphy->regd);
 }
 
 static void rcu_free_regdom(const struct ieee80211_regdomain *r)
@@ -140,8 +129,7 @@ static void rcu_free_regdom(const struct ieee80211_regdomain *r)
 
 static struct regulatory_request *get_last_request(void)
 {
-        return rcu_dereference_check(last_request,
-                                     lockdep_is_held(&reg_mutex));
+        return rcu_dereference_rtnl(last_request);
 }
 
 /* Used to queue up regulatory hints */
@@ -200,6 +188,7 @@ static const struct ieee80211_regdomain world_regdom = {
         }
 };
 
+/* protected by RTNL */
 static const struct ieee80211_regdomain *cfg80211_world_regdom =
         &world_regdom;
 
@@ -215,7 +204,7 @@ static void reset_regdomains(bool full_reset,
         const struct ieee80211_regdomain *r;
         struct regulatory_request *lr;
 
-        assert_reg_lock();
+        ASSERT_RTNL();
 
         r = get_cfg80211_regdom();
 
@@ -377,7 +366,7 @@ static void reg_regdb_search(struct work_struct *work)
         const struct ieee80211_regdomain *curdom, *regdom = NULL;
         int i;
 
-        mutex_lock(&cfg80211_mutex);
+        rtnl_lock();
 
         mutex_lock(&reg_regdb_search_mutex);
         while (!list_empty(&reg_regdb_search_list)) {
@@ -402,7 +391,7 @@ static void reg_regdb_search(struct work_struct *work)
         if (!IS_ERR_OR_NULL(regdom))
                 set_regdom(regdom);
 
-        mutex_unlock(&cfg80211_mutex);
+        rtnl_unlock();
 }
 
 static DECLARE_WORK(reg_regdb_work, reg_regdb_search);
@@ -936,13 +925,7 @@ static bool reg_request_cell_base(struct regulatory_request *request)
 
 bool reg_last_request_cell_base(void)
 {
-        bool val;
-
-        mutex_lock(&reg_mutex);
-        val = reg_request_cell_base(get_last_request());
-        mutex_unlock(&reg_mutex);
-
-        return val;
+        return reg_request_cell_base(get_last_request());
 }
 
 #ifdef CONFIG_CFG80211_CERTIFICATION_ONUS
@@ -1225,7 +1208,7 @@ static void update_all_wiphy_regulatory(enum nl80211_reg_initiator initiator)
         struct cfg80211_registered_device *rdev;
         struct wiphy *wiphy;
 
-        assert_cfg80211_lock();
+        ASSERT_RTNL();
 
         list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
                 wiphy = &rdev->wiphy;
@@ -1362,7 +1345,7 @@ get_reg_request_treatment(struct wiphy *wiphy,
                                 return REG_REQ_OK;
                         return REG_REQ_ALREADY_SET;
                 }
-                return 0;
+                return REG_REQ_OK;
         case NL80211_REGDOM_SET_BY_DRIVER:
                 if (lr->initiator == NL80211_REGDOM_SET_BY_CORE) {
                         if (regdom_changes(pending_request->alpha2))
@@ -1444,8 +1427,6 @@ static void reg_set_request_processed(void)
  * what it believes should be the current regulatory domain.
  *
  * Returns one of the different reg request treatment values.
- *
- * Caller must hold &reg_mutex
  */
 static enum reg_request_treatment
 __regulatory_hint(struct wiphy *wiphy,
@@ -1570,21 +1551,19 @@ static void reg_process_pending_hints(void)
 {
         struct regulatory_request *reg_request, *lr;
 
-        mutex_lock(&cfg80211_mutex);
-        mutex_lock(&reg_mutex);
         lr = get_last_request();
 
         /* When last_request->processed becomes true this will be rescheduled */
         if (lr && !lr->processed) {
                 REG_DBG_PRINT("Pending regulatory request, waiting for it to be processed...\n");
-                goto out;
+                return;
         }
 
         spin_lock(&reg_requests_lock);
 
         if (list_empty(&reg_requests_list)) {
                 spin_unlock(&reg_requests_lock);
-                goto out;
+                return;
         }
 
         reg_request = list_first_entry(&reg_requests_list,
@@ -1595,10 +1574,6 @@ static void reg_process_pending_hints(void)
         spin_unlock(&reg_requests_lock);
 
         reg_process_hint(reg_request, reg_request->initiator);
-
-out:
-        mutex_unlock(&reg_mutex);
-        mutex_unlock(&cfg80211_mutex);
 }
 
 /* Processes beacon hints -- this has nothing to do with country IEs */
@@ -1607,9 +1582,6 @@ static void reg_process_pending_beacon_hints(void)
         struct cfg80211_registered_device *rdev;
         struct reg_beacon *pending_beacon, *tmp;
 
-        mutex_lock(&cfg80211_mutex);
-        mutex_lock(&reg_mutex);
-
         /* This goes through the _pending_ beacon list */
         spin_lock_bh(&reg_pending_beacons_lock);
 
@@ -1626,14 +1598,14 @@ static void reg_process_pending_beacon_hints(void)
         }
 
         spin_unlock_bh(&reg_pending_beacons_lock);
-        mutex_unlock(&reg_mutex);
-        mutex_unlock(&cfg80211_mutex);
 }
 
 static void reg_todo(struct work_struct *work)
 {
+        rtnl_lock();
         reg_process_pending_hints();
         reg_process_pending_beacon_hints();
+        rtnl_unlock();
 }
 
 static void queue_regulatory_request(struct regulatory_request *request)
@@ -1717,29 +1689,23 @@ int regulatory_hint(struct wiphy *wiphy, const char *alpha2)
 }
 EXPORT_SYMBOL(regulatory_hint);
 
-/*
- * We hold wdev_lock() here so we cannot hold cfg80211_mutex() and
- * therefore cannot iterate over the rdev list here.
- */
 void regulatory_hint_11d(struct wiphy *wiphy, enum ieee80211_band band,
                          const u8 *country_ie, u8 country_ie_len)
 {
         char alpha2[2];
         enum environment_cap env = ENVIRON_ANY;
-        struct regulatory_request *request, *lr;
-
-        mutex_lock(&reg_mutex);
-        lr = get_last_request();
-
-        if (unlikely(!lr))
-                goto out;
+        struct regulatory_request *request = NULL, *lr;
 
         /* IE len must be evenly divisible by 2 */
         if (country_ie_len & 0x01)
-                goto out;
+                return;
 
         if (country_ie_len < IEEE80211_COUNTRY_IE_MIN_LEN)
-                goto out;
+                return;
+
+        request = kzalloc(sizeof(*request), GFP_KERNEL);
+        if (!request)
+                return;
 
         alpha2[0] = country_ie[0];
         alpha2[1] = country_ie[1];
@@ -1749,19 +1715,21 @@ void regulatory_hint_11d(struct wiphy *wiphy, enum ieee80211_band band,
         else if (country_ie[2] == 'O')
                 env = ENVIRON_OUTDOOR;
 
+        rcu_read_lock();
+        lr = get_last_request();
+
+        if (unlikely(!lr))
+                goto out;
+
         /*
          * We will run this only upon a successful connection on cfg80211.
          * We leave conflict resolution to the workqueue, where can hold
-         * cfg80211_mutex.
+         * the RTNL.
          */
         if (lr->initiator == NL80211_REGDOM_SET_BY_COUNTRY_IE &&
             lr->wiphy_idx != WIPHY_IDX_INVALID)
                 goto out;
 
-        request = kzalloc(sizeof(struct regulatory_request), GFP_KERNEL);
-        if (!request)
-                goto out;
-
         request->wiphy_idx = get_wiphy_idx(wiphy);
         request->alpha2[0] = alpha2[0];
         request->alpha2[1] = alpha2[1];
@@ -1769,8 +1737,10 @@ void regulatory_hint_11d(struct wiphy *wiphy, enum ieee80211_band band,
         request->country_ie_env = env;
 
         queue_regulatory_request(request);
+        request = NULL;
 out:
-        mutex_unlock(&reg_mutex);
+        kfree(request);
+        rcu_read_unlock();
 }
 
 static void restore_alpha2(char *alpha2, bool reset_user)
@@ -1858,8 +1828,7 @@ static void restore_regulatory_settings(bool reset_user)
         LIST_HEAD(tmp_reg_req_list);
         struct cfg80211_registered_device *rdev;
 
-        mutex_lock(&cfg80211_mutex);
-        mutex_lock(&reg_mutex);
+        ASSERT_RTNL();
 
         reset_regdomains(true, &world_regdom);
         restore_alpha2(alpha2, reset_user);
@@ -1914,9 +1883,6 @@ static void restore_regulatory_settings(bool reset_user)
         list_splice_tail_init(&tmp_reg_req_list, &reg_requests_list);
         spin_unlock(&reg_requests_lock);
 
-        mutex_unlock(&reg_mutex);
-        mutex_unlock(&cfg80211_mutex);
-
         REG_DBG_PRINT("Kicking the queue\n");
 
         schedule_work(&reg_work);
@@ -2231,7 +2197,6 @@ int set_regdom(const struct ieee80211_regdomain *rd)
         struct regulatory_request *lr;
         int r;
 
-        mutex_lock(&reg_mutex);
         lr = get_last_request();
 
         /* Note that this doesn't update the wiphys, this is done below */
@@ -2241,14 +2206,12 @@ int set_regdom(const struct ieee80211_regdomain *rd)
                         reg_set_request_processed();
 
                 kfree(rd);
-                goto out;
+                return r;
         }
 
         /* This would make this whole thing pointless */
-        if (WARN_ON(!lr->intersect && rd != get_cfg80211_regdom())) {
-                r = -EINVAL;
-                goto out;
-        }
+        if (WARN_ON(!lr->intersect && rd != get_cfg80211_regdom()))
+                return -EINVAL;
 
         /* update all wiphys now with the new established regulatory domain */
         update_all_wiphy_regulatory(lr->initiator);
@@ -2259,10 +2222,7 @@ int set_regdom(const struct ieee80211_regdomain *rd)
 
         reg_set_request_processed();
 
- out:
-        mutex_unlock(&reg_mutex);
-
-        return r;
+        return 0;
 }
 
 int reg_device_uevent(struct device *dev, struct kobj_uevent_env *env)
@@ -2287,23 +2247,20 @@ int reg_device_uevent(struct device *dev, struct kobj_uevent_env *env)
 
 void wiphy_regulatory_register(struct wiphy *wiphy)
 {
-        mutex_lock(&reg_mutex);
+        struct regulatory_request *lr;
 
         if (!reg_dev_ignore_cell_hint(wiphy))
                 reg_num_devs_support_basehint++;
 
-        wiphy_update_regulatory(wiphy, NL80211_REGDOM_SET_BY_CORE);
-
-        mutex_unlock(&reg_mutex);
+        lr = get_last_request();
+        wiphy_update_regulatory(wiphy, lr->initiator);
 }
 
-/* Caller must hold cfg80211_mutex */
 void wiphy_regulatory_deregister(struct wiphy *wiphy)
 {
         struct wiphy *request_wiphy = NULL;
         struct regulatory_request *lr;
 
-        mutex_lock(&reg_mutex);
         lr = get_last_request();
 
         if (!reg_dev_ignore_cell_hint(wiphy))
@@ -2316,18 +2273,18 @@ void wiphy_regulatory_deregister(struct wiphy *wiphy)
                 request_wiphy = wiphy_idx_to_wiphy(lr->wiphy_idx);
 
         if (!request_wiphy || request_wiphy != wiphy)
-                goto out;
+                return;
 
         lr->wiphy_idx = WIPHY_IDX_INVALID;
         lr->country_ie_env = ENVIRON_ANY;
-out:
-        mutex_unlock(&reg_mutex);
 }
 
 static void reg_timeout_work(struct work_struct *work)
 {
         REG_DBG_PRINT("Timeout while waiting for CRDA to reply, restoring regulatory settings\n");
+        rtnl_lock();
         restore_regulatory_settings(true);
+        rtnl_unlock();
 }
 
 int __init regulatory_init(void)
@@ -2385,9 +2342,9 @@ void regulatory_exit(void)
         cancel_delayed_work_sync(&reg_timeout);
 
         /* Lock to suppress warnings */
-        mutex_lock(&reg_mutex);
+        rtnl_lock();
         reset_regdomains(true, NULL);
-        mutex_unlock(&reg_mutex);
+        rtnl_unlock();
 
         dev_set_uevent_suppress(&reg_pdev->dev, true);
 
diff --git a/net/wireless/scan.c b/net/wireless/scan.c
index fd99ea495b7e..eeb71480f1af 100644
--- a/net/wireless/scan.c
+++ b/net/wireless/scan.c
@@ -169,7 +169,7 @@ void ___cfg80211_scan_done(struct cfg80211_registered_device *rdev, bool leak)
         union iwreq_data wrqu;
 #endif
 
-        lockdep_assert_held(&rdev->sched_scan_mtx);
+        ASSERT_RTNL();
 
         request = rdev->scan_req;
 
@@ -230,9 +230,9 @@ void __cfg80211_scan_done(struct work_struct *wk)
         rdev = container_of(wk, struct cfg80211_registered_device,
                             scan_done_wk);
 
-        mutex_lock(&rdev->sched_scan_mtx);
+        rtnl_lock();
         ___cfg80211_scan_done(rdev, false);
-        mutex_unlock(&rdev->sched_scan_mtx);
+        rtnl_unlock();
 }
 
 void cfg80211_scan_done(struct cfg80211_scan_request *request, bool aborted)
@@ -241,6 +241,7 @@ void cfg80211_scan_done(struct cfg80211_scan_request *request, bool aborted)
         WARN_ON(request != wiphy_to_dev(request->wiphy)->scan_req);
 
         request->aborted = aborted;
+        request->notified = true;
         queue_work(cfg80211_wq, &wiphy_to_dev(request->wiphy)->scan_done_wk);
 }
 EXPORT_SYMBOL(cfg80211_scan_done);
@@ -255,7 +256,7 @@ void __cfg80211_sched_scan_results(struct work_struct *wk)
 
         request = rdev->sched_scan_req;
 
-        mutex_lock(&rdev->sched_scan_mtx);
+        rtnl_lock();
 
         /* we don't have sched_scan_req anymore if the scan is stopping */
         if (request) {
@@ -270,7 +271,7 @@ void __cfg80211_sched_scan_results(struct work_struct *wk)
                 nl80211_send_sched_scan_results(rdev, request->dev);
         }
 
-        mutex_unlock(&rdev->sched_scan_mtx);
+        rtnl_unlock();
 }
 
 void cfg80211_sched_scan_results(struct wiphy *wiphy)
@@ -289,9 +290,9 @@ void cfg80211_sched_scan_stopped(struct wiphy *wiphy)
 
         trace_cfg80211_sched_scan_stopped(wiphy);
 
-        mutex_lock(&rdev->sched_scan_mtx);
+        rtnl_lock();
         __cfg80211_stop_sched_scan(rdev, true);
-        mutex_unlock(&rdev->sched_scan_mtx);
+        rtnl_unlock();
 }
 EXPORT_SYMBOL(cfg80211_sched_scan_stopped);
 
@@ -300,7 +301,7 @@ int __cfg80211_stop_sched_scan(struct cfg80211_registered_device *rdev,
 {
         struct net_device *dev;
 
-        lockdep_assert_held(&rdev->sched_scan_mtx);
+        ASSERT_RTNL();
 
         if (!rdev->sched_scan_req)
                 return -ENOENT;
@@ -464,10 +465,6 @@ static int cmp_bss(struct cfg80211_bss *a,
                 }
         }
 
-        /*
-         * we can't use compare_ether_addr here since we need a < > operator.
-         * The binary return value of compare_ether_addr isn't enough
-         */
         r = memcmp(a->bssid, b->bssid, sizeof(a->bssid));
         if (r)
                 return r;
@@ -522,6 +519,7 @@ static int cmp_bss(struct cfg80211_bss *a,
         }
 }
 
+/* Returned bss is reference counted and must be cleaned up appropriately. */
 struct cfg80211_bss *cfg80211_get_bss(struct wiphy *wiphy,
                                       struct ieee80211_channel *channel,
                                       const u8 *bssid,
@@ -649,6 +647,8 @@ static bool cfg80211_combine_bsses(struct cfg80211_registered_device *dev,
                         continue;
                 if (bss->pub.channel != new->pub.channel)
                         continue;
+                if (bss->pub.scan_width != new->pub.scan_width)
+                        continue;
                 if (rcu_access_pointer(bss->pub.beacon_ies))
                         continue;
                 ies = rcu_access_pointer(bss->pub.ies);
@@ -677,6 +677,7 @@ static bool cfg80211_combine_bsses(struct cfg80211_registered_device *dev,
         return true;
 }
 
+/* Returned bss is reference counted and must be cleaned up appropriately. */
 static struct cfg80211_internal_bss *
 cfg80211_bss_update(struct cfg80211_registered_device *dev,
                     struct cfg80211_internal_bss *tmp)
@@ -865,12 +866,14 @@ cfg80211_get_bss_channel(struct wiphy *wiphy, const u8 *ie, size_t ielen,
         return channel;
 }
 
+/* Returned bss is reference counted and must be cleaned up appropriately. */
 struct cfg80211_bss*
-cfg80211_inform_bss(struct wiphy *wiphy,
-                    struct ieee80211_channel *channel,
-                    const u8 *bssid, u64 tsf, u16 capability,
-                    u16 beacon_interval, const u8 *ie, size_t ielen,
-                    s32 signal, gfp_t gfp)
+cfg80211_inform_bss_width(struct wiphy *wiphy,
+                          struct ieee80211_channel *channel,
+                          enum nl80211_bss_scan_width scan_width,
+                          const u8 *bssid, u64 tsf, u16 capability,
+                          u16 beacon_interval, const u8 *ie, size_t ielen,
+                          s32 signal, gfp_t gfp)
 {
         struct cfg80211_bss_ies *ies;
         struct cfg80211_internal_bss tmp = {}, *res;
@@ -888,6 +891,7 @@ cfg80211_inform_bss(struct wiphy *wiphy,
 
         memcpy(tmp.pub.bssid, bssid, ETH_ALEN);
         tmp.pub.channel = channel;
+        tmp.pub.scan_width = scan_width;
         tmp.pub.signal = signal;
         tmp.pub.beacon_interval = beacon_interval;
         tmp.pub.capability = capability;
@@ -920,13 +924,15 @@ cfg80211_inform_bss(struct wiphy *wiphy,
         /* cfg80211_bss_update gives us a referenced result */
         return &res->pub;
 }
-EXPORT_SYMBOL(cfg80211_inform_bss);
+EXPORT_SYMBOL(cfg80211_inform_bss_width);
 
+/* Returned bss is reference counted and must be cleaned up appropriately. */
 struct cfg80211_bss *
-cfg80211_inform_bss_frame(struct wiphy *wiphy,
-                          struct ieee80211_channel *channel,
-                          struct ieee80211_mgmt *mgmt, size_t len,
-                          s32 signal, gfp_t gfp)
+cfg80211_inform_bss_width_frame(struct wiphy *wiphy,
+                                struct ieee80211_channel *channel,
+                                enum nl80211_bss_scan_width scan_width,
+                                struct ieee80211_mgmt *mgmt, size_t len,
+                                s32 signal, gfp_t gfp)
 {
         struct cfg80211_internal_bss tmp = {}, *res;
         struct cfg80211_bss_ies *ies;
@@ -936,7 +942,8 @@ cfg80211_inform_bss_frame(struct wiphy *wiphy,
         BUILD_BUG_ON(offsetof(struct ieee80211_mgmt, u.probe_resp.variable) !=
                         offsetof(struct ieee80211_mgmt, u.beacon.variable));
 
-        trace_cfg80211_inform_bss_frame(wiphy, channel, mgmt, len, signal);
+        trace_cfg80211_inform_bss_width_frame(wiphy, channel, scan_width, mgmt,
+                                              len, signal);
 
         if (WARN_ON(!mgmt))
                 return NULL;
@@ -971,6 +978,7 @@ cfg80211_inform_bss_frame(struct wiphy *wiphy,
         
         memcpy(tmp.pub.bssid, mgmt->bssid, ETH_ALEN);
         tmp.pub.channel = channel;
+        tmp.pub.scan_width = scan_width;
         tmp.pub.signal = signal;
         tmp.pub.beacon_interval = le16_to_cpu(mgmt->u.probe_resp.beacon_int);
         tmp.pub.capability = le16_to_cpu(mgmt->u.probe_resp.capab_info);
@@ -986,7 +994,7 @@ cfg80211_inform_bss_frame(struct wiphy *wiphy,
         /* cfg80211_bss_update gives us a referenced result */
         return &res->pub;
 }
-EXPORT_SYMBOL(cfg80211_inform_bss_frame);
+EXPORT_SYMBOL(cfg80211_inform_bss_width_frame);
 
 void cfg80211_ref_bss(struct wiphy *wiphy, struct cfg80211_bss *pub)
 {
@@ -1040,6 +1048,25 @@ void cfg80211_unlink_bss(struct wiphy *wiphy, struct cfg80211_bss *pub)
 EXPORT_SYMBOL(cfg80211_unlink_bss);
 
 #ifdef CONFIG_CFG80211_WEXT
+static struct cfg80211_registered_device *
+cfg80211_get_dev_from_ifindex(struct net *net, int ifindex)
+{
+        struct cfg80211_registered_device *rdev;
+        struct net_device *dev;
+
+        ASSERT_RTNL();
+
+        dev = dev_get_by_index(net, ifindex);
+        if (!dev)
+                return ERR_PTR(-ENODEV);
+        if (dev->ieee80211_ptr)
+                rdev = wiphy_to_dev(dev->ieee80211_ptr->wiphy);
+        else
+                rdev = ERR_PTR(-ENODEV);
+        dev_put(dev);
+        return rdev;
+}
+
 int cfg80211_wext_siwscan(struct net_device *dev,
                           struct iw_request_info *info,
                           union iwreq_data *wrqu, char *extra)
@@ -1062,7 +1089,6 @@ int cfg80211_wext_siwscan(struct net_device *dev,
         if (IS_ERR(rdev))
                 return PTR_ERR(rdev);
 
-        mutex_lock(&rdev->sched_scan_mtx);
         if (rdev->scan_req) {
                 err = -EBUSY;
                 goto out;
@@ -1169,9 +1195,7 @@ int cfg80211_wext_siwscan(struct net_device *dev,
                 dev_hold(dev);
         }
  out:
-        mutex_unlock(&rdev->sched_scan_mtx);
         kfree(creq);
-        cfg80211_unlock_rdev(rdev);
         return err;
 }
 EXPORT_SYMBOL_GPL(cfg80211_wext_siwscan);
@@ -1470,10 +1494,8 @@ int cfg80211_wext_giwscan(struct net_device *dev,
         if (IS_ERR(rdev))
                 return PTR_ERR(rdev);
 
-        if (rdev->scan_req) {
-                res = -EAGAIN;
-                goto out;
-        }
+        if (rdev->scan_req)
+                return -EAGAIN;
 
         res = ieee80211_scan_results(rdev, info, extra, data->length);
         data->length = 0;
@@ -1482,8 +1504,6 @@ int cfg80211_wext_giwscan(struct net_device *dev,
                 res = 0;
         }
 
- out:
-        cfg80211_unlock_rdev(rdev);
         return res;
 }
 EXPORT_SYMBOL_GPL(cfg80211_wext_giwscan);
diff --git a/net/wireless/sme.c b/net/wireless/sme.c
index 3ed35c345cae..20e86a95dc4e 100644
--- a/net/wireless/sme.c
+++ b/net/wireless/sme.c
@@ -1,5 +1,7 @@
 /*
- * SME code for cfg80211's connect emulation.
+ * SME code for cfg80211
+ * both driver SME event handling and the SME implementation
+ * (for nl80211's connect() and wext)
  *
  * Copyright 2009       Johannes Berg <johannes@sipsolutions.net>
  * Copyright (C) 2009   Intel Corporation. All rights reserved.
@@ -18,18 +20,26 @@
 #include "reg.h"
 #include "rdev-ops.h"
 
+/*
+ * Software SME in cfg80211, using auth/assoc/deauth calls to the
+ * driver. This is is for implementing nl80211's connect/disconnect
+ * and wireless extensions (if configured.)
+ */
+
 struct cfg80211_conn {
         struct cfg80211_connect_params params;
         /* these are sub-states of the _CONNECTING sme_state */
         enum {
-                CFG80211_CONN_IDLE,
                 CFG80211_CONN_SCANNING,
                 CFG80211_CONN_SCAN_AGAIN,
                 CFG80211_CONN_AUTHENTICATE_NEXT,
                 CFG80211_CONN_AUTHENTICATING,
+                CFG80211_CONN_AUTH_FAILED,
                 CFG80211_CONN_ASSOCIATE_NEXT,
                 CFG80211_CONN_ASSOCIATING,
-                CFG80211_CONN_DEAUTH_ASSOC_FAIL,
+                CFG80211_CONN_ASSOC_FAILED,
+                CFG80211_CONN_DEAUTH,
+                CFG80211_CONN_CONNECTED,
         } state;
         u8 bssid[ETH_ALEN], prev_bssid[ETH_ALEN];
         u8 *ie;
@@ -37,45 +47,16 @@ struct cfg80211_conn {
         bool auto_auth, prev_bssid_valid;
 };
 
-static bool cfg80211_is_all_idle(void)
-{
-        struct cfg80211_registered_device *rdev;
-        struct wireless_dev *wdev;
-        bool is_all_idle = true;
-
-        mutex_lock(&cfg80211_mutex);
-
-        /*
-         * All devices must be idle as otherwise if you are actively
-         * scanning some new beacon hints could be learned and would
-         * count as new regulatory hints.
-         */
-        list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
-                cfg80211_lock_rdev(rdev);
-                list_for_each_entry(wdev, &rdev->wdev_list, list) {
-                        wdev_lock(wdev);
-                        if (wdev->sme_state != CFG80211_SME_IDLE)
-                                is_all_idle = false;
-                        wdev_unlock(wdev);
-                }
-                cfg80211_unlock_rdev(rdev);
-        }
-
-        mutex_unlock(&cfg80211_mutex);
-
-        return is_all_idle;
-}
-
-static void disconnect_work(struct work_struct *work)
+static void cfg80211_sme_free(struct wireless_dev *wdev)
 {
-        if (!cfg80211_is_all_idle())
+        if (!wdev->conn)
                 return;
 
-        regulatory_hint_disconnect();
+        kfree(wdev->conn->ie);
+        kfree(wdev->conn);
+        wdev->conn = NULL;
 }
 
-static DECLARE_WORK(cfg80211_disconnect_work, disconnect_work);
-
 static int cfg80211_conn_scan(struct wireless_dev *wdev)
 {
         struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
@@ -85,7 +66,6 @@ static int cfg80211_conn_scan(struct wireless_dev *wdev)
         ASSERT_RTNL();
         ASSERT_RDEV_LOCK(rdev);
         ASSERT_WDEV_LOCK(wdev);
-        lockdep_assert_held(&rdev->sched_scan_mtx);
 
         if (rdev->scan_req)
                 return -EBUSY;
@@ -171,18 +151,23 @@ static int cfg80211_conn_do_work(struct wireless_dev *wdev)
         params = &wdev->conn->params;
 
         switch (wdev->conn->state) {
+        case CFG80211_CONN_SCANNING:
+                /* didn't find it during scan ... */
+                return -ENOENT;
         case CFG80211_CONN_SCAN_AGAIN:
                 return cfg80211_conn_scan(wdev);
         case CFG80211_CONN_AUTHENTICATE_NEXT:
                 BUG_ON(!rdev->ops->auth);
                 wdev->conn->state = CFG80211_CONN_AUTHENTICATING;
-                return __cfg80211_mlme_auth(rdev, wdev->netdev,
-                                            params->channel, params->auth_type,
-                                            params->bssid,
-                                            params->ssid, params->ssid_len,
-                                            NULL, 0,
-                                            params->key, params->key_len,
-                                            params->key_idx, NULL, 0);
+                return cfg80211_mlme_auth(rdev, wdev->netdev,
+                                          params->channel, params->auth_type,
+                                          params->bssid,
+                                          params->ssid, params->ssid_len,
+                                          NULL, 0,
+                                          params->key, params->key_len,
+                                          params->key_idx, NULL, 0);
+        case CFG80211_CONN_AUTH_FAILED:
+                return -ENOTCONN;
         case CFG80211_CONN_ASSOCIATE_NEXT:
                 BUG_ON(!rdev->ops->assoc);
                 wdev->conn->state = CFG80211_CONN_ASSOCIATING;
@@ -198,21 +183,27 @@ static int cfg80211_conn_do_work(struct wireless_dev *wdev)
                 req.vht_capa = params->vht_capa;
                 req.vht_capa_mask = params->vht_capa_mask;
 
-                err = __cfg80211_mlme_assoc(rdev, wdev->netdev, params->channel,
-                                            params->bssid, params->ssid,
-                                            params->ssid_len, &req);
+                err = cfg80211_mlme_assoc(rdev, wdev->netdev, params->channel,
+                                          params->bssid, params->ssid,
+                                          params->ssid_len, &req);
                 if (err)
-                        __cfg80211_mlme_deauth(rdev, wdev->netdev, params->bssid,
-                                               NULL, 0,
-                                               WLAN_REASON_DEAUTH_LEAVING,
-                                               false);
+                        cfg80211_mlme_deauth(rdev, wdev->netdev, params->bssid,
+                                             NULL, 0,
+                                             WLAN_REASON_DEAUTH_LEAVING,
+                                             false);
                 return err;
-        case CFG80211_CONN_DEAUTH_ASSOC_FAIL:
-                __cfg80211_mlme_deauth(rdev, wdev->netdev, params->bssid,
-                                       NULL, 0,
-                                       WLAN_REASON_DEAUTH_LEAVING, false);
-                /* return an error so that we call __cfg80211_connect_result() */
-                return -EINVAL;
+        case CFG80211_CONN_ASSOC_FAILED:
+                cfg80211_mlme_deauth(rdev, wdev->netdev, params->bssid,
+                                     NULL, 0,
+                                     WLAN_REASON_DEAUTH_LEAVING, false);
+                return -ENOTCONN;
+        case CFG80211_CONN_DEAUTH:
+                cfg80211_mlme_deauth(rdev, wdev->netdev, params->bssid,
+                                     NULL, 0,
+                                     WLAN_REASON_DEAUTH_LEAVING, false);
+                /* free directly, disconnected event already sent */
+                cfg80211_sme_free(wdev);
+                return 0;
         default:
                 return 0;
         }
@@ -226,9 +217,6 @@ void cfg80211_conn_work(struct work_struct *work)
         u8 bssid_buf[ETH_ALEN], *bssid = NULL;
 
         rtnl_lock();
-        cfg80211_lock_rdev(rdev);
-        mutex_lock(&rdev->devlist_mtx);
-        mutex_lock(&rdev->sched_scan_mtx);
 
         list_for_each_entry(wdev, &rdev->wdev_list, list) {
                 if (!wdev->netdev)
@@ -239,7 +227,8 @@ void cfg80211_conn_work(struct work_struct *work)
                         wdev_unlock(wdev);
                         continue;
                 }
-                if (wdev->sme_state != CFG80211_SME_CONNECTING || !wdev->conn) {
+                if (!wdev->conn ||
+                    wdev->conn->state == CFG80211_CONN_CONNECTED) {
                         wdev_unlock(wdev);
                         continue;
                 }
@@ -247,21 +236,21 @@ void cfg80211_conn_work(struct work_struct *work)
                         memcpy(bssid_buf, wdev->conn->params.bssid, ETH_ALEN);
                         bssid = bssid_buf;
                 }
-                if (cfg80211_conn_do_work(wdev))
+                if (cfg80211_conn_do_work(wdev)) {
                         __cfg80211_connect_result(
                                         wdev->netdev, bssid,
                                         NULL, 0, NULL, 0,
                                         WLAN_STATUS_UNSPECIFIED_FAILURE,
                                         false, NULL);
+                        cfg80211_sme_free(wdev);
+                }
                 wdev_unlock(wdev);
         }
 
-        mutex_unlock(&rdev->sched_scan_mtx);
-        mutex_unlock(&rdev->devlist_mtx);
-        cfg80211_unlock_rdev(rdev);
         rtnl_unlock();
 }
 
+/* Returned bss is reference counted and must be cleaned up appropriately. */
 static struct cfg80211_bss *cfg80211_get_conn_bss(struct wireless_dev *wdev)
 {
         struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
@@ -299,9 +288,6 @@ static void __cfg80211_sme_scan_done(struct net_device *dev)
 
         ASSERT_WDEV_LOCK(wdev);
 
-        if (wdev->sme_state != CFG80211_SME_CONNECTING)
-                return;
-
         if (!wdev->conn)
                 return;
 
@@ -310,20 +296,10 @@ static void __cfg80211_sme_scan_done(struct net_device *dev)
                 return;
 
         bss = cfg80211_get_conn_bss(wdev);
-        if (bss) {
+        if (bss)
                 cfg80211_put_bss(&rdev->wiphy, bss);
-        } else {
-                /* not found */
-                if (wdev->conn->state == CFG80211_CONN_SCAN_AGAIN)
-                        schedule_work(&rdev->conn_work);
-                else
-                        __cfg80211_connect_result(
-                                        wdev->netdev,
-                                        wdev->conn->params.bssid,
-                                        NULL, 0, NULL, 0,
-                                        WLAN_STATUS_UNSPECIFIED_FAILURE,
-                                        false, NULL);
-        }
+        else
+                schedule_work(&rdev->conn_work);
 }
 
 void cfg80211_sme_scan_done(struct net_device *dev)
@@ -335,10 +311,8 @@ void cfg80211_sme_scan_done(struct net_device *dev)
         wdev_unlock(wdev);
 }
 
-void cfg80211_sme_rx_auth(struct net_device *dev,
-                          const u8 *buf, size_t len)
+void cfg80211_sme_rx_auth(struct wireless_dev *wdev, const u8 *buf, size_t len)
 {
-        struct wireless_dev *wdev = dev->ieee80211_ptr;
         struct wiphy *wiphy = wdev->wiphy;
         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
         struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *)buf;
@@ -346,11 +320,7 @@ void cfg80211_sme_rx_auth(struct net_device *dev,
 
         ASSERT_WDEV_LOCK(wdev);
 
-        /* should only RX auth frames when connecting */
-        if (wdev->sme_state != CFG80211_SME_CONNECTING)
-                return;
-
-        if (WARN_ON(!wdev->conn))
+        if (!wdev->conn || wdev->conn->state == CFG80211_CONN_CONNECTED)
                 return;
 
         if (status_code == WLAN_STATUS_NOT_SUPPORTED_AUTH_ALG &&
@@ -379,46 +349,239 @@ void cfg80211_sme_rx_auth(struct net_device *dev,
                 wdev->conn->state = CFG80211_CONN_AUTHENTICATE_NEXT;
                 schedule_work(&rdev->conn_work);
         } else if (status_code != WLAN_STATUS_SUCCESS) {
-                __cfg80211_connect_result(dev, mgmt->bssid, NULL, 0, NULL, 0,
+                __cfg80211_connect_result(wdev->netdev, mgmt->bssid,
+                                          NULL, 0, NULL, 0,
                                           status_code, false, NULL);
-        } else if (wdev->sme_state == CFG80211_SME_CONNECTING &&
-                 wdev->conn->state == CFG80211_CONN_AUTHENTICATING) {
+        } else if (wdev->conn->state == CFG80211_CONN_AUTHENTICATING) {
                 wdev->conn->state = CFG80211_CONN_ASSOCIATE_NEXT;
                 schedule_work(&rdev->conn_work);
         }
 }
 
-bool cfg80211_sme_failed_reassoc(struct wireless_dev *wdev)
+bool cfg80211_sme_rx_assoc_resp(struct wireless_dev *wdev, u16 status)
 {
-        struct wiphy *wiphy = wdev->wiphy;
-        struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
+        struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
 
-        if (WARN_ON(!wdev->conn))
+        if (!wdev->conn)
                 return false;
 
-        if (!wdev->conn->prev_bssid_valid)
+        if (status == WLAN_STATUS_SUCCESS) {
+                wdev->conn->state = CFG80211_CONN_CONNECTED;
                 return false;
+        }
 
-        /*
-         * Some stupid APs don't accept reassoc, so we
-         * need to fall back to trying regular assoc.
-         */
-        wdev->conn->prev_bssid_valid = false;
-        wdev->conn->state = CFG80211_CONN_ASSOCIATE_NEXT;
+        if (wdev->conn->prev_bssid_valid) {
+                /*
+                 * Some stupid APs don't accept reassoc, so we
+                 * need to fall back to trying regular assoc;
+                 * return true so no event is sent to userspace.
+                 */
+                wdev->conn->prev_bssid_valid = false;
+                wdev->conn->state = CFG80211_CONN_ASSOCIATE_NEXT;
+                schedule_work(&rdev->conn_work);
+                return true;
+        }
+
+        wdev->conn->state = CFG80211_CONN_ASSOC_FAILED;
         schedule_work(&rdev->conn_work);
+        return false;
+}
 
-        return true;
+void cfg80211_sme_deauth(struct wireless_dev *wdev)
+{
+        cfg80211_sme_free(wdev);
 }
 
-void cfg80211_sme_failed_assoc(struct wireless_dev *wdev)
+void cfg80211_sme_auth_timeout(struct wireless_dev *wdev)
 {
-        struct wiphy *wiphy = wdev->wiphy;
-        struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
+        struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
+
+        if (!wdev->conn)
+                return;
+
+        wdev->conn->state = CFG80211_CONN_AUTH_FAILED;
+        schedule_work(&rdev->conn_work);
+}
+
+void cfg80211_sme_disassoc(struct wireless_dev *wdev)
+{
+        struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
+
+        if (!wdev->conn)
+                return;
 
-        wdev->conn->state = CFG80211_CONN_DEAUTH_ASSOC_FAIL;
+        wdev->conn->state = CFG80211_CONN_DEAUTH;
         schedule_work(&rdev->conn_work);
 }
 
+void cfg80211_sme_assoc_timeout(struct wireless_dev *wdev)
+{
+        struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
+
+        if (!wdev->conn)
+                return;
+
+        wdev->conn->state = CFG80211_CONN_ASSOC_FAILED;
+        schedule_work(&rdev->conn_work);
+}
+
+static int cfg80211_sme_connect(struct wireless_dev *wdev,
+                                struct cfg80211_connect_params *connect,
+                                const u8 *prev_bssid)
+{
+        struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
+        struct cfg80211_bss *bss;
+        int err;
+
+        if (!rdev->ops->auth || !rdev->ops->assoc)
+                return -EOPNOTSUPP;
+
+        if (wdev->current_bss)
+                return -EALREADY;
+
+        if (WARN_ON(wdev->conn))
+                return -EINPROGRESS;
+
+        wdev->conn = kzalloc(sizeof(*wdev->conn), GFP_KERNEL);
+        if (!wdev->conn)
+                return -ENOMEM;
+
+        /*
+         * Copy all parameters, and treat explicitly IEs, BSSID, SSID.
+         */
+        memcpy(&wdev->conn->params, connect, sizeof(*connect));
+        if (connect->bssid) {
+                wdev->conn->params.bssid = wdev->conn->bssid;
+                memcpy(wdev->conn->bssid, connect->bssid, ETH_ALEN);
+        }
+
+        if (connect->ie) {
+                wdev->conn->ie = kmemdup(connect->ie, connect->ie_len,
+                                        GFP_KERNEL);
+                wdev->conn->params.ie = wdev->conn->ie;
+                if (!wdev->conn->ie) {
+                        kfree(wdev->conn);
+                        wdev->conn = NULL;
+                        return -ENOMEM;
+                }
+        }
+
+        if (connect->auth_type == NL80211_AUTHTYPE_AUTOMATIC) {
+                wdev->conn->auto_auth = true;
+                /* start with open system ... should mostly work */
+                wdev->conn->params.auth_type =
+                        NL80211_AUTHTYPE_OPEN_SYSTEM;
+        } else {
+                wdev->conn->auto_auth = false;
+        }
+
+        wdev->conn->params.ssid = wdev->ssid;
+        wdev->conn->params.ssid_len = connect->ssid_len;
+
+        /* see if we have the bss already */
+        bss = cfg80211_get_conn_bss(wdev);
+
+        if (prev_bssid) {
+                memcpy(wdev->conn->prev_bssid, prev_bssid, ETH_ALEN);
+                wdev->conn->prev_bssid_valid = true;
+        }
+
+        /* we're good if we have a matching bss struct */
+        if (bss) {
+                wdev->conn->state = CFG80211_CONN_AUTHENTICATE_NEXT;
+                err = cfg80211_conn_do_work(wdev);
+                cfg80211_put_bss(wdev->wiphy, bss);
+        } else {
+                /* otherwise we'll need to scan for the AP first */
+                err = cfg80211_conn_scan(wdev);
+
+                /*
+                 * If we can't scan right now, then we need to scan again
+                 * after the current scan finished, since the parameters
+                 * changed (unless we find a good AP anyway).
+                 */
+                if (err == -EBUSY) {
+                        err = 0;
+                        wdev->conn->state = CFG80211_CONN_SCAN_AGAIN;
+                }
+        }
+
+        if (err)
+                cfg80211_sme_free(wdev);
+
+        return err;
+}
+
+static int cfg80211_sme_disconnect(struct wireless_dev *wdev, u16 reason)
+{
+        struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
+        int err;
+
+        if (!wdev->conn)
+                return 0;
+
+        if (!rdev->ops->deauth)
+                return -EOPNOTSUPP;
+
+        if (wdev->conn->state == CFG80211_CONN_SCANNING ||
+            wdev->conn->state == CFG80211_CONN_SCAN_AGAIN) {
+                err = 0;
+                goto out;
+        }
+
+        /* wdev->conn->params.bssid must be set if > SCANNING */
+        err = cfg80211_mlme_deauth(rdev, wdev->netdev,
+                                   wdev->conn->params.bssid,
+                                   NULL, 0, reason, false);
+ out:
+        cfg80211_sme_free(wdev);
+        return err;
+}
+
+/*
+ * code shared for in-device and software SME
+ */
+
+static bool cfg80211_is_all_idle(void)
+{
+        struct cfg80211_registered_device *rdev;
+        struct wireless_dev *wdev;
+        bool is_all_idle = true;
+
+        /*
+         * All devices must be idle as otherwise if you are actively
+         * scanning some new beacon hints could be learned and would
+         * count as new regulatory hints.
+         */
+        list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
+                list_for_each_entry(wdev, &rdev->wdev_list, list) {
+                        wdev_lock(wdev);
+                        if (wdev->conn || wdev->current_bss)
+                                is_all_idle = false;
+                        wdev_unlock(wdev);
+                }
+        }
+
+        return is_all_idle;
+}
+
+static void disconnect_work(struct work_struct *work)
+{
+        rtnl_lock();
+        if (cfg80211_is_all_idle())
+                regulatory_hint_disconnect();
+        rtnl_unlock();
+}
+
+static DECLARE_WORK(cfg80211_disconnect_work, disconnect_work);
+
+
+/*
+ * API calls for drivers implementing connect/disconnect and
+ * SME event handling
+ */
+
+/* This method must consume bss one way or another */
 void __cfg80211_connect_result(struct net_device *dev, const u8 *bssid,
                                const u8 *req_ie, size_t req_ie_len,
                                const u8 *resp_ie, size_t resp_ie_len,
@@ -434,11 +597,10 @@ void __cfg80211_connect_result(struct net_device *dev, const u8 *bssid,
         ASSERT_WDEV_LOCK(wdev);
 
         if (WARN_ON(wdev->iftype != NL80211_IFTYPE_STATION &&
-                    wdev->iftype != NL80211_IFTYPE_P2P_CLIENT))
-                return;
-
-        if (wdev->sme_state != CFG80211_SME_CONNECTING)
+                    wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)) {
+                cfg80211_put_bss(wdev->wiphy, bss);
                 return;
+        }
 
         nl80211_send_connect_result(wiphy_to_dev(wdev->wiphy), dev,
                                     bssid, req_ie, req_ie_len,
@@ -476,38 +638,30 @@ void __cfg80211_connect_result(struct net_device *dev, const u8 *bssid,
                 wdev->current_bss = NULL;
         }
 
-        if (wdev->conn)
-                wdev->conn->state = CFG80211_CONN_IDLE;
-
         if (status != WLAN_STATUS_SUCCESS) {
-                wdev->sme_state = CFG80211_SME_IDLE;
-                if (wdev->conn)
-                        kfree(wdev->conn->ie);
-                kfree(wdev->conn);
-                wdev->conn = NULL;
                 kfree(wdev->connect_keys);
                 wdev->connect_keys = NULL;
                 wdev->ssid_len = 0;
-                cfg80211_put_bss(wdev->wiphy, bss);
+                if (bss) {
+                        cfg80211_unhold_bss(bss_from_pub(bss));
+                        cfg80211_put_bss(wdev->wiphy, bss);
+                }
                 return;
         }
 
-        if (!bss)
-                bss = cfg80211_get_bss(wdev->wiphy,
-                                       wdev->conn ? wdev->conn->params.channel :
-                                       NULL,
-                                       bssid,
+        if (!bss) {
+                WARN_ON_ONCE(!wiphy_to_dev(wdev->wiphy)->ops->connect);
+                bss = cfg80211_get_bss(wdev->wiphy, NULL, bssid,
                                        wdev->ssid, wdev->ssid_len,
                                        WLAN_CAPABILITY_ESS,
                                        WLAN_CAPABILITY_ESS);
+                if (WARN_ON(!bss))
+                        return;
+                cfg80211_hold_bss(bss_from_pub(bss));
+        }
 
-        if (WARN_ON(!bss))
-                return;
-
-        cfg80211_hold_bss(bss_from_pub(bss));
         wdev->current_bss = bss_from_pub(bss);
 
-        wdev->sme_state = CFG80211_SME_CONNECTED;
         cfg80211_upload_connect_keys(wdev);
 
         rcu_read_lock();
@@ -543,8 +697,6 @@ void cfg80211_connect_result(struct net_device *dev, const u8 *bssid,
         struct cfg80211_event *ev;
         unsigned long flags;
 
-        CFG80211_DEV_WARN_ON(wdev->sme_state != CFG80211_SME_CONNECTING);
-
         ev = kzalloc(sizeof(*ev) + req_ie_len + resp_ie_len, gfp);
         if (!ev)
                 return;
@@ -571,6 +723,7 @@ void cfg80211_connect_result(struct net_device *dev, const u8 *bssid,
 }
 EXPORT_SYMBOL(cfg80211_connect_result);
 
+/* Consumes bss object one way or another */
 void __cfg80211_roamed(struct wireless_dev *wdev,
                        struct cfg80211_bss *bss,
                        const u8 *req_ie, size_t req_ie_len,
@@ -585,14 +738,9 @@ void __cfg80211_roamed(struct wireless_dev *wdev,
                     wdev->iftype != NL80211_IFTYPE_P2P_CLIENT))
                 goto out;
 
-        if (wdev->sme_state != CFG80211_SME_CONNECTED)
+        if (WARN_ON(!wdev->current_bss))
                 goto out;
 
-        /* internal error -- how did we get to CONNECTED w/o BSS? */
-        if (WARN_ON(!wdev->current_bss)) {
-                goto out;
-        }
-
         cfg80211_unhold_bss(wdev->current_bss);
         cfg80211_put_bss(wdev->wiphy, &wdev->current_bss->pub);
         wdev->current_bss = NULL;
@@ -641,8 +789,6 @@ void cfg80211_roamed(struct net_device *dev,
         struct wireless_dev *wdev = dev->ieee80211_ptr;
         struct cfg80211_bss *bss;
 
-        CFG80211_DEV_WARN_ON(wdev->sme_state != CFG80211_SME_CONNECTED);
-
         bss = cfg80211_get_bss(wdev->wiphy, channel, bssid, wdev->ssid,
                                wdev->ssid_len, WLAN_CAPABILITY_ESS,
                                WLAN_CAPABILITY_ESS);
@@ -654,6 +800,7 @@ void cfg80211_roamed(struct net_device *dev,
 }
 EXPORT_SYMBOL(cfg80211_roamed);
 
+/* Consumes bss object one way or another */
 void cfg80211_roamed_bss(struct net_device *dev,
                          struct cfg80211_bss *bss, const u8 *req_ie,
                          size_t req_ie_len, const u8 *resp_ie,
@@ -664,8 +811,6 @@ void cfg80211_roamed_bss(struct net_device *dev,
         struct cfg80211_event *ev;
         unsigned long flags;
 
-        CFG80211_DEV_WARN_ON(wdev->sme_state != CFG80211_SME_CONNECTED);
-
         if (WARN_ON(!bss))
                 return;
 
@@ -707,25 +852,14 @@ void __cfg80211_disconnected(struct net_device *dev, const u8 *ie,
                     wdev->iftype != NL80211_IFTYPE_P2P_CLIENT))
                 return;
 
-        if (wdev->sme_state != CFG80211_SME_CONNECTED)
-                return;
-
         if (wdev->current_bss) {
                 cfg80211_unhold_bss(wdev->current_bss);
                 cfg80211_put_bss(wdev->wiphy, &wdev->current_bss->pub);
         }
 
         wdev->current_bss = NULL;
-        wdev->sme_state = CFG80211_SME_IDLE;
         wdev->ssid_len = 0;
 
-        if (wdev->conn) {
-                kfree(wdev->conn->ie);
-                wdev->conn->ie = NULL;
-                kfree(wdev->conn);
-                wdev->conn = NULL;
-        }
-
         nl80211_send_disconnected(rdev, dev, reason, ie, ie_len, from_ap);
 
         /*
@@ -754,8 +888,6 @@ void cfg80211_disconnected(struct net_device *dev, u16 reason,
         struct cfg80211_event *ev;
         unsigned long flags;
 
-        CFG80211_DEV_WARN_ON(wdev->sme_state != CFG80211_SME_CONNECTED);
-
         ev = kzalloc(sizeof(*ev) + ie_len, gfp);
         if (!ev)
                 return;
@@ -773,21 +905,20 @@ void cfg80211_disconnected(struct net_device *dev, u16 reason,
 }
 EXPORT_SYMBOL(cfg80211_disconnected);
 
-int __cfg80211_connect(struct cfg80211_registered_device *rdev,
-                       struct net_device *dev,
-                       struct cfg80211_connect_params *connect,
-                       struct cfg80211_cached_keys *connkeys,
-                       const u8 *prev_bssid)
+/*
+ * API calls for nl80211/wext compatibility code
+ */
+int cfg80211_connect(struct cfg80211_registered_device *rdev,
+                     struct net_device *dev,
+                     struct cfg80211_connect_params *connect,
+                     struct cfg80211_cached_keys *connkeys,
+                     const u8 *prev_bssid)
 {
         struct wireless_dev *wdev = dev->ieee80211_ptr;
-        struct cfg80211_bss *bss = NULL;
         int err;
 
         ASSERT_WDEV_LOCK(wdev);
 
-        if (wdev->sme_state != CFG80211_SME_IDLE)
-                return -EALREADY;
-
         if (WARN_ON(wdev->connect_keys)) {
                 kfree(wdev->connect_keys);
                 wdev->connect_keys = NULL;
@@ -823,219 +954,41 @@ int __cfg80211_connect(struct cfg80211_registered_device *rdev,
                 }
         }
 
-        if (!rdev->ops->connect) {
-                if (!rdev->ops->auth || !rdev->ops->assoc)
-                        return -EOPNOTSUPP;
-
-                if (WARN_ON(wdev->conn))
-                        return -EINPROGRESS;
+        wdev->connect_keys = connkeys;
+        memcpy(wdev->ssid, connect->ssid, connect->ssid_len);
+        wdev->ssid_len = connect->ssid_len;
 
-                wdev->conn = kzalloc(sizeof(*wdev->conn), GFP_KERNEL);
-                if (!wdev->conn)
-                        return -ENOMEM;
-
-                /*
-                 * Copy all parameters, and treat explicitly IEs, BSSID, SSID.
-                 */
-                memcpy(&wdev->conn->params, connect, sizeof(*connect));
-                if (connect->bssid) {
-                        wdev->conn->params.bssid = wdev->conn->bssid;
-                        memcpy(wdev->conn->bssid, connect->bssid, ETH_ALEN);
-                }
-
-                if (connect->ie) {
-                        wdev->conn->ie = kmemdup(connect->ie, connect->ie_len,
-                                                GFP_KERNEL);
-                        wdev->conn->params.ie = wdev->conn->ie;
-                        if (!wdev->conn->ie) {
-                                kfree(wdev->conn);
-                                wdev->conn = NULL;
-                                return -ENOMEM;
-                        }
-                }
-
-                if (connect->auth_type == NL80211_AUTHTYPE_AUTOMATIC) {
-                        wdev->conn->auto_auth = true;
-                        /* start with open system ... should mostly work */
-                        wdev->conn->params.auth_type =
-                                NL80211_AUTHTYPE_OPEN_SYSTEM;
-                } else {
-                        wdev->conn->auto_auth = false;
-                }
-
-                memcpy(wdev->ssid, connect->ssid, connect->ssid_len);
-                wdev->ssid_len = connect->ssid_len;
-                wdev->conn->params.ssid = wdev->ssid;
-                wdev->conn->params.ssid_len = connect->ssid_len;
-
-                /* see if we have the bss already */
-                bss = cfg80211_get_conn_bss(wdev);
-
-                wdev->sme_state = CFG80211_SME_CONNECTING;
-                wdev->connect_keys = connkeys;
-
-                if (prev_bssid) {
-                        memcpy(wdev->conn->prev_bssid, prev_bssid, ETH_ALEN);
-                        wdev->conn->prev_bssid_valid = true;
-                }
-
-                /* we're good if we have a matching bss struct */
-                if (bss) {
-                        wdev->conn->state = CFG80211_CONN_AUTHENTICATE_NEXT;
-                        err = cfg80211_conn_do_work(wdev);
-                        cfg80211_put_bss(wdev->wiphy, bss);
-                } else {
-                        /* otherwise we'll need to scan for the AP first */
-                        err = cfg80211_conn_scan(wdev);
-                        /*
-                         * If we can't scan right now, then we need to scan again
-                         * after the current scan finished, since the parameters
-                         * changed (unless we find a good AP anyway).
-                         */
-                        if (err == -EBUSY) {
-                                err = 0;
-                                wdev->conn->state = CFG80211_CONN_SCAN_AGAIN;
-                        }
-                }
-                if (err) {
-                        kfree(wdev->conn->ie);
-                        kfree(wdev->conn);
-                        wdev->conn = NULL;
-                        wdev->sme_state = CFG80211_SME_IDLE;
-                        wdev->connect_keys = NULL;
-                        wdev->ssid_len = 0;
-                }
-
-                return err;
-        } else {
-                wdev->sme_state = CFG80211_SME_CONNECTING;
-                wdev->connect_keys = connkeys;
+        if (!rdev->ops->connect)
+                err = cfg80211_sme_connect(wdev, connect, prev_bssid);
+        else
                 err = rdev_connect(rdev, dev, connect);
-                if (err) {
-                        wdev->connect_keys = NULL;
-                        wdev->sme_state = CFG80211_SME_IDLE;
-                        return err;
-                }
 
-                memcpy(wdev->ssid, connect->ssid, connect->ssid_len);
-                wdev->ssid_len = connect->ssid_len;
-
-                return 0;
+        if (err) {
+                wdev->connect_keys = NULL;
+                wdev->ssid_len = 0;
+                return err;
         }
-}
 
-int cfg80211_connect(struct cfg80211_registered_device *rdev,
-                     struct net_device *dev,
-                     struct cfg80211_connect_params *connect,
-                     struct cfg80211_cached_keys *connkeys)
-{
-        int err;
-
-        mutex_lock(&rdev->devlist_mtx);
-        /* might request scan - scan_mtx -> wdev_mtx dependency */
-        mutex_lock(&rdev->sched_scan_mtx);
-        wdev_lock(dev->ieee80211_ptr);
-        err = __cfg80211_connect(rdev, dev, connect, connkeys, NULL);
-        wdev_unlock(dev->ieee80211_ptr);
-        mutex_unlock(&rdev->sched_scan_mtx);
-        mutex_unlock(&rdev->devlist_mtx);
-
-        return err;
+        return 0;
 }
 
-int __cfg80211_disconnect(struct cfg80211_registered_device *rdev,
-                          struct net_device *dev, u16 reason, bool wextev)
+int cfg80211_disconnect(struct cfg80211_registered_device *rdev,
+                        struct net_device *dev, u16 reason, bool wextev)
 {
         struct wireless_dev *wdev = dev->ieee80211_ptr;
-        int err;
+        int err = 0;
 
         ASSERT_WDEV_LOCK(wdev);
 
-        if (wdev->sme_state == CFG80211_SME_IDLE)
-                return -EINVAL;
-
         kfree(wdev->connect_keys);
         wdev->connect_keys = NULL;
 
-        if (!rdev->ops->disconnect) {
-                if (!rdev->ops->deauth)
-                        return -EOPNOTSUPP;
-
-                /* was it connected by userspace SME? */
-                if (!wdev->conn) {
-                        cfg80211_mlme_down(rdev, dev);
-                        goto disconnect;
-                }
-
-                if (wdev->sme_state == CFG80211_SME_CONNECTING &&
-                    (wdev->conn->state == CFG80211_CONN_SCANNING ||
-                     wdev->conn->state == CFG80211_CONN_SCAN_AGAIN)) {
-                        wdev->sme_state = CFG80211_SME_IDLE;
-                        kfree(wdev->conn->ie);
-                        kfree(wdev->conn);
-                        wdev->conn = NULL;
-                        wdev->ssid_len = 0;
-                        return 0;
-                }
-
-                /* wdev->conn->params.bssid must be set if > SCANNING */
-                err = __cfg80211_mlme_deauth(rdev, dev,
-                                             wdev->conn->params.bssid,
-                                             NULL, 0, reason, false);
-                if (err)
-                        return err;
-        } else {
+        if (wdev->conn)
+                err = cfg80211_sme_disconnect(wdev, reason);
+        else if (!rdev->ops->disconnect)
+                cfg80211_mlme_down(rdev, dev);
+        else if (wdev->current_bss)
                 err = rdev_disconnect(rdev, dev, reason);
-                if (err)
-                        return err;
-        }
-
- disconnect:
-        if (wdev->sme_state == CFG80211_SME_CONNECTED)
-                __cfg80211_disconnected(dev, NULL, 0, 0, false);
-        else if (wdev->sme_state == CFG80211_SME_CONNECTING)
-                __cfg80211_connect_result(dev, NULL, NULL, 0, NULL, 0,
-                                          WLAN_STATUS_UNSPECIFIED_FAILURE,
-                                          wextev, NULL);
-
-        return 0;
-}
-
-int cfg80211_disconnect(struct cfg80211_registered_device *rdev,
-                        struct net_device *dev,
-                        u16 reason, bool wextev)
-{
-        int err;
-
-        wdev_lock(dev->ieee80211_ptr);
-        err = __cfg80211_disconnect(rdev, dev, reason, wextev);
-        wdev_unlock(dev->ieee80211_ptr);
 
         return err;
 }
-
-void cfg80211_sme_disassoc(struct net_device *dev,
-                           struct cfg80211_internal_bss *bss)
-{
-        struct wireless_dev *wdev = dev->ieee80211_ptr;
-        struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
-        u8 bssid[ETH_ALEN];
-
-        ASSERT_WDEV_LOCK(wdev);
-
-        if (!wdev->conn)
-                return;
-
-        if (wdev->conn->state == CFG80211_CONN_IDLE)
-                return;
-
-        /*
-         * Ok, so the association was made by this SME -- we don't
-         * want it any more so deauthenticate too.
-         */
-
-        memcpy(bssid, bss->pub.bssid, ETH_ALEN);
-
-        __cfg80211_mlme_deauth(rdev, dev, bssid, NULL, 0,
-                               WLAN_REASON_DEAUTH_LEAVING, false);
-}
diff --git a/net/wireless/sysfs.c b/net/wireless/sysfs.c
index 8f28b9f798d8..9ee6bc1a7610 100644
--- a/net/wireless/sysfs.c
+++ b/net/wireless/sysfs.c
@@ -30,7 +30,8 @@ static ssize_t name ## _show(struct device *dev,			\
                               char *buf)                                \
 {                                                                       \
         return sprintf(buf, fmt "\n", dev_to_rdev(dev)->member);        \
-}
+}                                                                       \
+static DEVICE_ATTR_RO(name)
 
 SHOW_FMT(index, "%d", wiphy_idx);
 SHOW_FMT(macaddress, "%pM", wiphy.perm_addr);
@@ -42,7 +43,7 @@ static ssize_t name_show(struct device *dev,
         struct wiphy *wiphy = &dev_to_rdev(dev)->wiphy;
         return sprintf(buf, "%s\n", dev_name(&wiphy->dev));
 }
-
+static DEVICE_ATTR_RO(name);
 
 static ssize_t addresses_show(struct device *dev,
                               struct device_attribute *attr,
@@ -60,15 +61,17 @@ static ssize_t addresses_show(struct device *dev,
 
         return buf - start;
 }
-
-static struct device_attribute ieee80211_dev_attrs[] = {
-        __ATTR_RO(index),
-        __ATTR_RO(macaddress),
-        __ATTR_RO(address_mask),
-        __ATTR_RO(addresses),
-        __ATTR_RO(name),
-        {}
+static DEVICE_ATTR_RO(addresses);
+
+static struct attribute *ieee80211_attrs[] = {
+        &dev_attr_index.attr,
+        &dev_attr_macaddress.attr,
+        &dev_attr_address_mask.attr,
+        &dev_attr_addresses.attr,
+        &dev_attr_name.attr,
+        NULL,
 };
+ATTRIBUTE_GROUPS(ieee80211);
 
 static void wiphy_dev_release(struct device *dev)
 {
@@ -83,6 +86,7 @@ static int wiphy_uevent(struct device *dev, struct kobj_uevent_env *env)
         return 0;
 }
 
+#ifdef CONFIG_PM
 static void cfg80211_leave_all(struct cfg80211_registered_device *rdev)
 {
         struct wireless_dev *wdev;
@@ -100,10 +104,10 @@ static int wiphy_suspend(struct device *dev, pm_message_t state)
 
         rtnl_lock();
         if (rdev->wiphy.registered) {
-                if (!rdev->wowlan)
+                if (!rdev->wiphy.wowlan_config)
                         cfg80211_leave_all(rdev);
                 if (rdev->ops->suspend)
-                        ret = rdev_suspend(rdev, rdev->wowlan);
+                        ret = rdev_suspend(rdev, rdev->wiphy.wowlan_config);
                 if (ret == 1) {
                         /* Driver refuse to configure wowlan */
                         cfg80211_leave_all(rdev);
@@ -132,6 +136,7 @@ static int wiphy_resume(struct device *dev)
 
         return ret;
 }
+#endif
 
 static const void *wiphy_namespace(struct device *d)
 {
@@ -144,10 +149,12 @@ struct class ieee80211_class = {
         .name = "ieee80211",
         .owner = THIS_MODULE,
         .dev_release = wiphy_dev_release,
-        .dev_attrs = ieee80211_dev_attrs,
+        .dev_groups = ieee80211_groups,
         .dev_uevent = wiphy_uevent,
+#ifdef CONFIG_PM
         .suspend = wiphy_suspend,
         .resume = wiphy_resume,
+#endif
         .ns_type = &net_ns_type_operations,
         .namespace = wiphy_namespace,
 };
diff --git a/net/wireless/trace.h b/net/wireless/trace.h
index 5755bc14abbd..ba5f0d6614d5 100644
--- a/net/wireless/trace.h
+++ b/net/wireless/trace.h
@@ -1293,15 +1293,17 @@ TRACE_EVENT(rdev_return_int_int,
 
 #ifdef CONFIG_NL80211_TESTMODE
 TRACE_EVENT(rdev_testmode_cmd,
-        TP_PROTO(struct wiphy *wiphy),
-        TP_ARGS(wiphy),
+        TP_PROTO(struct wiphy *wiphy, struct wireless_dev *wdev),
+        TP_ARGS(wiphy, wdev),
         TP_STRUCT__entry(
                 WIPHY_ENTRY
+                WDEV_ENTRY
         ),
         TP_fast_assign(
                 WIPHY_ASSIGN;
+                WDEV_ASSIGN;
         ),
-        TP_printk(WIPHY_PR_FMT, WIPHY_PR_ARG)
+        TP_printk(WIPHY_PR_FMT WDEV_PR_FMT, WIPHY_PR_ARG, WDEV_PR_ARG)
 );
 
 TRACE_EVENT(rdev_testmode_dump,
@@ -1841,6 +1843,39 @@ TRACE_EVENT(rdev_crit_proto_stop,
                   WIPHY_PR_ARG, WDEV_PR_ARG)
 );
 
+TRACE_EVENT(rdev_channel_switch,
+        TP_PROTO(struct wiphy *wiphy, struct net_device *netdev,
+                 struct cfg80211_csa_settings *params),
+        TP_ARGS(wiphy, netdev, params),
+        TP_STRUCT__entry(
+                WIPHY_ENTRY
+                NETDEV_ENTRY
+                CHAN_DEF_ENTRY
+                __field(u16, counter_offset_beacon)
+                __field(u16, counter_offset_presp)
+                __field(bool, radar_required)
+                __field(bool, block_tx)
+                __field(u8, count)
+        ),
+        TP_fast_assign(
+                WIPHY_ASSIGN;
+                NETDEV_ASSIGN;
+                CHAN_DEF_ASSIGN(&params->chandef);
+                __entry->counter_offset_beacon = params->counter_offset_beacon;
+                __entry->counter_offset_presp = params->counter_offset_presp;
+                __entry->radar_required = params->radar_required;
+                __entry->block_tx = params->block_tx;
+                __entry->count = params->count;
+        ),
+        TP_printk(WIPHY_PR_FMT ", " NETDEV_PR_FMT ", " CHAN_DEF_PR_FMT
+                  ", block_tx: %d, count: %u, radar_required: %d"
+                  ", counter offsets (beacon/presp): %u/%u",
+                  WIPHY_PR_ARG, NETDEV_PR_ARG, CHAN_DEF_PR_ARG,
+                  __entry->block_tx, __entry->count, __entry->radar_required,
+                  __entry->counter_offset_beacon,
+                  __entry->counter_offset_presp)
+);
+
 /*************************************************************
  *           cfg80211 exported functions traces              *
  *************************************************************/
@@ -1911,24 +1946,46 @@ TRACE_EVENT(cfg80211_send_rx_assoc,
                   NETDEV_PR_ARG, MAC_PR_ARG(bssid), CHAN_PR_ARG)
 );
 
-DEFINE_EVENT(netdev_evt_only, __cfg80211_send_deauth,
-        TP_PROTO(struct net_device *netdev),
-        TP_ARGS(netdev)
+DECLARE_EVENT_CLASS(netdev_frame_event,
+        TP_PROTO(struct net_device *netdev, const u8 *buf, int len),
+        TP_ARGS(netdev, buf, len),
+        TP_STRUCT__entry(
+                NETDEV_ENTRY
+                __dynamic_array(u8, frame, len)
+        ),
+        TP_fast_assign(
+                NETDEV_ASSIGN;
+                memcpy(__get_dynamic_array(frame), buf, len);
+        ),
+        TP_printk(NETDEV_PR_FMT ", ftype:0x%.2x",
+                  NETDEV_PR_ARG,
+                  le16_to_cpup((__le16 *)__get_dynamic_array(frame)))
 );
 
-DEFINE_EVENT(netdev_evt_only, __cfg80211_send_disassoc,
-        TP_PROTO(struct net_device *netdev),
-        TP_ARGS(netdev)
+DEFINE_EVENT(netdev_frame_event, cfg80211_rx_unprot_mlme_mgmt,
+        TP_PROTO(struct net_device *netdev, const u8 *buf, int len),
+        TP_ARGS(netdev, buf, len)
 );
 
-DEFINE_EVENT(netdev_evt_only, cfg80211_send_unprot_deauth,
-        TP_PROTO(struct net_device *netdev),
-        TP_ARGS(netdev)
+DEFINE_EVENT(netdev_frame_event, cfg80211_rx_mlme_mgmt,
+        TP_PROTO(struct net_device *netdev, const u8 *buf, int len),
+        TP_ARGS(netdev, buf, len)
 );
 
-DEFINE_EVENT(netdev_evt_only, cfg80211_send_unprot_disassoc,
-        TP_PROTO(struct net_device *netdev),
-        TP_ARGS(netdev)
+TRACE_EVENT(cfg80211_tx_mlme_mgmt,
+        TP_PROTO(struct net_device *netdev, const u8 *buf, int len),
+        TP_ARGS(netdev, buf, len),
+        TP_STRUCT__entry(
+                NETDEV_ENTRY
+                __dynamic_array(u8, frame, len)
+        ),
+        TP_fast_assign(
+                NETDEV_ASSIGN;
+                memcpy(__get_dynamic_array(frame), buf, len);
+        ),
+        TP_printk(NETDEV_PR_FMT ", ftype:0x%.2x",
+                  NETDEV_PR_ARG,
+                  le16_to_cpup((__le16 *)__get_dynamic_array(frame)))
 );
 
 DECLARE_EVENT_CLASS(netdev_mac_evt,
@@ -2369,26 +2426,30 @@ TRACE_EVENT(cfg80211_get_bss,
                   __entry->capa_mask, __entry->capa_val)
 );
 
-TRACE_EVENT(cfg80211_inform_bss_frame,
+TRACE_EVENT(cfg80211_inform_bss_width_frame,
         TP_PROTO(struct wiphy *wiphy, struct ieee80211_channel *channel,
+                 enum nl80211_bss_scan_width scan_width,
                  struct ieee80211_mgmt *mgmt, size_t len,
                  s32 signal),
-        TP_ARGS(wiphy, channel, mgmt, len, signal),
+        TP_ARGS(wiphy, channel, scan_width, mgmt, len, signal),
         TP_STRUCT__entry(
                 WIPHY_ENTRY
                 CHAN_ENTRY
+                __field(enum nl80211_bss_scan_width, scan_width)
                 __dynamic_array(u8, mgmt, len)
                 __field(s32, signal)
         ),
         TP_fast_assign(
                 WIPHY_ASSIGN;
                 CHAN_ASSIGN(channel);
+                __entry->scan_width = scan_width;
                 if (mgmt)
                         memcpy(__get_dynamic_array(mgmt), mgmt, len);
                 __entry->signal = signal;
         ),
-        TP_printk(WIPHY_PR_FMT ", " CHAN_PR_FMT "signal: %d",
-                  WIPHY_PR_ARG, CHAN_PR_ARG, __entry->signal)
+        TP_printk(WIPHY_PR_FMT ", " CHAN_PR_FMT "(scan_width: %d) signal: %d",
+                  WIPHY_PR_ARG, CHAN_PR_ARG, __entry->scan_width,
+                  __entry->signal)
 );
 
 DECLARE_EVENT_CLASS(cfg80211_bss_evt,
diff --git a/net/wireless/util.c b/net/wireless/util.c
index f5ad4d94ba88..ce090c1c5e4f 100644
--- a/net/wireless/util.c
+++ b/net/wireless/util.c
@@ -33,6 +33,35 @@ ieee80211_get_response_rate(struct ieee80211_supported_band *sband,
 }
 EXPORT_SYMBOL(ieee80211_get_response_rate);
 
+u32 ieee80211_mandatory_rates(struct ieee80211_supported_band *sband,
+                              enum nl80211_bss_scan_width scan_width)
+{
+        struct ieee80211_rate *bitrates;
+        u32 mandatory_rates = 0;
+        enum ieee80211_rate_flags mandatory_flag;
+        int i;
+
+        if (WARN_ON(!sband))
+                return 1;
+
+        if (sband->band == IEEE80211_BAND_2GHZ) {
+                if (scan_width == NL80211_BSS_CHAN_WIDTH_5 ||
+                    scan_width == NL80211_BSS_CHAN_WIDTH_10)
+                        mandatory_flag = IEEE80211_RATE_MANDATORY_G;
+                else
+                        mandatory_flag = IEEE80211_RATE_MANDATORY_B;
+        } else {
+                mandatory_flag = IEEE80211_RATE_MANDATORY_A;
+        }
+
+        bitrates = sband->bitrates;
+        for (i = 0; i < sband->n_bitrates; i++)
+                if (bitrates[i].flags & mandatory_flag)
+                        mandatory_rates |= BIT(i);
+        return mandatory_rates;
+}
+EXPORT_SYMBOL(ieee80211_mandatory_rates);
+
 int ieee80211_channel_to_frequency(int chan, enum ieee80211_band band)
 {
         /* see 802.11 17.3.8.3.2 and Annex J
@@ -785,12 +814,8 @@ void cfg80211_process_rdev_events(struct cfg80211_registered_device *rdev)
         ASSERT_RTNL();
         ASSERT_RDEV_LOCK(rdev);
 
-        mutex_lock(&rdev->devlist_mtx);
-
         list_for_each_entry(wdev, &rdev->wdev_list, list)
                 cfg80211_process_wdev_events(wdev);
-
-        mutex_unlock(&rdev->devlist_mtx);
 }
 
 int cfg80211_change_iface(struct cfg80211_registered_device *rdev,
@@ -822,10 +847,8 @@ int cfg80211_change_iface(struct cfg80211_registered_device *rdev,
                 return -EBUSY;
 
         if (ntype != otype && netif_running(dev)) {
-                mutex_lock(&rdev->devlist_mtx);
                 err = cfg80211_can_change_interface(rdev, dev->ieee80211_ptr,
                                                     ntype);
-                mutex_unlock(&rdev->devlist_mtx);
                 if (err)
                         return err;
 
@@ -841,8 +864,10 @@ int cfg80211_change_iface(struct cfg80211_registered_device *rdev,
                         break;
                 case NL80211_IFTYPE_STATION:
                 case NL80211_IFTYPE_P2P_CLIENT:
+                        wdev_lock(dev->ieee80211_ptr);
                         cfg80211_disconnect(rdev, dev,
                                             WLAN_REASON_DEAUTH_LEAVING, true);
+                        wdev_unlock(dev->ieee80211_ptr);
                         break;
                 case NL80211_IFTYPE_MESH_POINT:
                         /* mesh should be handled? */
@@ -1169,6 +1194,9 @@ bool ieee80211_operating_class_to_band(u8 operating_class,
         case 84:
                 *band = IEEE80211_BAND_2GHZ;
                 return true;
+        case 180:
+                *band = IEEE80211_BAND_60GHZ;
+                return true;
         }
 
         return false;
@@ -1184,8 +1212,6 @@ int cfg80211_validate_beacon_int(struct cfg80211_registered_device *rdev,
         if (!beacon_int)
                 return -EINVAL;
 
-        mutex_lock(&rdev->devlist_mtx);
-
         list_for_each_entry(wdev, &rdev->wdev_list, list) {
                 if (!wdev->beacon_interval)
                         continue;
@@ -1195,8 +1221,6 @@ int cfg80211_validate_beacon_int(struct cfg80211_registered_device *rdev,
                 }
         }
 
-        mutex_unlock(&rdev->devlist_mtx);
-
         return res;
 }
 
@@ -1220,7 +1244,6 @@ int cfg80211_can_use_iftype_chan(struct cfg80211_registered_device *rdev,
         int i, j;
 
         ASSERT_RTNL();
-        lockdep_assert_held(&rdev->devlist_mtx);
 
         if (WARN_ON(hweight32(radar_detect) > 1))
                 return -EINVAL;
diff --git a/net/wireless/wext-compat.c b/net/wireless/wext-compat.c
index d997d0f0c54a..e7c6e862580d 100644
--- a/net/wireless/wext-compat.c
+++ b/net/wireless/wext-compat.c
@@ -72,7 +72,6 @@ int cfg80211_wext_siwmode(struct net_device *dev, struct iw_request_info *info,
         struct cfg80211_registered_device *rdev;
         struct vif_params vifparams;
         enum nl80211_iftype type;
-        int ret;
 
         rdev = wiphy_to_dev(wdev->wiphy);
 
@@ -98,11 +97,7 @@ int cfg80211_wext_siwmode(struct net_device *dev, struct iw_request_info *info,
 
         memset(&vifparams, 0, sizeof(vifparams));
 
-        cfg80211_lock_rdev(rdev);
-        ret = cfg80211_change_iface(rdev, dev, type, NULL, &vifparams);
-        cfg80211_unlock_rdev(rdev);
-
-        return ret;
+        return cfg80211_change_iface(rdev, dev, type, NULL, &vifparams);
 }
 EXPORT_SYMBOL_GPL(cfg80211_wext_siwmode);
 
@@ -579,13 +574,10 @@ static int cfg80211_set_encryption(struct cfg80211_registered_device *rdev,
 {
         int err;
 
-        /* devlist mutex needed for possible IBSS re-join */
-        mutex_lock(&rdev->devlist_mtx);
         wdev_lock(dev->ieee80211_ptr);
         err = __cfg80211_set_encryption(rdev, dev, pairwise, addr,
                                         remove, tx_key, idx, params);
         wdev_unlock(dev->ieee80211_ptr);
-        mutex_unlock(&rdev->devlist_mtx);
 
         return err;
 }
@@ -787,7 +779,7 @@ static int cfg80211_wext_siwfreq(struct net_device *dev,
         struct cfg80211_chan_def chandef = {
                 .width = NL80211_CHAN_WIDTH_20_NOHT,
         };
-        int freq, err;
+        int freq;
 
         switch (wdev->iftype) {
         case NL80211_IFTYPE_STATION:
@@ -804,10 +796,7 @@ static int cfg80211_wext_siwfreq(struct net_device *dev,
                 chandef.chan = ieee80211_get_channel(&rdev->wiphy, freq);
                 if (!chandef.chan)
                         return -EINVAL;
-                mutex_lock(&rdev->devlist_mtx);
-                err = cfg80211_set_monitor_channel(rdev, &chandef);
-                mutex_unlock(&rdev->devlist_mtx);
-                return err;
+                return cfg80211_set_monitor_channel(rdev, &chandef);
         case NL80211_IFTYPE_MESH_POINT:
                 freq = cfg80211_wext_freq(wdev->wiphy, wextfreq);
                 if (freq < 0)
@@ -818,10 +807,7 @@ static int cfg80211_wext_siwfreq(struct net_device *dev,
                 chandef.chan = ieee80211_get_channel(&rdev->wiphy, freq);
                 if (!chandef.chan)
                         return -EINVAL;
-                mutex_lock(&rdev->devlist_mtx);
-                err = cfg80211_set_mesh_channel(rdev, wdev, &chandef);
-                mutex_unlock(&rdev->devlist_mtx);
-                return err;
+                return cfg80211_set_mesh_channel(rdev, wdev, &chandef);
         default:
                 return -EOPNOTSUPP;
         }
diff --git a/net/wireless/wext-sme.c b/net/wireless/wext-sme.c
index e79cb5c0655a..14c9a2583ba0 100644
--- a/net/wireless/wext-sme.c
+++ b/net/wireless/wext-sme.c
@@ -54,8 +54,8 @@ int cfg80211_mgd_wext_connect(struct cfg80211_registered_device *rdev,
         if (wdev->wext.prev_bssid_valid)
                 prev_bssid = wdev->wext.prev_bssid;
 
-        err = __cfg80211_connect(rdev, wdev->netdev,
-                                 &wdev->wext.connect, ck, prev_bssid);
+        err = cfg80211_connect(rdev, wdev->netdev,
+                               &wdev->wext.connect, ck, prev_bssid);
         if (err)
                 kfree(ck);
 
@@ -87,12 +87,9 @@ int cfg80211_mgd_wext_siwfreq(struct net_device *dev,
                         return -EINVAL;
         }
 
-        cfg80211_lock_rdev(rdev);
-        mutex_lock(&rdev->devlist_mtx);
-        mutex_lock(&rdev->sched_scan_mtx);
         wdev_lock(wdev);
 
-        if (wdev->sme_state != CFG80211_SME_IDLE) {
+        if (wdev->conn) {
                 bool event = true;
 
                 if (wdev->wext.connect.channel == chan) {
@@ -103,8 +100,8 @@ int cfg80211_mgd_wext_siwfreq(struct net_device *dev,
                 /* if SSID set, we'll try right again, avoid event */
                 if (wdev->wext.connect.ssid_len)
                         event = false;
-                err = __cfg80211_disconnect(rdev, dev,
-                                            WLAN_REASON_DEAUTH_LEAVING, event);
+                err = cfg80211_disconnect(rdev, dev,
+                                          WLAN_REASON_DEAUTH_LEAVING, event);
                 if (err)
                         goto out;
         }
@@ -136,9 +133,6 @@ int cfg80211_mgd_wext_siwfreq(struct net_device *dev,
         err = cfg80211_mgd_wext_connect(rdev, wdev);
  out:
         wdev_unlock(wdev);
-        mutex_unlock(&rdev->sched_scan_mtx);
-        mutex_unlock(&rdev->devlist_mtx);
-        cfg80211_unlock_rdev(rdev);
         return err;
 }
 
@@ -190,14 +184,11 @@ int cfg80211_mgd_wext_siwessid(struct net_device *dev,
         if (len > 0 && ssid[len - 1] == '\0')
                 len--;
 
-        cfg80211_lock_rdev(rdev);
-        mutex_lock(&rdev->devlist_mtx);
-        mutex_lock(&rdev->sched_scan_mtx);
         wdev_lock(wdev);
 
         err = 0;
 
-        if (wdev->sme_state != CFG80211_SME_IDLE) {
+        if (wdev->conn) {
                 bool event = true;
 
                 if (wdev->wext.connect.ssid && len &&
@@ -208,8 +199,8 @@ int cfg80211_mgd_wext_siwessid(struct net_device *dev,
                 /* if SSID set now, we'll try to connect, avoid event */
                 if (len)
                         event = false;
-                err = __cfg80211_disconnect(rdev, dev,
-                                            WLAN_REASON_DEAUTH_LEAVING, event);
+                err = cfg80211_disconnect(rdev, dev,
+                                          WLAN_REASON_DEAUTH_LEAVING, event);
                 if (err)
                         goto out;
         }
@@ -226,9 +217,6 @@ int cfg80211_mgd_wext_siwessid(struct net_device *dev,
         err = cfg80211_mgd_wext_connect(rdev, wdev);
  out:
         wdev_unlock(wdev);
-        mutex_unlock(&rdev->sched_scan_mtx);
-        mutex_unlock(&rdev->devlist_mtx);
-        cfg80211_unlock_rdev(rdev);
         return err;
 }
 
@@ -287,12 +275,9 @@ int cfg80211_mgd_wext_siwap(struct net_device *dev,
         if (is_zero_ether_addr(bssid) || is_broadcast_ether_addr(bssid))
                 bssid = NULL;
 
-        cfg80211_lock_rdev(rdev);
-        mutex_lock(&rdev->devlist_mtx);
-        mutex_lock(&rdev->sched_scan_mtx);
         wdev_lock(wdev);
 
-        if (wdev->sme_state != CFG80211_SME_IDLE) {
+        if (wdev->conn) {
                 err = 0;
                 /* both automatic */
                 if (!bssid && !wdev->wext.connect.bssid)
@@ -303,8 +288,8 @@ int cfg80211_mgd_wext_siwap(struct net_device *dev,
                     ether_addr_equal(bssid, wdev->wext.connect.bssid))
                         goto out;
 
-                err = __cfg80211_disconnect(rdev, dev,
-                                            WLAN_REASON_DEAUTH_LEAVING, false);
+                err = cfg80211_disconnect(rdev, dev,
+                                          WLAN_REASON_DEAUTH_LEAVING, false);
                 if (err)
                         goto out;
         }
@@ -318,9 +303,6 @@ int cfg80211_mgd_wext_siwap(struct net_device *dev,
         err = cfg80211_mgd_wext_connect(rdev, wdev);
  out:
         wdev_unlock(wdev);
-        mutex_unlock(&rdev->sched_scan_mtx);
-        mutex_unlock(&rdev->devlist_mtx);
-        cfg80211_unlock_rdev(rdev);
         return err;
 }
 
@@ -382,9 +364,9 @@ int cfg80211_wext_siwgenie(struct net_device *dev,
         wdev->wext.ie = ie;
         wdev->wext.ie_len = ie_len;
 
-        if (wdev->sme_state != CFG80211_SME_IDLE) {
-                err = __cfg80211_disconnect(rdev, dev,
-                                            WLAN_REASON_DEAUTH_LEAVING, false);
+        if (wdev->conn) {
+                err = cfg80211_disconnect(rdev, dev,
+                                          WLAN_REASON_DEAUTH_LEAVING, false);
                 if (err)
                         goto out;
         }
@@ -420,8 +402,7 @@ int cfg80211_wext_siwmlme(struct net_device *dev,
         switch (mlme->cmd) {
         case IW_MLME_DEAUTH:
         case IW_MLME_DISASSOC:
-                err = __cfg80211_disconnect(rdev, dev, mlme->reason_code,
-                                            true);
+                err = cfg80211_disconnect(rdev, dev, mlme->reason_code, true);
                 break;
         default:
                 err = -EOPNOTSUPP;
diff --git a/net/x25/af_x25.c b/net/x25/af_x25.c
index 37ca9694aabe..45a3ab5612c1 100644
--- a/net/x25/af_x25.c
+++ b/net/x25/af_x25.c
@@ -224,7 +224,7 @@ static void x25_kill_by_device(struct net_device *dev)
 static int x25_device_event(struct notifier_block *this, unsigned long event,
                             void *ptr)
 {
-        struct net_device *dev = ptr;
+        struct net_device *dev = netdev_notifier_info_to_dev(ptr);
         struct x25_neigh *nb;
 
         if (!net_eq(dev_net(dev), &init_net))
@@ -1583,11 +1583,11 @@ out_cud_release:
         case SIOCX25CALLACCPTAPPRV: {
                 rc = -EINVAL;
                 lock_sock(sk);
-                if (sk->sk_state != TCP_CLOSE)
-                        break;
-                clear_bit(X25_ACCPT_APPRV_FLAG, &x25->flags);
+                if (sk->sk_state == TCP_CLOSE) {
+                        clear_bit(X25_ACCPT_APPRV_FLAG, &x25->flags);
+                        rc = 0;
+                }
                 release_sock(sk);
-                rc = 0;
                 break;
         }
 
@@ -1595,14 +1595,15 @@ out_cud_release:
                 rc = -EINVAL;
                 lock_sock(sk);
                 if (sk->sk_state != TCP_ESTABLISHED)
-                        break;
+                        goto out_sendcallaccpt_release;
                 /* must call accptapprv above */
                 if (test_bit(X25_ACCPT_APPRV_FLAG, &x25->flags))
-                        break;
+                        goto out_sendcallaccpt_release;
                 x25_write_internal(sk, X25_CALL_ACCEPTED);
                 x25->state = X25_STATE_3;
-                release_sock(sk);
                 rc = 0;
+out_sendcallaccpt_release:
+                release_sock(sk);
                 break;
         }
 
diff --git a/net/x25/x25_facilities.c b/net/x25/x25_facilities.c
index 66c638730c7a..b8253250d723 100644
--- a/net/x25/x25_facilities.c
+++ b/net/x25/x25_facilities.c
@@ -156,6 +156,8 @@ int x25_parse_facilities(struct sk_buff *skb, struct x25_facilities *facilities,
                         case X25_FAC_CALLING_AE:
                                 if (p[1] > X25_MAX_DTE_FACIL_LEN || p[1] <= 1)
                                         return -1;
+                                if (p[2] > X25_MAX_AE_LEN)
+                                        return -1;
                                 dte_facs->calling_len = p[2];
                                 memcpy(dte_facs->calling_ae, &p[3], p[1] - 1);
                                 *vc_fac_mask |= X25_MASK_CALLING_AE;
@@ -163,6 +165,8 @@ int x25_parse_facilities(struct sk_buff *skb, struct x25_facilities *facilities,
                         case X25_FAC_CALLED_AE:
                                 if (p[1] > X25_MAX_DTE_FACIL_LEN || p[1] <= 1)
                                         return -1;
+                                if (p[2] > X25_MAX_AE_LEN)
+                                        return -1;
                                 dte_facs->called_len = p[2];
                                 memcpy(dte_facs->called_ae, &p[3], p[1] - 1);
                                 *vc_fac_mask |= X25_MASK_CALLED_AE;
diff --git a/net/xfrm/xfrm_input.c b/net/xfrm/xfrm_input.c
index ab2bb42fe094..88843996f935 100644
--- a/net/xfrm/xfrm_input.c
+++ b/net/xfrm/xfrm_input.c
@@ -163,6 +163,11 @@ int xfrm_input(struct sk_buff *skb, int nexthdr, __be32 spi, int encap_type)
                 skb->sp->xvec[skb->sp->len++] = x;
 
                 spin_lock(&x->lock);
+                if (unlikely(x->km.state == XFRM_STATE_ACQ)) {
+                        XFRM_INC_STATS(net, LINUX_MIB_XFRMACQUIREERROR);
+                        goto drop_unlock;
+                }
+
                 if (unlikely(x->km.state != XFRM_STATE_VALID)) {
                         XFRM_INC_STATS(net, LINUX_MIB_XFRMINSTATEINVALID);
                         goto drop_unlock;
diff --git a/net/xfrm/xfrm_output.c b/net/xfrm/xfrm_output.c
index 0cf003dfa8fc..3bb2cdc13b46 100644
--- a/net/xfrm/xfrm_output.c
+++ b/net/xfrm/xfrm_output.c
@@ -89,7 +89,7 @@ static int xfrm_output_one(struct sk_buff *skb, int err)
 
                 err = x->type->output(x, skb);
                 if (err == -EINPROGRESS)
-                        goto out_exit;
+                        goto out;
 
 resume:
                 if (err) {
@@ -107,15 +107,14 @@ resume:
                 x = dst->xfrm;
         } while (x && !(x->outer_mode->flags & XFRM_MODE_FLAG_TUNNEL));
 
-        err = 0;
+        return 0;
 
-out_exit:
-        return err;
 error:
         spin_unlock_bh(&x->lock);
 error_nolock:
         kfree_skb(skb);
-        goto out_exit;
+out:
+        return err;
 }
 
 int xfrm_output_resume(struct sk_buff *skb, int err)
@@ -215,5 +214,26 @@ int xfrm_inner_extract_output(struct xfrm_state *x, struct sk_buff *skb)
         return inner_mode->afinfo->extract_output(x, skb);
 }
 
+void xfrm_local_error(struct sk_buff *skb, int mtu)
+{
+        unsigned int proto;
+        struct xfrm_state_afinfo *afinfo;
+
+        if (skb->protocol == htons(ETH_P_IP))
+                proto = AF_INET;
+        else if (skb->protocol == htons(ETH_P_IPV6))
+                proto = AF_INET6;
+        else
+                return;
+
+        afinfo = xfrm_state_get_afinfo(proto);
+        if (!afinfo)
+                return;
+
+        afinfo->local_error(skb, mtu);
+        xfrm_state_put_afinfo(afinfo);
+}
+
 EXPORT_SYMBOL_GPL(xfrm_output);
 EXPORT_SYMBOL_GPL(xfrm_inner_extract_output);
+EXPORT_SYMBOL_GPL(xfrm_local_error);
diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c
index ea970b8002a2..ed38d5d81f9e 100644
--- a/net/xfrm/xfrm_policy.c
+++ b/net/xfrm/xfrm_policy.c
@@ -308,7 +308,7 @@ void xfrm_policy_destroy(struct xfrm_policy *policy)
 {
         BUG_ON(!policy->walk.dead);
 
-        if (del_timer(&policy->timer))
+        if (del_timer(&policy->timer) || del_timer(&policy->polq.hold_timer))
                 BUG();
 
         security_xfrm_policy_free(policy->security);
@@ -320,10 +320,8 @@ static void xfrm_queue_purge(struct sk_buff_head *list)
 {
         struct sk_buff *skb;
 
-        while ((skb = skb_dequeue(list)) != NULL) {
-                dev_put(skb->dev);
+        while ((skb = skb_dequeue(list)) != NULL)
                 kfree_skb(skb);
-        }
 }
 
 /* Rule must be locked. Release descentant resources, announce
@@ -660,7 +658,13 @@ int xfrm_policy_insert(int dir, struct xfrm_policy *policy, int excl)
         xfrm_pol_hold(policy);
         net->xfrm.policy_count[dir]++;
         atomic_inc(&flow_cache_genid);
-        rt_genid_bump(net);
+
+        /* After previous checking, family can either be AF_INET or AF_INET6 */
+        if (policy->family == AF_INET)
+                rt_genid_bump_ipv4(net);
+        else
+                rt_genid_bump_ipv6(net);
+
         if (delpol) {
                 xfrm_policy_requeue(delpol, policy);
                 __xfrm_policy_unlink(delpol, dir);
@@ -1758,7 +1762,6 @@ static void xfrm_policy_queue_process(unsigned long arg)
         struct sk_buff *skb;
         struct sock *sk;
         struct dst_entry *dst;
-        struct net_device *dev;
         struct xfrm_policy *pol = (struct xfrm_policy *)arg;
         struct xfrm_policy_queue *pq = &pol->polq;
         struct flowi fl;
@@ -1805,7 +1808,6 @@ static void xfrm_policy_queue_process(unsigned long arg)
                 dst = xfrm_lookup(xp_net(pol), skb_dst(skb)->path,
                                   &fl, skb->sk, 0);
                 if (IS_ERR(dst)) {
-                        dev_put(skb->dev);
                         kfree_skb(skb);
                         continue;
                 }
@@ -1814,9 +1816,7 @@ static void xfrm_policy_queue_process(unsigned long arg)
                 skb_dst_drop(skb);
                 skb_dst_set(skb, dst);
 
-                dev = skb->dev;
                 err = dst_output(skb);
-                dev_put(dev);
         }
 
         return;
@@ -1839,7 +1839,6 @@ static int xdst_queue_output(struct sk_buff *skb)
         }
 
         skb_dst_force(skb);
-        dev_hold(skb->dev);
 
         spin_lock_bh(&pq->hold_queue.lock);
 
@@ -2126,8 +2125,6 @@ restart:
                  * have the xfrm_state's. We need to wait for KM to
                  * negotiate new SA's or bail out with error.*/
                 if (net->xfrm.sysctl_larval_drop) {
-                        /* EREMOTE tells the caller to generate
-                         * a one-shot blackhole route. */
                         dst_release(dst);
                         xfrm_pols_put(pols, drop_pols);
                         XFRM_INC_STATS(net, LINUX_MIB_XFRMOUTNOSTATES);
@@ -2785,7 +2782,7 @@ static void __net_init xfrm_dst_ops_init(struct net *net)
 
 static int xfrm_dev_event(struct notifier_block *this, unsigned long event, void *ptr)
 {
-        struct net_device *dev = ptr;
+        struct net_device *dev = netdev_notifier_info_to_dev(ptr);
 
         switch (event) {
         case NETDEV_DOWN:
diff --git a/net/xfrm/xfrm_proc.c b/net/xfrm/xfrm_proc.c
index c721b0d9ab8b..80cd1e55b834 100644
--- a/net/xfrm/xfrm_proc.c
+++ b/net/xfrm/xfrm_proc.c
@@ -44,6 +44,7 @@ static const struct snmp_mib xfrm_mib_list[] = {
         SNMP_MIB_ITEM("XfrmOutPolError", LINUX_MIB_XFRMOUTPOLERROR),
         SNMP_MIB_ITEM("XfrmFwdHdrError", LINUX_MIB_XFRMFWDHDRERROR),
         SNMP_MIB_ITEM("XfrmOutStateInvalid", LINUX_MIB_XFRMOUTSTATEINVALID),
+        SNMP_MIB_ITEM("XfrmAcquireError", LINUX_MIB_XFRMACQUIREERROR),
         SNMP_MIB_SENTINEL
 };
 
diff --git a/net/xfrm/xfrm_state.c b/net/xfrm/xfrm_state.c
index 78f66fa92449..b9c3f9e943a9 100644
--- a/net/xfrm/xfrm_state.c
+++ b/net/xfrm/xfrm_state.c
@@ -39,9 +39,6 @@ static DEFINE_SPINLOCK(xfrm_state_lock);
 
 static unsigned int xfrm_state_hashmax __read_mostly = 1 * 1024 * 1024;
 
-static struct xfrm_state_afinfo *xfrm_state_get_afinfo(unsigned int family);
-static void xfrm_state_put_afinfo(struct xfrm_state_afinfo *afinfo);
-
 static inline unsigned int xfrm_dst_hash(struct net *net,
                                          const xfrm_address_t *daddr,
                                          const xfrm_address_t *saddr,
@@ -499,7 +496,8 @@ struct xfrm_state *xfrm_state_alloc(struct net *net)
                 INIT_HLIST_NODE(&x->bydst);
                 INIT_HLIST_NODE(&x->bysrc);
                 INIT_HLIST_NODE(&x->byspi);
-                tasklet_hrtimer_init(&x->mtimer, xfrm_timer_handler, CLOCK_REALTIME, HRTIMER_MODE_ABS);
+                tasklet_hrtimer_init(&x->mtimer, xfrm_timer_handler,
+                                        CLOCK_BOOTTIME, HRTIMER_MODE_ABS);
                 setup_timer(&x->rtimer, xfrm_replay_timer_handler,
                                 (unsigned long)x);
                 x->curlft.add_time = get_seconds();
@@ -990,11 +988,13 @@ void xfrm_state_insert(struct xfrm_state *x)
 EXPORT_SYMBOL(xfrm_state_insert);
 
 /* xfrm_state_lock is held */
-static struct xfrm_state *__find_acq_core(struct net *net, struct xfrm_mark *m,
+static struct xfrm_state *__find_acq_core(struct net *net,
+                                          const struct xfrm_mark *m,
                                           unsigned short family, u8 mode,
                                           u32 reqid, u8 proto,
                                           const xfrm_address_t *daddr,
-                                          const xfrm_address_t *saddr, int create)
+                                          const xfrm_address_t *saddr,
+                                          int create)
 {
         unsigned int h = xfrm_dst_hash(net, daddr, saddr, reqid, family);
         struct xfrm_state *x;
@@ -1399,9 +1399,9 @@ xfrm_state_lookup_byaddr(struct net *net, u32 mark,
 EXPORT_SYMBOL(xfrm_state_lookup_byaddr);
 
 struct xfrm_state *
-xfrm_find_acq(struct net *net, struct xfrm_mark *mark, u8 mode, u32 reqid, u8 proto,
-              const xfrm_address_t *daddr, const xfrm_address_t *saddr,
-              int create, unsigned short family)
+xfrm_find_acq(struct net *net, const struct xfrm_mark *mark, u8 mode, u32 reqid,
+              u8 proto, const xfrm_address_t *daddr,
+              const xfrm_address_t *saddr, int create, unsigned short family)
 {
         struct xfrm_state *x;
 
@@ -1860,7 +1860,7 @@ int xfrm_state_unregister_afinfo(struct xfrm_state_afinfo *afinfo)
 }
 EXPORT_SYMBOL(xfrm_state_unregister_afinfo);
 
-static struct xfrm_state_afinfo *xfrm_state_get_afinfo(unsigned int family)
+struct xfrm_state_afinfo *xfrm_state_get_afinfo(unsigned int family)
 {
         struct xfrm_state_afinfo *afinfo;
         if (unlikely(family >= NPROTO))
@@ -1872,7 +1872,7 @@ static struct xfrm_state_afinfo *xfrm_state_get_afinfo(unsigned int family)
         return afinfo;
 }
 
-static void xfrm_state_put_afinfo(struct xfrm_state_afinfo *afinfo)
+void xfrm_state_put_afinfo(struct xfrm_state_afinfo *afinfo)
 {
         rcu_read_unlock();
 }